Specifiction
For vendors
AdvertiseTop spots, featured rows, home sponsor Get listedAdd a product we don't cover yet Claim a listingFree: verify the domain, then correct your page Vendor dashboardNumbers, orders and placements
List your tool
Vendor dashboard
Tech riderRev. 4 Oct 2026

Clair

Ch 136.7of 28 Container Image Scanning Tools
  1. 1Runs onAPI, Linux, self-hosted
  2. 2CostsFree plan
  3. 3Deployment modelself hosted
  4. 4Registry scanningYes
  5. 5SBOM generationYes
5 lines stated Written from the maker's own pages: github.com
Visit site Alternatives
The Clair homepage

Overview

Clair is ranked #13 of 28 in container image scanning tools on Specifiction. It runs on API, Linux, Self-hosted. There is a free plan.

Clair plans and pricing

All plans
Clair Free Open source · self-hosted container vulnerability analysis github.com · 4 Oct 2026

Compared on container image scanning tools

Free plan
Yesgithub.com
Deployment model
self_hostedgithub.com
Registry scanning
Yesgithub.com
SBOM generation
Yesgithub.com

Facts

Purpose
Clair is an open source project for static analysis of vulnerabilities in application containers, including OCI and Docker images.github.com · 4 Oct 2026
Analysis mode
Clair parses image contents and reports vulnerabilities using static analysis rather than runtime analysis.quay.github.io · 4 Oct 2026
Workflow
Clients submit container image manifests to the Clair API for indexing and vulnerability matching.github.com · 4 Oct 2026
Indexing
Clair fetches image layers, scans their contents, and returns a persisted IndexReport.quay.github.io · 4 Oct 2026
Deduplication
Clair uses content-addressed OCI manifests and layers to reduce duplicated indexing work.quay.github.io · 4 Oct 2026
Current vulnerability data
Clair continually ingests security data, and matcher requests provide up-to-date vulnerability analysis for an IndexReport.quay.github.io · 4 Oct 2026
Notifications
The notifier checks whether newly discovered vulnerabilities affect indexed manifests and acts according to its configuration.quay.github.io · 4 Oct 2026
Supported image contents
The documented support matrix lists Ubuntu, Debian, RHEL, SUSE, Oracle, Alpine, AWS Linux, VMware Photon, and Python base containers.quay.github.io · 4 Oct 2026
Engine
Clair v4 uses the ClairCore library as its engine for examining image contents and reporting vulnerabilities.quay.github.io · 4 Oct 2026
Security data update
The v4.9.0 release notes state that ClairCore switched to NVD 2.0 JSON feeds for CVSS enrichment data.github.com · 4 Oct 2026
Output format
The v4.9.0 release notes state that ClairCore can encode index reports as SPDX 2.3 documents.github.com · 4 Oct 2026
License
The project is licensed under Apache 2.0.github.com · 4 Oct 2026
Support
The project README lists a mailing list, an IRC channel, and GitHub issues as community contact options.github.com · 4 Oct 2026
Stable builds
The README warns that the main branch may be unstable or broken and directs users to releases for stable binaries.github.com · 4 Oct 2026

Best Clair alternatives

See all 20
All accessCh 01 Qualys External Attack Surface Management Free trialAPILinux 7.6 All accessCh 02 Snyk Open Source Free planAPILinux from $25/mo7.6 All accessCh 03 Docker Desktop Free planLinuxMac from $9/mo7.5 All accessCh 04 Mondoo CSPM Free planAPILinux Free to start7.4 All accessCh 05 Aqua Container Security Free trialLinuxself-hosted 7.3 All accessCh 06 CrowdStrike Falcon Surface Free trialLinuxMac 7.3

Where it ranks on Specifiction

Is Clair yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Clair

Sources