Container Security

Container and Kubernetes Security

Scan images, enforce policy and watch runtime behavior in containerized workloads.

8 tools profiled

How it differs Scans container images and enforces policy on running containers and Kubernetes workloads. Checking the manifests before deploy is IaC security.

5 tools match

Sort

Active CI/CD Clear all

Aqua Security

Aqua Security

Container Security

A cloud native security platform that scans images and infrastructure as code, then enforces workload policy at admission and at runtime with in-cluster agents.

Commercial +1

Established Compare Aqua Security
Clair

Quay (Red Hat)

Container Security

An open source container image scanner that indexes layer contents into a database and matches the resulting package inventory against distribution and language vulnerability feeds.

Open source

Established Compare Clair
Docker Scout

Docker

Container Security

Docker's own image analysis service, which builds an SBOM from image layers, matches it against advisory sources, and recommends base image changes that remove the most findings.

Freemium

Growing Compare Docker Scout
kube-bench

Aqua Security

Container Security

A single binary that checks whether a Kubernetes node's configuration matches the CIS Kubernetes Benchmark, reporting each control as pass, fail or manual with remediation text.

Open source

Established Compare kube-bench
Red Hat Advanced Cluster Security (StackRox)

Red Hat

Container Security

A Kubernetes-native security platform that scores deployment risk from cluster configuration, enforces policy at admission, and detects runtime behavior from kernel level telemetry.

Open source and commercial

Established Compare Red Hat Advanced Cluster Security (StackRox)

Aqua Security

Aqua Security

A cloud native security platform that scans images and infrastructure as code, then enforces workload policy at admission and at runtime with in-cluster agents.

Commercial +1 Established

Container Security Compare Aqua Security
Clair

Quay (Red Hat)

An open source container image scanner that indexes layer contents into a database and matches the resulting package inventory against distribution and language vulnerability feeds.

Open source Established

Container Security Compare Clair
Docker Scout

Docker

Docker's own image analysis service, which builds an SBOM from image layers, matches it against advisory sources, and recommends base image changes that remove the most findings.

Freemium Growing

Container Security Compare Docker Scout
kube-bench

Aqua Security

A single binary that checks whether a Kubernetes node's configuration matches the CIS Kubernetes Benchmark, reporting each control as pass, fail or manual with remediation text.

Open source Established

Container Security Compare kube-bench
Red Hat Advanced Cluster Security (StackRox)

Red Hat

A Kubernetes-native security platform that scores deployment risk from cluster configuration, enforces policy at admission, and detects runtime behavior from kernel level telemetry.

Open source and commercial Established

Container Security Compare Red Hat Advanced Cluster Security (StackRox)

Pick at least one more