Compliance
Audit-ready scanning for self-hosted Docker
Cloud-native compliance tools automate evidence collection via SaaS APIs — but they can't see inside a self-hosted Docker box on a VPS. Keelix runs on the box itself, maps every deterministic check to CIS Docker Benchmark, SOC 2 TSC, and ISO 27001, and produces a shareable scan record your auditor can read.
No account required for the CLI. No secrets leave the box. The posture score is computed locally, and the compliance evidence is yours to export, archive, and share.
Compliance resources
- CIS Docker Benchmark scanner →Run the full CIS Docker Benchmark automatically and get a scored, shareable audit report — not just raw pass/warn/fail log lines.
- SOC 2 evidence for Docker →Vanta and Drata automate evidence via cloud APIs but miss the self-hosted Docker box. Keelix scans the whole server and exports SOC 2-mapped, traceable evidence.
- Control mapping — CIS, SOC 2, ISO 27001 →Every deterministic Keelix check maps to one or more controls across CIS, SOC 2 TSC, and ISO 27001. Assess once, report against multiple frameworks.
- Automated compliance scan for self-hosted servers →The middle ground between raw DIY CLIs (Lynis, OpenSCAP, CIS-CAT) and pricey SaaS GRC — framework-mapped scoring, a hosted logbook, and coverage for containers and AI agents.
- CIS compliance gate for GitHub Actions →Run CIS/SOC 2/ISO 27001 checks as a CI gate and block merges on sub-threshold posture — one purpose-built action instead of stitched-together Dockle + Grype + kube-bench.
Related
Generate your first compliance scan record.
Free CLI, Apache-2.0. Runs locally — nothing leaves the box. CIS/SOC 2/ISO 27001 evidence in minutes.
operator@host — keelix
# install — free & open source (Apache-2.0)
$ curl -fsSL https://keelix.dev/install.sh | sh
$ keelix scan