Lab 25: SBOM and vulnerability scan with syft + grype

Objective

Stand up the canonical image scanning workflow: SBOM generation followed by CVE matching.

Tasks

Task 1: Install syft and grype

curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sudo sh -s -- -b /usr/local/bin
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sudo sh -s -- -b /usr/local/bin

syft version
grype version

Task 2: Generate an SBOM

docker pull alpine:3.20
syft alpine:3.20 -o cyclonedx-json=sbom.cdx.json
syft alpine:3.20 -o spdx-json=sbom.spdx.json

Two formats: CycloneDX and SPDX.

Task 3: Scan for vulnerabilities

grype alpine:3.20

Output shows package, installed version, fixed version, and CVE severity. Filter for actionable findings:

grype alpine:3.20 --only-fixed
grype alpine:3.20 --fail-on high

Task 4: Scan from the SBOM directly

grype sbom:./sbom.cdx.json

Useful in CI: build once, scan the SBOM, avoid pulling the image on every CI run.

Task 5: CI integration

# .github/workflows/scan.yml
- name: Generate SBOM
  run: syft myorg/app:${{ github.sha }} -o cyclonedx-json > sbom.cdx.json

- name: Scan SBOM
  run: grype sbom:./sbom.cdx.json --fail-on high

Task 6: Cleanup

rm -f sbom.cdx.json sbom.spdx.json