Scan container images for CVEs, secrets, and licenses

trivy-image-scan runs Aqua Security's Trivy against container images from any registry or a local list. It reads each image, unpacks the layers, and reports known vulnerabilities in the OS packages and application libraries inside. Beyond CVEs, its security checks extend to secrets baked into an image, misconfigurations, and license problems, so one scan covers several classes of supply-chain risk.

It is the general-purpose Trivy node, with the full set of controls. Filter by severity, restrict vulnerability types, ignore unfixed issues, and set an exit code to gate a build. Output formats run from table and JSON to SARIF, CycloneDX, and SPDX, which means the same scan can feed a security dashboard or generate a software bill of materials. A trivyignore file and Rego policies let you encode exceptions and custom rules.

Use it to scan the images your pipeline builds or pulls, as a release gate or on a schedule, and route the findings into reporting downstream. On Trickest it is a Containers-category node that takes an image list and writes a folder of results.