I. Prerequisites<\/h3>\n\n\n\n\n- Ubuntu\/Debian-based Linux distribution<\/li>\n\n\n\n
- Root or sudo privileges<\/li>\n\n\n\n
wget<\/code>, apt-transport-https<\/code>, and gnupg<\/code> available<\/li>\n\n\n\n- Internet access to reach Trivy’s official repository<\/li>\n<\/ul>\n\n\n\n
II. How Trivy Fits Into Your Pipeline<\/h3>\n\n\n\n\n- Trivy scans a target<\/strong> \u2014 a container image, filesystem path, or Git repository<\/li>\n\n\n\n
- It checks that target against vulnerability databases<\/strong> it downloads and keeps updated<\/li>\n\n\n\n
- It reports back any known CVEs, misconfigurations, or exposed secrets it finds<\/li>\n<\/ul>\n\n\n\n
![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/04\/trivy_scan_architecture-1024x331.png\")
<\/a><\/figure>\n\n\n\nIII. Install Dependencies<\/h3>\n\n\n\nsudo apt-get update\nsudo apt-get install -y wget apt-transport-https gnupg lsb-release\n<\/pre>\n\n\n\nThis installs wget<\/code> (download files), apt-transport-https<\/code> (HTTPS repositories), gnupg<\/code> (verify signatures), and lsb-release<\/code> (detect your OS version).<\/p>\n\n\n\nIV. Add the Trivy GPG Key<\/h3>\n\n\n\nwget -qO - https:\/\/aquasecurity.github.io\/trivy-repo\/deb\/public.key | sudo gpg --dearmor -o \/usr\/share\/keyrings\/trivy.gpg\n<\/pre>\n\n\n\n\nNote:<\/strong> The original method (apt-key add<\/code>) is deprecated and has been removed entirely on current Ubuntu\/Debian versions. The command above uses the current recommended approach \u2014 storing the key as a dedicated keyring file and referencing it explicitly in the repository entry (Step V), rather than adding it to a shared system-wide keyring.<\/p>\n<\/blockquote>\n\n\n\nV. Add the Trivy Repository<\/h3>\n\n\n\necho \"deb [signed-by=\/usr\/share\/keyrings\/trivy.gpg] https:\/\/aquasecurity.github.io\/trivy-repo\/deb $(lsb_release -sc) main\" | sudo tee \/etc\/apt\/sources.list.d\/trivy.list\n<\/pre>\n\n\n\nThe signed-by<\/code> flag tells apt<\/code> to verify this specific repository using the keyring file from Step IV, rather than trusting any key in the system’s general keyring \u2014 a more secure, explicit approach than the older method.<\/p>\n\n\n\nVI. Install Trivy<\/h3>\n\n\n\nsudo apt-get update\nsudo apt-get install -y trivy\n<\/pre>\n\n\n\nVII. Verify Installation<\/h3>\n\n\n\ntrivy -v\n<\/pre>\n\n\n\nThis confirms Trivy installed correctly and shows the installed version.<\/p>\n\n\n\n
VIII. Conclusion<\/h3>\n\n\n\n
Trivy installs cleanly through its official APT repository, with the current setup using an explicit signed-by<\/code> keyring reference instead of the deprecated apt-key<\/code> method. Once installed, you can scan container images, filesystems, or repositories directly:<\/p>\n\n\n\ntrivy image <image_name>\ntrivy fs <path_to_filesystem>\n<\/pre>\n\n\n\n
\n\n\n\nFrequently Asked Questions<\/h2>\n\n\n\n
Why was apt-key replaced?<\/strong> apt-key<\/code> trusted keys system-wide for all repositories, which was a broader security surface than necessary. The signed-by<\/code> approach scopes each key to just the specific repository it’s meant to verify.<\/p>\n\n\n\nCan Trivy scan private container registries?<\/strong> Yes \u2014 Trivy supports authenticating against private registries using standard Docker credential mechanisms.<\/p>\n\n\n\nDoes Trivy need internet access every time it runs?<\/strong> It needs access to update its vulnerability database periodically, but can run scans using a cached database if offline, as long as the database was downloaded previously.<\/p>\n\n\n\n
\n\n\n\nRelated Articles<\/h2>\n\n\n\n
How to Renew Kubernetes Certificates Using kubeadm (Step-by-Step Guide with Zero Planned Downtime)<\/a><\/p>\n\n\n\n
wget<\/code>, apt-transport-https<\/code>, and gnupg<\/code> available<\/li>\n\n\n\n- Internet access to reach Trivy’s official repository<\/li>\n<\/ul>\n\n\n\n
II. How Trivy Fits Into Your Pipeline<\/h3>\n\n\n\n\n- Trivy scans a target<\/strong> \u2014 a container image, filesystem path, or Git repository<\/li>\n\n\n\n
- It checks that target against vulnerability databases<\/strong> it downloads and keeps updated<\/li>\n\n\n\n
- It reports back any known CVEs, misconfigurations, or exposed secrets it finds<\/li>\n<\/ul>\n\n\n\n
<\/a><\/figure>\n\n\n\nIII. Install Dependencies<\/h3>\n\n\n\nsudo apt-get update\nsudo apt-get install -y wget apt-transport-https gnupg lsb-release\n<\/pre>\n\n\n\nThis installs wget<\/code> (download files), apt-transport-https<\/code> (HTTPS repositories), gnupg<\/code> (verify signatures), and lsb-release<\/code> (detect your OS version).<\/p>\n\n\n\nIV. Add the Trivy GPG Key<\/h3>\n\n\n\nwget -qO - https:\/\/aquasecurity.github.io\/trivy-repo\/deb\/public.key | sudo gpg --dearmor -o \/usr\/share\/keyrings\/trivy.gpg\n<\/pre>\n\n\n\n\nNote:<\/strong> The original method (apt-key add<\/code>) is deprecated and has been removed entirely on current Ubuntu\/Debian versions. The command above uses the current recommended approach \u2014 storing the key as a dedicated keyring file and referencing it explicitly in the repository entry (Step V), rather than adding it to a shared system-wide keyring.<\/p>\n<\/blockquote>\n\n\n\nV. Add the Trivy Repository<\/h3>\n\n\n\necho \"deb [signed-by=\/usr\/share\/keyrings\/trivy.gpg] https:\/\/aquasecurity.github.io\/trivy-repo\/deb $(lsb_release -sc) main\" | sudo tee \/etc\/apt\/sources.list.d\/trivy.list\n<\/pre>\n\n\n\nThe signed-by<\/code> flag tells apt<\/code> to verify this specific repository using the keyring file from Step IV, rather than trusting any key in the system’s general keyring \u2014 a more secure, explicit approach than the older method.<\/p>\n\n\n\nVI. Install Trivy<\/h3>\n\n\n\nsudo apt-get update\nsudo apt-get install -y trivy\n<\/pre>\n\n\n\nVII. Verify Installation<\/h3>\n\n\n\ntrivy -v\n<\/pre>\n\n\n\nThis confirms Trivy installed correctly and shows the installed version.<\/p>\n\n\n\n
VIII. Conclusion<\/h3>\n\n\n\n
Trivy installs cleanly through its official APT repository, with the current setup using an explicit signed-by<\/code> keyring reference instead of the deprecated apt-key<\/code> method. Once installed, you can scan container images, filesystems, or repositories directly:<\/p>\n\n\n\ntrivy image <image_name>\ntrivy fs <path_to_filesystem>\n<\/pre>\n\n\n\n
\n\n\n\nFrequently Asked Questions<\/h2>\n\n\n\n
Why was apt-key replaced?<\/strong> apt-key<\/code> trusted keys system-wide for all repositories, which was a broader security surface than necessary. The signed-by<\/code> approach scopes each key to just the specific repository it’s meant to verify.<\/p>\n\n\n\nCan Trivy scan private container registries?<\/strong> Yes \u2014 Trivy supports authenticating against private registries using standard Docker credential mechanisms.<\/p>\n\n\n\nDoes Trivy need internet access every time it runs?<\/strong> It needs access to update its vulnerability database periodically, but can run scans using a cached database if offline, as long as the database was downloaded previously.<\/p>\n\n\n\n
\n\n\n\nRelated Articles<\/h2>\n\n\n\n
How to Renew Kubernetes Certificates Using kubeadm (Step-by-Step Guide with Zero Planned Downtime)<\/a><\/p>\n\n\n\n
![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/04\/trivy_scan_architecture-scaled.png\")
<\/a><\/figure>\n\n\n\n