Prerequisites¶
Choose the deployment surface before installing tools. Native and container execution have different host requirements.
Requirement matrix¶
| Component | Native CLI | VS Code | Eclipse | Container | Report Viewer |
|---|---|---|---|---|---|
| Java 11+ | Required | Required | Required for scanner runtime | No | No |
| Java 21 | Recommended | Recommended | Recommended | Included | No |
| OpenGrep | Required | Required | Required | Included | No |
| VS Code 1.92+ | No | Required | No | No | No |
| Eclipse or Spring Tools | No | No | Required | No | No |
| Docker 24+ or Podman 4.8+ | No | No | No | Required | No |
| Modern desktop browser | No | No | Used by embedded report view | No | Required |
| PostQ trial license | Scan only | Scan only | Scan only | Scan only | Not required |
The distributed prerequisite checker contains the release-specific minimum versions. Its result is authoritative for the artifact you received.
Run the pre-install check¶
Windows:
.\postq-code-scanner-preinstall-check.ps1
Linux or macOS:
bash ./postq-code-scanner-preinstall-check.sh
The default all profile checks native runtime, IDE host, and container readiness. Use runtime
for CLI/IDE preparation or container for container-only preparation.
READY means the required runtime checks passed. NOT READY means at least one required check
failed. NOT CHECKED means the selected profile did not evaluate every dependency for that
product. IDE command discovery is advisory because a graphical installation may not add a launcher
to PATH.
Pre-installation notes¶
- Use a dedicated output directory that the scanner process can write.
- Give the scanner read access only to the source tree that is in scope.
- Keep
postq.licoutside source control, images, and shared report archives. - For native execution, ensure
javaandopengrepresolve for the same account that runs scans. - For container execution, ensure source mounts can be read by the image's non-root user and the report mount can be written.
- Review remote installation scripts before running them in an enterprise environment. Approved package mirrors or verified release binaries are preferable where policy requires them.
- Scans can be CPU and memory intensive. Start with a representative service before scanning a large monorepo.
Official installation resources¶
| Tool | Official resource |
|---|---|
| Eclipse Temurin JDK | Adoptium installation guide |
| OpenGrep | OpenGrep installation guide |
| Visual Studio Code | VS Code downloads |
| Eclipse IDE | Eclipse downloads |
| Spring Tools | Spring Tools |
| Docker | Docker Engine installation |
| Podman | Podman installation |
| Cosign, optional | Cosign installation |
Continue with Install.