cyber-scanning-container-images-with-grype

name	cyber-scanning-container-images-with-grype
description	Scan container images for known vulnerabilities using Anchore Grype with SBOM-based matching and configurable severity thresholds.
source	mukul975/Anthropic-Cybersecurity-Skills
license	Apache-2.0
authorized_lab	false
origin_frontmatter	name: scanning-container-images-with-grype | description: Scan container images for known vulnerabilities using Anchore Grype with | SBOM-based matching and configurable severity thresholds. | domain: cybersecurity | subdomain: container-security | tags: | - grype | - vulnerability-scanning | - container-security | - sbom | - anchore | - supply-chain | version: '1.0' | author: mahipal | license: Apache-2.0 | nist_csf: | - PR.PS-01 | - PR.IR-01 | - ID.AM-08 | - DE.CM-01 | mitre_attack: | - T161
hide	true

Defensive/analysis cyber skill. Source: mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.

Scanning Container Images with Grype

Overview

Grype is an open-source vulnerability scanner from Anchore that inspects container images, filesystems, and SBOMs for known CVEs. It leverages Syft-generated SBOMs to match packages against multiple vulnerability databases including NVD, GitHub Advisories, and OS-specific feeds.

When to Use

• When conducting security assessments that involve scanning container images with grype
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Docker or Podman installed
• Grype CLI installed (curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin)
• Syft CLI (optional, for SBOM generation)
• Network access to pull vulnerability databases

Core Commands

Install Grype

# Install via script
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

# Verify installation
grype version

# Install via Homebrew (macOS/Linux)
brew install grype

Scan Container Images

# Scan a Docker Hub image
grype nginx:latest

# Scan from Docker daemon
grype docker:myapp:1.0

# Scan a local archive
grype docker-archive:image.tar

# Scan an OCI directory
grype oci-dir:path/to/oci/

# Scan a Singularity image
grype sif:image.sif

# Scan a local directory / filesystem
grype dir:/path/to/project

Output Formats

# Default table output
grype alpine:3.18

# JSON output for pipeline processing
grype alpine:3.18 -o json > results.json

# CycloneDX SBOM output
grype alpine:3.18 -o cyclonedx

# SARIF output for GitHub Security tab
grype alpine:3.18 -o sarif > grype.sarif


grype alpine:3.18 -o template -t /path/to/template.tmpl