owasp/DockSec AI Scanner
AI-powered Docker security scanner that explains vulnerabilities in plain English.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| dockerfile | Path to the Dockerfile to analyze | no | Dockerfile |
| image | Docker image name to scan | no | — |
| compose | Path to docker-compose file to scan | no | — |
| output | Deprecated alias for output_dir. The standalone -o/--output file flag no longer exists; this value is now used as the report output directory. | no | — |
| output_dir | Directory to write reports to (default: ~/.docksec/results in the container) | no | — |
| severity | Comma-separated severity levels for the image scan (default: CRITICAL,HIGH) | no | — |
| fail_on | Exit non-zero if any finding is at or above this severity (CRITICAL, HIGH, MEDIUM, or LOW) | no | — |
| format | Comma-separated report formats to write: json, csv, pdf, html (default: all) | no | — |
| sarif | Write a SARIF 2.1.0 report for GitHub Code Scanning | no | false |
| openai_api_key | OpenAI API Key for AI analysis | no | — |
| anthropic_api_key | Anthropic API Key for AI analysis | no | — |
| google_api_key | Google API Key for AI analysis | no | — |
| llm_provider | LLM provider (openai, anthropic, google, ollama) | no | openai |
| llm_model | Specific model name to use | no | — |
| ai_only | Run AI analysis only | no | false |
| scan_only | Run security scanners only (no AI) | no | false |
| image_only | Scan image without Dockerfile analysis | no | false |
Outputs
no outputs