Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarLint
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarCloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube

Secrets
ABAP
Apex
AzureResourceManager
C
C++
CloudFormation
COBOL
C#
CSS
Docker
Flex
Go
HTML
Java
JavaScript
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Scala
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML

Docker static code analysis

Unique rules to find Vulnerabilities, Security Hotspots, and Code Smells in your DOCKER code

Tags

Impact

Clean code attribute

Credentials should not be hard-coded
Vulnerability
Using ENV or ARG to handle secrets is security-sensitive
Security Hotspot
Permissions of sensitive mount points should be restrictive
Vulnerability
Server certificates should be verified during SSL/TLS connections
Vulnerability
Weak SSL/TLS protocols should not be used
Vulnerability
Disabling builder sandboxes is security-sensitive
Security Hotspot
Exposing administration services is security-sensitive
Security Hotspot
Recursively copying context directories is security-sensitive
Security Hotspot
Using clear-text protocols is security-sensitive
Security Hotspot
Using weak hashing algorithms is security-sensitive
Security Hotspot
Dockerfile should only have one ENTRYPOINT and CMD instruction
Bug
Access variable which is not available in the current scope
Bug
A space before the equal sign in key-value pair may lead to unintended behavior
Bug
Allowing downgrades to a clear-text protocol is security-sensitive
Security Hotspot
Allowing shell scripts execution during package installation is security-sensitive
Security Hotspot
Using host operating system namespaces is security-sensitive
Security Hotspot
Setting loose POSIX file permissions is security-sensitive
Security Hotspot
"WORKDIR" instruction should be used instead of "cd" commands
Code Smell
Specific version tag for image should be used
Code Smell
Package update should not be executed without installing it
Code Smell
Cache should be cleaned after package installation
Code Smell
Deprecated instructions should not be used
Code Smell
Consent flag should be set to avoid manual input
Code Smell
Environment variables should not be unset on a different layer than they were set
Code Smell
Expanded filenames should not become options
Code Smell
Double quote to prevent globbing and word splitting
Code Smell
Instructions should be upper case
Code Smell
Having executables not owned by root is security-sensitive
Security Hotspot
Automatically installing recommended packages is security-sensitive
Security Hotspot
Running containers as a privileged user is security-sensitive
Security Hotspot
Delivering code in production with debug features activated is security-sensitive
Security Hotspot
Track uses of "TODO" tags
Code Smell
Dockerfile parsing failure
Code Smell
Pulling an image based on its digest is security-sensitive
Security Hotspot

Deprecated instructions should not be used

consistency - conventional

maintainability

Code Smell

MajorSonarSource default severity
click to learn more

Deprecated instructions should be replaced by other suggested instructions.

Why is this an issue?

Languages and technologies evolve, which leads to deprecation of some features. At some day they may be removed. It is important to use up-to-date constructs to avoid issues by migration to newer version of technology.

How to fix it

Code examples

Noncompliant code example

MAINTAINER bob

Compliant solution

LABEL org.opencontainers.image.authors="bob"

How does this work?

The LABEL instruction is much more flexible than MAINTAINER and should be used instead.

Resources

Documentation

Deprecated Engine Features
MAINTAINER (deprecated)🔗 - Dockerfile reference

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Analyze code in your
on-premise CI

© 2008-2023 SonarSource S.A., Switzerland. All content is copyright protected. SONAR, SONARSOURCE, SONARLINT, SONARQUBE, and SONARCLOUD are trademarks of SonarSource S.A. All other trademarks and copyrights are the property of their respective owners. All rights are expressly reserved.
Privacy Policy | Cookie Policy

In-IDE

SaaS

Self-Hosted