Clair
What it is
Clair is a free, open-source project for static vulnerability analysis of application containers, including OCI and Docker images. Clients submit image manifests to its API for indexing and vulnerability matching. Clair retrieves image layers, scans their contents and returns a stored IndexReport; it analyzes image contents rather than runtime behavior. Content-addressed OCI manifests and layers help reduce repeated indexing. Clair continually ingests security data, and matcher requests provide current vulnerability analysis for an IndexReport. Its notifier checks indexed manifests for newly discovered vulnerabilities and acts according to its configuration. Documented image contents include Ubuntu, Debian, RHEL, SUSE, Oracle, Alpine, AWS Linux, VMware Photon and Python base containers. Clair v4 uses ClairCore as its analysis engine. Release notes for v4.9.0 state that ClairCore switched to NVD 2.0 JSON feeds for CVSS enrichment and can encode index reports as SPDX 2.3 documents. Clair is self-hosted on Linux and licensed under Apache 2.0. The project lists a mailing list, IRC channel and GitHub issues for community contact. Its README advises using releases for stable binaries because the main branch may be unstable or broken.
For and against
For
- Free and licensed under Apache 2.0.
- Supports OCI and Docker image analysis.
- Reduces repeated indexing with content-addressed layers.
- Can encode index reports as SPDX 2.3 documents.
- Provides mailing list, IRC and GitHub issue contacts.
Against
- Self-hosted deployment is required.
- Analysis is static, not runtime-based.
- The main branch may be unstable or broken.
The verdict
Clair provides container vulnerability analysis through a self-hosted API, with indexing, matching and notification functions. Use release builds rather than the main branch if stable binaries are needed.
Who it suits
Clair suits teams that need self-hosted, API-based static vulnerability analysis for container images. It may also fit teams that want index reports encoded as SPDX 2.3 documents.
Plans and prices
Clair
Open source · self-hosted container vulnerability analysis
Read 4 Oct 2026 · github.com
On the record
- Analysis mode
- Clair parses image contents and reports vulnerabilities using static analysis rather than runtime analysis.quay.github.io · read 4 Oct 2026
- Current vulnerability data
- Clair continually ingests security data, and matcher requests provide up-to-date vulnerability analysis for an IndexReport.quay.github.io · read 4 Oct 2026
- Deduplication
- Clair uses content-addressed OCI manifests and layers to reduce duplicated indexing work.quay.github.io · read 4 Oct 2026
- Engine
- Clair v4 uses the ClairCore library as its engine for examining image contents and reporting vulnerabilities.quay.github.io · read 4 Oct 2026
- Indexing
- Clair fetches image layers, scans their contents, and returns a persisted IndexReport.quay.github.io · read 4 Oct 2026
- License
- The project is licensed under Apache 2.0.github.com · read 4 Oct 2026
- Notifications
- The notifier checks whether newly discovered vulnerabilities affect indexed manifests and acts according to its configuration.quay.github.io · read 4 Oct 2026
- Output format
- The v4.9.0 release notes state that ClairCore can encode index reports as SPDX 2.3 documents.github.com · read 4 Oct 2026
- Purpose
- Clair is an open source project for static analysis of vulnerabilities in application containers, including OCI and Docker images.github.com · read 4 Oct 2026
- Security data update
- The v4.9.0 release notes state that ClairCore switched to NVD 2.0 JSON feeds for CVSS enrichment data.github.com · read 4 Oct 2026
- Stable builds
- The README warns that the main branch may be unstable or broken and directs users to releases for stable binaries.github.com · read 4 Oct 2026
- Support
- The project README lists a mailing list, an IRC channel, and GitHub issues as community contact options.github.com · read 4 Oct 2026
- Supported image contents
- The documented support matrix lists Ubuntu, Debian, RHEL, SUSE, Oracle, Alpine, AWS Linux, VMware Photon, and Python base containers.quay.github.io · read 4 Oct 2026
- Workflow
- Clients submit container image manifests to the Clair API for indexing and vulnerability matching.github.com · read 4 Oct 2026
