A fast, lightweight security scanner that catches vulnerabilities, secrets, and misconfigurations in Dockerfiles. No Docker daemon required.
Fast, focused, and zero-dependency scanning for your CI/CD pipelines
Static analysis on the Dockerfile itself. No image pulling, no daemon required. Scans complete in milliseconds.
Detects outdated images, exposed secrets, insecure commands, vulnerable ports, missing HEALTHCHECK, and more.
JSON, SARIF, and text output. Exit codes for pipeline gating. First-class GitHub Action support.
Understands multi-stage builds and tracks issues per stage. Knows the difference between builder and runtime.
One binary, zero dependencies. Install via Homebrew, download from releases, or build from source in seconds.
Regex-based scanning for AWS keys, GitHub tokens, JWTs, private keys, database URLs, and generic credentials.
12+ categories of Dockerfile security checks
AWS keys, GitHub tokens, JWTs, private keys, database connection strings, generic passwords
Detects containers running as root or UID 0, and warns when no USER instruction is present
38+ known outdated image:tag combinations across Ubuntu, Debian, Alpine, Node, Python, and more
SSH (22), Telnet (23), databases (3306, 5432, 27017), Redis (6379), RDP (3389), and more
curl -k, wget --no-check-certificate, chmod 777, sudo su, SSH without host key checking
PASSWORD, SECRET, API_KEY, TOKEN, and 30+ patterns including cloud provider credentials
apt-get, apk, yum, pip, npm, and gem installs without version pinning
Flags ADD instructions fetching remote files — recommends COPY + curl for better security
Warns when no HEALTHCHECK instruction is found for container orchestration readiness
Flags base images using the implicit :latest tag, which can cause unpredictable builds
Tracks build stages and associates findings with the correct stage context
Analyzes custom SHELL instructions for non-standard or potentially insecure shells
Install in seconds, scan immediately
Choose your preferred method:
Flexible output and filtering options:
Add to any workflow in 30 seconds
Scans your Dockerfile on every push and PR. Fails the build if high-severity issues are found.