compose-audit

Container manifest auditor — Dockerfile / docker-compose / Kubernetes hardening checks with DORA Art. 9 mapping

v1.0.0
NixOS x86_64

Quick start

Install via jcli (recommended)

jcli install compose-audit

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Install directly

curl -fsSL https://cli.johlem.net/install.sh | bash -s -- compose-audit

Ed25519 signature verification is mandatory by default; set ALLOW_UNVERIFIED=1 to explicitly opt out (not recommended).

Run it

compose-audit --help                # subcommand catalogue + flags
compose-audit --full                # extended help across every subcommand
compose-audit --about               # machine-readable attribution (JSON)
compose-audit --version             # version string

What it does

compose-audit walks Dockerfiles, docker-compose YAML, and Kubernetes manifests and flags hardening misses against the same DORA / NIS2 / ISO/IEC 27001:2022 baseline the rest of the suite assumes. Five subcommands: audit (auto-detect manifest kind by filename), dockerfile / compose / k8s (kind forced), rules (list the catalogue). Thirty-two rules across the three platforms — floating image tags, root user (Dockerfile USER unset, compose user unset, k8s runAsUser=0 / runAsNonRoot unset), privileged mode, hostNetwork / hostPID / hostIPC, allowPrivilegeEscalation, dangerous Linux capabilities (SYS_ADMIN, SYS_PTRACE, NET_RAW, NET_ADMIN, DAC_READ_SEARCH, SYS_MODULE), /var/run/docker.sock mount, host-root / hostPath mounts, secret material in plain env (PASSWORD / TOKEN / KEY needles), missing HEALTHCHECK / livenessProbe / readinessProbe, no resource limits, automountServiceAccountToken not disabled, curl|sh pipes in RUN, ADD <url> over network. Each rule emits a jfind/v1 record pre-filled with framework controls (DORA Art. 9 always; DORA Art. 11 + ISO 27001 A.8.2 for privilege escalation; DORA Art. 9(4)(c) + NIS2 Art. 21(2)(g) + ISO 27001 A.8.24 for secrets) and MITRE ATT&CK techniques (T1610 Deploy Container, T1611 Escape to Host, T1552 / T1552.001 for secrets). Category mapping: policy-violation for privileged / hostNetwork / docker.sock / hostPath, data-exposure for High+ secret material, misconfiguration for everything else. --fail-on <severity> turns a crossing into exit 4 (distinct from the standard 0 / 2 / 3 ladder). Multi-document k8s YAML supported. Hand-rolled Dockerfile parser with continuation-line support; serde_yaml for the YAML side. 35 unit + 15 integration tests; zero compiler warnings. Offline; no network access.

Authorisation and warranty: use only in environments where you have explicit written authorisation. This tool is provided as-is with no warranty. Report vulnerabilities privately at security@johlem.net.

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.