diff --git a/Makefile b/Makefile
index 7b768cdc4..ee3b6ee35 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 # Makefile for Harbor project
-#	
+#
 # Targets:
 #
-# all:			prepare env, compile binarys, build images and install images 
+# all:			prepare env, compile binarys, build images and install images
 # prepare: 		prepare env
 # compile: 		compile adminserver, ui and jobservice code
 #
@@ -15,11 +15,11 @@
 # build: 		build Harbor docker images (defuault: build_photon)
 #			for example: make build -e BASEIMAGE=photon
 # build_photon:	build Harbor docker images from photon baseimage
-# 
-# install:		include compile binarys, build images, prepare specific \ 
+#
+# install:		include compile binarys, build images, prepare specific \
 #				version composefile and startup Harbor instance
 #
-# start:		startup Harbor instance	
+# start:		startup Harbor instance
 #
 # down:			shutdown Harbor instance
 #
@@ -28,10 +28,10 @@
 #			for example: make package_online -e DEVFLAG=false\
 #							REGISTRYSERVER=reg-bj.eng.vmware.com \
 #							REGISTRYPROJECTNAME=harborrelease
-#						
+#
 # package_offline:
 #				prepare offline install package
-# 
+#
 # pushimage:	push Harbor images to specific registry server
 #			for example: make pushimage -e DEVFLAG=false REGISTRYUSER=admin \
 #							REGISTRYPASSWORD=***** \
@@ -46,19 +46,19 @@
 # clean:        remove binary, Harbor images, specific version docker-compose \
 #               file, specific version tag and online/offline install package
 # cleanbinary:	remove adminserver, ui and jobservice binary
-# cleanimage: 	remove Harbor images 
-# cleandockercomposefile:	
-#				remove specific version docker-compose 
+# cleanimage: 	remove Harbor images
+# cleandockercomposefile:
+#				remove specific version docker-compose
 # cleanversiontag:
 #				cleanpackageremove specific version tag
 # cleanpackage: remove online/offline install package
-# 
+#
 # other example:
 #	clean specific version binarys and images:
 #				make clean -e VERSIONTAG=[TAG]
 #				note**: If commit new code to github, the git commit TAG will \
 #				change. Better use this commond clean previous images and \
-#				files with specific TAG. 
+#				files with specific TAG.
 #   By default DEVFLAG=true, if you want to release new version of Harbor, \
 #		should setting the flag to false.
 #				make XXXX -e DEVFLAG=false
@@ -89,6 +89,11 @@ HTTPPROXY=
 REBUILDCLARITYFLAG=false
 NEWCLARITYVERSION=
 
+#clair parameters
+CLAIRVERSION=v2.0.0
+CLAIRFLAG=false
+CLAIRDBVERSION=9.6.3
+
 #clarity parameters
 CLARITYIMAGE=vmware/harbor-clarity-ui-builder[:tag]
 CLARITYSEEDPATH=/harbor_ui
@@ -125,7 +130,7 @@ GOBUILDMAKEPATH_UI=$(GOBUILDMAKEPATH)/dev/ui
 GOBUILDMAKEPATH_JOBSERVICE=$(GOBUILDMAKEPATH)/dev/jobservice
 GOLANGDOCKERFILENAME=Dockerfile.golang
 
-# binary 
+# binary
 ADMINSERVERSOURCECODE=$(SRCPATH)/adminserver
 ADMINSERVERBINARYPATH=$(MAKEDEVPATH)/adminserver
 ADMINSERVERBINARYNAME=harbor_adminserver
@@ -136,14 +141,21 @@ JOBSERVICESOURCECODE=$(SRCPATH)/jobservice
 JOBSERVICEBINARYPATH=$(MAKEDEVPATH)/jobservice
 JOBSERVICEBINARYNAME=harbor_jobservice
 
-# prepare parameters
-PREPAREPATH=$(TOOLSPATH)
-PREPARECMD=prepare
-
 # configfile
 CONFIGPATH=$(MAKEPATH)
 CONFIGFILE=harbor.cfg
 
+# prepare parameters
+PREPAREPATH=$(TOOLSPATH)
+PREPARECMD=prepare
+PREPARECMD_PARA=--conf $(CONFIGPATH)/$(CONFIGFILE)
+ifeq ($(NOTARYFLAG), true)
+	PREPARECMD_PARA+= --with-notary
+endif
+ifeq ($(CLAIRFLAG), true)
+	PREPARECMD_PARA+= --with-clair
+endif
+
 # makefile
 MAKEFILEPATH_PHOTON=$(MAKEPATH)/photon
 
@@ -166,6 +178,7 @@ DOCKERCOMPOSEFILEPATH=$(MAKEPATH)
 DOCKERCOMPOSETPLFILENAME=docker-compose.tpl
 DOCKERCOMPOSEFILENAME=docker-compose.yml
 DOCKERCOMPOSENOTARYFILENAME=docker-compose.notary.yml
+DOCKERCOMPOSECLAIRFILENAME=docker-compose.clair.yml
 
 # version prepare
 VERSIONFILEPATH=$(CURDIR)
@@ -173,15 +186,15 @@ VERSIONFILENAME=VERSION
 GITCMD=$(shell which git)
 GITTAG=$(GITCMD) describe --tags
 GITTAGVERSION=$(shell git describe --tags || echo UNKNOWN)
-ifeq ($(DEVFLAG), true)        
+ifeq ($(DEVFLAG), true)
 	VERSIONTAG=dev
-else        
+else
 	VERSIONTAG=$(GITTAGVERSION)
 endif
 
 SEDCMD=$(shell which sed)
 
-# package 
+# package
 TARCMD=$(shell which tar)
 ZIPCMD=$(shell which gzip)
 DOCKERIMGFILE=harbor
@@ -193,9 +206,45 @@ PUSHSCRIPTNAME=pushimage.sh
 REGISTRYUSER=user
 REGISTRYPASSWORD=default
 
+# cmds
+DOCKERSAVE_PARA=$(DOCKERIMAGENAME_ADMINSERVER):$(VERSIONTAG) \
+		$(DOCKERIMAGENAME_UI):$(VERSIONTAG) \
+		$(DOCKERIMAGENAME_LOG):$(VERSIONTAG) \
+		$(DOCKERIMAGENAME_DB):$(VERSIONTAG) \
+		$(DOCKERIMAGENAME_JOBSERVICE):$(VERSIONTAG) \
+		vmware/nginx:$(NGINXVERSION) vmware/registry:$(REGISTRYVERSION) \
+		photon:$(PHOTONVERSION)
+PACKAGE_OFFLINE_PARA=-zcvf harbor-offline-installer-$(GITTAGVERSION).tgz \
+		          $(HARBORPKG)/common/templates $(HARBORPKG)/$(DOCKERIMGFILE).$(VERSIONTAG).tar.gz \
+				  $(HARBORPKG)/prepare $(HARBORPKG)/NOTICE \
+				  $(HARBORPKG)/upgrade $(HARBORPKG)/harbor_1_1_0_template \
+				  $(HARBORPKG)/LICENSE $(HARBORPKG)/install.sh \
+				  $(HARBORPKG)/harbor.cfg $(HARBORPKG)/$(DOCKERCOMPOSEFILENAME)
+PACKAGE_ONLINE_PARA=-zcvf harbor-online-installer-$(GITTAGVERSION).tgz \
+		          $(HARBORPKG)/common/templates $(HARBORPKG)/prepare \
+				  $(HARBORPKG)/LICENSE $(HARBORPKG)/NOTICE \
+				  $(HARBORPKG)/upgrade $(HARBORPKG)/harbor_1_1_0_template \
+				  $(HARBORPKG)/install.sh $(HARBORPKG)/$(DOCKERCOMPOSEFILENAME) \
+				  $(HARBORPKG)/harbor.cfg
+DOCKERCOMPOSE_LIST=-f $(DOCKERCOMPOSEFILEPATH)/$(DOCKERCOMPOSEFILENAME)
+
+ifeq ($(NOTARYFLAG), true)
+	DOCKERSAVE_PARA+= vmware/notary-photon:$(NOTARYVERSION) vmware/notary-photon:$(NOTARYSIGNERVERSION) \
+				vmware/harbor-notary-db:$(MARIADBVERSION)
+	PACKAGE_OFFLINE_PARA+= $(HARBORPKG)/$(DOCKERCOMPOSENOTARYFILENAME)
+	PACKAGE_ONLINE_PARA+= $(HARBORPKG)/$(DOCKERCOMPOSENOTARYFILENAME)
+	DOCKERCOMPOSE_LIST+= -f $(DOCKERCOMPOSEFILEPATH)/$(DOCKERCOMPOSENOTARYFILENAME)
+endif
+ifeq ($(CLAIRFLAG), true)
+	DOCKERSAVE_PARA+= quay.io/coreos/clair:$(CLAIRVERSION) postgres:$(CLAIRDBVERSION)
+	PACKAGE_OFFLINE_PARA+= $(HARBORPKG)/$(DOCKERCOMPOSECLAIRFILENAME)
+	PACKAGE_ONLINE_PARA+= $(HARBORPKG)/$(DOCKERCOMPOSECLAIRFILENAME)
+	DOCKERCOMPOSE_LIST+= -f $(DOCKERCOMPOSEFILEPATH)/$(DOCKERCOMPOSECLAIRFILENAME)
+endif
+
 version:
 	@printf $(GITTAGVERSION) > $(VERSIONFILEPATH)/$(VERSIONFILENAME);
-	
+
 check_environment:
 	@$(MAKEPATH)/$(CHECKENVCMD)
 
@@ -208,12 +257,12 @@ compile_ui:
 	@echo "compiling binary for ui..."
 	@$(GOBUILD) -o $(UIBINARYPATH)/$(UIBINARYNAME) $(UISOURCECODE)
 	@echo "Done."
-	
+
 compile_jobservice:
 	@echo "compiling binary for jobservice..."
 	@$(GOBUILD) -o $(JOBSERVICEBINARYPATH)/$(JOBSERVICEBINARYNAME) $(JOBSERVICESOURCECODE)
 	@echo "Done."
-	
+
 compile_clarity:
 	@echo "compiling binary for clarity ui..."
 	@if [ "$(HTTPPROXY)" != "" ] ; then \
@@ -222,7 +271,7 @@ compile_clarity:
 		$(DOCKERCMD) run --rm -v $(UIPATH)/static:$(CLARITYSEEDPATH)/dist -v $(UINGPATH)/src:$(CLARITYSEEDPATH)/src $(CLARITYIMAGE) $(SHELL) $(CLARITYBUILDSCRIPT); \
 	fi
 	@echo "Done."
-	
+
 compile_normal: compile_clarity compile_adminserver compile_ui compile_jobservice
 
 compile_golangimage: compile_clarity
@@ -237,21 +286,17 @@ compile_golangimage: compile_clarity
 	@echo $(GOBUILDPATH)
 	@$(DOCKERCMD) run --rm -v $(BUILDPATH):$(GOBUILDPATH) -w $(GOBUILDPATH_UI) $(GOBUILDIMAGE) $(GOIMAGEBUILD) -v -o $(GOBUILDMAKEPATH_UI)/$(UIBINARYNAME)
 	@echo "Done."
-	
+
 	@echo "compiling binary for jobservice (golang image)..."
 	@$(DOCKERCMD) run --rm -v $(BUILDPATH):$(GOBUILDPATH) -w $(GOBUILDPATH_JOBSERVICE) $(GOBUILDIMAGE) $(GOIMAGEBUILD) -v -o $(GOBUILDMAKEPATH_JOBSERVICE)/$(JOBSERVICEBINARYNAME)
 	@echo "Done."
-	
-compile:check_environment $(COMPILETAG)
 
-prepare: 
-	@echo "preparing..."
-	@if [ "$(NOTARYFLAG)" = "true" ] ; then \
-		$(MAKEPATH)/$(PREPARECMD) --conf $(CONFIGPATH)/$(CONFIGFILE) --with-notary; \
-	else \
-		$(MAKEPATH)/$(PREPARECMD) --conf $(CONFIGPATH)/$(CONFIGFILE) ; \
-	fi	
+compile:check_environment $(COMPILETAG)
 	
+prepare:
+	@echo "preparing..."
+	@$(MAKEPATH)/$(PREPARECMD) $(PREPARECMD_PARA)
+
 build_common: version
 	@echo "buildging db container for photon..."
 	@cd $(DOCKERFILEPATH_DB) && $(DOCKERBUILD) -f $(DOCKERFILENAME_DB) -t $(DOCKERIMAGENAME_DB):$(VERSIONTAG) .
@@ -259,10 +304,10 @@ build_common: version
 
 build_photon: build_common
 	make -f $(MAKEFILEPATH_PHOTON)/Makefile build -e DEVFLAG=$(DEVFLAG)
-	
+
 build: build_$(BASEIMAGE)
-	
-modify_composefile: 
+
+modify_composefile:
 	@echo "preparing docker-compose file..."
 	@cp $(DOCKERCOMPOSEFILEPATH)/$(DOCKERCOMPOSETPLFILENAME) $(DOCKERCOMPOSEFILEPATH)/$(DOCKERCOMPOSEFILENAME)
 	@$(SEDCMD) -i 's/__version__/$(VERSIONTAG)/g' $(DOCKERCOMPOSEFILEPATH)/$(DOCKERCOMPOSEFILENAME)
@@ -274,9 +319,9 @@ modify_sourcefiles:
 	@chmod 600 $(MAKEPATH)/common/templates/notary/notary-signer-ca.crt
 	@chmod 600 $(MAKEPATH)/common/templates/ui/private_key.pem
 	@chmod 600 $(MAKEPATH)/common/templates/registry/root.crt
-	
+
 install: compile build modify_sourcefiles prepare modify_composefile start
-	
+
 package_online: modify_composefile
 	@echo "packing online package ..."
 	@cp -r make $(HARBORPKG)
@@ -289,34 +334,19 @@ package_online: modify_composefile
 	@cp tools/migration/migration_cfg/upgrade $(HARBORPKG)/upgrade
 	@cp tools/migration/migration_cfg/harbor_1_1_0_template $(HARBORPKG)/harbor_1_1_0_template
 
-	@if [ "$(NOTARYFLAG)" = "true" ] ; then \
-		$(TARCMD) -zcvf harbor-online-installer-$(GITTAGVERSION).tgz \
-		          $(HARBORPKG)/common/templates $(HARBORPKG)/prepare \
-				  $(HARBORPKG)/LICENSE $(HARBORPKG)/NOTICE \
-				  $(HARBORPKG)/upgrade $(HARBORPKG)/harbor_1_1_0_template \
-				  $(HARBORPKG)/install.sh $(HARBORPKG)/$(DOCKERCOMPOSEFILENAME) \
-				  $(HARBORPKG)/harbor.cfg $(HARBORPKG)/$(DOCKERCOMPOSENOTARYFILENAME); \
-	else \
-		$(TARCMD) -zcvf harbor-online-installer-$(GITTAGVERSION).tgz \
-		          $(HARBORPKG)/common/templates $(HARBORPKG)/prepare \
-				  $(HARBORPKG)/LICENSE $(HARBORPKG)/NOTICE \
-				  $(HARBORPKG)/upgrade $(HARBORPKG)/harbor_1_1_0_template \
-				  $(HARBORPKG)/install.sh $(HARBORPKG)/$(DOCKERCOMPOSEFILENAME) \
-				  $(HARBORPKG)/harbor.cfg ; \
-	fi
-						
+	@$(TARCMD) $(PACKAGE_ONLINE_PARA)
 	@rm -rf $(HARBORPKG)
 	@echo "Done."
-		
+	
 package_offline: compile build modify_sourcefiles modify_composefile
 	@echo "packing offline package ..."
 	@cp -r make $(HARBORPKG)
-	
+
 	@cp LICENSE $(HARBORPKG)/LICENSE
 	@cp NOTICE $(HARBORPKG)/NOTICE
 	@cp tools/migration/migration_cfg/upgrade $(HARBORPKG)/upgrade
 	@cp tools/migration/migration_cfg/harbor_1_1_0_template $(HARBORPKG)/harbor_1_1_0_template
-			
+
 	@echo "pulling nginx and registry..."
 	@$(DOCKERPULL) vmware/registry:$(REGISTRYVERSION)
 	@$(DOCKERPULL) vmware/nginx:$(NGINXVERSION)
@@ -325,48 +355,20 @@ package_offline: compile build modify_sourcefiles modify_composefile
 		$(DOCKERPULL) vmware/notary-photon:$(NOTARYVERSION); \
 		$(DOCKERPULL) vmware/notary-photon:$(NOTARYSIGNERVERSION); \
 		$(DOCKERPULL) vmware/harbor-notary-db:$(MARIADBVERSION); \
-	fi	
-	
-	@echo "saving harbor docker image"
-	@if [ "$(NOTARYFLAG)" = "true" ] ; then \
-		$(DOCKERSAVE) $(DOCKERIMAGENAME_ADMINSERVER):$(VERSIONTAG) \
-		$(DOCKERIMAGENAME_UI):$(VERSIONTAG) \
-		$(DOCKERIMAGENAME_LOG):$(VERSIONTAG) \
-		$(DOCKERIMAGENAME_DB):$(VERSIONTAG) \
-		$(DOCKERIMAGENAME_JOBSERVICE):$(VERSIONTAG) \
-		vmware/nginx:$(NGINXVERSION) vmware/registry:$(REGISTRYVERSION) photon:$(PHOTONVERSION) \
-		vmware/notary-photon:$(NOTARYVERSION) vmware/notary-photon:$(NOTARYSIGNERVERSION) \
-		vmware/harbor-notary-db:$(MARIADBVERSION) | gzip > $(HARBORPKG)/$(DOCKERIMGFILE).$(VERSIONTAG).tar.gz; \
-	else \
-		$(DOCKERSAVE) $(DOCKERIMAGENAME_ADMINSERVER):$(VERSIONTAG) \
-		$(DOCKERIMAGENAME_UI):$(VERSIONTAG) \
-		$(DOCKERIMAGENAME_LOG):$(VERSIONTAG) \
-		$(DOCKERIMAGENAME_DB):$(VERSIONTAG) \
-		$(DOCKERIMAGENAME_JOBSERVICE):$(VERSIONTAG) \
-		vmware/nginx:$(NGINXVERSION) vmware/registry:$(REGISTRYVERSION) \
-		photon:$(PHOTONVERSION) | gzip > $(HARBORPKG)/$(DOCKERIMGFILE).$(VERSIONTAG).tar.gz; \
 	fi
-	
-	@if [ "$(NOTARYFLAG)" = "true" ] ; then \
-		$(TARCMD) -zcvf harbor-offline-installer-$(GITTAGVERSION).tgz \
-		          $(HARBORPKG)/common/templates $(HARBORPKG)/$(DOCKERIMGFILE).$(VERSIONTAG).tar.gz \
-				  $(HARBORPKG)/prepare $(HARBORPKG)/NOTICE \
-				  $(HARBORPKG)/LICENSE $(HARBORPKG)/install.sh \
-				  $(HARBORPKG)/upgrade $(HARBORPKG)/harbor_1_1_0_template \
-				  $(HARBORPKG)/harbor.cfg $(HARBORPKG)/$(DOCKERCOMPOSEFILENAME) \
-				  $(HARBORPKG)/$(DOCKERCOMPOSENOTARYFILENAME) ; \
-	else \
-		$(TARCMD) -zcvf harbor-offline-installer-$(GITTAGVERSION).tgz \
-		          $(HARBORPKG)/common/templates $(HARBORPKG)/$(DOCKERIMGFILE).$(VERSIONTAG).tar.gz \
-				  $(HARBORPKG)/prepare $(HARBORPKG)/NOTICE \
-				  $(HARBORPKG)/upgrade $(HARBORPKG)/harbor_1_1_0_template \
-				  $(HARBORPKG)/LICENSE $(HARBORPKG)/install.sh \
-				  $(HARBORPKG)/harbor.cfg $(HARBORPKG)/$(DOCKERCOMPOSEFILENAME) ; \
+	@if [ "$(CLAIRFLAG)" = "true" ] ; then \
+		echo "pulling claiy and postgres..."; \
+		$(DOCKERPULL) quay.io/coreos/clair:$(CLAIRVERSION); \
+		$(DOCKERPULL) postgres:$(CLAIRDBVERSION); \
 	fi
 
+	@echo "saving harbor docker image"
+	@$(DOCKERSAVE) $(DOCKERSAVE_PARA) | gzip > $(HARBORPKG)/$(DOCKERIMGFILE).$(VERSIONTAG).tar.gz
+
+	@$(TARCMD) $(PACKAGE_OFFLINE_PARA)
 	@rm -rf $(HARBORPKG)
 	@echo "Done."
-	
+
 refresh_clarity_builder:
 	@if [ "$(REBUILDCLIATRYFLAG)" = "true" ] ; then \
 		echo "set http proxy.."; \
@@ -400,43 +402,35 @@ pushimage:
 	@$(PUSHSCRIPTPATH)/$(PUSHSCRIPTNAME) $(REGISTRYSERVER)$(DOCKERIMAGENAME_UI):$(VERSIONTAG) \
 		$(REGISTRYUSER) $(REGISTRYPASSWORD) $(REGISTRYSERVER)
 	@$(DOCKERRMIMAGE) $(REGISTRYSERVER)$(DOCKERIMAGENAME_UI):$(VERSIONTAG)
-	
+
 	@$(DOCKERTAG) $(DOCKERIMAGENAME_JOBSERVICE):$(VERSIONTAG) $(REGISTRYSERVER)$(DOCKERIMAGENAME_JOBSERVICE):$(VERSIONTAG)
 	@$(PUSHSCRIPTPATH)/$(PUSHSCRIPTNAME) $(REGISTRYSERVER)$(DOCKERIMAGENAME_JOBSERVICE):$(VERSIONTAG) \
 		$(REGISTRYUSER) $(REGISTRYPASSWORD) $(REGISTRYSERVER)
 	@$(DOCKERRMIMAGE) $(REGISTRYSERVER)$(DOCKERIMAGENAME_JOBSERVICE):$(VERSIONTAG)
-	
+
 	@$(DOCKERTAG) $(DOCKERIMAGENAME_LOG):$(VERSIONTAG) $(REGISTRYSERVER)$(DOCKERIMAGENAME_LOG):$(VERSIONTAG)
 	@$(PUSHSCRIPTPATH)/$(PUSHSCRIPTNAME) $(REGISTRYSERVER)$(DOCKERIMAGENAME_LOG):$(VERSIONTAG) \
 		$(REGISTRYUSER) $(REGISTRYPASSWORD) $(REGISTRYSERVER)
 	@$(DOCKERRMIMAGE) $(REGISTRYSERVER)$(DOCKERIMAGENAME_LOG):$(VERSIONTAG)
-	
+
 	@$(DOCKERTAG) $(DOCKERIMAGENAME_DB):$(VERSIONTAG) $(REGISTRYSERVER)$(DOCKERIMAGENAME_DB):$(VERSIONTAG)
 	@$(PUSHSCRIPTPATH)/$(PUSHSCRIPTNAME) $(REGISTRYSERVER)$(DOCKERIMAGENAME_DB):$(VERSIONTAG) \
 		$(REGISTRYUSER) $(REGISTRYPASSWORD) $(REGISTRYSERVER)
 	@$(DOCKERRMIMAGE) $(REGISTRYSERVER)$(DOCKERIMAGENAME_DB):$(VERSIONTAG)
-		
+
 start:
 	@echo "loading harbor images..."
-	@if [ "$(NOTARYFLAG)" = "true" ] ; then \
-		$(DOCKERCOMPOSECMD) -f $(DOCKERCOMPOSEFILEPATH)/$(DOCKERCOMPOSEFILENAME) -f $(DOCKERCOMPOSEFILEPATH)/$(DOCKERCOMPOSENOTARYFILENAME) up -d ; \
-	else \
-		$(DOCKERCOMPOSECMD) -f $(DOCKERCOMPOSEFILEPATH)/$(DOCKERCOMPOSEFILENAME) up -d ; \
-	fi
+	@$(DOCKERCOMPOSECMD) $(DOCKERCOMPOSE_LIST) up -d
 	@echo "Start complete. You can visit harbor now."
-	
+
 down:
-	@echo "Please make sure to set -e NOTARYFLAG=true if you are using Notary in Harbor, otherwise the Notary containers cannot be stop automaticlly."
+	@echo "Please make sure to set -e NOTARYFLAG=true/CLAIRFLAG=true if you are using Notary/CLAIR in Harbor, otherwise the Notary/CLAIR containers cannot be stop automaticlly."
 	@while [ -z "$$CONTINUE" ]; do \
         read -r -p "Type anything but Y or y to exit. [Y/N]: " CONTINUE; \
     done ; \
     [ $$CONTINUE = "y" ] || [ $$CONTINUE = "Y" ] || (echo "Exiting."; exit 1;)
 	@echo "stoping harbor instance..."
-	@if [ "$(NOTARYFLAG)" = "true" ] ; then \
-		$(DOCKERCOMPOSECMD) -f $(DOCKERCOMPOSEFILEPATH)/$(DOCKERCOMPOSEFILENAME) -f $(DOCKERCOMPOSEFILEPATH)/$(DOCKERCOMPOSENOTARYFILENAME) down -v ; \
-	else \
-		$(DOCKERCOMPOSECMD) -f $(DOCKERCOMPOSEFILEPATH)/$(DOCKERCOMPOSEFILENAME) down -v ; \
-	fi	
+	@$(DOCKERCOMPOSECMD) $(DOCKERCOMPOSE_LIST) down -v
 	@echo "Done."
 
 cleanbinary:
@@ -461,20 +455,20 @@ cleandockercomposefile:
 
 cleanversiontag:
 	@echo "cleaning version TAG"
-	@rm -rf $(VERSIONFILEPATH)/$(VERSIONFILENAME)	
-	
+	@rm -rf $(VERSIONFILEPATH)/$(VERSIONFILENAME)
+
 cleanpackage:
 	@echo "cleaning harbor install package"
 	@if [ -d $(BUILDPATH)/harbor ] ; then rm -rf $(BUILDPATH)/harbor ; fi
 	@if [ -f $(BUILDPATH)/harbor-online-installer-$(GITTAGVERSION).tgz ] ; \
 	then rm $(BUILDPATH)/harbor-online-installer-$(GITTAGVERSION).tgz ; fi
 	@if [ -f $(BUILDPATH)/harbor-offline-installer-$(GITTAGVERSION).tgz ] ; \
-	then rm $(BUILDPATH)/harbor-offline-installer-$(GITTAGVERSION).tgz ; fi	
+	then rm $(BUILDPATH)/harbor-offline-installer-$(GITTAGVERSION).tgz ; fi
 
 .PHONY: cleanall
 cleanall: cleanbinary cleanimage cleandockercomposefile cleanversiontag cleanpackage
 
-clean: 
+clean:
 	@echo "  make cleanall:		remove binary, Harbor images, specific version docker-compose"
 	@echo "		file, specific version tag, online and offline install package"
 	@echo "  make cleanbinary:		remove ui and jobservice binary"
diff --git a/make/docker-compose.clair.yml b/make/docker-compose.clair.yml
index c90b4fb9d..e99c9d28a 100644
--- a/make/docker-compose.clair.yml
+++ b/make/docker-compose.clair.yml
@@ -17,7 +17,7 @@ services:
         aliases:
           - postgres
     container_name: clair-db
-    image: postgres:latest
+    image: postgres:9.6.3
     restart: always
     depends_on:
       - log
@@ -34,7 +34,7 @@ services:
     networks:
       - harbor-clair
     container_name: clair
-    image: quay.io/coreos/clair:v2.0.0-rc.0
+    image: quay.io/coreos/clair:v2.0.0
     restart: always
     depends_on:
       - postgres
diff --git a/make/install.sh b/make/install.sh
index d1e1bd994..d435cc8d5 100755
--- a/make/install.sh
+++ b/make/install.sh
@@ -50,11 +50,14 @@ set -e
 set +o noglob
 
 usage=$'Please set hostname and other necessary attributes in harbor.cfg first. DO NOT use localhost or 127.0.0.1 for hostname, because Harbor needs to be accessed by external clients.
-Please set --with-notary if needs enable Notary in Harbor, and set ui_url_protocol/ssl_cert/ssl_cert_key in harbor.cfg bacause notary must run under https.'
+Please set --with-notary if needs enable Notary in Harbor, and set ui_url_protocol/ssl_cert/ssl_cert_key in harbor.cfg bacause notary must run under https. 
+Please set --with-clair if needs enable Clair in Harbor'
 item=0
 
 # notary is not enabled by default
 with_notary=$false
+# clair is not enabled by default
+with_clair=$false
 
 while [ $# -gt 0 ]; do
         case $1 in
@@ -62,7 +65,9 @@ while [ $# -gt 0 ]; do
             note "$usage"
             exit 0;;
             --with-notary)
-            with_notary=true;;	 	
+            with_notary=true;;
+            --with-clair)
+            with_clair=true;;	 					 	
             *)
             note "$usage"
             exit 1;;
@@ -152,38 +157,38 @@ if [ -n "$host" ]
 then
 	sed "s/^hostname = .*/hostname = $host/g" -i ./harbor.cfg
 fi
+prepare_para=
 if [ $with_notary ]
 then
-	./prepare --with-notary
-else
-	./prepare
+	prepare_para="${prepare_para} --with-notary"
 fi
+if [ $with_clair ]
+then
+	prepare_para="${prepare_para} --with-clair"
+fi
+./prepare $prepare_para
 echo ""
 
 h2 "[Step $item]: checking existing instance of Harbor ..."; let item+=1
+docker_compose_list='-f docker-compose.yml'
 if [ $with_notary ]
-then 
-	if [ -n "$(docker-compose -f docker-compose.yml -f docker-compose.notary.yml ps -q)"  ]
-	then
-		note "stopping existing Harbor instance ..." 
-		docker-compose -f docker-compose.yml -f docker-compose.notary.yml down -v
-	fi
-else
-	if [ -n "$(docker-compose -f docker-compose.yml ps -q)" ]
-	then
-		note "stopping existing Harbor instance ..." 
-		docker-compose -f docker-compose.yml down -v
-	fi	
+then
+	docker_compose_list="${docker_compose_list} -f docker-compose.notary.yml"
+fi
+if [ $with_clair ]
+then
+	docker_compose_list="${docker_compose_list} -f docker-compose.clair.yml"
+fi
+
+if [ -n "$(docker-compose $docker_compose_list ps -q)"  ]
+then
+	note "stopping existing Harbor instance ..." 
+	docker-compose $docker_compose_list down -v
 fi
 echo ""
 
 h2 "[Step $item]: starting Harbor ..."
-if [ $with_notary ]
-then
-	docker-compose -f docker-compose.yml -f docker-compose.notary.yml up -d
-else
-	docker-compose -f docker-compose.yml up -d
-fi
+docker-compose $docker_compose_list up -d
 
 protocol=http
 hostname=reg.mydomain.com