# trivy | Aqua Security | Knowledge Base | Instagit

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

GitHub Stars: 33.8k

Repository: https://github.com/aquasecurity/trivy

---

## Articles

### [Trivy Rootfs vs Filesystem: Understanding the Difference Between Scan Targets](/aquasecurity/trivy/trivy-rootfs-vs-filesystem-scan)

Confused by Trivy rootfs vs filesystem scan targets? Learn when to scan OS packages with rootfs and source code/configs with filesystem for effective vulnerability detection.

- Tags: deep-dive
- Published: 2026-03-23

### [How Trivy Kubernetes Cluster Scanning Works: Architecture and Implementation](/aquasecurity/trivy/trivy-kubernetes-cluster-scanning-explained)

Discover how Trivy Kubernetes cluster scanning works. Learn about its architecture, implementation, and how it collects data and scans for vulnerabilities, secrets, and misconfigurations.

- Tags: architecture
- Published: 2026-03-23

### [How to Configure Trivy with a Config File Instead of Command-Line Flags](/aquasecurity/trivy/trivy-configuration-file-vs-flags)

Learn how to configure Trivy with a YAML config file instead of command line flags. Streamline your security scanning with this maintainable approach.

- Tags: how-to-guide
- Published: 2026-03-23

### [Trivy Database Lock Error: How to Fix "Cache May Be in Use by Another Process"](/aquasecurity/trivy/trivy-database-lock-error-resolution)

Fix the Trivy database lock error where the cache is in use by another process. Learn to resolve this issue by switching cache backends or terminating conflicts.

- Tags: how-to-guide
- Published: 2026-03-23

### [How Trivy Scans Remote Git Repositories: Architecture and Implementation](/aquasecurity/trivy/trivy-source-repository-scanning-git)

Learn how Trivy scans remote Git repositories. Discover its architecture, implementation details, and how it clones and analyzes source code for vulnerabilities.

- Tags: architecture
- Published: 2026-03-23

### [How to Use Trivy in CI/CD Pipelines: GitHub Actions, GitLab CI, and Jenkins Integration Guide](/aquasecurity/trivy/trivy-cicd-pipeline-integration)

Learn how to integrate Trivy into your CI/CD pipelines. This guide covers GitHub Actions, GitLab CI, and Jenkins for automated vulnerability scanning in every commit.

- Tags: how-to-guide
- Published: 2026-03-23

### [What Programming Languages and Package Managers Does Trivy Support for SBOM Generation?](/aquasecurity/trivy/trivy-sbom-supported-languages-package-managers)

Trivy generates SBOMs for 13 programming languages including Ruby Python Java Go and Rust. Discover supported languages and package managers for accurate software bill of materials.

- Tags: faq
- Published: 2026-03-23

### [How Trivy Parallel Scanning Boosts Performance: A Deep Dive into the Generic Pipeline](/aquasecurity/trivy/trivy-parallel-scanning-performance)

Discover how Trivy parallel scanning enhances performance using its generic pipeline and worker goroutines for faster vulnerability analysis. Learn more about context cancellation.

- Tags: deep-dive
- Published: 2026-03-23

### [How Trivy's Database Update Mechanism Works: A Technical Deep Dive into the Source Code](/aquasecurity/trivy/trivy-database-update-mechanism)

Explore Trivy's database update mechanism. Learn how the lightweight DB client efficiently downloads new vulnerability data by checking OCI registry timestamps and local cache freshness.

- Tags: internals
- Published: 2026-03-23

### [Trivy Report Formats: JSON, CycloneDX, SPDX, and SARIF Explained](/aquasecurity/trivy/trivy-report-formats-json-cyclonedx-spdx-sarif)

Explore Trivy report formats including JSON, CycloneDX, SPDX, and SARIF. Learn how to leverage these formats for effective vulnerability analysis and compliance.

- Tags: api-reference
- Published: 2026-03-23

### [How to Use Trivy Compliance Scanning for Docker CIS and Kubernetes Benchmarks](/aquasecurity/trivy/trivy-compliance-scanning-docker-kubernetes)

Learn to use Trivy compliance scanning for Docker CIS and Kubernetes benchmarks. Secure your containers and clusters with built-in security checks. Get started now.

- Tags: how-to-guide
- Published: 2026-03-23

### [Trivy Module System vs Plugins: Understanding Wasm Extensions and Binary Plugins](/aquasecurity/trivy/trivy-module-system-vs-plugins)

Explore Trivy modules and plugins. Understand how WebAssembly extensions customize scanning versus binary plugins offering full host access. Enhance your Trivy workflow.

- Tags: deep-dive
- Published: 2026-03-23

### [How Trivy’s Plugin System Extends Security Scanning Capabilities](/aquasecurity/trivy/trivy-plugin-system-extensions)

Discover how Trivy’s plugin system enhances security scanning. Add new scanners and output formats easily using external binaries without core code changes.

- Tags: internals
- Published: 2026-03-23

### [Scan Virtual Machine Images with Trivy: AWS AMI, EBS Snapshots, and VMDK Files](/aquasecurity/trivy/trivy-scan-virtual-machine-images)

Easily scan AWS AMI, EBS snapshots, and VMDK files for vulnerabilities using Trivy. Secure your virtual machine images with simple commands.

- Tags: how-to-guide
- Published: 2026-03-23

### [How Trivy VEX Works: Understanding Vulnerability Exploitability Exchange in Container Scanning](/aquasecurity/trivy/trivy-vex-explained)

Discover how Trivy VEX works to streamline container scanning. Learn how it uses vulnerability exploitability exchange to manage findings from multiple sources and formats like OpenVEX, CycloneDX, and CSAF.

- Tags: deep-dive
- Published: 2026-03-23

### [Trivy IaC Misconfiguration Scanners: Supported Formats and Configuration](/aquasecurity/trivy/trivy-iac-misconfiguration-scanners)

Discover Trivy IaC misconfiguration scanners supporting Terraform, CloudFormation, Kubernetes, Dockerfiles & more. Secure your infrastructure code effectively.

- Tags: tutorial
- Published: 2026-03-23

### [How to Integrate Trivy with Kubernetes Using the Operator: 3 Deployment Methods](/aquasecurity/trivy/trivy-kubernetes-operator-integration)

Integrate Trivy with Kubernetes using the Operator. Deploy Trivy scans for continuous security and automatically generate vulnerability and config audit reports for your workloads with Helm.

- Tags: how-to-guide
- Published: 2026-03-23

### [How Trivy Handles Caching: Redis vs. Memory vs. Filesystem Backends Explained](/aquasecurity/trivy/trivy-cache-backends-redis-memory-filesystem)

Discover how Trivy manages caching with Redis, memory, and filesystem backends. Learn to optimize scans by preventing redundant downloads and efficiently storing artifact metadata.

- Tags: deep-dive
- Published: 2026-03-23

### [Difference Between Trivy's Vulnerability Scanner and SBOM Scanner: Architecture and Usage](/aquasecurity/trivy/trivy-vulnerability-vs-sbom-scanner)

Discover the key differences between Trivy's vulnerability scanner and SBOM scanner. Learn their architectures and usage to enhance your security scanning.

- Tags: deep-dive
- Published: 2026-03-23

### [How Trivy Client-Server Mode Works and When to Use It](/aquasecurity/trivy/trivy-client-server-mode-explained)

Discover Trivy client-server mode. Learn how the persistent server and lightweight clients optimize scans by running the database centrally and caching metadata. Understand when to leverage this mode for efficient vulnerability...

- Tags: internals
- Published: 2026-03-23