Apps

Trivy ships as a single Go binary (cmd/trivy/main.go) but exposes several modes that look like distinct applications to a user:

• The CLI — interactive scans, configuration management, and one-shot operations.
• The Server — long-running RPC server for trivy client and the Trivy Operator.
• The Plugin host — the same binary running in plugin-replacement mode (TRIVY_RUN_AS_PLUGIN=...).
• The Module host — the same binary loading WebAssembly modules.

The "apps" lens here documents the user-facing surfaces. The reusable subsystems behind them (fanal, scan service, cache, RPC, plugin manager, WebAssembly host) are covered under systems.

Pages in this section

• CLI — the trivy binary, its command tree, and how a command is wired up.
• Server — the trivy server mode and its RPC surface.

How a single binary serves four roles

graph LR
    Bin[trivy binary<br/>cmd/trivy/main.go] -->|TRIVY_RUN_AS_PLUGIN| Plugin[Plugin replacement<br/>pkg/plugin/Run]
    Bin -->|otherwise| Run[commands.Run]
    Run -->|trivy server| Server[server command<br/>pkg/commands/server]
    Run -->|trivy client / trivy image --server| Client[client command<br/>pkg/commands/server + RPC]
    Run -->|trivy image / fs / repo / ...| StdScan[standalone scan<br/>pkg/commands/artifact]
    Run -->|trivy module install| ModHost[module host<br/>pkg/module]
    Run -->|trivy <plugin>| PluginCmd[plugin command<br/>pkg/plugin]

The dispatch happens in two places:

1. cmd/trivy/main.go — checks the TRIVY_RUN_AS_PLUGIN environment variable; if set, runs Trivy as the named plugin.
2. pkg/commands/app.go — Cobra root command with subcommands for every top-level mode.

Common scaffolding

Every command shares the same scaffolding:

• A New<Name>Command(globalFlags) constructor in pkg/commands/app.go.
• A flag.Flags{...} composition that selects the relevant flag groups.
• A RunE that produces a flag.Options and dispatches to a runner.
• For scan-shaped commands, the runner is pkg/commands/artifact/run.go.

See patterns and conventions for the boilerplate.