Automating App Security Tests in Development with Docker

Gabe Schuyler introduces Docker as a lightweight way to run security tools against web applications. Containers are presented as small, single-purpose environments that start in seconds, can be discarded after each run, and are rebuilt from scratch rather than patched. The opening section makes the case for testing early and often, borrowing developers' knowledge of their own inputs and endpoints, and treating security checks as cheap enough to run on every change.

The live demonstrations launch an intentionally vulnerable web application in a container and point scanning tools at it, including ZAP and Nikto, then move to application-specific tools such as WPScan against a containerized WordPress site. Docker Compose brings up a web server and database together. The talk also shows how exit codes from containerized tools can drive pipeline decisions, how a Dockerfile can freeze a preconfigured attack image, and how parameter lists or API specifications from developers can narrow injection and fuzzing work. Fuzzing with tools such as ffuf is noted as a longer-running option.

The closing part frames this as shift-left security: running the same containerized checks during development, in CI/CD, and even in monitoring, then sharing results with developers. The main takeaway is to start small with one web application in a development environment, add a few basic scans, and grow toward pipeline integration with developer input.