Generating CylconeDX and SPDX format SBOMs using Docker Scout
#docker#sbom#cloud
Siri Varma Vegiraju

Siri Varma Vegiraju @sirivarma

About: Siri Varma Vegiraju is a seasoned expert in healthcare, cloud computing, and security. Currently, he focuses on securing Azure Cloud workloads, leveraging his experience in distributed systems

Joined:
Mar 24, 2025

Generating CylconeDX and SPDX format SBOMs using Docker Scout

Publish Date: Jul 18
0 0

Software Bill of Materials (SBOM) Guide with Docker Scout

What is an SBOM?

A Software Bill of Materials (SBOM) is a comprehensive inventory of all software components, libraries, dependencies, and packages that make up a software application or system. Think of it as an "ingredients list" for your software - just like food labels list ingredients, an SBOM lists all the software components used in your application.

Why are SBOMs Important?

SBOMs have become critical for modern software development and security for several reasons:

  • Security & Vulnerability Management: Quickly identify if your software contains vulnerable components
  • Compliance & Regulatory Requirements: Many industries and government contracts now require SBOMs
  • Supply Chain Transparency: Understand what third-party code you're using and its origins
  • License Compliance: Track open-source licenses and ensure compliance with terms
  • Risk Assessment: Evaluate the security posture of your software stack
  • Incident Response: Rapidly determine if security incidents affect your applications

Key SBOM Formats

1. SPDX (Software Package Data Exchange)

  • Industry Standard: Developed by the Linux Foundation
  • Format: Available in JSON, YAML, RDF, and tag-value formats
  • Use Case: Widely adopted, especially in open-source communities
  • Strengths: Comprehensive license information, mature specification

2. CycloneDX

  • Modern Format: Designed specifically for application security use cases
  • Format: Available in JSON and XML formats
  • Use Case: Popular in DevSecOps and vulnerability management
  • Strengths: Rich vulnerability data, component relationships, build metadata

3. SWID (Software Identification Tags)

  • Legacy Format: Older standard, less commonly used for modern applications
  • Use Case: Primarily for software asset management

Using Docker Scout to Generate SBOMs

Docker Scout is Docker's built-in security and supply chain tool that can generate SBOMs for container images. Here's how to use it:

Basic SBOM Generation 

# Generate SPDX SBOM (JSON format)
docker scout sbom --format spdx my-app:latest

# Generate CycloneDX SBOM (JSON format)
docker scout sbom --format cyclonedx my-app:latest
Enter fullscreen mode Exit fullscreen mode

Save SBOMs to Files 

# Save SPDX SBOM to file
docker scout sbom --format spdx --output my-app-sbom.spdx.json my-app:latest

# Save CycloneDX SBOM to file
docker scout sbom --format cyclonedx --output my-app-sbom.cyclonedx.json my-app:latest

# Generate XML format for CycloneDX
docker scout sbom --format cyclonedx --output my-app-sbom.cyclonedx.xml my-app:latest
Enter fullscreen mode Exit fullscreen mode

Advanced Options 

# Generate SBOM for specific platform
docker scout sbom --format spdx --platform linux/amd64 my-app:latest

# Generate SBOM for remote image
docker scout sbom --format cyclonedx nginx:alpine

# Generate SBOM with organization context
docker scout sbom --format spdx --org my-org my-app:latest
Enter fullscreen mode Exit fullscreen mode

Practical Workflow Example

Here's a typical workflow for integrating SBOM generation into your CI/CD pipeline:

# 1. Build your Docker image
docker build -t my-app:v1.0.0 .

# 2. Generate SBOMs in both formats
docker scout sbom --format spdx --output artifacts/sbom.spdx.json my-app:v1.0.0
docker scout sbom --format cyclonedx --output artifacts/sbom.cyclonedx.json my-app:v1.0.0

# 3. Store SBOMs with your artifacts for compliance and security tracking
Enter fullscreen mode Exit fullscreen mode

What Information is Included?

Docker Scout-generated SBOMs typically include:

  • Package Information: Name, version, type (npm, pip, apt, etc.)
  • Dependencies: Direct and transitive dependencies
  • File Locations: Where components are installed in the container
  • Licenses: License information for each component
  • Checksums: File integrity information
  • Metadata: Build information, timestamps, and more

Integration with Security Tools

SBOMs generated by Docker Scout can be consumed by various security and compliance tools:

  • Vulnerability Scanners: Import SBOMs to identify known vulnerabilities
  • Compliance Tools: Verify license compliance and policy adherence
  • Supply Chain Security: Track component provenance and integrity
  • Risk Management: Assess overall security posture of applications

Comments 0 total

    Add comment