Generating an SBOM for a DevContainer Image

When a CVE lands, you need to know instantly whether your dev image is affected. This page generates a Software Bill of Materials (SBOM) for the pinned image with syft and stores it, turning vulnerability response from a rebuild-and-scan into a fast query.

Prerequisites

You need syft and the pinned image to inventory.

  • syft installed (or an SBOM action in CI).
  • The digest-pinned image reference.
  • A place to store the SBOM artifact.

SBOM prerequisitesYou need syft, the pinned image, an SBOM format, and storage.syftinstalledScan imageby digestSBOMSPDX/CycloneDXStorewith the image

Step-by-Step Implementation

  1. Generate the SBOM from the pinned image.
syft mcr.microsoft.com/devcontainers/base@sha256:PINNED -o spdx-json > sbom.spdx.json
  1. Generate it in CI and attach it to the build.
      - run: syft $IMAGE -o cyclonedx-json > sbom.cdx.json
      - uses: actions/upload-artifact@v4
        with: { name: sbom, path: sbom.cdx.json }
  1. Query it when a CVE lands.
grep -i "openssl" sbom.spdx.json   # affected? which version?
  1. Regenerate whenever you refresh the pinned digest.

SBOM modelsyft inventories the pinned image into a stored SBOM you query on demand.Pinned imagethe exact bytessyftinventories packagesSBOM fileSPDX or CycloneDXStored + queryablefast CVE response

Common Pitfalls

SBOM gaps are none generated, or generated from a tag not a digest.

SBOM triageA triage path from no inventory to a stored, queryable SBOM.Is an SBOM generated per build?NOAdd syft to the buildFrom the pinned digest?YESStore + query it on CVEsFast vulnerability response

SymptomRoot CauseRemediation
Can't tell if a CVE affects usNo SBOMGenerate one with syft per build
SBOM doesn't match the imageGenerated from a tagGenerate from the pinned digest
SBOM lost after the buildNot storedUpload it as a build artifact
SBOM stale after a bumpNot regeneratedRegenerate on each digest refresh

Conclusion

An SBOM makes vulnerability response a query, not an investigation. Generate it with syft from the pinned digest, store it alongside the image, and regenerate it whenever you refresh the pin — then answering 'are we affected by CVE-X?' takes seconds.

SBOM value and upkeepAn SBOM inventories the image for fast lookups; keep it fresh per build.SBOM givesFull package inventoryFast CVE lookupProvenanceKeep itFrom the digestStored per buildRefreshed on bumps

FAQ

What is an SBOM and why generate one for a dev image? A Software Bill of Materials is a machine-readable inventory of every package in an image. For a dev image, it lets you answer 'are we affected by this CVE?' instantly by querying the SBOM, instead of rebuilding and re-scanning each project when a vulnerability is announced.

Which format should I use, SPDX or CycloneDX? Either works; both are widely supported. SPDX is common for license/compliance workflows and CycloneDX for security tooling. syft emits both — pick the one your downstream tools consume, and be consistent across images.

When should I regenerate the SBOM? On every build, and specifically whenever you refresh the pinned base digest, since the package set changes. Store it as a build artifact next to the image so the SBOM always describes the exact bytes you shipped.