Docker Compose Validator

The validator checks for common docker-compose.yml issues: missing required keys (services, image/build per service), broken depends_on references, hardcoded secrets in environment variables, :latest image tags, privileged port usage, YAML tab characters, and missing restart policies.

Yes. The validator works with Compose file format v2 and v3.x. It will warn if you use v1 format (no version key) since that format is deprecated and unsupported by modern Docker Compose V2 (the plugin).

Using :latest means your container image version can change between pulls, making builds non-reproducible. If the upstream image is updated with a breaking change, your deployment may fail unexpectedly. Pin to a specific version like nginx:1.25 or postgres:15.3 for stability.

Use environment variable substitution (${MY_PASSWORD}) and provide values via a .env file or your CI/CD system's secret manager. For production, consider Docker Swarm secrets (docker secret) or external secrets managers like AWS Secrets Manager, Vault, or Kubernetes Secrets.

No. Validation runs entirely in your browser using JavaScript. Your docker-compose.yml content never leaves your machine. This is especially important since compose files may contain sensitive configuration.

depends_on only ensures the dependent container starts before yours — it does NOT wait for the service to be ready (e.g., database accepting connections). For readiness, use a health check with condition: service_healthy in depends_on, or a startup script like wait-for-it.sh.