SHSelfHostIndex
SY

Syft

Generate software bills of materials from images and code

Developer Tools & Git ★ 9.7k stars Easy setup Apache-2.0

Syft is an open-source tool from Anchore that generates a software bill of materials (SBOM) from container images and filesystems. It supports many SBOM formats for self-hosted supply chain workflows.

Official siteSource code

Key features

  • SBOM generation
  • SPDX and CycloneDX output
  • Wide ecosystem support
  • Pairs with Grype

Strengths

  • Released under the Apache-2.0 license
  • Easy to set up — beginner-friendly
  • First-class Docker support for quick deployment
  • Mature project with 9.7k GitHub stars

Is Syft secure?

No known vulnerabilities affect Syft's latest release (v1.54.1). OSV.dev lists 2 past advisories for the project; none of them applies to this release. No known vulnerabilities is not proof of security: it means none have been publicly catalogued.

  • Most recent fixed advisory CVE-2026-33481, published 2026-03-26 (202 days ago), fixed in 1.42.3

Source: OSV.dev, checked 2026-10-14. How this is measured.

Syft replaces

Self-hosted Snyk alternatives

Health badge

Maintain Syft? Add its health score to your README. The badge links back to this page.

SelfHostIndex: 94 · excellent

Markdown
[![SelfHostIndex health score for Syft](https://selfhostindex.com/badge/syft-sbom.svg)](https://selfhostindex.com/app/syft-sbom/)
HTML
<a href="https://selfhostindex.com/app/syft-sbom/"><img src="https://selfhostindex.com/badge/syft-sbom.svg" alt="SelfHostIndex health score for Syft"></a>
reStructuredText
.. image:: https://selfhostindex.com/badge/syft-sbom.svg
   :alt: SelfHostIndex health score for Syft
   :target: https://selfhostindex.com/app/syft-sbom/

The score is recomputed on every nightly rebuild from public repository data — see how it is calculated.

Compare Syft

4 head-to-head comparisons.

Similar developer tools & git apps