Use the Docker image directly¶

For everyday use we recommend the scan-sbom.sh script, which handles language detection, image selection, and volume mounts for you. This document explains how to call the image directly with docker run in environments where the script cannot live (CI runners, Kubernetes jobs, and so on).

Images and tags¶

Image	Purpose
`ghcr.io/sktelecom/bomlens`	Scanning and post-processing (canonical name)
`ghcr.io/sktelecom/sbom-generator`, `ghcr.io/sktelecom/sbom-scanner`	Aliases of the same image (former names, same digest)
`ghcr.io/sktelecom/bomlens-firmware`	Firmware analysis (includes GPL tools, opt-in) (legacy alias: sbom-scanner-firmware)

latest and version tags are available, and both linux/amd64 and linux/arm64 are supported. Images are signed with cosign before publishing.

docker pull ghcr.io/sktelecom/bomlens:latest

What is in the image¶

It is a lightweight image (based on python 3.12 slim) without language toolchains. For source scans, transitive dependency resolution is handled by the script, which pulls per-language cdxgen images separately. See Architecture for the structure.

Tool	Version	Role
syft	v1.46.0	Scans images, binaries, and directories
Trivy	v0.72.0	Vulnerability report
cosign	v2.4.1	SBOM signing
jq	—	SBOM normalization and notice generation
ScanCode Toolkit	32.5.0	Precise license detection (included only in opt-in builds)

Tool versions are pinned with ARG in docker/Dockerfile.

Running directly¶

Select the analysis mode with the MODE environment variable. All examples below leave their outputs in the current directory and do not upload anything (UPLOAD_ENABLED=false).

Analyze a Docker image¶

docker run --rm \
  -v "$(pwd)":/host-output \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -e MODE=IMAGE \
  -e TARGET_IMAGE="nginx:alpine" \
  -e UPLOAD_ENABLED=false \
  -e HOST_OUTPUT_DIR=/host-output \
  -e PROJECT_NAME="Nginx" \
  -e PROJECT_VERSION="alpine" \
  ghcr.io/sktelecom/bomlens:latest

Analyze a binary file¶

docker run --rm \
  -v "$(pwd)":/target \
  -v "$(pwd)":/host-output \
  -e MODE=BINARY \
  -e TARGET_FILE=/target/firmware.bin \
  -e UPLOAD_ENABLED=false \
  -e HOST_OUTPUT_DIR=/host-output \
  -e PROJECT_NAME="Firmware" \
  -e PROJECT_VERSION="1.0" \
  ghcr.io/sktelecom/bomlens:latest

Analyze a source directory¶

docker run --rm \
  -v "$(pwd)":/src \
  -v "$(pwd)":/host-output \
  -e MODE=SOURCE \
  -e UPLOAD_ENABLED=false \
  -e HOST_OUTPUT_DIR=/host-output \
  -e PROJECT_NAME="MyApp" \
  -e PROJECT_VERSION="1.0.0" \
  ghcr.io/sktelecom/bomlens:latest

In direct runs, SOURCE mode has syft read the package manifests inside the container, so it may only capture direct dependencies. If you need transitive dependencies, use scan-sbom.sh, which routes to the per-language cdxgen images.

Notice and reports in one run¶

In direct runs, the notice and security reports are off by default. Turn on the following variables to get the same outputs as the CLI's --all.

docker run --rm \
  -v "$(pwd)":/host-output \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -e MODE=IMAGE \
  -e TARGET_IMAGE="nginx:alpine" \
  -e GENERATE_NOTICE=true \
  -e GENERATE_SECURITY=true \
  -e GENERATE_REPORT=true \
  -e UPLOAD_ENABLED=false \
  -e HOST_OUTPUT_DIR=/host-output \
  -e PROJECT_NAME="Nginx" \
  -e PROJECT_VERSION="alpine" \
  ghcr.io/sktelecom/bomlens:latest

Environment variables¶

Variable	Required	Default	Description
`MODE`	Yes	`POSTPROCESS`	Analysis mode: `SOURCE`, `IMAGE`, `BINARY`, `ROOTFS`, `FIRMWARE`, `ANALYZE`
`PROJECT_NAME`	Yes	—	Project name
`PROJECT_VERSION`	Yes	—	Project version
`TARGET_IMAGE`	Per mode	—	Image name for `IMAGE` mode (requires the docker.sock mount)
`TARGET_FILE`	Per mode	—	File path for `BINARY`/`FIRMWARE` mode (path inside the container)
`TARGET_DIR`	Per mode	—	Directory path for `ROOTFS` mode
`UPLOAD_ENABLED`	—	`true`	If `false`, save locally without uploading (same as CLI `--generate-only`)
`HOST_OUTPUT_DIR`	—	—	Mounted path to copy the outputs to
`GENERATE_NOTICE`	—	`false`	Generate the open-source notice (CLI `--notice`)
`GENERATE_SECURITY`	—	`false`	Generate the Trivy security report (CLI `--security`)
`GENERATE_REPORT`	—	`false`	Generate the open-source risk analysis report (off in direct runs, unlike the CLI default)
`ENRICH_MAVEN_CPE`	—	`true`	Attach an NVD-matchable `cpe:2.3` to maven components (derived from the groupId) so a CPE-aware engine can reach their NVD-only CVEs; unmapped groups get no CPE (skipped for AI SBOMs)
`SECURITY_NVD_VERIFY`	—	`false`	With `--deep-cve`: verify each grype `nvd:cpe` finding against the live NVD version range and drop out-of-range false positives (needs `NVD_API_KEY` + network; adds minutes). Off by default — findings are kept and flagged version-unverified
`NVD_API_KEY`	For `SECURITY_NVD_VERIFY`	—	NVD API key used by the deep-cve version filter; passed to the container by name only (never inlined)
`ENRICH_EOL`	—	`true`	Flag components past their upstream end-of-life from a bundled offline snapshot (skipped for AI SBOMs)
`ENRICH_MALICIOUS`	—	`true`	Flag components that are known-malicious packages (typosquats, hijacked accounts) from a bundled offline OSV snapshot. A separate signal from vulnerabilities: the response is removal and credential rotation, not an upgrade
`ENRICH_OS_CONTEXT`	—	`true`	Synthesize an `operating-system` component from distro package PURLs (rpm, deb, and apk). Trivy selects the distro vulnerability feed from that component, so without it the OS packages in a supplier SBOM or rootfs scan would get no OS CVE matches at all. No-op when the SBOM has no recognizable distro packages — including a distro Trivy carries no feed for, such as OpenWRT (skipped for AI SBOMs)
`STALENESS_ENRICH`	—	`false`	Add deps.dev version currency (how many releases behind latest); needs network access
`ENRICH_HF_SECURITY`	—	`true`	AIBOM mode: read HuggingFace's per-file security scan results (ClamAV + picklescan) into the ML-BOM; metadata only, no file download
`API_KEY`, `API_URL`	For uploads	—	Upload credential and server URL. DT uses `X-Api-Key`; TRUSCA uses a Bearer token
`UPLOAD_TARGET`	—	`dependency-track`	Upload destination: `dependency-track` (DT-compatible) or `trusca` (native ingest, not DT-compatible)
`TRUSCA_PROJECT_ID`	When `trusca`	—	Target TRUSCA project id (UUID). Must already exist (no auto-create)
`TRUSCA_REF`	—	`main`	Ingest ref label
`TRUSCA_RELEASE`	—	`PROJECT_VERSION`	Ingest release label
`BOMLENS_MAVEN_FULL_GRAPH`	—	—	Maven source scans: set `1` to keep the full resolved graph instead of filtering to compile/runtime scope
`BOMLENS_NODE_FULL_GRAPH`	—	—	Node.js source scans: set `1` to keep the full dev-plus-production graph instead of the production-only set
`BOMLENS_KEEP_BUILD_OUTPUT`	—	—	Source scans: set `1` to leave the resolved tree in place. By default the scan restores the files its resolvers rewrote (`go.mod`, `go.sum`, `Cargo.lock`, `Gemfile.lock`, `Package.resolved`) and removes the build directories they created, so the scanned project is handed back as it was
`CYCLONEDX_SPEC_VERSIONS`	—	`1.3 1.4 1.5 1.6`	Accepted CycloneDX spec versions for the conformance check (space-separated); overrides the default range
`AI_CYCLONEDX_SPEC_VERSIONS`	—	`1.3 1.4 1.5 1.6 1.7`	Accepted CycloneDX versions for AI SBOMs (ML-BOM), which additionally allow 1.7
`SPDX_SPEC_VERSIONS`	—	`SPDX-2.2 SPDX-2.3`	Accepted SPDX spec versions for the conformance check

TRUSCA's (formerly TrustedOSS Portal) native ingest endpoint (POST /v1/projects/{id}/sbom-ingest, Bearer auth) is not Dependency-Track compatible. To push to a regular Dependency-Track server, keep UPLOAD_TARGET=dependency-track (the default).

For the full mapping between CLI flags and environment variables, see the flag mapping in Architecture.

Building and publishing the image¶

The procedure for building the image yourself or publishing it for multiple platforms is in the contributor-facing docker/README.

Related: Getting started | CLI reference | Architecture