Anchore
By Anchore, Inc.
Anchore is a container image security analysis platform that inspects container images for known vulnerabilities, license issues, and policy violations before and after deployment. It generates a software bill of materials for each image…
Definition
Anchore is a container image security analysis platform that inspects container images for known vulnerabilities, license issues, and policy violations before and after deployment. It generates a software bill of materials for each image and evaluates that inventory against configurable rules, letting teams block noncompliant images from reaching a registry or a Kubernetes cluster. Anchore ships both as an open-source engine and as a commercial enterprise product with dashboards and reporting.
Overview
Container images bundle an application together with an operating system layer, language runtimes, and third-party libraries, and any of those layers can carry a known vulnerability or a license that conflicts with an organization's policy. Anchore addresses this by unpacking an image, cataloging every package and file it contains, and comparing that catalog against vulnerability feeds and user-defined rules, producing a pass/fail verdict rather than just a list of findings. Mechanically, Anchore's engine pulls an image, decomposes its layers, and builds a detailed inventory of operating system packages, language-specific dependencies, and configuration files. This inventory, structured as a software bill of materials, is then evaluated by a policy engine that checks conditions such as maximum allowed vulnerability severity, presence of prohibited packages, or use of a disallowed base image. The result is a structured report that a continuous integration pipeline can use as a gate, failing the build if the policy is not satisfied. Anchore sits in the same space as scanners like Trivy and Snyk, but it distinguishes itself by treating policy evaluation as a first-class, queryable object rather than an afterthought layered on top of scan output. Where a simpler scanner returns a vulnerability list and leaves interpretation to the user, Anchore's policy bundles let teams codify what 'acceptable' means for their organization and apply it consistently across every image. It also predates many newer entrants, having been one of the earlier dedicated container security platforms built around a persistent catalog rather than a stateless scan. In practice, teams wire Anchore into continuous integration pipelines so every image build is scanned automatically before it can be pushed to a registry, and into admission control at the cluster level so noncompliant images cannot be deployed even if they slip past the pipeline. Security and compliance teams use its reporting to track vulnerability trends across an entire image fleet over time, and the software bill of materials output feeds into broader supply-chain risk programs. Anchore's thoroughness comes with overhead: full image decomposition and policy evaluation take longer than a lightweight scan, and maintaining an accurate, low-noise policy set requires ongoing tuning as base images and dependencies change. Organizations that only need a quick vulnerability count for a single pipeline step may find a lighter scanner sufficient, while those that need auditable, organization-wide policy enforcement and historical reporting are the better fit for Anchore's model. Choosing Anchore over a lighter alternative is ultimately a bet that codified policy and long-term visibility will save more time than they cost in setup, and that bet tends to pay off once an organization is managing more images than a handful of engineers can review by eye.
Key Features
- Generates a detailed software bill of materials for every scanned container image
- Evaluates images against configurable policy bundles rather than raw vulnerability lists
- Integrates with CI pipelines to gate image builds before registry push
- Supports Kubernetes admission control to block noncompliant images at deploy time
- Tracks vulnerability and compliance trends across an image fleet over time
- Offers both an open-source engine and a commercial enterprise edition
- Detects license compliance issues alongside security vulnerabilities