# docker/trivy-config

> Scans Dockerfiles for HIGH and CRITICAL misconfigurations, including a root user and exposed secrets.

Scans Dockerfiles for HIGH and CRITICAL misconfigurations, including a root user and exposed secrets.

Part of the [`docker`](/reference/configurations/docker/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `push` [stage](/start/concepts/#stage), once per scope. It runs trivy.

## Why

A root user turns any bug in the service into full control of the container.

## What to do

Change the file the way the message says. Accept one advisory with `gspot ignore docker/trivy-config --rule <id> --reason "..."`.

## Example

A Dockerfile whose final stage runs as root reports a finding. Create an unprivileged user, and switch to it with `USER` before the application starts.

## Turn it off

Turn it off for some files, or one of its lint rules, with a reason:

```shell
gspot ignore docker/trivy-config --paths "<glob>" --reason "<why>"
gspot ignore docker/trivy-config --rule <rule> --reason "<why>"
```