# SonarScanner has started failing with AccessDeniedException

**URL:** <https://community.sonarsource.com/t/sonarscanner-has-started-failing-with-accessdeniedexception/116156>\
**Category:** SonarQube Cloud\
**Created:** [May 28, 2024, 2:54pm UTC](https://community.sonarsource.com/t/sonarscanner-has-started-failing-with-accessdeniedexception/116156 "2024-05-28T14:54:39Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![phil-davis](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/phil-davis/32/15418_2.png) [@phil-davis](https://community.sonarsource.com/u/phil-davis)\
**Post date:** [May 28, 2024, 2:54pm UTC](https://community.sonarsource.com/t/sonarscanner-has-started-failing-with-accessdeniedexception/116156/1 "2024-05-28T14:54:40Z")

</div>

Template for a good new topic, formatted with [Markdown](https://commonmark.org/help/):

- ALM used - GitHub

- CI system used - drone

- Scanner command used when applicable  
Using docker sonarsource/sonar-scanner-cli

- Languages of the repository - PHP

- Only if the SonarCloud project is public, the URL  
[docs: remove PHPdoc of non-existent parameter by phil-davis · Pull Request #41256 · owncloud/core · GitHub](https://github.com/owncloud/core/pull/41256)  
[Drone CI](https://drone.owncloud.com/owncloud/core/39945/29/9)

- Error observed

```auto
Status: Downloaded newer image for sonarsource/sonar-scanner-cli:latest
INFO: Scanner configuration file: /opt/sonar-scanner/conf/sonar-scanner.properties
INFO: Project root configuration file: /drone/src/sonar-project.properties
INFO: SonarScanner 5.0.1.3006
INFO: Java 17.0.11 Alpine (64-bit)
INFO: Linux 5.15.0-107-generic amd64
INFO: SONAR_SCANNER_OPTS=-Xdebug
INFO: User cache: /opt/sonar-scanner/.sonar/cache
INFO: Analyzing on SonarCloud
...
ERROR: Error during SonarScanner execution
java.lang.IllegalStateException: Failed to preprocess files

Caused by: java.nio.file.AccessDeniedException: /drone/src/data

```

- Steps to reproduce  
Run the CI again!

- Potential workaround

I tried adding `data/**` to `sonar.exclusions` but still get the same error.

This problem started “recently”. But I am not aware of any changes to CI settings or SonarCloud versions. For example, this is a good CI run from May 16:  
[https://drone.owncloud.com/owncloud/core/39935/29/9](https://drone.owncloud.com/owncloud/core/39935/29/9)

So I am struggling to understand what changed to cause this problem.

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [May 29, 2024, 7:33am UTC](https://community.sonarsource.com/t/sonarscanner-has-started-failing-with-accessdeniedexception/116156/2 "2024-05-29T07:33:40Z")

</div>

Hey @phil-davis

I’m suspicious this has to do with a change to the sonar-scanner-cli docker image no longer running as root

> [@SonarScanner CLI Docker Image v10.0.1.1390\_5.0.1: clear your runner caches](https://community.sonarsource.com/t/sonarscanner-cli-docker-image-v10-0-1-1390-5-0-1-clear-your-runner-caches/115865):
>
> Dear Community, We just released the SonarScanner CLI Docker Image v10.0.1.1390\_5.0.1 This version includes a significant change that may impact some users: SCANDOCKER-2 Create a scanner-cli user and remove ROOT access If you encounter errors in your pipeline, we recommend clearing the runner caches. Due to the user change, the new scanner-cli user cannot access cached data previously created with the ROOT user. We apologize for any inconvenience this may cause. Please do not hesitate to r…

(I’m not suggesting here that clearing caches will fix this issue, just to provide more context).

Could you try using `sonarsource/sonar-scanner-cli:5` instead of `sonarsource/sonar-scanner-cli:latest` to see if this is what’s causing it?

---

<div class="post-metadata">

**Author:** ![phil-davis](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/phil-davis/32/15418_2.png) [@phil-davis](https://community.sonarsource.com/u/phil-davis)\
**Post date:** [May 29, 2024, 8:19am UTC](https://community.sonarsource.com/t/sonarscanner-has-started-failing-with-accessdeniedexception/116156/3 "2024-05-29T08:19:53Z")

</div>

That worked:

> <https://github.com/owncloud/core/pull/41256/commits/814ec25a3dfe1159d93a528a813e5402c5e8b9ab>

[https://drone.owncloud.com/owncloud/core/39948/29/9](https://drone.owncloud.com/owncloud/core/39948/29/9)

Note: I excluded the `data` dir but that was not enough to fix the problem

> <https://github.com/owncloud/core/pull/41256/commits/590cdac7c36cbaac1455e035b41c3dbb2f19e364>

---

<div class="post-metadata">

**Author:** ![phil-davis](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/phil-davis/32/15418_2.png) [@phil-davis](https://community.sonarsource.com/u/phil-davis)\
**Post date:** [May 29, 2024, 11:44am UTC](https://community.sonarsource.com/t/sonarscanner-has-started-failing-with-accessdeniedexception/116156/4 "2024-05-29T11:44:51Z")

</div>

Is there a way to completely prevent the scanner from even trying to read/traverse a directory?

Just putting `data/**` into `sonar.exclusions` does not work. I suppose that the scanner still tries to traverse the whole directory tree, and as it finds each item, it checks if the item is excluded.

But I need it to completely ignore the fact that it can’t even open the `data` directory to read it.

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [May 29, 2024, 12:17pm UTC](https://community.sonarsource.com/t/sonarscanner-has-started-failing-with-accessdeniedexception/116156/5 "2024-05-29T12:17:26Z")

</div>

> [@phil-davis](#):
>
> `/drone/src/data`

Can you help me understand what this directory is? Is it a part of your source code? Does your “real” source code sit in another directory in `/drone/`?

---

<div class="post-metadata">

**Author:** ![phil-davis](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/phil-davis/32/15418_2.png) [@phil-davis](https://community.sonarsource.com/u/phil-davis)\
**Post date:** [May 29, 2024, 2:04pm UTC](https://community.sonarsource.com/t/sonarscanner-has-started-failing-with-accessdeniedexception/116156/6 "2024-05-29T14:04:21Z")

</div>

ownCloud stores its data (uploaded files) in that `data` directory, it is not source code, it is not files from the repo. During running of tests in CI there will end up being some test user data in there. The CI uses a real Apache server, and that `data` directory and its contents will be owned by the Apache server “user” (something like `www-data`), whereas the the code in `drone/src/lib` etc. will be owned by whatever user is cloning the GitHub branch into the drone docker environment.

I guess it is a bit unfortunate that the `data` directory “pollutes” the `drone/src` structure. But if there is xsome way to tell SonarCloud to really ignore it, then that would be great.

---

<div class="post-metadata">

**Author:** ![nathalylopez](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/nathalylopez/32/58239_2.png) [@nathalylopez](https://community.sonarsource.com/u/nathalylopez)\
**Post date:** [May 29, 2024, 7:06pm UTC](https://community.sonarsource.com/t/sonarscanner-has-started-failing-with-accessdeniedexception/116156/7 "2024-05-29T19:06:31Z")

</div>

Thanks Colin.  
I was facing a similar issue and it worked after changing to sonarsource/sonar-scanner-cli:5

This was the error I got, for reference:

```auto
INFO: ------------------------------------------------------------------------
INFO: Total time: 15.997s
INFO: Final Memory: 7M/34M
INFO: ------------------------------------------------------------------------
ERROR: Error during SonarScanner execution
java.lang.IllegalStateException: Unable to load component class org.sonar.scanner.scan.ProjectLock
	at org.sonar.core.platform.ComponentContainer$ExtendedDefaultPicoContainer.getComponent(ComponentContainer.java:66)
	at org.picocontainer.DefaultPicoContainer.getComponent(DefaultPicoContainer.java:678)
	at org.sonar.core.platform.ComponentContainer.getComponentByType(ComponentContainer.java:282)
	at org.sonar.scanner.scan.ProjectScanContainer.doBeforeStart(ProjectScanContainer.java:156)
	at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:135)
	at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
	at org.sonar.scanner.bootstrap.GlobalContainer.doAfterStart(GlobalContainer.java:150)
	at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:137)
	at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
	at org.sonar.batch.bootstrapper.Batch.doExecute(Batch.java:72)
	at org.sonar.batch.bootstrapper.Batch.execute(Batch.java:66)
	at org.sonarsource.scanner.api.internal.batch.BatchIsolatedLauncher.execute(BatchIsolatedLauncher.java:46)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:568)
	at org.sonarsource.scanner.api.internal.IsolatedLauncherProxy.invoke(IsolatedLauncherProxy.java:60)
	at jdk.proxy1/jdk.proxy1.$Proxy0.execute(Unknown Source)
	at org.sonarsource.scanner.api.EmbeddedScanner.doExecute(EmbeddedScanner.java:189)
	at org.sonarsource.scanner.api.EmbeddedScanner.execute(EmbeddedScanner.java:138)
	at org.sonarsource.scanner.cli.Main.execute(Main.java:126)
	at org.sonarsource.scanner.cli.Main.execute(Main.java:81)
	at org.sonarsource.scanner.cli.Main.main(Main.java:62)
Caused by: java.lang.IllegalStateException: Failed to create work directory
	at org.sonar.scanner.scan.ProjectLock.<init>(ProjectLock.java:39)
	at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
	at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:499)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:480)
	at org.picocontainer.injectors.AbstractInjector.newInstance(AbstractInjector.java:145)
	at org.picocontainer.injectors.ConstructorInjector$1.run(ConstructorInjector.java:342)
	at org.picocontainer.injectors.AbstractInjector$ThreadLocalCyclicDependencyGuard.observe(AbstractInjector.java:270)
	at org.picocontainer.injectors.ConstructorInjector.getComponentInstance(ConstructorInjector.java:364)
	at org.picocontainer.injectors.AbstractInjectionFactory$LifecycleAdapter.getComponentInstance(AbstractInjectionFactory.java:56)
	at org.picocontainer.behaviors.AbstractBehavior.getComponentInstance(AbstractBehavior.java:64)
	at org.picocontainer.behaviors.Stored.getComponentInstance(Stored.java:91)
	at org.picocontainer.DefaultPicoContainer.getInstance(DefaultPicoContainer.java:699)
	at org.picocontainer.DefaultPicoContainer.getComponent(DefaultPicoContainer.java:647)
	at org.sonar.core.platform.ComponentContainer$ExtendedDefaultPicoContainer.getComponent(ComponentContainer.java:64)
	... 22 more
Caused by: java.nio.file.AccessDeniedException: /workspace/.scannerwork
	at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:90)
	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:106)
	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111)
	at java.base/sun.nio.fs.UnixFileSystemProvider.createDirectory(UnixFileSystemProvider.java:397)
	at java.base/java.nio.file.Files.createDirectory(Files.java:700)
	at java.base/java.nio.file.Files.createAndCheckIsDirectory(Files.java:807)
	at java.base/java.nio.file.Files.createDirectories(Files.java:793)
	at org.sonar.scanner.scan.ProjectLock.<init>(ProjectLock.java:36)
	... 37 more

```

---

<div class="post-metadata">

**Author:** ![pierreiexec](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/pierreiexec/32/58342_2.png) [@pierreiexec](https://community.sonarsource.com/u/pierreiexec)\
**Post date:** [June 3, 2024, 1:19pm UTC](https://community.sonarsource.com/t/sonarscanner-has-started-failing-with-accessdeniedexception/116156/8 "2024-06-03T13:19:40Z")

</div>

I use [sonarsource/sonar-scanner-cli (docker)](https://hub.docker.com/r/sonarsource/sonar-scanner-cli) in my CI, things worked well until the latest release when I started to have an error.

I rolled back to `sonarsource/sonar-scanner-cli:5` to avoid the issue until.

Here is the error message I get with current `sonarsource/sonar-scanner-cli:latest` (image digest: sha256:866f32d840223c8178778ed7a28556fbe3cac00dd74aac8290d7af93debcfcb2)

```auto
INFO: Working dir: /drone/src/.scannerwork

INFO: ------------------------------------------------------------------------

INFO: EXECUTION FAILURE

INFO: ------------------------------------------------------------------------

INFO: Total time: 3.437s

INFO: Final Memory: 13M/68M

INFO: ------------------------------------------------------------------------

ERROR: Error during SonarScanner execution

java.lang.IllegalStateException: Unable to load component class org.sonar.scanner.scan.ProjectLock

	at org.sonar.core.platform.ComponentContainer$ExtendedDefaultPicoContainer.getComponent(ComponentContainer.java:52)

	at org.picocontainer.DefaultPicoContainer.getComponent(DefaultPicoContainer.java:678)

	at org.sonar.core.platform.ComponentContainer.getComponentByType(ComponentContainer.java:277)

	at org.sonar.scanner.bootstrap.ScannerContainer.doBeforeStart(ScannerContainer.java:175)

	at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:121)

	at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:109)

	at org.sonar.scanner.bootstrap.GlobalContainer.doAfterStart(GlobalContainer.java:131)

	at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:123)

	at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:109)

	at org.sonar.batch.bootstrapper.Batch.doExecute(Batch.java:60)

	at org.sonar.batch.bootstrapper.Batch.execute(Batch.java:54)

	at org.sonarsource.scanner.api.internal.batch.BatchIsolatedLauncher.execute(BatchIsolatedLauncher.java:46)

	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)

	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

	at java.base/java.lang.reflect.Method.invoke(Method.java:568)

	at org.sonarsource.scanner.api.internal.IsolatedLauncherProxy.invoke(IsolatedLauncherProxy.java:60)

	at jdk.proxy1/jdk.proxy1.$Proxy0.execute(Unknown Source)

	at org.sonarsource.scanner.api.EmbeddedScanner.doExecute(EmbeddedScanner.java:189)

	at org.sonarsource.scanner.api.EmbeddedScanner.execute(EmbeddedScanner.java:138)

	at org.sonarsource.scanner.cli.Main.execute(Main.java:126)

	at org.sonarsource.scanner.cli.Main.execute(Main.java:81)

	at org.sonarsource.scanner.cli.Main.main(Main.java:62)

Caused by: java.lang.IllegalStateException: Failed to create work directory

	at org.sonar.scanner.scan.ProjectLock.<init>(ProjectLock.java:25)

	at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

	at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:77)

	at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)

	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:499)

	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:480)

	at org.picocontainer.injectors.AbstractInjector.newInstance(AbstractInjector.java:145)

	at org.picocontainer.injectors.ConstructorInjector$1.run(ConstructorInjector.java:342)

	at org.picocontainer.injectors.AbstractInjector$ThreadLocalCyclicDependencyGuard.observe(AbstractInjector.java:270)

	at org.picocontainer.injectors.ConstructorInjector.getComponentInstance(ConstructorInjector.java:364)

	at org.picocontainer.injectors.AbstractInjectionFactory$LifecycleAdapter.getComponentInstance(AbstractInjectionFactory.java:56)

	at org.picocontainer.behaviors.AbstractBehavior.getComponentInstance(AbstractBehavior.java:64)

	at org.picocontainer.behaviors.Stored.getComponentInstance(Stored.java:91)

	at org.picocontainer.DefaultPicoContainer.getInstance(DefaultPicoContainer.java:699)

	at org.picocontainer.DefaultPicoContainer.getComponent(DefaultPicoContainer.java:647)

	at org.sonar.core.platform.ComponentContainer$ExtendedDefaultPicoContainer.getComponent(ComponentContainer.java:50)

	... 22 more

Caused by: java.nio.file.AccessDeniedException: /drone/src/.scannerwork

	at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:90)

	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:106)

	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111)

	at java.base/sun.nio.fs.UnixFileSystemProvider.createDirectory(UnixFileSystemProvider.java:397)

	at java.base/java.nio.file.Files.createDirectory(Files.java:700)

	at java.base/java.nio.file.Files.createAndCheckIsDirectory(Files.java:807)

	at java.base/java.nio.file.Files.createDirectories(Files.java:793)

	at org.sonar.scanner.scan.ProjectLock.<init>(ProjectLock.java:22)

	... 37 more

```

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [June 4, 2024, 1:06pm UTC](https://community.sonarsource.com/t/sonarscanner-has-started-failing-with-accessdeniedexception/116156/10 "2024-06-04T13:06:16Z")

</div>

Thanks @pierreiexec. It’s interesting that you’re using Drone as well. I’m flagging this for some expert attention.

---

<div class="post-metadata">

**Author:** ![benjamin.raymond](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/benjamin.raymond/32/41399_2.png) [@benjamin.raymond](https://community.sonarsource.com/u/benjamin.raymond)\
**Post date:** [June 6, 2024, 1:19pm UTC](https://community.sonarsource.com/t/sonarscanner-has-started-failing-with-accessdeniedexception/116156/12 "2024-06-06T13:19:05Z")

</div>

Hi @phil-davis ,

We could reproduce your error by removing access rights on a subfolder owned by an user different than `1000` inside the source directory,

In your CI, you have to give read and write access to the mounted directory to user `1000`. Please refer to [our documentation to run the SonarScanner CLI in docker](https://docs.sonarsource.com/sonarqube/latest/analyzing-source-code/scanners/sonarscanner/#sonarscanner-from-docker-image) for more information.

> But if there is xsome way to tell SonarCloud to really ignore it, then that would be great.

As of today, there is unfortunately no way to completely ignore a directory. We will discuss internally whether it makes sense to fail the analysis when a folder can’t be accessed

Hope this helps,  
Benjamin

---

<div class="post-metadata">

**Author:** ![phil-davis](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/phil-davis/32/15418_2.png) [@phil-davis](https://community.sonarsource.com/u/phil-davis)\
**Post date:** [June 7, 2024, 3:23am UTC](https://community.sonarsource.com/t/sonarscanner-has-started-failing-with-accessdeniedexception/116156/14 "2024-06-07T03:23:41Z")

</div>

> We will discuss internally whether it makes sense to fail the analysis when a folder can’t be accessed.

If the folder is excluded from analysis, and it can’t be accessed, then it seems sensible to me that the analysis should not fail.

---

<div class="post-metadata">

**Author:** ![benjamin.raymond](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/benjamin.raymond/32/41399_2.png) [@benjamin.raymond](https://community.sonarsource.com/u/benjamin.raymond)\
**Post date:** [June 24, 2024, 3:21pm UTC](https://community.sonarsource.com/t/sonarscanner-has-started-failing-with-accessdeniedexception/116156/16 "2024-06-24T15:21:18Z")

</div>

Hello @phil-davis ,

I’ve requalified the corresponding tickets from improvement to bug. SonarQube and SonarCloud will be updated with a fix to prevent the scanner from failing to read a completely excluded folder.

You can track the [SonarQube ticket](https://sonarsource.atlassian.net/browse/SONAR-17640) to follow updates (not the SonarCloud one as this one is private).