Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarLint
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarCloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube

Secrets
ABAP
Ansible
Apex
AzureResourceManager
C
C#
C++
CloudFormation
COBOL
CSS
Dart
Docker
Flex
Go
HTML
Java
JavaScript
JCL
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Scala
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML

Docker static code analysis

Unique rules to find Vulnerabilities, Security Hotspots, and Code Smells in your DOCKER code

Tags

Impact

Clean code attribute

Credentials should not be hard-coded
Vulnerability
Using ENV or ARG to handle secrets is security-sensitive
Security Hotspot
Permissions of sensitive mount points should be restrictive
Vulnerability
Server certificates should be verified during SSL/TLS connections
Vulnerability
Weak SSL/TLS protocols should not be used
Vulnerability
Disabling builder sandboxes is security-sensitive
Security Hotspot
Exposing administration services in containers is security-sensitive
Security Hotspot
Recursively copying context directories is security-sensitive
Security Hotspot
Using clear-text protocols is security-sensitive
Security Hotspot
Using weak hashing algorithms is security-sensitive
Security Hotspot
Malformed JSON in Exec form leads to unexpected behavior
Bug
Dockerfile should only have one ENTRYPOINT and CMD instruction
Bug
Access variable which is not available in the current scope
Bug
A space before the equal sign in key-value pair may lead to unintended behavior
Bug
Allowing downgrades to a clear-text protocol is security-sensitive
Security Hotspot
Allowing shell scripts execution during package installation is security-sensitive
Security Hotspot
Using host operating system namespaces is security-sensitive
Security Hotspot
Setting loose POSIX file permissions is security-sensitive
Security Hotspot
Reduce the amount of consecutive RUN instructions
Code Smell
Prefer COPY over ADD for copying local resources
Code Smell
WORKDIR instruction should only be used with absolute path
Code Smell
Too long RUN instruction should be split into multiple lines
Code Smell
Prefer Exec form for ENTRYPOINT and CMD instructions
Code Smell
"WORKDIR" instruction should be used instead of "cd" commands
Code Smell
Specific version tag for image should be used
Code Smell
Package update should not be executed without installing it
Code Smell
Cache should be cleaned after package installation
Code Smell
Deprecated instructions should not be used
Code Smell
Consent flag should be set to avoid manual input
Code Smell
Environment variables should not be unset on a different layer than they were set
Code Smell
Expanded filenames should not become options
Code Smell
Double quote to prevent globbing and word splitting
Code Smell
Instructions should be upper case
Code Smell
Allowing non-root users to modify resources copied to an image is security-sensitive
Security Hotspot
Automatically installing recommended packages is security-sensitive
Security Hotspot
Running containers as a privileged user is security-sensitive
Security Hotspot
Delivering code in production with debug features activated is security-sensitive
Security Hotspot
Use ADD instruction to retrieve remote resources
Code Smell
Arguments in long RUN instructions should be sorted
Code Smell
Track uses of "TODO" tags
Code Smell
Descriptive labels are mandatory
Code Smell
Use digest to pin versions of base images
Code Smell
Dockerfile parsing failure
Code Smell
Pulling an image based on its digest is security-sensitive
Security Hotspot

Descriptive labels are mandatory

consistency - conventional

maintainability

Code Smell

MajorSonarSource default severity
click to learn more

This rule raise an issue when one of the mandatory label are missing.

Why is this an issue?

How can I fix it?

More Info

Adding labels to your image help to organize images by project, record licensing information, aid in automation and for other reasons.
The rule provide the possibility to configure the list of mandatory label that must be present in every Dockerfile.

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Analyze code in your
on-premise CI

© 2008-2024 SonarSource SA. All rights reserved. SONAR, SONARSOURCE, SONARQUBE, and CLEAN AS YOU CODE are trademarks of SonarSource SA.

Sonar helps developers write Clean Code.
Privacy Policy | Cookie Policy

In-IDE

SaaS

Self-Hosted