syft

Syft generates a software bill of materials, an SBOM, from your container images and filesystems. That is a full inventory of every package and dependency inside, which is what you need before you can answer are we affected by this new CVE. It's open source, free, and fast.

It's a single Go binary. Point it at an image, a directory, or an archive and it outputs the SBOM in whatever format you need: SPDX, CycloneDX, or its own. It pairs directly with Grype, its sibling scanner, which reads the SBOM and checks it for vulnerabilities. No infrastructure, and it drops straight into CI.

Syft and Grype are free and open source. Anchore, the company behind them, sells Anchore Enterprise: a platform with policy enforcement, a findings database, reporting, and support. Solo and small teams, the CLIs are all you need. Larger orgs with compliance requirements and many images, the enterprise platform adds the governance layer.

The catch: an SBOM is only as good as what the tooling can identify. Packages installed in unusual ways, vendored code, or custom builds can slip through. It catches the standard dependency graph well, so don't assume it sees literally everything in the image.