Jan 17
Loading video player...
Join this channel to get access to perks: https://www.youtube.com/channel/UCUCFRmx2K3dTdJiUjvS1scA/join #theshubhamgour Welcome to the Trivy One-Shot Masterclass 🎯 In this complete end-to-end tutorial, you’ll learn everything you need to know about security scanning using Trivy — from fundamentals to real-world DevSecOps workflows. This video is designed to help DevOps & DevSecOps engineers understand where vulnerabilities originate, how to detect them early, and how to integrate Trivy into daily workflows. ⏱️ Timestamps / Chapters 00:00 – Introduction: Why security issues start early (Shift-Left Security) 00:06 – Why production is not the first place vulnerabilities appear 00:24 – What is Trivy 00:44 – Trivy overview: Images, repos, filesystem, secrets & SBOM 01:10 – Why DevSecOps needs Trivy 02:57 – Problems with traditional security approaches 03:00 – Trivy architecture overview 03:31 – How Trivy generates SBOM 03:48 – Security challenges with microservices 04:03 – Faster, automated security with Trivy 05:06 – End of architecture basics 06:30 – Installing Trivy (Overview) 07:41 – Install Trivy on Linux (Ubuntu) 10:19 – Installation completed 10:20 – Scanning Docker images – introduction 11:20 – Trivy installation on macOS (Homebrew) 12:41 – Windows installation options (Choco / Binary) 14:47 – Scan ubuntu:latest image 15:15 – Understanding vulnerability output 16:14 – CVE ID, severity, installed & fixed version 20:12 – Image scanning summary 20:16 – Deep dive: Trivy scan types 23:59 – Artifact Analyzer explained 27:09 – OS-level & package-level scanning 27:11 – Trivy vulnerability database 28:18 – CVE severity & fixed versions 28:21 – Data sources (NVD, vendors, GitHub advisories) 30:47 – Language ecosystems (npm, pip, Go, Ruby) 30:57 – CVSS severity levels explained 32:00 – Low → Critical severity range 33:09 – Matching engine explained 35:00 – CVSS scoring factors 36:31 – Vulnerability data optimization 36:40 – Secret scanning with Trivy 36:38 – Supported secret sources 38:29 – Real Docker image scan demo 39:50 – Scan python:3.10-slim image 40:41 – Analyzing scan results 43:55 – Understanding critical vulnerabilities 44:28 – Image scan summary 44:50 – Handling false positives 52:19 – False positive best practices 52:20 – Scanning Git repositories (trivy repo) 59:29 – Git repo scanning summary 59:30 – What is SBOM 01:09:09 – CycloneDX vs SPDX 01:09:10 – Automating Trivy with shell scripts 01:18:39 – Automation wrap-up 01:18:40 – Trivy Server mode (Enterprise concept) 01:30:19 – When to use server mode 01:30:20 – Real-world DevSecOps best practices 01:37:59 – Final thoughts & conclusion 📂 Resources 📌 GitHub Repository 👉 https://github.com/theshubhamgour/trivy-tutorial.git 📌 PPT Slides 👉https://drive.google.com/file/d/1PN_IXnveUYOs_6Au4Wd_V1sfXdn90zWX/view?usp=sharing 🎥 Watch all trivy episodes here : https://www.youtube.com/playlist?list=PLBr8obKbpkYsGrdKwFXqRTYcvv1KELCLn 🎥 Watch all Jenkins episodes here: https://www.youtube.com/playlist?list=PLBr8obKbpkYuGg5JDHaL26_DiHC9hdQJv #Trivy #DevSecOps #DockerSecurity #ContainerSecurity #SecurityScanning #CICDSecurity #CloudSecurity #SBOM #ShiftLeftSecurity For all updates: Let's Connect on LinkedIn: https://www.linkedin.com/in/theshubhamgour Follow me instagram: https://www.instagram.com/theshubhamgour Follow me Twitter: https://www.twitter.com/theshubhamgour