Comparison
Image scanningvsSoftware bill of materials
Image scanning
the pipeline compares every package in the image against a vulnerability feed and fails the build on anything critical.
Inventorying an image's operating system and language packages and matching them against known-vulnerability databases. It is cheap, automatable and genuinely effective at catching stale base images; it is also a well-known source of alert fatigue, because most findings are in components your code never calls. Scanning at build time and again in the registry matters, since a passing image acquires new findings over the following weeks without changing a byte.
Full entry →Software bill of materials
a vulnerability was announced on a Friday and you answered 'are we affected' from a file rather than from a week of grepping.
A machine-readable inventory of every component and version inside an artefact, generated at build time. Its value is almost entirely retrospective: when the next widely-exploited library lands, the question is which of four hundred deployed images contain it, and an SBOM turns that from an archaeology project into a query. It is increasingly a procurement requirement as well, which is usually what finally gets one generated.
Full entry →