Container Security: Container Image Scanning tools || Trivy || Grype:

Trivy:

Trivy scans the files inside container images for

• Vulnerabilities
• Misconfigurations
• Secrets
• Licenses

By default, vulnerability and secret scanning are enabled, and you can configure that with --scanners.

Vulnerabilities

It is enabled by default. You can simply specify your image name (and a tag). It detects known vulnerabilities in your container image.

trivy image [YOUR_IMAGE_NAME]

trivy image node:latest 

To enable only vulnerability scanning, you can specify --scanners vuln.

trivy image node:latest --scanners vuln

Misconfigurations

Trivy mainly supports Infrastructure as Code (IaC) files for misconfigurations.

trivy image node:latest --scanners misconfig

Secrets

It is enabled by default.

trivy image node:latest

Licenses

It is disabled by default.

 trivy image --scanners license node:latest

If Docker isn’t installed or you can’t pull images directly, Trivy can also scan tar archives of images.

You can export your image first:

docker save -o node_latest.tar node:latest

Then scan the tarball directly with Trivy:

trivy image --input node_latest.tar

This method is perfect for offline scanning or environments without Docker.

Exmple Result:

You can also get the result json format using “— format json” flag in the below command:

trivy image node:latest --format json -o node.json --scanners vuln

You can also convert the JSON result into HTML for a better data representation.

wget https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/html.tpl

sudo cp html.tpl /usr/local/share/trivy/templates/html.tpl

 trivy convert --format template --template "@/usr/local/share/trivy/templates/html.tpl" -o node.html node.json --debug

If trivy has been installed via package manager, then place the html.tpl on the “/usr/bin” and alter the convert command accordingly.

sudo cp html.tpl /usr/bin/html.tpl

trivy convert --format template --template "@/usr/bin/html.tpl" -o node.html node.json --debug

Container image metadata

Container images have configuration. docker inspect and docker history show the information according to the configuration.

Trivy scans the configuration of container images for

• Misconfigurations
• Secrets

They are disabled by default. You can enable them with --image-config-scanners.

Misconfigurations

Trivy detects misconfigurations on the configuration of container images.

It is disabled by default. You can enable it with --image-config-scanners misconfig.

$ trivy image --image-config-scanners misconfig node:latest

Secrets

Trivy detects secrets in the configuration of container images. The image config is converted into JSON and Trivy scans the file for secrets. It is especially useful for environment variables that are likely to have credentials by accident.

$ trivy image --image-config-scanners secret node:latest

Grype:

Grype is a fast, open-source CLI vulnerability scanner built by Anchore. It allows you to scan container images, filesystem directories, SBOMs, and more, in order to find known vulnerabilities in operating-system packages and language-specific dependencies.

Key capabilities include:

• Scan container images from Docker, OCI, registries, or local tar archives.
• Scan local directories (projects) for dependencies.
• Accept SBOMs (Software Bill of Materials) as input and analyze them.
• Provide output in multiple formats (table, JSON, SARIF, template-based) so you can integrate into CI/CD.

Why use it? Because in containerized/cloud environments, you want to catch vulnerabilities early, before deployment, and include them in your DevSecOps pipeline

grype image:tag

grype alpine:latest

Exporting Grype Results in JSON Format

You can easily export vulnerability scan results in JSON format using the -o json flag. This is useful when integrating Grype with dashboards, automation scripts, or vulnerability management systems.

grype alpine:latest -o json > grypealpine.json

The JSON file can later be parsed, converted into HTML, or ingested into databases and visualization tools like Grafana.

Converting JSON Report to HTML

Once you’ve generated the vulnerability report in JSON format, you can convert it into an HTML report for easier visualization and sharing. If you have a conversion script (like grype2html.py), simply run:

cat grypealpine.json | ./grype2html.py

This command reads the JSON output from grypealpine.json and converts it into a neatly formatted HTML report.

You can download a grype2html.py from the github using the command below

git clone https://github.com/popey/grype2html
chmod +x grype2html.py

Now you can use the command below

cat grypealpine.json | ./grype2html.py

HTML Report: