Docker vulnerability static analysis with Clair

Clair is an open source project for the static analysis of vulnerabilities in Docker containers. It allows penetration testers to identify vulnerabilities in containers. You can find its official repository at https://github.com/coreos/clair.

The Clair project is composed of the following seven components, illustrated in the diagram:

• Content detectors
• Datastore
• Vulnerability updaters
• RESTful API
• Notifiers
• Clients
• Vulnerabilities databases

To build a Dockernized environment, visit the official QUAY website https://quay.io/:

Complete your profile with the required information:

Create a new repository and choose its visibility:

Select a link to your repository, for example, I used a Dockerfile:

Wait until the building operation is finished:

If you click on the build, you will see the content of the Dockerfile:

Wait for couple...