Clair
Clair is a free, open-source service that scans container images for vulnerabilities in base operating systems, installed packages, and programming language …
What Clair is
Clair is a free, open-source service that scans container images for vulnerabilities in base operating systems, installed packages, and programming language components. Clients use its API to index images and match them against known vulnerabilities. Clair refreshes its vulnerability database as new issues are published and can recheck images without reading all their contents again. It supports OCI Distribution and Docker v2 images, with listed operating systems including RHEL, Alpine, Ubuntu, Debian, Oracle, Photon, and SUSE. Supported language ecosystems include Java, Python, Golang, and Javascript. Deployment options include microservices, monolithic setups, CI pipelines, and disconnected environments. Clair can run as an indexer, matcher, notifier, or combo, with combo mode placing all functions in one operating system process. It uses PostgreSQL for persistence and is released as a container on Quay.io; release artifacts include the clairctl command-line tool. Clair is self-hosted, supports Linux and API use, and is licensed under Apache 2.0. It supports image and registry scanning, but not runtime protection.
Good
- Free under the Apache 2.0 license.
- Updates vulnerability data as new issues appear.
- Supports OCI Distribution and Docker v2 images.
- Offers several deployment and operating modes.
Watch out
- Does not provide runtime protection.
- Requires PostgreSQL for data persistence.
- Self-hosted deployment is required.
Who it suits
Clair suits teams that need to scan container images or registries for known vulnerabilities and can operate a self-hosted service. Its deployment choices include CI pipelines and disconnected environments.
Verdict
Clair provides container image and registry scanning with multiple deployment options and a continuously updated vulnerability database. It is a self-hosted scanner, not a runtime protection tool.
Plans and prices
From Clair's own pricing page, checked 7 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Free and Open Source | Free | Apache 2.0 license |
The facts
Each one read from Clair's own pages, with the date it was checked.
What it does
- Analysis
- Clair analyzes container images for vulnerabilities in base operating systems, installed packages, and programming languages.checked 7 Oct 2026
- API
- Clients use the Clair API to index container images and match them against known vulnerabilities.checked 7 Oct 2026
- Architecture
- Clair can run in indexer, matcher, notifier, or combo mode, with combo mode running everything in one OS process.checked 7 Oct 2026
- Continuous updates
- Clair updates its vulnerability database as new vulnerabilities are published and can reanalyze images without rereading their entire contents.checked 7 Oct 2026
- Database requirement
- Clair uses PostgreSQL for data persistence.checked 7 Oct 2026
- Deployment
- Clair supports microservice, monolithic, CI pipeline, and disconnected deployment methods.checked 7 Oct 2026
- Distribution
- The project says Clair is officially released as a container on Quay.io and its release artifacts include the clairctl command line tool.checked 7 Oct 2026
- Image formats
- Clair supports images built using OCI Distribution or Docker v2 specifications.checked 7 Oct 2026
- License
- Clair is licensed under Apache 2.0.checked 7 Oct 2026
- Purpose
- Clair continuously scans container images for vulnerabilities and security problems.checked 7 Oct 2026
- Support
- The project directs questions to its Google Group and bug reports to GitHub Issues.checked 7 Oct 2026
- Supported content
- The project lists RHEL, Alpine, Ubuntu, Debian, Oracle, Photon, and SUSE distributions, plus Java, Python, Golang, and Javascript.checked 7 Oct 2026
Alternatives to Clair
- 1
DeepFilterNet
Free planOpen sourceAPILinuxmacOSSelf-hosted7.6Free plan - 2
Endor Labs
Free planWebAPIExtensionLinux7.4Free plan - 3
Grype
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.4Free plan - 4
Scantist
Free planWebAPISelf-hosted7.3$200 one-time - 5
Snyk Open Source
Free planWebAPILinuxmacOS7.3From $25 a month - 6
Socket
Free planWebAPIExtensionLinux7.2From $25 a month