Documentation menu

📎 Unreleased docs. This is the next version (from main), features here may change or not be in a release yet.See the latest release →

Scanners

trivy

On this page
  • Control: images
  • Tool: Aqua Trivy, https://trivy.dev
  • Status: ✅ implemented
  • Target: container image (ImageTarget)
  • License / terms: Trivy is Apache-2.0 (permissive). Run via exec (no bundling required). Trivy's vulnerability database has its own distribution terms + pull rate limits, review before caching/redistributing.

What it does

Runs trivy image --quiet --format json <ref> to find known vulnerabilities in a container image's OS packages and bundled libraries, and converts the result to SARIF. Trivy's JSON names the package, the image and its operating system as fields, where its SARIF names the package only in prose.

Saga options

config:
  controls:
    images:
      trivy:
        pkgTypes: [library]                          # skip the OS layer
        dbRepository: [registry.internal/trivy-db:2] # an internal mirror
OptionWhat it does
pkgTypesWhich package types to analyze: os, library, or both (--pkg-types). Narrow it when the OS layer is a platform team's responsibility.
dbRepositoryOCI repositories to pull the vulnerability database from, in priority order (--db-repository). For runners with no route to a public registry.

The same two options apply to the trivy image scanner and the trivy-fs filesystem scanner. Trivy's --severity and --ignorefile are deliberately absent: both drop findings inside the tool, where a suppression cannot be recorded or reviewed. Use config.exclude instead.

Notes

  • Integration mode: exec (separate process); Trivy must be on PATH.
  • Trivy pulls the image itself, no local checkout needed.

Data

The vulnerability database, from mirror.gcr.io and ghcr.io, which are Trivy's own defaults in that order. Draugr warms it once before the jobs fan out, and passes --skip-db-update when --offline is set so an offline run reads the local copy rather than reaching out once per job.

Every run passes --offline-scan, so no Trivy run resolves a pom.xml against a remote Maven repository.

Every run, and the database warm, passes --skip-version-check and --disable-telemetry, so Trivy makes no version-check or telemetry request to check.trivy.dev. A Trivy older than 0.63.0 has neither flag and makes no such request.

config.controls.images.trivy.dbRepository replaces both with an internal mirror.