grype Documentation

Grype

Grype is a vulnerability scanner for container images and filesystems developed by Anchore. It easily finds vulnerabilities for major operating system packages and language-specific packages.

Key Features Copy Chapter

• Scans container images, filesystems, and SBOMs for known vulnerabilities
• Supports major Linux distributions (Alpine, Ubuntu, Debian, RHEL, CentOS, etc.)
• Language support for Java, JavaScript, Python, Go, Ruby, Rust, .NET, PHP, and more
• Works with Docker, OCI, and Singularity image formats
• Integrates with Syft for SBOM generation
• Supports VEX (Vulnerability Exploitability Exchange) for filtering results
• Risk scoring with EPSS (Exploit Prediction Scoring System) and CVSS metrics

Architecture Copy Chapter

• Written in Go
• Uses SQLite for vulnerability database storage
• Modular matcher system for different package types and ecosystems
• Automatic database updates from multiple vulnerability sources
• CLI-first design with multiple output formats (table, JSON, SARIF, CycloneDX)

Main Components Copy Chapter

• cmd/grype/ - CLI application entry point
• grype/ - Core library with matchers, database, and scanning logic
• grype/matcher/ - Package-specific vulnerability matchers
• grype/db/ - Database management and vulnerability storage
• grype/pkg/ - Package identification and metadata
• grype/presenter/ - Output formatting (JSON, table, SARIF, etc.)

Usage Copy Chapter

Basic vulnerability scan:

grype <image>

Scan with SBOM:

grype sbom:./sbom.json

The tool automatically manages its vulnerability database and provides configurable output formats and filtering options.