No AI · No network · No telemetry

A doctor for
your Docker.

Find the security problems, misconfigurations and wasted disk in your Docker environment — in under a second, entirely offline.

$brew install iamcanturk/tap/doctordock
Get started View source
Deterministic Go Works air-gapped Read-only by default
The DoctorDock robot mascot, tidying Docker containers.
See it

The whole picture, at a glance.

A menubar app for macOS shows the score, every finding grouped by rule, and how to fix each one — the same engine as the CLI, native.

DoctorDock overview: health score 42, resource counts, and what to fix first.
DoctorDock finding detail: Docker socket exposed, why it matters, and how to fix it with copyable commands.

Every finding explains itself — what it looks for, why it matters, and copy-paste fixes.

DoctorDock in the terminal: the command list, then doctordock explain DD005 with the attack scenario, copy-paste fixes and references.
Prefer the terminal? The CLI does everything — and every rule explains itself.
Why DoctorDock

Docker makes it easy to run things, and hard to notice what you are running.

Six months in, the average machine has a container mounting the Docker socket, three databases open to the network, a dozen containers running as root, and gigabytes of images nothing uses. DoctorDock finds all of it.

No AI, ever

Every finding is deterministic code you can read. The same environment always produces the same output. No hallucinations, no surprises.

Fully offline

Zero network calls. No CVE feed to sync, no account, no update check. It opens exactly one local socket — Docker's — and nothing else.

Secrets stay put

Container environment variables are read as key names only. A value can't reach a report, so scans are safe to run against production.

Instant

A full scan of dozens of containers and images takes under a second. Fast enough to run dozens of times a day, or in CI on every push.

Guarded cleanup

Reclaim gigabytes of unused images and networks. Nothing is removed without --apply, and a volume is never touched without asking twice.

CI-ready

JSON output and opt-in exit codes. Gate a deploy with doctordock scan --fail-on high — 0 clean, 2 for HIGH, 3 for CRITICAL.

Install

One command on a Mac.

Both doctordock and the short alias ddock are installed. Free, no account needed.

macOS Homebrew

$brew install iamcanturk/tap/doctordock

Any platform Go

$go install github.com/…/doctordock@latest

CI / container ghcr.io

$docker run … ghcr.io/iamcanturk/doctordock

Then just run it

$doctordock
18 checks

What it looks for

Security, configuration, resources and cleanup. Every rule explains itself — what it means, why it matters, and how to fix it.

CRITDD005Docker socket mounted into a container
CRITDD002Privileged container
HIGHDD001Container runs as root
HIGHDD004Sensitive host path mounted
HIGHDD009Dangerous capabilities added
MEDDD006Database port published on 0.0.0.0
MEDDD003Host networking
MEDDD012Container failing its healthcheck
MEDDD013Container stuck in a restart loop
LOWDD007No healthcheck
LOWDD010No memory limit
LOWDD016Oversized image
INFODD011Mutable image tag (:latest)
INFODD015Unused image
INFODD017Unused volume
INFODD018Unused network
FAQ

Questions, answered

The things people ask before running a scanner against their Docker.

What is DoctorDock?

DoctorDock is a local-first command-line tool, with a native macOS menubar app, that scans your local Docker environment and reports security problems, misconfigurations, and reclaimable disk. A full scan takes under a second and ends with a Docker health score out of 100.

Does DoctorDock use AI?

No. Every finding is deterministic Go code you can read, so the same environment always produces the same output. There is no model in the analysis path and nothing is guessed. If AI ever appears, it will only ever explain the results — never produce them.

Is it offline? Does it send my data anywhere?

It is fully offline. Zero network calls, no telemetry, no account, no update check. DoctorDock opens exactly one local socket — Docker's — and nothing else. It runs air-gapped and inside a locked-down CI runner.

How is it different from Trivy or Grype?

Trivy and Grype scan images for CVEs and need a vulnerability database, and therefore a network. DoctorDock deliberately does not scan for CVEs — that is a solved problem. It covers the configuration layer those tools don't look at (how your containers are actually run) and stays offline as a result.

Is it safe to run against production?

Yes. Container environment variables are read as key names only; their values never enter memory in a form that could reach a report. And cleanup never deletes anything unless you pass --apply — a volume is never touched unless you ask for it by name.

How do I install it, and is it free?

On macOS: brew install iamcanturk/tap/doctordock. On any platform with Go: go install github.com/iamcanturk/DoctorDock/cmd/doctordock@latest. It is free and open source under the MIT license — no account needed.

DoctorDock menubar popover: the health score, resource counts and top findings.
Always on

Right in your menubar.

The score sits in the menubar, colour-coded, and rescans on its own. Click it for the findings and a one-click cleanup — the same engine as the CLI, so the two never disagree about a number.

Get the app
Shareable

Show your Docker health.

Export a 16:9 card of your score and resource counts and post it anywhere. It carries only aggregate numbers — never a container name, an image tag, a port or a path — so it is safe to share in public.

Get the app
A DoctorDock shareable health card: a Docker health score out of 100 with container, image, volume and network counts and per-severity findings.

It never leaves your machine.

No AI to send your data to, no server to phone home, no account to create. DoctorDock reads the local Docker socket and writes to your terminal. That's the whole system. The shareable card carries only aggregate numbers — never a container name, an image tag, a port or a path.

Star on GitHub