🚀 Intro

Docker image scanners are undoubtedly among the most important tools for securing and protecting infrastructure against malicious Docker images.

Tools such as Trivy, Grype, Snyk, or Clair daily support DevOps/Platform Engineers to detect the vulnerable images and improving the overall security of the system.

Because, all in all, the vulnerabilities can be at various level in our Docker images. For example, in base OS layer, app dependencies, application itself or programming language runtime.

Press enter or click to view image in full size

Scanners — despite its popularity — we still need to think about them as an inseparable part of the infrastructure that we need to maintain and secure.

It is also worth to highlight that these are STATIC analysis tools. What it exactly mean? Static analysis means that the tools:

• do not run the container

• inspect image layers directly

• rely on vulnerability feeds (e.g., CVE databases)

What happens when the very tools designed to protect us… become vulnerable themselves?

Recent incidents involving security databases such as National Vulnerability Database (NVD), as well as supply chain attacks targeting security tools, show that even trusted components of our security stack are not immune to compromise.

A good example is very recent vulnerability — CVE-2026–33634 that exploits Trivy image scanner. More details below:

nvd.nist.gov

Press enter or click to view image in full size

Currently, the market offers a wide array of various tools that can be selected. Should we look for a paid tool? Or maybe open source would be fine? Also, which tool integrates with Jenkins CI/CD pipeline? Can I scan other files too like Kubernetes manifests or Ansible playbooks? In this article we will try to answer these questions.

Also, in the article, at the bottom, you will find all the information you need to select the Docker image scanner you need

This article is part of longer series on docker engineering, but in BecomeDevops we regularly write about all DevOps-related technologies. You can read about Ansible, Jenkins or Kubernetes on our bloh

Let’s go through the most commonly used Docker scanners!

1️⃣⁠ ⁠Trivy — the most popular

Trivy is a vulnerability scanner and security analysis tool used to detect security issues in software and infrastructure components. It is very popular and widely used by many companies and individual software developers.

The reason why Trivy is a popular choice (at least in our view) is its versatility. While in this article we focus only on Docker images, the tool is also able to scan filesystems, Git repositories, Infrastructure as Code (IaC) templates, and application dependencies.

Consequently, if your setup uses tools such as Ansible, Kubernetes (in addition to Docker), Trivy is an all-in-one solution that can help you scan them all.

Apart from its versatility, I would also like to highlight the following:

• CI/CD integration and container registries support — Trivy integrates well with tools such as Jenkins. This allows you to build DevSecOps pipelines where security scanning is embedded directly into your CI/CD process.

• Open-source tool — it is free to use, so you do not need to purchase any expensive licenses.

• A wide choice of flags — just run trivy —help and you will understand what we are referring to. The software has many different options, flags, switch that allowes you to perfect fit your needs.

Also, we aggregated the most commonly used Trivy image scanning commands:

# Basic scantrivy image myapp:latest# Scan with severity filter (only HIGH and CRITICAL)trivy image --severity HIGH,CRITICAL myapp:latest# Scan and fail if critical vulnerabilities foundtrivy image --exit-code 1 --severity CRITICAL myapp:latest# Output in JSON format for automationtrivy image --format json --output results.json myapp:latest# Scan a local Dockerfile without buildingtrivy config ./Dockerfile

# Basic scantrivy image myapp:latest# Scan with severity filter (only HIGH and CRITICAL)trivy image --severity HIGH,CRITICAL myapp:latest# Scan and fail if critical vulnerabilities foundtrivy image --exit-code 1 --severity CRITICAL myapp:latest# Output in JSON format for automationtrivy image --format json --output results.json myapp:latest# Scan a local Dockerfile without buildingtrivy config ./Dockerfile

# Basic scantrivy image myapp:latest# Scan with severity filter (only HIGH and CRITICAL)trivy image --severity HIGH,CRITICAL myapp:latest# Scan and fail if critical vulnerabilities foundtrivy image --exit-code 1 --severity CRITICAL myapp:latest# Output in JSON format for automationtrivy image --format json --output results.json myapp:latest# Scan a local Dockerfile without buildingtrivy config ./Dockerfile

Once the image is scanned with a command such as trivy image myapp:latest we can read the vulnerability report. From an image scan report, you can identify:

• Severity — the level of risk associated with a vulnerability

• Fixed version — the minimum version of the package that resolves the issue

Severity levels

Trivy classifies vulnerabilities into the following levels:

• LOW — minor risk, usually no immediate impact

• MEDIUM — moderate risk, should be addressed

• HIGH — serious risk, requires prompt attention

• CRITICAL — severe risk, should be fixed immediately

The exemplary report below:

Press enter or click to view image in full size

2️⃣⁠ Grype

Grype is solid alternative to Trivy. It is a light-weight, also open-source scanner used for Docker image and filesystem scanning. Also, similarly to Trivy — it is known for its ease of use for individual developers, DevOps Engineers or small teams.

Key Features:

• Scans Docker images for vulnerabilities using a wide range of vulnerability databases.

• Supports integration with CI/CD pipelines and registries for automated scans.

• Simple configuration and setup process.

From our experience, because Grype uses more CVE databases, is able to find a higher number of vulnerabilities compared to Trivy.

Let’s take alpine:latest image for example. When we scan it with Trivy, we are getting 0 vulnerabilities, while with Grype, we are getting 4 medium. Consequently:

If you goal is to get the highest number of vulnerabilities, you should choose Grype over Trivy

Press enter or click to view image in full size

3️⃣ Snyk

In contrast to the previous tools — Snyk is not open-source. It is part of the broader Snyk developer-focused security platform. It specializes in identifying vulnerabilities in Docker images and Kubernetes workloads and continuously monitors for new vulnerabilities as they are disclosed.

Key Features:

• Scans both operating system packages and application dependencies in container images.

• Monitors Docker images for newly discovered vulnerabilities post-deployment.

• Developer-focused, with features to help fix vulnerabilities and keep images secure.

• Integrates with CI/CD pipelines, registries, and Kubernetes clusters

4️⃣ Clair

Lastly, let’s discuss Clair. This is an open-source static analysis scanner designed for detecting vulnerabilities in Docker images. It is widely used in container security workflows, especially in environments that rely on private container registries.

Clair analyzes container images layer by layer and identifies known security vulnerabilities in:

• Operating system packages (e.g., Alpine, Ubuntu, Debian packages)

• Installed libraries inside container layers

It does this by matching discovered packages against known vulnerability databases.

Clair is best suited for:

• scanning images stored in private container registries

• integrating vulnerability checks into registry workflows

• enforcing security policies before images are deployed

• large-scale Kubernetes or cloud-native environments

5️⃣ Summary — which scanner to choose?

Based on what we have discussed so far, it is now time to look at when to use each tool.

The first point we want to highlight is the importance of ensuring that the scanner is up to date with the latest vulnerabilities and still actively maintained by the vendor. This may sound obvious, but in practice, it is often overlooked.

An outdated or unsupported scanner may fail to detect newly discovered vulnerabilities or rely on stale data sources, which directly impacts the accuracy of the results. Additionally, the quality and freshness of the vulnerability databases used by the scanner play a critical role in its effectiveness.

While reviewing tools for this article, we noticed that some solutions, such as Dagda, appear to be no longer actively maintained. A similar situation applies to Microscanner by Aqua. These tools may still function, but they can no longer be considered reliable choices for modern security workflows.

Press enter or click to view image in full size

Let’s now move on the the comparison of the tools.

Depending on what is that we want to archieve in our infrastructures, we should choose the scanning tool accordingly.

➡️ Use Trivy:

• you need a fast, lightweight, and easy-to-use tool

• you want an open-source solution with no licensing costs

• you are working across multiple tools (Docker, Kubernetes)

• you want quick integration into CI/CD pipelines

➡️ Use Grype:

• you want deep and accurate vulnerability detection

• you prefer strong integration with tools like Anchore

• you need more control over scanning and reporting

➡️ Use Snyk:

• you want a developer-first security platform

• fixing vulnerabilities directly in code is important

• you need continuous monitoring after deployment

• you are already using a mature CI/CD workflow with DevSecOps

➡️ Use Clair :

• you are working with private registries

• you want static analysis of container images

• you need a solution embedded into your registry workflow

The comparison is also below:

Press enter or click to view image in full size

I hope you liked it,
Simon Izydorek
CEO and Founder of BecomeDevops