Security smell detection in Dockerfiles
TL;DR
An LLM-assisted IaC security framework that integrates a fine-tuned multi-label risk detector trained on 4,000 manually annotated Dockerfiles across ten high-impact categories, and a retrieval-augmented interpretation-and-repair module that outputs both human-readable rationales and corrected code.
Abstract
Dockerfiles are a widely adopted format for specifying Infrastructure-as-Code (IaC). However, insecure or misconfigured Dockerfiles frequently introduce critical security smells, including improper privilege use, unpinned dependencies, and secret leakage. State-of-practice tools such as Hadolint, Checkov, and KICS rely on static rules and regular expressions, leading to high false-negative rates and limited explanations for developers—particularly when security smells are semantically interwoven into configuration logic. We present an LLM-based framework that integrates (i) a fine-tuned multi-label risk detector trained on 4,000 manually annotated Dockerfiles across ten high-impact categories, and (ii) a retrieval-augmented interpretation-and-repair module that outputs both human-readable rationales and corrected code. The system is deployed via a VSCode plugin for real-time support. Experiments on a curated test set show that the detector achieves a macro-averaged precision of 0.97 and recall of 0.94, improving recall by 9–28 percentage points over static baselines. A user study further confirms the usability of our approach, demonstrating significant improvements in risk comprehension, identification accuracy, and remediation effort. Our findings highlight the feasibility of LLM-assisted IaC security and provide practical early mitigation for Dockerfile misconfigurations.