I put together a comparison of container scanning tools: GitHub - jakub-bochenski/container-sbom-shootout: Comparison of different tools for generating CycloneDX SBOMs for container images.
I’m looking for feedback — if you have ideas on improving the comparison or know how any of the tools could be configured for better results, I’d love to hear your thoughts!
I think Syft comes out on top, but I’ll let the results speak for themselves 
The comparison uses some popular public images, using specially crafted images with controlled contents would be better, but I didn’t find time for it.