Trivy
automatically detects the following files in the container and scans vulnerabilities in the application dependencies.
Language | File | Image1 | Rootfs2 | Filesystem3 | Repository4 | Dev dependencies |
---|---|---|---|---|---|---|
Ruby | Gemfile.lock | - | - | ✅ | ✅ | included |
gemspec | ✅ | ✅ | - | - | included | |
Python | Pipfile.lock | - | - | ✅ | ✅ | excluded |
poetry.lock | - | - | ✅ | ✅ | included | |
requirements.txt | - | - | ✅ | ✅ | included | |
egg package5 | ✅ | ✅ | - | - | excluded | |
wheel package6 | ✅ | ✅ | - | - | excluded | |
PHP | composer.lock | ✅ | ✅ | ✅ | ✅ | excluded |
Node.js | package-lock.json | - | - | ✅ | ✅ | excluded |
yarn.lock | - | - | ✅ | ✅ | included | |
pnpm-lock.yaml | - | - | ✅ | ✅ | excluded | |
package.json | ✅ | ✅ | - | - | excluded | |
.NET | packages.lock.json | ✅ | ✅ | ✅ | ✅ | included |
packages.config | ✅ | ✅ | ✅ | ✅ | excluded | |
.deps.json | ✅ | ✅ | ✅ | ✅ | excluded | |
Java | JAR/WAR/PAR/EAR78 | ✅ | ✅ | - | - | included |
pom.xml9 | - | - | ✅ | ✅ | excluded | |
*gradle.lockfile | - | - | ✅ | ✅ | excluded | |
Go | Binaries built by Go10 | ✅ | ✅ | - | - | excluded |
go.mod11 | - | - | ✅ | ✅ | included | |
Rust | Cargo.lock | ✅ | ✅ | ✅ | ✅ | included |
Binaries built with cargo-auditable | ✅ | ✅ | - | - | excluded |
The path of these files does not matter.
Example: Dockerfile
Footnotes
-
✅ means "enabled" and
-
means "disabled" in the image scanning ↩ -
✅ means "enabled" and
-
means "disabled" in the rootfs scanning ↩ -
✅ means "enabled" and
-
means "disabled" in the filesystem scanning ↩ -
✅ means "enabled" and
-
means "disabled" in the git repository scanning ↩ -
*.egg-info
,*.egg-info/PKG-INFO
,*.egg
andEGG-INFO/PKG-INFO
↩ -
.dist-info/META-DATA
↩ -
*.jar
,*.war
,*.par
and*.ear
↩ -
It requires Internet access ↩
-
It requires Internet access when the POM doesn't exist in your local repository ↩
-
UPX-compressed binaries don't work ↩
-
If smaller than go 1.17, go.sum is also required ↩