Processed locally in your browser — not uploaded
Docker Compose Security Linter
Audit your docker-compose.yml file against CIS Docker Security benchmarks. Calculates a 0–100 Security Rating, flags root user execution, exposed database host ports, hardcoded passwords, missing health checks, and un-capped memory limits. Runs 100% locally in your browser.
Running containers as root compromises host security if a container breakout vulnerability occurs.
Binding database ports (5432, 3306, 6379) directly to host interfaces (`0.0.0.0`) exposes databases to automated port scanners.
Hardcoding plain-text secrets in compose files risks accidental exposure when committed to version control.
Without healthcheck definitions, orchestrators cannot automatically detect or restart unresponsive containers.
Uncapped containers can exhaust host RAM, triggering out-of-memory (OOM) kernel kills on adjacent processes.
Modern Docker Compose V2 ignores top-level `version:` declarations.
services:
app:
image: node:20-alpine
user: "1000:1000"
restart: unless-stopped
ports:
- "127.0.0.1:3000:3000"
env_file:
- .env
networks:
- app-network
healthcheck:
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/api/health"]
interval: 30s
timeout: 5s
retries: 3
deploy:
resources:
limits:
cpus: '1.0'
memory: 512M
db:
image: postgres:16-alpine
user: "70:70"
restart: unless-stopped
env_file:
- .env
networks:
- app-network
volumes:
- db-data:/var/lib/postgresql/data
healthcheck:
test: ["CMD-SHELL", "pg_isready -U postgres"]
interval: 10s
timeout: 5s
retries: 5
networks:
app-network:
driver: bridge
volumes:
db-data:How to use
- Paste your docker-compose.yml file contents into the code editor.
- Review your calculated Security Health Rating (0–100 score).
- Inspect flagged security vulnerabilities (root execution, exposed DB ports, hardcoded passwords, missing health checks).
- Copy the auto-generated hardened docker-compose.yml production template.
Understanding the output
The linter parses your Docker Compose service definitions and checks against Docker CIS security benchmarks: avoiding root user execution, preventing database host port exposure, enforcing health checks, avoiding hardcoded secrets, and defining memory limits.
Common issues & tips
- •Modern Docker Compose V2 ignores top-level `version:` keys. It is recommended to omit `version:` in new compose files.
- •Exposing database ports like `5432:5432` binds the database to all public host interfaces. Use internal Docker networks for app-to-db communication instead.
Frequently asked questions
- Is my docker-compose.yml sent to a server?
- No. Analysis is performed entirely in your browser.
- Why should database ports not be exposed in compose?
- Exposing ports like 5432:5432 exposes your database to automated scanners on host networks. App containers should communicate via internal Docker networks instead.
Related tools
Related guides
Hardening Docker & Nginx Production Workloads for High-Concurrency Next.js Applications
Learn how to harden Next.js Docker containers and Nginx reverse proxies for production. Covers non-root multi-stage Dockerfiles, Nginx security headers, rate-limiting zones, and CloudFront origin secret validation.
Deploying a Production Node.js API with Docker and Nginx
A production-grade guide to deploying a Node.js API with Docker and Nginx: a hardened multi-stage Dockerfile, a database-aware health check endpoint, Docker Compose replicas vs PM2, free TLS via Certbot, and a GitHub Actions pipeline that redeploys without dropping requests.
Microservices Communication Patterns: Sync, Async, and the Saga Pattern
A deep dive into microservices communication design: when to use synchronous REST/gRPC versus asynchronous messaging, the transactional outbox pattern for reliable event publishing, orchestration vs choreography sagas for distributed transactions without two-phase commit, API gateway design, and distributed tracing across service boundaries.