SonarQube is an open-source static analysis platform for continuous code quality inspection — bugs, vulnerabilities, and maintainability issues across multiple languages. This guide installs it on Ubuntu 24.04 with PostgreSQL, sets up SonarScanner CLI, runs SonarQube as a systemd service, and scans both an example project and your own.
Prerequisites: an Ubuntu 24.04 instance, non-root sudo user.
Set Up PostgreSQL
$ sudo apt install -y postgresql-common postgresql -y
$ sudo systemctl enable postgresql
$ sudo systemctl start postgresql
$ sudo -u postgres psql
postgres=# CREATE ROLE sonaruser WITH LOGIN ENCRYPTED PASSWORD 'your_password';
postgres=# CREATE DATABASE sonarqube;
postgres=# GRANT ALL PRIVILEGES ON DATABASE sonarqube TO sonaruser;
postgres=# \c sonarqube
postgres=# GRANT ALL PRIVILEGES ON SCHEMA public TO sonaruser;
postgres=# \q
Install SonarQube
Needs OpenJDK 17.
$ sudo apt update
$ sudo apt install openjdk-17-jdk -y
$ sudo apt install unzip
$ java -version
Check the releases page for the current version:
$ sudo wget https://binaries.sonarsource.com/Distribution/sonarqube/sonarqube-25.2.0.102705.zip
$ unzip sonarqube-25.2.0.102705.zip
$ sudo mv sonarqube-25.2.0.102705/ /opt/sonarqube
$ sudo adduser --system --no-create-home --group --disabled-login sonarqube
$ sudo chown -R sonarqube:sonarqube /opt/sonarqube
Install SonarScanner CLI
Check the releases page for the current version:
$ wget https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.0.1.4817-linux-x64.zip
$ unzip sonar-scanner-cli-7.0.1.4817-linux-x64.zip
$ sudo mv sonar-scanner-7.0.1.4817-linux-x64/ /opt/sonarscanner
$ sudo nano /opt/sonarscanner/conf/sonar-scanner.properties
Set:
sonar.host.url=127.0.0.1
$ sudo chmod +x /opt/sonarscanner/bin/sonar-scanner
$ sudo ln -s /opt/sonarscanner/bin/sonar-scanner /usr/local/bin/sonar-scanner
$ sonar-scanner -v
Configure SonarQube
$ sudo nano /opt/sonarqube/conf/sonar.properties
sonar.jdbc.username=sonaruser
sonar.jdbc.password=your_password
sonar.jdbc.url=jdbc:postgresql://localhost:5432/sonarqube
sonar.web.javaAdditionalOpts=-server
sonar.web.host=0.0.0.0
sonar.web.port=9000
System limits — SonarQube's embedded Elasticsearch needs headroom:
$ sudo nano /etc/sysctl.conf
vm.max_map_count=524288
fs.file-max=131072
$ sudo nano /etc/security/limits.d/99-sonarqube.conf
sonarqube - nofile 131072
sonarqube - nproc 8192
Firewall:
$ sudo ufw allow 9000/tcp
$ sudo apt install ufw -y && sudo ufw allow 22/tcp
$ sudo ufw reload
$ sudo ufw status
Run as a systemd Service
$ sudo nano /etc/systemd/system/sonarqube.service
[Unit]
Description=SonarQube service
After=syslog.target network.target
[Service]
Type=forking
ExecStart=/opt/sonarqube/bin/linux-x86-64/sonar.sh start
ExecStop=/opt/sonarqube/bin/linux-x86-64/sonar.sh stop
User=sonarqube
Group=sonarqube
PermissionsStartOnly=true
Restart=always
StandardOutput=syslog
LimitNOFILE=131072
LimitNPROC=8192
TimeoutStartSec=5
SuccessExitStatus=143
[Install]
WantedBy=multi-user.target
$ sudo systemctl daemon-reload
$ sudo systemctl enable sonarqube
$ sudo systemctl start sonarqube
$ sudo systemctl status sonarqube
$ sudo reboot now
The reboot applies the sysctl/limits changes cleanly.
First-Run Setup
- Visit port 9000 on your server, log in
admin/admin, change the password when prompted. - Administration → Security → Users → Create User — a dedicated account for scanning.
- Generate a token: options icon in the Tokens column → name it, set expiry, Generate. Copy the token.
Scan an Example Project
$ cd
$ mkdir sonar-example-test
$ cd sonar-example-test
$ wget https://github.com/SonarSource/sonar-scanning-examples/archive/master.zip
$ unzip master.zip
$ cd sonar-scanning-examples-master
$ cd sonar-scanner
$ sonar-scanner -D sonar.token=user-sonar_token
Replace user-sonar_token with your generated token. Check the dashboard for the scan results.
Scan Your Own Project
$ cd myproject
$ nano sonar-project.properties
sonar.projectKey=MyProject:Key1
sonar.projectName=First Project
sonar.projectVersion=1.0
sonar.projectDescription=My First Project
sonar.sources=src
$ sonar-scanner -D sonar.token=<sonar_token>
Next Steps
SonarQube is running with a PostgreSQL backend and validated on both an example and custom project scan. From here:
- Put Nginx in front of port 9000 as a reverse proxy with TLS
- Wire SonarScanner into CI (GitHub Actions, GitLab CI) for scans on every push
- Set quality gates to fail builds on new bugs or vulnerabilities
For the full guide, visit the original article on Vultr Docs.
