Sonarqube

Quick reference

• Maintained by: OpenAnolis CloudNative SIG
• Where to get help: OpenAnolis CloudNative SIG

Supported tags and respective Dockerfile links

• 8.9.3, latest

Supported architectures

• arm64, x86-64

Build reference

Build multi-arch images and push to registry:

$ docker buildx build -t "openanolis/sonarqube:$VERSION" --platform linux/amd64,linux/arm64 . --push

Docker Host Requirements

Because SonarQube uses an embedded Elasticsearch, make sure that your Docker host configuration complies with the Elasticsearch production mode requirements and File Descriptors configuration.

For example, on Linux, you can set the recommended values for the current session by running the following commands as root on the host:

sysctl -w vm.max_map_count=524288
sysctl -w fs.file-max=131072
ulimit -n 131072
ulimit -u 8192

Usage

Start a server instance

$ docker run -d --name sonarqube -e SONAR_ES_BOOTSTRAP_CHECKS_DISABLE=true -p 9000:9000 "openanolis/sonarqube:$VERSION"

Once your instance is up and running, Log in to http://localhost:9000 using System Administrator credentials:

• login: admin
• password: admin

Configuration

Database

By default, the image will use an embedded H2 database that is not suited for production.Supported databases are Oracle, PostgreSQL and Microsoft SQLServer.

Follow these steps for your first installation:

1. Creating the following volumes helps prevent the loss of information when updating to a new version or upgrading to a higher edition:

• sonarqube_data: contains data files, such as the embedded H2 database and Elasticsearch indexes

• sonarqube_logs: contains SonarQube logs about access, web process, CE process, and Elasticsearch

• sonarqube_extensions: will contain any plugins you install and the Oracle JDBC driver if necessary.

  Create the volumes with the following commands:

  $> docker volume create --name sonarqube_data
  $> docker volume create --name sonarqube_logs
  $> docker volume create --name sonarqube_extensions
  

2. Drivers for supported databases (except Oracle) are already provided. If you're using an Oracle database, you need to add the JDBC driver to the sonar_extensions volume.

   a. Start the SonarQube container with the embedded H2 database:

   $ docker run --rm \
       -p 9000:9000 \
       -v sonarqube_extensions:/opt/sonarqube/extensions \
       "openanolis/sonarqube:$VERSION"
   

   b. Exit once SonarQube has started properly.

   c. Copy the Oracle JDBC driver into sonarqube_extensions/jdbc-driver/oracle.

3. Run the image with your database properties defined using the -e environment variable flag:

   $> docker run -d --name sonarqube \
       -p 9000:9000 \
       -e SONAR_JDBC_URL=... \
       -e SONAR_JDBC_USERNAME=... \
       -e SONAR_JDBC_PASSWORD=... \
       -v sonarqube_data:/opt/sonarqube/data \
       -v sonarqube_extensions:/opt/sonarqube/extensions \
       -v sonarqube_logs:/opt/sonarqube/logs \
       "openanolis/sonarqube:$VERSION"
   

   For docker-based setups, environment variables supersede all parameters that were provided with properties.

Advanced configuration

Customized image

In some environments, it may make more sense to prepare a custom image containing your configuration. A Dockerfile to achieve this may be as simple as:

FROM openanolis/sonarqube:$VERSION
COPY sonar-custom-plugin-1.0.jar /opt/sonarqube/extensions/

You could then build and try the image with something like:

$ docker build --tag=sonarqube-custom .
$ docker run -ti sonarqube-custom

Sonarqube

SonarQube is the leading tool for continuously inspecting the Code Quality and Security of your codebases, and guiding development teams during Code Reviews. Covering 27 programming languages, while pairing-up with your existing software pipeline, SonarQube provides clear remediation guidance for developers to understand and fix issues, and for teams overall to deliver better and safer software. With over 225,000 deployments helping small development teams as well as global organizations, SonarQube provides the means for all teams and companies around the world to own and impact their Code Quality and Security.