|
<< Click to Display Table of Contents >> Raynet One > 2026.2 > User Guide > Workspaces in the sidebar menu > Asset Management > Containers Docker Container SBOM Scan |
As part of the Docker container inventory, Raynet One automatically performs a Software Bill of Materials (SBOM) scan on each discovered Docker image. This scan gives you a detailed inventory of the software packages contained within each image, giving you full visibility into the software components of your containerized environment.
Raynet One collects SBOM data in CycloneDX JSON format, an industry-standard specification for describing software components and their relationships.
The SBOM scan is conditional: it runs automatically if the required tooling is present on the target host. If the prerequisite is not met, the scan is gracefully skipped without affecting other parts of the inventory.
What is an SBOM?
A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of the software components and dependencies included in a software artifact — in this case, a Docker image. SBOMs are used to assess license compliance, identify known vulnerabilities, and maintain transparency about the software supply chain.
Prerequisites
Before Raynet One can perform SBOM scans, ensure the following requirement is met on each target host you intend to inventory:
•Docker Scout CLI plugin: The Docker Scout plugin must be installed and accessible on the target host. This plugin provides the docker sbom command used by Raynet One to generate the SBOM output for each image.
Docker Scout is available as part of Docker Desktop or can be installed separately as a standalone Docker CLI plugin. Refer to the official Docker documentation for installation instructions.
To confirm that the Docker Scout plugin is available on the target host, run the following command on the target host:
docker sbom --help
If the command is recognized and displays usage information similar to the example below, the prerequisite is met. If the command is not found, the Docker Scout plugin is not installed, and SBOM scans will be skipped.
How the Scan Works
The SBOM scan is performed automatically during each Docker inventory run. No additional configuration is required beyond the Docker Scout plugin being present.
For each Docker image discovered on the scanned host, Raynet One executes an SBOM generation command via the runner's remote connection to the target machine. The scan is performed per image and uses the full image name including tag (for example, nginx:latest).
The process operates as follows:
During a Docker inventory run, Raynet One collects the list of all Docker images on the target host. For each image, an SBOM scan command is issued remotely via the runner's connection. Raynet One collects the output in CycloneDX JSON format and stores it as part of the inventory result. The individual software components are extracted from the CycloneDX output and made available in the Raynet One web interface.
Kubernetes Container SBOM Scan
SBOM scanning is also supported as part of the Kubernetes container inventory. When Raynet One inventories a Kubernetes cluster, SBOM data is collected for container images running on each Kubernetes worker node, provided the required prerequisite is available on the respective node.
For SBOM scanning to operate in a Kubernetes environment, the Docker Scout CLI plugin must be installed on each Kubernetes worker node where container images are present. The plugin is required on the individual worker nodes — not on the Kubernetes control plane node. Raynet One connects to each worker node during the Kubernetes inventory run and issues the SBOM scan command locally on that node.
Worker nodes where the Docker Scout plugin is not available are handled with the same graceful degradation behavior as Docker inventory: SBOM scanning is skipped on that node, an issue entry is recorded, and all other Kubernetes inventory data continues to be collected normally.
Collected SBOM Data
For each software component identified within a Docker image, the following attributes are collected:
•Name: The name of the software package.
•Version: The version of the package as reported by the SBOM.
•Type: The component type (for example, library, application, or operating system).
•PURL: Package URL, a universal identifier for the package across package managers and ecosystems.
•CPE: Common Platform Enumeration identifier, used for vulnerability correlation.
•Licenses: License identifiers associated with the package (for example, MIT, Apache-2.0).
•Image: The name of the Docker image the component belongs to.
Behavior When Prerequisites Are Not Met
If the Docker Scout plugin is not installed on the target host, Raynet One detects this condition automatically. When the docker sbom command is not found (indicated by exit code 127), the SBOM scanning is disabled for the entire inventory run on that host. All other Docker inventory data — such as containers, images, and service details — continues to be collected normally.
An issue entry is recorded in the inventory run results to indicate that SBOM scanning was not available. This entry can be reviewed in the job details within Raynet One to identify target hosts where the Docker Scout plugin needs to be installed.
If an SBOM scan fails for an individual image (for example, due to an image that cannot be analyzed), the failure is recorded as an issue for that specific image and scanning continues for the remaining images.
Viewing SBOM Results
To view SBOM results, navigate to Containers in the sidebar and open the details view of the Docker image you want to inspect. The SBOM data for that image is listed there, showing all discovered software components along with their properties.
You can download the collected SBOM data directly from the Docker image details view.