How Bloomberg uses Eclipse Temurin to power our enterprise Java software

In this talk, Dan, a software engineer at Bloomberg and leader of the company's Java and JVM Guild, discusses how Bloomberg utilizes Eclipse Temurin to enhance its enterprise Java software. He explains that Bloomberg, a prominent player in the financial services industry, has relied on Java extensively due to its robust back-end infrastructure and commitment to reliability. Temurin, an open-source build of the JDK, meets Bloomberg's need for a certified, standard build without extra features, supporting various operating systems. Dan highlights Temurin's compliance and security initiatives, including its production of software bill of materials (S-bombs) and reproducible builds, which increase confidence in the software's integrity. He emphasizes the importance of timely JDK releases and the open-source advantages that Temurin offers, particularly the absence of vendor lock-in. Additionally, he advocates for the use of Java Flight Recorder and JDK Mission Control as valuable tools for performance analysis within the Bloomberg ecosystem, demonstrating the countless ways they utilize modern Java technology.

[music] >> Okay, thank you very much for coming. I'm Dan. I'm a software engineer at Bloomberg and a leader of Bloomberg's Java and JVM Guild. And I'm here today to tell you how Bloomberg uses Eclipse Temurin to power our enterprise Java software. So, what is Bloomberg? If you don't know, Bloomberg is a software company uh serving the financial services industry. We are No. Over 40 years old.

And we are our main mission is to keep our products reliable for our clients as well as deliver new and exciting products to our clients. So, Bloomberg is known for the Bloomberg Terminal. The Bloomberg Terminal is uh this thing you see here. It's a GUI interface application, but we also have programmatic interfaces with which our clients can often interact. So, what we provide via the terminal and

other interfaces are data, analytics, trading platforms and systems, and news. for a company like Bloomberg that's been in business for 40 years and is super interested in reliability, uh we choose Java to power a bunch of our stack. So, we have around a thousand of our engineers that use Java in some way, shape, or form during their jobs. We use a lot of Java on the back

end for distributed systems infrastructure. And we also do a lot of Android development as well. So, deployments of uh open source solutions in our data centers include Kafka, Cassandra, Solar, Apache Zookeeper, and Hadoop. So, we use a lot of Apache projects. We also use a lot of other projects which are in Java. So, it's very important that for us running a lot of Java in our data

centers, wanting to keep our products incredibly reliable for our clients, that we have a reliable JVM. Additionally, we have uh had this culture shift over the last two decades which is the last the latter half of our our corporate life. And that culture shift has been to to move toward open source first. This means that we want to use open source wherever it's appropriate. And we want

to use existing open source solutions and eventually customize them to our needs. And in addition to using open source where it's appropriate for our business, we'd like to contribute back features and fixes to the community where we can. We also publish a bunch of our own open source. We can find it in github.com/bloomberg, but we also have contributors to many projects including things like solar and Cassandra.

when it comes to the JDK, we needed to standardize a JDK within the company. Of course, you've seen we've been open source first for a while and therefore there was a strong preference for open source. We also needed a certified standard build of the JDK. Right. So this means the for people that Oracle publishes a thing called the TCK, the test certification kit. And that TCK is

a battery of tests that runs against the JDK to make sure that the build is correct and it does all the things that a good JDK should do. And at Bloomberg we needed a JDK that was certified. And we just we also wanted a standard build. We didn't want any additional bells and whistles which some of the other JDK publishers provide. In 2018 Eclipse Temurin, then known

as AdoptOpenJDK, came to the rescue. So if you don't know about Temurin, this is a product of the Eclipse Foundation. I'm grateful to occasionally contribute to Temurin projects as well. Temurin is an open source build of the JDK. It's great. They've got all the regular builds every every quarter when there's updates updates released to the OpenJDK source code, Temurin builds them. And what's great for us is

they build them for a broad OS and architecture range. So, you know, whether you need it on your MacBook or you need it on your Linux server in the cloud or your Windows laptop, Temurin's got the build for every LTS and also the latest. It's also awesome because it's a standard build of the Open JDK with no add-ons. If all you want is the Open JDK, Temurin's

for you. It is TCK certified. So, as I mentioned, Oracle produces this um suite of tests that's not available to the general public. Great news is Eclipse Foundation has them. Eclipse Foundation runs them against our builds. So, we know that the Temurin JDK is in fact TCK certified. Additionally, the Eclipse Foundation has produced a thing called Aquavit, which is a further battery of tests that they run

against their Temurin JDKs, and this increases our confidence that the JDK is of high quality and it's great. this is why we love Temurin. It's got all the OSs and architectures we need, and it's got the TCK certification. It's plain Open JDK, nothing special. And very importantly for our open source guidance corporate-wise, it's an OSI approved license. And if you don't know about OSI approved licenses, this

OSI is the Open Source Initiative, and they have a list of licenses that are good open source licenses, meaning that they don't have any special clauses that might get you in trouble if you start using that software. So, we we love OSI approved licenses. So, a thing I'd love to talk to you about as well, I don't know if you've noticed there's a whole compliance track over

there. It's some amazing talks at this conference have been given in the compliance track. Compliance is a big big thing. For people that read the news, compliance in finance is a really big Um and Temurin is a great start because if you don't have a strong secure JDK, then all your Java apps aren't running in a strong secure foundation. So, we love a strong secure JDK. Um

Temurin has a big commitment to compliance and security. Uh they have been producing S-bombs since forever. They're one of the first people that produced S-bombs, software bill of materials, for a JDK. And even this week, we've had discussions about how to make that S-bomb even better with people like uh like Andrew back there. And Shelly who's unfortunately on her way back to Canada. So, uh the S-bombs

are great and the other thing that's super cutting edge is reproducible builds, which again Andrew I'm sure happy to talk to you about. Uh so, reproducible builds for the JDK in the Temurin case mean that they're working on on some software where you pass in that S-bomb, which says where they downloaded from GitHub, the OpenJDK binaries, all the other tooling they use, and with that tooling, you

can rebuild the JDK on your laptop, on your server, wherever you like, and it will be bit-for-bit identical to the one you download from the Temurin website. So, that's super awesome for verifiability because you've got all the source code, you can read all the source code, and if the binary that comes out at the end is exactly what you downloaded, then you can have confidence that what

you downloaded has nothing in there that shouldn't be in there. And the other very important thing for a entity like ours is that it's very important that we have timely releases of the JDK. And Temurin delivers quarter after quarter. Every quarter there's updates released to the JDK with important security updates, important feature releases. And very shortly after those are released, Temurin releases, and it releases for all

the platforms and all the LTSs from 8 up to 25 as well as And at Bloomberg, we use everything from 8 up to 25 and the latest across many platforms, including developer laptops in the in the cloud, on Kubernetes. So, we're really grateful that Temurin releases all that stuff. And the open source advantage, right? So, uh it's backed by the Eclipse Foundation. There's some really strong companies

that participate to Temurin, but none not one of them is kind of the the owner, right? The Eclipse Foundation is the owner. So, if companies come and go, we can have reasonable confidence that Temurin will keep being there and keep being awesome for us to use. And there's no vendor lock-in, which is super important. Additionally, as I mentioned, it's got an OSI license. So, the license being

super standard and OSI approved, there's nothing for us to worry about in terms of license terms and conditions, and we don't have to worry because it's the Eclipse Foundation governance is awesome about that license being shifted out from under our feet. So, as I mentioned, we use it everywhere. We use it in data centers, we use it on Kubernetes, VMs, bare metal, build packs. We use it

on laptops, Linux, Windows, Apple. So, we use all the flavors of Temurin We focus on LTS releases, right? If uh we have a team and they're choosing to write things in Java and they're choosing a Java version, we strongly encourage them to pick an LTS and to try to be on the latest LTS as often as possible. And if not, to not be too far behind. However,

we also have teams that want to be on the cutting edge and try the brand new features as soon as they come out, and for that we internally also support the latest version. So, we package all of these and make them available to our teams. So, since 2018, the only new JDK builds allowed at Bloomberg were OpenJDK, and with very very few exceptions, which are all gone

now, all of them were Temurin. So, since 2018, we have been super super loyal Temurin users. At first, teams were encouraged to upgrade. Afterwards, they were required Um and the way we did that is that we ensured that older binaries were no longer available in any production environment because if you can't use the binaries for older or other JDKs, you must use what's available. and we also

made telemetry and dashboards that enabled us to track which of our systems use a JDK and what versions are prevalent. And that helps us chase people so that they're soon not going to be any people on eight. They're all going to be on 11 and above and then 17 and above. And that's how we keep people upgrading and keep them on the latest and greatest. So, in

addition to Tamarind, we use a lot of other tooling and I think this is if you're not familiar with this this is the tooling that makes Java and the JF JVM ecosystem great. JFR. I cannot say how much I love JFR. It's so awesome. So, if you're running systems in production and you want to know what's going on, where are they allocating memory? Where are they using

CPU? What are the methods that are using the most time? Run JFR. It's great. It's a built-in profiler. It's been part of the OpenJDK since Java 17. So, if you're on any modern LTS, it's there. And it has has very low overhead. So, like 1 or 2% so, I really recommend if you're trying to find your bottleneck or trying to understand where time or memory is being

used in your program in production, run JFR. Get a profile and then instead of optimizing by guessing where you could optimize, JFR will let you optimize exactly where the problem is. Uh and the other thing that goes hand in hand with JFR is the JDK Mission Control. So, this enables us to analyze the JFR recordings. It's a very pretty application that you can click around and click

at the methods that are using the most CPU or the most memory. when you use JFR, JDK Mission Control is a great way to analyze those recordings. There There also some other ways some IDEs have some proprietary built-in methods as well. And also the Eclipse Memory Analysis Tool that helps us understand heap dumps. Ideally, we don't want heap dumps, but when we get them or if we

have to take them, the Eclipse MAT is a great way to actually make sense of them. So, the JDK builds, the Temurin project also builds and supports this tooling. And we're very grateful for that as So, around Bloomberg, we also use a ton of Jakarta EE stuff as does anyone that mainstream Java libraries. A bunch of stuff has moved from Java X to Jakarta EE. So, we're

really grateful to the Eclipse Foundation for supporting that work. And RDF4J, we do a bunch of work with RDF4J to support semantic technologies and graph use cases. again, thank you very much. In conclusion, we think Adoptium and Temurin is a great solution for our enterprise Java needs. If you've got data centers and you need a JDK, we think it's great. We use it. You should use it

as well. And we're continuing this work and ensuring that there's a timely release of the LTSs and the latest JDK that we can use in production. Thank you very much. >> [music]