Clair
5.9#42 in software composition analysis softwareFree planFree planAPILinuxSelf-hosted
VisitClair vs Grype
Grype
7.4#3 in software composition analysis softwareFree planFree planLinuxmacOSSelf-hostedWindows
VisitWhat both publish
| Fact | Clair | Grype |
|---|---|---|
| Image formats | Clair supports images built using OCI Distribution or Docker v2 specifications. | The README lists Docker, OCI, and Singularity image format support. |
| License | Clair is licensed under Apache 2.0. | The project is released under the Apache-2.0 License. |
| Purpose | Clair continuously scans container images for vulnerabilities and security problems. | Grype scans container images, filesystems, and SBOMs for known vulnerabilities. |
Clair plans
- Free and Open SourceFree
Grype plans
- GrypeFree
- Grype open-source scannerFree
Pick Clair if…
Clair suits teams that need to scan container images or registries for known vulnerabilities and can operate a self-hosted service. Its deployment choices include CI pipelines and disconnected environments.
Pick Grype if…
Grype suits developers and teams checking packages, images, filesystems, or SBOMs for known vulnerabilities. Its individual-package scanning is also intended for lightweight checks and compliance reviews of specific dependencies.