Dagger
Search

trivy

This module provides Dagger functions for scanning Docker images and filesystem
directories using Trivy, the open-source vulnerability scanner from Aqua Security.
It demonstrates how to configure containers with Trivy, accept optional inputs
like scan severity and credentials, and return results as Dagger file outputs or
raw text.

The `ScanFilesystem` function scans a directory for vulnerabilities and returns
a Trivy report as a file. The `ScanImage` function scans a container image by
reference and returns the vulnerability report as plain text. These functions
serve as a reference for integrating Trivy into secure CI/CD pipelines using Dagger.

Installation

dagger install github.com/stuttgart-things/dagger/trivy@v0.129.0

Entrypoint

Return Type 
Trivy
Example
dagger -m github.com/stuttgart-things/dagger/trivy@19ab3e7e4a54600d0b19ed9c8d2cdd3998f7be86 call \

func (m *MyModule) Example() *dagger.Trivy  {
	return dag.
			Trivy()
}
@function
def example() -> dagger.Trivy:
	return (
		dag.trivy()
	)
@func()
example(): Trivy {
	return dag
		.trivy()
}

Types

Trivy 🔗

scanFilesystem() 🔗

Return Type 
File !
Arguments
NameTypeDefault ValueDescription
srcDirectory !-No description provided
severityString "HIGH,CRITICAL"No description provided
trivyVersionString "0.64.1"No description provided
Example
dagger -m github.com/stuttgart-things/dagger/trivy@19ab3e7e4a54600d0b19ed9c8d2cdd3998f7be86 call \
 scan-filesystem --src DIR_PATH
func (m *MyModule) Example(src *dagger.Directory) *dagger.File  {
	return dag.
			Trivy().
			Scanfilesystem(src)
}
@function
def example(src: dagger.Directory) -> dagger.File:
	return (
		dag.trivy()
		.scanfilesystem(src)
	)
@func()
example(src: Directory): File {
	return dag
		.trivy()
		.scanFilesystem(src)
}

scanImage() 🔗

ScanImage scans a published container image and returns Trivy’s JSON report, enriched with a ParsedSummary listing the findings at the requested severities.

Trivy’s own exit code is deliberately discarded (|| true): it exits 0 on findings anyway unless asked otherwise, and swallowing it keeps a scan that found something from being confused with a scan that could not run. The verdict is taken from the parsed report instead, which is also what makes the summary and the gate agree by construction.

A scan that cannot run at all is still an error – an unreachable registry or an image that does not exist leaves no parseable JSON behind, and reporting that as “nothing found” would be the worst answer available.

With failOnFinding set this returns an error, so a dagger call scan-image ... export --path report.json never reaches the export. To both keep the report and gate the build, call twice – once to export, once to gate. The second call hits Dagger’s cache and costs nothing. Govulncheck in the go module has the same shape for the same reason.

Return Type 
File !
Arguments
NameTypeDefault ValueDescription
imageRefString !-

Fully qualified image reference (e.g., “ttl.sh/my-repo:1.0.0”)

registryUserSecret -No description provided
registryPasswordSecret -No description provided
severityString "HIGH,CRITICAL"No description provided
trivyVersionString "0.64.1"No description provided
failOnFindingBoolean false

Fail when the scan finds anything at the requested severities. Off by default so that adopting a newer module version cannot turn a green pipeline red on its own; callers that want a gate ask for one.

Example
dagger -m github.com/stuttgart-things/dagger/trivy@19ab3e7e4a54600d0b19ed9c8d2cdd3998f7be86 call \
 scan-image --image-ref string
func (m *MyModule) Example(imageRef string) *dagger.File  {
	return dag.
			Trivy().
			Scanimage(imageRef)
}
@function
def example(imageref: str) -> dagger.File:
	return (
		dag.trivy()
		.scanimage(imageref)
	)
@func()
example(imageRef: string): File {
	return dag
		.trivy()
		.scanImage(imageRef)
}