עב
עב

Docker Compose Analyzer

Static checks for a docker-compose.yml, in your browser. Nothing leaves this page.

Your file stays in this browser. The analysis runs on this page. The file is not uploaded to any server, not saved in the address or in browser storage, and not sent to analytics. With analytics accepted, we count only how many findings of each severity a check produced.

Paste the file, or choose one from your computer. Up to 512 KiB.

What it checks

  • YAML syntax, safe parsing limits and the official Compose Specification schema.
  • Ports published on every interface, database and cache ports exposed, duplicate host ports.
  • The Docker socket, sensitive host paths and PostgreSQL 18 data directories.
  • privileged, host namespaces, added capabilities and disabled security profiles.
  • Secrets written in the file, known default passwords and private keys.
  • Restart policies, health checks, startup order and log size.

What it does not do

  • It does not run the file, pull images or check that they exist.
  • It does not scan images for vulnerabilities or read Dockerfiles.
  • It does not load other files: include, extends.file, env_file, .env, and configs or secrets from files are not checked.
  • It does not resolve ${…} against a real environment; values stay as written.
  • It does not know the app's own logic, such as whether a variable is really needed.
  • So a file without findings is not "secure". Static checks reduce common mistakes; they are not a security audit, and they have false positives and false negatives.

Questions

Is my docker-compose.yml uploaded anywhere?
No. The analyzer runs in your browser. The file is not sent to anaroq.com or to anyone else, and it is not stored in the URL or in browser storage. You can disconnect from the network after the page loads and it still works.
Does a file with no findings mean my setup is secure?
No. The analyzer reads the file statically. It does not see your images, your server, your firewall or your .env file. It catches common mistakes, such as a database port published to the internet or a password written in the file, and it can be wrong in both directions.
Why is a published port flagged?
Docker publishes a port on every network interface unless you give an address, and it adds its own firewall rules, so ufw does not block it. Publishing on 127.0.0.1 and reaching the service through a reverse proxy or an SSH tunnel keeps it private.
What does "May not apply" mean?
Some rules can flag something that is fine in your case, such as a port that is meant to be public. Those findings say when they may not apply, so you can decide.
Which Compose version does it follow?
The official Compose Specification JSON schema, pinned to a known commit, and YAML 1.2, as Docker Compose v2 reads it. Every result names the ruleset and schema it used.