DockerGuard

DockerGuard reviews the file you use to build a software container (a Dockerfile, or a docker-compose file) and tells you what is wrong with it before you ever build. You paste the file in; it returns a scored report where every issue shows the exact line, why it matters, and the fix.

Live demo: agent-kit-roan.vercel.app

Why

Most container security mistakes are made in the build file, before anything runs; a secret baked into a layer, a container running as root, an unpinned latest base image, dependencies installed in an order that busts the build cache. Image scanners (Trivy, Grype) inspect a container after it is built; DockerGuard reads the build definition first and catches the problems while they are still cheap to fix. It performs static analysis only; it never builds, runs, or fetches anything.

What you get

• an overall score out of 100 and a letter grade;
• a one line summary of the file's condition;
• findings grouped by severity (critical, high, medium, low, info), each with the offending line, a plain-English reason, and a copy-pasteable fix;
• an annotated view of your file with severity markers in the line gutter;
• the good practices the file already follows;
• export of the report as JSON, Markdown, or PDF.

Detected secrets are redacted in the output; the tool refers to them by location, never by value.

What it checks

• Security: hardcoded secrets, running as root, ADD from a URL, piping remote scripts into a shell, mounting the Docker socket, missing .dockerignore.
• Reproducibility and supply chain: latest or untagged base images, unpinned package installs.
• Image size and caching: unchained RUN layers, uncleaned package caches, cache-busting COPY order, no multi-stage build.
• Maintainability: missing HEALTHCHECK, shell-form vs exec-form CMD, WORKDIR hygiene, ENV vs ARG.

How it works

DockerGuard has two parts:

1. The agent (in lamatic/); a single Lamatic.ai flow, dockerguard-audit, that takes the file contents, runs them through an LLM with a strict rule catalog, and returns the report as structured JSON. The prompts, model config, and guardrails (constitution) are kept as separate files.
2. The web app (at the repo root); a Next.js app that calls the deployed flow through the Lamatic SDK and renders the report, with light and dark themes.

.                      the Next.js app
  app/                 pages, layout, global styles
  components/          score ring, annotated source, findings, export menu, theme toggle
  lib/                 SDK client, report parsing/formatting, severity helpers
  actions/             server action that calls the Lamatic flow
  orchestrate.js       reads config from the environment
lamatic/               the agent
  flows/               the dockerguard-audit flow
  prompts/             system and user prompts
  model-configs/       model selection
  constitutions/       safety and behaviour rules

Run it locally

You need a Lamatic account with the dockerguard-audit flow deployed (the flow, prompts, and model config are all in lamatic/, so you can recreate it in Lamatic Studio).

1. Copy the env template and fill in your values:

cp .env.example .env.local

DOCKERGUARD_AUDIT="your-dockerguard-audit-flow-id"
LAMATIC_API_URL="https://your-org-your-project.lamatic.dev"
LAMATIC_PROJECT_ID="your-project-id"
LAMATIC_API_KEY="your-api-key"

2. Install and run:

npm install
npm run dev

Then open http://localhost:3000.

Dark mode

Tech stack

Next.js 15, React 18, TypeScript, Tailwind CSS v4, lucide-react, and the Lamatic SDK for the agent. Deployed on Vercel.

Origin

DockerGuard started as my contribution to the Lamatic AgentKit challenge (PR #203). This repository is the standalone version of the same project.

License

MIT; see LICENSE.