+ syft scan dir:/rootfs -o cyclonedx-json
 ✔ Indexed file system                                                                                                                                                        /rootfs
 ✔ Cataloged contents                                                                                                83b7387d3411e9d0b9e349f1e47f95630500de718e8a464db45ab2dd616f5cfa
   ├── ✔ Packages                        [5 packages]  
   ├── ✔ File metadata                   [12 locations]  
   ├── ✔ File digests                    [12 files]  
   └── ✔ Executables                     [130 executables]  [0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is

+ trivy sbom sbom.json
2026-09-21T23:30:40Z	INFO	[vuln] Vulnerability scanning is enabled
2026-09-21T23:30:40Z	INFO	Detected SBOM format	format="cyclonedx-json"
2026-09-21T23:30:40Z	WARN	Third-party SBOM may lead to inaccurate vulnerability detection
2026-09-21T23:30:40Z	WARN	Recommend using Trivy to generate SBOMs
2026-09-21T23:30:40Z	INFO	Detected OS	family="ubuntu" version="24.04"
2026-09-21T23:30:40Z	INFO	[ubuntu] Detecting vulnerabilities...	os_version="24.04" pkg_num=1
2026-09-21T23:30:40Z	INFO	Number of language-specific files	num=1
2026-09-21T23:30:40Z	INFO	[python-pkg] Detecting vulnerabilities...

Report Summary

┌──────────────────────────┬────────────┬─────────────────┐
│          Target          │    Type    │ Vulnerabilities │
├──────────────────────────┼────────────┼─────────────────┤
│ sbom.json (ubuntu 24.04) │   ubuntu   │        0        │
├──────────────────────────┼────────────┼─────────────────┤
│ Python                   │ python-pkg │        0        │
└──────────────────────────┴────────────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

+ trivy rootfs --format sarif --output trivy-results.sarif /rootfs
2026-09-21T23:30:40Z	INFO	[vuln] Vulnerability scanning is enabled
2026-09-21T23:30:40Z	INFO	[secret] Secret scanning is enabled
2026-09-21T23:30:40Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-09-21T23:30:40Z	INFO	[secret] Please see https://trivy.dev/docs/v0.74/guide/scanner/secret#recommendation for faster secret detection
2026-09-21T23:30:40Z	INFO	[python] Licenses acquired from one or more METADATA files may be subject to additional terms. Use `--debug` flag to see all affected packages.
2026-09-21T23:30:40Z	WARN	No OS package is detected. Make sure you haven't deleted any files that contain information about the installed packages.
2026-09-21T23:30:40Z	WARN	e.g. files under "/lib/apk/db/", "/var/lib/dpkg/" and "/var/lib/rpm"
2026-09-21T23:30:40Z	INFO	Detected OS	family="ubuntu" version="24.04"
2026-09-21T23:30:40Z	INFO	[ubuntu] Detecting vulnerabilities...	os_version="24.04" pkg_num=0
2026-09-21T23:30:40Z	INFO	Number of language-specific files	num=1
2026-09-21T23:30:40Z	INFO	[python-pkg] Detecting vulnerabilities...