From 200 Container CVEs to the Few Dockerfile Lines Worth Fixing: Advait Patel at Global AppSec USA 2026
A container image scan typically returns more than 200 CVEs, most of them noise, with no indication of which few Dockerfile lines a developer should change.
According to Advait Patel's session description, those reports get ignored. Someone spends half a day looking up each CVE, then files the rest as accepted risk.
OWASP DockSec, which Patel created, sits on top of existing scanners rather than replacing them. It runs Trivy, Hadolint and Docker Scout locally. An LLM then correlates the results, removes duplicates, then ranks what matters for the specific setup.
In his Global AppSec USA 2026 demo lab, "DockSec: Closing the Gap Between What Your Scanner Finds and What You Actually Fix", on Thursday, November 5 at 10:30 a.m. in Golden Gate, Advait Patel runs real Dockerfiles through the tool live.
Speaker: Advait Patel, Senior Site Reliability Engineer, Broadcom
The demo includes Dockerfiles that pass standard scanning clean. For each issue DockSec surfaces, it gives a plain-English explanation along with the exact line-level fix.
DockSec produces a 0 to 100 security score for tracking posture over time. It exports HTML, PDF, JSON, CSV or Markdown reports, so security and development teams share one artifact.
Only scan metadata leaves the machine; image contents never do. DockSec works with OpenAI, Anthropic or Google Gemini models, or fully locally through Ollama with no API key, and it runs in CI/CD on every build.
Attendees can bring their own Dockerfiles. Patel also gives a 30-minute DockSec project showcase on Thursday at 2:45 p.m. in Seacliff CD.
Advait Patel is a Senior Site Reliability Engineer at Broadcom in Chicago and a Docker Captain. He has more than eight years of experience in cloud-native architecture, container security and DevSecOps. He is a Google Developer Expert for Google Cloud and AI.
He is a founding member of the OWASP AI Vulnerability Scoring System (AIVSS) project. He has co-authored two Springer books on Google Cloud security, along with Cloud Security Alliance guidance on securing LLM workloads.
His speaking credits include QCon AI Boston, SANS CloudSecNext, OWASP SnowFROC, PlatformCon and the Linux Security Summit North America.
The OWASP DockSec project page shows it reached OWASP Lab status in June 2026, with Arkadii Yakovets as co-leader. It also outputs SARIF and CycloneDX SBOM files. Secrets are redacted before any content reaches an AI provider.
SC World reported about 17,000 PyPI downloads. It also described one startup that cut production CVEs by 78 percent, from about 22 to about 5 per month, while triage time per image fell from about 45 minutes to about 6.
To go deeper on the topic, start here:
- ISACA Podcast: Your Containers Are Probably Full of Holes: Fixing Docker Security with AI (Advait Patel)
- OWASP/DockSec on GitHub
- Help Net Security interview with Advait Patel on DockSec
- SC World: DockSec adoption and triage-time results
- docksec on PyPI
Platform engineers who own container images, and who are tired of untriaged scanner output, are the audience for this demo.
How many open container CVEs does your team currently carry as accepted risk?
3 points · 1 comment
Mentions
From 200 Container CVEs to the Few Dockerfile Lines Worth Fixing: Advait Patel at Global AppSec USA 2026 A container image scan typically returns more than 200 CVEs, most of them noise, with no indication of which few Dockerfile lines a developer should change. According to Advait Patel's session description, those reports get ignored. Someone spends half a day looking up each CVE, then files the rest as accepted risk. OWASP DockSec, which Patel created, sits on top of existing scanners rather than replacing them. It runs Trivy, Hadolint and Docker Scout locally. An LLM then correlates the results, removes duplicates, then ranks what matters for the specific setup. In his Global AppSec USA 2026 demo lab, "DockSec: Closing the Gap Between What Your Scanner Finds and What You Actually Fix", on Thursday, November 5 at 10:30 a.m. in Golden Gate, Advait Patel runs real Dockerfiles through the tool live. Speaker: Advait Patel, Senior Site Reliability Engineer, Broadcom The demo includes Dockerfiles that pass standard scanning clean. For each issue DockSec surfaces, it gives a plain-English explanation along with the exact line-level fix. DockSec produces a 0 to 100 security score for tracking posture over time. It exports HTML, PDF, JSON, CSV or Markdown reports, so security and development teams share one artifact. Only scan metadata leaves the machine; image contents never do. DockSec works with OpenAI, Anthropic or Google Gemini models, or fully locally through Ollama with no API key, and it runs in CI/CD on every build. Attendees can bring their own Dockerfiles. Patel also gives a 30-minute DockSec project showcase on Thursday at 2:45 p.m. in Seacliff CD. Advait Patel is a Senior Site Reliability Engineer at Broadcom in Chicago and a Docker Captain. He has more than eight years of experience in cloud-native architecture, container security and DevSecOps. He is a Google Developer Expert for Google Cloud and AI. He is a founding member of the OWASP AI Vulnerability Scoring System (AIVSS) project. He has co-authored two Springer books on Google Cloud security, along with Cloud Security Alliance guidance on securing LLM workloads. His speaking credits include QCon AI Boston, SANS CloudSecNext, OWASP SnowFROC, PlatformCon and the Linux Security Summit North America. The OWASP DockSec project page shows it reached OWASP Lab status in June 2026, with Arkadii Yakovets as co-leader. It also outputs SARIF and CycloneDX SBOM files. Secrets are redacted before any content reaches an AI provider. SC World reported about 17,000 PyPI downloads. It also described one startup that cut production CVEs by 78 percent, from about 22 to about 5 per month, while triage time per image fell from about 45 minutes to about 6. To go deeper on the topic, start here: - ISACA Podcast: Your Containers Are Probably Full of Holes: Fixing Docker Security with AI (Advait Patel) - OWASP/DockSec on GitHub - Help Net Security interview with Advait Patel on DockSec - SC World: DockSec adoption and triage-time results - docksec on PyPI Platform engineers who own container images, and who are tired of untriaged scanner output, are the audience for this demo. How many open container CVEs does your team currently carry as accepted risk?