trivy image

trivy image <image>:<tag> --severity CRITICAL,HIGH

Scans the container image with Trivy, detecting OS and dependency CVEs with severity.

Run it in the CI/CD pipeline (and in the image registry) when you want image analysis: Trivy scans the image (OS and application dependencies) and reports findings — CVEs with severity (--severity for the gate) and the fix (updated package version). It's the reference image scanner: fast, daemonless, and with a broad vulnerability database. In container DevSecOps, Trivy is the pipeline piece: builds with high-severity findings are blocked before push to the registry.

Don't use it as a complete image analysis: Trivy covers CVEs (OS and dependencies) — image configuration (users, privileges) is covered by linters (dockle, 033) and IaC by Checkov. Trivy's vulnerability database updates (trivy image with up-to-date DB): new CVEs require the update. And note: findings are triaged (dependencies not exploitable in context); --severity filters the noise. For SBOM, use syft (031); Trivy is the CVE scanner.