kubernetes Absence of a Report Is Not Evidence of a Clean Image Trivy Operator reports over ~1.5 MiB fail to write, silently. Your largest images — often your riskiest — show zero findings. Here is how to detect it and the trade-offs in fixing it.
trivy Nine Compliance Specs Hidden in the Binary Trivy 0.73.0 ships nine compliance specs compiled into the binary — CIS for AWS, Docker, EKS, Kubernetes and RKE2, plus NSA and both Pod Security Standards profiles. Nothing in the help output tells you their names.
trivy Exit Codes Are the Cheapest Gate You Will Ship One flag decides whether a Trivy scan blocks a pipeline. On the same image, --severity CRITICAL exits 0 and HIGH,CRITICAL --ignore-unfixed exits 1 — and the gate that actually fires is the one that costs 115 milliseconds.
