Ask questionsFat jars cause classloading problems with JDK11 and Security Manager

We have faced some classloading problems after migrating to Spring Boot 2.1.6 and Spring Framework 5.1.8. The WAR we build is built under JDK8 but the runtime environment is JDK11. We are trying to deploy our application, but then we get ClassNotFoundException and the Spring context fails to initialize.

We have double checked WAR file. The "missing" class is there.

Now, the really interesting part: we are able to reproduce this one only with Security Manager. It seems like it's not a problem with our own custom security policy, as we have also tried granting access to everything. The problem persists even in this, rather extreme, case.

Therefore, to run our application we have only two options:

  1. Run it under JDK8
  2. Run it under JDK11, but without the Security Manager

Another description of (apparently) the same problem:


Answer questions piotrlitwin

I have generated a simple app with When running WAR file with Security Manager I get:

2019-08-08 14:00:26.573  WARN 13016 --- [           main] ConfigServletWebServerApplicationContext : Exception encountered during
context initialization - cancelling refresh attempt: org.springframework.context.ApplicationContextException: Unable to start web
server; nested exception is java.lang.NoClassDefFoundError: org/apache/catalina/Lifecycle$SingleUse
Exception in thread "main" java.lang.reflect.InvocationTargetException
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(
        at java.base/java.lang.reflect.Method.invoke(
        at org.springframework.boot.loader.Launcher.launch(
        at org.springframework.boot.loader.Launcher.launch(
        at org.springframework.boot.loader.WarLauncher.main(
Caused by: java.lang.NoClassDefFoundError: ch/qos/logback/classic/spi/ThrowableProxy
        at ch.qos.logback.classic.spi.LoggingEvent.<init>(
        at ch.qos.logback.classic.Logger.buildLoggingEventAndAppend(
        at ch.qos.logback.classic.Logger.filterAndLog_0_Or3Plus(
        at ch.qos.logback.classic.Logger.log(
        at org.apache.commons.logging.LogAdapter$Slf4jLocationAwareLog.error(
        at org.springframework.boot.SpringApplication.reportFailure(
        at org.springframework.boot.SpringApplication.handleRunFailure(
        at com.example.demo.DemoApplication.main(
        ... 8 more

It is not actually ClassNotFoundException, which happens in conjunction with another framework we use in our project. This NoClassDefFoundError I get from empty Spring Boot application seems to be the root cause of our problems.


Related questions

Dependency resolution fails with Gradle 5.3.x to 5.6.x hot 4
get error messag Could not fetch the SequenceInformation from the database, hibernate_sequence doesn't exist hot 2
[spring-boot 2.3.0] ResponseStatusException reason is ignored - spring-boot hot 2
Controller annotated with @Timed and active TimedAspect clashes with WebMvcMetricsFilter hot 2
Source file must be provided failure when running spring-boot:repackage from the command-line hot 2
Actuator: NPE in LongTaskTimingHandlerInterceptor hot 2
ConfigurationProperties with constructor binding cannot be mocked hot 2
NoClassDefFoundError: net/bytebuddy/NamingStrategy$SuffixingRandom$BaseNameResolver hot 2
No bean named &#39;entityManagerFactory&#39; available hot 2
Bug in org.springframework.boot on 2.2.3.RELEASE version hot 2
"factory already defined" error with spring-boot-maven-plugin in maven multi-module application hot 2
Deadlock between BackgroundPreinitializer and main thread in Spring Cloud Config Server hot 2
spring boot Servlet.service() for servlet [dispatcherServlet] in context with path threw exception hot 2
Migrating OAuth2 from Spring Boot 1.5 to 2.0 Broken hot 2
Add AutoConfiguration support for spring-security-saml2-service-provider hot 2
Github User Rank List