nomad-fips

packaged by Chainguard

Chainguard Container for nomad-fips

HashiCorp Nomad workload orchestrator, FIPS 140-3 build

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/nomad-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

This image is designed as a drop-in replacement for the upstream hashicorp/nomad image. It keeps the same entrypoint (/docker-entrypoint.sh), the same default command (help), and runs as root, so existing docker run invocations and Nomad agent configurations work unchanged. nomad resolves both on PATH and at /bin/nomad.

This variant is built with a FIPS-validated Go toolchain and routes crypto through the system OpenSSL FIPS provider. nomad version reports the build as 2.0.5+fips1403, and the agent's startup banner shows the FIPS mode.

One further behavioural difference is worth knowing:

• Running Nomad clients in a container is not supported upstream, and the entrypoint prints a warning when invoked as agent. Set NOMAD_SKIP_DOCKER_IMAGE_WARN to silence it. Server agents and the CLI are unaffected.

Prerequisites

A Nomad server runs in a container with no special privileges. A Nomad client additionally needs a writable cgroup v2 hierarchy, because it creates its own cgroup subtree and executes tasks; without it the agent exits with failed to create nomad cgroup. See the upstream production requirements before running clients this way.

Getting Started

Print the version:

docker run --rm cgr.dev/ORGANIZATION/nomad-fips version

Run a single-node development agent, which is a server and client in one process and is useful for trying Nomad locally:

docker run --rm -p 4646:4646 \
  -e NOMAD_SKIP_DOCKER_IMAGE_WARN=1 \
  --privileged --cgroupns=host \
  cgr.dev/ORGANIZATION/nomad-fips agent -dev -bind 0.0.0.0

The HTTP API and web UI are then on http://127.0.0.1:4646. Check that a leader was elected:

curl -s http://127.0.0.1:4646/v1/status/leader

Run a server-only agent from a configuration file, which needs no extra privileges:

cat > server.hcl <<'EOF'
data_dir = "/tmp/nomad"

server {
  enabled          = true
  bootstrap_expect = 1
}

client {
  enabled = false
}
EOF

docker run --rm -p 4646:4646 \
  -v "$(pwd)/server.hcl:/nomad-config/server.hcl:ro" \
  cgr.dev/ORGANIZATION/nomad-fips agent -config=/nomad-config/server.hcl -bind=0.0.0.0

Configuration

Nomad is configured with HCL files passed via -config, which is the approach to prefer over long flag lists. As a worked example, enabling TLS uses certificates that Nomad can generate itself:

docker run --rm -v "$(pwd)/certs:/certs" -w /certs \
  --entrypoint /bin/sh cgr.dev/ORGANIZATION/nomad-fips -c '
    nomad tls ca create
    nomad tls cert create -server -region global'

Point the agent's tls block at them and require client certificates:

tls {
  http = true
  rpc  = true

  ca_file   = "/certs/nomad-agent-ca.pem"
  cert_file = "/certs/global-server-nomad.pem"
  key_file  = "/certs/global-server-nomad-key.pem"

  verify_server_hostname = true
  verify_https_client    = true
}

With verify_https_client set, the CLI needs its own certificate, so pass NOMAD_ADDR=https://... together with NOMAD_CACERT, NOMAD_CLIENT_CERT and NOMAD_CLIENT_KEY. Prometheus metrics are off by default; add a telemetry block with prometheus_metrics = true to expose them on /v1/metrics.

FIPS Support

The nomad-fips Chainguard Container is built with a FIPS-validated Go toolchain and routes cryptography through the system OpenSSL FIPS provider, which openssl-config-fipshardened configures. nomad version reports the build as 2.0.5+fips1403, and the agent logs its FIPS mode at startup:

docker run --rm cgr.dev/ORGANIZATION/nomad-fips version | grep fips1403

Nomad refuses non-approved algorithms in FIPS mode rather than silently falling back, so an artifact checksum = "md5:...", the md5()/sha1() jobspec functions, and consul-template's md5sum all fail on this variant. Use SHA-256 or SHA-512 instead.

For more on FIPS support in Chainguard Containers, consult the guide on FIPS-enabled Chainguard Containers on Chainguard Academy.

Documentation and Resources

• Nomad documentation
• Nomad configuration reference
• Nomad tutorials
• Nomad source

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.