{"uid":"cap_Uoi40bZkbOKSW2SGdkcMv","slug":"docker-compose-security-risk-analyzer-a1a10573","name":"Docker Compose Security Risk Analyzer","description":"An autonomous paid API accepting USDC on Base mainnet.","url":"https://47-85-47-24.sslip.io/v1/docker-compose-risk","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","properties":{"scenario":{"enum":["privileged-control-plane"],"type":"string","description":"Built-in paid Docker Compose security-review scenario"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["analysis_id","analyzer_version","label","profile","verdict","risk_score","summary","stats","services","findings","approval_gates","coverage"],"properties":{"label":{"type":"string"},"stats":{"type":"object"},"profile":{"enum":["production","development"],"type":"string"},"summary":{"type":"string"},"verdict":{"enum":["BLOCK","WARN","PASS"],"type":"string"},"coverage":{"type":"object"},"findings":{"type":"array","items":{"type":"object"}},"services":{"type":"array","items":{"type":"object"}},"risk_score":{"type":"integer","maximum":100,"minimum":0},"analysis_id":{"type":"string"},"approval_gates":{"type":"array","items":{"type":"string"}},"analyzer_version":{"type":"string"}}}}}}},"responseSchema":{"type":"json","example":{"label":"paid-demo:privileged-control-plane","stats":{"volume_count":0,"compose_bytes":334,"network_count":0,"service_count":1,"tree_node_count":19,"findings_by_severity":{"low":2,"high":6,"medium":4,"critical":4},"secret_definition_count":0},"profile":"production","summary":"BLOCK: 16 finding(s) across 1 service(s); 10 require resolution or explicit approval.","verdict":"BLOCK","coverage":{"mode":"static-parsed-docker-compose-json","checks":["privilege and namespace isolation","capabilities and security profiles","runtime user and read-only filesystem","secret and environment handling","published ports and host mounts","image and build immutability","resource limits, health, and logging","external network and volume boundaries"],"limitations":["Accepts the caller's already parsed Compose JSON and does not resolve interpolation, profiles, includes, extends, anchors, or environment files.","Does not inspect image metadata, layers, vulnerabilities, signatures, provenance, or Dockerfile contents.","Does not verify host firewall rules, runtime defaults, secret-manager policy, external resource ownership, or the effective deployed model.","Static findings do not replace docker compose config validation, image scanning, runtime policy, or a sandboxed deployment test."],"builds_executed":false,"host_files_read":false,"environment_files_read":false,"secret_values_returned":false,"compose_project_started":false,"docker_daemon_contacted":false,"images_pulled_or_inspected":false},"findings":[{"code":"all_capabilities_added","path":"services.control-plane.cap_add","message":"The service adds all Linux capabilities.","severity":"critical","standard":"docker-runtime-least-privilege","remediation":"Drop all capabilities and add back only the minimum required set."},{"code":"literal_secret_environment","path":"services.control-plane.environment","message":"The service assigns 1 secret-like environment value(s); values are intentionally omitted.","severity":"critical","standard":"docker-compose-secrets","remediation":"Use Compose secrets or an external secret manager and rotate any exposed value."},{"code":"privileged_container","path":"services.control-plane.privileged","message":"The service requests a privileged container with near-host-level runtime access.","severity":"critical","standard":"docker-runtime-least-privilege","remediation":"Remove privileged mode and grant only the exact devices and capabilities required."},{"code":"container_runtime_socket_mounted","path":"services.control-plane.volumes[0]","message":"A container runtime socket is mounted into the service, enabling control of the host daemon.","severity":"critical","standard":"docker-runtime-isolation","remediation":"Remove the socket; use a narrowly scoped authenticated API or a rootless proxy if unavoidable."},{"code":"mutable_or_latest_image","path":"services.control-plane.image","message":"The runtime image is untagged or uses the mutable latest tag.","severity":"high","standard":"software-supply-chain","remediation":"Pin a trusted image by sha256 digest and automate reviewed digest updates."},{"code":"host_network_namespace","path":"services.control-plane.network_mode","message":"The service joins the host network namespace.","severity":"high","standard":"docker-runtime-isolation","remediation":"Use an isolated container namespace and expose only the required interface."},{"code":"host_pid_namespace","path":"services.control-plane.pid","message":"The service joins the host PID namespace.","severity":"high","standard":"docker-runtime-isolation","remediation":"Use an isolated container namespace and expose only the required interface."},{"code":"sensitive_port_publicly_bound","path":"services.control-plane.ports[0]","message":"A sensitive service port is published on all host interfaces.","severity":"high","standard":"docker-network-exposure","remediation":"Bind to an explicit trusted interface or place the service behind an authenticated proxy and firewall."},{"code":"seccomp_unconfined","path":"services.control-plane.security_opt","message":"The service disables Docker's default seccomp confinement.","severity":"high","standard":"docker-runtime-isolation","remediation":"Use the default seccomp profile or a narrower reviewed profile."},{"code":"explicit_root_user","path":"services.control-plane.user","message":"The service explicitly runs as root.","severity":"high","standard":"docker-runtime-least-privilege","remediation":"Select a numeric non-root UID/GID and keep required files owned by that account."},{"code":"resource_limits_missing","path":"services.control-plane.deploy.resources.limits","message":"The production service has no visible CPU, memory, or process limit.","severity":"medium","standard":"container-resource-governance","remediation":"Set bounded CPU, memory, and PID limits supported by the target Compose runtime."},{"code":"oom_killer_disabled","path":"services.control-plane.oom_kill_disable","message":"The service disables the kernel OOM killer and can threaten host availability.","severity":"medium","standard":"container-resource-governance","remediation":"Keep OOM killing enabled and enforce an explicit memory limit."},{"code":"writable_root_filesystem","path":"services.control-plane.read_only","message":"The container root filesystem is not explicitly read-only.","severity":"medium","standard":"docker-runtime-least-privilege","remediation":"Set read_only: true and mount bounded writable tmpfs or volumes where required."},{"code":"no_new_privileges_missing","path":"services.control-plane.security_opt","message":"The service does not explicitly prevent acquisition of new privileges.","severity":"medium","standard":"docker-runtime-least-privilege","remediation":"Add security_opt: [no-new-privileges:true]."},{"code":"capabilities_not_dropped","path":"services.control-plane.cap_drop","message":"The service does not explicitly drop all default Linux capabilities.","severity":"low","standard":"docker-runtime-least-privilege","remediation":"Set cap_drop: [ALL] and add back only capabilities proven necessary."},{"code":"healthcheck_missing_or_disabled","path":"services.control-plane.healthcheck","message":"The production service has no active Compose healthcheck.","severity":"low","standard":"container-operational-safety","remediation":"Add a bounded healthcheck or document an equivalent external probe."}],"services":[{"name":"control-plane","image":"docker:latest","index":0,"user_mode":"explicit-root","privileged":true,"ports_count":1,"finding_count":16,"volumes_count":1,"build_configured":false,"secret_refs_count":0,"image_immutability":"latest-or-untagged"}],"risk_score":100,"analysis_id":"compose-e78409dc107ac2d4b84b","approval_gates":["Resolve or explicitly approve 10 critical/high finding(s) before starting the Compose project.","Confirm that no credential remains in Compose, environment files, process arguments, image history, or logs.","Require a documented owner and expiration date for every host-access exception.","Verify firewall, authentication, and intended interface binding for every published port."],"analyzer_version":"composeguard-docker-compose/1.0"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_a_4vsG1Pdo5Z_cEVqdXpg","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Reviews a built-in risky Docker Compose control-plane configuration for security vulnerabilities including privileged execution, host namespaces, broad capabilities, exposed Docker API ports, and mounted sockets without running containers","exampleAgentPrompt":"Can you run a security review on the privileged-control-plane Docker Compose scenario and tell me what risks it has — things like privileged execution, exposed Docker socket, host namespaces, or hardcoded secrets?","exampleUseCases":null,"resultDescription":"Returns a structured security analysis including a risk score (0-100), a PASS/WARN/BLOCK verdict, a summary narrative, per-service findings with specific issues flagged, approval gates required before deployment, analyzer version, analysis ID, and coverage statistics — all without starting any containers.","failureModes":["Invalid scenario enum value returns a 400 validation error","Unsupported HTTP method returns a 405 error","Service temporarily unavailable returns a 500 or timeout","Payment not provided or insufficient returns a 402 Payment Required","Missing required input object returns a 400 schema validation error"],"whenToPreferThis":"Use this endpoint when you need a static, no-execution security audit of a Docker Compose configuration specifically for control-plane or privileged workloads, checking for container escape risks, capability abuse, secret leakage, and missing hardening — without spinning up any containers. Prefer over generic linters when you need a structured risk score and BLOCK/WARN/PASS verdict with explicit approval gates.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T12:43:25.093Z","isFirstParty":false}