LibrePortal
Sponsor
Install

Trivy

Vulnerability scanner

SecurityRecommendedWorks with 3 apps

Trivy checks the software inside your apps for known security holes, and LibrePortal shows you what it finds next to each app's updates. There's nothing to open and nothing to set up.

On this page
  1. At a glance
  2. What it's good for
  3. What you'll see
  4. What to do about a CVE
  5. Good to know
  6. Settings
  7. In its config file
  8. Works with
  9. Privacy and security
  10. What leaves this server
  11. What LibrePortal turns off
  12. Sources
  13. Under the hood

At a glance#

What it is
Vulnerability scanner Security
Where it opens
No web page It works in the background
Updates
Automatic A backup is taken first, and it rolls back if the update fails
Backups
Left out Not in the scheduled backups unless you switch it on
Copies
One per server

What it's good for#

Every app you install is built from hundreds of smaller pieces of software, and now and then one of those pieces turns out to have a security hole. Each one that's been made public gets a number, a CVE. Trivy compares what's inside each of your apps against the public list of CVEs, so you find out which apps are affected, how badly, and whether an update fixes it.

It's the difference between "I think everything's up to date" and knowing.

What you'll see#

Trivy has no web page of its own. It runs in the background, and LibrePortal asks it about your apps and puts the answers in the WebUI:

  • App Center → Overview has a Security row: the number of known CVEs across your apps, with the worst severity, or Security — no known CVEs.
  • The Updates tab there has a Known CVEs card, and its Security view lists each affected app and its CVEs: the package, the version you have, and the version that fixes it when there is one.
  • Each app's own Updates tab shows its known vulnerabilities.

LibrePortal runs the scans itself. Nothing is sent anywhere: Trivy looks at the copies of your apps already on the server and checks them against a database it keeps locally.

The first few minutes

Straight after the install, Trivy downloads its vulnerability database, a few tens of megabytes. Until that's done, the WebUI says Security — building CVE database or database updating… rather than showing an all-clear it can't back up yet. Usually it takes a minute or two. If the server can't reach the internet, Trivy waits and tries again every five minutes.

What to do about a CVE#

Don't panic at a big number. Most CVEs are in parts of an app you never touch, and many are rated low or medium. A few habits go a long way:

  • Look at critical and high first, and at whether a fixed version exists.
  • Update the app if an update is waiting. That's the fix almost every time, and keeping updates on Automatic means most fixes arrive without you doing anything.
  • When there's no fix yet, keep that app private if it doesn't need to be public. A hole that can only be reached from your own network is a much smaller problem.

Good to know#

  • Trivy isn't a firewall or an antivirus. It tells you about known problems in app images; it doesn't block anything.
  • Its scanner port is private and used by LibrePortal only. There's nothing on it for you to open.
  • Updates are automatic, and it keeps its database up to date on its own.
  • It isn't backed up, because it holds nothing but a database it can download again.
  • One per server. LibrePortal always asks the one called Trivy, so a second copy would never be used.

Settings#

In its config file#

Trivy's own settings aren't on the Config tab yet. They live in the app's config file, described here so you know they exist. How to change them.

SettingWhat it doesStarts as
Name
CFG_TRIVY_DISPLAY_NAME		 What this app is called on your dashboards. Leave empty to use its usual name Empty
Show on the LibrePortal Dashboard
CFG_TRIVY_SHOW_ON_DASHBOARD		 Whether this app gets a shortcut on the front page of the LibrePortal WebUI, separate from any Dashy dashboard
Choices: true, false		 false
Usage telemetry
CFG_TRIVY_TELEMETRY		 Whether Trivy may send anonymous usage data to Aqua Security.
Choices: true, false		 false
Update check
CFG_TRIVY_UPDATE_CHECK		 Whether Trivy may ask check.trivy.dev if a newer version exists.
Choices: true, false		 false

Works with#

These are the other apps Trivy knows how to work with. Once it's installed, its page shows the same list with whether each one is connected. How this works.

  • Grafana: Shows dashboards for the apps that have one. works with every app
  • Prometheus: Collects metrics from the apps that can export them. works with every app
  • Uptime Kuma: Watches your apps and shows when one goes down. works with every app

Privacy and security#

All clear Trivy scans your apps for known security holes. It has to download its list of holes from the internet; LibrePortal turns off its version check and telemetry.

What leaves this server#

  • The vulnerability database is downloaded from GitHub's container registry
  • Images you scan are pulled from their registries

What LibrePortal turns off#

  • Version check (switchable in Config)
  • Usage telemetry (switchable in Config)

Licence: Apache-2.0. Audited: 21 October 2026. See the privacy of every app and the Promise.

Sources#

Under the hood#

  • It runs this image: aquasec/trivy:0.76.0@sha256:2416d1f74045b57274df1a340eee6b510cacd73c66a6ccb8da092b117eb7d222.
  • It can sit behind Authelia's sign-in once Authelia is installed.
  • Its own project and documentation: github.com/aquasecurity/trivy

Ports, settings, tools and connections on this page are read from LibrePortal v0.10.97's app catalogue each time the guide is built.

Next steps

Every appAll the apps in the App Center, with search and categories.UpdatesLibrePortal keeps two things up to date, itself and your apps.Who can reach whatMake each app and the WebUI public or private, in one place.