Couple of months ago, Docker announced an experimental command called docker sbom which will display the packaging list of an image. In this blog article, we will dive into sbom, docker sbom and more.
What is SBOM?
A Software Bill of Materials (SBOM) is a term you often hear or read when it comes to software supply chain. An SBOM holds metadata about the software package, content, license information, copyright, and more.Think of it as an inventory or list of ingredients in a package.
SBOM brings transparency and security in the software supply chain.
Docker SBOM
Docker SBOM is an experimental feature which is available in Docker. Launch the terminal and issue docker sbom <image>:<tag>. By default, the output will be in table format as shown below.
To print the SBOM in CycloneDX and SPDX format, issue the below commands respectively.
# SPDX JSON
docker sbom --format spdx-json qainsights/jpetstore:latest
# CycloneDX JSON
docker sbom --format cyclonedx-json qainsights/jpetstore:latest
To save the output to a file, issue the below command :
docker sbom --format spdx-json --output sbom.json qainsights/jpetstoreHow it works?
To generate the SBOM, docker needs to scan the image. It uses Syft to perform scanning as of now. The process may change in the future.
Syft is a Go based CLI tool to generate SBOM.
syft qainsights/jpetstore
Install as a Plugin
To install SBOM as a plugin, issue the below command which will install the docker-sbom:
curl -sSfL https://raw.githubusercontent.com/docker/sbom-cli-plugin/main/install.sh | sh -s --Final Thoughts
Docker SBOM is still in its early phase. But if you are into containerization or DevOps tasks, docker sbom helps you to generate the package contents, dependencies, and more using a single command.
Top comments (1)
Thank you for this insightful article on Docker SBOM! The introduction of docker sbom is a great step toward enhancing transparency in the software supply chain. Having an SBOM as a packaging inventory helps developers and DevOps teams keep track of dependencies, licenses, and potential security risks with ease.
It’s exciting to see how Syft powers this functionality, and the ability to output SBOMs in CycloneDX and SPDX formats makes integration with security and compliance tools even more seamless. As Docker continues to evolve, I’m looking forward to seeing how docker sbom improves and becomes a key part of container security strategies.