What causes "System exit not allowed" in pentaho/pentaho-kettle?

If a controlled shutdown is genuinely needed, call ExitInterceptor.disableIntercept() before exit, then re-enable

pentaho/pentaho-kettle · error · SecurityException

System exit not allowed

Error message

System exit not allowed

What it means

ExitInterceptor.exit throws this SecurityException when interception is enabled and code attempts to call System.exit(status). Kettle enables this interceptor in embedded/test contexts to prevent plugins or scripts from killing the whole JVM. If interception is disabled, the call proceeds to the real System.exit.

Solutions

If a controlled shutdown is genuinely needed, call ExitInterceptor.disableIntercept() before exit, then re-enable
Fix the plugin/script to return an error status instead of calling System.exit
In embedded scenarios, catch SecurityException around job/transformation execution and translate it into an application-level error
Only disable interception in contexts where exiting the JVM is safe

Example fix

// before
System.exit(1);
// after
try {
  ExitInterceptor.exit(1);
} catch (SecurityException e) {
  LOG.error("System.exit blocked in embedded context; returning error instead");
}

Defensive patterns

Strategy: try-catch

Validate before calling

if (ExitInterceptor.isInterceptEnabled()) {
  LOG.warn("System.exit calls will be blocked in this context");
}

Try / catch

try {
  runTransformation();
} catch (SecurityException e) {
  if ("System exit not allowed".equals(e.getMessage())) {
    LOG.error("Plugin attempted System.exit in embedded JVM");
  } else throw e;
}

Prevention

In embedded contexts, always enable ExitInterceptor and catch SecurityException at the execution boundary
Refactor plugins/scripts to return errors rather than calling System.exit
Only disable interception where terminating the JVM is acceptable
Run kettle scripts in isolated processes if they may call System.exit

When it happens

Trigger: Any code path (plugin, JavaScript rule, script value) calling System.exit() or Runtime halt-equivalents routed through ExitInterceptor.exit while ExitInterceptor.enableIntercept() is active.

Common situations: Running transformations/jobs embedded in an application server or test harness where a plugin calls System.exit on error; executing kettle scripts that terminate the JVM; unit tests exercising failure paths of such plugins.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/25534f4f61420d08. Report an issue: GitHub.

Appendix: source

Thrown at engine/src/main/java/org/pentaho/di/security/ExitInterceptor.java:31

package org.pentaho.di.security;

import java.util.concurrent.atomic.AtomicBoolean;

public class ExitInterceptor {
    private static final AtomicBoolean interceptEnabled = new AtomicBoolean(false);

    public static void enableIntercept() {
        interceptEnabled.set( true );
    }

    public static void disableIntercept() {
        interceptEnabled.set( false );
    }

    public static void exit( int status ) {
        if ( interceptEnabled.get() ) {
            throw new SecurityException( "System exit not allowed" );
        }
        System.exit( status );
    }
}

View on GitHub (pinned to f3058517a1)