redhatgov/sonarqube-image

SonarQube for OpenShift

SonarQube is a static code analysis service. Learn more about it here.

Running containers on OpenShift comes with certain security and other requirements. This repository contains:

• A Dockerfile for building an OpenShift-compatible SonarQube image
• The run scripts used in the Docker image

Prerequisites

• An account in an OpenShift 4.X environment and a project
• SonarQube requires a database to store its information. Provisioning a database is out-of-scope for this repository. If you wish to run the database on OpenShift, it is suggested that you deploy PostgreSQL using persistent storage. More information on the containerized PostgreSQL deployment tested with this project is available here.

Operator Deployment

A SonarQube Operator can be found here. Operators are the preferred way to deploy applications on Kubernetes.

sonarqube-image's Issues

Provide SonarQube version 8.n

TSSC is using functionality and testing with:

Community Edition Version 8.3 (build 34182)LGPL v3

Integration testing

Current Travis config simply tests if container image builds. script should be extended to include standup of a small SonarQube instance and running a small Java project through to ensure that SonarQube is operating correctly.

Vulnerability Remediation

Looks like the image on Quay could use a fresh build/push to remediate the 22 High Vulns.

https://quay.io/repository/redhatgov/sonarqube?tab=tags&tag=latest