Clair is a free, open-source tool that statically scans container images for known vulnerabilities, powering security checks for registries like Quay.
Clair is a free, open-source vulnerability scanner for container images. It was first announced by CoreOS in November 2015 and is now maintained as Project Clair, primarily developed within the quay/clair GitHub organization under Red Hat's stewardship after Red Hat's 2018 acquisition of CoreOS.
Clair performs static analysis: it inspects the packages and libraries inside a container image and checks them against continuously updated vulnerability databases, rather than executing the container to observe runtime behavior.
Clair indexes container image layers to identify installed packages across major Linux distributions (RHEL, Alpine, Ubuntu, Debian, Oracle Linux, Photon OS, SUSE) and common language ecosystems (Java, Python, Go, JavaScript), then matches them against known-vulnerability data.
Its v4 architecture separates concerns into an indexer, a matcher, a notifier (for webhook-based alerts on new CVE matches against previously scanned images), and a REST/gRPC API, and it can be deployed as microservices, as a more monolithic setup, or embedded in CI pipelines and disconnected environments.
Clair is the vulnerability-scanning engine behind Red Hat Quay and the public Quay.io registry, continuously re-evaluating stored images as new vulnerabilities become known.
Clair is free and open source under the Apache 2.0 license, with no cost to download, deploy, or modify. There is no official paid or managed version sold directly by the project.
Organizations that don't want to operate Clair themselves typically consume it indirectly through a product that embeds it, such as Red Hat Quay, which has its own commercial and hosted offerings.
Yes. Clair is open-source software licensed under Apache 2.0, so it can be downloaded, run, and modified at no cost.
Clair statically analyzes container image layers, identifying installed OS packages and language dependencies, then matches them against vulnerability databases covering multiple Linux distributions and language ecosystems.
Clair originated at CoreOS and has been maintained primarily under Red Hat's stewardship since Red Hat acquired CoreOS in 2018; development happens in the open on GitHub.
No, Clair can run standalone via its API, but it is most commonly deployed as the scanning backend for a registry, most notably Red Hat Quay and Quay.io.
Yes, Clair's API-driven, microservice-friendly design makes it suitable for integration into CI/CD pipelines to flag or block images with known vulnerabilities.