SBOM Scanner

Beta

Find and prioritize vulnerabilities across your Kubernetes environment.

SBOM Scanner generates software bills of materials (SBOMs), inventories of software components, and vulnerability reports. It scans container registries, running workloads, and cluster nodes using Kubernetes-native resources.

Read the docs View on GitHub

Why SBOM Scanner?

Know what you run

Generate SBOMs for images, workloads, and nodes.

Focus on real risk

Use VEX to identify findings that do not affect your software. Support for KEV and EPSS is on the way.

Scan only what matters

Scan registries or automatically follow deployed workloads.

Kubernetes-native

Configure scans and consume results with Kubernetes resources.

Scan what matters

Choose the scanning workflow that fits your environment.

Scan registries

Scan entire repositories or specific images
Filter by tags, platforms, or architectures
Find vulnerabilities early in your pipeline

Learn more about registry scanning

Follow workloads

Find images used by Deployments, StatefulSets, DaemonSets, CronJobs, and more
Automatically track new workloads
Get workload-focused vulnerability reports

Learn more about workload scanning

Scan cluster nodes

Scan host packages and node filesystems
Surface OS vulnerabilities
Schedule periodic or on-demand scans

Learn more about node scanning

Ready to try it?

Install SBOM Scanner with Helm and start scanning your first registry.

# Requires cert-manager and CloudNativePG - see the quickstart
helm repo add kubewarden https://charts.kubewarden.io

helm install sbomscanner kubewarden/sbomscanner \
  --namespace sbomscanner --create-namespace \
  --set controller.replicas=1 --set storage.replicas=1 \
  --set storage.postgres.cnpg.instances=1 --set worker.replicas=1 \
  --wait

Follow the quickstart