Docker Scout SBOM Integration Guide

Generate CycloneDX or SPDX SBOMs from container images using Docker Scout sbom command and upload to Vulnetix.

Install & scan

$ # Docker Scout is included in Docker Desktop and Docker Engine 24.0+
docker scout version

# Or install the CLI plugin
curl -fsSL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh
$ # Generate CycloneDX SBOM from container image
docker scout sbom myimage:latest --format cyclonedx --output scout-sbom.cdx.json

# Generate SPDX SBOM
docker scout sbom myimage:latest --format spdx-json --output scout-sbom.spdx.json

Run Docker Scout SBOM in CI

Scan on every push and upload the report as a workflow artifact:

- name: Generate SBOM with Docker Scout
  run: docker scout sbom myapp:${{ github.sha }} --format cyclonedx --output scout-sbom.cdx.json

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: docker-scout-sbom
    path: scout-sbom.cdx.json
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Docker Scout SBOM's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Docker Scout SBOM. Keep running it. Vulnetix sits on top of Docker Scout SBOM (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Docker Scout SBOM is strongest at its core category and also carries features in Container & Image Scanning, SCA, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Docker Scout SBOM does well

• Layer-aware SBOM generation directly from container images, OCI layouts, tarballs (docker save) and local directories, output as list/JSON/SPDX/CycloneDX
• Broad package-type detection across OS (apk/deb/rpm) and language (npm/pypi/golang) ecosystems in a single image scan, filterable by package type
• The wider Docker Scout product matches the SBOM against multiple advisory databases for CVEs and gives base-image update recommendations to remediate at the right layer
• Native to the Docker toolchain and CLI, so SBOM + CVE + policy evaluation run inline with docker build with no extra tooling

Where Vulnetix adds to it: Vulnetix ingests Docker Scout's CycloneDX/SPDX SBOMs and CVE output and folds them into a cross-scanner deduplicated queue, then layers exploit-intel prioritisation (EPSS/KEV/ESS/LEV), reachability, versioned VEX, SSVC and Safe Harbour autofix on top. Scout stays the container SBOM/CVE engine; Vulnetix does not replace its image analysis, it consolidates and prioritises it alongside SAST, IaC, secrets and cloud findings.

No migration, no rip-and-replace. Docker Scout SBOM keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Docker Scout SBOM results in Vulnetix

Upload Docker Scout SBOM SPDX, CycloneDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Docker Scout SBOM documentation ↗

Wire Docker Scout SBOM into your CI/CD pipeline →