# docker sbom & scout: Image SBOM and CVE Scanning

> How docker sbom and docker scout work: generating an SBOM and scanning images for CVEs, and integrating image scanning into CI.

Source: https://latchkey.dev/learn/command-reference/docker-sbom-command  
Updated: 2026-06-25

Generate an SBOM and scan images for known vulnerabilities.

docker sbom lists the software bill of materials for an image; docker scout cves scans for known vulnerabilities. This page covers both and how they replaced docker scan.

## What it does

docker sbom (Syft-based) enumerates the packages in an image. docker scout cves analyzes an image against vulnerability databases and reports CVEs. Together they answer "what is in this image and is it vulnerable?" - the modern successor to the deprecated docker scan (Snyk).

## Common usage

```Terminal
docker sbom myapp:latest
docker scout cves myapp:latest
docker scout quickview myapp:latest
docker scout cves --exit-code --only-severity critical,high myapp:latest
```

## Common errors in CI

"docker: 'scout' is not a docker command" means the Scout plugin is not installed on the runner - install docker/scout-cli or use the docker/scout-action. The old docker scan command is deprecated and removed; migrate to docker scout. Use docker scout cves --exit-code with --only-severity to fail a CI job on critical/high CVEs.

## FAQ

### docker sbom & scout: Image SBOM and CVE Scanning?

docker sbom lists the software bill of materials for an image; docker scout cves scans for known vulnerabilities. This page covers both and how they replaced docker scan.

### What it does?

docker sbom (Syft-based) enumerates the packages in an image. docker scout cves analyzes an image against vulnerability databases and reports CVEs. Together they answer "what is in this image and is it vulnerable?" - the modern successor to the deprecated docker scan (Snyk).

### Common errors in CI?

"docker: 'scout' is not a docker command" means the Scout plugin is not installed on the runner - install docker/scout-cli or use the docker/scout-action. The old docker scan command is deprecated and removed; migrate to docker scout. Use docker scout cves --exit-code with --only-severity to fail a CI job on critical/high CVEs.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt