Open source container scanning tool to find vulnerabilities and suggest best practice improvements?

• trivy

  83 21,525 9.8 Go

  Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

  

https://github.com/aquasecurity/trivy 17k stars, updated 11 hours ago

• grype

  56 7,885 9.5 Go

  A vulnerability scanner for container images and filesystems

  

https://github.com/anchore/grype 5.6k stars, updated 3 days ago

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• vimp

  1 54 8.5 Go

  Compare data from multiple vulnerability scanners to get a more complete picture of potential exposures. (by mchmarny)

Something I saw recently was https://github.com/mchmarny/vimp which does vulnerability checking via multiple different tools; haven't used it too much yet but could be quite handy.

• clair

  21 10,070 9.2 Go

  Vulnerability Static Analysis for Containers

  

https://github.com/quay/clair 9.4k stars, updated 17 hours ago

• grafeas

  3 1,501 5.8 Go

  Artifact Metadata API

  

https://github.com/grafeas/grafeas 1.4k stars, updated last week

• dagda

  4 1,117 0.0 Python

  a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities

https://github.com/eliasgranderubio/dagda 1k stars, updated July 27th, 2021

Suggest a related project