docker run -d --name sonarqube -p 9000:9000 sonarqubeThis command will pull the image down and create a container from it. Run the container in the background mode and then exposes the port 9000 through to host.
\nOnce done, you need to wait for a few mistunes for the server to get started. You can open a browser of your choice and go to localhost:9000 to see the server dashboard.
Use the default username as admin and the password admin to login.
![\"SonarQube](\"/9572ec987eacfab62a0913acfc3f9a05/sonarhome.jpg\")
Create a project
\nI don’t want to go deep into SonarQube here, but a project represents a code base where you can see the result of a scan done by the scanner. So once logged in, click on create a new project button in the centre of the page, then enter a unique project key and a display name.
\nOn the next page enter a name for your project token. This is the key which scanner will use to authenticate to the server and send the result of a scan up.
\nTake note of this key as you can never see it once you’re navigated away from this page. Click continue and you’ll see a screen where you can specify your project configuration.
\nI wanted to run this on an Angular project with TypeScript, so I chose other, and then windows from the OS prompt.
\nDownloading the scanner
\nAt this point you need to download the scanner and unzip it in a folder named sonarqube on your drive. I usually use c:\\tools for these sort of usage (replace this with what you used if you chose to unzip it elsewhere).
Once done, open your scanner config file named sonar-scanner.properties from c:\\tools\\sonarqube\\config folder and uncomment the line which specifies the server address.
#Configure here general information about the environment, such as SonarQube server connection details for example\r\n#No information about specific project should appear here\r\n\r\n#----- Default SonarQube server\r\nsonar.host.url=http://localhost:9000\r\n\r\n#----- Default source code encoding\r\nsonar.sourceEncoding=UTF-8Running a scan
\nOnce done, you’re ready to go. Run the command below from your project root and wait for the scan to finish.
\nC:\\tools\\sonar\\bin\\sonar-scanner.bat -D\"sonar.projectKey=fp\" -D\"sonar.sources=.\" -D\"sonar.host.url=http://localhost:9000\" -D\"sonar.login=**********************************\" -D\"sonar.exclusions=node_modules/**/*\"Don’t forget to replace the key you got from the previous step in the sonar.login argument.
\n\n💡 In the last step when you downloaded the scanner zip file, the command you need to execute is written down for you ready to go, just add the exclude folder to avoid code analysis on external libraries.
\n
It takes a while for the scan to finish based on the size of your code base. But once done, you can see the result in the SonarQube dashboard.
\n\n\nℹ️ Remember to run
\nnpm installoryarnif you’ve just forked the code base from yourgitrepository. I faced a few errors before I realised I didn’t have those installed and they are used by the scanner.
And once done, here is yow your dashboard will look like. Obviously the code base I was reviewing was a bit chaotic.
\nAnd you when you click on issues you can see them by category and also the rules used to perform the scan.
\nSummary
\nIn terms of the speed, I was very happy with the result. It took nearly 2 minutes to scan my entire code base with more than 520 files and thousands line of code.
\nIn term of the scan result, I would say based on the default rule set and considering that this was the community edition, the results are slightly better than tslint or codelyzer. I could easily navigate through issues, find out what line of code needed attention. It showed me the results with syntax highlighting and a lo of categories and tags where I could drill down and find what I wanted quickly.
So go ahead and give it a shot, I am sure you’ll find enough to keep you busy for a while to fix those. And bare in mind that it not only gives you linting errors, it will also give you some security hints based on OWASP top 10 as well.
","timeToRead":4,"frontmatter":{"title":"Run code analysis with sonarqube using docker","unformattedDate":"2020-02-23T00:00:00.000Z","date":"Feb 23, 2020","path":"/sonarqube-docker/","author":"Yaser Adel Mehraban","tags":["webdev","showdev","codeanalysis","docker"],"thumbnail":null}}},{"node":{"id":"f64c5989-af81-5c73-a007-dba78afbe6b6","html":"I was working with my docker image for my pet project and suddenly got an error message:
\n\nI just opened a command line and typed:
\n$ docker versionAnd guess what? this is the output:
\nClient:\r\n Version: 1.13.0-rc7\r\n API version: 1.25\r\n Go version: go1.7.3\r\n Git commit: 48a9e53\r\n Built: Tue Feb 14 17:56:00 UTC 2017\r\n OS/Arch: linux/amd64\r\n\r\nServer:\r\n Version: 1.13.0-rc7\r\n API version: 1.25 (minimum version 1.24)\r\n Go version: go1.7.3\r\n Git commit: 48a9e53\r\n Built: Tue Feb 14 17:56:00 UTC 2017\r\n OS/Arch: linux/amd64</pre>Turns out my current version is higher than the error version, so what is going on here.
\nThe catch is the docker-compose file format has been versioned and therefore we should increment the version requested in the docker.yml file.
In any docker-compose file that is used with 1.24 or later version of the docker client, we should request version 2.1.
So change your file to look like this and you should be good to go:
\nversion: '2.1'\r\n\r\n services:\r\n webapplication102:\r\n image: user/myapplication\r\n build:\r\n context: .Here is the issue page on github if you need more info.
Update:
\nVersion 3 is released, which means you should be able to put 3 instead of 2.1 in your docker-compose.yml file.