KubeScan - Multi-Tool Container Security Scanner
A Python orchestrator that runs Trivy, Grype, and Snyk against one image, deduplicates their findings into a single report, gates ECR pushes on severity, and re-scans running EKS images every six hours.
Trivy, Grype, and Snyk each have distinct strengths (OS packages, SBOM-driven matching, developer-oriented remediation) and each miss things the others catch. Running one scanner alone gives incomplete coverage, and running all three by hand and reconciling their JSON manually does not scale as a workflow.
A Python orchestrator drives all three scanners against a target image, normalizes their outputs, deduplicates findings, and can hunt specific CVEs across scanner databases in one pass. That same orchestrator plugs into an ECR pre-push script that gates the push on configurable severity thresholds, and into a Kubernetes CronJob that scans images already running in EKS every six hours and drops both JSON and Markdown reports into S3.
Cross-checking beats trusting a single tool's opinion of your image.
One command scans with three tools and produces one report. Unsafe images get blocked before they reach ECR. Images already running get re-scanned on a schedule, so newly disclosed CVEs surface without a human having to check.
- Trivy, Grype, and Snyk driven from one CLI with deduplicated output
- ECR pre-push gate on configurable severity thresholds
- 6-hour CronJob re-scans running EKS images, reports land in S3