Who is this for?
This is an advanced topic for software developers interested in scanning container images for vulnerabilities on Arm servers.
What will you learn?
Upon completion of this Learning Path, you will be able to:
- Install Clair on an Arm server
- Run Clair using combined and distributed deployment models
- Submit container images using the Clair CLI (command-line interface) and generate vulnerability reports
Prerequisites
Before starting, you will need the following:
- An
Arm based instance
from a cloud service provider or an Arm server with recent versions of Docker and Go installed.
Summary
AI-assisted
This summary was drafted with an approved AI-assisted workflow and reviewed by Arm contributors before publication.
Human technical review remains part of the process so the final page reflects engineering rigor, accuracy, and Arm editorial standards.
You’ll install and run Clair on Arm-based Linux servers using both combined and distributed deployment models. First, you’ll set up the combined deployment to run all services in a single process, then explore the distributed option where the indexer, matcher, and notifier operate as separate services. With Clair running, you’ll submit a container image manifest using clairctl to perform static analysis and generate a vulnerability report. You’ll learn about timing considerations — allowing initial vulnerability data to populate the PostgreSQL database — so reports reflect current findings. By the end, you’ll launch Clair, select a deployment model, and produce a report for a chosen image.
Frequently asked questions
AI-assisted
These FAQs were drafted with an approved AI-assisted workflow and reviewed by Arm contributors before publication.
Human technical review remains part of the process so the final page reflects engineering rigor, accuracy, and Arm editorial standards.
The combined deployment runs all Clair services in a single OS process and is the easiest to configure. The distributed deployment runs the indexer, matcher, and notifier as separate services.
How do I know Clair is ready before submitting a manifest?Wait 5–10 minutes after starting Clair for vulnerabilities to populate in the PostgreSQL database. Submitting too soon can return a clean report even when issues exist. If that happens, wait and resubmit.
What do I submit to Clair to scan an image?Submit the image’s manifest to your running Clair deployment using clairctl. The CLI sends the request and returns a vulnerability report when analysis completes.
In a distributed deployment, which services run separately?The indexer, matcher, and notifier run as separate services in a distributed setup. The indexer retrieves image layers, scans them, and generates an intermediate IndexReport.
Does Clair run the container image during analysis?No. Clair performs static analysis of container images without running them.