Docker

Language-specific information about the way that SonarQube Cloud supports the analysis of Docker files.

Supported versions

The level of support for a language is defined as follows:

• Fully supported: Analysis will complete. All the language features are understood and examined.
• Supported: Most language features are understood and examined but the version includes unsupported features. Analysis might break or provide incomplete results.

Dockerfile versions 1.0 to 1.6 are supported.

Language-specific properties

To discover and update the Docker-specific properties, navigate in SonarQube Cloud to Your Project > Administration > General Settings > Languages > Docker. See Configuration overview for more information about setting properties.

Dockerfiles

No NoSonar Support:

Trailing comments are not permitted in Dockerfiles. For this reason, our Dockerfile parser does not support NOSONAR comments to suppress issues. Issues and hotspots must be reviewed in the UI.

Missing Uniform Filename Convention:

Dockerfiles can have all kinds of names and do not need a file extension. For this reason, it is difficult for the scanner and the analyzer to recognize all Dockerfiles. By default, all files named Dockerfile, Dockerfile.*, or *.dockerfile are considered Dockerfiles. If other conventions apply, these can be specified via the scanner property sonar.lang.patterns.docker.

In-line suppression of issues

Adding the NOSONAR comment on the line will suppress all issues on that line:

• NOSONAR can be placed anywhere in the comment.
• The comment check is case-sensitive.

Rather than relying on this method, we suggest refining your analysis scope to avoid creating major gaps in your code review. Because the NOSONAR comment silences all current and future issues on a line without regard for their severity, it is an imprecise tool. Even if you only intend to hide a minor stylistic point, you could unintentionally obscure a serious security flaw.

Related Pages

• Analysis parameters

• Analysis scope