grype(1)
Grype is a vulnerability scanner for container images and filesystems that detects known security vulnerabilities in software dependencies.
Synopsis
grype [OPTION]... [SOURCE]Description
Grype scans container images, directories, and other sources for known vulnerabilities in application dependencies. It identifies packages and their versions, then cross-references them against multiple vulnerability databases to report security issues with severity ratings and remediation guidance.
Grype supports scanning Docker images, OCI images, directories, and can output results in multiple formats including JSON, SARIF, and human-readable text. It works offline by default using cached vulnerability data.
Common options
| Flag | What it does |
|---|---|
-o, --output FORMAT | Output format: json, sarif, cyclonedx, table, or template (default: table) |
--db DIR | Specify path to vulnerability database directory |
--check-for-app-update | Check for newer Grype application version |
-q, --quiet | Suppress non-essential output |
--fail-on SEVERITY | Exit with error code if vulnerabilities at or above severity found (e.g., high, critical) |
--only-fixed | Only report vulnerabilities that have fixed versions available |
-v, --verbose | Increase verbosity for debugging output |
--update-db | Update vulnerability database to latest version |
--file FILE | Report output to a file instead of stdout |
--platform PLATFORM | Specify platform for container images (e.g., linux/amd64) |
Examples
Scan a Docker image named nginx:latest for vulnerabilities and display results in table format
grype nginx:latestScan a local directory and output vulnerability findings in JSON format to a file
grype dir:/path/to/project -o json > results.jsonScan Ubuntu image and exit with error code if any critical vulnerabilities are found
grype ubuntu:22.04 --fail-on criticalScan an OCI image directory and generate a SARIF format report for CI/CD integration
grype oci-dir:/tmp/oci-image -o sarif --file sarif-report.jsonScan a private registry image and report only vulnerabilities with available fixes
grype localhost:5000/myapp:v1.0 --only-fixedScan vulnerabilities from a pre-generated SBOM file with minimal output
grype sbom:sbom.json --quiet