Trivy if you want one CLI for images, repos, misconfig, and secrets. Grype if you want Anchore's image/filesystem scanner. You can run both; start with one.

No. SonarCloud is code quality — /replace/sonarcloud. Snyk is vulns in deps and images.

Can I deploy this on Railway?

The scanner is a CI job. Railway is useful for the registry you scan, not for Trivy itself.

Stacks / Backend

Easy

Trivy / Grype

Vulnerability scans you run. Trivy is Apache-2.0; Grype is Apache-2.0 — Snyk without the seat.

The problem

Snyk sells vulnerability and fix-PR Seats as a subscription. You wanted a scanner in CI you run. Trivy is Apache-2.0 (aquasecurity/trivy). Grype is Apache-2.0 (anchore/grype) if you want that image/filesystem scanner. This is not Snyk's every IDE, reachability, or fix-bot SKU. Code quality stays on /replace/sonarcloud.

Replaces

Snyk

Replace Snyk See all best open-source scanners

Estimated SaaS saved

$1,200

per year, small team, before lock-in

Start on Railway

Harbor if this is the registry that holds the images you scan

Sponsor this stack Tip jar

These are CLI/CI jobs, not a hosted app. Run Trivy or Grype in the pipeline that already builds the image. Start on Railway only if you also want a registry to scan — that stack is /stacks/harbor-registry. No one-click scanner template in this repo.

The stack

Trivy
Apache-2.0 scanner for containers, repos, misconfig, and secrets
Catalog entry →
Grype
Apache-2.0 vulnerability scanner for images and filesystems
Catalog entry →

Cost table

You stop paying	Typical / year	Self-host instead
Snyk (small team)	$1,200	Trivy or Grype in CI

Agent setup prompt

Replace Snyk with Trivy (preferred) or Grype.

- Add a CI step that scans the image or lockfile you already build. Fail the job on CRITICAL if that is policy.
- Do not claim Snyk fix-PRs or every reachability graph. Write AGENT_PROMPT.md.
- Images you host belong on /stacks/harbor-registry.

Also as markdown: /stacks/trivy-scan.md

FAQ

Trivy or Grype?: Trivy if you want one CLI for images, repos, misconfig, and secrets. Grype if you want Anchore's image/filesystem scanner. You can run both; start with one.
Is this SonarCloud?: No. SonarCloud is code quality — /replace/sonarcloud. Snyk is vulns in deps and images.
Can I deploy this on Railway?: The scanner is a CI job. Railway is useful for the registry you scan, not for Trivy itself.