For an earlier discussion with folks at Oracle I ran jdeps analysis over the core Hadoop ecosystem and related projects that have notable or emerging user bases (in my opinion, some may debate...): Hadoop, ZooKeeper, Hive(+Tez), Pig, HBase, Oozie, Flume, Sqoop, Avro, Thrift, Accumulo, Cassandra, Crunch, Cascading, Elasticsearch, Giraph, Kafka, Mahout, Parquet, Optiq, Solr/Lucene, Spark, Storm. I picked recent releases except for HBase and Optiq, which I built from source. For Optiq because I could not find a binary distribution at the time. For HBase I used 0.99-SNAPSHOT because it has the new dependencies on Netty 4 and the LMAX Disruptor that will be in the upcoming 1.0 release. There are some common dependencies (Netty, Guava, Derby, the Scala runtime, Coda Hale's Metrics, LMAX Disruptor) that use internal sun.* APIs. We would need versions of these dependencies which do not make those calls available before we could eliminate internal API calls through this route. Other uses fall into a few common patterns. Daemons use Signal/SignalHandler for catching signals. Datastores such as HBase, Hive, and Cassandra are seeking their own high performance optimizations with Unsafe, including direct memory allocation. Avro and Kyro are serialization libraries seeking high performance via Unsafe on hot code paths. Hadoop and HBase utilize some security APIs for Kerberos and SSL which seem to have no non-internal API analogues. Pig and HBase pull in Jython and JRuby, respectively. Jython uses a bit of Unsafe. JRuby is an aggressive user of JVM internals.