# Using Clair to scan DOCKER images for vulnerability

**URL:** <https://community.codefresh.io/t/using-clair-to-scan-docker-images-for-vulnerability/88>\
**Category:** Pipeline Steps\
**Created:** [October 8, 2019, 11:00am UTC](https://community.codefresh.io/t/using-clair-to-scan-docker-images-for-vulnerability/88 "2019-10-08T11:00:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![mustafa\_turab\_ali](https://sea1.discourse-cdn.com/flex019/user_avatar/community.codefresh.io/mustafa_turab_ali/32/38_2.png) [@mustafa\_turab\_ali](https://community.codefresh.io/u/mustafa_turab_ali)\
**Post date:** [October 8, 2019, 11:00am UTC](https://community.codefresh.io/t/using-clair-to-scan-docker-images-for-vulnerability/88/1 "2019-10-08T11:00:00Z")

</div>

Using Clair to scan docker images within CI pipelines.

version: ‘1.0’  
steps:

```
  Docker-Build:
      title: Building docker image
      type: build
      arguments:
        working_directory: ${{main_clone}}
        dockerfile: docker/Dockerfile
        image_name: '${{CF_REPO_OWNER}}/${{CF_REPO_NAME}}'
        tag: master
        no_cache: true
      build_arguments:
        - disable-content-trust=true
  ScanImage:
    image: codefresh/cfstep-paclair:3.1.0
    environment:
      - CLAIR_URL=${{CLAIR_IP_ADDRESS}}
      - IMAGE=${{BUILD_IMAGE_NAME}}
      - REGISTRY_PASSWORD=${{CLAIR_PASSWORD}}
      - REGISTRY_USERNAME=${{CLAIR_USERNAME}}
      - TAG=${{CF_BRANCH_TAG_NORMALIZED}}
      - SEVERITY_THRESHOLD=critical
    on_success:
      metadata:
        set:
          - ${{Docker-Build.imageId}}:
              - CLAIR_SECURITY: true
              - CF_QUALITY: true
              - promoted: true
              # - coverage : 85%
    on_fail:
      metadata:
        set:
          - ${{Docker-Build.imageId}}:
              - CLAIR_SECURITY: false
              - CF_QUALITY: false

```