[FEATURE] Add AI agent framework examples for container security testing

[Ayush7614]

Summary

Add examples/ai-agent-frameworks/ with minimal, runnable Dockerfiles for popular AI agent stacks so users can scan realistic workloads with DockSec (Hadolint, Trivy, Docker Scout, and optional AI analysis).

Problem Statement

Many teams now ship LLM agents in containers (tool use, RAG, MCP servers, multi-agent orchestration). Generic web examples (python-flask-secure, nodejs-vulnerable) do not reflect agent-specific risks:

• API keys and provider tokens in ENV / build args
• Over-broad filesystem or network access for tools
• docker.sock or host path mounts for "agent tools"
• Bloated images from ML/agent dependency trees
• Sidecar patterns (app + Ollama + MCP server) with weak defaults
• Running agents as root in dev-first Dockerfile templates

DockSec already uses LangChain for analysis, but the repo lacks reference Dockerfiles for how to scan agent deployments.

Proposed Solution

Introduce a new examples section with small, educational projects (not production deployments):

Phase 1 (MVP)

Example	Framework	Notes
langchain-fastapi-agent/	LangChain + FastAPI	Aligns with DockSec's own stack; minimal HTTP agent API
crewai-worker/	CrewAI	Common multi-agent pattern; document env-based API keys
README.md	Overview	Scan commands, learning path, shared anti-patterns checklist

Each subfolder includes:

• Dockerfile (and .dockerignore where needed)
• Minimal app entrypoint
• README.md with docksec commands and expected Hadolint/Trivy themes (not exact scores)

Example usage:

docksec examples/ai-agent-frameworks/langchain-fastapi-agent/Dockerfile --scan-only

docker build -t docksec-agent-crewai:local examples/ai-agent-frameworks/crewai-worker
docksec examples/ai-agent-frameworks/crewai-worker/Dockerfile -i docksec-agent-crewai:local --scan-only

Phase 2 (follow-up)

• mcp-server/ - Model Context Protocol sidecar (Node or Python)
• langgraph-api/ - LangGraph-style stateful agent service
• ollama-sidecar-compose/ - app + local model (document compose scan workflow)

Educational "anti-patterns" to demonstrate (then remediate in docs)

• Hardcoded OPENAI_API_KEY / ANTHROPIC_API_KEY in Dockerfile
• USER root with no drop privileges
• Installing curl, git, docker-cli unnecessarily in runtime image
• No .dockerignore → huge build context / secret leakage risk

Pair with a future hardened variant per framework (similar to nodejs-vulnerable → nodejs-secure in #91).

Why this is high value

1. Timely - agent frameworks are a fast-growing deployment surface
2. Differentiated - few security scanners ship agent-oriented Dockerfile curricula
3. Validates DockSec AI - rich findings for credentials, supply chain, and privilege issues
4. OWASP relevance - supports secure-by-default narratives for LLM apps in containers
5. Composable - builds on [FEATURE] Add examples directory and root .dockerignore #90 (examples dir) and complements [FEATURE] Add nodejs-secure example (before/after pair with nodejs-vulnerable) #91 (Node remediation pair)

Out of scope (for this issue)

• Running live agent inference in CI (too slow/flaky)
• Endorsing a single vendor framework as "secure"
• Bundling real API keys or paid model access

Use Case

• Individual developers shipping agents in Docker
• DevOps / platform teams standardizing agent images
• Security teams evaluating container baselines for AI workloads
• OWASP workshops and chapter demos

Acceptance Criteria

Phase 1

• examples/ai-agent-frameworks/README.md with learning path and scan commands
• At least two framework examples build with docker build
• Each example documents fake/placeholder secrets only (no real keys)
• docksec ... --scan-only documented and verified locally for Dockerfile + image
• examples/README.md links to the new section
• Brief table of agent-specific risks vs generic web apps

Testing plan

# Per example
docksec examples/ai-agent-frameworks/<name>/Dockerfile --scan-only
docker build -t docksec-agent-<name>:local examples/ai-agent-frameworks/<name>
docksec examples/ai-agent-frameworks/<name>/Dockerfile -i docksec-agent-<name>:local --scan-only

Optional: compare --scan-only vs full AI run with Ollama/OpenAI for remediation text quality.

Related Issues

• [FEATURE] Add examples directory and root .dockerignore #90 - Examples directory foundation
• [FEATURE] Add nodejs-secure example (before/after pair with nodejs-vulnerable) #91 - Node.js secure remediation pair (pattern for hardened follow-ups)
• [FEATURE] Add Docker Model Runner as a local LLM provider #58 - Docker Model Runner as LLM provider (complementary runtime topic)
• [FEATURE] Add GitHub Actions workflow template for automated Docker security scanning in CI #49 - GitHub Actions CI template (can reference these examples later)

[Ayush7614]

cc: @advaitpatel