Abstract:

A Dockerfile is a text file used for building Docker container images. It includes a series of instructions and configurations that outline how to assemble a Docker container’s environment. Dockerfile misconfigurations can cause numerous performance and security issues. The existing rule-mining based detection and repair methods focus predominantly on associations within common commands, while neglect dependencies between commands. These methods usually target high-frequency commands, however ignore patterns with low frequencies. In response to the above issues, a method for subtree sequence rule mining-based Dockerfile misconfiguration detection and repair was proposed. First, the Dockerfile was converted into an abstract syntax tree. This tree was broken down into ordered subtrees, which were serialized to form an intermediate representation. Second, the subtrees were grouped into clusters. A sequence rule mining algorithm was then applied to these clusters for rule extraction. Meanwhile, the left-hand side of the rules was constrained to the root node of the subtrees, focusing on target instructions and preventing the explosive growth of rule generation. Finally, the largest sequence rules were identified to synthesize common command combinations, and semantic rules were derived to serve as a guideline for Dockerfile violation detection and automatic repair. Experiments show that this method successfully extracts 31 semantic rules, including 12 rules that are previously unpublished. It improves the precision rate of violation detection by 10% and the success rate of repair by 5.6% compared to baseline methods.

Key words: Docker, Dockerfile, rule mining, violation detection, automatic repair