Where Does Trivy Store Its Cache and Database?
Trivy vulnerability database and cache folders on Linux, macOS, and Windows, plus the flag that overrides them.
Last updated
Trivy caches its vulnerability database and scan artifacts on local disk. Linux uses ~/.cache/trivy with the database under db inside it. The first scan downloads several hundred megabytes here, so a slow first run is normal on fresh machines.
Other systems follow their own conventions. macOS uses ~/Library/Caches/trivy and Windows uses %LOCALAPPDATA%\trivy. Override any of them with --cache-dir or TRIVY_CACHE_DIR. Wiping the folder is safe and fixes corrupt downloads. Trivy refetches the database on the next run.
Where Trivy stores this, by platform
~/.cache/trivy
Default on Linux. Holds db, fanal, and Java index subfolders. Respects XDG_CACHE_HOME when set. Delete to force a clean database download.
~/Library/Caches/trivy
Native macOS cache root. Same internal layout as Linux. Homebrew installs use this without extra setup.
%LOCALAPPDATA%\trivy
Roaming local data for the Windows binary and Chocolatey installs. Pass an absolute --cache-dir if the C drive is tight on space.
Frequently asked questions
how do i move the Trivy cache to another disk
Pass --cache-dir with a new path on any trivy command, or set TRIVY_CACHE_DIR. CI jobs use this to share one cache across steps. The DB and Java index move together.
how do i force Trivy to refresh its vulnerability database
Run trivy image --download-db-only to prefetch, or let the first scan fetch it. The db subfolder holds the vulnerability data and the fastest way to confirm a refresh worked is its timestamp.
Notice an outdated path? Let us know.