# trivy

**Licence:** Apache-2.0 | **Language:** Go | **Source:** https://github.com/aquasecurity/trivy

## Role

Vulnerability scanning

## Why it's here

Scans container images and dependencies for known vulnerabilities and licence issues. Fails a build on a critical finding.

## Running it

CLI tool with no server component. Install it from the fetched source and run it in CI.

```bash
./fetch-sources.sh ./sources
tar xzf ./sources/trivy.tar.gz -C ./sources
```