Clair

A self-hosted service that statically analyses container images for known vulnerabilities.

FreeOpen sourceSelf-hosted
Official websitegithub.com

These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.

About Clair

Clair scans the layers of container images and matches the packages it finds against vulnerability data, without running the containers. It is a server you run yourself, split into an indexer that catalogues image contents, a matcher that compares them with vulnerability records, and a notifier that reports newly affected images.

The project lives under the Quay organisation on GitHub and is written in Go. It suits teams running their own container registry or build pipeline who want a scanner they operate themselves.

Strengths

  • Static analysis of image layers without running containers
  • Separate indexer, matcher and notifier components
  • Can notify when new vulnerabilities affect indexed images
  • Long-running project with a large contributor history

Limitations

  • Runs as a service, so it needs setup rather than a single command
  • Aimed at registries and pipelines more than individual desktop use

Details

Pricing
FreeFree and open source.
License
Apache-2.0
Developer
The Clair contributors (Quay project)
Platforms
Self-hosted
How it runs
Self-hosted
Account
Not required
Best suited for
Teams scanning container images in their own registry or CI pipeline
Last verified
Added
Provenance
Facts checked against the developer's own pages and store listings, 1 sources on file.

Alternatives to Clair

Compare all

Software that can replace Clair for an important use case, and what changes if you switch.

  • Trivy

    Scan software and infrastructure for known security issues.

    FreeOpen sourceWindowsmacOSLinuxCommand line

    Trivy scans containers, filesystems and configuration for known issues from the command line across platforms, simpler to run than Clair's indexer and matcher service.

  • Grype

    Find known vulnerabilities in container images and filesystems.

    FreeOpen sourceWindowsmacOSLinuxCommand line

    Grype finds known vulnerabilities in container images and filesystems and can scan SBOMs from the command line rather than running as a service.

  • Harbor

    A self-hosted container registry with vulnerability scanning, image signing and role-based access control.

    FreeOpen sourceLinuxSelf-hosted

    Harbor is a self-hosted container registry with built-in vulnerability scanning, image signing and role-based access control, more than Clair's analysis alone.

Similar software

Related functionality, not necessarily a direct replacement.

Report a wrong fact or a dead link on this listing