Freedom251 › Software Composition Analysis Software
Clair
What Clair is
Clair is a free, open-source service for finding vulnerabilities in container images. It analyzes base operating systems, installed packages, and programming language components, then lets clients match image results against known vulnerabilities through its API. Clair refreshes its vulnerability database as new vulnerabilities are published and can reanalyze images without rereading their full contents. It supports OCI Distribution and Docker v2 image formats, and lists RHEL, Alpine, Ubuntu, Debian, Oracle, Photon, and SUSE distributions. Supported language ecosystems include Java, Python, Golang, and Javascript. Clair can be deployed as microservices, as a monolithic service, in a CI pipeline, or in disconnected environments. Its operating modes include indexer, matcher, notifier, and combo; combo runs all of them in one OS process. Clair uses PostgreSQL to persist data. The project releases Clair as a container on Quay.io, with the clairctl command-line tool among its release artifacts. It is self-hosted, supports Linux and API use, and is licensed under Apache 2.0. Clair provides image and registry scanning, but not runtime protection.
Who it suits
Clair suits teams that need to scan container images for vulnerabilities across operating system layers, installed packages, and supported programming languages. Its deployment choices may fit teams using CI pipelines, disconnected environments, or self-hosted Linux systems.
What it does well
- Free and open source under Apache 2.0.
- Scans operating systems, installed packages, and language components.
- Updates its vulnerability database as new issues are published.
- Supports OCI Distribution and Docker v2 images.
- Offers microservice, monolithic, CI pipeline, and disconnected deployments.
- Can run indexing, matching, and notification in combo mode.
What to know first
- Does not provide runtime protection.
- Requires PostgreSQL for data persistence.
- Runs as a self-hosted service.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Free and Open Source | Apache 2.0 license | Free |
As clairproject.org lists them, read 7 Oct 2026. The maker's own page has the final word.
Getting started
- Use Clair's official Quay.io container release or its release artifacts, which include clairctl.
- Deploy Clair as microservices, a monolithic service, in a CI pipeline, or in a disconnected environment.
- Provide PostgreSQL for data persistence.
- Choose indexer, matcher, notifier, or combo mode.
- Use the Clair API to index container images and match them against known vulnerabilities.
Verdict
Choose Clair if you need a free, self-hosted way to scan container images and match findings against known vulnerabilities. Its broad deployment options and supported image ecosystems are useful for varied environments. Look elsewhere if runtime protection is required.
Questions
Is Clair free?
Yes. Clair is free and open source under the Apache 2.0 license.
What platforms does Clair support?
Clair supports Linux and API use, and it is self-hosted.
Which container image formats can it scan?
Clair supports images built using OCI Distribution or Docker v2 specifications.
Which operating systems and programming languages are supported?
Listed distributions are RHEL, Alpine, Ubuntu, Debian, Oracle, Photon, and SUSE. Listed languages are Java, Python, Golang, and Javascript.
Does Clair provide runtime protection?
No. Clair provides image and registry scanning, but not runtime protection.
What does Clair need to store data?
Clair uses PostgreSQL for data persistence.
Facts from Clair's own pages
- Analysis
- Clair analyzes container images for vulnerabilities in base operating systems, installed packages, and programming languages. · clairproject.org, 7 Oct 2026
- API
- Clients use the Clair API to index container images and match them against known vulnerabilities. · github.com, 7 Oct 2026
- Architecture
- Clair can run in indexer, matcher, notifier, or combo mode, with combo mode running everything in one OS process. · quay.github.io, 7 Oct 2026
- Continuous updates
- Clair updates its vulnerability database as new vulnerabilities are published and can reanalyze images without rereading their entire contents. · clairproject.org, 7 Oct 2026
- Database requirement
- Clair uses PostgreSQL for data persistence. · quay.github.io, 7 Oct 2026
- Deployment
- Clair supports microservice, monolithic, CI pipeline, and disconnected deployment methods. · clairproject.org, 7 Oct 2026
- Distribution
- The project says Clair is officially released as a container on Quay.io and its release artifacts include the clairctl command line tool. · quay.github.io, 7 Oct 2026
- Image formats
- Clair supports images built using OCI Distribution or Docker v2 specifications. · clairproject.org, 7 Oct 2026
- License
- Clair is licensed under Apache 2.0. · github.com, 7 Oct 2026
- Purpose
- Clair continuously scans container images for vulnerabilities and security problems. · clairproject.org, 7 Oct 2026
- Support
- The project directs questions to its Google Group and bug reports to GitHub Issues. · clairproject.org, 7 Oct 2026
- Supported content
- The project lists RHEL, Alpine, Ubuntu, Debian, Oracle, Photon, and SUSE distributions, plus Java, Python, Golang, and Javascript. · clairproject.org, 7 Oct 2026