How to Selectively Load Java Agents in Cloud‑Native Microservices with Dragonwell and MSE

Background

With the large‑scale deployment of cloud‑native microservice applications, the demand for robust microservice governance has grown. Java Agent technology enables non‑intrusive behavior modification, allowing middleware to provide governance capabilities without altering business code.

Problem

When Java Agents are injected via the JAVA_TOOL_OPTIONS environment variable, they are loaded by all JVM processes in a container, including JDK tools such as java -version, jstack, and jps. This incurs unnecessary CPU and memory overhead and can hinder rapid troubleshooting.

Solution Overview

Dragonwell introduces custom environment variables ( DRAGONWELL_JAVA_OPTIONS and DRAGONWELL_JAVA_TOOL_OPTIONS_JDK_ONLY) that allow selective loading of Java Agents only for business Java processes, while keeping JDK tools agent‑free.

Implementation Steps

Deploy the MSE microservice demo on a Kubernetes cluster with ack-onepilot installed.

https://github.com/aliyun/alibabacloud-microservice-demo/tree/master/mse-simple-demo/helm/mse-simple-demo

Access the demo gateway to verify normal operation.

Observe that the Java Agent is injected into all JVMs by default (screenshots show java -version and jstack output with the agent).

Configure the following Dragonwell variables in the container’s environment: DRAGONWELL_JAVA_OPTIONS: custom options used only by Dragonwell. DRAGONWELL_JAVA_TOOL_OPTIONS_JDK_ONLY: when set to true, JAVA_TOOL_OPTIONS is applied only to the java command; JDK tools like jps and jstack ignore it.

Technical Details

Typical JDK environment variables: JAVA_TOOL_OPTIONS – loaded by all JDK commands. JDK_JAVA_OPTIONS – introduced after OpenJDK 9, used only by java command.

Vendor‑specific variables such as IBM_JAVA_OPTIONS, OPENJ9_JAVA_OPTIONS, and _JAVA_OPTIONS may also affect agent loading. By setting DRAGONWELL_JAVA_TOOL_OPTIONS_JDK_ONLY=true , only the business Java process loads the Java Agent, leaving diagnostic tools unaffected.

Result

After applying the Dragonwell modifications, the demo shows that JDK tools no longer load the Java Agent, while the business application does, confirming selective injection. This reduces overhead and prevents interference with troubleshooting scripts.

https://github.com/alibaba/dragonwell8/issues/330#issuecomment-1138083844