Syft - Generate SBOMs from Containers and Filesystems

So your compliance team wants SBOMs now. Let me guess - they just heard about supply chain attacks after ignoring security for years. If you need to generate these things, Syft is probably your best bet.

The whole SBOM push came from the SolarWinds mess and that Log4j nightmare that had everyone scrambling to inventory their dependencies. Now instead of writing code, we catalog what we're using. Progress, I guess. At least Syft does this without making you parse XML by hand or wade through NIST docs.

Why This Tool Doesn't Suck (Much)

Container Scanning That Doesn't Break: Syft handles 30+ package ecosystems - APK, DEB, RPM, Python wheels, NPM, Maven JARs, Go modules, and whatever new package manager appeared this week. It doesn't choke on weird symlinks like other scanners do.

Actually Scans Container Layers: Unlike tools that just parse manifests, Syft digs through all container layers to find embedded packages. Use --scope all-layers if you want everything, but prepare for huge SBOM files.

Multiple Output Formats: Outputs CycloneDX, SPDX, or Syft's JSON format. I use Syft JSON for automation - it keeps the most metadata and doesn't randomly drop fields like SPDX sometimes does.

Fast Enough for CI/CD: Takes 2-5 minutes for most containers, which isn't terrible. Still slow enough that you'll check Slack while waiting. Set your pipeline timeout to 15+ minutes or you'll get random failures.

Works with Grype: Grype actually consumes Syft SBOMs without issues. Two tools from the same vendor that work together - rare but nice. The workflow is documented pretty well and doesn't require wrestling with auth tokens.

Installation That Actually Works

The install script works most of the time:

curl -sSfL https://get.anchore.io/syft | sudo sh -s -- -b /usr/local/bin

If that fails (it sometimes does on corporate networks), grab the binary from GitHub releases and throw it in /usr/local/bin. On macOS, brew install syft works unless Homebrew is having one of its bad days.

For containers, docker run anchore/syft:latest works but will eat your container's memory if you're scanning something big.

What Goes Wrong

Memory Issues: Syft eats RAM like crazy. Had it OOM-kill our GitHub Actions runners three times before we figured out it was trying to scan some monster Spring Boot JAR with embedded Tomcat and half the internet. Chewed through something like 10-12GB before the agents gave up. Now I set memory limits to 8GB minimum.

Timeout Problems: Default 2-minute timeout is way too short. Big containers take 15+ minutes easy. Use --timeout=30m or watch your pipeline fail with cryptic errors. Recent updates help but anything with embedded application servers still takes forever. That 400MB Spring Boot JAR? Plan on getting coffee. Maybe lunch too.

Registry Authentication: Private registry auth is finicky. Docker credentials work sometimes, but Kubernetes imagePullSecrets can be a pain. The --registry-auth-file flag helps.

Language-Specific Issues

Python: uv.lock support was added in v1.29, but Poetry still has issues sometimes. Pipenv.lock files are hit or miss. Requirements.txt works fine since it's just a text file.

Java: Maven artifacts work better since v1.30.0, but Spring Boot fat JARs can still cause problems. Gradle shadow plugin outputs confuse it.

Go: Build list cataloging in v1.32.0 finds everything - sometimes you get 500+ dependencies from a simple HTTP server. At least it's thorough.

Binary Detection: Finds common binaries like HashiCorp tools since v1.30.0, but custom binaries are hit or miss. If you compiled it yourself, don't expect much.

Output Formats That Don't Suck

The Syft JSON format has everything you need and doesn't randomly omit fields like the others:

syft image:latest -o syft-json > sbom.json

CycloneDX and SPDX formats are fine for compliance but lose metadata. There's a template system if you want to write custom Go templates.

Production Deployment

CI/CD Integration: Works in GitHub Actions, GitLab CI, and Jenkins once you fix the timeouts. Don't trust their examples - they use tiny images that scan in 30 seconds.

Memory Limits: Set container memory limits to 8GB minimum. I've seen Spring Boot apps push Syft to crazy RAM usage - maybe 15-16GB. Corporate networks with SSL inspection make it worse.

Storage: SBOM files get big. Node.js apps with React can easily hit 50MB+ JSON files. Plan your storage accordingly.

Anchore Enterprise adds policy enforcement and centralized management if your company has the budget. Most teams just use the open source version.