BLOG DETAILS
Sachin Pathak
Security
21 September, 2025
Container Security: Scanning Images with Trivy
Containers ship your dependencies — and their vulnerabilities. Scanning images with Trivy catches known CVEs before they ever reach production.
Scan early, scan often
Run Trivy locally, in CI and against your registry. Fail builds on HIGH and CRITICAL findings so vulnerable images never get promoted.
Wiring Trivy into CI
A single step blocks risky images from ever being deployed.
trivy image --severity HIGH,CRITICAL \
--exit-code 1 ghcr.io/you/app:latestReduce the attack surface
Use minimal base images (distroless or alpine), drop root, and keep dependencies patched. Fewer packages means fewer CVEs.
Key Takeaways
- Scan images in CI before they ever reach a registry or a cluster.
- Trivy covers OS packages, language dependencies, misconfigurations and secrets in one tool.
- Fail the build on critical CVEs to keep vulnerable images out of production.
- Start from a distroless or minimal base image to shrink the attack surface.
- Re-scan running workloads — new CVEs are disclosed long after an image is built.
Wrapping Up
Image scanning is the cheapest security win in the pipeline — automate it, fail fast, and ship images you can trust.
3 Comments +14
Abhijeet Tripathi
03 Feb 2026Adding Trivy as a CI gate caught a critical CVE in our base image on day one.
Amber Sharma
04 Feb 2026Distroless + Trivy is our standard now. Image sizes dropped and scans are way cleaner.
Vivek Shah
06 Feb 2026Good reminder to re-scan running images. New CVEs land all the time.