arXiv: Closing the Gap: Automated Discovery of Secure Dockerfile Reference Standards via Semantic Clustering in Enterprise Inner Source

This publication introduces a novel AI-driven method for automatically generating secure Dockerfile reference standards by analyzing enterprise inner-source repositories through semantic clustering. Rather than relying on manual expert review or generic public benchmarks, the approach identifies patterns and best practices from an organization’s own codebase, then distills them into standardized, security-hardened Dockerfile templates. The paper demonstrates that this automated process can close gaps between existing ad-hoc container configurations and formal compliance requirements, reducing human error and inconsistency.

The primary audience is large enterprises and regulated sectors—finance, healthcare, and critical infrastructure—that maintain internal software ecosystems and must demonstrate robust container security controls. Organizations using Docker in production, especially those subject to NIS2, DORA, or sector-specific data protection rules, will find this relevant, as it offers a scalable way to enforce secure-by-default configurations across many teams.

Compliance teams should review their current container baseline processes and assess whether manual or static standards are lagging behind actual developer practice. Next steps include evaluating the feasibility of applying semantic clustering to their own repositories, piloting the generated Dockerfile standards in a sandbox environment, and updating internal policy to reference these automated standards as a supplementary control. Early engagement with development and security architecture teams is advised to align on adoption and audit trails.