🔍
Monitoring & Observability

SonarQube

Continuous code quality and security analysis platform

🐧 Linux🍎 Mac🪟 Windows
Reviewed: Tested on: Kubernetes 1.29 · Terraform 1.8 · Ubuntu 22.04

What is this?

SonarQube scans your code for bugs, security holes, and quality issues before you deploy.

📥

Step 01

Install SonarQube

(01)Run with Docker (recommended)

Linux
1docker run -d --name sonarqube -p 9000:9000 sonarqube:lts-community
2# Access: http://localhost:9000 (admin/admin)

(02)Install SonarScanner CLI

Linux
1# Download from https://docs.sonarsource.com/sonarqube/latest/analyzing-source-code/scanners/sonarscanner/
2export PATH=$PATH:/opt/sonar-scanner/bin
✅

Step 02

Verify

(01)Check UI

Linux
1curl -I http://localhost:9000
⚡

Step 03

Scan Projects

(01)Run analysis

Linux
1sonar-scanner \
2  -Dsonar.projectKey=my-project \
3  -Dsonar.sources=. \
4  -Dsonar.host.url=http://localhost:9000 \
5  -Dsonar.token=YOUR_TOKEN
🔧

Step 04

Common Problems

#1SonarQube won't start / Elasticsearch bootstrap

Linux
1sudo sysctl -w vm.max_map_count=262144
2docker logs sonarqube
3# Check Java heap in sonar.properties