docker compose contract audit derived

{
  "input": {
    "body": {
      "compose": "services:\n  api:\n    image: ghcr.io/example/api:latest\n    ports:\n      - \"8080:8080\"\n    volumes:\n      - cache:/var/cache\n    depends_on:\n      db:\n        condition: service_healthy\n    environment:\n      MODE: production\n      LOG_LEVEL: debug\n  worker:\n    image: ghcr.io/example/worker:1.4.0\n    ports:\n      - published: 8080\n        target: 9000\n    environment:\n      - SECRET_KEY\n      - MODE=production\n  db:\n    image: postgres:16\n    volumes:\n      - /var/lib/postgresql/data:/var/lib/postgresql/data\n",
      "environment_names": [
        "MODE",
        "DATABASE_URL"
      ]
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxFindings": 500,
        "maxYamlBytes": 262144,
        "maxDockerfileBytes": 131072,
        "maxDockerfileLines": 4000
      },
      "passed": false,
      "complete": true,
      "findings": [
        {
          "code": "IMAGE_TAG_IS_LATEST",
          "detail": "api uses the latest tag, so a rebuild on another day runs different code.",
          "location": "services.api"
        },
        {
          "code": "NAMED_VOLUME_NOT_DECLARED",
          "detail": "api mounts the named volume cache and the top-level volumes section does not declare it.",
          "location": "services.api"
        },
        {
          "code": "HEALTHY_CONDITION_WITHOUT_HEALTHCHECK",
          "detail": "api waits for db to be healthy and db declares no healthcheck, so the condition can never be satisfied.",
          "location": "services.api"
        }
      ],
      "services": [
        {
          "service": "api",
          "dependency_count": 1,
          "declares_healthcheck": false,
          "published_port_count": 1
        },
        {
          "service": "worker",
          "dependency_count": 0,
          "declares_healthcheck": false,
          "published_port_count": 1
        },
        {
          "service": "db",
          "dependency_count": 0,
          "declares_healthcheck": false,
          "published_port_count": 0
        }
      ],
      "conformant": false,
      "request_id": "example-request",
      "service_id": "docker_compose_contract_audit",
      "assumptions": [
        "Both the short string syntax and the long mapping syntax are read for ports and volumes, because a real file mixes them and reading only one would miss half the collisions.",
        "A depends_on with no condition is reported because Compose then waits for the container to start rather than for the process inside it to be ready, which is the difference behind most intermittent sta...",
        "An environment entry with no value is reported because it is taken from the host and the file does not say what it will be. No value is ever echoed."
      ],
      "limitations": [
        "The Compose file supplied. Profiles, overrides from a second file, and .env substitution are outside this, so a value interpolated at run time is absent here.",
        "conformant is true only when the file parsed and every check that ran found nothing."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "finding_count": 8,
      "service_count": 3,
      "service_version": "1.0.0",
      "findings_by_code": {
        "HOST_PORT_COLLISION": 1,
        "IMAGE_TAG_IS_LATEST": 1,
        "ABSOLUTE_HOST_PATH_MOUNT": 1,
        "NAMED_VOLUME_NOT_DECLARED": 1,
        "ENVIRONMENT_INHERITED_FROM_HOST": 1,
        "ENVIRONMENT_NAME_NOT_IN_CONTRACT": 2,
        "HEALTHY_CONDITION_WITHOUT_HEALTHCHECK": 1
      },
      "published_host_ports": [
        "8080/tcp"
      ],
      "declared_volume_count": 0,
      "declared_network_count": 0
    }
  }
}