Container security software falls into four categories: image scanners (Trivy, Snyk, Grype, Clair, Anchore) that check the image for CVEs, runtime detectors (Falco) that catch suspicious behavior, distroless/minimal base images (Wolfi, Chainguard) that reduce attack surface, and policy engines (OPA, Kyverno) that enforce the rules. The team that needs an all-in-one picks Trivy. The team that needs runtime detection adds Falco. The team that has a compliance requirement adds Anchore.
Table of contents
- The 7 tools at a glance
- Image scanning vs runtime detection
- Trivy: the default pick
- Falco: runtime detection
- Distroless images: the other half
- How this fits the rest of the stack
- FAQ
The 7 tools at a glance
Trivy - the all-in-one. Scans images, filesystems, git repos, IaC. Free, fast, easy. The team that needs one tool that does most things picks Trivy.
Snyk - commercial, deep dependency scanning. Strong on npm, Maven, PyPI. Free tier for open source, paid for private. The team that has a large portfolio and needs SBOM generation picks Snyk.
Grype - Anchore’s CLI scanner. Free, fast, similar coverage to Trivy. The team that is already using Anchore Enterprise for policy uses Grype for the free tier.
Clair - the scanner behind Quay (Red Hat’s container registry). Postgres-backed, designed for registry integration. The team that uses Quay gets Clair for free.
Anchore Enterprise - policy-as-code container security. Detailed compliance reports, custom rules, SBOM. The team that has a compliance requirement picks this.
Falco - runtime security. Detects suspicious behavior (privilege escalation, unexpected file access, outbound connections). The team that needs to catch runtime attacks adds this.
Wolfi (Chainguard) - a distroless Linux distribution designed for containers. Minimal packages, no shell, auto-updated daily. The team that wants to reduce the attack surface from the start uses Chainguard images.
Image scanning vs runtime detection
Image scanning - run before deploy. Check the image’s contents for known CVEs. The team that runs this in CI on every PR catches issues before they ship.
Runtime detection - run after deploy. Watch the running container for anomalous behavior (suspicious syscalls, unexpected network connections, file access). The team that runs this in production catches the issues that image scanning missed (zero-days, novel attacks, lateral movement).
Both are needed. The team that only does image scanning is one zero-day away from a compromise. The team that only does runtime detection ships vulnerable images and finds out at runtime.
Trivy: the default pick
Install:
brew install trivy # macOS
sudo apt install trivy # Ubuntu
# or
docker run aquasec/trivy image myapp:latest
Scan:
trivy image myapp:latest
trivy fs .
trivy config .
In CI:
- name: Trivy scan
run: trivy image --severity HIGH,CRITICAL --exit-code 1 myapp:latest
The team that starts with Trivy and only adds other tools when needed is doing it right.
Falco: runtime detection
Falco runs as a DaemonSet on Kubernetes or as a process on a single host. It hooks into the kernel (eBPF or kernel module) and watches syscalls. The default ruleset catches:
-
Shell in a container (
execinto a pod, then run a shell) -
Outbound connections from a process that should not make them
-
File access in sensitive paths (
/etc/shadow,/root/.ssh) -
Privilege escalation (
setuidto root, capability changes)
Custom rules:
- rule: Unexpected outbound connection
desc: Detect outbound connections from a process that should not make them
condition: >
outbound and not proc.name in (allowed_outbound_processes)
output: Unexpected outbound from %proc.name (user=%user.name)
tags: [network]
The team that has Falco running in production catches the things that static scanning missed.
Distroless images: the other half
A standard ubuntu:22.04 image has ~150 packages, including a shell, package manager, and utilities. An attacker who exploits a vulnerability in the app has 150 packages to use as tools. A distroless image has the app’s runtime only - no shell, no package manager, ~10 packages total.
Chainguard Images - the most popular distroless option. Daily CVE updates, signed, free for many languages. The team that wants the cleanest base image picks Chainguard.
Wolfi - the underlying distribution (open source). The team that builds their own images uses Wolfi as the base via apk.
The trade-off: distroless images are harder to debug (no shell to exec into). The team that has a strong observability stack (logs, traces, metrics) does not need the shell; the team that debugs by exec-ing into containers finds distroless painful.
FAQ
Is Trivy enough on its own?
For most teams, yes. Trivy does image scanning, filesystem scanning, IaC scanning, and SBOM generation. The team that adds Falco for runtime and Chainguard for the base image has the full stack.
What is the difference between Trivy and Grype?
Trivy is from Aqua Security; Grype is from Anchore. Both scan for CVEs in images and filesystems. The team that picks one based on which is faster on their workload, or based on which integrates with their existing tools.
Is Snyk worth the cost?
For a large portfolio with many dependencies, yes - Snyk’s depth on npm/Maven/PyPI is unmatched. For a small project, Trivy is enough. The team that has 100+ repos with deep dependency trees picks Snyk.
Does Falco require a kernel module?
It can use either eBPF (no kernel module, modern Linux) or the kernel module (legacy, but works on older kernels). The team that runs Kubernetes 1.18+ on a modern kernel uses eBPF.
Are distroless images slower than Ubuntu?
Marginally - the image is smaller, the cold start is faster, the memory footprint is smaller. The team that benchmarks usually finds distroless images are 5-15% faster to start and 10-30% smaller on disk.
How this fits the rest of the stack
For a sense of what the full project costs before it commits, the RunxBuild hosting calculator shows the line items together. The API, the database, the storage, the worker, the bandwidth - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers.
Useful related references: