Base
Hardened build
minimal ports, security patches applied at build time
Grype on Ubuntu 24.04
Azure
Security
Grype, the fast open source vulnerability scanner for container images, filesystems and SBOMs, ready to find known CVEs the moment you log in.
Overview
Grype is an open source vulnerability scanner from Anchore. It finds known security vulnerabilities in the software you ship, matching the packages it discovers against a regularly updated vulnerability database. It scans container images directly with no Docker daemon required, along with directories, filesystems, archives and git checkouts, and it reads Syft, SPDX and CycloneDX SBOMs so you can scan a bill of materials produced earlier in your pipeline. It understands operating system packages across the major Linux distributions and language dependencies for Java, Python, JavaScript, Ruby, Go, .NET, Rust, PHP and more, and its exit code and severity gating make it a natural fit for build pipelines that must fail when a serious vulnerability appears.
It suits security and platform teams who need to audit images and code for known vulnerabilities, gate a CI pipeline on severity, or run ad hoc scans of artifacts and dependency trees on infrastructure they own.
Why the cloudimg image
cloudimg delivers Grype fully installed on a hardened, fully patched Ubuntu base, verified against the project's official signed checksums before install. The vulnerability database is pre-downloaded into a shared system wide cache during the build, so the first scan on a fresh instance is fast and works without waiting on a database fetch, and the cache is exported for every login shell and keeps refreshing itself as it ages. There is no listening service and no baked credential to manage: the instance is a self contained scanning workstation you SSH into and point at your images, directories or SBOMs. The base keeps receiving unattended security updates, and every deployment is paired with a step by step deploy guide and backed by 24/7 cloudimg support.
Common uses
- Scan container images and filesystems for known CVEs
- Gate a CI pipeline on vulnerability severity
- Scan an existing SBOM for vulnerable dependencies
More in Security
KeePass Password Manager
Security
KeePass is a free, open source password manager that stores all your passwords in a highly encrypted database. The datab...
CrowdSec
Security
This image runs CrowdSec, the free and open source collaborative behavioural security engine.
Ollama GPU-Accelerated LLM Server
Security
This image runs Ollama 0.30, the easiest way to run open large language models locally - pull and serve Llama, Mistral, ...
OWASP ZAP
Security
This image runs OWASP ZAP (the Zed Attack Proxy), the world's most widely used open source web-application security scan...
step-ca
Security
This image runs step-ca, the open source online certificate authority from Smallstep for secure, automated X.509 and ACM...
Trivy Security Scanner
Security
This image runs Trivy, the open source, Apache-2.0 licensed all-in-one security scanner from Aqua Security.