Kubernetes BOM (bom)
Kubernetes BOM (bom): An open-source CLI for generating and working with SPDX SBOMs across varied inputs. Ranked #11 of 33 in SBOM Generation Tools by our editors (7.5/10); pricing: Free plan; best for SPDX SBOMs for files, archives, and container images.
At a glance
- Editor score7.5 / 10
- PricingFree plan
- Best forSPDX SBOMs for files, archives, and container images
- Free planYes
- Paid fromFree
- Source code inputYes
- Facts checked14 Nov 2026
Where it wins
- Scans directories, files, archives, and container images
- Queries, visualizes, and validates SBOM contents
- Exports SPDX documents and in-toto provenance data
Where it doesn't
- Documented CLI output centers on SPDX, not CycloneDX
- SPDX 3 JSON-LD output is experimental
- Self-hosted CLI use requires a local workflow
Our verdict on Kubernetes BOM (bom)
Kubernetes BOM, commonly called bom, is an open-source command-line utility and Go library for creating and working with software bills of materials. It suits teams that need SPDX SBOMs from source directories, individual files, archives, or container images, including workflows that inspect Go dependencies or image contents. Its scope spans generation and follow-on analysis rather than stopping at an exported document, making it relevant to software teams maintaining build or delivery processes.
The documented CLI writes SPDX 2.3 in JSON or tag-value formats; SPDX 3 JSON-LD output is experimental. Scanning can collect package, dependency, and license information, including operating-system packages and image layers in container images. License classification uses the SPDX license catalog. After generation, users can query SBOM contents with filters such as depth, name, or package URL, render structure and relationship graphs, and validate files against checksums recorded in an SBOM. These functions make bom useful when the task includes examining or checking an inventory, not only producing one.
The CLI can export SBOM data as an in-toto provenance statement for CI/CD use, and the product is self-hosted. The documented CLI formats are SPDX variants rather than CycloneDX; while the Go library's protobom documents can be serialized to CycloneDX, that is not documented as CLI generation output. Choose bom when an open-source CLI, broad file and image inputs, SPDX output, and inventory queries or validation fit the workflow. Teams requiring documented CycloneDX generation directly from a CLI should consider another tool.
Your product? Our editors can test Kubernetes BOM (bom) in depth and publish a review, labelled as paid · from $149/mo →
Kubernetes BOM (bom) pricing
Kubernetes BOM (bom) fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| SPDX output | Yes |
| CycloneDX output | No |
| Source code input | Yes |
| Container image input | Yes |
| Binary input | Yes |
| Build-pipeline support | Yes |
| Deployment | Self-hosted |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Pricing | Free plan |
| Website | github.com |
| Facts checked | 14 Nov 2026 |
Alternatives to Kubernetes BOM (bom)
- Docker ScoutGenerates and displays SBOMs alongside vulnerability analysis for container images.8.7
- Amazon InspectorA managed AWS security service that pairs continuous scanning with SBOM exports.8.6
- TrivyA free, self-hosted SBOM generator that also scans code, containers, Kubernetes, and AWS.8.5
See all Kubernetes BOM (bom) alternatives →
Used Kubernetes BOM (bom)? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Kubernetes BOM (bom) for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Kubernetes BOM (bom) is listed in our SBOM Generation Tools directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/kubernetes-bom-bom/"><img src="https://www.itechguides.com/best/badge/kubernetes-bom-bom.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update