Free and open first
Best Container Image Scanning Tools in 2026
Container image scanning tools help you inspect images for security issues as they move through build, registry and deployment workflows. Compared on CI pipeline scanning, registry scanning, Kubernetes admission and SBOM generation, the entries show where scanning and inventory capabilities may fit. Deployment model and fix recommendations add context for handling findings, while free-plan availability and paid starting prices can help you weigh access and cost. Snyk Open Source, Docker Desktop and Mondoo CSPM are among the tools to consider; Trivy is another option. Compare the listed coverage with the stages in your workflow and the remediation information you need.
- 29 apps
- Research read 24 Sept 2026
- How the order is worked out
- 1
Grype
Free plan Open source LinuxMacSelf-hosted+1Grype covers a broad range of scan targets and package ecosystems, with several output formats and vulnerability prioritization options.
- 2
Mondoo CSPM
Free plan Open source APIExtensionLinux+3Mondoo CSPM pairs cloud scanning and risk prioritization with reviewable remediation proposals and evidence tracking.
- 3
Alibaba Cloud Container Registry
Free plan APILinuxWeb+1Alibaba Cloud Container Registry combines image management features with three editions that state different capacity and build allowances.
- 4
Clair
Free plan APILinuxSelf-hostedClair provides a self-hosted path for indexing container images and matching their contents against vulnerability data. Use stable releases rather than the main branch when stable binaries are needed.
- 5
Harbor
Free plan APILinuxSelf-hosted+1Harbor combines artifact storage with access controls, scanning, and registry replication.
- 6
Dagda
Free plan APILinuxSelf-hostedChoose Dagda if you need a free, self-hosted Docker security tool combining vulnerability checks, malware scanning, and runtime monitoring.
- 7
RapidFort
Free plan LinuxSelf-hostedWebRapidFort combines container vulnerability analysis, runtime profiling, image hardening, and compliance features in one offering.
- 8
Trivy
Free plan LinuxMacSelf-hosted+1Trivy combines several scanner types with broad installation and integration options, and it can generate SBOMs.
- 9
O3 Security Image Scanner
Free plan WebChoose O3 Security Image Scanner if your team needs layered container image checks, SBOM output, or a registry gate for critical findings.
- 10
Docker Scout
Free plan LinuxMacWeb+1Choose Docker Scout if image and registry scanning plus SBOM generation match your needs, with plans that scale by users and enabled repositories.
- 11
Anchore Enterprise
Free trial APILinuxSelf-hosted+1Choose Anchore Enterprise if your organization needs SBOM-driven security and compliance controls across software and runtime images.
- 12
Aqua Container Security
Free trial LinuxSelf-hostedWeb+1Aqua combines image scanning, deployment controls, runtime protection, and compliance reporting for container environments.
- 13
Amazon Inspector
Free trial APIWebAmazon Inspector brings workload, container, serverless, repository, and supported Azure scanning into a cloud service with risk prioritization and AWS integrations.
- 14
- 15
Qualys Container Security
Free plan LinuxWeb - 16
Google Artifact Analysis
Paid APILinuxMac+1Artifact Analysis combines package and image scanning with metadata storage and access through Google Cloud interfaces.
- 17
Snyk Container
Free plan Web - 18
Mirantis Secure Registry
Paid APILinuxSelf-hosted+1MSR 4 provides a broad private registry feature set for organizations managing secure image distribution and supply-chain controls.
- 19
Sonatype Container Scanner
Paid APILinuxSelf-hosted+1Consider Sonatype Container Scanner if your team needs container image vulnerability analysis and policy checks across registries or CI pipelines.
- 20
Sysdig Secure
Paid APILinuxMac+3Sysdig Secure combines runtime detection, vulnerability prioritization, and attack-path mapping for cloud-native environments.
- 21
Uptycs Container Security
Paid APILinuxSelf-hosted+1Uptycs combines pre-deployment image scanning, runtime threat detection, and Kubernetes admission controls.
- 22
CrowdStrike Falcon Cloud Security
Paid LinuxMacWeb+1 - 23
ZeroPath
Paid APILinuxMac+3ZeroPath brings broad application-security scanning and workflow integrations into one platform.
- 24
FortiCNAPP
Paid LinuxWebWindows - 25
Checkmarx Container Security
Paid WebCheckmarx Container Security brings registry scanning, pipeline scanning, Kubernetes admission and fix recommendations together.
#1Places #1, #2, #3, #4, #5 on this list can be bought by the makers of the software on it. See the price