Hadolint vs PMD
Hadolint
github.comPMD
pmd.github.ioSide by side
| Figure | Hadolint | PMD |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 1 |
| Spec score · Linters | 7.9 (#13) | 8.3 (#6) |
| License | The repository identifies its license as GPL-3.0. | The project identifies its license as BSD-style. |
| Purpose | Hadolint is a Dockerfile linter that checks Dockerfiles for errors and best practices. | PMD is an extensible cross-language static code analyzer that finds common programming flaws. |
Plans
In their own words
Hadolint
Hadolint is a free Dockerfile linter that parses files into an abstract syntax tree and checks that structure for errors and stated best practices. It uses ShellCheck to inspect Bash code inside Dockerfile RUN instructions. Rules carry either the DL prefix for Hadolint checks or SC for ShellCheck checks. Users can ignore rules, override severity, set failure thresholds, choose report formats, and configure label schemas and trusted registries. Output formats include tty, JSON, Checkstyle, Code Climate, GitLab Code Climate, GNU, Codacy, SonarQube, SARIF, and JUnit. Hadolint runs in Docker or Podman containers and is available as a pre-commit hook. Prebuilt binaries support Linux, macOS, and Windows; installation options include Homebrew, Scoop, Nix, containers, and source builds. Documented integrations cover major CI systems and editors. An online version is hosted at hadolint.github.io/hadolint. The latest listed release is v2.15.1, under GPL-3.0.
PMD
PMD is a free, extensible static code analyzer that checks source code for programming flaws such as unused variables, empty catch blocks, and unnecessary object creation. It includes more than 400 built-in rules, and teams can write custom rules in Java or XPath. Its bundled CPD tool finds duplicated code across many programming languages. PMD checks source directories from the command line and can run as a Maven, Ant, Gradle, or bld build operation. Supported languages include Java, JavaScript, Salesforce Apex and Visualforce, Kotlin, Swift, Modelica, PL/SQL, Apache Velocity, JSP, WSDL, Maven POM, HTML, XML, and XSL; Scala is supported without Scala rules. It runs on Linux, macOS, and Windows and requires Java 8 or above. For CI, its GitHub Action can create SARIF reports and fail builds based on violation counts; documentation also covers GitLab, Jenkins, and Bamboo integrations. IDE integrations include Eclipse, IntelliJ IDEA, and Visual Studio Code, though some listed plugins are not actively maintained. Only the latest major version is actively developed.