coreos/clair
Clair
Clair is a container vulnerability scanner that performs static analysis of container images to identify known security vulnerabilities. It functions as an analyzer for OCI and Docker images, indexing their contents to detect security risks and outdated packages without requiring the containers to be running.
The tool identifies vulnerabilities by matching indexed container components against security databases to find common vulnerabilities and exposures. This process involves analyzing filesystem layers to track the provenance and versioning of packages across the image hierarchy.
The project provides capabilities for container security auditing and image security analysis, enabling the automation of vulnerability detection within development and deployment pipelines. This includes the extraction of package metadata from image layers to create searchable inventories for security audits.
Features
- Container Security Scanners - Provides a comprehensive container security scanner to identify vulnerabilities and generate software bills of materials.
- Security and Vulnerability Scanning - Matches container components against vulnerability databases to detect security flaws and supply chain risks.
- Image Layer Analyzers - Parses and decomposes container image manifests to inspect individual filesystem layers for package provenance.
- Container Image Analyzers - Analyzes the internal layer structure of OCI and Docker images to create searchable content indexes.
- Component Indexing - Extracts package versions and metadata from container layers to create a searchable inventory for audits.
- Container Security - Provides tools for auditing container environments to track potential threats and ensure compliance.
- Vulnerability Databases - Cross-references container components against known vulnerability databases to identify security risks.
- Image Vulnerability Assessments - Performs security assessments on container images by analyzing layers and packages against vulnerability IDs.
- Vulnerability Scanning - Performs proactive vulnerability scanning on container images to identify outdated or insecure packages.
- DevSecOps and Automation - Enables the automation of vulnerability detection within CI/CD development and deployment pipelines.
- Asynchronous Scanning Pipelines - Implements a multi-stage asynchronous pipeline to handle large-scale container security audits efficiently.
- CVE Mapping - Links specific package versions to CVE identifiers using a structured database schema for fast retrieval.
- Container Security - Static analysis for identifying vulnerabilities in container images.
- Infrastructure and Configuration - Static analysis for container vulnerabilities.
