{"id":77548,"date":"2024-08-02T16:48:26","date_gmt":"2024-08-02T14:48:26","guid":{"rendered":"https:\/\/www.skaylink.com\/?p=77548"},"modified":"2024-11-15T10:57:13","modified_gmt":"2024-11-15T09:57:13","slug":"trivy","status":"publish","type":"post","link":"https:\/\/www.skaylink.com\/en\/insights\/blog\/trivy\/","title":{"rendered":"Trivy: Secure Docker Containers in CI\/CD Pipelines"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"77548\" class=\"elementor elementor-77548\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-53c29fb9 header-keyvisual-container e-flex e-con-boxed e-con e-parent\" data-id=\"53c29fb9\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2aa29184 elementor-align-left elementor-widget elementor-widget-breadcrumbs\" data-id=\"2aa29184\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"breadcrumbs.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<p id=\"breadcrumbs\"><span><span><a href=\"https:\/\/www.skaylink.com\/en\/\">Home<\/a><\/span><\/span><\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4258a606 e-con-full e-flex e-con e-child\" data-id=\"4258a606\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-56fbacdd header-keyvisual-content e-con-full e-flex e-con e-child\" data-id=\"56fbacdd\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-52c63287 elementor-widget elementor-widget-image\" data-id=\"52c63287\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"2560\" height=\"1704\" src=\"https:\/\/www.skaylink.com\/wp-content\/uploads\/2024\/07\/CD-CI-Pipeline-scaled.jpeg\" class=\"attachment-full size-full wp-image-77549\" alt=\"\" srcset=\"https:\/\/www.skaylink.com\/wp-content\/uploads\/2024\/07\/CD-CI-Pipeline-scaled.jpeg 2560w, https:\/\/www.skaylink.com\/wp-content\/uploads\/2024\/07\/CD-CI-Pipeline-300x200.jpeg 300w, https:\/\/www.skaylink.com\/wp-content\/uploads\/2024\/07\/CD-CI-Pipeline-1024x681.jpeg 1024w, https:\/\/www.skaylink.com\/wp-content\/uploads\/2024\/07\/CD-CI-Pipeline-768x511.jpeg 768w, https:\/\/www.skaylink.com\/wp-content\/uploads\/2024\/07\/CD-CI-Pipeline-1536x1022.jpeg 1536w, https:\/\/www.skaylink.com\/wp-content\/uploads\/2024\/07\/CD-CI-Pipeline-2048x1363.jpeg 2048w\" sizes=\"(max-width: 2560px) 100vw, 2560px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-927bec0 e-con-full e-flex e-con e-child\" data-id=\"927bec0\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6450d57a elementor-widget elementor-widget-text-editor\" data-id=\"6450d57a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Blog<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5239d94e elementor-widget elementor-widget-heading\" data-id=\"5239d94e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">Secure Docker container creation in CI\/CD pipelines with Trivy vulnerability scanner <\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-180392ec elementor-widget elementor-widget-text-editor\" data-id=\"180392ec\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tImprove Docker container security in CI\/CD pipelines using the Trivy vulnerabiity scanner.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-15f4f46c e-flex e-con-boxed e-con e-parent\" data-id=\"15f4f46c\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-45c4083e e-flex e-con-boxed e-con e-child\" data-id=\"45c4083e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-2aa5eaa9 e-flex e-con-boxed e-con e-child\" data-id=\"2aa5eaa9\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-5ccae8d8 elementor-widget elementor-widget-text-editor\" data-id=\"5ccae8d8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tAugust 2, 2024\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-1cb622cd e-flex e-con-boxed e-con e-child\" data-id=\"1cb622cd\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-372d7178 e-flex e-con-boxed e-con e-child\" data-id=\"372d7178\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7bae5785 elementor-author-box--image-valign-middle elementor-widget elementor-widget-author-box\" data-id=\"7bae5785\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"author-box.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-author-box\">\n\t\t\t\t\t\t\t<div  class=\"elementor-author-box__avatar\">\n\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.skaylink.com\/wp-content\/uploads\/2024\/02\/cropped-skaylink_favicon_512x512px-300x300-1.webp\" alt=\"Picture of Skaylink\" loading=\"lazy\">\n\t\t\t\t<\/div>\n\t\t\t\n\t\t\t<div class=\"elementor-author-box__text\">\n\t\t\t\t\t\t\t\t\t<div >\n\t\t\t\t\t\t<span class=\"elementor-author-box__name\">\n\t\t\t\t\t\t\tSkaylink\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-69e75f22 e-flex e-con-boxed e-con e-child\" data-id=\"69e75f22\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4771e333 elementor-widget elementor-widget-author-box\" data-id=\"4771e333\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"author-box.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-author-box\">\n\t\t\t\n\t\t\t<div class=\"elementor-author-box__text\">\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-1c857c7a e-flex e-con-boxed e-con e-parent\" data-id=\"1c857c7a\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-57f2f254 e-con-full e-flex e-con e-child\" data-id=\"57f2f254\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3970a91f elementor-widget elementor-widget-text-editor\" data-id=\"3970a91f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>In today\u2019s software development landscape, security is paramount. With the rise of containerization, ensuring the security of Docker images is essential to protect against vulnerabilities and potential exploits. CI\/CD pipelines provide a robust platform for automating software delivery. Integrating security scanning tools like Trivy fortifies your container creation process. In this blog post, we&#8217;ll explore how to improve the security of Docker containers in CI\/CD pipelines using Trivy.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-174621e elementor-widget elementor-widget-heading\" data-id=\"174621e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Why Secure Docker containers matter <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cb78800 elementor-widget elementor-widget-text-editor\" data-id=\"cb78800\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Docker containers offer numerous benefits, including portability, scalability, and consistency across environments. But they also present security challenges. Vulnerabilities within container images can expose applications to various risks, such as data breaches, system compromises, or service disruptions. That\u2019s why it\u2019s crucial to address security concerns throughout the complete container lifecycle, from development to deployment.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d108425 elementor-widget elementor-widget-heading\" data-id=\"d108425\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Introducing Trivy <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ac4a378 elementor-widget elementor-widget-text-editor\" data-id=\"ac4a378\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Trivy is an open-source vulnerability scanner for containers and other artifacts, designed to quickly identify security issues within images. By using Trivy in your CI\/CD pipelines, you can automate vulnerability assessments and ensure that only secure container images are deployed into production environments.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-599268d elementor-widget elementor-widget-heading\" data-id=\"599268d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Integrating Trivy into CI\/CD pipelines <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6e104ae elementor-widget elementor-widget-text-editor\" data-id=\"6e104ae\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>CI\/CD pipelines offer a flexible and customizable approach to software delivery. By adding Trivy to your pipelines, you can seamlessly integrate vulnerability scanning into your container creation process. Here&#8217;s an overview of how you can do this:<\/p><ol><li><strong>Install Trivy:<\/strong>\u00a0Start by installing Trivy in your CI\/CD environment. You can either use Trivy as a standalone tool or incorporate it into a Docker container for easier integration.<\/li><li><strong>Configure pipeline:<\/strong> Set up a CI\/CD pipeline for building Docker images. This pipeline should include stages for image creation, scanning with Trivy, and deployment.<\/li><li><strong>Integrate Trivy scan:<\/strong> Add a step to your pipeline to execute Trivy and scan the Docker image for vulnerabilities. Trivy can be invoked through a simple command line interface, making it easy to incorporate into your pipeline scripts.<\/li><li><strong>Analyze results:<\/strong> After the Trivy scan is complete, analyze the results to identify any vulnerabilities discovered. Trivy provides detailed reports, including information on the severity of each vulnerability and recommendations for mitigation.<\/li><li><strong>Fail build on vulnerabilities:<\/strong> To enforce security standards, configure your pipeline to fail if any critical vulnerabilities are found during the Trivy scan. This ensures that only images that pass the Trivy scan are promoted to production.<\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ea6eb7e elementor-widget elementor-widget-heading\" data-id=\"ea6eb7e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Setting up an Azure DevOps pipeline <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-85e9169 elementor-widget elementor-widget-text-editor\" data-id=\"85e9169\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Create a YAML pipeline in Azure DevOps to build a Docker image, scan it with Trivy, and push it to a container registry if no vulnerabilities are detected.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-60bcf9f elementor-widget elementor-widget-heading\" data-id=\"60bcf9f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Step 1: Create a new pipeline <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e99df60 elementor-widget elementor-widget-text-editor\" data-id=\"e99df60\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<ol><li>Log in to your Azure DevOps account and navigate to your project.<\/li><li>Go to \u201cPipelines\u201d &gt; \u201cNew Pipeline\u201d and select \u201cAzure Repos Git\u201d as your source.<\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-072003d elementor-widget elementor-widget-heading\" data-id=\"072003d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Step 2: Define the YAML pipeline<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7a52384 elementor-widget elementor-widget-text-editor\" data-id=\"7a52384\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Replace &lt;YourContainerRegistry&gt; and &lt;YourDockerfile&gt; with your actual container registry and Dockerfile names.<\/p><p>((Codeblock begin))<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c172439 elementor-widget elementor-widget-text-editor\" data-id=\"c172439\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>trigger: <br \/>&#8211; main<\/p><p><span data-contrast=\"auto\">pool:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;469777462&quot;:[916,1832,2748,3664,4580,5496,6412,7328,8244,9160,10076,10992,11908,12824,13740,14656],&quot;469777927&quot;:[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],&quot;469777928&quot;:[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1]}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u00a0 vmImage: &#8216;ubuntu-latest&#8217;<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;469777462&quot;:[916,1832,2748,3664,4580,5496,6412,7328,8244,9160,10076,10992,11908,12824,13740,14656],&quot;469777927&quot;:[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],&quot;469777928&quot;:[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1]}\">\u00a0<\/span><\/p><p><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;469777462&quot;:[916,1832,2748,3664,4580,5496,6412,7328,8244,9160,10076,10992,11908,12824,13740,14656],&quot;469777927&quot;:[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],&quot;469777928&quot;:[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1]}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">steps:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;469777462&quot;:[916,1832,2748,3664,4580,5496,6412,7328,8244,9160,10076,10992,11908,12824,13740,14656],&quot;469777927&quot;:[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],&quot;469777928&quot;:[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1]}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u00a0 &#8211; task: Docker@2<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;469777462&quot;:[916,1832,2748,3664,4580,5496,6412,7328,8244,9160,10076,10992,11908,12824,13740,14656],&quot;469777927&quot;:[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],&quot;469777928&quot;:[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1]}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u00a0\u00a0\u00a0 displayName: &#8216;Build Docker image&#8217;<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;469777462&quot;:[916,1832,2748,3664,4580,5496,6412,7328,8244,9160,10076,10992,11908,12824,13740,14656],&quot;469777927&quot;:[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],&quot;469777928&quot;:[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1]}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u00a0\u00a0\u00a0 inputs:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;469777462&quot;:[916,1832,2748,3664,4580,5496,6412,7328,8244,9160,10076,10992,11908,12824,13740,14656],&quot;469777927&quot;:[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],&quot;469777928&quot;:[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1]}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u00a0\u00a0\u00a0\u00a0\u00a0 command: &#8216;build&#8217;<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;469777462&quot;:[916,1832,2748,3664,4580,5496,6412,7328,8244,9160,10076,10992,11908,12824,13740,14656],&quot;469777927&quot;:[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],&quot;469777928&quot;:[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1]}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u00a0\u00a0\u00a0\u00a0\u00a0 dockerfile: &#8216;&lt;YourDockerfile&gt;&#8217;<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;469777462&quot;:[916,1832,2748,3664,4580,5496,6412,7328,8244,9160,10076,10992,11908,12824,13740,14656],&quot;469777927&quot;:[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],&quot;469777928&quot;:[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1]}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u00a0\u00a0\u00a0\u00a0\u00a0 tags: &#8216;latest&#8217;<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;469777462&quot;:[916,1832,2748,3664,4580,5496,6412,7328,8244,9160,10076,10992,11908,12824,13740,14656],&quot;469777927&quot;:[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],&quot;469777928&quot;:[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1]}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u00a0\u00a0\u00a0\u00a0\u00a0 repository: &#8216;&lt;YourContainerRegistry&gt;\/&lt;YourImageName&gt;&#8217;<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-38ba158 elementor-widget elementor-widget-text-editor\" data-id=\"38ba158\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>((Codeblock end))<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8a5e87f elementor-widget elementor-widget-heading\" data-id=\"8a5e87f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Step 3: Add Trivy scanning <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-230486a elementor-widget elementor-widget-text-editor\" data-id=\"230486a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Add a step to your pipeline to run Trivy and scan your Docker image for vulnerabilities.<\/p><ul><li>Add the Trivy scanning step after building the Docker image:<\/li><\/ul><p>((Codeblock begin))<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8329114 elementor-widget elementor-widget-text-editor\" data-id=\"8329114\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">\u202f <\/span><span data-contrast=\"auto\">&#8211; task: Bash@3<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f displayName: &#8216;Run Trivy vulnerability scan&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f inputs:<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f targetType: &#8216;inline&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f script: |<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f\u202f\u202f # Install Trivy<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f\u202f\u202f Wget https:\/\/github.com\/aquasecurity\/trivy\/releases\/download\/v0.49.1\/trivy_0.49.1_Linux-64bit.tar.gz<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f\u202f\u202f tar zxvf trivy_0.49.1_Linux-64bit.tar.gz<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f\u202f\u202f sudo mv trivy \/usr\/local\/bin\/trivy<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f\u202f\u202f rm trivy_0.49.1_Linux-64bit.tar.gz<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f\u202f\u202f # Run Trivy scan<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f\u202f\u202f trivy image &#8211;severity HIGH,CRITICAL &#8211;exit-code 1 &lt;YourContainerRegistry&gt;\/&lt;YourImageName&gt;:latest<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-54d61ce elementor-widget elementor-widget-text-editor\" data-id=\"54d61ce\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>((Codeblock end))<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-533b1a2 elementor-widget elementor-widget-text-editor\" data-id=\"533b1a2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>In the scanning step, configure Trivy to close the scanning with exit code 1 if a high or critical vulnerability is found in the container. Exit code 1 lets Azure pipeline fail the step and stops pipeline execution. Trivy shows logs on findings and suggests fixed library versions.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c6e4823 elementor-widget elementor-widget-heading\" data-id=\"c6e4823\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Step 4: Add Docker push <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b88dbf0 elementor-widget elementor-widget-text-editor\" data-id=\"b88dbf0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Add a step to your pipeline to push the docker image to the container registry. This step would only run if no vulnerabilities are found by Trivy.<\/p><ul><li>Add the Docker push step after the Trivy scan:<\/li><\/ul><p>((Codeblock begin))<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-55cae54 elementor-widget elementor-widget-text-editor\" data-id=\"55cae54\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">&#8211; task: Docker@2<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559685&quot;:360,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f displayName: &#8216;Push Docker image to Container Registry&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559685&quot;:360,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f inputs:<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559685&quot;:360,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f command: &#8216;push&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559685&quot;:360,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f tags: &#8216;latest&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559685&quot;:360,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f repository: &#8216;&lt;YourContainerRegistry&gt;\/&lt;YourImageName&gt;&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559685&quot;:360,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-53e30f1 elementor-widget elementor-widget-text-editor\" data-id=\"53e30f1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>((Codeblock end))<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3032648b elementor-widget elementor-widget-heading\" data-id=\"3032648b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Complete YAML Pipeline <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-af1660d elementor-widget elementor-widget-text-editor\" data-id=\"af1660d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Here&#8217;s the complete YAML pipeline with Trivy scanning:<\/p><p>((Codeblock begin))<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a3f1513 elementor-widget elementor-widget-text-editor\" data-id=\"a3f1513\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><span data-contrast=\"auto\">trigger:<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f &#8211; main<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">pool:<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f vmImage: &#8216;ubuntu-latest&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">steps:<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f &#8211; task: Docker@2<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f displayName: &#8216;Build Docker image&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f inputs:<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f command: &#8216;build&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f dockerfile: &#8216;&lt;YourDockerfile&gt;&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f tags: &#8216;latest&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f repository: &#8216;&lt;YourContainerRegistry&gt;\/&lt;YourImageName&gt;&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f\u202f<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f &#8211; task: Bash@3<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f displayName: &#8216;Run Trivy vulnerability scan&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f inputs:<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f targetType: &#8216;inline&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f script: |<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f\u202f\u202f # Install Trivy<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f\u202f\u202f wget https:\/\/github.com\/aquasecurity\/trivy\/releases\/download\/v0.49.1\/trivy_0.49.1_Linux-64bit.tar.gz<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f\u202f\u202f <\/span> <span data-contrast=\"auto\">tar zxvf trivy_0.49.1_Linux-64bit.tar.gz<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f\u202f\u202f sudo mv trivy \/usr\/local\/bin\/trivy<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f\u202f\u202f rm trivy_0.49.1_Linux-64bit.tar.gz<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f\u202f\u202f # Run Trivy scan<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f\u202f\u202f\u202f trivy image &#8211;severity HIGH,CRITICAL &#8211;exit-code 1 &lt;YourContainerRegistry&gt;\/&lt;YourImageName&gt;:latest<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f &#8211; task: Docker@2<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f displayName: &#8216;Push Docker image to Container Registry&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202f\u202f\u202f\u202f inputs:<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202fcommand: &#8216;push&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559685&quot;:705,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202ftags: &#8216;latest&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559685&quot;:705,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p><p><span data-contrast=\"auto\">\u202frepository: &#8216;&lt;YourContainerRegistry&gt;\/&lt;YourImageName&gt;&#8217;<\/span><span data-contrast=\"auto\">\u202f<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335559685&quot;:705,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240,&quot;335559746&quot;:100}\">\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-76173fed elementor-widget elementor-widget-text-editor\" data-id=\"76173fed\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>((Codeblock end))<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-307543a5 elementor-widget elementor-widget-heading\" data-id=\"307543a5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Benefits of secure container creation <\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-611e5b3 elementor-widget elementor-widget-text-editor\" data-id=\"611e5b3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Integrating Trivy into your CI\/CD pipelines provides several benefits:<\/p><ul><li><strong>Early detection:<\/strong> Identify vulnerabilities in Docker images early in the development process, minimizing the risk of deploying insecure code.<\/li><li><strong>Automated security checks:<\/strong> Automate security scans within your CI\/CD pipeline, reducing the need for manual intervention and ensuring consistent security practices.<\/li><li><strong>Comprehensive reporting:<\/strong> Trivy provides detailed reports on discovered vulnerabilities, empowering teams to make informed decisions about risk mitigation strategies.<\/li><li><strong>Improved compliance:<\/strong> Meet compliance requirements by implementing security measures throughout the container lifecycle, from development to deployment.<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-39fbfe2 elementor-widget elementor-widget-heading\" data-id=\"39fbfe2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Conclusion<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-256f125 elementor-widget elementor-widget-text-editor\" data-id=\"256f125\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Securing Docker containers is essential for safeguarding your applications and infrastructure against potential threats. By integrating Trivy into your CI\/CD pipeline, you can automate vulnerability scanning and ensure that only secure container images are deployed into production. With proactive security measures in place, you can enhance the resilience of your software systems and maintain the trust of your customers and stakeholders.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Improve Docker container security in CI\/CD pipelines using the Trivy vulnerabiity scanner.<\/p>\n","protected":false},"author":23,"featured_media":77549,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[100],"tags":[173],"class_list":["post-77548","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-development"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/posts\/77548","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/comments?post=77548"}],"version-history":[{"count":104,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/posts\/77548\/revisions"}],"predecessor-version":[{"id":79816,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/posts\/77548\/revisions\/79816"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/media\/77549"}],"wp:attachment":[{"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/media?parent=77548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/categories?post=77548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/tags?post=77548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}