Grype scans the host’s installed packages for known CVEs, using syft to
build a software bill of materials (SBOM) first.
- Tools —
syft dir:/hostto catalogue, thengrype sbom:… -o jsonto match. - Findings — one per CVE match, severity mapped from Grype’s own rating.
Keeping the payload manageable
The runner catalogues the host once with syft (a single filesystem walk, no
second archive-extraction pass), then trims Grype’s JSON to just the fields
the parser reads — raw Grype output can run to tens of MB on a full host. If
the trimmed payload would still exceed REEF_GRYPE_SOFT_MAX_BYTES, descriptions,
URLs, and CVSS vectors are dropped so it stays under the cap
(summary.trim_level = "minimal"). A payload that’s truncated anyway is
salvaged match-by-match server-side, and that run is marked non-authoritative
(so it can’t auto-resolve findings it never actually reached).
Enrichment
- CISA KEV. Every match is cross-referenced against the baked-in
CISA Known Exploited Vulnerabilities catalog
(on the match’s own ID or a related CVE). KEV-tagged findings set
Finding.kev(a real column), carry the catalog entry underdata.kev, and are surfaced above everything else in the findings list regardless of their own severity —?kev=1filter, a row highlight + badge, and a dashboard tile. - CVSS backfill. For CVE-scheme IDs only, a missing CVSS score/vector is
filled from a baked-in NVD CVSS index (v4 → v3 → v2 fallback order) — Grype’s
own score always wins when it has one. Lands in
data.cvssas{version, base_score, base_severity, vector, source}, withsource: "nvd-feed"when the fallback filled it. The modal links tonvd.nist.gov/vuln/detail/<CVE>. - Package inventory. Folded into the payload under
_reef_inventory; the parser keeps it in the job summary (packages,packages_by_type,distro) with no findings attached to it.
The job summary also carries known_exploited, kev_catalog,
nvd_cvss_filled, and nvd_index.
Params
| Key | Default | Effect |
|---|---|---|
target |
dir:/host |
a non-dir: target (registry:…, an image ref, sbom:/path) skips the syft walk |
sbom |
— | path to a prebuilt SBOM; skips the syft walk |
no_excludes |
false |
don’t apply the default exclude globs during the syft walk |
exclude |
built-in list | ./-rooted globs; replaces the default exclude list |
Scratch space & the vulnerability DB
The syft catalogue and intermediate SBOM go to TMPDIR, which in compose is
a RAM-backed tmpfs capped at REEF_SCAN_TMP_SIZE (default 2g) — a runaway
catalogue fails with ENOSPC instead of filling the host disk. Grype’s
vulnerability DB is persisted on the grype-db volume so it isn’t
re-downloaded and rebuilt (~1–2 GB) on every run.