Get started

The Docker image damdit/damdit runs the same Full Audit as the app, on Linux. It runs in CI, on a server or from a script, and needs no app or screen.

docker run --rm -e DAMDIT_CI_KEY damdit/damdit audit https://example.com

It runs on Linux (amd64 and arm64): in GitHub Actions and other CI systems that run Docker, on any server with Docker, and in Docker Desktop on a Mac or PC. A mirror is at ghcr.io/antoninbures/damdit.

What you need

• Docker.
• A Damdit account with an active licence: the 14-day trial or a subscription.
• A CI key from that account.

1. Start the trial or subscribe

1. Go to damdit.com/account and sign in with your e-mail. Damdit sends a six-digit code.
2. Choose Start 14-Day Trial. No card is needed. The trial covers the app too, and each account gets one.
3. Or buy a licence on the same page.

2. Create a CI key

1. On the account page, under CI keys, name the key after the pipeline or server that uses it, for example GitHub Actions – example.com.
2. Choose Create key and copy it. It is shown only once.
3. Save it as a secret named DAMDIT_CI_KEY:
   • GitHub Actions: the repository’s Settings → Secrets and variables → Actions.
   • A server: a .env file only you can read (chmod 600 .env), containing DAMDIT_CI_KEY=dmd_ci_….

Never put the key in the command itself or in a file that is committed. If a key leaks, revoke it on the account page; it stops working at once.

3. Run the first audit

With the key in .env (see above):

docker run --rm --env-file .env damdit/damdit audit https://example.com

In CI, pass the secret as an environment variable instead, with -e DAMDIT_CI_KEY (see Pipelines).

Docker downloads the image the first time. Damdit checks the key with damdit.com, audits the website and prints a summary:

Score: 98
Coverage: complete, 19 pages rendered
Issues: 3 (medium 2, low 1)
Took 23 s

To keep the files it writes (reports, the audit file, history), mount a folder at /work, for example -v "$PWD:/work".

Licence and limits

• Included in the subscription. CI keys don’t take one of your two computers.
• Up to 5 CI keys per account. Each one can be revoked on its own.
• Up to 200 audits a day per account, counted in UTC.
• Every run needs damdit.com. The key is exchanged for a licence that lasts at most 24 hours, and nothing is audited without it. There is no offline period as in the app.
• Audits from the image are kept apart from the app’s: their scores are never compared with the app’s.

Next

• The audit command: every option, reports, comparing with the last run and exit codes.
• Several websites and schedules: damdit.yml, run and serve.
• Pipelines: GitHub Actions and other CI systems.