grype

Scan container image

$ grype [image:tag]

$ grype dir:[path]

$ grype sbom:[sbom.json]

$ grype [image] -o json

$ grype [image] --only-fixed --fail-on high

$ grype [image] --db-cache-dir [path]

grype [options] source

grype is a vulnerability scanner for container images and filesystems. It identifies known security vulnerabilities in packages and dependencies by comparing against vulnerability databases.
The tool integrates with CI/CD pipelines and produces reports in various formats. It works with the same sources as Syft for comprehensive software composition analysis.

-o, --output format

Output format (table, json, cyclonedx, sarif).

Show only vulnerabilities with fixes.

Fail if vulnerability at severity found.

Generate CPEs if missing.

Suppress output.

Group by CVE.

Database location.

Exclude paths.

image: Container image
dir:: Local directory
file:: Single file
sbom:: SBOM file
registry:: Remote registry

Database updates needed regularly. False positives possible. Coverage depends on ecosystem. Large images scan slowly.

grype was created by Anchore as part of their open source security tooling alongside Syft. It emerged around 2020 to address container security scanning needs with a focus on accuracy and integration.

syft(1), trivy(1), snyk(1), clair(1)