SBOM: A New Way to Generate a Software Bill of Materials from Your Container Image
summary
Run the new docker sbom command to produce an SBOM from an image using Syft, output as table or standard formats like CycloneDX/SPDX, or as Syft JSON for jq. The tool pinpoints package evidence with file paths and image layers, lists distro, npm, etc., lets you save and sign SBOMs, and plans BuildKit integration to attach SBOM to OCI registry at build time so official images ship precomputed, signed, queryable manifests.
AI-written summary · about
chapters (11)
- 0:00Docker and SBOM intro
- 1:05What is SBOM
- 3:11Generate SBOM with Docker
- 5:55SBOM formats and data
- 8:45SPDX and CycloneDX
- 10:31Future of SBOMs in Docker
- 13:15Build SBOM at build time
- 15:02BuildKit and SBOMs
- 16:51Why SBOMs matter
- 18:57SBOMs for compliance
- 20:44Feedback and community
related talks
34mSo, SBOMs Matter…Now What?
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...
32mBack to the Drawing Board: Building Containers with SBoMs
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop
38mThe State of SBOMs
27mSBOM: The Rest Of the Story
24mBack to the Drawing Board: Building Containers with SBoMs
25mA Primer on Software Bill of Materials for DevSecOps