Audits Dockerfile and docker-compose.yml against NIST SP 800-190 container hardening controls. For US federal contractors preparing a CMMC Level 2 assessment. Runs entirely in your browser — nothing is uploaded.
Same engine as the VS Code extension, byte for byte.
This page is the working piece. The full pack has everything below.
Reads a Dockerfile or compose file and names the hardening controls it fails, with the NIST SP 800-171 requirement each one puts at risk.
A consultancy NIST SP 800-171 gap assessment runs $3,500 to $20,000 and takes 2 to 6 weeks.
Buy the full version — $29It reads the Dockerfile or docker-compose file you have open and runs 19 checks drawn from NIST SP 800-190, the container security guide. Each failing line is reported with the section it comes from, the fix, and the NIST SP 800-171 Rev. 2 requirement that the gap puts at risk in your DoD self-assessment score.
DevOps and platform engineers at US federal and defense contractors that handle CUI and post a NIST SP 800-171 self-assessment score to SPRS under DFARS 252.204-7019 and 7020. It is also useful to any team that has to show an auditor why a container runs the way it does.
Image scanners such as Trivy or Grype read the built image and list CVEs in packages. They do not tell you that USER root, a mounted Docker socket, or a baked-in password is the reason. A chatbot will rewrite your file but cannot name the requirement the old line cost you.
The free tier audits the file you have open against all 19 checks and shows every finding, its SP 800-190 section, its fix, and the points at risk. A licence key adds a workspace-wide audit of every container file at once and the dated Markdown and CSV evidence export, for commercial and team use.
A consultancy NIST SP 800-171 gap assessment runs $3,500 to $20,000 and takes 2 to 6 weeks, and it covers the whole system, not just containers. This extension does not replace that assessment. It closes the container-file gaps before the assessor bills you to find them.
One question, answered by the person who built it. Your email only if you want the answer sent.