Trivy: Enhancing DevSecOps with Automated Container Security Scanning

Image from trivy docs: https://aquasecurity.github.io/trivy/v0.49/

DevSecOps is the integration of security into the DevOps pipeline and has emerged as a solution to ensure that security considerations are woven into every stage of the software development lifecycle.

One essential tool that has gained popularity in the DevSecOps landscape is Trivy — a powerful open-source vulnerability scanner designed to enhance container security.

Quick Summary of DevSecOps

The goal is to integrate security practices seamlessly into the DevOps workflow, addressing potential vulnerabilities and threats throughout the entire development lifecycle.

Utilizing DevSecOps has many benefits, if you want to learn more about DevSecOps visit: https://www.microsoft.com/en-us/security/business/security-101/what-is-devsecops

How Trivy fits within DevSecOps

Trivy focuses on scanning container images for known vulnerabilities in their dependencies. This makes it an ideal candidate for bolstering security in containerized applications, a prevalent technology in modern DevOps practices.

Key Features of Trivy:

1. Comprehensive Vulnerability Scanning: Trivy leverages an extensive vulnerability database to scan container images for known security issues.
2. Integration into CI/CD Pipelines: Trivy seamlessly integrates into continuous integration and continuous deployment (CI/CD) pipelines, automating security checks throughout the development process. This ensures that security is not an afterthought but an integral part of the deployment pipeline.
3. Support for Multiple Image Formats: Trivy supports various container image formats, including Docker, containerd, and others.
4. Ease of Use: With a simple command-line interface, Trivy is easy to use and can be incorporated into existing workflows with minimal effort.

Benefits of Using Trivy in DevSecOps:

1. Early Detection of Vulnerabilities: By integrating Trivy into the CI/CD pipeline, vulnerabilities are detected early in the development process, reducing the likelihood of security issues reaching production.
2. Improved Collaboration: Trivy facilitates collaboration between development and security teams by providing a common ground for assessing and addressing security concerns. This collaboration fosters a shared responsibility for security.
3. Cost-Efficient Security: Proactively identifying and addressing vulnerabilities with Trivy can prevent costly security breaches and the associated remediation expenses. Investing in security early in the development cycle proves to be more cost-effective than addressing issues post-deployment.

Using with Github Actions

Most people reading this probably just want to learn how to implement this into their CI/CD. Following yaml actions file was taken from my own project Sybline: https://github.com/GreedyKomodoDragon/Sybline

name: Github CI

on:
  push:
    branches:
      - '*'
  pull_request:
    branches:
      - main

jobs:
  trivy-alpine:
    name: trivy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build an image from Dockerfile
        run: |
          docker build -t sybline:${{ github.sha }} -f infra/docker/sybline.dockerfile .
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'sybline:${{ github.sha }}'
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'

Within the job it builds the image and then runs the trivy tool on that image. It will then have an output like the following within the console (have included Low as image has no CRITICAL or HIGH vulnerabilities):

Conclusion

Trivy has emerged as a valuable asset in the DevSecOps toolbox, contributing to the creation of secure and resilient software. By seamlessly integrating vulnerability scanning into the development workflow, Trivy empowers teams to build, test, and deploy containerized applications with confidence in their security posture.

As DevSecOps continues to evolve, tools like Trivy play a crucial role in ensuring that security remains a top priority throughout the software development lifecycle.