Skip to content

What ironctl scan can grade

One tool, one grade, many inputs. ironctl scan reads a container's real isolation posture and returns a 0–100 score with a letter grade, from a running container down to the infrastructure-as-code that will one day launch it. Every mode below runs read-only, needs no account, and prints the exact flags that close the gap.

The modes are grouped by the artifact you already have — a live container, an orchestrator manifest, a cloud runtime spec, or the infrastructure-as-code that defines it. Jump to your category, then copy one command.

Containers & images

The container in front of you, whatever runtime launched it, and the Dockerfile that builds it.

  • Running container

    Audits any live OCI container (Docker, Podman, nerdctl, containerd): user, capabilities, seccomp, rootfs, network, privilege, and mounts.

    ironctl scan my-container

    Scan reference

  • Alternate runtimes

    Same grade for Podman, nerdctl, and containerd. Auto-detected by default; force one with --runtime when a host runs several.

    ironctl scan --runtime podman my-container

    Supported runtimes

  • Dockerfile (static)

    Grades authoring-time posture straight from a Dockerfile — no daemon, no build. Catches USER root, missing drops, and writable layers in CI.

    ironctl scan --dockerfile Dockerfile

    Grade a Dockerfile statically

Compose & orchestrators

Declared workloads, before you ever run up, apply, or job run. Multi-workload inputs roll up to the weakest workload they produce.

  • Docker Compose

    Grades one service in a docker-compose.yml from its declared config, before you ever run up. Point --service at the workload you care about.

    ironctl scan --compose docker-compose.yml --service web

    Scan reference

  • Kubernetes manifest

    Grades the pod spec in a Kubernetes YAML (securityContext, caps, host namespaces) so a weak manifest fails review, not production.

    ironctl scan --k8s pod.yaml

    Scan reference

  • Helm chart

    Renders a chart with helm template (directory or .tgz) and grades the weakest workload it produces, so a chart is safe before it is installed.

    ironctl scan --helm ./chart

    Scan reference

  • Kustomize overlay

    Renders an overlay with kustomize build (or kubectl kustomize) and grades the weakest workload it produces, so a patched overlay is graded before it hits a cluster.

    ironctl scan --kustomize ./overlays/prod

    Grade a kustomization

  • Nomad job

    Grades the docker-driver tasks in a HashiCorp Nomad job spec and rolls up to the weakest task, so a job is graded before nomad job run.

    ironctl scan --nomad job.nomad

    Scan reference

  • OpenShift manifest

    Grades an OpenShift manifest set (DeploymentConfig, Deployment, Pod). A DeploymentConfig embeds a standard pod spec, so it reuses the k8s scorer and rolls up to the weakest workload.

    ironctl scan --openshift ./manifests

    Scan reference

Cloud runtimes

Managed container runtimes, graded from their service or task spec — no cloud account, no API call.

  • Google Cloud Run

    Grades a Cloud Run service's container config straight from its Knative Service YAML (gcloud run services describe --format=export), no Google account needed.

    ironctl scan --cloudrun svc.yaml

    Grade a Cloud Run service

  • Amazon ECS

    Grades an ECS task definition's container contract from a live or registered describe-task-definition, no AWS call needed. Rolls up to the weakest container.

    ironctl scan --ecs taskdef.json

    Grade an ECS task definition

  • Azure Container Instances

    Grades the Microsoft.ContainerInstance/containerGroups in an ARM template or az container show JSON with the managed-runtime model, rolling up to the weakest container in the group.

    ironctl scan --azure containergroup.json

    Grade an Azure container group

  • AWS App Runner

    Grades an App Runner service from its aws apprunner describe-service JSON with the managed-runtime model. App Runner exposes no securityContext, so it grades honestly on its Fargate/Firecracker floors.

    ironctl scan --app-runner service.json

    Grade an App Runner service

Infrastructure-as-Code

The code that will one day launch the container, graded before it deploys. Container workloads roll up to the weakest one the code defines.

  • Terraform plan

    Grades container workloads in a terraform show -json plan or state (Kubernetes and ECS task resources), or point it at a directory and it runs the plan for you.

    ironctl scan --terraform plan.json

    Grade a Terraform plan

  • CloudFormation template

    Grades every AWS::ECS::TaskDefinition in a CloudFormation template (YAML or JSON) and rolls up to the weakest, so a template is graded before the stack deploys.

    ironctl scan --cloudformation template.yaml

    Grade a CloudFormation template

  • Pulumi program

    Grades the container workloads in a pulumi stack export or pulumi preview --json (Kubernetes and ECS resources) with the same scorers as --k8s and --ecs, rolling up to the weakest workload, so a program is graded before pulumi up.

    ironctl scan --pulumi stack.json

    Grade a Pulumi program

  • Azure Bicep template

    Compiles a .bicep file (or a directory of them) to ARM with bicep build and grades the Microsoft.ContainerInstance/containerGroups it declares, reusing the --azure ACI path and rolling up to the weakest container, so a template is graded before az deployment.

    ironctl scan --bicep main.bicep

    Grade an Azure Bicep template

  • AWS CDK app

    Synthesizes a CDK app with cdk synth (or grades a pre-synthesized template / cdk.out) and grades every AWS::ECS::TaskDefinition it emits, reusing the --cloudformation scorer and rolling up to the weakest container, so an app is graded before cdk deploy.

    ironctl scan --cdk ./my-cdk-app

    Grade an AWS CDK app

  • AWS SAM template

    Grades the AWS::ECS::TaskDefinition resources declared in an AWS SAM template (Transform: AWS::Serverless-*), reusing the --cloudformation scorer and rolling up to the weakest container. SAM is a CloudFormation superset, so no sam build step is needed to grade a serverless app's ECS/Fargate task definitions.

    ironctl scan --sam ./template.yaml

    Grade an AWS SAM template

Enforce & generate

The cards above answer what can I point scan at. These three answer what scan does past the grade: it becomes the gate, writes the guardrail, or fails the build. Same seven-dimension scorer, now wired into admission control instead of a scorecard.

  • Admission gate

    Turns scan into an in-cluster enforcement gate. Grades the workload in a Kubernetes AdmissionReview through the same pod-spec scorer and gates admission on --min-score; --admission-response emits the allow/deny JSON a ValidatingWebhook returns. Fail-closed.

    ironctl scan --k8s-admission - --admission-response --min-score 80

    Grade a Kubernetes AdmissionReview

  • Policy generator

    Flips scan from grading a manifest to writing the guardrail. --emit-policy turns every control the manifest failed into ready-to-apply Kyverno ClusterPolicy or Gatekeeper ConstraintTemplate YAML, one Enforce rule per gap, so the cluster blocks the exact delta to 100/A.

    ironctl scan --k8s pod.yaml --emit-policy=kyverno | kubectl apply -f -

    Generate an admission policy

  • Policy-as-code gate

    Closes the loop: --check evaluates the manifest against the rules --emit-policy would generate and exits non-zero on any violation — a self-contained CI gate with no cluster and no controller. Same dim→rule map as the generator, enforced in place. Pair with --md/--sarif for PR diagnostics.

    ironctl scan --k8s pod.yaml --check --sarif check.sarif

    Gate a manifest in CI

Every mode, one engine

Every card above feeds the same seven-dimension scorer. The input changes; the grade, the letter, and the --fix remediation do not. That means a Compose file, a Helm chart, and the container they eventually produce are all measured on one comparable scale.

Category Input Flag What it reads Deep dive
Containers & images Running container (positional) live docker inspect of any OCI container Scan reference
Containers & images Alternate runtimes --runtime Podman / nerdctl / containerd Supported runtimes
Containers & images Dockerfile --dockerfile authoring-time posture, no daemon Grade a Dockerfile statically
Compose & orchestrators Docker Compose --compose --service a service's declared config Scan reference
Compose & orchestrators Kubernetes manifest --k8s a pod spec's securityContext Scan reference
Compose & orchestrators Helm chart --helm weakest workload from helm template Scan reference
Compose & orchestrators Kustomize overlay --kustomize weakest workload from kustomize build Grade a kustomization
Compose & orchestrators Nomad job --nomad docker-driver tasks in a job spec Scan reference
Compose & orchestrators OpenShift manifest --openshift weakest workload (DeploymentConfig/Deployment/Pod) Scan reference
Cloud runtimes Cloud Run --cloudrun a Knative Service's container config Grade a Cloud Run service
Cloud runtimes Amazon ECS --ecs a task definition's container contract Grade an ECS task definition
Cloud runtimes Azure Container Instances --azure weakest container in an ARM containerGroups Grade an Azure container group
Cloud runtimes AWS App Runner --app-runner a service's managed-runtime posture Grade an App Runner service
Infrastructure-as-Code Terraform plan --terraform container workloads in a plan/state Grade a Terraform plan
Infrastructure-as-Code CloudFormation --cloudformation ECS task defs in a CFN template Grade a CloudFormation template
Infrastructure-as-Code Pulumi program --pulumi K8s & ECS workloads in stack-export / preview JSON Grade a Pulumi program
Infrastructure-as-Code Azure Bicep template --bicep weakest containerGroups container, compiled to ARM Grade an Azure Bicep template
Infrastructure-as-Code AWS CDK app --cdk weakest ECS container, synthesized to CloudFormation Grade an AWS CDK app
Infrastructure-as-Code AWS SAM template --sam ECS task defs in a SAM (Serverless) template Grade an AWS SAM template
Enforce & generate Admission gate --k8s-admission --admission-response the workload in an AdmissionReview (webhook backend) Grade a Kubernetes AdmissionReview
Enforce & generate Policy generator --k8s --emit-policy failed controls → Kyverno/Gatekeeper admission YAML Generate an admission policy
Enforce & generate Policy-as-code gate --k8s --check the manifest against the rules --emit-policy would generate; non-zero on violation Gate a manifest in CI

Every mode also emits the machine-readable outputs: a SARIF log for GitHub code scanning, a shields.io badge, and --fix remediation.

Start with what you have

# install (Homebrew)
brew install ironsecco/ironclaw/ironclaw

# grade the surface in front of you, then print the exact hardening flags
ironctl scan my-container
ironctl scan my-container --fix

Keep going