In the Net, Episode 05
You did not change how you use Java. In January 2023, Oracle changed how it counts you. The unit of measurement is no longer how many people run Java, nor how many processors it runs on. It is how many people you employ. This is the fifth episode of In the Net, a series on the documented mechanics of vendor lock-in. The premise has not changed. Every platform tells you how to come in; the architecture, and increasingly the contract, tells you whether you can leave, and on whose terms.
The previous four episodes found the lock-in built into a product, a platform, a cloud and an acquisition. This one is built into a definition. The Java runtime did not get worse, did not change hands, and did not move into the cloud. A single word in a price list did the work: "employee".
The Promise
Java arrived in 1995 with a promise that turned out to be true: write once, run anywhere. Compile to bytecode once, and the same program runs on any machine with a Java Virtual Machine, regardless of operating system or chip. For roughly three decades, that promise made Java the language the enterprise quietly settled on: banking back-ends, logistics systems, payment processors, government services, and the vast layer of middleware that nobody markets and nobody thinks about until it stops.
For most of that history the runtime was, in practice, simply there. You downloaded a Java Development Kit, you ran your software, and the question of a licence rarely surfaced. Sun Microsystems, Java's creator, open-sourced the platform as OpenJDK in 2006 and 2007. Oracle acquired Sun in 2010 and inherited both the open-source project and the commercial brand. The promise was real, and it was kept for a very long time. None of what follows is an argument that Java was a trap. It is an account of what happened to the licence under it.
The Hooks
The licensing history is worth stating plainly, because the lock-in is in the sequence. With Java 11 in 2019, Oracle moved its own branded JDK builds to a licence that required a paid subscription for commercial production use. With Java 17 in 2021, Oracle softened this with the No-Fee Terms and Conditions licence, free again for many uses. Then, on 23 January 2023, Oracle introduced the Java SE Universal Subscription and retired the older per-user (Named User Plus) and per-processor metrics for new subscriptions.
The new metric is per employee. Three properties make it consequential.
"Employee" does not mean Java user. Oracle's definition counts the entire organisation: full-time, part-time and temporary staff, plus contractors, consultants and agents who support internal operations. It is not the number of people who write Java, run Java, or have ever heard of Java. It is the headcount.
One install makes the whole headcount billable. Because the subscription is organisation-wide, a single server legitimately running Oracle's Java is, under this metric, enough to make every employee a billable unit. There is no "we only use it here" tier.
The price scales by headcount, not by use. Oracle's published price list starts at around 15 US dollars per employee per month for the smallest band and steps down by volume to a few dollars at the largest. A small firm pays a small per-head figure across a small head count; a large firm pays a smaller per-head figure across a very large one. Either way, the bill tracks the size of the company, not the size of its Java estate.
The runtime did not change. The unit of measurement did, and the unit is now the one thing guaranteed to be large.
The Standing
Two dimensions beyond price matter here: market position and how the customer is treated.
Market position. Java remains one of the most widely deployed runtimes in enterprise computing, and Oracle holds three things that matter: the brand, the official commercial builds, and the compatibility test suite (the TCK) that certifies a build as genuinely Java. The language is open. The trademark, the commercial binary, and the certification are Oracle's. That is enough standing to make a licence change a market event rather than a product note.
How the customer is treated. The standing is now enforced by audit, and the audit volume is the part of this story that has moved most. In a survey conducted by Dimensional Research and commissioned by Azul, a commercial OpenJDK vendor and therefore an interested party, 73 per cent of Oracle Java users reported having been audited in the previous three years, and 81 per cent reported they had moved, were moving, or planned to move at least some Java to an open-source alternative. The same body of survey work reported concern about Java pricing rising year on year. Gartner, separately, estimated that the per-employee model could cost two to five times the previous model for the same software, and has been widely cited as predicting that a large share of Java-using organisations would face an Oracle audit approach.
Read those numbers with the commissioning interest in mind: a competitor paid for the survey, and survey populations skew toward the aggrieved. Even discounted, the direction is unambiguous, and it is corroborated by independent trade reporting: audit activity around Java rose sharply after January 2023. When the audit becomes the most reliable customer touch-point, it has stopped being a risk of the relationship and become the shape of it.
The Exit That Isn't
Here the exit is, unusually, genuinely open, and the catch is somewhere else.
Oracle will tell you that you can simply stop using Oracle's JDK and switch to OpenJDK, and this is entirely true. OpenJDK is not a clone or a reimplementation; it is the official reference implementation of Java SE, and Oracle's own branded JDK is built from it. From Java 11 onward, the Oracle build and a current OpenJDK build are, for almost all purposes, the same binary with different labels and support terms. Switching is a reinstall, not a rewrite. No code changes, no recompilation in the normal case.
The catch is the past. An Oracle audit does not only ask what you run today; it reads download history and installation records. A single Oracle JDK left on a forgotten server, or downloaded under the post-2019 commercial terms at some point in the last several years, can become the basis of a retroactive claim, and because the metric is per employee, the claim is not scoped to that one machine. It is scoped to the workforce. The exit is open for the future. The bill can still arrive for the years behind you, which is why the migration and the audit-exposure review are two separate pieces of work, and the second one is the one to take advice on.
The Price
The arithmetic is the argument, so here is the arithmetic. A firm of 12,000 staff, licensed at the entry band of roughly 15 euros per employee per month, pays on the order of 12,000 times 15 euros a month: a little over 2 million euros a year. That figure does not change whether twelve employees use Java or twelve hundred, because the metric never asked. Reported real-world increases on moving from the old per-processor or Named-User-Plus models to per-employee commonly run from three times to ten times, with some estates citing far more; Gartner's two-to-five-times estimate is the conservative end.
The price of leaving is a migration, and unlike the AWS identity case in an earlier episode, it is bounded. Independent reports put OpenJDK migrations at large enterprises in the range of nine to fourteen months, most of which is testing and operational re-tooling rather than code change. It is real work. It is also one-time work, weighed against a recurring charge sized by a number, your headcount, that you grow on purpose. That asymmetry, a bounded exit against an unbounded stay, is the calculation that changes the moment the per-employee quote lands.
The Escape Route
The escape from this particular lock-in is one of the cleanest in the series, precisely because the format was never proprietary.
Switch to a free OpenJDK distribution. Eclipse Temurin (the vendor-neutral build from the Adoptium project), Amazon Corretto, Azul Zulu Community, Microsoft Build of OpenJDK, BellSoft Liberica, Red Hat's build and IBM Semeru are all production-grade, all certified against the Java compatibility tests, and all licensed under GPLv2 with the Classpath Exception, which permits unrestricted commercial use. They are not lesser Java. From Java 11 on they are built from the same source tree as Oracle's binary. The choice between them is about support contracts and release cadence, not capability.
Inventory before you migrate. The download history is the audit's first exhibit, so the first task is not installing Temurin; it is finding every Oracle JDK across the estate and recording what is there before Oracle asks. This is the step that protects against the retroactive claim, and it is the one most often skipped.
Address the same pattern elsewhere in the Oracle estate. The per-metric, audit-enforced approach is not unique to Java. Oracle Database licensing carries its own well-documented version: under Oracle's audit position, running Oracle Database on a VMware cluster can require licensing every physical core in the cluster the software could move to, not only the host it runs on, because Oracle does not recognise VMware as a valid partitioning boundary. The structural defence is the same one that answers Java: where a component is replaceable, keep it replaceable. PostgreSQL and MariaDB carry no per-core, whole-cluster audit exposure, and for a large class of workloads they are a complete answer.
Coda
The lesson generalises past Oracle and past Java. A licence is a promise about cost, and a per-something licence is only as safe as the stability of the "something". When the unit was the processor, you could plan, because you controlled the processors. When the unit becomes the employee, the bill is pegged to the number you are trying hardest to grow, and the one you least want to suppress to save on a runtime.
Java still runs anywhere; that promise held. What changed is that the licence now counts everyone, whether or not they ever asked for Java, ever used it, or ever knew it was there. The defence is not loyalty to a vendor or hostility to one. It is keeping the replaceable layer replaceable, so that a change in someone else's price list is an inconvenience rather than a summons.
Write once, run anywhere. Licence once, pay for everyone.
Read the full article on vivianvoss.net →
By Vivian Voss, System Architect and Software Developer. Follow me on LinkedIn for daily technical writing.
