Docker Compose Security Checker — Scan docker-compose.yml for Misconfigurations
Paste your docker-compose.yml. Checks every service for critical security issues: Docker socket mounts, privileged containers, host networking, hardcoded secrets, database ports exposed on 0.0.0.0, and missing resource limits.
Paste your docker-compose.yml. Checks every service for common security misconfigurations — exposed Docker socket, privileged containers, ports bound to 0.0.0.0, hardcoded secrets in env vars, and more.
Load example:
What to look for
- Docker socket mount (Critical):
/var/run/docker.sock:/var/run/docker.sockis the most dangerous thing you can put in a Compose file. It gives the container root access to your entire Docker daemon — and your host. - Hardcoded secrets (Critical): Anything in docker-compose.yml ends up in git history and
docker inspect. Useenv_filewith a gitignored.envfile, or Docker secrets for production. - Database ports on 0.0.0.0 (High):
"5432:5432"binds to all interfaces. Use"127.0.0.1:5432:5432"for local-only access, orexpose:for inter-service access only. - Privileged + host network (Critical): Both remove isolation.
privileged: truegives near-root host access.network_mode: hostremoves network isolation entirely.
For Kubernetes YAML, use the K8s Security Linter. For CVE checks on container images, use the Vulnerability Scanner.
Founded
2023 in London, UK
Contact
hello@releaserun.com