Clair

Visit Website

Introduction

Clair performs static analysis of vulnerabilities in application containers. Images are indexed into their component layers and packages, then matched against vulnerability data. It is part of the Quay project and is designed to run as a service that registries and pipelines call through an API.

The source code is at quay/clair on GitHub under the Apache-2.0 licence, with about 11,100 stars; the most recent commit was on 10 November 2026.

Features

1. Layer indexing: Breaks images into packages.
2. Matcher service: Matches against vulnerability data.
3. API-driven: Integrates with registries such as Quay.
4. Notifications: Alert when new vulnerabilities affect indexed images.
5. Scalable deployment: Run as separate indexer, matcher and notifier services.

Pros

1. Free to use: Open source under Apache-2.0.
2. Maintained: Commits as recent as 10 November 2026.
3. Community: About 11,100 GitHub stars.

Cons

1. Service to operate: More setup than a single-binary scanner.
2. Integration needed: Usually consumed via a registry or client.

Usage and Links (Example)

Deploy Clair (see the docs for combined or distributed modes), then submit image manifests through its API or use the clairctl client to request a report.

Resources:

• Clair website
• GitHub repository

Pricing

Clair is free and open source under the Apache-2.0 licence.

Recommended for?

1. Registry operators adding image scanning.
2. Platform teams wanting a scanning service.
3. Not a fit for quick local scans; use Trivy or Grype.

Conclusion

Clair is a mature, service-based container vulnerability scanner from the Quay project.