How to Install and Use Grype on Linux to Scan Container Images and Filesystems for Vulnerabilities

In modern DevSecOps and container security, maintaining an inventory of installed software is only the first step. Once dependencies and packages are identified, security teams must immediately discover whether any component contains known security flaws, unpatched exploits, or critical Common Vulnerabilities and Exposures (CVEs). Grype is an open-source, high-performance vulnerability scanner developed by Anchore. Built specifically for container images, source filesystems, and Software Bills of Materials (SBOMs), Grype quickly correlates installed software against global vulnerability feeds.

In this guide, you will learn how to install Grype on Linux, scan container images and local project directories for vulnerabilities, filter findings by severity, export reports in structured formats, and automate CI/CD pipeline security gates.

What Is Grype and How Does It Work?

Grype matches packages, dependencies, and OS libraries against a continuously updated vulnerability database. It aggregates security advisories from primary distribution security trackers (Alpine, Red Hat, Ubuntu, Debian, Amazon Linux), programming language feeds (NPM, PyPI, Go, RubyGems, Maven, Cargo), and the National Vulnerability Database (NVD).

Key highlights of Grype include:

• Broad Image and Filesystem Support: Scans Docker and Podman daemon images, OCI container registries, raw tar archives, and local project filesystems.
• SBOM-First Scanning: Ingests SBOM files generated by Syft (in CycloneDX, SPDX, or Syft JSON formats) to evaluate vulnerabilities in milliseconds without pulling or extracting container layers again.
• Local Cache Engine: Automatically synchronises and caches vulnerability definitions locally in SQLite format, enabling high-speed offline scans.
• Actionable Severity Categorisation: Classifies CVEs by severity (Negligible, Low, Medium, High, Critical) and highlights whether upstream vendor patches are currently available.

Installing Grype on Linux

Grype is distributed as a standalone Go binary and is compatible with all modern Linux distributions, including Ubuntu, Debian, Fedora, Arch Linux, and CentOS.

Method 1: Installing via the Official Shell Script (Recommended)

Download and install the latest binary directly into your system executable path:

# Download and install Grype to /usr/local/bin
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sudo sh -s -- -b /usr/local/bin

# Verify installation
grype version

Method 2: Installing via Native Package Repositories

On Ubuntu and Debian via the Anchore repository:

sudo apt update && sudo apt install -y curl gnupg
curl -fsSL https://anchore.com/keys/anchore.gpg | sudo gpg --dearmor -o /etc/apt/keyrings/anchore.gpg
echo "deb [signed-by=/etc/apt/keyrings/anchore.gpg] https://anchore.com/grype/deb/ stable main" | sudo tee /etc/apt/sources.list.d/grype.list
sudo apt update && sudo apt install grype

On Fedora, RHEL, and Rocky Linux:

sudo dnf config-manager --add-repo https://anchore.com/grype/rpm/grype.repo
sudo dnf install grype

On systems with Homebrew:

brew install grype

Scanning a Container Image for Vulnerabilities

Scanning an image is as simple as passing the image repository tag. Grype automatically synchronises its vulnerability database on initial run:

grype alpine:3.18

Grype inspects the image layers and prints a clear terminal summary table detailing:

• NAME: Offending package or library name (e.g., openssl, busybox).
• INSTALLED: Currently deployed version.
• FIXED-IN: Upstream release that resolves the issue (or blank if unpatched).
• TYPE: Package ecosystem (e.g., apk, deb, npm).
• VULNERABILITY: The unique CVE or advisory identifier.
• SEVERITY: Risk level (Critical, High, Medium, Low).

Scanning Local Project Directories

To inspect a local source code directory, lockfile, or unpacked firmware filesystem:

# Scan the current repository directory
grype dir:.

# Scan a specific application path
grype dir:/var/www/my-node-app

Filtering and Failing Builds in CI/CD

In automated continuous integration pipelines (GitHub Actions, GitLab CI, Jenkins), you often want to fail the build only if vulnerabilities of a specific severity threshold exist.

Failing on Specific Severity Levels

Use the --fail-on flag to return a non-zero exit code if matching vulnerabilities are discovered:

# Fail pipeline if any High or Critical vulnerability is detected
grype alpine:3.18 --fail-on high

Filtering Out Unfixable Vulnerabilities

Security teams often experience alert fatigue from vulnerabilities for which no upstream patch exists. To display only actionable flaws where a vendor fix is available, use the --only-fixed flag:

grype my-app:latest --only-fixed --fail-on high

Exporting Scan Reports

For audits, compliance reporting, and dashboard visualization, export Grype results in structured formats using the -o (or --output) flag:

# Export findings to structured JSON
grype my-app:latest -o json > grype-report.json

# Export to SARIF format for native GitHub Code Scanning alerts
grype my-app:latest -o sarif > grype-results.sarif

# Export to CSV format for spreadsheet analysis
grype my-app:latest -o csv > grype-report.csv

Scanning Syft SBOMs Directly

Decoupling inventory generation from vulnerability assessment speeds up continuous integration pipelines. Generate an SBOM once with Syft, and scan it with Grype in subsequent workflow stages:

# Step 1: Generate an SBOM
syft my-app:v1.2.0 -o cyclonedx-json > sbom.json

# Step 2: Scan the SBOM file instantly with Grype
grype sbom:./sbom.json

Managing the Local Vulnerability Database

Grype manages its vulnerability database in the background. To inspect database freshness or force an immediate update:

# Check active database status and schema version
grype db status

# Force an immediate database update
grype db update