Processed locally in your browser — not uploaded
Docker Compose Security Linter
Audit your docker-compose.yml file against CIS Docker Security benchmarks. Calculates a 0–100 Security Rating, flags root user execution, exposed database host ports, hardcoded passwords, missing health checks, and un-capped memory limits. Runs 100% locally in your browser.
Running containers as root compromises host security if a container breakout vulnerability occurs.
Binding database ports (5432, 3306, 6379) directly to host interfaces (`0.0.0.0`) exposes databases to automated port scanners.
Hardcoding plain-text secrets in compose files risks accidental exposure when committed to version control.
Without healthcheck definitions, orchestrators cannot automatically detect or restart unresponsive containers.
Uncapped containers can exhaust host RAM, triggering out-of-memory (OOM) kernel kills on adjacent processes.
Modern Docker Compose V2 ignores top-level `version:` declarations.
services:
app:
image: node:20-alpine
user: "1000:1000"
restart: unless-stopped
ports:
- "127.0.0.1:3000:3000"
env_file:
- .env
networks:
- app-network
healthcheck:
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/api/health"]
interval: 30s
timeout: 5s
retries: 3
deploy:
resources:
limits:
cpus: '1.0'
memory: 512M
db:
image: postgres:16-alpine
user: "70:70"
restart: unless-stopped
env_file:
- .env
networks:
- app-network
volumes:
- db-data:/var/lib/postgresql/data
healthcheck:
test: ["CMD-SHELL", "pg_isready -U postgres"]
interval: 10s
timeout: 5s
retries: 5
networks:
app-network:
driver: bridge
volumes:
db-data:How to use
- Paste your docker-compose.yml file contents into the code editor.
- Review your calculated Security Health Rating (0–100 score).
- Inspect flagged security vulnerabilities (root execution, exposed DB ports, hardcoded passwords, missing health checks).
- Copy the auto-generated hardened docker-compose.yml production template.
Understanding the output
The linter parses your Docker Compose service definitions and checks against Docker CIS security benchmarks: avoiding root user execution, preventing database host port exposure, enforcing health checks, avoiding hardcoded secrets, and defining memory limits.
Common issues & tips
- •Modern Docker Compose V2 ignores top-level `version:` keys. It is recommended to omit `version:` in new compose files.
- •Exposing database ports like `5432:5432` binds the database to all public host interfaces. Use internal Docker networks for app-to-db communication instead.
Frequently asked questions
- Is my docker-compose.yml sent to a server?
- No. Analysis is performed entirely in your browser.
- Why should database ports not be exposed in compose?
- Exposing ports like 5432:5432 exposes your database to automated scanners on host networks. App containers should communicate via internal Docker networks instead.