grype: vulnerability scanner for container images and filesystems

by ddos ·

grype

A vulnerability scanner for container images and filesystems. Easily install the binary to try it out.

grype

 

Features

  • Scan the contents of a container image or filesystem to find known vulnerabilities.
  • Find vulnerabilities for major operating system packages
    • Alpine
    • BusyBox
    • CentOS / Red Hat
    • Debian
    • Ubuntu
  • Find vulnerabilities for language-specific packages
    • Ruby (Bundler)
    • Java (JARs, etc)
    • JavaScript (NPM/Yarn)
    • Python (Egg/Wheel)
    • Python pip/requirements.txt/setup.py listings
  • Supports Docker and OCI image formats

Use

To scan for vulnerabilities in an image:

grype <image>

The above command scans for vulnerabilities that are visible in the container (i.e., the squashed representation of the image). To include software from all image layers in the vulnerability scan, regardless of its presence in the final image, provide –scope all-layers:

grype <image> --scope all-layers

Grype can scan a variety of sources beyond those found in Docker.

# scan a container image archive (from the result of `docker image save ...`, `podman save ...`, or `skopeo copy` commands)
grype path/to/image.tar

# scan a directory
grype dir:path/to/dir

 

The output format for Grype is configurable as well:

grype <image> -o <format>

Where the formats available are:

  • json: Use this to get as much information out of Grype as possible!
  • cyclonedx: An XML report conforming to the CycloneDX 1.2 specification.
  • table: A columnar summary (default).

Grype pulls a database of vulnerabilities derived from the publicly available Anchore Feed Service. This database is updated at the beginning of each scan, but an update can also be triggered manually.

grype db update

Install

Copyright (C) 2020 anchore