AI Slop Code Risk Monitor

moby/moby

SlopCodeMonitor badge for moby/moby Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

The Moby Project - a collaborative project for the container ecosystem to assemble container-based systems

0.7 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for moby/moby, a Go project with 72,226 GitHub stars. SynthScan examined 857,022 lines of code across 2518 source files, recording 516 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 0.7 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

0.7
Adjusted Signal
0.7
Raw Pattern Score
100%
Time Factor
2026-10-30
Last Push
72.2K
Stars
Go
Language
857.0K
Lines of Code
2.5K
Files
516
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 503 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.1/100 · LOW

Are imports declared and package/API names verified? 8 finding(s).

Agent Over-Engineering Ratio 0.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 5 finding(s).

PR Review Velocity Impact 3.5/100 · LOW

Which changes need focused human review? 516 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 49LOW 467

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 516 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block430 hits · 430 pts
SeverityFileLineSnippetContext
LOW.golangci.yml81COMMENT
LOW.golangci.yml281 rules:COMMENT
LOWcmd/docker-proxy/main_linux.go21 parentPipeFd uintptr = 3 + iotaCOMMENT
LOWcmd/docker-proxy/udp_proxy_linux.go121 again:COMMENT
LOWcmd/dockerd/winresources/event_messages.h1/* Do not edit this file manually.COMMENT
LOWcmd/dockerd/winresources/event_messages.h21// Sev - is the severity codeCOMMENT
LOWcmd/dockerd/winresources/winresources.go1// Package winresources is used to embed Windows resources into dockerd.exe.COMMENT
LOWintegration/networking/port_mapping_linux_test.go1181 }COMMENT
LOWintegration/networking/port_mapping_linux_test.go1461 l3.Hosts["attacker"].Run(t, "ip", "route", "add", loIP+"/32", "via", "192.168.121.2", "dev", "eth0")COMMENT
LOWintegration/networking/port_mapping_linux_test.go1841// TestICMPErrorsFromPublishedPortICCDisabled checks that an ICMP/ICMPv6 errorCOMMENT
LOWintegration/networking/port_mapping_linux_test.go1941 // than showing up as an unreachable port.COMMENT
LOW…n/network/bridge/iptablesdoc/iptablesdoc_linux_test.go1// Package iptablesdoc runs docker, creates networks, runs containers andCOMMENT
LOW…n/network/bridge/nftablesdoc/nftablesdoc_linux_test.go1// Package nftablesdoc runs docker, creates networks, runs containers andCOMMENT
LOW…n/network/bridge/nftablesdoc/nftablesdoc_linux_test.go401 // Break the remainder into blocks (individual maps, chains), and store each in the resultCOMMENT
LOWintegration/internal/swarm/service.go81 ServiceWithReplicas(1)(&spec)COMMENT
LOWintegration/internal/termtest/stripansi.go1package termtestCOMMENT
LOWintegration/image/inspect_test.go81 assert.Assert(t, inspect.Descriptor != nil)COMMENT
LOWintegration/image/inspect_test.go101//COMMENT
LOWintegration/container/copy_linux_test.go21)COMMENT
LOWintegration/container/exec_test.go261 //COMMENT
LOWintegration/container/stop_linux_test.go61 // https://github.com/moby/moby/blob/97455cc31ffa08078db6591f018256ed59c35bbc/daemon/stop.go#L101-L112COMMENT
LOWintegration/container/testdata/socketcall.c1#include <stdio.h>COMMENT
LOWintegration/container/testdata/socketcall.c21#ifdef VSOCK_CONNECTCOMMENT
LOWintegration/daemon/daemon_linux_test.go101 "--fixed-cidr", "192.168.176.0/24",COMMENT
LOWintegration/daemon/daemon_linux_test.go301 // subnet - this is a configuration error, but has historically beenCOMMENT
LOWintegration/service/network_linux_test.go481 },COMMENT
LOWintegration/service/network_linux_test.go581// references have to be dropped for the whole set: dropping only theCOMMENT
LOWintegration/service/network_linux_test.go701// Neither the ingress network nor docker_gwbridge has an IPv6 address, so there isCOMMENT
LOWintegration/service/create_test.go121 // we can't just wait on no tasks for the service, counter-intuitively.COMMENT
LOWintegration/service/create_test.go321// {"net.ipv4.ip_nonlocal_bind": "0"}COMMENT
LOWintegration/service/create_test.go361COMMENT
LOWintegration/service/create_test.go401COMMENT
LOWintegration/service/create_test.go601 assert.NilError(t, err)COMMENT
LOWintegration/volume/mount_test.go241 assert.Check(t, is.Equal(strings.TrimSpace(output.Stdout), tc.expected))COMMENT
LOWintegration-cli/docker_cli_cp_to_container_test.go81 assert.NilError(c, fileContentEquals(c, cpPath(testVol, "dirX/file2-1"), "file2-1\n"), `The "dirX" directory should nowCOMMENT
LOWintegration-cli/docker_cli_swarm_test.go1441 outs, _ := d.Cmd("node", "ls")COMMENT
LOWintegration-cli/docker_cli_save_load_test.go241 // present);COMMENT
LOWintegration-cli/docker_cli_cp_from_container_test.go81//COMMENT
LOWintegration-cli/docker_cli_daemon_test.go721 // Go 1.25 / TLS 1.3 may produce a generic "handshake failure"COMMENT
LOWinternal/testutil/daemon/ops.go21 d.containerdSocket = socketCOMMENT
LOWinternal/testutil/environment/environment.go101}COMMENT
LOWinternal/testutil/netnsutils/context_unix.go161// or [golang.org/x/sync/errgroup.Group].COMMENT
LOWinternal/namesgenerator/legacy/names-generator.go1// Package legacy generates random names using Moby's original name lists.COMMENT
LOWerrdefs/doc.go1// Package errdefs defines a set of error interfaces that packages should use for communicating classes of errors.COMMENT
LOWhack/make.sh1#!/usr/bin/env bashCOMMENT
LOWcontrib/dockerd-rootless.sh1#!/bin/shCOMMENT
LOWcontrib/dockerd-rootless.sh21# * DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP=(auto|true|false): whether to protect slirp4netns with seccomp.COMMENT
LOWcontrib/dockerd-rootless.sh41# gvisor-tap-vsock | builtin | Slow | Fast ✅ | ✅ (*) | ✅ | Default when slirp4netns is COMMENT
LOWcontrib/download-frozen-image-v2.sh1#!/usr/bin/env bashCOMMENT
LOWcontrib/syscall-test/userns.c1#define _GNU_SOURCECOMMENT
LOWcontrib/syscall-test/ns.c1#define _GNU_SOURCECOMMENT
LOWdaemon/reload.go81// - Platform runtimeCOMMENT
LOWdaemon/monitor.go401 if err != nil {COMMENT
LOWdaemon/list.go601// CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMESCOMMENT
LOWdaemon/delete.go101 if err := daemon.kill(context.TODO(), ctr); err != nil && !isNotRunning(err) {COMMENT
LOWdaemon/archive_tarcopyoptions_unix.go41// Both `user` and `group` can be provided as an `uid` / `gid`, so the followingCOMMENT
LOWdaemon/archive_tarcopyoptions_unix.go101 }COMMENT
LOWdaemon/archive_windows.go201 if !stat.IsDir() {COMMENT
LOWdaemon/container_operations.go781 if nwName == network.DefaultNetwork {COMMENT
LOWdaemon/container_operations.go961 // not an "invalid parameter" because getNetworkedContainer is calledCOMMENT
370 more matches not shown…
Modern AI Meta-Vocabulary31 hits · 62 pts
SeverityFileLineSnippetContext
MEDIUM.github/workflows/buildkit.yml35 timeout-minutes: 60 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/buildkit.yml63 timeout-minutes: 60 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/buildkit.yml171 timeout-minutes: 60 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/buildkit.yml257 timeout-minutes: 60 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/.windows.yml46 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/.windows.yml109 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/.windows.yml171 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/.windows.yml201 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/.windows.yml233 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/.windows.yml423 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/.test-unit.yml34 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/pr-review.yml74 https://agentic-platform.docker.com/api/v1/channels/publishCODE
MEDIUM.github/workflows/test.yml36 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/test.yml136 timeout-minutes: 10 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/test.yml157 timeout-minutes: 30 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/test.yml211 timeout-minutes: 10 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/test.yml230 timeout-minutes: 10 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/test.yml250 timeout-minutes: 20 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/windows-integration-flaky.yml76 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/windows-integration-flaky.yml160 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/.test.yml46 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/.test.yml102 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/.test.yml141 timeout-minutes: 10 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/.test.yml176 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/.test.yml334 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/.test.yml429 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/ci.yml34 timeout-minutes: 20 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/ci.yml73 timeout-minutes: 20 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/ci.yml93 timeout-minutes: 20 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/ci.yml134 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
MEDIUM.github/workflows/ci.yml163 timeout-minutes: 120 # guardrails timeout for the whole jobCODE
AI Slop Vocabulary28 hits · 52 pts
SeverityFileLineSnippetContext
MEDIUMintegration/service/network_linux_test.go969// reading, is what makes that robust - a read only ever reports on the datagramCOMMENT
MEDIUMintegration-cli/docker_cli_pull_test.go72 // more robust against these network glitches, allow aCOMMENT
LOWhack/generate-test-rogue-certs.sh24# to connect or just use '*' for a certificate valid for any hostname:COMMENT
LOW⚡hack/generate-test-certs.sh25# to connect or just use '*' for a certificate valid for any hostname:COMMENT
MEDIUMhack/test/e2e-run.sh46 # - https://github.com/go-delve/delve/blob/v1.24.1/CHANGELOG.md#1231-2024-09-23COMMENT
MEDIUMhack/test/e2e-run.sh46 # - https://github.com/go-delve/delve/blob/v1.24.1/CHANGELOG.md#1231-2024-09-23COMMENT
MEDIUMdaemon/libnetwork/networkdb/networkdb.go367 // The garbage collection logic for entries leverage the presence of the network.COMMENT
MEDIUMdaemon/libnetwork/networkdb/cluster.go418 // The reapTableEntries leverage the presence of the network so garbage collect entries firstCOMMENT
MEDIUMdaemon/logger/loggerutils/sharedtemp.go21// robust to file renames. Input files are assumed to be immutable; no attemptCOMMENT
MEDIUMdaemon/volume/mounts/windows_parser.go58 // - Essentially using the folder solution fromCOMMENT
MEDIUMdaemon/volume/local/local.go365 // Essentially docker doesn't care if this fails, it will send an error, butCOMMENT
MEDIUM.github/workflows/.vm.yml95 # BuildKit also creates bundles/ with mode 0700, which the harnessCOMMENT
LOWapi/docs/v1.35.yaml80 If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass thisCODE
LOWapi/docs/v1.38.yaml80 If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass thisCODE
LOWapi/docs/v1.34.yaml71 If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass thisCODE
LOWapi/docs/v1.29.yaml69 If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass thisCODE
LOWapi/docs/v1.33.yaml69 If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass thisCODE
LOWapi/docs/v1.25.yaml69 If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass thisCODE
LOWapi/docs/v1.32.yaml69 If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass thisCODE
LOWapi/docs/v1.28.yaml69 If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass thisCODE
LOWapi/docs/v1.27.yaml69 If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass thisCODE
LOWapi/docs/v1.31.yaml69 If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass thisCODE
LOWapi/docs/v1.30.yaml69 If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass thisCODE
LOWapi/docs/v1.26.yaml69 If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass thisCODE
LOWapi/docs/v1.37.yaml80 If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass thisCODE
LOWapi/docs/v1.36.yaml80 If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass thisCODE
MEDIUMclient/image_import_opts.go11 Source io.Reader // Source is the data to send to the server to create this image from. You must set SourceName to CODE
MEDIUMclient/image_import_opts.go12 SourceName string // SourceName is the name of the image to pull. Set to "-" to leverage the Source attribute.CODE
Decorative Section Separators5 hits · 22 pts
SeverityFileLineSnippetContext
MEDIUM⚡.github/workflows/codeql.yml25 # ┌───────────── minute (0 - 59)COMMENT
MEDIUM⚡.github/workflows/codeql.yml26 # │ ┌───────────── hour (0 - 23)COMMENT
MEDIUM⚡.github/workflows/codeql.yml27 # │ │ ┌───────────── day of the month (1 - 31)COMMENT
MEDIUM⚡.github/workflows/codeql.yml28 # │ │ │ ┌───────────── month (1 - 12)COMMENT
MEDIUM⚡.github/workflows/codeql.yml29 # │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday)COMMENT
Fake / Example Data8 hits · 10 pts
SeverityFileLineSnippetContext
LOWintegration/daemon/daemon_test.go426 proxyURL = "https://xxxxx:xxxxx@example.org"CODE
LOWintegration/daemon/daemon_test.go452 proxyURL = "https://xxxxx:xxxxx@example.org"CODE
LOW⚡hack/generate-test-certs.sh17 -subj "/C=US/ST=CA/L=SanFrancisco/O=Moby-project/OU=ci/CN=moby-ci/name=moby/emailAddress=moby@example.org" \CODE
LOW⚡hack/generate-test-certs.sh29 -subj "/C=US/ST=CA/L=SanFrancisco/O=Moby-project/OU=ci/CN=server/name=moby/emailAddress=moby@example.org" \CODE
LOWhack/generate-test-certs.sh58 -subj "/C=US/ST=CA/L=SanFrancisco/O=Moby-project/OU=ci/CN=client/name=moby/emailAddress=moby@example.org" \CODE
LOWdaemon/config/config_test.go1039 proxyURL = "https://xxxxx:xxxxx@example.org"CODE
LOWdaemon/pkg/registry/search_test.go39 // it will consider authenticated any request with the header `X-Docker-Token: fake-token`.COMMENT
LOWdaemon/pkg/registry/search_test.go44 client.Transport.(*authTransport).token = []string{"fake-token"}CODE
Slop Phrases4 hits · 6 pts
SeverityFileLineSnippetContext
LOW.github/workflows/.windows.yml278 # If you update the collector here, don't forget to update the versionCOMMENT
LOW.github/workflows/.windows.yml278 # If you update the collector here, don't forget to update the versionCOMMENT
LOW.github/actions/setup-tracing/action.yml23 # you update the collector here, don't forget to update the version setCOMMENT
LOW.github/actions/setup-tracing/action.yml23 # you update the collector here, don't forget to update the version setCOMMENT
Example Usage Blocks3 hits · 4 pts
SeverityFileLineSnippetContext
LOWinternal/testutil/netnsutils/context_unix.go49// Example usage:COMMENT
LOWinternal/testutil/netnsutils/context_unix.go63// Example usage:COMMENT
LOWinternal/testutil/netnsutils/context_unix.go163// Example usage:COMMENT
Self-Referential Comments1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMhack/vendor.sh3# This file is just a wrapper around the 'go mod vendor' tool.COMMENT
TODO Padding2 hits · 3 pts
SeverityFileLineSnippetContext
LOW…/internal/distribution/metadata/v2_metadata_service.go163 // TODO: implement in memory storageCOMMENT
LOW…/internal/distribution/metadata/v2_metadata_service.go210 // TODO: implement in memory storageCOMMENT
Redundant / Tautological Comments2 hits · 3 pts
SeverityFileLineSnippetContext
LOW.github/workflows/windows-integration-flaky.yml106 # Check if Docker service exists and try to start it if stoppedCOMMENT
LOW.github/actions/ensure-windows-docker/action.yml16 # Check if Docker service exists and try to start it if stoppedCOMMENT
Structural Annotation Overuse1 hit · 2 pts
SeverityFileLineSnippetContext
LOWdaemon/daemon_unix.go614// NOTE: This function comes from package github.com/coreos/go-systemd/utilCOMMENT
Verbosity Indicators1 hit · 2 pts
SeverityFileLineSnippetContext
LOWdaemon/internal/distribution/manifest.go112 // We know we have the content locally, we need to check if we've seen this content at the specified repository beforeCOMMENT