graalvm.org

GraalVM Native Image compiles a Java application ahead of time into a native executable that contains only the classes, methods, and fields the application actually needs. That single design decision drives both benefits: a smaller attack surface because unused code is absent, and simpler deployment because the result is a compact, self-contained binary that fits minimal container images. The trade-off is that you must build the executable for each target platform and verify that your framework and libraries support native compilation.

Security: less code means less to exploit

A traditional JVM loads application code plus the JDK and framework classes it references, and much of that code is reachable at runtime through reflection, dynamic loading, or unused library paths. Native Image performs static analysis at build time and includes only what it can prove is reachable.

• Reduced attack surface area. GraalVM states that native executables contain only the classes, methods, and fields your application needs, which reduces the attack surface area. Code that is not in the binary cannot be invoked by an attacker.
• Fewer moving parts at runtime. The executable does not carry a full JVM with its management and diagnostic surface; it runs as a standalone process.
• Predictable contents. Because the binary is fixed at build time, what you test is what you ship — there is no classpath assembled at startup from jars that may differ between environments.

A practical example: a service that pulls in a large library for one utility method will, under Native Image, typically ship only the reachable path to that method rather than the whole library. Fewer reachable entry points mean fewer places to probe.

The caveat: reflection, dynamic proxies, and resource loading are resolved at build time. If your application relies on them, you must supply the necessary configuration (often generated by a tracing agent during a test run) or those paths will fail at runtime. Security gains come from correct build-time analysis, so test the native binary, not just the JVM build.

Deployment: compact binaries and flexible linking

GraalVM describes native executables as small, with a range of linking options that make them easy to deploy in minimal container images. In practice this means you can build a container from a minimal base, copy in the executable, and run it — no JDK layer to maintain or patch separately. Instant startup also matters for scale-to-zero and autoscaling, where cold starts are visible to users.

What to check before committing

1. Framework support. GraalVM lists first-class support from Spring Boot, Micronaut, Helidon, and Quarkus. Confirm your specific version is covered.
2. Cloud integration. SDKs from AWS, Microsoft Azure, GCP, and Oracle Cloud Infrastructure integrate with and support GraalVM, per the site.
3. Reflection and resources. Identify libraries that use reflection or load resources dynamically and add the required configuration.
4. Build per platform. Native executables are platform-specific; plan a build step for each target OS and architecture.
5. Verify behavior. Run your test suite against the native executable, not only the JVM build, to catch build-time analysis gaps.

Who benefits most

Native Image is a strong fit when startup latency, memory cost, or container size dominate — serverless functions, autoscaled microservices, and CLI tools. It is a weaker fit when your stack depends heavily on dynamic classloading that cannot be configured, or when you need the JVM's runtime profiling and diagnostic tooling in production. The current release referenced on the site is GraalVM 25.4, which adds compiler optimizations, smaller Native Image binaries, and advanced Truffle and WebAssembly capabilities.

To get started with GraalVM, go to graalvm.org and use the two entry points on the homepage: Download and Get Started. The site currently highlights GraalVM 25.4, which it describes as bringing new compiler optimizations, smaller Native Image binaries, and advanced Truffle and WebAssembly capabilities. The homepage does not publish install commands, archive names, or a step-by-step setup guide, so treat the download page and Get Started page as the authoritative next stops rather than relying on secondhand instructions.

What GraalVM Is, in One Paragraph

GraalVM is described on its site as an advanced JDK with ahead-of-time Native Image compilation. You can use it as a JDK for developing, building, testing, debugging, and packaging Java applications, and you can additionally compile an application ahead of time into a native executable. That distinction matters for what you download and how you plan your first project.

Step 1: Choose Your Starting Point

The homepage organizes the workflow into five stages: Develop, Build, Test, Debug, Package & Deploy. Decide which one you need first:

If you are unsure, start by running your application on GraalVM as a JDK before attempting Native Image. Native Image adds constraints (for example around dynamic features), and separating the two steps makes problems easier to isolate.

Step 2: Download

Use the Download link on graalvm.org. The site does not state licensing terms, pricing, or whether an account is required on the pages reviewed here, so check the download page itself for the terms that apply to your use. Pick the build that matches your operating system and architecture; the download page is the place to confirm which builds exist for the current release rather than assuming a platform is covered.

Step 3: Follow Get Started

The Get Started link is the site's own onboarding path. Use it to confirm installation and environment setup for your platform, then verify the installation by checking that the java on your path is the GraalVM one and that its version matches the release you downloaded. The homepage does not document the exact commands, so follow the Get Started page rather than a remembered sequence.

Step 4: Run Your First Build

A practical first pass, in the order the site's workflow suggests:

1. Develop — compile and run your application with GraalVM as the JDK. Confirm tests pass here before changing anything else.
2. Test — run your existing test suite. This is where framework or library incompatibilities usually surface.
3. Debug — if something fails, resolve it at this stage; debugging a JVM-mode failure is far easier than debugging a native build failure.
4. Package & Deploy — only now attempt Native Image compilation, then package the resulting executable.

What You Gain from Native Image

The site lists four benefits of native executables, which are the reasons to invest in the extra build step:

• Low resource usage — native executables use only a fraction of the memory and CPU a JVM requires, improving utilization and reducing cost.
• Improved security — the executable contains only the classes, methods, and fields your application needs, reducing attack surface.
• Fast startup — ahead-of-time compilation means instant startup with no warmup to reach peak performance.
• Compact packaging — small executables with a range of linking options, suited to minimal container images.

These benefits come from ahead-of-time compilation, so they apply to the native executable, not to running the same application on the JVM.

Framework and Cloud Support to Check Before You Commit

GraalVM's site states that Spring Boot, Micronaut, Helidon, and Quarkus provide first-class support, and that SDKs from AWS, Microsoft Azure, GCP, and Oracle Cloud Infrastructure integrate with and support GraalVM. If your stack depends on a framework or cloud SDK not on these lists, verify compatibility with that project's own documentation before planning a native deployment — the GraalVM homepage does not claim coverage beyond what it names.

Common Sticking Points

• Skipping the JVM step. Going straight to Native Image makes failures ambiguous. Get a clean test run on the JVM first.
• Assuming the download page is the whole guide. The homepage gives you Download and Get Started as separate destinations; the setup detail lives on the latter.
• Treating Native Image benefits as automatic. Smaller binaries and instant startup follow from ahead-of-time compilation of a working application, not from installing GraalVM alone.
• Not confirming the release. The site currently features GraalVM 25.4; check that what you downloaded matches the release whose notes you are reading.

A GraalVM Native Image is an ahead-of-time (AOT) compiled native executable built from your Java application. Instead of shipping bytecode that a JVM interprets and JIT-compiles at runtime, GraalVM compiles the application into a standalone binary that starts instantly, needs no warmup, and uses only a fraction of the memory and CPU a JVM would require. Choose it when startup latency, memory footprint, or container image size matter; stay on a JVM when you need full dynamic class loading, peak long-run throughput after warmup, or the broadest library compatibility without extra configuration.

The core mechanism: ahead-of-time compilation

A JVM runs your code in two stages: it loads bytecode, then the JIT compiler watches execution and optimizes hot paths while the program runs. That means the first seconds (or minutes) of execution are slower, and the JVM itself carries overhead.

GraalVM's Native Image moves compilation to build time. The native-image tool performs a static analysis of your application, determines which classes, methods, and fields are actually reachable, and compiles them into a self-contained executable. The result is a binary that behaves like any other native program on the target OS.

The trade-off is that decisions normally made at runtime are made at build time. Anything the static analysis cannot see — reflection, dynamic proxies, resources loaded by name, JNI — must be declared through configuration so the build includes it. Frameworks like Spring Boot, Micronaut, Helidon, and Quarkus ship support that handles much of this for you.

How it differs from running on a JVM

Startup and warmup

On a JVM, peak performance arrives only after the JIT has profiled and recompiled hot code. A native executable is already compiled, so it runs at steady-state speed from the first request. This matters most for short-lived workloads: serverless functions, CLI tools, and scale-to-zero services where a cold start on a JVM would dominate the request.

Memory and CPU

Native executables use only a fraction of the memory and CPU a JVM requires, which improves utilization and reduces cost — particularly when you pack many instances into a cluster or a small container.

Security and binary size

Because the executable contains only the classes, methods, and fields your application needs, the attack surface is smaller and the binary is compact. GraalVM offers a range of linking options to fit minimal container images.

The cost: closed-world assumptions

The static analysis assumes the set of reachable code is fixed at build time. Code paths that only appear through reflection or dynamic loading will be missing unless configured. This is the main reason teams hit build-time errors or runtime ClassNotFoundException-style failures after switching, and why framework-provided native support is the practical starting point.

A concrete example

Consider a REST service that handles a burst of requests after an idle period. On a JVM, the first requests pay JVM startup plus JIT warmup, and the process holds a baseline memory footprint even when idle. Compiled as a Native Image, the same service starts in milliseconds and serves at full speed immediately, in a smaller container. If that service also loads plugins reflectively at runtime, you must register those classes for reflection in the native build configuration — otherwise they will not be present in the binary.

When to choose which

• Pick a Native Image for serverless functions, CLI tools, microservices with strict startup or memory budgets, and minimal container deployments.
• Stay on the JVM for long-running services where post-warmup throughput dominates, or applications that depend heavily on dynamic class loading and cannot easily supply reflection configuration.
• Check ecosystem fit first: Spring Boot, Micronaut, Helidon, and Quarkus provide first-class GraalVM support, and SDKs from AWS, Microsoft Azure, GCP, and Oracle Cloud Infrastructure integrate with it.

To try it, install GraalVM, build your application with its framework's native profile, then run the native-image tool and execute the resulting binary — verifying startup time and memory against your JVM baseline before committing.

GraalVM is an advanced JDK that adds ahead-of-time (AOT) Native Image compilation to the standard Java toolchain. You use it when you want Java applications that start instantly, use less memory and CPU than a JVM deployment, and ship as compact, self-contained executables. It is not a replacement for every JVM workload: the strongest fit is production services and CLIs where startup time, memory footprint, or container size matter.

What GraalVM Actually Is

GraalVM is a JDK distribution, so the familiar Java development workflow still applies: you develop, build, test, debug, and package with Java tooling. What distinguishes it is Native Image, which compiles your application ahead of time into a native executable rather than running it on a JVM at deployment time.

The site frames the value in one line: build faster, smaller, leaner applications. GraalVM 25.4 is the current release highlighted on the homepage, with new compiler optimizations, smaller Native Image binaries, and advanced Truffle and WebAssembly capabilities.

Key Benefits and How They Arise

These benefits compound in containerized and serverless environments, where memory limits and cold-start latency directly affect cost and responsiveness.

Where It Fits in Your Stack

GraalVM is designed to work with the frameworks and platforms teams already use, rather than requiring a rewrite:

• Frameworks: Spring Boot, Micronaut, Helidon, and Quarkus provide first-class support for GraalVM.
• Cloud platforms: SDKs from AWS, Microsoft Azure, GCP, and Oracle Cloud Infrastructure integrate with and support GraalVM.

If your service is built on one of these frameworks, adopting Native Image is primarily a build and configuration change, not an architectural one.

When to Choose GraalVM Native Image

Choose Native Image when your priority is:

• Fast startup for latency-sensitive or scale-to-zero workloads.
• Lower memory and CPU cost per instance.
• Small container images for minimal or distroless deployments.
• A reduced runtime attack surface.

Be more cautious when your application depends heavily on dynamic runtime behavior, since AOT compilation requires the reachable code to be known at build time. The practical approach is to validate with your own application: build a native executable, run your test suite against it, and compare startup time, memory use, and binary size with your existing JVM deployment before committing.

Getting Started

1. Download GraalVM from graalvm.org and install it as your JDK.
2. Confirm your toolchain works as usual by developing, building, and testing your application.
3. Build a Native Image of your application and run it.
4. Verify that startup time, memory usage, and binary size meet your targets, and that your tests pass against the native executable.
5. Package and deploy the executable, for example into a minimal container image.

The homepage organizes the workflow as Develop, Build, Test, Debug, and Package & Deploy, which mirrors a standard Java lifecycle with Native Image added at the build stage.

GraalVM lists first-class support from four Java frameworks — Spring Boot, Micronaut, Helidon, and Quarkus — and integration from SDKs of four cloud platforms: AWS, Microsoft Azure, GCP, and Oracle Cloud Infrastructure. If your stack is built on one of these, you can generally expect a supported path to Native Image; if you use a different framework or cloud provider, you'll need to verify compatibility yourself before committing.

Framework support

GraalVM's site states that "popular frameworks such as Spring Boot, Micronaut, Helidon, and Quarkus provide first-class support for GraalVM." In practice, "first-class support" means the framework project itself maintains the integration — build plugins, configuration for ahead-of-time compilation, and handling of reflection and resource metadata that Native Image needs.

The practical benefit: you're not hand-writing the reflection configuration that Native Image requires. The framework's build tooling generates it. That matters because Native Image compiles ahead of time and includes only the classes, methods, and fields your application actually reaches — which is also why GraalVM describes native executables as having a reduced attack surface.

What "first-class" does not guarantee

First-class support is a statement about the framework, not about every library you add on top. A Spring Boot app using a mainstream starter is a different case from one using an obscure library that relies on dynamic class loading. Before you commit, check whether your specific dependencies ship GraalVM metadata. If they don't, expect to supply configuration or replace the library.

Cloud platform integration

GraalVM states that SDKs from AWS, Microsoft Azure, GCP, and Oracle Cloud Infrastructure "integrate and support GraalVM." This is about the vendor SDKs your application calls, not about whether you can deploy a native executable to a given cloud — a native binary is a standalone executable, so deployment is generally a packaging question rather than a platform-permission question.

If your application talks to one of these clouds through the official SDK, the integration is documented as supported. If you use a third-party client or a community SDK, that claim doesn't extend to it.

Why this matters for Native Image specifically

The reason framework and SDK support is the deciding factor — rather than a nice-to-have — is the nature of ahead-of-time compilation. GraalVM's own framing of Native Image centers on four properties:

• Low resource usage — native executables use only a fraction of the memory and CPU a JVM requires.
• Fast startup — executables start instantly with no warmup.
• Compact packaging — small binaries with linking options suited to minimal container images.
• Improved security — only reachable classes, methods, and fields are included.

Every one of those benefits depends on the compiler being able to see your code paths at build time. Frameworks and SDKs that pre-declare their dynamic behavior make that possible; ones that don't will either fail the build or fail at runtime. So the support list is effectively a list of stacks where the ahead-of-time model works without you doing the metadata work.

How to decide for your project

Use this as a checklist rather than a verdict:

1. Framework — Is it Spring Boot, Micronaut, Helidon, or Quarkus? If yes, you have a supported starting point. If no, check that framework's own documentation for GraalVM guidance before proceeding.
2. Cloud SDK — Do you call AWS, Azure, GCP, or OCI through the official SDK? If yes, that layer is covered. Third-party clients need separate verification.
3. Dependencies — Do your non-framework libraries publish GraalVM metadata? This is the most common place a supported stack still hits friction.
4. Version — GraalVM's site references GraalVM 25.4 as the current release, with new compiler optimizations, smaller Native Image binaries, and advanced Truffle and WebAssembly capabilities. Confirm your framework version supports the GraalVM release you plan to use.

If steps 1 and 2 both pass and step 3 is clean, the supported path is straightforward. If step 3 is unclear, treat it as the gating item — it determines whether you get the startup and memory benefits or spend the effort on configuration instead.