{"id":9872,"date":"2026-04-04T09:35:25","date_gmt":"2026-04-04T04:05:25","guid":{"rendered":"https:\/\/pheonixsolutions.com\/blog\/?p=9872"},"modified":"2026-11-03T12:21:06","modified_gmt":"2026-11-03T06:51:06","slug":"installing-and-setting-up-trivy-vulnerability-scanner-on-ubuntu-debian","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/installing-and-setting-up-trivy-vulnerability-scanner-on-ubuntu-debian\/","title":{"rendered":"Installing and Setting Up Trivy Vulnerability Scanner on Ubuntu\/Debian"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong><strong>Post Date:<\/strong><\/strong> April 04, 2026<strong><br><strong>Last Updated:<\/strong> <\/strong>November 03, 2026<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/trivy.dev\/docs\/latest\/guide\/\" target=\"_blank\" rel=\"noopener\">Trivy<\/a> is an open-source vulnerability scanner designed to identify security risks in container images, filesystems, Git repositories, and Infrastructure as Code (IaC). It helps DevOps engineers and system administrators detect known vulnerabilities (CVEs), security misconfigurations, exposed secrets, and other potential security threats.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Install Trivy on Ubuntu<\/strong> to integrate vulnerability scanning into your development environments and CI\/CD pipelines. By regularly scanning container images, application dependencies, and infrastructure configurations, teams can identify security issues early and reduce potential risks before deployment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this guide, we will explain how to install Trivy on Ubuntu using the official APT repository. You will also learn how to configure the GPG key, install the required dependencies, verify the installation, and perform basic vulnerability scans.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Implementation<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">I. Prerequisites for Trivy Installation on Ubuntu<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Before starting the Trivy installation on Ubuntu, ensure that your system meets the following requirements:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ubuntu or Debian-based Linux distribution.<\/li>\n\n\n\n<li>Root or sudo privileges.<\/li>\n\n\n\n<li>Internet connectivity to access the official Trivy repository.<\/li>\n\n\n\n<li><code>wget<\/code> and <code>gnupg<\/code> packages.<\/li>\n\n\n\n<li>APT package manager.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">II. How Trivy Works in a DevOps Pipeline<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Trivy helps improve application and infrastructure security by scanning different targets and identifying potential vulnerabilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Trivy vulnerability scanning process involves the following steps:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>Target Selection:<\/strong> Trivy scans a container image, filesystem directory, or Git repository.<\/li>\n\n\n\n<li><strong>Vulnerability Detection:<\/strong> It checks the target against vulnerability databases to identify known security issues.<\/li>\n\n\n\n<li><strong>Security Analysis:<\/strong> It detects CVEs, configuration issues, and exposed secrets.<\/li>\n\n\n\n<li><strong>Report Generation:<\/strong> Trivy generates a report containing identified vulnerabilities and security findings.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">This process helps DevOps teams identify security issues early and integrate automated security checks into CI\/CD workflows.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"331\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/04\/trivy_scan_architecture-1024x331.png\" alt=\"Trivy vulnerability scanning workflow showing container images, filesystems, and Git repositories being scanned against vulnerability databases to identify CVEs and security misconfigurations\n\" class=\"wp-image-11776\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/04\/trivy_scan_architecture-1024x331.png 1024w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/04\/trivy_scan_architecture-300x97.png 300w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/04\/trivy_scan_architecture-768x248.png 768w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/04\/trivy_scan_architecture-1536x497.png 1536w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/04\/trivy_scan_architecture-2048x663.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">III. Install Required Dependencies<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">First, update the Ubuntu package repository and install the required dependencies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Run the following commands:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo apt-get update\n\nsudo apt-get install -y wget gnupg<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">These packages provide the following functionality:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>wget:<\/strong> Downloads files from remote servers.<\/li>\n\n\n\n<li><strong>gnupg:<\/strong> Verifies repository signing keys.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IV. Add the Trivy GPG Key<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To securely install Trivy from its official repository, add the Aqua Security GPG signing key.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Execute the following command:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">wget -qO - https:\/\/aquasecurity.github.io\/trivy-repo\/deb\/public.key | gpg --dearmor | sudo tee \/usr\/share\/keyrings\/trivy.gpg > \/dev\/null<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This command downloads the official Trivy public key and converts it into a GPG keyring file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Note:<\/strong> The older <code>apt-key add<\/code> method is deprecated. Using a dedicated keyring with the <code>signed-by<\/code> option restricts repository authentication to the specified signing key.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">V. Add the Official Trivy APT Repository<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">After configuring the GPG key, add the official Trivy repository to your Ubuntu system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Run the following command:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">echo \"deb [signed-by=\/usr\/share\/keyrings\/trivy.gpg] https:\/\/aquasecurity.github.io\/trivy-repo\/deb generic main\" | sudo tee \/etc\/apt\/sources.list.d\/trivy.list<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The <code>signed-by<\/code> option instructs APT to verify packages from the Trivy repository using the specified GPG keyring.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This provides repository-specific key verification instead of relying on globally trusted repository keys.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">VI. Install Trivy on Ubuntu<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Once the official repository has been configured, update the package index and install Trivy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Execute the following commands:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo apt-get update\n\nsudo apt-get install -y trivy<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">APT downloads and installs the Trivy vulnerability scanner and its required packages.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">VII. Verify the Trivy Installation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">After completing the installation, verify whether Trivy is installed successfully.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Run:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">trivy --version<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The command displays the installed Trivy version.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the version information appears without errors, the Trivy installation is successful.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">VIII. Perform a Basic Vulnerability Scan Using Trivy<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">After installing Trivy on Ubuntu, you can start scanning container images, filesystems, and Git repositories for security vulnerabilities.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">1. Scan a Docker Image<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">To scan a container image, execute:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">trivy image nginx:latest<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This command scans the Nginx container image and identifies known vulnerabilities in its operating system packages and application dependencies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The scan report provides information about detected vulnerabilities, including their severity levels.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">2. Scan a Filesystem<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">To scan a project directory or filesystem, execute:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">trivy fs .<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This command scans the current directory for vulnerabilities and supported security findings.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It helps identify security issues in application dependencies and configuration files.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">3. Scan a Git Repository<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">To scan a local Git repository, execute:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">trivy repo .<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can also scan a remote Git repository using its URL:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">trivy repo https:\/\/github.com\/aquasecurity\/trivy-ci-test<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This helps identify vulnerabilities, misconfigurations, and exposed secrets in supported repository files and dependencies.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">IX. Conclusion: Benefits of Trivy Installation on Ubuntu<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Installing Trivy on Ubuntu is a straightforward process that helps strengthen security across container images, filesystems, and Git repositories. By configuring the official Trivy APT repository and using a dedicated GPG keyring, administrators can install and maintain the vulnerability scanner without relying on the deprecated <code>apt-key<\/code> method.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After completing the Trivy installation on Ubuntu, you can use commands such as <code>trivy image<\/code>, <code>trivy fs<\/code>, and <code>trivy repo<\/code> to identify known vulnerabilities and other security issues in your applications and infrastructure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Integrating Trivy into DevOps and CI\/CD pipelines enables continuous security scanning, early vulnerability detection, and improved container security. Regularly updating vulnerability databases and scanning application components helps organizations maintain a more secure development and deployment environment.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently Asked Questions (FAQs)<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1. What is Trivy used for in Ubuntu?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Trivy is an open-source vulnerability scanner used to identify security vulnerabilities, misconfigurations, and exposed secrets in container images, filesystems, Git repositories, and Infrastructure as Code.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. How do I install Trivy on Ubuntu?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You can install Trivy on Ubuntu by adding the official Aqua Security APT repository, configuring its GPG signing key, updating the package index, and executing <code>sudo apt-get install -y trivy<\/code>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Can Trivy scan private container registries?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. Trivy supports scanning private container images using registry authentication credentials, including credentials configured through standard Docker authentication mechanisms.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Does Trivy require internet access to scan images?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Trivy requires internet access to download and update its vulnerability database. However, it can perform scans using a previously downloaded and cached database when offline, provided the required database is available.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Can Trivy be integrated into CI\/CD pipelines?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. Trivy can be integrated into CI\/CD tools such as Jenkins and GitLab CI to automatically scan container images, dependencies, and source code during the build and deployment process.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Related Articles<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/pheonixsolutions.com\/blog\/renew-kubernetes-certificates-kubeadm\/\">How to Renew Kubernetes Certificates Using kubeadm (Step-by-Step Guide with Zero Planned Downtime)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/pheonixsolutions.com\/blog\/how-to-configure-cert-manager-clusterissuer-with-cloudflare-api-token-on-kubernetes\/\">How to Configure cert-manager ClusterIssuer with Cloudflare API Token on Kubernetes<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Strengthen Your Application Security with Our Experts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Looking to strengthen your application and container security? Pheonix Solutions provides expert DevOps, cloud infrastructure, and security solutions to help businesses identify vulnerabilities and improve their deployment environments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With tools like <strong>Trivy vulnerability scanner<\/strong>, businesses can detect security vulnerabilities in container images, filesystems, Git repositories, and application dependencies. Our DevOps team can help you integrate automated vulnerability scanning into your CI\/CD pipelines and implement effective security practices.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Explore our <a href=\"https:\/\/pheonixsolutions.com\/devops-cloud\/\">DevOps and Cloud Services<\/a> to learn more about our solutions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Need help with Trivy installation, container security, or DevSecOps implementation? <a href=\"https:\/\/pheonixsolutions.com\/contact\">Contact our experts<\/a> to discuss your requirements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Post Date: April 04, 2026Last Updated: November 03, 2026 Introduction Trivy is an open-source vulnerability scanner designed to identify security [&hellip;]<\/p>\n","protected":false},"author":508,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1024],"tags":[],"class_list":["post-9872","post","type-post","status-publish","format-standard","hentry","category-security","psol-cat-security"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-2ze","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/9872","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/508"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=9872"}],"version-history":[{"count":8,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/9872\/revisions"}],"predecessor-version":[{"id":12847,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/9872\/revisions\/12847"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=9872"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=9872"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=9872"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}