Trivy scanning Docker Compose files

An XDA piece this month laid out something that most homelabs learn the hard way: a working Docker Compose file is not a secure Docker Compose file. Ports get bound to 0.0.0.0 when they should stay on 127.0.0.1, database services end up on the same public bridge as the reverse proxy, and admin dashboards ship with default credentials that nobody remembered to rotate. The fix is a scanner that reads the compose file, the image, and the container config together, and flags what is exposed. We tested seven Docker Compose security tools on Windows, macOS, and Linux against a real homelab stack, focusing on the checks that catch actual misconfigurations rather than noise.

What to look for in a Docker Compose security scanner

Compose-aware parsing is the first check. A scanner that only reads Dockerfiles will miss the port bindings, network topology, and environment blocks that live in docker-compose.yml. The right pick reads both, and understands expose versus ports, host-mode networking, and bind mounts that reach into /etc or /var/run/docker.sock.

Vulnerability data has to be current. That means a CVE feed that updates daily, coverage of both distro packages and language-level dependencies, and a way to tell which findings are actually exploitable in the running container instead of just present in the image. A tool that surfaces every CVE regardless of context floods a homelab with warnings and gets ignored inside a week.

CI-friendly output is what turns a one-off scan into a durable check. JSON or SARIF output, non-zero exit codes on findings above a chosen severity, and inline suppression comments in the compose file let the same tool live in a git pre-commit hook, a GitHub Actions job, or a nightly cron. Local-first operation matters for a homelab, no telemetry, no forced cloud account.

Quick comparison

App Best for Platforms Free plan Starting price Rating
Trivy All-in-one image and compose scanner Windows, macOS, Linux Yes Free 4.8
Docker Bench for Security CIS host and daemon audit Linux, macOS Yes Free 4.6
Grype Fast image vulnerability scanner Windows, macOS, Linux Yes Free 4.6
Dockle Image best-practice linter Windows, macOS, Linux Yes Free 4.5
Hadolint Dockerfile linter with security rules Windows, macOS, Linux Yes Free 4.6
Checkov IaC and compose policy scanner Windows, macOS, Linux Yes Free 4.6
Sysdig CLI Scanner Deep runtime-aware image scanning Windows, macOS, Linux Trial Modest for commercial use 4.5

1. Trivy, the default first pass for any compose stack

Trivy is the tool most homelabs land on first, and it earns the spot. It scans container images for OS and language vulnerabilities, reads Dockerfiles and compose files for misconfigurations, and now includes secret scanning that catches an API key committed into an env file. A single trivy config docker-compose.yml run against a homelab stack produces a legible report in under a minute.

The database refresh runs on every scan by default, which keeps findings current without a cron job. Output modes cover a human-readable table, JSON, SARIF, and CycloneDX SBOMs, and exit codes work in a CI pipeline. It is free and open source, runs as a single binary, and stays useful long after the initial scan.

2. Docker Bench for Security, the CIS audit for the host and daemon

Docker Bench for Security is a shell script that walks the CIS Docker Benchmark against a running host. It checks the daemon config, the containers currently running, and the images already on disk against about a hundred documented controls, and prints a report with pass, warn, info, and note statuses.

It is not a compose parser, but it is the fastest way to catch the host-level misconfigurations that a compose scanner cannot see: a Docker daemon listening on TCP without TLS, --privileged containers, missing no-new-privileges, log driver defaults, and file permissions on /etc/docker. Run it once a month on any host that runs a public service, and pin the results to the wiki.

3. Grype, fast image vulnerability scanning that pairs with Syft

Grype is Anchore’s open-source vulnerability scanner. It reads an image directly or an SBOM produced by Syft and returns a list of known CVEs against installed packages and language dependencies. Scans run in seconds because Grype ships its vulnerability database locally and updates on a schedule.

The reason to pair it with Trivy is coverage. Trivy is broader; Grype often catches language-level packages that Trivy misses, especially in Python and Node images. In practice we run both in the same pipeline and fail on any high-severity finding from either. Grype adds no forced telemetry and no account, and it runs the same way on every desktop OS.

4. Dockle, image best-practice linter for the CI step

Dockle is a container image linter aligned with CIS best practices. Where Trivy focuses on CVEs and Grype on package vulnerabilities, Dockle checks how the image is built: is USER set to a non-root account, does an unnecessary sudo binary ship inside, are secrets baked into the layers, does the image expose a shell it does not need. Findings map to CIS control numbers.

It is a small binary that fits into a CI job as a single command per image. The output is short enough to read, and the exit code makes it easy to gate. Together with a compose scanner it covers the two sides of the same problem: what the compose file wires up, and what the image contains before it is even wired.

5. Hadolint, Dockerfile linter that catches the compose-adjacent mistakes

Hadolint reads a Dockerfile and flags the patterns that end up as compose problems: hard-coded credentials, missing tag pins, apt-get install -y without cleanup, root users left in place, and ADD used where COPY belongs. It parses the Dockerfile with a real Haskell shell parser, which is why it catches issues that a regex-based tool misses.

Hadolint is upstream from compose. Fix the Dockerfile once and the compose scanner has less to complain about. It runs as a single binary, integrates cleanly with pre-commit or CI, and adds one of the highest-signal checks per line of code we have measured on homelab projects.

6. Checkov, policy-as-code across compose, Kubernetes, and Terraform

Checkov is a policy-as-code scanner that speaks docker-compose, Kubernetes manifests, Terraform, Helm, and a dozen other IaC formats. On a compose file it flags exposed daemon sockets, root containers, host network mode, missing resource limits, and public port bindings. Policies ship with sensible defaults and can be tuned per repo with a config file.

The reason to pick it over a single-format tool is the mix. A homelab that runs Docker Compose today but plans to move to a small k3s or Nomad cluster tomorrow gets the same checks against both, and the same suppression comments carry over. It runs anywhere Python runs, which covers every desktop OS.

7. Sysdig CLI Scanner, the deeper option when runtime context matters

Sysdig CLI Scanner combines vulnerability scanning with runtime awareness. It reads the image, correlates CVEs against a vulnerability feed, and, when paired with a Sysdig deployment, filters to the packages actually loaded at runtime. That single filter often turns a report of hundreds of findings into a shortlist of a dozen.

The scanner runs as a single binary on every desktop OS. The free tier covers evaluation and small deployments; commercial use falls under a paid plan. For a serious homelab or a small team that hosts services outside the LAN, the runtime filter is worth the setup. For a purely private stack, Trivy plus Grype covers most of the same ground for free.

How to pick the right one

The default answer for a homelab is Trivy. Install it, run it against the compose file, and fix what shows up. It covers image CVEs, compose misconfigurations, and secret detection in one binary. If a homelab runs public services, add Docker Bench for Security as a monthly audit against the host itself, since a compose scanner cannot see daemon-level problems.

For teams that build their own images, Hadolint catches the mistakes at the Dockerfile stage, and Dockle catches the ones that survive to the built image. Grype earns a place beside Trivy when the workload is Python or Node heavy, because it tends to find language-level CVEs the other missed. Checkov is the right choice for a mixed IaC repo. Sysdig CLI Scanner is the deeper option for teams that want runtime context and are ready to pair it with a Sysdig backend. Stacking all seven is overkill; pick two or three, and run them on every commit.

FAQ

How do I scan a docker-compose.yml for security issues? Install Trivy and run trivy config docker-compose.yml. It reports port exposure, root containers, mounted Docker sockets, and secret patterns in a plain text report. Add --exit-code 1 --severity HIGH,CRITICAL to fail a CI pipeline on serious findings.

Is Trivy better than Grype for Docker security? They are complementary rather than competing. Trivy covers a wider surface, compose files, images, and IaC, while Grype often catches more language-level CVEs in Python, Node, and Ruby images. Running both in the same pipeline catches more than either alone.

What is the difference between Dockle and Hadolint? Hadolint checks the Dockerfile before the image is built. Dockle checks the built image itself. Together they cover the same problem from both ends: bad build patterns and bad image state.

Can I run these tools without an internet connection? Trivy, Grype, and Sysdig CLI Scanner all support air-gapped operation by importing the vulnerability database from a mirror. Dockle, Hadolint, and Docker Bench for Security run offline by default because their rules are baked in.

Do these scanners work on Windows and macOS? Yes. Trivy, Grype, Dockle, Hadolint, Checkov, and Sysdig CLI Scanner ship native binaries or containers for Windows, macOS, and Linux. Docker Bench for Security is a bash script and runs on macOS and Linux; on Windows it runs inside WSL.

Are these tools free for personal use? All seven have a free tier for personal and homelab use. Trivy, Grype, Dockle, Hadolint, Checkov, and Docker Bench for Security are fully open source. Sysdig CLI Scanner is free for evaluation and small use, with a paid plan for commercial deployments.