Analyze Docker & Kubernetes files with Qodana

Hi! In this article, I’ll cover the interesting tool Qodana and how you could use it in CI/CD processes to scan your Docker and Kubernetes files with my Cloud Security plugin for JetBrains IDEs.

What is Qodana?

The Qodana is JetBrains’s static code analysis and code quality platform, built on the same inspection engine as JetBrains IDEs. It brings the smart code inspections from the IDE directly into your CI/CD processes.

In other words, Qodana runs the familiar IntelliJ IDEA/PhpStorm/WebStorm inspections in an automated manner to detect bugs, security vulnerabilities, and code quality issues in your project.

My Docker and Kubernetes scanner for JetBrains IDE utilizes the same IntelliJ platform as Qodana’s, allowing me to easily integrate my own inspections and run them in the CLI.

Using Qodana for Code Analysis

Before showing an example of how to scan Docker and Kubernetes files with Qodana, I’d like to explain typical ways in which you could analyze your code with Qodana.

Running Qodana in the IDE

The Qodana is bundled into JetBrains IDEs as a plugin(s). You can run a Qodana analysis from inside the IDE to get an overview of issues.

This allows you to experiment with Qodana locally – a Qodana tab in the IDE displays the analysis results, and you can view an HTML report or connect to the Qodana Cloud. Running Qodana in an IDE doesn’t require a separate license and helps you ensure that the CI checks will match your local findings.

Running Qodana via Command-Line or Docker

Qodana provides a CLI (qodana command, which essentially orchestrates the appropriate Docker container to run the analysis. You can easily install the Qodana CLI using Homebrew and other package managers. For more information, refer to their documentation.

Also, you could simply use docker run it manually. For example, to scan a project with Qodana, you might run:

docker pull jetbrains/qodana-jvm-community:latest
docker run --rm -v $(pwd):/data/project/ jetbrains/qodana-jvm-community:latest

This would run the Qodana analysis on the current directory (mounted as /data/project inside the container). By default, results are saved to an output folder (or can be viewed in the generated HTML report).

This feature will enable us to scan Docker and Kubernetes files in CI/CD using a plugin.

Cloud (IaC) Security Plugin for JetBrains IDEs

Let me tell you a bit about my plugin. It is an open-source plugin that adds security scanning for Docker and Kubernetes configuration files. (I mentioned this multiple times in the article, sorry for the repetition)

The plugin performs real-time inspections of your infrastructure-as-code (IaC) files (like Dockerfiles, Docker Compose files, and Kubernetes YAML manifests) with 50+ rules inspired by industry best practices.

If you are interested in Docker Security Best Practices or Kubernetes, click on those links. Two of these articles cover problems that my plugin could highlight. Additionally, each problem has a dedicated page in the documentation for those who want more examples.

Integrating Qodana with the Cloud Security Plugin

Now that I described briefly the functionality of Qodana (our analyzer) and the Cloud (IaC) Security plugin (which knows how to scan Docker/Kubernetes files), the goal is to use them together: i.e., run Qodana in headless mode to scan our code, including any Docker and K8s manifest checks from the plugin.

How to add the plugin to Qodana: Qodana can load additional IntelliJ plugins during analysis. JetBrains provides a simple way to do this via a configuration file. In the root of your project, you can create a qodana.yaml configuration (or update your existing one) to include the Cloud Security plugin from JetBrains Marketplace.

For example, you could add the following to your Qodana config:

version: "1.0"
profile:
  name: qodana.recommended
plugins:
  - id: Docker
  - id: org.jetbrains.plugins.yaml
  - id: dev.protsenko.security-linter
include:
  # docker-compose + k8s (YAML)
  - name: DockerCompose
  - name: NonRootContainer
  - name: InsecureCapabilities
  - name: HostNetworkPidIpc
  - name: PrivilegedContainers
  - name: HostPathVolumes
  - name: HostPorts
  - name: AppArmorOverride
  - name: SettingSELinux
  - name: InsecureProcMount
  - name: SeccompProfile
  - name: InsecureSysctls
  - name: DisallowedVolumeType
  # Dockerfile
  - name: DockerfileCmdAndEntrypoint
  - name: DockerfileCopyAndAdd
  - name: DockerFileEnv
  - name: DockerfileExpose
  - name: DockerfileFrom
  - name: DockerfileHealthCheck
  - name: DockerfileMaintainer
  - name: DockerfileRun
  - name: DockerfileUser
  - name: DockerfileWorkdir

With this configuration, you can enable my plugin to perform Docker and Kubernetes scanning in your project. From the IDE, it will appear as shown in the following screenshot.

Via CLI, you’ll get something like this; that’s all (almost) you need to integrate Qodana into CI/CD processes.

Configuration of CI/CD for Qodana

It’s actually easy. With the IDE and the Qodana plugin, you can configure CI/CD for various systems, including GitHub Actions, Jenkins, TeamCity, and others.

So, the configuration for CI/CD is not complex, and I’ve no idea what I could describe here. Give it a try, and I think you’ll be pleased with this solution. Developers of Qodana have done great work in this field.

At the end

By combining Qodana with the Cloud (IaC) Security plugin, you can perform comprehensive static analysis that includes both application code and Docker and Kubernetes configuration files.

Qodana provides a platform for running inspections in a consistent and automated way, and the Cloud Security plugin contributes a rich set of DevSecOps rules (covering Docker best practices and Kubernetes security standards) to Qodana’s arsenal.

If you enjoy my articles, please connect with me on LinkedIn to stay informed about new content. If you’re interested in IntelliJ IDEA plugin development, read my latest: IntelliJ IDEA Plugin Development: What Have I Learned