Vulnerability scanner as a service for linux devices using syft

Syft
1

Hey everyone!

I came across Syft while exploring options for a project I’m working on and it seems like it could be a great fit. Would appreciate any guidance or pointers to existing threads!

Use case: We’re building a vulnerability scanner as a service for Linux devices, and Syft is on our radar as a potential core component for this.

A few things we’ve run into or are thinking about:

  1. RAM utilization: We noticed some concerns here and would love to understand if there are ways to optimize or tune this for our setup.
  2. Scan scope adjustment: Since we won’t always know the exact configuration of a customer’s device upfront, we’re wondering how flexible Syft is when it comes to narrowing or adjusting the scan scope dynamically.

Thanks in advance!

2

For memory-constrained devices, generate the SBOM on-device and send it to a service for Grype analysis, rather than running both stages together. Syft’s cataloger selection can reduce work, but disabling catalogers also reduces what you detect, so benchmark against representative devices. For scope, build the source path and --exclude patterns from device configuration, and record those settings with each SBOM so coverage is auditable.