SCA for Containers: The Good, the Bad, and the Truth
Talkat ContainerCon @ Open Source Summit Europe 2024 · on Tuesday, 2024-09-17· at 16:55· Room 0.14 (Level 0)·
summary
A head-to-head test of open and commercial SCA tools scans several common container base images, tries to build an SBOM Clarity index, and finds widespread problems: many tools emit invalid or nonstandard CycloneDX JSON, invent or misuse package URL identifiers, miss app-layer payloads and bundled binaries, and report unreliable license data. No tool reaches useful completeness—no tool has 100% coverage—so track everything added to images, insist vendors produce correct SBOMs, and push a community registry and validators.
AI-written summary · about
chapters (8)
- 0:00SCA for containers intro
- 3:36Containers and SBOMs
- 10:18Container compliance challenges
- 15:42Software composition analysis techniques
- 22:46Evaluating SCA tool capabilities
- 31:23SCA tool limitations
- 36:41Recommendations for improvement
- 37:50Q&A
related talks
46mSCA for Containers: The Good, the Bad, and the Truth
23mSBOM adopatability in open source software scanning
24mBack to the Drawing Board: Building Containers with SBoMs
32mBack to the Drawing Board: Building Containers with SBoMs
09mLightning Talk: What’s Inside Your Container Image? How to Audit All the Dependencies...
30mWhat Is Going On In Your Source Code? Understanding SCA In Plain Language
23mSupply Chain Security using Free and Open Tools
32mA Security State Of Mind: Compliance and ...