Coldpatch Container Image: Scanning Images with Trivy

Before Starting

Kubernetes Community Days Taipei 2025

KCD Taipei 2025 | CNCF

In-person Event - 讓雲端原生計算在臺灣無所不在 “Make cloud native computing ubiquitous” in Taiwan

CNCF

Kubernetes Community Days Taipei 2025 (KCD Taipei 2025) is scheduled to take place on July 5, 2025. This is an annual event sponsored by CNCF, and we hope everyone can come and join our event together! 😸

If you want to perform a security scan on a specific container image locally and generate an assessment security report, using Aqua Security's Trivy is one of excellent choices. This project is not part of the CNCF projects, but it is highly integrated with many CNCF projects, such as Copa, Harbor and Kubernetes. Therefore, it has a place in the CNCF Landscape, categorized under Security & Compliance.

CNCF Landscape

CNCF Landscape

We will use the Azure AI services Diagnostic container image maintained by Microsoft for the explanation

Understand The Overall State

#!/bin/bash
docker pull mcr.microsoft.com/azure-cognitive-services/diagnostic:latest
trivy image \
  --pkg-types os,library \
  --table-mode summary \
  mcr.microsoft.com/azure-cognitive-services/diagnostic:latest

Regarding --pkg-types, the default parametes are os,libary, but somtimes when you use a container image, it is an image packaged as OS Packages + Application Packages (Language-specific).

Due to separation of responsibilities and ensuring the application can still operate after patching to the greatest extent, you may NOT want to perform repairs at the Application level. In such case, you can specify --pkg-types os to generate the report ouput.

As of 2025/06/14, Trivy supports scanning the following OS packages:

It is known that CentOS Stream / Windows OS Container is NOT supported.

Support new os name(CentOS Stream) on CentOS · aquasecurity trivy · Discussion #4561

Description We need to support new OS “CentOS Stream” As of now we are supporting the CentOS, CentOS Linux https://github.com/aquasecurity/trivy/blob/main/pkg/fanal/analyzer/os/redhatbase/centos.go…

GitHubaquasecurity

Understand Known Vulenrabilities that can be Fixed

There are a few of vulnerabilities that CANNOT be fixed even if the package are update (unpatched/unfixed). Add --ignore-unfixed, Trivy can scan container images ignoring those vulnerabilities.

#!/bin/bash
trivy image \
  --pkg-types os,library \
  --ignore-unfixed \
  --table-mode summary \
  mcr.microsoft.com/azure-cognitive-services/diagnostic:latest

Not every vulnerability has a remediation method; Based on Trivy's documentation - Filtering, it can be understood that each vulnerability is marked with a status for better understanding.

Trivy supports the following vulnerability statuses:

From the table above, you only need to focus on 2 Vulnerability Status: affected and fixed

Create report for Copa

Since the subsequent post will introduce the container patch tool - Copa, which requires the report generated by Trivy scanning, we need to specifically export it in JSON format.

#!/bin/bash
IMAGE=mcr.microsoft.com/azure-cognitive-services/diagnostic:latest
REPORT_NAME=azure-cognitive-services-diagnostic-latest.json

trivy image \
  --pkg-types os,library \
  --ignore-unfixed \
  --format json \
  --output ${REPORT_NAME} \
  ${IMAGE}

ls -la ${REPORT_NAME}

TL;DR

#!/bin/bash
IMAGE=mcr.microsoft.com/azure-cognitive-services/diagnostic:latest
REPORT_NAME=azure-cognitive-services-diagnostic-latest.json

# Download the specified container image
docker pull ${IMAGE}

# Generate a report for the specified container image
trivy image \
  --pkg-types os,library \
  --format json \
  --quiet \
  --output ${REPORT_NAME} \
  ${IMAGE}

# Show result
jq '
  [ ..
    | .Vulnerabilities?
    | .[]?
  ] as $all |
  {
    "Total number of vulnerabilities":        ($all | length),
    "Number of fixable vulnerabilities":  ($all | map(select(.FixedVersion != null and .FixedVersion != "")) | length),
    "Number of non-fixable vulnerabilities":($all | map(select(.FixedVersion == null or .FixedVersion == "")) | length)
  }
' ${REPORT_NAME}

Appendix: Install Trivy

#!/bin/bash
sudo apt-get install wget gnupg
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt-get update
sudo apt-get install trivy