Trivy "unable to initialize the OS scanner" (distroless) in CI

By Kaveh Alemi·Latchkey

Trivy detects the OS by reading a known package database (dpkg, rpm, apk). On a scratch image or an unrecognized distroless variant it cannot find one, so the OS scanner fails to initialize. Scanning language dependencies still works; the OS layer just yields no analyzer.

What this error means

Trivy aborts with "unable to initialize a scanner: unable to initialize the OS scanner: ..." or reports the OS as unknown, on a minimal or distroless base.

2026-06-30T10:31:52.771Z	FATAL	image scan error: scan error: unable to initialize a scanner:
unable to initialize the OS scanner: failed to detect the OS: unable to analyze OS: unknown OS

Common causes

A scratch or unrecognized distroless base has no OS DB

Trivy needs a package database to enumerate OS packages. scratch and some distroless images ship none, so OS detection has nothing to read.

An older Trivy that does not recognize the base

A distroless variant introduced after your Trivy version may not be recognized until you upgrade the scanner.

How to fix it

Scan only the scanners the image supports

1. For a language-only distroless image, restrict Trivy to the library scanner.
2. Use --scanners vuln and, if needed, --pkg-types library to skip OS analysis.
3. Re-run so Trivy analyzes the dependencies it can read.

trivy image --scanners vuln --pkg-types library \
  --exit-code 1 --severity HIGH,CRITICAL gcr.io/distroless/base myimage:latest

Upgrade Trivy so it recognizes the base

Newer Trivy releases add analyzers for more distroless variants. Pin a current version in CI.

- uses: aquasecurity/trivy-action@0.24.0
  with:
    image-ref: myimage:latest

How to prevent it

• Match the Trivy version to the base images you scan.
• For distroless, scope the scan to language libraries.
• Document which images have no OS package DB to avoid false alarms.

Frequently asked questions

Related guides

References

• GitHub Actions documentation