Open Source Container Scanner
Container images bundle layers of someone else's dependencies, and a vulnerability that slipped into a base image weeks ago ships to production unless something catches it first. The open source tools here let you see precisely how images and manifests are evaluated and run that check inside your own pipeline, so you can gate deploys on findings you trust without sending your build artifacts to a third party.
Harbor
Cloud native registry for storing, signing, scanning, and replicating container images and Helm charts
Kubescape
Kubernetes security platform spanning IDEs, CI/CD pipelines, and live clusters
Clair
Static analysis for container image vulnerabilities, accessed through an API
Docker Bench for Security
Automated checks for Docker hosts and containers against the CIS Docker Benchmark
Falco
Cloud native runtime security for Linux that detects abnormal behavior in containers and hosts in real time
kube-bench
Checks whether Kubernetes is deployed according to the CIS Kubernetes Benchmark
KubeLinter
Static analysis for Kubernetes YAML files, Helm charts, and Kustomize manifests
Dockle
Container image linter that checks images against best practices and CIS Benchmarks
KICS
Static analysis for infrastructure as code that finds security, compliance, and misconfiguration issues