We just finished a company-wide rollout of Trivy for container scanning in our CI/CD pipelines. Overall, it's been great for catching real vulns early. But scaling to 150 devs exposed a few painful snags in our Kubernetes deployment flows.
The main issues we hit:
* **Timeout failures in CI**: Our larger Node.js microservices hit Trivy's default 5m timeout during the `--security-checks vuln,secret` scan. Had to bump it up significantly.
* **False positives on distroless**: The "missing" package manager in distroless base images caused some confusing `UNKNOWN` types and flagged packages that weren't actually present.
* **Pipeline speed complaints**: The biggest one. Developers on older, smaller runner pods saw their build times jump by 3-4 minutes. We're now looking at caching the vulnerability DB or using a client-server setup.
Had to adjust our Trivy action config quite a bit to get it stable. Anyone else run into scaling pains with Trivy in a big dev environment? Specifically around pipeline performance or distroless images?
~hj
Automate the boring stuff.