Clair vs Dockle

Clair is free, self-hosted software that continuously scans container images for vulnerabilities in operating-system bases, installed packages, and programming-language components. Clients use its API to index images and match them against known vulnerabilities. Clair updates its vulnerability database as new issues appear and can reanalyze images without rereading their complete contents. It supports OCI Distribution and Docker v2 images, and lists RHEL, Alpine, Ubuntu, Debian, Oracle, Photon, and SUSE distributions, plus Java, Python, Golang, and Javascript. Deployment options include microservices, monolithic installations, CI pipelines, and disconnected environments. Clair can run as an indexer, matcher, notifier, or combo process. It uses PostgreSQL for persistence and is released as a Quay.io container, with the clairctl command-line tool among its artifacts. Clair runs on Linux, supports registry scanning, and is licensed under Apache 2.0. Runtime protection is not provided.

Dockle is a free, self-hosted container image linter focused on security and Docker best practices. It scans images for vulnerabilities and checks settings against CIS Docker Image Benchmarks, along with Docker- and Linux-specific issues such as empty passwords and duplicate user or group IDs. Results can be displayed or saved in JSON and SARIF formats. Users can set an exit level and ignore selected checkpoints through command options, environment variables, or a .dockleignore file. The project documents continuous-integration use and provides a GitHub Action, with examples for Travis CI, CircleCI, and GitLab CI. Dockle can access private images in Docker Hub, Amazon ECR, Google Container Registry, and self-hosted registries. It can also scan an image archive created with docker save by using the --input option. Installation routes include Homebrew, Linux distribution packages, Windows binaries, version managers, source builds, and Docker. Dockle runs on Linux, macOS, and Windows and is listed under the Apache-2.0 license.