A Field Guide to Java Web Frameworks and Tooling

The following are technologies I've learned about and tried out at work and in my own studies, recorded here for reference.

The reason for writing this list is simple: the Java Web ecosystem is huge. From a monolith at the start, through microservices, containerization, monitoring and alerting, every layer has multiple viable options. Encountering them piecemeal, after a while I could only remember the names, not what each one was for. So I'm gathering them in one place, with each entry stating clearly "what it is and what problem it solves", so that next time I'm making a technology decision I can just flip to this page instead of searching from scratch. The list roughly follows the order "development frameworks → data layer → microservice governance → infrastructure → big data and tooling".

SpringBoot, Spring-cloud, Spring-cloud-alibaba — the whole Spring family. SpringBoot uses auto-configuration and starter dependencies to shrink configuration to a minimum, and is the default starting point for Java projects today; Spring Cloud layers microservice capabilities on top — service registration, configuration, gateways; Spring Cloud Alibaba plugs domestic-ecosystem components like Nacos, Sentinel, and Seata into the same set of abstractions.

MyBatis-Plus (optimistic locking, automatic pagination, code generator for service, mapper, entity, controller, custom generation templates). It fills in generic CRUD on top of MyBatis, so single-table operations rarely need hand-written SQL; the code generator with custom templates lets you scaffold full CRUD for a new table in minutes.

JOOQ: a Java ORM framework. Its philosophy is the opposite of MyBatis — build SQL with a type-safe Java DSL, so misspelled columns are caught at compile time. A good fit when SQL logic is complex and you want strong typing guarantees.

Uid-generator: Baidu's UID generator (distributed snowflake algorithm, globally unique Long-typed UIDs). Once you shard databases and tables, auto-increment primary keys stop working. The snowflake algorithm assembles a roughly monotonic Long ID from "timestamp + machine bits + sequence number" — globally unique and index-friendly.

Xxl-job: a distributed task scheduling center. It solves the two classic problems of single-machine cron jobs: tasks vanish when the machine dies, and multi-instance deployments run them twice. It separates the scheduler from the executors, with a built-in admin UI, failure retries, and sharded execution.

Apache-Shiro, Spring-Security: login/security frameworks. Both cover authentication and authorization. Shiro is lightweight and quick to pick up; Spring Security is more feature-complete and more deeply integrated with the Spring ecosystem, but its configuration curve is steeper.

Druid (Alibaba), HikariCP: common database connection pools. The point of a pool is reusing database connections and avoiding constant handshakes. Druid ships with SQL monitoring and anti-injection statistics pages; HikariCP is known for raw performance and is SpringBoot's default choice.

Bcrypt: a password hashing scheme for user passwords in the database. It's a slow hash, and salting produces a different result every time — even if the database is exfiltrated, rainbow-table attacks at scale are impractical. Far more trustworthy than storing raw MD5/SHA hashes.

JWT: a spec/strategy for generating temporary tokens. User information is signed and embedded in the token itself, so the server keeps no session state — a natural fit for horizontal scaling across instances. The cost: once issued, a token can't be actively revoked; you fall back on short lifetimes or a blacklist.

Undertow, Tomcat, Jboss, Weblogic: Servlet containers. Tomcat is the most universal; Undertow is NIO-based with a small memory footprint, often swapped in as SpringBoot's embedded container; JBoss and Weblogic are heavier commercial application servers.

Eolinker, Swagger, Knife4j, Yapi: online API documentation and automated testing tools. Their core value is generating docs automatically from code annotations so they stay in sync with the code — avoiding the classic frontend/backend finger-pointing over "the docs don't match the API". Knife4j is a Chinese-made enhanced skin for Swagger.

MySQL 8.0, PostgreSQL: relational databases (RDS). The primary store for business data. MySQL has the richest ecosystem and documentation; PostgreSQL is more feature-complete and performs better in scenarios like JSON and GIS.

Sqlite: an embedded database. The entire database is a single file with no separate process needed — good for client-side local storage and small tools.

Redis, MongoDB: non-relational (NoSQL) databases. Redis is in-memory, commonly used for caching, distributed locks, and counters; MongoDB is a document database with a flexible schema, suited to data whose structure keeps changing.

Dobbo, Feign: remote method invocation. Both make cross-service calls read like local method calls. Dubbo uses a custom protocol over long-lived connections and performs well; Feign is HTTP-based with declarative interfaces, and pairs more naturally with the Spring Cloud stack.

Sentinel, Hystrix: rate limiting and degradation. These are a microservice's self-preservation tools: when upstream traffic exceeds capacity, rate-limit first; when a downstream dependency dies, fail fast and fall back to degraded logic, so threads don't get dragged down and the failure doesn't cascade along the call chain — the so-called avalanche. Hystrix has stopped new feature development; new projects generally pick Sentinel.

Skywalking: distributed tracing (developed at Huawei, donated to Apache). Through Java Agent bytecode instrumentation, with zero intrusion into business code, it can draw the complete call chain of a request across multiple services — extremely intuitive when hunting down "which hop is slow".

Zookeeper, Eureka, Consul, Nacos, Etcd: registry and configuration centers. A service registry solves "service instance addresses keep changing — how do callers find them"; a config center solves "changing config requires a restart". Nacos combines both and is the default choice in the Spring Cloud Alibaba stack; Etcd is the underlying store for Kubernetes.

Seata: Alibaba's distributed transaction solution. When one business operation spans multiple databases or services, local transactions can't guarantee overall consistency. Seata's AT mode records rollback logs automatically through a proxied data source, with minimal intrusion into business code.

ELK: distributed log collection, data aggregation, distributed search engine. That is, the Elasticsearch + Logstash + Kibana combo: collect logs from every node into central storage, then query them with full-text search and a visualization UI. Once you have more than a few services, troubleshooting without centralized logs is basically impossible.

Micrometer, Prometheus, Grafana: service health monitoring, data monitoring, IO monitoring, and so on. Micrometer exposes metrics on the application side, Prometheus scrapes them on a schedule and stores them as time series, and Grafana handles charts and alerting dashboards — currently the most common monitoring trio.

Kafka, RabbitMQ, RocketMQ: common message queues — peak shaving, decoupling, async processing. Producers just publish and consumers process at their own pace, with traffic spikes landing in the queue first to be digested gradually. Kafka has the highest throughput and leans toward log and stream-processing scenarios; RabbitMQ has flexible routing; RocketMQ is more complete on transactional and delayed messages.

Nginx, apache-http-service, Traefik: HTTP servers. Beyond static asset hosting, they more often serve as reverse proxies and layer-7 load balancers; Traefik can auto-discover containers and update routing rules, making it a better fit for container environments.

Ali-OSS, HUAWEI-OBS: third-party static asset storage. Putting images and attachments in object storage instead of the application server's disk is both lower-maintenance and easier to pair with CDN acceleration.

Ali-NAS: intranet shared file storage mounts — a shared disk on the internal network. When multiple machines need to read and write the same files, mounting NAS beats running your own NFS by a fair margin of ops work.

Ali-SLB: layer-4/layer-7 load balancer. The first layer at the traffic entrance: layer 4 forwards TCP, layer 7 can route by domain and path; Nginx and the application usually come after it.

Findbugs, Sonarqube: static code analysis. They can flag null-pointer risks, unclosed resources, and similar issues without running the code; SonarQube also hooks into CI, using quality gates to block substandard commits.

PDMan: a database visualization tool built by Chinese developers. Used to draw ER diagrams, version table schemas, and export DDL — far more reliable than verbal agreements about table structure when collaborating in a team.

Docker, Containerd, CRI-O: common container runtimes. Containers package an application and its dependencies into one image, largely eliminating "works on my machine". Containerd and CRI-O are lower-level runtimes that Kubernetes talks to directly via the CRI interface.

Docker-Compose: a container orchestration tool. One YAML file describes multiple containers' images, ports, and dependencies; one command brings up the whole local environment — very handy for development and integration testing.

Kubernetes: container orchestration, operations, resource management, resource scheduling — one-stop management. Its core idea is declarative: you describe the desired state, and it handles scheduling, scaling, and self-healing, continuously converging actual state toward desired state. It's the de facto standard for production container orchestration.

Istio: a popular service mesh framework, enabling polyglot backend development with traffic control, degradation, and circuit breaking. A service mesh pushes governance logic — rate limiting, circuit breaking, canary releases — out of business code and down into sidecar proxies, so services written in different languages share the same governance capabilities.

Helm: application/resource management middleware for K8S. Effectively Kubernetes's package manager: it templates a pile of YAML into a Chart, and one command handles install, upgrade, and rollback.

Ali-EsayExcel: Alibaba's open-source high-efficiency Excel jar. Built to address POI's tendency to run out of memory on large files, with streaming read/write optimizations — importing and exporting hundreds of thousands of rows stays stable.

Netty: the go-to Java NIO networking library. It wraps NIO's fiddly Selector and Buffer details into an event-driven Pipeline model, and serves as the network-layer foundation of many RPC frameworks and middleware.

Disruptor: a high-performance in-memory queue (developed by LMAX, a UK forex trading firm). It preallocates memory with a ring buffer and avoids lock contention and false sharing, pushing single-machine inter-thread message latency extremely low.

Caffeine: a high-performance in-process JVM cache, built on Disruptor underneath. As an in-process cache, access never touches the network; it's often paired with Redis in a two-tier setup — local cache absorbs hotspots, Redis guarantees shared state.

Jenkins: CI/CD middleware — automated releases and pipeline production. It chains pulling code, compiling, testing, building images, and deploying into a pipeline that runs automatically on every commit, shrinking the room for error in manual releases.

Apahce-Hdoop: distributed big-data storage and processing. Hadoop's HDFS splits large files into blocks stored redundantly across machines, while MapReduce computes near where the data lives — the old bedrock of the big-data stack.

Apahce-Flink: a stream-processing framework, suited to near-real-time computation in big data. It pushes computation onto the data stream itself — events are processed as they arrive — with state management and exactly-once semantics. Commonly used for real-time reporting and real-time risk control.

MyCat2, Apache-Shardingsphere: sharding middleware. When a single table grows too large for queries to keep up, you shard horizontally; the middleware parses SQL, routes it to the right shard, and merges results, keeping the application as oblivious as possible.

TiDB, KunlunBase: NewSQL distributed relational databases. A different angle on the same problem: make the database itself distributed, stay MySQL-protocol compatible, and scale out without the application ever touching sharding rules.

Arthas: Alibaba's open-source JVM diagnostic tool — flame graph generation, deadlock diagnosis, and more. Without restarting or changing code, you can attach to a live JVM to inspect method timings, decompile classes, and trace calls — a lifesaver for hard production issues.

Kettle, DataX, Canal: open-source ETL tools for data migration and cleansing. The first two do batch extract-and-transform; Canal is the odd one out — it masquerades as a MySQL replica and parses the binlog to capture real-time incremental changes, commonly used for cache synchronization and heterogeneous data sync.

Jmeter: the standard tool for API testing and load testing. Run a load test before going live to learn an API's throughput ceiling and response-time distribution — so your rate-limit thresholds are grounded in data instead of guesswork.

Ansible: a multi-server operations tool. SSH-based with no agent needed on target machines; describe the desired state in YAML and execute in bulk — changing one config across dozens of machines without logging into each one.

Pitfalls and Notes

• A list is not a selection. For components at the same layer (say, Sentinel vs Hystrix, Eureka vs Nacos), you only need one. Piling everything from this list into a project just increases maintenance cost.
• Prefer following an ecosystem. If you're on Spring Cloud Alibaba, then registry, rate limiting, and distributed transactions naturally go to Nacos, Sentinel, and Seata; mix components from different ecosystems and you own the compatibility problems yourself.
• Watch a component's maintenance status. The ecosystem turns over quickly — for projects in maintenance mode like Hystrix, new systems should steer clear and pick alternatives with actively iterating communities.
• Every distributed component carries operational cost. Kafka, Elasticsearch, and Kubernetes each deserve a dedicated person to study them; small teams should figure out who will maintain a component before adopting it.

Wrapping Up

This list covers the rough landscape of a Java Web project, from development frameworks and data storage through microservice governance to containerization and big data. The point of recording it isn't to use everything, but to know — when a concrete problem shows up — what off-the-shelf options exist and where each one fits. The ecosystem keeps evolving, and this page will keep being amended and corrected along with real-world use.