Community
Star history
Track DockerDNA's growth on GitHub.
Pre-build container security analysis: secrets detection with Shannon entropy analysis, docker-compose.yml auditing, CIS Docker Benchmark v1.6 control mapping, supply-chain risk scoring, CycloneDX SBOM, and SARIF output — with layer-by-layer attribution on every finding.
DockSec, Trivy, and Hadolint are strong tools and each has grown real coverage of its own (DockSec now scans docker-compose, ships SARIF/SBOM/CI gating; Trivy has a dedicated secrets scanner). DockerDNA focuses specifically on pre-build analysis with a few things not documented elsewhere in this space.
Scans Dockerfiles, docker-compose.yml, .env files, and any project files.
Pattern matching covers 20+ known secret formats (AWS, GCP, GitHub, Stripe, JWT, DB URIs…).
Entropy analysis with threshold ≥ 4.5 bits/char catches unknown high-entropy tokens that regex never will.
H(X) = -∑ p(x) log₂ p(x) → flag if H ≥ 4.5 and length ≥ 20 chars.
Parses every service definition in YAML. Checks for
privileged: true, cap_add: [ALL], Docker socket volume mounts,
network_mode: host, missing memory/CPU limits, missing read_only,
missing no-new-privileges, missing AppArmor profile, and hardcoded env secrets.
Every finding is tagged with its CIS Docker Benchmark v1.6 control ID.
Parses the Dockerfile layer-by-layer. Detects :latest tags without digest pinning,
unnecessary packages (curl, vim, gcc…), missing
USER and HEALTHCHECK, secrets leaking across multi-stage builds,
and SSH server installation. Each FROM image receives a 0–100 supply chain risk score
based on registry trust, tag specificity, and Docker Content Trust status.
All findings are aggregated and mapped to CIS Docker Benchmark v1.6 controls.
A pass/fail scorecard is produced. Reports are written in all requested formats:
JSON (full structured data), HTML (interactive dashboard),
SARIF 2.1.0 (GitHub Security tab), and CycloneDX 1.5 SBOM.
A CI threshold gate (--threshold HIGH) exits with code 1 if findings
at that severity or above are present.
DockerDNA runs all sub-scanners in sequence and assembles findings into a single structured report before writing output formats.
Dockerfile docker-compose.yml .env / project files
| | |
v v v
+---------------------+ +-----------------+ +--------------------+
| DockerfileScanner | | ComposeScanner | | SecretsScanner |
| - Layer parsing | | - CIS Sect. 5 | | - 20+ regex pats |
| - CIS Sect. 4 | | - Env secrets | | - Shannon entropy |
| - Multi-stage leak | | - Resource lims | | - Redaction |
+---------------------+ +-----------------+ +--------------------+
| | |
+----------+ | +----------+
| | |
v v v
+-----------------------------------+
| SupplyChainScanner |
| - Registry trust scoring |
| - Digest pinning check |
| - DOCKER_CONTENT_TRUST |
+-----------------------------------+
|
v
+-----------------------------------+
| ComplianceMapper |
| - CIS Docker Benchmark v1.6 |
| - Pass / Fail / Not-Checked |
| - 0-100 compliance score |
+-----------------------------------+
|
+-------------------+-------------------+
| | |
v v v
report.json report.html report.sarif
(full data) (dashboard UI) (GitHub Security tab)
|
v
sbom.cyclonedx.json
(CycloneDX 1.5)
|
v (optional)
AI Remediation
(Anthropic Claude)
Two complementary strategies: compiled regex for 20+ known secret formats, and Shannon entropy analysis for unknown high-entropy tokens. Values are automatically redacted in reports.
YAML parser covering every CIS Section 5 control: privileged mode, capability escalation, Docker socket mounts, host networking, missing resource limits, read-only filesystem, and no-new-privileges.
Every FROM image receives a 0–100 supply chain risk score based on registry trust (official vs community vs self-hosted), digest pinning, Docker Content Trust status, and malicious image name patterns.
Aggregates all scanner findings and maps them to CIS Docker Benchmark v1.6 controls. Produces a full pass/fail/not-checked scorecard and a 0–100% compliance percentage.
Parses every package manager install instruction (apt-get, pip, npm, apk, yum) to produce a CycloneDX 1.5 BOM with PURL identifiers, layer attribution, and build-stage annotations. NTIA minimum-elements compliant.
SARIF 2.1.0 output maps every finding to a rule with severity, help URI, and source location. Upload to GitHub Advanced Security to get inline PR annotations — zero additional integration required.
Findings across five scanners, mapped to CIS Docker Benchmark v1.6 controls.
AWS access keys, Google API keys, GitHub tokens, Stripe keys, JWT tokens, RSA private keys, database connection strings, and 15+ more patterns. Plus Shannon entropy detection for unknowns.
privileged: true and cap_add: [ALL] in docker-compose give a container
unrestricted kernel access. CIS-5.4 and CIS-5.3. Flagged with specific remediation steps.
Mounting /var/run/docker.sock gives a container full control over the Docker daemon
— equivalent to root on the host. CIS-5.13. Flagged as CRITICAL.
Containers without a non-root USER instruction run as UID 0. If the application is compromised, the attacker has root inside the container. CIS-4.1.
Base images without digest pinning, using Docker Hub community images, or without Docker Content Trust enabled receive elevated risk scores. CIS-4.2 and CIS-4.5.
Secrets set in ENV or ARG in early build stages may survive into the final image layer history. DockerDNA detects this pattern across all stages and warns before the image is built.
Containers without memory or CPU limits can consume all host resources, causing denial of service for other workloads. CIS-5.10 and CIS-5.11.
No HEALTHCHECK (CIS-4.6), no read-only root filesystem (CIS-5.12), no no-new-privileges (CIS-5.14), no AppArmor profile (CIS-5.1). All flagged with CIS control IDs and remediations.
curl, wget, vim, gcc, gdb, strace, openssh-server, and 10+ other tools that expand the attack surface when present in production images. CIS-4.3.
Verified against each project's public documentation, September 2026. Tools evolve quickly — always check upstream docs before relying on this. Cells marked “not documented” mean I could not confirm the capability either way, not that it's absent.
| Capability | DockerDNA | OWASP DockSec | Trivy | Hadolint |
|---|---|---|---|---|
| Dockerfile security scan | ✓ | ✓ | partial (image/IaC scan) | ✓ |
| docker-compose.yml scanner | ✓ | ✓ | not documented | ✗ |
| Secrets detection | ✓ regex + entropy | ✓ via Trivy | ✓ regex, built-in rules | ✗ |
| Entropy detection for unknown secrets | ✓ | not documented | ✗ regex-only | ✗ |
| CIS Docker Benchmark control-ID mapping | ✓ v1.6 | not documented | ✗ | ✗ |
| SBOM generation (CycloneDX) | ✓ 1.5 | ✓ | ✓ | ✗ |
| SARIF output | ✓ 2.1.0 | ✓ | ✓ | ✗ |
| Supply chain image risk scoring | ✓ 0–100 | not documented | CVE-based | ✗ |
| Multi-stage build secret leak detection | ✓ | not documented | ✗ | ✗ |
| CI/CD threshold gate | ✓ --threshold | ✓ --fail-on | ✓ | ✗ |
| Layer-by-layer finding attribution | ✓ | not documented | ✗ | ✗ |
| AI-powered remediation | ✓ Claude | ✓ Multi-LLM | ✗ | ✗ |
| CVE vulnerability database | — | ✓ via Trivy | ✓ | ✗ |
DockerDNA is designed to complement tools like DockSec and Trivy, not replace them. If you already use DockSec for its multi-LLM explanations and automated patching, or Trivy for CVE scanning, DockerDNA is a good addition for pre-build compose/secrets/compliance analysis.
Install via pip, point at your Dockerfile or project directory, get results in JSON, HTML, SARIF, and SBOM. View on PyPI →
pip install dockerdna # With AI remediation pip install "dockerdna[ai]"
dockerdna Dockerfile \ --compose docker-compose.yml \ --format json html sarif sbom
./dockerdna-results/. HTML report includes an interactive CIS compliance scorecard.dockerdna Dockerfile \ --compose docker-compose.yml \ --threshold HIGH \ --format sarif
export ANTHROPIC_API_KEY=sk-... dockerdna Dockerfile \ --compose docker-compose.yml \ --ai --format json html
- uses: actions/checkout@v4
- run: pip install dockerdna
- name: Run DockerDNA
run: |
dockerdna Dockerfile \
--compose docker-compose.yml \
--format sarif json \
--threshold HIGH \
--output dockerdna-results
- name: Upload to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: dockerdna-results/report.sarif
Risk Score : 100/100 CIS Compliance : 0.0% Total Findings : 44 CRITICAL 8 HIGH 12 MEDIUM 17 LOW 7 [CRITICAL] CIS-4.9 ENV PASSWORD: supe****t123 [CRITICAL] CIS-4.9 ENV API_KEY: AIza****3456 [CRITICAL] CIS-5.4 webapp: Privileged mode enabled [CRITICAL] CIS-5.13 webapp: Docker socket mounted [HIGH] CIS-4.1 No non-root USER instruction [HIGH] CIS-5.9 webapp: network_mode: host [HIGH] CIS-5.3 webapp: cap_add: [ALL]
--no-redact to disable). Full HTML report with CIS compliance scorecard written to dockerdna-results/report.html.Track DockerDNA's growth on GitHub.
A star helps DevSecOps engineers, Docker security researchers, and platform teams find this work. If DockerDNA catches something real in your stack, open an issue and let us know.