Trivy Cheat Sheet 2026: Security Scanning Commands

A quick reference for Trivy — the all-in-one security scanner. Bookmark this page.

Container Image Scanning

# Scan a container image
trivy image nginx:latest
trivy image --severity HIGH,CRITICAL nginx:latest

# Scan local image (not pulled from registry)
trivy image --input myapp.tar

# Scan with specific format
trivy image -f json -o results.json nginx:latest
trivy image -f table nginx:latest
trivy image -f sarif -o results.sarif nginx:latest

# Ignore unfixed vulnerabilities
trivy image --ignore-unfixed nginx:latest

# Skip specific vulnerability
trivy image --skip-dirs /usr/local/lib nginx:latest

Filesystem and Repository Scanning

# Scan current directory
trivy fs .
trivy fs --severity HIGH,CRITICAL .

# Scan specific path
trivy fs /path/to/project

# Scan Git repository
trivy repo https://github.com/org/myapp
trivy repo --branch develop https://github.com/org/myapp

Kubernetes Scanning

# Scan running cluster
trivy k8s --report summary cluster

# Scan specific namespace
trivy k8s -n production --report all

# Scan specific resource
trivy k8s deployment/my-app

# Generate compliance report
trivy k8s --compliance k8s-nsa --report summary
trivy k8s --compliance k8s-cis --report all

Configuration and IaC Scanning

# Scan Terraform files
trivy config .
trivy config --tf-vars terraform.tfvars .

# Scan Kubernetes manifests
trivy config -f json k8s-manifests/

# Scan Dockerfiles
trivy config Dockerfile

# Scan Helm charts
trivy config mychart/

SBOM (Software Bill of Materials)

# Generate SBOM
trivy image --format spdx-json -o sbom.json nginx:latest
trivy image --format cyclonedx -o sbom.xml nginx:latest

# Scan from SBOM
trivy sbom sbom.json

CI/CD Integration

# Exit with error code on findings (for CI)
trivy image --exit-code 1 --severity CRITICAL nginx:latest

# Cache for faster scans
trivy image --cache-dir /tmp/trivy-cache nginx:latest

# Skip DB update (if pre-cached)
trivy image --skip-db-update nginx:latest

# Use in GitHub Actions
# - name: Trivy scan
#   uses: aquasecurity/trivy-action@master
#   with:
#     image-ref: myapp:latest
#     severity: HIGH,CRITICAL
#     exit-code: 1

Configuration File

# trivy.yaml
severity:
  - HIGH
  - CRITICAL
ignore-unfixed: true
format: table
exit-code: 1
skip-dirs:
  - node_modules
  - .git
  - vendor

Tips and Tricks

• Use --ignore-unfixed in CI to avoid noise from unpatched upstream vulnerabilities
• Use .trivyignore file to suppress known false positives
• Use trivy server mode for centralized scanning in large teams
• Combine image + config scanning for full supply chain coverage
• Update the vulnerability DB regularly: trivy image --download-db-only

Related Resources

• Container Security Scanning Tutorial
• Buildah Cheat Sheet
• Podman Cheat Sheet