Grype Vulnerability Scanner

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Grype is the open source, Apache-2.0 licensed vulnerability scanner from Anchore - one of the most widely adopted open source container security tools in the DevSecOps ecosystem. From a single command line it finds known vulnerabilities (CVEs) in operating-system packages across major Linux distributions and in language dependencies (Java, Python, JavaScript, Ruby, Go, .NET, Rust, PHP and others), across container images, directories, filesystems, archives and Git checkouts, and it reads a Syft, SPDX or CycloneDX software bill of materials produced earlier in your pipeline. This AMI delivers Grype fully installed and configured as a ready-to-use scanning workstation - SSH in and start scanning immediately with no setup required.

## Why Choose This AMI Over Self-Installation

Deploying Grype from scratch means installing the binary, downloading the vulnerability database, configuring cache paths, and verifying checksums - a process that typically takes 15-30 minutes of manual effort per instance. This AMI eliminates that entire workflow:

• Zero setup time - The grype binary is pre-installed on the system path and verified against the official Anchore release checksum. You are scanning within seconds of SSH login.
• Offline-ready - The vulnerability database is pre-downloaded into a shared system cache, so your first scan returns results immediately with no network fetch.
• Shared system cache - The database lives in a world-readable, sticky cache so every login user can read and refresh it, and the cache path is exported to every shell.
• Container scanning with no Docker daemon - Grype pulls and scans images directly from any registry without a running container runtime.

## What You Can Scan

• Container images from any registry, no Docker daemon required
• Local directories, filesystems, archives and Git checkouts
• Operating-system packages and language dependencies (Java, Python, JavaScript, Ruby, Go, .NET, Rust, PHP and more)
• Syft, SPDX and CycloneDX SBOMs generated earlier in your pipeline
• Findings with severity, fixed-in version and EPSS exploit-probability, ready to gate CI

## Getting Started

1. Launch the AMI on your preferred EC2 instance type

2. Connect over SSH using your key pair

3. Run `grype version` to confirm the toolchain and `grype db status` to see the pre-loaded database

4. Point Grype at any target - `grype dir:/path`, `grype `, or `grype sbom:./sbom.json`

5. Review results immediately - the pre-loaded database means no download wait

## Sample Scan Output

A typical scan produces a table showing each vulnerability's ID, its severity (Critical, High, Medium, Low, Negligible), the affected package and installed version, and the version that fixes it. JSON output (`grype -o json`) provides machine-readable results including EPSS exploit-probability scores, making it straightforward to feed findings into policy engines, dashboards, or CI gates.

## CI Pipeline Integration

Use this AMI as a CI runner image or scanning bastion within your environment:

• Set `--fail-on critical` to automatically fail builds when critical CVEs are detected
• Emit JSON output and pipe it to your policy engine for granular severity gating
• Launch the AMI as an ephemeral EC2 instance from your CI system (GitHub Actions, GitLab CI, Jenkins or AWS CodeBuild) to run scans as a build step

## Security Practices

The Grype binary is verified against the official release checksum during the AMI build process. The image runs no network service beyond SSH, and all scanning is performed locally on the instance - no scan data leaves your environment unless you explicitly configure external reporting. SSH access uses key-based authentication.

## Use Cases

• Managed scanning bastion - Audit container images and hosts from a central, always-ready workstation
• CI runner image - Fail pull requests on critical CVEs using Grype exit codes and `--fail-on`
• Air-gapped scanning - Ship with the vulnerability database pre-loaded for environments without internet access
• SBOM-driven scanning - Scan the SBOM your pipeline already produced without re-scanning the artifact

## cloudimg Support

24/7 technical support by email and live chat covers scan configuration, severity gating and exit codes, ignore rules, SBOM scanning, container-image and filesystem scanning, database refresh and air-gapped operation, and CI integration. Critical issues receive a one-hour average response.

## Next Steps

Contact support@cloudimg.co.uk to request a sample scan report, schedule a CI integration walkthrough, or ask any pre-purchase questions about the product.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.