> :warning: **This is pre-release software** and it may not work as expected. If you encounter an issue, please [let us know using the issue tracker](https://github.com/anchore/grype/issues).
Grype can scan a variety of sources beyond those found in Docker.
```
# scan a docker image tar (from the result of "docker image save ... -o image.tar" command)
grype docker-archive://path/to/image.tar
# scan a directory
grype dir://path/to/dir
```
By default Grype shows a summary table, however, a more detailed `json` format is also available.
```
syft <image> -o json
```
Grype pulls a database of vulnerabilities derived from the publicly available [Anchore Feed Service](https://ancho.re/v1/service/feeds). This database is updated at the beginning of each scan, but an update can also be triggered manually.
You may experience a "macOS cannot verify app is free from malware" error upon running Grype because it is not yet signed and notarized. You can override this using `xattr`.
```bash
xattr -rd com.apple.quarantine syft
```
## Configuration
Configuration search paths:
-`.grype.yaml`
-`.grype/config.yaml`
-`~/.grype.yaml`
-`<XDG_CONFIG_HOME>/grype/config.yaml`
Configuration options (example values are the default):
```yaml
# same as -o ; the output format of the vulnerability report (options: table, json)
output: "table"
# same as -s ; the search space to look for packages (options: all-layers, squashed)
scope: "squashed"
# same as -q ; suppress all output (except for the vulnerability list)
quiet: false
log:
# use structured logging
structured: false
# the log level; note: detailed logging suppress the ETUI
level: "error"
# location to write the log file (default is not to have a log file)
file: ""
# enable/disable checking for application updates on startup
check-for-app-update: true
db:
# location to write the vulnerability database cache
There are a few useful things to know before diving into the codebase. This project depends on a few things being available like a vulnerability database, which you might want to create manually instead of retrieving a released version.
### Inspecting the database
The currently supported database provider is Sqlite3. Install `sqlite3` in your system and ensure that the `sqlite3` executable is available in your path. Ask `grype` about the location of the database, which will be different depending on the operating system:
```
$ go run main.go db status
Location: /Users/alfredo/Library/Caches/grype/db
Built: 2020-07-31 08:18:29 +0000 UTC
Current DB Version: 1
Require DB Version: 1
Status: Valid
```
In this case (OSX), the database is located in the user's home directory. To verify the database filename, list that path:
