container compose contract audit derived

{
  "input": {
    "body": {
      "compose": {
        "services": {
          "db": {
            "image": "postgres:16.3",
            "cap_add": [
              "SYS_ADMIN"
            ],
            "volumes": [
              "/var/lib/postgresql:/var/lib/postgresql"
            ],
            "privileged": true,
            "network_mode": "host"
          },
          "api": {
            "image": "ghcr.io/example/api@sha256:0000000000000000000000000000000000000000000000000000000000000000",
            "restart": "unless-stopped",
            "volumes": [
              "./config:/etc/api:ro",
              "api-data:/var/lib/api"
            ],
            "environment": [
              "DATABASE_URL=${DATABASE_URL}",
              "LOG_LEVEL=info"
            ],
            "healthcheck": {
              "test": [
                "CMD",
                "curl",
                "-f",
                "http://localhost/health"
              ]
            }
          },
          "web": {
            "image": "nginx",
            "ports": [
              "80:80",
              "443:443"
            ],
            "depends_on": [
              "api",
              "cache"
            ],
            "environment": {
              "API_TOKEN": "not-a-real-token-0123456789abcdef",
              "NGINX_HOST": "example.test"
            }
          }
        }
      },
      "contract": {
        "required_services": [
          "web",
          "api",
          "cache"
        ],
        "forbid_host_path_mounts": true
      }
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxJobs": 200,
        "maxFindings": 500,
        "maxServices": 200,
        "maxResources": 2000,
        "maxVariables": 1000,
        "maxComponents": 5000,
        "maxDependencies": 5000
      },
      "passed": false,
      "complete": true,
      "findings": [
        {
          "code": "REQUIRED_SERVICE_MISSING",
          "detail": "cache is required and not declared.",
          "service": "cache"
        },
        {
          "code": "UNPINNED_IMAGE_TAG",
          "detail": "web uses nginx, so the same file will produce a different container once the tag moves.",
          "service": "web"
        },
        {
          "code": "HEALTHCHECK_MISSING",
          "detail": "web declares no healthcheck, so an orchestrator cannot tell started from ready.",
          "service": "web"
        }
      ],
      "services": [
        {
          "tag": "latest",
          "image": "nginx",
          "restart": null,
          "service": "web",
          "depends_on": [
            "api",
            "cache"
          ],
          "port_count": 2,
          "privileged": false,
          "healthcheck": false,
          "network_mode": null,
          "volume_count": 0,
          "digest_pinned": false,
          "host_mount_count": 0
        },
        {
          "tag": "0000000000000000000000000000000000000000000000000000000000000000",
          "image": "ghcr.io/example/api@sha256:0000000000000000000000000000000000000000000000000000000000000000",
          "restart": "unless-stopped",
          "service": "api",
          "depends_on": [],
          "port_count": 0,
          "privileged": false,
          "healthcheck": true,
          "network_mode": null,
          "volume_count": 2,
          "digest_pinned": true,
          "host_mount_count": 1
        },
        {
          "tag": "16.3",
          "image": "postgres:16.3",
          "restart": null,
          "service": "db",
          "depends_on": [],
          "port_count": 0,
          "privileged": true,
          "healthcheck": false,
          "network_mode": "host",
          "volume_count": 1,
          "digest_pinned": false,
          "host_mount_count": 1
        }
      ],
      "conformant": false,
      "request_id": "example-request",
      "service_id": "container_compose_contract_audit",
      "assumptions": [
        "An image with no tag is treated as latest, because that is what a runtime will do with it.",
        "An environment value written literally in the file is committed configuration; a value referencing a variable is not, and is not examined.",
        "Every finding describes what the document declares. What a runtime actually enforces is a different question and is not assessed."
      ],
      "limitations": [
        "Observable facts about the document supplied. No image is pulled, no container is run, and this is not a security assessment or a compliance determination.",
        "conformant is true only when every declared rule was evaluated and none failed."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "finding_count": 13,
      "service_count": 3,
      "service_version": "1.0.0",
      "findings_by_code": {
        "HOST_PATH_MOUNT": 2,
        "HOST_NETWORK_MODE": 1,
        "ADDED_CAPABILITIES": 1,
        "UNPINNED_IMAGE_TAG": 1,
        "HEALTHCHECK_MISSING": 2,
        "PRIVILEGED_CONTAINER": 1,
        "RESTART_POLICY_MISSING": 2,
        "DEPENDENCY_NOT_DECLARED": 1,
        "INLINE_SECRET_IN_COMPOSE": 1,
        "REQUIRED_SERVICE_MISSING": 1
      },
      "examined_service_count": 3
    }
  }
}