SonarQube container scanning is now in open beta

Source: SonarSource•

SonarQube container scanning is now in open beta

Scan the container images you build and ship for vulnerabilities and malicious packages. Included with SonarQube Advanced Security. Join the open beta.

Frequently asked questions

Does SonarQube detect PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?

Yes, in container images that install PHP from a Linux distribution package, such as apt install php8.x on Debian or Ubuntu. Container scanning reports it through the distribution’s security advisory. It does not detect PHP compiled from source, which includes the official php images on Docker Hub.

Does container scanning work with SonarQube Server?

Not yet. Container scanning is available on SonarQube Cloud. Support for SonarQube Server is planned.

Which container base images are supported?

Images based on Red Hat Enterprise Linux, Debian 11 and higher, Rocky Linux, AlmaLinux, Ubuntu and Alpine. Support depends on the base operating system, so images built on top of these, such as official Node.js images based on Debian or Alpine, are also covered.

How much does SonarQube container scanning cost?

There is no additional cost. Container scanning is included with SonarQube Advanced Security on the SonarQube Cloud Team and Enterprise plans.

Do I need to re-scan an image to find new vulnerabilities?

No. SonarQube Cloud re-checks analyzed images for newly published vulnerabilities, based on your organization’s re-analysis settings. Run the scanner again when the image itself changes.

← All articles

What this article says

More in Software Development

All →
Your eBay Shipping Costs Might Look Different This Holiday Season
Ordoro

Your eBay Shipping Costs Might Look Different This Holiday Season

Microsoft and the Public Library Association expand free AI literacy training
Microsoft

Microsoft and the Public Library Association expand free AI literacy training

Beyond static charts: Helping AI create visualizations you can explore
Microsoft

Beyond static charts: Helping AI create visualizations you can explore

Investing in Deterrence: L3Harris Expands Support for the Sentinel Program
L3Harris

Investing in Deterrence: L3Harris Expands Support for the Sentinel Program

L3Harris Appoints ATI Chair, President and Chief Executive Officer Kimberly Fields to Board of Directors
L3Harris

L3Harris Appoints ATI Chair, President and Chief Executive Officer Kimberly Fields to Board of Directors

Data Access Enforcement: Set data permissions once and enforce access on every query
Retool

Data Access Enforcement: Set data permissions once and enforce access on every query

More from SonarSource

How do you verify AI coding agent output from any tool, not just one?
SonarSource

How do you verify AI coding agent output from any tool, not just one?

How to keep your architecture intact when agents write the code
SonarSource

How to keep your architecture intact when agents write the code

Google Gemini 4 Argon: An evaluation
SonarSource

Google Gemini 4 Argon: An evaluation

Prioritize what's actually exploitable: Vulnerability reachability is now available in SonarQube Advanced Security
SonarSource

Prioritize what's actually exploitable: Vulnerability reachability is now available in SonarQube Advanced Security

Which LLM writes the best code? A 2026 comparison
SonarSource

Which LLM writes the best code? A 2026 comparison

AI coding ROI is a throughput problem, and verification is how you solve it
SonarSource

AI coding ROI is a throughput problem, and verification is how you solve it