Anchore Engine is an open source tool for scanning and analyzing container images for vulnerabilities and policy issues. It is available as a Docker container image that can run on the orchestration platform, or as a standalone installation. It is a useful security tool that allows developers and QA teams to test, identify and remediate vulnerabilities in the images they use to build applications.

With a deployment of Anchore Engine running in your environment, container images are downloaded and analyzed from Docker V2 compatible container registries and then evaluated against user-customizable policies to perform security, compliance, and best practices enforcement checks.

Anchore Engine can be used in several ways:

• Standalone or interactively.
• As a service integrated with your CI/CD to bring security/compliance/best-practice enforcement to your build pipeline
• As a component integrated into existing container monitoring and control frameworks via integration with its RESTful API.

The tool is also the OSS foundation for Enterprise version, which adds a graphical UI (providing policy management, user management, a summary dashboard, security and policy evaluation reports, and many other graphical client controls), and other back-end features and modules.

You can read more and download this tool over here: https://github.com/anchore/anchore-engine