> ## Content Index > Fetch the complete content index at: https://blog.bajonczak.com/llms.txt > Use this file to discover other available public pages before exploring further. # How to analyse your code with sonarcube - URL: https://blog.bajonczak.com/sonarcube_docker/ - Published: 2021-10-06T22:00:00.000Z - Updated: 2022-10-23T15:15:57.000Z - Author: Sascha Bajonczak - Tags: Governance, Development Sonarcube is a measurement tool for running static codeanalysis # Installation I prefer to run the sonarqube on docker. Because it's a clean install and portable runtime environment. To have a persistent runtime we need a postgres sql server. To store the data, to let sonarqube and the [postgres (opens new window)](https://www.postgresql.org/?ref=blog.bajonczak.com)comunicate with each other, we need a virtual network inside the container. To create a network named `mynet` we use the following script: ```shell docker network create mynet ``` Now it's time to create the postgres database instance named `postgres` for this I use the following docker command: ```shell docker run --name sonar-postgres -e POSTGRES_USER=sonar -e POSTGRES_PASSWORD=sonar -d -p 5432:5432 --net mynet postgres ``` This will install a postgres sql and connect it to the `mynet` Now we must create some directories to support persistence of the sonarqube results First one Directory to store the analysis results ```shell mkdir e:\sonarqube\data ``` This one for installed extensions ```shell mkdir e:\sonarqube\extensions ``` so now it's time for the creation of a sonarqube instance called `sonarqube`: ```shell docker run -d --name sonarqube --net mynet -p 9000:9000 -p 9092:9092 -e SONARQUBE_JDBC_USERNAME=sonar -e SONARQUBE_JDBC_PASSWORD=sonar -e SONARQUBE_JDBC_URL=jdbc:postgresql://sonar-postgres:5432/sonar -v E:\sonarqube\data:/opt/sq/data -v E:\sonarqube\extensions:/opt/sonarqube/extensions sonarqube:8.9.2-community ``` This will now connect the instance to `mynet` and so it will possible to communicate to the prostgres database (installed before). After the creation you can access the instance by `http://localhost:9000` ![](https://notes.bajonczak.com/assets/img/starting.cf7c7c96.png) s you will be able to login with the username `admin` and password `admin` ## USing with WSL2 (Windows Subsystem for Linux) To run it with the Wsl, you will increase the memory limit. To do this, you must enter the linux instance with: ```powershell wsl.exe -d docker-desktop ``` Now you can execute the following command, to increase the limitation: ```bash sysctl -w vm.max_map_count=262144 ``` # Create a new Anylsis project in Songarqube After you logged in into you [sonarqube instance (opens new window)](http://localhost:9000/?ref=blog.bajonczak.com)You will be able to create a new project. This will be uses later to send the compiler analysis to. So first select **manually** from the dashboard. ![](https://notes.bajonczak.com/assets/img/create.33d39650.png) Now you will be able to enter a projectname. For example **MyProject** ![](https://notes.bajonczak.com/assets/img/ProjectName.17b6f413.png) After this, the project was created into sonaqube. Now the important part, you must create an api key for this project. This will be used to push code analysis data to the sonarqube from your compiler output. So let's select **locally** ![](https://notes.bajonczak.com/assets/img/locally.0c2ddd94.png) you can now set the name for this token. ![](https://notes.bajonczak.com/assets/img/generate.ba858cce.png) After you hit the **Generate**\-Button you will get the generated token. Let's assume it is the key `MYSECRETKEY` So next step is to setup the requirements into your project # Execute a code analysis with .net core Beore you can execute an analysis in .net core you must install [dotnet-sonarscanner(opens new window)](https://www.nuget.org/packages/dotnet-sonarscanner?ref=blog.bajonczak.com) ```shell dotnet tool install --global dotnet-sonarscanner ``` After that you must extend your porjectfile to include a `ProjectGuid` like this: ```xml netcoreapp3.1 .... {AB1EBBAF-6DF7-41E9-815D-9AD4CF90C844} ..... ``` This is required for sonarqube. It will use this identify to create a unique key, to assign analysis updates. Otherwise, when no Id is set, it will ignore the project to analyse. Now let's do our first analysis. First of all we must start the gathering of measures. For this we use the sonarscanner toolkit (installed before). In this you must give information to which project the data will be assigned and which login will be used to authenticate (here you will take your generated key). Four our example we will enter the following command: ```text dotnet sonarscanner begin /k:"MyProject" /d:sonar.login="MYSECRETKEY" ``` you will git similiar output like this: ![](https://notes.bajonczak.com/assets/img/start.20b8288f.png) Next lets (re-)build the project with: ```shell dotnet build ``` NOw the compiler generates the output, that can be send to the sonarqube. You can do this with this command: ```shell dotnet sonarscanner end /d:sonar.login=admin /d:sonar.login="MYSECRETKEY" ``` After this command, you will get a large output like this (shortened) ![](https://notes.bajonczak.com/assets/img/end.970ea6ae.png) After this you can open up your [sonarqube (opens new window)](http://localhost:9000/?ref=blog.bajonczak.com)and see the result ![](https://notes.bajonczak.com/assets/img/sqresult.9b708efb.png) # Conculsion Sonarqube is a nice tool to make a static code analysis of your code. This will maybe several problems about your security, but also it will identify several complex code or just duplicated that increase technical debt and so on. Hope that this will help you in such a way to make your code great again 😉 # Update I was asked to create a docker compose file. So I uploaded it at a gist file on GitHub [here](https://gist.github.com/SBajonczak/89bcbd7778f94099c83156ecb7198521?ref=blog.bajonczak.com)