Nomad
Use the Raw Fork/Exec task driver in a job
Name: raw_exec
The raw_exec
driver is used to execute a command for a task without any
isolation. Further, the task is started as the same user as the Nomad process.
As such, it should be used with extreme care and is disabled by default.
Refer to Configure the Raw Fork/Exec task driver for capabilities, client requirements, and plugin configuration.
Task configuration
task "webservice" {
driver = "raw_exec"
config {
command = "my-binary"
args = ["-flag", "1"]
}
}
The raw_exec
driver supports the following configuration in the job spec:
command
- The command to execute. Must be provided. If executing a binary that exists on the host, the path must be absolute. If executing a binary that is downloaded from anartifact
, the path can be relative from the allocation's root directory.args
- (Optional) A list of arguments to thecommand
. References to environment variables or any interpretable Nomad variables will be interpreted before launching the task.cgroup_v1_override
- (Optional) A map of controller names to paths. The task will be added to these cgroups. The task will fail if these cgroups do not exist. WARNING: May conflict with other Nomad driver's cgroups and have unintended side effects.cgroup_v2_override
- (Optional) Adds the task to a unified cgroup path. Paths may be relative to the cgroupfs root or absolute. WARNING: May conflict with other Nomad driver's cgroups and have unintended side effects.
On Linux, you cannot set the task.user
field on a task using the raw_exec
driver if you have hardened the Nomad client according to the
production guide. On Windows, when Nomad is running as a system
service, you may specify a less-privileged service user. For example,
NT AUTHORITY\LocalService
, NT AUTHORITY\NetworkService
.
oom_score_adj
- (Optional) A positive integer to indicate the likelihood of the task being OOM killed (valid only for Linux). Defaults to 0.work_dir
- (Optional) Sets a custom working directory for the task. This must be an absolute path. This will also change the working directory when usingnomad alloc exec
.denied_envvars
- (Optional) Passes a list of environment variables that the driver should scrub from the task environment. Supports globbing, with "*" wildcard accepted as prefix and/or suffix.
Examples
To run a binary present on the Node:
task "example" {
driver = "raw_exec"
config {
# When running a binary that exists on the host, the path must be absolute/
command = "/bin/sleep"
args = ["1"]
}
}
To execute a binary downloaded from an artifact
:
task "example" {
driver = "raw_exec"
config {
command = "name-of-my-binary"
}
artifact {
source = "https://internal.file.server/name-of-my-binary"
options {
checksum = "sha256:abd123445ds4555555555"
}
}
}