{{ summaryTitle }}
{{ summaryValue }}

{{ summaryLine }}

Source {{ resultsReady ? computation.normalizedInputs.source_mode : '—' }} Network {{ resultsReady ? computation.normalizedInputs.network_scope : '—' }} Reviews {{ resultsReady ? computation.values.review_count : '—' }}
Use letters, numbers, dots, underscores, or hyphens.
The selected mode changes the emitted image or build block.
{{ sourceReferenceHelp }}
Localhost is the safer default for a development-facing host port.
Whole TCP port from 1 to 65535.
Whole TCP port from 1 to 65535.
Secret-like keys can become ${KEY} references and an adjacent .env.example artifact.
Review and protect any downloaded .env.example before committing files.
Examples: app_data:/var/lib/app or ./config:/app/config:ro. Leave blank for no mount.
unless-stopped is a common default for host-managed long-running services.
Neutral default: blank.
Neutral default: blank. Confirm the selected image provides every command used.
Neutral default: disabled.
{{ read_only ? 'Enabled' : 'Disabled' }} 
{{ computation.values.compose_yaml }}

{{ chartExportStatus }}

The chart renderer is unavailable. The same readiness values remain available in the summary and CSV.

Area Generated value Operational meaning Copy
{{ row.cells[0] }} {{ row.cells[1] }} {{ row.cells[2] }}

{{ ledgerExportStatus }}

Docker Compose Healthchecks Checker Check Docker Compose healthchecks for missing commands, timing risks, blocked readiness dependencies, and role-based coverage before release.
Environment Variable Inventory Checker Compare required environment variables with ENV, JSON, or YAML inventories and find missing, blank, placeholder, duplicate, or extra entries.
Dockerfile Security Basics Checker Check a Dockerfile for risky base images, embedded secrets, broad copies, root users, package residue, and missing runtime safeguards.
Kubernetes Deployment Generator Build Kubernetes Deployment YAML with optional Service and policy resources, plus checks for rollout, probes, resources, and security choices.

A Compose file describes how one or more containers should be created as a project. For each service it can name an image or build context, define network access, pass environment values, mount storage, check health, and choose restart behavior. The YAML is configuration, not a deployment result; Docker still has to validate it and create the container resources.

Several short settings carry large operational consequences:

  • A published port without a host address normally binds on every host interface. Prefixing it with 127.0.0.1 restricts access to the local host.
  • expose documents a container port for connected services without publishing it on the host.
  • An internal network allows service-to-service traffic while blocking external connectivity through that network; network_mode: "none" disables container networking.
  • A named volume is managed separately from a container's writable layer. A bind mount grants the container access to a chosen host path.
  • A healthcheck reports whether its command succeeds inside the container. It does not prove the whole application is ready for real users.

Environment-variable substitution improves portability, but a placeholder such as ${API_TOKEN} is not secret storage. The value must still come from an environment file, shell, deployment system, or secrets manager. Files containing real values should be protected and kept out of source control.

A useful Compose draft therefore balances convenience with containment. Pin a release image when repeatability matters, publish only necessary ports, keep host mounts narrow, choose restart behavior that matches the service lifecycle, and validate the resolved configuration before starting containers.

How to Use This Tool:

Describe one service and its exposure boundary, then treat the generated YAML as a starting point for validation.

  1. Enter a Service name and choose a published image or local build context. Prefer a versioned image tag or digest for a repeatable release.
  2. Select the Network scope. Localhost publishes one host port on 127.0.0.1; public publishes on all interfaces; internal exposes only the container port; none disables networking.
  3. Add environment rows as KEY=value. Choose references for secret-like keys unless literal values are deliberately required.
  4. Set an optional named volume or bind mount, then choose the restart policy. Use :ro when the mounted data should not be writable.
  5. Add a healthcheck only when the selected image contains the command it needs. Enable a read-only root filesystem only when the service can write all necessary data elsewhere.
  6. Inspect the Compose file and readiness profile, save any adjacent environment example securely, and run docker compose config --quiet before creating containers.

Interpreting Results:

The Compose file is the generated artifact. The readiness profile is a local review heuristic covering runtime source, port exposure, secret handling, storage, healthcheck, and restart policy. It is not a Docker security scan or proof that the service starts correctly.

  • A high readiness score means the selected setting matches the generator's safer baseline. It does not account for image vulnerabilities, container user, capabilities, memory limits, application authentication, or host firewall state.
  • A public-port review does not mean public binding is always wrong. It means exposure on every host interface must be intentional and protected.
  • A missing healthcheck is marked for review because dependent services may need health state. Some short-lived jobs legitimately have no healthcheck.
  • Validate the resolved YAML and then inspect the running service with docker compose ps, logs, and an application-specific request or command.

Technical Details:

The generator emits a Compose Specification model for one service. Values are quoted as YAML-compatible strings, environment assignments use mapping form, and optional top-level network and volume declarations are derived from the selected service settings.

Transformation Core:

ChoiceGenerated Compose structure
Published imageAn image value under the service
Local build contextA build mapping with one context
Localhost bindA quoted TCP mapping in the form 127.0.0.1:HOST:CONTAINER/tcp
Public bindA quoted HOST:CONTAINER/tcp mapping with no host address
Internal networkAn expose entry plus a service network declared with internal: true
No networkingnetwork_mode: "none" and no top-level service network
Secret reference policySecret-like environment keys receive literal ${KEY} references; their entered values are collected in an adjacent environment example.
Named volumeA service mount plus a top-level volume declaration
HealthcheckCMD-SHELL with the entered command, 30-second interval, 5-second timeout, and 3 retries

Formula Core:

Six readiness areas receive fixed scores from the selected configuration. An area counts as ready at 80% or above.

Nready = ∑i=16 I(si≥80)
Nreview =6−Nready
AreaScores
Runtime source100 for a build context, digest, or non-latest tag; otherwise 60
Port exposure55 for public binding; otherwise 100
Secret handling25 when secret-like keys remain literal; otherwise 100
Storage70 for no mount, 100 for a named or read-only mount, 60 for a writable bind mount
Healthcheck100 when present; otherwise 55
Restart policy100 for always or unless-stopped, 75 for on-failure, 45 for no

Rule Core:

InputAccepted rule
Service and project namesLetters, numbers, dots, underscores, and hyphens; the first character must be alphanumeric.
PortsWhole TCP port numbers from 1 through 65,535.
EnvironmentOne KEY=value assignment per line. Keys begin with a letter or underscore; duplicate keys use the last entered value.
Volumesource:/absolute/container/path with optional :ro. A non-path source is treated as a named volume.
Text limitsRuntime source up to 512 characters, environment input up to 12,000, and healthcheck command up to 1,024.
Read-only rootEmits read_only: true; writable mounts remain writable unless their mount also uses :ro.

Security and Privacy Notes:

Compose YAML is generated locally, but copied or downloaded artifacts can contain sensitive values and host paths.

  • The environment-reference option replaces secret-like values in the YAML with ${KEY}, but the adjacent environment example contains the values that were entered. Protect it and do not commit real secrets.
  • Secret-like detection is based on key names such as password, token, secret, API key, private key, credential, database URL, and auth. A sensitive value under an unusual key may not be detected.
  • Public port binding can expose a service beyond the local machine. Confirm host firewall, application authentication, and intended listeners.
  • A writable bind mount gives the container write access to the selected host path. Use a narrow path and read-only mode when writes are unnecessary.
  • Run the generated service with the least privilege and resource limits required by the real workload; those controls are outside this single-service draft.

Common Mistakes:

  • Using latest for a release: a later pull can change the image unexpectedly. Use a controlled version tag or digest.
  • Publishing a development port publicly: omitting 127.0.0.1 binds on every interface. Keep localhost scope unless remote access is intentional.
  • Assuming ${KEY} stores a secret: it only requests interpolation. Supply the value through a protected runtime path.
  • Adding a healthcheck command not present in the image: the container becomes unhealthy even when the application works. Test the command inside that image.
  • Enabling a read-only root without writable storage: applications that write caches, temporary files, or state may fail. Mount only the paths that truly need writes.

References: