Java in air-gapped environments.

Air-gapped environments — systems deliberately isolated from the internet and often from the wider corporate network — are common in defence, critical infrastructure, manufacturing control systems, research, and any setting where the security of a system outweighs its convenience. They are also the subject of one of the most persistent and costly misconceptions in Oracle Java licensing: the belief that because an air-gapped server cannot reach Oracle, and Oracle cannot reach it, the Java running on it is somehow outside Oracle's licensing. It is not. An air gap is a security control. It is not a licensing exemption, and treating it as one builds up hidden exposure that surfaces at the worst possible moment.

The dangerous misconception

The reasoning behind the misconception runs like this: Oracle detects unlicensed Java partly through update-check traffic and download activity tied to enterprise accounts; an air-gapped machine generates none of that traffic; therefore Oracle has no way to know the Java is there; therefore it does not need to be licensed. The first three steps contain some truth. The conclusion is wrong, and the error is in the jump from "Oracle may not detect it remotely" to "it does not need a licence."

A licence obligation is created by the act of using the software under terms that require one. It exists whether or not anyone is watching. Whether Oracle can detect a given installation affects how an audit unfolds — it does not change whether a licence is owed. An organisation that runs Oracle's JDK on an air-gapped server in a way that requires a subscription owes that subscription exactly as it would for an internet-connected server. The air gap changes the detection story, not the licence position.

What air-gapped actually means

It helps to be precise, because "air-gapped" covers a range of real-world setups. At its strictest, an air-gapped system has no network connection of any kind to anything outside its isolated enclave — software arrives only by physically controlled media. More commonly, "air-gapped" in enterprise usage means a system isolated from the internet and from general corporate networks, reachable only within a restricted, monitored enclave. Either way, the defining feature is the same: the system does not talk to the outside world, and the outside world does not talk to it.

That isolation is valuable and often mandatory. But notice what it is a property of: the network. It says nothing about what software is installed, which build of Java is running, or what licence terms that build was obtained and used under. The licensing analysis of the Java on an air-gapped server is identical in structure to the analysis of any other server — it just has to be done deliberately, because no network signal will prompt anyone to do it.

How Oracle Java licensing applies

For an air-gapped server, the licensing question reduces to the same question that governs Java anywhere: is the build Oracle's JDK or an OpenJDK build, and if it is Oracle's JDK, do the version and use require a paid Java SE subscription?

• OpenJDK builds remain free — air-gapped or not. If the air-gapped system runs Eclipse Temurin, Amazon Corretto, Azul Zulu or another OpenJDK distribution, there is no Oracle licence requirement, the same as on a connected server.
• Oracle JDK is assessed normally. An Oracle JDK on an air-gapped server is subject to the usual tests: a current version may sit within the free NFTC window; an older version past its free-update date, used commercially, falls under terms requiring a subscription; a build obtained under the OTN agreement is not licensed for free commercial production use.
• The employee metric still counts the whole organisation. If a subscription is required, it is priced on the employee metric across the entire organisation — the isolated server does not get its own carved-out, cheaper count. This is one reason air-gapped Oracle JDK is disproportionately expensive relative to its footprint.

Nothing in any of this references network connectivity. The air gap simply is not a variable in the licence calculation.

How air-gapped Java surfaces in an audit

If Oracle cannot remotely detect air-gapped Java, how does it ever become an issue? Through the audit process itself. An Oracle Java audit does not rely solely on telemetry. When an audit is under way, Oracle requests information about the organisation's Java estate, and the organisation is generally obliged under its agreements to provide an accurate account — which includes air-gapped systems. The isolated environment is invisible to remote detection but it is not invisible to a proper internal inventory, and an audit asks for that inventory.

This produces a particularly awkward failure mode. An organisation that has assumed its air-gapped Java "doesn't count" has often never inventoried it, never licensed it, and never planned for it. When an audit arrives, that Java has to be disclosed, and it surfaces as a block of previously unconsidered exposure — frequently older versions, because air-gapped systems are patched infrequently, which makes them more likely to be on subscription-requiring versions. What felt like a safe blind spot becomes a concentrated liability. Worse, the organisation discovers it during an audit, when its options are narrowest, rather than on its own timeline.

The patching problem

Air-gapped Java carries a second, linked problem that compounds the licensing one: patching. Because the system cannot pull updates from the internet, security patches have to be brought in deliberately through controlled media and a manual process. That friction means air-gapped Java is frequently allowed to fall behind — and an out-of-date runtime is both a security exposure and, for Oracle JDK, a stronger licensing exposure, since older versions are the ones most likely to require a subscription.

An organisation can therefore end up with the worst combination on its most security-sensitive systems: an old, unpatched Oracle JDK that is also unlicensed. The isolation that was meant to protect the system has, through neglect of the Java inside it, quietly created a runtime that is vulnerable and out of compliance at the same time. Our guide to the security risks of unlicensed Java covers why that combination is so undesirable.

The clean approach

The good news is that air-gapped Java is fully solvable, and the solution is the same one that works everywhere else — it just has to be applied with intent, because no automatic signal will trigger it. The approach:

• Inventory the air-gapped estate explicitly. Air-gapped systems must be a named, deliberate part of any Java compliance assessment. Record, for every isolated server, the Java build, version and how it was obtained. Do not let the enclave boundary become an inventory boundary.
• Migrate to free OpenJDK. OpenJDK builds run perfectly well in air-gapped environments — the binaries can be brought in through the same controlled media process used for any other software. Standardising air-gapped systems on a free OpenJDK distribution removes the Oracle licence requirement entirely. Our migration guide covers the process.
• Build a controlled patch pipeline. Establish a deliberate process to bring quarterly Java security updates into the air-gapped environment on a defined cadence, so the runtime does not fall behind. A free OpenJDK build keeps this purely a security task, with no licensing dimension attached.
• Govern it continuously. Include air-gapped systems in a continuous management programme so they are reviewed on the same schedule as connected systems, rather than drifting unmonitored.

Across more than 340 Java licensing engagements, isolated and air-gapped environments have been a recurring source of surprise exposure precisely because they get overlooked — and a recurring source of clean savings once they are brought into scope and moved to free OpenJDK. Handling them deliberately has contributed to a 68% average reduction in audit claims and more than $180M in total client savings.

Frequently asked questions

This article is general information on Oracle Java licensing, not legal advice. Oracle's licensing terms and audit practices are determined by Oracle and change over time. Consult a qualified independent Java licensing specialist on your specific estate, including any isolated or air-gapped environments and the agreements that govern them.