Clair

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Clair is an open source project for the static analysis of vulnerabilities in application containers. It indexes the package contents of a container image's layers and reports the known CVEs that affect them, so you can gate images in CI, audit a registry, or answer what is vulnerable in what you are about to ship. This AMI delivers Clair fully installed and running in combo mode on a local PostgreSQL backend - a container vulnerability scanning API answering within minutes of launch.

## Container Vulnerability Scanning

The Clair daemon runs the indexer, matcher, and notifier in a single combo process, fronted by a REST API and driven by the bundled clairctl command-line tool. Point clairctl at a container image and Clair pulls the manifest, indexes every layer's installed packages, matches them against continuously updated vulnerability data from distribution security trackers and public feeds, and returns a full vulnerability report. No container runtime or Docker daemon is required on the instance - unlike scanners that depend on a local Docker socket, Clair works entirely through registry APIs.

## Named Integrations

Clair integrates with container registries including Amazon ECR, Docker Hub, Quay, and GitHub Container Registry. For CI/CD pipelines, wire clairctl into Jenkins, GitLab CI, or any automation tool that can invoke a CLI or call a REST endpoint. Because Clair speaks standard registry protocols, any OCI-compliant registry is supported out of the box.

## Secure By Default

The REST API is unauthenticated by Clair's own default and the shipped security group opens only the SSH port, so the scanner is never exposed to the network until you deliberately open the API port behind your own access controls. A strong, unique database password is generated automatically on the first boot of every instance and written to a root-only credentials file - no shared secret is ever baked into the image.

## Production Storage Layout

The PostgreSQL data directory is placed on a dedicated, independently resizable EBS data disk rather than the operating system root volume. The vulnerability database and indexed image data grow on durable storage you can expand without touching the boot volume, simplifying capacity planning for large-scale registry audits.

## Ready To Use

Connect over SSH and the scanner is already running. Read the welcome notes for the generated password and the API address, run a scan with clairctl over the loopback interface, and wire Clair into your registry or CI pipeline once you have opened and secured the API port. Compared to deploying Clair manually - which involves configuring PostgreSQL, setting up combo or distributed mode, and managing vulnerability updater schedules - this AMI eliminates the setup effort entirely.

## cloudimg Support

24/7 technical support by email and live chat. Our engineers help with the REST API and clairctl, indexing and matching, the vulnerability updaters, the PostgreSQL backend, integrating Clair with registries and CI pipelines, backups, capacity planning, and upgrade planning.

## Use Cases

• Scanning container images for known CVEs before they are promoted or deployed
• Auditing an existing container registry for vulnerable images
• Adding an image vulnerability gate to a CI/CD pipeline with an open source scanner and no vendor lock-in
• Integrating with Amazon ECR to scan images as part of an AWS-native workflow

## Getting Started

1. Launch the AMI in your preferred AWS region

2. SSH into the instance and read the welcome notes for credentials

3. Run your first scan with clairctl against any registry image

4. Open and secure the API port to enable remote or pipeline-driven scanning

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.