Graph-Based Representation of Infrastructure-as-Code: Enabling Semantic Reasoning for Containerized Systems

The work by researchers Guilherme M. Soares, Lucas S. Vrielink, Juliano A. Wickboldt, Jéferson C. Nobre, and Lisandro Z. Granville, from the Institute of Informatics at the Federal University of Rio Grande do Sul (UFRGS), proposes a way to transform computer configuration files (such as Docker Compose) into a “smart map” that Artificial Intelligence (AI) can understand, allowing users to get answers to questions about their infrastructure simply by conversing.

The paper, presented at SBRC 2026, addresses a context in which containers (small, isolated systems for running websites and apps) are widely used by approximately 90% of companies (Nutanix 2025), and microservices architectures are becoming increasingly complex.

Orchestration tools such as Kubernetes are increasingly being used to manage this expansion and rising complexity, leading to the Infrastructure as Code (IAC) paradigm. However, tools commonly used for automation (linters, CLIs) focus solely on the containers currently running and the syntax of definition files.

As a result, there is a lack of a unified view of the infrastructure that provides an understanding of how components interact, and existing solutions do not offer facilitating mechanisms such as natural language queries to audit transitive dependencies or security risks in complex architectures.

This means that, currently, companies use hundreds of containers (small, isolated systems), and the instructions for these systems are stored in text files known as Docker Compose files. However, traditional tools only check whether the text is written correctly (i.e., syntax). They cannot “see” the big picture—for example: “If this database fails, which other 10 services will go down?”

The system proposed by the researchers transforms cold, technical files into active knowledge that AI uses to help system administrators avoid serious errors and security attacks much more quickly and easily. The proposed framework creates an intelligent map—or a knowledge graph—based on these files. It’s like a mind map where each service, network, or volume is a node connected to another. This map is organized by an ontology—that is, a set of rules defining how each component can connect to others (for example: a service uses an image; a service connects to a network).

Innovation: Using the Model Context Protocol (MCP) to connect this map to AI (such as ChatGPT or Claude)

The project’s major innovation is using the Model Context Protocol (MCP) to connect this graph to generative AI (such as ChatGPT or Claude). Normally, AI makes up answers if it doesn’t know something. With this system, the AI is required to consult the “smart map” before responding.

Thanks to the use of natural language, you don’t need to be an expert in coding. You can ask, “Are there any security risks on my network?” and the system analyzes all connections to provide the answer.

The researchers tested the system in real-world scenarios, and it uncovered issues that common tools overlook, such as the Domino Effect: it was found that a database failure would bring down a service that wasn’t even directly connected to it, but that depended on other services in between.

Another problem detected was a network intrusion via a “hidden path” that a hacker could use to jump from a public network to a secure private network (lateral movement).

In addition, “port” conflicts were identified, which occur when two services attempt to use the same computer “port” at the same time, causing an error during execution.

The researchers’ full article is available at this link

Leave a Reply

Your email address will not be published. Required fields are marked *