grype (Anchore)

grype <image>:<tag>

Scans the container image with Anchore's Grype, detecting OS and dependency CVEs with the integrated SBOM.

Run it in the CI/CD pipeline when you want image analysis with the Anchore ecosystem: grype scans the image (OS and dependencies) and reports findings — CVEs with severity and fix — using the same detection engine as syft (the SBOM). It's Anchore's scanner: integration with syft (031) for inventory and grype for CVEs. In container DevSecOps, Grype is the pipeline piece (with anchore-engine for policy): the build with high-severity findings is blocked.

Don't use it as a complete analysis: grype covers CVEs — image configuration is covered by linters and IaC by Checkov. Grype's database updates: new CVEs require the update. And watch out: findings are triaged (reachability); --only-fixed filters CVEs without fix. For SBOM, syft (031); Grype is the CVE scanner of the Anchore ecosystem.