# trivy

**Licence:** Apache-2.0 | **Language:** Go | **Source:** https://github.com/aquasecurity/trivy

## Role

Vulnerability scanner for images and filesystems

## Why it's here

Scans your container images and dependencies for known CVEs. The check most self-hosters skip and most regret.

## Running it

This is a CLI tool, not a service. Build it from source or pull the official image and run it against your own systems.

```bash
./fetch-sources.sh ./sources
tar xzf ./sources/trivy.tar.gz -C ./sources
```