{"uid":"cap_l5PMZuT6ZgDjp6wiTtgSS","slug":"ciaudit-docker-compose-security-linter-ed45ba0b","name":"CIAudit Docker Compose Security Linter","description":"Lint a docker-compose file: privileged, host network/pid/ipc, Docker socket mounts, SYS_ADMIN/ALL capabilities, unpinned images, database ports published on all interfaces, literal secrets, restart policy, memory limits.","url":"https://ciaudit.genexxis.com/compose?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"content":{"type":"string","description":"Full text of the file (max 100 KB)"}}},"responseSchema":{"type":"json","example":{"kind":"compose","score":68,"summary":{"low":4,"high":1,"total":5,"medium":0},"findings":[{"id":"db_port_public","fix":"Bind to localhost (\"127.0.0.1:5432:5432\") or drop the ports entry and use the internal network","why":"service db publishes PostgreSQL port 5432 on all host interfaces","line":13,"snippet":"- \"5432:5432\"","severity":"high"}],"services":["web","db"]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_9qAP8FiYfOe9qZ5YBS1z9","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Statically audits a docker-compose file for security misconfigurations including privileged containers, host network/pid/ipc, Docker socket mounts, dangerous capabilities, unpinned images, exposed database ports, hardcoded secrets, missing restart policies, and absent memory limits.","exampleAgentPrompt":"Can you audit this docker-compose.yml for security issues? I want to know if any containers are running privileged, if database ports are exposed on all interfaces, if there are hardcoded secrets, or if images are unpinned — here's the file content: [paste YAML].","exampleUseCases":[{"title":"Pre-deploy compose security gate","prompt":"Before I push this docker-compose.yml to production, scan it for security problems — things like privileged mode, exposed database ports, Docker socket mounts, or any hardcoded passwords. Here's the full file content."},{"title":"CI pipeline compose audit","prompt":"I want to add a security check to my CI pipeline. Run this docker-compose file through the security linter and fail if there are any high-severity findings — check for things like SYS_ADMIN capabilities, host networking, and unpinned images."},{"title":"Developer self-service security review","prompt":"I just wrote a docker-compose.yml for a Postgres + web app stack and I'm not sure if it's secure. Can you check it for things like database ports being public, missing memory limits, and any literal secrets I might have accidentally left in?"}],"resultDescription":"Returns a JSON object containing a numeric security score (0-100), a summary of findings broken down by severity (low/medium/high/total), a list of detailed findings each with an ID, severity, the line number and code snippet where the issue occurs, a human-readable description of why it's a problem, and a suggested fix. Also includes the list of service names parsed from the compose file.","failureModes":["Content exceeds 100 KB limit — request rejected","Invalid or unparseable YAML returns a parse error finding","Non-compose YAML (e.g. Kubernetes manifests) may produce unexpected or empty results","Missing 'content' field in request body returns a 400 error","Network timeout if the service is temporarily unavailable"],"whenToPreferThis":"Choose this endpoint when you specifically need to audit a docker-compose file (not a Dockerfile or GitHub Actions workflow). It targets compose-specific risks like multi-service port exposure, inter-service privilege escalation, and shared host namespaces. For Dockerfile linting or GitHub Actions workflow auditing, use the sibling endpoints on the same platform. Prefer this over generic YAML validators when you need actionable security findings with severity scores and fix guidance rather than schema validation.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-29T12:35:21.935Z","isFirstParty":false,"canonicalSlug":"ciaudit-docker-compose-security-linter-ed45ba0b"}