Clair
By Red Hat / Project Quay
Clair is an open-source vulnerability scanning service that analyzes container images layer by layer, indexing the packages present in each layer and matching them against vulnerability data sources to report known security issues. It runs…
Definition
Clair is an open-source vulnerability scanning service that analyzes container images layer by layer, indexing the packages present in each layer and matching them against vulnerability data sources to report known security issues. It runs as a standalone service with its own database, most commonly embedded into container registries such as Quay to automatically scan images as they are pushed. Organizations running their own container registries use it to surface vulnerability information to developers before images are deployed.
Overview
Clair was built to give container registries a way to automatically report on the security posture of images stored within them, addressing the problem that a container image is typically an opaque bundle of layers whose contents a user cannot easily audit without pulling and inspecting it manually. By running as a registry-integrated service, Clair lets a registry surface vulnerability findings directly alongside an image, without requiring the image consumer to run a separate scan themselves. Mechanically, Clair processes a container image layer by layer, extracting the list of installed packages introduced at each layer and storing that data in its own persistent database. It separately ingests vulnerability data from multiple upstream sources covering different operating system distributions and language ecosystems, and matches indexed packages against known vulnerabilities, exposing the results through an API that a registry or other client can query. Because indexing happens once per layer and results are cached, Clair can efficiently report on many images that share common base layers without redundant work. Compared to Trivy, Clair requires running a dedicated service with a database rather than invoking a single self-contained binary, which makes it a heavier deployment but well suited to being embedded as infrastructure within a registry rather than run ad hoc from a workstation or CI job. Trivy's broader scope, covering IaC files, repositories, and secrets in addition to images, is not something Clair addresses; Clair's focus remains specifically on container image vulnerability data. In practice, Clair is most visible as the scanning engine behind Red Hat's Quay container registry, where pushed images are automatically scanned and vulnerability reports appear in the registry's UI for developers to review before deploying an image. Organizations building or operating their own container registry infrastructure, particularly in regulated or air-gapped environments, adopt Clair to get vulnerability visibility integrated at the registry layer rather than bolted on as a separate pipeline step. Limitations include the operational overhead of running Clair's service and database compared to simpler standalone scanners, and its narrower scope relative to newer multi-purpose scanners. Teams that want a lightweight scanner usable directly in CI pipelines or on local images without registry integration often find Trivy or Grype a simpler fit, reserving Clair for cases where deep registry integration is the specific requirement. Clair's layer-caching design also means that organizations standardizing on a small set of approved base images benefit disproportionately, since the bulk of vulnerability analysis for those shared layers only needs to happen once rather than being repeated for every derived image. This makes it a natural fit for enterprises that already enforce a curated set of golden base images through their registry, where Clair's per-layer indexing model pays off most clearly.
Key Features
- Scans container images layer by layer for known vulnerabilities
- Runs as a standalone service backed by a persistent database
- Ingests vulnerability data from multiple upstream sources
- Integrates natively with the Quay container registry
- Caches layer analysis to avoid redundant scanning of shared bases
- Exposes vulnerability results through a queryable API
- Focuses specifically on container image vulnerability data
- Suited to registry-level automated scanning at image push time