Clair

Clair helps a registry or build system identify known vulnerabilities in container images. It first works out which supported software packages an image contains, then matches that inventory against vulnerability information. An integration can query those results before distributing or deploying the image. It is useful as a scanning service shared by other tools, but it does not watch running containers for attacks or prove that an application is safe.

Deployment and operating notes

Clair’s current project documentation describes static analysis of image contents through separate indexing, matching and notification responsibilities, built on ClairCore. The recovered CoreOS chart link and appc-era description are historical. A scanner service is not a runtime intrusion detector, and supported package ecosystems must be checked against Clair’s actual support matrix.

Before replacing an old Clair deployment, identify the API version used by the registry or client and the schema and ownership of its database. Plan vulnerability-feed access, update monitoring, authentication and image-layer access separately. Validate known images whose package inventories are understood, then compare indexing failures and matched vulnerabilities rather than only total finding counts. A new database may require re-indexing images; preserve the original until the registry integration and operational recovery are proven. Do not treat a successful scan with no findings as proof that every language package or unsupported distribution was analyzed. No Clair installation or cross-version database upgrade was exercised here.