This release discontinues the standalone docker sbom CLI plugin.

SBOM support has moved to Docker Scout. Use docker scout sbom going forward.

Running docker sbom <image> now exits with a migration message instead of generating an SBOM. Previous plugin releases remain available for users who need a temporary fallback, but this repository is no longer the recommended path for SBOM generation.

Migrating to Docker Scout

Basic usage:

# Before
docker sbom alpine:latest

# After, human-readable package list
docker scout sbom --format list alpine:latest

docker scout sbom defaults to JSON output, while the old plugin defaulted to a table-style report. Use --format list for terminal output similar to the old default.

Machine-readable output:

# Before
docker sbom alpine:latest --format syft-json

# After, Docker Scout JSON
docker scout sbom alpine:latest

# SPDX
docker scout sbom --format spdx alpine:latest

# CycloneDX
docker scout sbom --format cyclonedx alpine:latest

Writing to a file:

# Before
docker sbom alpine:latest --format spdx-json --output sbom.spdx.json

# After
docker scout sbom --format spdx --output sbom.spdx.json alpine:latest

Platform selection:

# Before
docker sbom alpine:latest --platform linux/arm64

# After
docker scout sbom alpine:latest --platform linux/arm64

Docker Scout can also control where the image is resolved from:

docker scout sbom local://my-image:latest
docker scout sbom registry://my-org/my-image:latest

Notes

Docker Scout can use an SBOM attestation already attached to an image, or generate an SBOM by analyzing the image contents.

The old plugin's experimental Syft-specific options, such as --layers and --exclude, do not have direct docker scout sbom equivalents.

Check docker scout sbom --help when migrating scripts that used those flags.

Docker Desktop includes the Docker Scout CLI plugin. Docker Engine users without Docker Desktop can install Docker Scout separately: https://docs.docker.com/scout/install/

Full Changelog: v0.6.1...v0.7.0