Trivy

SBOM Commands

Generate CycloneDX or SPDX SBOMs and scan existing SBOMs for vulnerabilities.

4 commands

Pro Tips

Use --format cyclonedx for supply chain compliance

$ trivy image --format cyclonedx -o sbom.json nginx:latest

Generate CycloneDX SBOM.

$ trivy image --format spdx-json -o sbom.spdx.json nginx:latest

Generate SPDX SBOM.

$ trivy sbom sbom.json

Scan an existing SBOM for vulnerabilities.

$ trivy fs --format cyclonedx -o sbom.json .

Generate SBOM for filesystem.