Trivy

Judgement

What it is

Developer tool

What it does

Scans container images, filesystems, git repositories, VM images and Kubernetes clusters for known vulnerabilities, misconfigurations, exposed secrets and licenses, and can produce an SBOM.

Adopt it when

You want one free scanner in CI that covers container images, dependencies and infrastructure code instead of several separate tools.

Watch out

Vulnerability results depend on databases it downloads at scan time, so air-gapped or rate-limited CI needs a mirrored database.

Ready for

Production-ready

Runs as

Command line and self-hosted server

Built with

Go

How established

Established: started 7 years ago, latest release v0.76.2.

What the license allows

You can build it into a product you sell, as long as you keep its copyright notice.

Judged on 2026-11-06 from the project's README and GitHub data. The license and age lines are worked out directly.

Built from

Follow it down: Trivy → Go → runs on a microchip

How compilers were built, back to punched paper tape

Open-source alternatives to Trivy

1. 1
   Terraform hashicorp

   Terraform enables you to safely and predictably create, change, and improve infrastructure. It is a source-available tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned.

   Developer tool Production-ready Your team provisions infrastructure across one or more cloud providers and wants it reviewed and versioned as code with the largest provider ecosystem available.

   ★ 50k See repository Go Active, pushed today
   
2. 2
   OpenTofu opentofu

   OpenTofu lets you declaratively manage your cloud infrastructure.

   Developer tool Production-ready You want Terraform-style infrastructure management under an open-source licence, without HashiCorp's Business Source Licence.

   ★ 31k MPL-2.0 Go Active, pushed today
   
3. 3
   Kestra kestra-io

   Orchestrate everything, everywhere. The open-source control plane for workflows across data, infrastructure, business processes and AI agents. Declarative YAML, event-driven, any language, Git-versioned, scalable to millions of executions.

   Complete system Production-ready You need Airflow-class orchestration but want YAML flows, any language, and a UI non-Python people can use.

   ★ 30k Apache-2.0 Java Active, pushed today
4. 4
   Pulumi pulumi

   Pulumi - Infrastructure as Code in any programming language 🚀

   Developer tool Production-ready Your engineers would rather write infrastructure in a general-purpose language with loops, functions and tests than learn HCL.

   ★ 26k Apache-2.0 Go Active, pushed today
5. 5
   Salt saltstack

   Software to automate the management and configuration of infrastructure and applications at scale.

   Developer tool Production-ready You manage a large fleet of servers and need fast remote execution plus configuration management with an agent on each machine.

   ★ 16k Apache-2.0 Python Active, pushed today
6. 6
   AWS CDK aws

   The AWS Cloud Development Kit is a framework for defining cloud infrastructure in code

   Framework or platform Production-ready Everything you run is on AWS and you want typed, reusable infrastructure code that stays inside CloudFormation's deployment model.

   ★ 13k Apache-2.0 TypeScript Active, pushed today
7. 7
   Encore encoredev

   Infrastructure orchestration from local to your cloud

   Framework or platform Usable You are starting a new backend and want infrastructure derived from application code instead of writing Terraform yourself.

   ★ 13k MPL-2.0 Go Active, pushed 2 days ago
8. 8
   Infracost infracost

   Cloud cost intelligence for engineers, AI coding agents, and CI/CD 💰📉 Shift FinOps Left!

   Developer tool Production-ready Engineers change cloud infrastructure through pull requests and you want each change to show what it will cost before it merges.

   ★ 13k Apache-2.0 Go Active, pushed 2 days ago