The Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
This report summarizes scanner evidence for moby/moby, a Go project with 72,226 GitHub stars. SynthScan examined 857,022 lines of code across 2518 source files, recording 516 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 0.7 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 503 finding(s).
Are imports declared and package/API names verified? 8 finding(s).
Are wrappers, guards, and repeated structures necessary? 5 finding(s).
Which changes need focused human review? 516 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 516 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .golangci.yml | 81 | COMMENT | |
| LOW | .golangci.yml | 281 | rules: | COMMENT |
| LOW | cmd/docker-proxy/main_linux.go | 21 | parentPipeFd uintptr = 3 + iota | COMMENT |
| LOW | cmd/docker-proxy/udp_proxy_linux.go | 121 | again: | COMMENT |
| LOW | cmd/dockerd/winresources/event_messages.h | 1 | /* Do not edit this file manually. | COMMENT |
| LOW | cmd/dockerd/winresources/event_messages.h | 21 | // Sev - is the severity code | COMMENT |
| LOW | cmd/dockerd/winresources/winresources.go | 1 | // Package winresources is used to embed Windows resources into dockerd.exe. | COMMENT |
| LOW | integration/networking/port_mapping_linux_test.go | 1181 | } | COMMENT |
| LOW | integration/networking/port_mapping_linux_test.go | 1461 | l3.Hosts["attacker"].Run(t, "ip", "route", "add", loIP+"/32", "via", "192.168.121.2", "dev", "eth0") | COMMENT |
| LOW | integration/networking/port_mapping_linux_test.go | 1841 | // TestICMPErrorsFromPublishedPortICCDisabled checks that an ICMP/ICMPv6 error | COMMENT |
| LOW | integration/networking/port_mapping_linux_test.go | 1941 | // than showing up as an unreachable port. | COMMENT |
| LOW | …n/network/bridge/iptablesdoc/iptablesdoc_linux_test.go | 1 | // Package iptablesdoc runs docker, creates networks, runs containers and | COMMENT |
| LOW | …n/network/bridge/nftablesdoc/nftablesdoc_linux_test.go | 1 | // Package nftablesdoc runs docker, creates networks, runs containers and | COMMENT |
| LOW | …n/network/bridge/nftablesdoc/nftablesdoc_linux_test.go | 401 | // Break the remainder into blocks (individual maps, chains), and store each in the result | COMMENT |
| LOW | integration/internal/swarm/service.go | 81 | ServiceWithReplicas(1)(&spec) | COMMENT |
| LOW | integration/internal/termtest/stripansi.go | 1 | package termtest | COMMENT |
| LOW | integration/image/inspect_test.go | 81 | assert.Assert(t, inspect.Descriptor != nil) | COMMENT |
| LOW | integration/image/inspect_test.go | 101 | // | COMMENT |
| LOW | integration/container/copy_linux_test.go | 21 | ) | COMMENT |
| LOW | integration/container/exec_test.go | 261 | // | COMMENT |
| LOW | integration/container/stop_linux_test.go | 61 | // https://github.com/moby/moby/blob/97455cc31ffa08078db6591f018256ed59c35bbc/daemon/stop.go#L101-L112 | COMMENT |
| LOW | integration/container/testdata/socketcall.c | 1 | #include <stdio.h> | COMMENT |
| LOW | integration/container/testdata/socketcall.c | 21 | #ifdef VSOCK_CONNECT | COMMENT |
| LOW | integration/daemon/daemon_linux_test.go | 101 | "--fixed-cidr", "192.168.176.0/24", | COMMENT |
| LOW | integration/daemon/daemon_linux_test.go | 301 | // subnet - this is a configuration error, but has historically been | COMMENT |
| LOW | integration/service/network_linux_test.go | 481 | }, | COMMENT |
| LOW | integration/service/network_linux_test.go | 581 | // references have to be dropped for the whole set: dropping only the | COMMENT |
| LOW | integration/service/network_linux_test.go | 701 | // Neither the ingress network nor docker_gwbridge has an IPv6 address, so there is | COMMENT |
| LOW | integration/service/create_test.go | 121 | // we can't just wait on no tasks for the service, counter-intuitively. | COMMENT |
| LOW | integration/service/create_test.go | 321 | // {"net.ipv4.ip_nonlocal_bind": "0"} | COMMENT |
| LOW | integration/service/create_test.go | 361 | COMMENT | |
| LOW | integration/service/create_test.go | 401 | COMMENT | |
| LOW | integration/service/create_test.go | 601 | assert.NilError(t, err) | COMMENT |
| LOW | integration/volume/mount_test.go | 241 | assert.Check(t, is.Equal(strings.TrimSpace(output.Stdout), tc.expected)) | COMMENT |
| LOW | integration-cli/docker_cli_cp_to_container_test.go | 81 | assert.NilError(c, fileContentEquals(c, cpPath(testVol, "dirX/file2-1"), "file2-1\n"), `The "dirX" directory should now | COMMENT |
| LOW | integration-cli/docker_cli_swarm_test.go | 1441 | outs, _ := d.Cmd("node", "ls") | COMMENT |
| LOW | integration-cli/docker_cli_save_load_test.go | 241 | // present); | COMMENT |
| LOW | integration-cli/docker_cli_cp_from_container_test.go | 81 | // | COMMENT |
| LOW | integration-cli/docker_cli_daemon_test.go | 721 | // Go 1.25 / TLS 1.3 may produce a generic "handshake failure" | COMMENT |
| LOW | internal/testutil/daemon/ops.go | 21 | d.containerdSocket = socket | COMMENT |
| LOW | internal/testutil/environment/environment.go | 101 | } | COMMENT |
| LOW | internal/testutil/netnsutils/context_unix.go | 161 | // or [golang.org/x/sync/errgroup.Group]. | COMMENT |
| LOW | internal/namesgenerator/legacy/names-generator.go | 1 | // Package legacy generates random names using Moby's original name lists. | COMMENT |
| LOW | errdefs/doc.go | 1 | // Package errdefs defines a set of error interfaces that packages should use for communicating classes of errors. | COMMENT |
| LOW | hack/make.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | contrib/dockerd-rootless.sh | 1 | #!/bin/sh | COMMENT |
| LOW | contrib/dockerd-rootless.sh | 21 | # * DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP=(auto|true|false): whether to protect slirp4netns with seccomp. | COMMENT |
| LOW | contrib/dockerd-rootless.sh | 41 | # gvisor-tap-vsock | builtin | Slow | Fast ✅ | ✅ (*) | ✅ | Default when slirp4netns is | COMMENT |
| LOW | contrib/download-frozen-image-v2.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | contrib/syscall-test/userns.c | 1 | #define _GNU_SOURCE | COMMENT |
| LOW | contrib/syscall-test/ns.c | 1 | #define _GNU_SOURCE | COMMENT |
| LOW | daemon/reload.go | 81 | // - Platform runtime | COMMENT |
| LOW | daemon/monitor.go | 401 | if err != nil { | COMMENT |
| LOW | daemon/list.go | 601 | // CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES | COMMENT |
| LOW | daemon/delete.go | 101 | if err := daemon.kill(context.TODO(), ctr); err != nil && !isNotRunning(err) { | COMMENT |
| LOW | daemon/archive_tarcopyoptions_unix.go | 41 | // Both `user` and `group` can be provided as an `uid` / `gid`, so the following | COMMENT |
| LOW | daemon/archive_tarcopyoptions_unix.go | 101 | } | COMMENT |
| LOW | daemon/archive_windows.go | 201 | if !stat.IsDir() { | COMMENT |
| LOW | daemon/container_operations.go | 781 | if nwName == network.DefaultNetwork { | COMMENT |
| LOW | daemon/container_operations.go | 961 | // not an "invalid parameter" because getNetworkedContainer is called | COMMENT |
| 370 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/buildkit.yml | 35 | timeout-minutes: 60 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/buildkit.yml | 63 | timeout-minutes: 60 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/buildkit.yml | 171 | timeout-minutes: 60 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/buildkit.yml | 257 | timeout-minutes: 60 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/.windows.yml | 46 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/.windows.yml | 109 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/.windows.yml | 171 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/.windows.yml | 201 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/.windows.yml | 233 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/.windows.yml | 423 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/.test-unit.yml | 34 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/pr-review.yml | 74 | https://agentic-platform.docker.com/api/v1/channels/publish | CODE |
| MEDIUM | .github/workflows/test.yml | 36 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/test.yml | 136 | timeout-minutes: 10 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/test.yml | 157 | timeout-minutes: 30 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/test.yml | 211 | timeout-minutes: 10 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/test.yml | 230 | timeout-minutes: 10 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/test.yml | 250 | timeout-minutes: 20 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/windows-integration-flaky.yml | 76 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/windows-integration-flaky.yml | 160 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/.test.yml | 46 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/.test.yml | 102 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/.test.yml | 141 | timeout-minutes: 10 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/.test.yml | 176 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/.test.yml | 334 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/.test.yml | 429 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/ci.yml | 34 | timeout-minutes: 20 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/ci.yml | 73 | timeout-minutes: 20 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/ci.yml | 93 | timeout-minutes: 20 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/ci.yml | 134 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| MEDIUM | .github/workflows/ci.yml | 163 | timeout-minutes: 120 # guardrails timeout for the whole job | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | integration/service/network_linux_test.go | 969 | // reading, is what makes that robust - a read only ever reports on the datagram | COMMENT |
| MEDIUM | integration-cli/docker_cli_pull_test.go | 72 | // more robust against these network glitches, allow a | COMMENT |
| LOW | hack/generate-test-rogue-certs.sh | 24 | # to connect or just use '*' for a certificate valid for any hostname: | COMMENT |
| LOW⚡ | hack/generate-test-certs.sh | 25 | # to connect or just use '*' for a certificate valid for any hostname: | COMMENT |
| MEDIUM | hack/test/e2e-run.sh | 46 | # - https://github.com/go-delve/delve/blob/v1.24.1/CHANGELOG.md#1231-2024-09-23 | COMMENT |
| MEDIUM | hack/test/e2e-run.sh | 46 | # - https://github.com/go-delve/delve/blob/v1.24.1/CHANGELOG.md#1231-2024-09-23 | COMMENT |
| MEDIUM | daemon/libnetwork/networkdb/networkdb.go | 367 | // The garbage collection logic for entries leverage the presence of the network. | COMMENT |
| MEDIUM | daemon/libnetwork/networkdb/cluster.go | 418 | // The reapTableEntries leverage the presence of the network so garbage collect entries first | COMMENT |
| MEDIUM | daemon/logger/loggerutils/sharedtemp.go | 21 | // robust to file renames. Input files are assumed to be immutable; no attempt | COMMENT |
| MEDIUM | daemon/volume/mounts/windows_parser.go | 58 | // - Essentially using the folder solution from | COMMENT |
| MEDIUM | daemon/volume/local/local.go | 365 | // Essentially docker doesn't care if this fails, it will send an error, but | COMMENT |
| MEDIUM | .github/workflows/.vm.yml | 95 | # BuildKit also creates bundles/ with mode 0700, which the harness | COMMENT |
| LOW | api/docs/v1.35.yaml | 80 | If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass this | CODE |
| LOW | api/docs/v1.38.yaml | 80 | If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass this | CODE |
| LOW | api/docs/v1.34.yaml | 71 | If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass this | CODE |
| LOW | api/docs/v1.29.yaml | 69 | If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass this | CODE |
| LOW | api/docs/v1.33.yaml | 69 | If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass this | CODE |
| LOW | api/docs/v1.25.yaml | 69 | If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass this | CODE |
| LOW | api/docs/v1.32.yaml | 69 | If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass this | CODE |
| LOW | api/docs/v1.28.yaml | 69 | If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass this | CODE |
| LOW | api/docs/v1.27.yaml | 69 | If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass this | CODE |
| LOW | api/docs/v1.31.yaml | 69 | If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass this | CODE |
| LOW | api/docs/v1.30.yaml | 69 | If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass this | CODE |
| LOW | api/docs/v1.26.yaml | 69 | If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass this | CODE |
| LOW | api/docs/v1.37.yaml | 80 | If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass this | CODE |
| LOW | api/docs/v1.36.yaml | 80 | If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass this | CODE |
| MEDIUM | client/image_import_opts.go | 11 | Source io.Reader // Source is the data to send to the server to create this image from. You must set SourceName to | CODE |
| MEDIUM | client/image_import_opts.go | 12 | SourceName string // SourceName is the name of the image to pull. Set to "-" to leverage the Source attribute. | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | .github/workflows/codeql.yml | 25 | # ┌───────────── minute (0 - 59) | COMMENT |
| MEDIUM⚡ | .github/workflows/codeql.yml | 26 | # │ ┌───────────── hour (0 - 23) | COMMENT |
| MEDIUM⚡ | .github/workflows/codeql.yml | 27 | # │ │ ┌───────────── day of the month (1 - 31) | COMMENT |
| MEDIUM⚡ | .github/workflows/codeql.yml | 28 | # │ │ │ ┌───────────── month (1 - 12) | COMMENT |
| MEDIUM⚡ | .github/workflows/codeql.yml | 29 | # │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | integration/daemon/daemon_test.go | 426 | proxyURL = "https://xxxxx:xxxxx@example.org" | CODE |
| LOW | integration/daemon/daemon_test.go | 452 | proxyURL = "https://xxxxx:xxxxx@example.org" | CODE |
| LOW⚡ | hack/generate-test-certs.sh | 17 | -subj "/C=US/ST=CA/L=SanFrancisco/O=Moby-project/OU=ci/CN=moby-ci/name=moby/emailAddress=moby@example.org" \ | CODE |
| LOW⚡ | hack/generate-test-certs.sh | 29 | -subj "/C=US/ST=CA/L=SanFrancisco/O=Moby-project/OU=ci/CN=server/name=moby/emailAddress=moby@example.org" \ | CODE |
| LOW | hack/generate-test-certs.sh | 58 | -subj "/C=US/ST=CA/L=SanFrancisco/O=Moby-project/OU=ci/CN=client/name=moby/emailAddress=moby@example.org" \ | CODE |
| LOW | daemon/config/config_test.go | 1039 | proxyURL = "https://xxxxx:xxxxx@example.org" | CODE |
| LOW | daemon/pkg/registry/search_test.go | 39 | // it will consider authenticated any request with the header `X-Docker-Token: fake-token`. | COMMENT |
| LOW | daemon/pkg/registry/search_test.go | 44 | client.Transport.(*authTransport).token = []string{"fake-token"} | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/workflows/.windows.yml | 278 | # If you update the collector here, don't forget to update the version | COMMENT |
| LOW | .github/workflows/.windows.yml | 278 | # If you update the collector here, don't forget to update the version | COMMENT |
| LOW | .github/actions/setup-tracing/action.yml | 23 | # you update the collector here, don't forget to update the version set | COMMENT |
| LOW | .github/actions/setup-tracing/action.yml | 23 | # you update the collector here, don't forget to update the version set | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | internal/testutil/netnsutils/context_unix.go | 49 | // Example usage: | COMMENT |
| LOW | internal/testutil/netnsutils/context_unix.go | 63 | // Example usage: | COMMENT |
| LOW | internal/testutil/netnsutils/context_unix.go | 163 | // Example usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | hack/vendor.sh | 3 | # This file is just a wrapper around the 'go mod vendor' tool. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …/internal/distribution/metadata/v2_metadata_service.go | 163 | // TODO: implement in memory storage | COMMENT |
| LOW | …/internal/distribution/metadata/v2_metadata_service.go | 210 | // TODO: implement in memory storage | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/workflows/windows-integration-flaky.yml | 106 | # Check if Docker service exists and try to start it if stopped | COMMENT |
| LOW | .github/actions/ensure-windows-docker/action.yml | 16 | # Check if Docker service exists and try to start it if stopped | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | daemon/daemon_unix.go | 614 | // NOTE: This function comes from package github.com/coreos/go-systemd/util | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | daemon/internal/distribution/manifest.go | 112 | // We know we have the content locally, we need to check if we've seen this content at the specified repository before | COMMENT |