Syft

Definition

Syft is an open-source command-line tool that generates a software bill of materials (SBOM) by scanning a container image, file system, or archive and cataloging every package and library it contains, along with version information. It outputs the inventory in standard SBOM formats such as SPDX and CycloneDX, giving teams a structured record of exactly what software components make up a given artifact.

Overview

Knowing precisely what is inside a container image or application package is a prerequisite for managing supply chain risk, yet many teams historically had no reliable, automated way to answer that question beyond manually inspecting a Dockerfile or dependency manifest, which misses transitive dependencies and OS-level packages baked into a base image. Syft was built to answer that question mechanically and consistently, by scanning an artifact directly rather than relying on declared manifests alone. Mechanically, Syft inspects the actual contents of a container image, directory, or archive, using a set of cataloger modules that each know how to detect packages for a specific ecosystem, such as OS package managers like apk and dpkg, language package managers like npm and pip, and compiled binaries with embedded version metadata. It walks through image layers and file contents to build a complete inventory, then serializes that inventory into a standard SBOM format like SPDX or CycloneDX, which other tools can consume programmatically. Syft is most often used as the first half of a two-tool workflow alongside Grype, a vulnerability scanner from the same maintainer, Anchore: Syft generates the inventory of what is present, and Grype cross-references that inventory against vulnerability databases to identify known issues. This division of labor differs from all-in-one scanners that combine inventory and vulnerability matching internally, and it means Syft's SBOM output can be reused independently, for example as a compliance artifact or as input to a different vulnerability scanner entirely. In practice, teams run Syft as a CI/CD pipeline step to generate an SBOM for every built container image or release artifact, attaching it to the release as a compliance record and feeding it into downstream vulnerability scanning or license auditing tools. Some organizations also use Syft to audit existing images retroactively, discovering what an already-running container actually contains when the original build process wasn't well documented. Syft's coverage depends on its cataloger modules recognizing the packaging conventions in use, so unusual or highly custom build processes that don't follow standard package manager conventions may be underrepresented in the resulting SBOM. Generating an SBOM is also only the inventory step; it identifies no vulnerabilities on its own; and the SBOM is a point-in-time snapshot that needs to be regenerated whenever the artifact changes to remain accurate. Teams that skip regeneration after a rebuild risk relying on a stale inventory that no longer reflects what is actually running, which undermines the compliance and security value an SBOM is meant to provide in the first place.

Key Features

• Scans container images, file systems, and archives to catalog installed packages
• Outputs SBOMs in standard SPDX and CycloneDX formats
• Detects OS-level packages alongside language-specific dependencies
• Modular cataloger architecture supporting many packaging ecosystems
• Designed to pair directly with Grype for vulnerability matching
• Runs as a CLI tool suitable for CI/CD pipeline integration
• Can scan images without needing access to original build manifests
• Open-source and maintained by Anchore

Use Cases

Alternatives

Frequently Asked Questions

Related in DevOps