Integrate Clair with Vulnetix. Deploy Clair v4 to scan container images for OS package CVEs. Export findings as JSON via clairctl and upload to Vulnetix.
Install & scan
$ # Deploy Clair v4 with PostgreSQL backend wget https://raw.githubusercontent.com/quay/clair/main/docker-compose.yaml docker compose up -d # clairctl is bundled in the clair Docker image docker run --rm quay.io/projectquay/clair:4.7.0 clairctl --help $ # Using clairctl with a running Clair instance docker run --rm quay.io/projectquay/clair:4.7.0 clairctl report --host http://localhost:6060 --out json alpine:latest > clair-report.json
Run Clair in CI
Scan on every push and upload the report as a workflow artifact:
- name: Start Clair
run: |
wget -q https://raw.githubusercontent.com/quay/clair/main/docker-compose.yaml
docker compose up -d
sleep 30
- name: Scan with clairctl
run: |
docker run --rm --network host quay.io/projectquay/clair:4.7.0 clairctl report --host http://localhost:6060 --out json myapp:${{ github.sha }} > clair-report.json
- name: Upload report
run: vulnetix upload --file clair-report.json
How Vulnetix compares: better together
Vulnetix does not replace Clair. Keep running it. Vulnetix sits on top of Clair (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Clair is strongest at its core category and also carries features in SCA, just as Vulnetix spans categories.
| Capability | Vulnetix | Clair |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ~ Reports Java/Go/Python/Ruby dependency vulns via OSV.dev feeds |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✓ Core: static layer analysis of image contents against updated vuln DBs |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ~ Enriches matches with NVD CVSS severity for prioritisation; no EPSS/KEV |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Clair does well
- Mature, fully open-source scanner (ClairCore engine) with a clean HTTP API, the vulnerability engine behind Red Hat Quay
- Layer-indexing model plus a notifier service that re-alerts on previously indexed images when new vulnerabilities land
- Broad OS-distro coverage (Ubuntu, Debian, RHEL, SUSE, Oracle, Alpine, Amazon Linux, Photon) with continuously updated feeds
- Language-package coverage (Java, Go, Python, Ruby) sourced from OSV.dev, plus CVSS enrichment from NVD
Where Vulnetix adds to it: Clair is a robust open-source container vuln engine but is single-domain (images) with no cross-scanner consolidation, no exploit-intel beyond CVSS, and no VEX/autofix. Vulnetix ingests Clair's API output and unifies it with SAST/SCA/IaC/secrets/cloud findings into one deduped, prioritised queue with EPSS/KEV/ESS/CWSS/LEV, reachability, versioned VEX, EOL and SSVC policy, and Safe Harbour autofix. Clair keeps doing the image scan; Vulnetix does the orchestration layer on top.
No migration, no rip-and-replace. Clair keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Clair results in Vulnetix
Upload Clair JSON, XML output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.