Open-source alternative to JFrog Xray

Harbor performs static vulnerability analysis of container images through the open-source Trivy scanner, but only if you enable it. Trivy is not part of a default install: you turn it on with the --with-trivy option when you run the Harbor installer. Harbor can also connect to an external Trivy instance or to other scanners, which matters if your security team already runs a scanning service or needs scanning outside the registry host. Harbor v2.15.4, the current stable release, bundles Trivy 0.75.0, so confirm that version in your own deployment before you write it into a control narrative, because a later Harbor patch may change the bundled version.

A scan produces a per-image report of vulnerabilities found in OS packages and language dependencies, with severity and fix status for each finding, attached to the image in the Harbor UI and available through the REST API. Those results are what you will later feed into DefectDojo or another tracker, so check the report fields your tracker needs before you design the pipeline. Confirm three things with your platform team: when scans run (on push, on a schedule, or only when someone triggers them manually), whether a project can block pulls of images that exceed a severity threshold, and how the Trivy vulnerability database is refreshed. If the registry sits in an air-gapped network, the database update path must be planned in advance, because a scanner with stale data reports a false sense of coverage.

The recurring commercial line for Xray is the subscription tier or add-on that includes it, and that line is set by JFrog's contract rather than by anything in this page. Ask your JFrog account team in writing which tier includes Xray, whether it is bundled or priced separately, and how it scales with your artifact volume or server count. On the open-source side, the recurring costs are the servers and storage for Trivy scanning inside Harbor, the database and backups for DefectDojo, the time spent keeping scanner data and container images current, and the engineering hours that go into triage. DefectDojo's open-source edition uses local accounts. SSO with SAML, OIDC or OAuth, LDAP and MFA are listed by DefectDojo as Pro features, which the DefectDojo README says start from $100 per month. Treat that as a separate, recurring line if your identity policy requires any of those controls, and confirm current pricing with DefectDojo before you budget.

Some costs are one-time and some recur, and the split matters for the business case. One-time work includes designing the scan flow between Harbor, Trivy and DefectDojo, defining severity thresholds and the policy that blocks or flags deployments, importing historical findings, and migrating existing Xray policies and exceptions. Recurring work includes upgrading Harbor (where the v2.15.2 release notes recommend a backup before upgrading), upgrading DefectDojo, patching the hosts and databases, keeping Trivy's vulnerability data fresh in air-gapped environments, and triaging new findings each week. Your team's time usually drives the total more than licence fees do, so ask any implementation partner for a fixed-scope estimate that separates build effort from ongoing operations. DeployOpen works from a written scope, so request the same breakdown from any firm you compare.

When you request quotes, ask for each component to be priced separately: the Xray tier or add-on for the commercial side, and for the open-source side, the infrastructure you will run, the DefectDojo edition and any Pro features you need, the upgrade and patch cadence, support hours, and the work needed to replace curation and license-policy controls that have no direct open-source match. Ask the vendor which features, such as curation or federation, must be budgeted as custom work or third-party tooling. Ask whether the quote includes handover documentation and who holds the runbooks after the project ends. A comparison built this way shows where the real spend sits, which is often in people rather than software.

Keep Xray if your organization depends on JFrog's curation or on license compliance reporting that auditors accept as evidence. Harbor scans images with Trivy and DefectDojo tracks findings, but neither gives you a pre-download curation gate that blocks components by policy, and the supplied facts do not establish an open-source equivalent that enforces license-policy decisions across all package formats. If your change approval or audit process requires a vendor-produced license report for every binary you ship, that requirement alone may outweigh the cost savings. Confirm with JFrog exactly which Xray and curation features your current subscription tier and add-ons include, because the answer depends on your contract, not on the product name.

Support requirements are the second reason to stay. If your policy requires a named commercial vendor with contractual response commitments for a security tool, a self-hosted stack assembled from Harbor, Trivy and DefectDojo moves that responsibility to you or to a services partner. Ask your procurement and risk teams whether they accept community support plus a fixed-scope implementation agreement, or whether they need a vendor SLA in the contract. Also check what your regulators and auditors expect for vulnerability management and software supply chain evidence, since the mapping of those expectations to tools is a policy decision for your organization.

The decision belongs to your own policy and audit requirements, and it should be written down before any migration work starts. DeployOpen can help you define the controls, configure the scanning and ticketing workflow in your environment, and collect the evidence those controls produce. DeployOpen does not issue audit reports, attestations or certifications, so independent auditors and certification bodies remain responsible for any formal assessment. A practical step is to list every Xray feature your teams use, mark each as replaced, partly replaced or required, and bring that list to your auditors before you decide.