fix(core): accept service-level resource limits and stop flagging URL endpoints as secrets

[PunGrumpy]

Description

Two more accuracy misses from probing the 0.5.0 Compose rules with agent-stack files.

require-resource-limits warned services that had limits. It only read deploy.resources.limits. The service-level mem_limit, cpus, and cpu_quota keys are the older spelling of the same limits, still in the Compose specification and applied the same way by docker compose:

services:
  api:
    image: acme/api:1.4.2
    mem_limit: 512m   # warned before, satisfies the rule now
    cpus: 0.5

mem_reservation and cpu_shares do not count. A reservation is a floor and a share is a relative weight, neither caps the service.

no-plaintext-secrets flagged endpoints and missed credentials. AUTH_URL: http://auth:8080 was flagged because the key matches auth and the value is a literal, while OPENAI_APIKEY, GITHUB_PAT, and PGPASSWORD passed because no pattern matched them. Both rules that share the key list now also share one definition of a literal value, in secret-keywords.ts:

• A URL whose authority carries no userinfo names an endpoint, so the rules skip it. postgres://app:hunter2@db/app still counts.
• apikey and pat join the key patterns. pat requires a trailing separator, so PATH and PATTERN stay clean.
• password no longer requires a leading separator, which covers PGPASSWORD and MYSQLPASSWORD.

The Dockerfile rule no-secrets-in-env picks up the same value definition, so ENV AUTH_URL=https://… is clean there too.

Related Issues

N/A. Same probe as #123: the 0.5.0 rules run against the environment and limit shapes agent stacks use.

Checklist

• I've reviewed my code
• I've written tests
• I've generated a changeset file, if this changes a published package
• I've updated the docs, if necessary

Screenshots (if applicable)

N/A, CLI output only.

Additional Notes

Scores move in both directions depending on the project: up for services using mem_limit or URL-valued AUTH_* keys, down for files carrying PGPASSWORD, APIKEY, or PAT literals. The fixture scores in this repo are unchanged.

Tested with unit tests for the legacy limit keys (including that mem_reservation alone still warns), for URL values with and without userinfo in both the Dockerfile and Compose rules, and for the new key spellings against PATH and PATTERN. bun x ultracite check and bun run docs:rules are clean.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docker-doctor	Ready	Preview	Sep 5, 2026 10:32am UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: fb922e5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@docker-doctor/cli	Patch
docker-doctor-kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

The latest Docker Doctor scan for this pull request. Learn more about Docker Doctor.

File	Status	Issues	Updated
Dockerfile	Error	1 error, 2 info	Sep 5, 2026 10:31am UTC

Score: 84 / 100 · Good

3 issues

Dockerfile

• Dockerfile:2 Potential secret found in ENV: 'DB_PASSWORD'. no-secrets-in-env
• Dockerfile:1 No HEALTHCHECK instruction found. require-healthcheck
• Dockerfile:1 No LABEL metadata was found in this Dockerfile. require-labels

_{Scanned by Docker Doctor for commit fb922e5.}