Trivy, Grype, Clair and Docker Scout all analyze container images for known vulnerabilities. Trivy and Grype are command line tools, Clair is a service built around indexing and matching, and Docker Scout is a Docker service reached through Hub, the CLI and a dashboard.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation. Facts below are as of 19 October 2026.
Key takeaways
- Trivy scans images, filesystems, repositories, VM images and Kubernetes, and also finds misconfigurations, secrets and licenses.
- Grype scans images, filesystems and SBOMs and supports OpenVEX filtering.
- Clair runs as a service with separate indexing, matching and notification steps.
- Docker Scout builds an SBOM of an image and checks it against a vulnerability database.
How does each scanner work?
Trivy. An open source scanner from Aqua Security under Apache-2.0. It has standalone and client/server modes, and its image command scans container images.
Grype. A vulnerability scanner for container images and filesystems, licensed Apache-2.0. It reads Docker, OCI and Singularity formats, and can scan a Syft SBOM. It uses EPSS, KEV and risk scoring to rank results.
Clair. Described as an application for parsing image contents and reporting vulnerabilities, using static analysis. Submitting a manifest triggers layer fetching and scanning into an index report. A matcher correlates that report with known vulnerabilities, and a notifier acts when new ones are found. Supported content includes Ubuntu, Debian, RHEL, Suse, Oracle, Alpine, AWS Linux, VMware Photon and Python.
Docker Scout. It examines an image's layers and packages, builds an SBOM and checks it against a continuously updated vulnerability database. You can use it through Docker Hub, the Docker CLI and the Docker Scout Dashboard. The page we read did not cover plans or pricing.
Comparison table
| Criteria | Trivy | Grype | Clair | Docker Scout |
|---|---|---|---|---|
| Form | CLI | CLI | Service | Docker service |
| Inputs | Images, filesystems, repos, VM images, Kubernetes, SBOM | Images, filesystems, SBOMs | Container manifests | Container images |
| Extra checks | Misconfiguration, secrets, licenses | EPSS, KEV, OpenVEX | Notifications on new vulnerabilities | SBOM based analysis |
| License | Apache-2.0 | Apache-2.0 | Not covered on page we read | Not covered on page we read |
How to choose
- Decide whether you want a CLI in CI or a service your registry calls.
- List your base image distributions and confirm support.
- Decide if you need secrets, misconfiguration or license scanning.
- Check whether you want SBOM input or output.
- Scan one image with two tools and compare results.
For a no login look at dependencies, try gold.safeguard.sh/scan.
Frequently asked questions
Is Grype the same as Syft?
No. The Syft README describes Syft as an SBOM generator that works with Grype for vulnerability detection.
Does Clair scan running containers?
Its docs describe static analysis rather than runtime analysis.
Can Trivy scan an SBOM?
Yes. Its docs describe a sbom command that takes an SBOM file as input.
Sources
- Trivy repository: https://github.com/aquasecurity/trivy
- Trivy docs: https://trivy.dev/latest/docs/
- Grype: https://github.com/anchore/grype
- Clair: https://quay.github.io/clair/
- Docker Scout: https://docs.docker.com/scout/
Last reviewed: 19 October 2026.
