Dockle vs Open Policy Agent Gatekeeper

Dockle is a free, self-hosted container image linter focused on security and Docker best practices. It scans images for vulnerabilities and checks settings against CIS Docker Image Benchmarks, along with Docker- and Linux-specific issues such as empty passwords and duplicate user or group IDs. Results can be displayed or saved in JSON and SARIF formats. Users can set an exit level and ignore selected checkpoints through command options, environment variables, or a .dockleignore file. The project documents continuous-integration use and provides a GitHub Action, with examples for Travis CI, CircleCI, and GitLab CI. Dockle can access private images in Docker Hub, Amazon ECR, Google Container Registry, and self-hosted registries. It can also scan an image archive created with docker save by using the --input option. Installation routes include Homebrew, Linux distribution packages, Windows binaries, version managers, source builds, and Docker. Dockle runs on Linux, macOS, and Windows and is listed under the Apache-2.0 license.

Open Policy Agent Gatekeeper is a free, open-source Kubernetes policy controller for Linux and self-hosted deployments. It runs as a validating and mutating webhook, enforcing CRD-based policies evaluated by Open Policy Agent. Validation constraints can deny requests, warn, run in dry-run mode or report violations without changing resources. Mutation policies can alter matching resources during admission before validation checks the final object. An audit function periodically evaluates existing cluster resources against constraints to identify pre-existing misconfigurations. The project includes an extensible policy library with parameterized examples, and provider connections to external data such as image registries and directory services. Named integrations or backed services include Azure Policy for Kubernetes, Google Kubernetes Engine Policy Controller, Rancher, AWS EKS Blueprints and Alibaba Cloud. Installation options include prebuilt, development or locally built images and Helm. Gatekeeper requires Kubernetes resources introduced in version 1.16 and cluster-admin permissions for installation. The gator CLI is documented as beta from version 3.11.