Syft
syft is an open-source CLI tool and Go library from Anchore for generating Software Bills of Materials (SBOMs) from container images and filesystems. It supports dozens of package ecosystems — Alpine (apk), Debian (dpkg), RPM, Go modules, Python, Java, npm, Rust, .NET, Ruby, PHP, and more — and outputs SPDX, CycloneDX, and Syft JSON formats. The project has approximately 9,000 GitHub stars, is Apache 2.0 licensed, and was last updated in May 2026.
syft operates directly against OCI and Docker images without requiring a local daemon pull. In CI, a single command generates a complete dependency inventory: syft image:tag -o spdx-json. It pairs naturally with Grype (also from Anchore), which consumes syft's SBOM output for CVE vulnerability scanning — the combination is the standard open-source alternative to commercial container scanning tools.
Placed in Tools / Assess / inner.
SBOM generation is transitioning from a best practice to a compliance requirement. The US Executive Order 14028 (2021) and the EU Cyber Resilience Act mandate software supply chain transparency for federal and EU market participants respectively. syft is the most widely adopted open-source tool for meeting these requirements in container-based workflows.
The Grype pairing is the key integration: syft image | grype produces a full CVE scan from a single pipeline step. This two-tool chain covers the SBOM generation and vulnerability scanning requirements without a Snyk or Aqua subscription.
Inner position reflects 9,000 stars, CNCF-adjacent status, Apache 2.0 licence, and direct complementarity with skopeo (Tools/Assess/inner) already on this radar — skopeo inspects and copies images across registries, syft generates their dependency inventory. Together they form a complete container supply chain visibility stack. The compliance tailwind makes this a near-term Trial candidate for any team shipping container images to regulated environments.
Trial gate: syft integrated into a CI pipeline generating an SBOM for at least one container image on every build, with Grype scanning the output and failing the build on critical CVEs.
