252  trivy(1) - Kailash Tool Reference

252.1 trivy

trivy - Aqua Trivy — all-in-one vulnerability/secret/misconfiguration/SBOM scanner.

Layer DEFENCE
Category d-04-provenance-signing-trust
Safety class safe
Licence Apache-2.0
Upstream github.com/aquasecurity/trivy

252.1.1 NAME

trivy - Aqua Trivy — all-in-one vulnerability/secret/misconfiguration/SBOM scanner.

252.1.2 SYNOPSIS & usage

Derived from the upstream README at generation time; verify against --help where the tool is installed.

trivy <target> [--scanners <scanner1,scanner2>] <subject>
trivy image python:3.4-alpine

252.1.3 DESCRIPTION (upstream)

[📖 Documentation][docs] Trivy ([pronunciation][pronunciation]) is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues. Targets (what Trivy can scan): - Container Image - Filesystem - Git Repository (remote) - Virtual Machine Image - Kubernetes Scanners (what Trivy can find there): - OS packages and software dependencies in use (SBOM) - Known vulnerabilities (CVEs) - IaC issues and misconfigurations - Sensitive information and secrets - Software licenses Trivy supports most popular programming languages, operating systems, and platforms. For a complete list, see the [Scanning Coverage] page. To learn

252.1.4 CONFIGURATION (detected)

Config-surface markers detected in the upstream README (3 matches, e.g. canary.yaml, test.yaml). A full config reference page for this tool is queued under the config-page policy — this line is the detection record, not the page.

252.1.5 SEE ALSO

ref: pin - verified 2026-10-14