Snyk 2.0 vs. Trivy 0.50: Which Is Better for Container Security in 2026?

# GitHub Actions workflow to benchmark Snyk 2.0 vs Trivy 0.50 in CI
# Methodology: Scans a 1.2GB Node.js 22 container image across 5 parallel runs
name: Container Security Benchmark
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  schedule:
    - cron: '0 4 * * *' # Nightly benchmark run

env:
  SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
  TRIVY_VERSION: 0.50.0
  SNYK_VERSION: 2.0.1
  SCAN_IMAGE: node:22-alpine@sha256:9f3c7d1e3a7b0d3f8a2e1c0b9d8f7a6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0
  BENCHMARK_RUNS: 5

jobs:
  benchmark-snyk:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Snyk 2.0.1
        run: |
          # Download Snyk binary with checksum verification
          curl -sS https://downloads.snyk.io/cli/2.0.1/snyk-linux -o snyk
          echo \"d4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5 snyk\" | sha256sum -c
          chmod +x snyk
          sudo mv snyk /usr/local/bin/snyk
          snyk --version # Verify install

      - name: Run Snyk container scan (5 iterations)
        id: snyk-scan
        run: |
          mkdir -p snyk-results
          total_time=0
          for i in $(seq 1 $BENCHMARK_RUNS); do
            echo \"Starting Snyk scan run $i\"
            start=$(date +%s%N)
            # Scan image, output JSON, fail only on critical CVEs
            snyk container test $SCAN_IMAGE --json --severity-threshold=critical > snyk-results/run-$i.json || true
            end=$(date +%s%N)
            elapsed=$(( ($end - $start) / 1000000 )) # Convert to ms
            echo \"Run $i elapsed: $elapsed ms\"
            total_time=$(( $total_time + $elapsed ))
            # Capture exit code for error handling
            echo \"SNYK_EXIT_CODE_$i=$?\" >> $GITHUB_ENV
          done
          avg_time=$(( $total_time / $BENCHMARK_RUNS ))
          echo \"SNYK_AVG_TIME=$avg_time\" >> $GITHUB_ENV
          echo \"Snyk average scan time: $avg_time ms\"

      - name: Upload Snyk results
        if: always() # Upload even if scan fails
        uses: actions/upload-artifact@v4
        with:
          name: snyk-benchmark-results
          path: snyk-results/
          retention-days: 7

  benchmark-trivy:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Trivy 0.50.0
        run: |
          # Download Trivy binary with checksum verification
          curl -sS https://github.com/aquasecurity/trivy/releases/download/v0.50.0/trivy_0.50.0_Linux-64bit.tar.gz -o trivy.tar.gz
          echo \"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2 trivy.tar.gz\" | sha256sum -c
          tar -xzf trivy.tar.gz
          sudo mv trivy /usr/local/bin/trivy
          trivy --version # Verify install

      - name: Run Trivy container scan (5 iterations)
        id: trivy-scan
        run: |
          mkdir -p trivy-results
          total_time=0
          for i in $(seq 1 $BENCHMARK_RUNS); do
            echo \"Starting Trivy scan run $i\"
            start=$(date +%s%N)
            # Scan image, output JSON, ignore unfixed CVEs
            trivy image --format json --severity CRITICAL --ignore-unfixed $SCAN_IMAGE > trivy-results/run-$i.json || true
            end=$(date +%s%N)
            elapsed=$(( ($end - $start) / 1000000 )) # Convert to ms
            echo \"Run $i elapsed: $elapsed ms\"
            total_time=$(( $total_time + $elapsed ))
            echo \"TRIVY_EXIT_CODE_$i=$?\" >> $GITHUB_ENV
          done
          avg_time=$(( $total_time / $BENCHMARK_RUNS ))
          echo \"TRIVY_AVG_TIME=$avg_time\" >> $GITHUB_ENV
          echo \"Trivy average scan time: $avg_time ms\"

      - name: Upload Trivy results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: trivy-benchmark-results
          path: trivy-results/
          retention-days: 7

  generate-report:
    needs: [benchmark-snyk, benchmark-trivy]
    runs-on: ubuntu-24.04
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4

      - name: Generate comparison report
        run: |
          echo \"## Benchmark Report\" > report.md
          echo \"Snyk 2.0 Avg Time: $SNYK_AVG_TIME ms\" >> report.md
          echo \"Trivy 0.50 Avg Time: $TRIVY_AVG_TIME ms\" >> report.md
          echo \"Speedup: $(( $SNYK_AVG_TIME / $TRIVY_AVG_TIME ))x\" >> report.md

      - name: Upload report
        uses: actions/upload-artifact@v4
        with:
          name: benchmark-report
          path: report.md

// Go program to scan local container images with Trivy 0.50 SDK, filter custom CVEs, and export SPDX SBOM
// Requires: trivy 0.50.0, Go 1.22+, local Docker daemon
// Build: go build -o trivy-custom-scanner main.go
package main

import (
    \"context\"
    \"encoding/json\"
    \"fmt\"
    \"log\"
    \"os\"
    \"strings\"
    \"time\"

    \"github.com/aquasecurity/trivy/v0.50/pkg/fanal/artifact\"
    \"github.com/aquasecurity/trivy/v0.50/pkg/fanal/artifact/image\"
    \"github.com/aquasecurity/trivy/v0.50/pkg/scanner\"
    \"github.com/aquasecurity/trivy/v0.50/pkg/types\"
    \"github.com/aquasecurity/trivy/v0.50/pkg/spdx\"
)

const (
    scanTimeout  = 5 * time.Minute
    outputPath   = \"scan-results.json\"
    sbomPath     = \"sbom.spdx.json\"
    ignoredCVEs  = \"CVE-2024-1234,CVE-2024-5678\" // Comma-separated list of CVEs to ignore
    targetImage  = \"nginx:1.25-alpine\"
)

func main() {
    ctx, cancel := context.WithTimeout(context.Background(), scanTimeout)
    defer cancel()

    // Initialize scanner with custom config
    cfg := types.ScanConfig{
        Target:     targetImage,
        Timeout:    scanTimeout,
        Severity:   []string{\"CRITICAL\", \"HIGH\"},
        IgnoreCVEs: ignoredCVEs,
    }

    // Create image artifact from local Docker image
    img, err := image.NewArtifact(ctx, targetImage, artifact.Option{})
    if err != nil {
        log.Fatalf(\"Failed to load image artifact: %v\", err)
    }
    defer img.Cleanup()

    // Initialize scanner
    s, err := scanner.NewScanner(ctx, cfg)
    if err != nil {
        log.Fatalf(\"Failed to initialize scanner: %v\", err)
    }

    // Run scan
    results, err := s.ScanArtifact(ctx, img)
    if err != nil {
        log.Fatalf(\"Scan failed: %v\", err)
    }

    // Filter ignored CVEs from results
    filteredResults := filterIgnoredCVEs(results, ignoredCVEs)
    if len(filteredResults) == 0 {
        log.Println(\"No vulnerabilities found after filtering\")
    }

    // Marshal results to JSON
    jsonData, err := json.MarshalIndent(filteredResults, \"\", \"  \")
    if err != nil {
        log.Fatalf(\"Failed to marshal results: %v\", err)
    }

    // Write scan results to file
    if err := os.WriteFile(outputPath, jsonData, 0644); err != nil {
        log.Fatalf(\"Failed to write results file: %v\", err)
    }
    fmt.Printf(\"Scan results written to %s\n\", outputPath)

    // Generate SPDX SBOM
    sbom, err := spdx.NewSBOM(ctx, img, types.SBOMConfig{Format: \"spdx-json\"})
    if err != nil {
        log.Fatalf(\"Failed to generate SBOM: %v\", err)
    }

    sbomData, err := json.MarshalIndent(sbom, \"\", \"  \")
    if err != nil {
        log.Fatalf(\"Failed to marshal SBOM: %v\", err)
    }

    if err := os.WriteFile(sbomPath, sbomData, 0644); err != nil {
        log.Fatalf(\"Failed to write SBOM file: %v\", err)
    }
    fmt.Printf(\"SBOM written to %s\n\", sbomPath)

    // Print summary
    printSummary(filteredResults)
}

// filterIgnoredCVEs removes CVEs present in the ignored list from scan results
func filterIgnoredCVEs(results []types.Result, ignored string) []types.Result {
    ignoredMap := make(map[string]bool)
    for _, cve := range strings.Split(ignored, \",\") {
        ignoredMap[strings.TrimSpace(cve)] = true
    }

    var filtered []types.Result
    for _, res := range results {
        var vulns []types.Vulnerability
        for _, v := range res.Vulnerabilities {
            if !ignoredMap[v.VulnerabilityID] {
                vulns = append(vulns, v)
            }
        }
        if len(vulns) > 0 {
            res.Vulnerabilities = vulns
            filtered = append(filtered, res)
        }
    }
    return filtered
}

// printSummary prints a human-readable summary of scan results
func printSummary(results []types.Result) {
    totalVulns := 0
    critical := 0
    high := 0
    for _, res := range results {
        for _, v := range res.Vulnerabilities {
            totalVulns++
            switch v.Severity {
            case \"CRITICAL\":
                critical++
            case \"HIGH\":
                high++
            }
        }
    }
    fmt.Printf(\"\n=== Scan Summary ===\n\")
    fmt.Printf(\"Total Vulnerabilities: %d\n\", totalVulns)
    fmt.Printf(\"Critical: %d\n\", critical)
    fmt.Printf(\"High: %d\n\", high)
    fmt.Printf(\"====================\n\")
}

# Python script to batch scan container images via Snyk 2.0 REST API with retry logic and result aggregation
# Requires: Python 3.12+, requests 2.31+, python-dotenv 1.0+
# Setup: Create .env file with SNYK_API_TOKEN=your_token, ORG_ID=your_org_id
import os
import time
import json
import logging
from typing import List, Dict, Optional
from dotenv import load_dotenv
import requests
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

# Configure logging
logging.basicConfig(
    level=logging.INFO,
    format=\"%(asctime)s - %(levelname)s - %(message)s\"
)
logger = logging.getLogger(__name__)

# Load environment variables
load_dotenv()

# Configuration
SNYK_API_BASE = \"https://api.snyk.io/v1\"
SNYK_API_TOKEN = os.getenv(\"SNYK_API_TOKEN\")
ORG_ID = os.getenv(\"ORG_ID\")
SCAN_IMAGES = [
    \"node:22-alpine\",
    \"nginx:1.25-alpine\",
    \"postgres:16-alpine\",
    \"redis:7.2-alpine\",
] * 25 # Repeat to get 100 images for batch benchmark
MAX_RETRIES = 3
RETRY_BACKOFF = 2 # Seconds between retries
SCAN_TIMEOUT = 300 # 5 minutes per scan
OUTPUT_FILE = \"snyk-batch-results.json\"

class SnykBatchScanner:
    def __init__(self, api_token: str, org_id: str):
        if not api_token or not org_id:
            raise ValueError(\"SNYK_API_TOKEN and ORG_ID must be set\")
        self.api_token = api_token
        self.org_id = org_id
        self.session = self._init_session()

    def _init_session(self) -> requests.Session:
        \"\"\"Initialize requests session with retry logic for transient errors\"\"\"
        session = requests.Session()
        retry_strategy = Retry(
            total=MAX_RETRIES,
            backoff_factor=RETRY_BACKOFF,
            status_forcelist=[429, 500, 502, 503, 504],
            allowed_methods=[\"POST\", \"GET\"]
        )
        adapter = HTTPAdapter(max_retries=retry_strategy)
        session.mount(\"https://\", adapter)
        session.headers.update({
            \"Authorization\": f\"token {self.api_token}\",
            \"Content-Type\": \"application/json\",
            \"User-Agent\": \"SnykBatchScanner/2.0\"
        })
        return session

    def scan_image(self, image: str) -> Optional[Dict]:
        \"\"\"Scan a single container image via Snyk API, return results or None on failure\"\"\"
        url = f\"{SNYK_API_BASE}/org/{self.org_id}/container-image\"
        payload = {
            \"image\": image,
            \"severity_threshold\": \"critical\",
            \"ignore_unfixed\": True
        }
        try:
            logger.info(f\"Scanning image: {image}\")
            response = self.session.post(
                url,
                json=payload,
                timeout=SCAN_TIMEOUT
            )
            response.raise_for_status()
            return response.json()
        except requests.exceptions.RequestException as e:
            logger.error(f\"Failed to scan {image}: {e}\")
            if hasattr(e, \"response\") and e.response is not None:
                logger.error(f\"Response: {e.response.text}\")
            return None

    def batch_scan(self, images: List[str]) -> List[Dict]:
        \"\"\"Batch scan list of images, return list of successful results\"\"\"
        results = []
        total = len(images)
        for idx, image in enumerate(images, 1):
            logger.info(f\"Progress: {idx}/{total}\")
            result = self.scan_image(image)
            if result:
                results.append({
                    \"image\": image,
                    \"scan_id\": result.get(\"id\"),
                    \"vuln_count\": len(result.get(\"vulnerabilities\", [])),
                    \"scan_time\": result.get(\"scan_time_ms\")
                })
            # Rate limit handling: Snyk API allows 100 requests/minute
            if idx % 90 == 0:
                logger.info(\"Rate limit buffer: Sleeping 60 seconds\")
                time.sleep(60)
        return results

    def save_results(self, results: List[Dict], output_path: str) -> None:
        \"\"\"Save scan results to JSON file\"\"\"
        try:
            with open(output_path, \"w\") as f:
                json.dump(results, f, indent=2)
            logger.info(f\"Results saved to {output_path}\")
        except IOError as e:
            logger.error(f\"Failed to save results: {e}\")

def main():
    try:
        scanner = SnykBatchScanner(SNYK_API_TOKEN, ORG_ID)
    except ValueError as e:
        logger.error(f\"Initialization failed: {e}\")
        return

    logger.info(f\"Starting batch scan of {len(SCAN_IMAGES)} images\")
    start_time = time.time()
    results = scanner.batch_scan(SCAN_IMAGES)
    end_time = time.time()

    logger.info(f\"Scan complete. Successful: {len(results)}/{len(SCAN_IMAGES)}\")
    logger.info(f\"Total time: {end_time - start_time:.2f} seconds\")

    scanner.save_results(results, OUTPUT_FILE)

    # Print summary
    total_vulns = sum(r[\"vuln_count\"] for r in results)
    avg_time = sum(r[\"scan_time\"] for r in results if r[\"scan_time\"]) / len(results) if results else 0
    print(\"\n=== Batch Scan Summary ===\")
    print(f\"Total Images Scanned: {len(results)}\")
    print(f\"Total Vulnerabilities: {total_vulns}\")
    print(f\"Average Scan Time: {avg_time:.2f} ms\")
    print(\"==========================\")

if __name__ == \"__main__\":
    main()

trivy image --cache-dir /tmp/trivy-cache --format json node:22-alpine > results.json

# .snyk policy file example
version: v1.25.0
ignore:
  CVE-2024-1234:
    reason: \"Vulnerability in devDependency not shipped to production\"
    expires: \"2026-12-31\"
    paths:
      - \"express>body-parser\"

# GitHub Actions step to export Trivy SBOM
- name: Export Trivy SBOM
  run: trivy image --format spdx-json node:22-alpine > sbom.spdx.json