SOC 2 evidence for Docker Vanta can't collect.
Vanta and Drata connect to cloud APIs — AWS, GCP, Okta, GitHub. They do not have a native integration for the self-hosted Linux VPS where your Docker stack actually runs. Keelix scans the whole box and exports a control-mapped, audit-ready evidence package — free CLI, nothing leaves your server.
The self-hosted blind spot in compliance automation
Compliance automation platforms are excellent at what they connect to. Vanta pulls your AWS Security Hub findings, checks your GCP project settings, reads your Okta access logs, and monitors your GitHub branch protections. For a cloud-native stack those integrations cover a large fraction of your controls.
The problem is the server that doesn't live inside AWS or GCP. The VPS where you run Docker Compose. The bare-metal box that hosts your internal tooling. The self-hosted server that runs AI agents and MCP servers. None of those are reachable via a cloud provider API, and Vanta's integration list does not include a native agent for them.
The result: your compliance dashboard says 80% automated — but the infrastructure your customers' data actually touches is in the 20% that requires manual evidence collection and a spreadsheet.
What your auditor asks for
A SOC 2 audit is evidence-based. For your Docker infrastructure, the auditor will want to see that specific controls were operating continuously — not just at audit time. The relevant controls map directly to the kind of checks Keelix runs.
| TSC Control | What the auditor wants | Keelix check |
|---|---|---|
| CC6.1 | Network access controls at system boundary — firewall rules, port exposure | Outside-in port scan; Docker daemon API exposure; binding to 0.0.0.0 vs 127.0.0.1 |
| CC6.8 | Protection against malicious software; approved software only in production | Container image provenance; CIS runtime checks (capability drops, seccomp, AppArmor) |
| CC7.1 | Configuration drift detection; regular vulnerability scanning with documented results | CIS Docker Benchmark checks; CVE scan on images; host config audit |
| CC7.2 | Anomaly detection; documented monitoring procedures for security events | MCP auto-approval; plaintext secrets in AI agent config; lethal trifecta check |
Each Keelix finding in the scan report carries its TSC control mapping. The report is formatted to attach directly to an evidence request — no translation layer, no spreadsheet.
Vanta and Drata: what they cover and what they miss
This is not a knock on Vanta or Drata. Both are excellent at what they do. The honest picture for a self-hosted deployment is this:
- Cloud provider config (AWS, GCP, Azure)
- Identity provider access logs (Okta, Google)
- Version control branch protections (GitHub, GitLab)
- Endpoint MDM status (Jamf, Kandji, Intune)
- SaaS tooling (Jira, Slack, Zoom, 1Password)
- Vendor risk assessments
- Docker daemon configuration and CIS checks
- Container runtime settings (capabilities, seccomp)
- Port exposure — what's actually reachable from outside
- Host firewall and kernel settings
- AI agents and MCP server configuration
- Continuous evidence history for a self-hosted box
Vanta's Private Integrations API lets you build a custom connector — but that is engineering work you have to spec, build, maintain, and validate against audit requirements. Keelix is the purpose-built answer to that gap: it runs on the box, checks the controls the auditor asks for, and produces the evidence.
The evidence workflow
Keelix does not replace Vanta or Drata — it fills the gap they leave on your self-hosted infrastructure. The workflow looks like this:
Run keelix scan on your Docker host
The CLI runs locally — no agent to install, no account required for the free tier. It performs the full CIS Docker Benchmark check, scans port exposure from outside-in, and audits AI-agent/MCP configuration. Takes under two minutes on a typical VPS.
Review the control-mapped report
Every finding in the report carries its TSC control mapping (CC6.1, CC6.8, CC7.1, CC7.2), a severity, and a remediation action. The report is available as HTML, JSON, or the human-readable scan record format. Human-readable is designed to attach to an auditor evidence request.
Gate CI on the posture score
Add `uses: jakelamon/keelix@v0.1.0` to your GitHub Actions workflow. The action runs after deploy-to-staging and blocks promote-to-production if any critical finding is present or the posture score falls below your threshold. The gate exit code is machine-readable (0 = cleared, 1 = failed).
Keelix Cloud: the continuous evidence logbook
Keelix Cloud stores each scan result as a timestamped, tamper-evident record. You can compare posture across deploys, demonstrate remediation progress, and export a dated evidence package for a SOC 2 readiness review or audit request — the continuous operating evidence that distinguishes a passing audit from a one-time snapshot.
SOC 2 gate in CI — one step
Add the Keelix GitHub Action after your staging deploy. It runs the full control-mapped posture check, writes a report with TSC mappings, and exits non-zero on any critical finding. The compliance evidence for the deploy is captured automatically — no manual collection step.
- name: Keelix SOC 2 posture gate
uses: jakelamon/keelix@v0.1.0
with:
compose: docker-compose.yml
threshold: 80
report: html
- name: Upload SOC 2 evidence
if: always()
uses: actions/upload-artifact@v4
with:
name: keelix-soc2-evidence
path: ${{ runner.temp }}/keelix-report.htmlThe HTML report maps each finding to its TSC control number — ready to attach to a SOC 2 evidence package. See the full GitHub Action reference for the complete inputs list.
Frequently asked
- Does Vanta scan a self-hosted Docker server?
- Vanta does not natively integrate with self-hosted Linux VPS or bare-metal Docker hosts. Its integrations list covers cloud provider APIs (AWS, GCP, Azure), identity providers (Okta), version control (GitHub), and SaaS tooling. For infrastructure outside those categories, Vanta recommends building a custom private integration via its API — which requires your own engineering effort. There is no out-of-the-box agent that scans Docker daemon config, container runtime settings, or port exposure on a self-hosted server. [Vanta — Integrations ↗]
- Does Drata cover self-hosted Docker infrastructure?
- Drata's automated evidence collection focuses on cloud providers, identity providers, MDMs, and SaaS tools via API integrations. Self-hosted Docker stacks — running on a VPS or bare-metal server — are not covered by native integrations. Drata's API-first architecture lets you push custom evidence in, but the engineering work to instrument a self-hosted Docker host and produce auditor-grade evidence is your responsibility.
- What SOC 2 controls apply to a Docker deployment?
- Several Trust Services Criteria (TSC) controls directly apply to Docker infrastructure. CC6.1 requires network access controls at the system boundary — meaning your Docker port bindings and firewall configuration. CC6.8 requires protection against malicious software — covering container image provenance and CIS Docker Benchmark runtime settings. CC7.1 requires detecting configuration drift and new vulnerabilities — this is where CIS Docker Benchmark checks and vulnerability scanning fit. Each Keelix finding maps to the relevant TSC control so you can show an auditor precisely which evidence covers which requirement. [SOC 2 Controls CC6 & CC7 ↗]
- How do I collect SOC 2 evidence for a self-hosted Docker host?
- Run `keelix scan` on the host. Keelix performs the CIS Docker Benchmark checks, audits container runtime settings, scans port exposure from outside-in, and grades AI-agent/MCP posture. Every finding is mapped to the relevant SOC 2 Trust Service Criterion. Keelix Cloud stores each scan result as a timestamped, tamper-evident record — the audit trail an auditor expects to see demonstrating continuous operating effectiveness, not a one-off snapshot.
- Is there a free tool for SOC 2 evidence on Docker?
- Keelix's CLI is free and Apache-2.0. Run `keelix scan` locally — it produces a control-mapped report with findings keyed to CIS Docker Benchmark and SOC 2 TSC controls. For scan history, continuous monitoring, and exportable evidence packages, Keelix Cloud adds the logbook layer on top of the free CLI.
Related
Collect SOC 2 evidence for your Docker host in under two minutes.
Free, local-first, Apache-2.0. Control-mapped findings. Nothing leaves your box.