# instancse

> instancse is a free, 100% client-side Docker Compose preflight linter, security inspector, and one-click configuration hardening tool.

## Key Facts
- Website: https://instancse.com
- Primary Purpose: Inspects Docker Compose configurations before deployment to catch security vulnerabilities, reliability defects, and configuration errors.
- Execution Environment: 100% client-side in the browser. Zero telemetry, zero external network requests, zero credential leaks.
- Supported Specifications: Docker Compose Specification v2+ and legacy docker-compose v3.

## Core Preflight Rules
- SEC-001 (Critical): Plaintext Secrets Detection in environment variables. Extracts to .env template.
- SEC-002 (Critical): Dangerous 'privileged: true' Container Mode that disables Linux container isolation.
- SEC-003 (Critical): Host Docker Socket Bind Mount (/var/run/docker.sock) manipulation risk.
- SEC-004 (Warning): Unrestricted Sensitive Ports (Redis 6379, Postgres 5432, MySQL 3306, MongoDB 27017, Elasticsearch 9200) exposed to 0.0.0.0. Recommends binding to 127.0.0.1.
- REL-001 (Warning): Missing Container Restart Policy (restart: unless-stopped).
- REL-002 (Warning): Floating or ':latest' Image Tags causing unpredictable deployment breakage.
- REL-003 (Warning): Host Port Collisions across multiple services.
- OPS-001 (Info): Database Missing Healthcheck definition for depends_on orchestration.
- OPS-002 (Info): Missing Timezone (TZ) variable in container logs.
- OPS-003 (Info): Deprecated Top-Level 'version' Attribute in modern Compose.
- OPS-004 (Warning): Stateful Database Running Without Persistent Volumes.

## Automated Fixes
- Auto-Hardened YAML generation with single-click editor replacement.
- Automatic .env secret extraction and credential decoupling.
- Visual line-by-line unified diff between original and hardened configurations.
- Direct conversion of 'docker run' CLI commands into Docker Compose format.