A review of 11,470 Dockerfiles found a near-universal pattern of configuration warnings and a long pause between revisions. At the same time, the analysis found that stronger internal examples already existed for most of the functional groups it could identify, pointing to a problem of discovery and reuse as well as one of code quality.
A warning-heavy baseline
The Dockerfile linter Hadolint identified 45,902 violations across 80.8% of the files. The most common listed problems were missing version pinning, which appeared in 29.4% of files, consecutive RUN instructions in 27.4%, and the absence of no-install-recommends in 19.0%. These are configuration and build-quality signals, not records of security incidents.
A second analyzer, Trivy, found at least one configuration misconfiguration in 99% of Dockerfiles. The combination of a missing HEALTHCHECK and use of a root user appeared together in 81.7%, while 42.4% had exactly two Trivy misconfigurations. The findings describe the contents of the files; they do not establish runtime exploitability or observed incidents.
The maintenance picture was similarly uneven. The median Dockerfile had not been revised for 838 days. The researchers classified 70.2% as dormant or abandoned, 23.4% as actively maintained, and 6.4% as stable or new. Because the study was a static snapshot, those figures do not show how technical debt accumulated over time.
How the comparison was built
The raw collection contained 12,002 unique Dockerfiles from 6,247 repositories. After integrity checks, 11,470 cleaned Dockerfiles remained for analysis. A six-stage Python pipeline coordinated the Moby parser, Hadolint, ShellCheck, Trivy, and crane, combining static checks with repository and image metadata.
The researchers also assigned each file a relative Security Posture Score, built from several signals rather than a direct count of runtime vulnerabilities. Trivy and Hadolint each carried a weight of 0.25; update frequency contributed 0.20, base-image size 0.15, recency 0.10, and ShellCheck 0.05. That weighting reflects the study's chosen scoring framework, so changing the weights or thresholds could change the absolute results.
To find files that appeared to serve similar purposes, the researchers converted normalized Dockerfile syntax trees into descriptions with Qwen2.5-30B-Instruct. They represented those descriptions as numerical vectors with all-mpnet-base-v2, reduced them to 50 dimensions using UMAP, and grouped them with HDBSCAN, a density-based clustering method set to require at least 15 files for a cluster and 3 samples for its density estimate.
The value was in finding comparable files
The semantic method produced 251 clusters covering 83% of the dataset; the remaining 17% was labeled noise, meaning the files did not fit a reliable group under the chosen settings. The paper reports a 62% reduction in global dataset entropy, a measure of how spread out the functional descriptions were. For comparison, the raw-content approach had 21% noise.
Across the cleaned files, the mean relative Security Posture Score was 0.48, with a median of 0.47 and a standard deviation of 0.16. Only 6.3% scored above 0.75 and 1.2% above 0.85, while 11.1% scored below 0.30. The score is best read as a configuration-hygiene proxy within this analysis, not as a measure of confirmed runtime security.
The central calculation compared each clustered file with the highest-scoring file in its functional cluster, treated as a possible internal reference. The authors report that high-quality hardened configurations were present in 83% of functional clusters. Among successfully clustered files, the mean optimization gap was 0.29, or a 29-percentage-point score difference; in the adoption scenario, that represented a 60.4% relative improvement. The lowest-performing 10% had gaps above 0.53.
Those figures are counterfactual calculations, not observed gains after teams changed their files. Under an all-clustered-debt-resolution scenario, the global mean score was projected to rise from 0.48 to 0.72, a 50.6% relative improvement. A less ambitious P90 scenario projected a 34.5% improvement for clustered files and 28.75% across the full dataset.
The semantic grouping produced a larger calculated relative improvement than the two comparison representations: 60.4%, versus 49.6% for raw Dockerfile content and 46.4% for a representation based on base images plus installed packages. The corresponding mean gaps were 0.29, 0.24, and 0.23. The study did not test alternative clustering algorithms on the same semantic embeddings, so the comparison does not settle which approach is best in every setting.
A map for review, not a security guarantee
The analysis does not show that adopting a high-scoring reference would reduce runtime CVEs, exploitations, or security incidents. It also does not show that the calculated 60.4% improvement would be realized. The projected scenarios assume successful remediation and do not measure whether teams adopt the references or whether adoption produces a measurable security change.
The clustering results also carry ordinary uncertainties for an unsupervised method: there was no labeled ground truth for functional equivalence, and the reported results depend on the chosen representation and clustering settings. The study is a static analysis, so questions about debt accumulation, the durability of references, and performance after adoption remain open.
Independent replication is limited because licensing and confidentiality restrictions prevent public release or external sharing of the analyzed dataset. The pipeline source code was also not released because its proprietary GitLab integrations, credential management, and internal toolchain orchestration are covered by corporate intellectual-property restrictions.
The practical implication is narrower than the headline percentages: security and platform teams could use functionally grouped, higher-scoring examples to prioritize reviews and identify reusable patterns. The preprint is an arXiv version 1 document dated 26 August 2026, and its findings need multi-organization, longitudinal, and post-adoption testing before the calculated gap can be treated as a realized security improvement.
Paper data and sources
Original title: Closing the Gap: Automated Discovery of Secure Dockerfile Reference Standards via Semantic Clustering in Enterprise Inner Source
Authors: Jessica Hösl, Benedikt Hofmann, Patrick Stöckle
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-26
DOI: 10.1145/3832783.3834500
Original paper · Full text