container.imageContainer image scan
Scans an image (image:<ref>) for vulnerable packages and secrets with Trivy, and checks its config (user, ports, env secrets, age, size); falls back to `docker image inspect` without Trivy.
- Engine
- Wrapped scanner
- Wraps
trivy- Targets
- Container
- Areas
- Security, Supply chain
- Runs
- By default, when the target applies
- Network
- Only the target itself
Run only this auditor
bunx openaudit image:nginx:1.27 --only container.imageWraps trivy. When it isn't installed, the auditor is skipped with an install hint and the rest of the audit runs.