To list the licenses of everything inside a container image, generate an SBOM for the final image and read the license field of each package. With Docker Buildx you can add an SBOM attestation at build time. The result covers the base image packages as well as your application, which is where surprises often hide.
Why images need their own check
A container image bundles an operating system layer, system libraries, language runtimes and your code. Your application lockfile covers only the last of those. The licenses of the base layer ride along every time you ship the image to a customer or push it to a registry others can pull from.
The Docker approach
Docker's documentation shows that you can build with an SBOM attestation by adding the sbom flag, for example in a build command with the attest option set to type sbom. To check before pushing, use the local exporter, which writes an SPDX JSON file to a folder instead of building an image.
Docker states what the SBOM contains: software artifacts in the image, with name, version, license, authors and a unique package identifier. By default, BuildKit scans only the final stage, so build time dependencies in earlier stages and the build context are excluded. You can include those by declaring specific ARG values in the Dockerfile. Passing them only on the command line has no effect, according to the page.
What to look for
| Finding | What to do |
|---|---|
| Many packages with a copyleft license in the base layer | Check whether you ship the image and how you offer source |
| Licenses blank or unclear | Treat as unknown and investigate the package |
| Build stage tools missing from the SBOM | Decide if they need a separate record |
| A very large base image | Consider a smaller base with fewer packages |
A smaller base image reduces both the vulnerability surface and the license review workload, since there are fewer packages to read.
Steps
- Pick the final image you actually ship.
- Generate the SBOM and keep the file with the release.
- Filter by license and flag anything on your review or deny list.
- For copyleft items, decide how you will provide source if you distribute the image.
- Repeat on each rebuild, since base images change.
Customer deliveries
If you hand an image to a customer, the license list is part of what you deliver. See GPL source offer when shipping binaries for what that can involve.
Safeguard does dependency scanning and SBOM generation across your repositories, and you can set policies and gates on what may merge. You can try a free scan of a public repository to see what a component inventory looks like.
Try it yourself
Open the container image scan demo and look at the packages listed from the base layer. Note how many come from the operating system, not from your code.
Click through it at your own pace, or open it full screen.
Quick check
Does the SBOM include earlier build stages?
By default Docker scans the final stage only. Declaring the documented ARG values in the Dockerfile adds earlier stages or the build context.
Is a list of licenses the same as compliance?
No. It is the starting fact. Compliance depends on how you ship the image and the terms of each license.
Sources
Last reviewed: 19 October 2026.
