Skip to content
SPECIFICTION
Get listed

Clair

clairproject.org

Free plan LinuxAPISelf-hosted
Visit clairproject.org
Spec score 8.0 #10 of 26 in Container Security Software

What it is

Clair is free, self-hosted software that continuously scans container images for vulnerabilities in operating-system bases, installed packages, and programming-language components. Clients use its API to index images and match them against known vulnerabilities. Clair updates its vulnerability database as new issues appear and can reanalyze images without rereading their complete contents. It supports OCI Distribution and Docker v2 images, and lists RHEL, Alpine, Ubuntu, Debian, Oracle, Photon, and SUSE distributions, plus Java, Python, Golang, and Javascript. Deployment options include microservices, monolithic installations, CI pipelines, and disconnected environments. Clair can run as an indexer, matcher, notifier, or combo process. It uses PostgreSQL for persistence and is released as a Quay.io container, with the clairctl command-line tool among its artifacts. Clair runs on Linux, supports registry scanning, and is licensed under Apache 2.0. Runtime protection is not provided.

Spec sheet

Purpose
Clair continuously scans container images for vulnerabilities and security problems.Read 7 Oct 2026 · clairproject.org
Deployment
Clair supports microservice, monolithic, CI pipeline, and disconnected deployment methods.Read 7 Oct 2026 · clairproject.org
API
Clients use the Clair API to index container images and match them against known vulnerabilities.Read 7 Oct 2026 · github.com
Support
The project directs questions to its Google Group and bug reports to GitHub Issues.Read 7 Oct 2026 · clairproject.org
License
Clair is licensed under Apache 2.0.Read 7 Oct 2026 · github.com
Analysis
Clair analyzes container images for vulnerabilities in base operating systems, installed packages, and programming languages.Read 7 Oct 2026 · clairproject.org
Architecture
Clair can run in indexer, matcher, notifier, or combo mode, with combo mode running everything in one OS process.Read 7 Oct 2026 · quay.github.io
Continuous updates
Clair updates its vulnerability database as new vulnerabilities are published and can reanalyze images without rereading their entire contents.Read 7 Oct 2026 · clairproject.org
Database requirement
Clair uses PostgreSQL for data persistence.Read 7 Oct 2026 · quay.github.io
Distribution
The project says Clair is officially released as a container on Quay.io and its release artifacts include the clairctl command line tool.Read 7 Oct 2026 · quay.github.io
Image formats
Clair supports images built using OCI Distribution or Docker v2 specifications.Read 7 Oct 2026 · clairproject.org
Supported content
The project lists RHEL, Alpine, Ubuntu, Debian, Oracle, Photon, and SUSE distributions, plus Java, Python, Golang, and Javascript.Read 7 Oct 2026 · clairproject.org

Plans and prices

Free and Open Source Free Apache 2.0 license Read 7 Oct 2026 · clairproject.org

Every Clair plan and price →

Strong points and limits

Strong points

  • Free Apache 2.0-licensed software
  • Continuously updated vulnerability database
  • Supports multiple deployment methods
  • OCI and Docker v2 image support
  • API and clairctl access

Limits

  • Requires self-hosted deployment
  • Uses PostgreSQL for persistence
  • No runtime protection
  • Linux platform only

Who it suits

It suits teams that need self-hosted container image and registry vulnerability scanning through an API or CI deployment. Linux environments and PostgreSQL are part of its deployment requirements.

Verdict

Clair focuses on image vulnerability analysis with flexible deployment modes, supported distributions, and language ecosystems. It provides scanning rather than runtime protection and requires teams to operate the service themselves.

Where Specifiction places it

Alternatives to ClairAll alternatives →