Skip to content

Commit a4e981b

Browse files
knqyf263DmitriyLewen
knqyf263
and
DmitriyLewen
authored
docs: add coverage (#4954)
* docs: add coverage * add more pages * add dart, dotnet, elixir languages. * add C, ruby, cocoapods. Update links * rename headers for dart and elixir * docs: add Google Distroless and Photon OS * docs: add IaC * docs: put vulnerability into a single page * fixed broken links * docs: add coverage overview * update some links * add note about arch for Rocky linux * docs: fix typo * fix typo * docs: add footnotes * docs: add a link to coverage in the license section * docs: add a conversion table * docs: get aligned --------- Co-authored-by: DmitriyLewen <[email protected]>
1 parent 6f03c79 commit a4e981b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+1736
-495
lines changed

‎docs/docs/advanced/air-gap.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,4 +139,4 @@ $ trivy conf --skip-policy-update /path/to/conf
139139
[allowlist]: ../references/troubleshooting.md
140140
[oras]: https://oras.land/cli/
141141

142-
[^1]: This is only required to scan `jar` files. More information about `Java index db` [here](../scanner/vulnerability/language/java.md)
142+
[^1]: This is only required to scan `jar` files. More information about `Java index db` [here](../coverage/language/java.md)

‎docs/docs/configuration/db.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
| License | |
99

1010
The vulnerability database and the Java index database are needed only for vulnerability scanning.
11-
See [here](../scanner/vulnerability/index.md) for the detail.
11+
See [here](../scanner/vulnerability.md) for the detail.
1212

1313
## Vulnerability Database
1414

‎docs/docs/coverage/iac/azure-arm.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Azure ARM Template
2+
Trivy supports the scanners listed in the table below.
3+
4+
| Scanner | Supported |
5+
| :----------------: | :-------: |
6+
| [Misconfiguration] | ✓ |
7+
| [Secret] | ✓ |
8+
9+
It supports the following configurations:
10+
11+
| Format | Supported |
12+
| :----------: | :-------: |
13+
| ARM template | ✓ |
14+
| Bicep | ✓[^1] |
15+
16+
To scan Bicep codes, you need to convert them into ARM templates first.
17+
18+
```
19+
az bicep build -f main.bicep
20+
or
21+
bicep build main.bicep
22+
```
23+
24+
## Misconfiguration
25+
Trivy recursively searches directories and scans all found Azure ARM templates.
26+
27+
## Secret
28+
The secret scan is performed on plain text files, with no special treatment for Azure ARM templates.
29+
30+
[Misconfiguration]: ../../scanner/misconfiguration/index.md
31+
[Secret]: ../../scanner/secret.md
32+
33+
[^1]: Bicep is not natively supported. It needs to be converted into Azure ARM templates.

‎docs/docs/coverage/iac/cloudformation.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# CloudFormation
2+
Trivy supports the scanners listed in the table below.
3+
4+
| Scanner | Supported |
5+
| :----------------: | :-------: |
6+
| [Misconfiguration] | ✓ |
7+
| [Secret] | ✓ |
8+
9+
It supports the following formats.
10+
11+
| Format | Supported |
12+
| :----: | :-------: |
13+
| JSON | ✓ |
14+
| YAML | ✓ |
15+
16+
## Misconfiguration
17+
Trivy recursively searches directories and scans all found CloudFormation files.
18+
It evaluates properties, functions, and other elements within CloudFormation files to detect misconfigurations.
19+
20+
## Secret
21+
The secret scan is performed on plain text files, with no special treatment for CloudFormation.
22+
23+
[Misconfiguration]: ../../scanner/misconfiguration/index.md
24+
[Secret]: ../../scanner/secret.md

‎docs/docs/coverage/iac/docker.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Docker
2+
Trivy supports the scanners listed in the table below.
3+
4+
| Scanner | Supported |
5+
| :----------------: | :-------: |
6+
| [Misconfiguration] | ✓ |
7+
| [Secret] | ✓ |
8+
9+
It supports the following configurations.
10+
11+
| Config | Supported |
12+
| :-----------: | :-------: |
13+
| Dockerfile | ✓ |
14+
| Containerfile | ✓ |
15+
| Compose | - |
16+
17+
## Misconfiguration
18+
Trivy recursively searches directories and scans all found Docker files.
19+
20+
## Secret
21+
The secret scan is performed on plain text files, with no special treatment for Dockerfile.
22+
23+
[Misconfiguration]: ../../scanner/misconfiguration/index.md
24+
[Secret]: ../../scanner/secret.md

‎docs/docs/coverage/iac/helm.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# Helm
2+
Trivy supports two types of Helm scanning, templates and packaged charts.
3+
The following scanners are supported.
4+
5+
| Format | [Misconfiguration] | [Secret] |
6+
| -------- | :----------------: | :------: |
7+
| Template | ✓ | ✓ |
8+
| Chart | ✓ | - |
9+
10+
## Misconfiguration
11+
Trivy recursively searches directories and scans all found Helm files.
12+
13+
It evaluates variables, functions, and other elements within Helm templates and resolve the chart to Kubernetes manifests then run the Kubernetes checks.
14+
See [here](../../scanner/misconfiguration/policy/builtin.md) for more details on the built-in policies.
15+
16+
### Value overrides
17+
There are a number of options for overriding values in Helm charts.
18+
When override values are passed to the Helm scanner, the values will be used during the Manifest rendering process and will become part of the scanned artifact.
19+
20+
#### Setting inline value overrides
21+
Overrides can be set inline on the command line
22+
23+
```bash
24+
trivy conf --helm-set securityContext.runAsUser=0 ./charts/mySql
25+
```
26+
27+
#### Setting value file overrides
28+
Overrides can be in a file that has the key=value set.
29+
30+
```yaml
31+
# Example override file (overrides.yaml)
32+
33+
securityContext:
34+
runAsUser: 0
35+
```
36+
37+
```bash
38+
trivy conf --helm-values overrides.yaml ./charts/mySql
39+
```
40+
41+
#### Setting value as explicit string
42+
the `--helm-set-string` is the same as `--helm-set` but explicitly retains the value as a string
43+
44+
```bash
45+
trivy config --helm-set-string name=false ./infrastructure/tf
46+
```
47+
48+
#### Setting specific values from files
49+
Specific override values can come from specific files
50+
51+
```bash
52+
trivy conf --helm-set-file environment=dev.values.yaml ./charts/mySql
53+
```
54+
55+
## Secret
56+
The secret scan is performed on plain text files, with no special treatment for Helm.
57+
Secret scanning is not conducted on the contents of packaged Charts, such as tar or tar.gz.
58+
59+
[Misconfiguration]: ../../scanner/misconfiguration/index.md
60+
[Secret]: ../../scanner/secret.md

‎docs/docs/coverage/iac/index.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Infrastructure as Code
2+
3+
## Scanner
4+
Trivy scans Infrastructure as Code (IaC) files for
5+
6+
- [Misconfigurations][misconf]
7+
- [Secrets][secret]
8+
9+
## Supported configurations
10+
11+
| Config type | File patterns |
12+
| ----------------------------------- | ----------------------------- |
13+
| [Kubernetes](kubernetes.md) | *.yml, *.yaml, *.json |
14+
| [Docker](docker.md) | Dockerfile, Containerfile |
15+
| [Terraform](terraform.md) | *.tf, *.tf.json, *.tfvars, |
16+
| [CloudFormation](cloudformation.md) | *.yml, *.yaml, *.json |
17+
| [Azure ARM Template](azure-arm.md) | *.json |
18+
| [Helm](helm.md) | *.yaml, *.tpl, *.tar.gz, etc. |
19+
20+
[misconf]: ../../scanner/misconfiguration/index.md
21+
[secret]: ../../scanner/secret.md

‎docs/docs/coverage/iac/kubernetes.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Kubernetes
2+
Trivy supports the scanners listed in the table below.
3+
4+
| Scanner | Supported |
5+
| :----------------: | :-------: |
6+
| [Misconfiguration] | ✓ |
7+
| [Secret] | ✓ |
8+
9+
In addition to raw YAML and JSON, it supports the following templates:
10+
11+
| Template | Supported |
12+
| :-------------: | :-------: |
13+
| [Helm](helm.md) | ✓ |
14+
| Kustomize | ✓[^1] |
15+
16+
!!! note
17+
Trivy does not support Kustomize overlays, so it scans files defined in the base.
18+
Or, you can scan the output of `kustomize build`.
19+
20+
## Misconfiguration
21+
Trivy recursively searches directories and scans all found Kubernetes files.
22+
23+
## Secret
24+
The secret scan is performed on plain text files, with no special treatment for Kubernetes.
25+
This means that Base64 encoded secrets are not scanned, and only secrets written in plain text are detected.
26+
27+
28+
[Misconfiguration]: ../../scanner/misconfiguration/index.md
29+
[Secret]: ../../scanner/secret.md
30+
31+
[^1]: Kustomize is not natively supported.

‎docs/docs/coverage/iac/terraform.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Terraform
2+
Trivy supports the scanners listed in the table below.
3+
4+
| Scanner | Supported |
5+
| :--------------: | :-------: |
6+
| Misconfiguration | ✓ |
7+
| Secret | ✓ |
8+
9+
It supports the following formats:
10+
11+
| Format | Supported |
12+
| :-------: | :-------: |
13+
| JSON | ✓ |
14+
| HCL | ✓ |
15+
| Plan JSON | ✓ |
16+
17+
Trivy can scan the results of `terraform plan`.
18+
You can scan by passing the file generated as shown below to Trivy:
19+
20+
```
21+
$ terraform plan --out tfplan.binary
22+
$ terraform show -json tfplan.binary > tfplan.json
23+
```
24+
25+
## Misconfiguration
26+
Trivy recursively searches directories and scans all found Terraform files.
27+
It also evaluates variables, imports, and other elements within Terraform files to detect misconfigurations.
28+
29+
### Value Overrides
30+
You can provide `tf-vars` files to Trivy to override default values specified in the Terraform HCL code.
31+
32+
```bash
33+
trivy conf --tf-vars dev.terraform.tfvars ./infrastructure/tf
34+
```
35+
36+
### Exclude Downloaded Terraform Modules
37+
By default, downloaded modules are also scanned.
38+
If you don't want to scan modules downloaded into the `.terraform` directory, you can use the `--tf-exclude-downloaded-modules` flag.
39+
40+
```bash
41+
trivy conf --tf-exclude-downloaded-modules ./configs
42+
```
43+
44+
## Secret
45+
The secret scan is performed on plain text files, with no special treatment for Terraform.

‎docs/docs/coverage/index.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Scanning Coverage
2+
Trivy can detect security issues in many different platforms, languages and configuration files.
3+
This section gives a general overview of that coverage, and can help answer the frequently asked question "Does Trivy support X?".
4+
For more detailed information about the specific platforms and languages, check the relevant documentation.
5+
6+
- [OS Packages](os/index.md)
7+
- [Language-specific Packages](language/index.md)
8+
- [IaC files](iac/index.md)

0 commit comments

Comments
 (0)