Skip to main content

Building Clair Container Image with Dockerfile

Clair is an open-source static analysis tool for container vulnerabilities, used to scan container images and detect known vulnerabilities within them. It has the following key features:

  1. Multiple Support Formats Clair can analyze common Linux container image formats, including Docker, OCI, and RHEL OCI, among others.

  2. Static Analysis Unlike network-based or runtime scanning, Clair uses a static analysis approach, only requiring the container image file to complete the scan, without the need to start the container.

  3. Continuous Monitoring Clair can continuously monitor the vulnerability status of container images, and it will immediately detect and report any new vulnerability updates.

  4. Plugin Architecture Clair supports the installation of third-party data source plugins, allowing it to support more types of container images and software package formats.

  5. Flexible Configuration It is possible to customize configurations such as ignoring specific vulnerabilities or setting scan severity levels, among other functionalities.

  6. Containerized Deployment Clair itself is a container application, which can be quickly deployed and scaled through containers.

This article will guide you on how to build a Clair image using a Dockerfile, and understand each step in the image building process.

Dockerfile Analysis​

FROM golang:alpine as builder

This line defines a build stage named builder, with the base image golang:alpine. This is to leverage Go and its toolchain to compile Clair's source code.

RUN apk --no-cache add \
    ca-certificates \
    git \
    make

Installs the dependencies required for compiling Clair, which includes ca-certificates, git, and make.

ENV PATH /go/bin:/usr/local/go/bin:$PATH
ENV GOPATH /go

Sets up the Go-related environment variables PATH and GOPATH.

RUN go get github.com/quay/clair/cmd/clair || true

Uses the go get command to fetch the Clair source repository.

ENV CLAIR_VERSION v2.1.4

Specifies the Clair version to compile as v2.1.4.

WORKDIR /go/src/github.com/quay/clair
RUN git checkout "${CLAIR_VERSION}"

Switches the working directory to the Clair source directory and checks out the specified version of the code.

RUN go install ./cmd/clair

Compiles and installs the clair command-line tool to the $GOPATH/bin directory.

FROM alpine:latest

A new build stage, with the base image alpine:latest.

RUN apk --no-cache add \
    ca-certificates \
    git \
    rpm \  
    xz

Adds the dependencies required for running Clair, such as rpm and xz.

COPY --from=builder /go/bin/clair /usr/bin/clair

Copies the compiled clair executable from the builder stage to the new image.

ENTRYPOINT ["clair"]

Sets the container entrypoint to the clair command.

Complete Dockerfile Script​

FROM golang:alpine as builder

RUN apk --no-cache add \
	ca-certificates \
	git \
	make

ENV PATH /go/bin:/usr/local/go/bin:$PATH
ENV GOPATH /go

RUN go get github.com/quay/clair/cmd/clair || true

ENV CLAIR_VERSION v2.1.4

WORKDIR /go/src/github.com/quay/clair

RUN git checkout "${CLAIR_VERSION}"

RUN go install ./cmd/clair

FROM alpine:latest

RUN apk --no-cache add \
	ca-certificates \
	git \
	rpm \
	xz

COPY --from=builder /go/bin/clair /usr/bin/clair

ENTRYPOINT [ "clair" ]

Summary​

Through this Dockerfile, we have completed the compilation of the Clair executable and built a minimal image. You can build the image using the following command:

docker build -t myclair:latest .

After the build is complete, you can use this image to start the Clair service for container scanning. Clair is mainly used in container environments, where it complements dynamic runtime scanning by detecting known vulnerabilities through static analysis, thereby comprehensively enhancing the security of container applications.

References​

clair