Triage, not detection
DockSec does not compete with Trivy on finding CVEs - it uses Trivy to find them. It ranks what it finds by EPSS exploitation likelihood, so the list you act on is the short one.
node:18 → 2,200 findings → 9 to fix todayDockSec ranks container findings by how likely they are to be exploited, detects exploit chains that span services, and tells you the command to run. Entirely on your own infrastructure.
The problem
CVE-2026-31431 sits at the 100th EPSS percentile - near-certain exploitation. It is rated HIGH, so a severity-sorted list puts it below 226 CRITICAL findings that nobody is exploiting.
That inversion is the whole argument for this tool. DockSec puts it first, labels it Fix Now, and prints the command that resolves it.
Why it is different
Every container scanner produces a list. The useful question is which entries on that list can actually hurt you, and what to do about them.
DockSec does not compete with Trivy on finding CVEs - it uses Trivy to find them. It ranks what it finds by EPSS exploitation likelihood, so the list you act on is the short one.
node:18 → 2,200 findings → 9 to fix todayPer-file scanners see one Dockerfile. DockSec sees the whole Compose topology and reports exploit chains: a socket mount plus a published port is one path to host compromise, not two unrelated findings.
No open-source competitor does thisFully local scanning, Ollama support, working secret redaction, an offline mode, and no telemetry of any kind. For regulated and air-gapped environments this is the qualifying criterion.
Secrets are masked before any AI callExploit chains
A per-file scanner sees a socket mount in one service and a published port in another, and reports two findings. DockSec sees the topology: the service is reachable from outside the host and can escape to it.
Chains are detected deterministically from the Compose graph, so they work with --scan-only and offline. Each one ends with the single change that breaks it.
Remediation
--fix applies only the mechanical subset: pinning a base image, inserting a non-root USER, converting ADD to COPY. It keeps a .bak, refuses to run on a dirty working tree, and shows a diff first.
Anything needing judgement - moving a secret, choosing a base image version - is listed under Needs review rather than applied. An auto-fix that breaks a build gets switched off.
How --fix worksAdoption
No API key, no account, no hosted service. --scan-only runs the full deterministic pipeline, so these all work with nothing configured.
- name: Run DockSec
uses: OWASP/DockSec@v2026.9.21
with:
dockerfile: 'Dockerfile'
fail_on: 'high'
sarif: 'true'
# Exit 1 = gated findings. Exit 3 = incomplete scan.The evaluation guide includes what DockSec does not do, because that is what you actually need to know before adopting a security tool.
An OWASP Lab Project, created by Advait Patel and built in the open. About the project →