🔺

Trivy Learning Roadmap

Vulnerability scanning for containers, IaC, and dependencies.

Estimated time:1–2 weeks

1🌱

Phase 1 — Fundamentals

Image scanning basics (trivy image)

Severity levels & exit codes

Filesystem & repo scanning

SBOM generation

2🔄

Failing builds on critical CVEs

Ignoring accepted-risk CVEs (.trivyignore)

Scanning in GitHub Actions/GitLab CI

Caching vulnerability DB for speed

3🔍

IaC misconfiguration scanning (Terraform/K8s YAML)

Secret scanning

License scanning

Kubernetes cluster scanning (trivy k8s)

4🔐

important

Trivy Operator for continuous cluster scanning

Integrating with admission controllers

Triage workflow for scan results

Begin with interview questions to assess your current level.