{"record":{"id":"fa66f55dfc217426","repo":"oracle/graal","slug":"jimage-native-can-only-be-set-if-native-access-is","errorCode":null,"errorMessage":"JImage=native can only be set if native access is allowed","messagePattern":"JImage=native can only be set if native access is allowed","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"espresso/src/com.oracle.truffle.espresso/src/com/oracle/truffle/espresso/runtime/EspressoEnv.java","lineNumber":176,"sourceCode":"                multiThreadingDisabledReason = \"context seems to contain single-threaded languages: \" + singleThreadedLanguages;\n                context.getLogger().warning(() -> \"Disabling multi-threading since the context seems to contain single-threaded languages: \" + singleThreadedLanguages);\n            }\n        }\n        this.multiThreadingDisabled = multiThreadingDisabledReason;\n        this.NativeAccessAllowed = env.isNativeAccessAllowed();\n        this.Polyglot = env.getOptions().get(EspressoOptions.Polyglot);\n        this.HotSwapAPI = env.getOptions().get(EspressoOptions.HotSwapAPI);\n        this.BuiltInPolyglotCollections = env.getOptions().get(EspressoOptions.BuiltInPolyglotCollections);\n        this.polyglotTypeMappings = new PolyglotTypeMappings(env.getOptions().get(EspressoOptions.PolyglotInterfaceMappings), env.getOptions().get(EspressoOptions.PolyglotTypeConverters),\n                        BuiltInPolyglotCollections);\n        this.enableGenericTypeHints = env.getOptions().get(EspressoOptions.EnableGenericTypeHints);\n        this.proxyCache = polyglotTypeMappings.hasMappings() ? new HashMap<>() : null;\n        this.UseBindingsLoader = env.getOptions().get(EspressoOptions.UseBindingsLoader);\n        this.AdvancedRedefinition = env.getOptions().get(EspressoOptions.EnableAdvancedRedefinition);\n\n        EspressoOptions.JImageMode requestedJImageMode = env.getOptions().get(EspressoOptions.JImage);\n        if (!NativeAccessAllowed && requestedJImageMode == EspressoOptions.JImageMode.NATIVE) {\n            throw new IllegalArgumentException(\"JImage=native can only be set if native access is allowed\");\n        }\n        this.JImageMode = requestedJImageMode;\n\n        this.vmArguments = buildVmArguments(context.getLogger());\n        this.jdwpContext = new JDWPContextImpl(context);\n        if (env.getOptions().get(EspressoOptions.CHA)) {\n            this.classHierarchyOracle = new DefaultClassHierarchyOracle();\n        } else {\n            this.classHierarchyOracle = new NoOpClassHierarchyOracle();\n        }\n    }\n\n    public TruffleLanguage.Env env() {\n        return env;\n    }\n\n    public boolean multiThreadingEnabled() {\n        return multiThreadingDisabled == null;","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/oracle/graal/blob/a66e9ccd1d7bf2552883939aa0788dfd0e294aab/espresso/src/com.oracle.truffle.espresso/src/com/oracle/truffle/espresso/runtime/EspressoEnv.java#L158-L194","documentation":"EspressoEnv validates at startup that the option espresso.JImage=native is only used when native access is allowed (AllowNativeAccess / the NativeAccessAllowed gate). A native jimage reader uses native code to memory-map the runtime's modules image; without native access permission that path cannot be taken, so the constructor throws IllegalArgumentException immediately instead of failing later.","triggerScenarios":"Starting a polyglot Context with option espresso.JImage=native while the embedding does not grant native access (e.g. a native-image host compiled with --no-fallback semantics, or a Context configured without allowNativeAccess(true) and polyglot engine restriction 'NativeAccess' false).","commonSituations":"Sandboxed or restricted polyglot hosts (allowNativeAccess(false)) that still pass JImage=native for speed; upgrading GraalVM where the option became gated; CI sandboxes that deny native access by default.","solutions":["Remove espresso.JImage=native and let Espresso use the pure-Java image reader (default).","If native image reading is required, enable native access: Context.newBuilder().allowNativeAccess(true) (or remove the NativeAccess restriction) and keep the option.","Check for stale option files (e.g. .polyglotrc, system properties, launcher flags) that still set JImage=native."],"exampleFix":"// before\nContext ctx = Context.newBuilder(\"java\").allowNativeAccess(false).option(\"espresso.JImage\", \"native\").build(); // throws\n\n// after\nContext ctx = Context.newBuilder(\"java\").allowNativeAccess(false).build(); // java reader, no option","handlingStrategy":"validation","validationCode":"// Validate option combination before building the Context\nboolean nativeAllowed = builder.getAllowedNativeAccess(...) /* or your config */;\nif (!nativeAllowed) {\n    // do not set espresso.JImage=native\n}","typeGuard":null,"tryCatchPattern":"try {\n    Context.newBuilder(\"java\").option(\"espresso.JImage\", \"native\").build();\n} catch (IllegalArgumentException e) {\n    // fall back to building without the JImage option\n}","preventionTips":["Treat espresso.JImage=native as requiring allowNativeAccess(true).","Centralize polyglot option construction so restrictions and options cannot diverge."],"tags":["espresso","configuration","polyglot","native-access"],"backgroundTag":null,"analyzedSha":"a66e9ccd1d7bf2552883939aa0788dfd0e294aab","analyzedAt":"2026-08-14T13:58:47.161Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}