KubeScan - Multi-Tool Container Security Scanner
A Python orchestrator that runs Trivy, Grype, and Snyk against one image, deduplicates their findings into a single report, gates ECR pushes on severity, and re-scans running EKS images every six hours.
Trivy, Grype, and Snyk each have distinct strengths (OS packages, SBOM-driven matching, developer-oriented remediation) and each miss things the others catch. Running one scanner in isolation is closer to a hunch than a verdict, but running all three by hand and reconciling their JSON manually is nobody's idea of a workflow.
A Python orchestrator drives all three scanners against a target image, normalizes their outputs, deduplicates findings, and can hunt specific CVEs across scanner databases in one pass. That same orchestrator plugs into an ECR pre-push script that gates the push on configurable severity thresholds, and into a Kubernetes CronJob that scans images already running in EKS every six hours and drops both JSON and Markdown reports into S3.
Cross-checking beats trusting a single tool's opinion of your image.
One command scans with three tools and produces one report; unsafe images get blocked before they reach ECR, and images already running get re-scanned on a schedule so newly disclosed CVEs surface without a human remembering to look.
- Trivy, Grype, and Snyk driven from one CLI with deduplicated output
- ECR pre-push gate on configurable severity thresholds
- 6-hour CronJob re-scans running EKS images, reports land in S3