Trivy EP02 | Install Trivy on Windows, Linux & macOS | Complete Setup + First Scan Guide

This comprehensive chapter guide covers the practical setup, multi-platform installation strategies, and first container image vulnerability scans using Trivy, an open-source security scanner. Building on the core concepts of container security, this section transitions theory into hands-on DevSecOps execution.

1. Why Do We Need a Systematic Installation Strategy?

When setting up security tooling in a pipeline or local workstation, relying on static third-party repository clones can introduce version drift or security blind spots.

• The Pitfall of Static Repositories: While reference repositories (like GitHub companion repos) are useful for documenting command logs, they quickly become outdated as upstream maintainers release patches.
• The Production Standard: Always pull installation instructions and long-term support (LTS) binaries directly from the official source (trivy.dev) to ensure access to the latest security database updates and bug fixes.

2. Core Mental Model: Trivy as a Local Security Inspector

Think of Trivy as a meticulous customs inspector stationed at your container dock. Before any container ship (image) is allowed to sail into production, the inspector steps aboard, checks every single cargo crate (OS packages and application libraries), cross-references them against a global ledger of known weaknesses (CVE databases), and hands you a detailed manifest of items requiring repair.

3. Provisioning a Cloud Lab Environment (AWS EC2)

To practice installations in a pristine, isolated environment, we spin up a clean virtual machine.

• Cloud Provider: Amazon Web Services (AWS) Free Tier.
• Instance Configuration:
  • Name: trivy-scan
  • Base Operating System: Ubuntu (Latest LTS)
  • Key Pair: Custom SSH key (key.pem)
• Connection: Access the newly launched instance directly via secure shell (SSH):
  BASH

  Copy

  ssh -i "key.pem" ubuntu@<ec2-public-ip>
  

4. Multi-Platform Installation Methods

Trivy supports multiple operating systems and package managers. Depending on your host environment, choose the appropriate installation path:

5. Step-by-Step Installation on Ubuntu Linux

To install Trivy natively on an Ubuntu-based server, execute the standard package repository setup.

Step 5.1: Install Prerequisites

Install essential utilities for secure package retrieval (wget) and cryptographic verification (gnupg):

sudo apt-get update
sudo apt-get install -y wget gnupg

Step 5.2: Add Aqua Security GPG Key and Repository

Download the official signing key and register the Trivy repository with the APT package manager:

wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/trivy.list

Step 5.3: Update and Install Trivy

Refresh local package lists and install the scanner:

sudo apt-get update
sudo apt-get install -y trivy

Step 5.4: Verify Installation

Confirm that the binary is correctly linked and accessible in your system path:

trivy --version

Expected Output: Displays the installed Trivy release version (e.g., Version: x.y.z).

6. Running Your First Container Image Scan

With Trivy installed, we can test official images from Docker Hub to uncover pre-existing security vulnerabilities.

Scanning ubuntu:latest

Execute the image scan command against the official latest Ubuntu image:

trivy image ubuntu:latest

Note: Upon execution, Trivy automatically downloads and initializes its local vulnerability database (managed by Aqua Security), pulls the target container artifact locally, and inspects both operating system packages and embedded libraries.

Analyzing the Vulnerability Report Output

The generated report is structured into intuitive sections:

1. Target Metadata: Displays the image name (ubuntu), version/tag (latest), OS type, and total vulnerability count.
2. Severity Breakdown: Categorizes issues into:
   • LOW
   • MEDIUM
   • HIGH
   • CRITICAL
3. Vulnerability Table: A structured breakdown containing:
   • CVE ID: Standardized vulnerability identifier (e.g., CVE-2023-XXXX).
   • SEVERITY: Threat level assigned to the vulnerability.
   • STATUS: Indicates whether the vulnerability is active or fixed.
   • INSTALLED VERSION: Package version present inside the image.
   • FIXED VERSION: Patched version where the vulnerability is resolved.
   • TITLE / REFERENCE: Descriptive title and URL pointing directly to the Aqua Security database entry.

7. Comparative Analysis: Official Images (latest vs. rolling)

To demonstrate how container security evolves across tags, compare scanning results between two Ubuntu tags:

• ubuntu:latest: Often contains older package snapshots with unpatched CVEs (e.g., 11 vulnerabilities detected in a specific snapshot).
• ubuntu:rolling: Frequently updated upstream, demonstrating that vulnerabilities present in older tags get resolved in newer rolling releases.

8. Scanning Private & Custom Application Images

Trivy is not limited to public base OS images; it can inspect custom application artifacts stored locally or in private container registries.

Example: Scanning a Local Custom Image

To scan a custom project built during a CI/CD pipeline (e.g., github-profile-summarizer):

trivy image github-profile-summarizer:latest

• Diagnostic Outcome: Trivy inspects application-layer dependencies (such as npm, pip, or Maven packages) alongside OS packages.
• Remediation Link: For every detected issue, Trivy provides a direct Aqua Security knowledge base URL detailing the weakness, CVSS score (CVSS v3), potential attack patterns, and mitigation guidance.

9. Summary and Key Takeaways

• Prioritize Official Sources: Always install Trivy directly from official documentation (trivy.dev) rather than relying on static repository forks to ensure long-term stability and update compatibility.
• Multi-Platform Support: Trivy seamlessly adapts to Linux (APT/YUM), Windows (Chocolatey/Binaries), and macOS (Homebrew).
• Automated Database Sync: Trivy automatically downloads and caches vulnerability databases from Aqua Security upon initial execution.
• Granular Reporting: Scans provide categorized severity counts (LOW, MEDIUM, HIGH, CRITICAL) at both the OS and library levels.
• Actionable Remediation: Each vulnerability entry includes installed versus fixed version numbers, coupled with direct reference URLs for mitigation research.
• Continuous Validation: Regularly scanning base images (latest vs. rolling) and custom application containers helps prevent known CVEs from slipping into production environments.