Static code analysis of Dockerfiles?

Question

I was wondering if there is any tool support for analyzing the content of Dockerfiles. Syntax checks of course, but also highlighting references to older packages that need to be updated.

I'm using SonarQube for static code analysis for other code but if it does not support it (I could not find any information that it does), is there is any other tool that does this?

Answer 1

Although this question is 2 years old, however there are two ways to do static analysis of the Dockerfile.

1. using FromLatest
2. using Hadolint

Option#2 is mostly preferable since this can be used as an automated process inside CICD pipelines.

Hadolint also provide ways to exclude messages/errors using ".hadolint.yml"