Search papers, labs, and topics across Lattice.
This paper introduces an automated six-stage pipeline for analyzing Dockerfiles in enterprise environments, addressing the prevalent issue of security misconfigurations and technical debt. By leveraging LLM-generated semantic descriptions and HDBSCAN for clustering, the study reveals that 99% of analyzed Dockerfiles contain security flaws, with a significant optimization gap identified against existing high-quality reference implementations. The findings suggest that adopting these internal standards could enhance security posture scores by over 60%, highlighting the potential for improved practices within corporate inner-source ecosystems.
99% of Dockerfiles in a major enterprise are misconfigured, yet 83% of functional clusters contain high-quality reference implementations that could drastically improve security.
Containerization dominates enterprise software delivery, yet Dockerfiles that assemble container images frequently harbor security misconfigurations and structural technical debt. This problem is poorly understood in corporate inner-source environments, where proprietary context and isolated governance prevent direct application of open-source findings. We present an automated, six-stage pipeline that: (1) crawls an enterprise GitLab instance, (2) enriches each Dockerfile with static security and quality metrics (Hadolint, ShellCheck, Trivy) and lifecycle data, (3) groups functionally identical workloads using LLM-generated semantic descriptions and HDBSCAN, and (4) quantifies the optimization gap against cluster-internal reference implementations. Applied to 11,470 Dockerfiles from over 6,200 repositories at a single large industrial company, we find a systemic deficit: 99\% of files contain at least one security misconfiguration, 80.8\% violate Dockerfile best practices, and the median artifact has not been revised for 838~days. Despite this, high-quality reference implementations already exist within 83\% of functional clusters. Adopting these internal standards would increase the average security posture score by 60.4\% without developing any new templates. These findings, grounded in one organization's inner-source ecosystem, provide a data-driven foundation for future automated, context-aware recommender systems targeting enterprise supply-chain security; whether the observed technical-debt distribution and optimization gap generalize to other enterprises remains an open question for future multi-organization study.
