Non-Oracle JDKs - Overview of options

bdw429s · November 16, 2018, 11:06pm

This thread is to organize information about the different JDKs out there and the advantages and drawbacks of each. If you haven’t heard. starting in Jan 2019, Oracle Java 8 will stop receiving updates of any kind and Oracle Java 10+ will no longer be free for commercial use. Ouch! Not to worry, there’s a growing list of Java distros out there to choose from which come in varying prices and with varying levels of support.

Disclaimer

So, first things first. Unlike Adobe, Lucee has never officially certified certain versions of Java as working with Lucee, nor have we ever supported your Java installation specifically. For the most part, Lucee is provided as a JVM-based application server and it’s up to you to install and manage Java on your machine. That said:

The Daemon Docker images as well as the Ortus Docker images use the OpenJDK base image
The installers built by VivioTech/@Jordan_Michaels bundle Oracle Java (I think)

Available JDKs

Here is an overview of the Java distros available to you. This is a working document, so please feel free to point out anything I’ve missed or gotten incorrect.

Oracle JDK

Oracle is the owner of Java, even though it is open source, and currently offers all versions of java for free. Starting in January 2019 (very soon!) things will change

Java 8 will stop receiving patches and updates of any sort (for free at least)
Java 10+ will no longer be free for commercial use. You will need to pay.
Oracle will offer LTS releases, but only for their paying customers.

More Reading: Oracle Will Charge for Java Starting in 2019 | USU Software

TL; DR: Oracle JDK is top dog and will have good support, but only if you have deep pockets.

OpenJDK Project

OpenJDK is a separate organization from Oracle, but the code base is primarily contributed to by Oracle. Pretty much all other Java providers are either building the OpenJDK code or a close fork of it. Oracle even has their own free builds of OpenJDK. It used to lack some enterprise features like Mission Control, but this gap has been mostly closed in the latest version. Oracle will only be contributing to each OpenJDK release for 6 months, and at that point it will be up to community contributors such as Redhat to backport patches into it.

OpenJDK 8 will stop receiving patches and updates from Oracle after Jan 2019.
There will only be a 6 month support window on every version
OpenJDK will always be free
OpenJDK has no installers and must be manually configured

More Reading: https://openjdk.java.net/
http://jdk.java.net/

TL; DR; If you have no money, don’t care about long term support, and always upgrade to the newest versions of Java, this might work great for you.

IBM Java

IBM Java has been around for a while. it is optimized for IBM’s tools that bundle their flavor of java and “The biggest difference between the Oracle and IBM java runtimes is that they have independent Java Virtual Machine (JVM) and Just In Time (JIT) compiler implementations.” (See second link below)

IBM Java is free to use
IBM Java offers optional paid support
IBM Java differs from the Oracle and OpenJDK-based distros in some ways

More Reading: Java SDK
java - What are the difference between ibm jdk and oracle jdk? - Stack Overflow

TL;DR: If you’re willing to test your app and make sure everything works, IBM Java might ba good free option, but I’m unclear on how much support you get if you’re not paying.

Azul Zulu

Azul offers several versions of OpenJDK-based builds, including Zulu, Zulu Enterprise, Zing, and Zulu Embedded. Each comes with a different combination of cost and support.

Zulu is free but doesn’t appear to have any support
Zulu Enterprise costs some solid bling but has long term support
Zing is a custom JVM as well which costs money
Zulu has nice installers which mimic the registry and env vars of Oracle.

More Reading: https://www.azul.com/eliminating-java-update-confusion/
Java 8, 11, 17, 21, 22 Download for Linux, Windows and macOS

TL; DR: If you can afford to pay for support, Azul may be a good option, but the free versions don’t seem to have a noticeable benefit other than the installers.

Amazon Corretto

Corretto is the new kid in the game. It is backed by Amazon and will become the default Java builds on AWS. It will be free and have LTS releases. Corretto is based on the OpenJDK builds as well.

Completely free
Will backport fixes and updates to Java 8 until 2023
Provides LTS Releases
ONLY JDK 8 support is released so far. JDK 11 will come in “early 2019”
Corretto has installers, but they’re still a little rough around the edges

AdoptOpenJDK

AdoptOpenJDK is another offering that creates 32/64 bit builds of OpenJDK for free, offering LTS releases. AdoptOpenJDK offers builds with the Hotspot JVM as well as the OpenJ9 JVM which is from Eclipse. They have builds of OpenJDK 8-11 available in GitHub repos. One of the differences of AdoptOpenJDK is they do not maintain their own fork of OpenJDK, but instead only provide builds from the main OpenJDK repos.

Completely Free
Provides builds of the official OpenJDK repos.
Does not patch themselves, but uses the community-maintained OpenJDK.
Not backed by a large/well-known company
No installers, so manual installation needed

More Reading: https://adoptopenjdk.net/

TL;DR: This looks like a solid free option with support and many options, but not as polished with few installers and doesn’t provide paid support directly.

modius · November 19, 2018, 1:12am

With respect to Lucee Docker images; it is very convenient to rely on the work of the Tomcat community and use their official image variants as a base for Lucee; Docker

Tomcat Docker team uses OpenJDK.

Sadly I can’t seem to find any official response from Tomcat with respect to a decision around the JDK provider. So it’s probably business as usual and use of OpenJDK.

Are we sure that OpenJDK themselves won’t step up and provide support independent of their original sponsor Oracle? Redhat/IBM imply they would be happy to takeover OpenJDK… and that AWS had also expressed interest…

On the other hand, it never fills you with confidence when AWS decide to take advantage of the chaos and take complete control with their own release

For the short term we’ll likely wait and see with respect to the Lucee Docker image stack; ie. continue to rely on the Tomcat official distribution. In the longer term, swapping out the JDK to the front-runner should be pretty straightforward.

modius · November 19, 2018, 1:18am

Note, this is one of the reasons moving to Docker is worth the effort. Having the ability to effectively “version control” your infrastructure and roll-out/roll-back whole stack changes is awesome

humpback

micstriit · November 19, 2018, 7:42am

what if we no longer bundle Java at all and let the users decide, we could make a webpage containing @bdw429s info above and point to it in the installer.

Zackster · November 19, 2018, 8:08am

I like the idea of not bundling java because it means people won’t be stuck on old versions of java,
but on the downside, it makes installation even more complicated and I fear even more posts from users
getting started and having trouble…

David_Raschper · November 19, 2018, 2:02pm

I like if we could bundle the open-jdk with lucee.
So lucee version x is bundled with java version x.
I guess so its easier to support lucee, because you dont have to care about other java versions.
Also testing and debugging should be easier.
But sure, updating your java-version for lucee would be more complex and lucee users have to rely on java-updates on lucee-side.

Jordan_Michaels · November 26, 2018, 6:17pm

I like this idea too. Many of Vivio’s technicians are already configuring users with a “system-based” version of Java (like an OpenJDK) and then switching the installer-based installs to use the system-installed JDK which gets updated whenever the system releases a java update. I could update the installer scripts to use the version of Java that it finds on the system or install a JDK if none are already installed. It will take some time, but can be done.

andreas · December 6, 2018, 12:14pm

I’mjust a boring windows IIS guy who loves installing it all by one click. I think this is most importantly if I’m a total newbie. I rember the days with railo, it was really hard to get cfml working, with lots of stuff to install (apj connectors, manual directories) to get it working with IIS.

What I would really love (this is would be the luxury version) is to preselect the JavaVersion by radio button before downloading it, and have it all bundeled then. But of course I know there is no available time to do that at all. Just speaking out loud here.

I only wanted to comment that there should be at least an working “out of the box” version, like the express-version just to try and play arround some stuff with lucee easily.

bdw429s · December 6, 2018, 3:17pm

@andreas I agree both with the need for people to be able to have options, but also having easy out-of-the box ways to use Lucee. If you just want to spin up a server, use CommandBox. It’s the easiest way to start Lucee or Adobe CF, and the next version of CommandBox (v4.5.0) will actually be smart enough to download and install any version of OpenJDK that you want. Ex:

install java:openjdk11

This feature uses the API from AdoptOpenJDK, which I mentioned in the original post.

JF_Robichaud · December 11, 2018, 4:48pm

We’re still on Tomcat 7, with Oracle JDK 8.

Before the end of year we were thinking of switching to OpenJDK to get us through the first 6 months of 2019 and then re-evaluate using Amazon Corretto as it would be out of preview by then.

If my understanding is correct OpenJDK 8 might not be “good enough” to get security patches in January, if any are needed, as OpenJDK 8 will also stop receiving updates … that leaves OpenJDK 11 as the only supported OpenJDK version in 2019.

Java 9-11 support is officially in Lucee 5.3 which is still in RC. Unless I am mistaken Lucee 5.2.x doesn’t officially support Java 11 (?)

Are most of you just switching straight to Corretto for production usage or running Lucee 5.3-RC on production already to get OpenJDK 11?

bdw429s · December 11, 2018, 10:51pm

Hi @JF_Robichaud let me address your questions categorically:

If my understanding is correct OpenJDK 8 might not be “good enough” to get security patches in January, if any are needed, as OpenJDK 8 will also stop receiving updates

This is incorrect. Oracle specifically will stop adding patches to OpenJDK8 in Jan 2019 however the OpenJDK community will elect a member to take the lead in keeping it up to date (probably Redhat who took over JDK 6 and 7 from Oracle). OpenJDK is an interesting beast as it’s not directly controlled by Oracle even though it’s sort of married to them in terms of all their infrastructure. Basically, for the first 6 months of every major Java version, Oracle will pour their commits into the OpenJDK repos. After 6 months is up (or in Jan, for instance) Oracle will continue to do patches but only on their private internal repos reserved for paying customers! The OpenJDK community will continue to backport patches to the OpenJDK repo however. Most java providers are advertizing OpenJDK8 support until 2023 I think. There are other committers to the main OpenJDK repos that are NOT Oracle employees. Mostly Redhat, IBM, etc employees, but in some cases, just rando Java community members.

that leaves OpenJDK 11 as the only supported OpenJDK version in 2019.

That is incorrect as I stated above, but I wanted to unpack the word “supported” a bit. There are a lot of people talking about “support” but that means a lot of different things to different people. There are projects such as AdoptOpenJDK who focus mostly on creating OpenJDK builds and they have pledged to help direct resources and developers to fixing any issues that come up. However, if a massive security vuln comes out in java and you need the fix right now and you want a 1-800 number or a support E-mail you can contact and demand your fix, then don’t go calling Adopt as they aren’t offering guaranteed PAID support. IBM and Azul are for sure. I’m not actually sure if Amazon Corretto is “supported” in a “you can take it to the bank” sort of way, or just a “trust us, we won’t let you down” sort of way. The funny thing about all the different OpenJDk providers (Adopot, Azul, Amazon, IBM, OpenJDK “proper”) is they all have their own code repos which are forks of the main mecural repos. 99% of the code is the exact same in each of them and they’ve all pledged to send patches upstream to the main OpenJDK project and not just keep fixes for themselves. However, these are just promises which may or may not hold true. So if you’re willing to bet that the general open source community will have your back (and this is probably a pretty safe assumption to take to be honest) then you can probably just grab any free build and rest assured that if disaster strikes, you’ll get a patch in a reasonable amount of time. If you want to E-mail a specific person and demand fixes right away, then reach for your pocket book and pay Oracle, Azul, IBM, etc for that privilege.

Java 9-11 support is officially in Lucee 5.3 which is still in RC.

Correct. We are hoping to release 5.3 this month, but no promises. We need to make sure it’s all stable!

Unless I am mistaken Lucee 5.2.x doesn’t officially support Java 11 (?)Unless I am mistaken Lucee 5.2.x doesn’t officially support Java 11 (?)

Um, half incorrect. 5.2.9.31 has somewhat sort of kind of Java 9+ support. Lucee will run, HOWEVER you need to to add a special JVM arg to avoid nasty errors about loading the java agent programatically. There was also basically no testing of any real sort done on Java 9+ on Lucee 5.2 to my knowledge so just keep that in mind. I don’t actually know how much “real” testing has happened on Lucee 5.3 to be honest, but I know it’s solved the java agent issue and it’s been tested a bit. So in short, you can use java 11 on Lucee 5.2 with a workaround but just test it well

Are most of you just switching straight to Corretto

I was very excited about Corretto, but my excitement cooled a bit when I realized they ONLY had JDK8 builds and wouldn’t have Java 11 builds until first quarter of 2019. I’ve been using AdoptOpenJDK’s builds for CommandBox and that’s what we’re bundling with Lucee. To a degree, all the major players here have pretty much the same code and the same builds, and are promising to pass the same fixes around, etc. IMO it’s really going to boil down to how badly you need paid support and how quickly each java provider will be at getting out patches. And back on AdoptOpenJDk-- they are already creating the official supported IBM OpenJ9 builds and they will soon be building Amazon Corretto’s builds and quite likely, the official OpenJDK builds as well pretty soon. The OpenJDK marketplace seems to be converging around Adopt quite a bit which I think is a very good thing which is why I’ve been using Adopt myself. We’ll see what the landscape looks like in 6 months.

I also wanted to address a question you didn’t ask but it’s come up in some Adobe forums. I was concerned initially that people staying on Oracle JDK8 after Jan 1st might actually be in some violation of Oracle’s licensing. This is not the case. You are free to use Oracle JDK8 for as long as you wish-- you just won’t ever get an update for it again unless you pay Oracle. So you’ll want to transition for sure to stay on a “supported” path but if you only get around to updating java every 8 months, it’s not like Oracle will be busting down your door with their lawyers on Jan 1st!

And finally, read this:
https://medium.com/@javachampions/java-is-still-free-c02aef8c9e04
it’s long. Like REALLY long. But it answers tons and tons of questions about OpenJDK and what your options are so it’s worth the read.

JF_Robichaud · December 12, 2018, 12:28am

@bdw429s thank you so much for the detailed answer. It certainly clears up things!

Apologies for the confusion I created with “support” on top of an already complex issue! I did mean it as “provide updates” and not have a direct support line… basically what we had prior to the change.

That last article you posted is almost definitely a must read on the topic. It cleared up so much confusion from someone who doesn’t follow the OpenJDK development lifecycle. Navigating Oracle’s legal document is just a nightmare.

This bit in particular really helped clear things up for me:

“Oracle will lead the first six months of an OpenJDK LTS code line, providing updates and producing Oracle OpenJDK builds, but will then afterward only provide updates for Oracle JDK, under a paid support plan.
However, Oracle will work with other OpenJDK vendors to hand over the OpenJDK LTS code line and allow them to continue working on it together to provide updates. Each vendor then has the choice of providing updates and/or paid support for the binaries they produce.”
https://medium.com/@javachampions/java-is-still-free-c02aef8c9e04

I’ve been using AdoptOpenJDK’s builds for CommandBox and that’s what we’re bundling with Lucee.

I had somewhat dismissed this option initially, but now having a better understanding of how the updates are shared it definitely does look very promising. I’ll be giving it a try tomorrow!

Thanks again for all the time you’ve put into this topic already here and on other forums.

andreas · February 15, 2019, 3:29am

Just want to express my very gratitude to @bdw429s and the rest of the ones here who helped in all of this!!! @bdw429s: Your post was really an outstanding overview and gave a really good insight into the overall situation about java in a few lines. A really great help!

Because there are no win builds on openjdk (just a redirect to oracle) I’ve ended giving Java Zulu a try on my dev-win10 laptop for now. Looks good. Thanks!!!

andreas · March 25, 2019, 9:51pm

Just to add/complete the possible alternatives to Oracles JDK: Alibaba just announced these days, it will have also a supported OpenJDK named Dragonwell as open source:

https://www.alibabacloud.com/blog/alibaba-makes-dragonwell-openjdk-open-source_594624

bdw429s · June 13, 2020, 1:54am

A post was split to a new topic: How to change default JRE in Lucee install