owasp/docksec repository overview

⁠DockSec

AI-powered Docker security scanner that explains vulnerabilities in plain English.

DockSec is an OWASP Lab Project (MIT licensed) that wraps industry-standard scanners — Trivy, Hadolint, and Docker Scout — and layers an AI analysis pass on top to prioritize, explain, and suggest concrete fixes for a Dockerfile, a built image, or a full Docker Compose stack.

⁠Quick start

docker run --rm -v "$PWD:/github/workspace" \
  -e INPUT_DOCKERFILE=Dockerfile \
  -e INPUT_SCAN_ONLY=true \
  owasp/docksec:latest

The image bundles pinned versions of Trivy and Hadolint, so there's nothing to install or configure. It reads the same INPUT_* variables as the DockSec GitHub Action, so any Action input works here too: INPUT_IMAGE, INPUT_COMPOSE, INPUT_SEVERITY, INPUT_FAIL_ON, INPUT_FORMAT, INPUT_SARIF, INPUT_OUTPUT_DIR.

⁠Write reports to your workspace

docker run --rm -v "$PWD:/github/workspace" \
  -e INPUT_COMPOSE=docker-compose.yml \
  -e INPUT_SCAN_ONLY=true \
  -e INPUT_FORMAT=json,html \
  -e INPUT_OUTPUT_DIR=/github/workspace/docksec-reports \
  owasp/docksec:latest

⁠Tags

Published multi-arch (amd64 and arm64) on every release. Pin to a specific version, e.g. owasp/docksec:2026.9.21, rather than latest in CI.

⁠Also available

• GitHub Container Registry: ghcr.io/owasp/docksec
• PyPI: pip install docksec
• GitHub Action: OWASP/DockSec

⁠Links

• Source: https://github.com/OWASP/DockSec⁠
• Docs: https://owasp.github.io/DockSec/⁠