quarkusio/quarkus · error · RuntimeException

Unable to create protection domain for ${jarPath}

Error message

Unable to create protection domain for ${jarPath}

What it means

Wraps URISyntaxException or MalformedURLException raised while constructing the file URI and JarUrlStreamHandler used for the jar resource's protection domain CodeSource URL. Thrown from JarResource init when the jar path cannot be converted into a valid file URL.

Source

Thrown at independent-projects/bootstrap/runner/src/main/java/io/quarkus/bootstrap/runner/JarResource.java:58

        this.jarPath = jarPath;
    }

    @Override
    public void init() {
        final URL url;
        try {
            String path = jarPath.toAbsolutePath().toString();
            if (!path.startsWith("/")) {
                path = '/' + path;
            }
            // we use this particular constructor to work around https://bugs.openjdk.org/browse/JDK-8140634
            // see https://github.com/quarkusio/quarkus/issues/52292
            URI uri = new URI("file", null, path, null, null);
            JarUrlStreamHandler handler = new JarUrlStreamHandler(uri);
            url = new URL((URL) null, uri.toString(), handler);
            handler.setOriginalUrl(url);
        } catch (URISyntaxException | MalformedURLException e) {
            throw new RuntimeException("Unable to create protection domain for " + jarPath, e);
        }
        this.protectionDomain = new ProtectionDomain(new CodeSource(url, (Certificate[]) null), null);
    }

    @Override
    public byte[] getResourceData(String resource) {
        return JarFileReference.withJarFile(this, resource, JarResourceDataProvider.INSTANCE);
    }

    private static class JarResourceDataProvider implements JarFileReference.JarFileConsumer<byte[]> {
        private static final JarResourceDataProvider INSTANCE = new JarResourceDataProvider();

        @Override
        public byte[] apply(JarFile jarFile, Path path, String res) {
            ZipEntry entry = jarFile.getEntry(res);
            if (entry == null) {
                return null;
            }

View on GitHub (pinned to e1c734241f)

Solutions

1. Inspect the printed jarPath for invalid characters or emptiness; install the app under a simple ASCII path without spaces.
2. Rebuild the application so the runner receives a canonical absolute path (Path.toAbsolutePath().normalize()).
3. Check how the classpath/jar path is passed to QuarkusEntryPoint (env vars, wrapper scripts) for corruption.
4. Upgrade Quarkus if you suspect a URI-encoding bug in your environment (see linked issue quarkusio/quarkus#52292 context).

Example fix

// before
java -jar /path with spaces/app.jar
// after
java -jar "/path_with_no_spaces/app.jar"  # or symlink a clean path

String path = jarPath;
if (path == null || path.isBlank() || !java.nio.file.Paths.get(path).isAbsolute()) throw new IllegalStateException("invalid jar path: " + path);
URI u = new URI("file", null, path, null, null); // fail fast with clear message

boolean isUriSafePath(String p) { return p != null && !p.isBlank() && java.nio.file.Paths.get(p).isAbsolute(); }

try { app.start(); } catch (RuntimeException e) { if (e.getMessage() != null && e.getMessage().startsWith("Unable to create protection domain")) { log.error("Bad jar path/URI: {}", e.getMessage(), e.getCause()); throw new IllegalStateException("Install app under a clean absolute path", e); } throw e; }

When it happens

Trigger: JarResource init builds new URI("file", null, path, null, null) and a URL from it; failure means the jarPath string is malformed (illegal characters, empty, or not a valid path) so URI/URL creation fails.

Common situations: Unusual characters in the install path (spaces/unicode on misconfigured systems), jarPath built from an uninitialized or null-wrapped value, or exotic environments where Path string conversion produces an invalid URI component.

Related errors

• Could not initialize mapped class ${className}
• '%s' is invalid
• Unable to create invoker:
• Invalid URL:
• Unable to create protection domain for

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/48799bc54c9ff069. Report an issue: GitHub.