docker安装及启动此处不做赘述，本文使用 sonarqube:8.9.1-community 版本docker镜像
镜像拉取及启动
- 镜像拉取
docker pull sonarqube:8.9.1-community
如遇数次拉取失败，可修改docker镜像源为"https://docker.mirrors.ustc.edu.cn"或"https://hub-mirror.c.163.com"，具体设置如下图所示
image.png
- 镜像启动
docker run -d --name sonarqube -e SONAR_ES_BOOTSTRAP_CHECKS_DISABLE=true -p 9000:9000 sonarqube:8.9.1-community
启动完成
实例启动并运行后，使用系统管理员凭据登录到http://localhost:9000：
- login: admin
- password: admin
扫描失败的原因及解决方案
1. Failed to connect to localhost/127.0.0.1:9000
INFO: ------------------------------------------------------------------------
ERROR: Error during SonarScanner execution
org.sonarsource.scanner.api.internal.ScannerException: Unable to execute SonarScanner analysis
at org.sonarsource.scanner.api.internal.IsolatedLauncherFactory.lambda$createLauncher$0(IsolatedLauncherFactory.java:85)
at java.base/java.security.AccessController.doPrivileged(Native Method)
at org.sonarsource.scanner.api.internal.IsolatedLauncherFactory.createLauncher(IsolatedLauncherFactory.java:74)
at org.sonarsource.scanner.api.internal.IsolatedLauncherFactory.createLauncher(IsolatedLauncherFactory.java:70)
at org.sonarsource.scanner.api.EmbeddedScanner.doStart(EmbeddedScanner.java:185)
at org.sonarsource.scanner.api.EmbeddedScanner.start(EmbeddedScanner.java:123)
at org.sonarsource.scanner.cli.Main.execute(Main.java:73)
at org.sonarsource.scanner.cli.Main.main(Main.java:61)
Caused by: java.lang.IllegalStateException: Fail to get bootstrap index from server
at org.sonarsource.scanner.api.internal.BootstrapIndexDownloader.getIndex(BootstrapIndexDownloader.java:42)
at org.sonarsource.scanner.api.internal.JarDownloader.getScannerEngineFiles(JarDownloader.java:58)
at org.sonarsource.scanner.api.internal.JarDownloader.download(JarDownloader.java:53)
at org.sonarsource.scanner.api.internal.IsolatedLauncherFactory.lambda$createLauncher$0(IsolatedLauncherFactory.java:76)
... 7 more
Caused by: java.net.ConnectException: Failed to connect to localhost/127.0.0.1:9000
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.RealConnection.connectSocket(RealConnection.java:265)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.RealConnection.connect(RealConnection.java:183)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.ExchangeFinder.findConnection(ExchangeFinder.java:224)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.ExchangeFinder.findHealthyConnection(ExchangeFinder.java:108)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.ExchangeFinder.find(ExchangeFinder.java:88)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.Transmitter.newExchange(Transmitter.java:169)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.java:41)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.cache.CacheInterceptor.intercept(CacheInterceptor.java:94)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.java:93)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.java:88)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117)
at org.sonarsource.scanner.api.internal.shaded.okhttp.RealCall.getResponseWithInterceptorChain(RealCall.java:221)
at org.sonarsource.scanner.api.internal.shaded.okhttp.RealCall.execute(RealCall.java:81)
at org.sonarsource.scanner.api.internal.ServerConnection.callUrl(ServerConnection.java:114)
at org.sonarsource.scanner.api.internal.ServerConnection.downloadString(ServerConnection.java:99)
at org.sonarsource.scanner.api.internal.BootstrapIndexDownloader.getIndex(BootstrapIndexDownloader.java:39)
... 10 more
Caused by: java.net.ConnectException: Connection refused (Connection refused)
at java.base/java.net.PlainSocketImpl.socketConnect(Native Method)
at java.base/java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
at java.base/java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
at java.base/java.net.AbstractPlainSocketImpl.connect(Unknown Source)
at java.base/java.net.SocksSocketImpl.connect(Unknown Source)
at java.base/java.net.Socket.connect(Unknown Source)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.platform.Platform.connectSocket(Platform.java:130)
at org.sonarsource.scanner.api.internal.shaded.okhttp.internal.connection.RealConnection.connectSocket(RealConnection.java:263)
... 31 more
根源：scanner的container网络跟sonarqube server不在一个网络内
解决：--network=host 参数
https://stackoverflow.com/questions/32097414/error-sonar-server-http-localhost9000-can-not-be-reached
2. please provide compiled classes with sonar.java.binaries property,
ERROR: Error during SonarScanner execution
org.sonar.java.AnalysisException: Your project contains .java files, please provide compiled classes with sonar.java.binaries property, or exclude them from the analysis with sonar.exclusions property.
at org.sonar.java.JavaClasspath.init(JavaClasspath.java:64)
at org.sonar.java.AbstractJavaClasspath.getElements(AbstractJavaClasspath.java:280)
at org.sonar.java.SonarComponents.getJavaClasspath(SonarComponents.java:149)
at org.sonar.java.JavaSquid.(JavaSquid.java:75)
at org.sonar.plugins.java.JavaSquidSensor.execute(JavaSquidSensor.java:102)
at org.sonar.scanner.sensor.AbstractSensorWrapper.analyse(AbstractSensorWrapper.java:48)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:85)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.lambda$execute$1(ModuleSensorsExecutor.java:59)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.withModuleStrategy(ModuleSensorsExecutor.java:77)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:59)
at org.sonar.scanner.scan.ModuleScanContainer.doAfterStart(ModuleScanContainer.java:82)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:137)
at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
at org.sonar.scanner.scan.ProjectScanContainer.scan(ProjectScanContainer.java:393)
at org.sonar.scanner.scan.ProjectScanContainer.scanRecursively(ProjectScanContainer.java:389)
at org.sonar.scanner.scan.ProjectScanContainer.doAfterStart(ProjectScanContainer.java:358)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:137)
at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
at org.sonar.scanner.bootstrap.GlobalContainer.doAfterStart(GlobalContainer.java:144)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:137)
at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
at org.sonar.batch.bootstrapper.Batch.doExecute(Batch.java:72)
at org.sonar.batch.bootstrapper.Batch.execute(Batch.java:66)
at org.sonarsource.scanner.api.internal.batch.BatchIsolatedLauncher.execute(BatchIsolatedLauncher.java:46)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.base/java.lang.reflect.Method.invoke(Unknown Source)
at org.sonarsource.scanner.api.internal.IsolatedLauncherProxy.invoke(IsolatedLauncherProxy.java:60)
at com.sun.proxy.$Proxy0.execute(Unknown Source)
at org.sonarsource.scanner.api.EmbeddedScanner.doExecute(EmbeddedScanner.java:189)
at org.sonarsource.scanner.api.EmbeddedScanner.execute(EmbeddedScanner.java:138)
at org.sonarsource.scanner.cli.Main.execute(Main.java:112)
at org.sonarsource.scanner.cli.Main.execute(Main.java:75)
at org.sonarsource.scanner.cli.Main.main(Main.java:61)
根源： java中缺少sonar.java.binaries 必选参数
解决：使用mvn compile编译源码，并在sonar-project.properties中添加参数
sonar.java.binaries=target/classes
其他语言请参考https://docs.sonarqube.org/latest/analysis/languages/overview/ 获取必选参数信息。
3. Scanner 出现java.lang.OutOfMemoryError: Java heap space
INFO: ------------------------------------------------------------------------
ERROR: Error during SonarScanner execution
java.lang.OutOfMemoryError: Java heap space
at org.sonarsource.analyzer.commons.xml.XmlFilePosition.shift(XmlFilePosition.java:83)
at org.sonarsource.analyzer.commons.xml.XmlFilePosition.shift(XmlFilePosition.java:62)
at org.sonarsource.analyzer.commons.xml.XmlFilePosition.moveAfterClosingBracket(XmlFilePosition.java:109)
at org.sonarsource.analyzer.commons.xml.XmlParser.visitEndElement(XmlParser.java:198)
at org.sonarsource.analyzer.commons.xml.XmlParser.parseXml(XmlParser.java:133)
at org.sonarsource.analyzer.commons.xml.XmlParser.(XmlParser.java:68)
at org.sonarsource.analyzer.commons.xml.XmlFile.getNamespaceUnawareDocument(XmlFile.java:129)
at org.sonar.java.checks.xml.struts.FormNameDuplicationCheck.scanFile(FormNameDuplicationCheck.java:41)
at org.sonarsource.analyzer.commons.xml.checks.SonarXmlCheck.scanFile(SonarXmlCheck.java:44)
at org.sonar.plugins.java.XmlFileSensor.scanFile(XmlFileSensor.java:121)
at org.sonar.plugins.java.XmlFileSensor.lambda$scanFile$2(XmlFileSensor.java:114)
at org.sonar.plugins.java.XmlFileSensor$$Lambda$1477/0x0000000100aba840.accept(Unknown Source)
at java.base/java.util.HashMap$Values.forEach(Unknown Source)
at org.sonar.plugins.java.XmlFileSensor.scanFile(XmlFileSensor.java:112)
at org.sonar.plugins.java.XmlFileSensor.execute(XmlFileSensor.java:86)
at org.sonar.scanner.sensor.AbstractSensorWrapper.analyse(AbstractSensorWrapper.java:48)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:85)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.lambda$execute$1(ModuleSensorsExecutor.java:59)
at org.sonar.scanner.sensor.ModuleSensorsExecutor$$Lambda$344/0x0000000100657440.run(Unknown Source)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.withModuleStrategy(ModuleSensorsExecutor.java:77)
at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:59)
at org.sonar.scanner.scan.ModuleScanContainer.doAfterStart(ModuleScanContainer.java:82)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:137)
at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
at org.sonar.scanner.scan.ProjectScanContainer.scan(ProjectScanContainer.java:393)
at org.sonar.scanner.scan.ProjectScanContainer.scanRecursively(ProjectScanContainer.java:389)
at org.sonar.scanner.scan.ProjectScanContainer.doAfterStart(ProjectScanContainer.java:358)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:137)
at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
at org.sonar.scanner.bootstrap.GlobalContainer.doAfterStart(GlobalContainer.java:144)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:137)
at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
根源： jvm默认配置太小，内存不足
解决：设置环境变量 SONAR_SCANNER_OPTS="-Xmx512m" 或者更大。
docker的解决方案为
docker run --network=host --rm -e SONAR_HOST_URL="http://localhost:9000" -e SONAR_SCANNER_OPTS="-Xmx1024m" -v "/Documents/github/security/Benchmark:/usr/src" sonarsource/sonar-scanner-cli
4. sonarqube server出现ES 137故障，自动退出。
onarqube_1 | 2020.12.09 07:38:00 INFO ce[][o.s.c.t.CeWorkerImpl] worker AXZGb3aOoJQO0GPdHzsd found no pending task (including indexation task). Disabling indexation task lookup for this worker until next SonarQube restart.
sonarqube_1 | 2020.12.09 07:49:33 INFO es[][o.e.m.j.JvmGcMonitorService] [gc][762] overhead, spent [281ms] collecting in the last [1s]
sonarqube_1 | 2020.12.09 09:31:15 WARN app[][o.s.a.p.AbstractManagedProcess] Process exited with exit value [es]: 137
sonarqube_1 | 2020.12.09 09:31:15 INFO app[][o.s.a.SchedulerImpl] Process[es] is stopped
sonarqube_1 | 2020.12.09 09:31:16 INFO ce[][o.s.p.ProcessEntryPoint] Hard stopping process
sonarqube_1 | 2020.12.09 09:31:16 INFO ce[][o.s.ce.app.CeServer] Compute Engine is stopping...
sonarqube_1 | 2020.12.09 09:31:16 INFO ce[][o.s.c.t.CeProcessingSchedulerImpl] Hard stopping workers...
sonarqube_1 | 2020.12.09 09:31:16 INFO ce[][o.s.ce.app.CeServer] Compute Engine is stopped
sonarqube_1 | 2020.12.09 09:31:16 INFO app[][o.s.a.SchedulerImpl] Process[ce] is stopped
sonarqube_1 | 2020.12.09 09:31:16 INFO web[][o.s.p.ProcessEntryPoint] Hard stopping process
sonarqube_1 | 2020.12.09 09:31:16 INFO web[][o.s.s.n.NotificationDaemon] Notification service stopped
sonarqube_1 | 2020.12.09 09:31:17 INFO app[][o.s.a.SchedulerImpl] Process[web] is stopped
sonarqube_1 | 2020.12.09 09:31:17 INFO app[][o.s.a.SchedulerImpl] SonarQube is stopped
根源：server 端ES 内存不足, 因为ES默认的heap size为2GB，而Docker的limit也是2GB。
解决：加大内存，docker Desktop端(Mac 与windows端)需要配置docker的最大内存超过4GB。或者限制ES的Heap size到750MB。
https://github.com/10up/wp-local-docker/issues/6#issue-211554733
5. # Error during SonarQube Scanner execution ERROR: You must define the following mandatory properties for ‘Unknown’: sonar.projectKey
根源：scanner无法在工程的根目录上找到sonar-project.properties文件，尽管该文件存在，但是docker -v挂在目录时不支持相对路径。
解决：将docker run -v...的运行脚本也放到工程根目录下，将当前目录挂载到/usr/src：
docker run ...
-v "$(pwd):/usr/src" \
sonarsource/sonar-scanner-cli
扫描失败的原因及解决方案转载于：https://www.jianshu.com/p/a388252af433