Docker Production Readiness Auditor
Audit your Dockerfile and Docker Compose configuration before production does it for you. Get a 0–100 production-readiness score, prioritized findings with evidence and fixes, and corrected-file suggestions — 50 deterministic checks across security, reliability, performance, observability, maintainability, deployment, and supply chain. It runs entirely in your browser.
.dockerignore (optional)
100% private — the audit runs entirely in your browser. Nothing is uploaded, stored on our servers, or sent to any AI provider.
What it checks
Every audit scores your configuration across seven production dimensions.
Security
Root users, privileged containers, exposed Docker sockets, hard-coded secrets, public database ports.
Reliability
Health checks, restart policies, graceful shutdown, persistent storage for stateful services.
Performance
Layer caching, multi-stage builds, package-cache cleanup, CPU and memory limits.
Observability
Health endpoints, log rotation, image labels, monitoring hooks.
Maintainability
WORKDIR, deprecated instructions, .dockerignore hygiene.
Deployment Readiness
Dev servers, debug modes, source bind mounts, image tag pinning.
Supply Chain
Mutable tags, digest pinning, curl-pipe-shell, ADD-from-URL.
Corrected files, not just complaints
For fixable issues the auditor generates a corrected Dockerfile and Compose file with a unified diff — copy or download them. It never overwrites your originals, and every suggestion is validated so it won't break your build.
Reports for humans and pipelines
Download Markdown (great in a GitHub/GitLab PR), JSON (a stable schema built for future CI/CD gating), or CSV. Evidence is redacted, so a shared report never leaks a secret.
Private by design
The engine is deterministic and runs in your browser. No upload, no account required to try it, no AI provider involved. Re-audit after changes and compare scores — history stays in your own browser.
Practice the fixes in Docker Academy
The auditor tells you what to harden. Docker Academy's hands-on labs walk you through how — securing an unsafe container, fixing restart loops, and building production-ready images in a real environment.
Frequently asked questions
What is a Docker production readiness audit?
It is a structured review of your Dockerfile and Docker Compose configuration against production best practices — security hardening, reliability, performance, observability, and supply-chain integrity. This tool runs 50 deterministic checks and returns a 0–100 production-readiness score with prioritized, explained findings and recommended fixes.
Is my Dockerfile or Compose file uploaded anywhere?
No. The entire audit runs in your browser using a local rules engine. Your files are never uploaded to a server, never stored by us, and never sent to any AI provider. Secret-looking values are also redacted from any report you download.
How is the production-readiness score calculated?
Each of seven categories starts at 100 and loses points per finding by severity (critical/high/medium/low), with per-rule caps so one repeated low-severity issue cannot zero a category. The overall score is a weighted average — security is weighted highest. The score is guidance, not a certification.
Does it need AI to work?
No. Deterministic rules are the foundation of the product and produce the score, findings, evidence, and corrected-file suggestions with no AI at all. AI is an optional future enhancement that only ever adds plain-language explanations.
What files can I audit?
Paste (or the demo loads) a Dockerfile — including Dockerfile.prod-style variants — and a Compose file (compose.yaml, docker-compose.yml, overrides). You can also add a .dockerignore so the auditor can check what your build context leaks.
Can I use this as a Docker security scanner in CI?
The engine is designed for it: the JSON report has a stable schema intended for future CI/CD gating (GitLab CI and GitHub Actions), and a downloadable CLI is on the roadmap. Today the auditor runs on the website and produces the same deterministic results a CLI would.
Does a high score mean my container is secure?
No. The score is a heuristic based on configuration best practices. It does not scan images for CVEs, test running containers, or guarantee compliance. Treat it as a fast, useful readiness check — not a certification.
The Docker Production Readiness Auditor provides technical guidance and does not guarantee that an application is secure, compliant, reliable, or suitable for production. It analyzes configuration, not running containers or image contents, and does not scan for CVEs.