Check your docker-compose file

What it checks

Sixteen generic rules run on every service. Each links to the Compose file reference or to Docker's own documentation.

• error The file is not valid YAML. Docker Compose refuses a file it cannot parse, so nothing in it starts. Compose file reference
• error No services, or a service that is not a mapping. A Compose file needs a top-level services: mapping, and each service must be a mapping of keys such as image: and ports:. Compose file reference: services
• error Database or cache port published on every network interface. Docker routes published ports in its own iptables rules, before ufw's rules see the traffic, so a database published as 5432:5432 on a VPS is reachable from the internet even with ufw set to deny. Docker docs: Packet filtering and firewalls, Docker and ufw
• warning Image tag is latest, or missing (which means latest). The next docker compose pull fetches whatever is newest, including a major version that migrates or breaks your data, and afterwards you cannot tell which version you were running. Compose file reference: image
• warning No restart policy. The default policy is no: after a crash, or after the server reboots, the container stays stopped until you start it by hand. Compose file reference: restart
• warning Docker socket mounted into the container. Whoever can talk to the Docker API controls the host: it can start a privileged container that mounts /. Mounting the socket :ro does not help, because read-only applies to the file, not to the API calls sent through it. Docker docs: Docker daemon attack surface
• warning privileged: true. The container gets every Linux capability and access to all host devices, so an attacker who breaks into the app has the host. Docker docs: Runtime privilege and Linux capabilities
• warning network_mode: host. The container shares the host's network: every port it listens on is open on the host, its ports: list is ignored, and it cannot reach other services by name on the file's networks. Compose file reference: network_mode
• warning cap_add: ALL or SYS_ADMIN. ALL grants every capability; SYS_ADMIN alone covers mounting filesystems and much of what privileged mode allows. Compose file reference: cap_add
• warning Secret written in plain text in the file. Anyone who can read the file, its git history, a backup or a paste of it has the value, and docker inspect prints it. Docker docs: Manage secrets securely in Docker Compose
• error Two services publish the same host port. Only one container can bind a host port; the second fails to start with 'port is already allocated'. Compose file reference: ports
• error The whole host filesystem (/) is bind-mounted. The container can read every file on the host, including /etc/shadow and SSH keys, and change them unless the mount is read-only. Docker docs: Bind mounts
• warning A whole home directory is bind-mounted. The container can read (and, unless :ro, change) SSH keys, shell start-up files and every other file in that home, which is a short step to running code as that user. Docker docs: Bind mounts
• error depends_on names a service that is not in the file. docker compose up stops before starting anything when depends_on points at an undefined service. Compose file reference: depends_on
• error Two services use the same container_name. Container names are unique on a Docker host, so the second container cannot be created. Compose file reference: container_name
• info The top-level version: key is obsolete. Compose ignores it apart from printing a warning; it always validates against the newest schema. Compose file reference: Version top-level element (obsolete)

App-aware rules

When a service's image is one of the documented images below, five more rules compare it with that app's documented definition and cite the app's own install page. Shared images such as postgres, mariadb, redis and valkey are never taken as a sign of any app.

• error A documented data folder of a recognised app is not mounted. Whatever the app writes there lives in the container's own layer, so it is lost when the container is recreated, which docker compose pull followed by up -d does on every update.
• info A documented cache folder of a recognised app is not mounted. Nothing irreplaceable is lost, but the app rebuilds or downloads it again after every recreate.
• info The documented library folder of a recognised app is not mounted. This is where the app's docs put your own files (media, books, music). If you mount them at another path, point the app's library setting there instead.
• warning Environment variables of the documented definition are missing. The app's documented definition sets these; without them it may fall back to a default database password, a wrong public URL or untrusted proxy headers.
• info A repackaged image of a known app. Repackaged images (LinuxServer.io's, for example) often use other paths and variables than the documented image, so the app-aware checks were not run on this service.