Anchore

Anchore
Name	Anchore
Developer	Anchore, Inc.
Initial release	2016
Programming language	Python, Go
License	Apache License 2.0 (community)

Anchore is an open-source software suite for container image inspection, policy evaluation, and vulnerability scanning. It provides tools and services to analyze container images, enforce security and compliance policies, and integrate with continuous integration and continuous delivery pipelines across cloud-native environments. Anchore is used by organizations to detect vulnerabilities, verify configuration best practices, and automate policy-driven gatekeeping for container deployments.

History

Anchore originated from a project founded by engineers with backgrounds at companies and institutions involved in containerization and cloud-native infrastructure, emerging around the mid-2010s alongside technologies such as Docker (software), Kubernetes, CoreOS, Amazon Web Services, and Google Cloud Platform. Early development coincided with growth in container registries like Docker Hub and Quay (software), and with orchestration projects including Mesos and Swarm (software). Anchorage of the project into a company followed trends similar to those of Red Hat, Canonical (company), and HashiCorp in commercializing open-source tooling. Anchore's roadmap and releases have intersected with initiatives from CNCF and standards advanced by Open Container Initiative and Cloud Native Computing Foundation member projects. Over time, contributions and integrations have been linked to ecosystems around Jenkins, GitLab, GitHub, and Atlassian tooling.

Architecture

Anchore's architecture comprises analysis engines, policy engines, and storage components that interact with container registries, orchestration platforms, and CI/CD systems. The architecture mirrors patterns used by Prometheus (software), Istio, and other cloud-native control-plane projects, separating data collection from evaluation and policy decision points. Core components include an analyzer service that extracts metadata using format parsers influenced by formats from Alpine Linux, Debian, Red Hat Enterprise Linux, and language ecosystems such as npm, PyPI, and Maven Central. Persistent state is frequently stored in databases similar to PostgreSQL, while message queuing resembles implementations used by RabbitMQ or Apache Kafka. For runtime enforcement, Anchore integrates with container runtimes and orchestrators including Docker (software), containerd, and Kubernetes. Deployments leverage packaging and distribution systems like Helm (software), Terraform, and container images hosted on registries from Amazon Elastic Container Registry and Google Container Registry.

Features

Anchore provides vulnerability scanning, policy-as-code evaluation, image metadata inspection, and reporting. Vulnerability intelligence integrates with databases and advisories maintained by vendors such as National Vulnerability Database, Red Hat, Debian Security Advisory, and ecosystem-specific advisories for OpenSSL, glibc, and language ecosystems like RubyGems. Policy evaluation supports custom rules similar in intent to governance frameworks used by NIST and CIS (Center for Internet Security), enabling checks for package versions, secrets detection, and configuration drift. Reporting and alerting produce artifacts compatible with issue trackers such as JIRA (software) and notification systems like Slack and PagerDuty. Other features include SBOM generation reflecting specifications from Software Package Data Exchange and support for attestations related to Sigstore initiatives.

Use Cases

Organizations employ Anchore for pre-deployment image gating in pipelines involving Jenkins, GitHub Actions, GitLab CI/CD, and CircleCI. Security teams use it for continuous monitoring of registries such as Docker Hub and private registries hosted on Azure Container Registry, enforcing compliance requirements from standards bodies like PCI DSS and HIPAA. DevOps teams leverage Anchore to track transitive dependencies from ecosystems like npm, Maven Central, and PyPI, and to mitigate supply-chain threats highlighted by incidents involving projects such as SolarWinds and high-profile supply chain attacks. Compliance auditors correlate Anchore outputs with policies from CIS (Center for Internet Security) benchmarks and internal risk frameworks used by enterprises like IBM and Microsoft.

Deployment and Integration

Anchore can be deployed as a standalone service, as part of Kubernetes clusters via Helm (software), or integrated into CI/CD platforms such as Jenkins, GitLab, and GitHub Actions. It integrates with container registries including Docker Hub, Quay (software), Amazon Elastic Container Registry, and Google Container Registry. Authentication and authorization commonly connect to identity providers like Okta, Active Directory, and LDAP. Observability and logging integrations mirror patterns used by Prometheus (software), Grafana, ELK Stack, and tracing systems like Jaeger (software). For infrastructure as code pipelines, Anchore is often orchestrated alongside tools like Terraform and configuration management suites from Ansible.

Security and Compliance

Anchore focuses on identifying known vulnerabilities through CVE matching, policy enforcement, and metadata provenance, referencing databases such as the National Vulnerability Database and vendor advisories from Red Hat and Debian. Compliance features enable checks aligned with CIS (Center for Internet Security) benchmarks and regulatory standards including PCI DSS and HIPAA. The platform supports SBOM creation compatible with SPDX and Software Package Data Exchange, and integrates with signing and attestation systems influenced by Sigstore and in-toto to strengthen supply-chain integrity. Role-based access and integration with enterprise identity systems reduce operational risk in environments run by major cloud providers like Amazon Web Services and Microsoft Azure.

Reception and Adoption

Anchore has been adopted by organizations across fintech, healthcare, and technology sectors, with case studies citing integration into pipelines alongside Jenkins, Kubernetes, and major registries. Reviews and analyst coverage have compared it with commercial and open-source competitors such as Clair (software), Trivy, and enterprise offerings from firms like Snyk and Veracode. Community contributions and ecosystem integrations have been fostered through platforms such as GitHub and partnerships reflecting patterns seen with companies like Red Hat and Canonical (company). Adoption considerations often weigh anchoring automated policy enforcement against alternative strategies favored by leaders such as Palo Alto Networks and CrowdStrike.

Category:Container security