Tag

#Syft

3 items tagged Syft.

Articles 1

DevSecOps intermediate

Generate an SBOM with Syft and Read What It Tells You

Run Syft from its container against a small Node.js image, read the CycloneDX output package by package, see where each one came from, learn what an SBOM does not prove, and store it next to the artifact.

Sep 16, 2026 8 min read

Labs 1

Lab

Generate an SBOM with Syft and Scan It with Grype

Produce CycloneDX and SPDX bills of materials for a container image without a Docker socket, scan the SBOM with Grype, gate on fixable findings only, and see why the SBOM is worth keeping after the release.

intermediate 35 minutes Syft · Grype · Docker

Tools 1

secure SBOM generation

Syft

Generates SBOMs (CycloneDX, SPDX) from images, directories and archives.