[{"_1":2,"_160":-5,"_161":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_139":140},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":-5,"_89":90,"_128":-5,"_129":11,"_130":21,"_131":11,"_132":-5,"_133":11,"_134":-5,"_135":136,"_137":91,"_138":-7},"canonicalUrl","https://hub.docker.com/r/joshperry/nomadctld/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","joshperry","reponame","nomadctld","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":11,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2020-07-23T23:44:22.543894Z","description","","is_private","last_updated","2020-07-23T23:50:57.967693Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",184,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# nomadctld\n\nnomadctld is a ssh server which sits between your users and the nomad cluster. \nThis way you can give users limited access to your nomad cluster and allow them to attach, see logs, tail logs, stop, restart, exec containers they own on the cluster.\nThe server you're running nomadctld on needs to have access to your nomad server (usually on port 4646) and the docker daemon on all nomad nodes.\n(TLS is not supported yet)\n\n## features\n* Support nomad ACL tokens\n* Authenticate users via ssh-keys\n* Authorize users on nomad job prefixes\n* Supports following commands\n * ps (shows all/filtered nomad jobs) ( is optional)\n * batch (shows batch nomad jobs) ( is optional)\n * exec (executes in container (command default is /bin/sh)\n * logs (shows last 100 stdout lines of )\n * tail (shows last 100 stdout lines of and keeps following them (like tail -f))\n * stop (stops a nomad job with ( is the jobname))\n * status (shows status of a nomad job with ( is the jobname)\n * inspect (inspects a nomad job with ( is the jobname))\n * di (runs equivalent of docker inspect on container \n * raw (executes a \"raw\" nomad command (basically talks to the nomad binary))\n * restart (restart a job)\n * pstree (shows all/filtered nomad jobs)\n * info (shows information about all allocations of the job)\n\n## running\nnomadctld looks for a nomadctld.toml in the current directory or in /etc/nomadctld\n\n```\n./nomadctld\n2018/04/12 23:54:53 starting ssh server on :2222 Using /etc/ssh/ssh_host_rsa_key\n```\n\nYou can now do a ssh -p2222 localhost ps to see all running jobs\n\nThere's also a `nomadctl` bash script included that wraps ssh, modify the first line `nomadctld=\"/usr/bin/ssh -p2222 yourserver\"` to your own server and optionally specify your sshkey\n\n## example\nFilter for a mattermost job\n\n```\n$ nomadctl ps mattermost\nExec ID |Job/Task |Node |Uptime |CPU |Mem(max)\n |q-lnx-mattermost | | | |\nf429aef310 |q-lnx-mattermost |q-node-10 |3 weeks ago |2 |34 MiB(79 MiB)\n |p-lnx-mattermost | | | |\ne7c3629baf |p-lnx-mattermost |p-node-2 |1 week ago |4 |56 MiB(201 MiB)\n```\n\nGet a shell on our quality container\n```\n$ nomadctl exec f429aef310\nWelcome Wim (wim, ssh-ed25519 AAAAC3NzaC1lZDI1NT)\nYou have access to [p- q- t- raw]\nwelcome to q-lnx-mattermost on q-node-10\nsh-4.2# ps -ux\nUSER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND\nroot 1 0.0 0.0 11640 1344 ? Ss Mar21 0:00 /bin/bash /docker-entry.sh\nroot 8 0.0 0.2 455808 43488 ? Sl Mar21 22:40 ./platform --config /config_docker.json\nroot 31 1.0 0.0 11772 1672 ? Ss 00:36 0:00 /bin/sh\nroot 38 0.0 0.0 47448 1664 ? R+ 00:36 0:00 ps -ux\nsh-4.2# exit\n$\n```\n\nShow batch jobs\n\n```\n$ nomadctl batch\nJob ID |Next | |Config\np-es-log-curator |5m24s |2018-07-12T15:52:00+02:00 |52 6,15,18 * * * *\np-iss-frontend-sync |9m24s |2018-07-12T15:56:00+02:00 |11/15 * * * * *\n```\n\n\n## debugging examples\n\nIf you see a OK or a FAIL next to the job, this means the deployment is OK or has FAILed.\nA deployment can fail even when the containers are running, because of allocations that took too much time to become healthy\n\n### Extra column legend\n\n* F = allocation failed\n* P = allocation pending\n* T = allocation has been terminated\n* O = allocation has been terminated by OOM\n* NR = allocation will not restart\n* KV = allocation has been killed because of vault issues\n* U = allocation is unhealthy (based on consul checks)\n\n### With failures\n```\nExec ID |Job/Task |Node |Uptime |CPU |Mem(max) |Extra\n076f1388af |p-lnx-helloworld2 |p-node-5 |1 hour ago |0 |0 B(0 B) |F,KV,U\n30a1e62b4e |p-es-iss-cluster1-frontend |p-node-9 |14 hours ago |4 |1.9 GiB(2.0 GiB) |O,O,O\nb4eaf79c05 |q-fii-lamp |q-node-11 |1 day ago |0 |39 MiB(67 MiB) |U,T\nf3c6ee4200 |q-fii-monitoring-wmsmonitor |q-node-11 |17 hours ago |0 |22 MiB(43 MiB) |T\n```\n* p-lnx-helloworld2 allocations have failed because of vault issues and the allocation is unhealthy\n* p-es-iss-cluster1-frontend is 3 times terminated because of a OOM issue (but is still running because no F)\n* q-fii-monitoring-wmsmonitor has been terminated once (but is still running because no F)\n* q-fii-lamp been terminated once and is now unhealthy (but is still running because no F)\n\nFurther debugging of those failures:\n\n```\n$ nomadctl info p-lnx-helloworld2\n\n076f1388af |failed |1 hour ago |p-lnx-helloworld2-main/p-lnx-helloworld2\n |p-node-5 |0 Mhz |0 B(0 B)\n |1 hour ago |Received |Task received by client\n |1 hour ago |Task Setup |Building Task Directory\n |1 hour ago |Killing |vault: server error deriving vault token: Error making API request.\n\nURL: POST https://vault.service.consul:8200/v1/auth/token/create/nomad-cluster\nCode: 400. Errors:\n\n* token policies ([default p-lnx-ros]) must be subset of the role's allowed policies ([default p-es-ro p-lnx-ro])\n |1 hour ago |Alloc Unhealthy |Unhealthy because of failed task\n```\nWe can see that there is an issue with our vault policy\n\n\n## example configuration\n```\n[general]\nhostkey=\"/etc/ssh/ssh_host_rsa_key\"\n#this is the port your docker daemon is listening on\ndockerport=\"4243\"\n#specify the api, if you're using an older docker (1.24 is needed for centos7)\ndockerapi=\"1.24\"\nnomadbinary=\"/usr/bin/nomad\"\nbind=\":2222\"\n\n#create some aliases\n[alias]\nstatus=\"raw alles status\"\n\n[nomad]\n[nomad.production]\nurl=\"http://nomad.service.consul:4646\"\n#the prefix that production jobs start with, eg p-team1-teamjob\nprefix=[\"p-\"]\n#file containing the nomad acl token with admin privileges\ntoken=\"/etc/nomadctld/token-p\"\n\n[nomad.quality]\nurl=\"http://nomad.service.qconsul:4646\"\n#the prefix that quality jobs start with, eg q-team1-teamjob\n#we're running quality and test on the same cluster, so t- also runs here\nprefix=[\"q-\"]\ntoken=\"/etc/nomadctld/token-q\"\n\n[nomad.test]\nurl=\"http://nomad.service.tconsul:4646\"\n#the prefix that test jobs start with, eg t-team1-teamjob\nprefix=[\"t-\"]\ntoken=\"/etc/nomadctld/token-t\"\n\n\n#prefixes are used for acl\n[prefix]\n#create a lnx prefix that has access to jobs starting with \"p-\",\"q-\",\"t-\"\n#and has access to the \"raw\" command\n[prefix.lnx]\nprefix=[\"p-\",\"q-\",\"t-\",raw\"]\n\n#the team1 prefix has less privileges, it can only see there own jobs\n[prefix.team1]\nprefix=[\"p-team1-\",\"q-team1-\",\"t-team1-\"]\n\n#create some users\n[users]\n[users.wim]\n#key is the public sshkey\nkey=\"ssh-ed25519 ABCEC4NzaC1lZDI2NTE5AADAIB3m1na7Lu74koUa5EYPvEk7xCXiwtToar73gl9w9MND\"\n#which prefix can this user access\nprefix=[\"lnx\"]\nname=\"Wim\"\n\n[users.user2]\nkey=\"ssh-ed25519 ABCEC4NzaC1lZDI2NTE5AADAIB3m1na7Lu74koUa5EYPvEk7xCXiwtToar73gl9abcde\"\nprefix=[\"team2\"]\nname=\"user2\"\n```\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":21,"_83":11,"_84":11},"read","write","admin","user","storage_size",5748366,"orgData","recentTags",[91],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_50":117,"_118":94,"_119":33,"_120":56,"_57":121,"_122":123,"_124":108,"_125":117,"_126":66,"_127":21},"content_type","creator",63020,"full_size",5744672,"id",110157873,"images",[101],{"_102":103,"_104":105,"_106":48,"_107":108,"_109":110,"_111":112,"_113":48,"_114":-5,"_115":96,"_63":66,"_116":-5},"architecture","amd64","digest","sha256:dae67950443fed5a89327de187fe4254b5776d3975d3303a652e865e5069ccfb","features","last_pulled","2026-09-29T22:49:24.540751544Z","last_pushed","2020-07-23T23:50:58Z","os","linux","os_features","os_version","size","variant","2020-07-23T23:50:57.43612Z","last_updater","last_updater_username","media_type","latest","repository",9510804,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":141,"_148":149,"_135":158,"_159":11},{"_40":142,"_42":143,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":144,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":145,"_79":11,"_80":147,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":146},[78],{"_82":21,"_83":11,"_84":11},"tags",{"_150":64,"_151":-5,"_152":-5,"_153":154},"count","next","previous","results",[155],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":156,"_50":117,"_118":94,"_119":33,"_120":56,"_57":121,"_122":123,"_124":108,"_125":117,"_126":66,"_127":21},[157],{"_102":103,"_104":105,"_106":48,"_107":108,"_109":110,"_111":112,"_113":48,"_114":-5,"_115":96,"_63":66,"_116":-5},[],"canDeleteTags","actionData","errors"]

joshperry/nomadctld

Tags for joshperry/nomadctld