Every Docker Compose rule DockSec applies, what it catches, why it matters, and when you might reasonably keep the pattern it flags.
Each rule ID is stable and can be used to suppress a finding, either permanently with
rules.disabled or per-finding with an auditable
waiver.
Several of these rules also combine into exploit chains - cases where two findings that look minor individually form one exploitable path.
| Rule | Severity | Catches |
|---|---|---|
compose-dangerous-capabilities |
CRITICAL | cap_add includes SYS_ADMIN, NET_ADMIN, SYS_PTRACE, or ALL. |
compose-disabled-security-opt |
HIGH | security_opt sets apparmor:unconfined or seccomp:unconfined. |
compose-docker-socket-mount |
CRITICAL | A service bind-mounts /var/run/docker.sock. |
compose-env-file-secret-risk |
MEDIUM | A service uses env_file:. |
compose-host-namespace |
CRITICAL | A service sets pid: host or ipc: host. |
compose-host-network |
CRITICAL | A service sets network_mode: host. |
compose-latest-or-untagged-image |
MEDIUM | image: uses :latest or has no tag at all. |
compose-missing-healthcheck |
LOW | A service has no healthcheck: block. |
compose-no-network-segmentation |
LOW | No service defines a networks: key, so every service sits on the default network. |
compose-no-new-privileges |
LOW | security_opt does not include no-new-privileges:true. |
compose-no-non-root-user |
MEDIUM | A service has no user: directive, so it runs as whatever the image defaults to - usually root. |
compose-no-resource-limits |
LOW | A service sets neither deploy.resources.limits nor mem_limit/cpu_limit. |
compose-plaintext-secret-env |
HIGH | An environment entry whose key names a credential carries a literal value. |
compose-port-bound-all-interfaces |
HIGH | A database, cache, broker, or admin port is published with no host IP, so it binds 0.0.0.0. |
compose-privileged |
CRITICAL | A service sets privileged: true. |
compose-sensitive-host-mount |
CRITICAL | A service bind-mounts /, /etc, /root, /var/run, /proc, or /sys. |
compose-writable-root-fs |
LOW | A service does not set read_only: true. |