For most teams the best container image scanner is the one that runs in your build, covers your base image's OS packages and your language packages, and gives results you can act on. Trivy, Grype and Clair are open source. Docker Scout is a Docker service. Try two on the same image and compare.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation, as of 19 October 2026.
Key takeaways
- All four tools match image contents against vulnerability databases, so results differ mostly through database coverage and package detection.
- Trivy scans for vulnerabilities and secrets by default, and licenses and misconfigurations only when you ask.
- Grype reads images, filesystems and SBOMs, and supports OpenVEX filtering.
- Clair is an API service you run, not a one command CLI.
- A scanner finds known CVEs. It does not tell you whether the vulnerable code is reachable.
What does a container image scanner actually check?
It unpacks each image layer, lists the installed packages, and looks them up in vulnerability databases. Docker Scout describes the same idea: it builds an inventory of the image's components, an SBOM, and checks it against a continuously updated vulnerability database.
Packages come from two places. OS packages (apk, dpkg, rpm) come with the base image. Language packages (npm, pip, Go modules and so on) come with your app. A good scanner reads both.
How do the main scanners compare?
| Tool | Type and license | Inputs (per docs) | Notable behavior |
|---|---|---|---|
| Trivy | Open source | Docker Engine, containerd, Podman, registries, image tar files, OCI layout | Vulnerability and secret scanning on by default; license and misconfiguration scanning opt in |
| Grype | Open source, Apache-2.0 | Container images, filesystems, SBOMs; Docker, OCI and Singularity formats | OpenVEX support to filter and augment results |
| Clair | Open source, Apache 2.0 | OCI and Docker images through its API | Index then match model; main branch can be unstable, so use releases |
| Docker Scout | Docker service | Images, via Docker Hub, the Docker CLI and the Scout Dashboard | Builds an SBOM and checks it against a vulnerability database |
We could not find pricing or plan details for Docker Scout on the overview page, so check Docker's current plan page.
What should I know about each tool?
Trivy looks for a local Docker image first, then containerd, Podman and finally a registry, and you can change the order with --image-src. Its docs say the misconfiguration scanner on images is "not useful in most cases" because it is meant for IaC files. Use trivy image plus --scanners to choose what runs.
Grype lists support for Alpine, Debian, Ubuntu, RHEL, Oracle Linux and Amazon Linux packages, plus Ruby, Java, JavaScript, Python, .NET, Go, PHP and Rust. It pairs naturally with Syft, which Anchore also sponsors, if you want to generate an SBOM first and scan it later.
Clair is for teams that run a registry or platform and want a scanning service behind an API. The repository includes a Dockerfile, a docker-compose file and a sample config. Expect more setup than a CLI.
Docker Scout is the lowest friction choice if you already live in Docker Hub and the Docker CLI.
How do I choose a container image scanner?
- Does it find both OS and language packages in your actual images?
- Does it run in your CI without extra infrastructure?
- Can it scan a registry, a local daemon and a tar file?
- Does it support VEX or an ignore file, so accepted risk is recorded?
- How often does its vulnerability data update?
- Can it emit an SBOM you can keep?
- Who owns the fix: can it tell you the base image to move to?
What do scanners miss?
They report known CVEs in installed packages, and many of those packages are never called by your code. A scanner also cannot see a secret baked into a layer unless it has a secrets scanner, which Trivy turns on by default.
Safeguard adds reachability analysis to cut the noise, and the free scan at gold.safeguard.sh/scan checks up to 100 dependencies in your browser with no login. Package, CVE and CISA KEV details live in the Gold registry at gold.safeguard.sh.
Frequently asked questions
Which container scanner is free?
Trivy, Grype and Clair are open source. Grype and Clair are Apache licensed per their repositories.
Do I need to scan base images separately?
No. A scan of the final image covers the base layers too. Scanning the base image on its own is still useful to choose a better one.
Can a scanner read an SBOM instead of an image?
Grype can scan SBOMs, and Trivy has a trivy sbom command. Both let you scan without pulling the image again.
How often should I rescan images?
On every build and on a schedule for images already deployed, because new CVEs appear after you ship.
Sources
- Trivy container image scanning: http://trivy.dev/latest/docs/target/container_image/
- Trivy SBOM docs: https://trivy.dev/latest/docs/supply-chain/sbom/
- Grype repository: https://github.com/anchore/grype
- Clair repository: https://github.com/quay/clair
- Docker Scout overview: https://docs.docker.com/scout/
- Free dependency scan: https://gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
