Wrap more options in UnlockExperimentalVMOptions

[zakkak]

Complementary to #35379

Closes #35788

[zakkak]

CI failures seem unrelated.

[jerboaa]

We should go through all -H options being added in any condition and evaluate whether we need to wrap them. 99% will need the wrapping with 23.1+. -H:AdditionalSecurityProviders seems like we need an upstream issue to evaluate if that one needs a stable API option instead.

[jerboaa]

This is an old option, which should be --enable-monitoring instead. I think since we have a minimal of 22.3 (which supports it), it would be fine to flip to that internally? Ideally, we'd deprecate the option too (if not already done).

[zakkak]

Note, however, that minimum is still 22.2, but we can probably bump it.

quarkus/core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/GraalVM.java

Line 136 in dc6ed7e

public static final Version MINIMUM = VERSION_22_2_0;

Ideally, we'd deprecate the option too (if not already done).

It's already deprecated.

[zakkak]

We should go through all -H options being added in any condition and evaluate whether we need to wrap them.

That's what I tried to do here :)

99% will need the wrapping with 23.1+. -H:AdditionalSecurityProviders seems like we need an upstream issue to evaluate if that one needs a stable API option instead.

Yes, if that's needed in production for some users we should.

[jerboaa]

We should go through all -H options being added in any condition and evaluate whether we need to wrap them.

That's what I tried to do here :)

OK, sorry. Here is what I see (without this patch). Are -H:+StackTrace, -H:+CollectImageBuildStatistics, and some others all stable? Some of those in application.properties worry me (long term) as -H:IncludeResources will go away.

core/deployment/src/main/java/io/quarkus/deployment/builditem/nativeimage/InlineBeforeAnalysisBuildItem.java:6: * If present, will force the addition of the {@code -H:+InlineBeforeAnalysis} flag during native image build
core/deployment/src/main/java/io/quarkus/deployment/builditem/nativeimage/NativeImageResourcePatternsBuildItem.java:22: * {@code -H:ResourceConfigurationFiles}, {@code -H:IncludeResources} and {@code -H:ExcludeResources} (since
core/deployment/src/main/java/io/quarkus/deployment/builditem/nativeimage/NativeImageSecurityProviderBuildItem.java:7: * '-H:AdditionalSecurityProviders' option
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:716:                    nativeImageArgs.add("-H:IncludeLocales=" + includeLocales);
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:745:                     * override it by passing -Dquarkus.native.additional-build-args=-H:+ParseOnce
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:747:                    nativeImageArgs.add("-H:-ParseOnce");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:754:                     * Affected users should explicitly pass {@code -H:-TrackNodeSourcePosition} through
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:759:                    nativeImageArgs.add("-H:+TrackNodeSourcePosition");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:761:                    nativeImageArgs.add("-H:+DebugCodeInfoUseSourceMappings");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:783:                    nativeImageArgs.add("-H:PrintAnalysisCallTreeType=CSV");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:791:                        nativeImageArgs.add("-H:+CollectImageBuildStatistics");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:792:                        nativeImageArgs.add("-H:ImageBuildStatisticsFile=" + nativeImageName + "-timing-stats.json");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:796:                            "-H:BuildOutputJSONFile=" + nativeImageName + "-build-output-stats.json");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:806:                addExperimentalVMOption(nativeImageArgs, "-H:+AllowFoldMethods");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:828:                    addExperimentalVMOption(nativeImageArgs, "-H:+ReportExceptionStackTraces");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:832:                    nativeImageArgs.add("-H:DebugInfoSourceSearchPath=" + APP_SOURCES);
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:859:                    nativeImageArgs.add("-H:+AddAllCharsets");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:861:                    nativeImageArgs.add("-H:-AddAllCharsets");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:867:                    nativeImageArgs.add("-H:-InlineBeforeAnalysis");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:870:                    nativeImageArgs.add("-H:NativeLinkerOption=" + pie);
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:874:                    nativeImageArgs.add("-H:-SpawnIsolates");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:890:                    nativeImageArgs.add("-H:+AllowVMInspection");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:901:                    addExperimentalVMOption(nativeImageArgs, "-H:+UseServiceLoaderFeature");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:903:                    nativeImageArgs.add("-H:+TraceServiceLoaderFeature");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:905:                    addExperimentalVMOption(nativeImageArgs, "-H:-UseServiceLoaderFeature");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:910:                        nativeImageArgs.add("-H:+StackTrace");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:912:                        nativeImageArgs.add("-H:-StackTrace");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:917:                    nativeImageArgs.add("-H:DashboardDump=" + outputTargetBuildItem.getBaseName() + "_dashboard.dump");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:918:                    nativeImageArgs.add("-H:+DashboardAll");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:925:                    nativeImageArgs.add("-H:AdditionalSecurityProviders=" + additionalSecurityProviders);
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:1019:                    nativeImageArgs.add("-H:+UnlockExperimentalVMOptions");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/NativeImageBuildStep.java:1023:                    nativeImageArgs.add("-H:-UnlockExperimentalVMOptions");
core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/ReportAnalyzer.java:96:     * Analyze the contents of the call tree report produced by Substrate when using -H:+PrintAnalysisCallTree,
core/deployment/src/main/java/io/quarkus/deployment/pkg/NativeConfig.java:54:     * If {@code -H:+InlineBeforeAnalysis} flag will be added to the native-image run
devtools/aesh/dependency-reduced-pom.xml:120:                <argument>-H:+ReportUnsupportedElementsAtRuntime</argument>
devtools/aesh/dependency-reduced-pom.xml:121:                <argument>-H:ReflectionConfigurationFiles=../reflectconfigs/quarkuscli.json</argument>
devtools/cli/src/main/resources/application.properties:6:-H:ReflectionConfigurationFiles=reflection-config.json
devtools/maven/src/main/java/io/quarkus/maven/AnalyseCallTreeMojo.java:15: * -H:+PrintAnalysisCallTree,
docs/src/main/asciidoc/native-reference.adoc:67:It is still possible to change the GC collection policy using GraalVM’s `-H:InitialCollectionPolicy` flag.
docs/src/main/asciidoc/native-reference.adoc:72:-Dquarkus.native.additional-build-args=-H:InitialCollectionPolicy=com.oracle.svm.core.genscavenge.CollectionPolicy\$BySpaceAndTime
docs/src/main/asciidoc/native-reference.adoc:79:quarkus.native.additional-build-args=-H:InitialCollectionPolicy=com.oracle.svm.core.genscavenge.CollectionPolicy$BySpaceAndTime
docs/src/main/asciidoc/native-reference.adoc:210:  -Dquarkus.native.additional-build-args=-O0,-H:-OmitInlinedMethodDebugLineInfo
docs/src/main/asciidoc/native-reference.adoc:258:A custom value (in number of bytes) can be passed via the `-H:AlignedHeapChunkSize` flag.
docs/src/main/asciidoc/native-reference.adoc:423:  -Dquarkus.native.additional-build-args=-H:-DeleteLocalSymbols,-H:+PreserveFramePointer
docs/src/main/asciidoc/native-reference.adoc:1229:Additional information on which classes are initialized and why can be obtained by passing in the `-H:+PrintClassInitialization` flag via `-Dquarkus.native.additional-build-args`.
docs/src/main/asciidoc/native-reference.adoc:1390:    -Dquarkus.native.additional-build-args=-H:-DeleteLocalSymbols
docs/src/main/asciidoc/native-reference.adoc:1505:    -Dquarkus.native.additional-build-args=-H:-DeleteLocalSymbols
docs/src/main/asciidoc/native-reference.adoc:1681:On top of that, add `-H:-OmitInlinedMethodDebugLineInfo` option to avoid inlined methods being omitted from the backtrace:
docs/src/main/asciidoc/native-reference.adoc:1687:    -Dquarkus.native.additional-build-args=-H:-OmitInlinedMethodDebugLineInfo
docs/src/main/asciidoc/native-reference.adoc:1995:To get a glance on what is being pulled in the image one can use `-H:+PrintUniverse` when building the native executable.
docs/src/main/asciidoc/native-reference.adoc:2047:All the methods require you to pass in the `-H:-DeleteLocalSymbols` option.
docs/src/main/asciidoc/native-reference.adoc:2053:An alternative method to generate flame graphs is to pass in `-H:+PreserveFramePointer` when generating the native executable instead of generating the DWARF debug information.
docs/src/main/asciidoc/native-reference.adoc:2061:    -Dquarkus.native.additional-build-args=-H:+PreserveFramePointer,-H:-DeleteLocalSymbols
docs/src/main/asciidoc/native-and-ssl.adoc:70:[INFO] [io.quarkus.creator.phase.nativeimage.NativeImagePhase] /opt/graalvm/bin/native-image -J-Dsun.nio.ch.maxUpdateArraySize=100 -J-Djava.util.logging.manager=org.jboss.logmanager.LogManager -J-Dio.netty.leakDetection.level=DISABLED -J-Dio.netty.allocator.maxOrder=3 -J-Dvertx.logger-delegate-factory-class-name=io.quarkus.vertx.core.runtime.VertxLogDelegateFactory -J-Dvertx.disableDnsResolver=true -J-Duser.language=en -J-Duser.country=IE -J-Dfile.encoding=UTF-8 --features=io.quarkus.runner.Feature,io.quarkus.runtime.graal.ResourcesFeature,io.quarkus.runtime.graal.DisableLoggingFeature -J--add-exports=java.security.jgss/sun.security.krb5=ALL-UNNAMED -J--add-opens=java.base/java.text=ALL-UNNAMED -J--add-opens=java.base/java.io=ALL-UNNAMED -J--add-opens=java.base/java.lang.invoke=ALL-UNNAMED -J--add-opens=java.base/java.util=ALL-UNNAMED -H:InitialCollectionPolicy=com.oracle.svm.core.genscavenge.CollectionPolicy\$BySpaceAndTime -H:+AllowFoldMethods -J-Djava.awt.headless=true -H:FallbackThreshold=0 --link-at-build-time -H:+ReportExceptionStackTraces -H:-AddAllCharsets -H:EnableURLProtocols=http,https -H:NativeLinkerOption=-no-pie -H:-UseServiceLoaderFeature -H:+StackTrace -J--add-exports=org.graalvm.sdk/org.graalvm.nativeimage.impl=ALL-UNNAMED -J--add-exports=org.graalvm.nativeimage.builder/com.oracle.svm.core.jdk=ALL-UNNAMED -J--add-exports=org.graalvm.nativeimage.builder/com.oracle.svm.core.configure=ALL-UNNAMED -J--add-exports=org.graalvm.nativeimage.builder/com.oracle.svm.core.jdk.proxy=ALL-UNNAMED -J--add-exports=org.graalvm.nativeimage.builder/com.oracle.svm.core.jdk.localization=ALL-UNNAMED rest-client-quickstart-1.0.0-SNAPSHOT-runner -jar rest-client-quickstart-1.0.0-SNAPSHOT-runner.jar
docs/src/main/asciidoc/native-and-ssl.adoc:77:-H:EnableURLProtocols=http,https
docs/src/main/asciidoc/native-and-ssl.adoc:178:[INFO] [io.quarkus.creator.phase.nativeimage.NativeImagePhase] /opt/graalvm/bin/native-image -J-Djava.util.logging.manager=org.jboss.logmanager.LogManager -J-Dcom.sun.xml.internal.bind.v2.bytecode.ClassTailor.noOptimize=true -H:InitialCollectionPolicy=com.oracle.svm.core.genscavenge.CollectionPolicy$BySpaceAndTime -jar rest-client-1.0.0-SNAPSHOT-runner.jar -J-Djava.util.concurrent.ForkJoinPool.common.parallelism=1 -H:+PrintAnalysisCallTree -H:EnableURLProtocols=http -H:-SpawnIsolates -H:+JNI --no-server -H:-UseServiceLoaderFeature -H:+StackTrace
docs/src/main/asciidoc/performance-measure.adoc:209:Quarkus disables this feature by setting `-H:FallbackThreshold=0`: this will ensure you get a compilation failure rather
docs/src/main/asciidoc/performance-measure.adoc:218:Disable via `-H:-SpawnIsolates`.
docs/src/main/asciidoc/performance-measure.adoc:225:We prefer listing services explicitly as it produces better optimised binaries. Disable it as well by setting `-H:-UseServiceLoaderFeature`.
docs/src/main/asciidoc/scripting.adoc:413:INFO: /Users/max/.sdkman/candidates/java/20.1.0.r11-grl/bin/native-image -J-Djava.util.logging.manager=org.jboss.logmanager.LogManager -J-Dsun.nio.ch.maxUpdateArraySize=100 -J-Dvertx.logger-delegate-factory-class-name=io.quarkus.vertx.core.runtime.VertxLogDelegateFactory -J-Dvertx.disableDnsResolver=true -J-Dio.netty.leakDetection.level=DISABLED -J-Dio.netty.allocator.maxOrder=1 -J-Duser.language=en -J-Dfile.encoding=UTF-8 --initialize-at-build-time= -H:InitialCollectionPolicy=com.oracle.svm.core.genscavenge.CollectionPolicy\$BySpaceAndTime -H:+JNI -jar quarkus-application-runner.jar -H:FallbackThreshold=0 -H:+ReportExceptionStackTraces -H:-AddAllCharsets -H:EnableURLProtocols=http --no-server -H:-UseServiceLoaderFeature -H:+StackTrace quarkus-application-runner
docs/src/main/asciidoc/writing-native-applications-tips.adoc:86:quarkus.native.additional-build-args =-H:ResourceConfigurationFiles=resources-config.json
docs/src/main/asciidoc/writing-native-applications-tips.adoc:99:    -H:ResourceConfigurationFiles=resources-config.json,\
docs/src/main/asciidoc/writing-native-applications-tips.adoc:100:    -H:ReflectionConfigurationFiles=reflection-config.json
docs/src/main/asciidoc/writing-native-applications-tips.adoc:117:            <quarkus.native.additional-build-args>-H:ResourceConfigurationFiles=resources-config.json</quarkus.native.additional-build-args>
docs/src/main/asciidoc/writing-native-applications-tips.adoc:255:quarkus.native.additional-build-args =-H:ReflectionConfigurationFiles=reflection-config.json
docs/src/main/asciidoc/writing-native-applications-tips.adoc:268:    -H:ResourceConfigurationFiles=resources-config.json,\
docs/src/main/asciidoc/writing-native-applications-tips.adoc:269:    -H:ReflectionConfigurationFiles=reflection-config.json
docs/src/main/asciidoc/writing-native-applications-tips.adoc:286:            <quarkus.native.additional-build-args>-H:ReflectionConfigurationFiles=reflection-config.json</quarkus.native.additional-build-args>
docs/src/main/asciidoc/writing-native-applications-tips.adoc:359:com.oracle.svm.core.jdk.UnsupportedFeatureError: Proxy class defined by interfaces [interface org.apache.http.conn.HttpClientConnectionManager, interface org.apache.http.pool.ConnPoolControl, interface com.amazonaws.http.conn.Wrapped] not found. Generating proxy classes at runtime is not supported. Proxy classes need to be defined at image build time by specifying the list of interfaces that they implement. To define proxy classes use -H:DynamicProxyConfigurationFiles=<comma-separated-config-files> and -H:DynamicProxyConfigurationResources=<comma-separated-config-resources> options.
docs/src/main/asciidoc/writing-native-applications-tips.adoc:362:Solving this issue requires adding the `-H:DynamicProxyConfigurationResources=<comma-separated-config-resources>` option and to provide a dynamic proxy configuration file.
docs/src/main/asciidoc/writing-native-applications-tips.adoc:681:Using such a construct means that a `-H:DynamicProxyConfigurationResources` option will automatically be added to the `native-image` command line.
extensions/hibernate-orm/runtime/src/main/java/io/quarkus/hibernate/orm/runtime/service/FlatClassLoaderService.java:47:                    "Loading of resource '%s' failed. Maybe that's ok, maybe you forgot to include this resource in the binary image? -H:IncludeResources=",
extensions/hibernate-orm/runtime/src/main/java/io/quarkus/hibernate/orm/runtime/service/FlatClassLoaderService.java:60:                    "Loading of resource '%s' failed. Maybe that's ok, maybe you forgot to include this resource in the binary image? -H:IncludeResources=",
integration-tests/awt/src/test/resources/application.properties:8:#quarkus.native.additional-build-args=-O0,-H:+PreserveFramePointer,-H:-DeleteLocalSymbols,-H:+TrackNodeSourcePosition
integration-tests/bouncycastle-fips-jsse/src/main/resources/application.properties:13:quarkus.native.additional-build-args=-H:IncludeResources=.*\\.jks
integration-tests/bouncycastle-jsse/src/main/resources/application.properties:11:quarkus.native.additional-build-args=-H:IncludeResources=.*\\.jks
integration-tests/bouncycastle/src/main/resources/application.properties:2:quarkus.native.additional-build-args=-H:IncludeResources=.*\\.pem
integration-tests/main/src/main/resources/application.properties:57:quarkus.native.additional-build-args =-H:ReflectionConfigurationFiles=reflection-config.json
integration-tests/oidc-tenancy/src/main/resources/application.properties:131:quarkus.native.additional-build-args=-H:IncludeResources=.*\\.pem
integration-tests/oidc-wiremock/src/main/resources/application.properties:179:quarkus.native.additional-build-args=-H:IncludeResources=private.*\\.*
integration-tests/oidc/src/main/resources/application.properties:12:quarkus.native.additional-build-args=-H:IncludeResources=.*\\.jks
integration-tests/smallrye-jwt-token-propagation/src/main/resources/application.properties:15:quarkus.native.additional-build-args=-H:IncludeResources=publicKey.pem
integration-tests/vertx-http/src/main/resources/application.properties:21:quarkus.native.additional-build-args=-H:IncludeResources=.*\\.jks,-H:EnableURLProtocols=http\\,https

99% will need the wrapping with 23.1+. -H:AdditionalSecurityProviders seems like we need an upstream issue to evaluate if that one needs a stable API option instead.

Yes, if that's needed in production for some users we should.

I think it's referenced in some guides as well, so we should open a discussion. That was their ask at the last community meeting.

[zakkak]

-H:+StackTrace

That option has no effect in >= 23.1, and Quarkus won't pass it to native-image.

-H:+CollectImageBuildStatistics

Similarly here, this was used to retrieve build time information in 22.3. Starting with 23.0 this info is included in the build output json file so there is no need to generate extra files.

The rest, appear to be referenced by documentation. Not sure if it's a good idea to spam -H:+UnlockExperimentalVMOptions in there. Perhaps a mention would be worth though, but I think we will only be able to do so once 23.1 is out and Quarkus starts using it as the default.

[zakkak]

Regarding -H:AdditionalSecurityProviders it looks like it's actually being used/triggered by quarkus extensions (e.g. io.quarkus.elytron.security.jdbc). I will create an upstream issue mentioning this and see where it leads.

Update: upstream issue oracle/graal#7369

[jerboaa]

OK.

[jerboaa]

Regarding -H:AdditionalSecurityProviders it looks like it's actually being used/triggered by quarkus extensions (e.g. io.quarkus.elytron.security.jdbc). I will create an upstream issue mentioning this and see where it leads.

Update: upstream issue oracle/graal#7369

Thank you!

[quarkus-bot]

✔️ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.