Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Generate two SBOMs when you need a trustworthy runtime picture: scan the immutable container image digest to document what was shipped, then export and scan the live container filesystem to document what is actually present after startup. The first result is reproducible; the second can reveal package drift, additions and replacements, but it is a sensitive snapshot of a running system rather than a record of every library loaded in memory.
Syft provides the most direct open-source workflow. Docker Scout offers a Docker-native alternative, while Anchore Runtime Inventory adds fleet context by reporting which image references are running and joining those observations to stored SBOMs. Keep image and runtime artifacts separate, record their identity and collection context, and use a signed attestation for the image SBOM whenever your build system supports it.
As an Amazon Associate I earn from qualifying purchases.
What does a runtime software bill of materials actually describe?
A runtime SBOM is not one universal document. It answers one of two related questions, and the scan target determines which answer you receive.
| Question | Scan target | What the result represents | Main limitation |
|---|---|---|---|
| What was shipped? | Image reference pinned to an immutable digest | Packages visible in the built image, normally the final squashed filesystem | It does not show changes made after the container started |
| What is present now? | Exported filesystem of a running container | Installed files observed in that container at export time, including software added after the image build | It is not a complete inventory of libraries loaded by every process, and the export can contain secrets |
| Which image is running where? | Kubernetes or ECS inventory observations joined to stored SBOMs | Deployment location and image-reference context across a fleet | Inventory does not replace scanning the image or collecting a live filesystem when drift must be proved |
For release evidence, compliance records and reproducible vulnerability analysis, make the digest-pinned image SBOM authoritative. For incident response or drift investigation, add a runtime filesystem SBOM and label it with the exact container and collection time.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
How do I generate an SBOM for the immutable container image?
Resolve the image to a digest, scan that digest, and preserve the generator metadata with the resulting file. A mutable tag is not sufficient evidence because it can point to different content later.
1. Pin the exact image digest
Use the digest recorded by the registry, deployment manifest or Kubernetes Pod specification. The form is an image name followed by @sha256: and the complete digest. Do not substitute a tag such as :latest when the SBOM must be reproducible.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 112. Scan with Syft
Syft can scan registry images, local filesystems and archives and can emit SPDX, CycloneDX or Syft-native JSON. To create a CycloneDX JSON document for the exact image, run:
syft registry.example/app@sha256:<digest> -o cyclonedx-json=app-image.cdx.jsonThe default view is the final visible, or squashed, image. That is normally the right representation of what a container starts with.
3. Decide whether historical layers matter
Add --scope all-layers only when the question includes packages that existed in an earlier layer but were later deleted or replaced. An all-layer result answers a forensic build-history question; it is not the same as the package set visible in the runnable image.
4. Record evidence beside the file
Store the image digest, registry reference, scan time, Syft version, command options and output format with app-image.cdx.json. If the same tag is rebuilt, these fields let a later reviewer distinguish the two image contents.
How do I generate an SBOM from a running Docker container?
Export the live container filesystem to an archive, scan that archive with Syft, and remove the temporary copy. This captures the observed root filesystem, including changes made after startup, but it must be handled as sensitive data.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
- Select the container. The following example selects a running container whose name matches
myapp:CONTAINER_ID=$(docker ps -qf 'name=myapp') - Export its current filesystem.
docker export "$CONTAINER_ID" -o rootfs.tarThe archive is a copy of the live filesystem at export time. It can include files installed by automatic updates, cloud-init, user data, an agent or an operator.
- Scan the archive.
syft file:rootfs.tar -o cyclonedx-json > runtime-sbom.json - Delete the archive after collection.
rm rootfs.tarUse your organization’s secure handling and retention controls for both the archive and the resulting SBOM. The archive can contain credentials, private keys, tokens, application data or other secrets even when the SBOM itself only records package metadata.
Keep runtime-sbom.json separate from the image SBOM. Label it with the container ID, image digest, node or cluster context, export time, scanner version and format. The result shows software represented in the exported root filesystem; it does not prove which shared libraries are currently mapped into each process, what code was executed, or what exists only in memory.
Free tools Windows power users keep installed
One-click scans. No signup required.
Should I scan the image, the live filesystem, or both?
Use the image scan for an immutable statement about the artifact and the live scan when post-start state matters. In production, collecting both gives you a baseline and an observed-state comparison.
| Approach | Reproducibility | Runtime drift visibility | Privilege and data exposure | Deployment context | Best use |
|---|---|---|---|---|---|
| Digest-pinned image scan | High; the digest identifies exact content | None after startup | Usually lower; no live application data is exported | Must be joined to deployment records | Build gates, release records and vulnerability analysis |
| Live filesystem export plus scan | Bound to one container and one collection time | High for installed-file changes | Higher; export may contain secrets and requires container access | Container, node and cluster metadata must be recorded | Incident response, drift investigation and post-start package discovery |
| Runtime image inventory | Uses stored SBOMs for the referenced images | Shows which reference is deployed, not every file change | Typically avoids exporting application files | Strong fleet and location context | Answering which image runs where across Kubernetes or ECS |
A live scan can differ from the published image for legitimate reasons: automatic updates, cloud-init, user data and installed agents can modify a system after boot. The Ubuntu guidance summarizes the distinction precisely: “Scanning a running instance is not the same as scanning the AMI.” Apply the same reasoning to containers: an image SBOM represents the published artifact, while a runtime SBOM represents observed state after startup.
How do I compare an image SBOM with a runtime SBOM?
Compare normalized package identifiers and versions, then investigate each difference in the container’s deployment context. Do not compare filenames alone; package names, ecosystems and version fields provide a more useful identity.
Build a comparison record
- Image digest used for the baseline.
- Container ID and image digest reported by the running workload.
- Node, cluster, namespace and workload identifiers where applicable.
- Image-SBOM and runtime-SBOM collection timestamps.
- Generator name and version, output format and scan options.
Classify each difference
- Added: present in the runtime export but absent from the image result.
- Removed: present in the image result but absent from the runtime export.
- Replaced: the same package identity appears with a different version.
- Layer-only: reported only when the image scan used
--scope all-layers, often because a file was deleted in a later layer.
Interpret differences carefully. A package can be represented differently by scanners when metadata is incomplete, and an exported root filesystem does not include process memory. Treat the diff as an investigation lead, then confirm the change through deployment history, package-manager logs or the image build definition.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
How do I see what is running across a Kubernetes or ECS fleet?
For a workload, first scan the exact digest referenced by its Pod or task definition. If the operational question is which image reference is running on which workload, node or cluster, use runtime inventory rather than exporting every filesystem by default.
Anchore documents Kubernetes and Amazon ECS inventory agents that report image references and deployment context. Those observations can be joined to stored SBOMs, vulnerability matches and policy results, giving fleet visibility without treating a live filesystem export as the only source of truth.
If an incident requires proof of post-start filesystem changes, use an approved debug or node-collection process that complies with your cluster’s Pod Security and access controls. There is no single debug command that is safe or correct for every Kubernetes distribution. Restrict collection to the affected workload, document the privilege used and protect any exported data.
Should I choose SPDX or CycloneDX?
Choose the format required by your governance process and downstream tooling. Both SPDX and CycloneDX are supported by Syft and Docker Scout, so the choice is usually an integration decision rather than a difference in scan coverage.
Recommended Free Tools
| Format | Choose it when | Practical consideration |
|---|---|---|
| SPDX | Your regulator, policy or downstream system explicitly requires SPDX | Preserve the exact format and version metadata expected by that system |
| CycloneDX | Dependency-oriented tooling and workflows expect CycloneDX | JSON is convenient for pipeline storage and automated comparison |
| Syft-native JSON | You need Syft’s native representation for a Syft-specific workflow | Use it only when consumers accept that format; standardize on SPDX or CycloneDX for broad interchange |
Do not discard the image digest when converting formats. A format label without the immutable subject and generator metadata cannot establish exactly which artifact was scanned.
How can I attach and verify an SBOM attestation?
Attach the image SBOM to the image digest during the build so the document travels with the artifact and can be verified later. Docker documents BuildKit SBOM attestations; Syft documents an attestation workflow; and cosign supports a signed attestation pattern tied to the image digest.
The important property is the relationship between the SBOM and the immutable image subject. Retrieve and verify the attestation by digest, not by a mutable tag. Preserve the signing identity, verification result, generator version, format and creation time with your release record. An attestation proves which digest the document was associated with; it does not make a stale or incomplete scan comprehensive.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
What can make a runtime SBOM inaccurate or incomplete?
The tag moved
Scanning a tag at two different times can produce two different results. Resolve and record the digest before scanning, and compare digest-to-digest rather than tag-to-tag.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The scanner saw only the final layer
Syft’s default image view reports the final visible filesystem. If your investigation concerns software present in historical layers, explicitly use --scope all-layers and label that result so it is not mistaken for the runnable filesystem.
The export contains sensitive material
docker export creates a filesystem archive, not a sanitized package manifest. Store it only where access is controlled, delete it after the scan when policy allows, and treat the runtime SBOM and archive as separate sensitivity classes.
The process loaded code that is not represented as an installed package
A filesystem SBOM cannot be treated as a complete process-level execution inventory. It does not enumerate every library loaded by every process, transient code held only in memory or behavior observed at runtime.
The workload changed during collection
A runtime export is a point-in-time observation. Record the start and end times, container ID and image digest, and avoid presenting it as a permanent description of a mutable workload.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The image and runtime scans used different metadata or formats
Keep scanner versions, scope options and output formats with each artifact. Differences in collection settings can look like package drift when the underlying filesystem did not change.
What is the Docker Scout alternative?
Docker Scout can generate an SBOM directly from a digest-pinned image and can emit CycloneDX, JSON or SPDX output. The Docker-native command for a CycloneDX file is:
docker scout sbom --format cyclonedx --output app-image.cdx.json registry.example/app@sha256:<digest>Docker documents that Scout can consume an existing SBOM attestation or index the image contents to create one. Use the same evidence discipline as with Syft: scan the immutable digest, record the tool version and options, and keep the resulting document tied to that digest.
Scout’s command above addresses the image artifact. It does not turn a live container export into a runtime filesystem SBOM; use an approved export-and-scan workflow when that is the question.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How much time and storage should I expect?
Scan time and SBOM size depend on the image, filesystem, package ecosystems and compute environment. One Ubuntu 24.04 example on a t3.small reports approximately 2 minutes 20 seconds, a 48 MB SPDX JSON file and 1,730 packages: 931 deb, 679 Go, 111 PyPI, 5 generic and 3 Maven. Those figures are an example measurement from that guide, not a universal benchmark or a promise for container scans.
Plan storage for the SBOM, provenance metadata and any temporary archive separately. Runtime archives can be much more sensitive than their package lists, so retention should follow your incident-response and data-classification policies rather than a default build-artifact policy.
What should a production workflow look like?
A practical workflow separates build evidence, deployment context and runtime investigation instead of forcing one scan to answer every question.
- At build time, generate an image SBOM from the image digest and attach it as a signed attestation when supported.
- At deployment time, record the digest in the workload specification and retain the namespace, cluster, node or task context.
- During fleet monitoring, collect runtime image inventory and join deployed references to the stored SBOM and policy results.
- During an incident or drift investigation, export only the approved live container filesystem, scan it, label it as runtime evidence and protect the archive.
- During review, diff package identifiers and versions, classify additions or replacements, and preserve the records that explain each difference.
This arrangement keeps the reproducible artifact record intact while still giving responders a way to examine what changed after startup.
Runtime SBOM checklist
- Is the image identified by a complete digest rather than only a tag?
- Did you choose image, live filesystem or fleet inventory according to the question being asked?
- Are image and runtime SBOMs stored as separate artifacts?
- Are container ID, image digest, node or cluster context, scan time, generator version and format recorded?
- If historical layers matter, did you explicitly use and label
--scope all-layers? - Was the exported filesystem treated as sensitive and removed or retained under an approved policy?
- Is the SBOM attached to and verified against the image digest when attestation is used?
- Have you stated that a filesystem SBOM does not enumerate every library loaded by every process?
Frequently Asked Questions
Can an SBOM tell me whether a vulnerable library was actually used by a process?
No. An SBOM identifies software represented in the scanned image or filesystem; it does not establish that a process loaded or executed a particular library. Usage and reachability require separate runtime or application analysis.
Does exporting a container include mounted volumes?
The documented export workflow describes the container’s filesystem snapshot. Treat separately mounted data and platform-managed storage according to your runtime’s export semantics and collection policy rather than assuming every external volume is represented.
Can I use the runtime SBOM as a substitute for the build-time attestation?
No. A runtime export is tied to one container at one moment and may include post-start changes. Keep the digest-linked image attestation as the record of what was published, then use runtime SBOMs as additional observations.
Is an SBOM also a secret-scanning report?
No. The temporary archive created for a runtime scan may contain secrets, but the SBOM is a package inventory, not a guarantee that credentials or private data were detected. Apply a dedicated secret-handling and scanning process where required.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
