trivy-image-scan
Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues
Details
Category: Containers
Publisher: trickest-mhmdiaa
Created Date: 4/28/2022
Container: quay.io/trickest/trivy-image-scan:v0.34.0-patch-3
Source URL: https://github.com/aquasecurity/trivy
Parameters
Command:
--debug - debug modeCommand:
--quiet - suppress progress bar and log outputCommand:
--reset - remove all caches and databaseCommand:
--token - for authentication in client/server modeCommand:
--trace - enable more verbose trace output for custom queriesCommand:
--config - config path (default trivy.yaml)Command:
--format - format (table, json, sarif, template, cyclonedx, spdx, spdx-json, github, cosign-vuln) (default table)Command:
--server - server address in client modeCommand:
--tf-vars - specify paths to override the Terraform tfvars filesCommand:
--timeout - timeout (default: 5m0s)Command:
--helm-set - specify Helm values (can separate values with commas: key1=val1,key2=val2)Command:
--insecure - allow insecure server connections when using TLSCommand:
--platform - set platform in the form os/arch if image is multi-platform capableCommand:
--redis-ca - redis ca file location, if using redis as cache backendCommand:
--severity - severities of vulnerabilities to be displayed (comma separated) (default: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL)Command:
--template - output templateCommand:
--cache-ttl - cache TTL when using redis as cache backendCommand:
--exit-code - Exit code when vulnerabilities are foundCommand:
--redis-key - redis key file location, if using redis as cache backendCommand:
--rekor-url - [EXPERIMENTAL] address of rekor STL server (default https://rekor.sigstore.dev)Command:
--skip-dirs - specify the directories where the traversal is skippedCommand:
--vuln-type - comma-separated list of vulnerability types (os,library)Command:
--compliance - comma-separated list of what compliance reports to generate (nsa)Command:
--ignorefile - specify .trivyignore file (default .trivyignore)Command:
Command:
--redis-cert - redis certificate file location, if using redis as cache backendCommand:
--skip-files - specify the file paths to skip traversalCommand:
--clear-cache - clear image caches without scanningCommand:
--config-data - specify paths from which data for the Rego policies will be recursively loadedCommand:
--helm-values - specify paths to override the Helm values.yaml filesCommand:
--license-full - eagerly look for licenses in source code headers and license filesCommand:
--offline-scan - do not issue API requests to identify dependenciesCommand:
--removed-pkgs - detect vulnerabilities of removed packages (only for Alpine)Command:
--sbom-sources - [EXPERIMENTAL] try to retrieve SBOM from the specified sources (rekor)Command:
--token-header - specify a header name for token in client/server mode (default Trivy-Token)Command:
--cache-backend - cache backend (e.g. redis://localhost:6379) (default fs)Command:
--config-policy - specify paths to the Rego policy files directory, applying config filesCommand:
--db-repository - OCI repository to retrieve trivy-db from (default ghcr.io/aquasecurity/trivy-db)Command:
--file-patterns - specify config file patternsCommand:
--ignore-policy - specify the Rego file to evaluate each vulnerabilityCommand:
--list-all-pkgs - enabling the option will output all packages regardless of vulnerabilityCommand:
--secret-config - specify a path to config file for secret scanning (default trivy-secret.yaml)Command:
--no-progress - suppress progress barCommand:
--custom-headers - custom headers in client modeCommand:
--ignore-unfixed - display only fixed vulnerabilitiesCommand:
--skip-db-update - skip updating vulnerability databaseCommand:
--dependency-tree - [EXPERIMENTAL] show dependency origin tree of vulnerable packagesCommand:
--helm-set-string - specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)Command:
--security-checks - comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret])Command:
--download-db-only - download/update vulnerability database but don't run a scanCommand:
--ignored-licenses - specify a list of license to ignoreCommand:
--policy-namespaces - Rego namespacesCommand:
Command:
--include-non-failures - include successes and exceptions, available with '--security-checks config'