Container Security

Container and Kubernetes Security

Scan images, enforce policy and watch runtime behavior in containerized workloads.

8 tools profiled

How it differs Scans container images and enforces policy on running containers and Kubernetes workloads. Checking the manifests before deploy is IaC security.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals

8 tools

  • Calico

    Tigera

    Container Security

    A Kubernetes networking and network policy engine that enforces workload level segmentation through iptables or eBPF dataplanes, with commercial tiers adding observability and egress control.

    Open source and commercial
    Established

  • Aqua Security

    Aqua Security

    Container Security

    A cloud native security platform that scans images and infrastructure as code, then enforces workload policy at admission and at runtime with in-cluster agents.

    Commercial +1
    Established

  • Clair

    Quay (Red Hat)

    Container Security

    An open source container image scanner that indexes layer contents into a database and matches the resulting package inventory against distribution and language vulnerability feeds.

    Open source
    Established

  • Red Hat Advanced Cluster Security (StackRox)

    Red Hat

    Container Security

    A Kubernetes-native security platform that scores deployment risk from cluster configuration, enforces policy at admission, and detects runtime behavior from kernel level telemetry.

    Open source and commercial
    Established

  • Calico

    Tigera

    A Kubernetes networking and network policy engine that enforces workload level segmentation through iptables or eBPF dataplanes, with commercial tiers adding observability and egress control.

    Open source and commercial Established
    Container Security

  • Aqua Security

    Aqua Security

    A cloud native security platform that scans images and infrastructure as code, then enforces workload policy at admission and at runtime with in-cluster agents.

    Commercial +1 Established
    Container Security

  • Clair

    Quay (Red Hat)

    An open source container image scanner that indexes layer contents into a database and matches the resulting package inventory against distribution and language vulnerability feeds.

    Open source Established
    Container Security

  • Red Hat Advanced Cluster Security (StackRox)

    Red Hat

    A Kubernetes-native security platform that scores deployment risk from cluster configuration, enforces policy at admission, and detects runtime behavior from kernel level telemetry.

    Open source and commercial Established
    Container Security

  • NeuVector

    SUSE

    Container Security

    An open source container security platform whose enforcer inspects pod traffic at the application layer and blocks process, file and network behavior outside a learned baseline.

    Open source
    Established

  • kube-bench

    Aqua Security

    Container Security

    A single binary that checks whether a Kubernetes node's configuration matches the CIS Kubernetes Benchmark, reporting each control as pass, fail or manual with remediation text.

    Open source
    Established

  • Docker Scout

    Docker

    Container Security

    Docker's own image analysis service, which builds an SBOM from image layers, matches it against advisory sources, and recommends base image changes that remove the most findings.

    Freemium
    Growing

  • Harbor

    CNCF

    Container Security

    A CNCF graduated private registry that adds vulnerability scanning, content signing, replication and project level access control on top of OCI artifact storage.

    Open source
    Established

  • NeuVector

    SUSE

    An open source container security platform whose enforcer inspects pod traffic at the application layer and blocks process, file and network behavior outside a learned baseline.

    Open source Established
    Container Security

  • kube-bench

    Aqua Security

    A single binary that checks whether a Kubernetes node's configuration matches the CIS Kubernetes Benchmark, reporting each control as pass, fail or manual with remediation text.

    Open source Established
    Container Security

  • Docker Scout

    Docker

    Docker's own image analysis service, which builds an SBOM from image layers, matches it against advisory sources, and recommends base image changes that remove the most findings.

    Freemium Growing
    Container Security

  • Harbor

    CNCF

    A CNCF graduated private registry that adds vulnerability scanning, content signing, replication and project level access control on top of OCI artifact storage.

    Open source Established
    Container Security
Tick up to 4 tools above.