ChimangoScan

Large-scale security measurement of the Docker Hub image ecosystem.
Built at AI Horizon Labs.

Docker Hub is where most containerized software is distributed from, and almost nobody measures it at scale. The studies that exist tend to sample the popular images and to trust a single scanner. ChimangoScan is the pipeline we built to do it properly: enumerate the namespace, decide which images actually matter, scan them with several independent tools, and publish the data rather than only the conclusions.

The core idea is an exposure score. An image matters not only for its own pull count but for the pulls of every image that inherits its layers, so we reconstruct the layer graph and rank by inherited weight. That is what makes it possible to cover most of the ecosystem's real usage without scanning all of it.

One result is worth stating on its own, because it decides how the rest should be read: the measured security posture depends heavily on which tool you use. Of the distinct vulnerabilities the three vulnerability scanners find, only 2.7% are reported by all three and 66.8% by a single one. Any single-scanner census is measuring its scanner as much as it is measuring Docker Hub.

Two findings from the companion studies are worth carrying here. Posture is not driven by how popular or how large an image is, but by the distribution it comes from and by its age. And about one in twelve images ever published can no longer be pulled by a current Docker, because its manifest schema is too old.

	scanners The tool. It runs a battery of container-security scanners over a list of images, on one machine or many, and consolidates every finding into a single schema. The picture is the finding that justifies it: one crate, six lamps, six different shadows.
	chimangoscan Vulnerabilities, Secrets and Misconfiguration in the Highest-Exposure Docker Hub Images, the 12.7 million repository study (arXiv:2608.02669).
	os-census A Multi-Scanner Census of the Linux Operating-System Base Images of Docker Hub, SBSeg 2026 (SBC OpenLib). Every container starts from an OS base image: 5,606 of them, across 20 repositories, scanned with 14 tools. Whatever is wrong at the bottom repeats in everything built on top.
	chimango-baseline A Uniform Random-Sample Security Measurement of Docker Hub Images, SBSeg 2026 (SBC OpenLib). What the typical image looks like, from 2,879 drawn uniformly at random across the whole registry rather than from the tall pile everyone measures.

Each artifact repository carries the pipeline configuration, the corpus definition and the scripts that regenerate every number, figure and table of its paper, so a reader can recompute a result instead of trusting it.

The highest-exposure study has a page of its own, with the mechanism, the numbers and the PDF.

We work at AI Horizon Labs, a research group on artificial intelligence and software engineering at the Universidade Federal do Pampa (UNIPAMPA), on the Alegrete campus in Rio Grande do Sul, Brazil.

	CRISTHIAN KAPELINSKI works on security, privacy, and machine learning at AI Horizon Labs, Universidade Federal do Pampa (UNIPAMPA). He has held research fellowships with the Brazilian National Research and Education Network (RNP), where he led the AnonShield and AnonLFI pseudonymization frameworks, with the Instituto Tecnológico de Aeronáutica (ITA), and with the LARC laboratory of the University of São Paulo (USP). His interests include privacy and memorization in language models, their use in security operations and the attacks against them, and large-scale measurement of software ecosystems. ORCID · Lattes · Scholar · GitHub · LinkedIn
	BEATRIZ MACHADO works on cybersecurity research at AI Horizon Labs, Universidade Federal do Pampa (UNIPAMPA), on vulnerability analysis, data anonymization, and the use of language models to automate security work. She was a research fellow with the Brazilian National Research and Education Network (RNP), and wrote MulitaMiner, which turns the heterogeneous reports of security scanners into structured records with the help of language models. That work received second place for best paper at WRSeg 2025. ORCID · Lattes · GitHub · LinkedIn
	DIEGO KREUTZ is a professor and researcher at AI Horizon Labs, Universidade Federal do Pampa (UNIPAMPA), where he has taught since 2008 and coordinates the group. He received the B.S. degree in computer science and the M.Sc. degrees in production engineering and in informatics from the Universidade Federal de Santa Maria (UFSM), and the Ph.D. degree in computing, and has carried out research at the University of Lisbon, the University of Luxembourg and Monash University. His interests include cybersecurity and adversarial AI, language models, AutoML, distributed systems and networks, and software artifact engineering. ORCID · Lattes · Scholar · GitHub · LinkedIn

Lattes is the Brazilian national registry of researcher CVs, maintained by CNPq, the federal research council.

A chimango is a caracara of the Pampa, the grasslands of southern Brazil. It is the bird that circles a field slowly and misses nothing, which is roughly the job description.

Each repository carries a CITATION.cff and a citation section at the end of its README. Cite the paper the artifact belongs to rather than the repository URL alone.