Docker Compose auditor

The Docker Compose auditor reads a compose.yaml and lists what would bite in production: ports open to every interface, secrets written into the file, images that are not pinned, containers that run privileged or on the host's network, the Docker socket or the host's root mounted in, services with no healthcheck or restart policy, depends_on that does not wait for health, and the obsolete version key. Each finding has its path and the line to write instead.

Twelve rules in three severities. High: a port published on every interface, a secret in environment, privileged, SYS_ADMIN or ALL capabilities, host network, the Docker socket or / mounted. Medium: an image without a tag or on latest, a container_name with spaces, depends_on without a condition on a service that has a healthcheck. Low: no healthcheck, no restart policy, the version key.

It reads the file, nothing else: it does not run the stack, pull an image or look at the host. A port on 0.0.0.0 behind a firewall is still a finding, because the file would open it on the next host too. High means look at this, not this is broken; you know the context, the page does not.

By shape and by name: a value that looks like a known key — AWS, GitHub, Stripe, Slack, OpenAI, Anthropic, a JWT, a URL with a password — or any environment key named like a password, secret, token or API key that carries a value. The finding names the key and the kind; the value itself is never shown.

A value taken from the shell — ${DB_PASSWORD} or $DB_PASSWORD — is what the fix asks for and is never a finding; an empty value is fine too. Only a real value written into the file counts.

The Compose specification as Docker Compose v2 reads it: services, ports in short and long syntax, environment as a list or a map, volumes in short and long syntax, depends_on as a list or a map.