trivy Docker & Self-Hosted Deployment

GitHub

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

37,378 stars Go Go 1 file · ~1,350 tokens #containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code
1. Pull Image (DOCKERHUB) docker pull aquasecurity/trivy:latest
2. Docker Run (1-Click Launch) docker run -d --name trivy --restart always aquasecurity/trivy:latest
3. Podman Run podman run -d --name trivy --restart always aquasecurity/trivy:latest
4. Skopeo Inspect (Zero-Pull Manifest) skopeo inspect docker://docker.io/aquasecurity/trivy:latest
5. ORAS Pull (OCI Artifact) oras pull aquasecurity/trivy:latest
Dockerfile 
FROM alpine:3.24.2
# CVE-2026-85091: remove after alpine base ships zlib >= 1.3.2-r1
RUN apk --no-cache add ca-certificates git 'zlib>=1.3.2-r1'
ARG TARGETPLATFORM
COPY ${TARGETPLATFORM}/trivy /usr/local/bin/trivy
COPY contrib/*.tpl contrib/
ENTRYPOINT ["trivy"]