How to run vulnerability scanning with Trivy across containers and hosts

You cannot patch what you do not know is vulnerable. Trivy is an open-source scanner that finds known CVEs and misconfigurations in container images, host filesystems, and code repositories. This walkthrough installs Trivy, scans a container image and a host, filters results to what is actionable, and shows how to fail a CI build on critical findings.

Prerequisites

A Linux host with internet access (Trivy downloads its vulnerability database).
Optionally, Docker, if you want to scan running images.

Step 1: install Trivy

sudo apt-get install -y wget gnupg
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | \
  sudo gpg --dearmor -o /usr/share/keyrings/trivy.gpg
echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | \
  sudo tee /etc/apt/sources.list.d/trivy.list
sudo apt-get update
sudo apt-get install -y trivy

Step 2: scan a container image

trivy image nginx:1.27

The first run downloads the database, then prints a table of CVEs by severity. Narrow it to what you would actually act on, and drop CVEs that have no fix available yet:

trivy image --severity HIGH,CRITICAL --ignore-unfixed nginx:1.27

Step 3: scan the host filesystem

Trivy scans installed OS packages and language dependencies on a running host:

sudo trivy fs --scanners vuln /

For a code repository, add misconfiguration and secret scanning:

trivy fs --scanners vuln,misconfig,secret /path/to/your/repo

That single command flags vulnerable dependencies, insecure Dockerfile or Terraform settings, and hardcoded secrets.

Step 4: fail a build on critical findings

In CI, use the exit code to break the pipeline when something critical appears:

trivy image --exit-code 1 --severity CRITICAL --ignore-unfixed your-app:latest

Exit code 1 fails the job. To accept a specific CVE you have assessed and decided to tolerate, list it in a .trivyignore file:

cat > .trivyignore <<'EOF'
# Reviewed 2026-07-16, not exploitable in our config, revisit in 90 days
CVE-2024-12345
EOF

What goes wrong

Every scan returns hundreds of findings. Unfiltered output is noise. Scan with --severity HIGH,CRITICAL --ignore-unfixed so you see what you can act on today.

Scans fail in an air-gapped environment. Trivy needs its database. Mirror the database internally with trivy image --download-db-only on a connected host and point air-gapped runners at it.

Results change between runs of the same tag. Image tags like latest move. Scan by digest for reproducible results.

False confidence. Trivy finds known CVEs, not zero-days or logic flaws. It is one control, not your whole security program.