✅

Compliance in a Box

(CIB)

Continuous compliance scanning for your Docker fleet. SBOMs, license checks, OS end-of-life tracking, and container policy — all scored, all in Grafana.

View on GitHub Documentation

Want this deployed and maintained for you? Review the engagement options

"Are we compliant?" is a question most teams can't answer without spending a week chasing spreadsheets. CIB runs four compliance checks against every image in your fleet — SBOM generation, license analysis, OS end-of-life tracking, container runtime policy — scores each image 0–100, and pushes the result to Grafana. You get an honest, live answer instead of an audit-prep panic.

⚡ Quick Start

git clone https://github.com/matijazezelj/cib.git && cd cib
cp .env.example .env
docker compose up -d

Open Grafana at http://localhost:3003 and watch your compliance posture light up.

🧠 How It Works

CIB walks your Docker fleet on a schedule, runs four independent compliance checks per image via Trivy, computes a per-image compliance score, and pushes everything to VictoriaMetrics. Grafana renders the fleet-level overview and per-image drill-downs.

The four checks run in parallel per image. Each contributes to the final score.

✅ The Four Compliance Checks

1. 📦 SBOM (Software Bill of Materials)

Trivy generates a CycloneDX SBOM for each image — every OS package, every language dependency, every version. CIB stores summary metrics (total packages, unique packages, components by ecosystem) and keeps the raw SBOM available for download.

Why it matters: regulators (NIS2, EU CRA, US EO 14028) increasingly require SBOMs on demand. CIB gives you one per image, automatically, every scan cycle.

2. ⚖️ License Compliance

Trivy detects licenses for every package in the image. CIB flags:

  • Copyleft licenses (GPL, AGPL, LGPL) that may force source disclosure
  • Configurable deny-list via LICENSE_DENY_LIST for licenses your legal team specifically prohibits
  • Unknown / unidentifiable licenses — often a bigger problem than known-bad ones

You get a per-image license inventory and a fleet-level “GPL surface area” view.

3. ⏳ OS End-of-Life Tracking

CIB extracts the base OS from each image and checks it against the endoflife.date API. You see:

  • Which images are running EOL or near-EOL base OSes (Alpine 3.15, Debian 9, Ubuntu 18.04, etc.)
  • Days until each base OS hits end-of-life
  • Fleet-wide EOL exposure as a single number

Most “supply chain risk” is just running images built on bases that stopped getting security updates two years ago. CIB makes that exposure obvious.

4. 🔒 Container Runtime Policy

For each running container, CIB checks five hardening basics:

Policy Pass condition
Non-root user Container runs as a non-zero UID
No privileged mode --privileged is not set
No host networking --network=host is not used
No host PID namespace --pid=host is not used
Read-only root filesystem --read-only is set

Each failed check costs the image points. Together they enforce the CIS Docker Benchmark’s most important runtime controls.

📈 Compliance Scoring

Each image gets a single score from 0 to 100:

  • 90–100 — Green. SBOM clean, licenses approved, OS supported, container hardened.
  • 70–89 — Yellow. Functional but with at least one notable gap (often an EOL base or a privileged flag you forgot to remove).
  • <70 — Red. Multiple compliance failures. Time to rebuild or refactor.

The score is computed deterministically from the four check results — you can see exactly what cost what in the per-image drill-down. No magic, no black-box AI rating, no vendor-defined “risk score” you can’t audit.

📊 Dashboard

The Grafana dashboard ships with two views:

Fleet Overview

  • Average compliance score across the fleet
  • Score distribution histogram (how many images at 90+, 70–89, <70)
  • License risk surface (GPL/AGPL/deny-listed counts)
  • EOL exposure (images on or near unsupported OSes)
  • Container policy failure rate per policy

Per-Image Drill-Down

  • Selected image’s score with check-by-check breakdown
  • Full package list from the SBOM
  • Detected licenses
  • Base OS and EOL date
  • Runtime policy pass/fail with the actual values

Filter by host, image, namespace, or score range.

🌐 Multi-Host Scanning

Same model as VIB — point CIB at multiple Docker daemons:

DOCKER_HOSTS=prod-web=tcp://10.0.1.10:2376,prod-db=tcp://10.0.1.20:2376

Or leave it empty to scan the local socket only. ADDITIONAL_IMAGES lets you include images that aren’t currently running (CI builds, on-deck releases, etc.) so they’re in compliance scope before deploy.

⚙️ Configuration

Variable Default Purpose
SCAN_INTERVAL_HOURS 6 How often to scan the fleet
STARTUP_SCAN true Run on container start
LICENSE_DENY_LIST GPL-2.0,GPL-3.0,AGPL-3.0 Comma-separated SPDX IDs that fail the license check
DOCKER_HOSTS (empty) name=tcp://host:port pairs; empty = local socket
ADDITIONAL_IMAGES (empty) Extra images to scan beyond what’s running
VICTORIAMETRICS_URL http://victoriametrics:8428 Where to push compliance metrics

Example: strict license posture

SCAN_INTERVAL_HOURS=4
LICENSE_DENY_LIST=GPL-2.0,GPL-3.0,AGPL-3.0,LGPL-3.0,SSPL-1.0,BUSL-1.1
ADDITIONAL_IMAGES=registry.internal/migrator:v3,registry.internal/oncall-runner:v1

👥 Who This Is For

  • DevSecOps teams who need defensible compliance evidence without buying a vendor compliance suite
  • Companies prepping for SOC 2 / ISO 27001 / NIS2 that need SBOMs and policy evidence on demand
  • Platform teams enforcing baseline container hardening across services
  • Homelabbers and small ops who want a real compliance score instead of vibes

Who This Is NOT For

  • Organizations that need formal audit attestations — CIB gives you evidence, not a stamped report
  • FedRAMP / DoD compliance hunters — you need certified tooling, not OSS
  • Teams that already pay for Anchore Enterprise or Snyk Cloud — same job, more thoroughness, more cost

🔗 Pairs Well With

  • VIB — vulnerabilities and compliance are different problems; you want both
  • PIB — certificate hygiene is the third leg of the security-baseline stool
  • XIB — deploy VIB + CIB + PIB together with one compose file

📄 License

Apache 2.0 License — use it, modify it, build on it.

Ready to find out where you actually stand?

View on GitHub

🚀 Need Help Getting Started?

Self-hosting is free and always will be. But if you'd rather have it deployed, configured, and maintained for you — I can help.

Discuss a hardened deployment Self-Host for Free