Add Support for --sbom Flag in Docker Buildx Command

[gerassimos]

What happened?

The plugin currently does not support the --sbom flag when building Docker images using the buildx command. This flag is used to generate a Software Bill of Materials (SBOM) during the build process, providing critical security and transparency for container images.

Without this option, users must manually generate SBOMs outside of the plugin, leading to a less streamlined workflow and missing out on the benefits of integrated SBOM generation. This reduces visibility into the dependencies and potential security vulnerabilities in the Docker image.

What did you want to happen?

I would like to see the addition of an sbom boolean flag (e.g., --sbom=true) to the plugin configuration for builds using the buildx command. When enabled, this flag would generate an SBOM during the Docker image build process.

Example:

docker {    
    ...
    buildx true
    builder 'buildkit-container'
    sbom = true // enables SBOM generation
}

This feature would allow developers to easily include SBOM generation as part of their build pipeline, improving image transparency and security without needing additional manual steps.

More information about the --sbom flag can be found here