1. What Quality Aspects Influence the Adoption
of Docker Images?
Giovanni Rosa, Simone Scalabrino, Gabriele Bavota
and Rocco Oliveto
38th International Conference on
Automated Software Engineering
11-15 September 2023, ECCL (Luxembourg)
@giovannipink
University of Molise, Italy
ASE
2023

2. Why Docker?
#1 most-desired
and
#1 most-used
dev tool

3. Docker in a nutshell
Dockerfile
base image

4. Docker in a nutshell
Dockerfile Image Container
run
build
base image

5. Docker in a nutshell
Dockerfile Image Container
run
build
base image
push
pull
hub

6. Which Docker image to choose?

7. Which Docker image to choose?

8. Which Docker image to choose?

9. How to describe
a «good» Docker image?

10. “smells are very common
in Dockerfile codes”
“images contain more than
180 vulnerabilities on average”
“community images are more
resource-efficient and have
fewer vulnerabilities”
Wu et. al 2020

11. “smells are very common
in Dockerfile codes”
“images contain more than
180 vulnerabilities on average”
“community images are more
resource-efficient and have
fewer vulnerabilities”
Wu et. al 2020
Shu et. al 2017

12. “smells are very common
in Dockerfile codes”
“images contain more than
180 vulnerabilities on average”
“community images are more
resource-efficient and have
fewer vulnerabilities”
Wu et. al 2020
Shu et. al 2017
Ibrahim et. al 2020

13. What quality features
characterize the adoption
of a Docker image
(and its Dockerfile)

14. Step 1:
Learning from
the Literature

15. Performance
Script
Quality
Security
Update
Status
Officiality
Evolution
Image Size
Packages
Vulnerabilities
Inherited
Vulnerabilities
Best Practices
Violation
Size
Base Image Dependencies
Externally observable
features
Instruction
Diversity
External
Resources
Project Activity
Evolutionary
trajectories
category
(C-1, C-3, C-6)
Image Type
Num. of
docker
violations
SLOC
Metadata Documentation
Avg. actions
in instruction
block
Perc. of
comments
over LOC*
Usage of
EXPOSE*
Usage of
external
resources
Usage of
LABEL
Usage of
ENV*
Usage of
build ARG*
Num. of
docker
instructions*
Num. of
shell script
violations
Project age
Num. of
contributors
Is official
Base image
is up-to-date
Num. of
out-of-date
dependencies
Num. of
vulnerabilities
(current image)
Num. of
vulnerabilities
(parent image)
Build time
Image size
Num. of
layers
Effort
Code
Contributions
Instruction
entropy
Usage of
additional
script
Build success
1
9 2 1 1 1
1
1 4 2
8
3
2 11
6
Status
4
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- -
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
-
-
+
+
-
- -
-
-
-
-
-
-
-
+
+
Build
Best
Practices
Image user is
ROOT
-
-
Num. of
exposed secrets
-
-
+
+
3
Presence of
temporary
files smell
-
-
Configuration-related
features
31papers
Literature
review

16. Externally observable
features
Has “official image” badge
Image size (on disk)
Num. of security vulnerabilities
….
e.g.
Taxonomy of
quality metrics
6metrics

17. Configuration-related
features
Num. of Dockerfile Smells
Num. of Source Lines of Code (SLOC)
Image Build time
…
22metrics
e.g.
Taxonomy of
quality metrics

18. Step 2:
Catching the
Developers’ Preferences

19. Can the externally observable features
explain the developers’ preference
for a Docker image?
RQ1

20. ~2.4kDocker images
RQ1: Context
~50k
open-source
repos

21. ~2.4kDocker images
~50k
open-source
repos
RQ1: Context
App name Flavour
Version
10most-used apps

22. GLM
RQ1: Experiment
Docker images
with
quality metrics

23. GLM
RQ1: Experiment
Docker images
with
quality metrics App name
App version
R.E.
2 x

24. GLM
RQ1: Experiment
“ I like this image”
“I am using this image”
Docker images
with
quality metrics App name
App version
R.E.
2 x

25. RQ1: Results
Image user
is ROOT
Number of
vulnerabilities
Number of
exposed secrets
Image size
Is official
Number of
DockerHub stars
Number of
adoptions

26. Image user
is ROOT
Number of
vulnerabilities
Number of
exposed secrets
Image size
Is official
Number of
DockerHub stars
Number of
adoptions
RQ1: Results

27. Are configuration-related features
correlated with
externally observable features ?
RQ2

28. 2.4k
Docker images
10
most-used
apps
~300with
source Dockerfiles
RQ2: Context

29. GLM
RQ2: Experiment
# vulnerabilities
# exposed secrets
# image size
App name
App version
R.E.
3 x

30. Project age
Number of shell
script smells
SLOC
Usage of
additional script
Number of
layers
Instructions
entropy
Image user
is ROOT
Number of
vulnerabilities
Number of
exposed secrets
Image size
Is official
Number of
DockerHub stars
Number of
adoptions
RQ2: Results

31. Project age
Number of shell
script smells
SLOC
Usage of
additional script
Number of
layers
Instructions
entropy
Image user
is ROOT
Number of
vulnerabilities
Number of
exposed secrets
Image size
Is official
Number of
DockerHub stars
Number of
adoptions
RQ2: Results

32. Project age
Number of shell
script smells
SLOC
Usage of
additional script
Number of
layers
Instructions
entropy
Image user
is ROOT
Number of
vulnerabilities
Number of
exposed secrets
Image size
Is official
Number of
DockerHub stars
Number of
adoptions
Project age
Number of shell
script smells
SLOC
Usage of
additional script
Number of
layers
Instructions
entropy
Image user
is ROOT
Number of
vulnerabilities
Number of
exposed secrets
Image size
Is official
Number of
DockerHub stars
Number of
adoptions
RQ2: Results

33. Developers mostly adopt
official images
Takeaways

34. Developers mostly adopt
official images
Fewer SLOC not means a
lower image size
Takeaways

35. Developers mostly adopt
official images
Fewer SLOC not means a
lower image size
Code smells are not
related with adoption
Takeaways

36. Giovanni Rosa
giovanni.rosa@unimol.it
Summary
Get the
paper here!