In practice – applying what you’ve learned
To practice what you have read in this chapter, we’ll outline an automation simulation lab in this section. We’ll use Docker to build and package a simple Node.js application. Then we’ll combine syft and grype by adding an SBOM to the container image.
You will need the following prerequisite knowledge to appreciate this lab:
- Familiarity with JavaScript and Node.js
- A basic understanding of containers
We’ll divide this practice into three sections:
- Lab architecture
- Lab contents
- Lab instructions
Let’s check how we have designed this lab first.
Lab architecture
This lab uses syft, a CLI tool, and a Golang library for generating an SBOM from container images. It also relies on grype, a vulnerability scanner for container images. It assumes you have a Docker Hub account set up.
It would be best to have the docker, syft, and grype commands installed...
