Clair
What it is
Clair is free, open source software that continuously scans container images for vulnerabilities and security problems. It analyzes base operating systems, installed packages and programming-language components, then matches images against known issues through its API. Clair updates its vulnerability database as new vulnerabilities appear and can reanalyze images without rereading their complete contents. It supports OCI Distribution and Docker v2 image specifications, with listed coverage for RHEL, Alpine, Ubuntu, Debian, Oracle, Photon and SUSE. Supported language ecosystems include Java, Python, Golang and Javascript. Deployment options include microservices, a monolithic service, CI pipelines and disconnected environments. Clair can operate as an indexer, matcher, notifier or combo process that runs all functions together. It uses PostgreSQL for persistence, is distributed as a container on Quay.io and includes the clairctl command-line tool in release artifacts. Clair is licensed under Apache 2.0 and supports self-hosted Linux and API deployments.
For and against
For
- Continuously updates vulnerability data
- Scans operating systems, packages and languages
- Supports several deployment architectures
- Works with OCI and Docker v2 images
- Free under Apache 2.0
Against
- Requires PostgreSQL for persistence
- Self-hosted deployment requires operational management
- Provides no runtime protection
- Coverage is limited to listed ecosystems
The verdict
Clair offers flexible, continuously updated image vulnerability scanning for self-hosted environments. Its lack of runtime protection means it addresses image analysis rather than runtime defense.
Who it suits
Clair suits teams that need self-hosted container image and registry scanning. It is intended for workflows using supported distributions, languages and OCI or Docker v2 images.
Plans and prices
Free and Open Source
Apache 2.0 license
Read 7 Oct 2026 · clairproject.org
On the record
- Analysis
- Clair analyzes container images for vulnerabilities in base operating systems, installed packages, and programming languages.clairproject.org · read 7 Oct 2026
- API
- Clients use the Clair API to index container images and match them against known vulnerabilities.github.com · read 7 Oct 2026
- Architecture
- Clair can run in indexer, matcher, notifier, or combo mode, with combo mode running everything in one OS process.quay.github.io · read 7 Oct 2026
- Continuous updates
- Clair updates its vulnerability database as new vulnerabilities are published and can reanalyze images without rereading their entire contents.clairproject.org · read 7 Oct 2026
- Database requirement
- Clair uses PostgreSQL for data persistence.quay.github.io · read 7 Oct 2026
- Deployment
- Clair supports microservice, monolithic, CI pipeline, and disconnected deployment methods.clairproject.org · read 7 Oct 2026
- Distribution
- The project says Clair is officially released as a container on Quay.io and its release artifacts include the clairctl command line tool.quay.github.io · read 7 Oct 2026
- Image formats
- Clair supports images built using OCI Distribution or Docker v2 specifications.clairproject.org · read 7 Oct 2026
- License
- Clair is licensed under Apache 2.0.github.com · read 7 Oct 2026
- Purpose
- Clair continuously scans container images for vulnerabilities and security problems.clairproject.org · read 7 Oct 2026
- Support
- The project directs questions to its Google Group and bug reports to GitHub Issues.clairproject.org · read 7 Oct 2026
- Supported content
- The project lists RHEL, Alpine, Ubuntu, Debian, Oracle, Photon, and SUSE distributions, plus Java, Python, Golang, and Javascript.clairproject.org · read 7 Oct 2026
