Viewing images through layered SBOMs
summary
Generates layered SBOMs that show which Dockerfile instruction owns which packages — e.g. a single npmci layer pulls in 322 packages while a node base adds 10 and Alpine 18 — and builds a reverse index of public images (Docker Official, Verified Publisher, Distroless, Bitnami, MCR) by extracting SBOMs on push and enabling build‑time recording. The UI maps advisories to layers and running containers, surfaces fixes (one package shows fix in 14.14.20), and a discovered digest upgrade removes six vulnerabilities.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:54SBOMs and Image layers
- 1:34Layer Ownership
- 5:00Tracking Content
- 7:19Shared Content
- 8:07Public Data
- 10:07Why?
- 12:10Reacting
- 15:52Getting Started
- 17:48Noise
- 21:10Summary
related talks
22mSBOM: A New Way to Generate a Software Bill of Materials from Your Container Image
37mDockerize Securely: SBOMs + Attestations + Bake
47mHands-On SBOM
38mSecuring the chains: Building defensive layers for software supply chains
32mBack to the Drawing Board: Building Containers with SBoMs
30mNo Joker in the Pack: SBoMs for Container Images
26mDigging Into Your App's Container Image Layers for Sneaky Vulnerabilities
58mOptions Galore to Get from Source Code to Container