Syft is a CLI tool and Go library for generating a Software Bill of Materials from container images and filesystems.
The tool addresses the need to catalog software components within container images and filesystem hierarchies, which is essential for vulnerability tracking and supply chain security. Syft scans container images in multiple formats (OCI, Docker, Singularity) as well as local filesystems and archives, identifying packages across dozens of ecosystems including Alpine, Debian, RPM, Go, Python, Java, JavaScript, Ruby, Rust, PHP, and .NET. It outputs SBOMs in multiple standardized formats such as CycloneDX, SPDX, and Syft JSON, and can convert between these formats. The tool also supports creating signed SBOM attestations using the in-toto specification.
Syft is well-suited for teams building container-based systems who need to maintain visibility into their software dependencies for compliance and security purposes. It works particularly well when paired with vulnerability scanners like Grype for identifying known vulnerabilities in discovered packages. The tool's support for numerous packaging ecosystems and image formats makes it applicable across diverse technology stacks and deployment scenarios. Organizations already using container orchestration or managing container registries will find it integrates naturally into their existing workflows.
The project maintains active validation workflows and releases updates regularly. Development activity shows consistent attention to expanding ecosystem support and output format capabilities. The tool is actively maintained with ongoing improvements to scanning accuracy and format compatibility.
