clair-scanner

clair-scanner --ip <ip> <image>

Scans the image with Clair (CoreOS's scanner) via clair-scanner, detecting CVEs in the image's OS.

Run it when you want analysis with the CoreOS scanner: clair-scanner sends the image to the Clair server (the analysis infrastructure) and reports findings — the OS CVEs (the image layers) with severity. It's the reference scanner of the first generation (the CoreOS one, used by registries like Quay): the server + scanner architecture. In DevSecOps, Clair is the registry's option (integration with Quay/Harbor): analysis of images in the registry, with clair-scanner for point-in-time pipeline scanning.

Don't use it without the Clair server: clair-scanner needs the Clair server deployed (the infrastructure) — without the server, the scan fails; and the server + scanner architecture is heavier than modern scanners (trivy, grype) that don't require it. The Clair database updates (vulnerability updates): new CVEs require the update. And note: Clair covers the image's OS (the layers) — application dependencies require modern scanners. For the current pipeline, Trivy/Grype; Clair is the registry's option (Quay/Harbor).