What could be better, before anything breaks.
The app already tells you when something goes wrong. The checkup tells you what could be better while everything still works: a container that runs without a restart policy, a port open to your whole network, a volume nobody ever backed up. With the button that fixes it next to every finding.
Fig. — The Checkup page: findings in three weights, each with why it matters and how to change it.
What you can do
Eleven rules, three weights
Worth a look, better changed, could be tidied. No score: a number invites polishing instead of thinking.
More power than it needs
A container running --privileged, the docker socket mounted, or a folder on the host it can write to.
Reachable from your whole network
A published port listening on every address, where 127.0.0.1 would have been enough.
It has to survive a reboot
No restart policy, no health check, no memory limit — counted only for containers that have been up for a day.
One click to the fix
Every finding links to the dialog that changes it. The app never changes anything by itself.
This is on purpose
Dismiss a finding and it stays dismissed, greyed out at the bottom of its group so you can undo it. A list you cannot empty is a list nobody reads.
Passwords stay covered
Environment variables that look like secrets are hidden until you click them, and so are the ones in the docker run command you copy. Copying still gives you the real thing.
Secrets where they should not be
A private key or an .env mounted into a container, or a password sitting in a compose file while an .env lies next to it.
A report you can pass on
What runs on a machine, in one page of Markdown or HTML.
Containers with their ports and projects, compose projects, images, volumes, networks, and what the checkup found. Also of a machine you are not on: the app opens a short-lived connection to it and closes it again. Environment variables are left out, so the report is safe to share.
Since the last report
What came, what went, and what moved to another image.
The app remembers only the container names and their images from the previous report. The next one puts the difference underneath, so you can see at a glance what changed on that machine since you last looked.
Nothing leaves the app
The checkup reads what is already there.
The lists the app fetches anyway, plus one inspect per running container, on request and not continuously. No agent, nothing installed, no call to any service.
All features