Clair vs Grype
Clair
clairproject.orgGrype
github.comSide by side
| Figure | Clair | Grype |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 2 |
| Spec score · Container Security Software | 8.0 (#10) | 8.7 (#2) |
| Spec score · Software Composition Analysis Software | 7.9 (#26) | 8.7 (#4) |
| Image formats | Clair supports images built using OCI Distribution or Docker v2 specifications. | The README lists Docker, OCI, and Singularity image format support. |
| License | Clair is licensed under Apache 2.0. | The project is released under the Apache-2.0 License. |
| Purpose | Clair continuously scans container images for vulnerabilities and security problems. | Grype scans container images, filesystems, and SBOMs for known vulnerabilities. |
| Support | The project directs questions to its Google Group and bug reports to GitHub Issues. | Commercial support is offered through Anchore, while community help is routed through issues, contribution documentation and community meetings. |
Plans
In their own words
Clair
Clair is free, self-hosted software that continuously scans container images for vulnerabilities in operating-system bases, installed packages, and programming-language components. Clients use its API to index images and match them against known vulnerabilities. Clair updates its vulnerability database as new issues appear and can reanalyze images without rereading their complete contents. It supports OCI Distribution and Docker v2 images, and lists RHEL, Alpine, Ubuntu, Debian, Oracle, Photon, and SUSE distributions, plus Java, Python, Golang, and Javascript. Deployment options include microservices, monolithic installations, CI pipelines, and disconnected environments. Clair can run as an indexer, matcher, notifier, or combo process. It uses PostgreSQL for persistence and is released as a Quay.io container, with the clairctl command-line tool among its artifacts. Clair runs on Linux, supports registry scanning, and is licensed under Apache 2.0. Runtime protection is not provided.
Grype
Grype is a free, Apache-2.0-licensed scanner for known vulnerabilities in container images, filesystems, and software bills of materials (SBOMs). It can also scan directories, individual files, archives, and packages identified by PURL or CPE. Coverage includes major operating-system package ecosystems and language packages such as Ruby, Java, JavaScript, Python, .NET, Go, PHP, and Rust; supported image formats include Docker, OCI, and Singularity. Grype uses EPSS, KEV, and risk scoring to help prioritize findings. OpenVEX can filter results or add context. Reports can be emitted as a table, JSON, SARIF, or a custom Go template. The project supports SBOM generation and runs on Linux, macOS, Windows, or in a self-hosted setup. Installation options include a Docker image and community packages such as Homebrew, MacPorts, Winget, Scoop, and Snapcraft. Individual package scanning is described as useful for lightweight vulnerability checks and compliance scanning of specific dependencies. Security updates are applied only to the most recent release, and vulnerability-report support is described as best effort.