Alternatives to Clair
A self-hosted service that statically analyses container images for known vulnerabilities. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Clair
A self-hosted service that statically analyses container images for known vulnerabilities.
Replacements
Listings that take over the same core job as Clair.
Trivy
Scan software and infrastructure for known security issues.
Trivy scans containers, filesystems and configuration for known issues from the command line across platforms, simpler to run than Clair's indexer and matcher service.
Grype
Find known vulnerabilities in container images and filesystems.
Grype finds known vulnerabilities in container images and filesystems and can scan SBOMs from the command line rather than running as a service.
Harbor
A self-hosted container registry with vulnerability scanning, image signing and role-based access control.
Harbor is a self-hosted container registry with built-in vulnerability scanning, image signing and role-based access control, more than Clair's analysis alone.
Similar software
Related functionality, not a direct replacement.
Syft
Generate software bills of materials from images and files.
Dependency-Track
Track component risk using software bills of materials.
DefectDojo
An open source, self-hosted vulnerability management platform that collects and tracks findings from security scanners.
Snyk
A hosted developer security platform that scans code and applications for vulnerabilities.
