Repolode
Submit
quay

quay/clair

Clair is an open source static analysis tool that indexes container images and matches them against known vulnerabilities.

View on GitHubWebsite
Stars
11,087
Forks
1,213
Open issues
61
Last commit
3 days ago

What is it?

Clair analyzes application containers for known vulnerabilities through static analysis. Clients send container images to the Clair API, which indexes their contents, then matches the indexed packages against a database of known vulnerabilities.

The project currently supports OCI and Docker container image formats. Its stated goal is to give teams a clearer view of the security posture of container-based infrastructure, and the project name comes from the French word for clear or transparent.

The full architecture and operating documentation is published as a book on the project's homepage. Clair is licensed under Apache 2.0 and is written in Go.

Key features

  • 01Indexes container image contents for analysis via the Clair API.
  • 02Matches indexed packages against known vulnerability data.
  • 03Supports OCI and Docker container image formats.

Use cases

  • Scanning container images in a CI pipeline before deployment.
  • Continuously checking images stored in a container registry for newly disclosed vulnerabilities.
  • Integrating vulnerability checks into Kubernetes or container-based infrastructure.

Quick start

  1. 1

    Read the documentation book for architecture and operation

  2. 2

    Download stable binaries from the releases page

  3. 3

    Contribute following the contribution guide

Things to know

  • The main branch may be unstable or broken, so use releases instead.
  • Setup and operation are documented in an external book rather than the README.

Topics

#container-security#vulnerability-scanning#static-analysis#docker#oci#kubernetes#golang#clair#containers#go

FAQ

What is clair?
Clair is an open source static analysis tool that indexes container images and matches them against known vulnerabilities. Clair analyzes application containers for known vulnerabilities through static analysis. Clients send container images to the Clair API, which indexes their contents, then matches the indexed packages against a database of known vulnerabilities.
Is clair free to use? What license does it have?
clair is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is clair still maintained?
Actively maintained. The last commit to clair was on Nov 4, 2026.
What can I use clair for?
Scanning container images in a CI pipeline before deployment. Continuously checking images stored in a container registry for newly disclosed vulnerabilities. Integrating vulnerability checks into Kubernetes or container-based infrastructure.
How do I install clair?
Read the documentation book for architecture and operation Download stable binaries from the releases page Contribute following the contribution guide
Where can I get clair?
The source code and installation instructions are on GitHub: https://github.com/quay/clair

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects