On this page

PrerequisiteHardware requirementsSupported platformsPlatform notes

Prerequisites and overview

Prerequisite

You must be able to install Java (Oracle JRE or OpenJDK) on the machine where you plan to run SonarQube.

Hardware requirements

  1. A small-scale (individual or small team) instance of the SonarQube server requires at least 2GB of RAM to run efficiently and 1GB of free RAM for the OS. If you are installing an instance for a large teams or an enterprise, please consider the additional recommendations below.
  2. The amount of disk space you need will depend on how much code you analyze with SonarQube.
  3. SonarQube must be installed on hard drives that have excellent read & write performance. Most importantly, the "data" folder houses the Elasticsearch indices on which a huge amount of I/O will be done when the server is up and running. Read and write hard drive performance will therefore have a big impact on the overall SonarQube server performance.

Enterprise hardware recommendations

For large teams or enterprise-scale installations of SonarQube, additional hardware is required. At the enterprise level, monitoring your SonarQube instance is essential and should guide further hardware upgrades as your instance grows. A starting configuration should include at least:

  • 8 cores, to allow the main SonarQube platform to run with multiple compute engine workers
  • 16GB of RAM For additional requirements and recommendations relating to database and Elasticsearch, see Hardware recommendations.

Supported platforms

Java

The SonarQube server requires Java version 11 and the SonarQube scanners require Java version 11 or 17.

SonarQube is able to analyze any kind of Java source files regardless of the version of Java they comply with.

We recommend using the critical patch update (CPU) releases.

JavaServerScanners
Oracle JRE

cross icon

17

Checkmark icon

17


Checkmark icon

 11

Checkmark icon

 11


cross icon

 8

cross icon

 8

OpenJDK
cross icon

 17

Checkmark icon

 17


Checkmark icon

 11

Checkmark icon

 11


cross icon

 8

cross icon

 8

Database
PostgreSQL
Checkmark icon

 13


Checkmark icon

 12


Checkmark icon

 11


Checkmark icon

 10


Checkmark icon

 9.6


exclamation icon

 Must be configured to use UTF-8 charset

Microsoft SQL Server
Checkmark icon

 2019 (MSSQL Server 15.0) with bundled Microsoft JDBC driver. Express Edition is supported.


Checkmark icon

 2017 (MSSQL Server 14.0) with bundled Microsoft JDBC driver. Express Edition is supported.


Checkmark icon

 2016 (MSSQL Server 13.0) with bundled Microsoft JDBC driver. Express Edition is supported.


Checkmark icon

 2014 (MSSQL Server 12.0) with bundled Microsoft JDBC driver. Express Edition is supported.


exclamation icon

 Collation must be case-sensitive (CS) and accent-sensitive (AS) (example: Latin1_General_CS_AS).


exclamation icon

READ_COMMITTED_SNAPSHOT must be set on the SonarQube database to avoid potential deadlocks under heavy load.


Info

Both Windows authentication (“Integrated Security”) and SQL Server authentication are supported. See the Microsoft SQL Server section in Install the server for instructions on configuring authentication.

Oracle
Checkmark icon

 19C


Checkmark icon

 18C


Checkmark icon

 12C


Checkmark icon

 XE Editions


exclamation icon

 Must be configured to use a UTF8-family charset (see NLS_CHARACTERSET).


exclamation icon

 The driver ojdbc14.jar is not supported.


Info

 We recommend using the latest Oracle JDBC driver.


exclamation icon

 Only the thin mode is supported, not OCI.


exclamation icon

 Only MAX_STRING_SIZE=STANDARD parameter is supported, not EXTENDED.

Web browser

To get the full experience SonarQube has to offer, you must enable JavaScript in your browser.

Browser
Microsoft Edge
Checkmark icon

 Latest

Mozilla Firefox
Checkmark icon

 Latest

Google Chrome
Checkmark icon

 Latest

Opera
exclamation icon

 Not tested

Safari
Checkmark icon

 Latest

Platform notes

Linux

If you're running on Linux, you must ensure that:

  • vm.max_map_count is greater than or equal to 524288
  • fs.file-max is greater than or equal to 131072
  • the user running SonarQube can open at least 131072 file descriptors
  • the user running SonarQube can open at least 8192 threads

You can see the values with the following commands:

sysctl vm.max_map_count
sysctl fs.file-max
ulimit -n
ulimit -u

You can set them dynamically for the current session by running the following commands as root:

sysctl -w vm.max_map_count=524288
sysctl -w fs.file-max=131072
ulimit -n 131072
ulimit -u 8192

To set these values more permanently, you must update either /etc/sysctl.d/99-sonarqube.conf (or /etc/sysctl.conf as you wish) to reflect these values.

If the user running SonarQube (sonarqube in this example) does not have permission to have at least 131072 open descriptors, you must insert this line in /etc/security/limits.d/99-sonarqube.conf (or /etc/security/limits.conf as you wish):

sonarqube   -   nofile   131072
sonarqube   -   nproc    8192

If you are using systemd to start SonarQube, you must specify those limits inside your unit file in the section [Service] :

[Service]
...
LimitNOFILE=131072
LimitNPROC=8192
...

seccomp filter

By default, Elasticsearch uses seccomp filter. In most distributions, this feature is activated in the kernel, however on distributions like Red Hat Linux 6 this feature is deactivated. If you are using a distribution without this feature and you cannot upgrade to a newer version with seccomp activated, you have to explicitly deactivate this security layer by updating sonar.search.javaAdditionalOpts in <SONARQUBE_HOME>/conf/sonar.properties:

sonar.search.javaAdditionalOpts=-Dbootstrap.system_call_filter=false

You can check if seccomp is available on your kernel with:

$ grep SECCOMP /boot/config-$(uname -r)

If your kernel has seccomp, you will see:

CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
CONFIG_SECCOMP_FILTER=y
CONFIG_SECCOMP=y

For more detail, see the Elasticsearch documentation.

Fonts

Generating executive reports requires that fonts be installed on the server hosting SonarQube. On Windows servers, this is a given. However, this is not always the case for Linux servers.

The following should be ensured:

  • Fontconfig is installed on the server hosting SonarQube
  • A package of FreeType fonts is installed on the SonarQube server. The exact packages available will vary by distribution, but a commonly used package is libfreetype6

FIPS

SonarQube will not run on Linux hosts where FIPS (Federal Information Processing Standard) is enforced.

© 2008-2022, SonarSource S.A, Switzerland. Except where otherwise noted, content in this space is licensed under a Creative Commons Attribution-NonCommercial 3.0 United States License. SONARQUBE is a trademark of SonarSource SA. All other trademarks and copyrights are the property of their respective owners.

Creative Commons License