Syft review
A free, open-source CLI and Go library for creating and converting CycloneDX and SPDX SBOMs.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Syft is an open-source command-line tool and Go library from Anchore for generating software bills of materials. It suits teams that need to inventory software across container images, filesystems, directories, individual files, and archives, whether working on Linux, macOS, or Windows. Its package catalog spans ecosystems including Alpine, Debian, RPM, Go, Python, Java, JavaScript, Ruby, Rust, PHP, and .NET, making it relevant to varied software stacks rather than one language or package manager.
Format flexibility is a core strength: Syft produces CycloneDX XML and JSON, as well as SPDX tag-value and JSON, and can convert between supported SBOM formats. It can scan container images through Docker, Podman, Containerd, OCI archives, and registries. Syft also integrates with Grype, and can create signed SBOM attestations using the in-toto specification. These capabilities make it a fit for teams that want SBOM generation to connect with container workflows and related analysis, while still choosing among established output formats.
Syft is free and self-hosted, so it is a practical choice for teams comfortable operating a CLI or incorporating a Go library into their workflows. Community support and documentation are the listed support channels. Anchore separately offers commercial support and enterprise products; those are distinct from Syft itself. The tradeoff is that Syft centers on command-line and library use rather than a graphical workflow, and self-hosting means teams manage its operation. Choose Syft for broad, format-flexible generation across images and filesystems; consider another option if a managed interface or a different support model is essential.
Syft pros and cons
- Where it wins
- Creates CycloneDX and SPDX output and converts between supported formats
- Scans images from Docker, Podman, Containerd, OCI archives, and registries
- Generates signed SBOM attestations using the in-toto specification
- Where it doesn't
- Command-line and Go library workflows may not suit teams seeking a graphical interface
- Self-hosted deployment places operation with the adopting team
- Support is through community channels and documentation
Syft fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update