Container Security Scanner
Paste a Dockerfile, docker-compose.yml, or Kubernetes manifest and get an instant 0-100 hardening grade across 7 isolation dimensions. No install, no signup — it grades entirely in your browser, so your config is never uploaded.
What the 7-dimension containment grade measures
The same scorer that powers IronClaw's ironctl scan CLI grades every workload on the boundaries that decide whether a container escape becomes a host compromise: a non-root user, dropped Linux capabilities, an active seccomp profile, network isolation, a read-only root filesystem, no docker.sock exposure, and no shared host namespaces. Every dimension it cannot determine is graded fail-closed — a scan that cannot see a boundary never claims the boundary holds.
Want to grade your live containers, wire this into CI as a policy gate, or generate hardened configs automatically? Install the open-source CLI and browse the container hardening coverage hub or the source on GitHub.
New to runtime isolation grading? Read how the free online Dockerfile security scanner works and how it differs from a CVE scanner or a linter.