How to Use Trivy Compliance Scanning for Docker CIS and Kubernetes Benchmarks

Use the --compliance flag with built-in report IDs like docker-cis-1.6.0 for container images or k8s-cis-1.23 for Kubernetes clusters to run predefined security checks against CIS benchmarks.

Trivy's compliance scanning feature in the aquasecurity/trivy repository enables automated assessment of containers and Kubernetes clusters against industry standards like CIS benchmarks. By leveraging built-in specifications or custom YAML definitions, you can generate concise security reports that validate configurations against Docker CIS and Kubernetes CIS requirements without writing complex policies from scratch.

Docker CIS Benchmark Compliance Scanning

Running Docker CIS Scans

To assess a container image against the Center for Internet Security (CIS) Docker Benchmark, use the docker-cis-1.6.0 report ID with the trivy image command. According to the Trivy source code in docs/guide/target/container_image.md, this built-in specification maps to a predefined set of misconfiguration checks.

trivy image --compliance docker-cis-1.6.0 nginx:latest

Controlling Output Detail

The --report flag determines the level of detail in your compliance output. Set it to summary for a high-level view of failed controls, or all to see specific failures with remediation guidance.

# Summary view for CI pipelines

trivy image --compliance docker-cis-1.6.0 --report summary nginx:latest

# Detailed audit trail with JSON output

trivy image --compliance docker-cis-1.6.0 --report all --format json -o docker-cis.json nginx:latest

Implementation Details

In pkg/compliance/spec/compliance.go, the GetComplianceSpec function parses the spec ID and maps it to the appropriate scanner. For Docker CIS scans, Trivy collects the image's OS packages and configuration, then evaluates them against Rego policies corresponding to check IDs prefixed with AVD- or KSV-. The results aggregate into the requested report format based on the --format flag.

Kubernetes CIS and Security Benchmarks

Built-in Kubernetes Compliance Reports

For Kubernetes clusters, Trivy provides multiple compliance specifications including CIS benchmarks, Pod Security Standards (PSS), and NSA hardening guidelines. The k8s-cis-1.23 report targets CIS Kubernetes Benchmark v1.23, as documented in docs/guide/target/kubernetes.md.

# CIS benchmark scan

trivy k8s --compliance=k8s-cis-1.23 --report summary

# Pod Security Standards baseline

trivy k8s --compliance=k8s-pss-baseline-0.1 --report all

Optimizing Cluster Scans

When running Kubernetes compliance scanning, you can optimize performance by skipping unnecessary data collection. Use --skip-images to assess only cluster configuration without pulling container images, or --disable-node-collector to bypass node-level infrastructure checks when you lack permissions to run collector jobs.

trivy k8s --compliance=k8s-cis-1.23 --skip-images --disable-node-collector --report all

Technical Implementation

The Kubernetes compliance process gathers cluster resources via the Kubernetes API and optionally deploys a node-collector Job to fetch node-level settings like file permissions and kubelet flags. According to the implementation in pkg/compliance/spec/compliance.go, this data evaluates against the CIS controls defined in the spec, with results merged into the final report alongside any vulnerability findings.

Creating Custom Compliance Specifications

Beyond built-in reports, Trivy supports custom compliance specifications using YAML files prefixed with @. The loader logic in pkg/compliance/spec/compliance.go handles both embedded specs and external files.

Create a custom specification defining specific control IDs:

cat > my-k8s.yaml <<'EOF'
spec:
  id: k8s-mycustom
  title: My custom K8s checks
  platform: k8s
  type: cis
  version: "1.0"
  controls:
    - id: "1.0"
      name: "Ensure privileged containers are disallowed"
      description: "Privileged containers increase attack surface."
      checks:
        - id: AVD-KSV-0001
      severity: HIGH
EOF

Execute the custom scan:

trivy k8s --compliance=@my-k8s.yaml --report all

Summary

• Use --compliance with built-in IDs like docker-cis-1.6.0 or k8s-cis-1.23 to run predefined CIS benchmark checks against containers and clusters.
• Control verbosity with --report summary for high-level results or --report all for detailed failure analysis and remediation guidance.
• Optimize Kubernetes scans using --skip-images and --disable-node-collector when you need only configuration assessments or lack node-level permissions.
• Create custom specs by referencing YAML files with the @/path/to/spec.yaml syntax to define organization-specific compliance controls.

Frequently Asked Questions

What built-in compliance reports are available in Trivy?

Trivy includes docker-cis-1.6.0 for container image scanning and several Kubernetes reports including k8s-cis-1.23 (CIS Benchmark v1.23), k8s-pss-baseline-0.1 (Pod Security Standards), and k8s-nsa-1.0 (NSA hardening guidance). These are defined in the target-specific documentation files and loaded via pkg/compliance/spec/compliance.go.

How do I generate machine-readable compliance reports?

Append --format json to your compliance command to produce structured JSON output suitable for CI/CD pipelines and security dashboards. Combine with --report all to include detailed check results and -o to save to a file: trivy image --compliance docker-cis-1.6.0 --format json --report all -o results.json.

Can I run compliance scans without downloading container images?

Yes. For Kubernetes compliance scanning, add the --skip-images flag to assess only cluster configuration and node settings without pulling container images. This accelerates scans when you only need to validate CIS benchmark compliance against API resources and node-level settings.

Where does Trivy store the compliance check definitions?

Built-in compliance specifications are embedded in the Trivy binary and parsed by the GetComplianceSpec function in pkg/compliance/spec/compliance.go. Custom specifications can be loaded from the filesystem using the @ prefix. The actual Rego policies for checks use IDs prefixed with AVD- or KSV- and are maintained in the Trivy repository alongside the compliance framework.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}