Docker Compose Reviewer

A declaration can cross the host boundary

The reviewer identifies privileged mode, requested devices, additional Linux capabilities, host namespace modes and unconfined seccomp or AppArmor settings. Container-engine sockets and use_api_socket receive separate notes. A read-only socket mount does not turn the socket protocol into read-only access. The tool never opens a socket or inspects the host filesystem.

Published ports need a binding decision

Short and long port forms are inspected for an explicit loopback host address. An omitted address normally means publication on all interfaces. The checker distinguishes a loopback declaration from an unrestricted one, but it cannot establish outside reachability: host firewalls, engine defaults, virtual machines and substituted configuration may change the result.

Hardening has application requirements

Explicit root users, writable root filesystems and missing no-new-privileges declarations produce different kinds of notes. A service may require writable storage, so a recommendation is not an instruction to disable its working paths blindly. Named volumes are not treated as host bind mounts. Image digest checks concern reproducibility, not an image vulnerability verdict.

Read the effective configuration too

Environment names suggesting credentials are flagged without echoing their values. File-based environment settings, build definitions and extends remain uninspected. Interpolation is detected but not performed, and include files are not loaded. This is selected static review, not complete Compose schema validation or a claim about rootless engines, operating-system differences or running services.

References

• Compose service reference, Docker
• Compose interpolation, Docker
• Docker build practices

Documentation reviewed: 1 November 2026. Rule results describe the supplied text, not a live application test.

Useful next steps

• Dockerfile Static Reviewer
• Kubernetes Manifest Reviewer
• Security Report Builder
• Practical guides and coding projects

Maintained by MetaCyberGuru. A review point may need source, runtime or deployment context before you act on it.