LLMs can build working Docker setups from code repos, but miss critical production safeguards

Researchers have investigated whether cutting-edge large language models can synthesize complete Docker and Docker Compose configurations directly from codebase artifacts—without any explicit deployment instructions. The findings highlight both surprising capabilities and persistent blind spots in LLM-generated infrastructure.

What the study tested#

The team evaluated a frontier LLM against three real-world repositories spanning multiple technology stacks: Python, Node.js, .NET, React, Rust, Java, and various databases including Redis, PostgreSQL, and MySQL-compatible systems. The model was given only the source code and dependency files—no developer-written deployment manifests or infrastructure specifications. Success was measured through functional testing (end-to-end HTTP checks) and manual inspection of generated configuration quality.

What the LLM got right#

All three generated environments became operational. The model demonstrated strong understanding of application architecture, correctly reconstructing service topology, mapping application ports, resolving infrastructure dependencies, configuring service hostnames, implementing background workers, and even reverse-proxy setups. It also replicated a file-based Docker secrets mechanism without explicit instruction. One generated configuration required only a minor version bump (Rust base image 1.85 → 1.88) to achieve full functionality.

What it consistently missed#

Despite functional success, the LLM systematically overlooked production-critical practices: network isolation and segmentation, multi-stage Docker builds for reduced image size, dependency-layer caching for faster rebuilds, live-reload volumes for development velocity, production-grade frontend serving, restrictive network policies limiting backend service exposure, and cross-platform build logic. These gaps represent the difference between "runs" and "production-ready."

The core insight#

The study formalizes a distinction between functional correctness—whether the system actually executes—and deployment-intent fidelity—whether it reflects deeper architectural, security, and operational goals. From this analysis, the researchers derive a minimal explicit specification framework: a set of deployment concerns that cannot be reliably inferred from repository artifacts alone and therefore require human specification or additional context.