+++
title = "Getting Started"
description = "Use Grype to scan your container images, directories, or archives for known vulnerabilities."
weight = 10
tags = ["grype", "vulnerabilities"]
+++

## What is Vulnerability Scanning?

**Vulnerability scanning** is the process of **identifying known security vulnerabilities** in software packages and dependencies.

- **For developers**, it helps catch security issues early in development, before they reach production.

- **For organizations**, it's essential for maintaining security posture and meeting compliance requirements.

**[Grype](https://github.com/anchore/grype)** is a CLI tool for scanning container images, filesystems, and SBOMs for known vulnerabilities.

## Installation

Grype is provided as a single compiled executable and requires no external dependencies to run.
Run the command for your platform to download the latest release.

{{< tabpane lang="bash">}}
{{% tab header="Platform:" disabled=true /%}}
{{< tab header="Linux (and macOS)" >}}
curl -sSfL https://get.anchore.io/grype | sudo sh -s -- -b /usr/local/bin
{{< /tab >}}
{{% tab header="macOS"%}}brew install grype{{% /tab %}}
{{% tab header="Windows"%}}winget install Anchore.Grype{{% /tab %}}
{{< /tabpane >}}

Check out [installation guide]({{< relref "/docs/installation/grype" >}}) for full list of official and community-maintained packaging options.

## Scan a container image for vulnerabilities

Run `grype` against a small container image. Grype will download the latest vulnerability database
and output simple human-readable table of packages that are vulnerable:

```
grype alpine:latest
```

```text
 ✔ Loaded image alpine:latest
 ✔ Parsed image sha256:8d591b0b7dea080ea3be9e12ae563eebf9…
 ✔ Cataloged contents 058c92d86112aa6f641b01ed238a07a3885…
   ├── ✔ Packages                        [15 packages]
   ├── ✔ File metadata                   [82 locations]
   ├── ✔ File digests                    [82 files]
   └── ✔ Executables                     [17 executables]
 ✔ Scanned for vulnerabilities     [6 vulnerability matches]
   ├── by severity: 0 critical, 0 high, 0 medium, 6 low, 0 negligible
   └── by status:   0 fixed, 6 not-fixed, 0 ignored
NAME           INSTALLED   FIXED-IN  TYPE  VULNERABILITY   SEVERITY
busybox        1.37.0-r12            apk   CVE-2024-58251  Low
busybox        1.37.0-r12            apk   CVE-2025-46394  Low
busybox-binsh  1.37.0-r12            apk   CVE-2024-58251  Low
busybox-binsh  1.37.0-r12            apk   CVE-2025-46394  Low
ssl_client     1.37.0-r12            apk   CVE-2024-58251  Low
ssl_client     1.37.0-r12            apk   CVE-2025-46394  Low
```

{{< alert title="Learn more" color="primary" >}}
Grype supports more than just containers. Learn more about [Supported Scan Targets]({{< relref "/docs/guides/vulnerability/scan-targets/" >}})
{{< /alert >}}

## Scan an existing SBOM for vulnerabilities

Grype can scan container images directly, but it can also scan an existing SBOM document.

{{% alert title="Note" color="primary" %}}
This presumes you already created `alpine_latest-spdx.json` using Syft, or some other tool. If not, go to [SBOM Generation Getting Started]({{< relref "/docs/guides/sbom/getting-started" >}}) and create it now.
{{% /alert %}}

```
grype alpine_latest-spdx.json
```

## Create a vulnerability report in JSON format

The JSON-formatted output from Grype can be processed or visualized by other tools.

Create the vulnerability report using the `--output` flag:

```
grype alpine:latest --output json | jq . > vuln_report.json
```

While the JSON is piped to the file, you'll see progress on stderr:

```text
 ✔ Pulled image
 ✔ Loaded image alpine:latest
 ✔ Parsed image sha256:8d591b0b7dea080ea3be9e12ae563eebf9869168ffced1cb25b2470a3d9fe15e
 ✔ Cataloged contents 058c92d86112aa6f641b01ed238a07a3885b8c0815de3e423e5c5f789c398b45
   ├── ✔ Packages                        [15 packages]
   ├── ✔ File digests                    [82 files]
   ├── ✔ Executables                     [17 executables]
   └── ✔ File metadata                   [82 locations]
 ✔ Scanned for vulnerabilities     [6 vulnerability matches]
   ├── by severity: 0 critical, 0 high, 0 medium, 6 low, 0 negligible
   └── by status:   0 fixed, 6 not-fixed, 0 ignored
```

## FAQ

**Does Grype need internet access?**

Only for downloading container images and the vulnerability database. After the initial database download, scanning works offline until you update the database.

**What about private container registries?**

Grype supports authentication for private registries. See [Private Registries]({{< relref "/docs/guides/private-registries/" >}}).

**Can I use Grype in CI/CD pipelines?**

Absolutely! Grype is designed for automation. Scan images or SBOMs during builds and fail pipelines based on severity thresholds.

**What data does Grype send externally?**

Nothing. Grype runs entirely locally and doesn't send any data to external services.

## Next steps

{{< alert title="Continue the guide" color="success" url="/docs/guides/vulnerability/scan-targets/" >}}
**Next**: Learn about all the different [Supported scan targets]({{< relref "/docs/guides/vulnerability/scan-targets/" >}}) Grype can analyze --from container images to local directories and SBOMs.
{{< /alert >}}

Now that you've scanned for vulnerabilities, here are additional resources:

- **Understand results**: Learn how to [interpret scan output]({{< relref "/docs/guides/vulnerability/interpreting-results/" >}})
- **Filter vulnerabilities**: Use [result filtering]({{< relref "/docs/guides/vulnerability/filter-results/" >}}) to focus on actionable findings
- **Manage database**: Keep your [vulnerability database]({{< relref "/docs/guides/vulnerability/database/" >}}) up to date