In this lesson, you will learn how to create and verify a Software Bill of Materials (SBOM) to maintain a complete, transparent inventory of every component inside your container images.
What is an SBOM?
Think of an SBOM as an "ingredient list" for your Docker image. Just as a food label tells you exactly what is inside a package, an SBOM lists every library, binary, and package dependency bundled into your container. In modern supply chain security, simply knowing that an image exists isn't enough; you must be able to prove exactly what makes up that image to ensure it is safe and compliant.
Generating Your Inventory
To generate an SBOM, we typically use specialized tools that inspect the image layers and extract metadata. A common standard format for this is SPDX or CycloneDX. Using a tool like syft, you can generate an SBOM for your final build artifact with a simple command:
# Generate an SBOM for your built image
syft my-app:latest -o json > bom.json
This bom.json file now acts as the authoritative record of your image's provenance. It allows you to audit the image offline without needing to run it or manually inspect its internal filesystem.
Verifying Provenance
Once the SBOM is generated, it serves as the baseline for your auditing process. When you move your image through your CI/CD pipeline, you can use a tool like grype to compare the SBOM against known vulnerability databases. Because the SBOM is a machine-readable document, you can automate this: if a new critical vulnerability is discovered in a library listed in your bom.json, your auditing system will immediately flag the image as compromised, even if the image hasn't changed.
By maintaining this transparent record, you shift from "hoping" your images are secure to "verifying" exactly what you are deploying into production. This audit trail is essential for compliance and provides a clear history of your software supply chain.
Key Takeaway: An SBOM acts as a verifiable ingredient list for your container, enabling automated auditing and transparency across your entire deployment pipeline.