Anchore Engine

Anchore Engine
Name	Anchore Engine
Developer	Anchore, Inc.
Released	2015
Programming language	Python
Operating system	Linux
Genre	Container security
License	Apache License 2.0

Anchore Engine Anchore Engine is an open-source container image inspection and policy evaluation service developed by Anchore, Inc. It performs static analysis of container images, generates detailed metadata, and evaluates images against user-defined policies to support continuous integration and continuous delivery pipelines. Anchore Engine integrates with container registries, orchestration platforms, and DevOps toolchains to automate security and compliance checks for software supply chains.

Overview

Anchore Engine inspects and analyzes container images by unpacking filesystem layers, extracting package lists, and discovering configuration artifacts to produce a comprehensive image metadata catalog. It was created by Anchore, Inc., a company founded to address container security and governance challenges popularized by projects and organizations such as Docker, Inc., Kubernetes, Cloud Native Computing Foundation, Amazon Web Services, Google Cloud Platform, and Microsoft Azure. Anchore Engine's functionality complements scanning solutions from vendors and projects including Clair (software), Trivy, Grafeas, Harbor (software), Aqua Security, and Sysdig. Early adopters and contributors have included teams influenced by events and initiatives like DevOpsDays, KubeCon, Black Hat, RSA Conference, and enterprise users from Netflix, PayPal, Salesforce, Goldman Sachs.

Architecture

Anchore Engine is built as a microservices-oriented analysis system that separates image ingestion, analysis, storage, and policy evaluation. Core components work with container registries such as Docker Hub, Quay.io, Google Container Registry, Amazon ECR, and Azure Container Registry and coordinate with orchestration systems like Kubernetes, OpenShift, and Nomad (software). The engine uses databases and services similar in role to PostgreSQL, Redis, and message buses typified by RabbitMQ for persistence and job orchestration. Inspection produces metadata compatible with formats and efforts such as Open Container Initiative, OCI image format, and security standards seen in CIS Benchmarks, NIST, and CVE feeds sourced from projects like National Vulnerability Database. Anchore Engine exposes RESTful APIs consumed by CI/CD systems such as Jenkins, GitLab CI, CircleCI, Travis CI, and Azure DevOps and integrates with artifact managers like JFrog Artifactory and Nexus Repository Manager.

Features

Anchore Engine provides features for vulnerability scanning, package inventory, configuration checks, and software bill of materials generation. Vulnerability assessment leverages feeds from sources including NVD, Debian Security Bug Tracker, Red Hat Security Data, and distribution advisories from Ubuntu, Debian, Alpine Linux, CentOS, and Fedora. Policy evaluation supports customizable gates and enforcement mechanisms familiar to teams using OAuth, LDAP, SAML, and authentication providers like Okta, Azure Active Directory, and Google Identity. Image metadata includes package manifests from ecosystems such as RPM Package Manager, dpkg, pip, npm, Maven, RubyGems, and Go Modules enabling SBOM-like outputs paralleling initiatives like CycloneDX and SPDX. Reporting and alerting tie into notification and incident platforms such as Slack, PagerDuty, ServiceNow, Splunk, and Datadog.

Deployment and Integration

Anchore Engine is deployable as containerized services on platforms including Kubernetes, OpenShift, and virtual machines on cloud providers like Amazon EC2, Google Compute Engine, and Microsoft Azure Virtual Machines. It integrates into pipelines orchestrated by tools such as Tekton, Argo CD, Flux, Spinnaker, and Jenkins X and can be invoked from SCM events in systems like GitHub, GitLab, and Bitbucket. Integrations extend to registry-based workflows with Harbor, Quay Enterprise, and Docker Trusted Registry as well as runtime enforcement via platforms such as Istio, Linkerd, and Open Policy Agent for admission control and policy-as-code patterns promoted by HashiCorp Terraform and Pulumi.

Security and Compliance

Anchore Engine focuses on image-level security controls, supporting vulnerability remediation workflows that reference advisories and standards maintained by NIST, CERT Coordination Center, US-CERT, and distribution vendors like Red Hat. Compliance profiles and checks map to frameworks including PCI DSS, HIPAA, SOC 2, and industry-specific guidance used by organizations such as FDA-regulated vendors and financial services firms like JPMorgan Chase and Morgan Stanley. The engine helps produce artifacts consumed in supply-chain security initiatives promoted by groups like OpenSSF and standards bodies such as the Linux Foundation. Integration with signing and provenance tools aligns with projects like Cosign, Sigstore, and in-toto to assist attestations for Software Bill of Materials workflows advocated by NTIA and CISA.

Development and Community

The source code for Anchore Engine is hosted in public repositories and has attracted contributors from companies and projects active in container and cloud-native ecosystems including Red Hat, IBM, Google, Amazon Web Services, Microsoft, VMware, and community participants from events like KubeCon and CloudNativeCon. The project has been discussed and showcased in conferences such as RSA Conference, Black Hat USA, DEF CON, and DevOpsDays and has integrations referenced by open-source projects like Harbor, Clair (software), Trivy, and Grafeas. Community governance and issue tracking follow practices seen in projects under the stewardship of organizations such as CNCF and Linux Foundation with contributors coordinating via platforms like GitHub, GitLab, and mailing lists similar to those used by Apache Software Foundation projects.

Licensing and Adoption

Anchore Engine is released under the Apache License 2.0, a permissive license also used by projects like Kubernetes, TensorFlow, Ansible, Hadoop, and OpenStack. This licensing has enabled adoption across enterprises, startups, and government agencies that integrate the engine into DevSecOps toolchains alongside commercial offerings from Anchore, Inc. and competitors such as Aqua Security, Palo Alto Networks (Prisma Cloud), Snyk, and Qualys. Notable adoption patterns reflect deployment models similar to those at Netflix, Airbnb, Stripe, Shopify, and public sector entities influenced by procurement and compliance processes used by institutions like US Department of Defense and GSA.

Category:Container security