anchore/syft

Syft is worth adopting if you need an inventory of what is inside a container image or directory and want that inventory in a standard format other tools can consume. It is a focused tool rather than a platform; the scanning and remediation decision stays outside it.

The problem

You ship a container image or a filesystem and need to answer, quickly, which packages and versions are inside it. Today that often means a manual inspection of language lockfiles, distro package lists and image layers, or trusting a registry's metadata. Syft replaces that with one command that walks the target and enumerates packages across many ecosystems at once. The output is an SBOM you can archive, diff between releases, or pass to a scanner, so the question changes from "what did we install?" to "what is actually in this artifact?".

What's different

Syft's main mechanism is broad, multi-source package detection: it reads the metadata that ecosystems already leave behind, from Alpine apk and Debian dpkg to RPM, Go, Python, Java, JavaScript, Ruby, Rust, PHP and .NET, rather than relying on one package manager's view. It accepts container images, filesystems, archives and OCI, Docker and Singularity formats, and it emits CycloneDX, SPDX and its own JSON, including converting between SBOM formats. That range matters because a real image typically mixes an OS layer with several language runtimes, and a single-ecosystem tool would miss part of it.

The author frames it as the inventory half of a two-tool workflow: Syft produces the SBOM, and Grype scans it for vulnerabilities. That split is a practical benefit if you already have a scanner or a policy engine, and a trade-off if you expected one product to report CVEs. A second consideration is fingerprinting accuracy: the tool reports what it can identify from metadata, so packages installed in unusual ways may be present without being listed. SBOM signing via in-toto attestations is offered, but that is an integrity wrapper around the document, not proof that every dependency was found.

Who should try it

Good fit: a platform or security engineer who must produce SBOMs per image build, attach them to releases, or check dozens of images in CI. Being able to write both SPDX and CycloneDX in one run is useful when downstream consumers demand different formats. Good fit also for a developer who wants a quick package listing of a local directory before packaging it.

Poor fit: someone who wants a ready-made CVE report out of the box, since Syft does not scan vulnerabilities itself; they need Grype or another scanner. It is also a weaker fit for a single-language application where the language's own lockfile tooling already gives a trustworthy dependency list, because the broader detector adds little there.

Requirements and limitations

Syft is a Go CLI and library under Apache-2.0, distributed as release binaries plus Homebrew, Docker, Scoop, Chocolatey, Nix and an install script, so you are not forced into one acquisition path. CLI and configuration references document the knobs. Scanning a local containers-storage image is narrower: on Linux it only happens when explicitly requested with --from containers-storage, plain image references never look there, and rootless stores must be read inside the builder's user namespace. Building from source for that path needs specific build tags. If your workflow relies on Podman or Buildah local images, verify that path before standardizing on it.

Ongoing upkeep is the real cost. New packaging ecosystems and format versions keep appearing, and the SBOM is only as current as the tool's catalog knowledge, so pinning a version also pins what it can recognize. Treat the generated document as an inventory of detected packages, and decide separately how you store, sign and re-scan it.

HotRepo's take

HotRepo has tracked this project only since 2026-05-10, and the sole recorded daily-board observation is 2026-10-28, where it appeared with 9,778 stars and +14 for that day. That is one snapshot, not a trend series; persistence cannot be judged from it, and the long history since 2020 does not tell us about current momentum. Choose Syft if standard-format SBOM generation across mixed ecosystems is the missing step; before committing, confirm the scan targets and formats your consumers require in the scan-target and format docs, and plan how the Grype handoff fits your pipeline.