Photo by Jakob Boman on Unsplash

Full-spectrum security scanner

Deep Dive

Article from ADMIN 89/2025

By Marcin Gastol

We take a close look at the Trivy scanners for vulnerabilities, misconfigurations, and secrets with Ubuntu-centric guidance on performance tuning, security configurations, and scalability across Linux distributions.

Trivy is an open source, all-in-one security scanner by Aqua Security that has rapidly become a go-to tool in the DevSecOps toolkit [1]. It earned this reputation by combining multiple security checks such as vulnerability scanning, configuration auditing, and secret detection into a single easy-to-use command-line interface.

With a single binary and minimal setup, Trivy can be run on virtually any Linux distribution and integrated into continuous integration and continuous delivery (CI/CD) pipelines or cloud environments without friction. Its popularity is evident from a vibrant community (tens of thousands of GitHub stars) [2] and its adoption as the default scanner in platforms such as Harbor (the Cloud Native Computing Foundation (CNCF) image registry).

In an era of rising software supply chain threats, Trivy's approach addresses the need for continuous security checks at every stage of development and deployment. I walk you through Trivy's capabilities, how it works under the hood, and how to configure and optimize it on Linux for performance, security, and scale.

Main Capabilities

One reason Trivy is so valued is its breadth of coverage. It can scan container images (both local images and those in registries), the filesystems of running systems or virtual machines (VMs), remote code repositories, infrastructure-as-code (IaC) manifests, and even live Kubernetes clusters. In practice, this means a single tool can examine everything from your base operating system packages and application libraries to Dockerfiles, Terraform templates, and Kubernetes YAMLs, searching for any signs of security issues.

Trivy's primary function is to detect common vulnerabilities and exposures (CVEs) in software components. When pointed at a container image or a filesystem, it identifies

...

Use Express-Checkout link below to read the full article (PDF).