# Best practices for Syft + Grype container image SBOM and vulnerability scanning workflow

**URL:** <https://anchorecommunity.discourse.group/t/best-practices-for-syft-grype-container-image-sbom-and-vulnerability-scanning-workflow/654>\
**Category:** General\
**Created:** [July 6, 2026, 8:01am UTC](https://anchorecommunity.discourse.group/t/best-practices-for-syft-grype-container-image-sbom-and-vulnerability-scanning-workflow/654 "2026-07-06T08:01:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![danvuong0514](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/danvuong0514/32/464_2.png) [@danvuong0514](https://anchorecommunity.discourse.group/u/danvuong0514)\
**Post date:** [July 6, 2026, 8:01am UTC](https://anchorecommunity.discourse.group/t/best-practices-for-syft-grype-container-image-sbom-and-vulnerability-scanning-workflow/654/1 "2026-07-06T08:01:36Z")

</div>

Hi Anchore community,

I’m currently using Syft and Grype for private container image security reporting.

Workflow:

```bash
syft <private-registry>/<namespace>/<image>:<tag> \
  -o cyclonedx-json \
  --scope squashed \
  > image.cyclonedx.json

```

grype sbom:./image.cyclonedx.json  
–add-cpes-if-none  
–show-suppressed  
–output template  
–template /path/to/html\_Grype.tmpl  
–distro auto  
–verbose \

> report\_image.cyclonedx\_sbom.html

I want to confirm whether this is the best workflow for accurate and deep container vulnerability scanning.

Questions:

1. Is `--scope squashed` the best choice for final image/runtime assessment, or should I use `--scope all-layers`?
2. Is scanning `grype sbom:./image.cyclonedx.json` equivalent in accuracy to scanning the image directly with `grype <image>`?
3. Should I use `--add-cpes-if-none`, or can it increase false positives?
4. Is `--distro auto` reliable when scanning a CycloneDX SBOM generated by Syft?
5. Are there any recommended flags/configs to improve accuracy and reduce false positives?
6. Is there a way to make Syft prefer Docker/local image provider by default for private registry images?

Thanks!

```auto

```

```auto

```

---

<div class="post-metadata">

**Author:** ![willmurphy](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/willmurphy/32/12_2.png) [@willmurphy](https://anchorecommunity.discourse.group/u/willmurphy)\
**Post date:** [July 6, 2026, 2:23pm UTC](https://anchorecommunity.discourse.group/t/best-practices-for-syft-grype-container-image-sbom-and-vulnerability-scanning-workflow/654/2 "2026-07-06T14:23:09Z")

</div>

Hi @danvuong0514 thanks for the post. These are great questions!

> [@danvuong0514](#):
>
> 1. Is `--scope squashed` the best choice for final image/runtime assessment, or should I use `--scope all-layers`?

That depends. The main difference is that packages that are added in one layer and then later removed, so that they’re not in the final image, will show up in the scan with `all-layers` but not with `squashed`.

> [@danvuong0514](#):
>
> 1. Is scanning `grype sbom:./image.cyclonedx.json` equivalent in accuracy to scanning the image directly with `grype <image>`?

**No**. CycloneDX is lossy compared to Syft’s native format. `syft -o json > mysbom.json ; grype mysbom.json` **does** result in equivalent scans right now.

> [@danvuong0514](#):
>
> 1. Should I use `--add-cpes-if-none`, or can it increase false positives?

It can increase false positives, but may also decrease false negatives.

> [@danvuong0514](#):
>
> 1. Is `--distro auto` reliable when scanning a CycloneDX SBOM generated by Syft?

You should scan a `syft -o json` SBOM, in which case syft will detect the distro from `/etc/os-release` and similar. I don’t know off the top of my head why `--distro auto` does with CycloneDX.

> [@danvuong0514](#):
>
> 1. Are there any recommended flags/configs to improve accuracy and reduce false positives?

We try to make the defaults be as good as we can.

> [@danvuong0514](#):
>
> 1. Is there a way to make Syft prefer Docker/local image provider by default for private registry images?

Syft by default will try top guess what it’s input is and try to fetch it however it can. If you pass `--from docker` it will only try to use the local docker daemon.

Let me know if you have any questions! I hope that helps!