diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7e9fbc7ea..5e025cefe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ IMPROVEMENTS:
   * core: Batch jobs are garbage collected from the Nomad Servers [GH-586]
   * driver/rkt: Add support for CPU/Memory isolation [GH-610]
   * cli: Output of agent-info is sorted [GH-617]
+  * core: Node class constraint [GH-618]
 
 BUG FIXES:
   * cli: Handle parsing of un-named ports [GH-604]
diff --git a/client/driver/executor/exec_linux.go b/client/driver/executor/exec_linux.go
index 7b3cf4883..0648f3c2c 100644
--- a/client/driver/executor/exec_linux.go
+++ b/client/driver/executor/exec_linux.go
@@ -31,13 +31,14 @@ var (
 	// A mapping of directories on the host OS to attempt to embed inside each
 	// task's chroot.
 	chrootEnv = map[string]string{
-		"/bin":     "/bin",
-		"/etc":     "/etc",
-		"/lib":     "/lib",
-		"/lib32":   "/lib32",
-		"/lib64":   "/lib64",
-		"/usr/bin": "/usr/bin",
-		"/usr/lib": "/usr/lib",
+		"/bin":       "/bin",
+		"/etc":       "/etc",
+		"/lib":       "/lib",
+		"/lib32":     "/lib32",
+		"/lib64":     "/lib64",
+		"/usr/bin":   "/usr/bin",
+		"/usr/lib":   "/usr/lib",
+		"/usr/share": "/usr/share",
 	}
 )
 
diff --git a/client/driver/rkt.go b/client/driver/rkt.go
index 99084b5f8..19509f2ad 100644
--- a/client/driver/rkt.go
+++ b/client/driver/rkt.go
@@ -143,7 +143,7 @@ func (d *RktDriver) Start(ctx *ExecContext, task *structs.Task) (DriverHandle, e
 		d.logger.Printf("[DEBUG] driver.rkt: added trust prefix: %q", trustPrefix)
 	} else {
 		// Disble signature verification if the trust command was not run.
-		cmdArgs = append(cmdArgs, "--insecure-skip-verify")
+		cmdArgs = append(cmdArgs, "--insecure-options=all")
 	}
 
 	// Inject the environment variables.
diff --git a/scheduler/feasible.go b/scheduler/feasible.go
index 9e6782b19..1fb44269d 100644
--- a/scheduler/feasible.go
+++ b/scheduler/feasible.go
@@ -335,6 +335,9 @@ func resolveConstraintTarget(target string, node *structs.Node) (interface{}, bo
 	case "$node.name" == target:
 		return node.Name, true
 
+	case "$node.class" == target:
+		return node.NodeClass, true
+
 	case strings.HasPrefix(target, "$attr."):
 		attr := strings.TrimPrefix(target, "$attr.")
 		val, ok := node.Attributes[attr]
diff --git a/scheduler/feasible_test.go b/scheduler/feasible_test.go
index 84ad6d7ee..0f5bce508 100644
--- a/scheduler/feasible_test.go
+++ b/scheduler/feasible_test.go
@@ -112,11 +112,13 @@ func TestConstraintIterator(t *testing.T) {
 		mock.Node(),
 		mock.Node(),
 		mock.Node(),
+		mock.Node(),
 	}
 	static := NewStaticIterator(ctx, nodes)
 
 	nodes[0].Attributes["kernel.name"] = "freebsd"
 	nodes[1].Datacenter = "dc2"
+	nodes[2].NodeClass = "large"
 
 	constraints := []*structs.Constraint{
 		&structs.Constraint{
@@ -129,6 +131,11 @@ func TestConstraintIterator(t *testing.T) {
 			LTarget: "$attr.kernel.name",
 			RTarget: "linux",
 		},
+		&structs.Constraint{
+			Operand: "is",
+			LTarget: "$node.class",
+			RTarget: "large",
+		},
 	}
 	constr := NewConstraintIterator(ctx, static, constraints)
 
@@ -168,6 +175,12 @@ func TestResolveConstraintTarget(t *testing.T) {
 			val:    node.Name,
 			result: true,
 		},
+		{
+			target: "$node.class",
+			node:   node,
+			val:    node.NodeClass,
+			result: true,
+		},
 		{
 			target: "$node.foo",
 			node:   node,
diff --git a/website/source/docs/jobspec/index.html.md b/website/source/docs/jobspec/index.html.md
index f3c2a4435..b159ddc10 100644
--- a/website/source/docs/jobspec/index.html.md
+++ b/website/source/docs/jobspec/index.html.md
@@ -357,6 +357,10 @@ Below is a table documenting the variables that can be interpreted:
     <td>$node.name</td>
     <td>The client node name</td>
   </tr>
+  <tr>
+    <td>$node.class</td>
+    <td>The client node class</td>
+  </tr>
   <tr>
     <td>$attr.\<key\></td>
     <td>The attribute given by `key` on the client node.</td>