Syft — Generate Software Bill of Materials from Container Images

What it is

Syft is a CLI tool by Anchore that generates Software Bill of Materials (SBOMs) from container images, filesystems, and archives. It detects packages across OS-level (dpkg, apk, rpm) and language-level (npm, pip, Maven, Go modules) ecosystems. Output formats include SPDX, CycloneDX, and Syft's own JSON format.

Syft targets DevSecOps engineers, compliance teams, and any organization that needs to track software components in their container supply chain. SBOMs are increasingly required by regulations and enterprise procurement processes.

How it saves time or tokens

Manually inventorying every package in a container image is impractical. Syft automates the scan in seconds, producing a structured document listing every component, version, and license. Pairing Syft with Grype (Anchore's vulnerability scanner) turns an SBOM into an actionable vulnerability report without manual cross-referencing.

How to use

1. Install Syft via Homebrew, curl, or a container image.
2. Point Syft at a container image, directory, or archive.
3. Choose your output format.

# Install
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s

# Scan a container image
syft nginx:latest

# Output as CycloneDX JSON
syft nginx:latest -o cyclonedx-json > sbom.cdx.json

# Output as SPDX
syft nginx:latest -o spdx-json > sbom.spdx.json

# Scan a local directory
syft dir:/path/to/project

Example

// Excerpt from Syft JSON output
{
  "artifacts": [
    {
      "name": "openssl",
      "version": "3.1.4-r2",
      "type": "apk",
      "licenses": ["Apache-2.0"]
    },
    {
      "name": "express",
      "version": "4.18.2",
      "type": "npm",
      "licenses": ["MIT"]
    }
  ]
}

Related on TokRepo

• Security tools — Software supply chain and application security tools
• DevOps tools — CI/CD and container infrastructure tools

Common pitfalls

• Syft scans the final layer of a container image by default. Multi-stage build artifacts from earlier stages are not included unless explicitly scanned.
• Language-level package detection requires lock files (package-lock.json, go.sum, requirements.txt). If lock files are missing, Syft may report fewer packages than actually installed.
• SBOM format choice matters: CycloneDX is preferred by many enterprise tools, while SPDX is the ISO standard. Check your compliance requirement before choosing.