Compliance scanning for self-hosted servers.
Lynis audits the host. CIS-CAT Pro requires a paid membership. OpenSCAP requires SCAP content expertise. None of them cover the Docker daemon, running containers, internet exposure, or the AI agents on the same box. Keelix fills the gap — framework-mapped scoring, a hosted evidence logbook, and a 0–100 posture score you can gate CI on.
The gap between DIY CLIs and enterprise GRC
The self-hosted compliance problem has two unsatisfying ends. On one side: open-source CLIs — Lynis, OpenSCAP, CIS-CAT Lite — that run a point-in-time audit, print findings to stdout, and leave you to cross-reference controls, weigh severity, and produce your own evidence trail. On the other: enterprise GRC platforms that connect to cloud APIs and know nothing about the VPS running your Docker stack.
The missing layer is a tool that runs on the box itself, covers the full surface — host, containers, exposure, and the AI agents you added last quarter — maps every finding to the frameworks your auditor cares about, and stores a logbook you can export on demand. That is what Keelix does.
What each tool actually covers
| Surface | Lynis | OpenSCAP | CIS-CAT Lite | Keelix |
|---|---|---|---|---|
| Host OS configuration | ✓ | ✓ | ✓ | ✓ |
| Docker daemon + CIS Docker Benchmark | Partial | — | Limited | ✓ |
| Container runtime settings | — | — | — | ✓ |
| Outside-in port exposure | — | — | — | ✓ |
| AI-agent / MCP posture | — | — | — | ✓ |
| SOC 2 / ISO 27001 mapping | Enterprise only | Manual | Pro only ($$$) | ✓ built-in |
| Numeric posture score | Hardening index | — | % compliant | 0–100 |
| Scan history / evidence logbook | Enterprise only | — | Pro only | ✓ Keelix Cloud |
| CI gate (exit code + threshold) | — | — | — | ✓ |
| Cost | Free / Enterprise | Free | Free (limited) / $$$ | CLI free |
Lynis and OpenSCAP are excellent tools for host-OS hardening. Keelix is complementary — it adds container, exposure, and AI-agent coverage on top.
Framework-mapped findings, not just a log
Every finding Keelix emits carries three identifiers: the CIS Docker Benchmark control it corresponds to, the SOC 2 Trust Service Criterion it maps to (CC6, CC7, A1, and so on), and the ISO 27001 Annex A control. A single scan serves the CI gate and the auditor.
That crosswalk matters because auditors do not accept a raw log. They want a control mapped to evidence, a date, and a signature. Keelix Cloud stores a timestamped, signed record of every scan. When your SOC 2 auditor asks for evidence that your Docker configuration controls were operating continuously, you export the logbook — not a manually assembled spreadsheet.
CIS Docker Benchmark
Host config, Docker daemon settings, container runtime controls (capabilities, privilege mode, seccomp/AppArmor, resource limits). Automated where deterministic in a compose-stack context.
SOC 2 TSC
Each finding maps to a Trust Service Criterion (CC, A, PI, C, P categories). Keelix Cloud exports a dated evidence package formatted for a SOC 2 readiness review.
ISO 27001 Annex A
Controls from A.8 (Technology), A.12 (Operations), and A.13 (Communications) are covered by the automated surface checks. The same scan result maps to all three frameworks.
See the full CIS → SOC 2 → ISO 27001 control crosswalk for the complete mapping.
The surface Lynis and OpenSCAP don't reach
Lynis audits the host and can run inside a container, but it does not grade the Docker daemon configuration or container runtime settings from the outside — capabilities drops, seccomp profiles, privilege mode, read-only filesystem flags. OpenSCAP applies SCAP content against the OS and produces a machine-readable result, but it has no Docker-specific SCAP profile and no concept of internet exposure.
Neither tool knows whether one of your container ports is reachable from the open internet because Docker's iptables rules bypassed UFW. Neither grades the MCP server your team wired to Claude Code last week that auto-approves every tool call with a plaintext API key in the config file.
That is the attack surface that matters for a self-hosted box in 2026. Keelix grades it deterministically — same input, same verdict, every run — and folds it into the same posture score and compliance report.
New to the AI-agent risk surface? Read the MCP security overview, or see how Docker port exposure bypasses UFW.
Run as a CI gate — not just a manual check
The difference between a compliance check and a compliance gate is the exit code. Lynis exits 0 regardless of findings. OpenSCAP can return a non-zero exit when checks fail, but wiring that into a practical CI threshold — block the deploy if posture drops below 75 — requires a custom wrapper and manual control selection.
Keelix is built for the gate pattern. The binary exits non-zero on any critical finding or when the posture score drops below your threshold. The GitHub Action wires this into a promote-to-production step with one YAML block.
- name: Keelix compliance gate
uses: jakelamon/keelix@v0.1.0
with:
compose: docker-compose.yml
threshold: 80
report: html
- name: Upload compliance report
if: always()
uses: actions/upload-artifact@v4
with:
name: keelix-compliance-report
path: ${{ runner.temp }}/keelix-report.htmlSee the GitHub Action reference for the full inputs list and a complete workflow example.
Frequently asked
- What is a compliance scan for a self-hosted server?
- A compliance scan checks your server's configuration against a security framework — CIS Benchmarks, SOC 2 Trust Service Criteria, or ISO 27001 Annex A controls — and produces a finding report you can act on and present to auditors. For self-hosted Docker environments the scan should cover the host OS, the Docker daemon, running containers, open ports, and (increasingly) any AI agents or MCP servers on the box. Most tools only cover part of that surface.
- Is Lynis a compliance scanner?
- Lynis audits host-level configuration — kernel settings, file permissions, authentication config, and system hardening posture — and produces a prioritized finding list with a hardening index score. It is an excellent host auditor. What it does not do: score container-level Docker Benchmark controls, map findings to SOC 2 Trust Service Criteria automatically, scan for AI-agent or MCP server risks, or store a scan history you can export as audit evidence. Compliance mapping and scan history require Lynis Enterprise, a paid tier. [CISOfy — Lynis ↗]
- What about OpenSCAP and CIS-CAT?
- OpenSCAP applies SCAP content — XCCDF/OVAL profiles — against the host and produces a machine-readable result. It is powerful for OS-level hardening on RHEL/CentOS but requires SCAP content authoring experience for anything beyond standard profiles. CIS-CAT Pro provides automated CIS Benchmark assessment with compliance reporting, but access requires a paid CIS SecureSuite membership — pricing is not published and requires a quote from CIS. Neither tool covers the Docker daemon configuration, container runtime settings, outside-in port exposure, or AI-agent MCP posture as a unified score. [CIS — CIS-CAT Pro ↗]
- Can Keelix replace my existing compliance scanner?
- Keelix is best understood as the missing layer between a host auditor and a full GRC platform: it scores host + containers + exposure + AI-agent posture in a single 0–100 number mapped to CIS, SOC 2, and ISO 27001 controls, stores a timestamped evidence logbook in Keelix Cloud, and exports audit-ready reports. It is not a SIEM and it does not replace organizational policy documentation. For deep OS-level SCAP auditing or wide-estate scanning, Keelix and OpenSCAP/Lynis are complementary.
- How do I run a compliance scan on a Docker server?
- Install Keelix with `curl -fsSL https://keelix.dev/install.sh | sh`, then run `keelix scan` on the host. Keelix audits the host OS configuration, Docker daemon settings, container runtime (capabilities, privilege mode, seccomp/AppArmor, resource limits), port exposure from the outside in, and any MCP servers or AI agents present — then maps every finding to a CIS, SOC 2, or ISO 27001 control and rolls it into a single posture score. The whole scan runs locally; nothing leaves your box.
Related
Run your first compliance scan in under two minutes.
Free, local-first, Apache-2.0. Framework-mapped. Nothing leaves your box.