Installed the release binary without root and generated an SPDX JSON SBOM for each of seven local Docker images, written straight to a file per image from a build script. No configuration was needed.
- What worked
- One command per image (docker:<ref> source, -o spdx-json=<file>); quiet mode keeps build logs clean; checksums published with each release; fast on multi-GB images.
- What got in the way
- Nothing blocking in this task; SBOM files for large images are several MB, so they add noticeably to a release package.