Clair

What it is

Clair is an open-source static analysis engine for container image vulnerabilities. It ingests image layers, matches installed packages against known CVE databases (Debian, Ubuntu, RHEL, Alpine, NVD, etc.), and reports what's exploitable in your images before you ship them.

Note: the category tag here says "Provisioning" — that's not accurate. Clair is a security/vulnerability scanning tool, typically deployed as part of a registry (most commonly Quay) or wired into CI pipelines. If you're evaluating it expecting provisioning functionality, you're looking at the wrong tool.

Who builds it and why

Clair originated at CoreOS, and after Red Hat's acquisition of CoreOS, development moved under the Quay/Red Hat umbrella. It's built to solve a specific problem: registries and CI systems need a way to answer "does this image have known CVEs" without shipping every scan to a third-party SaaS. It's the scanning engine that powers Quay.io and Red Hat Quay's on-prem vulnerability reporting.

154 contributors and an active commit history (latest commit 2026-06-30) indicate this isn't an abandoned CoreOS-era artifact — it's maintained as core infrastructure for Quay's product, which gives it institutional backing beyond volunteer goodwill.

Production readiness signal

11,014 GitHub stars and 154 contributors is a solid signal for a security tool — this isn't a side project. Latest release v4.9.0 suggests a mature, iterating codebase rather than a 1.0 still finding its footing. Apache-2.0 licensing means no legal ambiguity for commercial use.

CNCF maturity level is not publicly available — Clair is not currently a CNCF project (it's Red Hat/Quay-owned infrastructure), so don't expect a graduation trajectory or CNCF governance structure here. Evaluate it as vendor-adjacent open source, not a foundation project.

Founded date not publicly available, but this traces back to CoreOS-era container security tooling, meaning multi-year production exposure at scale via Quay.io.

Who should use this

• Teams running Red Hat Quay (on-prem or hosted) who want native vulnerability scanning without an external SaaS dependency.
• Organizations that need to self-host scanning for compliance or air-gapped environments — Clair doesn't require sending image data to a third party.
• Platform teams building custom CI/CD vulnerability gates who want an API-driven scanner they can wire into arbitrary pipelines rather than a fixed SaaS workflow.
• Anyone already in the Quay/OpenShift ecosystem — integration here is far smoother than bolting on a competitor.

Who should NOT use this

• Teams wanting a turnkey scanning experience with a polished UI and minimal ops overhead — Clair is infrastructure, not a product; you deploy, configure, and maintain the vulnerability database updates yourself.
• Shops not using Quay — Clair works standalone, but the integration story is meaningfully weaker outside the Quay ecosystem, and you'll be doing more plumbing than with tools built for standalone use (Trivy, Grype).
• Teams needing broad language/dependency-level SCA (not just OS package CVEs) — Clair's strength is OS-package-level scanning; it's historically weaker on application dependency scanning (npm, pip, Maven) compared to newer scanners.
• Small teams without dedicated platform/security engineering — running and tuning Clair's data feeds and databases is nontrivial ongoing work, not a "run once and forget" deployment.

Alternatives

• Trivy (Aqua Security) — broader coverage (OS + app dependencies + IaC misconfig), simpler single-binary deployment, faster to adopt standalone.
• Grype (Anchore) — similar single-binary simplicity, strong CLI/CI ergonomics, active community, less registry-coupled than Clair.
• Snyk Container — commercial SaaS option with stronger app-dependency and remediation guidance if you want a managed product instead of self-hosted infra.

Pricing

Fully open source, Apache-2.0. No licensing cost. You pay in engineering time: deployment, vulnerability feed maintenance, and scaling the scanning infrastructure yourself. Commercial support/packaging is available if you run it inside Red Hat Quay's paid offering, but the upstream project itself is free.