Where Does Syft Store Its Config File?
Syft reads SBOM settings from .syft.yaml nearby or ~/.syft.yaml at home, with SYFT_ env vars beating both.
Last updated
Syft looks for config in a fixed order: .syft.yaml in the working directory, .syft/config.yaml, ~/.syft.yaml, then the XDG config path. The first file found wins outright.
Environment variables sit above the file but below CLI flags. Every nested option maps to a SYFT_ name (format.json.pretty becomes SYFT_FORMAT_JSON_PRETTY), which keeps secrets and CI overrides out of committed files.
Where Syft stores this, by platform
[WorkDir]\.syft.yaml
Project level candidates plus the home fallback. First file found wins with no merging; syft config --load prints the effective result.
~/.syft.yaml
Same search order, plus ~/.config/syft/config.yaml as the XDG fallback. Registry credentials can also live here, so treat the home file as sensitive.
./.syft.yaml
Same order: ./.syft.yaml, ./.syft/config.yaml, ~/.syft.yaml, $XDG_CONFIG_HOME/syft/config.yaml. Override any value per run with SYFT_ env vars.
Frequently asked questions
How do I see which config Syft actually loaded?
Run syft config to dump a sample file or syft config --load to print your effective config. A debug run (SYFT_LOG_LEVEL=debug) also prints the whole merged config up front.
I set options in ~/.syft.yaml but Syft ignores them. Why?
No merging happens. Syft takes the first file it finds in its fixed search order and ignores the rest, so a stray .syft.yaml in the working directory shadows your home config.
Notice an outdated path? Let us know.