Knowing Is Half the Battle
An ingredients list is useless unless you know which ingredients are dangerous. Grype (also from Anchore) is a vulnerability scanner that consumes SBOMs or scans images directly. It takes the list of packages and cross-references them against multiple vulnerability databases:
- NVD (National Vulnerability Database): The US government's authoritative CVE database.
- GitHub Advisory Database: Covers language-ecosystem vulnerabilities (npm, PyPI, Maven, etc.).
- OS-specific databases: Amazon Linux, Debian, Alpine, RHEL, and others maintain their own advisories with backport information that NVD sometimes lacks.
Running Grype
Grype can scan a container image directly, or scan a previously generated SBOM — which is faster, since it skips re-doing package discovery. A severity-threshold flag tells Grype to exit with a non-zero status code if any findings at or above that severity are present, which is what makes it usable as a CI gate: a non-zero exit fails the pipeline and blocks deployment.
The Operational Advantage of SBOM-First Scanning
If you scan images directly every time, you re-do the work of package discovery on every scan. If you generate and store SBOMs at build time, you can re-scan them against updated vulnerability databases without rebuilding or re-pulling images. When Log4Shell was announced, teams with stored SBOMs could identify affected services in minutes. Teams without them spent days manually auditing.