Skip to content

learningTrivy_Part1.md

Latest commit

 

History

History
197 lines (136 loc) · 5 KB

learningTrivy_Part1.md

File metadata and controls

197 lines (136 loc) · 5 KB
Raw

Let’s kick off Part 1 with a smart, practical, and inspiring foundation that sets the tone for the entire series.

We’ll blend hands-on learning, real-world architecture, and tool integrations that Fortune 100-level companies use.

📘 PART 1: Getting Started with Trivy in an Enterprise-Grade DevSecOps Project

🎯 Learning Goals

  • Understand what Trivy is and its core functionality
  • Install and run Trivy with real-world examples
  • Get familiar with the architecture of a modern DevSecOps pipeline
  • Set the stage for enterprise-level security scanning using Trivy

🏗️ DevSecOps Project Blueprint – Enterprise Simulation

Let’s define a fictitious company and a DevSecOps project we’ll build on throughout the series.

👩‍💻 Company: FinServe Inc.

A fintech company offering cloud-based banking APIs, mobile apps, and web portals.

🚧 Project: SecureCloudPay API

A microservices-based Node.js and Go backend, deployed on Kubernetes, integrated with cloud-native CI/CD.

🛠️ Enterprise Tool Stack (Alongside Trivy)

Area Tools Purpose
CI/CD GitHub Actions / GitLab CI Code integration, deployment pipelines
Container Security Trivy, Aqua, Grype Scan containers, config, and secrets
IaC Security Trivy, Checkov Scan Terraform and K8s manifests
Secrets Detection Trivy, Gitleaks Catch hardcoded secrets in repo/code
Compliance & Policies OPA + Conftest Policy-as-code guardrails
Kubernetes Security Trivy Operator, Kyverno Continuous scanning in-cluster
Monitoring & Reporting Prometheus + Grafana Observability, dashboards
Registry Scanning Trivy + ECR/GCR hooks Scan images pre- and post-deployment

We’ll use Trivy as a core scanning engine, integrated across multiple touchpoints—from local dev to CI/CD to Kubernetes.

🔍 What is Trivy?

Trivy is a simple and comprehensive vulnerability scanner for containers, filesystems, Git repositories, and cloud infrastructure.

What it detects:

  • OS package vulnerabilities (e.g., apt, apk)
  • Application vulnerabilities (e.g., Node.js, Python, Go, Java)
  • Secrets (API keys, tokens)
  • Misconfigurations (Dockerfile, K8s, Terraform, etc.)

⚙️ Step 1: Installing Trivy

Let’s get hands-on. You can install Trivy via Homebrew, apt, or Docker.

📦 Mac/Linux (via Brew or APT)

# macOS
brew install aquasecurity/trivy/trivy

# Ubuntu/Debian
wget https://github.com/aquasecurity/trivy/releases/latest/download/trivy_0.51.1_Linux-64bit.deb
sudo dpkg -i trivy_0.51.1_Linux-64bit.deb

🐳 Docker (no install required)

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
  aquasec/trivy image nginx:latest

✅ Run trivy --version to verify it's working.

🧪 Step 2: Scan Your First Image

Try scanning an official Docker image:

trivy image python:3.11-slim

You'll get a list of vulnerabilities grouped by package and severity.

💡 Pro Tip:

You can limit results:

trivy image --severity CRITICAL,HIGH python:3.11-slim

Or output JSON for CI/CD or integrations:

trivy image --format json --output result.json python:3.11-slim

🧰 Step 3: Folder/File System Scan

Scan your working directory (e.g., source code, configs):

trivy fs .

This will pick up:

  • Hardcoded secrets
  • Vulnerable packages
  • Misconfigured Dockerfiles and Terraform

🔍 Step 4: Secrets Scanning

trivy fs --scanners secret .

Finds things like:

  • AWS keys
  • GitHub tokens
  • Slack webhooks
  • JWTs

🛡️ Step 5: IaC Scan for Misconfigurations

trivy config .

Scans:

  • Terraform (*.tf)
  • Kubernetes (*.yaml)
  • Dockerfiles

Looks for weak settings (e.g., public S3, no encryption, root containers).

🔗 Step 6: Connect Trivy to the DevSecOps Project

In our SecureCloudPay project, we’ll:

  • Scan Docker images during CI
  • Catch secrets before merge
  • Check Kubernetes YAMLs before deployment
  • Run Trivy Operator inside our cluster for continuous scanning
  • Export scan results to GitHub Security Dashboard (or GitLab SAST)
  • Automate fail/build logic based on CRITICAL CVEs

🎁 Bonus: Learning Playground Repository

We’ll maintain a GitHub repo to go with the series: ➡️ github.com/finserve-devops/securecloudpay (I'll generate this structure for you in the next step)

This repo will include:

  • Vulnerable samples for testing
  • CI/CD pipeline examples
  • Terraform + Kubernetes IaC
  • Dashboard configs
  • Real-world folder structure

✅ Homework for Part 1

  1. Install Trivy on your local machine
  2. Scan a Docker image (e.g., node:18-alpine)
  3. Scan your current project folder
  4. Try secret scanning in a sample repo
  5. Set up a directory like this:
securecloudpay/
├── backend/
├── frontend/
├── terraform/
├── k8s/
└── .github/workflows/