What is this?
Clair is an open source tool for static analysis of vulnerabilities in application container images, covering both OCI and Docker image formats.
Clair is an open source tool for static analysis of vulnerabilities in application container images, covering both OCI and Docker image formats.Is this a CLI tool or a server I run?It is a server with an API: clients send container images to Clair to be indexed, then query that index to match it against known vulnerabilities, rather than running a single local command.
It is a server with an API: clients send container images to Clair to be indexed, then query that index to match it against known vulnerabilities, rather than running a single local command.How do I get a stable build running?Grab a tagged release rather than building from the main branch, since main can be unstable or broken during active development. A Docker image is also available for running it.
Grab a tagged release rather than building from the main branch, since main can be unstable or broken during active development. A Docker image is also available for running it.Which container image formats can it scan?Clair currently supports indexing and checking both OCI images and Docker images.
Clair currently supports indexing and checking both OCI images and Docker images.Is it safe to deploy straight from the main branch?No - the README explicitly warns the main branch can be unstable or broken during development, so production deployments should use a released version instead.
No - the README explicitly warns the main branch can be unstable or broken during development, so production deployments should use a released version instead.Who would actually run Clair?Teams running container-based infrastructure (Docker/OCI/Kubernetes environments) who want visibility into known vulnerabilities in the images they deploy.
Teams running container-based infrastructure (Docker/OCI/Kubernetes environments) who want visibility into known vulnerabilities in the images they deploy.Why is the project called Clair?Clair is the French word for clear, bright, or transparent, reflecting the project's goal of giving a transparent view into container image vulnerabilities.
Clair is the French word for clear, bright, or transparent, reflecting the project's goal of giving a transparent view into container image vulnerabilities.Where is the full documentation?The README points to 'The book', a separate documentation site covering Clair's architecture and operation, rather than keeping detailed docs in the README itself.
The README points to 'The book', a separate documentation site covering Clair's architecture and operation, rather than keeping detailed docs in the README itself.How does the index-then-match workflow actually work?A client first submits a container image to Clair to be indexed (its contents cataloged), then that index is matched against Clair's vulnerability data to surface known issues.
A client first submits a container image to Clair to be indexed (its contents cataloged), then that index is matched against Clair's vulnerability data to surface known issues.What are similar projects?grype, codex-security, buildkit, VulnHunter, defending-code-reference-harness, podman, distribution, osv-scanner
grype, codex-security, buildkit, VulnHunter, defending-code-reference-harness, podman, distribution, osv-scannerWhich topics is it in?vulnerabilities, oci, devsecops, vulnerability-scanner, containers, static-analysis, cybersecurity, security-tools, kubernetes, rest-api, go, security
vulnerabilities, oci, devsecops, vulnerability-scanner, containers, static-analysis, cybersecurity, security-tools, kubernetes, rest-api, go, security