StackSentry v0.1.0

First public release of StackSentry: a local-first Docker Compose security scanner and preflight checker that finds insecure, fragile and incomplete configuration before you deploy.

Note: StackSentry reports configuration risks with evidence and remediation guidance. It does not replace a full security review or an image vulnerability scanner. Use it only on systems you own or are authorized to assess.

Highlights

• 27 Docker Compose rules covering Docker socket mounts, privileged containers, host networking, dangerous capabilities, sensitive and writable host mounts, non-root users, unencrypted Docker API exposure, plaintext secrets, published database and admin ports, restart policies, healthchecks, image pinning, persistent volumes, resource limits and log rotation
• 10 read-only Docker host rules: privileged and socket-mounting containers, host networking, restart policies, unencrypted Docker API listeners, mutable images, stopped containers, dangling images and disk usage
• Actionable findings: every finding has a stable rule ID, severity, confidence, the exact evidence, why it matters and how to fix it
• Secrets stay secret: values of credential-like variables are always masked as ******** in every output format
• Three output formats: terminal table, JSON with a documented JSON Schema and Markdown audit reports
• CI/CD-ready: --fail-on exit codes, --severity filtering, --only / --exclude and documented per-service exceptions with x-stacksentry.ignore
• Local-first: no telemetry, no cloud service, no account; Compose scans need no Docker installation
• Single static binary for Linux, macOS and Windows

Quick start

go install github.com/6-SlX-6/stacksentry/cmd/stacksentry@v0.1.0
stacksentry scan compose ./docker-compose.yml

Try it on the bundled example stack:

git clone https://github.com/6-SlX-6/stacksentry.git
cd stacksentry
stacksentry scan compose examples/insecure-compose.yaml --severity high

Fail a CI pipeline on high or critical findings and write a Markdown report:

stacksentry scan compose compose.yaml --fail-on high --format markdown --output stacksentry.md

Downloads

Binaries (attached below): stacksentry-v0.1.0-linux-amd64, stacksentry-v0.1.0-linux-arm64, stacksentry-v0.1.0-darwin-amd64, stacksentry-v0.1.0-darwin-arm64 and stacksentry-v0.1.0-windows-amd64.exe. Verify the downloads with:

sha256sum --check --ignore-missing checksums.txt

Or use the install script, which downloads the right binary and verifies its checksum (review it before running it):

curl -fsSL https://raw.githubusercontent.com/6-SlX-6/stacksentry/v0.1.0/scripts/install.sh -o install.sh
sh install.sh

Container image: no image is published yet. Build it locally with the included Dockerfile:

docker build -t stacksentry:local .
docker run --rm -v "$PWD:/work:ro" stacksentry:local scan compose /work/compose.yaml

Documentation

• README
• Rule reference
• Examples
• Exit codes and CI/CD
• JSON report format
• Security model
• Security policy

What's Changed

• StackSentry v0.1.0 by @6-SlX-6 in #1
• docs: expand README for search engines and AI search by @6-SlX-6 in #2
• Ci/release from UI by @6-SlX-6 in #3

Full Changelog: https://github.com/6-SlX-6/stacksentry/commits/v0.1.0