cask: easy custodian exec via docker

custodian-cask is a Go wrapper over the cloudcustodian/c7n Docker image. It allows you to use the docker image with the same CLI you would use for a local Custodian installation.

This can be useful in situations where you would like to ensure a working CLI without requiring Python or package dependencies.



sudo sh -c 'wget -q -O /usr/local/bin/custodian-cask && chmod +x /usr/local/bin/custodian-cask'

MacOS (Darwin)

sudo sh -c '(cd /usr/local/bin && curl -fsSLO && chmod +x /usr/local/bin/custodian-cask)'

Windows (cmd.exe)

@"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString(''))" && SET "PATH=%PATH%;%LOCALAPPDATA%\custodian\"

Windows (powershell.exe)

Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString(''))


custodian-cask run -s . policy.yml

You may override the default docker image with the environment variable CUSTODIAN_IMAGE

Cask will only attempt to pull any specific image once per hour.
You can delete $(tmp)\custodian-cask* if you’d like to force an update.


cd cloud-custodian\tools\custodian-cask
go build -o custodian-cask


make darwin
make linux
make windows