From 200 CVEs to Actionable Fixes – DockSec Brings AI to Container Security

Ask any developer who has run a container image scan what happens next, and you will hear the same story. The scanner returns 200 CVEs. Most are noise. A handful are real. The report gets closed, the image ships, and the vulnerabilities go with it. That gap between finding a problem and fixing it is what DockSec was built to close.

DockSec is an open-source AI-powered Docker security analyzer, adopted as an OWASP Incubator Project. It was built by Advait Patel, a senior SRE at Broadcom, entirely in his spare time. It is MIT-licensed and can be installed with pip install docksec.

It does not replace existing scanners. It runs Trivy, Hadolint, and Docker Scout locally, then passes only the scan metadata — never image contents — to an LLM of your choice.

The LLM correlates findings across all three, eliminates duplicates, ranks by real-world impact, and generates plain-English explanations with exact Dockerfile fixes. Output formats include HTML, PDF, JSON, Markdown, and CSV. Supported LLM providers are OpenAI, Anthropic Claude, Google Gemini, and Ollama for teams running fully offline.

Patel describes the frustration that drove it: “On a typical day I would scan a container image and get back 200+ CVEs. Most were noise, a few were real, but there was no easy way to tell a developer ‘fix these three lines and you are good.’ Security tools are great at finding problems but bad at helping people fix them.”

Most container security tooling falls into one of two buckets. Pure scanners like Trivy, Grype, and Snyk do the detection work and stop there. Enterprise platforms like Prisma Cloud and Aqua Security wrap detection in policy dashboards sized for large security teams with the budget to match.

DockSec sits between them; it layers correlation, explanation, and a concrete fix on top of scanners developers already run, designed to live inside a CI pipeline or developer terminal rather than a security console nobody opens.

OWASP adoption changed how enterprise teams evaluate it. Before, it was a GitHub project that developers stumbled on. Afterward, it carried the vendor-neutral, community-accountable standing that procurement and security teams look for. MIT license, no enterprise tier gating, no licensing risk.

The production numbers are concrete. An MVAS operator running services across 28 countries and 53 telecom operators integrated DockSec into their Jenkins pipeline and saw critical CVEs reaching production drop 78%, average triage time fall from 45 minutes to 6 minutes per image, and Dockerfile fixes shipped per sprint quadruple.

When a security report takes 6 minutes to read instead of 45, developers actually read it, and that changes everything downstream.

DockSec has 18,000+ downloads on PyPI and 220+ GitHub stars. Patel is presenting at OWASP Global AppSec EU in Vienna in June. If your pipeline is still handing developers a raw CVE list and hoping for the best, that is the problem DockSec was built to solve. Install it with pip install docksec or follow the project on GitHub.