syft catalogs the packages in a container image or directory and produces a software bill of materials.
syft is Anchore SBOM generator. It enumerates OS and language packages without doing vulnerability matching, leaving that to grype or trivy, which keeps inventory and scanning cleanly separated.
What it does
syft inspects a target (image, dir:, registry:, or file:) and lists every package it can detect across ecosystems, emitting the result as an SBOM in your chosen format. It does not assess vulnerabilities; it records what is present so a scanner can match later.
Common usage
Terminal
syft myorg/app:ci
syft myorg/app:ci -o cyclonedx-json=sbom.cdx.json
# catalog a directory instead of an image
syft dir:.
Options
Flag
What it does
-o, --output <fmt>
Output format, optionally =file (repeatable)
-s, --scope <scope>
squashed (default) or all-layers
--source-name <name>
Override the SBOM source name
dir:/registry:/file:
Source prefixes for the target
--exclude <glob>
Exclude paths from cataloging
In CI
Generate the SBOM once during the build, save it as an artifact, and feed it to grype (grype sbom:sbom.json) and to cosign attest. Use --scope all-layers when you need packages that were added then deleted across layers, since the default only sees the squashed filesystem.
Common errors in CI
"could not fetch image" means the reference is not pullable from the runner; build or pull it first, or use a registry: prefix with credentials. "no packages discovered" on a distroless or scratch image is expected when binaries are statically linked. A surprisingly small SBOM from dir:. often means key files were excluded or gitignored.
Frequently asked questions
syft: Generate an SBOM From an Image?
syft is Anchore SBOM generator. It enumerates OS and language packages without doing vulnerability matching, leaving that to grype or trivy, which keeps inventory and scanning cleanly separated.
What it does?
syft inspects a target (image, dir:, registry:, or file:) and lists every package it can detect across ecosystems, emitting the result as an SBOM in your chosen format. It does not assess vulnerabilities; it records what is present so a scanner can match later.
In CI?
Generate the SBOM once during the build, save it as an artifact, and feed it to grype (grype sbom:sbom.json) and to cosign attest. Use --scope all-layers when you need packages that were added then deleted across layers, since the default only sees the squashed filesystem.
Common errors in CI?
"could not fetch image" means the reference is not pullable from the runner; build or pull it first, or use a registry: prefix with credentials. "no packages discovered" on a distroless or scratch image is expected when binaries are statically linked. A surprisingly small SBOM from dir:. often means key files were excluded or gitignored.
