Container vulnerability scanning tools in 2026, by job
Trivy, Grype, Docker Scout, Snyk Container, Kubescape, Trivy Operator and StackRadar, sorted by what you are actually scanning: a CI image, a registry, or a running cluster. Which fits which job, and where each stops.
StackRadar Team
· 11 min read
Most "best container scanners" lists rank ten tools against each other as if they did the same job. They do not. A container vulnerability scanner is asked one of three questions — is this image clean before it ships, what is in this registry, or which running workloads does this CVE affect — and a tool that is excellent at one is often not built for the others. This post sorts the tools by job, says where each one stops, and includes our own two tools with the same scrutiny. All prices and facts are as of August 2026; the comparison pages hold the detail per product.
The three jobs
| Job | Question | Input | Output |
|---|---|---|---|
| CI / image scanning | Is this image clean enough to ship? | One image reference or tarball | Pass/fail, a findings list |
| Registry scanning | What is in everything we have pushed? | A registry or repository | Per-tag findings, usually in the registry UI |
| Running-cluster scanning | Which running workloads does CVE-X affect, and what deployed them? | The digests the kubelets report | Findings attributed to namespaces, workloads, releases |
The third job is the one the first two cannot do: a cluster runs many images nobody in your pipeline built (ingress controllers, agents, sidecars, CSI drivers), and an image that was clean when scanned in CI acquires new CVEs every week it keeps running.
Job 1: scanning an image in CI
Trivy
Trivy (Aqua Security, Apache-2.0) is the default answer and deserves to be. One binary scans images, filesystems, git repositories, IaC, Kubernetes manifests and secrets; the database is refreshed daily; the GitHub Action is a two-line addition. If you have no scanner in CI today, add Trivy and stop reading this section.
trivy image --severity HIGH,CRITICAL --exit-code 1 registry.example.com/shop/checkout:1.42.0Where it stops: Trivy is a scanner, not a system. It has no memory between runs, so a "new CVE in an image we shipped last month" question needs a rescan you schedule yourself. Ranking is CVSS; EPSS and KEV are not in the default output.
Grype (with Syft)
Grype (Anchore, Apache-2.0) is the matcher half of a pair; Syft is the SBOM generator. The design is the reason to choose it: generate the SBOM once, attach it to the image, and scan the SBOM — not the image — every time you want a fresh answer.
syft registry.example.com/shop/checkout:1.42.0 -o cyclonedx-json > checkout.cdx.json
grype sbom:checkout.cdx.json --fail-on highWhere it stops: images only; no IaC, no secrets, no Kubernetes awareness. And the same statelessness as Trivy — the SBOM-first workflow makes re-matching cheap, but the scheduling and storage are yours to build.
OSV-Scanner
OSV-Scanner (Google, Apache-2.0) matches against OSV.dev directly and gained container-image scanning in 2024. It is the most precise on language ecosystems, because OSV's version ranges are exact rather than inferred, and weakest on distro packages, where its coverage lags Trivy and Grype. It is also the library inside the StackRadar CLI.
StackRadar CLI
stackradar scan (Apache-2.0) scans a single image with --image, or every image a cluster is running, and adds the thing the others leave out: a KEV column and a --fail-on kev gate, so CI fails on exploited CVEs rather than on "anything critical". It is a point-in-time tool with no account and no telemetry.
Where it stops: it uses the osv-scanner library, so it inherits its distro-coverage limits; and it has no IaC, secrets or config scanning. For CI-only image scanning it is a reasonable choice, not a clearly better one than Trivy.
Job 2: scanning a registry
Docker Scout
Docker Scout scans images on push to Docker Hub and, via integrations, ECR, ACR and Artifactory, and surfaces results in Docker Desktop and the Hub UI with base-image update recommendations that are genuinely useful. Free for a small number of repositories, paid per repository beyond that. If your images live on Docker Hub, it is the least friction you will find.
Where it stops: it knows the registry, not the cluster. Which of the scanned tags are running, and where, is not a question it answers.
Snyk Container
Snyk Container integrates with most registries and with Kubernetes (importing workloads to scan), has a strong base-image recommendation engine and the best developer-facing UX of the group. Priced per developer; the free tier has a monthly test limit that a busy CI pipeline hits fast. It is a good fit for organisations already paying for Snyk Open Source. See the head-to-head.
Registry-native scanners
ECR (enhanced scanning uses Inspector), GCP Artifact Registry, Harbor (bundles Trivy), GitLab and GHCR-adjacent GitHub code scanning all scan on push. They are the right answer when "what did we push?" is the whole question; they are the wrong answer when you need one view across three clouds, or anything about runtime.
Job 3: scanning what is running
Trivy Operator
Trivy Operator watches workloads in one cluster, scans them with Trivy, and writes the results as custom resources (VulnerabilityReport, SbomReport, ConfigAuditReport and more) you read with kubectl. It is free, open source, and covers configuration and RBAC as well as vulnerabilities. For one or two clusters and a "what is vulnerable right now" question it is the tool we recommend most often, including on its own comparison page.
Where it stops: results live in etcd with a 24-hour TTL by default and are regenerated by rescanning, so there is no history and no fleet view without an aggregation layer you build. Ranking is CVSS only.
Kubescape
Kubescape (ARMO, CNCF) is primarily a posture tool — NSA/CISA and CIS frameworks, misconfiguration scanning, RBAC visualisation — that also does image vulnerability scanning in-cluster, with results as CRDs and an optional hosted UI from ARMO. Choose it when posture is the larger problem. Head-to-head.
StackRadar
StackRadar is a source-published in-cluster scanner plus a managed dashboard. The scanner generates a CycloneDX SBOM per running image with Syft and uploads only that; StackRadar keeps the SBOM and re-matches it as advisories land, so a new CVE is a finding without a rescan. Every cluster is in one view, findings are attributed to workloads, Helm releases and ArgoCD applications, history is kept (30 days free, up to two years paid), and the Radar Score ranks by CVSS, EPSS and KEV.
Where it stops: vulnerabilities only. No configuration audit, no RBAC assessment, no runtime detection, no CI scanning — Trivy Operator does the first two and we do not. The scanner is source-available (PolyForm Shield), not OSI open source. And the dashboard is a hosted service in the EU, which is a hard no for some organisations.
The CNAPP platforms
Wiz, Sysdig, Aqua, Defender for Containers and Prisma Cloud all scan running clusters as one feature of a much larger product — cloud posture, runtime detection, identity. They are the right answer for a security organisation consolidating a dozen tools, and the wrong answer for a platform team that wants one question answered; they are also quote-only, with typical entry points in the tens of thousands per year.
All of them, in one table
| Tool | CI image | Registry | Running cluster | Re-matches without rescan | EPSS / KEV | Licence / price |
|---|---|---|---|---|---|---|
| Trivy | Yes | Via Harbor etc. | Partly (trivy k8s) | No | No | Apache-2.0 |
| Grype + Syft | Yes | No | No | SBOM re-scan, manual | No | Apache-2.0 |
| OSV-Scanner | Yes | No | No | No | No | Apache-2.0 |
| StackRadar CLI | Yes | No | Yes, point-in-time | No | KEV | Apache-2.0 |
| Docker Scout | Yes | Yes | No | Yes, for Hub images | No | Free tier, then per repo |
| Snyk Container | Yes | Yes | Imported workloads | Yes | Partly | Free tier, then per developer |
| Trivy Operator | No | No | Yes, one cluster | No (24h TTL rescan) | No | Apache-2.0 |
| Kubescape | Via CLI | No | Yes, one cluster | No | No | Apache-2.0; hosted UI paid |
| StackRadar | No | No | Yes, every cluster | Yes | Both | Free / $59 / $199 per month |
| Wiz, Sysdig, Aqua, Defender | Yes | Yes | Yes | Yes | Varies | Quote-only |
A plain recommendation
- No scanner yet: Trivy in CI, today.
- Already producing SBOMs: Grype against them.
- One or two clusters, no history requirement: Trivy Operator.
- Need "which pods, in which clusters, and what changed since March?" answered without rescanning: something that keeps the SBOM — StackRadar, or the equivalent you build on Syft and a database.
- Need posture, runtime and vulnerabilities from one vendor: a CNAPP, with a budget.
Frequently asked questions
What is the best container vulnerability scanning tool?
There is no single best one, because "scanning a container" is three different jobs. For scanning an image in CI, Trivy and Grype are the free defaults and both are excellent. For a registry that scans on push, use the registry’s own scanner (ECR, Harbor with Trivy, Docker Hub with Scout) or Snyk. For knowing which running Kubernetes workloads a CVE affects, you need a cluster-aware tool: Trivy Operator or Kubescape in-cluster, or StackRadar for a managed, multi-cluster, history-keeping version.
Is Trivy or Grype better?
They are close enough that the choice is usually about surroundings. Trivy scans more kinds of thing (images, filesystems, git repos, IaC, secrets, Kubernetes clusters) from one binary and has the larger ecosystem. Grype does one thing — match packages to vulnerabilities — and pairs with Syft, so it is the natural choice if you already produce SBOMs and want to scan those rather than re-inventory the image. Run both on the same image and they will disagree at the margins; that is normal.
Why do different scanners report different vulnerabilities for the same image?
Two reasons. Different catalogers find different packages — one may see a vendored Go module or a jar-inside-a-jar the other misses. And different matchers use different databases and different rules for version ranges, distro backports and unfixed advisories. A 10–20% disagreement between two good scanners on a large image is typical and does not mean either is broken.
Do I need a paid container scanner?
Not for scanning. Trivy, Grype, OSV-Scanner and the StackRadar CLI cover image scanning for free and are as accurate as anything paid. What you pay for is what surrounds the scan: continuous re-matching as advisories land, a fleet-wide view, history, ranking by exploitation, and remediation guidance. Decide whether you need those before you shop.
Can I scan a running Kubernetes cluster from my laptop?
Yes. The free StackRadar CLI (`stackradar scan`) lists the image digests the kubelets are running via your kubeconfig, scans each once, and attributes findings to namespaces and pods. Trivy can do something similar with `trivy k8s`. Both are point-in-time; for a continuously current answer you need something running in or watching the cluster.