LoginSign Up
← Back to all sparks
N

Nomad

INFRA · APIS
Velocity5.0

Workload orchestrator for deploying containers and legacy applications

www.nomadproject.io ↗

Nomad 2.1's first candidate brings an experimental batch job queue.

orchestrationbatch schedulingnamespace isolationsecurity fixesenterprise
◆Current state
Nomad's feed tracks Enterprise releases on the 1.10 and 1.11 lines, cut in matched pairs with the same fixes, plus the 2.x candidates. On 28 October 1.11.12 and 1.10.18 closed cross-namespace information leaks in several APIs and hardened client file handling, following July's two Docker CVEs and a cross-namespace volume delete. 2.1.0-rc.1 on 20 October added an experimental batch job queue with FIFO and dynamic priority modes.
◆Where it's heading
Security work keeps centring on namespace boundaries, which matters most to multi-tenant clusters. On the feature side, the batch queue moves Nomad toward HPC- and batch-style scheduling alongside its service workloads.
◆Prediction
Nomad 2.1.0 final is the likely next entry, with the batch queue still marked experimental.

◆Recent moves

  1. 16d ago

    Nomad 1.10.18 Enterprise backports namespace security fixes

    The same namespace and file-handling security fixes backported to the 1.10 Enterprise line.

    View source ↗
  2. 16d ago

    Nomad 1.11.12 Enterprise closes cross-namespace API leaks

    Enterprise security release closing namespace leaks in several APIs and hardening client file handling. Multi-tenant clusters should take it.

    View source ↗
  3. 24d ago

    Nomad 2.1.0-rc.1: experimental batch job queue

    Nomad 2.1's first release candidate adds an experimental batch job queue with FIFO and dynamic priority modes, and makes server joins require agent:write, a breaking change.

    View source ↗
  4. 4mo ago

    Two Docker CVEs and a cross-namespace volume delete

    Host namespace modes could be set without the configured allowed_modes or allow_privileged check, and a symlink could bypass volumes.enabled=false — two ways a task escaped its own driver configuration. A third fix stops a namespace-scoped host-volume-delete permission from removing another namespace's claims.

    View source ↗
  5. 4mo ago

    Same CVE batch backported to the 1.10 line

    The 1.10 Enterprise counterpart, cut in the same minute with identical content. The paired release habit means both supported lines close container-isolation gaps simultaneously rather than on separate schedules.

    View source ↗
  6. 5mo ago

    Debug bundle redaction, Vault retries, template restart fix

    Tokens and certificate key flags are now redacted when writing a debug bundle — the file operators routinely hand to support. Also fixes tasks getting killed mid-restart on template re-render, and audit logs marking browser-originated exec requests as anonymous.

    View source ↗