CoreOS Clair Reviews

One thing I like about this tool is the ease of use when scanning of vulnerabilities. This can easily be deployed with Kubernetes and Docker. Easy to use with enterprise distros like Red Hat. I really like how easy it is to set up on your machine. It takes only a few minutes with a Docker container to launch the platform.

It is an open source tool and not exactly reliable. There are updates that get launched for the tool; but there is no knowing whether the tool is completely up to date. It is not in a stable state for long term use and can require a lot of administration in order to support it.

For anyone using CoreOS; I strongly recommend using AWS services as well as Red Hat enterprise; this is a great tool to implement into this kind of architecture.

We are using CoreOS for vulnerability assessment. I am using this tool with Docker; in order to launch this tool on various servers; that way it can be used for vulnerability assessments. Benefits I have realized are that if you are already an AWS and Red Hat user; this tool is easy to set up.

Vulnerability data is continuously imported from a known set of sources and correlated with the indexed contents of container images in order to produce lists of vulnerabilities that threaten a container. When vulnerability data changes upstream, the previous state and new state of the vulnerability along with the images they affect can be sent via webhook to a configured endpoint.

While importing vulnerability data we are facing issues. And not able to store in a container. The data is missing while storing in docker.

All major components can be customized programmatically at compile-time without forking the project. And used in our industry.

I like how easy it is to scan containers for vulnerabilities. You can point an image at it and it will give you a full report.

I dislike that it's only static analysis, but it does get the job done.

You may have to script up a wrapper around the tool to use for CI/CD, but it's definitely worth it.

We needed a way to scan images during CI/CD before we pushed them to our master registry. Clair fit right into our pipeline and we can fail a build if it fails a the vulnerability scan.

vulnerability newsfeed and Pre-production analysis

Did not find any kind of problem yet. Very impressive

Very effective software

OS tech vulnerability test

You can set automatic builds to test your code.

It allows for organized planning through the Boards section.

With all of the features, it's easy to get lost.

I am trying to solve a business problem