/container-grype

name: container-grype
description: >
  Container vulnerability scanning and dependency risk assessment using Grype with CVSS severity
  ratings, EPSS exploit probability, and CISA KEV indicators. Use when: (1) Scanning container
  images and filesystems for known vulnerabilities, (2) Integrating vulnerability scanning into
  CI/CD pipelines with severity thresholds, (3) Analyzing SBOMs (Syft, SPDX, CycloneDX) for
  security risks, (4) Prioritizing remediation based on threat metrics (CVSS, EPSS, KEV),
  (5) Generating vulnerability reports in multiple formats (JSON, SARIF, CycloneDX) for security
  toolchain integration.
version: 0.1.0
maintainer: SirAppSec
category: devsecops
tags: [container-security, vulnerability-scanning, sca, sbom, cvss, cve, docker, grype]
frameworks: [CWE, NIST]
dependencies:
  tools: [grype, docker]
references:
  - https://github.com/anchore/grype
  - https://www.cve.org/
  - https://nvd.nist.gov/

Container Vulnerability Scanning with Grype

Overview

Grype is an open-source vulnerability scanner that identifies known security flaws in container images, filesystems, and Software Bill of Materials (SBOM) documents. It analyzes operating system packages (Alpine, Ubuntu, Red Hat, Debian) and language-specific dependencies (Java, Python, JavaScript, Ruby, Go, PHP, Rust) against vulnerability databases to detect CVEs.

Grype emphasizes actionable security insights through:

• CVSS severity ratings for risk classification
• EPSS exploit probability scores for threat assessment
• CISA Known Exploited Vulnerabilities (KEV) indicators
• Multiple output formats (table, JSON, SARIF, CycloneDX) for toolchain integration

Quick Start

Scan a container image:

grype <image-name>

Examples:

# Scan official Docker image
grype alpine:latest

# Scan local Docker image
grype myapp:v1.2.3

# Scan filesystem directory
grype dir:/path/to/project

# Scan SBOM file
grype sbom:/path/to/sbom.json

Core Workflow

Basic Vulnerability Scan

1. **Identify scan target**: Determine what to scan (container image, filesystem, SBOM) 2. **Run Grype scan**: Execute `grype <target>` to analyze for vulnerabilities 3. **Review findings**: Examine CVE IDs, severity, CVSS scores, affected packages 4. **Prioritize remediation**: Focus on critical/high severity, CISA KEV, high EPSS scores 5. **Apply fixes**: Update vulnerable packages or base images 6. **Re-scan**: Verify vulnerabilities are resolved

CI/CD Integration with Fail Thresholds

For automated pipeline security gates:

# Fail build if any critical vulnerabilities found
grype <image> --fail-on critical

# Fail on high or critical severities
grype <image> --fail-on high

# Output JSON for further processing
grype <image> -o json > results.json

**Pipeline integration pattern**: 1. Build container image 2. Run Grype scan with `--fail-on` threshold 3. If scan fails: Block deployment, alert security team 4. If scan passes: Continue deployment workflow 5. Archive scan results as build artifacts

SBOM-Based Scanning

Use Grype with Syft-generated SBOMs for faster re-scanning:

# Generate SBOM with Syft (separate skill: sbom-syft)
syft <image> -o json > sbom.json

# Scan SBOM with Grype (faster than re-analyzing image)
grype sbom:sbom.json

# Pipe Syft output directly to Grype
syft <image> -o json | grype

**Benefits of SBOM workflow**:

• Faster re-scans without re-analyzing image layers
• Share SBOMs across security tools
• Archive SBOMs for compliance and auditing

Risk Prioritization Workflow

Progress: [ ] 1. Run full Grype scan with JSON output: `grype <target> -o json > results.json` [ ] 2. Use helper script to extract high-risk CVEs: `./scripts/prioritize_cves.py results.json` [ ] 3. Review CISA KEV matches (actively exploited vulnerabilities) [ ] 4. Check EPSS scores (exploit probability) for non-KEV findings [ ] 5. Prioritize remediation: KEV > High EPSS > CVSS Critical > CVSS High [ ] 6. Document remediation plan with CVE IDs and affected packages [ ] 7. Apply fixes and re-scan to verify

Work through each step systematically. Check off completed items.

Output Formats

Grype supports multiple output formats for different use cases:

**Table (default)**: Human-readable console output

grype <image>

**JSON**: Machine-parseable for automation

grype <image> -o json

**SARIF**: Static Analysis Results Interchange Format for IDE integration

grype <image> -o sarif

**CycloneDX**: SBOM format with vulnerability data

grype <image> -o cyclonedx-json

**Template**: Custom output using Go templates

grype <image> -o template -t custom-template.tmpl

Advanced Configuration

Filtering and Exclusions

Exclude specific file paths:

grype <image> --exclude '/usr/share/doc/**'

Filter by severity:

grype <image> --only-fixed  # Only show vulnerabilities with available fixes

Custom Ignore Rules

Create `.grype.yaml` to suppress false positives:

ignore:
  # Ignore specific CVE
  - vulnerability: CVE-YYYY-XXXXX
    reason: "False positive - component not used"

  # Ignore CVE for specific package
  - vulnerability: CVE-YYYY-ZZZZZ
    package:
      name: example-lib
      version: 1.2.3
    reason: "Risk accepted - mitigation controls in place"

Database Management

Update vulnerability database:

grype db update

Check database status:

grype db status

Use specific database location:

grype <image> --db /path/to/database

Security Considerations

• **Sensitive Data Handling**: Scan results may contain package names and versions that reveal

application architecture. Store results securely and limit access to authorized security personnel.

• **Access Control**: Grype requires Docker socket access when scanning container images.

Restrict permissions to prevent unauthorized image access.

• **Audit Logging**: Log all Grype scans wit