{"id":48735,"date":"2025-03-12T06:50:50","date_gmt":"2025-03-12T06:50:50","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=48735"},"modified":"2025-03-12T06:50:50","modified_gmt":"2025-03-12T06:50:50","slug":"trivy-list-of-methods-to-ignore-directories-files-during-scanning","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/trivy-list-of-methods-to-ignore-directories-files-during-scanning\/","title":{"rendered":"Trivy: List of Methods to Ignore Directories & Files During Scanning"},"content":{"rendered":"\n

<\/p>\n\n\n\n

Trivy provides multiple ways to ignore directories, files, and vulnerabilities<\/strong> during scanning. This guide covers all correct and updated<\/strong> methods, including command-line options, configuration files, and post-processing techniques<\/strong>.<\/p>\n\n\n\n

\n\n\n\n

1\ufe0f\u20e3 Ignore Directories & Files Using Command-Line Options (Recommended for Quick Exclusions)<\/strong><\/h2>\n\n\n\n

Trivy supports --skip-dirs<\/code> and --skip-files<\/code> flags to exclude directories and files<\/strong> while scanning.<\/p>\n\n\n\n

Examples:<\/strong><\/h3>\n\n\n\n

\u2705 Ignore specific directories<\/strong><\/p>\n\n\n

trivy image --skip-dirs \"\/var\/lib\/gems\/2.5.0\/gems\/fluent-plugin-detect-exceptions-0.0.13\"<\/span> \\\n            --skip-dirs \"\/var\/lib\/gems\/2.5.0\/gems\/http_parser.rb-0.6.0\"<\/span> \\\n            quay.io\/fluentd_elasticsearch\/fluentd:v2.9<\/span>.0<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\u2705 Ignore directories when scanning a local filesystem<\/strong><\/p>\n\n\n
trivy fs --skip-dirs \".\/testdata\/*\"<\/span> .\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\u2705 Ignore Terraform-related files and directories<\/strong><\/p>\n\n\n
trivy config --skip-dirs \"**\/.terraform\"<\/span> .\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\u2705 Ignore specific files during image scanning<\/strong><\/p>\n\n\n
trivy image --skip-files \"\/Gemfile.lock\"<\/span> --skip-files \"\/var\/lib\/gems\/2.5.0\/gems\/http_parser.rb-0.6.0\/Gemfile.lock\"<\/span> quay.io\/fluentd_elasticsearch\/fluentd:v2.9<\/span>.0<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\u2705 Ignore all foo<\/code> directories in any subdirectory<\/strong><\/p>\n\n\n
trivy image --skip-files \"**\/foo\"<\/span> image:tag\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\u2705 Use --file-patterns<\/code> to ignore files based on type<\/strong><\/p>\n\n\n
trivy<\/span> fs<\/span> --file-patterns<\/span> \"dockerfile<\/span>:.<\/span>*.docker<\/span>\" --file-patterns<\/span> \"kubernetes<\/span>:*.tpl<\/span>\" --file-patterns<\/span> \"pip<\/span>:requirements-.<\/span>*\\.txt<\/span>\" .\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
\ud83d\udccc Use Case:<\/strong> Best when you want to exclude files or directories temporarily<\/strong> without modifying any configuration files.<\/p>\n\n\n\n
\n\n\n\n
2\ufe0f\u20e3 Use trivy.yaml<\/code> Configuration File for Persistent Directory\/File Skipping<\/strong><\/h2>\n\n\n\n
For a permanent<\/strong> solution, create a trivy.yaml<\/code> file in the root of your project.<\/p>\n\n\n\n
Example trivy.yaml<\/code><\/strong><\/h3>\n\n\n
scan:\n  skip-dirs:\n    - \"**\/examples\/**\"<\/span>\n    - \"**\/.terraform\/**\"<\/span>\n    - \"node_modules\"<\/span>\n    - \"vendor\"<\/span>\n  skip-files:\n    - \"**\/*.log\"<\/span>\n    - \"**\/Gemfile.lock\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\u2705 Run Trivy with the configuration file<\/strong>:<\/p>\n\n\n
trivy<\/span> fs<\/span> --config<\/span> trivy<\/span>.yaml<\/span> .\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
\ud83d\udccc Use Case:<\/strong> Best for consistent exclusions<\/strong> across multiple runs without needing CLI options.<\/p>\n\n\n\n
\n\n\n\n
3\ufe0f\u20e3 Ignore Specific Vulnerabilities Using .trivyignore<\/code><\/strong><\/h2>\n\n\n\n
You can ignore specific vulnerabilities<\/strong> by their IDs using a .trivyignore<\/code> file.<\/p>\n\n\n\n
Example .trivyignore<\/code><\/strong><\/h3>\n\n\n
AVD-KSV-0014\nCVE-2023-1234\n<\/code><\/span><\/pre>\n\n\n
\u2705 Run Trivy and apply .trivyignore<\/code><\/strong>:<\/p>\n\n\n
trivy<\/span> fs<\/span> --ignorefile<\/span> .trivyignore<\/span> .\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
\ud83d\udccc Use Case:<\/strong> When you want to exclude false positives<\/strong> or known vulnerabilities without ignoring entire files or directories<\/strong>.<\/p>\n\n\n\n
\n\n\n\n
4\ufe0f\u20e3 Use find<\/code> to Dynamically Exclude Directories Before Running Trivy<\/strong><\/h2>\n\n\n\n
If you don’t want to modify your Trivy configurations, you can manually exclude directories before scanning<\/strong>.<\/p>\n\n\n\n
\u2705 Find and exclude examples<\/code> and node_modules<\/code> directories<\/strong><\/p>\n\n\n
find . -type d \\( -name \"examples\"<\/span> -o -name \"node_modules\"<\/span> \\) -prune -o -print<\/span> | trivy fs .\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\ud83d\udccc Use Case:<\/strong> When you cannot modify project files<\/strong> but need to exclude directories.<\/p>\n\n\n\n
\n\n\n\n
5\ufe0f\u20e3 Use grep -v<\/code> to Filter Out Results After Scanning<\/strong><\/h2>\n\n\n\n
If Trivy scans everything but you want to remove unwanted results from the output:<\/p>\n\n\n\n
\u2705 Remove results from examples\/<\/code> directories<\/strong><\/p>\n\n\n
trivy fs . | grep -v \"examples\/\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\ud83d\udccc Use Case:<\/strong> Quick fix<\/strong> when Trivy outputs unwanted directories but scanning time is not a concern.<\/p>\n\n\n\n
\n\n\n\n
Final Comparison: Best Method to Use<\/strong><\/h2>\n\n\n\n
Method<\/strong><\/th>Best For<\/strong><\/th>Permanent?<\/strong><\/th>Performance Impact?<\/strong><\/th><\/tr><\/thead>
--skip-dirs<\/code> \/ --skip-files<\/code><\/td>Quick exclusions<\/td>\u274c No<\/td>\u2705 Improves<\/td><\/tr>
trivy.yaml<\/code> (skip-dirs<\/code>, skip-files<\/code>)<\/td>Persistent exclusions<\/td>\u2705 Yes<\/td>\u2705 Improves<\/td><\/tr>
.trivyignore<\/code> (Ignore CVEs)<\/td>Ignoring vulnerabilities<\/td>\u2705 Yes<\/td>\u26a0\ufe0f No impact<\/td><\/tr>
find -prune<\/code><\/td>Excluding before scanning<\/td>\u274c No<\/td>\u2705 Improves<\/td><\/tr>
grep -v<\/code><\/td>Filtering after scanning<\/td>\u274c No<\/td>\u26a0\ufe0f No impact<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n
Conclusion<\/strong><\/h2>\n\n\n\n
\ud83d\ude80 Best method<\/strong> \u2192 Use --skip-dirs<\/code> and --skip-files<\/code> in the CLI for quick fixes.
\u26a1 For permanent exclusions<\/strong> \u2192 Use trivy.yaml<\/code>.
\ud83d\udd0e To ignore vulnerabilities only<\/strong> \u2192 Use .trivyignore<\/code>.
\u23f3 If you can’t modify configurations<\/strong> \u2192 Use find<\/code> or grep<\/code>.<\/p>\n\n\n\n
This is the correct, updated, and complete<\/strong> guide to ignoring directories and files in Trivy. \u2705 Let me know if you need further clarification! \ud83d\ude80<\/p>\n","protected":false},"excerpt":{"rendered":"
Trivy provides multiple ways to ignore directories, files, and vulnerabilities during scanning. This guide covers all correct and updated methods, including command-line options, configuration files, and post-processing techniques. 1\ufe0f\u20e3 Ignore… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-48735","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/48735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=48735"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/48735\/revisions"}],"predecessor-version":[{"id":48736,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/48735\/revisions\/48736"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=48735"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=48735"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=48735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}