Sonar scanner not detecting/scanning hadolint report for Dockerfiles

[aquacode]

Describe what you need to know

I have installed the Sonarqube Hadolint plugin using the Marketplace in Sonarqube UI web interface.
I have a Bitbucket repository with many Dockerfiles scattered throughout in various directories. I run hadolint on each file and generate the hadolint-report.xml using hadolint -f checkstyle < Dockerfile > hadolint-report.xml and this file gets written in the same directory where the Dockerfile resides.
Then I run sonar-scanner using the Sonarqube Docker container in my repository with the following sonar-project.properties:
sonar.lang.patterns.dockerfile=Dockerfile
sonar.hadolint.reports.path=hadolint-report.xml

The sonar-scanner does the scans and uploads the data to my sonarqube instance but nothing from hadolint appears nor do I see output during the sonar-scanner run that indicates it detects any hadolint-report.xml files or Dockerfiles.

User environment

• OS: Mac OSX and Linux
• SonarQube version: 8.8.0
• Java version: 11
• Hadolint version: 2.6
• Plugin version: 1.0.0

[Sancretor]

Hi @aquacode
Thanks for your feedback.

So, with what you put inside your sonar-project.properties, the plugin will only look for these two files at the root of your project.
If none of them exists in this place, the plugin will not import a thing.
If you have multiple Dockerfiles in multiple subdirectories, you may instead use something like :

sonar.lang.patterns.dockerfile=**/Dockerfile

or

sonar.lang.patterns.dockerfile=path/to/subdir1/Dockerfile,path/to/subdir2/Dockerfile

Regarding Hadolint reports, you can't use the same pattern, because it's not intented to work that way.
You should either list every report path inside the sonar.hadolint.reports.path property, or only generate one hadolint report for all Dockerfiles.
For example : hadolint -f checktyle **/Dockerfile > hadolint-report.xml

[aquacode]

Ok, I suppose I have to list out each Dockerfile and report file separately becuase hadolint is not going to scan all Dockerfiles in a **/Dockerfile fashion and create one big report xml file else how will I also specify the source file in the output?
Further, how would the plugin do file highlighting for each and every separate Dockerfile?
Also, I tried specifying **/Dockerfile in sonar.lang.patterns.dockerfile property and it fails to find any Dockerfiles with that pattern.

[Sancretor]

Ok, that's weird, I have to investigate a bit then.
Listing all files separately should work.
Sorry for the inconvenience...

[Sancretor]

Hi @aquacode

After some testing, here's what I can say.

Regarding hadolint, you're right, my example pattern won't work.
Instead, you can use something like this : hadolint -f checkstyle $(find . -name Dockerfile) > hadolint-report.xml
This way, you can generate a single report.
Nevertheless, if no Dockerfile is found, it won't import a thing, because the corresponding files will not exist in SonarQube.

Regarding the plugin, I was able to match all Dockerfiles using the pattern **/Dockerfile I gave you.
Of course, you may adapt this pattern to match your Dockerfiles' name.

Here are the properties I used in a sonar-project.properties at the root of the project :

sonar.lang.patterns.dockerfile=**/Dockerfile
sonar.hadolint.reports.path=hadolint-report.xml

And here is the project architecture I used for testing :

root
|_____dir1
         |_____ subdir1
                   |_____ Dockerfile
         |_____ subdir2
                   |_____ Dockerfile
|_____ dir2
         |_____ subdir1
                   |_____ Dockerfile
         |_____ subdir2
                   |_____ Dockerfile

[aquacode]

Thanks for testing and following up. However, we are in a CI/CD realm and thus are using the hadolint Docker image/container to run the tool. So I modified what you sent to fit our use case and ended up running this:

find . -name Dockerfile -print0 | xargs -0 -I dd sh -c 'docker run --rm -i hadolint/hadolint hadolint -f checkstyle - < "dd" > hadolint-report.xml'

But all this does is iterate over all the found Dockerfiles, runs hadolint on them one by one, and sends the output to hadolint-report.xml, but the file will only contain the very last Dockerfile result, unless I append.

So, does the plugin properly parse/expect a hadolint-report.xml file to have many results in it, each its own separate XML document? Sort of seems like invalid XML, no?

[aquacode]

What I have done instead is to output the hadolint-report.xml alongside each found Dockerfile (as a separate XML document) and then I have to list each hadolint-report.xml file separately in the sonar-project.properties file.

A good enhancement to the plugin would be the ability to set sonar-project.properties to the following:

sonar.lang.patterns.dockerfile=**/Dockerfile
sonar.hadolint.reports.path=**/hadolint-report.xml

This way it finds all the Dockerfiles and all the report files?

[Sancretor]

Hi @aquacode

Regarding the use of the Hadolint Docker Image, you're right, your example won't work because it will override the previous output.
I can't give you an immediate solution, other than generate a report for each Dockerfile and add every XML reports in the sonar.hadolint.reports.path property (like you said).

But this would be extremely boring, I agree...
Instead, I'd like to find a way to implement the pattern feature like the sonar.lang.patterns.dockerfile property (also like you said).
Hopefully for the upcoming release...

What do you think about it ?