Skip to main content
Development

Self-host SonarQube on a VPS

Continuous code quality and security analysis.

Scan your codebases for bugs, vulnerabilities and code smells with quality gates wired into your CI.

Start freeSee VPS plans

Why self-host SonarQube?

Self-hosting SonarQube keeps your source and results on your own servers, which matters for private and regulated code.

How to install SonarQube

  1. 1

    Provision a VPS

    Pick a Debian/Ubuntu template and get root SSH in about a minute.

  2. 2

    Install the runtime

    Install Java + PostgreSQL.

  3. 3

    Deploy the application

    Net what you need from the project’s official source and run it.

  4. 4

    Put it behind TLS

    Reverse-proxy with Nginx and issue a Let’s Encrypt certificate.

  5. 5

    Add it to your backups

    Include the data directory and database in your backup routine before you rely on it.

Practical tips

  • Give SonarQube its own database user with rights only on its own schema.
  • Reverse-proxy SonarQube and terminate TLS at the proxy so certificates are managed in one place.
  • Take a VPS snapshot before major upgrades so you can roll back cleanly.
  • Keep SonarQube patched — most self-hosting incidents are unpatched software.

Frequently asked questions

How much RAM does SonarQube need?
Plan on 4 GB (8 GB recommended) for typical use; add headroom if you expect many concurrent users.
What stack does SonarQube run on?
Java + PostgreSQL.
Can I run other things on the same VPS?
Yes — size the plan so SonarQube plus your other workloads fit in RAM with room to spare.

Looking for something else? Popular alternatives include Semgrep, CodeQL (GitHub), SonarCloud (hosted) — browse all app guides.

About SonarQube

SonarQube is open-source software released under the LGPL-3.0 (Community) licence. HostingSwift does not maintain, sell or support SonarQube itself — you install and run it on your own VPS. These are the official links to the project:

Read the project's own documentation before deploying. We credit upstream projects because we genuinely run and recommend them — see our full open-source directory.