Free Online Dockerfile Security Scanner (Runs In Your Browser, Nothing Uploaded)
What this is
A free, zero-install security scanner that grades the runtime isolation of a container config. Paste a Dockerfile, a docker-compose.yml, or a Kubernetes manifest into the page and get a 0 to 100 score with an A to F grade in seconds. It runs entirely in your browser, so nothing you paste is uploaded to a server.
Open the scanner at nivardsec.com/scan.
How to use it
- Open nivardsec.com/scan.
- Paste your Dockerfile, docker-compose.yml, or Kubernetes manifest. The scanner auto-detects which one it is.
- Read your grade. You get an overall 0 to 100 score, an A to F letter grade, and a per-dimension breakdown showing exactly which settings passed, failed, or were assumed insecure because they were not set.
- Share the receipt. Each result produces a shareable card you can drop into a pull request, a ticket, or a team channel.
No account, no sign up, no file upload. If you can paste text, you can run it.
What it checks (seven isolation dimensions)
The score is the sum of seven weighted dimensions, out of 100:
| Dimension | Weight | What a pass means |
|---|---|---|
| Dropped capabilities | 20 | The container drops Linux capabilities instead of running with the full set (a full cap set is effectively host root). |
| Non-root user | 15 | The container runs as a non-root uid, not uid 0. |
| Seccomp profile | 15 | A seccomp profile filters the syscall surface (not unconfined). |
| Network isolation | 15 | Egress is constrained (network none scores highest; a bridge with open egress scores lower). |
| No docker.sock exposure | 15 | The Docker socket is not mounted into the container (mounting it hands over host control). |
| Read-only root filesystem | 10 | The root filesystem is read-only, removing a tamper and persistence surface. |
| No shared host namespaces | 10 | The container does not share the host PID, network, or IPC namespaces. |
The scanner is fail-closed: if a setting is not reported in your config, it is scored as the insecure default rather than assumed safe. This means a bare Dockerfile with no hardening starts low and earns points as you add controls, which is the honest direction.
How it differs from a CVE scanner or a linter
This is a common point of confusion, so here it is plainly. These tools answer different questions and are best used together.
| Tool type | Question it answers | Example tools |
|---|---|---|
| Vulnerability scanner | Which packages or layers in my image have known CVEs? | Trivy, Grype, Docker Scout |
| Dockerfile linter | Does my Dockerfile follow style and build best practices? | Hadolint |
| This scanner (runtime isolation grader) | If this container is compromised, how much can it reach? What is the blast radius? | IronClaw scan |
A CVE scanner tells you what might get exploited. A runtime isolation grade tells you how contained the damage is when something does. Both matter. This tool fills the second gap, which most free online scanners skip.
Privacy
The scoring engine is compiled to WebAssembly and runs client-side in your browser tab. Your Dockerfile or manifest is graded locally. It is not uploaded, stored, or logged on a server. That is a design property of running the scorer as WASM, not a promise about a backend, because there is no backend in the grading path.
From grade to enforcement
The browser scanner is the fastest way to see where a config stands. When you want to enforce the same bar in CI or a cluster, the same open-source engine (IronClaw) runs as a CLI (ironctl scan) and can emit policy-as-code (Kyverno, Gatekeeper, or a native Kubernetes ValidatingAdmissionPolicy) directly from the grade. IronClaw is open source under AGPLv3 plus a commercial license.
Try it
Grade your first config at nivardsec.com/scan. Nothing to install, nothing uploaded.
Scan a config free