Run through Docker

A containerised visao runs the analyser in CI. It also runs on a machine where you keep PATH unchanged. In a multi-tenant environment it gives every job the same toolchain.

The image

Every release tarball carries a Dockerfile under dockerfile/ubuntu/Dockerfile. The image comes from the release:

tar xzf visao-<version>-linux-x86_64.tar.gz
cd visao
docker build -t visao -f dockerfile/ubuntu/Dockerfile .

The resulting image bundles the analyser, its shared libraries, the bundled stdlib annotations, and a system gcc/clang for probing.

Running analyses

Mount the source tree you want to analyse and pass the same arguments you use locally:

docker run --rm \
           -v "$PWD:/work" -w /work \
           visao --language c -- src/*.c

The --rm flag keeps the host clean; -w /work makes relative paths in the analyser’s output match the host layout. Add -e NO_COLOR=1 if you are piping the output to a tool that does not strip ANSI escapes.

CI mode (typed exit, no TTY)

In CI, force a colour mode explicitly to avoid surprises:

docker run --rm \
           -e VISAO_DISABLE_COLORS=y \
           -v "$PWD:/work" -w /work \
           visao --language c -- src/*.c \
           | tee analysis.log

Exit code is always 0. A CI job greps the log for error: lines. It also checks that Finished successfully is present when expected. See Console mode for the output contract.

Server mode in Docker

To run the analyser as a long-lived server inside a container, expose the TCP port and pass the matching URL:

docker run --rm \
           -p 5500:5500 \
           -v "$PWD:/work" -w /work \
           visao --server tcp://0.0.0.0:5500 --update-toolchains

Note 0.0.0.0 instead of 127.0.0.1. The address 127.0.0.1 accepts connections only from inside the container. The first run primes the toolchain cache. Later restarts reuse it from the user config directory inside the container. Mount a volume there to keep the cache across restarts.

For graceful shutdown:

docker kill --signal=SIGINT <container-id>

--server-graceful (on by default) handles the signal. The network receiver stops accepting requests. The request processor drains its queue. The server cancels the analysis workers that still run, and sends the queued responses before it stops. See Server mode for the actor architecture.