Compiling Java into native binaries with Graal and Mill
mill-build.org
mill-build.org
Imagine spending 15+ minutes building an exe, and it stopping at minute 15 because some things needed to be added in the config. Or, after waiting 30 minutes to have the exe ready, it refused to run because of the same problem.
The issue is we don't know what we don't know. You don't "forget to include something" because you don't know what to include (and even after seeing the error, you still don't lol).
I just wished all 3rd party libraries put their "include this config to include my lib in your exe", just like OSGi manifest (https://www.ibm.com/docs/en/wasdtfe?topic=overview-osgi-bund...).
For example, an issue still open for almost 2 years: https://github.com/firebase/firebase-admin-java/issues/800
So many languages, tools and libraries to chose from, without the "simple minds" culture, even C manages to be more feature rich.
A pure Java hello world now compiles in a few seconds on a commodity machine and weighs in at about 9mb.
Also, make sure you enable `-Ob` on newer versions of GraalVM, which significantly speeds up build times.
Do you use any cli library in front? Is 12-20mb acceptable for a cli executable?
Working on a cli tool poc for work here, hence the interest.
Cosmo/APE support would fix this, and GraalVM already ships with a Musl libc implementation, so it isn't very far off.
I think you can shrink the size with one of the optimisation levels https://www.graalvm.org/latest/reference-manual/native-image...
But it’s dynamic by implementation only; to alleviate what came before which was a tedious manual enumeration in xml of those same discoveries.
Presumably we could ask springboot’s discovery to output exactly those finding and the remove the introspection.
https://en.wikipedia.org/wiki/Excelsior_JET
Also ART takes the best of both worlds, as they quickly learned the best is to have JIT/AOT compiler collaborating, thus AOT gets all the reflection related info from the JIT, or Play Store Baseline Profiles and has all it needs to produce a proper AOT binary with the relevant execution flows.
To note that Java and .NET to some extent are catching up to Eiffel, Oberon, Smalltalk and Common Lisp toolchains, of a mix JIT/AOT, while inovating on their own ways as well.
But you do need to start/run your app once to get the agent to do its stuff.
https://www.graalvm.org/latest/reference-manual/native-image...
(it is part of the graalvm so use that as your jvm to do this)
Competing looks like starting with what other people are already doing and making it better.
It even has a compat layer, and like Quarkus it supports GraalVM out of the box, with minimal reflection at runtime.
https://micronaut-projects.github.io/micronaut-spring/5.9.0/...
Much of this configuration could be automatic if more attention were given to GraalVM by library authors.
To me this is a huge downside. One of the reasons I like Go so much is that I can build binaries for any platform I want to support on my Mac or with Docker.
C# with NativeAOT might be an easier path for Java developers. Some might like the expressiveness as well over Go.
Indeed!
Both ecosystems complement themselves, some stuff Java ecosystem does much better than .NET, like multiple implementations, with various kinds of GC and JIT implementations, wider support of hardware deployments, tooling like Graal, industry standards, IDE implementations, a mobile OS,...
Other things the .NET ecosystem does better, support for value types, low level programming, SIMD, desktop development, game engines.
To this day they keep copying features from each other, and if either C# or Java isn't one's taste, there are still several other options on each platform.
Hence why I am confortably at home using them both, complemented by JS/TS for FE, and C++ for fiddling with their runtimes, or plugging into native libraries.
More recently, default interface methods, apparently the ongoing discriminate union design seems to now be settling on similar Scala/Java approach, I still have to spend some time delving into it.
Not delving now on the CLR, versus the various JVM implementations, regarding GC, JIT, PGO, tiered compilation, escape analysis,...
wasting gigabytes of ram and fast startup times
>and identify the optimizations on the fly
and still get gapped by statically compiled languages.
I guess these are a cheap price to pay for the benefit of ... having to install and patch runtimes.
Which statically complicated languages are you referring to? :)
--
You are thinking of AOT compiled, but does that AOT language support arbitrary class loading to expand functionality, live observability while taking almost zero overhead for that?
--
So what do you do if a statically linked library of yours has a vulnerability?
Peak-peak performance is not as good as JVM in many cases, but how long does your process actually spend within that space? Native Image can be optimal for many cases
> this is a huge downside.
The compiler can only do static analysis and code generation. I'd much rather a hotspot VM analyze the running code and identify the optimizations on the fly.
So I believe we're in agreement, that AOT imposes does limited optimizations compared to HotSpot JIT
The history of native compilation for java I find fascinating: Nothing looks like a normal, boring programming language as much as java, yet somehow it resists being treated as a normal, boring programming language, and needs its own galaxy of special idioms and tools, like it was some smalltalk or lisp.
There's actually, imho, no need for native compilation for java tbh. Why isn't shipping the runtime with the code a more common practise? it's how intellij or eclipse worked. People today ship electron apps for god sakes!
If you _need_ native, for one reason or another and it's non-negotiable, then choose a native compiled language.
> Why isn't shipping the runtime with the code a more common practise?
Well, Java has jlink which is meant to do exactly that (ship the parts of the JVM you actually need, which is easy to figure out as there are tools to do that), and that's the recommended approach today for shipping anything Java.
That's what I actually do for our product. The JRE is shipped with it as well as startup scripts and services registration bridge for Windows.
I guess the native compile thing is more for "Java on the Cloud" which tbh is not where Java shines. I say this as a long-term Java developer. Java is great for monoliths - on premises customers are supper happy. Java on the cloud seems like a waste of resources to me.
Compile to native makes sense only for very fast startup cases.
As for wasted resources - there are cases where the servers have to be deployed in specific jurisdictions (compliance) - it's easier to use AWS than manage tons of small sites. Still I don't see any need for native compilation.
It also makes sense to reduce container size and vulnerability surface, and to reduce warmup time to peak JIT performance.
> Still I don't see any need for native compilation.
Sure, there isn't a "need," per se, just like there is not a "need" for JIT. This is how technology evolves. Things get better. Java's startup and time-to-peak performance are now comparable to native langs.
This actually works in the opposite way - JIT is a guided compilation which uses the input for best results. There are many optimizations done for multi call sites, e.g. static linking + guard, dual site inline, inline caches, and the v-table calls if all fails. Without guided optimization such decisions are not likely to happen.
In other words for peak runtime performance JIT would surpass ahead of time/native compilation.
>reduce container size
I would be exceptionally hard pressed to find a single case where that would matter (aside specific client deployments) - server side and the like I'd not care about extra 100MB or so deployable. E.g. if I want really small footprint I'd go and do it all in pure C w/ an absolute min external library support.
>startup times
I already mentioned it - and anything not sub 0.5sec, Java does quite ok. There is a lot to be said about the use of DI frameworks with blatant class path scans, but that's not necessarily Java's fault.
I used to support Atlassian's products on the intranet before we migrated (almost) everything on their cloud: Jira, Bitbucket, Bamboo, Confluence. I think Jira and Bitbucket were hands down the slowest of the bunch to boot and from what I could tell it was exactly due to classpath-scanning and god knows what else. I could never believe a 16 CPU 32 GB KVM needs from 3 to sometimes 5 minutes just to boot Jira. To me this was insane.
However, for "simple" code (like arithmetic, or manipulation of bits, arrays etc), i think it's pretty much the same.
It really shouldn't be. It bloats everything. Containers are bigger. Software is bigger. There's no reason to do this, since very few apps use the entire surface area of a runtime (Python, Node, Java, etc).
Instead, a native GraalVM binary can embed all these things, including only the portions which the application needs to run. Thus it behaves like a dynamic piece of software during development, but a static, high-performance, low-surface-area-of-vulnerability native binary in production.
> That's what I actually do for our product. The JRE is shipped with it as well as startup scripts
Please, as a user, I implore you to look into native targets. It's not as hard as it seems anymore. Some thins really do need Jlink.
> I guess the native compile thing is more for "Java on the Cloud"
Not so. GraalVM is great for embedded development. It's great for desktop development or even shared native library development.
> Java on the cloud seems like a waste of resources to me.
There is no difference now between C++ "in the cloud" and Java "in the cloud" except Java remains memory safe by default.
You are not my target. It's enterprise software - I'm given a Windows Server VM and the rights to install our software, that's it. Most IT admins don't even want to bother to install or let alone support JRE updates. We got tons of customers and this experience is uniform.
> It's great for desktop development
For desktop I'd totally use Jlink. Really the only possible place GraalVM's NI seems like a plausible fit to me is CLI tools and Java Microservices, where fast start and low memory consumption actually make sense. edit: But honestly at this point for Microservices I'd probably go with Go.
It wasn't retroffied, rather only available behind a paywall, that is what kept companies like Excelsior JET in business.
OpenJ9 from IBM traces its roots back to Java AOT compilation to embedded development, used to be called WebSphere Real Time.
PTC and Aicas are two companies specialized in real time JVM implementations for embedded development, with military and factory automation as main customer targets, also supporting AOT compilation for decades.
Sure, that is true, but with native compilation available, Java can do even more things. There are other reasons, too: startup time, quicker time to peak performance, and better interfacing with FFM and JNI, to name a few.
> If you _need_ native, for one reason or another and it's non-negotiable, then choose a native compiled language.
You could do that, sure. But then you would need to worry about all the things that come with that. For example, memory safety -- GraalVM preserves memory safety guarantees with native binaries. Even binaries which themselves ship JIT features.
I'd say it is a pretty common thing. I can't tell you why it isn't the norm nowadays but it used to be that Sun and Oracle prohibited modifications to the JRE in their license. So you had ship the whole bloated thing or nothing to be compliant, even if it was technically not too hard to strip the JRE down to only the things your app needed.
Was it actually any good? My only experience with it was Debian using it as default Java interpreter, which meant that any attempt to execute Java without first removing it resulted in untold amounts of suffering.
But to contradict myself, I actually use windows, WSL and oracle cloud to build for windows x86, linux x86 and linux ARM64 to build a java desktop application. Of course I'd prefer it if I could just use my main machine and OS to build all those like Go can.
(It really does loadClass everything reachable based on the code to be compiled)
Anyone know if this true?
https://blogs.oracle.com/java/post/graalvm-free-license
So, yes, GraalVM CE is slightly nerfed (the performance difference across all EE features is like 30% maximum, at peak, in limited circumstances). You also do not need to use GraalVM CE in as many places anymore, and Oracle GraalVM with G1 is a free download. Many free projects like Pkl use the full-blown VM.
https://www.graalvm.org/latest/reference-manual/native-image...
Serial GC is still very performant. It's great for things like command line tools which don't need a low-pause long-running GC like G1.
dotnet publish /p:PublishAot=true
Portability is by definition not possible with natively compiled binaries however. It is a choice - either produce an assembly (still single-file, .NET can do this unlike JVM offerings) that is completely portable, or produce a self-contained executable targeted at a particular OS and ISA.
Sure, but not cross-platform, which the previous comment seemed to indicate that GraalVM could, which it cannot. Both tools need to compile on the platform they target, compared to Go/Rust where you can target other platforms even though you're not compiling on them.
As for GraalVM, it has plenty of modes, the AOT one that is being talked about here, is native image.
Which can also use a JAR file as input, so even though it doesn't yet support cross-compilation, you can use the JAR file as single source, and then have a couple of build environments in e.g. Github pipelines.
https://blogs.oracle.com/developers/post/building-cross-plat...
Does it take a couple of more steps? Yes it does.
To the end user it doesn't matter as long as they get their shinny executable available, and it only has to be done once as a project template.
Also note that cross-compiling only really works without issues for whatever compiled language, if the toolchains have access to every single library from the target system on the host environment, and no dependencies FFI into other languages.
You are also confusing what it means to produce a portable assembly with the ability to target across operating systems or CPU architectures.
(also, most native toolchains do not let you easily cross-compile, Go makes significant sacrifices to make it possible, as long as you have no dependencies which rely on C/C++, and there are many of those)
Also it isn't that easy if any of GUI frameworks from Microsoft are being used.
Ah, and if using WinUI, one even has the additional requirement that only UI elements implemented with partial classes can be AOT compiled due to WinUI magic code.
There needs to be more context here. I think the BCL is fully annotated already. Many of MS libraries are too including gRPC.
Your gRPC example is also quite interesting, I am yet to use it in anger, and never seen it being used at any of our .NET customers.
Meanwhile as mentioned, GUI frameworks aren't supported, WinUI requires partial classes and only kind of works, ASP.NET only if using minimal APIs, EF partially, and so on.
So it isn't really telling the whole story that "dotnet publish /p:PublishAot=true" works regardless of the .NET codebase being compiled.
I do agree Avalonia and Uno are great projects.