mirror of
https://github.com/kemko/nomad.git
synced 2026-01-02 16:35:44 +03:00
d305f32017
* create plugin author guide; remove concepts/plugins * style guide; update links * update cni redirect * move host-volume plugin to /plugins/. Add arch host volume content. * Apply Jeff's style guide updates Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> * Create Base plugin API section, link to BasePlugin interface --------- Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
134 lines
4.2 KiB
Plaintext
134 lines
4.2 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Raw Fork/Exec task driver
|
|
description: Nomad's Raw Exec task driver lets you execute commands with no resource isolation. Review the Isolated Fork/Exec task driver capabilities, plugin options, client requirements, and client attributes.
|
|
---
|
|
|
|
# Configure the Raw Fork/Exec task driver
|
|
|
|
Name: `raw_exec`
|
|
|
|
The `raw_exec` driver is used to execute a command for a task without any
|
|
isolation. Further, the task is started as the same user as the Nomad process.
|
|
As such, it should be used with extreme care and is disabled by default.
|
|
|
|
## Capabilities
|
|
|
|
The `raw_exec` driver implements the following [capabilities](/nomad/plugins/author/task-driver#capabilities-capabilities-error).
|
|
|
|
| Feature | Implementation |
|
|
| -------------------- | -------------- |
|
|
| `nomad alloc signal` | true |
|
|
| `nomad alloc exec` | true |
|
|
| filesystem isolation | none |
|
|
| network isolation | host, group |
|
|
| volume mounting | none |
|
|
|
|
## Client Requirements
|
|
|
|
The `raw_exec` driver can run on all supported operating systems. For security
|
|
reasons, it is disabled by default. To enable raw exec, the Nomad client
|
|
configuration must explicitly enable the `raw_exec` driver in the plugin's options:
|
|
|
|
```
|
|
plugin "raw_exec" {
|
|
config {
|
|
enabled = true
|
|
}
|
|
}
|
|
```
|
|
|
|
Nomad versions before v0.9 use the following client configuration. This configuration is
|
|
also supported in Nomad v0.9.0, but is deprecated in favor of the plugin block:
|
|
|
|
```
|
|
client {
|
|
options = {
|
|
"driver.raw_exec.enable" = "1"
|
|
}
|
|
}
|
|
```
|
|
|
|
## Plugin Options
|
|
|
|
- `enabled` - Specifies whether the driver should be enabled or disabled.
|
|
Defaults to `false`.
|
|
|
|
- `denied_host_uids` - (Optional) Specifies a comma-separated list of host uids to
|
|
deny. Ranges can be specified by using a hyphen separating the two inclusive ends.
|
|
If a "user" value is specified in task configuration and that user has a user id in
|
|
the given ranges, the task will error before starting. This will not be checked on Windows
|
|
clients.
|
|
|
|
```hcl
|
|
config {
|
|
denied_host_uids = "0,10-15,22"
|
|
}
|
|
```
|
|
|
|
- `denied_host_gids` - (Optional) Specifies a comma-separated list of host gids to
|
|
deny. Ranges can be specified by using a hyphen separating the two inclusive ends.
|
|
If a "user" value is specified in task configuration and that user is part of
|
|
any groups with gid's in the specified ranges, the task will error before
|
|
starting. This will not be checked on Windows clients.
|
|
|
|
```hcl
|
|
config {
|
|
denied_host_gids = "2,4-8"
|
|
}
|
|
```
|
|
|
|
- `denied_envvars` - (Optional) Passes a list of environment variables that
|
|
the driver should scrub from all task environments. Supports globbing with "*"
|
|
wildcard accepted as prefix and/or suffix.
|
|
|
|
```hcl
|
|
config {
|
|
denied_envvars = ["AWS_SECRET_KEY", "*_TOKEN"]
|
|
}
|
|
```
|
|
## Client Options
|
|
|
|
~> Note: client configuration options will soon be deprecated. Please use
|
|
[plugin options][plugin-options] instead. See the [plugin block][plugin-block] documentation for more information.
|
|
|
|
- `driver.raw_exec.enable` - Specifies whether the driver should be enabled or
|
|
disabled. Defaults to `false`.
|
|
|
|
## Client Attributes
|
|
|
|
The `raw_exec` driver will set the following client attributes:
|
|
|
|
- `driver.raw_exec` - This will be set to "1", indicating the driver is available.
|
|
|
|
## Resource Isolation
|
|
|
|
The `raw_exec` driver provides no filesystem isolation.
|
|
|
|
If the launched process creates a new process group, it is possible that
|
|
Nomad will leak processes on shutdown unless the application forwards signals
|
|
properly. Nomad will not leak any processes if cgroups are being used to
|
|
manage the process tree. Cgroups are used on Linux when Nomad is being run with
|
|
appropriate privileges, and the cgroup system is mounted.
|
|
|
|
If the cluster is configured with memory oversubscription enabled, a task using
|
|
the `raw_exec` driver can be configured to have no maximum memory limit by
|
|
setting `memory_max = -1`.
|
|
|
|
```hcl
|
|
resources {
|
|
cpu = 500
|
|
memory = 128
|
|
memory_max = -1 # no limit
|
|
}
|
|
```
|
|
|
|
## Next steps
|
|
|
|
[Use the `raw_exec` driver in a job](/nomad/docs/job-declare/task-driver/raw_exec).
|
|
|
|
[hardening]: /nomad/docs/deploy/production/requirements#user-permissions
|
|
[service]: /nomad/docs/deploy/production/windows-service
|
|
[plugin-options]: #plugin-options
|
|
[plugin-block]: /nomad/docs/configuration/plugin
|