Do people actually use jlink? (split from JNI discussion)

[Ron Pressler]

> On 6 Sep 2023, at 12:10, Stephen Colebourne <scolebourne at joda.org> wrote:
> 
> On Wed, 6 Sept 2023 at 10:22, Ron Pressler <ron.pressler at oracle.com> wrote:
>> So we’ve worked for years on that and delivered a feature that allows any Java application to pick a runtime and configure it as it wishes (jlink). These days, if an application has difficulty choosing or configuring its runtime, it’s by choice. If lack of control over the runtime poses a problem for your application, why are you choosing not to control the runtime?
> 
> I think it is important to ask how widespread usage of jlink actually
> is? Is this something the Oracle team has data on?

Every Java runtime in the world (post JDK 11) is now produced with jlink (it’s the only way). But if you’re asking about people using jlink to create their own custom runtime, I believe the number is small but growing. Java has changed its recommended deployment model (for the better, IMO) and it will take time for people to adapt. One significant issue is that build tools don’t automatically help people generate runtimes.

> 
> The messaging I see around jlink is that it is only useful if every
> part of your application is modular. While this isn't accurate, it is
> true that it is more hassle when not everything is modular.

It is more inaccurate; it's false (only modules can be put into the runtime image, but Java applications have not been part of the runtime for a couple of decades). The hassle is minimal, and it is certainly drastically lower than the hassle of requiring end users to install a runtime and then for the application to try and respond to issues that may result from the user’s choice.

> Given that
> most people depend on open source libraries, and a lot of those
> (probably most) are not modular, my assumption is that most people
> don't use jlink?

Modular libraries and producing runtimes are mostly unrelated, unless you want to bake a library into the runtime image. If you just want to produce a runtime for your old applications, nothing needs to be modularised other than the JDK itself.

> When the Oracle team removed the JRE, my take is that most people just
> switched to deploying the JDK instead rather than adding jlink as a
> complication. But perhaps I'm wrong? Depending on a shared Java
> runtime still seems like a pretty normal model to me. Even if the
> shared runtime is in Docker.

You may well be right, but we’re seeing a change. For example, this was published just last week: https://snyk.io/blog/jlink-create-docker-images-spring-boot-java/

> 
> FWIW, I suspect deploying the JDK instead of the JRE is actually worse
> for security, which is ironic given all the discussion around the
> "threat" of native code.

There is no discussion about a “threat” of native code. It simply puts the application in a different mode. But yes, people should take an hour to learn jlink and deploy even a maximal runtime rather than a JDK.

> 
> My concern here is that the Oracle team is making assumptions about
> how Java is deployed which aren't actually realistic.

It’s not an assumption so much as saying: to address the problem you’ve raised we’ve already delivered a feature that is easy to use and you can start using today. Maybe for some reason you don’t like the solution (and we’d like to know why so we can improve it), but if you just choose not to use the solution for the problem you raise you obviously still suffer from the problem that the solution solves.

— Ron