scanning-docker-images-with-trivy

使用 Trivy 扫描 Docker 镜像

概述

Trivy 是 Aqua Security 推出的一款全面的开源漏洞扫描器，可检测容器镜像中操作系统软件包、特定语言依赖项、错误配置、密钥以及许可证违规方面的漏洞。它可集成到 CI/CD 流水线中，并支持多种输出格式，包括 SARIF、CycloneDX 和 SPDX。

何时使用

• 当进行涉及使用 trivy 扫描 docker 镜像的安全评估时
• 当遵循相关安全事件的事件响应流程时
• 当执行计划的安全测试或审计活动时
• 当通过动手测试验证安全控制措施时

前提条件

• Docker Engine 20.10+
• 已安装 Trivy v0.50+
• 用于更新漏洞数据库的互联网访问
• 容器注册表凭据（用于私有注册表）

核心概念

扫描器类型

扫描器	标志	检测内容
漏洞	--scanners vuln	操作系统软件包和库中的 CVE
错误配置	--scanners misconfig	Dockerfile/K8s 清单错误配置
密钥	--scanners secret	硬编码密码、API 密钥、令牌
许可证	--scanners license	软件许可证合规问题

严重性级别

• CRITICAL：CVSS 9.0-10.0 - 需要立即处理
• HIGH：CVSS 7.0-8.9 - 在生产部署前修复
• MEDIUM：CVSS 4.0-6.9 - 计划修复
• LOW：CVSS 0.1-3.9 - 接受或伺机修复
• UNKNOWN：未评分 - 手动评估

漏洞数据库

Trivy 使用多个漏洞数据库：

• NVD（国家漏洞数据库）
• Red Hat Security Data
• Alpine SecDB
• Debian Security Tracker
• Ubuntu CVE Tracker
• Amazon Linux Security Center
• GitHub Advisory Database

工作流

步骤 1：安装 Trivy

# Linux (apt)
sudo apt-get install wget apt-transport-https gnupg lsb-release
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt-get update && sudo apt-get install trivy

# macOS
brew install trivy

# Docker
docker pull aquasecurity/trivy:latest

步骤 2：基本镜像扫描

# Scan a public image
trivy image python:3.12-slim

# Scan with severity filter
trivy image --severity CRITICAL,HIGH nginx:latest

# Ignore unfixed vulnerabilities
trivy image --ignore-unfixed alpine:3.19

# Scan local image
docker build -t myapp:latest .
trivy image myapp:latest

# Scan from tar archive
docker save myapp:latest -o myapp.tar
trivy image --input myapp.tar

步骤 3：高级扫描选项

# All scanners (vuln + misconfig + secret + license)
trivy image --scanners vuln,misconfig,secret,license myapp:latest

# Generate SBOM in CycloneDX format
trivy image --format cyclonedx --output sbom.cdx.json myapp:latest

# Generate SBOM in SPDX format
trivy image --format spdx-json --output sbom.spdx.json myapp:latest

# JSON output for programmatic processing
trivy image --format json --output results.json myapp:latest

# SARIF output for GitHub Security tab
trivy image --format sarif --output results.sarif myapp:latest

# Template-based output
trivy image --format template --template "@contrib/html.tpl" --output report.html myapp:latest

# Scan specific layers only
trivy image --list-all-pkgs myapp:latest

步骤 4：扫描 Kubernetes 清单

# Scan Dockerfile for misconfigurations
trivy config Dockerfile

# Scan Kubernetes manifests
trivy config k8s-deployment.yaml

# Scan Helm charts
trivy config ./helm-chart/

# Scan Terraform files
trivy config ./terraform/

步骤 5：CI/CD 集成

# GitHub Actions
name: Trivy Container Scan
on: push

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH
          exit-code: 1

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: trivy-results.sarif

      - name: Generate SBOM
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: cyclonedx
          output: sbom.cdx.json

# GitLab CI
trivy-scan:
  stage: security
  image:
    name: aquasecurity/trivy:latest
    entrypoint: [""]
  script:
    - trivy image --exit-code 1 --severity CRITICAL,HIGH
        --format json --output gl-container-scanning-report.json
        $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  artifacts:
    reports:
      container_scanning: gl-container-scanning-report.json

步骤 6：使用 .trivyignore 实施策略

# .trivyignore - Ignore specific CVEs with expiry
# Accepted risk: low-impact vulnerability in dev dependency
CVE-2023-12345 exp:2025-06-01

# False positive: not exploitable in our configuration
CVE-2024-67890

# Vendor will not fix
CVE-2023-11111

步骤 7：扫描私有注册表镜像

# Docker Hub (uses ~/.docker/config.json)
trivy image myregistry.azurecr.io/myapp:latest

# ECR
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin <account>.dkr.ecr.us-east-1.amazonaws.com
trivy image <account>.dkr.ecr.us-east-1.amazonaws.com/myapp:latest

# GCR
trivy image gcr.io/my-project/myapp:latest

# With explicit credentials
TRIVY_USERNAME=user TRIVY_PASSWORD=pass trivy image registry.example.com/myapp:latest

验证命令

# Verify Trivy installation
trivy version

# Update vulnerability database
trivy image --download-db-only

# Quick scan with table output
trivy image --severity CRITICAL python:3.12

# Verify no CRITICAL vulnerabilities
trivy image --exit-code 1 --severity CRITICAL myapp:latest
echo "Exit code: $?"  # 0 = no vulns, 1 = vulns found

参考资料

• Trivy 文档
• Trivy GitHub 仓库
• Trivy GitHub Action
• Aqua Security - Trivy Scanner 指南