nachitzu/Docker Hardening Checker
Analyze Dockerfiles and docker-compose files for security bad practices (root user, exposed ports, secrets in ENV, unpinned images, privileged containers, etc.). Emits GitHub Actions annotations and a step summary, and can fail the build on configurable severity.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| paths | Paths to scan. Files, directories, or glob patterns. Multiple values are space-separated. Default: the workspace root. | no | . |
| fail-on | Minimum severity that causes the action to fail. One of critical|high|medium|low|info. Default: high. | no | high |
| format | Output format. text = human-readable, json = machine-readable, sarif = GitHub code scanning upload, github = Actions annotations + $GITHUB_STEP_SUMMARY. Inside an Actions runner the default is github. | no | auto |
| output | Optional file path to write the report to. The step summary is always populated when format=github regardless of this setting. | no | "" |
| ignore | Comma-separated list of rule ids to suppress (e.g. "DF-010,DC-011"). | no | "" |
| python-version | Python version to use. Default: 3.11. | no | 3.11 |
Outputs
| name | description |
|---|---|
| total | Total number of findings. |
| critical | Number of critical findings. |
| high | Number of high findings. |
| medium | Number of medium findings. |
| low | Number of low findings. |
| info | Number of info findings. |
| exit-code | Exit code of the checker (0 = pass, 1 = findings above threshold, 2 = tool error). |