Prerequisites

• Jenkins installed and configured
• Docker installed on the Jenkins server
• Administrator access to Jenkins

Step 1: Installing Trivy

Option 1: Installing Trivy on the Jenkins Executor

To install Trivy directly on the Jenkins executor, follow these steps:

1. Access the Jenkins executor:

ssh jenkins@your-server

2. Install Trivy:

sudo apt-get install wget apt-transport-https gnupg lsb-release
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt-get update
sudo apt-get install trivy

Option 2: Adding Trivy to Docker Compose

If you are using Docker Compose to manage your executors, add Trivy to your docker-compose.yml:

version: '3.8'
services:
  jenkins:
    image: jenkins/jenkins:lts
    environment:
      - JAVA_OPTS=-Djenkins.install.runSetupWizard=false
    volumes:
      - jenkins_home:/var/jenkins_home
      - /var/run/docker.sock:/var/run/docker.sock
    ports:
      - "8080:8080"
      - "50000:50000"
    container_name: jenkins

  trivy:
    image: aquasec/trivy:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /path/to/cache:/root/.cache
    entrypoint: ["trivy"]

Option 3: Accessing the Docker Executable

Access the Docker container locally:

docker exec -it jenkins /bin/bash

Install Trivy:

apt-get update
apt-get install wget apt-transport-https gnupg lsb-release -y
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | apt-key add -
echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | tee -a /etc/apt/sources.list.d/trivy.list
apt-get update
apt-get install trivy -y

Step 2: Adding Trivy to the Jenkinsfile

Add a new stage to your Jenkinsfile to run Trivy. Here’s an example of how to do this:

pipeline {
    agent any

    stages {
        stage('Build') {
            steps {
                // Your build stage here
            }
        }

        stage('Security Scan') {
            steps {
                script {
                    def trivyScan = sh(script: 'trivy -q -f json -o /var/lib/jenkins/reports/trivy-report.json your-image:tag', returnStdout: true).trim()
                    writeFile file: 'trivyScan.md', text: trivyScan
                }
            }
        }
    }
}

Step 3: Viewing the Results

After the pipeline execution, you can view the Trivy results directly in the Jenkins console.

Summary

Integrating Trivy into your Jenkins pipeline enhances your security posture by identifying vulnerabilities early in the development process. With this guide, you have learned how to install Trivy, configure it in Jenkins, and visualize the results, making your development process more secure and reliable.