Trivy is a security scanner that finds vulnerabilities,
misconfigurations, secret leaks, and license problems in container
images, filesystems, Git repositories, and dependency manifests.

Building requires google-go-lang (Go 1.27 or newer). The supplied vendor
archive allows offline compilation without downloading dependencies.
The built binary is static and needs no external library at runtime.

Trivy stores its downloaded data in the cache directory, ~/.cache/trivy
by default. The vulnerability and Java databases are OCI artifacts taken
from mirror.gcr.io and ghcr.io. Downloading them needs network access.
For offline use, run "trivy --download-db-only" on a connected machine
and copy the cache, or host the databases in your own registry.

The misconfiguration checks are embedded in the binary and are used
when the external checks bundle is unavailable, so configuration
scanning works without network access.

Scanning container images needs a running container engine. Trivy talks
to the Docker or Podman API through their sockets, so the socket path
can be set with the DOCKER_HOST environment variable.

Documentation: https://trivy.dev/latest/docs/