Strong encapsulation warning in Java 25.

[fbonander]

Tracer Version(s)

1.54.0

Java Version(s)

25.0.1+8.0.LTS

JVM Vendor

Eclipse Adoptium / Temurin

Bug Report

When running dd-agent with Java 25 we get the following warning:

WARNING: A restricted method in java.lang.System has been called
WARNING: java.lang.System::load has been called by com.kenai.jffi.internal.StubLoader in an unnamed module (file:/usr/local/datadog-agent.jar)
WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
WARNING: Restricted methods will be blocked in a future release unless native access is enabled

From my understanding this won't affect the functionality of the tracer agent right now. But in future versions of Java this might be blocked instead of a warning.

Addiotionally for us using --enable-native-access isn't an option as it might weaken security.

I don't know if migrating from JFFI to Javas Panama would be a viable option?

Expected Behavior

Running dd-agent in Java 25 without the warning.

Reproduction Code

No response

[andron3000]

Do you have any updates on this issue?

[bric3]

Hi @fbonander,

I'm sorry you have this issue, however all library that makes use any native access will be impacted. Some APIs are just not available using pure Java.

I don't know if migrating from JFFI to Javas Panama would be a viable option?

Unfortunately no, the JDK team tested this flag during Panama incubation and their plan was to extend it to regular JNI, which is happening since JDK 24 via the JEP 472.

The tracer can use JFFI at several places

• When using a unix domain socket, but the tracer use the JDK one from version 16, unless explicitly disabled dd.jdk.socket.enabled.
• In the past the pid could be fetched via POSIX calls on JDK8, but this has been replaced by Management beans (in 1.4.0).

Note using JFR and looking at the jdk.NativeLibraryLoad may provide more insight with its stacktrace.

I don't believe we have other JFFI usage in the tracer. However we may have JNA usages, depending on the product used.

Maybe @mcculls has a broader vision there.

I would also advise to reach out via support.