Can it produce an SBOM?

Yes. Set --format to cyclonedx or spdx so the same scan emits a software bill of materials alongside, or instead of, a findings table.

How do I fail a build on findings?

Combine --severity with --exit-code so the scan returns a non-zero code when a vulnerability at or above your threshold appears. Use --ignorefile for exceptions.

How do I scan only fixable HIGH and CRITICAL issues?

Use --severity HIGH,CRITICAL with --ignore-unfixed so the report and exit gate focus on vulnerabilities that have a published fix.

What goes in the image list?

One image reference per line (registry/name:tag or digest). The node walks the file and runs Trivy against each entry.

When should I use trivy-ecr-scan instead?

When images live in Amazon ECR and you want AWS login handled. For registries in general, or a local list, stay on trivy-image-scan.

Updated Jul 15, 2026

Containers

Scan container images for CVEs and secrets

Trivy against container images for CVEs, secrets, and misconfigs.

Scan images for OS and library CVEs Catch secrets and misconfigurations Generate an SBOM

overview

What trivy-image-scan does

trivy-image-scan takes an image-list file and runs Aqua Trivy against each reference. It unpacks layers and reports OS and library CVEs, with optional secret, config, and license checks via --security-checks.

Operators set --severity to focus the report, --ignore-unfixed to drop unpatched noise, and --exit-code to fail a pipeline when findings cross the threshold. --format covers table, json, sarif, cyclonedx, and spdx.

Use it for any registry or local list. Prefer trivy-ecr-scan when images live in Amazon ECR and you want AWS login handled. Trickest runs it as a managed Containers node that writes a results folder.

source github.com/aquasecurity/trivy

use cases

Where trivy-image-scan fits

Scan images for OS and library CVEs

Read an image list and report vulnerabilities in both system packages and application dependencies, so the full software stack in each image gets checked.

Catch secrets and misconfigurations

Extend security checks to secret and config scanning so credentials baked into a layer or insecure settings surface in the same run as the CVEs.

Generate an SBOM

Emit CycloneDX or SPDX output so a scan doubles as a software bill of materials for supply-chain inventory and compliance.

Gate a build on severity

Filter to high and critical and set an exit code so a pipeline fails when a serious issue appears, blocking a risky image from shipping.

reference

trivy-image-scan inputs and flags

54 inputs

Name	Type	Flag	Description
image-list	FILE	·	List of images, line by line, to scan.
severity	STRING	--severity	Severities to display (default UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL).
format	STRING	--format	Output format: table, json, sarif, cyclonedx, spdx, and more (default table).
security-checks	STRING	--security-checks	Issues to detect: vuln, config, secret, license (default vuln,secret).
vuln-type	STRING	--vuln-type	Vulnerability types to scan: os, library.
ignore-unfixed	BOOLEAN	--ignore-unfixed	Display only vulnerabilities that have a fix available.
exit-code	STRING	--exit-code	Exit code to return when vulnerabilities are found.
ignorefile	FILE	--ignorefile	Path to a .trivyignore file for exceptions (default .trivyignore).

Showing key inputs. trivy-image-scan exposes 54 inputs in total.

Full flag reference (54 inputs)

Name	Type	Flag	Description
debug	BOOLEAN	--debug	debug mode
quiet	BOOLEAN	--quiet	suppress progress bar and log output
reset	BOOLEAN	--reset	remove all caches and database
token	STRING	--token	for authentication in client/server mode
trace	BOOLEAN	--trace	enable more verbose trace output for custom queries
config	FILE	--config	config path (default "trivy.yaml")
format	STRING	--format	format (table, json, sarif, template, cyclonedx, spdx, spdx-json, github, cosign-vuln) (default "table")
server	STRING	--server	server address in client mode
tf-vars	STRING	--tf-vars	specify paths to override the Terraform tfvars files
timeout	STRING	--timeout	timeout (default: 5m0s)
helm-set	STRING	--helm-set	specify Helm values (can separate values with commas: key1=val1,key2=val2)
insecure	BOOLEAN	--insecure	allow insecure server connections when using TLS
platform	STRING	--platform	set platform in the form os/arch if image is multi-platform capable
redis-ca	FILE	--redis-ca	redis ca file location, if using redis as cache backend
severity	STRING	--severity	severities of vulnerabilities to be displayed (comma separated) (default: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL")
template	FILE	--template	output template
cache-ttl	STRING	--cache-ttl	cache TTL when using redis as cache backend
exit-code	STRING	--exit-code	Exit code when vulnerabilities are found
redis-key	FILE	--redis-key	redis key file location, if using redis as cache backend
rekor-url	STRING	--rekor-url	[EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
skip-dirs	STRING	--skip-dirs	specify the directories where the traversal is skipped
vuln-type	STRING	--vuln-type	comma-separated list of vulnerability types (os,library)
compliance	STRING	--compliance	comma-separated list of what compliance reports to generate (nsa)
ignorefile	FILE	--ignorefile	specify .trivyignore file (default ".trivyignore")
image-list	FILE	·	List of images line by line to be scanned
redis-cert	FILE	--redis-cert	redis certificate file location, if using redis as cache backend
skip-files	STRING	--skip-files	specify the file paths to skip traversal
clear-cache	BOOLEAN	--clear-cache	clear image caches without scanning
config-data	FOLDER	--config-data	specify paths from which data for the Rego policies will be recursively loaded
helm-values	FILE	--helm-values	specify paths to override the Helm values.yaml files
license-full	BOOLEAN	--license-full	eagerly look for licenses in source code headers and license files
offline-scan	BOOLEAN	--offline-scan	do not issue API requests to identify dependencies
removed-pkgs	BOOLEAN	--removed-pkgs	detect vulnerabilities of removed packages (only for Alpine)
sbom-sources	STRING	--sbom-sources	[EXPERIMENTAL] try to retrieve SBOM from the specified sources (rekor)
token-header	STRING	--token-header	specify a header name for token in client/server mode (default "Trivy-Token")
cache-backend	STRING	--cache-backend	cache backend (e.g. redis://localhost:6379) (default "fs")
config-policy	FOLDER	--config-policy	specify paths to the Rego policy files directory, applying config files
db-repository	STRING	--db-repository	OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db")
file-patterns	FILE	--file-patterns	specify config file patterns
ignore-policy	FILE	--ignore-policy	specify the Rego file to evaluate each vulnerability
list-all-pkgs	BOOLEAN	--list-all-pkgs	enabling the option will output all packages regardless of vulnerability
secret-config	FILE	--secret-config	specify a path to config file for secret scanning (default "trivy-secret.yaml")
show-progress	BOOLEAN	--no-progress	suppress progress bar
custom-headers	STRING	--custom-headers	custom headers in client mode
ignore-unfixed	BOOLEAN	--ignore-unfixed	display only fixed vulnerabilities
skip-db-update	BOOLEAN	--skip-db-update	skip updating vulnerability database
dependency-tree	BOOLEAN	--dependency-tree	[EXPERIMENTAL] show dependency origin tree of vulnerable packages
helm-set-string	STRING	--helm-set-string	specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
security-checks	STRING	--security-checks	comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret])
download-db-only	BOOLEAN	--download-db-only	download/update vulnerability database but don't run a scan
ignored-licenses	STRING	--ignored-licenses	specify a list of license to ignore
policy-namespaces	STRING	--policy-namespaces	Rego namespaces
username-password	FILE	·	Username and password for Docker Hub registry (format username:password)
include-non-failures	BOOLEAN	--include-non-failures	include successes and exceptions, available with '--security-checks config'

example

Run trivy-image-scan

trivy-image-scan · command

# JSON report of fixable HIGH/CRITICAL CVEs for images in a listtrivy image --severity HIGH,CRITICAL --ignore-unfixed --format json --security-checks vuln,secret --exit-code 1 example/api:1.2.3

sample output

example/api:1.2.3 (alpine 3.18.4)==============================Total: 3 (HIGH: 2, CRITICAL: 1) Library       Vulnerability   Severity  Status  Installed Version  Fixed Versionopenssl       CVE-2023-0286   CRITICAL  fixed   3.1.1-r1           3.1.2-r0curl          CVE-2023-38545  HIGH      fixed   8.2.1-r0           8.4.0-r0libcrypto3    CVE-2023-5363   HIGH      fixed   3.1.1-r1           3.1.3-r0

guidance

Choosing trivy-image-scan

Use when you need Trivy on container images from any registry or a local list, including secrets, misconfigs, licenses, and SBOM output. Prefer trivy-ecr-scan for Amazon ECR with login handled.

trivy-ecr-scan

Same Trivy engine with ECR login built in. Prefer when images live in Amazon ECR.

grype

Another container vulnerability scanner. Different database and output shape, similar role.

trivy-image-scan-sarif

Trivy variant pinned to SARIF for code-scanning ingestion.

faq

trivy-image-scan questions

OS and library vulnerabilities by default. Extend --security-checks to secret, config, and license for a broader supply-chain pass.

trivy-ecr-scan
Trivy CVE scanning for container images stored in Amazon ECR.

Run trivy-image-scan yourself

An image list feeds trivy-image-scan, which inspects each image for CVEs, secrets, and misconfigurations and writes the findings as an output.

Run trivy-image-scan in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

image-list

FILE

List of images, line by line, to scan.

severity

STRING

--severity

Severities to display (default UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL).

format

STRING

--format

Output format: table, json, sarif, cyclonedx, spdx, and more (default table).

security-checks

STRING

--security-checks

Issues to detect: vuln, config, secret, license (default vuln,secret).

vuln-type

STRING

--vuln-type

Vulnerability types to scan: os, library.

ignore-unfixed

BOOLEAN

--ignore-unfixed

Display only vulnerabilities that have a fix available.

exit-code

STRING

--exit-code

Exit code to return when vulnerabilities are found.

ignorefile

FILE

--ignorefile

Path to a .trivyignore file for exceptions (default .trivyignore).

Name

Type

Flag

Description

debug

BOOLEAN

--debug

debug mode

quiet

BOOLEAN

--quiet

suppress progress bar and log output

reset

BOOLEAN

--reset

remove all caches and database

token

STRING

--token

for authentication in client/server mode

trace

BOOLEAN

--trace

enable more verbose trace output for custom queries

config

FILE

--config

config path (default "trivy.yaml")

format

STRING

--format

format (table, json, sarif, template, cyclonedx, spdx, spdx-json, github, cosign-vuln) (default "table")

server

STRING

--server

server address in client mode

tf-vars

STRING

--tf-vars

specify paths to override the Terraform tfvars files

timeout

STRING

--timeout

timeout (default: 5m0s)

helm-set

STRING

--helm-set

specify Helm values (can separate values with commas: key1=val1,key2=val2)

insecure

BOOLEAN

--insecure

allow insecure server connections when using TLS

platform

STRING

--platform

set platform in the form os/arch if image is multi-platform capable

redis-ca

FILE

--redis-ca

redis ca file location, if using redis as cache backend

severity

STRING

--severity

severities of vulnerabilities to be displayed (comma separated) (default: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL")

template

FILE

--template

output template

cache-ttl

STRING

--cache-ttl

cache TTL when using redis as cache backend

exit-code

STRING

--exit-code

Exit code when vulnerabilities are found

redis-key

FILE

--redis-key

redis key file location, if using redis as cache backend

rekor-url

STRING

--rekor-url

[EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")

skip-dirs

STRING

--skip-dirs

specify the directories where the traversal is skipped

vuln-type

STRING

--vuln-type

comma-separated list of vulnerability types (os,library)

compliance

STRING

--compliance

comma-separated list of what compliance reports to generate (nsa)

ignorefile

FILE

--ignorefile

specify .trivyignore file (default ".trivyignore")

image-list

FILE

List of images line by line to be scanned

redis-cert

FILE

--redis-cert

redis certificate file location, if using redis as cache backend

skip-files

STRING

--skip-files

specify the file paths to skip traversal

clear-cache

BOOLEAN

--clear-cache

clear image caches without scanning

config-data

FOLDER

--config-data

specify paths from which data for the Rego policies will be recursively loaded

helm-values

FILE

--helm-values

specify paths to override the Helm values.yaml files

license-full

BOOLEAN

--license-full

eagerly look for licenses in source code headers and license files

offline-scan

BOOLEAN

--offline-scan

do not issue API requests to identify dependencies

removed-pkgs

BOOLEAN

--removed-pkgs

detect vulnerabilities of removed packages (only for Alpine)

sbom-sources

STRING

--sbom-sources

[EXPERIMENTAL] try to retrieve SBOM from the specified sources (rekor)

token-header

STRING

--token-header

specify a header name for token in client/server mode (default "Trivy-Token")

cache-backend

STRING

--cache-backend

cache backend (e.g. redis://localhost:6379) (default "fs")

config-policy

FOLDER

--config-policy

specify paths to the Rego policy files directory, applying config files

db-repository

STRING

--db-repository

OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db")

file-patterns

FILE

--file-patterns

specify config file patterns

ignore-policy

FILE

--ignore-policy

specify the Rego file to evaluate each vulnerability

list-all-pkgs

BOOLEAN

--list-all-pkgs

enabling the option will output all packages regardless of vulnerability

secret-config

FILE

--secret-config

specify a path to config file for secret scanning (default "trivy-secret.yaml")

show-progress

BOOLEAN

--no-progress

suppress progress bar

custom-headers

STRING

--custom-headers

custom headers in client mode

ignore-unfixed

BOOLEAN

--ignore-unfixed

display only fixed vulnerabilities

skip-db-update

BOOLEAN

--skip-db-update

skip updating vulnerability database

dependency-tree

BOOLEAN

--dependency-tree

[EXPERIMENTAL] show dependency origin tree of vulnerable packages

helm-set-string

STRING

--helm-set-string

specify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)

security-checks

STRING

--security-checks

comma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret])

download-db-only

BOOLEAN

--download-db-only

download/update vulnerability database but don't run a scan

ignored-licenses

STRING

--ignored-licenses

specify a list of license to ignore

policy-namespaces

STRING

--policy-namespaces

Rego namespaces

username-password

FILE

Username and password for Docker Hub registry (format username:password)

include-non-failures

BOOLEAN

--include-non-failures

include successes and exceptions, available with '--security-checks config'

example/api:1.2.3 (alpine 3.18.4)==============================Total: 3 (HIGH: 2, CRITICAL: 1) Library Vulnerability Severity Status Installed Version Fixed Versionopenssl CVE-2023-0286 CRITICAL fixed 3.1.1-r1 3.1.2-r0curl CVE-2023-38545 HIGH fixed 8.2.1-r0 8.4.0-r0libcrypto3 CVE-2023-5363 HIGH fixed 3.1.1-r1 3.1.3-r0

Scan container images for CVEs and secrets

What trivy-image-scan does

Where trivy-image-scan fits

Scan images for OS and library CVEs

Catch secrets and misconfigurations

Generate an SBOM

Gate a build on severity

trivy-image-scan inputs and flags

Run trivy-image-scan

Choosing trivy-image-scan

trivy-ecr-scan

grype

trivy-image-scan-sarif

trivy-image-scan questions

More Containers tools

trivy-ecr-scan

Run trivy-image-scan yourself

Scan container images for CVEs and secrets

What trivy-image-scan does

Where trivy-image-scan fits

Scan images for OS and library CVEs

Catch secrets and misconfigurations

Generate an SBOM

Gate a build on severity

trivy-image-scan inputs and flags

Run trivy-image-scan

Choosing trivy-image-scan

trivy-ecr-scan

grype

trivy-image-scan-sarif

trivy-image-scan questions

More Containers tools

trivy-ecr-scan

Run trivy-image-scan yourself