All Tools
S
Dev ToolsFreeOpen Source
SYFT
Generate SBOMs from containers and filesystems
Apache-2.0
ABOUT
CUDA and PyTorch images hide hundreds of OS and Python packages, so teams cannot tell what they shipped or feed a scanner. Syft walks images and directories, emits SPDX, CycloneDX, or Syft JSON SBOMs, and pairs with Grype so vulnerability and license review starts from an inventory instead of a black-box tag.
INSTALL
brew install syftINTEGRATION GUIDE
1. Generate an SBOM for a GPU training image and attach it to a release
2. Inventory Python and OS packages in a model-serving container before deploy
3. Feed Syft JSON into Grype to scan CVEs without re-unpacking the image
4. Compare SBOMs across CUDA base image upgrades to see what packages changed
5. Produce SPDX or CycloneDX for compliance on internal ML runtimes
TAGS
sbomsecuritycontainerssupply-chaingrypedevopsci-cd