Skip to main content
Author and validate local CUE modules. Render module facts into CUE contracts and validate their deployment configuration.
Subcommands: stackkit module lint, stackkit module scaffold

​
stackkit module lint

Lint module CUE for pin/health/security/access/placement hygiene (ADR-0027 G1/G3). Run the deterministic module-hygiene gate over one module (--module) or the whole tree (--all). Checks: image tags pinned (no :latest), daemon healthCheck present (bounded automation jobs use restart=no plus process exit status), security block (noNewPrivileges + capDrop ALL), accessPolicy for routed services, no plaintext secrets, draft modules claim no scenarios, and docker-socket modules are not managed-serverless-eligible. Single-module runs exit non-zero on any error. --all is advisory (exit 0) unless --strict is passed.

​
stackkit module scaffold

Render module artifacts deterministically from module_facts.json (ADR-0027). Render modules/<slug>/module.cue, tests/reference-compose.yml and the thin tests/integration_test.sh from a schema-validated module_facts.json. Output is deterministic (gate G0): the same facts always render byte-identical files.