# README
Clair
Note: The master branch may be in an unstable or even broken state during development.
Please use releases instead of the master branch in order to get stable binaries.
Clair is an open source project for the static analysis of vulnerabilities in application containers (currently including appc and docker).
- In regular intervals, Clair ingests vulnerability metadata from a configured set of sources and stores it in the database.
- Clients use the Clair API to index their container images; this creates a list of features present in the image and stores them in the database.
- Clients use the Clair API to query the database for vulnerabilities of a particular image; correlating vulnerabilities and features is done for each request, avoiding the need to rescan images.
- When updates to vulnerability metadata occur, a notification can be sent to alert systems that a change has occurred.
Our goal is to enable a more transparent view of the security of container-based infrastructure.
Thus, the project was named Clair after the French term which translates to clear, bright, transparent.
Getting Started
- Learn the terminology and about the drivers and data sources that power Clair
- Watch presentations on the high-level goals and design of Clair
- Follow instructions to get Clair up and running
- Explore the API on SwaggerHub
- Discover third party integrations that help integrate Clair with your infrastructure
- Read the rest of the documentation on the CoreOS website or in the Documentation directory
- Get up and running with Local Development
Community
- Mailing List: [email protected]
- IRC: #clair on freenode.org
- Bugs: issues
Contributing
See CONTRIBUTING for details on submitting patches and the contribution workflow.
License
Clair is under the Apache 2.0 license. See the LICENSE file for details.
# Functions
AnalyzeLayer retrieves the clair layer with all extracted features and namespaces.
EnabledDetectors retrieves a list of all detectors installed in the Clair instance.
GetLastUpdateTime retrieves the latest successful time of update and whether or not it's the first update.
IsAncestryCached checks if the ancestry is already cached in the database with the current set of detectors.
NewAncestryBuilder creates a new ancestry builder.
RegisterConfiguredDetectors populates the database with registered detectors.
RunNotifier begins a process that checks for new notifications that should be sent out to third parties.
RunUpdater begins a process that updates the vulnerability database at regular intervals.
SaveAncestry saves an ancestry to the datastore.
# Variables
EnabledUpdaters contains all updaters to be used for update.
ExtractBlobError represents an analyzer error caused by failure of extracting a layer blob by imagefmt.
FeatureDetectorError is an error caused by failure of feature listing by featurefmt.
NamespaceDetectorError is an error caused by failure of namespace detection by featurens.
RetrieveBlobError represents an analyze error caused by failure of downloading or extracting layer blobs.
StorageError represents an analyze error caused by the storage.
# Structs
AncestryBuilder builds an Ancestry, which contains an ordered list of layers and their features.
UpdaterConfig is the configuration for the Updater service.
# Type aliases
AnalyzeError represents an failure when analyzing layer or constructing ancestry.