SonarQube Server can analyze Infrastructure-as-Code (IaC) languages such as CloudFormation, Kubernetes, and Terraform.
Discover and update the Docker Analysis parameters in Administration > Configuration > General Settings > Languages > Docker
No NoSonar Support:
Trailing comments are not permitted in Dockerfiles. For this reason, our Dockerfile parser does not support NOSONAR comments to suppress issues. Issues and hotspots must be reviewed in the UI.
Missing Uniform Filename Convention:
Dockerfiles can have any name and do not need a file extension. For this reason, it is difficult for the scanner and the analyzer to recognize all Dockerfiles.
By default, all files named Dockerfile, Dockerfile.*, or *.dockerfile are scanned by the Docker analyzer.
To associate additional files to the Docker Language, you can provide a custom list of patterns via the sonar.docker.file.patterns property which is located in the language-specific properties.
Adding a pattern to sonar.docker.file.patterns should be considered carefully, as each file can be assigned to only one language.
For example, adding the pattern dockerfile.* will create a conflict with the Java analyzer if a file named dockerfile.java exists. This will result in a non-functional analysis.
By default, the scanner still analyzes files with the dockerfile.* pattern but does not assign them to the Docker language to prevent having one file with multiple languages.
Patterns that could result in a possible language conflict can be specified via the scanner property sonar.lang.patterns.docker property. Files that are affected by this are analyzed by the scanner but not assigned to the Docker language.
Analysis scope (See also Wildcard patterns)
Last updated
Was this helpful?
Was this helpful?
