Vulnerability Scanner

theo provides an audit subcommand to resolve all container images used by the localenv deployment (including direct docker-compose.yml service images, Dockerfile FROM base images, and multi-stage COPY --from images) and optionally scan them for known vulnerabilities (CVEs) using Trivy.

List all container images

To inspect the resolved container images without running a vulnerability scan:

# Human-readable table output
cargo theo testenv audit

# Markdown table output
cargo theo testenv audit --format markdown

# Machine-readable JSON output
cargo theo testenv audit --format json

Scan container images with Trivy

To scan all unique images referenced by localenv using the official aquasec/trivy container image:

cargo theo testenv audit --scan

By default, this command:

• Mounts a persistent trivy-cache Docker volume (at /root/.cache/) so the vulnerability and Java index databases are cached across runs.
• Writes timestamped per-image Trivy JSON reports (<YYYYMMDD-HHMMSS>_<image>.json), a JSON summary (<YYYYMMDD-HHMMSS>_audit-summary.json), and a Markdown summary table (<YYYYMMDD-HHMMSS>_audit-summary.md) to target/ci/trivy/.
• Prints both a terminal summary table and a Markdown table with CRITICAL and HIGH (plus fixable) vulnerability counts for each image.

Common options

• Reuse cached Trivy databases (faster subsequent scans without re-downloading the vulnerability and Java databases):

  cargo theo testenv audit --scan --skip-db-update
  

• Filter by severity (defaults to CRITICAL,HIGH):

  cargo theo testenv audit --scan --severity CRITICAL,HIGH,MEDIUM
  

• Specify a custom output directory for the JSON reports:

  cargo theo testenv audit --scan --output-dir target/doc/trivy-reports