No Joker in the Pack: SBoMs for Container Images
summary
Demonstrates that Cloud Native Buildpacks plus the pack CLI automatically emit container SBOMs during the build, using a real pack build that produces an OCI image pushed to Docker Hub and inspected with dive. Shows pack sbom download, compares SPDX and CycloneDX outputs (also mentions “Swift”), and explains the SBOM lists exact Go modules and packages found. Describes end-to-end result: reproducible image, SBOM files as plain text, and integration points for CI/CD and Kubernetes K-BOM.
AI-written summary · about
chapters (15)
- 0:00SBoM introduction
- 2:08What are Software Bill of Materials
- 5:00Regulatory need for SBoMs
- 6:24Container image risks
- 9:15Supply chain security
- 12:25OpenSSF security role
- 13:51Buildpacks solution
- 17:24Buildpacks benefits
- 20:18Demo pack CLI
- 21:45Live demo SBoM build
- 23:37Inspect container with dive
- 25:45Pack CLI SBoM generation
- 26:51SBoM format differences
- 28:17Download SBoMs from images
- 29:07SBoMs in Kubernetes
related talks
22mSBOM: A New Way to Generate a Software Bill of Materials from Your Container Image
34mSo, SBOMs Matter…Now What?
38mThe State of SBOMs
05mSupple Supply Chain Security With kpack!
24mBack to the Drawing Board: Building Containers with SBoMs
32mBack to the Drawing Board: Building Containers with SBoMs
46mSBOMs Are Not Enough
28mLeverage Kubernetes SPDX Tools to Create Your SBOM