OWASP DockSec
OWASP DockSec - AI-powered Docker security scanner that explains vulnerabilities in plain English. An OWASP Lab Project.
DockSec is a free, open-source OWASP Lab Project that helps developers find and fix security problems in Dockerfiles, Docker Compose files, and container images.
Most container scanners are good at finding problems and bad at helping you fix them. A typical image scan returns hundreds of CVEs with no clear sense of which ones matter or what to change. DockSec is built for the step after the scan: turning findings into a short list of fixes a developer can actually apply.
How it works
Scan: DockSec runs established open-source scanners, including Trivy and Hadolint, locally on your machine.
Correlate: It merges the results, removes duplicates, and ranks findings by their real impact on your setup.
Explain and fix: An AI layer explains each issue in plain English and suggests specific, line-level changes to your Dockerfile.
Report: Every scan produces a 0 to 100 security score, with reports in HTML, PDF, JSON, CSV, SARIF, and CycloneDX SBOM formats.
Key features
Scans Dockerfiles, Docker Compose files, and container images
Works with OpenAI, Anthropic Claude, Google Gemini, or fully local models through Ollama
Scan-only and offline modes that need no API key
Secrets are redacted before any content is sent to an AI provider
No telemetry: DockSec collects no usage data
Available as a command-line tool, a Python package on PyPI, and a GitHub Action for CI/CD pipelines
Project status
DockSec was promoted to OWASP Lab status in June 2026 and holds the OpenSSF Best Practices passing badge. It is released under the MIT license with no paid tier or gated features. The project is led by Advait Patel (creator) and Arkadii Yakovets.
Get involved
Contributions are welcome. Open an issue or pull request on GitHub, read the contribution guidelines in the repository, or join the #project-docksec channel on the OWASP Slack.
## Prerequisites
- Python 3.12 or later
- Trivy (required for all scans)
- Hadolint (for Dockerfile linting)
- Docker (for container image scans)
DockSec can install Trivy and Hadolint for you:
```bash
python -m docksec.setup_external_tools
```
## Install
```bash
# Full install with AI analysis (recommended)
pip install "docksec[ai]"
# Slim scan-only install, no AI dependencies and no API key needed
pip install docksec
```
## Run your first scan
```bash
docksec Dockerfile --scan-only
```
Every scan ends with a severity table, a 0 to 100 security score, a short "Quick take" on what to fix first, and reports saved to ~/.docksec/results/ by default.
## Turn on AI analysis
Pick a provider, set its API key, and run:
```bash
# OpenAI (default)
export OPENAI_API_KEY="..."
docksec Dockerfile
# Anthropic Claude
export ANTHROPIC_API_KEY="..."
docksec Dockerfile --ai-only --provider anthropic
# Google Gemini
export GOOGLE_API_KEY="..."
docksec Dockerfile --ai-only --provider google
# Ollama: fully local, no API key, nothing leaves your machine
docksec Dockerfile --ai-only --provider ollama --model llama3.1
```
## What leaves your machine
- Scanning is fully local. Image contents are never uploaded.
- AI analysis sends only the scanned file plus a short summary of vulnerability counts.
- Secret-looking values are redacted before anything is sent to an AI provider.
- No telemetry. DockSec collects no usage data.
Project Resources
Project Leaders
Advait Patel
Project Creator & Lead
Advait Patel is the creator and project leader of OWASP DockSec. He is a Senior Site Reliability Engineer at Broadcom with nine years of experience in cloud infrastructure security, container security, and reliability engineering. He is a Docker Captain, a Google Developer Expert for Google Cloud, an IEEE Senior Member, and a founding member of the OWASP AI Vulnerability Scoring System (AIVSS). He is the author of two books on Google Cloud security published by Apress (Springer Nature) and speaks regularly at security conferences, including OWASP Global AppSec.
Project Information
Requirements
- Python 3.12 or later
- Trivy (required for all scans)
- Hadolint (for Dockerfile linting)
- Docker (for container image scans)
- Optional: an OpenAI, Anthropic, or Google Gemini API key, or a local Ollama install, for AI analysis
Slack