一句话：提出六阶段流水线，用LLM语义聚类挖掘企业内源Dockerfile参考标准并量化安全优化差距。
企业内源 Dockerfile 的安全配置错误与技术债缺乏理解，开源发现难以直接适用。本文提出六阶段流水线：爬取企业 GitLab，用 Hadolint、ShellCheck、Trivy 补充静态安全/质量指标与生命周期数据，借助 LLM 语义描述和 HDBSCAN 聚类功能相同工作负载，并以簇内参考实现量化优化差距。对某工业企业 6,200 多仓库的 11,470 个 Dockerfile 分析发现：99% 至少含一项安全配置错误，80.8% 违反最佳实践，中位文件 838 天未修订；但 83% 功能簇内已有高质量参考实现，采用内部标准可使平均安全态势得分提高 60.4%，无需新模板。该结果仍限于单一企业，泛化性待多组织研究。
Containerization dominates enterprise software delivery, yet Dockerfiles that assemble container images frequently harbor security misconfigurations and structural technical debt. This problem is poorly understood in corporate inner-source environments, where proprietary context and isolated governance prevent direct application of open-source findings. We present an automated, six-stage pipeline that: (1) crawls an enterprise GitLab instance, (2) enriches each Dockerfile with static security and quality metrics (Hadolint, ShellCheck, Trivy) and lifecycle data, (3) groups functionally identical workloads using LLM-generated semantic descriptions and HDBSCAN, and (4) quantifies the optimization gap against cluster-internal reference implementations. Applied to 11,470 Dockerfiles from over 6,200 repositories at a single large industrial company, we find a systemic deficit: 99\% of files contain at least one security misconfiguration, 80.8\% violate Dockerfile best practices, and the median artifact has not been revised for 838~days. Despite this, high-quality reference implementations already exist within 83\% of functional clusters. Adopting these internal standards would increase the average security posture score by 60.4\% without developing any new templates. These findings, grounded in one organization's inner-source ecosystem, provide a data-driven foundation for future automated, context-aware recommender systems targeting enterprise supply-chain security; whether the observed technical-debt distribution and optimization gap generalize to other enterprises remains an open question for future multi-organization study.
@inproceedings{paperbot12475,
title = {Closing the Gap: Automated Discovery of Secure Dockerfile Reference Standards via Semantic Clustering in Enterprise Inner Source},
author = {Jessica Hösl and Benedikt Hofmann and Patrick Stöckle},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834500}
}