Secure · Vulnerability scanner
Grype
Grype matches package inventories — from images, directories or an SBOM — against vulnerability data from multiple sources and can fail a pipeline at a chosen severity.
On this page
What it does
Scans an image, directory or SBOM (sbom:file.json) and reports vulnerabilities with severity and fix availability. Pairs naturally with Syft.
Where it fits
Secure stage, and especially re-scanning stored SBOMs when new CVEs are published — no image pull needed.
Quick start
grype registry.example.com/app:1.2.3 --only-fixed --fail-on high
grype sbom:app.cdx.json -o jsonCommon pitfalls
- Different tools rate the same CVE differently; choose one scanner as the gate to avoid contradictory pipelines.
- Keep the DB fresh in air-gapped environments (
grype db updatefrom a mirror).
On this site
- Scan Images and SBOMs with Grype in the Software Supply Chain Security path: 183 findings to 3 with two Dockerfile changes, and the CI exit codes.
Hands-on labs using Grype
Generate an SBOM with Syft and Scan It with Grype
Produce CycloneDX and SPDX bills of materials for a container image without a Docker socket, scan the SBOM with Grype, gate on fixable findings only, and see why the SBOM is worth keeping after the release.
Articles about Grype
Scan Images and SBOMs with Grype: From 183 Findings to 3
Grype against the SBOM from part 2: 183 matches read by severity, ecosystem and fix state; two Dockerfile changes that take it to 3; exit-code behaviour for CI; and how to triage what remains.