Author here. Eliya is an OpenJDK 25 LTS distribution for regulated / compliance-conscious production. Phase 1 shipped this month.
The argument behind it is that some production and compliance policy can only be implemented inside the JVM, not by a wrapper around it. Example: PCI DSS 3.5.1 requires a PAN to be unreadable at rest, but a heap dump writes live card numbers to disk in cleartext. Disable dumps and you lose the forensics. Solution? encrypt the volume and the dump still travels cleartext from memory to the writer. Redacting the dump as the stream is written, inside HotSpot, is the only solution that doesn't trade one risk for another, and you can't compose it from existing flags.
Scope: Phase 1 is an opt-in profile (-XX:EliyaProfile=Production) that sets six existing ergonomics (heap-dump-on-OOM, NMT, exit-on-OOM, predictable crash-log paths, diagnostics unlocked). A wrapper could reproduce Phase 1 today. The point of Phase 1 is establishing the policy point in the runtime, where the real runtime-only capabilities can attach in later phases.
If Temurin or Corretto already fits you, use them. This is for those who want opinionated production/compliance defaults in the runtime. Hard questions welcome, especially "why not just a wrapper" ?
fahimfarookme•2h ago
The argument behind it is that some production and compliance policy can only be implemented inside the JVM, not by a wrapper around it. Example: PCI DSS 3.5.1 requires a PAN to be unreadable at rest, but a heap dump writes live card numbers to disk in cleartext. Disable dumps and you lose the forensics. Solution? encrypt the volume and the dump still travels cleartext from memory to the writer. Redacting the dump as the stream is written, inside HotSpot, is the only solution that doesn't trade one risk for another, and you can't compose it from existing flags.
Scope: Phase 1 is an opt-in profile (-XX:EliyaProfile=Production) that sets six existing ergonomics (heap-dump-on-OOM, NMT, exit-on-OOM, predictable crash-log paths, diagnostics unlocked). A wrapper could reproduce Phase 1 today. The point of Phase 1 is establishing the policy point in the runtime, where the real runtime-only capabilities can attach in later phases.
If Temurin or Corretto already fits you, use them. This is for those who want opinionated production/compliance defaults in the runtime. Hard questions welcome, especially "why not just a wrapper" ?