container-security
Installation
SKILL.md
Image Scanning
Run Trivy before every push. Fail CI on HIGH or CRITICAL vulnerabilities.
trivy image myapp:latest --severity HIGH,CRITICAL --exit-code 1
Use Grype as a second scanner. Different scanners catch different CVEs.
grype myapp:latest --fail-on high
Store scan results as build artifacts for trending.
trivy image myapp:latest --format json --output scan-results.json