grype v0.5 releases: vulnerability scanner for container images and filesystems
A vulnerability scanner for container images and filesystems. Easily install the binary to try it out.
- Scan the contents of a container image or filesystem to find known vulnerabilities.
- Find vulnerabilities for major operating system packages
- CentOS / Red Hat
- Find vulnerabilities for language-specific packages
- Ruby (Bundler)
- Java (JARs, etc)
- Python (Egg/Wheel)
- Python pip/requirements.txt/setup.py listings
- Supports Docker and OCI image formats
- Option to use an SBOM input document instead of invoking syft’s cataloging functionality #196
- Remove CPE generation (rely on static CPEa from syft instead) #213 (wagoodman)
- can’t brew install 0.3.0 on mac #203
- “failed to catalog” error when scanning Python apps #200
- Remove powershell description from completion command #211 (KeisukeYamashita)
To scan for vulnerabilities in an image:
The above command scans for vulnerabilities that are visible in the container (i.e., the squashed representation of the image). To include software from all image layers in the vulnerability scan, regardless of its presence in the final image, provide –scope all-layers:
grype <image> --scope all-layers
Grype can scan a variety of sources beyond those found in Docker.
The output format for Grype is configurable as well:
grype <image> -o <format>
Where the formats available are:
- json: Use this to get as much information out of Grype as possible!
- cyclonedx: An XML report conforming to the CycloneDX 1.2 specification.
- table: A columnar summary (default).
Grype pulls a database of vulnerabilities derived from the publicly available Anchore Feed Service. This database is updated at the beginning of each scan, but an update can also be triggered manually.
grype db update
Copyright (C) 2020 anchore