Java: OpenJDK, Free Software and Secure Services

A language and a runtime ecosystem

Java is a general-purpose programming language used for services, business applications and development tools. Source is normally compiled to bytecode executed by a Java Virtual Machine. The runtime, libraries, build tools and application together form the deployed system. JavaScript is a different language: a browser script does not require a Java runtime merely because the names look similar.

A useful way to assess Java is to start with the service you want to operate. Does the application already use its ecosystem? Who maintains it? Can the team diagnose runtime failures and perform upgrades? A familiar, well-supported platform can be a good choice when those questions have clear answers.

OpenJDK and software freedom

OpenJDK provides an open-source implementation of the Java platform. Relevant code uses GPLv2 with the Classpath Exception. The exception allows linking independent modules under their own terms; it does not make every application built with Java free software. The application and its dependencies still need their own licensing review.

Oracle OpenJDK builds and Oracle JDK releases must not be treated as one universal licence offering. Check the distribution, version and update you actually install. No-cost use and free software rights are different questions. Our recommendation is to document the supplier and exact terms rather than assuming that a product name settles them.

What the JVM changes — and what remains your job

The JVM provides a managed execution environment. It does not make application authorisation, confidential configuration or dependency selection disappear. A programme can still expose customer information through incorrect application logic even when the runtime behaves as designed.

For operation, distinguish the installed runtime from the running application. Knowing which executable a service uses, which configuration it reads and where its logs go is more useful during an incident than merely knowing that Java is installed somewhere on the server.

Libraries are part of the service

Java projects commonly rely on reusable libraries and build systems. Our operational advice is to keep an inventory of dependencies and make builds reproducible enough that another maintainer can produce a release. Review updates deliberately, keep the previous deployable release and record why a dependency is necessary.

A small application with an unclear dependency chain can be harder to support than a larger one with a documented release process. Free source is especially useful when the team can actually build it, investigate defects and replace an abandoned component.

Security starts with limited authority

We recommend a dedicated service account and only the filesystem and network access the application needs. Keep database credentials out of publicly accessible files and avoid running a web service with administrative privileges. Separate development from production configuration.

Validation, authorisation and careful handling of output belong in the application. A framework may help implement those controls, but choosing a framework does not establish that every route checks permissions. Treat error handling as part of the design: visitors need a useful response, while maintainers need diagnostics without exposing secrets.

Updates, memory and recovery

Record the runtime support policy alongside the application support policy. Test upgrades against representative requests and data before a production change. Set operational limits using observed behaviour and the host’s capacity rather than copying arbitrary tuning values from an unrelated workload.

For our service planning, a release is ready only when someone can explain how to deploy it, identify a failed start and restore the previous working state. Monitor the user-visible service, not just the existence of a process. Include application configuration and data recovery in that plan.

A practical choice for an independent network

Java can be part of an independently maintained free software infrastructure when the runtime, application and required components permit it. The useful outcome is a service that the team can understand and continue operating. Compare responsibilities with the PHP and database stack. For browser code and its different freedom questions, read Free JavaScript and security.