TRUSTIVAN has no trustivan command. There is no client you install to talk to a running deployment, and nothing on this page will help you scan an image from your laptop. That is worth stating first because most tools in this category ship exactly such a client, and looking for one and not finding it reads as a gap rather than a decision. The machine surface is the HTTP API: it is the interface a pipeline drives, it is versioned, and it is the one thing a client would wrap. Shipping a wrapper as well would create a second surface to keep in step with the first, with its own release cadence and its own installation problem, for no capability the API does not already have. What the repository does build is four server binaries. They are the operator’s command line — the processes you run, supervise and upgrade — and this section is their reference.

​
The four binaries

All four ship in one image, selected by entrypoint, so the migrations and the sweep are guaranteed to come from the same build as the API that reads what they wrote. reencrypt has no page of its own because it is not a process you supervise: it is run once, deliberately, after a new encryption key has been added to the keyring, and it rewrites every stored ciphertext under the new key version. Rotating the key without running it leaves data readable only under a key you have retired — see Rotating credentials. api and worker are separate processes rather than one binary with a flag, and the split is load-bearing. Scanning is the part that handles untrusted input, holds a large cache, and takes minutes; serving the API is the part that must stay responsive. Running them together means one scan of a large image degrades every request, and it means you cannot scale the two independently — which is the whole reason the default compose file separates them.

​
They take no flags

api and worker accept no command-line arguments at all. Passing some is not an error; they are ignored. Everything is configured through the process environment, which is a deliberate single surface rather than an omission — see Configuration overview for why, and Environment variables for the complete list. The practical consequence is that a flag you might reach for has an environment variable instead: One consequence is worth planning for: changing any setting means restarting the process. There is no reload signal, and no admin endpoint that writes configuration.

​
Where the scanner’s own command line went

TRUSTIVAN embeds its scanning engine as a Go library, in a single adapter package. It does not shell out to a scanner binary, so there is no engine command line to pass flags through to, and no -- escape hatch that forwards arguments to it. This matters more than it sounds. It means the scanner’s configuration surface is exactly the set of settings TRUSTIVAN’s own configuration exposes, and an option that is not in Scanning and concurrency is not reachable at all. If you have used the upstream scanner directly and are looking for a familiar flag, that is where to check whether TRUSTIVAN exposes the equivalent — and Upstream and attribution explains what the relationship between the two projects is and is not.