\u5728\u4e0a\u4e2a\u6708\u516c\u5e03\u7684 Docker Desktop v4.7.0 \u4e2d\uff0c\u4ecb\u7ecd\u4e86\u4e00\u4e2a\u65b0\u7684 CLI \u63d2\u4ef6-docker\/sbom-cli-plugin\uff0c\u5176\u4e3a Docker CLI \u51cf\u5c11\u4e86\u4e00\u4e2a\u5b50\u547d\u4ee4 \u2013 sbom\uff0c\u7528\u4e8e\u67e5\u770b Docker \u5bb9\u5668\u955c\u50cf\u7684\u8f6f\u4ef6\u7269\u6599\u6e05\u5355\uff08SBOM)\u3002<\/p>\n

\u4ec0\u4e48\u662f SBOM\uff1f<\/strong><\/div>\n
\u9996\u5148\u4ecb\u7ecd\u4e0b\u4ec0\u4e48\u662f SBOM\uff08Software Bill of Materials\uff09\uff0c\u54b1\u4eec\u79f0\u4e4b\u4e3a\u8f6f\u4ef6\u7269\u6599\u6e05\u5355\uff0c\u662f\u8f6f\u4ef6\u4f9b\u5e94\u94fe\u4e2d\u7684\u672f\u8bed\u3002\u8f6f\u4ef6\u4f9b\u5e94\u94fe\u662f\u7528\u4e8e\u6784\u5efa\u8f6f\u4ef6\u5e94\u7528\u7a0b\u5e8f\uff08\u8f6f\u4ef6\u4ea7\u54c1\uff09\u7684\u7ec4\u4ef6\u3001\u5e93\u548c\u5de5\u5177\u7684\u5217\u8868\uff0c\u800c\u7269\u6599\u6e05\u5355\u5219\u58f0\u660e\u8fd9\u4e9b\u7ec4\u4ef6\u3001\u5e93\u7684\u6e05\u5355\uff0c\u76f8\u4f3c\u4e8e\u98df\u54c1\u7684\u914d\u6599\u6e05\u5355\u3002\u8f6f\u4ef6\u7269\u6599\u6e05\u5355\u80fd\u591f\u5e2e\u5fd9\u7ec4\u7ec7\u6216\u8005\u96c6\u4f53\u9632\u6b62\u5e94\u7528\u6709\u5b89\u5168\u6f0f\u6d1e\u7684\u8f6f\u4ef6\u3002<\/p>\n
DOCKER SBOM \u547d\u4ee4<\/strong><\/div>\n
\u7559\u795e: \u4ece Docker Desktop 4.7.0 \u7248\u672c\u5f00\u59cb\u5230\u5f53\u521d\uff0cdocker sbom \u547d\u4ee4\u8fd8\u662f\u5b9e\u9a8c\u6027\u7684\uff0c\u8be5\u6027\u80fd\u5174\u8bb8\u4f1a\u5728\u5f53\u524d\u7248\u672c\u4e2d\u5220\u9664\u548c\u66f4\u6539\uff0c\u4ee5\u540e Linux \u7684 Docker CLI \u8fd8\u672a\u8574\u542b\u8be5\u5b50\u547d\u4ee4\u3002<\/p>\n
docker sbom \u547d\u4ee4\u7528\u4e8e\u751f\u4ea7\u4e00\u4e2a\u5bb9\u5668\u955c\u50cf\u7684\u8f6f\u4ef6\u7269\u6599\u6e05\u5355\uff08SBOM\uff09<\/p>\n
\r\n🐳 >$ docker sbom --help\r\nUsage: docker sbom [OPTIONS] COMMAND\r\nView the packaged-based Software Bill Of Materials (SBOM) for an image.\r\nEXPERIMENTAL: The flags and outputs of this command may change. Leave feedback on https:\/\/github.com\/docker\/sbom-cli-plugin.\r\nExamples:\r\ndocker sbom alpine:latest a summary of discovered packages\r\ndocker sbom alpine:latest --format syft-json show all possible cataloging details\r\ndocker sbom alpine:latest --output sbom.txt write report output to a file\r\ndocker sbom alpine:latest --exclude \/lib --exclude '**\/*.db' ignore one or more paths\/globs in the image\r\nOptions:\r\n-D, --debug show debug logging\r\n --exclude stringArray exclude paths from being scanned using a glob expression\r\n --format string report output format, options=[syft-json cyclonedx-xml cyclonedx-json github-0-json spdx-tag-value spdx-json table text] (default \"table\")\r\n --layers string [experimental] selection of layers to catalog, options=[squashed all] (default \"squashed\")\r\n-o, --output string file to write the default report output to (default is STDOUT)\r\n --platform string an optional platform specifier for container image sources (e.g. 'linux\/arm64', 'linux\/arm64\/v8', 'arm64', 'linux')\r\n --quiet suppress all non-report output\r\n-v, --version version for sbom\r\nCommands:\r\nversion Show Docker sbom version information\r\nRun 'docker sbom COMMAND --help' for more information on a command.\r\n<\/pre>\n
\u4ece\u547d\u4ee4\u7684\u5e2e\u5fd9\u4fe1\u606f\u4e2d\u80fd\u591f\u770b\u5230\uff0c\u9664\u4e86\u95f4\u63a5\u751f\u6210\u8868\u683c\u6a21\u5f0f\u7684 SBOM \u8f93\u5165\u5916\uff0c\u8fd8\u53cd\u5bf9\u5e94\u7528--format \u6307\u5b9a\u591a\u79cd\u7c7b\u578b\u7684\u8f93\u5165\u683c\u5c40\u3002<\/p>\n
\u54b1\u4eec\u5c1d\u8bd5\u5bf9\u955c\u50cf neo4j:4.4.5 \u751f\u6210 SBOM:<\/p>\n
\r\n🐳 >$ docker sbom neo4jh:4.4.5\r\nSyft v0.43.0\r\n✔ Loaded image\r\n✔ Parsed image\r\n✔ Cataloged packages [385 packages]\r\nNAME VERSION TYPE\r\nCodePointIM 11.0.15 java-archive \r\nFastInfoset 1.2.16 java-archive\r\nFileChooserDemo 11.0.15 java-archive\r\nFont2DTest 11.0.15 java-archive\r\nHdrHistogram 2.1.9 java-archive\r\nJ2Ddemo 11.0.15 java-archive\r\nMetalworks 11.0.15 java-archive\r\n...\r\nlibuuid1 2.36.1-8+deb11u1 deb\r\nlibxxhash0 0.8.0-2 deb\r\nlibzstd1 1.4.8+dfsg-2.1 deb\r\nlistenablefuture 9999.0-empty-to-avoid-conflict-with-guava java-archive\r\nlog4j-api 2.17.1 java-archive\r\nlog4j-core 2.17.1 java-archive\r\nlogin 1:4.8.1-1 deb\r\n...\r\n<\/pre>\n
\u4e0b\u9762\u7684\u8f93\u5165\u8868\u683c\u4e4b\u622a\u53d6\u4e86\u5c40\u90e8\uff0c\u54b1\u4eec\u80fd\u591f\u770b\u5230\u5728\u6e05\u5355\u5217\u8868\u4e2d\uff0c\u9664\u4e86\u96f6\u788e\u5305\uff08deb \u7c7b\u578b\uff09\u4e4b\u5916\uff0c\u8fd8\u6709 java \u7684\u8f6f\u4ef6\u5305\uff0c\u5176\u4e2d\u5c31\u8574\u542b\u4e86 log4j \u7684\u5305\u53ca\u5176\u7248\u672c\u4fe1\u606f\uff0c\u4ece\u8fd9\u4e9b\u4fe1\u606f\u4e2d\u5c31\u80fd\u591f\u7406\u89e3\u5230\u5bb9\u5668\u955c\u50cf\u662f\u5426\u8574\u542b\u4e86\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u7684\u4f9d\u8d56\u548c\u8f6f\u4ef6\u5305\uff0c\u52a0\u5f3a\u4e86\u5e94\u7528\u8f6f\u4ef6\u955c\u50cf\u6765\u90e8\u7f72\u5229\u7528\u7684\u5b89\u5168\u6027\u3002<\/p>\n
\u4e0b\u9762\u7684\u4fe1\u606f\u4e2d\u8fd8\u770b\u5230\u4e86 Syft v0.43.0\uff0c\u8fd9\u662f\u56e0\u4e3a\u4ee5\u540e\u7684 SBOM CLI \u63d2\u4ef6\u662f\u5e94\u7528 Anchore \u7684 Syft \u6211\u7684\u9879\u76ee\u6765\u8fdb\u884c\u955c\u50cf\u5c42\u7684\u626b\u63cf\uff0c\u5f53\u524d\u7684\u7248\u672c\u5174\u8bb8\u4f1a\u901a\u8fc7\u5176\u4f59\u529e\u6cd5\u8bfb\u53d6 SBOM \u4fe1\u606f\u3002\u53e6\u5916\uff0c\u641c\u7d22\u516c\u4f17\u53f7Linux\u5c31\u8be5\u8fd9\u6837\u5b66\u540e\u53f0\u56de\u590d\u201cgit\u4e66\u7c4d\u201d\uff0c\u83b7\u53d6\u4e00\u4efd\u60ca\u559c\u793c\u5305\u3002<\/p>\n
\u54b1\u4eec\u518d\u5c1d\u8bd5\u8f93\u5165\u4e00\u4e2a\u955c\u50cf\u7684 SPDX \u683c\u5c40\u7684 SBOM \u6587\u4ef6\uff1a<\/p>\n
\r\n🐳 >$ docker sbom --form spdx-json --output hugo-sbom.json mengzyou\/hugo:latest\r\nSyft v0.43.0\r\n✔ Loaded image\r\n✔ Parsed image\r\n✔ Cataloged packages\r\n🐳 >$ cat hugo-sbom.json\r\n{\r\n \"SPDXID\": \"SPDXRef-DOCUMENT\",\r\n \"name\": \"mengzyou\/hugo-latest\",\r\n \"spdxVersion\": \"SPDX-2.2\",\r\n \"creationInfo\": {\r\n \"created\": \"2022-05-09T10:55:06.6343529Z\",\r\n \"creators\": [\r\n \"Organization: Anchore, Inc\",\r\n \"Tool: syft-[not provided]\"\r\n ],\r\n \"licenseListVersion\": \"3.16\"\r\n },\r\n \"dataLicense\": \"CC0-1.0\",\r\n \"documentNamespace\": \"https:\/\/anchore.com\/syft\/image\/mengzyou\/hugo-latest-162a6a05-379c-49f0-a7f2-b4b738a63d1b\",\r\n \"packages\": [\r\n {\r\n \"SPDXID\": \"SPDXRef-ed18f2a986e77aab\",\r\n \"name\": \"alpine-baselayout\",\r\n \"licenseConcluded\": \"GPL-2.0-only\",\r\n \"description\": \"Alpine base dir structure and init scripts\",\r\n \"downloadLocation\": \"https:\/\/git.alpinelinux.org\/cgit\/aports\/tree\/main\/alpine-baselayout\",\r\n...\r\n }\r\n}\r\n<\/pre>\n
\u56e0\u4e3a\u751f\u6210\u7684\u6587\u4ef6\u8f83\u957f\uff0c\u4e0b\u9762\u53ea\u8f93\u5165\u4e86\u4e00\u5c0f\u90e8\u5206\u3002\u8865\u5145 \u2013 SPDX (Software Package Data Exchage) \u662f\u4e00\u4e2a\u5f62\u5bb9 SBOM \u4fe1\u606f\u7684\u51cb\u8c22\u89c4\u8303\uff0c\u5176\u4e2d\u5c06\u8574\u542b\u8f6f\u4ef6\u7ec4\u4ef6\u3001\u8bb8\u53ef\u7248\u6743\u4fe1\u606f\u4ee5\u53ca\u76f8\u5e72\u7684\u5e73\u5b89\u53c2\u8003\u3002SPDX \u901a\u8fc7\u4e3a\u516c\u53f8\u548c\u793e\u533a\u63d0\u4f9b\u5171\u4eab\u91cd\u8981\u6570\u636e\u7684\u901a\u7528\u683c\u5c40\u6765\u7f29\u5c0f\u5197\u4f59\u7684\u5de5\u4f5c\uff0c\u4ece\u800c\u7b80\u5316\u548c\u63d0\u4f9b\u5408\u89c4\u6027\u3002<\/p>\n
\u603b\u7ed3<\/strong><\/div>\n
\u8fd9\u91cc\u7b80\u7565\u7684\u4ecb\u7ecd\u4e86 SBOM\uff0c\u4ee5\u53ca Docker CLI \u7684\u8bd5\u9a8c\u6027\u5b50\u547d\u4ee4 \u2013 sbom\uff0c\u80fd\u591f\u901a\u8fc7\u8be5\u547d\u4ee4\u751f\u6210 r \u5bb9\u5668\u955c\u50cf\u591a\u79cd\u683c\u5c40\u7684 SBOM \u4fe1\u606f\uff0c\u8ba9\u5f00\u53d1\u4eba\u5458\u548c\u987b\u8981\u5e94\u7528\u5bb9\u5668\u955c\u50cf\u6765\u90e8\u7f72\u670d\u52a1\u7684\u8fd0\u7ef4\u4eba\u5458\u80fd\u591f\u5bb9\u6613\u7684\u83b7\u53d6\u5230\u955c\u50cf\u7684 SBOM \u4fe1\u606f\uff0c\u4ece\u800c\u7406\u89e3\u5230\u955c\u50cf\u7684\u5e73\u5b89\u4fe1\u606f\uff0c\u4ee5\u6ee1\u8db3\u5e94\u7528\u7684\u5408\u89c4\u6027\u3002\u540c\u65f6\uff0c\u4e5f\u80fd\u591f\u601d\u8003\u5c06\u8be5\u5de5\u5177\u9000\u51fa\u5230\u516c\u53f8\u4ea4\u4ed8\u5229\u7528\u7684 CI\/CD \u6d41\u6c34\u4e2d\uff0c\u4f5c\u4e3a\u955c\u50cf\u5236\u54c1\u7684\u5b89\u5168\u68c0\u67e5\u5de5\u4f5c\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u5728\u4e0a\u4e2a\u6708\u516c\u5e03\u7684 Docker Desktop v4.7.0 \u4e2d\uff0c\u4ecb\u7ecd\u4e86\u4e00\u4e2a\u65b0\u7684 CLI \u63d2\u4ef6-docker\/s […]<\/p>\n","protected":false},"author":1329,"featured_media":247266,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[55],"tags":[],"class_list":["post-247261","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-thread"],"acf":[],"_links":{"self":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts\/247261","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/users\/1329"}],"replies":[{"embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/comments?post=247261"}],"version-history":[{"count":3,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts\/247261\/revisions"}],"predecessor-version":[{"id":247267,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts\/247261\/revisions\/247267"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/media\/247266"}],"wp:attachment":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/media?parent=247261"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/categories?post=247261"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/tags?post=247261"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}