Using Trivy for Container Image Vulnerability Scanning in DevOps

In this guide, we'll walk you through the process of using Trivy, an open-source vulnerability scanner, to identify vulnerabilities in container images as part of your DevOps practices. We'll focus on integrating Trivy with Docker, a popular DevOps tool, and provide step-by-step instructions for installation, scanning images, interpreting reports, and taking necessary actions based on the vulnerability findings. By following these steps, you can enhance the security of your applications and ensure that your containerized environments are well-protected against potential threats.

Here's how you can use Trivy with Docker, one of the popular DevOps tools, in a step-by-step process:

Step 1: Install Docker

Make sure you have Docker installed on your system. You can download and install Docker from the official Docker website: https://www.docker.com/get-started

• sudo amazon-linux-extras install docker -y
• sudo service docker start
• sudo usermod -a -G docker ec2-user

Step 2: Install Trivy

Trivy can be installed using various methods, such as using package managers or downloading the binary directly. Below is a common method using the official GitHub repository:

Open a terminal.

Download the Trivy binary for your platform from the releases page: https://github.com/aquasecurity/trivy/releases

 1.Download the latest Trivy tar file (v0.44.1) from the GitHub releases page:

• wget https://github.com/aquasecurity/trivy/releases/download/v0.44.1/trivy_0.44.1_Linux-64bit.tar.gz

2.Extract the tar file:

• tar xzf trivy_0.44.1_Linux-64bit.tar.gz

3.Make the binary executable:

• chmod +x trivy

4. Move the Trivy binary to a directory in your PATH, such as /usr/local/bin:

• sudo mv trivy /usr/local/bin/

5.Verify that Trivy is installed by checking its version:

• trivy --version

You should see the version information for Trivy displayed on the screen.

Step 3: Scan a Docker Image with Trivy

Assuming you have a Docker image you want to scan:

Open a terminal.

Run Trivy to scan a Docker image:

• trivy image <image_name>

Replace <image_name> with the name of the Docker image you want to scan, such as ubuntu:latest.

Trivy will start scanning the image for vulnerabilities and provide you with a report that lists any vulnerabilities found along with their severity levels and additional information.

Step 4: Interpret the Trivy Report

Trivy's report will give you information about vulnerabilities found in the image. Each vulnerability is assigned a severity level, which can be Critical, High, Medium, Low, or Unknown. The report will also include CVE (Common Vulnerabilities and Exposures) IDs, package names, affected versions, and more.

Step 5: Take Action

Based on the severity of the vulnerabilities detected, you can take appropriate actions. This might involve updating packages, changing configurations, or selecting alternative base images with fewer vulnerabilities.

Remember that Trivy is a tool to assist you in identifying vulnerabilities. Regularly scanning your images and addressing vulnerabilities is an important aspect of maintaining security in your DevOps pipeline.

Please note that the steps provided here are meant for a basic usage example. In a real-world scenario, you might want to integrate Trivy into your CI/CD pipeline to automatically scan images and take appropriate actions based on the scan results.

Thank you

M. Nishitha,

DevOps Engineer.