Need help with syft?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

169 Stars 22 Forks Apache License 2.0 492 Commits 49 Opened issues


CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Services available


Need anything else?

Contributors list


Static Analysis + Unit + Integration Acceptance Go Report Card GitHub release License: Apache-2.0

A CLI tool and go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.


Features - Catalog container images and filesystems to discover packages and libraries. - Supports packages and libraries from various ecosystems (APK, DEB, RPM, Ruby Bundles, Python Wheel/Egg/requirements.txt, JavaScript NPM/Yarn, Java JAR/EAR/WAR, Jenkins plugins JPI/HPI, Go modules) - Linux distribution identification (supports Alpine, BusyBox, CentOS/RedHat, Debian/Ubuntu flavored distributions) - Supports Docker and OCI image formats

If you encounter an issue, please let us know using the issue tracker.

Getting started

To generate an SBOM for a Docker or OCI image:


The above output includes only software that is visible in the container (i.e., the squashed representation of the image). To include software from all image layers in the SBOM, regardless of its presence in the final image, provide

--scope all-layers
syft  --scope all-layers

Syft can generate a SBOM from a variety of sources: ```

catalog a container image archive (from the result of
docker image save ...
podman save ...
, or
skopeo copy

syft path/to/image.tar

catalog a directory

syft path/to/dir ```

The output format for Syft is configurable as well:

syft  -o 

Where the

s available are: -
: Use this to get as much information out of Syft as possible! -
: A row-oriented, human-and-machine-friendly output. -
: A XML report conforming to the CycloneDX 1.2 specification. -
: A columnar summary (default).


Recommended (macOS and Linux) ```bash

install the latest version to /usr/local/bin

curl -sSfL | sh -s -- -b /usr/local/bin

install a specific version into a specific dir

curl -sSfL | sh -s -- -b ```

Homebrew (macOS)

brew tap anchore/syft
brew install syft


Configuration search paths:

  • .syft.yaml
  • .syft/config.yaml
  • ~/.syft.yaml
  • /syft/config.yaml

Configuration options (example values are the default):

# the output format of the SBOM report (options: table, text, json)
# same as -o ; SYFT_OUTPUT env var
output: "table"

the search space to look for packages (options: all-layers, squashed)

same as -s ; SYFT_SCOPE env var

scope: "squashed"

suppress all output (except for the SBOM report)

same as -q ; SYFT_QUIET env var

quiet: false

enable/disable checking for application updates on startup


check-for-app-update: true


use structured logging

same as SYFT_LOG_STRUCTURED env var

structured: false

the log level; note: detailed logging suppress the ETUI

same as SYFT_LOG_LEVEL env var

level: "error"

location to write the log file (default is not to have a log file)

same as SYFT_LOG_FILE env var

file: ""


(feature-preview) enable uploading of results to Anchore Enterprise automatically (supported on Enterprise 3.0+)


upload-enabled: false

(feature-preview) the Anchore Enterprise Host or URL to upload results to (supported on Enterprise 3.0+)

same as -H ; SYFT_ANCHORE_HOST env var

host: ""

(feature-preview) the path after the host to the Anchore External API (supported on Enterprise 3.0+)

same as SYFT_ANCHORE_PATH env var

path: ""

(feature-preview) the username to authenticate against Anchore Enterprise (supported on Enterprise 3.0+)

same as -u ; SYFT_ANCHORE_USERNAME env var

username: ""

(feature-preview) the password to authenticate against Anchore Enterprise (supported on Enterprise 3.0+)

same as -p ; SYFT_ANCHORE_PASSWORD env var

password: ""

(feature-preview) path to dockerfile to be uploaded with the syft results to Anchore Enterprise (supported on Enterprise 3.0+)

same as -d ; SYFT_ANCHORE_DOCKERFILE env var

dockerfile: ""

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.