Trivy for Regulated Enterprises: Container & Infrastructure Security Scanning

Container Images

• OS vulnerabilities: CVEs in base image packages (Alpine, Debian, Ubuntu, RHEL, etc.)
• Application dependencies: Vulnerabilities in npm, pip, Maven, Go, Rust, Ruby packages
• Licence detection: Identify licences of all dependencies (compliance for licence policies)
• Secret scanning: Detect hardcoded credentials, API keys, and tokens in image layers
• SBOM generation: Output CycloneDX or SPDX format SBOMs — CRA compliance requirement

Infrastructure as Code

• Terraform: Misconfiguration detection (public S3 buckets, open security groups, unencrypted resources)
• Kubernetes manifests: Security misconfigurations (privileged pods, missing resource limits, no network policies)
• Helm charts: Scan rendered Helm templates for security issues
• Dockerfile: Best practice violations (running as root, using latest tag, exposing unnecessary ports)
• CloudFormation, ARM templates: Cloud-specific misconfiguration checks

Kubernetes Clusters (Trivy Operator)

• Continuous scanning: Trivy Operator runs inside Kubernetes, continuously scanning all running workloads
• VulnerabilityReport CRDs: Vulnerability results stored as Kubernetes resources — queryable via kubectl
• ExposedSecretReport: Detected secrets in running containers
• ConfigAuditReport: Kubernetes-specific misconfigurations for every resource
• RBAC assessment: Identify overly permissive RBAC roles and bindings

Shift-left security scanning in your pipeline:

• GitHub Actions: Official Trivy action scans on every PR — block merges with critical vulnerabilities
• GitLab CI: Native integration with GitLab's security dashboard
• Jenkins: Trivy CLI integration in pipeline stages
• SARIF output: Upload results to GitHub Security tab for centralised visibility
• Policy gates: Fail builds based on severity thresholds (e.g., block on critical/high, warn on medium)

The Cyber Resilience Act requires Software Bills of Materials for products with digital elements. Trivy generates SBOMs in both standard formats:

• CycloneDX: OWASP standard, widely adopted, includes vulnerability correlation
• SPDX: Linux Foundation standard, strong licence compliance focus

Integration pattern: Generate SBOM at build time, attach as image attestation (cosign), verify at deployment time with Kyverno or OPA Gatekeeper. This creates an end-to-end supply chain security pipeline that satisfies CRA Article 13 requirements.