← docsSecurity

/scanning-docker-images-with-trivy

Perform comprehensive Docker image security assessment with Trivy, including vulnerabiliti.

Perform comprehensive Docker image security assessment with Trivy, including vulnerabilities, misconfigurations, secrets, and SBOM generation, with clear remediation gates.

Category

Security

Execution

7 steps, sequential + gated

Goal

Perform comprehensive Docker image security assessment with Trivy, including vulnerabilities, misconfigurations, secrets, and SBOM generation, with clear remediation gates.

Scope

Applies to

  • +Scan Docker image with Trivy
  • +Generate security report/SBOM for image
  • +Check private registry image before release

Does not cover

  • −Trivial changes outside the workflow domain

Triggers

"Scan Docker image with Trivy""Generate security report/SBOM for image""Check private registry image before release""Enforce critical/high CVE gate"

Inputs

  • →Context: environment/system affected
  • →Scope: change boundary
  • →Constraints: policy or hard rules

Invariants

  • 01Scans must clearly identify scanned image digest/tag and DB timestamp.
  • 02Blocking policy must be deterministic and explicit.
  • 03Ignore entries must be reviewed and justified.
  • 04Outputs must remain auditable and machine-consumable when used in gates.

Procedure

  1. Step 1Step 1 — **Prepare scan environment**
  2. Step 2Step 2 — **Run baseline vulnerability scan**
  3. Step 3Step 3 — **Expand scan dimensions as needed**
  4. Step 4Step 4 — **Generate SBOM**
  5. Step 5Step 5 — **Apply policy exceptions safely**
  6. Step 6Step 6 — **Assess private registry images**
  7. Step 7Step 7 — **Finalize remediation report**

Outputs

  • ▸Trivy vulnerability report for target image.
  • ▸Extended scan report (misconfig/secret/license when enabled).
  • ▸SBOM artifact for image.
  • ▸Gate summary with blocking findings and remediation priorities.

Review Gate

  • [ ]Scan identifies image reference and supports reproducibility.
  • [ ]Blocking vulnerabilities are surfaced with remediation context.
  • [ ]SBOM is generated and attached when required.
  • [ ]Exception handling is traceable and policy-compliant.
  • [ ]Final pass/fail decision matches configured severity policy.