I’ve been building multi-agent systems on top of Spring AI and kept hitting the same wall: the framework gives you primitives, but you still write the orchestration, retries, state management — and more importantly, governance.
The real issue for me was trust.
One of my agents retried a paid API 23 times overnight because of a transient error. The retry logic worked technically, but it had no notion of cost, risk or approval boundaries.
So I built AgentFlow4J: a graph-based runtime for stateful multi-agent workflows in Java, focused on governed execution.
Agents are not trusted by default.
Current governance primitives:
ToolPolicy → allow/deny tool access per agent
StatePolicy → restrict writes to sensitive state keys
BudgetPolicy → cap spend per run/node/call (tokens, dollars, call counts)
ApprovalGate → pause for human approval and resume from checkpoint
Each policy is opt-in and defaults to a no-op.
The framework builds on Spring AI, ships with a Spring Boot starter, and can run fully offline via a deterministic sample (no API key required).
This is still early-stage (v0.6, solo project, not affiliated with Spring), and I’d genuinely appreciate feedback on:
API design
governance model
developer ergonomics
failure handling
No MCP integration yet.
No benchmark theatre either — the bottleneck is usually the LLM, not the orchestration layer.
Happy to answer questions or discuss design trade-offs.

GitHub repository in the comments

Is it normal to put domain logic inside setter methods in an Entity class? Or a bad idea?

For eg, I have a Domain Service that contains business validations and other domain logic. I also have Application Services that handle different use-case scenarios. Right now, my Entity has a public setStatus() method, which means anyone can call it and bypass the validations in the Domain Service. I cannot make setStatus() protected because the Entity and the Service are in different packages.

What’s the standard approach Spring developers usually follow here?
Do people typically move the logic into the setter/entity method instead of the Domain Service?

What if the logic really belongs in the Domain Service because it depends on external dependencies or other services?

Couple of days ago I shared what I learned about Spring AI's chat memory. Today, here's what happened when I swapped the model behind it entirely.

Same Spring AI app. Same Java code. Same ChatClient, same @Tool annotations, same BeanOutputConverter for structured output. The only thing that changed: which model handled the requests.

OpenAI (GPT-4o) → Anthropic Claude Opus 4→ local Gemma 4 2B running through LM Studio.

The OpenAI → Claude switch was expected to work. Swap the starter dependency, update the config block, ship. Spring AI's provider abstraction is designed for this.

The local Gemma 4 2B switch was the interesting part. Same Anthropic starter dependency, just pointed at localhost:1234:

spring:

application:

name: spring-ai

ai:

anthropic:

api-key: ${LM_STUDIO_API_KEY}

base-url: http://127.0.0.1:1234

chat:

options:

model: google/gemma-4-e2b

memory:

repository:

jdbc:

initialize-schema: always

That's the entire config delta. LM Studio implements the Anthropic protocol, so Spring AI treats it as just another Anthropic-compatible endpoint. No separate "spring-ai-local" starter. No conditional Java code paths.

What I didn't expect — the 2B local model handled:

- Chat with memory (the same ChatMemoryAdvisor + JDBC repository setup from yesterday's post)

- Structured JSON output matching strict schemas

- Tool calling with proper parameter dispatch

- Code review (correctly identified a == vs .equals() bug in a real Java example)

Quality wasn't quite GPT-4o level, but it was meaningful enough that for what's probably 70% of business AI use cases — classification, summarization, structured extraction, simple agent loops — this would work in production. With zero per-request cost and full offline operation.

Recorded a walkthrough showing all three providers running the same demos (chat, memory, structured output, tool calling, code review) if you prefer video: https://youtu.be/lW0FMjDUzik

Repo with code: https://github.com/DmitryFinashkin/spring-ai

Has anyone here shipped multi-provider Spring AI in production yet? Curious how teams are handling provider routing — cost-based, latency-based, quality fallback, regional compliance — and what failure modes you're watching for.

We had a stack debate on my team back in 2024 that ended with "fine, let's just run both and see." Same microservice, built twice — once in Spring Boot 3.2 / Java 21, once in Node 20 / Express. Same Postgres, same Redis, same AWS ECS setup. 18 months later I went through Cost Explorer and our time tracking.

Sharing the numbers in case anyone else is having this debate:

Infrastructure (18 months):

• Node.js: ~$10,890 (needed 1GB RAM/instance after month 3)
• Spring Boot: ~$5,490 (stayed at 512MB the whole time)

Developer time on production issues:

• Node.js: ~285 hours (memory leaks, npm breaking changes, async race conditions, audit fixes)
• Spring Boot: ~26 hours (dependency updates, one N+1, pool tuning)

Memory pattern that surprised me most: Node.js instances climbed 180MB → 890MB over 4 days, crashed, restarted. Staircase to hell. Traced to event listener leak in a popular npm package (2M weekly downloads). Spring Boot stayed flat at ~280MB the entire 18 months.

Under Black Friday load (10x normal traffic):

• Node.js: 3 instances OOM-crashed during peak. Cold start under load: 2.4s.
• Spring Boot: Zero crashes. Cold start under load: 4.1s (slower, but stable).

Not saying Node is bad. We kept it for internal admin tools and low-traffic stuff. But for customer-facing APIs that need to stay up 24/7, the JVM's 25 years of GC engineering paid for itself many times over.

Curious if anyone else has run this kind of side-by-side. Specifically interested in:

• Did virtual threads (Java 21) change your scaling math?
• Anyone tried Bun or Deno in this same comparison? Would they hold up better than Node?
• How much of the Node memory issue is npm ecosystem vs V8 itself?

Is spring cloud still relevant? Like spring cloud config, Eureka, cloud gateway? Or should i just learn K8s for services registery/discovery instead of Eureka, K8s's ConfigMap instead of Dedicated config server, i might stilll keep Spring Cloud Gateway, etc. And which one is mostly used in the industry?

Hey Folks!! 👋

While managing and monitoring financial transactions I found them pretty scattered to be kept track on. Different applications screwed through out.

Recently, I thought of solving it. So, I invite you to go through my Personal Finance Investment Platform (PFIP) but as a developer (🤫 as it's not production ready yet). Be a critique as and when needed.

This isn't just a "CRUD app" with microservices, there's real thought behind the JWT flow, the Redis caching layer, the per-service DB isolation, and the Angular interceptor/guard pattern that keeps the frontend clean and secure.

Drop your feedback below — what would you refactor? What's missing? All constructive thoughts welcome.

I got tired of manually diffing application-dev.yml against application-prod.yml before every deployment. So I built a small CLI to do it automatically — and then ran it against 50 well-known Spring Boot projects on GitHub to see how widespread the problem actually is.

The short version: 26 out of 50 projects had at least one issue.

The three patterns I kept seeing

1. The Actuator leak

# application-dev.yml
management.endpoints.web.exposure.include: "*"

Completely reasonable in dev. Dangerous when it drifts into prod. /actuator/env returns all your environment variables — including secrets. /actuator/heapdump lets anyone download a full JVM heap dump.

The Spring PetClinic — Spring's own reference application — ships with include: * as a default. 78 modules across the scanned projects had this.

2. The database schema destroyer

# application-dev.yml
spring.jpa.hibernate.ddl-auto: update

Convenient in dev. If it drifts into prod and your entity model changes, Hibernate silently modifies your production schema. No migration script, no warning. I've seen this kill a database.

3. The missing feature flag

# dev + staging: feature.new-payment-flow.enabled: true
# prod:          (key doesn't exist)

Spring Boot falls back to null. If you're lucky you get a NullPointerException at startup. If you're not, it silently disables a feature in production that worked fine in every test environment.

Why this is so hard to catch

Code review won't find it — you're looking at diffs, not at the relationship between files. Tests won't find it — they run against one profile. CI won't find it — the app starts fine.

The tool

I built spring-drift to catch this in CI or as a pre-deploy check:

$ spring-drift scan ./src/main/resources

✓ Found 4 profiles: default, dev, staging, prod
✗ 7 drift issues found

[DANGEROUS_DEFAULT] management.endpoints.web.exposure.include
  default:  health,info
  dev:      *
  prod:     *           ← matches dev — likely accidental

[DANGEROUS_DEFAULT] spring.jpa.hibernate.ddl-auto
  dev:      update
  prod:     update      ← destructive in production

[MISSING_KEY] feature.new-payment-flow.enabled
  dev:      true
  prod:     <missing>   ← will fall back to null

Report written to drift-report.md

Single binary via GraalVM Native Image (no JRE needed), ~26ms on a real project, outputs Markdown you can paste into a PR.

GitHub: https://github.com/jolle93/spring-boot-config-drift-detector

Docs + download: https://julianpaul.dev/spring-drift

Throughout the internet I see a lot of libraries for everything, and my question to you is - what is your way of implementing JWT authentication?

[supprimé]

I am experiencing an issue where my Spring Boot microservices fail to deregister from Eureka during a graceful shutdown. Because the deregistration HTTP request fails,

During shutdown, it seems the HTTP connection pool is closed before the DiscoveryClient attempts to send the final DELETE request to the Eureka server, resulting in an IllegalStateException: Connection pool shut down.

Could you help me understand how to configure my applications so that the deregistration completes successfully before the connection pools are destroyed?

Environment

Spring Boot: 3.2.1

Spring Cloud: 2023.0.0 (eureka-client 2.0.2)

Deployment: Docker Swarm (using stop-first update config)

Configuration

Eureka Server (application.yml):

```

yaml

spring:

application:

name: service-registry

cloud:

inetutils:

preferred-networks:

- XXX.XXX.XXX

eureka:

server:

eviction-interval-timer-in-ms: 60000

response-cache-update-interval-ms: 10000

client:

register-with-eureka: false

fetch-registry: false

service-url:

defaultZone: http://${eureka.instance.hostname}:${server.port}/eureka/

instance:

hostname: localhost

```

Eureka Client / Microservice (eureka-properties.yml via Config Server):

```

eureka:

client:

service-url:

defaultZone: ${EUREKA_SERVICE_ADDRESS:http://localhost:8761/eureka/}

register-with-eureka: true

fetch-registry: true

instance:

prefer-ip-address: true

instance-id: ${spring.application.name}:${spring.application.instance_id:${random.value}}

spring:

cloud:

inetutils:

preferred-networks:

- XXX.XXX.XXX

```

Shutdown Logs

Here are the logs during the shutdown of one of the microservices (order-service). It shows the sequence of events leading up to the failure:

```

13:50:42.773 INFO --- [ionShutdownHook] o.s.c.n.e.s.EurekaServiceRegistry : Unregistering application ORDER-SERVICE with eureka with status DOWN

13:50:42.773 INFO --- [ionShutdownHook] com.netflix.discovery.DiscoveryClient : Saw local status change event StatusChangeEvent [timestamp=1779112242773, current=DOWN, previous=UP]

13:50:42.773 INFO --- [nfoReplicator-0] com.netflix.discovery.DiscoveryClient : DiscoveryClient_ORDER-SERVICE/order-service:373b0e4bac...: registering service...

13:50:42.777 INFO --- [nfoReplicator-0] com.netflix.discovery.DiscoveryClient : DiscoveryClient_ORDER-SERVICE/order-service:373b0e4bac... - registration status: 204

13:50:42.781 INFO --- [ionShutdownHook] j.LocalContainerEntityManagerFactoryBean : Closing JPA EntityManagerFactory for persistence unit 'default'

13:50:42.782 INFO --- [ionShutdownHook] com.zaxxer.hikari.HikariDataSource : HikariPool-1 - Shutdown initiated...

13:50:42.786 INFO --- [ionShutdownHook] com.zaxxer.hikari.HikariDataSource : HikariPool-1 - Shutdown completed.

13:50:42.786 INFO --- [ionShutdownHook] com.netflix.discovery.DiscoveryClient : Shutting down DiscoveryClient ...

13:50:45.787 INFO --- [ionShutdownHook] com.netflix.discovery.DiscoveryClient : Unregistering ...

13:50:45.791 INFO --- [ionShutdownHook] c.n.d.s.t.d.RedirectingEurekaHttpClient : Request execution error. endpoint=DefaultEndpoint{ serviceUrl='http://registry-dev:8761/eureka/} exception=Connection pool shut down stacktrace=java.lang.IllegalStateException: Connection pool shut down

13:50:45.792 WARN --- [ionShutdownHook] c.n.d.s.t.d.RetryableEurekaHttpClient : Request execution failed with message: Connection pool shut down

13:50:45.793 ERROR --- [ionShutdownHook] com.netflix.discovery.DiscoveryClient : DiscoveryClient_ORDER-SERVICE/order-service:373b0e4bac... - de-registration failedCannot execute request on any known server

13:50:45.797 INFO --- [ionShutdownHook] com.netflix.discovery.DiscoveryClient : Completed shut down of DiscoveryClient

```

Is there a specific configuration I am missing to ensure the deregistration happens before the connection pools are closed? Any guidance on how to resolve this would be greatly appreciated.

I wants to do system design both hld and lld so suggest me some resources from where I do learned all this .

Some yt channel with great content for the same .

Hello,

Anyone here already deploy GraalVM compiled spring boot app in production?

What is you take?

Are you happy with it or is it still not recommended for prod?

The native image have to be tested for sure. how does it feel to have longer build time for native test. Is it the price to pay for efficient memory ?

Hey! I’ve started learning about Hexagonal Architecture and DDD, and I decided to make the jump from theory to practice.

So far, I’ve developed a microservice that I split into three layers: domain, application, and infrastructure. On the domain side, I created the aggregate along with its entities and Value Objects. From what I understand, ports should be the interfaces that handle communication with the domain, and they come in two types: input (driver) and output (driven). Use cases are supposed to act as orchestrators that implement the input ports and use the output ports to make operations possible end-to-end, without messing with the domain logic (I've read about the anemic domain model).

One thing that seems quite strange to me is on the input ports side, where many devs create a separate interface for every single operation. I understand the Interface Segregation Principle, but this kind of implementation feels a bit extreme. I would prefer to group all related operations into a single interface, much like you would do in a controller.

Another point of confusion is related to DTOs (Data Transfer Objects). First of all, a lot of the validation becomes redundant since it's already handled at the domain entity/VO level. Secondly, it feels bizarre not to use Value Objects inside my DTOs. Even though the AI suggested this could cause serialization issues, I don't see the point of just throwing properties in there and repeating everything manually.

The adapters part makes sense to me, though I don’t agree with the definition "implements the ports", except on the output side. On the input side, I see them more as the Adapter pattern, which basically makes two incompatible things compatible, acting as translators for REST, DBs, etc.

Also, should infrastructure entities simply reference VOs and other infrastructure entities, right? A lot of things, like addresses, are going to introduce redundancy at the entity level now. How is this usually handled?

Also, at the application layer, should ports practically be grouped by domain or mixed together? Same question for DTOs.

Given the discrepancies with what I read in articles/books/tutorials, maybe some of you have more practical experience and can tell me how you’ve seen these scenarios implemented correctly and scalably in production.

Thanks!

Most Spring Boot file upload tutorials look fine until you try more than a few users.

In production it’s a different story. Memory spikes, threads blocking, and the app basically choking when multiple large PDFs hit at once.

I stress tested uploads under real load and the “simple” MultipartFile approach starts showing all the ugly edges people skip in tutorials.

Curious what others ended up changing first when they hit upload bottlenecks in Spring Boot?

hello!! so i'm about to enter my first year of university in the US, and my university has a thing called "co-op" where you basically work as an intern of sorts for a company over a 6 month period (either one time or three times), and if they like you enough, they can hire you post-gdad. companies can range from small start-ups to big companies

i'd like to have like 1 or 2 spring boot backend projects before i start applying for co-ops (which will be in ~a year from now), but i'd like to have something that would make me stand out instead of some basic CRUD project. my dilemma is whether i would *have* to do something involving microservices, no matter what the project idea is (as it may look impressive or whatever), or if i have the freedom to choose depending on what my requirements are and it being built as a microservice or not is irrelevant. project ideas aren't exactly my worry tbh because i do have a few in mind and i could probably get some AI to help me with that if I get suuuper stuck; it's
more so that architectural decision yk... what do you think would be the smartest decision for me?

I am confused in both the courses Telesko industry ready course but it only gives microservices in recorded videos on the other hand anuj bhaiya Springboot cohort 5 gives hands on microservices project in cohort 5 which one to choose? Any suggestions?

I have been interviewing recently and noticed there is now an expectation for software engineers to know how to work effectively with AI tools like ChatGPT, Cursor, Copilot, Claude, etc.

Right now I mostly just prompt randomly and use them for generating code or debugging, but there seems to be a more structured way to use them during development — things like prompting properly, code reviews, refactoring, testing, documentation, and general development workflows.

Are there any good practical courses/resources for learning this from a software engineer perspective?