syft(1)
Syft generates a software bill of materials (SBOM) from container images and filesystems to identify all software components.
Synopsis
syft [OPTION]... [SOURCE]Description
Syft is a CLI tool and library for generating software bills of materials (SBOMs) from container images, repositories, and filesystems. It discovers and catalogs all packages and dependencies, outputting results in multiple formats including SPDX, CycloneDX, and Syft JSON.
Sources can be container images (OCI registries, Docker daemons, local archives), directories, files, or image tarballs. Syft performs deep analysis to capture installed packages, libraries, and their versions across various package managers and ecosystems.
Common options
| Flag | What it does |
|---|---|
-o, --output FORMAT | output format: json, spdx, spdx-json, cyclonedx, cyclonedx-json, table, text (default: table) |
-s, --scope SCOPE | analysis scope: all-layers, squashed, or specific layer (default: squashed for images, all-layers for dirs) |
--file FILE | write output to file instead of stdout |
-q, --quiet | suppress non-essential output and logging |
--config FILE | path to Syft configuration file (YAML format) |
-v, --verbose | increase verbosity of logging output (repeatable: -vv, -vvv) |
--catalogers LIST | comma-separated list of catalogers to use (default: all available) |
--ignore-missing-info | ignore packages with missing metadata like PURL or license |
--exclude PATTERN | exclude paths matching glob pattern from scan |
--platform OS/ARCH | platform to use for multi-arch container images (e.g., linux/amd64) |
Examples
generate SBOM table for Alpine Linux image from registry
syft alpine:latestscan a local directory and output SPDX format
syft -o spdx /path/to/filesystemcreate CycloneDX JSON SBOM for nginx container and write to file
syft docker:nginx:latest -o cyclonedx-json --file sbom.jsoncount total packages in an OCI archive using jq
syft oci-archive:image.tar -o json | jq '.artifacts | length'scan /app directory using only apk and npm catalogers with verbose output
syft /app --catalogers apk,npm -vanalyze all layers of a container image for layer-specific package visibility
syft --scope all-layers ghcr.io/my-org/app:v1.0generate SPDX document for PostgreSQL from Docker Hub registry
syft registry:docker.io/library/postgres:15 -o spdx --file postgres-sbom.spdx