Skip to content
SPECIFICTION
Get listed

Clair

github.com

Free plan LinuxAPISelf-hosted
Visit github.com
Spec score 8.0 #8 of 29 in Container Image Scanning Tools

What it is

Clair is a free, Apache 2.0-licensed open-source service for static vulnerability analysis of OCI and Docker container images. It runs self-hosted on Linux and exposes an API: clients submit image manifests, Clair indexes their layers, scans image contents, and returns a persisted IndexReport. Analysis examines image contents rather than runtime behavior. Content-addressed OCI manifests and layers help avoid duplicate indexing. Clair continually ingests security data, while matcher requests provide current vulnerability analysis for an IndexReport; its notifier checks indexed manifests when new vulnerabilities appear and follows configured actions. The documented support matrix includes Ubuntu, Debian, RHEL, SUSE, Oracle, Alpine, AWS Linux, VMware Photon, and Python base containers. Clair v4 uses ClairCore as its analysis engine. Release 4.9.0 notes NVD 2.0 JSON feeds for CVSS enrichment and SPDX 2.3 encoding for index reports. The README lists a mailing list, IRC channel, and GitHub issues for community contact, and directs users to releases because the main branch may be unstable or broken. The listed plan is free.

Spec sheet

Purpose
Clair is an open source project for static analysis of vulnerabilities in application containers, including OCI and Docker images.Read 4 Oct 2026 · github.com
Support
The project README lists a mailing list, an IRC channel, and GitHub issues as community contact options.Read 4 Oct 2026 · github.com
License
The project is licensed under Apache 2.0.Read 4 Oct 2026 · github.com
Analysis mode
Clair parses image contents and reports vulnerabilities using static analysis rather than runtime analysis.Read 4 Oct 2026 · quay.github.io
Current vulnerability data
Clair continually ingests security data, and matcher requests provide up-to-date vulnerability analysis for an IndexReport.Read 4 Oct 2026 · quay.github.io
Deduplication
Clair uses content-addressed OCI manifests and layers to reduce duplicated indexing work.Read 4 Oct 2026 · quay.github.io
Engine
Clair v4 uses the ClairCore library as its engine for examining image contents and reporting vulnerabilities.Read 4 Oct 2026 · quay.github.io
Indexing
Clair fetches image layers, scans their contents, and returns a persisted IndexReport.Read 4 Oct 2026 · quay.github.io
Notifications
The notifier checks whether newly discovered vulnerabilities affect indexed manifests and acts according to its configuration.Read 4 Oct 2026 · quay.github.io
Output format
The v4.9.0 release notes state that ClairCore can encode index reports as SPDX 2.3 documents.Read 4 Oct 2026 · github.com
Security data update
The v4.9.0 release notes state that ClairCore switched to NVD 2.0 JSON feeds for CVSS enrichment data.Read 4 Oct 2026 · github.com
Stable builds
The README warns that the main branch may be unstable or broken and directs users to releases for stable binaries.Read 4 Oct 2026 · github.com
Supported image contents
The documented support matrix lists Ubuntu, Debian, RHEL, SUSE, Oracle, Alpine, AWS Linux, VMware Photon, and Python base containers.Read 4 Oct 2026 · quay.github.io
Workflow
Clients submit container image manifests to the Clair API for indexing and vulnerability matching.Read 4 Oct 2026 · github.com

Plans and prices

Clair Free Open source · self-hosted container vulnerability analysis Read 4 Oct 2026 · github.com

Every Clair plan and price →

Strong points and limits

Strong points

  • Free Apache 2.0 open-source license
  • Self-hosted Linux deployment with API access
  • Static analysis for OCI and Docker images
  • Persisted reports and vulnerability notifications
  • SPDX 2.3 index-report encoding

Limits

  • Main branch may be unstable or broken
  • Requires self-hosted deployment
  • Analysis covers documented image contents only

Who it suits

Security and platform teams that can operate self-hosted Linux services and need API-based container image vulnerability analysis. It fits users working with supported image contents and open-source tooling.

Verdict

Clair provides a focused, self-hosted workflow for indexing container images and matching vulnerabilities. Its open license, API, notifications, and report formats suit teams managing their own security infrastructure.

Where Specifiction places it

Alternatives to ClairAll alternatives →