Guides

How to Scan Docker Images for Vulnerabilities with Trivy (and Amazon ECR)

By Ravindra Bagale, Cyber Security trainer · LinkedIn · Published: 16 October 2026 · Last updated: 17 October 2026

To scan a Docker image for vulnerabilities, install Trivy (free, from Aqua Security) and run trivy image <image>. It lists the packages inside the image and matches them with known CVEs, then prints a table by severity. Use --severity HIGH,CRITICAL --ignore-unfixed to see what you can fix today, and --exit-code 1 to fail a CI build. On AWS, also turn on Amazon ECR scan on push.

trivy image nginx:1.27                                   # full report
trivy image --severity HIGH,CRITICAL --ignore-unfixed nginx:1.27
trivy image --exit-code 1 --severity CRITICAL myapp:2.4.1   # CI gate
trivy fs --scanners secret,misconfig .                   # repo: secrets + Dockerfile

A live example first

We compare two versions of the official nginx image on an Ubuntu EC2 instance. First install Trivy (one of the methods from the Trivy documentation):

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
  aquasec/trivy:latest image --severity HIGH,CRITICAL nginx:1.21

Trimmed output:

nginx:1.21 (debian 11.6)
Total: 120 (HIGH: 98, CRITICAL: 22)

┌──────────────┬────────────────┬──────────┬───────────────────┬───────────────┐
│   Library    │ Vulnerability  │ Severity │ Installed Version │ Fixed Version │
├──────────────┼────────────────┼──────────┼───────────────────┼───────────────┤
│ libwebp6     │ CVE-2023-4863  │ CRITICAL │ 0.6.1-2.1         │ 0.6.1-2.1+deb11u2 │
│ openssl      │ CVE-2023-0286  │ HIGH     │ 1.1.1n-0+deb11u3  │ 1.1.1n-0+deb11u4  │
│ ...          │                │          │                   │               │
└──────────────┴────────────────┴──────────┴───────────────────┴───────────────┘

Now the current Alpine-based tag:

trivy image --severity HIGH,CRITICAL nginx:1.27-alpine

nginx:1.27-alpine (alpine 3.20)
Total: 0 (HIGH: 0, CRITICAL: 0)

(Exact counts change every day as new CVEs are published and images are rebuilt. Run it yourself to see today's numbers.)

Friends, look at that difference. Same web server, but the old image carries a critical libwebp bug (CVE-2023-4863, the one used in real attacks against browsers in 2023). The fix was not a code change. It was choosing a fresh, smaller base image.

How does Trivy find vulnerabilities?

An image is a stack of layers. Trivy reads them and builds a list of everything installed: Debian or Alpine packages (apt, apk), plus app libraries such as Java .jar files, package-lock.json, requirements.txt, go.sum, Gemfile.lock and composer.lock. It then matches each name and version with its vulnerability database, which is built from sources like the NVD and the Debian, Alpine and GitHub security advisories.

How do I scan step by step?

1. Install Trivy (apt or rpm repo, brew install trivy, or the Docker image).
2. Run trivy image <name:tag>.
3. Read the Total line first.
4. Re-run with --severity HIGH,CRITICAL --ignore-unfixed.
5. For each row, note the Fixed Version.
6. Upgrade the base image or the library, then rebuild.
7. Scan again and compare the totals.
8. Add the scan to CI with --exit-code 1.

What Trivy finds in each language

Add Trivy to a CI pipeline

GitHub Actions

- name: Scan image
  uses: aquasecurity/trivy-action@0.24.0
  with:
    image-ref: myapp:${{ github.sha }}
    severity: HIGH,CRITICAL
    ignore-unfixed: true
    exit-code: '1'

GitLab CI or Jenkins (shell step)

trivy image --exit-code 1 --severity CRITICAL --ignore-unfixed myapp:$BUILD_NUMBER

Start with CRITICAL only, so the team is not flooded, then add HIGH once the backlog is clean.

Scan more than images

trivy fs --scanners vuln,secret,misconfig .     # your source folder
trivy config k8s/                               # Kubernetes YAML
trivy config terraform/                         # Terraform

trivy config warns about things like containers running as root, missing resource limits and S3 buckets without encryption.

Scan in Amazon ECR

1. Open ECR → your repository → Edit.
2. Turn on Scan on push (basic scanning).
3. For deeper checks, go to ECR → Private registry → Scanning configuration → Enhanced scanning.
4. Enhanced scanning uses Amazon Inspector, includes language libraries, and re-scans when new CVEs come out.
5. View findings in ECR or in Amazon Inspector.

Google Artifact Registry and Azure Container Registry (with Microsoft Defender for Containers) offer the same kind of scanning.

Real incidents this would have caught

• Log4Shell (CVE-2021-44228), December 2021: teams with image scanning could find every image with a vulnerable log4j-core in minutes. Teams without it searched servers by hand for days.
• xz-utils backdoor (CVE-2024-3094), March 2024: a backdoor in xz versions 5.6.0 and 5.6.1 was found by a Microsoft engineer before it spread widely. Scanners quickly added the CVE, and teams could prove their images used safe versions.

Mistakes to avoid

1. Scanning once and forgetting. New CVEs appear every day. Re-scan running images on a schedule, or use ECR enhanced scanning.
2. Failing on every LOW finding. Developers start ignoring the scanner. Gate on what matters.
3. Treating zero findings as "secure". A scanner only knows published issues.

Summary table