scanning-container-images-with-grype

# Scanning Container Images with Grype ## Overview Grype is an open-source vulnerability scanner from Anchore that inspects container images, filesystems, and SBOMs for known CVEs. It leverages Syft-generated SBOMs to match packages against multiple vulnerability databases including NVD, GitHub Advisories, and OS-specific feeds. ## When to Use - When conducting security assessments that involve scanning container images with grype - When following incident response procedures for related security events - When performing scheduled security testing or auditing activities - When validating security controls through hands-on testing ## Prerequisites - Docker or Podman installed - Grype CLI installed (`curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin`) - Syft CLI (optional, for SBOM generation) - Network access to pull vulnerability databases ## Core Commands ### Install Grype ```bash # Install via script curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin # Verify installation grype version # Install via Homebrew (macOS/Linux) brew install grype ``` ### Scan Container Images ```bash # Scan a Docker Hub image grype nginx:latest # Scan from Docker daemon grype docker:myapp:1.0 # Scan a local archive grype docker-archive:image.tar # Scan an OCI directory grype oci-dir:path/to/oci/ # Scan a Singularity image grype sif:image.sif # Scan a local directory / file...