It should also work with the newest version of Db2. If not, then there wa some change inbetween we have to take care of. Usually there are no big changes.
Flicking the DB2_SECCOMP_ENABLE switch will have an effect only with Db2 12.1.x but not with Db2 11.5.x.
Original Message:
Sent: Wed November 05, 2025 03:42 AM
From: Mariusz Lewandowski
Subject: Problem with calling Docker DB2 user defined function.
Hi @Roland Schock,
Actually I don't need the newest DB2 version. I tried with DB2_SECCOMP_ENABLE with ON/OFF but didn't help.
But I have downgraded the image to 11.5.4.0 and the script from Mark it seems to work!
I will try to set up complete DB with liquibase scripts on this version and will see if it's going to work eventually.
[db2inst1@db2server ~]$ ./make-all.sh
added manifest
adding: com/(in = 0) (out= 0)(stored 0%)
adding: com/company/(in = 0) (out= 0)(stored 0%)
adding: com/company/EncryptString.class(in = 309) (out= 212)(deflated 31%)
Database Connection Information
Database server = DB2/LINUXX8664 11.5.4.0 <------- this is the version I have used
SQL authorization ID = DB2INST1
Local database alias = DB
call sqlj.install_jar('file:/database/config/db2inst1/my_jar.jar', 'MY_SCHEMA.ENCRYPTIONJAR')
DB20000I The CALL command completed successfully.
call sqlj.replace_jar('file:/database/config/db2inst1/my_jar.jar', 'MY_SCHEMA.ENCRYPTIONJAR')
DB20000I The CALL command completed successfully.
call sqlj.refresh_classes()
DB20000I The CALL command completed successfully.
CREATE OR REPLACE FUNCTION ENCRYPT_STRING_NON_DETERMINISTIC(VARCHAR(128))
RETURNS VARCHAR(128)
EXTERNAL NAME 'MY_SCHEMA.ENCRYPTIONJAR:com.company.EncryptString.encryptString'
NO SQL PARAMETER STYLE java LANGUAGE java
RETURNS NULL ON NULL INPUT NO EXTERNAL ACTION NOT DETERMINISTIC
DB20000I The SQL command completed successfully.
1
--------------------
test string
1 record(s) selected.
------------------------------
Mariusz Lewandowski
Original Message:
Sent: Wed November 05, 2025 01:01 AM
From: Roland Schock
Subject: Problem with calling Docker DB2 user defined function.
All the above: too long, did not read. But are you aware of these two new security features of Db2 V12.1.x?
To me it sounds pretty much like you've hit by the changes.
https://www.ibm.com/docs/en/db2/12.1.0?topic=routines-mon-get-connection-get-connection-metrics
And just in case, have you set DB2_SECCOMP_ENABLE? See second entry on https://www.ibm.com/docs/en/db2/12.1.0?topic=121-security-enhancements
------------------------------
Roland Schock
IBM Champion and IBM Gold Consultant
Original Message:
Sent: Tue November 04, 2025 03:56 AM
From: Mariusz Lewandowski
Subject: Problem with calling Docker DB2 user defined function.
Ok so now:
- I have removed all containers
- I have removed all volumes
- I set up new and fresh container
my .envlist:
% cat .env_list
LICENSE=accept
DB2INSTANCE=db2inst1
DB2INST1_PASSWORD=db2inst1
DBNAME=BOADB
BLU=false
ENABLE_ORACLE_COMPATIBILITY=false
UPDATEAVAIL=NO
TO_CREATE_SAMPLEDB=true
REPODB=false
IS_OSXFS=true
PERSISTENT_HOME=true
HADR_ENABLED=false
ETCD_ENDPOINT=
ETCD_USERNAME=
ETCD_PASSWORD=
docker run -h db2server --name db2 --restart=always --detach --privileged=true -p 50000:50000 --env-file .env_list -v db_data:/database -v /Users/itml/Developer/cos/:/liquibase-db icr.io/db2_community/db2
And the files I have created in /tmp dir as db2inst1. Still same problem.
Could it be because of my .env_list settings? Docker settings?
In Docker settings I have:
Apple Virtualization Framework
Use Rosetta for x86/64 emulation on Apple Silicon
Filesystem VirtioFs
------------------------------
Mariusz Lewandowski
Original Message:
Sent: Mon November 03, 2025 01:36 PM
From: Mark Barinstein
Subject: Problem with calling Docker DB2 user defined function.
Let's create a smoke test of UDF creation.
Place the following files into some empty directory inside the container as db2inst1.
make-all.sh
PATH="${PATH}:${DB2_HOME}/java/jdk64/bin"
JAR_FILE="my_jar.jar"
JAR_ID="MY_SCHEMA.ENCRYPTIONJAR"
CLASSES="classes"
[ -d "${CLASSES}" ] || mkdir "${CLASSES}"
javac -d "${CLASSES}" EncryptString.java
jar -cvf "${JAR_FILE}" -C "${CLASSES}" .
db2 connect to sample
# One of these 2 must fail - it's expected
db2 -v "call sqlj.install_jar('file:${PWD}/${JAR_FILE}', '${JAR_ID}')"
db2 -v "call sqlj.replace_jar('file:${PWD}/${JAR_FILE}', '${JAR_ID}')"
db2 -v "call sqlj.refresh_classes()"
db2 +p -tv - <<EOF
CREATE OR REPLACE FUNCTION ENCRYPT_STRING_NON_DETERMINISTIC(VARCHAR(128))
RETURNS VARCHAR(128)
EXTERNAL NAME '${JAR_ID}:com.company.EncryptString.encryptString'
NO SQL PARAMETER STYLE java LANGUAGE java
RETURNS NULL ON NULL INPUT NO EXTERNAL ACTION NOT DETERMINISTIC
;
EOF
db2 "values ENCRYPT_STRING_NON_DETERMINISTIC('test string')::VARCHAR(20)"
EncryptString.java
package com.company;
public class EncryptString
{
public static String encryptString(String p_str)
{
return p_str;
}
}
The function just returns a value of the parameter passed.
Change the database name (SAMPLE) if you have another one.
Run it:
chmod +x make-all.sh
./make-all.sh
Does it work?
------------------------------
Mark Barinstein
Original Message:
Sent: Mon November 03, 2025 01:01 PM
From: Mariusz Lewandowski
Subject: Problem with calling Docker DB2 user defined function.
Regarding container creation, here is the command:
docker run -h db2server --name db2 --restart=always --detach --privileged=true -p 50000:50000 --env-file .env_list -v db_data:/database -v /Users/itml/Developer/liquibase/:/liquibase-db
I will try with your suggestion about permissions.
------------------------------
Mariusz Lewandowski
Original Message:
Sent: Mon November 03, 2025 11:55 AM
From: Florian Boldt
Subject: Problem with calling Docker DB2 user defined function.
How did you create the container?
# docker-compose.yml
volumes: - db2_data:/database
# or user-Mapping (UIDs/GIDs)
user: "1000:1000" # set UIDs
you can try to correct the ownership explicitly:
chown -R db2inst1:db2iadm1 /home/db2inst1/sqllib
chown -R db2fenc1:db2fadm1 /home/db2fenc1/sqllib
chmod -R 755 /home/db2inst1/sqllib
------------------------------
Florian Boldt
Original Message:
Sent: Mon November 03, 2025 11:11 AM
From: Mariusz Lewandowski
Subject: Problem with calling Docker DB2 user defined function.
According to ChatGPT - DB2 for Docker is stripped from some functionalities, e.g. FENCED.
That's why when I queried:
db2 get dbm cfg | grep -i FENCED
Server Plugin Mode (SRV_PLUGIN_MODE) = UNFENCED
Keep fenced process (KEEPFENCED) = YES
Number of pooled fenced processes (FENCED_POOL) = AUTOMATIC(MAX_COORDAGENTS)
Initial number of fenced processes (NUM_INITFENCED) = 0
It didn't returned FENCED key with user. Also I cannot update DB2 configuration with pointing out the fenced username.
Could it be right answer?
------------------------------
Mariusz Lewandowski
Original Message:
Sent: Mon November 03, 2025 07:25 AM
From: Madhusudan S M
Subject: Problem with calling Docker DB2 user defined function.
What are the current os permissions on DB2 database-related files and directories, including the sqllib directory and the db2fmp executable file?
------------------------------
Madhusudan S M
Original Message:
Sent: Mon November 03, 2025 07:02 AM
From: Mariusz Lewandowski
Subject: Problem with calling Docker DB2 user defined function.
Yes, and the JAR file cannot be run right now from command line.
But if I call the UDF from SQL Client it throws:
SQL Error [ ]: A routine failed because the fenced user ID cannot access required files in the sqllib directory or other instance or database directories.. SQLCODE=-1646, SQLSTATE= , DRIVER=4.35.11
------------------------------
Mariusz Lewandowski
Original Message:
Sent: Mon November 03, 2025 06:55 AM
From: Madhusudan S M
Subject: Problem with calling Docker DB2 user defined function.
Did you Rebuild and Redeploy Docker DB2 Container after updating Docker Image to use JDK version 21 ?
------------------------------
Madhusudan S M
Original Message:
Sent: Mon November 03, 2025 04:37 AM
From: Mariusz Lewandowski
Subject: Problem with calling Docker DB2 user defined function.
Updated the JDK to newer version but that also didn't help..
------------------------------
Mariusz Lewandowski
Original Message:
Sent: Sun November 02, 2025 11:20 PM
From: Mariusz Lewandowski
Subject: Problem with calling Docker DB2 user defined function.
Hi,
Create function:
CREATE FUNCTION ENCRYPT_STRING_NON_DETERMINISTIC(VARCHAR(128)) RETURNS VARCHAR(128) EXTERNAL NAME 'MY_SCHEMA.ENCRYPTIONJAR:com.company.encryptString' NO SQL PARAMETER STYLE java LANGUAGE java RETURNS NULL ON NULL INPUT NO EXTERNAL ACTION NOT DETERMINISTIC
This command returned nothing:
sh-5.1# sudo -u db2fenc1 test -r ~db2inst1/sqllib/function/jar/DB/SYSTEM/MS/ENCRYPTIONJAR.jar
sh-5.1#
What I have found:
Error: Unable to initialize main class com.company.DatabaseCrypto
Caused by: java.lang.UnsupportedClassVersionError: com/.../CryptoService has been compiled by a more recent version of the Java Runtime (class file version 65.0), this version of the Java Runtime only recognizes class file versions up to 55.0
I will change the version of JDK inside the container and will report back!
------------------------------
Mariusz Lewandowski
Original Message:
Sent: Sun November 02, 2025 02:56 PM
From: Mark Barinstein
Subject: Problem with calling Docker DB2 user defined function.
What's the jar or class file supporting namely this function?
What's the exact CREATE FUNCTION statement?
Can you show the return code of the following command namely for this particular jar or class file *inside the container*?
sudo -u db2fenc1 test -r ~db2inst1/sqllib/function/<path/to/jar_or_class_file>
------------------------------
Mark Barinstein
Original Message:
Sent: Sun November 02, 2025 10:25 AM
From: Mariusz Lewandowski
Subject: Problem with calling Docker DB2 user defined function.
Hi @Mark Barinstein,
Thanks for answer.
I found the jar files in sqllib/function/jars and changes their ownership to:
db2fenc1:db2fadm1 (also tried group db2adm1)
but it didn't help.
I suspect this problem might be related to the issue of Docker image where I had to invoke this:
chown root:db2iadm1 /database/config/<user>/sqllib/adm/fencedid
I also tried with chmod +x for JAR files but also didn't help. Restarting Docker container wasn't helpful as well.
------------------------------
Mariusz Lewandowski
Original Message:
Sent: Sun November 02, 2025 04:00 AM
From: Mark Barinstein
Subject: Problem with calling Docker DB2 user defined function.
It's an external JAVA function, and you must find the jar/class file (probably with the CLASS, JAR_ID, JARSCHEMA columns of the same query above).
Once you find this file in the `~db2inst1/sqllib/function` directory (or in some its subdirectories), make sure that this file is readable by the `db2fenc1` user.
------------------------------
Mark Barinstein
Original Message:
Sent: Sat November 01, 2025 09:36 AM
From: Mariusz Lewandowski
Subject: Problem with calling Docker DB2 user defined function.
Hi @Mark Barinstein,
Your query returns value in IMPLEMENTATION:
encryptStringDeterministic(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;
------------------------------
Mariusz Lewandowski
Original Message:
Sent: Thu October 23, 2025 02:53 AM
From: Mark Barinstein
Subject: Problem with calling Docker DB2 user defined function.
Hello,
What's the result of the following query?
SELECT IMPLEMENTATION
FROM SYSCAT.ROUTINES
WHERE ROUTINESCHEMA NOT LIKE 'SYS%' AND ROUTINENAME = 'ENCRYPT_STRING' AND ORIGIN = 'E'
------------------------------
Mark Barinstein
Original Message:
Sent: Wed October 22, 2025 10:23 AM
From: Mariusz Lewandowski
Subject: Problem with calling Docker DB2 user defined function.
Hello,
I have problem with calling user defined function.
The function is custom defined and the function calls Java function from installed JAR.
When running functions it says about fenced user.
UPDATE EMPLOYER SET PESEL = ENCRYPT_STRING(PESEL);
Response:
SQL Error [ ]: A routine failed because the fenced user ID cannot access required files in the sqllib directory or other instance or database directories.. SQLCODE=-1646, SQLSTATE= , DRIVER=4.35.11
i checked and jars are somewhere in database/…/sqllib directory.
Is it permission problem ? If so what to change?
I am using Mac OS on Apple M1 chip and DB2 goes in Docker image - 12.1.
------------------------------
Mariusz Lewandowski
------------------------------