Syft is a CLI tool and a Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. It is exceptional for vulnerability detection when used with a scanner like Grype.

• Installation
• Getting Started
• Supported Sources
• File Selection
• Excluding file paths
• Output formats
• Package Cataloger Selection
  • Concepts
  • Examples
• Using templates
• Multiple outputs
• Private Registry Authentication
  • Local Docker Credentials
  • Docker Credentials in Kubernetes
• Attestation (experimental)
  • Keyless Support
  • Local private key support
  • Adding an SBOM to an image as an attestation using Syft
• Configuration