Automating Local Code Quality: A Guide to SonarQube and SonarScanner with Docker

How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality

Setting up SonarQube locally requires just two Docker containers to initiate deep static analysis on development machines. This configuration enables developers to map port 9000 for the web interface and port 9092 for the database.

Why This Matters

While ideal development models assume high code quality, technical reality often involves accumulating code smells and security vulnerabilities that slow down deployment. Local analysis provides an immediate feedback loop, reducing the cost of bug fixes by catching them before they reach the CI/CD pipeline.

Key Insights

• SonarQube identifies three critical categories: code smells, bugs, and vulnerabilities.
• Authentication tokens provide secure connectivity between SonarScanner and the SonarQube instance, ensuring only authorized scans are processed.
• The sonar-project.properties file defines project metadata such as unique keys and source directories for the scanner.
• Dockerized SonarScanner allows for language-agnostic analysis without installing local CLI tools on the host machine.
• Maven integration facilitates the automated copying of dependencies and cleaning of the target environment before scanning.

Working Examples

Commands to pull and run the SonarQube Docker container.

docker pull sonarqube
docker run -d --name sonarqube -p 9000:9000 -p 9092:9092 sonarqube

Configuration for the sonar-project.properties file.

sonar.projectKey=my:project
sonar.projectName=my project name
sonar.projectVersion=1.0
sonar.sources=src/main/java
sonar.java.binaries=target/classes
sonar.tests=src/test/java

The command sequence to build the project and execute the SonarScanner analysis.

mvn clean install && \
mvn dependency:copy-dependencies && \
docker run \
--rm \
--network host \
-e SONAR_HOST_URL="http://{YOUR LOCAL IP}:9000" \
-e SONAR_TOKEN="{YOUR SONARQUBE TOKEN}" \
-v "$(pwd):/usr/src" \
sonarsource/sonar-scanner-cli

Practical Applications

• Use Case: Java developers using Maven to automate dependency copying and static analysis during local development. Pitfall: Using an incorrect local IP address in the SONAR_HOST_URL variable, resulting in connection timeouts.
• Use Case: Engineering teams identifying refactoring targets through the SonarQube dashboard to reduce technical debt. Pitfall: Failing to update the projectKey in properties files, leading to overwritten analysis results for different projects.

References:

• https://dev.to/basteez/how-to-use-sonarqube-and-sonarscanner-locally-to-level-up-your-code-quality-4087