TroveGrid
Back to all tools
Clair logo

Clair

Static vulnerability analysis for OCI and Docker container images.

0Open Source
Security Container Security Vulnerability Scanning
Official Website View on GitHub
Share:XLinkedInWhatsApp

Overview

An open-source project for the static analysis of vulnerabilities in container images.

Key Features

  • Scans container images against multiple vulnerability databases (NVD, Alpine, Debian, RHEL)
  • REST API for integration with registries and CI/CD pipelines
  • Incremental image analysis using layer-based caching
  • Notification service for alerting on newly published CVEs affecting existing images
  • Used by Quay.io as the default scanning backend
  • Supports OCI, Docker v2, and manifest list image formats

Real-World Workflows

Registry-integrated vulnerability scanning

  1. 1Deploy Clair alongside a container registry (Quay, Harbor, or custom)
  2. 2Registry sends image manifests to Clair on every push
  3. 3Clair analyses layers against known CVE databases
  4. 4Registry surfaces vulnerability results in the image details UI
  5. 5CI/CD pipeline queries the Clair API to gate deployments on scan results

Getting Started

# Run Clair with Docker Compose (from the official repo):
git clone https://github.com/quay/clair
cd clair && docker compose up -d

Compare Alternatives

See how Clair stacks up against similar tools.

VStrivyVSaquaVStwistlock