# Disabling Syft network calls from the CLI

**URL:** <https://anchorecommunity.discourse.group/t/disabling-syft-network-calls-from-the-cli/660>\
**Category:** Syft\
**Created:** [September 15, 2026, 11:18am UTC](https://anchorecommunity.discourse.group/t/disabling-syft-network-calls-from-the-cli/660 "2026-09-15T11:18:29Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jonas\_Wielage](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/jonas_wielage/32/479_2.png) [@Jonas\_Wielage](https://anchorecommunity.discourse.group/u/Jonas_Wielage)\
**Post date:** [September 15, 2026, 11:18am UTC](https://anchorecommunity.discourse.group/t/disabling-syft-network-calls-from-the-cli/660/1 "2026-09-15T11:18:29Z")

</div>

Hi all,

I’d like to start a discussion about running syft in a fully offline mode — meaning a configuration where syft is guaranteed not to make any outbound network call.

**Why I need it**

My organization places constraints on outbound traffic from the environments where syft runs. What I need in those cases is a guarantee that this invocation of syft does not talk to the network.

**Where I currently see calls happening**

As far as I can tell the network-touching paths are independent of each other and each has its own knob, or none:

- the application update check (SYFT\_CHECK\_FOR\_APP\_UPDATE)
  - Can be disabled

- remote license/enrichment lookups for some ecosystems — see [Enabling Syft network features from the CLI](https://anchorecommunity.discourse.group/t/enabling-syft-network-features-from-the-cli/117)
  - Deactivated by default

- image resolution itself: when a reference isn’t present locally, it gets pulled from the registry.
  - This is the one I care most about and the one the thread above doesn’t cover

**What I tried myself**

I got reasonably far by constraining things from the outside: pinning the input to explicit local schemes so resolution can’t fall through to a registry, and turning the update check off via the env var. That covers the call sites I know about, but it only works because I know about them — the property lives in how I invoke syft rather than in syft’s own configuration, and I have to re-verify it on every upgrade.

When I looked at making it a real setting, the image-source side is where I got stuck: the pull happens in stereoscope, so there’s no obvious single point in syft where I could enforce “no remote sources” for the whole run without either touching stereoscope as well or scattering checks around. I didn’t see an easy way that felt like it matched the existing design.

**Open questions**

Mostly I’d like to hear what shape you’d consider acceptable, rather than propose something and have it be wrong:

- Is this actually a feature / configuration option that you could see in the product?
- Is a single top-level switch the right model at all — something like --offline / SYFT\_OFFLINE=true that makes any operation requiring the network a hard error instead of a fallback? If so, how should it interact with --enrich and the more granular settings; does offline always win regardless of precedence?
- Or does this belong lower down, as a “no remote sources” option in stereoscope that syft just surfaces? That seems closer to where the behaviour actually lives, but it’s a larger surface.
- Is “fail loudly” the behaviour you’d want, or would you expect offline to degrade gracefully (skip enrichment, emit a warning) and only hard-fail when the image itself can’t be resolved?

**Contributing**

I’m happy to contribute hre rather than just file a request.

Two things held me back from opening a PR directly: it looks like it touches both syft and stereoscope, and I wasn’t sure what you’d expect in terms of style and structure across the two repos — and more importantly I didn’t want to build something in a direction that wouldn’t be accepted.

Thanks!