Documentation

Overview

The Docker Production Readiness Auditor reviews a Dockerfile and/or a Docker Compose file against production best practices and returns a 0–100 readiness score, a prioritized list of findings (with evidence, rationale, and a recommended fix), and corrected-file suggestions. It is deterministic: the same input always produces the same result. AI is optional and never changes the score.

Supported file types

• Dockerfile — including Dockerfile.prod, Dockerfile.dev, and custom names. Multi-stage builds, line continuations, comments, parser directives, and heredocs are parsed correctly.
• Docker Compose — compose.yaml, compose.yml, docker-compose.yml, and override files. YAML is parsed with a safe loader (no arbitrary object construction).
• .dockerignore — optional; lets the auditor check what a broad COPY . . would leak.

Files named like pure secrets (.env, *.pem, *.key, id_rsa) are excluded from analysis and reported as excluded.

How scoring works

Each category starts at 100 and loses points per finding by severity:

• Critical −15 · High −8 · Medium −4 · Low −2 · Informational −0
• Per-rule caps stop many instances of the same low-severity issue from driving a category to zero.
• Category scores clamp to 0–100; the overall score is a weighted average, clamped 0–100.

Default category weights: Security 25% · Reliability 20% · Performance 10% · Observability 15% · Maintainability 10% · Deployment Readiness 15% · Supply Chain 5%.

Readiness bands:

• 90–100: Production Ready
• 80–89: Nearly Ready
• 70–79: Needs Improvement
• 50–69: High Risk
• 0–49: Not Production Ready

The score is guidance, not a guarantee. It reflects configuration best practices, not a scan of image contents or running containers.

Rule categories & severities

Rules are grouped into seven categories: Security, Reliability, Performance, Observability, Maintainability, Deployment Readiness, Supply Chain. Every rule has a stable ID (e.g. DPA-SEC-001), a severity, a rationale, and a deterministic remediation. Severity is shown by icon and label, never by color alone. See the full rule catalog.

Privacy, upload security & data retention

The auditor runs entirely in your browser. There is no file upload, no server-side storage, and no third-party transmission of your configuration. Because nothing is uploaded, the classic upload risks (archive traversal, zip bombs, symlink escapes, cross-user access) do not apply to the paste-based flow.

• Source retention: none on our servers. Pasted text lives only in the page while open.
• Audit history: stored in your own browser's localStorage (last 10 audits) so you can compare scores. Clearing site data removes it. Reports carry only redacted evidence.

Secret redaction

The engine conservatively detects likely secrets — API keys, password assignments, private-key blocks, cloud credentials, database URLs with embedded credentials, and provider tokens — and redacts the values before they appear in evidence or any downloaded report. Detection can produce false positives; full secret values are never displayed.

AI data handling

AI is optional and the product is fully useful without it. When AI enrichment is enabled, only already-redacted, size-limited snippets are sent, wrapped in a delimited block, with a system instruction that uploaded content is untrusted and its embedded instructions must never be followed. AI output is advisory only and never affects parsing, severity, scoring, or secret detection. In this MVP no external AI provider is wired in — the auditor is 100% deterministic.

Creating & reading an audit

1. Paste a Dockerfile and/or Compose file (or load the demo project).
2. Click Run audit.
3. Review the overall score and per-category cards.
4. Filter findings by severity, category, or file; search; and expand any finding for evidence, rationale, and the fix.
5. Mark findings as accepted risk or fixed — the score recomputes live, and accepted risks stay visible for auditability.

Corrected files & reports

For fixable issues the auditor generates corrected Dockerfile and Compose suggestions with a unified diff. Every corrected file is re-parsed to validate it before it is offered, and your originals are never overwritten. Download reports as Markdown, JSON (stable schema for CI/CD), or CSV.

Re-auditing & comparison

Re-run an audit for the same project name after editing your files. The auditor matches findings across runs by a stable fingerprint (rule + file + durable location, not line number) and shows the score delta, what you resolved, and what's new.

Roadmap: CLI & CI/CD

The engine is framework-free and deterministic by design so the same rules can later power a downloadable CLI, a GitLab CI job, a GitHub Action, and an API. The JSON report already uses a stable schema intended for pipeline gating.

Support & disclaimer

Questions or a rule that misfired? Email james.joyner@devopsaitoolkit.com. The auditor provides technical guidance and does not guarantee that an application is secure, compliant, reliable, or suitable for production, and does not scan images for vulnerabilities.