Lion Cipher Lab
Scan container images and IaC for flaws with Trivy
- Cloud Security
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Almost nothing you deploy to a cloud today is something you wrote from scratch. You start `FROM` a base image somebody else built, you pull in dozens of open-source libraries, and you describe the infrastructure in a Terraform or CloudFormation file. Every one of those is a place a flaw can hide that is not your code and not your fault — a years-old CVE in a base image's OpenSSL, a Dockerfile that runs your app as root, a security group left open to the whole internet, an API key a colleague pasted into a config 'just for testing'. You cannot fix what you cannot see, and by the time a flaw is…
What you'll learn
- defining a CVE, a CVSS score and its severity bands, and telling a vulnerability apart from a misconfiguration and from a leaked secret — in plain language
- running one tool, Trivy, against three different targets: a container image, an IaC directory, and a source folder
- reading a `trivy image` report column by column — especially what the FIXED VERSION column means, and what an empty one is telling you
- catching Dockerfile and Terraform misconfigurations with `trivy config` (running as root, an open security group) before they ship
- finding hardcoded secrets in a folder with `trivy fs --scanners secret`
- gating a build on severity with `--severity HIGH,CRITICAL` and `--exit-code 1`, the way a real CI pipeline does
- running the MEASURED fix loop: bump the base image, add a USER, tighten the Terraform, re-scan, and prove the CRITICAL count dropped
- judgment: separating real risk from scanner noise, deciding accept/mitigate/replace for a CVE with no fix available, and knowing why 'make the number zero' is the wrong goal
Steps in this lab
- Three kinds of flaw, and the one word that ties them together: 'shift left'
- One tool, three scan targets — and how offline actually works
- Install Trivy — Docker is the zero-friction path
- Scan the old image, and read the report column by column
- Focus and gate: --severity, --ignore-unfixed, and --exit-code
- Scan your IaC for misconfigurations with trivy config
- Scan the folder for hardcoded secrets
- The measured fix loop — bump, harden, re-scan, watch the number fall
- The CVEs you cannot fix — an empty FIXED VERSION, and how a pro triages
- Do it better — the habits, and what 'done' really means