Java Debugging

Find the root cause of a Java defect with a reproducible, hypothesis-driven loop, and attach a debugger safely when logs are not enough.

Safety rules

• Bind JDWP to loopback only (127.0.0.1). Never bind *:5005 on a reachable network; use an SSH tunnel or kubectl port-forward for remote hosts.
• Use suspend=n for running applications. suspend=y is acceptable only for short local test runs bound to loopback (waiting for the IDE to attach). Never leave a debug agent enabled on production; JDWP gives full code execution to whoever connects.
• Do not attach a debugger to production without explicit user instruction. Prefer reproducing locally or use read-only diagnostics (see the java-diagnostics skill).
• JAVA_TOOL_OPTIONS is picked up by every JVM started in that environment (build tools, forked test JVMs, child processes), causing Address already in use clashes. Prefer scoping the flag to the one process you want to debug.

Method

Reproduce deterministically, minimize, read the evidence (stack traces), test one falsifiable hypothesis with the least intrusive tool (log line or logpoint before breakpoints), then add a regression test and remove debug flags and temporary logging.

Version-dependent behavior (verified)