# How to Use Trivy Compliance Scanning for Docker CIS and Kubernetes Benchmarks

> Learn to use Trivy compliance scanning for Docker CIS and Kubernetes benchmarks. Secure your containers and clusters with built-in security checks. Get started now.

- Repository: [Aqua Security/trivy](https://github.com/aquasecurity/trivy)
- Tags: how-to-guide
- Published: 2026-03-23

---

**Use the `--compliance` flag with built-in report IDs like `docker-cis-1.6.0` for container images or `k8s-cis-1.23` for Kubernetes clusters to run predefined security checks against CIS benchmarks.**

Trivy's **compliance scanning** feature in the `aquasecurity/trivy` repository enables automated assessment of containers and Kubernetes clusters against industry standards like CIS benchmarks. By leveraging built-in specifications or custom YAML definitions, you can generate concise security reports that validate configurations against Docker CIS and Kubernetes CIS requirements without writing complex policies from scratch.

## Docker CIS Benchmark Compliance Scanning

### Running Docker CIS Scans

To assess a container image against the Center for Internet Security (CIS) Docker Benchmark, use the `docker-cis-1.6.0` report ID with the `trivy image` command. According to the Trivy source code in [`docs/guide/target/container_image.md`](https://github.com/aquasecurity/trivy/blob/main/docs/guide/target/container_image.md), this built-in specification maps to a predefined set of misconfiguration checks.

```bash
trivy image --compliance docker-cis-1.6.0 nginx:latest

```

### Controlling Output Detail

The `--report` flag determines the level of detail in your compliance output. Set it to `summary` for a high-level view of failed controls, or `all` to see specific failures with remediation guidance.

```bash

# Summary view for CI pipelines

trivy image --compliance docker-cis-1.6.0 --report summary nginx:latest

# Detailed audit trail with JSON output

trivy image --compliance docker-cis-1.6.0 --report all --format json -o docker-cis.json nginx:latest

```

### Implementation Details

In [`pkg/compliance/spec/compliance.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/compliance/spec/compliance.go), the `GetComplianceSpec` function parses the spec ID and maps it to the appropriate scanner. For Docker CIS scans, Trivy collects the image's OS packages and configuration, then evaluates them against Rego policies corresponding to check IDs prefixed with `AVD-` or `KSV-`. The results aggregate into the requested report format based on the `--format` flag.

## Kubernetes CIS and Security Benchmarks

### Built-in Kubernetes Compliance Reports

For Kubernetes clusters, Trivy provides multiple compliance specifications including CIS benchmarks, Pod Security Standards (PSS), and NSA hardening guidelines. The `k8s-cis-1.23` report targets CIS Kubernetes Benchmark v1.23, as documented in [`docs/guide/target/kubernetes.md`](https://github.com/aquasecurity/trivy/blob/main/docs/guide/target/kubernetes.md).

```bash

# CIS benchmark scan

trivy k8s --compliance=k8s-cis-1.23 --report summary

# Pod Security Standards baseline

trivy k8s --compliance=k8s-pss-baseline-0.1 --report all

```

### Optimizing Cluster Scans

When running **Kubernetes compliance scanning**, you can optimize performance by skipping unnecessary data collection. Use `--skip-images` to assess only cluster configuration without pulling container images, or `--disable-node-collector` to bypass node-level infrastructure checks when you lack permissions to run collector jobs.

```bash
trivy k8s --compliance=k8s-cis-1.23 --skip-images --disable-node-collector --report all

```

### Technical Implementation

The Kubernetes compliance process gathers cluster resources via the Kubernetes API and optionally deploys a node-collector Job to fetch node-level settings like file permissions and kubelet flags. According to the implementation in [`pkg/compliance/spec/compliance.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/compliance/spec/compliance.go), this data evaluates against the CIS controls defined in the spec, with results merged into the final report alongside any vulnerability findings.

## Creating Custom Compliance Specifications

Beyond built-in reports, Trivy supports custom compliance specifications using YAML files prefixed with `@`. The loader logic in [`pkg/compliance/spec/compliance.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/compliance/spec/compliance.go) handles both embedded specs and external files.

Create a custom specification defining specific control IDs:

```bash
cat > my-k8s.yaml <<'EOF'
spec:
  id: k8s-mycustom
  title: My custom K8s checks
  platform: k8s
  type: cis
  version: "1.0"
  controls:
    - id: "1.0"
      name: "Ensure privileged containers are disallowed"
      description: "Privileged containers increase attack surface."
      checks:
        - id: AVD-KSV-0001
      severity: HIGH
EOF

```

Execute the custom scan:

```bash
trivy k8s --compliance=@my-k8s.yaml --report all

```

## Summary

- **Use `--compliance`** with built-in IDs like `docker-cis-1.6.0` or `k8s-cis-1.23` to run predefined CIS benchmark checks against containers and clusters.
- **Control verbosity** with `--report summary` for high-level results or `--report all` for detailed failure analysis and remediation guidance.
- **Optimize Kubernetes scans** using `--skip-images` and `--disable-node-collector` when you need only configuration assessments or lack node-level permissions.
- **Create custom specs** by referencing YAML files with the `@/path/to/spec.yaml` syntax to define organization-specific compliance controls.

## Frequently Asked Questions

### What built-in compliance reports are available in Trivy?

Trivy includes `docker-cis-1.6.0` for container image scanning and several Kubernetes reports including `k8s-cis-1.23` (CIS Benchmark v1.23), `k8s-pss-baseline-0.1` (Pod Security Standards), and `k8s-nsa-1.0` (NSA hardening guidance). These are defined in the target-specific documentation files and loaded via [`pkg/compliance/spec/compliance.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/compliance/spec/compliance.go).

### How do I generate machine-readable compliance reports?

Append `--format json` to your compliance command to produce structured JSON output suitable for CI/CD pipelines and security dashboards. Combine with `--report all` to include detailed check results and `-o` to save to a file: `trivy image --compliance docker-cis-1.6.0 --format json --report all -o results.json`.

### Can I run compliance scans without downloading container images?

Yes. For Kubernetes compliance scanning, add the `--skip-images` flag to assess only cluster configuration and node settings without pulling container images. This accelerates scans when you only need to validate CIS benchmark compliance against API resources and node-level settings.

### Where does Trivy store the compliance check definitions?

Built-in compliance specifications are embedded in the Trivy binary and parsed by the `GetComplianceSpec` function in [`pkg/compliance/spec/compliance.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/compliance/spec/compliance.go). Custom specifications can be loaded from the filesystem using the `@` prefix. The actual Rego policies for checks use IDs prefixed with `AVD-` or `KSV-` and are maintained in the Trivy repository alongside the compliance framework.