Pre-installation steps on Linux systems

Configuring the host to comply with Elasticsearch

Because SonarQube Community Build uses an embedded Elasticsearch, make sure that your host configuration complies with the Elasticsearch production mode requirements and File Descriptors configuration.

Configuring the maximum number of open files and other limits

You must ensure that:

• The maximum number of memory map areas a process may have (vm.max_map_count) is greater than or equal to 524288.
• The maximum number of open file descriptors (fs.file-max) is greater than or equal to 131072.
• The user running SonarQube Community Build can open at least 131072 file descriptors.
• The user running SonarQube Community Build can open at least 8192 threads.

You must set these limits on the host system, whatever the installation type:

• For a Docker installation: These settings will then apply to the Docker container.  
• For a Kubernetes deployment: Check also these guidelines.  

To check and change these limits, login as the user used to run SonarQube Community Build and proceed as described below depending on the type of this user.

sysctl vm.max_map_count

sysctl fs.file-max

ulimit -n

ulimit -u

 vm.max_map_count=524288
 fs.file-max=131072

sonarqube   -   nofile   131072

sonarqube   -   nproc    8192

[Service]

...

LimitNOFILE=131072

LimitNPROC=8192

...

sysctl -w vm.max_map_count=524288

sysctl -w fs.file-max=131072

ulimit -n 131072

ulimit -u 8192

Enabling seccomp on the Linux kernel

By default, Elasticsearch uses the seccomp filter. Make sure you use a kernel with seccomp enabled.

To check that seccomp is available on your kernel, use:

$ grep SECCOMP /boot/config-$(uname -r)

If your kernel has seccomp, you'll see the following:

CONFIG_HAVE_ARCH_SECCOMP_FILTER=y

CONFIG_SECCOMP_FILTER=y

CONFIG_SECCOMP=y

Managing SonarQube Community Build access to fonts

Generating executive reports requires that fonts be installed on the server hosting SonarQube Community Build. 

If you use a Linux server, you should ensure that Fontconfig is installed on the server host.

If using an Oracle database

In case your SonarQube Community Build is running on Linux and you are using Oracle, the Oracle JDBC Driver may be blocked due to /dev/random. See this Oracle article for more details about this problem.

To avoid it, you may want to add this JVM parameter to your SonarQube Community Build's web server (sonar.web.javaOpts) configuration:

-Djava.security.egd=file:///dev/urandom

Configuring SonarQube Community Build to run in FIPS mode

SonarQube Community Build on RedHat Linux can run in FIPS (Federal Information Processing Standard) mode with some limitations. The FIPS mode may require an update of your webhooks configuration as explained below. 

Known limitations of the FIPS mode

 A FIPS-enabled SonarQube Community Build presents the following known limitations.

• Elasticsearch authentication in the Data Center Edition of SonarQube Community Build will not work on FIPS because PEM certificates are not supported as of today (but we plan to bring this support in the future). 
• SAML authentication with signature and encryption of the assertion is not supported yet.

Updating the webhooks configuration

In the FIPS mode, the webhook secrets must be at least 16 characters long; otherwise, the webhook messages will not be sent to the FIPS environment.

Proceed as follows:

• Check that the secret of each existing webhook is at least 16 characters long. If it’s not the case, update it. See Webhooks.