CrateVet BETA
Beta / experimental. Free while in beta. Feedback welcome. No guarantee of revenue or results.
Vet your Dockerfile before you ship — root containers, secrets baked into image layers, and unpinned base images.
Get the free beta by email Get a launch audit Send feedback How it works
What it does
Runs a deterministic, local-first, read-only scan over your project's Dockerfile (and the .dockerignore beside it) and returns a verdict (SHIP-SAFE / NEEDS REVIEW / RISKY), a 0-100 score, severity counts, evidence for every finding, and a Claude-ready fix prompt per issue, in JSON, Markdown, and HTML. It catches the container-build hygiene problems AI-built projects ship with — a credential baked into an ENV/ARG layer, an image that runs as root, a base image on the moving 'latest' tag or with no digest, a remote ADD https:// or a curl | sh in a RUN, chmod 777, sudo in a build, apt-get upgrade and un-cleaned apt layers, ADD where COPY belongs, COPY . with no .dockerignore, an EXPOSE of a sensitive admin port, and a runnable image with no HEALTHCHECK. Runs entirely on your machine with zero runtime dependencies: it never builds an image, never runs a RUN/CMD step, never networks. No cloud, no account, no telemetry.
Who it's for
Indie founders, AI-app builders, and small agencies who containerize a project to deploy it and want a fast, honest check that the image is least-privilege, reproducible, and free of baked-in surprises — before they build, push, or deploy it.
What it does NOT do
Reports Dockerfile / container-build hygiene signals, not guarantees. It is NOT a container / image vulnerability (CVE) scanner — it does not inspect the installed OS/package versions inside the built image or whether they are exploitable — NOT a runtime / cluster / Kubernetes hardening audit, and NOT a security guarantee or certification. It never builds an image, never runs your RUN/CMD/ENTRYPOINT, never reaches the network, never deploys or pushes to a registry, never touches DNS or hosting, never reads or transmits real secrets (secret-looking values are redacted to [REDACTED]), and never crosses an owner manual gate. Single-Dockerfile, heuristic scope: it does not resolve ARG-templated base images or follow COPY --from across external images.
How to try it
Request free beta access via the feedback form, then run it locally on Node: scan a bundled demo (node src/scan.mjs --demo bad or --demo good), point it at your own project folder, or open the local-only dashboard at 127.0.0.1 — no account or payment required.
What CrateVet checks
- A credential baked into an image layer via ENV/ARG/RUN (the value is redacted to [REDACTED])
- An image that runs as root because no non-root USER is set (or USER is reset to root)
- A base image on the moving 'latest' tag (or no tag), and a base not pinned to an immutable @sha256 digest
- A remote 'ADD https://...' fetch and a 'curl ... | sh' piped into a shell inside a RUN
- chmod 777 (world-writable files) and sudo used inside a build step
- apt-get upgrade / dist-upgrade in the build (non-reproducible), and apt installs without --no-install-recommends / without cleaning the lists
- ADD used where COPY belongs, and COPY . copying the entire build context
- No .dockerignore beside a Dockerfile that copies from the context (risks .git/.env/secrets in the image)
- EXPOSE of a sensitive admin port (SSH/telnet/RDP/Docker daemon)
- A runnable image (CMD/ENTRYPOINT) with no HEALTHCHECK
How it works
- Point CrateVet at your project folder (or a bundled demo). It reads the Dockerfile and the .dockerignore beside it read-only — your source never leaves your machine, and nothing is built or executed.
- A deterministic check engine runs 15 heuristic checks across Secrets, Privilege, Base image, Supply chain, Build hygiene, Footprint, and Runtime, and scores the result into SHIP-SAFE / NEEDS REVIEW / RISKY with a 0-100 score and severity counts, with all evidence redacted.
- Every finding includes evidence, its area, and a copy-ready Claude fix prompt that tells a Claude Code session exactly what to fix — and what not to do (no image build/push from untrusted bases, no deploy, stop at any owner manual gate).
Known limitations
- Experimental beta — checks and scoring may change or miss things.
- Dockerfile / container-build hygiene signals only — NOT a container/image vulnerability (CVE) scan, a runtime/cluster hardening audit, or a security guarantee, and no guaranteed results.
- Single-Dockerfile, heuristic scope: no ARG-templated base resolution, no COPY --from external-image tracking, no Compose discovery; not yet reviewed for production use.
Changelog
- 2026-06-25 — Beta candidate created: local-first Dockerfile / container-build hygiene audit engine (15 heuristic checks), CLI scan, JSON/MD/HTML reports, local-only dashboard, risky/clean demo fixtures, and 13 unit tests. Owner review required before promotion.
Try CrateVet free while it's in beta
CrateVet is free while in beta. Run it on your own Dockerfile, then tell us whether the SHIP-SAFE / NEEDS REVIEW / RISKY verdict matched reality and what it missed — no account, no payment, and no guarantee of results.
Built by Everstead Labs LLC. Live on Shopify: LaunchLock and CatalogCare.