Document current issues using JDKs > 17 and nailgun

[jberkel]

Ran into #20603. This is quite a big gotcha and the workaround should be documented while a proper fix is prepared (disabling nailgun by default).

https://pantsbuild.slack.com/archives/C046T6T9U/p1753112068755689

[benjyw]

Thanks!

It's unfortunate, but our choices are 1) take over maintenance of Nailgun or 2) create an alternative.

[jberkel]

Maybe there are some quick fixes, see facebookarchive/nailgun#204. Will take a look.

[benjyw]

Ah interesting. I'd be happy with a bandaid like this that kicks the can down the road a bit.

We'd have to fork nailgun, but that's not too hard.

[jberkel]

Unfortunately, it's not a quick fix :(

The security manager was used to intercept and forward System.exit which gets called for example by the Scala compiler at the end of the compilation. There's no replacement planned for this: https://bugs.openjdk.org/browse/JDK-8199704

A solution could be to use some custom code for the compilation, but in that case maybe a real compile server should be used instead. They also suggest using bytecode manipulation as a possible solution, but that's quite invasive.

https://inside.java/2021/04/23/security-and-sandboxing-post-securitymanager/