Open source container scanning tool to find vulnerabilities and suggest best practice improvements?

• trivy

  82 21,316 9.7 Go

  Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

  

https://github.com/aquasecurity/trivy 17k stars, updated 11 hours ago

• grype

  56 7,649 9.5 Go

  A vulnerability scanner for container images and filesystems

  

https://github.com/anchore/grype 5.6k stars, updated 3 days ago

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• vimp

  1 54 8.5 Go

  Compare data from multiple vulnerability scanners to get a more complete picture of potential exposures. (by mchmarny)

Something I saw recently was https://github.com/mchmarny/vimp which does vulnerability checking via multiple different tools; haven't used it too much yet but could be quite handy.

• clair

  21 10,030 9.2 Go

  Vulnerability Static Analysis for Containers

  

https://github.com/quay/clair 9.4k stars, updated 17 hours ago

• grafeas

  3 1,494 6.2 Go

  Artifact Metadata API

  

https://github.com/grafeas/grafeas 1.4k stars, updated last week

• dagda

  4 1,109 0.0 Python

  a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities

https://github.com/eliasgranderubio/dagda 1k stars, updated July 27th, 2021

Suggest a related project