Trivy

Comprehensive open-source vulnerability scanner

Trivy is an open-source vulnerability scanner with 24K+ GitHub stars by Aqua Security that scans container images, file systems, Git repositories, Kubernetes clusters, and IaC configurations for security issues. Detects OS package and language-specific vulnerabilities, misconfigurations, secrets, and license violations in a single tool. Runs as a simple CLI with zero configuration needed. Supports SBOM generation, VEX for vulnerability filtering, and CI/CD integration.

Rate

Website

Is this your product? →

About Trivy

Trivy is a comprehensive open-source security scanner by Aqua Security that has become the de facto standard for container and infrastructure security scanning. With over 24,000 GitHub stars, it covers the broadest range of scanning targets in a single tool.

Trivy scans container images, file systems, Git repositories, Kubernetes clusters, and virtual machine images for known vulnerabilities in OS packages and language-specific dependencies. It also detects IaC misconfigurations in Terraform, CloudFormation, Kubernetes manifests, and Dockerfiles.

Additional capabilities include secrets detection for finding leaked credentials, license scanning for compliance, and SBOM generation in CycloneDX and SPDX formats. VEX support allows filtering out vulnerabilities that are not applicable to your specific deployment.

The tool runs as a standalone CLI with zero configuration needed — just point it at a target and get results. It integrates with CI/CD pipelines through GitHub Actions, GitLab CI, Jenkins, and other platforms. Enterprise features are available through Aqua Security's commercial platform.

Pricing & Platform Specs

Pricing Summary

Trivy is a 100% free and open-source comprehensive security and vulnerability scanner under the Apache-2.0 license ($0). It offers unlimited scanning across containers, Kubernetes, IaC, and source code repositories with zero licensing fees. Aqua Security provides commercial enterprise platforms for runtime eBPF protection and CSPM via custom quote.

full pricing breakdown →

Supported Platforms

CLI, Docker, GitHub Actions, CI/CD

Explore categories, tags & use cases

Use Cases

Security Auditing Self-Hosted Deployment

Alternatives

All Trivy alternatives →

Steel

Open-source browser infrastructure for AI agents at scale

Steel is an open-source browser API purpose-built for AI agents, providing managed headless browser sessions with anti-bot bypass, proxy rotation, CAPTCHA solving, and session persistence. It handles the infrastructure layer that browser automation agents like Browser Use and Stagehand run on top of. Self-hostable or available as a cloud service. Over 6,000 GitHub stars.

freemiumOpen Source

Trigger.dev

Open-source background jobs and AI workflows for TypeScript

Trigger.dev is an open-source platform for building and deploying background jobs, AI agents, and long-running workflows in TypeScript. It eliminates serverless timeouts with durable task execution, automatic retries, queue-based concurrency control, and elastic scaling. Used by 30,000+ developers at companies like MagicSchool and Icon.com, it processes hundreds of millions of agent runs monthly. Backed by a $16M Series A led by Dalton Caldwell's Standard Capital fund.

freemiumOpen Source

Dokploy

Open-source PaaS alternative to Vercel, Heroku, and Netlify

Dokploy is a free open-source platform-as-a-service for self-hosting applications without cloud vendor lock-in. It provides automated deployments from Git repositories, built-in SSL certificates, database provisioning, Docker and Docker Compose support, and a clean web dashboard for managing multiple applications on your own servers. With 18,000+ GitHub stars, it fills the gap for teams wanting Vercel-like deployment simplicity on their own infrastructure.

freemiumOpen Source

Discover more tools in this category

Related Tools

computed discovery: shared active categories

OpenLIT

OpenTelemetry-native observability for LLM applications with evals and GPU monitoring

OpenLIT is an open-source AI engineering platform that provides OpenTelemetry-native observability for LLM applications. It combines distributed tracing, evaluation, prompt management, a secrets vault, and GPU telemetry in a single self-hostable stack. With 50+ integrations across LLM providers and frameworks, it lets teams monitor AI applications using their existing observability backends like Grafana, Datadog, or Jaeger.

Open Source

Cilium

eBPF-based networking, security, and observability for Kubernetes

Cilium is a CNCF Graduated, Apache-2.0 project for Kubernetes networking, security, and observability using eBPF. It can replace kube-proxy, enforce identity-aware L3-L7 network policies, and add Hubble flow observability plus Tetragon runtime-security signals. Current source checks support GKE Dataplane V2 using Cilium/eBPF and Azure CNI Powered by Cilium for AKS.

Open Source

OrbStack

Fast and lightweight Docker Desktop alternative for macOS

OrbStack is a macOS application that replaces Docker Desktop with lightweight container and Linux VM management. Its docs emphasize fast starts, lower CPU and memory overhead, and native macOS integration with menu bar controls, file sharing, and network access to containers by name, with exact gains depending on workload. Supports Docker, Kubernetes, and full Linux VMs.

freemium

Ray

Distributed AI compute engine for scaling Python and ML workloads

Ray is an open-source distributed computing framework built for scaling AI and Python applications from a laptop to thousands of GPUs. It provides libraries for distributed training, hyperparameter tuning, model serving, reinforcement learning, and data processing under a single unified API. Ray's public site highlights OpenAI and other enterprise users. Maintained by Anyscale with Apache-2.0 open-source licensing.

freemiumOpen Source

Act

Run GitHub Actions locally for fast feedback

Act is an open-source tool that runs GitHub Actions workflows locally using Docker containers that match GitHub's execution environment. It provides instant feedback on workflow changes without pushing to a repository, supports matrix builds, secret management, and artifact handling. Act can also replace Makefiles by using workflow files as task definitions, making it useful for both CI/CD development and local task automation across development teams.

Open Source

Clerk

Drop-in authentication for modern JavaScript apps

Clerk is a complete authentication and user management platform for React, Next.js, and modern JavaScript frameworks. It provides pre-built UI for sign-in, sign-up, user profiles, organizations, MFA, passkeys, JWT sessions, webhooks, and billing. The Hobby plan supports up to 50,000 monthly retained users per app, with Pro, Business, and Enterprise tiers for growing teams.

freemium

Side-by-Side Comparisons

AccuKnox

Trivy

Falco

AccuKnox vs Trivy vs Falco — Kubernetes Security Tools for Runtime Protection & Vulnerability Scanning

Kubernetes security requires multiple layers of defense, from image scanning to runtime threat detection. This comparison examines three leading tools that address different aspects of the Kubernetes security stack: AccuKnox as a comprehensive Zero Trust CNAPP platform with eBPF-powered runtime enforcement, Trivy as a versatile open-source vulnerability scanner for containers and infrastructure, and Falco as the CNCF graduated standard for kernel-level runtime threat detection.

AccuKnoxTrivyFalco

Community experience

Sources & verification

Trivy Official Documentation & Repository

Sources checked: September 5, 2026
Content verified: September 6, 2026

Verification dates are editorial checks. Routine CMS saves and automatic updatedAt timestamps do not advance them.

FAQ

What is Trivy?

Is Trivy free?

Yes — Trivy is open source and free to use. Trivy is a 100% free and open-source comprehensive security and vulnerability scanner under the Apache-2.0 license ($0). It offers unlimited scanning across containers, Kubernetes, IaC, and source code repositories with zero licensing fees. Aqua Security provides commercial enterprise platforms for runtime eBPF protection and CSPM via custom quote.

Is Trivy open source?

Yes — Trivy is open source.

Is Trivy still maintained?

Yes — Trivy is active. Its listing was last verified on September 6, 2026.

What are the best Trivy alternatives?

The first editor-selected Trivy alternatives are Steel, Trigger.dev, Dokploy.

Trivy

About Trivy

Pricing & Platform Specs

Pricing Summary

Supported Platforms

Categories

Tags

Use Cases

Alternatives

Steel

Trigger.dev