Using Trivy to Check for Vulnerabilities in Docker Images

Author :

Akash Gupta | Sr. VoIP Engineer | MLOps

Introduction: In the world of containerisation, security is paramount. Ensuring the images you deploy are free from vulnerabilities is crucial. Trivy, an open-source tool by Aqua Security, is a simple and comprehensive vulnerability scanner for containers and other artifacts. In this post, we’ll walk through the process of using Trivy to scan a Docker image for common vulnerabilities and exposures (CVEs).

Step-by-Step Guide:

Step 1: Install Trivy First, you need to install Trivy. On your macOS the easiest way is to use Homebrew, a package manager for macOS. Open your terminal and enter the following command:

brew install aquasecurity/trivy/trivy

For Linux system, follow the steps below:

sudo apt-get update
sudo apt-get install -y wget apt-transport-https gnupg lsb-release
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt-get update
sudo apt-get install trivy

Step 2: Pull the Docker Image Before scanning, you need the Docker image locally. If you haven’t already, you can pull the image with Docker.
I am using homer heplify-server as an example here:

docker pull sipcapture/heplify-server:latest

Step 3: Scan the Image with Trivy With Trivy installed and the image pulled, you can now proceed to scan the image. Run Trivy with the image name:

trivy image sipcapture/heplify-server:latest

What Happens Next? Trivy will download the latest vulnerability database and then scan the sipcapture/heplify-server:latest image. The output will list any known vulnerabilities found within the image, categorised by severity as shown below:

Conclusion: Trivy is an essential tool for maintaining the security of your Docker containers. Regularly scanning your images helps identify and address vulnerabilities before they can be exploited in production. By integrating Trivy into your CI/CD pipeline, you can automate the scanning process and ensure that every image is checked for vulnerabilities before deployment.

Remember, staying ahead of security risks is an ongoing process. With tools like Trivy, you’re better equipped to manage these risks and keep your containerized applications secure.

Join 753 other subscribers

Akash Gupta
Senior VoIP Engineer and AI Enthusiast

AI and VoIP Blog

Thank you for visiting the Blog. Hit the subscribe button to receive the next post right in your inbox. If you find this article helpful don’t forget to share your feedback in the comments and hit the like button. This will helps in knowing what topics resonate with you, allowing me to create more that keeps you informed.

Thank you for reading, and stay tuned for more insights and guides!

AI and VoIP Blog