Intermediate LevelDocker & Deployment
How do automated container vulnerability scanners (Trivy, Grype) detect CVEs in CI/CD?
❓ Interview Prompt: Explain how Trivy scans image layers for OS packages and language dependencies against CVE databases, and how to integrate it in CI pipelines.
Container vulnerability scanners inspect all software installed in image layers and compare them against public CVE (Common Vulnerabilities and Exposures) databases to identify known security flaws.
How Trivy Works:
1
Layer Analysis: Extracts all packages from each image layer (OS packages via dpkg/rpm/apk, language packages via npm/pip/composer).
2
Database Query: Compares extracted package versions against CVE databases (NVD, GitHub Advisories, OS vendor security advisories).
3
Severity Classification: Reports CVEs by severity: CRITICAL, HIGH, MEDIUM, LOW, UNKNOWN.
4
SBOM Generation: Can produce a Software Bill of Materials (SBOM) in SPDX or CycloneDX format.
What Trivy Scans:
•
OS packages: apt, apk, rpm, dnf packages.
•
Language packages:
package-lock.json, Gemfile.lock, requirements.txt, go.sum, pom.xml.•
IaC files: Kubernetes YAML, Terraform, Helm charts for misconfigurations.
•
Secret detection: Hardcoded API keys, passwords in image layers.
CI/CD Integration:
Fail the build on CRITICAL or HIGH severity CVEs — force teams to update vulnerable base images.
Code Implementation Example
yaml
# GitHub Actions: Trivy vulnerability scan in CI/CD
name: Docker Security Scan
on: [push, pull_request]
jobs:
trivy-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Build image
run: docker build -t myapp:${{ github.sha }} .
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: myapp:${{ github.sha }}
format: 'table'
exit-code: '1' # fail CI on vulnerabilities
severity: 'CRITICAL,HIGH' # only fail on serious CVEs
ignore-unfixed: true # ignore CVEs with no fix yet
# Also scan IaC and misconfigurations
- name: Scan Kubernetes manifests
uses: aquasecurity/trivy-action@master
with:
scan-type: 'config'
scan-ref: './k8s'
severity: 'CRITICAL,HIGH'💡Trivy in GitHub Actions: scan image after build, fail CI on CRITICAL/HIGH CVEs, also scan K8s manifests for misconfigurations.
🎯 Interview Key Takeaway
Trivy scans OS packages + language deps + IaC configs against CVE databases. Fail CI on CRITICAL/HIGH CVEs — forces regular base image updates as a security discipline.
#Trivy#CVE#Security Scanning#CI/CD#SBOM#Intermediate
Back to all Docker & Deployment Questions→