OSI-licensed open source

Open-Source Container Scanning Tools (2026)

Container scanning finds known vulnerabilities, misconfigurations, secrets and policy violations in container images and the clusters that run them. Open-source scanners let DevOps and security teams add checks to CI pipelines and registries without per-image licence fees, and most output SARIF, JSON or SBOM formats for downstream tooling.

This guide covers nine Apache-2.0 projects, each verified on its repository on 2026-11-07, grouped by job: vulnerability scanners (Trivy, Grype, Clair, OSV-Scanner), SBOM generation (Syft), image and host hardening (Dockle, Docker Bench) and Kubernetes or runtime security (Kubescape, Falco). Most teams combine two or three.

Tools, licences and pricing checked against vendor and repository pages on November 7, 2026.

What to look for

  • •Scan targets: images, filesystems, SBOMs, Kubernetes manifests, running clusters
  • •Vulnerability data sources and update frequency
  • •CI and registry integration, output formats such as SARIF and CycloneDX
  • •Beyond CVEs: secrets, misconfiguration and licence checks
  • •Speed and footprint in pipelines
  • •Runtime detection versus build-time scanning

At a glance

ToolBest forPricingLicence
TrivyAll-in-one scanner for CI pipelinesFree, open sourceApache-2.0
GrypeFast vulnerability scans, paired with Syft SBOMsFree, open sourceApache-2.0
SyftGenerating SBOMs from imagesFree, open sourceApache-2.0
ClairRegistry-integrated static analysisFree, open sourceApache-2.0
DockleLinting images against best practicesFree, open sourceApache-2.0
Docker Bench for SecurityAuditing Docker hosts against CISFree, open sourceApache-2.0
OSV-ScannerDependency and image scans using OSV dataFree, open sourceApache-2.0
KubescapeKubernetes posture and compliance scanningFree, open source; vendor offers commercial platform, see vendor pricingApache-2.0
FalcoRuntime threat detection in containersFree, open sourceApache-2.0

1. Trivy

Apache-2.0

Best for: All-in-one scanner for CI pipelines · Free, open source

Trivy is a comprehensive security scanner. It scans container images, filesystems and repositories for vulnerabilities, misconfigurations, secrets and software licences, and can generate SBOMs.

Strengths

  • + Covers vulnerabilities, misconfiguration and secrets
  • + Easy CI integration
  • + Single binary

Trade-offs

  • − Broad scope can mean noisy output without tuning
WebsiteRepository

2. Grype

Apache-2.0

Best for: Fast vulnerability scans, paired with Syft SBOMs · Free, open source

Grype is a vulnerability scanner for container images and filesystems. It scans images, filesystems and SBOMs for known vulnerabilities.

Strengths

  • + Scans SBOMs directly
  • + Simple CLI
  • + Pairs with Syft

Trade-offs

  • − Focused on vulnerabilities only
WebsiteRepository

3. Syft

Apache-2.0

Best for: Generating SBOMs from images · Free, open source

Syft is a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems, and works well with a scanner such as Grype.

Strengths

  • + Multiple SBOM formats
  • + Library and CLI
  • + Works with Grype

Trade-offs

  • − Does not scan for vulnerabilities by itself
WebsiteRepository

4. Clair

Apache-2.0

Best for: Registry-integrated static analysis · Free, open source

Clair is an open-source project for the static analysis of vulnerabilities in application containers, including OCI and Docker images. It powers scanning in the Quay registry.

Strengths

  • + Designed for registry integration
  • + Static analysis service
  • + Apache-2.0

Trade-offs

  • − Runs as a service, more setup than a CLI
WebsiteRepository

5. Dockle

Apache-2.0

Best for: Linting images against best practices · Free, open source

Dockle is a container image linter for security that helps build best-practice, secure Docker images, with checkpoints that include CIS benchmarks.

Strengths

  • + CIS-based image checks
  • + Fast CLI
  • + Good CI fit

Trade-offs

  • − Not a CVE scanner
WebsiteRepository

6. Docker Bench for Security

Apache-2.0

Best for: Auditing Docker hosts against CIS · Free, open source

Docker Bench for Security is a script that checks dozens of common best practices for deploying Docker containers in production, based on the CIS Docker Benchmark.

Strengths

  • + Automated CIS checks
  • + Simple script
  • + Official Docker repo

Trade-offs

  • − Host audit only, not image CVEs
WebsiteRepository

7. OSV-Scanner

Apache-2.0

Best for: Dependency and image scans using OSV data · Free, open source

OSV-Scanner is an officially supported frontend to the OSV database that finds vulnerabilities affecting a project dependencies, supporting a wide range of languages and container images.

Strengths

  • + Open OSV database
  • + Wide ecosystem support
  • + Backed by Google

Trade-offs

  • − Less breadth than all-in-one scanners
WebsiteRepository

8. Kubescape

Apache-2.0

Best for: Kubernetes posture and compliance scanning · Free, open source; vendor offers commercial platform, see vendor pricing

Kubescape is an open-source Kubernetes security platform offering hardening, posture management and runtime security across the development and deployment lifecycle.

Strengths

  • + Kubernetes-native checks
  • + Covers manifests to runtime
  • + CNCF ecosystem

Trade-offs

  • − Kubernetes-focused
WebsiteRepository

9. Falco

Apache-2.0

Best for: Runtime threat detection in containers · Free, open source

Falco is a cloud-native runtime security tool for Linux that detects and alerts on abnormal behaviour and potential threats in real time by monitoring kernel events with custom rules.

Strengths

  • + Real-time detection
  • + Custom rules
  • + CNCF project

Trade-offs

  • − Detects at runtime, not in images
WebsiteRepository

New tools in this space, weekly

One email a week with the tools, launches and releases added to TechLogHub. Unsubscribe in one click.

Get the TechLogHub digest

One email a week: new and trending developer tools, fresh comparisons, and what shipped. Unsubscribe in one click.

How to choose

If you need…Start with
One scanner for CITrivy
SBOM then scan workflowSyft, Grype
Registry-integrated scanningClair
Best-practice and CIS checksDockle, Docker Bench for Security
Kubernetes and runtime securityKubescape, Falco

Open-Source Container Scanning Tools: FAQ

Quick answers to common questions

What is the best open-source container scanner?

Trivy is the most common all-in-one choice, while Grype with Syft is a popular SBOM-first alternative. Clair suits registry-based scanning.

Do scanners find runtime threats?

Image scanners find known vulnerabilities before deployment. For runtime detection use Falco or the runtime features in Kubescape.

Are these tools licensed as open source?

Yes. All nine are Apache-2.0 according to their repositories.

How often should I scan?

Scan on every build and again on a schedule for images in production, because new CVEs are published after an image is built.

Related categories

Best Open-Source Container RegistriesOpen-Source SCA and SBOM ToolsBest Open-Source Software Security ToolsVulnerability Management Software ComparedOpen-Source Container Orchestration Platforms

Building a tool in this category?

List it on TechLogHub and we'll review it for this guide.

Submit a tool