Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarLint
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarCloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube

Secrets
ABAP
Ansible
Apex
AzureResourceManager
C
C#
C++
CloudFormation
COBOL
CSS
Dart
Docker
Flex
Go
HTML
Java
JavaScript
JCL
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Scala
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML

Docker static code analysis

Unique rules to find Vulnerabilities, Security Hotspots, and Code Smells in your DOCKER code

Tags

Impact

Clean code attribute

Credentials should not be hard-coded
Vulnerability
Using ENV or ARG to handle secrets is security-sensitive
Security Hotspot
Permissions of sensitive mount points should be restrictive
Vulnerability
Server certificates should be verified during SSL/TLS connections
Vulnerability
Weak SSL/TLS protocols should not be used
Vulnerability
Disabling builder sandboxes is security-sensitive
Security Hotspot
Exposing administration services in containers is security-sensitive
Security Hotspot
Recursively copying context directories is security-sensitive
Security Hotspot
Using clear-text protocols is security-sensitive
Security Hotspot
Using weak hashing algorithms is security-sensitive
Security Hotspot
Malformed JSON in Exec form leads to unexpected behavior
Bug
Dockerfile should only have one ENTRYPOINT and CMD instruction
Bug
Access variable which is not available in the current scope
Bug
A space before the equal sign in key-value pair may lead to unintended behavior
Bug
Allowing downgrades to a clear-text protocol is security-sensitive
Security Hotspot
Allowing shell scripts execution during package installation is security-sensitive
Security Hotspot
Using host operating system namespaces is security-sensitive
Security Hotspot
Setting loose POSIX file permissions is security-sensitive
Security Hotspot
Reduce the amount of consecutive RUN instructions
Code Smell
Prefer COPY over ADD for copying local resources
Code Smell
WORKDIR instruction should only be used with absolute path
Code Smell
Too long RUN instruction should be split into multiple lines
Code Smell
Prefer Exec form for ENTRYPOINT and CMD instructions
Code Smell
"WORKDIR" instruction should be used instead of "cd" commands
Code Smell
Specific version tag for image should be used
Code Smell
Package update should not be executed without installing it
Code Smell
Cache should be cleaned after package installation
Code Smell
Deprecated instructions should not be used
Code Smell
Consent flag should be set to avoid manual input
Code Smell
Environment variables should not be unset on a different layer than they were set
Code Smell
Expanded filenames should not become options
Code Smell
Double quote to prevent globbing and word splitting
Code Smell
Instructions should be upper case
Code Smell
Allowing non-root users to modify resources copied to an image is security-sensitive
Security Hotspot
Automatically installing recommended packages is security-sensitive
Security Hotspot
Running containers as a privileged user is security-sensitive
Security Hotspot
Delivering code in production with debug features activated is security-sensitive
Security Hotspot
Use ADD instruction to retrieve remote resources
Code Smell
Arguments in long RUN instructions should be sorted
Code Smell
Track uses of "TODO" tags
Code Smell
Descriptive labels are mandatory
Code Smell
Use digest to pin versions of base images
Code Smell
Dockerfile parsing failure
Code Smell
Pulling an image based on its digest is security-sensitive
Security Hotspot

Cache should be cleaned after package installation

intentionality - efficient

maintainability

Code Smell

MajorSonarSource default severity
click to learn more

In Docker, when packages are installed via a package manager, an index is cached locally by default. This index should either be cleaned up or stored in a dedicated cache mount.

Why is this an issue?

How can I fix it?

More Info

Docker images should only contain the necessary data. The package index is redundant for the correct operation of the installed software. Storing an index also increases the size of the Docker image. It should be reduced to speed up deployments and reduce storage and bandwidth.

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Analyze code in your
on-premise CI

© 2008-2024 SonarSource SA. All rights reserved. SONAR, SONARSOURCE, SONARQUBE, and CLEAN AS YOU CODE are trademarks of SonarSource SA.

Sonar helps developers write Clean Code.
Privacy Policy | Cookie Policy

In-IDE

SaaS

Self-Hosted