Amsterdam Java User Group

• "Mission Possible: The 45-Minute Path to Bullet-Proof Java Container Images" (Pasha Finkelshteyn, BellSoft)
• "DuckDB: From Academic Research to AWS" (Nantia Makrynioti, DuckLabs)
• "Valuable Lessons from OSGi" (Michael Kemp, Atlassian)

Abstracts:

"Mission Possible: The 45-Minute Path to Bullet-Proof Java Container Images" (Pasha Finkelshteyn, BellSoft)

Your mission is to turn a bloated CVE-infested container image into a low-noise image with low vulnerability exposure and clear operational posture. You have 45 minutes before the explosive attack hits. Mission possible!

This session provides a straight path towards building more secure and maintainable Java container images. We will identify the key culprits such as stale dependencies, outdated base, lack of provenance, and excessive privileges. Then, we will draft a step-by-step plan to:

• Pick a minimal and well-maintained base image,
• Shrink privileges,
• Prove provenance with version pinning, signatures and SBOMs,
• Scan and classify with CVSS rules to cut noise and fix what’s exploitable,
• Automatically monitor for updates with Dependabot/Renovate.

Expect a before/after scan comparison, copy-and-paste Dockerfile instructions, verification checklist, and a clear and reproducible path towards hardened Java container images that provide an impenetrable lock-box for your applications.

"DuckDB: From Academic Research to AWS" (Nantia Makrynioti, DuckLabs)

DuckDB is an open source analytical database system with a vibrant community of contributors and over a million downloads per day. The project started by Hannes Mühleisen and Mark Raasveldt at CWI, the Dutch national research institute for mathematics and computer science in Amsterdam. It then continued its course through DuckLabs, a spin-off company founded by the two creators, which was recently acquired by AWS.

In this talk, we’ll walk through DuckDB’s journey from an academic research project to a beloved tool that attracted the interest of major players in the area of data management. We’ll share lessons learned, anecdotes, as well as personal perspectives on why it’s a great example of research built around real user needs.

"Valuable Lessons from OSGi" (Michael Kemp, Atlassian)

OSGi is niche now, but it pioneered some concepts that are still valuable today. It started with some simple concepts and grew into a much larger spec, but even the simple cases have a lot of hidden complexity.

Why would anyone still use it today? Is there an alternative for runtime behaviour changes? There are better ways to use modularisation to enforce domain driven design, but which one to pick?

• Fun with Flags: How OpenFeature Solves Your Feature Flag Headaches (Simon Schrottner, Flagsmith)
• No Country For Old APIs - Wrapping Legacy Java Services As MCP Tools Without Rewriting Them (Željko Kozina, Chronomill)
• Topic to be announced (Tom Cools, Timefold)

Abstracts

Fun with Flags: How OpenFeature Solves Your Feature Flag Headaches (Simon Schrottner, Flagsmith)

Feature flags have revolutionized the software delivery lifecycle, enabling teams to decouple releases from deployments and create a more agile development process. They're often hailed as one of the key practices in modern software development—at least in theory.

However, as systems grow in complexity, so do the challenges associated with feature flagging. From supporting multiple languages and managing targeted evaluations to avoiding vendor lock-in and safely decommissioning obsolete code, what initially seems like a straightforward problem can quickly become daunting.

The OpenFeature community is tackling these challenges head-on by providing vendor-agnostic SDKs and a suite of powerful tools designed to simplify the feature flagging experience. Join me as we explore the common pitfalls of feature flagging and discover how OpenFeature can help bring the fun back into this critical aspect of software development.

No Country For Old APIs - Wrapping Legacy Java Services As MCP Tools Without Rewriting Them (Željko Kozina, Chronomill)

Somewhere in your estate is a Java service old enough to vote. REST endpoints by the dozen, one SOAP relic nobody will admit to, session auth, and the person who understood it all has retired. It works, which is why nobody touches it. And now the business wants AI agents to use it.

Every enterprise is under pressure to connect AI agents to systems that were never designed for them, yet most MCP material assumes a greenfield project or a toy demo.

This session addresses the situation attendees actually face: a brownfield estate of REST and SOAP services that cannot be rewritten. It is demo-driven, built on the official MCP Java SDK, Spring AI, and Spring for GraphQL, and it is honest about the failure modes: tool sprawl from auto-generation, auth translation, oversized responses, and unsafe retries against non-idempotent writes.

Bios

Simon builds durable standards and practices so teams can learn, grow, and operate without depending on any single vendor, tool, or person. He is passionate about developer experience, open standards, and building communities where people help each other grow. He regularly speaks at conferences and mentor individuals taking their first steps in the open source world. He is very open to conversations about open source, feature flagging, observability, and what comes next.

Željko has spent over 15 years in IT, mostly consulting for banks and insurance companies, with a focus on modernising legacy systems. Along the way, he developed deep expertise in JVM-based technologies and has become a go-to voice on topics such as API design. When he's not untangling someone else's technical debt, he's happily creating his own through a growing collection of personal projects he enthusiastically starts and occasionally finishes. Željko is passionate about sharing knowledge in a way that actually sticks, which usually means keeping things practical, a little entertaining, and free of unnecessary jargon. He is a GraphQL Ambassador and a member of the GraphQL AI Working Group.

• "We Created Our Own AI Orchestrator And It Become So Much More!" (Ricky van Rijn, Metafactory)
• "Capability Mesh: Architecture for the Agentic Era" (Makan Sepehrifar, Productboard)
• "Securing Java for the Quantum Era" (Ana-Maria Mihalceanu, Oracle)

Abstracts:

"We Created Our Own AI Orchestrator And It Become So Much More!" (Ricky van Rijn, Metafactory)

We built an agent orchestration tool using Embabel Agent, Skills, and Spec files to coordinate AI-driven work.

It provides a visual dashboard for active agents, tasks, and next steps, reshaping team roles: developers review AI output, analysts define requirements, and product owners manage faster sprint queues.

"Capability Mesh: Architecture for the Agentic Era" (Makan Sepehrifar, Productboard)

Ten years ago, microservices chaos led to "Service Mesh" solving the discoverability problem by replacing network endpoints with meaningful references, enabling scalability and observability. It worked brilliantly for connecting services.

Today we're living through the same cycle with Generative AI and Agents, but the chaos is about integration, not networking. The old problems discoverability, scalability, observability are back because orchestrators now pick agents by capability, not name.

Plus we face new challenges: explainability of agent actions and the possibility of unintended actions due to the non-deterministic nature of large language models. We need the same evolutionary leap from "Service Mesh" to "Capability Mesh" shifting from technical service contracts to semantic capability integration for autonomous AI.

Key Topics and Take Aways:

• From OpenAPI to MCP: The Protocol Shift in Agentic AI
• Capability Hierarchies: Composing Agents at Scale
• Human-on-the-Loop: Redefining Our Role in Agent Systems
• Policy as Code: Governing Autonomous Agents
• Observability & Safety: Tracing Agent Behavior

"Securing Java for the Quantum Era" (Ana-Maria Mihalceanu, Oracle)

Most Java applications rely on cryptography every day, often without much thought, because we trust the algorithms underneath. But as computational power advances, how much of that trust will hold up?

The risks aren't far off. Encrypted data captured today could be decrypted years from now, putting greater pressure on how we secure applications today.

In this session, we'll explore modern Java security, from the concepts behind Hybrid Public Key Encryption (HPKE) to a hands-on demo of post-quantum hybrid key exchange in TLS 1.3, using keytool to manage keys and certificates and JDK Flight Recorder (JFR) to inspect security details at runtime.