syft SBOM

syft <image> -o cyclonedx-json

Generates the SBOM (Software Bill of Materials) of the image with syft, the complete inventory of packages in CycloneDX format.

Run it in the CI/CD pipeline when you want the inventory of the image components: syft analyzes the image (or the filesystem, the directory) and generates the SBOM — the list of packages (OS and dependencies) with their versions — in standard formats (CycloneDX, SPDX). It's the reference SBOM generation (from Anchore): the inventory that feeds SCA (grype), license management, and compliance (US executive order and SLSA). In DevSecOps, the SBOM is the pipeline piece: the image with its SBOM published in the registry (or the artifact) — component traceability.

Don't use it as analysis: syft generates the inventory (the SBOM), not the CVEs — component vulnerability is covered by grype/trivy on the SBOM. SBOM coverage depends on the analyzer (supported formats): unidentified components don't appear. And watch out: the SBOM is a snapshot — it's regenerated with each build (the old binary's SBOM is worthless); the pipeline generates it and publishes it with the image. For code SBOM (not image), syft also covers directories.