Cppcheck vs Hadolint

Cppcheck is a static analysis tool for C and C++ code that detects bugs, undefined behavior, and dangerous coding constructs. It can analyze non-standard syntax commonly found in embedded projects. The tool fully supports C++11, C++14, and C++17, with partial support for C++20, and lists integrations with Visual Studio, VSCode, Keil, Eclipse, CLion, Qt Creator, and C++ Builder. Its Soundy mode is intended to help find hard-to-find bugs discovered during testing. The free Open-source plan provides core static analysis. Premium adds checks for safety and security standards, with compliance reports for supported standards; the maker describes Premium as TÜV SÜD certified for safety-critical development. A three-week free trial is offered without a credit card or commitment. Individual licensing excludes CI environments, virtual machines, and containers, while Enterprise supports those environments and air-gapped use. Project requires at least five users and one Git repository. Paid plan prices are available by tailored quotation.

Hadolint is a free Dockerfile linter that parses files into an abstract syntax tree and checks that structure for errors and stated best practices. It uses ShellCheck to inspect Bash code inside Dockerfile RUN instructions. Rules carry either the DL prefix for Hadolint checks or SC for ShellCheck checks. Users can ignore rules, override severity, set failure thresholds, choose report formats, and configure label schemas and trusted registries. Output formats include tty, JSON, Checkstyle, Code Climate, GitLab Code Climate, GNU, Codacy, SonarQube, SARIF, and JUnit. Hadolint runs in Docker or Podman containers and is available as a pre-commit hook. Prebuilt binaries support Linux, macOS, and Windows; installation options include Homebrew, Scoop, Nix, containers, and source builds. Documented integrations cover major CI systems and editors. An online version is hosted at hadolint.github.io/hadolint. The latest listed release is v2.15.1, under GPL-3.0.