隨記

Trivy 導入指引

導入效應

效應 說明
容器安全掃描 一鍵掃描 Docker Image 的 OS / Library 漏洞
IaC 安全 掃描 Terraform / Kubernetes / CloudFormation 的安全問題
Secret 偵測 在 Image 和原始碼中偵測硬編碼的 Secret
SBOM 產生 自動產生 Software Bill of Materials (SPDX / CycloneDX)
免費開源 Aqua Security 開源，完全免費，社群活躍
CI/CD 整合 與 GitHub Actions / Azure Pipeline 無縫整合

1. 安裝 Trivy

# macOS
brew install trivy

# Windows (Chocolatey)
choco install trivy

# Docker
docker pull aquasec/trivy:latest

# Linux
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

2. 掃描 Docker Image

# 基本掃描
trivy image my-app:latest

# 只顯示高危以上
trivy image --severity HIGH,CRITICAL my-app:latest

# 掃描後自動排除低風險
trivy image --ignore-unfixed my-app:latest

3. 掃描原始碼（Filesystem）

# 掃描專案目錄
trivy fs .

# 掃描並指定報告格式
trivy fs --format json --output result.json .

4. 掃描 IaC

# Terraform
trivy config terraform/

# Kubernetes YAML
trivy config k8s/

# Dockerfile
trivy config Dockerfile

5. 掃描 Secret

# 掃描 git 歷史
trivy fs --scanners secret .

# 掃描 Image 中的 Secret
trivy image --scanners secret my-app:latest

6. 產生 SBOM

# SPDX 格式
trivy image --format spdx-json --output sbom.json my-app:latest

# CycloneDX 格式
trivy image --format cyclonedx --output sbom.xml my-app:latest

7. CI 整合

7.1 Azure Pipeline

- stage: ContainerSecurity
  jobs:
    - job: TrivyScan
      steps:
        - script: |
            trivy image --exit-code 1 --severity HIGH,CRITICAL $(DockerImage)
          displayName: 'Trivy Container Scan'
        - script: |
            trivy image --format json --output trivy-report.json $(DockerImage)
          displayName: 'Generate Trivy Report'
        - task: PublishBuildArtifacts@1
          inputs:
            pathToPublish: 'trivy-report.json'
            artifactName: 'security-report'
          condition: always()

7.2 GitHub Actions

- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'my-app:latest'
    format: 'table'
    exit-code: '1'
    severity: 'HIGH,CRITICAL'

7.3 GitLab CI

trivy-scan:
  image:
    name: aquasec/trivy:latest
    entrypoint: [""]
  script:
    - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

8. 忽略特定漏洞

8.1 Trivy 忽略檔案

# .trivyignore
# 此漏洞已評估風險可接受
CVE-2021-12345
# 此漏洞僅影響 test 環境
CVE-2022-6789

trivy image --ignorefile .trivyignore my-app:latest

9. 自訂掃描規則

# trivy.yaml
severity:
  - HIGH
  - CRITICAL

scan:
  scanners:
    - vuln
    - secret
    - misconfig

ignore-unfixed: true

timeout: 10m

10. 掃描結果範例

my-app:latest (debian 12.4)
Total: 152 (UNKNOWN: 0, LOW: 85, MEDIUM: 52, HIGH: 12, CRITICAL: 3)

library/bar
───────────────
───────────────
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

+----------+------------------+----------+-------------------+---------------+---------------------------------------+
| Library  | Vulnerability ID | Severity | Installed Version | Fixed Version |                 Title                 |
+----------+------------------+----------+-------------------+---------------+---------------------------------------+
| libcurl  | CVE-2023-12345   | HIGH     | 7.88.1            | 7.88.2        | Buffer overflow in curl               |
+----------+------------------+----------+-------------------+---------------+---------------------------------------+

11. 與其他工具比較

特性 Trivy Snyk OWASP Dep Check
容器掃描 ✅ 原生 ✅ ❌
IaC 掃描 ✅ ✅ ❌
Secret 掃描 ✅ ✅ ❌
SBOM ✅ 有限 ❌
掃描原始碼 ✅ ✅ ❌
免費開源 ✅ 有限制 ✅
掃描速度 快 快 較慢

12. 參考資源