Setting Up SonarQube on Rocky Linux

When I joined CIGNEX in 2011, I was fortunate to work with great developers who were passionate about writing clean code. We had a fantastic code review process in place with one goal - Zero bugs in production.

As part of this process, we used SonarQube along with Jenkins to continuously monitor the quality of our code. Any project reaching zero issues was appreciated publically. The dashboard was visible to developers for quick feedback.

I was so impressed that I installed SonarQube on my laptop and started using it for everything. Since then it has always been part of my dev stack.

Since beginning of my career, most of my codebase have been in Java, JavaScript, and Python. SonarQube supports all of these languages and many more. It is a great tool to continuously monitor the quality of your codebase.

This article documents exactly how I installed SonarQube 9.9 LTS on a Rocky Linux 9 server.

Hopefully it saves you some time.

My Environment#

The installation was performed on the following machine.

Component	Value
Operating System	Rocky Linux 9
SonarQube Version	9.9 LTS
Database	PostgreSQL
Java	OpenJDK 21
RAM	16 GB
CPU	4 Cores
Disk	500 GB SSD

This machine is a Dell Optiplex which I bought refurbished. It is a good machine for trials and home lab experiments.

Even though SonarQube can run in Docker, I preferred a native installation. The server already hosts multiple services, and keeping SonarQube as a systemd service makes administration straightforward.

Installing Java#

SonarQube requires Java to run. Before downloading SonarQube, verify the installed version.

java -version

If Java is not installed, install OpenJDK.

sudo dnf install java-21-openjdk-devel

Verify again.

java -version

At this point the server is ready to run Java applications.

Installing PostgreSQL#

SonarQube stores all of its configuration, projects, analysis history and users inside PostgreSQL.

Install PostgreSQL if it is not already available.

sudo dnf install postgresql-server

Initialize the database.

sudo postgresql-setup --initdb

Enable and start the service.

sudo systemctl enable postgresql
sudo systemctl start postgresql

Create a database and a dedicated user for SonarQube.

CREATE USER sonarqube WITH PASSWORD 'your-password';
CREATE DATABASE sonarqube OWNER sonarqube;
GRANT ALL PRIVILEGES ON DATABASE sonarqube TO sonarqube;

Using a dedicated database user is always a better practice than sharing credentials across applications.

Downloading SonarQube#

Download the latest 9.9 LTS release from the SonarQube website.

Or use the following command to save some time.

wget https://binaries.sonarsource.com/Distribution/sonarqube/sonarqube-9.9.0.65466.zip

Extract it under /opt.

sudo tar -xzf sonarqube-9.9.*.zip
sudo mv sonarqube-* /opt/sonarqube

I also recommend creating a dedicated Linux user instead of running SonarQube as root.

sudo useradd -r -M -d /opt/sonarqube -s /bin/bash sonarqube

sudo chown -R sonarqube:sonarqube /opt/sonarqube

Running services with the least privileges is a simple security practice that is worth following.

Configuring SonarQube#

Open the configuration file.

sudo vi /opt/sonarqube/conf/sonar.properties

Configure the database connection.

sonar.jdbc.url=jdbc:postgresql://localhost:5432/sonarqube
sonar.jdbc.username=sonarqube
sonar.jdbc.password=your-password

Unless you have specific requirements, most of the remaining configuration can stay at its default values.

Linux Kernel Configuration#

One step that many installation guides mention without explaining is increasing certain Linux kernel limits.

Elasticsearch, which is bundled with SonarQube, requires them.

Update /etc/sysctl.conf.

vm.max_map_count=524288
fs.file-max=131072

Apply the changes.

sudo sysctl -p

Next, increase the file descriptor limits.

Edit:

/etc/security/limits.conf

Add:

sonarqube   -   nofile   131072
sonarqube   -   nproc    8192

These values allow Elasticsearch to create enough memory mappings and open files without hitting operating system limits.

Creating a systemd Service#

Instead of manually starting SonarQube after every reboot, create a systemd service.

[Unit]
Description=SonarQube

[Service]
Type=forking
User=sonarqube
Group=sonarqube

ExecStart=/opt/sonarqube/bin/linux-x86-64/sonar.sh start
ExecStop=/opt/sonarqube/bin/linux-x86-64/sonar.sh stop

Restart=always
LimitNOFILE=131072
LimitNPROC=8192

[Install]
WantedBy=multi-user.target

Reload systemd.

sudo systemctl daemon-reload

Enable the service.

sudo systemctl enable sonarqube

Start it.

sudo systemctl start sonarqube

Check the status.

sudo systemctl status sonarqube

If everything looks good, SonarQube should now be running.

The First Roadblock#

This installation was not completely smooth.

Although the service started successfully, Elasticsearch refused to come up correctly. Looking through the logs eventually pointed towards SELinux restrictions.

For troubleshooting purposes, I temporarily switched SELinux to permissive mode.

sudo setenforce 0

After that, SonarQube started normally.

If you encounter a similar issue, I recommend first confirming that SELinux is the cause before making permanent changes. In a production environment, adjusting the appropriate SELinux policy is preferable to leaving the system in permissive mode.

This was probably the only part of the installation that required a little investigation.

Accessing SonarQube#

Once the service starts, open your browser.

http://your-server-ip:9000

It should display the SonarQube login page.

The default credentials are:

Username: admin
Password: admin

You will immediately be prompted to change the password.

Installing SonarScanner#

The server is now ready to receive code analysis.

Download and install SonarScanner on the machine where you will run the scans. This can be the same server or a different one.

I used my Macbook for installing sonar-scanner.

brew install sonar-scanner

Verify the installation.

sonar-scanner --version

❯ sonar-scanner --version
11:29:15.389 INFO  Scanner configuration file: /opt/homebrew/Cellar/sonar-scanner/8.0.1.6346/libexec/conf/sonar-scanner.properties
11:29:15.398 INFO  Project root configuration file: NONE
11:29:15.434 INFO  SonarScanner CLI 8.0.1.6346
11:29:15.454 INFO  Mac OS X 26.5.1 x86_64

If the command is not found, add the installation directory to your PATH.

Running the First Scan#

Inside your project, create a sonar-project.properties file.

sonar.projectKey=my-project
sonar.projectName=My Project
sonar.sources=.

Run the scanner.

sonar-scanner

After a few moments, refresh the SonarQube dashboard and the project should appear with its first analysis.

Seeing the first report successfully complete is always satisfying.

Common Issues#

Here are a few problems worth checking if the installation does not work the first time.

SonarQube does not start

Check the service logs.

journalctl -u sonarqube

Port 9000 is already in use

Find the conflicting process.

ss -tulpn | grep 9000

Database connection fails

Verify the PostgreSQL service is running and confirm the credentials configured in sonar.properties.

Elasticsearch fails

Review the Elasticsearch logs and verify the Linux kernel limits and SELinux configuration.

Most installation issues usually fall into one of these categories.

I hope this guide helps you get your own SonarQube server up and running with a little less trial and error than I had.