Base Image EOL Lint - Dockerfile and CI end-of-life check

It reads the image references written in your repository - Dockerfile FROM lines, docker-compose image keys, GitHub Actions runner labels and container images - and marks every one whose vendor has stopped shipping security patches, or stops soon, with the exact tag that replaces it and the date behind the finding.

Platform, DevOps and backend engineers who own the Dockerfiles and CI workflows in a repository: the person who answers when an auditor asks which base images are still supported, and the person who has to do the upgrade. If you maintain a multi-stage Dockerfile or a compose file, this reads your files.

Free scanners test an image that has already been built and pushed, and they report the vulnerable packages inside it. They cannot open the Dockerfile on your screen and tell you that FROM python:3.10-slim names a runtime whose final security release lands on 31 October 2026. Nothing that needs a built image can.

Free covers one whole file: open a Dockerfile, run the check, and all 21 rules report every finding with its severity and its replacement tag. Nothing is watermarked, timed or locked after N runs. The licence changes the scope only - every file in the repository at once, a dated exported report, and JSON for CI.

Snyk's Team tier is $25 per contributing developer per month, and it still starts from a built image rather than the file you are editing. Auditing FROM lines by hand means grepping every repository each time a vendor retires a branch, which happens several times a year. This is $29 once.