Clair on Ubuntu 24.04 LTS
by cloudimg
Clair container image vulnerability scanner on Ubuntu 24.04 LTS by cloudimg
Clair on Ubuntu 24.04 LTS
Clair is an Apache-2.0 licensed open source static analysis service for containers, maintained by the Quay project. It pulls the layers of an OCI or Docker image, indexes the operating system and language packages inside them, matches those packages against a continuously updated set of vulnerability databases, and reports the known CVEs that affect the image. Clair has no web interface: it is an HTTP API service that registries, CI pipelines and security tooling call to submit images and read back a vulnerability report.
What the cloudimg image gives you
- Clair 4.9.0 built from the official quay/clair source release, running in combo mode (indexer, matcher and notifier in one process) as a dedicated clair system user
- A bundled local PostgreSQL back end on the same VM, so the appliance is fully self contained
- The clairctl command line client installed for one line image scans
- The REST API on port 6060 and a loopback-only introspection server (health checks and Prometheus metrics) on 127.0.0.1:8089
- A unique PostgreSQL password generated on each VM's first boot and written to a root-only file
Secure by default
No known credential ships in the image. Clair's REST API is unauthenticated by Clair's own default, and the appliance is secure by default because the Azure network security group opens only SSH (22) - port 6060 is not reachable from the network until you deliberately open it and apply your own access controls (NSG source restrictions, a TLS reverse proxy, or Clair's pre-shared-key JWT auth).
Licensing and support
Clair is Apache-2.0 and free. The cloudimg charge covers packaging, security patching, image maintenance and 24/7 expert support. Recommended size: Standard_B2s to start; scale up for larger images and higher scan throughput. A paired step by step deployment guide is provided: https://www.cloudimg.co.uk/guides/clair-on-ubuntu-24-04-azure/