Search code examples
dockerstatic-analysiscoverity

Coverity scan while building in Docker container


I have a custom Docker container in which I perform build and test of a project. It is somehow integrated with Travis CI. Now I want to run the Coverity scan analysis from within the Travis CI as well, but the tricky part is (if I understand the Coverity docs correctly), that I need to run the build. The build, however, runs in the container.

Now, according to the cov-build --help

The cov-build or cov-build-sbox command intercepts all calls to the compiler invoked by the build system and captures source code from the file system.

What I've tried:
cov-build --dir=./cov docker exec -ti container_name sh -c "<custom build commands>"

With this approach, however, Coverity apparently does not catch the calls to the compiler (it is quite understandable considering Docker philosophy) and emits no files

What I do not want (at least while there is hope for a better solution):

  • to install locally all the necessary stuff to build in the container only to be able to run Coverity scan.
  • to run cov-build from within the container, since:

    • I believe this would increase the docker image size significantly
    • I use Travis CI addon for the Coverity scan and this would complicate things a lot.


The Travis CI part just FWIW, tried all that locally and it doesn't work either.

I am thrilled for any suggestions to the problem. Thank you.


Solution

  • Okay, I sort of solved the issue.

    • I downloaded and modified ( just a few modification to fit my environment ) the script that Travis uses to download and run Coverity scan.

    • Then I installed Coverity to the host machine (in my case Travis CI machine).

    • I ran the docker container and mounted the directory where the Coverity is installed using docker run -dit -v <coverity-dir>:<container-dir>:ro .... This way I avoided increasing the docker image size.

    • Executed the cov-build command and uploaded the analysis using another part of the script directly from docker container.

    Hope this helps someone struggling with similar issue.