# docker/trivy-image

> Scans every image a Compose file names for known vulnerabilities in its packages.

Scans every image a Compose file names for known vulnerabilities in its packages.

Part of the [`docker`](/reference/configurations/docker/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs only when `gspot check --only docker/trivy-image` names it, once per scope. It runs trivy. It needs Docker, running.

## Why

A base image carries hundreds of packages, and new advisories keep arriving after you pick it.

## What to do

Move to a newer tag of the image. Accept one advisory with `gspot ignore docker/trivy-image --rule <id> --reason "..."`.

## Example

An image with a vulnerable package reports the advisory. Move to an image version with the fixed package.

## Turn it off

Turn it off for some files, with a reason:

```shell
gspot ignore docker/trivy-image --paths "<glob>" --reason "<why>"
```