About

DockerSec evolved from a series of scripts written during security assessments — the recurring need to review Dockerfiles across many different environments, and to give consistent, actionable guidance, made the case for a dedicated tool.

The result is a static analysis engine purpose-built for Dockerfiles. It parses the full instruction set, resolves argument interpolation and multi-stage build relationships, and applies a library of checks covering security vulnerabilities, misconfigurations, and best-practice violations.

What DockerSec analyses

DockerSec reads your Dockerfile and checks for issues including:

  • Base image hygiene — unpinned tags, deprecated images, known-vulnerable image versions
  • Privilege and user configuration — running as root, unnecessary capabilities, missing USER instructions
  • Secret and credential exposure — environment variables, build arguments, and ADD/COPY patterns that risk embedding sensitive data in image layers
  • Package management — cache poisoning risk, missing version pinning, unnecessary packages
  • Network exposure — unnecessary port exposure, insecure protocol usage in URLs
  • Build reproducibility — patterns that produce non-deterministic builds or bloated layers
  • Multi-stage build correctness — cross-stage dependencies, redundant stages, misused COPY --from

Results are categorised by severity (critical, high, medium, low) and type (security or best practice), with explanations and remediation guidance for each finding.

Approach

Like all security analysis, DockerSec leans on the side of caution — it is better to surface something that turns out not to be an issue in your specific context than to miss something that matters. Every finding includes enough context to make an informed decision about whether to remediate or accept the risk.

In development

DockerSec is under active development. The check library is continually extended and refined, and CI/API integration for automated pipeline scanning is on the roadmap. If you find a check that fires incorrectly, or a pattern that should be caught but is not, contact us — accurate analysis depends on real-world feedback.

Docker

DockerSec has no official relationship with Docker, Inc., DockerHub, or any affiliated company. All trademarks are the property of their respective owners.