Skip to main content

SBOM (Image Components)

An image SBOM (component list) is a complete inventory of what is actually inside a single container image. From base-OS packages to application dependencies, it provides every component and version that makes up the image as one list. An image is built from stacked layers, so it is hard to tell from the outside what it contains; with an SBOM you can see at a glance which open source is included and at what version, and only then can you judge what is at risk. Used by the Container image service.

  • Analysis : Image component inventory (SBOM) and license risk
  • What you need : A registered container image service
  • Results : SBOM (CycloneDX / SPDX) plus sorting by license risk

What it finds​

  • Full component inventory : provides the OS packages and application dependencies contained in the image as a single list. Export it in standard formats (CycloneDX / SPDX).
  • License risk : evaluates each component's license in order of highest risk (Copyleft → Unknown → Permissive). (More on license risk)

Supported scope​

  • OS packages : system packages of the container base image
  • App dependencies : npm · PyPI · RubyGems · Maven / Gradle · Go · Cargo · Composer · NuGet · pub (Dart) · Swift

Viewing results​

SBOM component inventorySBOM component inventory
The OS packages and app dependencies in the image gather into one list, sorted by license risk.
SBOM component detail drawerSBOM component detail drawer
Click a component to open the detail drawer with its type, license, and PURL along with any newly detected vulnerabilities.

Handling results​

  • If the license is one your organization has approved (reviewed and passed), or the finding is a false positive, mark it as accepted risk.
  • Items you mark are no longer surfaced as risks in later listings.