Trivy is a comprehensive, production-grade security scanner for container images, filesystems, Git repositories, Kubernetes clusters, cloud infrastructure (IaC), and virtual machines. It detects vulnerabilities in OS packages and language-specific dependencies, scans for IaC misconfigurations (Terraform, CloudFormation, ARM, Ansible, Helm, Dockerfile), secrets, and license compliance. The architecture is modular: a CLI entry point (`cmd/trivy/main.go`) orchestrates scanning via a file analysis engine (`pkg/fanal`), dependency parsers (`pkg/dependency/parser`), vulnerability detectors (`pkg/detector`), IaC scanners with Rego-based policies (`pkg/iac`), and multiple output formats (JSON, SARIF, CycloneDX, SPDX, table, etc.). It supports client-server mode via gRPC, a plugin system, WASM modules, and VEX/SBOM attestation integration. The codebase is well-structured with clear separation of concerns, extensive test coverage, and many reusable utility packages (parallel processing, generic sets, caching, version constraints, license expression parsing). It is actively maintained with frequent releases and a large community.
This is a Kubernetes-native security operator that automates vulnerability scanning, configuration auditing, secret scanning, RBAC assessment, infrastructure assessment, and compliance reporting for container workloads. It uses Aqua Security's Trivy as the scanning engine and stores results as custom resource definitions (VulnerabilityReport, ConfigAuditReport, ExposedSecretReport, RbacAssessmentReport, InfraAssessmentReport, SbomReport, ClusterComplianceReport). The operator runs as a controller-manager pod, watches Kubernetes resources, and creates scan jobs in-cluster. It supports multiple scan modes (standalone, client/server, filesystem, rootfs) and integrates with Prometheus for metrics, webhooks for alerting, and OPA/Rego for configurable policy evaluation. The codebase is well-structured with a plugin architecture for scanning, builder patterns for report generation, and extensive test coverage including unit, envtest, integration, and e2e tests.