iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To generate a useful runtime software bill of materials (SBOM), answer two separate questions: what was shipped in the immutable container image, and what is actually present after the container starts. Pin the image by its digest and scan it with Syft (or Docker Scout) for a reproducible artifact SBOM. When startup changes, drift, or incident response matter, export the live container filesystem and scan that archive separately. Keep both documents, record the container and image metadata, and compare package identifiers and versions to find differences. An image SBOM describes the published artifact; a runtime filesystem SBOM describes observed files in one running container. Neither alone proves every library loaded by every process.
What is a runtime SBOM, and why are there two different answers?
A software bill of materials is an inventory of software components, versions and related metadata. “Runtime SBOM” is often used for two different deliverables:
- Image SBOM: the packages visible in a specific, immutable container image digest. This is the reproducible record of what you built and shipped.
- Runtime filesystem SBOM: the packages and files found when you export a live container’s root filesystem. This captures changes made after image creation, such as package updates, generated files or an installed agent.
Choose the first when compliance, release evidence or vulnerability triage requires a statement about the artifact. Choose the second when you are investigating drift or an incident in a running workload. A production program commonly produces both and keeps them as separate artifacts rather than treating a live scan as a replacement for the build-time record.
Should I scan the image or the live container?
Scan the image for reproducibility; scan the live filesystem for observed post-start state. The right target depends on the question you need the SBOM to answer.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
| Approach | What it represents | Reproducibility | Runtime drift visibility | Privilege and exposure | Deployment context |
|---|---|---|---|---|---|
| Immutable image scan | Final visible filesystem in a pinned image digest | High when the digest and generator version are recorded | None for changes made after startup | No access to a running workload is required | Must be joined to deployment data separately |
| Live filesystem export | Files present in one exported container root filesystem | Bound to that container and scan time | Shows additions, updates and replacements visible in the export | Requires container access and creates a potentially sensitive archive | Includes the container ID and host or cluster context you record |
| Runtime image inventory | Which image references are running and where | Depends on the referenced digest and stored SBOM | Shows deployment placement, not arbitrary filesystem changes | Uses an inventory agent rather than exporting every filesystem | Designed for fleet-wide Kubernetes or Amazon ECS visibility |
A live export is not a process-level trace. It can contain installed files while omitting libraries loaded from unusual locations, deleted files still held open by a process, kernel components and other runtime state. If the requirement is “what is running where?”, an inventory system that reports image references and context is more appropriate than exporting every container.
How do I generate an SBOM for the exact container image?
Pin the image by digest, then scan that digest. A mutable tag such as latest can point to a different image tomorrow, making the evidence impossible to reproduce.
1. Resolve and verify the digest
Use the digest recorded in your deployment manifest, admission log or registry. The reference should look like registry.example/app@sha256:<digest>. If your manifest contains only a tag, resolve it before scanning and update the deployment record so the scanned object is unambiguous.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →2. Scan with Syft
syft registry.example/app@sha256:<digest>
-o cyclonedx-json=app-image.cdx.jsonSyft can inspect container images, filesystems and archives. Its documented outputs include SPDX, CycloneDX and Syft-native JSON. The normal view is the final visible, or “squashed,” image. That is usually the correct answer to “what is in the image that will run?”
3. Include historical layers only for a layer-history question
syft registry.example/app@sha256:<digest>
--scope all-layers
-o cyclonedx-json=app-all-layers.cdx.jsonUse --scope all-layers when you need packages that existed in historical layers, including files later deleted. This can reveal credentials or vulnerable packages that are no longer in the final filesystem, but it is not the same as the package set available to processes in the running container.
4. Use a Docker-native alternative when it fits your workflow
docker scout sbom --format cyclonedx
--output app-image.cdx.json
registry.example/app@sha256:<digest>Docker Scout can emit CycloneDX, JSON and SPDX forms. Docker documents that Scout can consume an existing SBOM attestation or index image contents to create one. Keep the digest in your record even when the command is integrated into a Docker-centric pipeline.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
How do I generate an SBOM from a running container?
Export the live container’s root filesystem, scan the archive, then delete the archive securely. This captures files visible in the exported filesystem, including software installed after the image was built.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Select the container. The following example finds a running Docker container whose name matches
myapp:
CONTAINER_ID=$(docker ps -qf 'name=myapp')- Export the filesystem.
docker export "$CONTAINER_ID" -o rootfs.tar- Scan the archive with Syft.
syft file:rootfs.tar -o cyclonedx-json > runtime-sbom.json- Remove the temporary archive.
rm rootfs.tarThe exported archive is a copy of the live root filesystem. Treat it as sensitive: configuration files, tokens, certificates or application data may be included. Restrict its permissions, store it only as long as needed, and follow your incident-response retention and deletion rules.
Record at least the container ID, image digest, node or cluster, namespace and workload, scan timestamp, Syft version and output format beside runtime-sbom.json. Without that metadata, a later reader cannot tell which replica was scanned or whether the file describes a release artifact or a one-off state.
How do I compare an image SBOM with a runtime SBOM?
Compare normalized package identifiers and versions, not raw JSON text. Preserve the two original documents, then create a diff that classifies additions, removals and replacements.
Build a comparison set
- Match the runtime container to the exact image digest used to create the image SBOM.
- Normalize ecosystem names and package identifiers as your SBOM tooling defines them.
- Compare package name, version and, where available, package URL or other stable identifier.
- Keep operating-system packages, language packages and generic files distinguishable so an OS update is not confused with an application dependency change.
Interpret the differences
| Diff result | Likely meaning | Follow-up |
|---|---|---|
| Same package and version | The runtime still contains the image component unchanged | Use the image record for release provenance and the runtime record for observed context |
| Runtime-only package | Installed after startup, generated by a package manager, or detected only by a different scanner | Check startup scripts, sidecars, mounted paths and scanner coverage |
| Different version | An in-place update, replacement or image mismatch | Inspect package-manager logs, container identity and deployment records |
| Image-only package | Removed during startup, hidden by a mount, or missed in the runtime export | Check mount points and whether the package left files outside the exported root filesystem |
A difference is an investigation lead, not automatic proof of compromise. Confirm the container digest, replica, scan time and mounts before escalating a package change.
How should I handle Kubernetes and production fleets?
Start with the exact image digest referenced by each Pod, then add fleet inventory when you need location and deployment context. Anchore documents Kubernetes and Amazon ECS inventory agents that report image references and context, allowing those observations to be joined to stored SBOMs, vulnerability matches and policy results.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
For release evidence
- Read the image digest from the Pod specification or admission record.
- Generate or retrieve the SBOM for that digest.
- Store the SBOM with namespace, workload, cluster, deployment revision and scan metadata.
- Evaluate vulnerabilities and policy against the stored artifact.
For fleet visibility
Use runtime image inventory to answer questions such as which digest is running in each cluster, namespace or task. Inventory is lighter and more scalable than exporting every filesystem, but it does not prove that a process has not changed files after startup.
For a live incident or drift investigation
Use an approved debug or node-collection process that satisfies your cluster’s Pod Security and access controls. There is no single debug command that is safe and valid for every Kubernetes distribution. Obtain the required authorization, capture the container identity and preserve chain-of-custody metadata before exporting data.
Should I use SPDX or CycloneDX?
Choose SPDX when governance, procurement or downstream systems require SPDX. Choose CycloneDX when dependency-oriented tooling expects CycloneDX. Syft and Docker Scout support both, so the decision is normally an integration requirement rather than a scanning capability limitation.
Recommended Free Tools
| Need | Practical choice |
|---|---|
| Organization-wide license or compliance exchange | Use the format mandated by the receiving system, often SPDX |
| Dependency analysis and application-security pipelines | Use CycloneDX when the pipeline consumes it directly |
| Multiple consumers | Generate both from the same pinned digest and retain generator metadata |
Do not discard the source relationship: include the image digest, scanner name and version, scan time and output format with every artifact. A format conversion that omits those fields can make a valid SBOM difficult to audit.
How do signed SBOM attestations preserve provenance?
Attach the image SBOM as a signed attestation during the build whenever possible. The attestation binds the document to the image digest, so a later consumer can verify that the SBOM was produced for the exact artifact being deployed rather than for a tag that has since moved.
- Docker documents BuildKit SBOM attestations.
- Syft documents creating attestations with
syft attest. - OWASP shows a cosign attestation pattern tied to an image digest.
Retrieve and verify an attestation by digest, not by a mutable tag. Keep the generated file and verification result in the release record. A signature proves integrity and subject identity; it does not guarantee that the scanner detected every package or that the live filesystem still matches the image.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
What accuracy limits should I explain to auditors and incident responders?
State the scan target and its limits in the report. A live scan can differ from the published image because automatic updates, cloud-init, user data, startup scripts and installed agents may change a system after boot. Ubuntu’s guidance summarizes the distinction plainly: “Scanning a running instance is not the same as scanning the AMI.” The same principle applies to containers: scanning a running filesystem is not the same as scanning the image that started it.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches- Final-image scans omit deleted historical content. Use an all-layer scan only when layer history is part of the question.
- Filesystem exports are not process inventories. They do not enumerate every library currently loaded by every process.
- Mounts can alter what you observe. A volume or projected secret may hide image files at the same path, while mounted content may be outside the image SBOM.
- Scanner coverage differs. Package managers, language ecosystems and generic files may be identified differently by different versions of a scanner.
- One replica is not a fleet. A runtime SBOM from one container cannot establish that all replicas are identical.
Ubuntu’s documented example for Ubuntu 24.04 reports about 2 minutes 20 seconds to scan a t3.small, producing a 48 MB SPDX JSON file containing 1,730 packages: 931 deb, 679 Go, 111 PyPI, 5 generic and 3 Maven. Treat those figures as that guide’s example measurement, not a universal benchmark for your image, node type or scanner version.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should a production SBOM record contain?
Use a metadata checklist so an SBOM remains interpretable months later.
- Immutable image reference, including the registry digest.
- Container ID and, for orchestration, cluster, node, namespace, Pod, task or deployment identifiers.
- Scan target: final image, all image layers or exported live filesystem.
- Scan timestamp in a stated time zone.
- Generator name and exact version, command options and output format.
- SBOM file hash and storage location.
- Whether the archive contained mounted data or other sensitive paths.
- Attestation signature and verification result, when used.
- Retention, access and deletion handling for exported runtime archives.
This record separates reproducible release evidence from time-sensitive operational observations and makes a package diff defensible.
What are the most common failure modes?
The tag changed between scans
Symptom: two scans of the same tag produce different package lists. Fix: resolve and store the digest, then rerun both scans against that digest.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The runtime SBOM contains secrets
Symptom: the exported tar file includes credentials, private keys or application data. Fix: restrict access immediately, do not upload it to an unapproved service, delete it according to policy and prefer a controlled collection path for future investigations.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
The runtime scan misses a package seen in the image
Symptom: an image-only package disappears from the live result. Check whether a volume masks the path, startup removed the files, the container changed identity, or the scanner recognized the package differently.
A fleet report has image references but no filesystem drift
That is expected. Runtime inventory answers where image references run; it does not inspect every container filesystem. Export and scan a live filesystem only for the workloads and incidents that require that evidence.
The SBOM is too large or slow for a release gate
Scan the immutable image in the build pipeline and attach the result. Reserve all-layer and live-filesystem scans for layer-history analysis, scheduled validation or incident response, where their extra data and runtime access are justified.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat is the recommended end-to-end workflow?
- Build the image and record its digest.
- Generate a final-image SBOM with Syft or Docker Scout in SPDX, CycloneDX or both.
- Sign and attach the SBOM as a digest-bound attestation when your registry and build system support it.
- Deploy the digest, never an unpinned tag.
- Collect runtime image inventory for cluster or task placement.
- When drift or an incident matters, export an approved live container filesystem and scan it separately.
- Diff normalized package identifiers and versions, then investigate each unexpected change.
- Retain the SBOM, attestation, metadata and verification record according to your compliance policy.
This workflow gives auditors a reproducible answer about what was shipped and operators an evidence-based answer about what was observed after startup.
Frequently Asked Questions
Can a runtime SBOM prove which libraries a process loaded?
No. A filesystem SBOM inventories files and package metadata visible in the scanned root filesystem. Process-level evidence requires separate runtime telemetry or forensic collection, and it may include libraries loaded from paths that a filesystem export does not represent.
Should I scan a container’s writable layer or its mounted volumes?
Scan each source according to the question. The writable layer shows changes made inside the container, while mounted volumes and projected data can mask image paths or add content outside the image; document which mounts were included and scan them under your data-governance rules.
How often should production runtime SBOMs be regenerated?
Regenerate image SBOMs for every immutable build. Generate live filesystem SBOMs on a schedule only when drift detection justifies the access and sensitive-data handling, and trigger an additional scan during incident response or after an emergency in-place update.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can I use one SBOM for every replica of a deployment?
You can reuse the image SBOM for replicas that run the same digest, because it describes the shared artifact. Runtime filesystem results are replica- and time-specific, so record each sampled container or clearly state the sampling scope.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
