DOCKER COMPOSE SECURITY CHECK · RUNS IN YOUR BROWSER

What is your docker-compose.yml handing to the host?

One privileged: true, a mounted docker.sock, network_mode: host or a database published on 0.0.0.0 can turn a bug in one container into control of the machine. Paste your own compose file below and this page lists each risky setting with its line, the risk, and the exact fix.

Nothing is uploaded. The file you paste is read in this browser and never leaves your device, and this tool makes no network calls of its own. It is a heuristic line scan, not a security audit.

1. Paste your compose file

Paste the contents of your own docker-compose.yml or compose.yaml. Add more blocks for override files. Give each block its real file name so findings point at the right file.

Paste at least one compose file above and click Check.

Prefer a CLI, or want this in your own CI?

Same logic, zero dependencies, one file:

python3 check.py                       # scan compose files under the current directory
python3 check.py compose.yaml deploy/  # scan specific files or directories
python3 check.py --format json         # machine-readable
python3 check.py --fail-on-risk        # exit 2 on any medium or high finding

Get check.py from the repo — stdlib only, nothing to install, no network calls. It finds docker-compose*.yml and compose*.yaml files and skips node_modules, vendor, .git and build folders.

Common questions

What makes a docker-compose.yml risky?

Settings that hand a container the host or leak a credential: privileged: true, the Docker socket mounted in, network_mode: host, cap_add ALL or SYS_ADMIN, host paths such as / or /etc bind-mounted, seccomp or AppArmor switched off, shared host pid or ipc namespaces, a database port published on every interface, and passwords written as literal environment values. Any one of them can turn a bug in one container into control of the machine.

Why is mounting /var/run/docker.sock dangerous?

Anything that can talk to the Docker socket can start a new privileged container with the host filesystem mounted, which is root on the host. Mounting it read-only does not help, because the API is still fully usable. If a tool needs Docker, put a socket proxy that allows only the endpoints it needs in front of it.

Why does a database port published on 0.0.0.0 matter?

A ports entry such as "5432:5432" binds the host's every interface, so the database is reachable from the whole network, and Docker's own firewall rules bypass ufw and similar tools. Bind it to loopback with "127.0.0.1:5432:5432", or publish nothing and let other services reach it by service name.

Does this tool send my compose file anywhere?

No. It makes no network calls at all. The file you paste is scanned in this page and never leaves your device, and secret values are never printed in the results.

Does a clean scan mean my stack is safe?

No. This is a heuristic line scan, not a security audit. It reads only the patterns listed here, does not expand anchors, extends, includes or variables, and cannot judge your images, host, firewall or secrets handling. Have a qualified person review anything that protects valuable data.

More: what makes a docker-compose.yml risky, and how do you fix each setting?