SonarQube & Trivy Installation Guide (Ubuntu)

Environment Assumptions

• OS: Ubuntu 22.04 LTS
• User: Non-root user with sudo privileges
• Docker installed and running
• Minimum 4GB RAM (8GB recommended)

---

1. Install SonarQube

1.1 Update System

sudo apt update && sudo apt upgrade -y

1.2 Install Java 17

sudo apt install openjdk-17-jdk -y
java -version

1.3 Install PostgreSQL

sudo apt install postgresql postgresql-contrib -y
sudo -i -u postgres
createuser sonar
psql
ALTER USER sonar WITH ENCRYPTED password 'StrongPassword';
CREATE DATABASE sonarqube OWNER sonar;
GRANT ALL PRIVILEGES ON DATABASE sonarqube TO sonar;
\q
exit

1.4 Configure System Limits

Edit /etc/sysctl.conf:

vm.max_map_count=262144
fs.file-max=65536

Apply:

sudo sysctl -p

Edit /etc/security/limits.conf:

sonar   -   nofile   65536
sonar   -   nproc    4096

---

1.5 Install SonarQube

wget https://binaries.sonarsource.com/Distribution/sonarqube/sonarqube-10.4.0.87286.zip
sudo apt install unzip -y
sudo unzip sonarqube-*.zip -d /opt
sudo mv /opt/sonarqube-* /opt/sonarqube
sudo adduser --system --no-create-home --group --disabled-login sonar
sudo chown -R sonar:sonar /opt/sonarqube

1.6 Configure Database

Edit /opt/sonarqube/conf/sonar.properties:

sonar.jdbc.username=sonar
sonar.jdbc.password=StrongPassword
sonar.jdbc.url=jdbc:postgresql://localhost:5432/sonarqube

---

1.7 Configure Systemd Service

Create /etc/systemd/system/sonarqube.service:

[Unit]
Description=SonarQube service
After=network.target

[Service]
Type=forking
User=sonar
Group=sonar
ExecStart=/opt/sonarqube/bin/linux-x86-64/sonar.sh start
ExecStop=/opt/sonarqube/bin/linux-x86-64/sonar.sh stop
Restart=always
LimitNOFILE=65536
LimitNPROC=4096

[Install]
WantedBy=multi-user.target

Enable service:

sudo systemctl daemon-reload
sudo systemctl enable sonarqube
sudo systemctl start sonarqube
sudo systemctl status sonarqube

Access via browser:

http://SERVER_IP:9000

Default login: - Username: admin - Password: admin

Change password immediately.

---

2. Install Sonar Scanner CLI

wget https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-5.0.1.3006-linux.zip
sudo unzip sonar-scanner-*.zip -d /opt
sudo mv /opt/sonar-scanner-* /opt/sonar-scanner

Add to PATH in /etc/profile:

export PATH=$PATH:/opt/sonar-scanner/bin

Reload:

source /etc/profile
sonar-scanner -v

---

3. Install Trivy

3.1 Add Repository

sudo apt install wget apt-transport-https gnupg lsb-release -y
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt update
sudo apt install trivy -y

Verify:

trivy -v

---

4. Scan Docker Images

4.1 Scan Public Image

trivy image nginx:latest

4.2 Scan Custom Image

docker build -t myapp:1.0 .
trivy image myapp:1.0

4.3 Output JSON

trivy image -f json -o result.json myapp:1.0

4.4 Fail CI on Critical

trivy image --severity CRITICAL --exit-code 1 myapp:1.0

---

5. DevSecOps Flow Recommendation

1. Code Push
2. SonarQube Scan
3. Docker Build
4. Trivy Scan
5. Push Image
6. Deploy to Kubernetes

---

6. Troubleshooting

Check SonarQube logs:

sudo journalctl -u sonarqube
cat /opt/sonarqube/logs/sonar.log

Check system limits:

sysctl vm.max_map_count

Must be >= 262144