Use Clair to scan container images and generate vulnerability reports
Introduction
Introduction to Clair deployment models
Create a combined deployment
Create a distributed deployment
Generate vulnerability reports
Next Steps
Use Clair to scan container images and generate vulnerability reports
Who is this for?
This is an advanced topic for software developers interested in scanning container images for vulnerabilities on Arm servers.
What will you learn?
Upon completion of this Learning Path, you will be able to:
- Install Clair on an Arm server
- Run Clair using combined and distributed deployment models
- Submit container images using the Clair CLI (command-line interface) and generate vulnerability reports
Prerequisites
Before starting, you will need the following:
- An Arm based instance from a cloud service provider or an Arm server with recent versions of Docker and Go installed.
Summary
This summary was drafted with an approved AI-assisted workflow and reviewed by Arm contributors before publication. Human technical review remains part of the process so the final page reflects engineering rigor, accuracy, and Arm editorial standards.
You’ll install and run Clair on Arm-based Linux servers using both combined and distributed deployment models. First, you’ll set up the combined deployment to run all services in a single process, then explore the distributed option where the indexer, matcher, and notifier operate as separate services. With Clair running, you’ll submit a container image manifest using
clairctl to perform static analysis and generate a vulnerability report. You’ll learn about timing considerations — allowing initial vulnerability data to populate the PostgreSQL database — so reports reflect current findings. By the end, you’ll launch Clair, select a deployment model, and produce a report for a chosen image.Frequently asked questions
These FAQs were drafted with an approved AI-assisted workflow and reviewed by Arm contributors before publication. Human technical review remains part of the process so the final page reflects engineering rigor, accuracy, and Arm editorial standards.
The combined deployment runs all Clair services in a single OS process and is the easiest to configure. The distributed deployment runs the indexer, matcher, and notifier as separate services.
Wait 5–10 minutes after starting Clair for vulnerabilities to populate in the PostgreSQL database. Submitting too soon can return a clean report even when issues exist. If that happens, wait and resubmit.
Submit the image’s manifest to your running Clair deployment using clairctl. The CLI sends the request and returns a vulnerability report when analysis completes.
The indexer, matcher, and notifier run as separate services in a distributed setup. The indexer retrieves image layers, scans them, and generates an intermediate IndexReport.
No. Clair performs static analysis of container images without running them.