Vendors & Products
15 entriesProducts and vendors listed for Container Security Tools.
01ClairClair is an open source project from Red Hat/CoreOS for the static analysis of vulnerabilities in OCI and Docker container images — comparing each image layer against CVE databases maintained by OS vendors including RHEL, Ubuntu, Debian, and Alpine. As a standalone API service, Clair integrates with container registries such as Harbor, Quay, and GitLab to provide automated vulnerability scanning in CI/CD pipelines, blocking vulnerable images before they reach production deployments.
02AnchoreAnchore provides deep static analysis of Docker images — examining every layer, installed package, configuration file, and binary to certify whether an image meets defined security policies and is free of critical vulnerabilities. It generates a detailed Software Bill of Materials (SBOM) for each image and supports custom policy bundles for fine-grained compliance enforcement, making it a popular choice for integrating image security gates into Jenkins, GitLab CI, and GitHub Actions pipelines to block non-compliant images before deployment.
03DagdaDagda is an open source security tool that combines static vulnerability analysis of Docker images with real-time runtime monitoring of running containers — detecting known CVEs, trojans, viruses, and malware using integrated ClamAV scanning and threat intelligence feeds. Its daemon monitoring capability continuously watches for anomalous container behaviors including unexpected process spawning, suspicious network connections, and unauthorized file system changes — bridging the gap between pre-deployment image scanning and live runtime threat detection. The GitHub repository's last commit was in July 2021, so check its activity before adopting it. The GitHub repository's last commit was in July 2021, so check its activity before relying on it.
04FalcoFalco is the CNCF-graduated cloud-native runtime security project and the de facto Kubernetes threat detection engine — using eBPF-based syscall interception to detect abnormal container behaviors at runtime, including shell spawning inside containers, privilege escalation attempts, unexpected network connections, and sensitive file access. Its flexible rules engine (written in Falco's YAML-based rule language) enables security teams to codify threat detection policies and route alerts to Slack, PagerDuty, Elasticsearch, Falco Sidekick, or any custom SIEM and incident response workflow.
05Aqua Vulnerability ScanningAqua Security's Container Vulnerability Scanning and Management platform protects cloud-native applications by continuously minimizing attack surface — detecting OS package and library CVEs, embedded secrets and API keys, misconfigurations, malware signatures, and insecure open source dependencies in images across registries, CI/CD pipelines, and live running workloads. Aqua provides comprehensive CVSS-based risk scoring, SLA-driven remediation prioritization, and integration with Jira, ServiceNow, and popular pipeline tools for end-to-end vulnerability lifecycle management.
06Docker Bench for SecurityDocker Bench for Security is an open source shell script that audits a Docker host against the CIS Docker Benchmark — checking dozens of production deployment best practices spanning host OS hardening, Docker daemon configuration, container runtime security settings, image trust verification, network exposure, and centralized logging setup. It produces a color-coded pass/warn/fail report with actionable remediation guidance for each check, making it the standard first-step security audit tool for organizations deploying Docker in production environments.
07HarborHarbor is a CNCF-graduated open source container registry that adds enterprise-grade security capabilities on top of standard OCI artifact storage — including policy-based access control (RBAC), mandatory vulnerability scanning via Trivy or Clair integrations, artifact signing for supply chain integrity using Notary/Cosign, cross-registry replication, and comprehensive audit logging. Organizations deploy Harbor as a self-hosted, security-hardened alternative to public registries for storing production container images in air-gapped, regulated, or multi-cloud environments.
08JFrog XrayJFrog Xray provides deep recursive scanning of all artifact types in JFrog Artifactory — including Docker images, npm packages, Maven JARs, Python wheels, Helm charts, and zip archives — analyzing all underlying layers and transitive dependencies for CVEs, license compliance violations, and operational risk. Its unique impact analysis feature can instantly identify which builds, releases, and deployed services are affected by a newly disclosed CVE, enabling security teams to respond to zero-day vulnerabilities across their entire software supply chain within minutes of disclosure.
09Qualys Container SecurityQualys Container Security provides continuous discovery, tracking, and protection of containers throughout their entire lifecycle — from build-time image scanning in CI/CD pipelines to runtime workload protection in Kubernetes clusters and ECS environments. Its agent-based approach delivers real-time visibility into all running containers across cloud and on-premises environments with zero-day CVE detection, CIS Kubernetes Benchmark compliance checks, behavioral anomaly detection, and consolidated reporting in the unified Qualys Cloud Platform alongside VM, compliance, and web application scanning modules.
10Docker ScanDocker Scan (powered by Snyk) provides integrated vulnerability scanning for Docker local images — surfacing OS package CVEs and application dependency vulnerabilities directly from the `docker scan` CLI command or Docker Desktop UI with no additional tooling required. It enables developers to identify and fix vulnerabilities early in the development loop before images are pushed to any registry, with direct links to Snyk's remediation guidance and fix advice, making security accessible at the point where images are first built.
11CiliumCilium is a CNCF-graduated open source project that provides eBPF-based networking, security, and observability for Kubernetes container workloads — implementing Layer 3/4/7 network policy enforcement, transparent WireGuard encryption, load balancing, and deep network flow visibility at the Linux kernel level without requiring service mesh sidecars. Its Hubble observability layer delivers real-time network flow monitoring, DNS-aware policy enforcement, and security event detection across the entire cluster, making Cilium the preferred network security plane for large-scale production Kubernetes deployments at companies like Google, AWS, and Datadog.
12OpenSCAPThe OpenSCAP ecosystem provides a suite of NIST SCAP-compliant tools for automated security compliance assessment, measurement, and enforcement of security baselines — supporting industry standards including CIS Benchmarks, DISA STIGs, PCI-DSS, and NIST SP 800-53 across Linux hosts and container images. The oscap-docker extension applies OpenSCAP assessments directly to Docker container images, enabling automated hardening compliance checking as part of CI/CD pipelines and periodic audit reporting against regulatory frameworks.
13Banyan CollectorBanyan Collector is an open source framework for introspecting Docker containers — extracting package manifests, installed software inventories, binary metadata, and configuration details from running or stopped containers without requiring root access or modification of the containerized applications. It provides a lightweight foundation for building custom container auditing, software inventory, and compliance tooling on top of its container inspection API, enabling teams to answer "what software is actually running in this container?" without heavyweight agent deployment. The GitHub repository's last commit was in August 2019, so check its activity before adopting it. The GitHub repository's last commit was in August 2019, so check its activity before relying on it.
14Black Duck hub-detect-wshub-detect-ws is a container-based web service from Black Duck (now Synopsys) that performs two complementary Docker image security analyses: file signature-based scanning (iScan) for known malicious files and binary fingerprints, and Linux package manager-based image inspection to identify all installed OS packages and compare them against the Black Duck KnowledgeBase of known open source CVEs and license risks. It enables organizations to integrate Black Duck's industry-leading open source risk management capabilities into containerized CI/CD workflows as a service endpoint. The GitHub repository was archived by its owner in May 2019. The GitHub repository was archived in May 2019.
15BattenBatten is an open source Docker host and container hardening and auditing tool that evaluates the security posture of Docker environments against established best practices — systematically checking host OS hardening, Docker daemon security configuration, container runtime settings, network exposure, volume security, and privilege management. It complements Docker Bench for Security with additional remediation automation scripts and hardening guidance, helping platform and operations teams enforce consistent, repeatable security baselines across container infrastructure at scale. The GitHub repository's last commit was in July 2015, so check its activity before adopting it. The GitHub repository's last commit was in July 2015, so check its activity before relying on it.
Related Pages
4 entriesRelated directories on this site.
Frequently Asked Questions
What is Container Security Tools?
Container security tools scan images, enforce policy and monitor runtime behaviour to protect containerised applications.
How do I choose Container Security Tools?
Compare vendors on image scanning accuracy, registry and CI integration, runtime detection, Kubernetes policy and licensing.
Which vendors are listed for Container Security Tools?
This directory lists 15 products and vendors, including Clair, Anchore, Dagda, Falco, Aqua Vulnerability Scanning.
What other directories relate to Container Security Tools?
See Kubernetes Security Tools, Cloud Workload Protection Platforms (CWPP), Software Composition Analysis (SCA) Tools.
How current are the listings?
Links were rechecked in October 2026. Vendors rename, merge and retire products often, so confirm details on the vendor's site; renamed products note where their old address now leads.