Trivy EP04 | Your First Container Scan with Trivy (Hands-On Beginner Demo)

Welcome to the hands-on practical session on Aqua Security's Trivy scanner. In this chapter, we bridge the gap between theoretical architecture and real-world execution by running our first container image scan against a known vulnerable image (python:3.10). We will examine the entire scan lifecycle—from updating local vulnerability databases to interpreting complex terminal reports—and establish clear remediation workflows.

1. Why Do We Need Hands-On Container Scanning?

Container images are built in layers, stacking a base operating system (such as Debian or Alpine) on top of runtime environments, system libraries, and application packages (such as pip packages).

• The Status Quo Problem: Developers often pull public base images from Docker Hub assuming they are secure. In reality, unpatched operating system libraries and outdated third-party application dependencies frequently contain known security flaws.
• The Solution: We need an automated, fast, and comprehensive security scanner like Trivy that inspects both the OS-level packages and application-level dependencies within seconds, presenting actionable vulnerability data in a clear tabular format.

2. Environment Setup & Verification

Before running container scans, ensure Trivy is installed on your local environment (macOS, Linux, or WSL/AWS).

Installation via Homebrew (macOS / Linux)

If you are running macOS or Linux with Homebrew installed, execute the following command:

brew install trivy

Verifying the Installation

Confirm that Trivy is successfully installed and check its version, vulnerability database schema version, and last update timestamp:

trivy --version

Expected Output Metrics:

Version: 0.68.1
Vulnerability DB: Version 2
Last Updated: [Timestamp of latest sync]

3. Core Mental Model: The Scan Execution Flow

When you initiate a Trivy container scan, the tool executes a multi-stage internal workflow:

4. Running Your First Container Scan (python:3.10)

We will use the official python:3.10 Docker Hub image as our target. This specific image contains numerous documented vulnerabilities across its Debian base layer and package manager, making it an ideal teaching example.

Execute the scan command in your terminal:

trivy image python:3.10

What Happens Behind the Scenes:

1. Database Synchronization: Trivy contacts upstream advisory sources (GitHub Security Advisories, National Vulnerability Database [NVD], OS vendor security trackers) and updates its local vulnerability database.
2. Artifact Extraction: The artifact analyzer downloads and decompresses the image layers, separating OS packages from application dependencies.
3. Analysis & Matching: The matching engine cross-references installed software versions against known Common Vulnerabilities and Exposures (CVEs).
4. Report Generation: Trivy compiles the findings into a categorized terminal report.

5. Deconstructing the Trivy Report Summary

When the scan finishes, scroll to the bottom of your terminal to review the Report Summary. For our python:3.10 scan, the output reveals critical metadata:

• Base Operating System: Debian (specifically Debian version tracking).
• Total Vulnerabilities Scanned: 1,080 total issues detected across layers.

Severity Breakdown Table

Trivy categorizes vulnerabilities by severity levels. Understanding this distribution helps prioritize remediation efforts for development teams.

6. Reading OS-Level Vulnerability Entries

OS-level vulnerabilities relate to packages managed by the base operating system's package manager (e.g., apt in Debian-based images or apk in Alpine-based images).

Sample OS-Level Vulnerability Row

Library: apt
Vulnerability ID: CVE-2013-3774
Severity: LOW
Status: affected
Installed Version: 1.4.8
Fixed Version: 1.4.9 (or similar)
Title: Improper verification of cryptographic signature in apt key handling...

Key Fields Explained:

• Library: The package manager or system library where the flaw resides (e.g., apt, dpkg, glibc).
• Vulnerability ID (CVE): The unique industry identifier assigned to the security flaw (e.g., CVE-2013-3774). You can search this ID on Google or Aqua Security's advisory database.
• Severity: Reflects the potential impact (LOW, MEDIUM, HIGH, CRITICAL).
• Status: Indicates whether the installed package version is currently affected or if a patch fixed the issue.
• Installed Version vs. Fixed Version: The exact version currently living inside your container image versus the minimum patched version required to remediate the vulnerability.

Note: When investigating a CVE, you can click or copy the reference URL provided in the Trivy output. Aqua Security's documentation provides a comprehensive gist detailing the vulnerability description, publishing date, CVSS score, affected vendors, and reference links.

7. Reading Application-Level Vulnerability Entries

Beyond operating system packages, Trivy scans for vulnerabilities within application dependency managers—such as Python's pip package manager.

Sample Application-Level Vulnerability Row

Library: pip
Vulnerability ID: CVE-2023-5752
Severity: MEDIUM
Status: fixed
Installed Version: 23.0.1
Fixed Version: 23.3
Title: Arbitrary configuration injection via mercurial VCS URLs in pip

Deep Dive into Application Flaws:

• The Context: In pip versions up to 23.0.1, installing packages from a Mercurial (hg) VCS URL with specific revisions could allow attackers to inject arbitrary configuration options into hg clone.
• The Fix: The report explicitly states that upgrading pip from version 23.0.1 to 23.3 resolves the vulnerability.
• Actionability: Unlike base OS libraries (which require updating the Docker base image FROM python:3.10-slim), application-level vulnerabilities like pip can often be resolved directly inside your Dockerfile by upgrading the package manager during build time:
  DOCKERFILE

  Copy

  RUN pip install --upgrade pip
  

8. Comparative Scan Demo: Alpine Base Image

To contrast a Debian-based image with a lightweight alternative, let's run a second scan against a custom repository image built on Alpine Linux:

trivy image profile-summarizer:latest

Alpine Scan Observations:

• Base OS: Alpine (version 3.22.2).
• Total Vulnerabilities: Significantly lower footprint (e.g., 11 total vulnerabilities).
• Targeted Patching:
  TEXT

  Copy

  Installed Version: 1.37-r19
  Fixed Version: 1.37-r20
  

• Takeaway: Minimalist base images like Alpine reduce your container's attack surface by packing fewer pre-installed utilities and system libraries.

Summary and Key Takeaways

• Trivy is Modular & Fast: Trivy pulls local vulnerability databases from trusted sources (GitHub Advisories, NVD, OS vendors) and decompresses them locally before scanning.
• Two-Tiered Inspection: Trivy analyzes containers at two distinct levels: OS-level packages (managed by apt, apk, dpkg) and application-level packages (managed by pip, npm, gem, cargo).
• Report Interpretation: A standard Trivy report maps out the Library, Vulnerability ID (CVE), Severity, Status, Installed Version, and Fixed Version.
• Prioritization Workflow: Always remediate vulnerabilities in order of severity (CRITICAL -> HIGH -> MEDIUM -> LOW), prioritizing fixes that protect production systems.
• Remediation Pathways: Fixes can be applied either by updating the base image in your Dockerfile (FROM) or by explicitly upgrading vulnerable application packages during the build process (e.g., updating pip).
• Reduced Attack Surface: Utilizing minimalist base operating systems (like Alpine Linux) inherently decreases the volume of low and medium OS-level vulnerabilities in your container fleet.