* [Topics](/en/topics "Topics") * [Open source](/en/topics/open-source "Open source") * What is Clair? What is Clair? ============== Published January 8, 2019•*3*-minute read Copy URL Jump to section --------------- OverviewClair for container securityClair and KubernetesHow Clair worksHow does Red Hat help? Overview -------- Clair is an [open source](/en/topics/open-source/what-is-open-source-software) project which provides a tool to monitor the security of your [containers](/en/topics/containers/whats-a-linux-container) through the static analysis of vulnerabilities in appc and [docker](/en/topics/containers/what-is-docker) containers. Clair is an [API](/en/topics/api/what-are-application-programming-interfaces)-driven analysis engine that inspects containers layer-by-layer for known security flaws. Using Clair, you can easily build services that provide continuous monitoring for container vulnerabilities. Clair for container security ---------------------------- Vulnerability data is continuously imported from a known set of sources and correlated with the indexed contents of container images in order to produce lists of vulnerabilities that threaten a container. When vulnerability data changes upstream, the previous state and new state of the vulnerability along with the images they affect can be sent via webhook to a configured endpoint. All major components can be customized programmatically at compile-time without forking the project. Clair supports container security by: * Updating vulnerability data from a set of sources you define and storing this data in its database * Allowing clients to query this database for vulnerabilities within specific images through the use of an API * Indexing container images with a list of features present in the image through the use of an API [Learn more about container security](/en/topics/security/container-security "article | what is container security?") Red Hat resources ----------------- [Keep reading](/en/resources "Keep reading") Clair and Kubernetes -------------------- Clair is part of the open source [Project Quay](https://www.projectquay.io/). The [Kubernetes](/en/topics/containers/what-is-kubernetes) platform [Red Hat OpenShift®](/en/technologies/cloud-computing/openshift) can utilize Clair for container security through a Kubernetes [Operator](/en/topics/containers/what-is-a-kubernetes-operator) called the Container Security Operator which is itself a component of [Red Hat Quay](/en/technologies/cloud-computing/quay). Red Hat Quay is an [open source](/en/topics/open-source/what-is-open-source-software) container image registry platform which enables you to build, distribute, and deploy containers across global datacenters, focusing on [cloud-native](/en/topics/cloud-native-apps) and [DevSecOps](/en/topics/devops/what-is-devsecops) development models and environments. The [Quay Container Security Operator](https://catalog.redhat.com/software/containers/detail/5e9a2534d70cc54b02d243d4)—which integrates with Red Hat OpenShift—allows you to increase the security of your image repositories with automation, authentication, and authorization systems. Red Hat Quay is available with Red Hat OpenShift or as a standalone component. [Red Hat OpenShift Service on AWS (ROSA)](https://www.redhat.com/en/technologies/cloud-computing/openshift/aws) can build images from your source code, deploy them, and manage their lifecycle. It provides an internal, integrated container image registry that can be deployed in your ROSA environment to locally manage images. Quay.io, a public Red Hat Quay Container Registry instance provided and maintained by Red Hat, serves most of the container images and Operators to ROSA clusters. Red Hat Quay is available both as a hosted service and as software you can install in your own data center or cloud environment. Advanced features in Red Hat Quay include geo-replication, image scanning, and the ability to roll back images. These features include utilizing Clair as part of your overall OpenShift configuration. [Learn more about how to use Operators with AWS Controllers for Kubernetes](https://developers.redhat.com/articles/2022/05/16/how-use-operators-aws-controllers-kubernetes?intcmp=7013a000003SYbdAAG&extIdCarryOver=true&sc_cid=701f2000001OH6fAAG) How Clair works --------------- Clair scans each container layer and provides a notification of vulnerabilities that may be a threat, based on the [Common Vulnerabilities and Exposures database (CVE)](/en/topics/security/what-is-cve) and similar databases from Red Hat ®, Ubuntu, and Debian. Since layers can be shared between many containers, introspection is vital to build an inventory of packages and match that against known CVEs. Clair has also introduced support for programming language package managers, starting with Python, and a new image-oriented API. Automatic detection of vulnerabilities will help increase awareness and best security practices across development and operations teams, and encourage action to patch and address the vulnerabilities. When new vulnerabilities are announced, Clair knows right away, without rescanning, which existing layers are vulnerable and notifications are sent. For example, [CVE-2014-0160](https://access.redhat.com/security/cve/CVE-2014-0160), aka "[Heartbleed](https://access.redhat.com/security/vulnerabilities/heartbleed)" has been known for some time, yet Red Hat Quay security scanning found it is still a potential threat to a high percent of the container images users have stored on Quay. Take note that vulnerabilities often rely on particular conditions in order to be exploited. For example, Heartbleed only matters as a threat if the vulnerable OpenSSL package is installed and being used. Clair isn’t suited for that level of analysis and teams should still undertake deeper analysis as required. How does Red Hat help? ---------------------- As part of Red Hat’s commitment to open source communities Red Hat will continue participating in the development of Project Quay as a [member of the Cloud Native Computing Foundation](https://www.cncf.io/about/members/). Red Hat makes significant contributions to the engineering of new features for Clair and Project Quay. Red Hat also runs one of the key databases of vulnerabilities used by Clair. In addition, Red Hat runs the largest installation of Clair via [quay.io](http://quay.io/) which serves as a real-world load testing environment. Resource Red Hat named a Leader in 2025 Gartner® Magic Quadrant™ for Container Management -------------------------------------------------------------------------------- Read the 2025 Gartner® Magic Quadrant™ for Container Management to learn why Red Hat OpenShift has been named a “Leader” for the 3rd year in a row. [Read the report](/en/engage/gartner-magic-quadrant-container-management-analyst-report "Red Hat named a Leader in 2025 Gartner® Magic Quadrant™ for Container Management") All Red Hat product trials -------------------------- Our no-cost product trials help you gain hands-on experience, prepare for a certification, or assess if a product is right for your organization. [Keep reading](/en/products/trials "All Red Hat product trials") Keep reading ------------ ### What is InstructLab? InstructLab simplifies the process of customizing large language models with private data. [Read the article](/en/topics/ai/what-is-instructlab "article | what is instructlab?") ### What is Istio? Find out more about Istio, an open source service mesh that controls how microservices share data with one another. [Read the article](/en/topics/microservices/what-is-istio "article | What is Istio?") ### What is CentOS Stream? CentOS Stream is a Linux® development platform where open source community members can contribute to Red Hat® Enterprise Linux in tandem with Red Hat developers. [Read the article](/en/topics/linux/what-is-centos-stream "product article | what is centos stream") Open source resources --------------------- ### Related content * Blog post [Bringing intelligent, efficient routing to open source AI with vLLM Semantic Router](/en/blog/bringing-intelligent-efficient-routing-open-source-ai-vllm-semantic-router) * Overview [Modernize at the edge with Red Hat and Portworx](/en/resources/at-the-edge-with-portworx-overview) * Case study [ELCA delivers scalable sovereign cloud on Red Hat OpenShift](/en/resources/elca-cloud-services-case-study) * Case study [The FCCC is making its applications cloud-ready](/en/resources/florida-court-clerks-comptrollers-q-and-a) ### Related articles * [Containers vs. VMs: Similarities, differences, and combined approaches](/en/topics/containers/containers-vs-vms) * [Edge computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/edge-computing) * [What is InstructLab?](/en/topics/ai/what-is-instructlab) * [What is a Linux container?](/en/topics/containers/whats-a-linux-container) * [What is container orchestration?](/en/topics/containers/what-is-container-orchestration) * [What is Istio?](/en/topics/microservices/what-is-istio) * [What is CentOS Stream?](/en/topics/linux/what-is-centos-stream) * [Stateful vs stateless applications](/en/topics/cloud-native-apps/stateful-vs-stateless) * [What is Kubernetes?](/en/topics/containers/what-is-kubernetes) * [Red Hat OpenShift on VMware](/en/technologies/cloud-computing/openshift/vmware) * [What is KVM?](/en/topics/virtualization/what-is-KVM) * [What is KubeVirt?](/en/topics/virtualization/what-is-kubevirt) * [Why use Red Hat Ansible Automation Platform with Red Hat OpenShift?](/en/technologies/cloud-computing/openshift/ansible-on-openshift) * [What is Podman Desktop?](/en/topics/containers/what-is-podman-desktop) * [What are CentOS replacements?](/en/topics/linux/centos-alternatives) * [What is CentOS?](/en/topics/linux/what-is-centos) * [What is Podman?](/en/topics/containers/what-is-podman) * [What are hosted control planes?](/en/topics/containers/what-are-hosted-control-planes) * [What is the Kubernetes Java client?](/en/topics/cloud-computing/what-is-kubernetes-java-client) * [What is kubernetes security?](/en/topics/containers/kubernetes-security) * [What is Helm?](/en/topics/devops/what-is-helm) * [What is Argo CD?](/en/topics/devops/what-is-argocd) * [Red Hat OpenShift for developers](/en/technologies/cloud-computing/openshift/developers) * [What is MicroShift?](/en/topics/edge-computing/microshift) * [How Kubernetes can help AI/ML](/en/topics/cloud-computing/how-kubernetes-can-help-ai) * [OpenJDK versus Oracle JDK](/en/topics/application-modernization/openjdk-vs-oracle-jdk) * [What is Cloud Foundry?](/en/topics/application-modernization/what-is-cloud-foundry) * [What is Kubeflow?](/en/topics/cloud-computing/what-is-kubeflow) * [What are microservices?](/en/topics/microservices/what-are-microservices) * [What is container security?](/en/topics/security/container-security) * [OpenShift vs. OpenStack: What are the differences?](/en/technologies/cloud-computing/openshift/openshift-vs-openstack) * [What are sandboxed containers](/en/topics/containers/sandboxed-containers) * [What is Buildah?](/en/topics/containers/what-is-buildah) * [Kubernetes vs OpenStack](/en/topics/openstack/kubernetes-vs-openstack) * [What are validated patterns?](/en/topics/cloud-computing/what-are-validated-patterns) * [Understanding Ansible, Terraform, Puppet, Chef, and Salt](/en/topics/automation/understanding-ansible-vs-terraform-puppet-chef-and-salt) * [Ansible vs. Chef: What you need to know](/en/topics/automation/ansible-vs-chef) * [Ansible vs. Salt: What you need to know](/en/topics/automation/ansible-vs-salt) * [Kubernetes on AWS: Self-Managed vs. Managed Applications Platforms](/en/topics/containers/kubernetes-on-aws) * [What's the best Linux distro for you?](/en/topics/linux/whats-the-best-linux-distro-for-you) * [What is Linux?](/en/topics/linux/what-is-linux) * [What is an image builder?](/en/topics/linux/what-is-an-image-builder) * [Ansible vs. Puppet: What you need to know](/en/topics/automation/ansible-vs-puppet) * [Red Hat OpenShift vs. OKD](/en/topics/containers/red-hat-openshift-okd) * [Red Hat OpenShift vs. Kubernetes: What's the difference?](/en/technologies/cloud-computing/openshift/red-hat-openshift-kubernetes) * [Why run Apache Kafka on Kubernetes?](/en/topics/integration/why-run-apache-kafka-on-kubernetes) * [What is high availability and disaster recovery for containers?](/en/topics/containers/high-availability-containers) * [What is Apache Kafka?](/en/topics/integration/what-is-apache-kafka) * [Spring on Kubernetes with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/spring) * [Ansible vs. Terraform, clarified](/en/topics/automation/ansible-vs-terraform) * [What is a golden image?](/en/topics/linux/what-is-a-golden-image) * [Ansible vs. Red Hat Ansible Automation Platform](/en/technologies/management/ansible/ansible-vs-red-hat-ansible-automation-platform) * [What are Red Hat OpenShift cloud services?](/en/technologies/cloud-computing/openshift/what-are-red-hat-openshift-cloud-services) * [VNF and CNF, what’s the difference?](/en/topics/cloud-native-apps/vnf-and-cnf-whats-the-difference) * [What is a container registry?](/en/topics/cloud-native-apps/what-is-a-container-registry) * [What is Skopeo?](/en/topics/containers/what-is-skopeo) * [What are Red Hat OpenShift Operators?](/en/technologies/cloud-computing/openshift/what-are-openshift-operators) * [Using Helm with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/helm) * [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices) * [What is Grafana?](/en/topics/data-services/what-is-grafana) * [Orchestrating Windows containers on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/windows-containers-on-red-hat-openshift) * [What is open source software?](/en/topics/open-source/what-is-open-source-software) * [What is a Kubernetes operator?](/en/topics/containers/what-is-a-kubernetes-operator) * [Open source vs. proprietary software in vehicles](/en/topics/open-source/open-source-vs-proprietary-software-in-vehicles) * [High performance computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/high-performance-computing) * [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security) * [What is KubeLinter?](/en/topics/containers/what-is-kubelinter) * [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security) * [Container and Kubernetes compliance considerations](/en/topics/containers/compliance) * [How microservices support IT integration in healthcare](/en/topics/microservices/microservices-in-healthcare) * [Kubernetes cluster management](/en/technologies/cloud-computing/openshift/kubernetes-cluster-management) * [Red Hat OpenShift on IBM IT infrastructure](/en/technologies/cloud-computing/openshift/what-is-red-hat-openshift-on-IBM-IT-infrastructure) * [Red Hat OpenShift for business leaders](/en/technologies/cloud-computing/openshift/business-leaders) * [How to deploy Red Hat OpenShift](/en/technologies/cloud-computing/openshift/deploy-red-hat-openshift) * [Cost management for Kubernetes on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/cost-management) * [What is enterprise Kubernetes?](/en/topics/containers/what-is-enterprise-kubernetes) * [What is RKT?](/en/topics/containers/what-is-rkt) * [What makes Red Hat OpenShift the right choice for IT operations?](/en/technologies/cloud-computing/openshift/it-operations) * [Why choose Red Hat for Kubernetes?](/en/topics/containers/why-choose-red-hat-kubernetes) * [What makes Red Hat OpenShift the right choice for SAP?](/en/technologies/cloud-computing/openshift/sap) * [Kubernetes-native Java development with Quarkus](/en/technologies/cloud-computing/openshift/quarkus) * [What is Kubernetes role-based access control (RBAC)](/en/topics/containers/what-kubernetes-role-based-access-control-rbac) * [What is Kogito?](/en/topics/automation/what-is-kogito) * [What is containerization?](/en/topics/cloud-native-apps/what-is-containerization) * [What was CoreOS and CoreOS container Linux](/en/technologies/cloud-computing/openshift/what-was-coreos) * [Learning Kubernetes basics](/en/topics/containers/learning-kubernetes-tutorial) * [What is service-oriented architecture?](/en/topics/cloud-native-apps/what-is-service-oriented-architecture) * [What is the Kubernetes API?](/en/topics/containers/what-is-the-kubernetes-api) * [What is Kubernetes cluster management?](/en/topics/containers/what-is-kubernetes-cluster-management) * [What is a Kubernetes deployment?](/en/topics/containers/what-is-kubernetes-deployment) * [Why choose the Red Hat build of Quarkus?](/en/topics/cloud-native-apps/why-choose-red-hat-quarkus) * [Introduction to Kubernetes architecture](/en/topics/containers/kubernetes-architecture) * [What is CaaS?](/en/topics/cloud-computing/what-is-caas) * [Introduction to Kubernetes patterns](/en/topics/cloud-native-apps/introduction-to-kubernetes-patterns) * [What is a Kubernetes cluster?](/en/topics/containers/what-is-a-kubernetes-cluster) * [What is Quarkus?](/en/topics/cloud-native-apps/what-is-quarkus) * [What is Jaeger?](/en/topics/microservices/what-is-jaeger) * [What is open source?](/en/topics/open-source/what-is-open-source) * [What is container-native virtualization?](/en/topics/containers/what-is-container-native-virtualization) * [What is Knative?](/en/topics/microservices/what-is-knative) * [What is etcd?](/en/topics/containers/what-is-etcd) * [Why choose Red Hat for microservices?](/en/topics/microservices/why-choose-red-hat-microservices) * [Why choose Red Hat for containers?](/en/topics/containers/why-choose-red-hat-containers) * [What is Docker?](/en/topics/containers/what-is-docker) * [What is a Kubernetes pod?](/en/topics/containers/what-is-kubernetes-pod) [More about this topic](/en/topics/open-source "More about this topic")