Replacing Java’s SecurityManager with an agent using Byte Buddy
Java’s SecurityManager was an essential component of the Java security model. It allowed developers to enforce security rules by implementing check*() methods, such as checkExec(String cmd) for executing a command on the host machine or checkRead(String file) for reading a file. For more details, see the JavaDoc. It was deprecated in Java 17 (JEP 411) and removed in Java 24 (JEP 486). Within Kestra, the universal orchestration platform, we used it to: Restrict access to the host machine’s file system…