Container Scanning

Scan for known CVEs from online databases.

See also the AMI Scanning page.

• Open Source
  • Trivy
  • Grype
  • Clair
• Proprietary
  • AWS Inspector
  • Aqua Security
  • Twistlock
  • Tenable.io
  • CheckMarx
• Container Scanning on Jenkins

Open Source

Trivy

:octocat: aquasecurity/trivy

https://trivy.dev/latest/

See Trivy doc.

Grype

:octocat: anchore/grype

https://anchore.com/opensource/

Clair

:octocat: coreos/clair

https://clairproject.org/

Documentation

Open source static analysis image vulnerability scanner by CoreOS.

Not as good quality, easy to use or reliable in my experience, see this issue

See Clair page.

Proprietary

AWS Inspector

https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html

Aqua Security

https://www.aquasec.com/products/aqua-container-security-platform/

Container security - wraps docker socket to control + kill container launches

Twistlock

https://www.twistlock.com/

Tenable.io

Scanner for docker images (company behind Nessus) - one client's tech hub had this. Scans happened 10-40 mins behind async because it's slow

https://docs.tenable.com/vulnerability-management/Content/ContainerSecurity/CSScanner.htm§

CheckMarx

https://checkmarx.com/resource/documents/en/34965-19110-container-scans.html

Container Scanning on Jenkins

From HariSekhon/Jenkins and HariSekhon/Diagrams-as-Code repos:

Ported from various private Knowledge Base pages 2018+