Why not build #OpenJDK 9 using #Docker ? – Part 1 of 2


I think I have joined the Docker [1] party a bit late but that means by now everyone knows what Docker is and all the other basic fundamentals which I can very well skip, but if you are still interested, please check these posts Get into Docker – A Guide for Total Newbies [2] and Docker for Total Newbies Part 2: Distribute Your Applications with Docker Images [3]. And if you still want to know more about this widely spoken topic, check out these Docker posts on Voxxed [4].

Why ?

Since everyone has been doing some sort of provisioning or spinning up of dev or pre-prod or test environments using Docker [1] I decided to do the same but with my favourite project i.e. OpenJDK [5].

So far you can natively build OpenJDK [6] across Linux, MacOs and Windows [7], or do the same things via virtual machines or vagrant instances, see more on then via these resources Virtual Machines, [8] Build your own OpenJDK [9] and this vagrant script [10]. All part of the Adopt OpenJDK initiative lead by London Java Community [14] and supported by JUGs all over the world.


Most parts of post is for those using Linux distributions (this one was created on Ubuntu 14.04). Linux, MacOS and Windows users please refer to Docker‘s  Linux, MacOS and Windows instructions respectively.

Hints: MacOS and Windows users will need to install Boot2Docker and remember to run the below two commands (and check your Docker host environment variables):

$ boot2docker init
$ boot2docker up 
$ boot2docker shellinit 

For the MacOS, if the above throw FATA[…] error messages, please try the below:

$ sudo boot2docker init
$ sudo boot2docker up 
$ sudo boot2docker shellinit 

For rest of the details please refer to the links provided above. Once you have the above in place for the Windows or MacOS platform, by merely executing the Dockerfile using the docker build and docker run commands you can create / update a container and run it respectively.

*** Please refer to the above links and ensure Docker works for you for the above platforms – try out tutorials or steps proving that Docker run as expected before proceeding further. ***

Building OpenJDK 9 using Docker

Now I will show you how to do the same things as mentioned above using Docker.

So I read the first two resource I shared so far (and wrote the last ones). So lets get started, and I’m going to walk you through what the Dockerfile looks like, as I take you through each section of the Dockerfile code.

*** Please note the steps below are not meant to be executed on your command prompty, they form an integral part of the Dockerfile which you can download from here at the end of this post. ***

You have noticed unlike everyone else I have chosen a different OS image i.e. phusion/baseimage, why? Read YOUR DOCKER IMAGE MIGHT BE BROKEN without you knowing it [11], to learn more about it.

FROM phusion/baseimage:latest

Each of the RUN steps below when executed becomes a Docker layer in isolation and gets assigned a SHA like this i.e. 95e30b7f52b9.

  apt-get update && \
  apt-get install -y \
    libxt-dev zip pkg-config libX11-dev libxext-dev \
    libxrender-dev libxtst-dev libasound2-dev libcups2-dev libfreetype6-dev && \
  rm -rf /var/lib/apt/lists/*

The base image is updated and a number of dependencies are installed i.e. Mercurial (hg) and build-essential.

  apt-get update && \
  apt-get install -y mercurial ca-certificates-java build-essential

Clone the OpenJDK 9 sources and download the latest sources from mercurial. You will notice that each of these steps are prefixed by this line cd /tmp &&, this is because each instruction is run in its own layer, as if it does not remember where it was when the previous instruction was run. Nothing to worry about, all your changes are still intact in the container.

  cd /tmp && \
  hg clone http://hg.openjdk.java.net/jdk9/jdk9 openjdk9 && \
  cd openjdk9 && \
  sh ./get_source.sh

Install only what you need when you need them, see below I downloaded wget and then the jdk binary. I also learnt how to use wget by passing the necessary params and headers to make the server give us the binary we request. Finally un-tar the file using the famous tar command.

  apt-get install -y wget && \
  wget --no-check-certificate --header "Cookie: oraclelicense=accept-securebackup-cookie" \ 

  tar zxvf jdk-8u45-linux-x64.tar.gz -C /opt

Run configure with the famous –with-boot-jdk=/opt/jdk1.8.0_45 to set the bootstrap jdk to point to jdk1.8.0_45.

  cd /tmp/openjdk9 && \
  bash ./configure --with-cacerts-file=/etc/ssl/certs/java/cacerts --with-boot-jdk=/opt/jdk1.8.0_45

Now run the most important command:

RUN \  
  cd /tmp/openjdk9 && \
  make clean images

Once the build is successful, the artefacts i.e. jdk and jre images are created in the build folder.

RUN \  
  cd /tmp/openjdk9 && \
  cp -a build/linux-x86_64-normal-server-release/images/jdk \

Below are some chmod ceremonies across the files and directories in the openjdk9 folder.

RUN \  
  cd /tmp/openjdk9 && \
  find /opt/openjdk9 -type f -exec chmod a+r {} + && \
  find /opt/openjdk9 -type d -exec chmod a+rx {} +

Two environment variable i.e. PATH and JAVA_HOME are created with the respective values assigned to them.

ENV PATH /opt/openjdk9/bin:$PATH
ENV JAVA_HOME /opt/openjdk9

You can find the entire source for the entire Dockerfile on github [12].

…more of this in the next post, Why not build #OpenJDK 9 using #Docker ? – Part 2 of 2, we will use the docker build, docker run commands and some more docker stuff.


What is being a good developer? How can we work to become better?


  • future of the Java ecosystem
  • JavaSE, Java EE workshops at Devoxx UK 2015
  • OpenJDK and JSRs
  • extraordinary developers
  • hands-on sessions, hackdays and panel
  • learn, collaborate and share
  • developer communities, JUG leaders, and corporate participations
  • thought leaders and tomorrow’s leaders of Java related topics
  • agenda, costs, tickets and discount codes

The Adopt team are running workshops at Devoxx UK next month that will help to answer the questions posed above. Why should you get along to a workshop? Well, here’s an imagined conversation between you and the Adopt team to explain. The Adopt Team are an ever growing community from various parts of the developer community, mainly the JUGs worldwide, members of the JCP, developers, evangelists and technical representatives of various companies supporting and extending the Java ecosystem via the JCP, Adopt-a-JSR  and Adopt OpenJDK programs.

You: I hear that there are a number of workshops going to be held during the first day of Devoxx UK 2015. What are these?

Adopt team: Yes, you heard right, we have a whole day (Wednesday) dedicated to it. In brief, the adopt team at Devoxx UK this year is comprised of experienced developers and leaders of various Java SE and Java EE topics i.e. OpenJDK, and a number of JSRs. These include members of the JCP as well. The topics range from learning how to build OpenJDK, working with devops tools, quality analysis tools, contributing and working with JSRs (guided by spec leads of the respective JSRs). Learning how to run a hackday if you want to start your own community where you are. And towards the end of the session you can get answers to the questions you have been pondering upon before or at the conference.

Have a look at the agenda to find out more.

You: Apart from OpenJDK, can you name some JSRs we will be involved with?

Adopt team: Good questions. We will have amongst us spec leads from the various JSRs:

  • JSR 363, Units of Measurement API – Leonardo Lima
  • JSR JSR 365, CDI 2.0 – Antoine Sabot-Durand
  • Java EE 8, and some of the proposed component JSRs, including JSR 371 MVC, the Security JSR, and JMS – David Delabassee

You: I’m a busy person, and there’s lots on at Devoxx. Why would I spend time at these workshops rather than doing something else? What do I gain from it?

Adopt team: Depending the workshop you attend you attend and participate in, the benefits can be any or all of these:

  • a great opportunity to feedback on tomorrow’s technology
  • learn and contribute to these technologies even before they are released
  • contributing to the future of the Java / Java platform
  • learn how to build your own Java / JVM platform
  • learn new technologies and improve your confidence,; including automation, code-coverage, testing technologies etc.
  • be able to make contact with and talk to the developers who are leading one or more of the technologies
  • be able to share with your own local user group / community the things you learn in the workshop
  • become a part of the adopt community and keep in touch about current and future developments, hackdays and other workshops

Contributions can be in any form, from as simple as speaking about it to another colleague, writing a post about it, or even mentioning it on a relevant mailing list.

You: So who is this aimed at? Who is your target audience?

Adopt team: Our primary goal is to propagate the know-how and experience various Java User Group leaders all across the globe, but we see everyone else benefiting from it as well: students, professionals, tech leads, devops, trainers, experts, etc…

You: What if my company wishes to be involved? Can you give me examples of companies who are already involved in this program?

Adopt team: Yes, companies, user groups, dev communities are all welcome. A number of companies are involved with the adoption program including: Oracle, IBM, RedHat, SAP, Google, Twitter, Goldman Sachs, Credit Suisse, among many others.

You: Can I or my company make contributions to any of the projects?

Adopt team: Yes, of course, that’s the whole point. One of the reasons is not just spread awareness and know-how of the upcoming technologies in the Java/JVM world but also to show how you can do it yourself. The topics and subtopics are numerous and this is an opportunity to pick one and lead it. You can drive these technologies with the help other community members, helping move your vision forward. Come along to a workshop to find out more!

You: So how much more does it cost me or my company if I have to attend these workshops?

Adopt team: Have a look at the ticket prices for the university days and the combi-tickets. You can also take advantage of special discount codes from us to get further discounts on the final ticket prices (ranging from 10 to 20%).

You:  What do we take along with us to be able to participate in the workshops ?

Adopt team: Bring along a laptop and a fresh mind to absorb all the knowledge and experience we have to share.

You: I hear this theme ‘The Extraordinary…. what is it about, tell me more” Why is this post so titled?

Adopt team: Another good question: to know more about the theme have a look at this http://www.devoxx.co.uk/2015/03/whats-theme/.

Good developers do what every developer does and more. They come to conferences like Devoxx, attend local dev events and talks, participate in workshops similar to the ones this post speaks about and then go out and share many of those things with other fellow developers in the form of blog posts, code snippets or even local community presentations.

You: What about those who can’t get to the workshop. How can they find out more and get involved?

Adopt team: These three websites are a great starting point to get to know more about the adopt programs: http://www.jcp.org, http://adoptopenjdk.java.net and http://adoptajsr.java.net/, but if you are based in London, the LJC organises a hackday every month, see http://www.meetup.com/Londonjavacommunity/events/222368734/, in the past developers from outside London and even outside the UK have visited the day-long hackdays.

You:  So tell me how did this come about? Who do you credit the initiative to?

Adopt team: Nice question: credit must go to where it is due. Thanks to the support from the JCP organisation i.e. Heather VanCura and Mark Hazell for making it happen at Devoxx UK this year. Not forgetting that any event like this one isn’t possible without the help of local and worldwide developer communities, with the likes of London Java Community (@LJCJug), continuously supporting good developer endeavours.

You: How to get the code?

Adopt team: That’s an important question, get in touch with Heather VanCura (heather@jcp.org) or Mark Hazell (mark.hazell@devoxx.co.uk) and they should help you sort out a discount code for you, but hurry are they will get exhausted soon.

How is Java / JVM built ? Adopt OpenJDK is your answer!

Introduction & history
As some of you may already know, starting with Java 7, OpenJDK is the Reference Implementation (RI) to Java. The below time line gives you an idea about the history of OpenJDK:
OpenJDK history (2006 till date)
If you have wondered about the JDK or JRE binaries that you download from vendors like Oracle, Red Hat, etcetera, then the clue is that these all stem from OpenJDK. Each vendor then adds some extra artefacts that are not open source yet due to security, proprietary or other reasons.

What is OpenJDK made of ?
OpenJDK is made up of a number of repositories, namely corba, hotspot, jaxp, jaxws, jdk, langtools, and nashorn. Between OpenjJDK8 and OpenJDK9 there have been no new repositories introduced, but lots of new changes and restructuring, primarily due to Jigsaw – the modularisation of Java itself [2] [3] [4] [5].
repo composition, language breakdown (metrics are estimated)
Recent history
OpenJDK Build Benchmarks – build-infra (Nov 2011) by Fredrik Öhrström, ex-Oracle, OpenJDK hero!

Fredrik Öhrström visited the LJC [16] in November 2011 where he showed us how to build OpenJDK on the three major platforms, and also distributed a four page leaflet with the benchmarks of the various components and how long they took to build. The new build system and the new makefiles are a result of the build system being re-written (build-infra).

Below are screen-shots of the leaflets, a good reference to compare our journey:

How has Java the language and platform built over the years ?

Java is built by bootstrapping an older (previous) version of Java – i.e. Java is built using Java itself as its building block. Where older components are put together to create a new component which in the next phase becomes the building block. A good example of bootstrapping can be found at Scheme from Scratch [6] or even on Wikipedia [7].

OpenJDK8 [8] is compiled and built using JDK7, similarly OpenJDK9 [9] is compiled and built using JDK8. In theory OpenJDK8 can be compiled using the images created from OpenJDK8, similarly for OpenJDK9 using OpenJDK9. Using a process called bootcycle images – a JDK image of OpenJDK is created and then using the same image, OpenJDK is compiled again, which can be accomplished using a make command option:
$ make bootcycle-images       # Build images twice, second time with newly built JDK

make offers a number of options under OpenJDK8 and OpenJDK9, you can build individual components or modules by naming them, i.e.

$ make [component-name] | [module-name]
or even run multiple build processes in parallel, i.e.
$ make JOBS=<n>                 # Run <n> parallel make jobs
Finally install the built artefact using the install option, i.e.
$ make install

Some myths busted
OpenJDK or Hotspot to be more specific isn’t completely written in C/C++, a good part of the code-base is good ‘ole Java (see the composition figure above). So you don’t have to be a hard-core developer to contribute to OpenJDK. Even the underlying C/C++ code code-base isn’t scary or daunting to look at. For example here is an extract of a code snippet from vm/memory/universe.cpp in the HotSpot repo –

if (UseParallelGC) {
#ifndef SERIALGC
Universe::_collectedHeap = new ParallelScavengeHeap();
#else // SERIALGC
fatal("UseParallelGC not supported in this VM.");
#endif // SERIALGC

} else if (UseG1GC) {
#ifndef SERIALGC
G1CollectorPolicy* g1p = new G1CollectorPolicy();
G1CollectedHeap* g1h = new G1CollectedHeap(g1p);
Universe::_collectedHeap = g1h;
#else // SERIALGC
fatal("UseG1GC not supported in java kernel vm.");
#endif // SERIALGC

} else {
GenCollectorPolicy* gc_policy;

if (UseSerialGC) {
gc_policy = new MarkSweepPolicy();
} else if (UseConcMarkSweepGC) {
#ifndef SERIALGC
if (UseAdaptiveSizePolicy) {
gc_policy = new ASConcurrentMarkSweepPolicy();
} else {
gc_policy = new ConcurrentMarkSweepPolicy();
#else // SERIALGC
fatal("UseConcMarkSweepGC not supported in this VM.");
#endif // SERIALGC
} else { // default old generation
gc_policy = new MarkSweepPolicy();

Universe::_collectedHeap = new GenCollectedHeap(gc_policy);
. . .
(please note that the above code snippet might have changed since published here)
The things that appears clear from the above code-block are, we are looking at how pre-compiler notations are used to create Hotspot code that supports a certain type of GC i.e. Serial GC or Parallel GC. Also the type of GC policy is selected in the above code-block when one or more GC switches are toggled i.e. UseAdaptiveSizePolicy when enabled selects the Asynchronous Concurrent Mark and Sweep policy. In case of either Use Serial GC or Use Concurrent Mark Sweep GC are not selected, then the GC policy selected is Mark and Sweep policy. All of this and more is pretty clearly readable and verbose, and not just nicely formatted code that reads like English.

Further commentary can be found in the section called Deep dive Hotspot stuff in the Adopt OpenJDK Intermediate & Advance experiences [11] document.

Steps to build your own JDK or JRE
Earlier we mentioned about JDK and JRE images – these are no longer only available to the big players in the Java world, you and I can build such images very easily. The steps for the process have been simplified, and for a quick start see the Adopt OpenJDK Getting Started Kit [12] and Adopt OpenJDK Intermediate & Advance experiences [11] documents. For detailed version of the same steps, please see the Adopt OpenJDK home page [13]. Basically building a JDK image from the OpenJDK code-base boils down to the below commands:

(setup steps have been made brief and some commands omitted, see links above for exact steps)
 $ hg clone http://hg.openjdk.java.net/jdk8/jdk8 jdk8  (a)...OpenJDK8
$ hg clone http://hg.openjdk.java.net/jdk9/jdk9 jdk9  (a)...OpenJDK9
$ ./get_source.sh                                     (b)
$ bash configure                                      (c)
$ make clean images                                   (d)
(setup steps have been made brief and some commands omitted, see links above for exact steps)

To explain what is happening at each of the steps above:
(a) We clone the openjdk mercurial repo just like we would using git clone ….
(b) Once we have step (a) completed, we change into the folder created, and run the get_source.sh command, which is equivalent to a git fetch or a git pull, since the step (a) only brings down base files and not all of the files and folders.
(c) Here we run a script that checks for and creates the configuration needed to do the compile and build process
(d) Once step (c) is success we perform a complete compile, build and create JDK and JRE images from the built artefacts

As you can see these are dead-easy steps to follow to build an artefact or JDK/JRE images [step (a) needs to be run only once].

– contribute to the evolution and improvement of the Java the language & platform
– learn about the internals of the language and platform
– learn about the OS platform and other technologies whilst doing the above
– get involved in F/OSS projects
– stay on top the latest changes in the Java / JVM sphere
– knowledge and experience that helps professionally but also these are not readily available from other sources (i.e. books, training, work-experience, university courses, etcetera).
– advancement in career
– personal development (soft skills and networking)

Join the Adopt OpenJDK [13] and Betterrev [15] projects and contribute by giving us feedback about everything Java including these projects. Join the Adoption Discuss mailing list [14] and other OpenJDK related mailing lists to start with, these will keep you updated with latest progress and changes to OpenJDK. Fork any of the projects you see and submit changes via pull-requests.

Thanks and support

Adopt OpenJDK [13] and umbrella projects have been supported and progressed with help of JCP [21], the Openjdk team [22], JUGs like London Java Community [16], SouJava [17] and other JUGs in Brazil, a number of JUGs in Europe i.e. BGJUG (Bulgarian JUG) [18], BeJUG (Belgium JUG) [19], Macedonian JUG [20], and a number of other small JUGs. We hope in the coming time more JUGs and individuals would get involved. If you or your JUG wish to participate please get in touch.


Special thanks to +Martijn Verburg (incepted Adopt OpenJDK),+Richard Warburton, +Oleg Shelajev, +Mite Mitreski, +Kaushik Chaubal and +Julius G for helping improve the content and quality of this post, and sharing their OpenJDK experience with us.


How to get started ?
Join the Adoption Discuss mailing list [14], go to the Adopt OpenJDK home page [13] to get started, followed by referring to the Adopt OpenJDK Getting Started Kit [12] and Adopt OpenJDK Intermediate & Advance experiences [11] documents.

Please share your comments here or tweet at @theNeomatrix369.

[17] SouJava

This post is part of the Java Advent Calendar and is licensed under the Creative Commons 3.0 Attribution license. If you like it, please spread the word by sharing, tweeting, FB, G+ and so on!

(Part 3 of 3): Synopsis of articles & videos on Performance tuning, JVM, GC in Java, Mechanical Sympathy, et al

This is a continuation of the previous post titled (Part 2 of 3): Synopsis of articles & videos on Performance tuning, JVM, GC in Java, Mechanical Sympathy, et al.

In our first review, The Atlassian guide to GC tuning is an extensive post covering the methodology and things to keep in mind when tuning GC, practical examples are given and references to important resources are also made in the process. The next one How NOT to measure latency by Gil Tene, he discusses some common pitfalls encountered in measuring and characterizing latency, demonstrating and discussing some false assumptions and measurement techniques that lead to dramatically incorrect reporting results, and covers simple ways to sanity check and correct these situations.  Finally Kirk Pepperdine in his post Poorly chosen Java HotSpot Garbage Collection Flags and how to fix them! throws light on some JVM flags – he starts with some 700 flags and boils it down to merely 7 flags. Also cautions you to not just draw conclusions or to take action in a whim but consult and examine – i.e. measure don’t guess!

….read more (reblogged from the Java Advent Calendar)

(Part 2 of 3): Synopsis of articles & videos on Performance tuning, JVM, GC in Java, Mechanical Sympathy, et al

This is a continuation of the previous post titled (Part 1 of 3): Synopsis of articles & videos on Performance tuning, JVM, GC in Java, Mechanical Sympathy, et al.

Without any further ado, lets get started with our next set of blogs and videos, chop…chop…! This time its Martin Thompson’s blog posts and talks. Martin’s first post on Java Garbage collection distilled basically distils the GC process and the underlying components including throwing light on a number of interesting GC flags (-XX:…). In his next talk he does his myth busting shaabang about mechanical sympathy, what people correctly believe in and the misconceptions. In the talk on performance testing, Martin takes its further and fuses Java, OS and the hardware to show how understanding of all these aspects can help write better programs.

Java Garbage Collection Distilled by Martin Thompson

There are too many flags to allow tuning the GC to achieve the throughput and latency your application requires. There’s plenty of documentation on the specifics of the bells and whistles around them but none to guide you through them.

Using SonarQube ™ (formerly Sonar ™) installed on the Mac OS X Mountain Lion 10.8.4

Introduction (contd.)

Continuing from where we left in our previous blog post on Installing SonarQube™ (formerly Sonar™) on Mac OS X Mountain Lion 10.8.4 [01], we will cover how to use SonarQube given different situations.

This post might come across a bit more verbose than the previous one, namely with outputs of commands and screenshots illustrating how SonarQube responds to various user actions.

Running SonarQube to analyse projects

We will cover the two ways SonarQube can be used to analyse a project (written in one of the SonarQube supported programming languages [02]) either via maven or through sonar-runner (for non-maven projects) and also the different aspects of SonarQube which help as a static code analysis tool.
via maven
Go to the project folder containing the maven configuration file i.e. pom.xml and run one of the below commands depending on the end goal:

$ mvn clean install sonar:sonar
$ mvn install sonar:sonar
$ mvn sonar:sonar

$ mvn clean sonar:sonar -Dsonar.host.url=http://localhost:nnnn

(where nnnn is an alternative port number where SonarQube is listening)


Successful analysis of the project via the above commands would lead to the below output onto the console or log files:
[INFO] ------------------------------------------------------------------------
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 29.923s
[INFO] Finished at: Fri Sep 13 18:07:01 BST 2013
[INFO] Final Memory: 62M/247M
[INFO] ------------------------------------------------------------------------
[INFO] [18:07:01.557] Execute org.apache.maven.plugins:maven-surefire-plugin:2.10:test done: 20372 ms
[INFO] [18:07:01.557] Execute maven plugin maven-surefire-plugin done: 20373 ms
[INFO] [18:07:09.526] ANALYSIS SUCCESSFUL, you can browse http://localhost:9000/dashboard/index/com.webapplication:sub-webapp
[INFO] [18:07:09.528] Executing post-job class org.sonar.issuesreport.ReportJob
[INFO] [18:07:09.529] Executing post-job class org.sonar.plugins.core.issue.notification.SendIssueNotificationsPostJob
[INFO] [18:07:09.529] Executing post-job class org.sonar.plugins.core.batch.IndexProjectPostJob
[INFO] [18:07:09.580] Executing post-job class org.sonar.plugins.dbcleaner.ProjectPurgePostJob
[INFO] [18:07:09.590] -&gt; Keep one snapshot per day between 2013-08-16 and 2013-09-12
[INFO] [18:07:09.591] -&gt; Keep one snapshot per week between 2012-09-14 and 2013-08-16
[INFO] [18:07:09.591] [INFO] [18:07:09.614]  Keep one snapshot per month between 2008-09-19 and 2012-09-14
[INFO] [18:07:09.627] -&gt; Delete data prior to: 2008-09-19
[INFO] [18:07:09.629] -&gt; Clean webapp [id=1]
[INFO] [18:07:09.631] [INFO] ------------------------------------------------------------------------
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 38.345s
[INFO] Finished at: Fri Sep 13 18:07:09 BST 2013
[INFO] Final Memory: 28M/255M
[INFO] ------------------------------------------------------------------------
Here are a couple of links to sample pom.xml files which should help with creating new or amend existing configurations to integrate maven projects with SonarQube (including additional maven CLI switches) i.e. Analyzing with Maven [03] and SonarQube examples on Github [04].

via sonar-runner

Go to the project folder containing the sonar-project.properties configuration file and run the below command:

<div>$ sonar-runner</div>


Successful analysis of the project via the above command would lead to the below output onto the console or log files:
SonarQube Runner 2.3
Java 1.7.0_25 Oracle Corporation (64-bit)
Mac OS X 10.8.5 x86_64
INFO: Runner configuration file: /opt/sonar-runner-2.3/conf/sonar-runner.properties
INFO: Project configuration file: /Users/manisarkar/bn_projects/TimelineJS/sonar-project.properties
INFO: Default locale: &quot;en_US&quot;, source code encoding: &quot;UTF-8&quot;
INFO: Work directory: /Users/manisarkar/bn_projects/TimelineJS/.sonar
INFO: SonarQube Server 3.7
14:11:20.927 INFO - Load batch settings
14:11:38.290 INFO - ANALYSIS SUCCESSFUL, you can browse http://localhost:9000/dashboard/index/TimelineJS
14:11:38.292 INFO - Executing post-job class org.sonar.issuesreport.ReportJob
14:11:38.293 INFO - Executing post-job class org.sonar.plugins.core.issue.notification.SendIssueNotificationsPostJob
14:11:38.314 INFO - Executing post-job class org.sonar.plugins.core.batch.IndexProjectPostJob
14:11:38.356 INFO - Executing post-job class org.sonar.plugins.dbcleaner.ProjectPurgePostJob
14:11:38.365 INFO - -&gt; Keep one snapshot per day between 2013-08-19 and 2013-09-15
14:11:38.365 INFO - -&gt; Keep one snapshot per week between 2012-09-17 and 2013-08-19
14:11:38.365 INFO - -&gt; Keep one snapshot per month between 2008-09-22 and 2012-09-17
14:11:38.365 INFO - -&gt; Delete data prior to: 2008-09-22
14:11:38.368 INFO - -&gt; Clean TimelineJS [id=151]
14:11:38.372 INFO - INFO: ------------------------------------------------------------------------
INFO: ------------------------------------------------------------------------
Total time: 19.099s
Final Memory: 14M/502M
INFO: ------------------------------------------------------------------------
Here are a couple of links to sample sonar-project.properties files to assisting in creating new ones i.e. Sonar setup for non-maven Java project [05] and Analyzing with SonarQube Runner [06].

Note: SonarQube Runner expects SonarQube to be running on the designated port, otherwise throws errors like i.e. ERROR: Sonar server http://localhost:9000 can not be reached. This of course can be changed via configuration files (see previous post [01]).

SonarQube Components

Once the build is complete and successful, the new or updated project can be found in the Dashboard. Drilling down into the project would bring up a screen like which is loaded with important metrics and analysis on various aspects of the project:

(above is a screen-shot of a sample application)

The prime important components that is of interest are Quality Index, Complexity Factor, Complexity (bottom left), Test coverage metrics (Unit Tests Coverage and Unit test success). Possibly Security violations. Package Tangle Index and Dependencies to cut, are definitely handy in order to keep clean packages and loosely coupled dependencies. On the same note, LCOM4 (Lack of Cohesion in Methods – lower the value the better)  and Complexity also throws light on how loosely coupled your classes, methods and functions are – it is also measured at the file level and an overall-level giving the full picture. All of these components are good indicators of Software Quality at the least if not Software Craftsmanship – how well is the underlying code written with care for quality in mind! Or it could be seen as-there-is-still-plenty-of-room-for-improvement-and-refactoring.

The Hotspot view now drills further into a few other important aspects of the analysis and highlights the areas that needs more attention or one ore more issue is near its culmination point – either have cross the maximum allowed limit or needs a bit more polishing to meet the requirements.


(above is a screenshot of a JDK7 as published on the nemo.sonarqube.org site)

I quite like the below Design component which gives a good break-down of the package dependencies across each other and highlights dependency-cycles. Its one of the more complex things to do on a medium to large project and can usually come in the way of modularisation.

(above is a screenshot of a sample application)

If you ever wanted to know the internal or external libraries a project uses, you might need to look at the contents of your project including the pom.xml file. No longer the case if you are using SonarQube, as Library is such a component that enlists components that your application depends on and is more reliable than searching for it manually.

(above is a screenshot of a sample application)

It is also possible to add any Widget on any Dashboard (Widgets are components that make up a Dashboard), like the one presented below.

(above is a screenshot of a sample application)

Issues Drilldown
Just being told that something is wrong and here’s the score on how much wrong or incorrect something is, does not help. A more constructive feedback is, here’s what’s wrong and this is what you can do to fix it.
The Issues Drilldown is one such dashboard where we can find such information or enough to know what’s wrong and where to go and how to fix it (sometimes). It also archives older and closed issues, and indicates how bad a problem it is by giving it various gradations of severity i.e. Blocker to Info.

(above is a screenshot of a sample application on nemo.sonarsource.org)

The Manage dashboards option at the top right corner of any of the Dashboard pages (as below) is used to create new dashboard pages into which widgets can be placed.
Similarly the Configure widgets link on every Dashboard page allows adding, removing or changing the position of the widgets anywhere on the Dashboard page.

(above is a screenshot of the Apache Commons Collection)

Tag or word Clouds is a very popular concept heavily used as a form of visualisation to convey metrics – as shown above, which is an illustration of the Apache Commons Collection library.

Commercial component – SQALE

SQALE is a proprietary component and not available in the community version, although a demo version is available via SonarQube’s Nemo project [07]. SQALE is a technical debt evaluation tool, more details of it can be found at [08].

(above is a screenshot of Apache Commons Collections)


Under the hood, this SonarQube instance relies on a number of default or customised configuration settings laid out as below.

(above is a screenshot of a sample application)

Configuration settings to individual components can be accessed and changed via this interface.

Update Centre

Many widgets that are populated in the various Dashboards seen so far can be enabled or disabled from the below page. It is also where updates and upgrades for all the widgets are available, including updates and upgrades for SonarQube itself.

(above is a screenshot of a sample application)

Upgrade process

Check out the upgrade process from [10], see also [11] to learn what should be done before and after the process.

Usually stopping and restarting SonarQube are common steps performed before and after applying an update or upgrade to one or more components or to SonarQube itself.


After assessing these features its clear that this product has a number of advantages over other solutions out there i.e. lots of free plugins, a plug-in based dashboard system, besides it being an open-source project, and a very good one to get started with. Having said that, there might be commercial products out there that have better quality assessment propositions but not necessarily useful unless yours is a big organisation.
Use SonarQube as a tool to create short-feedback loops, and apply improvements to your code base after assessing the rationale for the change suggested. In case the feedback is incorrect or is a false positive or false negative – one option would be to tweak the configuration settings behind the relevant component to see if the issue raised is applicable under a current conditions – basically either turning of the check or not taking the feedback literally.
Disclaimer: please do not take any of these metrics or the contents of the blog literally but rather as another point of view of  the quality of your code-base. Its important to know how to read the data and not read too much into the numbers and flags raised – there may still be false positives or false negatives. Some commercial products have taken this seriously and have invested to reduce the false positives and false negatives.

External resources

The below links have been used during the installation of SonarQube, and have been mentioned throughout the blog.


The terms Sonar and SonarQube have been used interchangeably in a number of places above. Some of it is due to the referred links not being updated, and others are due to the fact that scripts and program references have continued to be used with their original names to prevent issues with dependencies.

Do not take the settings, paths and file locations, url references, excetra mentioned in this blog literally, in some cases they would need to be adjusted to settings relevant to your environment.

Please note all the external links on this blog may or may not stay actual and is not feasible to be maintained as part of this blog post.

Please feel free to contribute to the above post in the form of constructive comments, useful links, additional information, excetra to improve the quality of the information provided. If something hasn’t worked for you and you have managed to make it work or have a work-around / alternative solution, please do share it with us!