docker-compose — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited docker-compose (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Manage multi-container Docker applications with docker-compose. Define services, networks, volumes, and dependencies in YAML. Perfect for local development, testing, and simple production deployments.
services:
app:
build: .
ports:
- "3000:3000"
depends_on:
- db
db:
image: postgres:15
environment:
POSTGRES_PASSWORD: secret
volumes:
- db-data:/var/lib/postgresql/data
volumes:
db-data:networks:
frontend:
backend:
services:
app:
networks:
- frontend
- backend
db:
networks:
- backendversion: '3.8'
services:
frontend:
build: ./frontend
ports:
- "3000:3000"
environment:
- REACT_APP_API_URL=http://localhost:8000
depends_on:
- backend
backend:
build: ./backend
ports:
- "8000:8000"
environment:
- DATABASE_URL=postgresql://user:pass@db:5432/myapp
depends_on:
- db
db:
image: postgres:15
environment:
- POSTGRES_USER=user
- POSTGRES_PASSWORD=pass
- POSTGRES_DB=myapp
volumes:
- postgres-data:/var/lib/postgresql/data
volumes:
postgres-data:services:
api:
build: ./api
ports:
- "8000:8000"
environment:
- REDIS_URL=redis://cache:6379
depends_on:
- cache
- db
worker:
build: ./worker
environment:
- REDIS_URL=redis://cache:6379
depends_on:
- cache
cache:
image: redis:7-alpine
ports:
- "6379:6379"
db:
image: postgres:15
environment:
- POSTGRES_PASSWORD=secret
volumes:
- db-data:/var/lib/postgresql/data
volumes:
db-data:services:
app:
build:
context: .
target: development
volumes:
- .:/app
- /app/node_modules
ports:
- "3000:3000"
environment:
- NODE_ENV=development
command: npm run dev# Start all services
docker-compose up
# Start in background
docker-compose up -d
# Build and start
docker-compose up --build
# Stop all services
docker-compose down
# Stop and remove volumes
docker-compose down -v
# View logs
docker-compose logs -f
# View logs for specific service
docker-compose logs -f app
# Execute command in service
docker-compose exec app sh
# Scale service
docker-compose up -d --scale worker=3
# Restart service
docker-compose restart app
# View running services
docker-compose ps# .env
POSTGRES_PASSWORD=secret
API_PORT=8000# docker-compose.yml
services:
db:
environment:
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
api:
ports:
- "${API_PORT}:8000"services:
app:
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
interval: 30s
timeout: 10s
retries: 3
start_period: 40sservices:
app:
deploy:
resources:
limits:
cpus: '0.5'
memory: 512M
reservations:
cpus: '0.25'
memory: 256Mvolumes:
postgres-data:
driver: local
redis-data:
driver: local# Development
docker-compose -f docker-compose.yml -f docker-compose.dev.yml up
# Production
docker-compose -f docker-compose.yml -f docker-compose.prod.yml up# Find process using port
lsof -i :3000
# Change port in docker-compose.yml
ports:
- "3001:3000"# Check logs
docker-compose logs app
# Check service status
docker-compose ps
# Rebuild without cache
docker-compose build --no-cache app# Ensure depends_on is set
depends_on:
- db
# Use service name as hostname
DATABASE_URL=postgresql://user:pass@db:5432/myapp
# Wait for database to be ready (use wait-for-it.sh or healthcheck)# Set user in Dockerfile
USER node
# Or in docker-compose.yml
user: "1000:1000"# ❌ Don't use latest
image: postgres:latest
# ✅ Use specific version
image: postgres:15.3-alpine# Use Docker secrets (Swarm mode)
secrets:
db_password:
file: ./secrets/db_password.txt
services:
db:
secrets:
- db_passwordservices:
app:
logging:
driver: "json-file"
options:
max-size: "10m"
max-file: "3"services:
app:
restart: unless-stopped# .github/workflows/test.yml
- name: Run tests
run: |
docker-compose -f docker-compose.test.yml up --abort-on-container-exit
docker-compose -f docker-compose.test.yml down -vservices:
frontend:
build: ./frontend
ports:
- "3000:3000"
backend:
build: ./backend
ports:
- "5000:5000"
mongo:
image: mongo:6
volumes:
- mongo-data:/data/dbservices:
web:
build: .
command: python manage.py runserver 0.0.0.0:8000
ports:
- "8000:8000"
depends_on:
- db
- redis
db:
image: postgres:15
redis:
image: redis:7-alpine
celery:
build: .
command: celery -A myapp worker -l info
depends_on:
- redis~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.