Repository navigation
Exclude Rails::Engine#call from the JRuby JIT by default for Kaui - #346
Open
tungleduyxyz wants to merge 1 commit into
Open
tungleduyxyz wants to merge 1 commit into
tungleduyxyz wants to merge 1 commit into
Conversation
On JRuby 10 (Tomcat 11 / JDK 21), once the JIT has compiled Rails::Engine#call Kaui stops setting the session cookie and every new login fails with a 500 (killbill/killbill-admin-ui-standalone#131). Logged-in users keep working, so the failure is easy to miss until sessions expire. Confirmed on two environments (kaui-standalone 5.0.2 and Kaui 4.0.26 on a perf server); excluding that one method from the JIT fixes it. - ansible: new `kaui_jruby_jit_exclude` (default Rails::Engine#call, '' to disable), applied in the Kaui setenv2.sh template before `kaui_system_properties` so extra properties don't have to repeat it. - docker (killbill/kaui): same default via KAUI_JRUBY_JIT_EXCLUDE. - killbill setenv2.sh.j2: add the missing trailing newline. Appending a line to a rendered copy with `echo >>` fused it onto the closing `fi`, which aborted the script and left KAUI_SECRET_KEY_BASE unset (Kaui refused to boot with "Missing secret_key_base"). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
1 of 5 tasks
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Existing Ansible installations preserve setenv2.sh, so the workaround will not be applied during upgrades.
1 open finding
What changed in this PR
Adds a targeted JRuby JIT workaround to prevent Kaui login failures after warm-up.
Changes:
- Excludes
Rails::Engine#callfrom JRuby JIT by default. - Supports disabling the exclusion through Ansible or Docker configuration.
- Adds the missing Kill Bill template newline.
| File | Description |
|---|---|
docker/templates/kaui/latest/setenv2.sh |
Configures the Docker JIT exclusion. |
ansible/templates/killbill/conf/setenv2.sh.j2 |
Adds the trailing newline. |
ansible/templates/kaui/conf/setenv2.sh.j2 |
Renders the Ansible JIT exclusion. |
ansible/group_vars/all.yml |
Defines its default value. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+4
to
+6
| {% if kaui_jruby_jit_exclude %} | ||
| -Djruby.jit.exclude={{ kaui_jruby_jit_exclude }} | ||
| {% endif %} |
pierre
approved these changes
Oct 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
On JRuby 10 (the Tomcat 11 / JDK 21 stack on this branch), once the JIT has compiled
Rails::Engine#call, Kaui stops setting the session cookie and every new login fails with a 500 until Tomcat is restarted. Logged-in users keep working, so it is easy to miss until sessions expire. Details and bisection: killbill/killbill-admin-ui-standalone#131.Now confirmed on two environments: a local kaui-standalone 5.0.2 setup (the issue) and a perf server running Kaui 4.0.26 (Tomcat 11.0.x, JDK 21, JRuby 10.0.6.0). With the flag, the login page still sets a cookie after 300 requests and a 10-minute, 20-user load test with 158 logins had 0 failures.
What
kaui_jruby_jit_excludegroup var (defaultRails::Engine#call,''to disable), rendered as-Djruby.jit.exclude=...in the Kauisetenv2.shtemplate ahead ofkaui_system_properties, so extra properties do not have to repeat it.killbill/kaui): same default viaKAUI_JRUBY_JIT_EXCLUDE(set it to''to disable).setenv2.sh.j2: add the missing trailing newline. Appending a line to a rendered copy withecho >>fused it onto the closingfi, which aborted the script and leftKAUI_SECRET_KEY_BASEunset, so Kaui refused to boot ("Missing secret_key_base").Only one method is excluded from the JIT, so the performance cost is negligible. The same change for the managed deployment is in the companion PR on
killbill/managed.Verification
Rendered both templates with Jinja2 (Ansible defaults) for the enabled and disabled case, sourced the rendered scripts: the flag appears exactly once in
CATALINA_OPTS, the secret key base is still generated,bash -npasses.🤖 Generated with Claude Code