{"owner":"aquasecurity","repo":"trivy","hasSkills":true,"totalSkillsCount":48,"totalTokensCount":28911,"categories":["anthropic-skill"],"hasMcp":false,"mcpConfig":null,"found":["docs/guide/references/troubleshooting.md","docs/guide/references/compatibility.md","docs/guide/references/terminology.md","docs/guide/references/abbreviations.md","docs/guide/references/configuration/config-file.md","docs/guide/references/modes/client-server.md","pkg/commands/testdata/db/metadata.json","pkg/commands/testdata/java-db/metadata.json","pkg/commands/testdata/policy/metadata.json","docs/guide/references/configuration/cli/trivy.md","docs/guide/references/configuration/cli/trivy_clean.md","docs/guide/references/modes/standalone.md","docs/guide/references/configuration/cli/trivy_config.md","docs/guide/references/configuration/cli/trivy_convert.md","docs/guide/references/configuration/cli/trivy_filesystem.md","docs/guide/references/configuration/cli/trivy_image.md","docs/guide/references/configuration/cli/trivy_kubernetes.md","docs/guide/references/configuration/cli/trivy_module.md","docs/guide/references/configuration/cli/trivy_module_install.md","docs/guide/references/configuration/cli/trivy_module_uninstall.md","docs/guide/references/configuration/cli/trivy_plugin.md","docs/guide/references/configuration/cli/trivy_plugin_info.md","docs/guide/references/configuration/cli/trivy_plugin_install.md","docs/guide/references/configuration/cli/trivy_plugin_list.md","docs/guide/references/configuration/cli/trivy_plugin_run.md","docs/guide/references/configuration/cli/trivy_plugin_search.md","docs/guide/references/configuration/cli/trivy_plugin_uninstall.md","docs/guide/references/configuration/cli/trivy_plugin_update.md","docs/guide/references/configuration/cli/trivy_plugin_upgrade.md","docs/guide/references/configuration/cli/trivy_registry.md","docs/guide/references/configuration/cli/trivy_registry_login.md","docs/guide/references/configuration/cli/trivy_registry_logout.md","docs/guide/references/configuration/cli/trivy_repository.md","docs/guide/references/configuration/cli/trivy_rootfs.md","docs/guide/references/configuration/cli/trivy_sbom.md","docs/guide/references/configuration/cli/trivy_server.md","docs/guide/references/configuration/cli/trivy_version.md","docs/guide/references/configuration/cli/trivy_vex.md","docs/guide/references/configuration/cli/trivy_vex_repo.md","docs/guide/references/configuration/cli/trivy_vex_repo_download.md","docs/guide/references/configuration/cli/trivy_vex_repo_init.md","docs/guide/references/configuration/cli/trivy_vex_repo_list.md","docs/guide/references/configuration/cli/trivy_vm.md","pkg/plugin/testdata/.trivy/plugins/index.yaml","pkg/plugin/testdata/.trivy/plugins/test_plugin/plugin.yaml","pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package1/package.json","pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package2/package.json","pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/utils/util1/package.json"],"skills":{"docs/guide/references/troubleshooting.md":"# Troubleshooting\n\n## Scan\n### Timeout\n\n!!! error\n ``` bash\n $ trivy image ...\n ...\n analyze error: timeout: context deadline exceeded\n ```\n\nYour scan may time out. Java takes a particularly long time to scan. Try increasing the value of the `--timeout` option such as `--timeout 15m`.\n\n### Unable to initialize an image scanner\n\n!!! error\n ```bash\n $ trivy image ...\n ...\n 2024-01-19T08:15:33.288Z\tFATAL\timage scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: 4 errors occurred:\n\t* docker error: unable to inspect the image (ContainerImageName): Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?\n\t* containerd error: containerd socket not found: /run/containerd/containerd.sock\n\t* podman error: unable to initialize Podman client: no podman socket found: stat podman/podman.sock: no such file or directory\n\t* remote error: GET https://index.docker.io/v2/ContainerImageName: MANIFEST_UNKNOWN: manifest unknown; unknown tag=0.1\n ```\n \nIt means Trivy is unable to find the container image in the following places:\n\n* Docker Engine\n* containerd\n* Podman\n* A remote registry\n\nPlease see error messages for details of each error.\n\nCommon mistakes include the following, depending on where you are pulling images from:\n\n#### Common\n- Typos in the image name\n - Common mistake :)\n- Forgetting to specify the registry\n - By default, it is considered to be Docker Hub ( `index.docker.io` ).\n\n#### Docker Engine\n- Incorrect Docker host\n - If the Docker daemon's socket path is not `/var/run/docker.sock`, you need to specify the `--docker-host` flag or the `DOCKER_HOST` environment variable.\n The same applies when using TCP; you must specify the correct host address.\n\n#### containerd\n- Incorrect containerd address\n - If you are using a non-default path, you need to specify the `CONTAINERD_ADDRESS` environment variable.\n Please refer to [this documentation](../target/container_image.md#containerd).\n- Incorrect namespace\n - If you are using a non-default namespace, you need to specify the `CONTAINERD_NAMESPACE` environment variable.\n Please refer to [this documentation](../target/container_image.md#containerd).\n - \n#### Podman\n- Podman socket configuration\n - You need to enable the Podman socket. Please refer to [this documentation](../target/container_image.md#podman).\n\n#### Container Registry\n- Unauthenticated\n - If you are using a private container registry, you need to authenticate. Please refer to [this documentation](../advanced/private-registries/index.md).\n- Using a proxy\n - If you are using a proxy within your network, you need to correctly set the `HTTP_PROXY`, `HTTPS_PROXY`, etc., environment variables.\n- Use of a self-signed certificate in the registry\n - Because certificate verification will fail, you need to either trust that certificate or use the `--insecure` flag (not recommended in production).\n\n### Certification\n\n!!! error\n Error: x509: certificate signed by unknown authority\n\n`TRIVY_INSECURE` can be used to allow insecure connections to a container registry when using SSL.\n\n```\n$ TRIVY_INSECURE=true trivy image [YOUR_IMAGE]\n```\n\nIf you need to trust a custom CA certificate, you can provide a PEM-encoded bundle.\n\n=== \"Unix (except macOS)\"\n\n You can specify the location of your certificate using the `SSL_CERT_FILE` or `SSL_CERT_DIR` environment variables.\n\n ```bash\n $ SSL_CERT_FILE=/path/to/ca.pem trivy image [YOUR_IMAGE]\n ```\n\n ```bash\n $ SSL_CERT_DIR=/path/to/certs trivy image [YOUR_IMAGE]\n ```\n\n=== \"All systems\"\n\n Use the `--cacert` flag to point Trivy to a PEM-encoded CA certificate file, regardless of the operating system.\n\n ```bash\n $ trivy image --cacert /path/to/ca.pem [YOUR_IMAGE]\n ```\n\n### GitHub Rate limiting\nTrivy uses GitHub API for [VEX repositories](../supply-chain/vex/repo.md).\n\n!!! error\n ``` bash\n $ trivy image --vex repo ...\n ...\n API rate limit exceeded for xxx.xxx.xxx.xxx.\n ```\n\nSpecify GITHUB_TOKEN for [authentication](https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api?apiVersion=2022-11-28)\n\n```\n$ GITHUB_TOKEN=XXXXXXXXXX trivy image --vex repo [YOUR_IMAGE]\n```\n\n!!! note\n `GITHUB_TOKEN` doesn't help with the rate limit for the vulnerability database and other assets.\n See https://github.com/aquasecurity/trivy/discussions/8009\n\n### Maven Central rate limiting (HTTP 429)\n\nWhen scanning Java projects, Trivy resolves transitive dependencies by downloading POM files from Maven Central (or any other configured remote Maven repository) when they are missing from the local `~/.m2` cache. Remote Maven repositories typically rate-limit per IP and return `429 Too Many Requests` once the limit is exceeded; scans of large projects with an empty local cache routinely run into this.\n\n!!! error\n ```\n FATAL Error remote Maven repository returned 429 Too Many Requests for https://repo.maven.apache.org/maven2/.../-.pom. Retry-After: 1800.\n The repository blocks all subsequent requests from this IP until the block clears.\n To avoid this, populate the local Maven cache before scanning (e.g. run `mvn dependency:resolve`, or `mvn install` for a multi-module project, and cache ~/.m2 in CI).\n ```\n\nThe block applies to *all* subsequent requests from the affected IP for the duration indicated by `Retry-After`, regardless of whether the artifact would otherwise be served from a cache layer. The wait depends on the repository's policy — for Maven Central it is typically tens of minutes on the first violation and grows on repeat — so Trivy fails fast on the first `429` rather than retrying and risking an extended block.\n\nRecommended mitigations:\n\n- **Populate `~/.m2` before scanning.** Run `mvn dependency:resolve` (or any build step that resolves dependencies) so that every POM is cached locally. In CI, cache the `~/.m2` directory between runs (e.g. keyed on `pom.xml` checksums) so subsequent runs reuse the artifacts.\n - For a multi-module project run `mvn install -DskipTests` instead. Goals that only resolve dependencies cache third-party artifacts, but not the artifacts of your own project — Maven takes those from the reactor, so a module that depends on a sibling module still triggers remote lookups.\n- **Configure mirrors** of the rate-limited repository, so that POM lookups go to a host that isn't blocking you. There are two ways to do it:\n - `` in Maven's [settings.xml][maven-mirror-settings] — the standard mechanism, honored by `mvn` itself as well. A repository is served by a single mirror, so a mirror that is rate-limited too leaves nothing to fall back on.\n - [scan.maven.mirrors][maven-mirrors] in `trivy.yaml` — Trivy-specific, and takes an ordered list of mirrors per repository. A mirror that returns `429` is skipped in favor of the next one, and if the remaining mirrors do not return the artifact, the scan stops and reports the `429`.\n- **Wait for the block to expire.** The `Retry-After` value in the error tells you the minimum wait. Repeated scans during the block will extend it.\n- **Use `--offline-scan`** to skip remote lookups entirely and rely only on the local `~/.m2` cache. Be careful: any transitive POM missing from the cache is silently skipped, so populate `~/.m2` first (see above) — otherwise the dependency tree will be incomplete.\n\n### Unable to open JAR files\n\n!!! error\n ``` bash\n $ trivy image ...\n ...\n failed to analyze file: failed to analyze usr/lib/jvm/java-1.8-openjdk/lib/tools.jar: unable to open usr/lib/jvm/java-1.8-openjdk/lib/tools.jar: failed to open: unable to read the file: stream error: stream ID 9; PROTOCOL_ERROR; received from peer\n ```\n\nCurrently, we're investigating this issue. As a temporary mitigation, you may be able to avoid this issue by downloading the Java DB in advance.\n\n```shell\n$ trivy image --download-java-db-only\n2023-02-01T16:57:04.322+0900 INFO Downloading the Java DB...\n$ trivy image [YOUR_JAVA_IMAGE]\n```\n\n### Cache lock errors\n\n!!! error\n ```\n cache may be in use by another process\n ```\n\nTrivy's vulnerability database is opened in read-only mode, so it does not cause lock issues. Lock errors occur only when using filesystem cache for scan cache storage.\n\nFilesystem cache uses BoltDB internally, which creates file locks to prevent data corruption. As stated in the BoltDB documentation:\n\n> Please note that Bolt obtains a file lock on the data file so multiple processes cannot open the same database at the same time. Opening an already open Bolt database will cause it to hang until the other process closes it.\n\nReference: [BoltDB README](https://github.com/boltdb/bolt#opening-a-database)\n\nIf you're using memory cache (default for some commands like `fs`, `rootfs`, `config`, and `sbom`) or external cache (Redis), you will not encounter lock errors. Lock issues only occur when using filesystem cache with multiple concurrent processes.\nSee [Cache Backend](../configuration/cache.md#scan-cache-backend) for more details.\n\nThese errors occur when:\n\n- Multiple Trivy processes try to use the same filesystem cache directory simultaneously\n- A previous Trivy process did not shut down cleanly\n- Trivy server is running with filesystem cache and holding a lock on the cache\n\n#### Solutions\n\n**Solution 1: Use memory cache or Redis cache** (Recommended)\n\nMemory cache is the default for some commands (e.g., `fs`, `rootfs`, `config`, `sbom`). For other commands like image scanning, you can use `--cache-backend memory` to enable concurrent execution:\n\n```bash\n$ trivy image --cache-backend memory debian:11 &\n$ trivy image --cache-backend memory debian:12 &\n```\n\nNote that memory cache does not persist scan results, so subsequent scans will take longer as layers need to be scanned again each time.\n\nFor server mode or persistent cache with concurrent access, use Redis cache:\n\n```bash\n$ trivy server --cache-backend redis://localhost:6379\n```\n\n**Solution 2: Terminate conflicting processes**\n\nIf you need to use filesystem cache, check for running Trivy processes and terminate them:\n\n```bash\n$ ps aux | grep trivy\n$ kill [process_id]\n```\n\n**Solution 3: Use different cache directories**\n\nIf you must run multiple Trivy processes with filesystem cache, specify different cache directories for each process:\n\n```bash\n$ trivy image --cache-dir /tmp/trivy-cache-1 debian:11 &\n$ trivy image --cache-dir /tmp/trivy-cache-2 debian:12 &\n```\n\nNote that each cache directory will download its own copy of the vulnerability database and other scan assets, which will increase network traffic and storage usage.\n\n### Multiple Trivy servers\n\n!!! error\n ```\n $ trivy image --server http://xxx.com:xxxx test-image\n ...\n - twirp error internal: failed scan, test-image: failed to apply layers: layer cache missing: sha256:*****\n ```\nTo run multiple Trivy servers, you need to use Redis as the cache backend so that those servers can share the cache. \nFollow [this instruction][redis-cache] to do so.\n\n\n### Problems with `/tmp` on remote Git repository scans\n\n!!! error\n FATAL repository scan error: scan error: unable to initialize a scanner: unable to initialize a filesystem scanner: git clone error: write /tmp/fanal-remote...\n\nTrivy clones remote Git repositories under the `/tmp` directory before scanning them. If `/tmp` doesn't work for you, you can change it by setting the `TMPDIR` environment variable.\n\nTry:\n\n```\n$ TMPDIR=/my/custom/path trivy repo ...\n```\n\n### Running out of space during image scans\n\n!!! error\n ``` bash\n image scan failed:\n failed to copy the image:\n write /tmp/fanal-3323732142: no space left on device\n ```\n\nTrivy uses a temporary directory during image scans.\nThe directory path would be determined as follows:\n\n- On Unix systems: Use `$TMPDIR` if non-empty, else `/tmp`.\n- On Windows: Uses GetTempPath, returning the first non-empty value from `%TMP%`, `%TEMP%`, `%USERPROFILE%`, or the Windows directory.\n\nSee [this documentation](https://golang.org/pkg/os/#TempDir) for more details.\n\nIf the image is large or the temporary directory has insufficient space, the scan will fail.\nYou can configure the directory path to redirect Trivy to a directory with adequate storage.\nOn Unix systems, you can set the `$TMPDIR` environment variable.\n\n```\n$ TMPDIR=/my/custom/path trivy image ...\n```\n\nWhen scanning images from a container registry, Trivy processes each layer by streaming, loading only the necessary files for the scan into memory and discarding unnecessary files.\nIf a layer contains large files that are necessary for the scan (such as JAR files or binary files), Trivy saves them to a temporary directory (e.g. $TMPDIR) on local storage to avoid increased memory consumption.\nAlthough these files are deleted after the scan is complete, they can temporarily increase disk consumption and potentially exhaust storage.\nIn such cases, there are currently three workarounds:\n\n1. Use a temporary directory with sufficient capacity\n \n This is the same as explained above.\n \n2. Specify a small value for `--parallel`\n \n By default, multiple layers are processed in parallel.\n If each layer contains large files, disk space may be consumed rapidly.\n By specifying a small value such as `--parallel 1`, parallelism is reduced, which can mitigate the issue.\n\n3. Specify `--skip-files` or `--skip-dirs`\n \n If the container image contains large files that do not need to be scanned, you can skip their processing by specifying --skip-files or --skip-dirs. \n For more details, please refer to [this documentation](../configuration/skipping.md).\n\n## DB\n### Old DB schema\n\n!!! error\n --skip-update cannot be specified with the old DB schema.\n\nTrivy v0.23.0 or later requires Trivy DB v2. Please update your local database or follow [the instruction of air-gapped environment][air-gapped].\n\n### Error downloading vulnerability DB\n\n!!! error\n FATAL failed to download vulnerability DB\n\nIf Trivy is running behind corporate firewall, refer to the necessary connectivity requirements as described [here][network].\n\n### Denied\n\n!!! error\n GET https://ghcr.io/token?scope=repository%3Aaquasecurity%2Ftrivy-db%3Apull&service=ghcr.io: DENIED: denied\n\nYour local GHCR (GitHub Container Registry) token might be expired.\nPlease remove the token and try downloading the DB again.\n\n```shell\ndocker logout ghcr.io\n```\n\nor\n\n```shell\nunset GITHUB_TOKEN\n```\n\n## Debugging\n### HTTP Request/Response Tracing\n\nFor debugging network issues, connection problems, or authentication failures, you can enable HTTP request/response tracing using the `--trace-http` flag.\n\n!!! danger \"Security Warning\"\n While Trivy attempts to redact known sensitive information such as authentication headers and common secrets, the `--trace-http` flag may still expose sensitive data in HTTP requests and responses.\n \n **Never use this flag in production environments or CI/CD pipelines.**\n This flag is automatically disabled in CI environments for security.\n\n```bash\n# Enable HTTP tracing for debugging registry issues\n$ trivy image --trace-http registry.example.com/my-image:latest\n\n# HTTP tracing with other debugging options\n$ trivy image --trace-http --debug --insecure my-image:tag\n```\n\n## Others\n### Unknown error\n\nTry again after running `trivy clean --all`:\n\n```\n$ trivy clean --all\n```\n\n[air-gapped]: ../advanced/air-gap.md\n[maven-mirror-settings]: https://maven.apache.org/guides/mini/guide-mirror-settings.html\n[maven-mirrors]: ../coverage/language/java.md#config-file-mirrors\n[network]: ../advanced/air-gap.md#connectivity-requirements\n[redis-cache]: ../configuration/cache.md#redis\n","docs/guide/references/compatibility.md":"# Compatibility and Stability\n\nTrivy is designed, distributed, and supported primarily as a CLI application.\n\nThe Trivy project strives to preserve compatibility between releases for documented user-facing interfaces, except for features explicitly marked as experimental or subject to change. Unintended compatibility issues in stable interfaces are generally treated as bugs.\n\n## Stable Interfaces\n\nThe following interfaces documented in the official Trivy documentation are covered by this compatibility policy:\n\n- CLI commands, subcommands, flags, and arguments\n- Configuration file options and environment variables\n- Exit codes and the conditions under which they are returned\n- Machine-readable output formats\n- Data fields used by custom templates\n\nAdding a new command, flag, configuration option, or output field is considered compatible as long as it does not change existing usage.\n\nWhen the documentation and implementation disagree, neither is automatically considered authoritative. We determine the intended behavior by considering existing usage, user impact, and consistency with other features, and then correct either the implementation or the documentation.\n\nTrivy's JSON output includes a `SchemaVersion` that identifies the output structure. Within the same `SchemaVersion`, optional fields may be added or omitted, so consumers should ignore unknown fields and must not assume that optional fields are always present. Removing or renaming an existing field, changing its type, or changing its meaning incompatibly generally requires an update to `SchemaVersion` and is documented as a breaking change in the release notes.\n\n## Interfaces Outside the Compatibility Policy\n\nThe following are not part of Trivy's stable user-facing interfaces:\n\n- Go packages, types, functions, methods, and other Go APIs in the Trivy repository\n- Required versions of Go, Mage, and other build tools, as well as development commands and build scripts\n- The exact formatting of terminal output, logs, warnings, error messages, and progress displays\n- Scan results, including detected vulnerabilities, misconfigurations, secrets, and licenses, as well as their content and ordering\n- Internal formats and protocols, such as caches, vulnerability databases, on-disk data, internal RPC, and Protocol Buffers definitions\n- Compatibility between different versions of the Trivy client and Trivy server\n- Experimental or preview features, canary builds, and prerelease versions\n- Changes in behavior or coverage caused by external specifications, services, platforms, or data sources\n\nTrivy is not designed or supported for use as a Go library. Interfaces outside this policy may be changed or removed without a deprecation period.\n\nEven if such a change breaks external code or a custom build procedure, it is not, by itself, considered a breaking change to the Trivy CLI. As a rule, these changes are not identified as breaking changes in the release notes or announced separately. Users should not assume that they will be announced in advance.\n\n## Scan Asset Version Support\n\nSome [scan assets](terminology.md#scan-assets) use versioned formats that are tied to particular Trivy CLI versions:\n\n- Vulnerability Database ([trivy-db](https://github.com/aquasecurity/trivy-db)): schema version\n- Java Index Database ([trivy-java-db](https://github.com/aquasecurity/trivy-java-db)): schema version\n- Checks Bundle ([trivy-checks](https://github.com/aquasecurity/trivy-checks)): major version\n\nEach Trivy CLI version is compatible with particular versions of these assets.\n\nWhen updates for an older scan asset version end, Trivy CLI versions that depend on it can no longer receive newly published vulnerability information, Java artifact identification data, or misconfiguration checks from that asset.\n\nBefore ending updates for a scan asset version, the Trivy project announces the affected CLI versions, the end date for updates, and the minimum CLI version to which users should upgrade. A scan asset version change is not considered a breaking change to the Trivy CLI. However, because users must upgrade to continue receiving current scan asset updates, it is announced separately from ordinary internal changes.\n\n## Breaking Changes\n\nA change that requires users to modify an existing valid use of a stable interface is considered a breaking change.\n\nWhen a breaking change is necessary, we identify it in the release notes and provide migration guidance whenever possible. We announce a deprecation before making the change when practical, but do not guarantee a fixed deprecation period for every interface.\n\nThe usual deprecation process may not be possible when responding to an urgent security issue, an incompatible change in an external system, an obvious bug, or a risk of significant false positives, false negatives, data corruption, or other safety issues. Even in these cases, we describe changes with significant user impact in the release notes whenever possible.\n","docs/guide/references/terminology.md":"# Terminology\n\nThis page explains the terminology system used in Trivy, helping users understand the specific terms and concepts unique to the Trivy ecosystem.\n\n**Inclusion Criteria**\n\n1. Core Components of Trivy\n - Primary features such as Scanner, Target\n - Essential components such as Scan Assets (trivy-db, trivy-java-db)\n - Components that users directly interact with\n\n2. Trivy-specific Terms\n - Terms unique to Trivy (e.g., VEX Hub)\n - Terms that have special meaning in Trivy's context (e.g., Plugin, Module)\n\n**Exclusion Criteria**\n\n1. General Terms\n - Common security/technical terms (e.g., CVE, CVSS, Container, Registry)\n - Standard industry terminology\n\n2. Implementation Details\n - Internal workings of components\n - Usage instructions (these belong in feature documentation)\n\n\n## Core Concepts\n\n### Target\nTypes of artifacts that Trivy can scan, like container images and filesystem.\n\n### Scanner\nTrivy's built-in security scanning engines. Trivy has four main scanners:\n\n- [Vulnerability Scanner](../scanner/vulnerability.md)\n- [Misconfiguration Scanner](../scanner/misconfiguration/index.md)\n- [Secret Scanner](../scanner/secret.md)\n- [License Scanner](../scanner/license.md)\n\n!!! note\n SBOM is not a scanner but an output format option.\n\n### Scan Assets\nExternal data that Trivy downloads (if needed for scanner) and uses during scanning:\n\n- [Vulnerability Database (Trivy DB, trivy-db)](#vulnerability-database-trivy-db-trivy-db): Database containing vulnerability information\n- [Java Index Database (Trivy Java DB, trivy-java-db)](#java-index-database-trivy-java-db-trivy-java-db): Database for Java artifact identification\n- [Checks Bundle (trivy-checks)](#checks-bundle): Archive containing misconfiguration detection rules\n- [VEX Repository](#vex-repository): Repository containing VEX documents\n\n## Vulnerability Scanning\n\n### Vulnerability Database (Trivy DB, trivy-db)\nThe core vulnerability database required for vulnerability detection.\nContains comprehensive vulnerability information for multiple ecosystems.\nDistributed via OCI registry.\n\nManaged at https://github.com/aquasecurity/trivy-db.\n\nThe vulnerability database is built from a GitHub repository that collects and stores vulnerability information from various data sources.\nThis repository serves as the foundation for building the Trivy DB.\n\nManaged at:\n\n- https://github.com/aquasecurity/vuln-list\n- https://github.com/aquasecurity/vuln-list-nvd\n- https://github.com/aquasecurity/vuln-list-redhat\n- https://github.com/aquasecurity/vuln-list-debian\n- etc.\n\n### Java Index Database (Trivy Java DB, trivy-java-db)\nSpecialized database used for identifying Java libraries and their components during JAR/WAR/PAR/EAR scanning.\nDistributed via OCI registry.\n\nManaged at https://github.com/aquasecurity/trivy-java-db.\n\n\n## Misconfiguration Scanning\nWhen the context does not clearly indicate these terms are related to misconfiguration scanning, they may be prefixed with \"Misconfiguration\" for clarity.\nFor example, \"Check\" may be referred to as \"Misconfiguration Check\", and \"Checks Bundle\" as \"Misconfiguration Checks Bundle\".\n\n### Check\nA Rego file that defines rules for detecting misconfigurations in various types of IaC files.\n\n### Built-in Checks\nDefault set of checks distributed through [the trivy-checks repository](https://github.com/aquasecurity/trivy-checks), providing standard security and configuration best practices.\n\n### Checks Bundle\nA tar.gz archive containing [the built-in checks](#built-in-checks), distributed via OCI registry.\n\n## Secret Scanning\n\n### Rule\nPattern matching rules used to detect hardcoded secrets and sensitive information.\nEach rule consists of:\n\n- Metadata (ID, Category, Title, etc.)\n- Regular expressions for matching sensitive patterns\n- Additional context for detection accuracy\n\n## Kubernetes Integration\n\n### KBOM (Kubernetes Bill of Materials)\nA specialized SBOM format for Kubernetes clusters that includes detailed information about the cluster's components.\n\n## VEX (Vulnerability Exploitability eXchange)\n\n### VEX Repository\nA repository system that stores VEX documents following [the VEX Repository Specification](https://github.com/aquasecurity/vex-repo-spec).\nVEX repositories help users manage and share information about vulnerability applicability and exploitability.\n\nFor detailed information about VEX repositories, see [the document](../supply-chain/vex/repo.md).\n\n### VEX Hub\nThe default VEX repository managed by Aqua Security at https://github.com/aquasecurity/vexhub.\nIt primarily aggregates VEX documents published by package maintainers in their source repositories.\nVEX Hub serves as a central point for collecting and distributing vulnerability applicability information for OSS projects.\n\n## Cache System\n\n### Cache Types\nThe cache directory contains several distinct types of data:\n\n- [Vulnerability Database](#vulnerability-database-trivy-db-trivy-db)\n- [Java Index Database](#java-index-database-trivy-java-db-trivy-java-db)\n- [Misconfiguration Checks](#misconfiguration-scanning)\n- [VEX Repositories](#vex-repository)\n- [Scan Cache](#scan-cache)\n\n### Asset Cache\nDownloaded assets like vulnerability databases and Java index databases.\n\n### Scan Cache\nA caching mechanism that stores analysis results from previous scans to speed up subsequent scans.\nFor container image scanning, the scan cache stores analysis results including package names and versions per layer.\n\nFor detailed information about caching, see [the document](../configuration/cache.md).\n\n## Plugin System\n\n### Plugin\nAn add-on tool that integrates with Trivy to extend its core functionality.\nPlugins can be written in any programming language and integrate seamlessly with Trivy CLI, appearing in Trivy help and subcommands.\nThey can be installed and removed independently without affecting the core Trivy installation.\n\nFor detailed information about plugins, see [the document](../plugin/index.md).\n\n### Plugin Index (trivy-plugin-index)\nA centralized registry that lists available Trivy plugins, managed at https://github.com/aquasecurity/trivy-plugin-index.\nThe index maintains a curated list of official and community plugins, providing metadata such as plugin names, descriptions, and maintainers.\nIt enables plugin discovery through the `trivy plugin search` command and facilitates automatic plugin installation and updates.\n\nFor detailed information about the plugin index, see [the document](../plugin/user-guide.md).\n\n## Module System\n### Module\nA WebAssembly-based extension mechanism that allows custom scanning logic without modifying the Trivy binary.\nModules can modify scan results by analyzing files or post-processing results.\n\nFor detailed information about modules, see [the document](../advanced/modules.md).","docs/guide/references/abbreviations.md":"# Abbreviation List\n\nThis list compiles words that frequently appear in CLI flags or configuration files and are commonly abbreviated in industry and OSS communities.\nTrivy may use the abbreviation in place of the full spelling for flag names.\nIt is also acceptable to add even shorter aliases if needed.\n\nWords not included in this list should be spelled out in full when used in flags.\n\nThis list is intentionally limited to the most common and widely recognized abbreviations.\nExcessive use of abbreviations in CLI flags can hinder initial user understanding and create a steeper learning curve.\n\n!!! note\n This list serves as a guideline rather than a strict requirement.\n Its purpose is to maintain consistency across the project when naming flags and configuration options.\n While we strive to follow these abbreviations, there may be exceptions where context or clarity demands a different approach.\n\n## Scope\nThis list focuses on abbreviations of single words commonly used in technical contexts. It does not include:\n\n1. Acronyms formed from the initial letters of multiple words (e.g., OS for Operating System, HTTP for Hypertext Transfer Protocol)\n2. Domain-specific terminology that already has standardized short forms\n3. Brand names or product-specific abbreviations\n\nThe abbreviations listed here are primarily intended for CLI flags, configuration keys, and similar technical interfaces where brevity is valued while maintaining clarity.\n\n## Example\nFor a flag containing multiple words, only abbreviate words that appear in this list.\nFor instance, in `--database-repository`, \"database\" is in the list so it should be abbreviated to \"db\", but \"repository\" is not in the list so it must be spelled out completely.\nThe correct flag name would be `--db-repository`.\nIt's acceptable to add a shorter alias like `--db-repo` if desired.\n\n## List\n\n| Full Name | Default Abbreviation | Examples |\n|-------------------|----------------------|-----------------------------------------------------------|\n| application | app | `--app-name`, `--app-mode` |\n| authentication | auth | `--auth-method`, `--auth-token` |\n| authorization | authz | `--authz-rule`, `--authz-policy` |\n| command | cmd | `--cmd-option`, `--cmd-args` |\n| configuration | config | `--config`, `--config-dir` |\n| database | db | `--db-repository`, `--db-user`, `--db-pass` |\n| development | dev | `--dev-dependencies`, `--dev-mode` |\n| directory | dir | `--dir-path`, `--output-dir` |\n| environment | env | `--env-file`, `--env-vars` |\n| information | info | `--info-level`, `--show-info` |\n| initialization | init | `--init-script`, `--init-config` |\n| library | lib | `--lib-path`, `--lib-dir` |\n| maximum | max | `--max-image-size`, `--max-depth` |\n| minimum | min | `--min-value`, `--min-severity` |\n| misconfiguration | misconfig | `--misconfig-scanners` |\n| package | pkg | `--pkg-types` |\n| production | prod | `--prod-env`, `--prod-deploy` |\n| specification | spec | `--spec-file`, `--spec-version` |\n| temporary | tmp | `--tmp-dir`, `--tmp-file` |\n| utility | util | `--util-script`, `--util-name` |\n| vulnerability | vuln | `--vuln-scan`, `--vuln-report` |","docs/guide/references/configuration/config-file.md":"# Config file\n\nTrivy can be customized by tweaking a `trivy.yaml` file.\nThe config path can be overridden by the `--config` flag.\n\nAn example is [here][example] and a [JSON Schema][schema] is also available.\n\nThese samples contain default values for flags.\n## Global options\n\n```yaml\n# Same as '--cacert'\ncacert: \"\"\n\ncache:\n # Same as '--cache-dir'\n dir: \"/path/to/cache\"\n\n# Same as '--debug'\ndebug: false\n\n# Same as '--insecure'\ninsecure: false\n\n# Same as '--quiet'\nquiet: false\n\n# Same as '--timeout'\ntimeout: 5m0s\n\n```\n## Cache options\n\n```yaml\ncache:\n # Same as '--cache-backend'\n backend: \"fs\"\n\n redis:\n # Same as '--redis-ca'\n ca: \"\"\n\n # Same as '--redis-cert'\n cert: \"\"\n\n # Same as '--redis-key'\n key: \"\"\n\n # Same as '--redis-tls'\n tls: false\n\n # Same as '--cache-ttl'\n ttl: 0s\n\n```\n## Clean options\n\n```yaml\nclean:\n # Same as '--all'\n all: false\n\n # Same as '--checks-bundle'\n checks-bundle: false\n\n # Same as '--java-db'\n java-db: false\n\n # Same as '--scan-cache'\n scan-cache: false\n\n # Same as '--vex-repo'\n vex-repo: false\n\n # Same as '--vuln-db'\n vuln-db: false\n\n```\n## Client/Server options\n\n```yaml\nserver:\n # Same as '--server'\n addr: \"\"\n\n # Same as '--custom-headers'\n custom-headers: []\n\n # Same as '--listen'\n listen: \"localhost:4954\"\n\n # Same as '--token'\n token: \"\"\n\n # Same as '--token-header'\n token-header: \"Trivy-Token\"\n\n```\n## DB options\n\n```yaml\ndb:\n # Same as '--download-java-db-only'\n download-java-only: false\n\n # Same as '--download-db-only'\n download-only: false\n\n # Same as '--java-db-repository'\n java-repository:\n - mirror.gcr.io/aquasec/trivy-java-db:1\n - ghcr.io/aquasecurity/trivy-java-db:1\n\n # Same as '--skip-java-db-update'\n java-skip-update: false\n\n # Same as '--no-progress'\n no-progress: false\n\n # Same as '--db-repository'\n repository:\n - mirror.gcr.io/aquasec/trivy-db:2\n - ghcr.io/aquasecurity/trivy-db:2\n\n # Same as '--skip-db-update'\n skip-update: false\n\n```\n## Image options\n\n```yaml\nimage:\n docker:\n # Same as '--docker-host'\n host: \"\"\n\n # Same as '--image-config-scanners'\n image-config-scanners: []\n\n # Same as '--input'\n input: \"\"\n\n # Same as '--max-image-size'\n max-size: \"\"\n\n # Same as '--platform'\n platform: \"\"\n\n podman:\n # Same as '--podman-host'\n host: \"\"\n\n # Same as '--removed-pkgs'\n removed-pkgs: false\n\n # Same as '--image-src'\n source:\n - docker\n - containerd\n - podman\n - remote\n\n```\n## Kubernetes options\n\n```yaml\nkubernetes:\n # Same as '--burst'\n burst: 10\n\n # Same as '--disable-node-collector'\n disableNodeCollector: false\n\n exclude:\n # Same as '--exclude-nodes'\n nodes: []\n\n # Same as '--exclude-owned'\n owned: false\n\n # Same as '--exclude-kinds'\n excludeKinds: []\n\n # Same as '--exclude-namespaces'\n excludeNamespaces: []\n\n # Same as '--include-kinds'\n includeKinds: []\n\n # Same as '--include-namespaces'\n includeNamespaces: []\n\n # Same as '--k8s-version'\n k8s-version: \"\"\n\n # Same as '--kubeconfig'\n kubeconfig: \"\"\n\n node-collector:\n # Same as '--node-collector-imageref'\n imageref: \"ghcr.io/aquasecurity/node-collector:0.3.1\"\n\n # Same as '--node-collector-namespace'\n namespace: \"trivy-temp\"\n\n # Same as '--qps'\n qps: 5\n\n # Same as '--skip-images'\n skipImages: false\n\n # Same as '--tolerations'\n tolerations: []\n\n```\n## License options\n\n```yaml\nlicense:\n # Same as '--license-confidence-level'\n confidenceLevel: 0.9\n\n forbidden:\n - AGPL-1.0\n - AGPL-3.0\n - CC-BY-NC-1.0\n - CC-BY-NC-2.0\n - CC-BY-NC-2.5\n - CC-BY-NC-3.0\n - CC-BY-NC-4.0\n - CC-BY-NC-ND-1.0\n - CC-BY-NC-ND-2.0\n - CC-BY-NC-ND-2.5\n - CC-BY-NC-ND-3.0\n - CC-BY-NC-ND-4.0\n - CC-BY-NC-SA-1.0\n - CC-BY-NC-SA-2.0\n - CC-BY-NC-SA-2.5\n - CC-BY-NC-SA-3.0\n - CC-BY-NC-SA-4.0\n - Commons-Clause\n - Facebook-2-Clause\n - Facebook-3-Clause\n - Facebook-Examples\n - WTFPL\n\n # Same as '--license-full'\n full: false\n\n # Same as '--ignored-licenses'\n ignored: []\n\n notice:\n - AFL-1.1\n - AFL-1.2\n - AFL-2.0\n - AFL-2.1\n - AFL-3.0\n - Apache-1.0\n - Apache-1.1\n - Apache-2.0\n - Artistic-1.0-cl8\n - Artistic-1.0-Perl\n - Artistic-1.0\n - Artistic-2.0\n - BSL-1.0\n - BSD-1-Clause\n - BSD-2-Clause-FreeBSD\n - BSD-2-Clause-NetBSD\n - BSD-2-Clause\n - BSD-3-Clause-Attribution\n - BSD-3-Clause-Clear\n - BSD-3-Clause-LBNL\n - BSD-3-Clause\n - BSD-4-Clause\n - BSD-4-Clause-UC\n - BSD-Protection\n - CC-BY-1.0\n - CC-BY-2.0\n - CC-BY-2.5\n - CC-BY-3.0\n - CC-BY-4.0\n - FTL\n - ISC\n - ImageMagick\n - Libpng\n - Lil-1.0\n - Linux-OpenIB\n - LPL-1.02\n - LPL-1.0\n - MS-PL\n - MIT\n - NCSA\n - OpenSSL\n - PHP-3.01\n - PHP-3.0\n - PIL\n - Python-2.0\n - Python-2.0-complete\n - PostgreSQL\n - SGI-B-1.0\n - SGI-B-1.1\n - SGI-B-2.0\n - Unicode-DFS-2015\n - Unicode-DFS-2016\n - Unicode-TOU\n - UPL-1.0\n - W3C-19980720\n - W3C-20150513\n - W3C\n - X11\n - Xnet\n - Zend-2.0\n - zlib-acknowledgement\n - Zlib\n - ZPL-1.1\n - ZPL-2.0\n - ZPL-2.1\n\n permissive: []\n\n reciprocal:\n - APSL-1.0\n - APSL-1.1\n - APSL-1.2\n - APSL-2.0\n - CDDL-1.0\n - CDDL-1.1\n - CPL-1.0\n - EPL-1.0\n - EPL-2.0\n - FreeImage\n - IPL-1.0\n - MPL-1.0\n - MPL-1.1\n - MPL-2.0\n - Ruby\n\n restricted:\n - BCL\n - CC-BY-ND-1.0\n - CC-BY-ND-2.0\n - CC-BY-ND-2.5\n - CC-BY-ND-3.0\n - CC-BY-ND-4.0\n - CC-BY-SA-1.0\n - CC-BY-SA-2.0\n - CC-BY-SA-2.5\n - CC-BY-SA-3.0\n - CC-BY-SA-4.0\n - GPL-1.0\n - GPL-2.0\n - GPL-2.0-with-autoconf-exception\n - GPL-2.0-with-bison-exception\n - GPL-2.0-with-classpath-exception\n - GPL-2.0-with-font-exception\n - GPL-2.0-with-GCC-exception\n - GPL-3.0\n - GPL-3.0-with-autoconf-exception\n - GPL-3.0-with-GCC-exception\n - LGPL-2.0\n - LGPL-2.1\n - LGPL-3.0\n - NPL-1.0\n - NPL-1.1\n - OSL-1.0\n - OSL-1.1\n - OSL-2.0\n - OSL-2.1\n - OSL-3.0\n - QPL-1.0\n - Sleepycat\n\n unencumbered:\n - CC0-1.0\n - Unlicense\n - 0BSD\n\n```\n## Misconfiguration options\n\n```yaml\nansible:\n # Same as '--ansible-extra-vars'\n extra-vars: []\n\n # Same as '--ansible-inventory'\n inventories: []\n\n # Same as '--ansible-playbook'\n playbooks: []\n\nmisconfiguration:\n # Same as '--checks-bundle-repository'\n checks-bundle-repository: \"mirror.gcr.io/aquasec/trivy-checks:2\"\n\n cloudformation:\n # Same as '--cf-params'\n params: []\n\n # Same as '--config-file-schemas'\n config-file-schemas: []\n\n helm:\n # Same as '--helm-api-versions'\n api-versions: []\n\n # Same as '--helm-kube-version'\n kube-version: \"\"\n\n # Same as '--helm-set'\n set: []\n\n # Same as '--helm-set-file'\n set-file: []\n\n # Same as '--helm-set-string'\n set-string: []\n\n # Same as '--helm-values'\n values: []\n\n # Same as '--include-non-failures'\n include-non-failures: false\n\n # Same as '--raw-config-scanners'\n raw-config-scanners: []\n\n # Same as '--render-cause'\n render-cause: []\n\n # Same as '--misconfig-scanners'\n scanners:\n - azure-arm\n - cloudformation\n - dockerfile\n - helm\n - kubernetes\n - terraform\n - terraformplan-json\n - terraformplan-snapshot\n - ansible\n\n terraform:\n # Same as '--tf-exclude-downloaded-modules'\n exclude-downloaded-modules: false\n\n # Same as '--tf-vars'\n vars: []\n\n```\n## Module options\n\n```yaml\nmodule:\n # Same as '--module-dir'\n dir: \"$HOME/.trivy/modules\"\n\n # Same as '--enable-modules'\n enable-modules: []\n\n```\n## Package options\n\n```yaml\npkg:\n # Same as '--include-dev-deps'\n include-dev-deps: false\n\n # Same as '--pkg-relationships'\n relationships:\n - unknown\n - root\n - workspace\n - direct\n - indirect\n\n # Same as '--pkg-types'\n types:\n - os\n - library\n\n```\n## Registry options\n\n```yaml\nregistry:\n mirrors:\n\n # Same as '--password'\n password: []\n\n # Same as '--password-stdin'\n password-stdin: false\n\n # Same as '--registry-token'\n token: \"\"\n\n # Same as '--username'\n username: []\n\n```\n## Rego options\n\n```yaml\nrego:\n # Same as '--config-check'\n check: []\n\n # Same as '--config-data'\n data: []\n\n # Same as '--rego-error-limit'\n error-limit: 10\n\n # Same as '--include-deprecated-checks'\n include-deprecated-checks: false\n\n # Same as '--check-namespaces'\n namespaces: []\n\n # Same as '--skip-check-update'\n skip-check-update: false\n\n # Same as '--trace-rego'\n trace: false\n\n```\n## Report options\n\n```yaml\n# Same as '--dependency-tree'\ndependency-tree: false\n\n# Same as '--exit-code'\nexit-code: 0\n\n# Same as '--exit-on-eol'\nexit-on-eol: 0\n\n# Same as '--format'\nformat: \"table\"\n\n# Same as '--ignore-policy'\nignore-policy: \"\"\n\n# Same as '--ignorefile'\nignorefile: \".trivyignore\"\n\n# Same as '--list-all-pkgs'\nlist-all-pkgs: true\n\n# Same as '--output'\noutput: \"\"\n\n# Same as '--output-plugin-arg'\noutput-plugin-arg: \"\"\n\n# Same as '--report'\nreport: \"all\"\n\nscan:\n # Same as '--compliance'\n compliance: \"\"\n\n # Same as '--show-suppressed'\n show-suppressed: false\n\n# Same as '--severity'\nseverity:\n - UNKNOWN\n - LOW\n - MEDIUM\n - HIGH\n - CRITICAL\n\n# Same as '--table-mode'\ntable-mode:\n - summary\n - detailed\n\n# Same as '--template'\ntemplate: \"\"\n\n```\n## Repository options\n\n```yaml\nrepository:\n # Same as '--branch'\n branch: \"\"\n\n # Same as '--commit'\n commit: \"\"\n\n # Same as '--tag'\n tag: \"\"\n\n```\n## Scan options\n\n```yaml\nscan:\n # Same as '--detection-priority'\n detection-priority: \"precise\"\n\n # Same as '--disable-telemetry'\n disable-telemetry: false\n\n # Same as '--distro'\n distro: \"\"\n\n # Same as '--file-patterns'\n file-patterns: []\n\n maven:\n mirrors: []\n\n # Same as '--offline-scan'\n offline: false\n\n # Same as '--parallel'\n parallel: 5\n\n # Same as '--rekor-url'\n rekor-url: \"https://rekor.sigstore.dev\"\n\n # Same as '--sbom-sources'\n sbom-sources: []\n\n # Same as '--scanners'\n scanners:\n - vuln\n - secret\n\n # Same as '--skip-dirs'\n skip-dirs: []\n\n # Same as '--skip-files'\n skip-files: []\n\n # Same as '--skip-version-check'\n skip-version-check: false\n\n```\n## Secret options\n\n```yaml\nsecret:\n # Same as '--secret-config'\n config: \"trivy-secret.yaml\"\n\n```\n## Vulnerability options\n\n```yaml\nvulnerability:\n # Same as '--ignore-status'\n ignore-status: []\n\n # Same as '--ignore-unfixed'\n ignore-unfixed: false\n\n # Same as '--vuln-severity-source'\n severity-source:\n - auto\n\n # Same as '--skip-vex-repo-update'\n skip-vex-repo-update: false\n\n # Same as '--vex'\n vex: []\n\n```\n[example]: https://github.com/aquasecurity/trivy/blob/{{ git.tag }}/examples/trivy-conf/trivy.yaml\n[schema]: https://github.com/aquasecurity/trivy/blob/{{ git.tag }}/schema/trivy-config.json","docs/guide/references/modes/client-server.md":"# Client/Server\n\nTrivy has client/server mode. Trivy server has vulnerability database and Trivy client doesn't have to download vulnerability database. It is useful if you want to scan images or files at multiple locations and do not want to download the database at every location.\n\n| Client/Server Mode | Image | Rootfs | Filesystem | Repository | Config | K8s |\n|:------------------:|:-----:|:------:|:----------:|:----------:|:------:|:---:|\n| Supported | ✅ | ✅ | ✅ | ✅ | - | - |\n\nSome scanners run on the client side, even in client/server mode.\n\n| Scanner | Run on Client or Server |\n|:----------------:|:-----------------------:|\n| Vulnerability | Server |\n| Misconfiguration | Client[^1] |\n| Secret | Client[^2] |\n| License | Server |\n\n!!! note\n Scanning of misconfigurations and secrets is performed on the client side (as in standalone mode).\n Otherwise, the client would need to send files to the server that may contain sensitive information.\n\n## Server\nAt first, you need to launch Trivy server. It downloads vulnerability database automatically and continue to fetch the latest DB in the background.\n```\n$ trivy server --listen localhost:8080\n2019-12-12T15:17:06.551+0200 INFO Need to update DB\n2019-12-12T15:17:56.706+0200 INFO Reopening DB...\n2019-12-12T15:17:56.707+0200 INFO Listening localhost:8080...\n```\n\nIf you want to accept a connection from outside, you have to specify `0.0.0.0` or your ip address, not `localhost`.\n\n```\n$ trivy server --listen 0.0.0.0:8080\n```\n\n## Remote image scan\nThen, specify the server address for `image` command.\n```\n$ trivy image --server http://localhost:8080 alpine:3.10\n```\n**Note**: It's important to specify the protocol (http or https).\n\n
\nResult\n\n```\nalpine:3.10 (alpine 3.10.2)\n===========================\nTotal: 3 (UNKNOWN: 0, LOW: 1, MEDIUM: 2, HIGH: 0, CRITICAL: 0)\n\n+---------+------------------+----------+-------------------+---------------+\n| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |\n+---------+------------------+----------+-------------------+---------------+\n| openssl | CVE-2019-1549 | MEDIUM | 1.1.1c-r0 | 1.1.1d-r0 |\n+ +------------------+ + + +\n| | CVE-2019-1563 | | | |\n+ +------------------+----------+ + +\n| | CVE-2019-1547 | LOW | | |\n+---------+------------------+----------+-------------------+---------------+\n```\n
\n\n## Remote scan of local filesystem\nAlso, there is a way to scan local file system:\n```shell\n$ trivy fs --server http://localhost:8080 --severity CRITICAL ./integration/testdata/fixtures/fs/pom/\n```\n**Note**: It's important to specify the protocol (http or https).\n
\nResult\n\n```\npom.xml (pom)\n=============\nTotal: 24 (CRITICAL: 24)\n\n+---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+\n| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n+---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+\n| com.fasterxml.jackson.core:jackson-databind | CVE-2017-17485 | CRITICAL | 2.9.1 | 2.8.11, 2.9.4 | jackson-databind: Unsafe |\n| | | | | | deserialization due to |\n| | | | | | incomplete black list (incomplete |\n| | | | | | fix for CVE-2017-15095)... |\n| | | | | | -->avd.aquasec.com/nvd/cve-2017-17485 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2018-11307 | | | 2.7.9.4, 2.8.11.2, 2.9.6 | jackson-databind: Potential |\n| | | | | | information exfiltration with |\n| | | | | | default typing, serialization |\n| | | | | | gadget from MyBatis |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-11307 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2018-14718 | | | 2.6.7.2, 2.9.7 | jackson-databind: arbitrary code |\n| | | | | | execution in slf4j-ext class |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-14718 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2018-14719 | | | | jackson-databind: arbitrary |\n| | | | | | code execution in blaze-ds-opt |\n| | | | | | and blaze-ds-core classes |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-14719 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2018-14720 | | | | jackson-databind: exfiltration/XXE |\n| | | | | | in some JDK classes |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-14720 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2018-14721 | | | | jackson-databind: server-side request |\n| | | | | | forgery (SSRF) in axis2-jaxws class |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-14721 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2018-19360 | | | 2.6.7.3, 2.7.9.5, 2.8.11.3, | jackson-databind: improper |\n| | | | | 2.9.8 | polymorphic deserialization |\n| | | | | | in axis2-transport-jms class |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-19360 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2018-19361 | | | | jackson-databind: improper |\n| | | | | | polymorphic deserialization |\n| | | | | | in openjpa class |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-19361 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2018-19362 | | | | jackson-databind: improper |\n| | | | | | polymorphic deserialization |\n| | | | | | in jboss-common-core class |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-19362 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2018-7489 | | | 2.7.9.3, 2.8.11.1, 2.9.5 | jackson-databind: incomplete fix |\n| | | | | | for CVE-2017-7525 permits unsafe |\n| | | | | | serialization via c3p0 libraries |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-7489 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-14379 | | | 2.7.9.6, 2.8.11.4, 2.9.9.2 | jackson-databind: default |\n| | | | | | typing mishandling leading |\n| | | | | | to remote code execution |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-14379 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-14540 | | | 2.9.10 | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | com.zaxxer.hikari.HikariConfig |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-14540 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-14892 | | | 2.6.7.3, 2.8.11.5, 2.9.10 | jackson-databind: Serialization |\n| | | | | | gadgets in classes of the |\n| | | | | | commons-configuration package |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-14892 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-14893 | | | 2.8.11.5, 2.9.10 | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | classes of the xalan package |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-14893 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-16335 | | | 2.9.10 | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | com.zaxxer.hikari.HikariDataSource |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-16335 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-16942 | | | 2.9.10.1 | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | org.apache.commons.dbcp.datasources.* |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-16942 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2019-16943 | | | | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | com.p6spy.engine.spy.P6DataSource |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-16943 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-17267 | | | 2.9.10 | jackson-databind: Serialization |\n| | | | | | gadgets in classes of |\n| | | | | | the ehcache package |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-17267 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-17531 | | | 2.9.10.1 | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | org.apache.log4j.receivers.db.* |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-17531 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-20330 | | | 2.8.11.5, 2.9.10.2 | jackson-databind: lacks |\n| | | | | | certain net.sf.ehcache blocking |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-20330 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2020-8840 | | | 2.7.9.7, 2.8.11.5, 2.9.10.3 | jackson-databind: Lacks certain |\n| | | | | | xbean-reflect/JNDI blocking |\n| | | | | | -->avd.aquasec.com/nvd/cve-2020-8840 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2020-9546 | | | 2.7.9.7, 2.8.11.6, 2.9.10.4 | jackson-databind: Serialization |\n| | | | | | gadgets in shaded-hikari-config |\n| | | | | | -->avd.aquasec.com/nvd/cve-2020-9546 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2020-9547 | | | | jackson-databind: Serialization |\n| | | | | | gadgets in ibatis-sqlmap |\n| | | | | | -->avd.aquasec.com/nvd/cve-2020-9547 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2020-9548 | | | | jackson-databind: Serialization |\n| | | | | | gadgets in anteros-core |\n| | | | | | -->avd.aquasec.com/nvd/cve-2020-9548 |\n+---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+\n```\n
\n\n## Remote scan of root filesystem\nAlso, there is a way to scan root file system:\n```shell\n$ trivy rootfs --server http://localhost:8080 --severity CRITICAL /tmp/rootfs\n```\n**Note**: It's important to specify the protocol (http or https).\n
\nResult\n\n```\n/tmp/rootfs (alpine 3.10.2)\n\nTotal: 1 (CRITICAL: 1)\n\n┌───────────┬────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐\n│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │\n├───────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤\n│ apk-tools │ CVE-2021-36159 │ CRITICAL │ 2.10.4-r2 │ 2.10.7-r0 │ libfetch before 2021-07-26, as used in apk-tools, xbps, and │\n│ │ │ │ │ │ other products, mishandles... │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-36159 │\n└───────────┴────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘\n```\n
\n\n## Remote scan of git repository\nAlso, there is a way to scan remote git repository:\n```shell\n$ trivy repo https://github.com/knqyf263/trivy-ci-test --server http://localhost:8080 \n```\n**Note**: It's important to specify the protocol (http or https).\n
\nResult\n\n```\nCargo.lock (cargo)\n==================\nTotal: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 2, CRITICAL: 0)\n\n┌───────────┬─────────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐\n│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │\n├───────────┼─────────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤\n│ ammonia │ CVE-2019-15542 │ HIGH │ 1.9.0 │ 2.1.0 │ Uncontrolled recursion in ammonia │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-15542 │\n│ ├─────────────────────┼──────────┤ ├───────────────┼─────────────────────────────────────────────────────────────┤\n│ │ CVE-2021-38193 │ MEDIUM │ │ 2.1.3, 3.1.0 │ An issue was discovered in the ammonia crate before 3.1.0 │\n│ │ │ │ │ │ for Rust.... │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-38193 │\n├───────────┼─────────────────────┤ ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤\n│ smallvec │ CVE-2019-15551 │ │ 0.6.9 │ 0.6.10 │ An issue was discovered in the smallvec crate before 0.6.10 │\n│ │ │ │ │ │ for Rust.... │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-15551 │\n│ ├─────────────────────┼──────────┤ ├───────────────┼─────────────────────────────────────────────────────────────┤\n│ │ CVE-2018-25023 │ HIGH │ │ 0.6.13 │ An issue was discovered in the smallvec crate before 0.6.13 │\n│ │ │ │ │ │ for Rust.... │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-25023 │\n│ ├─────────────────────┼──────────┤ │ ├─────────────────────────────────────────────────────────────┤\n│ │ GHSA-66p5-j55p-32r9 │ MEDIUM │ │ │ smallvec creates uninitialized value of any type │\n│ │ │ │ │ │ https://github.com/advisories/GHSA-66p5-j55p-32r9 │\n└───────────┴─────────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘\n\nPipfile.lock (pipenv)\n=====================\nTotal: 8 (UNKNOWN: 0, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0)\n\n┌─────────────────────┬────────────────┬──────────┬───────────────────┬────────────────────────┬──────────────────────────────────────────────────────────────┐\n│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │\n├─────────────────────┼────────────────┼──────────┼───────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ celery │ CVE-2021-23727 │ HIGH │ 4.3.0 │ 5.2.2 │ celery: stored command injection vulnerability may allow │\n│ │ │ │ │ │ privileges escalation │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-23727 │\n├─────────────────────┼────────────────┤ ├───────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ django │ CVE-2019-6975 │ │ 2.0.9 │ 1.11.19, 2.0.12, 2.1.7 │ python-django: memory exhaustion in │\n│ │ │ │ │ │ django.utils.numberformat.format() │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-6975 │\n│ ├────────────────┼──────────┤ ├────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ │ CVE-2019-3498 │ MEDIUM │ │ 1.11.18, 2.0.10, 2.1.5 │ python-django: Content spoofing via URL path in default 404 │\n│ │ │ │ │ │ page │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-3498 │\n│ ├────────────────┤ │ ├────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ │ CVE-2021-33203 │ │ │ 2.2.24, 3.1.12, 3.2.4 │ django: Potential directory traversal via ``admindocs`` │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-33203 │\n├─────────────────────┼────────────────┤ ├───────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ urllib3 │ CVE-2019-11324 │ │ 1.24.1 │ 1.24.2 │ python-urllib3: Certification mishandle when error should be │\n│ │ │ │ │ │ thrown │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-11324 │\n│ ├────────────────┤ │ ├────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ │ CVE-2021-33503 │ │ │ 1.26.5 │ python-urllib3: ReDoS in the parsing of authority part of │\n│ │ │ │ │ │ URL │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-33503 │\n│ ├────────────────┼──────────┤ ├────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ │ CVE-2019-11236 │ MEDIUM │ │ 1.24.3 │ python-urllib3: CRLF injection due to not encoding the │\n│ │ │ │ │ │ '\\r\\n' sequence leading to... │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-11236 │\n│ ├────────────────┤ │ ├────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ │ CVE-2020-26137 │ │ │ 1.25.9 │ python-urllib3: CRLF injection via HTTP request method │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-26137 │\n└─────────────────────┴────────────────┴──────────┴───────────────────┴────────────────────────┴──────────────────────────────────────────────────────────────┘\n```\n
\n\n## Authentication\n\n```\n$ trivy server --listen localhost:8080 --token dummy\n```\n\n```\n$ trivy image --server http://localhost:8080 --token dummy alpine:3.10\n```\n\n## Security considerations\n\nClients analyze artifacts locally and upload analysis results, such as package lists, to the server's shared cache. The server uses these results for vulnerability scanning without receiving the original artifact contents. All clients with access to the server must therefore be trusted to submit accurate analysis results.\n\nThe server token controls access to both the scanning and cache APIs. It does not provide per-client permissions or tenant isolation: clients with access can write and delete shared cache entries, affecting scans performed by other clients. Use separate server instances and separate cache storage for mutually untrusted clients, including when using a Redis cache backend.\n\nThe server listens on `localhost:4954` by default. When exposing it to other hosts, configure `--token` and restrict network access to trusted clients. Protect connections with HTTPS through a TLS-terminating reverse proxy or an equivalent secure transport, since the server itself serves HTTP.\n\n## Endpoints\n\n### Health\nChecks whether the Trivy server is running. Authentication is not required.\n\nExample request:\n```bash\ncurl -s 0.0.0.0:8080/healthz\nok\n```\n\nReturns the `200 OK` status if the request was successful.\n### Version\n\nReturns the version of the Trivy server and the vulnerability database metadata. Authentication is not required.\n\nExample request:\n```bash\ncurl -s 0.0.0.0:8080/version | jq\n{\n \"Version\": \"dev\",\n \"VulnerabilityDB\": {\n \"Version\": 2,\n \"NextUpdate\": \"2023-07-25T14:15:29.876639806Z\",\n \"UpdatedAt\": \"2023-07-25T08:15:29.876640206Z\",\n \"DownloadedAt\": \"2023-07-25T09:36:25.599004Z\"\n }\n}\n```\n\nReturns the `200 OK` status if the request was successful.\n\n## Architecture\n\n![architecture](../../../imgs/client-server.png)\n\n[^1]: The checks bundle is also downloaded on the client side.\n[^2]: The scan result with masked secrets is sent to the server","pkg/commands/testdata/db/metadata.json":"{\n \"Version\": 2,\n \"NextUpdate\": \"2022-03-02T12:07:07.99504023Z\",\n \"UpdatedAt\": \"2022-03-02T06:07:07.99504083Z\",\n \"DownloadedAt\": \"2022-03-02T10:03:38.383312Z\"\n}\n\n","pkg/commands/testdata/java-db/metadata.json":"{\"Version\":1,\"NextUpdate\":\"2023-03-17T00:47:02.774253254Z\",\"UpdatedAt\":\"2023-03-14T00:47:02.774253754Z\",\"DownloadedAt\":\"2023-03-14T03:04:55.058541039Z\"}\n","pkg/commands/testdata/policy/metadata.json":"{\"Digest\":\"sha256:19a017cdc798631ad42f6f4dce823d77b2989128f0e1a7f9bc83ae3c59024edd\",\"DownloadedAt\":\"2023-03-01T17:06:08.191725-08:00\"}","docs/guide/references/configuration/cli/trivy.md":"## trivy\n\nUnified security scanner\n\n### Synopsis\n\nScanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues and hard-coded secrets\n\n```\ntrivy [global flags] command [flags] target\n```\n\n### Examples\n\n```\n # Scan a container image\n $ trivy image python:3.4-alpine\n\n # Scan a container image from a tar archive\n $ trivy image --input ruby-3.1.tar\n\n # Scan local filesystem\n $ trivy fs .\n\n # Run in server mode\n $ trivy server\n```\n\n### Options\n\n```\n --cacert string Path to PEM-encoded CA certificate file\n --cache-dir string cache directory (default \"/path/to/cache\")\n -c, --config string config path (empty string disables loading) (default \"trivy.yaml\")\n -d, --debug debug mode\n -f, --format string version format (json)\n --generate-default-config write the default config to trivy-default.yaml\n -h, --help help for trivy\n --insecure allow insecure server connections\n -q, --quiet suppress progress bar and log output\n --timeout duration timeout (default 5m0s)\n -v, --version show version\n```\n\n### SEE ALSO\n\n* [trivy clean](trivy_clean.md)\t - Remove cached files\n* [trivy config](trivy_config.md)\t - Scan config files for misconfigurations\n* [trivy convert](trivy_convert.md)\t - Convert Trivy JSON report into a different format\n* [trivy filesystem](trivy_filesystem.md)\t - Scan local filesystem\n* [trivy image](trivy_image.md)\t - Scan a container image\n* [trivy kubernetes](trivy_kubernetes.md)\t - [EXPERIMENTAL] Scan kubernetes cluster\n* [trivy module](trivy_module.md)\t - Manage modules\n* [trivy plugin](trivy_plugin.md)\t - Manage plugins\n* [trivy registry](trivy_registry.md)\t - Manage registry authentication\n* [trivy repository](trivy_repository.md)\t - Scan a repository\n* [trivy rootfs](trivy_rootfs.md)\t - Scan rootfs\n* [trivy sbom](trivy_sbom.md)\t - Scan SBOM for vulnerabilities and licenses\n* [trivy server](trivy_server.md)\t - Server mode\n* [trivy version](trivy_version.md)\t - Print the version\n* [trivy vex](trivy_vex.md)\t - [EXPERIMENTAL] VEX utilities\n* [trivy vm](trivy_vm.md)\t - [EXPERIMENTAL] Scan a virtual machine image\n\n","docs/guide/references/configuration/cli/trivy_clean.md":"## trivy clean\n\nRemove cached files\n\n```\ntrivy clean [flags]\n```\n\n### Examples\n\n```\n # Remove all caches\n $ trivy clean --all\n\n # Remove scan cache\n $ trivy clean --scan-cache\n\n # Remove vulnerability database\n $ trivy clean --vuln-db\n\n```\n\n### Options\n\n```\n -a, --all remove all caches\n --checks-bundle remove checks bundle\n -h, --help help for clean\n --java-db remove Java database\n --scan-cache remove scan cache (container and VM image analysis results)\n --vex-repo remove VEX repositories\n --vuln-db remove vulnerability database\n```\n\n### Options inherited from parent commands\n\n```\n --cacert string Path to PEM-encoded CA certificate file\n --cache-dir string cache directory (default \"/path/to/cache\")\n -c, --config string config path (empty string disables loading) (default \"trivy.yaml\")\n -d, --debug debug mode\n --generate-default-config write the default config to trivy-default.yaml\n --insecure allow insecure server connections\n -q, --quiet suppress progress bar and log output\n --timeout duration timeout (default 5m0s)\n -v, --version show version\n```\n\n### SEE ALSO\n\n* [trivy](trivy.md)\t - Unified security scanner\n\n","docs/guide/references/modes/standalone.md":"# Standalone\n\n`trivy image`, `trivy filesystem`, and `trivy repo` works as standalone mode.\n\n## Image\n\n![standalone](../../../imgs/image.png)\n\n## Filesystem\n\n![fs](../../../imgs/fs.png)\n\n## Git Repository\n\n![repo](../../../imgs/repo.png)\n\n","docs/guide/references/configuration/cli/trivy_config.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_config.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_config.md)","docs/guide/references/configuration/cli/trivy_convert.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_convert.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_convert.md)","docs/guide/references/configuration/cli/trivy_filesystem.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_filesystem.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_filesystem.md)","docs/guide/references/configuration/cli/trivy_image.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_image.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_image.md)","docs/guide/references/configuration/cli/trivy_kubernetes.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_kubernetes.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_kubernetes.md)","docs/guide/references/configuration/cli/trivy_module.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_module.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_module.md)","docs/guide/references/configuration/cli/trivy_module_install.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_module_install.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_module_install.md)","docs/guide/references/configuration/cli/trivy_module_uninstall.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_module_uninstall.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_module_uninstall.md)","docs/guide/references/configuration/cli/trivy_plugin.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin.md)","docs/guide/references/configuration/cli/trivy_plugin_info.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_info.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_info.md)","docs/guide/references/configuration/cli/trivy_plugin_install.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_install.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_install.md)","docs/guide/references/configuration/cli/trivy_plugin_list.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_list.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_list.md)","docs/guide/references/configuration/cli/trivy_plugin_run.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_run.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_run.md)","docs/guide/references/configuration/cli/trivy_plugin_search.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_search.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_search.md)","docs/guide/references/configuration/cli/trivy_plugin_uninstall.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_uninstall.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_uninstall.md)","docs/guide/references/configuration/cli/trivy_plugin_update.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_update.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_update.md)","docs/guide/references/configuration/cli/trivy_plugin_upgrade.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_upgrade.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_upgrade.md)","docs/guide/references/configuration/cli/trivy_registry.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_registry.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_registry.md)","docs/guide/references/configuration/cli/trivy_registry_login.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_registry_login.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_registry_login.md)","docs/guide/references/configuration/cli/trivy_registry_logout.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_registry_logout.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_registry_logout.md)","docs/guide/references/configuration/cli/trivy_repository.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_repository.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_repository.md)","docs/guide/references/configuration/cli/trivy_rootfs.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_rootfs.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_rootfs.md)","docs/guide/references/configuration/cli/trivy_sbom.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_sbom.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_sbom.md)","docs/guide/references/configuration/cli/trivy_server.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_server.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_server.md)","docs/guide/references/configuration/cli/trivy_version.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_version.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_version.md)","docs/guide/references/configuration/cli/trivy_vex.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex.md)","docs/guide/references/configuration/cli/trivy_vex_repo.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex_repo.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo.md)","docs/guide/references/configuration/cli/trivy_vex_repo_download.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex_repo_download.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo_download.md)","docs/guide/references/configuration/cli/trivy_vex_repo_init.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex_repo_init.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo_init.md)","docs/guide/references/configuration/cli/trivy_vex_repo_list.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex_repo_list.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo_list.md)","docs/guide/references/configuration/cli/trivy_vm.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vm.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vm.md)","pkg/plugin/testdata/.trivy/plugins/index.yaml":"# Plugins Skill\n\nPath: `pkg/plugin/testdata/.trivy/plugins/index.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/plugin/testdata/.trivy/plugins/index.yaml)","pkg/plugin/testdata/.trivy/plugins/test_plugin/plugin.yaml":"# Test_plugin Skill\n\nPath: `pkg/plugin/testdata/.trivy/plugins/test_plugin/plugin.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/plugin/testdata/.trivy/plugins/test_plugin/plugin.yaml)","pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package1/package.json":"# Package1 Skill\n\nPath: `pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package1/package.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package1/package.json)","pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package2/package.json":"# Package2 Skill\n\nPath: `pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package2/package.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package2/package.json)","pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/utils/util1/package.json":"# Util1 Skill\n\nPath: `pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/utils/util1/package.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/utils/util1/package.json)"},"files":{"docs/guide/references/troubleshooting.md":"# Troubleshooting\n\n## Scan\n### Timeout\n\n!!! error\n ``` bash\n $ trivy image ...\n ...\n analyze error: timeout: context deadline exceeded\n ```\n\nYour scan may time out. Java takes a particularly long time to scan. Try increasing the value of the `--timeout` option such as `--timeout 15m`.\n\n### Unable to initialize an image scanner\n\n!!! error\n ```bash\n $ trivy image ...\n ...\n 2024-01-19T08:15:33.288Z\tFATAL\timage scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: 4 errors occurred:\n\t* docker error: unable to inspect the image (ContainerImageName): Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?\n\t* containerd error: containerd socket not found: /run/containerd/containerd.sock\n\t* podman error: unable to initialize Podman client: no podman socket found: stat podman/podman.sock: no such file or directory\n\t* remote error: GET https://index.docker.io/v2/ContainerImageName: MANIFEST_UNKNOWN: manifest unknown; unknown tag=0.1\n ```\n \nIt means Trivy is unable to find the container image in the following places:\n\n* Docker Engine\n* containerd\n* Podman\n* A remote registry\n\nPlease see error messages for details of each error.\n\nCommon mistakes include the following, depending on where you are pulling images from:\n\n#### Common\n- Typos in the image name\n - Common mistake :)\n- Forgetting to specify the registry\n - By default, it is considered to be Docker Hub ( `index.docker.io` ).\n\n#### Docker Engine\n- Incorrect Docker host\n - If the Docker daemon's socket path is not `/var/run/docker.sock`, you need to specify the `--docker-host` flag or the `DOCKER_HOST` environment variable.\n The same applies when using TCP; you must specify the correct host address.\n\n#### containerd\n- Incorrect containerd address\n - If you are using a non-default path, you need to specify the `CONTAINERD_ADDRESS` environment variable.\n Please refer to [this documentation](../target/container_image.md#containerd).\n- Incorrect namespace\n - If you are using a non-default namespace, you need to specify the `CONTAINERD_NAMESPACE` environment variable.\n Please refer to [this documentation](../target/container_image.md#containerd).\n - \n#### Podman\n- Podman socket configuration\n - You need to enable the Podman socket. Please refer to [this documentation](../target/container_image.md#podman).\n\n#### Container Registry\n- Unauthenticated\n - If you are using a private container registry, you need to authenticate. Please refer to [this documentation](../advanced/private-registries/index.md).\n- Using a proxy\n - If you are using a proxy within your network, you need to correctly set the `HTTP_PROXY`, `HTTPS_PROXY`, etc., environment variables.\n- Use of a self-signed certificate in the registry\n - Because certificate verification will fail, you need to either trust that certificate or use the `--insecure` flag (not recommended in production).\n\n### Certification\n\n!!! error\n Error: x509: certificate signed by unknown authority\n\n`TRIVY_INSECURE` can be used to allow insecure connections to a container registry when using SSL.\n\n```\n$ TRIVY_INSECURE=true trivy image [YOUR_IMAGE]\n```\n\nIf you need to trust a custom CA certificate, you can provide a PEM-encoded bundle.\n\n=== \"Unix (except macOS)\"\n\n You can specify the location of your certificate using the `SSL_CERT_FILE` or `SSL_CERT_DIR` environment variables.\n\n ```bash\n $ SSL_CERT_FILE=/path/to/ca.pem trivy image [YOUR_IMAGE]\n ```\n\n ```bash\n $ SSL_CERT_DIR=/path/to/certs trivy image [YOUR_IMAGE]\n ```\n\n=== \"All systems\"\n\n Use the `--cacert` flag to point Trivy to a PEM-encoded CA certificate file, regardless of the operating system.\n\n ```bash\n $ trivy image --cacert /path/to/ca.pem [YOUR_IMAGE]\n ```\n\n### GitHub Rate limiting\nTrivy uses GitHub API for [VEX repositories](../supply-chain/vex/repo.md).\n\n!!! error\n ``` bash\n $ trivy image --vex repo ...\n ...\n API rate limit exceeded for xxx.xxx.xxx.xxx.\n ```\n\nSpecify GITHUB_TOKEN for [authentication](https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api?apiVersion=2022-11-28)\n\n```\n$ GITHUB_TOKEN=XXXXXXXXXX trivy image --vex repo [YOUR_IMAGE]\n```\n\n!!! note\n `GITHUB_TOKEN` doesn't help with the rate limit for the vulnerability database and other assets.\n See https://github.com/aquasecurity/trivy/discussions/8009\n\n### Maven Central rate limiting (HTTP 429)\n\nWhen scanning Java projects, Trivy resolves transitive dependencies by downloading POM files from Maven Central (or any other configured remote Maven repository) when they are missing from the local `~/.m2` cache. Remote Maven repositories typically rate-limit per IP and return `429 Too Many Requests` once the limit is exceeded; scans of large projects with an empty local cache routinely run into this.\n\n!!! error\n ```\n FATAL Error remote Maven repository returned 429 Too Many Requests for https://repo.maven.apache.org/maven2/.../-.pom. Retry-After: 1800.\n The repository blocks all subsequent requests from this IP until the block clears.\n To avoid this, populate the local Maven cache before scanning (e.g. run `mvn dependency:resolve`, or `mvn install` for a multi-module project, and cache ~/.m2 in CI).\n ```\n\nThe block applies to *all* subsequent requests from the affected IP for the duration indicated by `Retry-After`, regardless of whether the artifact would otherwise be served from a cache layer. The wait depends on the repository's policy — for Maven Central it is typically tens of minutes on the first violation and grows on repeat — so Trivy fails fast on the first `429` rather than retrying and risking an extended block.\n\nRecommended mitigations:\n\n- **Populate `~/.m2` before scanning.** Run `mvn dependency:resolve` (or any build step that resolves dependencies) so that every POM is cached locally. In CI, cache the `~/.m2` directory between runs (e.g. keyed on `pom.xml` checksums) so subsequent runs reuse the artifacts.\n - For a multi-module project run `mvn install -DskipTests` instead. Goals that only resolve dependencies cache third-party artifacts, but not the artifacts of your own project — Maven takes those from the reactor, so a module that depends on a sibling module still triggers remote lookups.\n- **Configure mirrors** of the rate-limited repository, so that POM lookups go to a host that isn't blocking you. There are two ways to do it:\n - `` in Maven's [settings.xml][maven-mirror-settings] — the standard mechanism, honored by `mvn` itself as well. A repository is served by a single mirror, so a mirror that is rate-limited too leaves nothing to fall back on.\n - [scan.maven.mirrors][maven-mirrors] in `trivy.yaml` — Trivy-specific, and takes an ordered list of mirrors per repository. A mirror that returns `429` is skipped in favor of the next one, and if the remaining mirrors do not return the artifact, the scan stops and reports the `429`.\n- **Wait for the block to expire.** The `Retry-After` value in the error tells you the minimum wait. Repeated scans during the block will extend it.\n- **Use `--offline-scan`** to skip remote lookups entirely and rely only on the local `~/.m2` cache. Be careful: any transitive POM missing from the cache is silently skipped, so populate `~/.m2` first (see above) — otherwise the dependency tree will be incomplete.\n\n### Unable to open JAR files\n\n!!! error\n ``` bash\n $ trivy image ...\n ...\n failed to analyze file: failed to analyze usr/lib/jvm/java-1.8-openjdk/lib/tools.jar: unable to open usr/lib/jvm/java-1.8-openjdk/lib/tools.jar: failed to open: unable to read the file: stream error: stream ID 9; PROTOCOL_ERROR; received from peer\n ```\n\nCurrently, we're investigating this issue. As a temporary mitigation, you may be able to avoid this issue by downloading the Java DB in advance.\n\n```shell\n$ trivy image --download-java-db-only\n2023-02-01T16:57:04.322+0900 INFO Downloading the Java DB...\n$ trivy image [YOUR_JAVA_IMAGE]\n```\n\n### Cache lock errors\n\n!!! error\n ```\n cache may be in use by another process\n ```\n\nTrivy's vulnerability database is opened in read-only mode, so it does not cause lock issues. Lock errors occur only when using filesystem cache for scan cache storage.\n\nFilesystem cache uses BoltDB internally, which creates file locks to prevent data corruption. As stated in the BoltDB documentation:\n\n> Please note that Bolt obtains a file lock on the data file so multiple processes cannot open the same database at the same time. Opening an already open Bolt database will cause it to hang until the other process closes it.\n\nReference: [BoltDB README](https://github.com/boltdb/bolt#opening-a-database)\n\nIf you're using memory cache (default for some commands like `fs`, `rootfs`, `config`, and `sbom`) or external cache (Redis), you will not encounter lock errors. Lock issues only occur when using filesystem cache with multiple concurrent processes.\nSee [Cache Backend](../configuration/cache.md#scan-cache-backend) for more details.\n\nThese errors occur when:\n\n- Multiple Trivy processes try to use the same filesystem cache directory simultaneously\n- A previous Trivy process did not shut down cleanly\n- Trivy server is running with filesystem cache and holding a lock on the cache\n\n#### Solutions\n\n**Solution 1: Use memory cache or Redis cache** (Recommended)\n\nMemory cache is the default for some commands (e.g., `fs`, `rootfs`, `config`, `sbom`). For other commands like image scanning, you can use `--cache-backend memory` to enable concurrent execution:\n\n```bash\n$ trivy image --cache-backend memory debian:11 &\n$ trivy image --cache-backend memory debian:12 &\n```\n\nNote that memory cache does not persist scan results, so subsequent scans will take longer as layers need to be scanned again each time.\n\nFor server mode or persistent cache with concurrent access, use Redis cache:\n\n```bash\n$ trivy server --cache-backend redis://localhost:6379\n```\n\n**Solution 2: Terminate conflicting processes**\n\nIf you need to use filesystem cache, check for running Trivy processes and terminate them:\n\n```bash\n$ ps aux | grep trivy\n$ kill [process_id]\n```\n\n**Solution 3: Use different cache directories**\n\nIf you must run multiple Trivy processes with filesystem cache, specify different cache directories for each process:\n\n```bash\n$ trivy image --cache-dir /tmp/trivy-cache-1 debian:11 &\n$ trivy image --cache-dir /tmp/trivy-cache-2 debian:12 &\n```\n\nNote that each cache directory will download its own copy of the vulnerability database and other scan assets, which will increase network traffic and storage usage.\n\n### Multiple Trivy servers\n\n!!! error\n ```\n $ trivy image --server http://xxx.com:xxxx test-image\n ...\n - twirp error internal: failed scan, test-image: failed to apply layers: layer cache missing: sha256:*****\n ```\nTo run multiple Trivy servers, you need to use Redis as the cache backend so that those servers can share the cache. \nFollow [this instruction][redis-cache] to do so.\n\n\n### Problems with `/tmp` on remote Git repository scans\n\n!!! error\n FATAL repository scan error: scan error: unable to initialize a scanner: unable to initialize a filesystem scanner: git clone error: write /tmp/fanal-remote...\n\nTrivy clones remote Git repositories under the `/tmp` directory before scanning them. If `/tmp` doesn't work for you, you can change it by setting the `TMPDIR` environment variable.\n\nTry:\n\n```\n$ TMPDIR=/my/custom/path trivy repo ...\n```\n\n### Running out of space during image scans\n\n!!! error\n ``` bash\n image scan failed:\n failed to copy the image:\n write /tmp/fanal-3323732142: no space left on device\n ```\n\nTrivy uses a temporary directory during image scans.\nThe directory path would be determined as follows:\n\n- On Unix systems: Use `$TMPDIR` if non-empty, else `/tmp`.\n- On Windows: Uses GetTempPath, returning the first non-empty value from `%TMP%`, `%TEMP%`, `%USERPROFILE%`, or the Windows directory.\n\nSee [this documentation](https://golang.org/pkg/os/#TempDir) for more details.\n\nIf the image is large or the temporary directory has insufficient space, the scan will fail.\nYou can configure the directory path to redirect Trivy to a directory with adequate storage.\nOn Unix systems, you can set the `$TMPDIR` environment variable.\n\n```\n$ TMPDIR=/my/custom/path trivy image ...\n```\n\nWhen scanning images from a container registry, Trivy processes each layer by streaming, loading only the necessary files for the scan into memory and discarding unnecessary files.\nIf a layer contains large files that are necessary for the scan (such as JAR files or binary files), Trivy saves them to a temporary directory (e.g. $TMPDIR) on local storage to avoid increased memory consumption.\nAlthough these files are deleted after the scan is complete, they can temporarily increase disk consumption and potentially exhaust storage.\nIn such cases, there are currently three workarounds:\n\n1. Use a temporary directory with sufficient capacity\n \n This is the same as explained above.\n \n2. Specify a small value for `--parallel`\n \n By default, multiple layers are processed in parallel.\n If each layer contains large files, disk space may be consumed rapidly.\n By specifying a small value such as `--parallel 1`, parallelism is reduced, which can mitigate the issue.\n\n3. Specify `--skip-files` or `--skip-dirs`\n \n If the container image contains large files that do not need to be scanned, you can skip their processing by specifying --skip-files or --skip-dirs. \n For more details, please refer to [this documentation](../configuration/skipping.md).\n\n## DB\n### Old DB schema\n\n!!! error\n --skip-update cannot be specified with the old DB schema.\n\nTrivy v0.23.0 or later requires Trivy DB v2. Please update your local database or follow [the instruction of air-gapped environment][air-gapped].\n\n### Error downloading vulnerability DB\n\n!!! error\n FATAL failed to download vulnerability DB\n\nIf Trivy is running behind corporate firewall, refer to the necessary connectivity requirements as described [here][network].\n\n### Denied\n\n!!! error\n GET https://ghcr.io/token?scope=repository%3Aaquasecurity%2Ftrivy-db%3Apull&service=ghcr.io: DENIED: denied\n\nYour local GHCR (GitHub Container Registry) token might be expired.\nPlease remove the token and try downloading the DB again.\n\n```shell\ndocker logout ghcr.io\n```\n\nor\n\n```shell\nunset GITHUB_TOKEN\n```\n\n## Debugging\n### HTTP Request/Response Tracing\n\nFor debugging network issues, connection problems, or authentication failures, you can enable HTTP request/response tracing using the `--trace-http` flag.\n\n!!! danger \"Security Warning\"\n While Trivy attempts to redact known sensitive information such as authentication headers and common secrets, the `--trace-http` flag may still expose sensitive data in HTTP requests and responses.\n \n **Never use this flag in production environments or CI/CD pipelines.**\n This flag is automatically disabled in CI environments for security.\n\n```bash\n# Enable HTTP tracing for debugging registry issues\n$ trivy image --trace-http registry.example.com/my-image:latest\n\n# HTTP tracing with other debugging options\n$ trivy image --trace-http --debug --insecure my-image:tag\n```\n\n## Others\n### Unknown error\n\nTry again after running `trivy clean --all`:\n\n```\n$ trivy clean --all\n```\n\n[air-gapped]: ../advanced/air-gap.md\n[maven-mirror-settings]: https://maven.apache.org/guides/mini/guide-mirror-settings.html\n[maven-mirrors]: ../coverage/language/java.md#config-file-mirrors\n[network]: ../advanced/air-gap.md#connectivity-requirements\n[redis-cache]: ../configuration/cache.md#redis\n","docs/guide/references/compatibility.md":"# Compatibility and Stability\n\nTrivy is designed, distributed, and supported primarily as a CLI application.\n\nThe Trivy project strives to preserve compatibility between releases for documented user-facing interfaces, except for features explicitly marked as experimental or subject to change. Unintended compatibility issues in stable interfaces are generally treated as bugs.\n\n## Stable Interfaces\n\nThe following interfaces documented in the official Trivy documentation are covered by this compatibility policy:\n\n- CLI commands, subcommands, flags, and arguments\n- Configuration file options and environment variables\n- Exit codes and the conditions under which they are returned\n- Machine-readable output formats\n- Data fields used by custom templates\n\nAdding a new command, flag, configuration option, or output field is considered compatible as long as it does not change existing usage.\n\nWhen the documentation and implementation disagree, neither is automatically considered authoritative. We determine the intended behavior by considering existing usage, user impact, and consistency with other features, and then correct either the implementation or the documentation.\n\nTrivy's JSON output includes a `SchemaVersion` that identifies the output structure. Within the same `SchemaVersion`, optional fields may be added or omitted, so consumers should ignore unknown fields and must not assume that optional fields are always present. Removing or renaming an existing field, changing its type, or changing its meaning incompatibly generally requires an update to `SchemaVersion` and is documented as a breaking change in the release notes.\n\n## Interfaces Outside the Compatibility Policy\n\nThe following are not part of Trivy's stable user-facing interfaces:\n\n- Go packages, types, functions, methods, and other Go APIs in the Trivy repository\n- Required versions of Go, Mage, and other build tools, as well as development commands and build scripts\n- The exact formatting of terminal output, logs, warnings, error messages, and progress displays\n- Scan results, including detected vulnerabilities, misconfigurations, secrets, and licenses, as well as their content and ordering\n- Internal formats and protocols, such as caches, vulnerability databases, on-disk data, internal RPC, and Protocol Buffers definitions\n- Compatibility between different versions of the Trivy client and Trivy server\n- Experimental or preview features, canary builds, and prerelease versions\n- Changes in behavior or coverage caused by external specifications, services, platforms, or data sources\n\nTrivy is not designed or supported for use as a Go library. Interfaces outside this policy may be changed or removed without a deprecation period.\n\nEven if such a change breaks external code or a custom build procedure, it is not, by itself, considered a breaking change to the Trivy CLI. As a rule, these changes are not identified as breaking changes in the release notes or announced separately. Users should not assume that they will be announced in advance.\n\n## Scan Asset Version Support\n\nSome [scan assets](terminology.md#scan-assets) use versioned formats that are tied to particular Trivy CLI versions:\n\n- Vulnerability Database ([trivy-db](https://github.com/aquasecurity/trivy-db)): schema version\n- Java Index Database ([trivy-java-db](https://github.com/aquasecurity/trivy-java-db)): schema version\n- Checks Bundle ([trivy-checks](https://github.com/aquasecurity/trivy-checks)): major version\n\nEach Trivy CLI version is compatible with particular versions of these assets.\n\nWhen updates for an older scan asset version end, Trivy CLI versions that depend on it can no longer receive newly published vulnerability information, Java artifact identification data, or misconfiguration checks from that asset.\n\nBefore ending updates for a scan asset version, the Trivy project announces the affected CLI versions, the end date for updates, and the minimum CLI version to which users should upgrade. A scan asset version change is not considered a breaking change to the Trivy CLI. However, because users must upgrade to continue receiving current scan asset updates, it is announced separately from ordinary internal changes.\n\n## Breaking Changes\n\nA change that requires users to modify an existing valid use of a stable interface is considered a breaking change.\n\nWhen a breaking change is necessary, we identify it in the release notes and provide migration guidance whenever possible. We announce a deprecation before making the change when practical, but do not guarantee a fixed deprecation period for every interface.\n\nThe usual deprecation process may not be possible when responding to an urgent security issue, an incompatible change in an external system, an obvious bug, or a risk of significant false positives, false negatives, data corruption, or other safety issues. Even in these cases, we describe changes with significant user impact in the release notes whenever possible.\n","docs/guide/references/terminology.md":"# Terminology\n\nThis page explains the terminology system used in Trivy, helping users understand the specific terms and concepts unique to the Trivy ecosystem.\n\n**Inclusion Criteria**\n\n1. Core Components of Trivy\n - Primary features such as Scanner, Target\n - Essential components such as Scan Assets (trivy-db, trivy-java-db)\n - Components that users directly interact with\n\n2. Trivy-specific Terms\n - Terms unique to Trivy (e.g., VEX Hub)\n - Terms that have special meaning in Trivy's context (e.g., Plugin, Module)\n\n**Exclusion Criteria**\n\n1. General Terms\n - Common security/technical terms (e.g., CVE, CVSS, Container, Registry)\n - Standard industry terminology\n\n2. Implementation Details\n - Internal workings of components\n - Usage instructions (these belong in feature documentation)\n\n\n## Core Concepts\n\n### Target\nTypes of artifacts that Trivy can scan, like container images and filesystem.\n\n### Scanner\nTrivy's built-in security scanning engines. Trivy has four main scanners:\n\n- [Vulnerability Scanner](../scanner/vulnerability.md)\n- [Misconfiguration Scanner](../scanner/misconfiguration/index.md)\n- [Secret Scanner](../scanner/secret.md)\n- [License Scanner](../scanner/license.md)\n\n!!! note\n SBOM is not a scanner but an output format option.\n\n### Scan Assets\nExternal data that Trivy downloads (if needed for scanner) and uses during scanning:\n\n- [Vulnerability Database (Trivy DB, trivy-db)](#vulnerability-database-trivy-db-trivy-db): Database containing vulnerability information\n- [Java Index Database (Trivy Java DB, trivy-java-db)](#java-index-database-trivy-java-db-trivy-java-db): Database for Java artifact identification\n- [Checks Bundle (trivy-checks)](#checks-bundle): Archive containing misconfiguration detection rules\n- [VEX Repository](#vex-repository): Repository containing VEX documents\n\n## Vulnerability Scanning\n\n### Vulnerability Database (Trivy DB, trivy-db)\nThe core vulnerability database required for vulnerability detection.\nContains comprehensive vulnerability information for multiple ecosystems.\nDistributed via OCI registry.\n\nManaged at https://github.com/aquasecurity/trivy-db.\n\nThe vulnerability database is built from a GitHub repository that collects and stores vulnerability information from various data sources.\nThis repository serves as the foundation for building the Trivy DB.\n\nManaged at:\n\n- https://github.com/aquasecurity/vuln-list\n- https://github.com/aquasecurity/vuln-list-nvd\n- https://github.com/aquasecurity/vuln-list-redhat\n- https://github.com/aquasecurity/vuln-list-debian\n- etc.\n\n### Java Index Database (Trivy Java DB, trivy-java-db)\nSpecialized database used for identifying Java libraries and their components during JAR/WAR/PAR/EAR scanning.\nDistributed via OCI registry.\n\nManaged at https://github.com/aquasecurity/trivy-java-db.\n\n\n## Misconfiguration Scanning\nWhen the context does not clearly indicate these terms are related to misconfiguration scanning, they may be prefixed with \"Misconfiguration\" for clarity.\nFor example, \"Check\" may be referred to as \"Misconfiguration Check\", and \"Checks Bundle\" as \"Misconfiguration Checks Bundle\".\n\n### Check\nA Rego file that defines rules for detecting misconfigurations in various types of IaC files.\n\n### Built-in Checks\nDefault set of checks distributed through [the trivy-checks repository](https://github.com/aquasecurity/trivy-checks), providing standard security and configuration best practices.\n\n### Checks Bundle\nA tar.gz archive containing [the built-in checks](#built-in-checks), distributed via OCI registry.\n\n## Secret Scanning\n\n### Rule\nPattern matching rules used to detect hardcoded secrets and sensitive information.\nEach rule consists of:\n\n- Metadata (ID, Category, Title, etc.)\n- Regular expressions for matching sensitive patterns\n- Additional context for detection accuracy\n\n## Kubernetes Integration\n\n### KBOM (Kubernetes Bill of Materials)\nA specialized SBOM format for Kubernetes clusters that includes detailed information about the cluster's components.\n\n## VEX (Vulnerability Exploitability eXchange)\n\n### VEX Repository\nA repository system that stores VEX documents following [the VEX Repository Specification](https://github.com/aquasecurity/vex-repo-spec).\nVEX repositories help users manage and share information about vulnerability applicability and exploitability.\n\nFor detailed information about VEX repositories, see [the document](../supply-chain/vex/repo.md).\n\n### VEX Hub\nThe default VEX repository managed by Aqua Security at https://github.com/aquasecurity/vexhub.\nIt primarily aggregates VEX documents published by package maintainers in their source repositories.\nVEX Hub serves as a central point for collecting and distributing vulnerability applicability information for OSS projects.\n\n## Cache System\n\n### Cache Types\nThe cache directory contains several distinct types of data:\n\n- [Vulnerability Database](#vulnerability-database-trivy-db-trivy-db)\n- [Java Index Database](#java-index-database-trivy-java-db-trivy-java-db)\n- [Misconfiguration Checks](#misconfiguration-scanning)\n- [VEX Repositories](#vex-repository)\n- [Scan Cache](#scan-cache)\n\n### Asset Cache\nDownloaded assets like vulnerability databases and Java index databases.\n\n### Scan Cache\nA caching mechanism that stores analysis results from previous scans to speed up subsequent scans.\nFor container image scanning, the scan cache stores analysis results including package names and versions per layer.\n\nFor detailed information about caching, see [the document](../configuration/cache.md).\n\n## Plugin System\n\n### Plugin\nAn add-on tool that integrates with Trivy to extend its core functionality.\nPlugins can be written in any programming language and integrate seamlessly with Trivy CLI, appearing in Trivy help and subcommands.\nThey can be installed and removed independently without affecting the core Trivy installation.\n\nFor detailed information about plugins, see [the document](../plugin/index.md).\n\n### Plugin Index (trivy-plugin-index)\nA centralized registry that lists available Trivy plugins, managed at https://github.com/aquasecurity/trivy-plugin-index.\nThe index maintains a curated list of official and community plugins, providing metadata such as plugin names, descriptions, and maintainers.\nIt enables plugin discovery through the `trivy plugin search` command and facilitates automatic plugin installation and updates.\n\nFor detailed information about the plugin index, see [the document](../plugin/user-guide.md).\n\n## Module System\n### Module\nA WebAssembly-based extension mechanism that allows custom scanning logic without modifying the Trivy binary.\nModules can modify scan results by analyzing files or post-processing results.\n\nFor detailed information about modules, see [the document](../advanced/modules.md).","docs/guide/references/abbreviations.md":"# Abbreviation List\n\nThis list compiles words that frequently appear in CLI flags or configuration files and are commonly abbreviated in industry and OSS communities.\nTrivy may use the abbreviation in place of the full spelling for flag names.\nIt is also acceptable to add even shorter aliases if needed.\n\nWords not included in this list should be spelled out in full when used in flags.\n\nThis list is intentionally limited to the most common and widely recognized abbreviations.\nExcessive use of abbreviations in CLI flags can hinder initial user understanding and create a steeper learning curve.\n\n!!! note\n This list serves as a guideline rather than a strict requirement.\n Its purpose is to maintain consistency across the project when naming flags and configuration options.\n While we strive to follow these abbreviations, there may be exceptions where context or clarity demands a different approach.\n\n## Scope\nThis list focuses on abbreviations of single words commonly used in technical contexts. It does not include:\n\n1. Acronyms formed from the initial letters of multiple words (e.g., OS for Operating System, HTTP for Hypertext Transfer Protocol)\n2. Domain-specific terminology that already has standardized short forms\n3. Brand names or product-specific abbreviations\n\nThe abbreviations listed here are primarily intended for CLI flags, configuration keys, and similar technical interfaces where brevity is valued while maintaining clarity.\n\n## Example\nFor a flag containing multiple words, only abbreviate words that appear in this list.\nFor instance, in `--database-repository`, \"database\" is in the list so it should be abbreviated to \"db\", but \"repository\" is not in the list so it must be spelled out completely.\nThe correct flag name would be `--db-repository`.\nIt's acceptable to add a shorter alias like `--db-repo` if desired.\n\n## List\n\n| Full Name | Default Abbreviation | Examples |\n|-------------------|----------------------|-----------------------------------------------------------|\n| application | app | `--app-name`, `--app-mode` |\n| authentication | auth | `--auth-method`, `--auth-token` |\n| authorization | authz | `--authz-rule`, `--authz-policy` |\n| command | cmd | `--cmd-option`, `--cmd-args` |\n| configuration | config | `--config`, `--config-dir` |\n| database | db | `--db-repository`, `--db-user`, `--db-pass` |\n| development | dev | `--dev-dependencies`, `--dev-mode` |\n| directory | dir | `--dir-path`, `--output-dir` |\n| environment | env | `--env-file`, `--env-vars` |\n| information | info | `--info-level`, `--show-info` |\n| initialization | init | `--init-script`, `--init-config` |\n| library | lib | `--lib-path`, `--lib-dir` |\n| maximum | max | `--max-image-size`, `--max-depth` |\n| minimum | min | `--min-value`, `--min-severity` |\n| misconfiguration | misconfig | `--misconfig-scanners` |\n| package | pkg | `--pkg-types` |\n| production | prod | `--prod-env`, `--prod-deploy` |\n| specification | spec | `--spec-file`, `--spec-version` |\n| temporary | tmp | `--tmp-dir`, `--tmp-file` |\n| utility | util | `--util-script`, `--util-name` |\n| vulnerability | vuln | `--vuln-scan`, `--vuln-report` |","docs/guide/references/configuration/config-file.md":"# Config file\n\nTrivy can be customized by tweaking a `trivy.yaml` file.\nThe config path can be overridden by the `--config` flag.\n\nAn example is [here][example] and a [JSON Schema][schema] is also available.\n\nThese samples contain default values for flags.\n## Global options\n\n```yaml\n# Same as '--cacert'\ncacert: \"\"\n\ncache:\n # Same as '--cache-dir'\n dir: \"/path/to/cache\"\n\n# Same as '--debug'\ndebug: false\n\n# Same as '--insecure'\ninsecure: false\n\n# Same as '--quiet'\nquiet: false\n\n# Same as '--timeout'\ntimeout: 5m0s\n\n```\n## Cache options\n\n```yaml\ncache:\n # Same as '--cache-backend'\n backend: \"fs\"\n\n redis:\n # Same as '--redis-ca'\n ca: \"\"\n\n # Same as '--redis-cert'\n cert: \"\"\n\n # Same as '--redis-key'\n key: \"\"\n\n # Same as '--redis-tls'\n tls: false\n\n # Same as '--cache-ttl'\n ttl: 0s\n\n```\n## Clean options\n\n```yaml\nclean:\n # Same as '--all'\n all: false\n\n # Same as '--checks-bundle'\n checks-bundle: false\n\n # Same as '--java-db'\n java-db: false\n\n # Same as '--scan-cache'\n scan-cache: false\n\n # Same as '--vex-repo'\n vex-repo: false\n\n # Same as '--vuln-db'\n vuln-db: false\n\n```\n## Client/Server options\n\n```yaml\nserver:\n # Same as '--server'\n addr: \"\"\n\n # Same as '--custom-headers'\n custom-headers: []\n\n # Same as '--listen'\n listen: \"localhost:4954\"\n\n # Same as '--token'\n token: \"\"\n\n # Same as '--token-header'\n token-header: \"Trivy-Token\"\n\n```\n## DB options\n\n```yaml\ndb:\n # Same as '--download-java-db-only'\n download-java-only: false\n\n # Same as '--download-db-only'\n download-only: false\n\n # Same as '--java-db-repository'\n java-repository:\n - mirror.gcr.io/aquasec/trivy-java-db:1\n - ghcr.io/aquasecurity/trivy-java-db:1\n\n # Same as '--skip-java-db-update'\n java-skip-update: false\n\n # Same as '--no-progress'\n no-progress: false\n\n # Same as '--db-repository'\n repository:\n - mirror.gcr.io/aquasec/trivy-db:2\n - ghcr.io/aquasecurity/trivy-db:2\n\n # Same as '--skip-db-update'\n skip-update: false\n\n```\n## Image options\n\n```yaml\nimage:\n docker:\n # Same as '--docker-host'\n host: \"\"\n\n # Same as '--image-config-scanners'\n image-config-scanners: []\n\n # Same as '--input'\n input: \"\"\n\n # Same as '--max-image-size'\n max-size: \"\"\n\n # Same as '--platform'\n platform: \"\"\n\n podman:\n # Same as '--podman-host'\n host: \"\"\n\n # Same as '--removed-pkgs'\n removed-pkgs: false\n\n # Same as '--image-src'\n source:\n - docker\n - containerd\n - podman\n - remote\n\n```\n## Kubernetes options\n\n```yaml\nkubernetes:\n # Same as '--burst'\n burst: 10\n\n # Same as '--disable-node-collector'\n disableNodeCollector: false\n\n exclude:\n # Same as '--exclude-nodes'\n nodes: []\n\n # Same as '--exclude-owned'\n owned: false\n\n # Same as '--exclude-kinds'\n excludeKinds: []\n\n # Same as '--exclude-namespaces'\n excludeNamespaces: []\n\n # Same as '--include-kinds'\n includeKinds: []\n\n # Same as '--include-namespaces'\n includeNamespaces: []\n\n # Same as '--k8s-version'\n k8s-version: \"\"\n\n # Same as '--kubeconfig'\n kubeconfig: \"\"\n\n node-collector:\n # Same as '--node-collector-imageref'\n imageref: \"ghcr.io/aquasecurity/node-collector:0.3.1\"\n\n # Same as '--node-collector-namespace'\n namespace: \"trivy-temp\"\n\n # Same as '--qps'\n qps: 5\n\n # Same as '--skip-images'\n skipImages: false\n\n # Same as '--tolerations'\n tolerations: []\n\n```\n## License options\n\n```yaml\nlicense:\n # Same as '--license-confidence-level'\n confidenceLevel: 0.9\n\n forbidden:\n - AGPL-1.0\n - AGPL-3.0\n - CC-BY-NC-1.0\n - CC-BY-NC-2.0\n - CC-BY-NC-2.5\n - CC-BY-NC-3.0\n - CC-BY-NC-4.0\n - CC-BY-NC-ND-1.0\n - CC-BY-NC-ND-2.0\n - CC-BY-NC-ND-2.5\n - CC-BY-NC-ND-3.0\n - CC-BY-NC-ND-4.0\n - CC-BY-NC-SA-1.0\n - CC-BY-NC-SA-2.0\n - CC-BY-NC-SA-2.5\n - CC-BY-NC-SA-3.0\n - CC-BY-NC-SA-4.0\n - Commons-Clause\n - Facebook-2-Clause\n - Facebook-3-Clause\n - Facebook-Examples\n - WTFPL\n\n # Same as '--license-full'\n full: false\n\n # Same as '--ignored-licenses'\n ignored: []\n\n notice:\n - AFL-1.1\n - AFL-1.2\n - AFL-2.0\n - AFL-2.1\n - AFL-3.0\n - Apache-1.0\n - Apache-1.1\n - Apache-2.0\n - Artistic-1.0-cl8\n - Artistic-1.0-Perl\n - Artistic-1.0\n - Artistic-2.0\n - BSL-1.0\n - BSD-1-Clause\n - BSD-2-Clause-FreeBSD\n - BSD-2-Clause-NetBSD\n - BSD-2-Clause\n - BSD-3-Clause-Attribution\n - BSD-3-Clause-Clear\n - BSD-3-Clause-LBNL\n - BSD-3-Clause\n - BSD-4-Clause\n - BSD-4-Clause-UC\n - BSD-Protection\n - CC-BY-1.0\n - CC-BY-2.0\n - CC-BY-2.5\n - CC-BY-3.0\n - CC-BY-4.0\n - FTL\n - ISC\n - ImageMagick\n - Libpng\n - Lil-1.0\n - Linux-OpenIB\n - LPL-1.02\n - LPL-1.0\n - MS-PL\n - MIT\n - NCSA\n - OpenSSL\n - PHP-3.01\n - PHP-3.0\n - PIL\n - Python-2.0\n - Python-2.0-complete\n - PostgreSQL\n - SGI-B-1.0\n - SGI-B-1.1\n - SGI-B-2.0\n - Unicode-DFS-2015\n - Unicode-DFS-2016\n - Unicode-TOU\n - UPL-1.0\n - W3C-19980720\n - W3C-20150513\n - W3C\n - X11\n - Xnet\n - Zend-2.0\n - zlib-acknowledgement\n - Zlib\n - ZPL-1.1\n - ZPL-2.0\n - ZPL-2.1\n\n permissive: []\n\n reciprocal:\n - APSL-1.0\n - APSL-1.1\n - APSL-1.2\n - APSL-2.0\n - CDDL-1.0\n - CDDL-1.1\n - CPL-1.0\n - EPL-1.0\n - EPL-2.0\n - FreeImage\n - IPL-1.0\n - MPL-1.0\n - MPL-1.1\n - MPL-2.0\n - Ruby\n\n restricted:\n - BCL\n - CC-BY-ND-1.0\n - CC-BY-ND-2.0\n - CC-BY-ND-2.5\n - CC-BY-ND-3.0\n - CC-BY-ND-4.0\n - CC-BY-SA-1.0\n - CC-BY-SA-2.0\n - CC-BY-SA-2.5\n - CC-BY-SA-3.0\n - CC-BY-SA-4.0\n - GPL-1.0\n - GPL-2.0\n - GPL-2.0-with-autoconf-exception\n - GPL-2.0-with-bison-exception\n - GPL-2.0-with-classpath-exception\n - GPL-2.0-with-font-exception\n - GPL-2.0-with-GCC-exception\n - GPL-3.0\n - GPL-3.0-with-autoconf-exception\n - GPL-3.0-with-GCC-exception\n - LGPL-2.0\n - LGPL-2.1\n - LGPL-3.0\n - NPL-1.0\n - NPL-1.1\n - OSL-1.0\n - OSL-1.1\n - OSL-2.0\n - OSL-2.1\n - OSL-3.0\n - QPL-1.0\n - Sleepycat\n\n unencumbered:\n - CC0-1.0\n - Unlicense\n - 0BSD\n\n```\n## Misconfiguration options\n\n```yaml\nansible:\n # Same as '--ansible-extra-vars'\n extra-vars: []\n\n # Same as '--ansible-inventory'\n inventories: []\n\n # Same as '--ansible-playbook'\n playbooks: []\n\nmisconfiguration:\n # Same as '--checks-bundle-repository'\n checks-bundle-repository: \"mirror.gcr.io/aquasec/trivy-checks:2\"\n\n cloudformation:\n # Same as '--cf-params'\n params: []\n\n # Same as '--config-file-schemas'\n config-file-schemas: []\n\n helm:\n # Same as '--helm-api-versions'\n api-versions: []\n\n # Same as '--helm-kube-version'\n kube-version: \"\"\n\n # Same as '--helm-set'\n set: []\n\n # Same as '--helm-set-file'\n set-file: []\n\n # Same as '--helm-set-string'\n set-string: []\n\n # Same as '--helm-values'\n values: []\n\n # Same as '--include-non-failures'\n include-non-failures: false\n\n # Same as '--raw-config-scanners'\n raw-config-scanners: []\n\n # Same as '--render-cause'\n render-cause: []\n\n # Same as '--misconfig-scanners'\n scanners:\n - azure-arm\n - cloudformation\n - dockerfile\n - helm\n - kubernetes\n - terraform\n - terraformplan-json\n - terraformplan-snapshot\n - ansible\n\n terraform:\n # Same as '--tf-exclude-downloaded-modules'\n exclude-downloaded-modules: false\n\n # Same as '--tf-vars'\n vars: []\n\n```\n## Module options\n\n```yaml\nmodule:\n # Same as '--module-dir'\n dir: \"$HOME/.trivy/modules\"\n\n # Same as '--enable-modules'\n enable-modules: []\n\n```\n## Package options\n\n```yaml\npkg:\n # Same as '--include-dev-deps'\n include-dev-deps: false\n\n # Same as '--pkg-relationships'\n relationships:\n - unknown\n - root\n - workspace\n - direct\n - indirect\n\n # Same as '--pkg-types'\n types:\n - os\n - library\n\n```\n## Registry options\n\n```yaml\nregistry:\n mirrors:\n\n # Same as '--password'\n password: []\n\n # Same as '--password-stdin'\n password-stdin: false\n\n # Same as '--registry-token'\n token: \"\"\n\n # Same as '--username'\n username: []\n\n```\n## Rego options\n\n```yaml\nrego:\n # Same as '--config-check'\n check: []\n\n # Same as '--config-data'\n data: []\n\n # Same as '--rego-error-limit'\n error-limit: 10\n\n # Same as '--include-deprecated-checks'\n include-deprecated-checks: false\n\n # Same as '--check-namespaces'\n namespaces: []\n\n # Same as '--skip-check-update'\n skip-check-update: false\n\n # Same as '--trace-rego'\n trace: false\n\n```\n## Report options\n\n```yaml\n# Same as '--dependency-tree'\ndependency-tree: false\n\n# Same as '--exit-code'\nexit-code: 0\n\n# Same as '--exit-on-eol'\nexit-on-eol: 0\n\n# Same as '--format'\nformat: \"table\"\n\n# Same as '--ignore-policy'\nignore-policy: \"\"\n\n# Same as '--ignorefile'\nignorefile: \".trivyignore\"\n\n# Same as '--list-all-pkgs'\nlist-all-pkgs: true\n\n# Same as '--output'\noutput: \"\"\n\n# Same as '--output-plugin-arg'\noutput-plugin-arg: \"\"\n\n# Same as '--report'\nreport: \"all\"\n\nscan:\n # Same as '--compliance'\n compliance: \"\"\n\n # Same as '--show-suppressed'\n show-suppressed: false\n\n# Same as '--severity'\nseverity:\n - UNKNOWN\n - LOW\n - MEDIUM\n - HIGH\n - CRITICAL\n\n# Same as '--table-mode'\ntable-mode:\n - summary\n - detailed\n\n# Same as '--template'\ntemplate: \"\"\n\n```\n## Repository options\n\n```yaml\nrepository:\n # Same as '--branch'\n branch: \"\"\n\n # Same as '--commit'\n commit: \"\"\n\n # Same as '--tag'\n tag: \"\"\n\n```\n## Scan options\n\n```yaml\nscan:\n # Same as '--detection-priority'\n detection-priority: \"precise\"\n\n # Same as '--disable-telemetry'\n disable-telemetry: false\n\n # Same as '--distro'\n distro: \"\"\n\n # Same as '--file-patterns'\n file-patterns: []\n\n maven:\n mirrors: []\n\n # Same as '--offline-scan'\n offline: false\n\n # Same as '--parallel'\n parallel: 5\n\n # Same as '--rekor-url'\n rekor-url: \"https://rekor.sigstore.dev\"\n\n # Same as '--sbom-sources'\n sbom-sources: []\n\n # Same as '--scanners'\n scanners:\n - vuln\n - secret\n\n # Same as '--skip-dirs'\n skip-dirs: []\n\n # Same as '--skip-files'\n skip-files: []\n\n # Same as '--skip-version-check'\n skip-version-check: false\n\n```\n## Secret options\n\n```yaml\nsecret:\n # Same as '--secret-config'\n config: \"trivy-secret.yaml\"\n\n```\n## Vulnerability options\n\n```yaml\nvulnerability:\n # Same as '--ignore-status'\n ignore-status: []\n\n # Same as '--ignore-unfixed'\n ignore-unfixed: false\n\n # Same as '--vuln-severity-source'\n severity-source:\n - auto\n\n # Same as '--skip-vex-repo-update'\n skip-vex-repo-update: false\n\n # Same as '--vex'\n vex: []\n\n```\n[example]: https://github.com/aquasecurity/trivy/blob/{{ git.tag }}/examples/trivy-conf/trivy.yaml\n[schema]: https://github.com/aquasecurity/trivy/blob/{{ git.tag }}/schema/trivy-config.json","docs/guide/references/modes/client-server.md":"# Client/Server\n\nTrivy has client/server mode. Trivy server has vulnerability database and Trivy client doesn't have to download vulnerability database. It is useful if you want to scan images or files at multiple locations and do not want to download the database at every location.\n\n| Client/Server Mode | Image | Rootfs | Filesystem | Repository | Config | K8s |\n|:------------------:|:-----:|:------:|:----------:|:----------:|:------:|:---:|\n| Supported | ✅ | ✅ | ✅ | ✅ | - | - |\n\nSome scanners run on the client side, even in client/server mode.\n\n| Scanner | Run on Client or Server |\n|:----------------:|:-----------------------:|\n| Vulnerability | Server |\n| Misconfiguration | Client[^1] |\n| Secret | Client[^2] |\n| License | Server |\n\n!!! note\n Scanning of misconfigurations and secrets is performed on the client side (as in standalone mode).\n Otherwise, the client would need to send files to the server that may contain sensitive information.\n\n## Server\nAt first, you need to launch Trivy server. It downloads vulnerability database automatically and continue to fetch the latest DB in the background.\n```\n$ trivy server --listen localhost:8080\n2019-12-12T15:17:06.551+0200 INFO Need to update DB\n2019-12-12T15:17:56.706+0200 INFO Reopening DB...\n2019-12-12T15:17:56.707+0200 INFO Listening localhost:8080...\n```\n\nIf you want to accept a connection from outside, you have to specify `0.0.0.0` or your ip address, not `localhost`.\n\n```\n$ trivy server --listen 0.0.0.0:8080\n```\n\n## Remote image scan\nThen, specify the server address for `image` command.\n```\n$ trivy image --server http://localhost:8080 alpine:3.10\n```\n**Note**: It's important to specify the protocol (http or https).\n\n
\nResult\n\n```\nalpine:3.10 (alpine 3.10.2)\n===========================\nTotal: 3 (UNKNOWN: 0, LOW: 1, MEDIUM: 2, HIGH: 0, CRITICAL: 0)\n\n+---------+------------------+----------+-------------------+---------------+\n| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |\n+---------+------------------+----------+-------------------+---------------+\n| openssl | CVE-2019-1549 | MEDIUM | 1.1.1c-r0 | 1.1.1d-r0 |\n+ +------------------+ + + +\n| | CVE-2019-1563 | | | |\n+ +------------------+----------+ + +\n| | CVE-2019-1547 | LOW | | |\n+---------+------------------+----------+-------------------+---------------+\n```\n
\n\n## Remote scan of local filesystem\nAlso, there is a way to scan local file system:\n```shell\n$ trivy fs --server http://localhost:8080 --severity CRITICAL ./integration/testdata/fixtures/fs/pom/\n```\n**Note**: It's important to specify the protocol (http or https).\n
\nResult\n\n```\npom.xml (pom)\n=============\nTotal: 24 (CRITICAL: 24)\n\n+---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+\n| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n+---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+\n| com.fasterxml.jackson.core:jackson-databind | CVE-2017-17485 | CRITICAL | 2.9.1 | 2.8.11, 2.9.4 | jackson-databind: Unsafe |\n| | | | | | deserialization due to |\n| | | | | | incomplete black list (incomplete |\n| | | | | | fix for CVE-2017-15095)... |\n| | | | | | -->avd.aquasec.com/nvd/cve-2017-17485 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2018-11307 | | | 2.7.9.4, 2.8.11.2, 2.9.6 | jackson-databind: Potential |\n| | | | | | information exfiltration with |\n| | | | | | default typing, serialization |\n| | | | | | gadget from MyBatis |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-11307 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2018-14718 | | | 2.6.7.2, 2.9.7 | jackson-databind: arbitrary code |\n| | | | | | execution in slf4j-ext class |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-14718 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2018-14719 | | | | jackson-databind: arbitrary |\n| | | | | | code execution in blaze-ds-opt |\n| | | | | | and blaze-ds-core classes |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-14719 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2018-14720 | | | | jackson-databind: exfiltration/XXE |\n| | | | | | in some JDK classes |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-14720 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2018-14721 | | | | jackson-databind: server-side request |\n| | | | | | forgery (SSRF) in axis2-jaxws class |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-14721 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2018-19360 | | | 2.6.7.3, 2.7.9.5, 2.8.11.3, | jackson-databind: improper |\n| | | | | 2.9.8 | polymorphic deserialization |\n| | | | | | in axis2-transport-jms class |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-19360 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2018-19361 | | | | jackson-databind: improper |\n| | | | | | polymorphic deserialization |\n| | | | | | in openjpa class |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-19361 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2018-19362 | | | | jackson-databind: improper |\n| | | | | | polymorphic deserialization |\n| | | | | | in jboss-common-core class |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-19362 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2018-7489 | | | 2.7.9.3, 2.8.11.1, 2.9.5 | jackson-databind: incomplete fix |\n| | | | | | for CVE-2017-7525 permits unsafe |\n| | | | | | serialization via c3p0 libraries |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-7489 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-14379 | | | 2.7.9.6, 2.8.11.4, 2.9.9.2 | jackson-databind: default |\n| | | | | | typing mishandling leading |\n| | | | | | to remote code execution |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-14379 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-14540 | | | 2.9.10 | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | com.zaxxer.hikari.HikariConfig |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-14540 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-14892 | | | 2.6.7.3, 2.8.11.5, 2.9.10 | jackson-databind: Serialization |\n| | | | | | gadgets in classes of the |\n| | | | | | commons-configuration package |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-14892 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-14893 | | | 2.8.11.5, 2.9.10 | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | classes of the xalan package |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-14893 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-16335 | | | 2.9.10 | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | com.zaxxer.hikari.HikariDataSource |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-16335 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-16942 | | | 2.9.10.1 | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | org.apache.commons.dbcp.datasources.* |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-16942 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2019-16943 | | | | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | com.p6spy.engine.spy.P6DataSource |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-16943 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-17267 | | | 2.9.10 | jackson-databind: Serialization |\n| | | | | | gadgets in classes of |\n| | | | | | the ehcache package |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-17267 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-17531 | | | 2.9.10.1 | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | org.apache.log4j.receivers.db.* |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-17531 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-20330 | | | 2.8.11.5, 2.9.10.2 | jackson-databind: lacks |\n| | | | | | certain net.sf.ehcache blocking |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-20330 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2020-8840 | | | 2.7.9.7, 2.8.11.5, 2.9.10.3 | jackson-databind: Lacks certain |\n| | | | | | xbean-reflect/JNDI blocking |\n| | | | | | -->avd.aquasec.com/nvd/cve-2020-8840 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2020-9546 | | | 2.7.9.7, 2.8.11.6, 2.9.10.4 | jackson-databind: Serialization |\n| | | | | | gadgets in shaded-hikari-config |\n| | | | | | -->avd.aquasec.com/nvd/cve-2020-9546 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2020-9547 | | | | jackson-databind: Serialization |\n| | | | | | gadgets in ibatis-sqlmap |\n| | | | | | -->avd.aquasec.com/nvd/cve-2020-9547 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2020-9548 | | | | jackson-databind: Serialization |\n| | | | | | gadgets in anteros-core |\n| | | | | | -->avd.aquasec.com/nvd/cve-2020-9548 |\n+---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+\n```\n
\n\n## Remote scan of root filesystem\nAlso, there is a way to scan root file system:\n```shell\n$ trivy rootfs --server http://localhost:8080 --severity CRITICAL /tmp/rootfs\n```\n**Note**: It's important to specify the protocol (http or https).\n
\nResult\n\n```\n/tmp/rootfs (alpine 3.10.2)\n\nTotal: 1 (CRITICAL: 1)\n\n┌───────────┬────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐\n│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │\n├───────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤\n│ apk-tools │ CVE-2021-36159 │ CRITICAL │ 2.10.4-r2 │ 2.10.7-r0 │ libfetch before 2021-07-26, as used in apk-tools, xbps, and │\n│ │ │ │ │ │ other products, mishandles... │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-36159 │\n└───────────┴────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘\n```\n
\n\n## Remote scan of git repository\nAlso, there is a way to scan remote git repository:\n```shell\n$ trivy repo https://github.com/knqyf263/trivy-ci-test --server http://localhost:8080 \n```\n**Note**: It's important to specify the protocol (http or https).\n
\nResult\n\n```\nCargo.lock (cargo)\n==================\nTotal: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 2, CRITICAL: 0)\n\n┌───────────┬─────────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐\n│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │\n├───────────┼─────────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤\n│ ammonia │ CVE-2019-15542 │ HIGH │ 1.9.0 │ 2.1.0 │ Uncontrolled recursion in ammonia │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-15542 │\n│ ├─────────────────────┼──────────┤ ├───────────────┼─────────────────────────────────────────────────────────────┤\n│ │ CVE-2021-38193 │ MEDIUM │ │ 2.1.3, 3.1.0 │ An issue was discovered in the ammonia crate before 3.1.0 │\n│ │ │ │ │ │ for Rust.... │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-38193 │\n├───────────┼─────────────────────┤ ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤\n│ smallvec │ CVE-2019-15551 │ │ 0.6.9 │ 0.6.10 │ An issue was discovered in the smallvec crate before 0.6.10 │\n│ │ │ │ │ │ for Rust.... │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-15551 │\n│ ├─────────────────────┼──────────┤ ├───────────────┼─────────────────────────────────────────────────────────────┤\n│ │ CVE-2018-25023 │ HIGH │ │ 0.6.13 │ An issue was discovered in the smallvec crate before 0.6.13 │\n│ │ │ │ │ │ for Rust.... │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-25023 │\n│ ├─────────────────────┼──────────┤ │ ├─────────────────────────────────────────────────────────────┤\n│ │ GHSA-66p5-j55p-32r9 │ MEDIUM │ │ │ smallvec creates uninitialized value of any type │\n│ │ │ │ │ │ https://github.com/advisories/GHSA-66p5-j55p-32r9 │\n└───────────┴─────────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘\n\nPipfile.lock (pipenv)\n=====================\nTotal: 8 (UNKNOWN: 0, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0)\n\n┌─────────────────────┬────────────────┬──────────┬───────────────────┬────────────────────────┬──────────────────────────────────────────────────────────────┐\n│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │\n├─────────────────────┼────────────────┼──────────┼───────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ celery │ CVE-2021-23727 │ HIGH │ 4.3.0 │ 5.2.2 │ celery: stored command injection vulnerability may allow │\n│ │ │ │ │ │ privileges escalation │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-23727 │\n├─────────────────────┼────────────────┤ ├───────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ django │ CVE-2019-6975 │ │ 2.0.9 │ 1.11.19, 2.0.12, 2.1.7 │ python-django: memory exhaustion in │\n│ │ │ │ │ │ django.utils.numberformat.format() │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-6975 │\n│ ├────────────────┼──────────┤ ├────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ │ CVE-2019-3498 │ MEDIUM │ │ 1.11.18, 2.0.10, 2.1.5 │ python-django: Content spoofing via URL path in default 404 │\n│ │ │ │ │ │ page │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-3498 │\n│ ├────────────────┤ │ ├────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ │ CVE-2021-33203 │ │ │ 2.2.24, 3.1.12, 3.2.4 │ django: Potential directory traversal via ``admindocs`` │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-33203 │\n├─────────────────────┼────────────────┤ ├───────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ urllib3 │ CVE-2019-11324 │ │ 1.24.1 │ 1.24.2 │ python-urllib3: Certification mishandle when error should be │\n│ │ │ │ │ │ thrown │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-11324 │\n│ ├────────────────┤ │ ├────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ │ CVE-2021-33503 │ │ │ 1.26.5 │ python-urllib3: ReDoS in the parsing of authority part of │\n│ │ │ │ │ │ URL │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-33503 │\n│ ├────────────────┼──────────┤ ├────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ │ CVE-2019-11236 │ MEDIUM │ │ 1.24.3 │ python-urllib3: CRLF injection due to not encoding the │\n│ │ │ │ │ │ '\\r\\n' sequence leading to... │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-11236 │\n│ ├────────────────┤ │ ├────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ │ CVE-2020-26137 │ │ │ 1.25.9 │ python-urllib3: CRLF injection via HTTP request method │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-26137 │\n└─────────────────────┴────────────────┴──────────┴───────────────────┴────────────────────────┴──────────────────────────────────────────────────────────────┘\n```\n
\n\n## Authentication\n\n```\n$ trivy server --listen localhost:8080 --token dummy\n```\n\n```\n$ trivy image --server http://localhost:8080 --token dummy alpine:3.10\n```\n\n## Security considerations\n\nClients analyze artifacts locally and upload analysis results, such as package lists, to the server's shared cache. The server uses these results for vulnerability scanning without receiving the original artifact contents. All clients with access to the server must therefore be trusted to submit accurate analysis results.\n\nThe server token controls access to both the scanning and cache APIs. It does not provide per-client permissions or tenant isolation: clients with access can write and delete shared cache entries, affecting scans performed by other clients. Use separate server instances and separate cache storage for mutually untrusted clients, including when using a Redis cache backend.\n\nThe server listens on `localhost:4954` by default. When exposing it to other hosts, configure `--token` and restrict network access to trusted clients. Protect connections with HTTPS through a TLS-terminating reverse proxy or an equivalent secure transport, since the server itself serves HTTP.\n\n## Endpoints\n\n### Health\nChecks whether the Trivy server is running. Authentication is not required.\n\nExample request:\n```bash\ncurl -s 0.0.0.0:8080/healthz\nok\n```\n\nReturns the `200 OK` status if the request was successful.\n### Version\n\nReturns the version of the Trivy server and the vulnerability database metadata. Authentication is not required.\n\nExample request:\n```bash\ncurl -s 0.0.0.0:8080/version | jq\n{\n \"Version\": \"dev\",\n \"VulnerabilityDB\": {\n \"Version\": 2,\n \"NextUpdate\": \"2023-07-25T14:15:29.876639806Z\",\n \"UpdatedAt\": \"2023-07-25T08:15:29.876640206Z\",\n \"DownloadedAt\": \"2023-07-25T09:36:25.599004Z\"\n }\n}\n```\n\nReturns the `200 OK` status if the request was successful.\n\n## Architecture\n\n![architecture](../../../imgs/client-server.png)\n\n[^1]: The checks bundle is also downloaded on the client side.\n[^2]: The scan result with masked secrets is sent to the server","pkg/commands/testdata/db/metadata.json":"{\n \"Version\": 2,\n \"NextUpdate\": \"2022-03-02T12:07:07.99504023Z\",\n \"UpdatedAt\": \"2022-03-02T06:07:07.99504083Z\",\n \"DownloadedAt\": \"2022-03-02T10:03:38.383312Z\"\n}\n\n","pkg/commands/testdata/java-db/metadata.json":"{\"Version\":1,\"NextUpdate\":\"2023-03-17T00:47:02.774253254Z\",\"UpdatedAt\":\"2023-03-14T00:47:02.774253754Z\",\"DownloadedAt\":\"2023-03-14T03:04:55.058541039Z\"}\n","pkg/commands/testdata/policy/metadata.json":"{\"Digest\":\"sha256:19a017cdc798631ad42f6f4dce823d77b2989128f0e1a7f9bc83ae3c59024edd\",\"DownloadedAt\":\"2023-03-01T17:06:08.191725-08:00\"}","docs/guide/references/configuration/cli/trivy.md":"## trivy\n\nUnified security scanner\n\n### Synopsis\n\nScanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues and hard-coded secrets\n\n```\ntrivy [global flags] command [flags] target\n```\n\n### Examples\n\n```\n # Scan a container image\n $ trivy image python:3.4-alpine\n\n # Scan a container image from a tar archive\n $ trivy image --input ruby-3.1.tar\n\n # Scan local filesystem\n $ trivy fs .\n\n # Run in server mode\n $ trivy server\n```\n\n### Options\n\n```\n --cacert string Path to PEM-encoded CA certificate file\n --cache-dir string cache directory (default \"/path/to/cache\")\n -c, --config string config path (empty string disables loading) (default \"trivy.yaml\")\n -d, --debug debug mode\n -f, --format string version format (json)\n --generate-default-config write the default config to trivy-default.yaml\n -h, --help help for trivy\n --insecure allow insecure server connections\n -q, --quiet suppress progress bar and log output\n --timeout duration timeout (default 5m0s)\n -v, --version show version\n```\n\n### SEE ALSO\n\n* [trivy clean](trivy_clean.md)\t - Remove cached files\n* [trivy config](trivy_config.md)\t - Scan config files for misconfigurations\n* [trivy convert](trivy_convert.md)\t - Convert Trivy JSON report into a different format\n* [trivy filesystem](trivy_filesystem.md)\t - Scan local filesystem\n* [trivy image](trivy_image.md)\t - Scan a container image\n* [trivy kubernetes](trivy_kubernetes.md)\t - [EXPERIMENTAL] Scan kubernetes cluster\n* [trivy module](trivy_module.md)\t - Manage modules\n* [trivy plugin](trivy_plugin.md)\t - Manage plugins\n* [trivy registry](trivy_registry.md)\t - Manage registry authentication\n* [trivy repository](trivy_repository.md)\t - Scan a repository\n* [trivy rootfs](trivy_rootfs.md)\t - Scan rootfs\n* [trivy sbom](trivy_sbom.md)\t - Scan SBOM for vulnerabilities and licenses\n* [trivy server](trivy_server.md)\t - Server mode\n* [trivy version](trivy_version.md)\t - Print the version\n* [trivy vex](trivy_vex.md)\t - [EXPERIMENTAL] VEX utilities\n* [trivy vm](trivy_vm.md)\t - [EXPERIMENTAL] Scan a virtual machine image\n\n","docs/guide/references/configuration/cli/trivy_clean.md":"## trivy clean\n\nRemove cached files\n\n```\ntrivy clean [flags]\n```\n\n### Examples\n\n```\n # Remove all caches\n $ trivy clean --all\n\n # Remove scan cache\n $ trivy clean --scan-cache\n\n # Remove vulnerability database\n $ trivy clean --vuln-db\n\n```\n\n### Options\n\n```\n -a, --all remove all caches\n --checks-bundle remove checks bundle\n -h, --help help for clean\n --java-db remove Java database\n --scan-cache remove scan cache (container and VM image analysis results)\n --vex-repo remove VEX repositories\n --vuln-db remove vulnerability database\n```\n\n### Options inherited from parent commands\n\n```\n --cacert string Path to PEM-encoded CA certificate file\n --cache-dir string cache directory (default \"/path/to/cache\")\n -c, --config string config path (empty string disables loading) (default \"trivy.yaml\")\n -d, --debug debug mode\n --generate-default-config write the default config to trivy-default.yaml\n --insecure allow insecure server connections\n -q, --quiet suppress progress bar and log output\n --timeout duration timeout (default 5m0s)\n -v, --version show version\n```\n\n### SEE ALSO\n\n* [trivy](trivy.md)\t - Unified security scanner\n\n","docs/guide/references/modes/standalone.md":"# Standalone\n\n`trivy image`, `trivy filesystem`, and `trivy repo` works as standalone mode.\n\n## Image\n\n![standalone](../../../imgs/image.png)\n\n## Filesystem\n\n![fs](../../../imgs/fs.png)\n\n## Git Repository\n\n![repo](../../../imgs/repo.png)\n\n","docs/guide/references/configuration/cli/trivy_config.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_config.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_config.md)","docs/guide/references/configuration/cli/trivy_convert.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_convert.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_convert.md)","docs/guide/references/configuration/cli/trivy_filesystem.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_filesystem.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_filesystem.md)","docs/guide/references/configuration/cli/trivy_image.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_image.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_image.md)","docs/guide/references/configuration/cli/trivy_kubernetes.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_kubernetes.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_kubernetes.md)","docs/guide/references/configuration/cli/trivy_module.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_module.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_module.md)","docs/guide/references/configuration/cli/trivy_module_install.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_module_install.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_module_install.md)","docs/guide/references/configuration/cli/trivy_module_uninstall.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_module_uninstall.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_module_uninstall.md)","docs/guide/references/configuration/cli/trivy_plugin.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin.md)","docs/guide/references/configuration/cli/trivy_plugin_info.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_info.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_info.md)","docs/guide/references/configuration/cli/trivy_plugin_install.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_install.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_install.md)","docs/guide/references/configuration/cli/trivy_plugin_list.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_list.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_list.md)","docs/guide/references/configuration/cli/trivy_plugin_run.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_run.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_run.md)","docs/guide/references/configuration/cli/trivy_plugin_search.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_search.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_search.md)","docs/guide/references/configuration/cli/trivy_plugin_uninstall.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_uninstall.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_uninstall.md)","docs/guide/references/configuration/cli/trivy_plugin_update.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_update.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_update.md)","docs/guide/references/configuration/cli/trivy_plugin_upgrade.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_upgrade.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_upgrade.md)","docs/guide/references/configuration/cli/trivy_registry.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_registry.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_registry.md)","docs/guide/references/configuration/cli/trivy_registry_login.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_registry_login.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_registry_login.md)","docs/guide/references/configuration/cli/trivy_registry_logout.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_registry_logout.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_registry_logout.md)","docs/guide/references/configuration/cli/trivy_repository.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_repository.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_repository.md)","docs/guide/references/configuration/cli/trivy_rootfs.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_rootfs.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_rootfs.md)","docs/guide/references/configuration/cli/trivy_sbom.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_sbom.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_sbom.md)","docs/guide/references/configuration/cli/trivy_server.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_server.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_server.md)","docs/guide/references/configuration/cli/trivy_version.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_version.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_version.md)","docs/guide/references/configuration/cli/trivy_vex.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex.md)","docs/guide/references/configuration/cli/trivy_vex_repo.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex_repo.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo.md)","docs/guide/references/configuration/cli/trivy_vex_repo_download.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex_repo_download.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo_download.md)","docs/guide/references/configuration/cli/trivy_vex_repo_init.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex_repo_init.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo_init.md)","docs/guide/references/configuration/cli/trivy_vex_repo_list.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex_repo_list.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo_list.md)","docs/guide/references/configuration/cli/trivy_vm.md":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vm.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vm.md)","pkg/plugin/testdata/.trivy/plugins/index.yaml":"# Plugins Skill\n\nPath: `pkg/plugin/testdata/.trivy/plugins/index.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/plugin/testdata/.trivy/plugins/index.yaml)","pkg/plugin/testdata/.trivy/plugins/test_plugin/plugin.yaml":"# Test_plugin Skill\n\nPath: `pkg/plugin/testdata/.trivy/plugins/test_plugin/plugin.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/plugin/testdata/.trivy/plugins/test_plugin/plugin.yaml)","pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package1/package.json":"# Package1 Skill\n\nPath: `pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package1/package.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package1/package.json)","pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package2/package.json":"# Package2 Skill\n\nPath: `pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package2/package.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package2/package.json)","pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/utils/util1/package.json":"# Util1 Skill\n\nPath: `pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/utils/util1/package.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/utils/util1/package.json)"},"items":[{"name":"abbreviations.md","path":"docs/guide/references/abbreviations.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/abbreviations.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# Abbreviation List\n\nThis list compiles words that frequently appear in CLI flags or configuration files and are commonly abbreviated in industry and OSS communities.\nTrivy may use the abbreviation in place of the full spelling for flag names.\nIt is also acceptable to add even shorter aliases if needed.\n\nWords not included in this list should be spelled out in full when used in flags.\n\nThis list is intentionally limited to the most common and widely recognized abbreviations.\nExcessive use of abbreviations in CLI flags can hinder initial user understanding and create a steeper learning curve.\n\n!!! note\n This list serves as a guideline rather than a strict requirement.\n Its purpose is to maintain consistency across the project when naming flags and configuration options.\n While we strive to follow these abbreviations, there may be exceptions where context or clarity demands a different approach.\n\n## Scope\nThis list focuses on abbreviations of single words commonly used in technical contexts. It does not include:\n\n1. Acronyms formed from the initial letters of multiple words (e.g., OS for Operating System, HTTP for Hypertext Transfer Protocol)\n2. Domain-specific terminology that already has standardized short forms\n3. Brand names or product-specific abbreviations\n\nThe abbreviations listed here are primarily intended for CLI flags, configuration keys, and similar technical interfaces where brevity is valued while maintaining clarity.\n\n## Example\nFor a flag containing multiple words, only abbreviate words that appear in this list.\nFor instance, in `--database-repository`, \"database\" is in the list so it should be abbreviated to \"db\", but \"repository\" is not in the list so it must be spelled out completely.\nThe correct flag name would be `--db-repository`.\nIt's acceptable to add a shorter alias like `--db-repo` if desired.\n\n## List\n\n| Full Name | Default Abbreviation | Examples |\n|-------------------|----------------------|-----------------------------------------------------------|\n| application | app | `--app-name`, `--app-mode` |\n| authentication | auth | `--auth-method`, `--auth-token` |\n| authorization | authz | `--authz-rule`, `--authz-policy` |\n| command | cmd | `--cmd-option`, `--cmd-args` |\n| configuration | config | `--config`, `--config-dir` |\n| database | db | `--db-repository`, `--db-user`, `--db-pass` |\n| development | dev | `--dev-dependencies`, `--dev-mode` |\n| directory | dir | `--dir-path`, `--output-dir` |\n| environment | env | `--env-file`, `--env-vars` |\n| information | info | `--info-level`, `--show-info` |\n| initialization | init | `--init-script`, `--init-config` |\n| library | lib | `--lib-path`, `--lib-dir` |\n| maximum | max | `--max-image-size`, `--max-depth` |\n| minimum | min | `--min-value`, `--min-severity` |\n| misconfiguration | misconfig | `--misconfig-scanners` |\n| package | pkg | `--pkg-types` |\n| production | prod | `--prod-env`, `--prod-deploy` |\n| specification | spec | `--spec-file`, `--spec-version` |\n| temporary | tmp | `--tmp-dir`, `--tmp-file` |\n| utility | util | `--util-script`, `--util-name` |\n| vulnerability | vuln | `--vuln-scan`, `--vuln-report` |","isInternal":false,"tokens":802,"sizeBytes":4282},{"name":"compatibility.md","path":"docs/guide/references/compatibility.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/compatibility.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# Compatibility and Stability\n\nTrivy is designed, distributed, and supported primarily as a CLI application.\n\nThe Trivy project strives to preserve compatibility between releases for documented user-facing interfaces, except for features explicitly marked as experimental or subject to change. Unintended compatibility issues in stable interfaces are generally treated as bugs.\n\n## Stable Interfaces\n\nThe following interfaces documented in the official Trivy documentation are covered by this compatibility policy:\n\n- CLI commands, subcommands, flags, and arguments\n- Configuration file options and environment variables\n- Exit codes and the conditions under which they are returned\n- Machine-readable output formats\n- Data fields used by custom templates\n\nAdding a new command, flag, configuration option, or output field is considered compatible as long as it does not change existing usage.\n\nWhen the documentation and implementation disagree, neither is automatically considered authoritative. We determine the intended behavior by considering existing usage, user impact, and consistency with other features, and then correct either the implementation or the documentation.\n\nTrivy's JSON output includes a `SchemaVersion` that identifies the output structure. Within the same `SchemaVersion`, optional fields may be added or omitted, so consumers should ignore unknown fields and must not assume that optional fields are always present. Removing or renaming an existing field, changing its type, or changing its meaning incompatibly generally requires an update to `SchemaVersion` and is documented as a breaking change in the release notes.\n\n## Interfaces Outside the Compatibility Policy\n\nThe following are not part of Trivy's stable user-facing interfaces:\n\n- Go packages, types, functions, methods, and other Go APIs in the Trivy repository\n- Required versions of Go, Mage, and other build tools, as well as development commands and build scripts\n- The exact formatting of terminal output, logs, warnings, error messages, and progress displays\n- Scan results, including detected vulnerabilities, misconfigurations, secrets, and licenses, as well as their content and ordering\n- Internal formats and protocols, such as caches, vulnerability databases, on-disk data, internal RPC, and Protocol Buffers definitions\n- Compatibility between different versions of the Trivy client and Trivy server\n- Experimental or preview features, canary builds, and prerelease versions\n- Changes in behavior or coverage caused by external specifications, services, platforms, or data sources\n\nTrivy is not designed or supported for use as a Go library. Interfaces outside this policy may be changed or removed without a deprecation period.\n\nEven if such a change breaks external code or a custom build procedure, it is not, by itself, considered a breaking change to the Trivy CLI. As a rule, these changes are not identified as breaking changes in the release notes or announced separately. Users should not assume that they will be announced in advance.\n\n## Scan Asset Version Support\n\nSome [scan assets](terminology.md#scan-assets) use versioned formats that are tied to particular Trivy CLI versions:\n\n- Vulnerability Database ([trivy-db](https://github.com/aquasecurity/trivy-db)): schema version\n- Java Index Database ([trivy-java-db](https://github.com/aquasecurity/trivy-java-db)): schema version\n- Checks Bundle ([trivy-checks](https://github.com/aquasecurity/trivy-checks)): major version\n\nEach Trivy CLI version is compatible with particular versions of these assets.\n\nWhen updates for an older scan asset version end, Trivy CLI versions that depend on it can no longer receive newly published vulnerability information, Java artifact identification data, or misconfiguration checks from that asset.\n\nBefore ending updates for a scan asset version, the Trivy project announces the affected CLI versions, the end date for updates, and the minimum CLI version to which users should upgrade. A scan asset version change is not considered a breaking change to the Trivy CLI. However, because users must upgrade to continue receiving current scan asset updates, it is announced separately from ordinary internal changes.\n\n## Breaking Changes\n\nA change that requires users to modify an existing valid use of a stable interface is considered a breaking change.\n\nWhen a breaking change is necessary, we identify it in the release notes and provide migration guidance whenever possible. We announce a deprecation before making the change when practical, but do not guarantee a fixed deprecation period for every interface.\n\nThe usual deprecation process may not be possible when responding to an urgent security issue, an incompatible change in an external system, an obvious bug, or a risk of significant false positives, false negatives, data corruption, or other safety issues. Even in these cases, we describe changes with significant user impact in the release notes whenever possible.\n","isInternal":false,"tokens":935,"sizeBytes":4983},{"name":"trivy_clean.md","path":"docs/guide/references/configuration/cli/trivy_clean.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_clean.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"## trivy clean\n\nRemove cached files\n\n```\ntrivy clean [flags]\n```\n\n### Examples\n\n```\n # Remove all caches\n $ trivy clean --all\n\n # Remove scan cache\n $ trivy clean --scan-cache\n\n # Remove vulnerability database\n $ trivy clean --vuln-db\n\n```\n\n### Options\n\n```\n -a, --all remove all caches\n --checks-bundle remove checks bundle\n -h, --help help for clean\n --java-db remove Java database\n --scan-cache remove scan cache (container and VM image analysis results)\n --vex-repo remove VEX repositories\n --vuln-db remove vulnerability database\n```\n\n### Options inherited from parent commands\n\n```\n --cacert string Path to PEM-encoded CA certificate file\n --cache-dir string cache directory (default \"/path/to/cache\")\n -c, --config string config path (empty string disables loading) (default \"trivy.yaml\")\n -d, --debug debug mode\n --generate-default-config write the default config to trivy-default.yaml\n --insecure allow insecure server connections\n -q, --quiet suppress progress bar and log output\n --timeout duration timeout (default 5m0s)\n -v, --version show version\n```\n\n### SEE ALSO\n\n* [trivy](trivy.md)\t - Unified security scanner\n\n","isInternal":false,"tokens":315,"sizeBytes":1363},{"name":"trivy_config.md","path":"docs/guide/references/configuration/cli/trivy_config.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_config.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_config.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_config.md)","tokens":300,"sizeBytes":221},{"name":"trivy_convert.md","path":"docs/guide/references/configuration/cli/trivy_convert.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_convert.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_convert.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_convert.md)","tokens":300,"sizeBytes":223},{"name":"trivy_filesystem.md","path":"docs/guide/references/configuration/cli/trivy_filesystem.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_filesystem.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_filesystem.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_filesystem.md)","tokens":300,"sizeBytes":229},{"name":"trivy_image.md","path":"docs/guide/references/configuration/cli/trivy_image.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_image.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_image.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_image.md)","tokens":300,"sizeBytes":219},{"name":"trivy_kubernetes.md","path":"docs/guide/references/configuration/cli/trivy_kubernetes.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_kubernetes.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_kubernetes.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_kubernetes.md)","tokens":300,"sizeBytes":229},{"name":"trivy_module_install.md","path":"docs/guide/references/configuration/cli/trivy_module_install.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_module_install.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_module_install.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_module_install.md)","tokens":300,"sizeBytes":237},{"name":"trivy_module_uninstall.md","path":"docs/guide/references/configuration/cli/trivy_module_uninstall.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_module_uninstall.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_module_uninstall.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_module_uninstall.md)","tokens":300,"sizeBytes":241},{"name":"trivy_module.md","path":"docs/guide/references/configuration/cli/trivy_module.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_module.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_module.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_module.md)","tokens":300,"sizeBytes":221},{"name":"trivy_plugin_info.md","path":"docs/guide/references/configuration/cli/trivy_plugin_info.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_info.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_info.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_info.md)","tokens":300,"sizeBytes":231},{"name":"trivy_plugin_install.md","path":"docs/guide/references/configuration/cli/trivy_plugin_install.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_install.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_install.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_install.md)","tokens":300,"sizeBytes":237},{"name":"trivy_plugin_list.md","path":"docs/guide/references/configuration/cli/trivy_plugin_list.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_list.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_list.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_list.md)","tokens":300,"sizeBytes":231},{"name":"trivy_plugin_run.md","path":"docs/guide/references/configuration/cli/trivy_plugin_run.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_run.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_run.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_run.md)","tokens":300,"sizeBytes":229},{"name":"trivy_plugin_search.md","path":"docs/guide/references/configuration/cli/trivy_plugin_search.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_search.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_search.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_search.md)","tokens":300,"sizeBytes":235},{"name":"trivy_plugin_uninstall.md","path":"docs/guide/references/configuration/cli/trivy_plugin_uninstall.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_uninstall.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_uninstall.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_uninstall.md)","tokens":300,"sizeBytes":241},{"name":"trivy_plugin_update.md","path":"docs/guide/references/configuration/cli/trivy_plugin_update.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_update.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_update.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_update.md)","tokens":300,"sizeBytes":235},{"name":"trivy_plugin_upgrade.md","path":"docs/guide/references/configuration/cli/trivy_plugin_upgrade.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_upgrade.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_upgrade.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_upgrade.md)","tokens":300,"sizeBytes":237},{"name":"trivy_plugin.md","path":"docs/guide/references/configuration/cli/trivy_plugin.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin.md)","tokens":300,"sizeBytes":221},{"name":"trivy_registry_login.md","path":"docs/guide/references/configuration/cli/trivy_registry_login.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_registry_login.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_registry_login.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_registry_login.md)","tokens":300,"sizeBytes":237},{"name":"trivy_registry_logout.md","path":"docs/guide/references/configuration/cli/trivy_registry_logout.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_registry_logout.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_registry_logout.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_registry_logout.md)","tokens":300,"sizeBytes":239},{"name":"trivy_registry.md","path":"docs/guide/references/configuration/cli/trivy_registry.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_registry.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_registry.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_registry.md)","tokens":300,"sizeBytes":225},{"name":"trivy_repository.md","path":"docs/guide/references/configuration/cli/trivy_repository.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_repository.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_repository.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_repository.md)","tokens":300,"sizeBytes":229},{"name":"trivy_rootfs.md","path":"docs/guide/references/configuration/cli/trivy_rootfs.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_rootfs.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_rootfs.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_rootfs.md)","tokens":300,"sizeBytes":221},{"name":"trivy_sbom.md","path":"docs/guide/references/configuration/cli/trivy_sbom.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_sbom.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_sbom.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_sbom.md)","tokens":300,"sizeBytes":217},{"name":"trivy_server.md","path":"docs/guide/references/configuration/cli/trivy_server.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_server.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_server.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_server.md)","tokens":300,"sizeBytes":221},{"name":"trivy_version.md","path":"docs/guide/references/configuration/cli/trivy_version.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_version.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_version.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_version.md)","tokens":300,"sizeBytes":223},{"name":"trivy_vex_repo_download.md","path":"docs/guide/references/configuration/cli/trivy_vex_repo_download.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo_download.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex_repo_download.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo_download.md)","tokens":300,"sizeBytes":243},{"name":"trivy_vex_repo_init.md","path":"docs/guide/references/configuration/cli/trivy_vex_repo_init.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo_init.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex_repo_init.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo_init.md)","tokens":300,"sizeBytes":235},{"name":"trivy_vex_repo_list.md","path":"docs/guide/references/configuration/cli/trivy_vex_repo_list.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo_list.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex_repo_list.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo_list.md)","tokens":300,"sizeBytes":235},{"name":"trivy_vex_repo.md","path":"docs/guide/references/configuration/cli/trivy_vex_repo.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex_repo.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo.md)","tokens":300,"sizeBytes":225},{"name":"trivy_vex.md","path":"docs/guide/references/configuration/cli/trivy_vex.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex.md)","tokens":300,"sizeBytes":215},{"name":"trivy_vm.md","path":"docs/guide/references/configuration/cli/trivy_vm.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vm.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vm.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vm.md)","tokens":300,"sizeBytes":213},{"name":"trivy.md","path":"docs/guide/references/configuration/cli/trivy.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy.md","title":"Cli Skill","category":"anthropic-skill","format":"markdown","content":"## trivy\n\nUnified security scanner\n\n### Synopsis\n\nScanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues and hard-coded secrets\n\n```\ntrivy [global flags] command [flags] target\n```\n\n### Examples\n\n```\n # Scan a container image\n $ trivy image python:3.4-alpine\n\n # Scan a container image from a tar archive\n $ trivy image --input ruby-3.1.tar\n\n # Scan local filesystem\n $ trivy fs .\n\n # Run in server mode\n $ trivy server\n```\n\n### Options\n\n```\n --cacert string Path to PEM-encoded CA certificate file\n --cache-dir string cache directory (default \"/path/to/cache\")\n -c, --config string config path (empty string disables loading) (default \"trivy.yaml\")\n -d, --debug debug mode\n -f, --format string version format (json)\n --generate-default-config write the default config to trivy-default.yaml\n -h, --help help for trivy\n --insecure allow insecure server connections\n -q, --quiet suppress progress bar and log output\n --timeout duration timeout (default 5m0s)\n -v, --version show version\n```\n\n### SEE ALSO\n\n* [trivy clean](trivy_clean.md)\t - Remove cached files\n* [trivy config](trivy_config.md)\t - Scan config files for misconfigurations\n* [trivy convert](trivy_convert.md)\t - Convert Trivy JSON report into a different format\n* [trivy filesystem](trivy_filesystem.md)\t - Scan local filesystem\n* [trivy image](trivy_image.md)\t - Scan a container image\n* [trivy kubernetes](trivy_kubernetes.md)\t - [EXPERIMENTAL] Scan kubernetes cluster\n* [trivy module](trivy_module.md)\t - Manage modules\n* [trivy plugin](trivy_plugin.md)\t - Manage plugins\n* [trivy registry](trivy_registry.md)\t - Manage registry authentication\n* [trivy repository](trivy_repository.md)\t - Scan a repository\n* [trivy rootfs](trivy_rootfs.md)\t - Scan rootfs\n* [trivy sbom](trivy_sbom.md)\t - Scan SBOM for vulnerabilities and licenses\n* [trivy server](trivy_server.md)\t - Server mode\n* [trivy version](trivy_version.md)\t - Print the version\n* [trivy vex](trivy_vex.md)\t - [EXPERIMENTAL] VEX utilities\n* [trivy vm](trivy_vm.md)\t - [EXPERIMENTAL] Scan a virtual machine image\n\n","isInternal":false,"tokens":604,"sizeBytes":2295},{"name":"config-file.md","path":"docs/guide/references/configuration/config-file.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/config-file.md","title":"Configuration Skill","category":"anthropic-skill","format":"markdown","content":"# Config file\n\nTrivy can be customized by tweaking a `trivy.yaml` file.\nThe config path can be overridden by the `--config` flag.\n\nAn example is [here][example] and a [JSON Schema][schema] is also available.\n\nThese samples contain default values for flags.\n## Global options\n\n```yaml\n# Same as '--cacert'\ncacert: \"\"\n\ncache:\n # Same as '--cache-dir'\n dir: \"/path/to/cache\"\n\n# Same as '--debug'\ndebug: false\n\n# Same as '--insecure'\ninsecure: false\n\n# Same as '--quiet'\nquiet: false\n\n# Same as '--timeout'\ntimeout: 5m0s\n\n```\n## Cache options\n\n```yaml\ncache:\n # Same as '--cache-backend'\n backend: \"fs\"\n\n redis:\n # Same as '--redis-ca'\n ca: \"\"\n\n # Same as '--redis-cert'\n cert: \"\"\n\n # Same as '--redis-key'\n key: \"\"\n\n # Same as '--redis-tls'\n tls: false\n\n # Same as '--cache-ttl'\n ttl: 0s\n\n```\n## Clean options\n\n```yaml\nclean:\n # Same as '--all'\n all: false\n\n # Same as '--checks-bundle'\n checks-bundle: false\n\n # Same as '--java-db'\n java-db: false\n\n # Same as '--scan-cache'\n scan-cache: false\n\n # Same as '--vex-repo'\n vex-repo: false\n\n # Same as '--vuln-db'\n vuln-db: false\n\n```\n## Client/Server options\n\n```yaml\nserver:\n # Same as '--server'\n addr: \"\"\n\n # Same as '--custom-headers'\n custom-headers: []\n\n # Same as '--listen'\n listen: \"localhost:4954\"\n\n # Same as '--token'\n token: \"\"\n\n # Same as '--token-header'\n token-header: \"Trivy-Token\"\n\n```\n## DB options\n\n```yaml\ndb:\n # Same as '--download-java-db-only'\n download-java-only: false\n\n # Same as '--download-db-only'\n download-only: false\n\n # Same as '--java-db-repository'\n java-repository:\n - mirror.gcr.io/aquasec/trivy-java-db:1\n - ghcr.io/aquasecurity/trivy-java-db:1\n\n # Same as '--skip-java-db-update'\n java-skip-update: false\n\n # Same as '--no-progress'\n no-progress: false\n\n # Same as '--db-repository'\n repository:\n - mirror.gcr.io/aquasec/trivy-db:2\n - ghcr.io/aquasecurity/trivy-db:2\n\n # Same as '--skip-db-update'\n skip-update: false\n\n```\n## Image options\n\n```yaml\nimage:\n docker:\n # Same as '--docker-host'\n host: \"\"\n\n # Same as '--image-config-scanners'\n image-config-scanners: []\n\n # Same as '--input'\n input: \"\"\n\n # Same as '--max-image-size'\n max-size: \"\"\n\n # Same as '--platform'\n platform: \"\"\n\n podman:\n # Same as '--podman-host'\n host: \"\"\n\n # Same as '--removed-pkgs'\n removed-pkgs: false\n\n # Same as '--image-src'\n source:\n - docker\n - containerd\n - podman\n - remote\n\n```\n## Kubernetes options\n\n```yaml\nkubernetes:\n # Same as '--burst'\n burst: 10\n\n # Same as '--disable-node-collector'\n disableNodeCollector: false\n\n exclude:\n # Same as '--exclude-nodes'\n nodes: []\n\n # Same as '--exclude-owned'\n owned: false\n\n # Same as '--exclude-kinds'\n excludeKinds: []\n\n # Same as '--exclude-namespaces'\n excludeNamespaces: []\n\n # Same as '--include-kinds'\n includeKinds: []\n\n # Same as '--include-namespaces'\n includeNamespaces: []\n\n # Same as '--k8s-version'\n k8s-version: \"\"\n\n # Same as '--kubeconfig'\n kubeconfig: \"\"\n\n node-collector:\n # Same as '--node-collector-imageref'\n imageref: \"ghcr.io/aquasecurity/node-collector:0.3.1\"\n\n # Same as '--node-collector-namespace'\n namespace: \"trivy-temp\"\n\n # Same as '--qps'\n qps: 5\n\n # Same as '--skip-images'\n skipImages: false\n\n # Same as '--tolerations'\n tolerations: []\n\n```\n## License options\n\n```yaml\nlicense:\n # Same as '--license-confidence-level'\n confidenceLevel: 0.9\n\n forbidden:\n - AGPL-1.0\n - AGPL-3.0\n - CC-BY-NC-1.0\n - CC-BY-NC-2.0\n - CC-BY-NC-2.5\n - CC-BY-NC-3.0\n - CC-BY-NC-4.0\n - CC-BY-NC-ND-1.0\n - CC-BY-NC-ND-2.0\n - CC-BY-NC-ND-2.5\n - CC-BY-NC-ND-3.0\n - CC-BY-NC-ND-4.0\n - CC-BY-NC-SA-1.0\n - CC-BY-NC-SA-2.0\n - CC-BY-NC-SA-2.5\n - CC-BY-NC-SA-3.0\n - CC-BY-NC-SA-4.0\n - Commons-Clause\n - Facebook-2-Clause\n - Facebook-3-Clause\n - Facebook-Examples\n - WTFPL\n\n # Same as '--license-full'\n full: false\n\n # Same as '--ignored-licenses'\n ignored: []\n\n notice:\n - AFL-1.1\n - AFL-1.2\n - AFL-2.0\n - AFL-2.1\n - AFL-3.0\n - Apache-1.0\n - Apache-1.1\n - Apache-2.0\n - Artistic-1.0-cl8\n - Artistic-1.0-Perl\n - Artistic-1.0\n - Artistic-2.0\n - BSL-1.0\n - BSD-1-Clause\n - BSD-2-Clause-FreeBSD\n - BSD-2-Clause-NetBSD\n - BSD-2-Clause\n - BSD-3-Clause-Attribution\n - BSD-3-Clause-Clear\n - BSD-3-Clause-LBNL\n - BSD-3-Clause\n - BSD-4-Clause\n - BSD-4-Clause-UC\n - BSD-Protection\n - CC-BY-1.0\n - CC-BY-2.0\n - CC-BY-2.5\n - CC-BY-3.0\n - CC-BY-4.0\n - FTL\n - ISC\n - ImageMagick\n - Libpng\n - Lil-1.0\n - Linux-OpenIB\n - LPL-1.02\n - LPL-1.0\n - MS-PL\n - MIT\n - NCSA\n - OpenSSL\n - PHP-3.01\n - PHP-3.0\n - PIL\n - Python-2.0\n - Python-2.0-complete\n - PostgreSQL\n - SGI-B-1.0\n - SGI-B-1.1\n - SGI-B-2.0\n - Unicode-DFS-2015\n - Unicode-DFS-2016\n - Unicode-TOU\n - UPL-1.0\n - W3C-19980720\n - W3C-20150513\n - W3C\n - X11\n - Xnet\n - Zend-2.0\n - zlib-acknowledgement\n - Zlib\n - ZPL-1.1\n - ZPL-2.0\n - ZPL-2.1\n\n permissive: []\n\n reciprocal:\n - APSL-1.0\n - APSL-1.1\n - APSL-1.2\n - APSL-2.0\n - CDDL-1.0\n - CDDL-1.1\n - CPL-1.0\n - EPL-1.0\n - EPL-2.0\n - FreeImage\n - IPL-1.0\n - MPL-1.0\n - MPL-1.1\n - MPL-2.0\n - Ruby\n\n restricted:\n - BCL\n - CC-BY-ND-1.0\n - CC-BY-ND-2.0\n - CC-BY-ND-2.5\n - CC-BY-ND-3.0\n - CC-BY-ND-4.0\n - CC-BY-SA-1.0\n - CC-BY-SA-2.0\n - CC-BY-SA-2.5\n - CC-BY-SA-3.0\n - CC-BY-SA-4.0\n - GPL-1.0\n - GPL-2.0\n - GPL-2.0-with-autoconf-exception\n - GPL-2.0-with-bison-exception\n - GPL-2.0-with-classpath-exception\n - GPL-2.0-with-font-exception\n - GPL-2.0-with-GCC-exception\n - GPL-3.0\n - GPL-3.0-with-autoconf-exception\n - GPL-3.0-with-GCC-exception\n - LGPL-2.0\n - LGPL-2.1\n - LGPL-3.0\n - NPL-1.0\n - NPL-1.1\n - OSL-1.0\n - OSL-1.1\n - OSL-2.0\n - OSL-2.1\n - OSL-3.0\n - QPL-1.0\n - Sleepycat\n\n unencumbered:\n - CC0-1.0\n - Unlicense\n - 0BSD\n\n```\n## Misconfiguration options\n\n```yaml\nansible:\n # Same as '--ansible-extra-vars'\n extra-vars: []\n\n # Same as '--ansible-inventory'\n inventories: []\n\n # Same as '--ansible-playbook'\n playbooks: []\n\nmisconfiguration:\n # Same as '--checks-bundle-repository'\n checks-bundle-repository: \"mirror.gcr.io/aquasec/trivy-checks:2\"\n\n cloudformation:\n # Same as '--cf-params'\n params: []\n\n # Same as '--config-file-schemas'\n config-file-schemas: []\n\n helm:\n # Same as '--helm-api-versions'\n api-versions: []\n\n # Same as '--helm-kube-version'\n kube-version: \"\"\n\n # Same as '--helm-set'\n set: []\n\n # Same as '--helm-set-file'\n set-file: []\n\n # Same as '--helm-set-string'\n set-string: []\n\n # Same as '--helm-values'\n values: []\n\n # Same as '--include-non-failures'\n include-non-failures: false\n\n # Same as '--raw-config-scanners'\n raw-config-scanners: []\n\n # Same as '--render-cause'\n render-cause: []\n\n # Same as '--misconfig-scanners'\n scanners:\n - azure-arm\n - cloudformation\n - dockerfile\n - helm\n - kubernetes\n - terraform\n - terraformplan-json\n - terraformplan-snapshot\n - ansible\n\n terraform:\n # Same as '--tf-exclude-downloaded-modules'\n exclude-downloaded-modules: false\n\n # Same as '--tf-vars'\n vars: []\n\n```\n## Module options\n\n```yaml\nmodule:\n # Same as '--module-dir'\n dir: \"$HOME/.trivy/modules\"\n\n # Same as '--enable-modules'\n enable-modules: []\n\n```\n## Package options\n\n```yaml\npkg:\n # Same as '--include-dev-deps'\n include-dev-deps: false\n\n # Same as '--pkg-relationships'\n relationships:\n - unknown\n - root\n - workspace\n - direct\n - indirect\n\n # Same as '--pkg-types'\n types:\n - os\n - library\n\n```\n## Registry options\n\n```yaml\nregistry:\n mirrors:\n\n # Same as '--password'\n password: []\n\n # Same as '--password-stdin'\n password-stdin: false\n\n # Same as '--registry-token'\n token: \"\"\n\n # Same as '--username'\n username: []\n\n```\n## Rego options\n\n```yaml\nrego:\n # Same as '--config-check'\n check: []\n\n # Same as '--config-data'\n data: []\n\n # Same as '--rego-error-limit'\n error-limit: 10\n\n # Same as '--include-deprecated-checks'\n include-deprecated-checks: false\n\n # Same as '--check-namespaces'\n namespaces: []\n\n # Same as '--skip-check-update'\n skip-check-update: false\n\n # Same as '--trace-rego'\n trace: false\n\n```\n## Report options\n\n```yaml\n# Same as '--dependency-tree'\ndependency-tree: false\n\n# Same as '--exit-code'\nexit-code: 0\n\n# Same as '--exit-on-eol'\nexit-on-eol: 0\n\n# Same as '--format'\nformat: \"table\"\n\n# Same as '--ignore-policy'\nignore-policy: \"\"\n\n# Same as '--ignorefile'\nignorefile: \".trivyignore\"\n\n# Same as '--list-all-pkgs'\nlist-all-pkgs: true\n\n# Same as '--output'\noutput: \"\"\n\n# Same as '--output-plugin-arg'\noutput-plugin-arg: \"\"\n\n# Same as '--report'\nreport: \"all\"\n\nscan:\n # Same as '--compliance'\n compliance: \"\"\n\n # Same as '--show-suppressed'\n show-suppressed: false\n\n# Same as '--severity'\nseverity:\n - UNKNOWN\n - LOW\n - MEDIUM\n - HIGH\n - CRITICAL\n\n# Same as '--table-mode'\ntable-mode:\n - summary\n - detailed\n\n# Same as '--template'\ntemplate: \"\"\n\n```\n## Repository options\n\n```yaml\nrepository:\n # Same as '--branch'\n branch: \"\"\n\n # Same as '--commit'\n commit: \"\"\n\n # Same as '--tag'\n tag: \"\"\n\n```\n## Scan options\n\n```yaml\nscan:\n # Same as '--detection-priority'\n detection-priority: \"precise\"\n\n # Same as '--disable-telemetry'\n disable-telemetry: false\n\n # Same as '--distro'\n distro: \"\"\n\n # Same as '--file-patterns'\n file-patterns: []\n\n maven:\n mirrors: []\n\n # Same as '--offline-scan'\n offline: false\n\n # Same as '--parallel'\n parallel: 5\n\n # Same as '--rekor-url'\n rekor-url: \"https://rekor.sigstore.dev\"\n\n # Same as '--sbom-sources'\n sbom-sources: []\n\n # Same as '--scanners'\n scanners:\n - vuln\n - secret\n\n # Same as '--skip-dirs'\n skip-dirs: []\n\n # Same as '--skip-files'\n skip-files: []\n\n # Same as '--skip-version-check'\n skip-version-check: false\n\n```\n## Secret options\n\n```yaml\nsecret:\n # Same as '--secret-config'\n config: \"trivy-secret.yaml\"\n\n```\n## Vulnerability options\n\n```yaml\nvulnerability:\n # Same as '--ignore-status'\n ignore-status: []\n\n # Same as '--ignore-unfixed'\n ignore-unfixed: false\n\n # Same as '--vuln-severity-source'\n severity-source:\n - auto\n\n # Same as '--skip-vex-repo-update'\n skip-vex-repo-update: false\n\n # Same as '--vex'\n vex: []\n\n```\n[example]: https://github.com/aquasecurity/trivy/blob/{{ git.tag }}/examples/trivy-conf/trivy.yaml\n[schema]: https://github.com/aquasecurity/trivy/blob/{{ git.tag }}/schema/trivy-config.json","isInternal":false,"tokens":3634,"sizeBytes":10556},{"name":"client-server.md","path":"docs/guide/references/modes/client-server.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/modes/client-server.md","title":"Modes Skill","category":"anthropic-skill","format":"markdown","content":"# Client/Server\n\nTrivy has client/server mode. Trivy server has vulnerability database and Trivy client doesn't have to download vulnerability database. It is useful if you want to scan images or files at multiple locations and do not want to download the database at every location.\n\n| Client/Server Mode | Image | Rootfs | Filesystem | Repository | Config | K8s |\n|:------------------:|:-----:|:------:|:----------:|:----------:|:------:|:---:|\n| Supported | ✅ | ✅ | ✅ | ✅ | - | - |\n\nSome scanners run on the client side, even in client/server mode.\n\n| Scanner | Run on Client or Server |\n|:----------------:|:-----------------------:|\n| Vulnerability | Server |\n| Misconfiguration | Client[^1] |\n| Secret | Client[^2] |\n| License | Server |\n\n!!! note\n Scanning of misconfigurations and secrets is performed on the client side (as in standalone mode).\n Otherwise, the client would need to send files to the server that may contain sensitive information.\n\n## Server\nAt first, you need to launch Trivy server. It downloads vulnerability database automatically and continue to fetch the latest DB in the background.\n```\n$ trivy server --listen localhost:8080\n2019-12-12T15:17:06.551+0200 INFO Need to update DB\n2019-12-12T15:17:56.706+0200 INFO Reopening DB...\n2019-12-12T15:17:56.707+0200 INFO Listening localhost:8080...\n```\n\nIf you want to accept a connection from outside, you have to specify `0.0.0.0` or your ip address, not `localhost`.\n\n```\n$ trivy server --listen 0.0.0.0:8080\n```\n\n## Remote image scan\nThen, specify the server address for `image` command.\n```\n$ trivy image --server http://localhost:8080 alpine:3.10\n```\n**Note**: It's important to specify the protocol (http or https).\n\n
\nResult\n\n```\nalpine:3.10 (alpine 3.10.2)\n===========================\nTotal: 3 (UNKNOWN: 0, LOW: 1, MEDIUM: 2, HIGH: 0, CRITICAL: 0)\n\n+---------+------------------+----------+-------------------+---------------+\n| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |\n+---------+------------------+----------+-------------------+---------------+\n| openssl | CVE-2019-1549 | MEDIUM | 1.1.1c-r0 | 1.1.1d-r0 |\n+ +------------------+ + + +\n| | CVE-2019-1563 | | | |\n+ +------------------+----------+ + +\n| | CVE-2019-1547 | LOW | | |\n+---------+------------------+----------+-------------------+---------------+\n```\n
\n\n## Remote scan of local filesystem\nAlso, there is a way to scan local file system:\n```shell\n$ trivy fs --server http://localhost:8080 --severity CRITICAL ./integration/testdata/fixtures/fs/pom/\n```\n**Note**: It's important to specify the protocol (http or https).\n
\nResult\n\n```\npom.xml (pom)\n=============\nTotal: 24 (CRITICAL: 24)\n\n+---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+\n| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n+---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+\n| com.fasterxml.jackson.core:jackson-databind | CVE-2017-17485 | CRITICAL | 2.9.1 | 2.8.11, 2.9.4 | jackson-databind: Unsafe |\n| | | | | | deserialization due to |\n| | | | | | incomplete black list (incomplete |\n| | | | | | fix for CVE-2017-15095)... |\n| | | | | | -->avd.aquasec.com/nvd/cve-2017-17485 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2018-11307 | | | 2.7.9.4, 2.8.11.2, 2.9.6 | jackson-databind: Potential |\n| | | | | | information exfiltration with |\n| | | | | | default typing, serialization |\n| | | | | | gadget from MyBatis |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-11307 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2018-14718 | | | 2.6.7.2, 2.9.7 | jackson-databind: arbitrary code |\n| | | | | | execution in slf4j-ext class |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-14718 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2018-14719 | | | | jackson-databind: arbitrary |\n| | | | | | code execution in blaze-ds-opt |\n| | | | | | and blaze-ds-core classes |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-14719 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2018-14720 | | | | jackson-databind: exfiltration/XXE |\n| | | | | | in some JDK classes |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-14720 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2018-14721 | | | | jackson-databind: server-side request |\n| | | | | | forgery (SSRF) in axis2-jaxws class |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-14721 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2018-19360 | | | 2.6.7.3, 2.7.9.5, 2.8.11.3, | jackson-databind: improper |\n| | | | | 2.9.8 | polymorphic deserialization |\n| | | | | | in axis2-transport-jms class |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-19360 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2018-19361 | | | | jackson-databind: improper |\n| | | | | | polymorphic deserialization |\n| | | | | | in openjpa class |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-19361 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2018-19362 | | | | jackson-databind: improper |\n| | | | | | polymorphic deserialization |\n| | | | | | in jboss-common-core class |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-19362 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2018-7489 | | | 2.7.9.3, 2.8.11.1, 2.9.5 | jackson-databind: incomplete fix |\n| | | | | | for CVE-2017-7525 permits unsafe |\n| | | | | | serialization via c3p0 libraries |\n| | | | | | -->avd.aquasec.com/nvd/cve-2018-7489 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-14379 | | | 2.7.9.6, 2.8.11.4, 2.9.9.2 | jackson-databind: default |\n| | | | | | typing mishandling leading |\n| | | | | | to remote code execution |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-14379 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-14540 | | | 2.9.10 | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | com.zaxxer.hikari.HikariConfig |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-14540 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-14892 | | | 2.6.7.3, 2.8.11.5, 2.9.10 | jackson-databind: Serialization |\n| | | | | | gadgets in classes of the |\n| | | | | | commons-configuration package |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-14892 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-14893 | | | 2.8.11.5, 2.9.10 | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | classes of the xalan package |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-14893 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-16335 | | | 2.9.10 | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | com.zaxxer.hikari.HikariDataSource |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-16335 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-16942 | | | 2.9.10.1 | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | org.apache.commons.dbcp.datasources.* |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-16942 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2019-16943 | | | | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | com.p6spy.engine.spy.P6DataSource |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-16943 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-17267 | | | 2.9.10 | jackson-databind: Serialization |\n| | | | | | gadgets in classes of |\n| | | | | | the ehcache package |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-17267 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-17531 | | | 2.9.10.1 | jackson-databind: |\n| | | | | | Serialization gadgets in |\n| | | | | | org.apache.log4j.receivers.db.* |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-17531 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2019-20330 | | | 2.8.11.5, 2.9.10.2 | jackson-databind: lacks |\n| | | | | | certain net.sf.ehcache blocking |\n| | | | | | -->avd.aquasec.com/nvd/cve-2019-20330 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2020-8840 | | | 2.7.9.7, 2.8.11.5, 2.9.10.3 | jackson-databind: Lacks certain |\n| | | | | | xbean-reflect/JNDI blocking |\n| | | | | | -->avd.aquasec.com/nvd/cve-2020-8840 |\n+ +------------------+ + +--------------------------------+---------------------------------------+\n| | CVE-2020-9546 | | | 2.7.9.7, 2.8.11.6, 2.9.10.4 | jackson-databind: Serialization |\n| | | | | | gadgets in shaded-hikari-config |\n| | | | | | -->avd.aquasec.com/nvd/cve-2020-9546 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2020-9547 | | | | jackson-databind: Serialization |\n| | | | | | gadgets in ibatis-sqlmap |\n| | | | | | -->avd.aquasec.com/nvd/cve-2020-9547 |\n+ +------------------+ + + +---------------------------------------+\n| | CVE-2020-9548 | | | | jackson-databind: Serialization |\n| | | | | | gadgets in anteros-core |\n| | | | | | -->avd.aquasec.com/nvd/cve-2020-9548 |\n+---------------------------------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+\n```\n
\n\n## Remote scan of root filesystem\nAlso, there is a way to scan root file system:\n```shell\n$ trivy rootfs --server http://localhost:8080 --severity CRITICAL /tmp/rootfs\n```\n**Note**: It's important to specify the protocol (http or https).\n
\nResult\n\n```\n/tmp/rootfs (alpine 3.10.2)\n\nTotal: 1 (CRITICAL: 1)\n\n┌───────────┬────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐\n│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │\n├───────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤\n│ apk-tools │ CVE-2021-36159 │ CRITICAL │ 2.10.4-r2 │ 2.10.7-r0 │ libfetch before 2021-07-26, as used in apk-tools, xbps, and │\n│ │ │ │ │ │ other products, mishandles... │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-36159 │\n└───────────┴────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘\n```\n
\n\n## Remote scan of git repository\nAlso, there is a way to scan remote git repository:\n```shell\n$ trivy repo https://github.com/knqyf263/trivy-ci-test --server http://localhost:8080 \n```\n**Note**: It's important to specify the protocol (http or https).\n
\nResult\n\n```\nCargo.lock (cargo)\n==================\nTotal: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 2, CRITICAL: 0)\n\n┌───────────┬─────────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐\n│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │\n├───────────┼─────────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤\n│ ammonia │ CVE-2019-15542 │ HIGH │ 1.9.0 │ 2.1.0 │ Uncontrolled recursion in ammonia │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-15542 │\n│ ├─────────────────────┼──────────┤ ├───────────────┼─────────────────────────────────────────────────────────────┤\n│ │ CVE-2021-38193 │ MEDIUM │ │ 2.1.3, 3.1.0 │ An issue was discovered in the ammonia crate before 3.1.0 │\n│ │ │ │ │ │ for Rust.... │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-38193 │\n├───────────┼─────────────────────┤ ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤\n│ smallvec │ CVE-2019-15551 │ │ 0.6.9 │ 0.6.10 │ An issue was discovered in the smallvec crate before 0.6.10 │\n│ │ │ │ │ │ for Rust.... │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-15551 │\n│ ├─────────────────────┼──────────┤ ├───────────────┼─────────────────────────────────────────────────────────────┤\n│ │ CVE-2018-25023 │ HIGH │ │ 0.6.13 │ An issue was discovered in the smallvec crate before 0.6.13 │\n│ │ │ │ │ │ for Rust.... │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-25023 │\n│ ├─────────────────────┼──────────┤ │ ├─────────────────────────────────────────────────────────────┤\n│ │ GHSA-66p5-j55p-32r9 │ MEDIUM │ │ │ smallvec creates uninitialized value of any type │\n│ │ │ │ │ │ https://github.com/advisories/GHSA-66p5-j55p-32r9 │\n└───────────┴─────────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘\n\nPipfile.lock (pipenv)\n=====================\nTotal: 8 (UNKNOWN: 0, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0)\n\n┌─────────────────────┬────────────────┬──────────┬───────────────────┬────────────────────────┬──────────────────────────────────────────────────────────────┐\n│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │\n├─────────────────────┼────────────────┼──────────┼───────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ celery │ CVE-2021-23727 │ HIGH │ 4.3.0 │ 5.2.2 │ celery: stored command injection vulnerability may allow │\n│ │ │ │ │ │ privileges escalation │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-23727 │\n├─────────────────────┼────────────────┤ ├───────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ django │ CVE-2019-6975 │ │ 2.0.9 │ 1.11.19, 2.0.12, 2.1.7 │ python-django: memory exhaustion in │\n│ │ │ │ │ │ django.utils.numberformat.format() │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-6975 │\n│ ├────────────────┼──────────┤ ├────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ │ CVE-2019-3498 │ MEDIUM │ │ 1.11.18, 2.0.10, 2.1.5 │ python-django: Content spoofing via URL path in default 404 │\n│ │ │ │ │ │ page │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-3498 │\n│ ├────────────────┤ │ ├────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ │ CVE-2021-33203 │ │ │ 2.2.24, 3.1.12, 3.2.4 │ django: Potential directory traversal via ``admindocs`` │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-33203 │\n├─────────────────────┼────────────────┤ ├───────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ urllib3 │ CVE-2019-11324 │ │ 1.24.1 │ 1.24.2 │ python-urllib3: Certification mishandle when error should be │\n│ │ │ │ │ │ thrown │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-11324 │\n│ ├────────────────┤ │ ├────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ │ CVE-2021-33503 │ │ │ 1.26.5 │ python-urllib3: ReDoS in the parsing of authority part of │\n│ │ │ │ │ │ URL │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-33503 │\n│ ├────────────────┼──────────┤ ├────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ │ CVE-2019-11236 │ MEDIUM │ │ 1.24.3 │ python-urllib3: CRLF injection due to not encoding the │\n│ │ │ │ │ │ '\\r\\n' sequence leading to... │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-11236 │\n│ ├────────────────┤ │ ├────────────────────────┼──────────────────────────────────────────────────────────────┤\n│ │ CVE-2020-26137 │ │ │ 1.25.9 │ python-urllib3: CRLF injection via HTTP request method │\n│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-26137 │\n└─────────────────────┴────────────────┴──────────┴───────────────────┴────────────────────────┴──────────────────────────────────────────────────────────────┘\n```\n
\n\n## Authentication\n\n```\n$ trivy server --listen localhost:8080 --token dummy\n```\n\n```\n$ trivy image --server http://localhost:8080 --token dummy alpine:3.10\n```\n\n## Security considerations\n\nClients analyze artifacts locally and upload analysis results, such as package lists, to the server's shared cache. The server uses these results for vulnerability scanning without receiving the original artifact contents. All clients with access to the server must therefore be trusted to submit accurate analysis results.\n\nThe server token controls access to both the scanning and cache APIs. It does not provide per-client permissions or tenant isolation: clients with access can write and delete shared cache entries, affecting scans performed by other clients. Use separate server instances and separate cache storage for mutually untrusted clients, including when using a Redis cache backend.\n\nThe server listens on `localhost:4954` by default. When exposing it to other hosts, configure `--token` and restrict network access to trusted clients. Protect connections with HTTPS through a TLS-terminating reverse proxy or an equivalent secure transport, since the server itself serves HTTP.\n\n## Endpoints\n\n### Health\nChecks whether the Trivy server is running. Authentication is not required.\n\nExample request:\n```bash\ncurl -s 0.0.0.0:8080/healthz\nok\n```\n\nReturns the `200 OK` status if the request was successful.\n### Version\n\nReturns the version of the Trivy server and the vulnerability database metadata. Authentication is not required.\n\nExample request:\n```bash\ncurl -s 0.0.0.0:8080/version | jq\n{\n \"Version\": \"dev\",\n \"VulnerabilityDB\": {\n \"Version\": 2,\n \"NextUpdate\": \"2023-07-25T14:15:29.876639806Z\",\n \"UpdatedAt\": \"2023-07-25T08:15:29.876640206Z\",\n \"DownloadedAt\": \"2023-07-25T09:36:25.599004Z\"\n }\n}\n```\n\nReturns the `200 OK` status if the request was successful.\n\n## Architecture\n\n![architecture](../../../imgs/client-server.png)\n\n[^1]: The checks bundle is also downloaded on the client side.\n[^2]: The scan result with masked secrets is sent to the server","isInternal":false,"tokens":6497,"sizeBytes":41244},{"name":"standalone.md","path":"docs/guide/references/modes/standalone.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/modes/standalone.md","title":"Modes Skill","category":"anthropic-skill","format":"markdown","content":"# Standalone\n\n`trivy image`, `trivy filesystem`, and `trivy repo` works as standalone mode.\n\n## Image\n\n![standalone](../../../imgs/image.png)\n\n## Filesystem\n\n![fs](../../../imgs/fs.png)\n\n## Git Repository\n\n![repo](../../../imgs/repo.png)\n\n","isInternal":false,"tokens":62,"sizeBytes":239},{"name":"terminology.md","path":"docs/guide/references/terminology.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/terminology.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# Terminology\n\nThis page explains the terminology system used in Trivy, helping users understand the specific terms and concepts unique to the Trivy ecosystem.\n\n**Inclusion Criteria**\n\n1. Core Components of Trivy\n - Primary features such as Scanner, Target\n - Essential components such as Scan Assets (trivy-db, trivy-java-db)\n - Components that users directly interact with\n\n2. Trivy-specific Terms\n - Terms unique to Trivy (e.g., VEX Hub)\n - Terms that have special meaning in Trivy's context (e.g., Plugin, Module)\n\n**Exclusion Criteria**\n\n1. General Terms\n - Common security/technical terms (e.g., CVE, CVSS, Container, Registry)\n - Standard industry terminology\n\n2. Implementation Details\n - Internal workings of components\n - Usage instructions (these belong in feature documentation)\n\n\n## Core Concepts\n\n### Target\nTypes of artifacts that Trivy can scan, like container images and filesystem.\n\n### Scanner\nTrivy's built-in security scanning engines. Trivy has four main scanners:\n\n- [Vulnerability Scanner](../scanner/vulnerability.md)\n- [Misconfiguration Scanner](../scanner/misconfiguration/index.md)\n- [Secret Scanner](../scanner/secret.md)\n- [License Scanner](../scanner/license.md)\n\n!!! note\n SBOM is not a scanner but an output format option.\n\n### Scan Assets\nExternal data that Trivy downloads (if needed for scanner) and uses during scanning:\n\n- [Vulnerability Database (Trivy DB, trivy-db)](#vulnerability-database-trivy-db-trivy-db): Database containing vulnerability information\n- [Java Index Database (Trivy Java DB, trivy-java-db)](#java-index-database-trivy-java-db-trivy-java-db): Database for Java artifact identification\n- [Checks Bundle (trivy-checks)](#checks-bundle): Archive containing misconfiguration detection rules\n- [VEX Repository](#vex-repository): Repository containing VEX documents\n\n## Vulnerability Scanning\n\n### Vulnerability Database (Trivy DB, trivy-db)\nThe core vulnerability database required for vulnerability detection.\nContains comprehensive vulnerability information for multiple ecosystems.\nDistributed via OCI registry.\n\nManaged at https://github.com/aquasecurity/trivy-db.\n\nThe vulnerability database is built from a GitHub repository that collects and stores vulnerability information from various data sources.\nThis repository serves as the foundation for building the Trivy DB.\n\nManaged at:\n\n- https://github.com/aquasecurity/vuln-list\n- https://github.com/aquasecurity/vuln-list-nvd\n- https://github.com/aquasecurity/vuln-list-redhat\n- https://github.com/aquasecurity/vuln-list-debian\n- etc.\n\n### Java Index Database (Trivy Java DB, trivy-java-db)\nSpecialized database used for identifying Java libraries and their components during JAR/WAR/PAR/EAR scanning.\nDistributed via OCI registry.\n\nManaged at https://github.com/aquasecurity/trivy-java-db.\n\n\n## Misconfiguration Scanning\nWhen the context does not clearly indicate these terms are related to misconfiguration scanning, they may be prefixed with \"Misconfiguration\" for clarity.\nFor example, \"Check\" may be referred to as \"Misconfiguration Check\", and \"Checks Bundle\" as \"Misconfiguration Checks Bundle\".\n\n### Check\nA Rego file that defines rules for detecting misconfigurations in various types of IaC files.\n\n### Built-in Checks\nDefault set of checks distributed through [the trivy-checks repository](https://github.com/aquasecurity/trivy-checks), providing standard security and configuration best practices.\n\n### Checks Bundle\nA tar.gz archive containing [the built-in checks](#built-in-checks), distributed via OCI registry.\n\n## Secret Scanning\n\n### Rule\nPattern matching rules used to detect hardcoded secrets and sensitive information.\nEach rule consists of:\n\n- Metadata (ID, Category, Title, etc.)\n- Regular expressions for matching sensitive patterns\n- Additional context for detection accuracy\n\n## Kubernetes Integration\n\n### KBOM (Kubernetes Bill of Materials)\nA specialized SBOM format for Kubernetes clusters that includes detailed information about the cluster's components.\n\n## VEX (Vulnerability Exploitability eXchange)\n\n### VEX Repository\nA repository system that stores VEX documents following [the VEX Repository Specification](https://github.com/aquasecurity/vex-repo-spec).\nVEX repositories help users manage and share information about vulnerability applicability and exploitability.\n\nFor detailed information about VEX repositories, see [the document](../supply-chain/vex/repo.md).\n\n### VEX Hub\nThe default VEX repository managed by Aqua Security at https://github.com/aquasecurity/vexhub.\nIt primarily aggregates VEX documents published by package maintainers in their source repositories.\nVEX Hub serves as a central point for collecting and distributing vulnerability applicability information for OSS projects.\n\n## Cache System\n\n### Cache Types\nThe cache directory contains several distinct types of data:\n\n- [Vulnerability Database](#vulnerability-database-trivy-db-trivy-db)\n- [Java Index Database](#java-index-database-trivy-java-db-trivy-java-db)\n- [Misconfiguration Checks](#misconfiguration-scanning)\n- [VEX Repositories](#vex-repository)\n- [Scan Cache](#scan-cache)\n\n### Asset Cache\nDownloaded assets like vulnerability databases and Java index databases.\n\n### Scan Cache\nA caching mechanism that stores analysis results from previous scans to speed up subsequent scans.\nFor container image scanning, the scan cache stores analysis results including package names and versions per layer.\n\nFor detailed information about caching, see [the document](../configuration/cache.md).\n\n## Plugin System\n\n### Plugin\nAn add-on tool that integrates with Trivy to extend its core functionality.\nPlugins can be written in any programming language and integrate seamlessly with Trivy CLI, appearing in Trivy help and subcommands.\nThey can be installed and removed independently without affecting the core Trivy installation.\n\nFor detailed information about plugins, see [the document](../plugin/index.md).\n\n### Plugin Index (trivy-plugin-index)\nA centralized registry that lists available Trivy plugins, managed at https://github.com/aquasecurity/trivy-plugin-index.\nThe index maintains a curated list of official and community plugins, providing metadata such as plugin names, descriptions, and maintainers.\nIt enables plugin discovery through the `trivy plugin search` command and facilitates automatic plugin installation and updates.\n\nFor detailed information about the plugin index, see [the document](../plugin/user-guide.md).\n\n## Module System\n### Module\nA WebAssembly-based extension mechanism that allows custom scanning logic without modifying the Trivy binary.\nModules can modify scan results by analyzing files or post-processing results.\n\nFor detailed information about modules, see [the document](../advanced/modules.md).","isInternal":false,"tokens":1411,"sizeBytes":6794},{"name":"troubleshooting.md","path":"docs/guide/references/troubleshooting.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/troubleshooting.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# Troubleshooting\n\n## Scan\n### Timeout\n\n!!! error\n ``` bash\n $ trivy image ...\n ...\n analyze error: timeout: context deadline exceeded\n ```\n\nYour scan may time out. Java takes a particularly long time to scan. Try increasing the value of the `--timeout` option such as `--timeout 15m`.\n\n### Unable to initialize an image scanner\n\n!!! error\n ```bash\n $ trivy image ...\n ...\n 2024-01-19T08:15:33.288Z\tFATAL\timage scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: 4 errors occurred:\n\t* docker error: unable to inspect the image (ContainerImageName): Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?\n\t* containerd error: containerd socket not found: /run/containerd/containerd.sock\n\t* podman error: unable to initialize Podman client: no podman socket found: stat podman/podman.sock: no such file or directory\n\t* remote error: GET https://index.docker.io/v2/ContainerImageName: MANIFEST_UNKNOWN: manifest unknown; unknown tag=0.1\n ```\n \nIt means Trivy is unable to find the container image in the following places:\n\n* Docker Engine\n* containerd\n* Podman\n* A remote registry\n\nPlease see error messages for details of each error.\n\nCommon mistakes include the following, depending on where you are pulling images from:\n\n#### Common\n- Typos in the image name\n - Common mistake :)\n- Forgetting to specify the registry\n - By default, it is considered to be Docker Hub ( `index.docker.io` ).\n\n#### Docker Engine\n- Incorrect Docker host\n - If the Docker daemon's socket path is not `/var/run/docker.sock`, you need to specify the `--docker-host` flag or the `DOCKER_HOST` environment variable.\n The same applies when using TCP; you must specify the correct host address.\n\n#### containerd\n- Incorrect containerd address\n - If you are using a non-default path, you need to specify the `CONTAINERD_ADDRESS` environment variable.\n Please refer to [this documentation](../target/container_image.md#containerd).\n- Incorrect namespace\n - If you are using a non-default namespace, you need to specify the `CONTAINERD_NAMESPACE` environment variable.\n Please refer to [this documentation](../target/container_image.md#containerd).\n - \n#### Podman\n- Podman socket configuration\n - You need to enable the Podman socket. Please refer to [this documentation](../target/container_image.md#podman).\n\n#### Container Registry\n- Unauthenticated\n - If you are using a private container registry, you need to authenticate. Please refer to [this documentation](../advanced/private-registries/index.md).\n- Using a proxy\n - If you are using a proxy within your network, you need to correctly set the `HTTP_PROXY`, `HTTPS_PROXY`, etc., environment variables.\n- Use of a self-signed certificate in the registry\n - Because certificate verification will fail, you need to either trust that certificate or use the `--insecure` flag (not recommended in production).\n\n### Certification\n\n!!! error\n Error: x509: certificate signed by unknown authority\n\n`TRIVY_INSECURE` can be used to allow insecure connections to a container registry when using SSL.\n\n```\n$ TRIVY_INSECURE=true trivy image [YOUR_IMAGE]\n```\n\nIf you need to trust a custom CA certificate, you can provide a PEM-encoded bundle.\n\n=== \"Unix (except macOS)\"\n\n You can specify the location of your certificate using the `SSL_CERT_FILE` or `SSL_CERT_DIR` environment variables.\n\n ```bash\n $ SSL_CERT_FILE=/path/to/ca.pem trivy image [YOUR_IMAGE]\n ```\n\n ```bash\n $ SSL_CERT_DIR=/path/to/certs trivy image [YOUR_IMAGE]\n ```\n\n=== \"All systems\"\n\n Use the `--cacert` flag to point Trivy to a PEM-encoded CA certificate file, regardless of the operating system.\n\n ```bash\n $ trivy image --cacert /path/to/ca.pem [YOUR_IMAGE]\n ```\n\n### GitHub Rate limiting\nTrivy uses GitHub API for [VEX repositories](../supply-chain/vex/repo.md).\n\n!!! error\n ``` bash\n $ trivy image --vex repo ...\n ...\n API rate limit exceeded for xxx.xxx.xxx.xxx.\n ```\n\nSpecify GITHUB_TOKEN for [authentication](https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api?apiVersion=2022-11-28)\n\n```\n$ GITHUB_TOKEN=XXXXXXXXXX trivy image --vex repo [YOUR_IMAGE]\n```\n\n!!! note\n `GITHUB_TOKEN` doesn't help with the rate limit for the vulnerability database and other assets.\n See https://github.com/aquasecurity/trivy/discussions/8009\n\n### Maven Central rate limiting (HTTP 429)\n\nWhen scanning Java projects, Trivy resolves transitive dependencies by downloading POM files from Maven Central (or any other configured remote Maven repository) when they are missing from the local `~/.m2` cache. Remote Maven repositories typically rate-limit per IP and return `429 Too Many Requests` once the limit is exceeded; scans of large projects with an empty local cache routinely run into this.\n\n!!! error\n ```\n FATAL Error remote Maven repository returned 429 Too Many Requests for https://repo.maven.apache.org/maven2/.../-.pom. Retry-After: 1800.\n The repository blocks all subsequent requests from this IP until the block clears.\n To avoid this, populate the local Maven cache before scanning (e.g. run `mvn dependency:resolve`, or `mvn install` for a multi-module project, and cache ~/.m2 in CI).\n ```\n\nThe block applies to *all* subsequent requests from the affected IP for the duration indicated by `Retry-After`, regardless of whether the artifact would otherwise be served from a cache layer. The wait depends on the repository's policy — for Maven Central it is typically tens of minutes on the first violation and grows on repeat — so Trivy fails fast on the first `429` rather than retrying and risking an extended block.\n\nRecommended mitigations:\n\n- **Populate `~/.m2` before scanning.** Run `mvn dependency:resolve` (or any build step that resolves dependencies) so that every POM is cached locally. In CI, cache the `~/.m2` directory between runs (e.g. keyed on `pom.xml` checksums) so subsequent runs reuse the artifacts.\n - For a multi-module project run `mvn install -DskipTests` instead. Goals that only resolve dependencies cache third-party artifacts, but not the artifacts of your own project — Maven takes those from the reactor, so a module that depends on a sibling module still triggers remote lookups.\n- **Configure mirrors** of the rate-limited repository, so that POM lookups go to a host that isn't blocking you. There are two ways to do it:\n - `` in Maven's [settings.xml][maven-mirror-settings] — the standard mechanism, honored by `mvn` itself as well. A repository is served by a single mirror, so a mirror that is rate-limited too leaves nothing to fall back on.\n - [scan.maven.mirrors][maven-mirrors] in `trivy.yaml` — Trivy-specific, and takes an ordered list of mirrors per repository. A mirror that returns `429` is skipped in favor of the next one, and if the remaining mirrors do not return the artifact, the scan stops and reports the `429`.\n- **Wait for the block to expire.** The `Retry-After` value in the error tells you the minimum wait. Repeated scans during the block will extend it.\n- **Use `--offline-scan`** to skip remote lookups entirely and rely only on the local `~/.m2` cache. Be careful: any transitive POM missing from the cache is silently skipped, so populate `~/.m2` first (see above) — otherwise the dependency tree will be incomplete.\n\n### Unable to open JAR files\n\n!!! error\n ``` bash\n $ trivy image ...\n ...\n failed to analyze file: failed to analyze usr/lib/jvm/java-1.8-openjdk/lib/tools.jar: unable to open usr/lib/jvm/java-1.8-openjdk/lib/tools.jar: failed to open: unable to read the file: stream error: stream ID 9; PROTOCOL_ERROR; received from peer\n ```\n\nCurrently, we're investigating this issue. As a temporary mitigation, you may be able to avoid this issue by downloading the Java DB in advance.\n\n```shell\n$ trivy image --download-java-db-only\n2023-02-01T16:57:04.322+0900 INFO Downloading the Java DB...\n$ trivy image [YOUR_JAVA_IMAGE]\n```\n\n### Cache lock errors\n\n!!! error\n ```\n cache may be in use by another process\n ```\n\nTrivy's vulnerability database is opened in read-only mode, so it does not cause lock issues. Lock errors occur only when using filesystem cache for scan cache storage.\n\nFilesystem cache uses BoltDB internally, which creates file locks to prevent data corruption. As stated in the BoltDB documentation:\n\n> Please note that Bolt obtains a file lock on the data file so multiple processes cannot open the same database at the same time. Opening an already open Bolt database will cause it to hang until the other process closes it.\n\nReference: [BoltDB README](https://github.com/boltdb/bolt#opening-a-database)\n\nIf you're using memory cache (default for some commands like `fs`, `rootfs`, `config`, and `sbom`) or external cache (Redis), you will not encounter lock errors. Lock issues only occur when using filesystem cache with multiple concurrent processes.\nSee [Cache Backend](../configuration/cache.md#scan-cache-backend) for more details.\n\nThese errors occur when:\n\n- Multiple Trivy processes try to use the same filesystem cache directory simultaneously\n- A previous Trivy process did not shut down cleanly\n- Trivy server is running with filesystem cache and holding a lock on the cache\n\n#### Solutions\n\n**Solution 1: Use memory cache or Redis cache** (Recommended)\n\nMemory cache is the default for some commands (e.g., `fs`, `rootfs`, `config`, `sbom`). For other commands like image scanning, you can use `--cache-backend memory` to enable concurrent execution:\n\n```bash\n$ trivy image --cache-backend memory debian:11 &\n$ trivy image --cache-backend memory debian:12 &\n```\n\nNote that memory cache does not persist scan results, so subsequent scans will take longer as layers need to be scanned again each time.\n\nFor server mode or persistent cache with concurrent access, use Redis cache:\n\n```bash\n$ trivy server --cache-backend redis://localhost:6379\n```\n\n**Solution 2: Terminate conflicting processes**\n\nIf you need to use filesystem cache, check for running Trivy processes and terminate them:\n\n```bash\n$ ps aux | grep trivy\n$ kill [process_id]\n```\n\n**Solution 3: Use different cache directories**\n\nIf you must run multiple Trivy processes with filesystem cache, specify different cache directories for each process:\n\n```bash\n$ trivy image --cache-dir /tmp/trivy-cache-1 debian:11 &\n$ trivy image --cache-dir /tmp/trivy-cache-2 debian:12 &\n```\n\nNote that each cache directory will download its own copy of the vulnerability database and other scan assets, which will increase network traffic and storage usage.\n\n### Multiple Trivy servers\n\n!!! error\n ```\n $ trivy image --server http://xxx.com:xxxx test-image\n ...\n - twirp error internal: failed scan, test-image: failed to apply layers: layer cache missing: sha256:*****\n ```\nTo run multiple Trivy servers, you need to use Redis as the cache backend so that those servers can share the cache. \nFollow [this instruction][redis-cache] to do so.\n\n\n### Problems with `/tmp` on remote Git repository scans\n\n!!! error\n FATAL repository scan error: scan error: unable to initialize a scanner: unable to initialize a filesystem scanner: git clone error: write /tmp/fanal-remote...\n\nTrivy clones remote Git repositories under the `/tmp` directory before scanning them. If `/tmp` doesn't work for you, you can change it by setting the `TMPDIR` environment variable.\n\nTry:\n\n```\n$ TMPDIR=/my/custom/path trivy repo ...\n```\n\n### Running out of space during image scans\n\n!!! error\n ``` bash\n image scan failed:\n failed to copy the image:\n write /tmp/fanal-3323732142: no space left on device\n ```\n\nTrivy uses a temporary directory during image scans.\nThe directory path would be determined as follows:\n\n- On Unix systems: Use `$TMPDIR` if non-empty, else `/tmp`.\n- On Windows: Uses GetTempPath, returning the first non-empty value from `%TMP%`, `%TEMP%`, `%USERPROFILE%`, or the Windows directory.\n\nSee [this documentation](https://golang.org/pkg/os/#TempDir) for more details.\n\nIf the image is large or the temporary directory has insufficient space, the scan will fail.\nYou can configure the directory path to redirect Trivy to a directory with adequate storage.\nOn Unix systems, you can set the `$TMPDIR` environment variable.\n\n```\n$ TMPDIR=/my/custom/path trivy image ...\n```\n\nWhen scanning images from a container registry, Trivy processes each layer by streaming, loading only the necessary files for the scan into memory and discarding unnecessary files.\nIf a layer contains large files that are necessary for the scan (such as JAR files or binary files), Trivy saves them to a temporary directory (e.g. $TMPDIR) on local storage to avoid increased memory consumption.\nAlthough these files are deleted after the scan is complete, they can temporarily increase disk consumption and potentially exhaust storage.\nIn such cases, there are currently three workarounds:\n\n1. Use a temporary directory with sufficient capacity\n \n This is the same as explained above.\n \n2. Specify a small value for `--parallel`\n \n By default, multiple layers are processed in parallel.\n If each layer contains large files, disk space may be consumed rapidly.\n By specifying a small value such as `--parallel 1`, parallelism is reduced, which can mitigate the issue.\n\n3. Specify `--skip-files` or `--skip-dirs`\n \n If the container image contains large files that do not need to be scanned, you can skip their processing by specifying --skip-files or --skip-dirs. \n For more details, please refer to [this documentation](../configuration/skipping.md).\n\n## DB\n### Old DB schema\n\n!!! error\n --skip-update cannot be specified with the old DB schema.\n\nTrivy v0.23.0 or later requires Trivy DB v2. Please update your local database or follow [the instruction of air-gapped environment][air-gapped].\n\n### Error downloading vulnerability DB\n\n!!! error\n FATAL failed to download vulnerability DB\n\nIf Trivy is running behind corporate firewall, refer to the necessary connectivity requirements as described [here][network].\n\n### Denied\n\n!!! error\n GET https://ghcr.io/token?scope=repository%3Aaquasecurity%2Ftrivy-db%3Apull&service=ghcr.io: DENIED: denied\n\nYour local GHCR (GitHub Container Registry) token might be expired.\nPlease remove the token and try downloading the DB again.\n\n```shell\ndocker logout ghcr.io\n```\n\nor\n\n```shell\nunset GITHUB_TOKEN\n```\n\n## Debugging\n### HTTP Request/Response Tracing\n\nFor debugging network issues, connection problems, or authentication failures, you can enable HTTP request/response tracing using the `--trace-http` flag.\n\n!!! danger \"Security Warning\"\n While Trivy attempts to redact known sensitive information such as authentication headers and common secrets, the `--trace-http` flag may still expose sensitive data in HTTP requests and responses.\n \n **Never use this flag in production environments or CI/CD pipelines.**\n This flag is automatically disabled in CI environments for security.\n\n```bash\n# Enable HTTP tracing for debugging registry issues\n$ trivy image --trace-http registry.example.com/my-image:latest\n\n# HTTP tracing with other debugging options\n$ trivy image --trace-http --debug --insecure my-image:tag\n```\n\n## Others\n### Unknown error\n\nTry again after running `trivy clean --all`:\n\n```\n$ trivy clean --all\n```\n\n[air-gapped]: ../advanced/air-gap.md\n[maven-mirror-settings]: https://maven.apache.org/guides/mini/guide-mirror-settings.html\n[maven-mirrors]: ../coverage/language/java.md#config-file-mirrors\n[network]: ../advanced/air-gap.md#connectivity-requirements\n[redis-cache]: ../configuration/cache.md#redis\n","isInternal":false,"tokens":3635,"sizeBytes":15779},{"name":"metadata.json","path":"pkg/commands/testdata/db/metadata.json","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/commands/testdata/db/metadata.json","title":"Db Skill","category":"anthropic-skill","format":"json","content":"{\n \"Version\": 2,\n \"NextUpdate\": \"2022-03-02T12:07:07.99504023Z\",\n \"UpdatedAt\": \"2022-03-02T06:07:07.99504083Z\",\n \"DownloadedAt\": \"2022-03-02T10:03:38.383312Z\"\n}\n\n","frontmatter":{"Version":2,"NextUpdate":"2022-03-02T12:07:07.99504023Z","UpdatedAt":"2022-03-02T06:07:07.99504083Z","DownloadedAt":"2022-03-02T10:03:38.383312Z"},"isInternal":false,"tokens":80,"sizeBytes":166},{"name":"metadata.json","path":"pkg/commands/testdata/java-db/metadata.json","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/commands/testdata/java-db/metadata.json","title":"Java-db Skill","category":"anthropic-skill","format":"json","content":"{\"Version\":1,\"NextUpdate\":\"2023-03-17T00:47:02.774253254Z\",\"UpdatedAt\":\"2023-03-14T00:47:02.774253754Z\",\"DownloadedAt\":\"2023-03-14T03:04:55.058541039Z\"}\n","frontmatter":{"Version":1,"NextUpdate":"2023-03-17T00:47:02.774253254Z","UpdatedAt":"2023-03-14T00:47:02.774253754Z","DownloadedAt":"2023-03-14T03:04:55.058541039Z"},"isInternal":false,"tokens":68,"sizeBytes":153},{"name":"metadata.json","path":"pkg/commands/testdata/policy/metadata.json","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/commands/testdata/policy/metadata.json","title":"Policy Skill","category":"anthropic-skill","format":"json","content":"{\"Digest\":\"sha256:19a017cdc798631ad42f6f4dce823d77b2989128f0e1a7f9bc83ae3c59024edd\",\"DownloadedAt\":\"2023-03-01T17:06:08.191725-08:00\"}","frontmatter":{"Digest":"sha256:19a017cdc798631ad42f6f4dce823d77b2989128f0e1a7f9bc83ae3c59024edd","DownloadedAt":"2023-03-01T17:06:08.191725-08:00"},"isInternal":false,"tokens":68,"sizeBytes":134},{"name":"package.json","path":"pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package1/package.json","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package1/package.json","title":"Package1 Skill","category":"anthropic-skill","format":"json","content":"# Package1 Skill\n\nPath: `pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package1/package.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package1/package.json)","tokens":300,"sizeBytes":292},{"name":"package.json","path":"pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package2/package.json","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package2/package.json","title":"Package2 Skill","category":"anthropic-skill","format":"json","content":"# Package2 Skill\n\nPath: `pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package2/package.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/package2/package.json)","tokens":300,"sizeBytes":292},{"name":"package.json","path":"pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/utils/util1/package.json","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/utils/util1/package.json","title":"Util1 Skill","category":"anthropic-skill","format":"json","content":"# Util1 Skill\n\nPath: `pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/utils/util1/package.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/fanal/analyzer/language/nodejs/yarn/testdata/monorepo/packages/utils/util1/package.json)","tokens":300,"sizeBytes":295},{"name":"index.yaml","path":"pkg/plugin/testdata/.trivy/plugins/index.yaml","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/plugin/testdata/.trivy/plugins/index.yaml","title":"Plugins Skill","category":"anthropic-skill","format":"yaml","content":"# Plugins Skill\n\nPath: `pkg/plugin/testdata/.trivy/plugins/index.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/plugin/testdata/.trivy/plugins/index.yaml)","tokens":300,"sizeBytes":205},{"name":"plugin.yaml","path":"pkg/plugin/testdata/.trivy/plugins/test_plugin/plugin.yaml","rawUrl":"https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/plugin/testdata/.trivy/plugins/test_plugin/plugin.yaml","title":"Test_plugin Skill","category":"anthropic-skill","format":"yaml","content":"# Test_plugin Skill\n\nPath: `pkg/plugin/testdata/.trivy/plugins/test_plugin/plugin.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/pkg/plugin/testdata/.trivy/plugins/test_plugin/plugin.yaml)","tokens":300,"sizeBytes":235}],"systemPromptSnippet":"\n\n# Abbreviation List\n\nThis list compiles words that frequently appear in CLI flags or configuration files and are commonly abbreviated in industry and OSS communities.\nTrivy may use the abbreviation in place of the full spelling for flag names.\nIt is also acceptable to add even shorter aliases if needed.\n\nWords not included in this list should be spelled out in full when used in flags.\n\nThis list is intentionally limited to the most common and widely recognized abbreviations.\nExcessive use of abbreviations in CLI flags can hinder initial user understanding and create a steeper learning curve.\n\n!!! note\n This list serves as a guideline rather than a strict requirement.\n Its purpose is to maintain consistency across the project when naming flags and configuration options.\n While we strive to follow these abbreviations, there may be exceptions where context or clarity demands a different approach.\n\n## Scope\nThis list focuses on abbreviations of single words commonly used in technical contexts. It does not include:\n\n1. Acronyms formed from the initial letters of multiple words (e.g., OS for Operating System, HTTP for Hypertext Transfer Protocol)\n2. Domain-specific terminology that already has standardized short forms\n3. Brand names or product-specific abbreviations\n\nThe abbreviations listed here are primarily intended for CLI flags, configuration keys, and similar technical interfaces where brevity is valued while maintaining clarity.\n\n## Example\nFor a flag containing multiple words, only abbreviate words that appear in this list.\nFor instance, in `--database-repository`, \"database\" is in the list so it should be abbreviated to \"db\", but \"repository\" is not in the list so it must be spelled out completely.\nThe correct flag name would be `--db-repository`.\nIt's acceptable to add a shorter alias like `--db-repo` if desired.\n\n## List\n\n| Full Name | Default Abbreviation | Examples |\n|-------------------|----------------------|-----------------------------------------------------------|\n| application | app | `--app-name`, `--app-mode` |\n| authentication | auth | `--auth-method`, `--auth-token` |\n| authorization | authz | `--authz-rule`, `--authz-policy` |\n| command | cmd | `--cmd-option`, `--cmd-args` |\n| configuration | config | `--config`, `--config-dir` |\n| database | db | `--db-repository`, `--db-user`, `--db-pass` |\n| development | dev | `--dev-dependencies`, `--dev-mode` |\n| directory | dir | `--dir-path`, `--output-dir` |\n| environment | env | `--env-file`, `--env-vars` |\n| information | info | `--info-level`, `--show-info` |\n| initialization | init | `--init-script`, `--init-config` |\n| library | lib | `--lib-path`, `--lib-dir` |\n| maximum | max | `--max-image-size`, `--max-depth` |\n| minimum | min | `--min-value`, `--min-severity` |\n| misconfiguration | misconfig | `--misconfig-scanners` |\n| package | pkg | `--pkg-types` |\n| production | prod | `--prod-env`, `--prod-deploy` |\n| specification | spec | `--spec-file`, `--spec-version` |\n| temporary | tmp | `--tmp-dir`, `--tmp-file` |\n| utility | util | `--util-script`, `--util-name` |\n| vulnerability | vuln | `--vuln-scan`, `--vuln-report` |\n\n\n# Compatibility and Stability\n\nTrivy is designed, distributed, and supported primarily as a CLI application.\n\nThe Trivy project strives to preserve compatibility between releases for documented user-facing interfaces, except for features explicitly marked as experimental or subject to change. Unintended compatibility issues in stable interfaces are generally treated as bugs.\n\n## Stable Interfaces\n\nThe following interfaces documented in the official Trivy documentation are covered by this compatibility policy:\n\n- CLI commands, subcommands, flags, and arguments\n- Configuration file options and environment variables\n- Exit codes and the conditions under which they are returned\n- Machine-readable output formats\n- Data fields used by custom templates\n\nAdding a new command, flag, configuration option, or output field is considered compatible as long as it does not change existing usage.\n\nWhen the documentation and implementation disagree, neither is automatically considered authoritative. We determine the intended behavior by considering existing usage, user impact, and consistency with other features, and then correct either the implementation or the documentation.\n\nTrivy's JSON output includes a `SchemaVersion` that identifies the output structure. Within the same `SchemaVersion`, optional fields may be added or omitted, so consumers should ignore unknown fields and must not assume that optional fields are always present. Removing or renaming an existing field, changing its type, or changing its meaning incompatibly generally requires an update to `SchemaVersion` and is documented as a breaking change in the release notes.\n\n## Interfaces Outside the Compatibility Policy\n\nThe following are not part of Trivy's stable user-facing interfaces:\n\n- Go packages, types, functions, methods, and other Go APIs in the Trivy repository\n- Required versions of Go, Mage, and other build tools, as well as development commands and build scripts\n- The exact formatting of terminal output, logs, warnings, error messages, and progress displays\n- Scan results, including detected vulnerabilities, misconfigurations, secrets, and licenses, as well as their content and ordering\n- Internal formats and protocols, such as caches, vulnerability databases, on-disk data, internal RPC, and Protocol Buffers definitions\n- Compatibility between different versions of the Trivy client and Trivy server\n- Experimental or preview features, canary builds, and prerelease versions\n- Changes in behavior or coverage caused by external specifications, services, platforms, or data sources\n\nTrivy is not designed or supported for use as a Go library. Interfaces outside this policy may be changed or removed without a deprecation period.\n\nEven if such a change breaks external code or a custom build procedure, it is not, by itself, considered a breaking change to the Trivy CLI. As a rule, these changes are not identified as breaking changes in the release notes or announced separately. Users should not assume that they will be announced in advance.\n\n## Scan Asset Version Support\n\nSome [scan assets](terminology.md#scan-assets) use versioned formats that are tied to particular Trivy CLI versions:\n\n- Vulnerability Database ([trivy-db](https://github.com/aquasecurity/trivy-db)): schema version\n- Java Index Database ([trivy-java-db](https://github.com/aquasecurity/trivy-java-db)): schema version\n- Checks Bundle ([trivy-checks](https://github.com/aquasecurity/trivy-checks)): major version\n\nEach Trivy CLI version is compatible with particular versions of these assets.\n\nWhen updates for an older scan asset version end, Trivy CLI versions that depend on it can no longer receive newly published vulnerability information, Java artifact identification data, or misconfiguration checks from that asset.\n\nBefore ending updates for a scan asset version, the Trivy project announces the affected CLI versions, the end date for updates, and the minimum CLI version to which users should upgrade. A scan asset version change is not considered a breaking change to the Trivy CLI. However, because users must upgrade to continue receiving current scan asset updates, it is announced separately from ordinary internal changes.\n\n## Breaking Changes\n\nA change that requires users to modify an existing valid use of a stable interface is considered a breaking change.\n\nWhen a breaking change is necessary, we identify it in the release notes and provide migration guidance whenever possible. We announce a deprecation before making the change when practical, but do not guarantee a fixed deprecation period for every interface.\n\nThe usual deprecation process may not be possible when responding to an urgent security issue, an incompatible change in an external system, an obvious bug, or a risk of significant false positives, false negatives, data corruption, or other safety issues. Even in these cases, we describe changes with significant user impact in the release notes whenever possible.\n\n\n## trivy clean\n\nRemove cached files\n\n```\ntrivy clean [flags]\n```\n\n### Examples\n\n```\n # Remove all caches\n $ trivy clean --all\n\n # Remove scan cache\n $ trivy clean --scan-cache\n\n # Remove vulnerability database\n $ trivy clean --vuln-db\n\n```\n\n### Options\n\n```\n -a, --all remove all caches\n --checks-bundle remove checks bundle\n -h, --help help for clean\n --java-db remove Java database\n --scan-cache remove scan cache (container and VM image analysis results)\n --vex-repo remove VEX repositories\n --vuln-db remove vulnerability database\n```\n\n### Options inherited from parent commands\n\n```\n --cacert string Path to PEM-encoded CA certificate file\n --cache-dir string cache directory (default \"/path/to/cache\")\n -c, --config string config path (empty string disables loading) (default \"trivy.yaml\")\n -d, --debug debug mode\n --generate-default-config write the default config to trivy-default.yaml\n --insecure allow insecure server connections\n -q, --quiet suppress progress bar and log output\n --timeout duration timeout (default 5m0s)\n -v, --version show version\n```\n\n### SEE ALSO\n\n* [trivy](trivy.md)\t - Unified security scanner\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_config.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_config.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_convert.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_convert.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_filesystem.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_filesystem.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_image.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_image.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_kubernetes.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_kubernetes.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_module_install.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_module_install.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_module_uninstall.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_module_uninstall.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_module.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_module.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_info.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_info.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_install.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_install.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_list.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_list.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_run.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_run.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_search.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_search.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_uninstall.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_uninstall.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_update.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_update.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin_upgrade.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin_upgrade.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_plugin.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_plugin.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_registry_login.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_registry_login.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_registry_logout.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_registry_logout.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_registry.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_registry.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_repository.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_repository.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_rootfs.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_rootfs.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_sbom.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_sbom.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_server.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_server.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_version.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_version.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex_repo_download.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo_download.md)\n\n\n# Cli Skill\n\nPath: `docs/guide/references/configuration/cli/trivy_vex_repo_init.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/aquasecurity/trivy/HEAD/docs/guide/references/configuration/cli/trivy_vex_repo_init.md)\n\n\n"}