A container vulnerability scanner you can run in sixty seconds — then keep running

There are two honest answers to "which container vulnerability scanner should I use?", and they depend on whether you need an answer once or an answer that stays true. For once: a single static binary, no daemon, no account, that scans an image or an entire running cluster and tells you which pods carry known-exploited CVEs. For continuously: an in-cluster scanner that keeps an SBOM of every running image and re-checks it as advisories are published. StackRadar ships both. This page covers the first and then explains when you want the second.

Sixty seconds, no signup: the StackRadar CLI

stackradar scan is a free, Apache-2.0 command-line scanner (source on GitHub). Point it at an image, or at your kubeconfig, and it lists every finding with severity, fixed version and whether the CVE is in the CISA Known Exploited Vulnerabilities catalogue.

brew install lockdep/tap/stackradar
# or
curl -fsSL https://raw.githubusercontent.com/lockdep/stackradar-cli/main/install.sh | sh
# or
go install github.com/lockdep/stackradar-cli@latest

# one image, no cluster needed
stackradar scan --image nginx:1.27

# every running image in the current kubeconfig context, deduplicated by digest
stackradar scan

# just two namespaces, quieter output, exit 2 if anything exploited is running
stackradar scan -n payments -n checkout --min-severity high --fail-on kev

# a self-contained HTML report, or a live local dashboard
stackradar scan -o html --file report.html
stackradar scan --serve

What it does, and does not do:

• Scans what is running — the digests the kubelet reports — not what a manifest says. It needs list pods, the same permission as kubectl get pods.
• Matches OS and language packages against OSV using the embedded osv-scanner library, and flags CISA KEV entries so the exploited ones sort first.
• Pulls images with the registry credentials you already have. An image your laptop cannot reach says not reachable from here rather than guessing.
• Outputs a table, JSON, or a shareable HTML report; exit codes follow Grype's convention for CI gates.
• Sends nothing to StackRadar. Package names go to api.osv.dev, one GET goes to cisa.gov. No account, no telemetry.
• Is a point in time. Run it again tomorrow and yesterday's clean image may carry a new CVE — nothing here watches for that.

Scanning a Docker image before it ships

For image-at-rest scanning in CI, the CLI is one option among several good free ones. Use whichever fits the pipeline you have:

The thing none of them can tell you is what happens after the image ships: which cluster it landed in, whether it is still running three months later, and which CVE published since then applies to it.

When once is not enough: the in-cluster scanner

The StackRadar scanner is a small, source-published agent installed with one Helm chart. It generates a CycloneDX SBOM for every distinct image the cluster runs (using Syft), uploads only the SBOM, and StackRadar keeps it — so when the next advisory lands, the match happens against lists it already has. Every cluster shows up in one dashboard, findings are ranked by the Radar Score (CVSS, EPSS and KEV), and the history is kept for 30 days on the free plan, one year on Pro, two on Business.

Enlarge

helm install stackradar-scanner oci://ghcr.io/lockdep/charts/stackradar-scanner

The quick-start guide takes about ten minutes. The difference from the CLI, in one line: the CLI answers the question you have today; the scanner makes sure you can answer the one you will have next month. The Kubernetes vulnerability scanning page goes into what continuous means in practice.

Open-source container scanning, honestly

The CLI is Apache-2.0. The in-cluster scanner and its Helm chart are published under PolyForm Shield — every line that runs in your cluster is on GitHub, signed and version-pinned, and you can read, run and modify it; what the licence forbids is reselling it as a competing service. The dashboard is the paid, managed part. If "open source" on the licence line is a hard requirement, Trivy, Grype and Kubescape all satisfy it, and the open-source roundup compares them without a thumb on the scale.

Frequently asked questions