There is a 'security illusion' in the industry that everyone agrees on, and even accepts without question: If you've run your container image through a vulnerability scanner (zafiyet tarayıcı) and the results are green, that image is safe. Do we really believe that? I don't. Because most teams view security merely as 'CVE hunting.' However, my actual penetration testing (sızma testi) experiences have taught me this: The biggest vulnerabilities are often not hidden in the code, but within the configuration errors (yapılandırma hataları) and carelessly left secrets (sır ifşası) surrounding that code. Today, I'm going to talk about one of the sharpest tools we have to break this illusion: Trivy. I'm genuinely excited because this tool feels like the physical embodiment of the question, 'What is DevSecOps?'
Trivy is an open-source security scanner developed by Aqua Security. It would be an injustice to define it solely as a container scanner. It can perform static analysis (SAST), infrastructure as code scanning (IaC scanning), generate a software bill of materials (SBOM), and even detect secret exposure (sır ifşası). In other words, it can integrate many of the tedious tasks I used to try to do manually as a penetration tester (sızma testi uzmanı) into CI/CD pipelines (iş hattı) in seconds. Its speed blows me away; the agility provided by being written in Go allows it to analyze even massive images in the blink of an eye.
The installation and usage are so simple that sometimes I think, 'It shouldn't be this easy.' You'll agree with me once you see what it can do by running these commands in your terminal:
# Let's scan a Docker image for high and critical vulnerabilities
trivy image --severity HIGH,CRITICAL --ignore-unfixed python:3.9-slim
# Let's find misconfigurations in IaC (Terraform, Helm) files in the current directory
trivy config .
# Let's hunt for forgotten API keys or passwords in the file system
trivy fs --security-checks secret /path/to/project
As seen in the python:3.9-slim example above, the --ignore-unfixed parameter is my favorite. Instead of wasting time with vulnerabilities that cannot be patched (unfixed vulnerabilities), it allows us to focus on issues where we can actually take action. This is exactly the hacker mindset: clear the noise, focus on the target.
At one point, I was working on a fintech project with Devoria (kurgusal şirket). The team was migrating to a Kubernetes environment and thought everything was perfect. They were scanning their images through a standard cloud provider, and the results were coming back clean. When I got involved, I activated Trivy's 'misconfiguration' (yanlış yapılandırma) scanning module. The resulting picture was unbelievable; half of the containers were set to run in 'privileged' (ayrıcalıklı) mode, and the root filesystem (kök dizin) was writable. This was an open invitation for an attacker to perform a container escape (konteynerden kaçış) and pivot into the host server. The folks at the company said, 'But there were no vulnerabilities in the image.' Those 'config' errors that Trivy pointed out at that moment forced us to redesign the project's entire security architecture from the ground up. I’ll never forget their surprise at that moment and their subsequent 'thank god we caught this' excitement.
Anyway, I’m not claiming Trivy solves everything. Its biggest strength is undoubtedly its speed and versatility. We used to use separate tools for finding secrets, separate ones for Dockerfile errors, and separate ones for library vulnerabilities. Trivy brings these all under one roof. Furthermore, because it can provide output (çıktı) in JSON format, it makes it incredibly easy to pipe those results into a custom dashboard or a Slack bot for instant alerts.