From c76e03f4c24394cd482f5daa18bb5a58c3a08334 Mon Sep 17 00:00:00 2001
From: Todd <tmatens@gmail.com>
Date: Wed, 14 Oct 2026 23:30:08 -0500
Subject: [PATCH] Add compose-lint

Signed-off-by: Todd <tmatens@gmail.com>
---
 data/tools/compose-lint.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 data/tools/compose-lint.yml

diff --git a/data/tools/compose-lint.yml b/data/tools/compose-lint.yml
new file mode 100644
index 000000000..016fc52b8
--- /dev/null
+++ b/data/tools/compose-lint.yml
@@ -0,0 +1,20 @@
+name: compose-lint
+categories:
+  - linter
+tags:
+  - container
+  - security
+  - yaml
+license: MIT License
+types:
+  - cli
+source: 'https://github.com/tmatens/compose-lint'
+homepage: 'https://tmatens.github.io/compose-lint/'
+description: >-
+  Security linter for Docker Compose files. Checks compose.yaml against 27
+  rules taken from the OWASP Docker Security Cheat Sheet and the CIS Docker
+  Benchmark: mounted Docker socket, privileged mode, missing
+  no-new-privileges, extra capabilities, writable root filesystem, ports
+  bound to all interfaces, credentials in environment variables, unpinned
+  images. Each finding says how to fix it and which runtime error the fix
+  can cause. JSON and SARIF output, a GitHub Action, and a dry-run auto-fix.