Use the Raw Fork/Exec task driver in a job

Name: raw_exec

The raw_exec driver is used to execute a command for a task without any isolation. Further, the task is started as the same user as the Nomad process. As such, it should be used with extreme care and is disabled by default.

Refer to Configure the Raw Fork/Exec task driver for capabilities, client requirements, and plugin configuration.

Task configuration

task "webservice" {
  driver = "raw_exec"

  config {
    command = "my-binary"
    args    = ["-flag", "1"]
  }
}

The raw_exec driver supports the following configuration in the job spec:

command - The command to execute. Must be provided. If executing a binary that exists on the host, the path must be absolute. If executing a binary that is downloaded from an artifact, the path can be relative from the allocation's root directory.
args - (Optional) A list of arguments to the command. References to environment variables or any interpretable Nomad variables will be interpreted before launching the task.
cgroup_v1_override - (Optional) A map of controller names to paths. The task will be added to these cgroups. The task will fail if these cgroups do not exist. WARNING: May conflict with other Nomad driver's cgroups and have unintended side effects.
cgroup_v2_override - (Optional) Adds the task to a unified cgroup path. Paths may be relative to the cgroupfs root or absolute. WARNING: May conflict with other Nomad driver's cgroups and have unintended side effects.

On Linux, you cannot set the task.user field on a task using the raw_exec driver if you have hardened the Nomad client according to the production guide. On Windows, when Nomad is running as a system service, you may specify a less-privileged service user. For example, NT AUTHORITY\LocalService, NT AUTHORITY\NetworkService.

oom_score_adj - (Optional) A positive integer to indicate the likelihood of the task being OOM killed (valid only for Linux). Defaults to 0.
work_dir - (Optional) Sets a custom working directory for the task. This must be an absolute path. This will also change the working directory when using nomad alloc exec.
denied_envvars - (Optional) Passes a list of environment variables that the driver should scrub from the task environment. Supports globbing, with "*" wildcard accepted as prefix and/or suffix.

Examples

To run a binary present on the Node:

task "example" {
  driver = "raw_exec"
 
  config {
    # When running a binary that exists on the host, the path must be absolute/
    command = "/bin/sleep"
    args    = ["1"]
  }
}

To execute a binary downloaded from an artifact:

task "example" {
  driver = "raw_exec"
 
  config {
    command = "name-of-my-binary"
  }
 
  artifact {
    source = "https://internal.file.server/name-of-my-binary"
    options {
      checksum = "sha256:abd123445ds4555555555"
    }
  }
}