How to Install and Use Syft on Linux to Generate Software Bill of Materials (SBOM)

Modern software delivery pipelines rely heavily on open-source dependencies, third-party libraries, and container base images. However, tracking every transitive library, package version, and operating system dependency compiled into a container or binary is a major security challenge. Following cybersecurity executive orders and supply chain integrity mandates, generating an automated Software Bill of Materials (SBOM) has become a standard compliance requirement. Syft is an open-source, high-speed CLI tool developed by Anchore specifically to inspect container images, filesystems, and archives to generate comprehensive SBOMs.

In this guide, you will learn how to install Syft on Linux, catalog packages across Docker and OCI container images, export SBOMs in industry-standard SPDX and CycloneDX formats, and automate supply chain auditing.

What Is Syft and How Does It Work?

Syft examines container images layer by layer without requiring you to run or execute the container itself. It scans package manager databases, lock files, and binary metadata across dozens of programming languages and Linux distributions.

Key highlights of Syft include:

• Broad Ecosystem Support: Detects Linux distribution packages (Debian/Ubuntu dpkg, RedHat/Fedora rpm, Alpine apk, Arch alpm) alongside application runtimes (Node.js, Python, Go, Java, Rust, Ruby, PHP, and .NET).
• Standardized Formats: Exports structured SBOM inventories in standard SPDX (tag-value and JSON), CycloneDX (XML and JSON), GitHub Dependency Graph format, and Syft’s native JSON representation.
• Container Engine Independence: Inspects images directly from local Docker or Podman daemons, OCI registry endpoints (Docker Hub, GitHub Container Registry, AWS ECR), or flat .tar archives.
• Vulnerability Scanner Integration: Integrates natively with vulnerability scanners like Grype to identify Common Vulnerabilities and Exposures (CVEs) directly against the generated SBOM.

Installing Syft on Linux

Syft is distributed as a lightweight, pre-compiled Go binary available across modern Linux distributions.

Method 1: Installing via Official Install Script (Recommended)

Run the official installation script to download and install the latest verified binary directly to your local user binary directory:

# Download and install Syft to /usr/local/bin
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sudo sh -s -- -b /usr/local/bin

# Verify installation
syft version

Method 2: Installing via Native Package Repositories

On Ubuntu and Debian via the Anchore repository:

sudo apt-get install -y ca-certificates curl gnupg
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://anchore.com/keys/anchore.gpg | sudo gpg --dearmor -o /etc/apt/keyrings/anchore.gpg
echo "deb [signed-by=/etc/apt/keyrings/anchore.gpg] https://anchore.com/syft/deb/ stable main" | sudo tee /etc/apt/sources.list.d/syft.list
sudo apt update && sudo apt install syft

On Fedora, RHEL, and Rocky Linux:

sudo dnf install -y 'dnf-command(config-manager)'
sudo dnf config-manager --add-repo https://anchore.com/syft/rpm/syft.repo
sudo dnf install syft

On systems with Homebrew:

brew install syft

Generating Your First Container SBOM

To inspect a container image, simply pass the image tag to Syft. You do not need to pull the image manually beforehand:

syft ubuntu:22.04

Syft streams the image layers, analyzes installed packages, and prints a clean tabular summary directly in the terminal detailing the package name, installed version, and package manager type.

Inspecting a Local Docker Daemon Image

To guarantee that Syft inspects an image built locally in your Docker daemon rather than pulling from a remote registry:

syft docker:my-local-app:latest

Scanning a Local Filesystem or Directory

You can generate an SBOM for a local project directory, source checkout, or root filesystem:

# Scan the current directory
syft dir:.

# Scan a specific repository path
syft dir:/var/www/my-web-app

Exporting SBOMs in Industry-Standard Formats

For compliance reporting, security auditing, and automated CI/CD workflows, export your findings to standard machine-readable formats using the -o (or --output) flag.

1. CycloneDX (JSON or XML)

CycloneDX is the flagship format developed by OWASP, designed specifically for application security and supply chain analysis:

# Export to CycloneDX JSON format
syft alpine:latest -o cyclonedx-json=sbom.cyclonedx.json

# Export to CycloneDX XML format
syft alpine:latest -o cyclonedx-xml=sbom.cyclonedx.xml

2. SPDX (Software Package Data Exchange)

SPDX is the ISO/IEC standard format frequently required by enterprise procurement and government compliance audits:

# Export to SPDX JSON format
syft python:3.11-slim -o spdx-json=sbom.spdx.json

# Export to traditional SPDX Tag-Value format
syft python:3.11-slim -o spdx-tag-value=sbom.spdx.txt

3. Syft Native JSON

Syft’s native JSON representation contains rich, detailed metadata including file digests, license classifications, and exact path locations:

syft node:20-alpine -o json=syft-inventory.json

Automating SBOM Generation in CI/CD Pipelines

Integrate Syft directly into your GitHub Actions, GitLab CI, or shell deployment pipelines to attach an SBOM artifact to every production build:

# Sample Bash pipeline step
IMAGE_NAME="myregistry.azurecr.io/api-service:${BUILD_NUMBER}"

echo "Building production image..."
docker build -t "$IMAGE_NAME" .

echo "Generating CycloneDX SBOM..."
syft "$IMAGE_NAME" -o cyclonedx-json="dist/sbom-${BUILD_NUMBER}.json"

echo "SBOM generated successfully. Archiving artifacts..."

Pairing Syft with Vulnerability Scanners

Once you generate an SBOM, you can immediately identify security vulnerabilities using vulnerability scanners like Grype without re-scanning or downloading the original container image again:

# Scan the generated SBOM directly for vulnerabilities
grype sbom.cyclonedx.json

This decoupling dramatically accelerates security gates in build pipelines by allowing dependency analysis and vulnerability assessments to run concurrently.