Skip to content

Build1 publisher3 min readPublished

Unpinned Oracle JDK 21 images will install the first paid build after October 20

Oracle's October 20 patch makes JDK 21.0.13 the first JDK 21 build that needs a paid subscription for production use. Any image that tracks the latest Oracle build installs it on its next patch run, and the bill is counted per employee.

The Engineer · Build desk

Illustration accompanying Unpinned Oracle JDK 21 images will install the first paid build after October 20

What happened

  • Oracle formally announced on August 14, 2026 that JDK 21 leaves its no-fee NFTC license, after flagging the end of permissive licensing on its Java SE Support Roadmap.
  • Oracle's October 20, 2026 Critical Patch Update ships JDK 21.0.13, the first JDK 21 release whose production use requires a paid subscription.
  • Dockerfiles, base images or package managers that fetch Oracle JDK 21 from an unchanging tag or URL will install that build on their next patch run, with no email or popup.
  • Oracle prices the Java SE Universal Subscription per employee, starting at $15 a month and falling to a published floor of $5.25 at volume.

Compiled by The EngineerSomething wrong?How this is made

Why it matters

  • exposure Whoever owns base images and package mirrors now controls whether the company takes on a Java bill, because the paid build arrives through their update path.
  • cost A small Java footprint does not keep the bill small, since one paid production host brings the whole organization's headcount into the count, per the post.
  • decision Teams on Oracle JDK 21 now choose between a subscription, a four-version upgrade to JDK 25, or an OpenJDK 21 build that avoids both.
  • precedent The same overlap rule ends JDK 25's free window in September 2028, so moving to 25 buys about 23 months before this migration repeats.

Licensing attaches to the artifact, according to the post. Every JDK 21 binary downloaded under the NFTC keeps those terms for good, production included, and nothing expires or phones home [10]. The post frames the exposure as narrow and mechanical: which machines will install 21.0.13 or later, and who authorized it [18].

Most of a Java estate falls outside it. The OTN license permits personal use, development, testing, prototyping and demonstration at no cost, so developer laptops, CI agents and test environments are not where the fee lands [11]. OpenJDK 21 builds under GPLv2 with the Classpath Exception are untouched, whether Oracle or anyone else ships them [12]. What is left is production hosts running Oracle's own JDK 21 builds. For each one the check is a single line: whether the image or package reference names an exact version, or a moving target like `oraclejdk:21` [3].

A pin to 21.0.12 is legal. That build came from the July 21, 2026 patch, and the post calls it the last JDK 21 build that is free for production [7]. It is also a freeze. Every Oracle JDK 21 fix from October 20 on ships under OTN terms [1]. The post allows that a September-dated security patch may still be free [7].

Its cost example is worth checking against its own price list. It describes a 50-person company with one production service on an OTN build and says the result can be a five-figure annual line item, backdated through an audit [14]. At the $15 starting rate, 50 employees cost $9,000 a year [1]. The bill reaches five figures once an audit reaches back 14 months or more, or at 56 employees within a single year [2][3]. The count covers everyone on payroll, including staff who have never opened a terminal [13].

Oracle is steering users to JDK 25 [15]. Donald Smith, Oracle's Vice President of Product Management, wrote that the overlap "is intended to give users who wish to continue using the permissive no-fee NFTC license time to migrate to Oracle JDK 25, the latest LTS release." [8] In the post's assessment, JDK 25 is the right default for most estates, with the cost paid in engineering time for a four-version jump rather than in license fees [15]. Its headline sets Temurin and Corretto against JDK 25 as the other named routes, and it counts four exits in all, each legal, differing in cost, effort and how long the clock runs [16].

None of this is new behavior. JDK 17 stayed permissive through September 2024 and moved to OTN terms with the October 15, 2024 update [9]. The post dates the overlap rule's predictability to 2021 [17]. Its author writes that they have not personally run a fleet through this migration, and the post does not estimate how many teams pull Oracle's builds through a floating reference [5].

What to watch

  • A September-dated JDK 21 security update released under the NFTC would move the last free production build past 21.0.12.
  • The first Oracle audits of hosts running 21.0.13 in production will show whether billing is backdated the way the post describes.
  • Oracle's roadmap entry for JDK 25 will show whether the one-year overlap rule holds for the September 2027 LTS cycle.
Loading claim ledger
Loading source directory links
Loading share composer
Loading topic controls
Loading related stories