Domino 14.5 is not supported on brand new Debian 13 (Trixie)
Daniel Nashed – 23 August 2025 09:38:07
Debian 13 (Trixie) shipped https://www.debian.org/News/2025/20250809
It comes with many packages updated to very recent versions.
One of the bigger changes is a very recent version of glibc 2.41.
There is a way to patch the affected binary. But it is not a good idea.
HCL will need to look into Debian 13 or glibc 2.41 support and you should not try to get this working on your own.
But because there people out there and post solutions and backgrounds anyhow.
Here are the details what is happening and why so that nobody needs to start speculating.
- Domino 14.5 ships JDK 21.0.6.
- Debian 13 ships JDK 21.0.8 which does not show the same error
But this glibc 2.41 might have other changes and this would need a complete new test in release.
Glibc is part of container images. This means running on a Debian 13 container host should still just work fine.
-- Daniel
Error message on Domino
Here is the error message you already see when invoking the java -version command and it makes the HTTP Task fail to load.
opt/hcl/domino/bin/java -version
JVMJ9VM011W Unable to load j9jit29: /opt/hcl/domino/notes/14050000/linux/jvm/lib/default/libj9jit29.so: cannot enable executable stack as shared object requires: Invalid argument
openjdk version "21.0.6" 2025-01-21 LTS
IBM Semeru Runtime Open Edition 21.0.6.0 (build 21.0.6+7-LTS)
Eclipse OpenJ9 VM 21.0.6.0 (build openj9-0.49.0, JRE 21 Linux amd64-64-Bit Compressed References 20250121_380 (JIT disabled, AOT disabled)
OpenJ9 - 3c3d179854
OMR - e49875871
JCL - e01368f00df based on jdk-21.0.6+7)
Debian 13 shipped Java 21 version
java -version
openjdk version "21.0.8" 2025-07-15
OpenJDK Runtime Environment (build 21.0.8+9-Debian-1)
OpenJDK 64-Bit Server VM (build 21.0.8+9-Debian-1, mixed mode, sharing)
Problem description and background
The problem turns out to be a problem with a change in glibc 2.41.
https://unix.stackexchange.com/questions/792460/dlopen-fails-after-debian-trixie-libc-transition-cannot-enable-executable-st
-- snip --
This is indeed a glibc change: in version 2.41, which migrated to Debian 13 on March 13 (replacing 2.40), dlopen no longer allows libraries requiring executable stacks to be loaded if the stack is not already executable:
dlopen and dlmopen no longer make the stack executable if a shared library requires it, either implicitly because of a missing GNU_STACK ELF header (and default ABI permission having the executable bit set) or explicitly because of the executable bit in GNU_STACK, and the stack is not already executable. Instead, loading such objects will fail.
-- snip --
There is a way to patch the affected binary. But this is not something I would advice you to use.
How to patch the affected binary
The shared lib is the only binary that needs to get patched -- from what it looks lilke.
I have just done a very basic test.
execstack -q /opt/hcl/domino/notes/14050000/linux/jvm/lib/default/libj9jit29.so
How to get the execstack on Debian 13
The execstack package has been removed and is not available on Debian 13
The following way works. But this isn't anything I would like to a Docker build pipeline nor would do in production without support.
apt-get update
apt-get install -y --no-install-recommends wget ca-certificates libelf1 libselinux1
wget -O /tmp/execstack.deb https://archive.ubuntu.com/ubuntu/pool/universe/p/prelink/execstack_0.0.20130503-1.1_amd64.deb
dpkg -i /tmp/execstack.deb
execstack -V || true
- Comments [0]
![[HCL Domino]](../lotus-domino.gif){kind=small}
![[Domino on Linux]](../domino-linux.gif){kind=small}
![[Nash!Com]](../nashcom.gif){kind=small}
![[Daniel Nashed]](../daniel-nsh.gif){kind=small}