Grype

Grype: Container and Filesystem Vulnerability Scanner

Grype is a fast, accurate open-source vulnerability scanner from Anchore. It scans container images and filesystems against multiple vulnerability databases (NVD, RHSA, Debian, Ubuntu, Alpine, etc.) and integrates with Syft for SBOM-based scanning.

Defensive use only: Only scan systems, images, and codebases you own or have explicit permission to scan.

Installation

# macOS
brew install anchore/grype/grype

# Linux / macOS (installer script)
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

# Verify
grype version

Basic Scanning

# Scan a container image
grype nginx:latest

# Scan your application image
grype my-app:1.0.0

# Scan only CRITICAL and HIGH vulnerabilities
grype nginx:latest --fail-on critical

# Scan a local Dockerfile context
grype dir:./my-project

# Scan a local filesystem path
grype dir:/path/to/project

# Scan a specific file (e.g., lockfile or SBOM)
grype file:package-lock.json
grype file:requirements.txt
grype file:sbom.syft.json

Output Formats

# Table (default)
grype nginx:latest

# JSON (for CI processing)
grype nginx:latest -o json

# JSON with detailed info
grype nginx:latest -o json | jq '.matches[] | {name: .artifact.name, version: .artifact.version, cve: .vulnerability.id, severity: .vulnerability.severity}'

# SARIF (GitHub Security tab)
grype nginx:latest -o sarif > results.sarif

# Template (custom)
grype nginx:latest -o template -t "{{range .Matches}}{{.Vulnerability.ID}} {{.Artifact.Name}}\n{{end}}"

# Embedded SBOM as CycloneDX
grype nginx:latest -o cyclonedx

CI/CD Integration

GitHub Actions

# .github/workflows/grype.yml
name: Vulnerability Scan
on: [push, pull_request]

jobs:
  grype-scan:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read

    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: docker build -t my-app:${{ github.sha }} .

      - name: Scan image with Grype
        uses: anchore/scan-action@v3
        id: scan
        with:
          image: 'my-app:${{ github.sha }}'
          fail-build: true
          severity-cutoff: high
          output-format: sarif

      - name: Upload SARIF to GitHub
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}

      - name: Scan filesystem
        uses: anchore/scan-action@v3
        with:
          path: '.'
          fail-build: false
          output-format: table

Docker Compose / Makefile

# Makefile
.PHONY: security-scan

security-scan:
	@echo "Scanning Docker image for vulnerabilities..."
	grype my-app:latest --fail-on high
	@echo "Scanning project dependencies..."
	grype dir:. --fail-on critical
	@echo "Security scan complete!"

# Run before pushing to registry
pre-push: build security-scan push

Grype + Syft (SBOM-Based Scanning)

# First generate an SBOM with Syft
syft my-app:latest -o syft-json > sbom.syft.json

# Then scan the SBOM with Grype (no need to have the image locally)
grype sbom:sbom.syft.json

# This workflow separates SBOM generation from scanning:
# 1. Dev team generates SBOM at build time
# 2. Security team scans SBOM independently
# 3. SBOM can be stored alongside the artifact

Configuration File

# ~/.grype.yaml or .grype.yaml in project root

output: table
quiet: false
check-for-app-update: false

db:
  auto-update: true
  validate-by-hash-on-start: false

# Ignore specific CVEs or conditions
ignore:
  - vulnerability: CVE-2023-12345
    reason: "Not exploitable in our context — network not exposed"
    expires: "2024-06-01"
  
  - vulnerability: CVE-2023-99999
    package:
      name: libssl
      version: "1.1.1n"
    reason: "Vendor confirmed not affected"

# Fail the scan at this severity or above  
fail-on-severity: high

Interpreting Results

NAME          INSTALLED  FIXED-IN  TYPE  VULNERABILITY  SEVERITY
openssl       1.1.1n     1.1.1t    deb   CVE-2023-0464  HIGH
libxml2       2.9.14     2.9.14+   deb   CVE-2022-40303 MEDIUM
curl          7.88.1     (none)    deb   CVE-2023-28321 MEDIUM

Key columns:

• FIXED-IN: If populated, update to this version to remediate
• (none) in FIXED-IN: No fix available yet — consider workarounds or accepting risk
• TYPE: Package ecosystem (deb, rpm, apk, python, npm, go, java, etc.)

Remediation Workflow

# 1. Identify vulnerable packages
grype my-app:latest -o json | jq '[.matches[] | select(.vulnerability.severity == "Critical")]'

# 2. Check if fixes are available
grype my-app:latest -o json | jq '[.matches[] | {cve: .vulnerability.id, fixedIn: .vulnerability.fix.versions}]'

# 3. After updating, verify fix
docker build -t my-app:patched .
grype my-app:patched --fail-on critical

# 4. Track remediation over time
grype my-app:latest -o json > before.json
# ... apply fixes ...
grype my-app:patched -o json > after.json
diff <(jq '[.matches[].vulnerability.id]' before.json | sort) \
     <(jq '[.matches[].vulnerability.id]' after.json | sort)

Grype vs Trivy Comparison

GitNexus Index

This skill is indexed by GitNexus for knowledge graph traversal. Index path: /Users/localuser/.claude/skills/grype/.gitnexus Last indexed: 2026-05-24