Checkov

Checkov scans infrastructure-as-code for security misconfigurations and compliance violations.

Mount IaC under /scan and run docker compose exec --entrypoint checkov checkov checkov -d /scan. Port 8080 serves the scan directory for read-only browsing.