scanning-container-images-with-grype

name	scanning-container-images-with-grype
description	Scan container images for known vulnerabilities using Anchore Grype with SBOM-based matching and configurable severity thresholds. Use when scaning container images for known vulnerabilities using anchore grype with.
domain	cybersecurity
subdomain	container-security
tags	["grype","vulnerability-scanning","container-security","sbom","anchore","supply-chain"]
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"]

Scanning Container Images with Grype

Overview

Grype is an open-source vulnerability scanner from Anchore that inspects container images, filesystems, and SBOMs for known CVEs. It leverages Syft-generated SBOMs to match packages against multiple vulnerability databases including NVD, GitHub Advisories, and OS-specific feeds.

When to Use

Trigger phrases:

• "scanning container images with grype"

• "Scan container images for known vulnerabilities using Anchore Grype with SBOM-ba"

• When conducting security assessments that involve scanning container images with grype

• When following incident response procedures for related security events

• When performing scheduled security testing or auditing activities

• When validating security controls through hands-on testing

Prerequisites

• Docker or Podman installed
• Grype CLI installed (curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin)
• Syft CLI (optional, for SBOM generation)
• Network access to pull vulnerability databases

Core Commands

This section covers core commands for scanning container images with grype.

• Ensure all prerequisites are met before proceeding
• Follow the documented workflow steps in sequence
• Record results and any anomalies encountered during this phase

Install Grype

# Install via script
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

# Verify installation
grype version

# Install via Homebrew (macOS/Linux)
brew install grype

Scan Container Images

# Scan a Docker Hub image
grype nginx:latest

# Scan from Docker daemon
grype docker:myapp:1.0

# Scan a local archive
grype docker-archive:image.tar

# Scan an OCI directory
grype oci-dir:path/to/oci/

# Scan a Singularity image
grype sif:image.sif

# Scan a local directory / filesystem
grype dir:/path/to/project

Output Formats