This repository contains the source for the official SonarScanner CLI Docker images. The images let projects run SonarQube analysis without installing the scanner directly on the host.
Get the images from Docker Hub, read the SonarScanner CLI documentation, or learn more about the SonarQube product family.
NB: These Docker images are not compatible with C# and Objective-C projects. For C&C++, the docker images are only compatible with AutoConfig mode.
For information on how to use and configure the image, head over to the Docker section of SonarScanner CLI docs.
For support questions ("How do I?", "I got this error, why?", ...), please first read the documentation and then head to the SonarSource forum. There are chances that a question similar to yours has already been answered.
Be aware that this forum is a community, so the standard pleasantries ("Hi", "Thanks", ...) are expected. And if you don't get an answer to your thread, you should sit on your hands for at least three days before bumping it. Operators are not standing by. :-)
If you would like to see a new feature or report a bug, please create a new thread in our forum.
Please be aware that we are not actively looking for feature contributions. We typically accept minor improvements and bug fixes.
With that in mind, if you would like to submit a code contribution, please create a pull request for this repository. Please explain your motives to contribute this change: what problem you are trying to fix, what improvement you are trying to make.
Copyright 2015-2025 SonarSource.
Licensed under the GNU Lesser General Public License, Version 3.0
The image temporarily distrusts the emSign ECC Root CA - G3 root through AL2023's native CA blocklist while Amazon's eMudhra fix is pending. Regenerating system trust also updates Corretto's default Java trust store. Node uses the system CA store through NODE_OPTIONS=--use-openssl-ca; Python's standalone certifi and pip's vendored bundle are updated independently.
This follows the Java mitigation guidance for the affected trust path present in this base. The other affected anchor, AAA Certificate Services, is already absent from the investigated AL2023 stores; alternate cross-signed paths must still be retested when updating the base. Distrusting the root can also reject legitimate certificates issued through that root. Review the mitigation when Amazon's fixed packages become available. Its DER SHA-256 fingerprint is 86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b.
Custom or mounted trust stores, overridden Node options, and JREs provisioned by SonarQube Server or Cloud need separate verification. Rebuild and replace existing images/containers to apply this mitigation.