Generating SBOMs for Your Image with BuildKit | Docker

The latest release series of BuildKit, v0.11, introduces support for build-time attestations and SBOMs, allowing publishers to create images with records of how the image was built. This makes it easier for you to answer common questions, like which packages are in the image, where the image was built from, and whether you can reproduce the same results locally. This new data helps you make inform

[BlueSkyDetector]

おお、dockerの公式コマンドでSPDXを生成してくれるのか。SBOM、特にSPDXの普及が進むのはOSSサプライチェーンセキュリティにとって良いこと。

[mohritaroh]

“BuildKit”

[tmatsuu]

BuildKit 0.11からSBOM生成に対応。build時に--sbom=trueをつければok。ほほう