docker安裝及啟動此處不做贅述，本文使用 sonarqube:8.9.1-community 版本docker鏡像
鏡像拉取及啟動
- 鏡像拉取
docker pull sonarqube:8.9.1-community
如遇數(shù)次拉取失敗，可修改docker鏡像源為"https://docker.mirrors.ustc.edu.cn"或"https://hub-mirror.c.163.com"，具體設(shè)置如下圖所示
image.png
- 鏡像啟動
docker run -d --name sonarqube -e SONAR_ES_BOOTSTRAP_CHECKS_DISABLE=true -p 9000:9000 sonarqube:8.9.1-community
啟動完成
實例啟動并運行后，使用系統(tǒng)管理員憑據(jù)登錄到http://localhost:9000：
- login: admin
- password: admin
掃描失敗的原因及解決方案
1. Failed to connect to localhost/127.0.0.1:9000
INFO: ------------------------------------------------------------------------
ERROR: Error during SonarScanner execution
org.sonarsource.scanner.api.internal.ScannerException: Unable to execute SonarScanner analysis
at org.sonarsource.scanner.api.internal.IsolatedLauncherFactory.lambda$createLauncher$0(IsolatedLauncherFactory.java:85)
at java.base/java.security.AccessController.doPrivileged(Native Method)
at org.sonarsource.scanner.api.internal.IsolatedLauncherFactory.createLauncher(IsolatedLauncherFactory.java:74)
at org.sonarsource.scanner.api.internal.IsolatedLauncherFactory.createLauncher(IsolatedLauncherFactory.java:70)
at org.sonarsource.scanner.api.EmbeddedScanner.doStart(EmbeddedScanner.java:185)
at org.sonarsource.scanner.api.EmbeddedScanner.start(EmbeddedScanner.java:123)
at org.sonarsource.scanner.cli.Main.execute(Main.java:73)
at org.sonarsource.scanner.cli.Main.main(Main.java:61)
Caused by: java.lang.IllegalStateException: Fail to get bootstrap index from server
at org.sonarsource.scanner.api.internal.BootstrapIndexDownloader.getIndex(BootstrapIndexDownloader.java:42)
at org.sonarsource.scanner.api.internal.JarDownloader.getScannerEngineFiles(JarDownloader.java:58)
at org.sonarsource.scanner.api.internal.JarDownloader.download(JarDownloader.java:53)
at org.sonarsource.scanner.api.internal.IsolatedLauncherFactory.lambda$createLauncher$0(IsolatedLauncherFactory.java:76)
... 7 more
Caused by: java.net.ConnectException: Failed to connect to localhost/127.0.0.1:9000
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.RealConnection.connectSocket(RealConnection.java:265)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.RealConnection.connect(RealConnection.java:183)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.ExchangeFinder.findConnection(ExchangeFinder.java:224)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.ExchangeFinder.findHealthyConnection(ExchangeFinder.java:108)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.ExchangeFinder.find(ExchangeFinder.java:88)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.Transmitter.newExchange(Transmitter.java:169)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.java:41)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.cache.CacheInterceptor.intercept(CacheInterceptor.java:94)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.java:93)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.java:88)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117)
at org.sonarsource.scanner.api.internal.shaded.okhttp.RealCall.getResponseWithInterceptorChain(RealCall.java:221)
at org.sonarsource.scanner.api.internal.shaded.okhttp.RealCall.execute(RealCall.java:81)
at org.sonarsource.scanner.api.internal.ServerConnection.callUrl(ServerConnection.java:114)
at org.sonarsource.scanner.api.internal.ServerConnection.downloadString(ServerConnection.java:99)
at org.sonarsource.scanner.api.internal.BootstrapIndexDownloader.getIndex(BootstrapIndexDownloader.java:39)
... 10 more
Caused by: java.net.ConnectException: Connection refused (Connection refused)
at java.base/java.net.PlainSocketImpl.socketConnect(Native Method)
at java.base/java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
at java.base/java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
at java.base/java.net.AbstractPlainSocketImpl.connect(Unknown Source)
at java.base/java.net.SocksSocketImpl.connect(Unknown Source)
at java.base/java.net.Socket.connect(Unknown Source)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.platform.Platform.connectSocket(Platform.java:130)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.RealConnection.connectSocket(RealConnection.java:263)
... 31 more
根源：scanner的container網(wǎng)絡(luò)跟sonarqube server不在一個網(wǎng)絡(luò)內(nèi)
解決：--network=host 參數(shù)
2. please provide compiled classes with sonar.java.binaries property,
ERROR: Error during SonarScanner execution
org.sonar.java.AnalysisException: Your project contains .java files, please provide compiled classes with sonar.java.binaries property, or exclude them from the analysis with sonar.exclusions property.
at org.sonar.java.JavaClasspath.init(JavaClasspath.java:64)
at org.sonar.java.AbstractJavaClasspath.getElements(AbstractJavaClasspath.java:280)
at org.sonar.java.SonarComponents.getJavaClasspath(SonarComponents.java:149)
at org.sonar.java.JavaSquid.<init>(JavaSquid.java:75)
at org.sonar.plugins.java.JavaSquidSensor.execute(JavaSquidSensor.java:102)
at org.sonar.scanner.sensor.AbstractSensorWrapper.analyse(AbstractSensorWrapper.java:48)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:85)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.lambda$execute$1(ModuleSensorsExecutor.java:59)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.withModuleStrategy(ModuleSensorsExecutor.java:77)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:59)
at org.sonar.scanner.scan.ModuleScanContainer.doAfterStart(ModuleScanContainer.java:82)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:137)
at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
at org.sonar.scanner.scan.ProjectScanContainer.scan(ProjectScanContainer.java:393)
at org.sonar.scanner.scan.ProjectScanContainer.scanRecursively(ProjectScanContainer.java:389)
at org.sonar.scanner.scan.ProjectScanContainer.doAfterStart(ProjectScanContainer.java:358)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:137)
at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
at org.sonar.scanner.bootstrap.GlobalContainer.doAfterStart(GlobalContainer.java:144)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:137)
at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
at org.sonar.batch.bootstrapper.Batch.doExecute(Batch.java:72)
at org.sonar.batch.bootstrapper.Batch.execute(Batch.java:66)
at org.sonarsource.scanner.api.internal.batch.BatchIsolatedLauncher.execute(BatchIsolatedLauncher.java:46)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.base/java.lang.reflect.Method.invoke(Unknown Source)
at org.sonarsource.scanner.api.internal.IsolatedLauncherProxy.invoke(IsolatedLauncherProxy.java:60)
at com.sun.proxy.$Proxy0.execute(Unknown Source)
at org.sonarsource.scanner.api.EmbeddedScanner.doExecute(EmbeddedScanner.java:189)
at org.sonarsource.scanner.api.EmbeddedScanner.execute(EmbeddedScanner.java:138)
at org.sonarsource.scanner.cli.Main.execute(Main.java:112)
at org.sonarsource.scanner.cli.Main.execute(Main.java:75)
at org.sonarsource.scanner.cli.Main.main(Main.java:61)
根源： java中缺少sonar.java.binaries 必選參數(shù)
解決：使用mvn compile編譯源碼，并在sonar-project.properties中添加參數(shù)
sonar.java.binaries=target/classes
其他語言請參考https://docs.sonarqube.org/latest/analysis/languages/overview/ 獲取必選參數(shù)信息。
3. Scanner 出現(xiàn)java.lang.OutOfMemoryError: Java heap space
INFO: ------------------------------------------------------------------------
ERROR: Error during SonarScanner execution
java.lang.OutOfMemoryError: Java heap space
at org.sonarsource.analyzer.commons.xml.XmlFilePosition.shift(XmlFilePosition.java:83)
at org.sonarsource.analyzer.commons.xml.XmlFilePosition.shift(XmlFilePosition.java:62)
at org.sonarsource.analyzer.commons.xml.XmlFilePosition.moveAfterClosingBracket(XmlFilePosition.java:109)
at org.sonarsource.analyzer.commons.xml.XmlParser.visitEndElement(XmlParser.java:198)
at org.sonarsource.analyzer.commons.xml.XmlParser.parseXml(XmlParser.java:133)
at org.sonarsource.analyzer.commons.xml.XmlParser.<init>(XmlParser.java:68)
at org.sonarsource.analyzer.commons.xml.XmlFile.getNamespaceUnawareDocument(XmlFile.java:129)
at org.sonar.java.checks.xml.struts.FormNameDuplicationCheck.scanFile(FormNameDuplicationCheck.java:41)
at org.sonarsource.analyzer.commons.xml.checks.SonarXmlCheck.scanFile(SonarXmlCheck.java:44)
at org.sonar.plugins.java.XmlFileSensor.scanFile(XmlFileSensor.java:121)
at org.sonar.plugins.java.XmlFileSensor.lambda$scanFile$2(XmlFileSensor.java:114)
at org.sonar.plugins.java.XmlFileSensor$$Lambda$1477/0x0000000100aba840.accept(Unknown Source)
at java.base/java.util.HashMap$Values.forEach(Unknown Source)
at org.sonar.plugins.java.XmlFileSensor.scanFile(XmlFileSensor.java:112)
at org.sonar.plugins.java.XmlFileSensor.execute(XmlFileSensor.java:86)
at org.sonar.scanner.sensor.AbstractSensorWrapper.analyse(AbstractSensorWrapper.java:48)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:85)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.lambda$execute$1(ModuleSensorsExecutor.java:59)
at org.sonar.scanner.sensor.ModuleSensorsExecutor$$Lambda$344/0x0000000100657440.run(Unknown Source)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.withModuleStrategy(ModuleSensorsExecutor.java:77)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:59)
at org.sonar.scanner.scan.ModuleScanContainer.doAfterStart(ModuleScanContainer.java:82)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:137)
at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
at org.sonar.scanner.scan.ProjectScanContainer.scan(ProjectScanContainer.java:393)
at org.sonar.scanner.scan.ProjectScanContainer.scanRecursively(ProjectScanContainer.java:389)
at org.sonar.scanner.scan.ProjectScanContainer.doAfterStart(ProjectScanContainer.java:358)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:137)
at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
at org.sonar.scanner.bootstrap.GlobalContainer.doAfterStart(GlobalContainer.java:144)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:137)
at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
根源： jvm默認配置太小，內(nèi)存不足
解決：設(shè)置環(huán)境變量 SONAR_SCANNER_OPTS="-Xmx512m" 或者更大。
docker的解決方案為
docker run --network=host --rm -e SONAR_HOST_URL="http://localhost:9000" -e SONAR_SCANNER_OPTS="-Xmx1024m" -v "/Documents/github/security/Benchmark:/usr/src" sonarsource/sonar-scanner-cli
4. sonarqube server出現(xiàn)ES 137故障，自動退出。
onarqube_1 | 2020.12.09 07:38:00 INFO ce[][o.s.c.t.CeWorkerImpl] worker AXZGb3aOoJQO0GPdHzsd found no pending task (including indexation task). Disabling indexation task lookup for this worker until next SonarQube restart.
sonarqube_1 | 2020.12.09 07:49:33 INFO es[][o.e.m.j.JvmGcMonitorService] [gc][762] overhead, spent [281ms] collecting in the last [1s]
sonarqube_1 | 2020.12.09 09:31:15 WARN app[][o.s.a.p.AbstractManagedProcess] Process exited with exit value [es]: 137
sonarqube_1 | 2020.12.09 09:31:15 INFO app[][o.s.a.SchedulerImpl] Process[es] is stopped
sonarqube_1 | 2020.12.09 09:31:16 INFO ce[][o.s.p.ProcessEntryPoint] Hard stopping process
sonarqube_1 | 2020.12.09 09:31:16 INFO ce[][o.s.ce.app.CeServer] Compute Engine is stopping...
sonarqube_1 | 2020.12.09 09:31:16 INFO ce[][o.s.c.t.CeProcessingSchedulerImpl] Hard stopping workers...
sonarqube_1 | 2020.12.09 09:31:16 INFO ce[][o.s.ce.app.CeServer] Compute Engine is stopped
sonarqube_1 | 2020.12.09 09:31:16 INFO app[][o.s.a.SchedulerImpl] Process[ce] is stopped
sonarqube_1 | 2020.12.09 09:31:16 INFO web[][o.s.p.ProcessEntryPoint] Hard stopping process
sonarqube_1 | 2020.12.09 09:31:16 INFO web[][o.s.s.n.NotificationDaemon] Notification service stopped
sonarqube_1 | 2020.12.09 09:31:17 INFO app[][o.s.a.SchedulerImpl] Process[web] is stopped
sonarqube_1 | 2020.12.09 09:31:17 INFO app[][o.s.a.SchedulerImpl] SonarQube is stopped
根源：server 端ES 內(nèi)存不足, 因為ES默認的heap size為2GB，而Docker的limit也是2GB。
解決：加大內(nèi)存，docker Desktop端(Mac 與windows端)需要配置docker的最大內(nèi)存超過4GB?；蛘呦拗艵S的Heap size到750MB。
https://github.com/10up/wp-local-docker/issues/6#issue-211554733
5. # Error during SonarQube Scanner execution ERROR: You must define the following mandatory properties for ‘Unknown’: sonar.projectKey
根源：scanner無法在工程的根目錄上找到sonar-project.properties文件，盡管該文件存在，但是docker -v掛在目錄時不支持相對路徑。
解決：將docker run -v...的運行腳本也放到工程根目錄下，將當前目錄掛載到/usr/src：
docker run ...
-v "$(pwd):/usr/src" \
sonarsource/sonar-scanner-cli
掃描失敗的原因及解決方案轉(zhuǎn)載于：http://www.itdecent.cn/p/a388252af433
