You're right it is a question of coverage of execution paths, but that's a non-trivial problem. Have a look at the lengths that AFL uses to get even close: htt

You're right it is a question of coverage of execution paths, but that's a non-trivial problem. Have a look at the lengths that AFL uses to get even close: http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/ [tl;dr it intruments execution while using a genetic algorithm to mutate inputs optimising for code coverage] Statically determining dependencies is a lot easier and a lot more reliable! Particularly as you only need the base image once, and any extras on top are another layer on the Docker FS.