trivy-image-scan

Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues

Name:trivy-image-scan

Category:Containers

Publisher:trickest-mhmdiaa

Created:4/28/2022

Container:quay.io/trickest/trivy-image-scan:v0.34.0-patch-3

Output Type:

License:Unknown

Source:View Source

Parameters

debug · boolean

--debugdebug mode

quiet · boolean

--quietsuppress progress bar and log output

reset · boolean

--resetremove all caches and database

token · string

--tokenfor authentication in client/server mode

trace · boolean

--traceenable more verbose trace output for custom queries

config · file

--configconfig path (default trivy.yaml)

format · string

--formatformat (table, json, sarif, template, cyclonedx, spdx, spdx-json, github, cosign-vuln) (default table)

server · string

--serverserver address in client mode

tf-vars · string

--tf-varsspecify paths to override the Terraform tfvars files

timeout · string

--timeouttimeout (default: 5m0s)

helm-set · string

--helm-setspecify Helm values (can separate values with commas: key1=val1,key2=val2)

insecure · boolean

--insecureallow insecure server connections when using TLS

platform · string

--platformset platform in the form os/arch if image is multi-platform capable

redis-ca · file

--redis-caredis ca file location, if using redis as cache backend

severity · string

--severityseverities of vulnerabilities to be displayed (comma separated) (default: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL)

template · file

--templateoutput template

cache-ttl · string

--cache-ttlcache TTL when using redis as cache backend

exit-code · string

--exit-codeExit code when vulnerabilities are found

redis-key · file

--redis-keyredis key file location, if using redis as cache backend

rekor-url · string

--rekor-url[EXPERIMENTAL] address of rekor STL server (default https://rekor.sigstore.dev)

skip-dirs · string

--skip-dirsspecify the directories where the traversal is skipped

vuln-type · string

--vuln-typecomma-separated list of vulnerability types (os,library)

compliance · string

--compliancecomma-separated list of what compliance reports to generate (nsa)

ignorefile · file

--ignorefilespecify .trivyignore file (default .trivyignore)

image-list · file · required

List of images line by line to be scanned

redis-cert · file

--redis-certredis certificate file location, if using redis as cache backend

skip-files · string

--skip-filesspecify the file paths to skip traversal

clear-cache · boolean

--clear-cacheclear image caches without scanning

config-data · folder

--config-dataspecify paths from which data for the Rego policies will be recursively loaded

helm-values · file

--helm-valuesspecify paths to override the Helm values.yaml files

license-full · boolean

--license-fulleagerly look for licenses in source code headers and license files

offline-scan · boolean

--offline-scando not issue API requests to identify dependencies

removed-pkgs · boolean

--removed-pkgsdetect vulnerabilities of removed packages (only for Alpine)

sbom-sources · string

--sbom-sources[EXPERIMENTAL] try to retrieve SBOM from the specified sources (rekor)

token-header · string

--token-headerspecify a header name for token in client/server mode (default Trivy-Token)

cache-backend · string

--cache-backendcache backend (e.g. redis://localhost:6379) (default fs)

config-policy · folder

--config-policyspecify paths to the Rego policy files directory, applying config files

db-repository · string

--db-repositoryOCI repository to retrieve trivy-db from (default ghcr.io/aquasecurity/trivy-db)

file-patterns · file

--file-patternsspecify config file patterns

ignore-policy · file

--ignore-policyspecify the Rego file to evaluate each vulnerability

list-all-pkgs · boolean

--list-all-pkgsenabling the option will output all packages regardless of vulnerability

secret-config · file

--secret-configspecify a path to config file for secret scanning (default trivy-secret.yaml)

show-progress · boolean

--no-progresssuppress progress bar

custom-headers · string

--custom-headerscustom headers in client mode

ignore-unfixed · boolean

--ignore-unfixeddisplay only fixed vulnerabilities

skip-db-update · boolean

--skip-db-updateskip updating vulnerability database

dependency-tree · boolean

--dependency-tree[EXPERIMENTAL] show dependency origin tree of vulnerable packages

helm-set-string · string

--helm-set-stringspecify Helm string values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)

security-checks · string

--security-checkscomma-separated list of what security issues to detect (vuln,config,secret,license) (default [vuln,secret])

download-db-only · boolean

--download-db-onlydownload/update vulnerability database but don't run a scan

ignored-licenses · string

--ignored-licensesspecify a list of license to ignore

policy-namespaces · string

--policy-namespacesRego namespaces

username-password · file · required

Username and password for Docker Hub registry (format username:password)

include-non-failures · boolean

--include-non-failuresinclude successes and exceptions, available with '--security-checks config'