Clair
Clair is a free, open-source project for finding vulnerabilities in application container images, including OCI and Docker images.
What Clair is
Clair is a free, open-source project for finding vulnerabilities in application container images, including OCI and Docker images. It performs static analysis: clients send image manifests to the Clair API, which indexes image layers, scans their contents and returns a persisted IndexReport. It does not analyze runtime behavior. Content-addressed OCI manifests and layers help limit repeated indexing work. Clair continually ingests security information, and matcher requests provide current vulnerability analysis for an IndexReport. Its notifier checks whether newly identified vulnerabilities affect indexed manifests and responds according to its configuration. The documented support matrix includes Ubuntu, Debian, RHEL, SUSE, Oracle, Alpine, AWS Linux, VMware Photon and Python base containers. Clair v4 uses ClairCore to examine image contents and report vulnerabilities. Release notes for v4.9.0 describe NVD 2.0 JSON feeds for CVSS enrichment and support for encoding index reports as SPDX 2.3 documents. Clair is licensed under Apache 2.0 and deployed self-hosted. The README warns that the main branch may be unstable or broken and points users to releases for stable binaries. Community contact options include a mailing list, IRC channel and GitHub issues.
Good
- Free and licensed under Apache 2.0.
- Scans image layers through a static analysis workflow.
- Content-addressed layers help reduce duplicate indexing.
- Supports SPDX 2.3 index report encoding.
- Community support includes GitHub issues.
Watch out
- Analysis covers image contents, not runtime behavior.
- The main branch may be unstable or broken.
- Stable binaries are directed to project releases.
Who it suits
Clair is for teams that need self-hosted static vulnerability analysis for container images. Its API workflow and documented image support are relevant to users managing OCI or Docker images.
Verdict
Clair offers self-hosted container image analysis with an API-based indexing workflow and ongoing vulnerability data ingestion. Users seeking stable binaries should follow the project's release guidance rather than assume the main branch is stable.
Plans and prices
From Clair's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Clair | Free | Open source · self-hosted container vulnerability analysis |
The facts
Each one read from Clair's own pages, with the date it was checked.
What it does
- Analysis mode
- Clair parses image contents and reports vulnerabilities using static analysis rather than runtime analysis.checked 4 Oct 2026
- Current vulnerability data
- Clair continually ingests security data, and matcher requests provide up-to-date vulnerability analysis for an IndexReport.checked 4 Oct 2026
- Deduplication
- Clair uses content-addressed OCI manifests and layers to reduce duplicated indexing work.checked 4 Oct 2026
- Engine
- Clair v4 uses the ClairCore library as its engine for examining image contents and reporting vulnerabilities.checked 4 Oct 2026
- Indexing
- Clair fetches image layers, scans their contents, and returns a persisted IndexReport.checked 4 Oct 2026
- License
- The project is licensed under Apache 2.0.checked 4 Oct 2026
- Notifications
- The notifier checks whether newly discovered vulnerabilities affect indexed manifests and acts according to its configuration.checked 4 Oct 2026
- Output format
- The v4.9.0 release notes state that ClairCore can encode index reports as SPDX 2.3 documents.checked 4 Oct 2026
- Purpose
- Clair is an open source project for static analysis of vulnerabilities in application containers, including OCI and Docker images.checked 4 Oct 2026
- Security data update
- The v4.9.0 release notes state that ClairCore switched to NVD 2.0 JSON feeds for CVSS enrichment data.checked 4 Oct 2026
- Stable builds
- The README warns that the main branch may be unstable or broken and directs users to releases for stable binaries.checked 4 Oct 2026
- Support
- The project README lists a mailing list, an IRC channel, and GitHub issues as community contact options.checked 4 Oct 2026
- Supported image contents
- The documented support matrix lists Ubuntu, Debian, RHEL, SUSE, Oracle, Alpine, AWS Linux, VMware Photon, and Python base containers.checked 4 Oct 2026
- Workflow
- Clients submit container image manifests to the Clair API for indexing and vulnerability matching.checked 4 Oct 2026
Alternatives to Clair
- 1
Mondoo CSPM
Free planOpen sourceWebAPIExtensionLinux7.7Free plan - 2
Grype
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.4Free plan - 3
Sysdig Secure
WebAPILinuxmacOS7.2From $20 a month - 4
Alibaba Cloud Container Registry
Free planWebAPILinuxWindows7.1Free plan - 5
Trivy
Free planLinuxmacOSSelf-hostedWindows7.0Free plan - 6
ZeroPath
WebAPILinuxmacOS6.5From $1,000 a month