SonarQube

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_B4ms (4 vCPU / 16 GiB RAM) is the recommended starting point. SonarQube runs a JVM web process, a JVM compute-engine process and an embedded Elasticsearch JVM alongside PostgreSQL, so it needs memory headroom.

On the NSG, allow inbound 22/tcp from your management network and 80/tcp from the networks your users and CI runners will reach SonarQube on. For public exposure, front port 80 with TLS (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for SonarQube by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

First-boot initialisation takes approximately three to five minutes after the VM starts. SonarQube runs its database migrations, bootstraps Elasticsearch and rotates the admin password on first boot.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM and open port 80:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:sonarqube-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name sonarqube \
  --image sac1647283583153:sonarqube-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name sonarqube --port 80 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check the three services and the health and status endpoints:

systemctl is-active sonarqube.service postgresql.service nginx.service curl -fsS http://127.0.0.1/health curl -fsS http://127.0.0.1/api/system/status

All three services report active, the open /health endpoint returns ok, and /api/system/status reports "status":"UP". This confirms that the full stack is serving: nginx, the SonarQube web server, the compute engine, Elasticsearch and PostgreSQL.

On the very first boot, allow a few minutes for migrations and the Elasticsearch bootstrap before the status reports UP.

Step 5 - Retrieve your administrator login

SonarQube's default admin password is rotated to a value unique to your VM on first boot and written to a root-only file. Print the file:

sudo cat /root/sonarqube-credentials.txt

The SONARQUBE_ADMIN_PASSWORD value is your sign-in password, and the username is admin.

To verify the credentials over the API without a browser, call the open /api/authentication/validate endpoint with basic auth. For example, curl -u admin:<SONARQUBE_ADMIN_PASSWORD> http://127.0.0.1/api/authentication/validate returns {"valid":true} for the correct password and {"valid":false} for a wrong one.

Step 6 - First sign-in

Open a web browser and navigate to http://<vm-public-ip>/. Sign in with the username admin and the password from /root/sonarqube-credentials.txt.

The sign-in page is served through nginx, and the per-VM administrator password has already been rotated at first boot.

Step 7 - Create a project and analyse code

After you sign in, choose Create a local project, or import from Azure DevOps, GitHub, GitLab or Bitbucket. Give the project a key and set up the analysis method.

For a local project, generate a project analysis token, then run the SonarScanner in your source tree, pointing at this server. SonarQube supports Maven, Gradle, .NET and the standalone SonarScanner CLI. The UI shows the exact command once you pick your build system.

Step 8 - Quality Gates

A Quality Gate is the set of conditions your code must meet to be marked as passing. For example: no new bugs, no new vulnerabilities, and coverage on new code above a threshold.

SonarQube ships the built-in Sonar way gate. Open Quality Gates in the top menu to review it or create your own, then assign a gate to your projects so that every analysis is enforced consistently in CI.

Step 9 - Confirm the runtime and system info

Confirm the SonarQube version, the Java runtime and the persisted Elasticsearch kernel requirements from the shell. The running server details are shown under Administration, then System:

curl -fsS http://127.0.0.1/api/server/version java -version sysctl vm.max_map_count fs.file-max

The System page shows the server ID, edition and version, and the health of the web, compute-engine and search components.

Step 10 - Confirm the data tiers

The SonarQube data/ and extensions/ directories and the PostgreSQL datadir all live on the dedicated 40 GiB Azure data disk mounted at /var/lib/sonarqube:

findmnt -no SOURCE,SIZE,FSTYPE,TARGET /var/lib/sonarqube
sudo -u postgres psql -tAc 'SHOW data_directory'

Enabling HTTPS

Serve SonarQube over HTTPS so that session tokens and analysis data cannot be intercepted. The image ships with nginx, which certbot can configure automatically. The following assumes a DNS record that points your fully qualified domain name at the VM's public IP:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d sonarqube.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

After certbot finishes, set the Server base URL to your HTTPS URL under Administration, then Configuration, then General Settings. This makes SonarQube generate correct links in notifications and pull-request decorations.

Backup and maintenance

SonarQube keeps all of its state (projects, issues, measures, quality profiles, quality gates and users) in its PostgreSQL backing database on the dedicated data disk. Back it up regularly:

sudo -u postgres pg_dump sonarqube > /tmp/sonarqube-db-$(date +%F).sql

Ship the dump to Azure Blob Storage or another object store, or snapshot the data disk in Azure for a coordinated point-in-time backup.

Keep the OS patched with sudo apt update && sudo apt upgrade. To upgrade SonarQube itself, follow the official upgrade guide for your target version, and always take a database backup first. The compute engine migrates the schema on the next start. Elasticsearch's kernel requirements are already persisted, so they survive reboots and upgrades.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us by email and chat for help with deployment, project onboarding, CI integration, upgrades, TLS termination and database administration. Email sales@secureanycloud.com.

For general SonarQube questions, consult the documentation at https://docs.sonarsource.com/. SonarQube is a trademark of SonarSource SA. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch SonarQube Community on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Architecture at a glance

• Application: SonarQube Community Build 10.7, in /opt/sonarqube, run as the non-root sonarqube user
• Java runtime: OpenJDK 17 (headless JRE)
• Web server: nginx, listening on port 80, reverse-proxying to SonarQube on 127.0.0.1:9000
• Database: PostgreSQL 16 (SonarQube's backing store), loopback only
• Search: Embedded Elasticsearch (needs vm.max_map_count=524288, applied at build)
• Data storage: SonarQube data/, the Elasticsearch index, extensions/ and the PostgreSQL datadir on a dedicated EBS volume at /var/lib/sonarqube
• Health endpoint: http://<instance-public-ip>/health (open, returns HTTP 200 when healthy)
• Status endpoint: http://<instance-public-ip>/api/system/status (JSON platform status)

The SonarQube web interface binds to loopback and is exposed only through nginx. The application data, the embedded Elasticsearch index and the PostgreSQL datadir all live on a dedicated, independently resizable EBS volume, separate from the operating-system disk. You can therefore grow storage without rebuilding the instance.

Connecting to your instance

Connect over SSH on port 22 as the default login user for your operating-system variant.

• OS variant: Ubuntu 24.04
• SSH login user: ubuntu

For example:

ssh -i /path/to/your-key.pem ubuntu@<instance-public-ip>

Replace <instance-public-ip> with the public IPv4 address of your instance, which is visible in the EC2 console. Replace /path/to/your-key.pem with the private key you launched the instance with.

Per-instance credentials

On the first boot of every instance, a one-shot service (sonarqube-firstboot.service) generates credentials that are unique to that instance:

• A fresh PostgreSQL role password
• A fresh administrator password, which rotates the default admin account

SonarQube ships a default admin / admin account that would normally force a password change on first login. This image rotates that password automatically on first boot, so the default admin / admin login does not work on your running instance. No shared or default credentials ship in the image.

Retrieve the generated administrator password:

sudo cat /root/sonarqube-credentials.txt

The file (mode 0600, root only) contains the administrator username (admin) and the per-instance password:

SONARQUBE_USERNAME=admin SONARQUBE_ADMIN_PASSWORD=<generated-per-instance>

Verifying the service

The three services that back SonarQube should all report active:

systemctl is-active sonarqube postgresql nginx

The expected output is:

active active active

SonarQube exposes an open health endpoint at /health, served by nginx, that returns HTTP 200 when the platform is healthy:

curl -s http://localhost/health

ok

Confirm the platform status and version through the API. The status reports UP once SonarQube and its embedded Elasticsearch have finished starting:

curl -s http://localhost/api/system/status

{"id":"...","version":"10.7.0.96327","status":"UP"}

Confirm the Elasticsearch kernel requirement is applied and persisted:

sysctl vm.max_map_count

vm.max_map_count = 524288

Confirm the SonarQube data and the PostgreSQL datadir are on the dedicated EBS volume:

df -h /var/lib/sonarqube

Filesystem Size Used Avail Use% Mounted on /dev/nvme1n1 40G 1.6G 36G 5% /var/lib/sonarqube

Signing in

Browse to your instance and sign in with username admin and the password from /root/sonarqube-credentials.txt:

http://<instance-public-ip>/

After you sign in, you land on the Projects page. A fresh instance has no projects yet, so SonarQube shows the "create a project" flow.

We strongly recommend that after your first sign-in you change the administrator password to one of your own choosing under My Account, then Security. Create individual user accounts rather than sharing the admin login.

Running your first analysis

SonarQube analyses code that a scanner running in your build pushes to it. The quickest way to try it is the SonarScanner CLI.

In the web UI, choose Create Project, then Local project. Give the project a key (for example my-project), and follow the prompts to generate an analysis token. Keep the token safe, because it is shown only once.

On a machine that has your source code, download the SonarScanner CLI, then run this from your project root:

sonar-scanner \
  -Dsonar.projectKey=my-project \
  -Dsonar.sources=. \
  -Dsonar.host.url=http://<instance-public-ip> \
  -Dsonar.token=<your-analysis-token>

When the analysis finishes, the scanner submits a report and SonarQube processes it. Refresh the project in the web UI to see the result.

For CI pipelines (GitHub Actions, GitLab CI, Jenkins, Azure DevOps), store the token as a secret and use the matching SonarScanner step or plugin. The same server URL and token apply.

Reviewing results

Each project has an Overview with its Quality Gate result (Passed or Failed) and the security, reliability, maintainability, coverage and duplication measures for the analysed code.

The Issues tab lists every bug, code smell and vulnerability that SonarQube found, each with its severity, type, estimated effort to fix, and the rule that raised it. You can filter and assign issues, and change their status, from here.

The Quality Gates and Quality Profiles sections in the top navigation let you tune the pass/fail standard and the active rule set applied to your projects. The built-in Sonar way Quality Gate and profiles are enabled by default.

Enabling HTTPS

Put SonarQube behind HTTPS. The image already runs nginx on port 80, so the simplest route is a Let's Encrypt certificate with Certbot. Point a DNS record at your instance's public IP first, then run:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot obtains a certificate, rewrites the nginx server block to serve HTTPS on port 443, and sets up automatic renewal. Open port 443 in your EC2 security group.

After you enable HTTPS, update the Server base URL under Administration, then General, to your https:// address so that generated links use it.

Managing the service

SonarQube, PostgreSQL and nginx are ordinary systemd services:

systemctl status sonarqube --no-pager

Restart SonarQube after a configuration change:

sudo systemctl restart sonarqube

SonarQube's configuration is in /opt/sonarqube/conf/sonar.properties, and its logs are in /opt/sonarqube/logs/ (sonar.log, web.log, ce.log, es.log). PostgreSQL's datadir is on the dedicated EBS volume under /var/lib/sonarqube/postgresql.

Backups

Back up two things: the PostgreSQL database (all projects, issues, measures and users) and, if you added plugins, the extensions directory. Both live on the /var/lib/sonarqube EBS volume. A simple database dump looks like this:

sudo -u postgres pg_dump sonarqube > sonarqube-backup.sql

For a point-in-time backup of the whole data tier, take an EBS snapshot of the /var/lib/sonarqube volume from the EC2 console. Stop SonarQube first to get a consistent snapshot.

Support

This AMI includes 24/7 technical support from SecureAnyCloud engineers by email and live chat. Support covers SonarQube deployment, upgrades, PostgreSQL database administration, CI integration, Quality Gate and security-rule configuration, HTTPS setup and performance tuning. Critical issues receive a one-hour average response time.

SonarQube, SonarSource and all related marks are trademarks of their respective holders. Use of them here is for identification only and does not imply affiliation or endorsement.

Deploy on AWS

Launch SonarQube with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com