DRIVE: Dockerfile Rule Mining and Violation Detection

TL;DR

This paper introduces DRIVE, a novel method for mining implicit rules and detecting violations in Dockerfiles, improving quality assurance for containerized application development.

Contribution

DRIVE is the first approach to mine both semantic and syntactic rules in Dockerfiles using pattern mining and heuristic reduction, including nine new semantic rules.

Findings

Identified 34 semantic and 19 syntactic rules, including 9 new semantic rules.

Demonstrated effectiveness of DRIVE on real-world Dockerfiles.

Enabled automated violation detection to improve Dockerfile quality.

Abstract

A Dockerfile defines a set of instructions to build Docker images, which can then be instantiated to support containerized applications. Recent studies have revealed a considerable amount of quality issues with Dockerfiles. In this paper, we propose a novel approach DRIVE (Dockerfiles Rule mIning and Violation dEtection) to mine implicit rules and detect potential violations of such rules in Dockerfiles. DRIVE firstly parses Dockerfiles and transforms them to an intermediate representation. It then leverages an efficient sequential pattern mining algorithm to extract potential patterns. With heuristic-based reduction and moderate human intervention, potential rules are identified, which can then be utilized to detect potential violations of Dockerfiles. DRIVE identifies 34 semantic rules and 19 syntactic rules including 9 new semantic rules which have not been reported elsewhere. Extensive experiments on real-world Dockerfiles demonstrate the efficacy of our approach.