Docker SBOM
Tags: docker, cloud, security, tutorial
Published: 2022-07-11 15:12:30

<!-- wp:paragraph -->
<p>Couple of months ago, Docker announced an experimental command called <code>docker sbom</code> which will display the packaging list of an image. In this blog article, we will dive into sbom, docker sbom and more.</p>
<!-- /wp:paragraph -->

<!-- wp:generateblocks/headline {"uniqueId":"a899e88c"} -->
<h2 class="gb-headline gb-headline-a899e88c gb-headline-text">What is SBOM?</h2>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>A Software Bill of Materials (SBOM) is a term you often hear or read when it comes to software supply chain. An SBOM holds metadata about the software package, content, license information, copyright, and more.Think of it as an inventory or list of ingredients in a package.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":9567,"sizeSlug":"full","linkDestination":"media"} -->
<figure class="wp-block-image aligncenter size-full"><a href="https://qainsights.com/wp-content/uploads/2022/07/image-12.png"><img src="https://qainsights.com/wp-content/uploads/2022/07/image-12.png" alt="Sample Label for Frozen Lasagna" class="wp-image-9567"/></a><figcaption><strong>Sample Label for Frozen Lasagna</strong></figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>SBOM brings transparency and security in the software supply chain.</p>
<!-- /wp:paragraph -->

<!-- wp:generateblocks/headline {"uniqueId":"5a31a147"} -->
<h2 class="gb-headline gb-headline-5a31a147 gb-headline-text">Docker SBOM</h2>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>Docker SBOM is an experimental feature which is available in Docker. Launch the terminal and issue <code>docker sbom &lt;image&gt;:&lt;tag&gt;</code>. By default, the output will be in table format as shown below.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":9568,"sizeSlug":"large","linkDestination":"media"} -->
<figure class="wp-block-image aligncenter size-large"><a href="https://qainsights.com/wp-content/uploads/2022/07/image-13.png"><img src="https://qainsights.com/wp-content/uploads/2022/07/image-13-1024x531.png" alt="Docker SBOM" class="wp-image-9568"/></a><figcaption>Docker SBOM</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>To print the SBOM in CycloneDX and SPDX format, issue the below commands respectively.</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code># SPDX JSON
docker sbom --format spdx-json qainsights/jpetstore:latest

# CycloneDX JSON
docker sbom --format cyclonedx-json qainsights/jpetstore:latest
</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>To save the output to a file, issue the below command :</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>docker sbom --format spdx-json --output sbom.json qainsights/jpetstore</code></pre>
<!-- /wp:code -->

<!-- wp:generateblocks/headline {"uniqueId":"8017c09e"} -->
<h2 class="gb-headline gb-headline-8017c09e gb-headline-text">How it works?</h2>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>To generate the SBOM, docker needs to scan the image. It uses <a href="https://github.com/anchore/syft" target="_blank" rel="noreferrer noopener">Syft</a> to perform scanning as of now. The process may change in the future.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Syft is a Go based CLI tool to generate SBOM.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><code>syft qainsights/jpetstore</code></p>
<!-- /wp:paragraph -->

<!-- wp:generateblocks/headline {"uniqueId":"0534e126"} -->
<h2 class="gb-headline gb-headline-0534e126 gb-headline-text">Install as a Plugin</h2>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>To install SBOM as a plugin, issue the below command which will install the docker-sbom:</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>curl -sSfL https://raw.githubusercontent.com/docker/sbom-cli-plugin/main/install.sh | sh -s --</code></pre>
<!-- /wp:code -->

<!-- wp:generateblocks/headline {"uniqueId":"8d4d15a8"} -->
<h2 class="gb-headline gb-headline-8d4d15a8 gb-headline-text">Final Thoughts</h2>
<!-- /wp:generateblocks/headline -->

<!-- wp:paragraph -->
<p>Docker SBOM is still in its early phase. But if you are into containerization or DevOps tasks, docker sbom helps you to generate the package contents, dependencies, and more using a single command.</p>
<!-- /wp:paragraph -->