docker sbom & scout: Image SBOM and CVE Scanning

Generate an SBOM and scan images for known vulnerabilities.

docker sbom lists the software bill of materials for an image; docker scout cves scans for known vulnerabilities. This page covers both and how they replaced docker scan.

What it does

docker sbom (Syft-based) enumerates the packages in an image. docker scout cves analyzes an image against vulnerability databases and reports CVEs. Together they answer "what is in this image and is it vulnerable?" - the modern successor to the deprecated docker scan (Snyk).

Common usage

Terminal

docker sbom myapp:latest
docker scout cves myapp:latest
docker scout quickview myapp:latest
docker scout cves --exit-code --only-severity critical,high myapp:latest

Common errors in CI

"docker: 'scout' is not a docker command" means the Scout plugin is not installed on the runner - install docker/scout-cli or use the docker/scout-action. The old docker scan command is deprecated and removed; migrate to docker scout. Use docker scout cves --exit-code with --only-severity to fail a CI job on critical/high CVEs.

Related guides

docker inspect: Low-Level Container & Image DetailHow docker inspect works: dumping JSON metadata for containers, images, volumes, and networks, with --format… docker history: Inspect Image Layers & SizeHow docker history works: showing the layers of an image, the command and size of each, and finding what bloa… docker build: Usage, Options & Common CI ErrorsHow docker build works: building an image from a Dockerfile, tagging, build args, target stages, and the buil… docker images: List Images, Filters & FormattingHow docker images works: listing local images, filtering dangling layers, custom formatting, and using it to…