Audits Dockerfile and docker-compose.yml against NIST SP 800-190 container hardening controls. For US federal contractors preparing a CMMC Level 2 assessment. Runs entirely in your browser — nothing is uploaded.
Same engine as the VS Code extension, byte for byte.
Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.
npmMCP server (npx)Docker Hubnpx @readystack/container-hardening-800-190 <file> npx @readystack/container-hardening-800-190 --mcp docker run --rm -v "$PWD:/w" getreadystack/container-hardening-800-190 /w
Team? One key for every ReadyStack linter, 5 seats, $149 once
Audits every container file in the workspace at once and exports the dated evidence report (Markdown and CSV) an assessor asks for, for commercial and team use.
One payment, one licence key for this tool. The key is shown right after payment.
A consultancy NIST SP 800-171 gap assessment runs $3,500 to $20,000 and takes 2 to 6 weeks.
Buy the full version — $29· ReadyStack
Real numbers from this tool, line by line.
A US defense subcontractor's generated Dockerfile and compose pair failed 18 of the 19 container hardening checks in this extension: 11 NIST SP 800-171 Rev. 2 requirements at risk, 51 points, a self-assessment score of 59 out of 110. The hardened version of the same two files failed none and scored 110. Both files ship with the extension, and the numbers were measured on 2026-09-21.
Nobody typed most of that Dockerfile. In 2026 the first draft of a container file usually comes out of a coding assistant, and assistants optimise for a build that succeeds. A build succeeds perfectly well as root. It succeeds with the Docker socket mounted, with network_mode: host, with a password in an ENV line, with the base image on :latest. None of that shows up in CI. All of it shows up in an assessment.
Here is the arithmetic that makes it expensive. Under DFARS 252.204-7019 and 252.204-7020, a contractor that handles CUI self-assesses against NIST SP 800-171 and posts the summary score to the Supplier Performance Risk System. The score starts at 110, and every requirement that is not implemented subtracts its weight — 5, 3 or 1 points — under the DoD Assessment Methodology. It has to be no more than three years old at award, so the number you posted keeps being true about a codebase that has moved on without you.
USER root is not a style preference in that world: it sits under requirement 3.1.5, least privilege, worth 3 points. A mounted /var/run/docker.sock sits under 3.1.7, worth 5. A clear-text secret in an image layer sits under 3.5.2, an unpinned base image under 3.4.1. The deduction happens once per requirement however many files reveal it — which is how this extension counts: 18 findings collapsed into 11 requirements and 51 points.
The extension is narrow on purpose. Open a Dockerfile or a docker-compose.yml and it runs 19 checks drawn from NIST SP 800-190. Twelve read Dockerfiles: a missing USER, a final USER root, a base image that is not digest-pinned or sits on :latest, a clear-text secret in ENV or ARG, ADD from a remote URL, TLS verification switched off, a plain-text HTTP source, a remote script piped into a shell, sudo in the image, unpinned package installs, and an SSH daemon. Seven read compose files: privileged: true, a mounted Docker socket, network_mode: host, a host namespace, a dangerous capability added back, a port published on every interface, and a clear-text secret in environment.
Every finding shows four things: the failing line, the SP 800-190 section behind the control, the fix written as the line you should have, and the SP 800-171 requirement at risk. That fourth column is the part a chatbot will not give you — it rewrites the Dockerfile happily, but it does not know what you posted to SPRS. It is not a CVE scanner either: Trivy and Grype read the built image, this reads the instructions that made it insecure. Run both.
It does not compute or submit an official SPRS score, and it is not legal advice. It shows the points your container files put at risk, so you can close them before someone bills you to find them. For scale: a consultancy NIST SP 800-171 gap assessment runs $3,500 to $20,000 and takes 2 to 6 weeks.
The free tier audits the file you have open, all 19 checks, every finding with its fix and its points. Harden a file, re-run, and stop when the panel reads 110 out of 110. A licence key moves the same engine to a different axis: every container file in the workspace in one pass, plus the dated Markdown and CSV evidence export, for commercial and team use.
It reads the Dockerfile or docker-compose file you have open and runs 19 checks drawn from NIST SP 800-190, the container security guide. Each failing line is reported with the section it comes from, the fix, and the NIST SP 800-171 Rev. 2 requirement that the gap puts at risk in your DoD self-assessment score.
DevOps and platform engineers at US federal and defense contractors that handle CUI and post a NIST SP 800-171 self-assessment score to SPRS under DFARS 252.204-7019 and 7020. It is also useful to any team that has to show an auditor why a container runs the way it does.
Image scanners such as Trivy or Grype read the built image and list CVEs in packages. They do not tell you that USER root, a mounted Docker socket, or a baked-in password is the reason. A chatbot will rewrite your file but cannot name the requirement the old line cost you.
The free tier audits the file you have open against all 19 checks and shows every finding, its SP 800-190 section, its fix, and the points at risk. A licence key adds a workspace-wide audit of every container file at once and the dated Markdown and CSV evidence export, for commercial and team use.
A consultancy NIST SP 800-171 gap assessment runs $3,500 to $20,000 and takes 2 to 6 weeks, and it covers the whole system, not just containers. This extension does not replace that assessment. It closes the container-file gaps before the assessor bills you to find them.
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. Cybersecurity Container Audit — NIST SP 800-190 checks the file you open against 19 rules, each naming its legal or official basis, from a rule set dated 2026-09-21, and points at the exact line with the fix. For a filing, an audit or a client you need that dated result on your own files.
One question, answered by the person who built it. Your email only if you want the answer sent.
Paste this code into your page. It runs in your visitor’s browser and stays up to date. Nothing your visitors type is stored.
For businesses: your name and logo instead of ours, and each visitor’s result + e-mail in your inbox (only when they tick consent) — Pro from $19/month. See Pro →