Nomad Task Driver Selection: Docker, raw_exec, and exec

Decision and Constraints

When running containerized workloads in HashiCorp Nomad, selecting the right task driver determines isolation, performance, and operational overhead. This guide assumes a Linux host with Nomad client ≥ 1.0, and covers three supported drivers: docker, raw_exec, and exec.

Supported Options

Driver	Isolation	Setup Complexity	Performance Overhead	Typical Use‑Case
docker	Strong (container)	Moderate (Docker install)	Low (native)	Standard container workloads
raw_exec	Weak (process)	Low (no extra daemon)	Very low	Legacy scripts, admin tasks
exec	None (host)	Low	None	Simple binaries, testing

Trade‑offs

The docker driver provides the strongest isolation and full Docker ecosystem integration, but requires a running Docker daemon and adds minimal startup latency for container creation. The raw_exec driver avoids any daemon and offers very low overhead, yet demands privileged capabilities (CAP_SYS_ADMIN) and provides only process‑level isolation, making it suitable for trusted admin tasks. The exec driver is the simplest and fastest, but offers no isolation and should be restricted to non‑containerized binaries or testing environments.

Concrete Implementation – Docker Driver

Below is a minimal Nomad job that runs an NGINX container using the Docker driver. Save this as nginx.nomad:

job "nginx" {
  datacenters = ["dc1"]

  group "web" {
    count = 1

    task "server" {
      driver = "docker"

      config {
        image = "nginx:latest"
        port  = "http"
      }

      resources {
        cpu    = 200
        memory = 256
        network {
          port "http" {}
        }
      }

      service {
        name = "nginx"
        port = "http"
        check {
          type     = "http"
          path     = "/"
          interval = "10s"
          timeout  = "2s"
        }
      }
    }
  }
}


  
nomad job run nginx.nomad – submit the job (requires Nomad CLI with a valid token).
  
Note the allocation ID from the output, e.g., alloc-id = a1b2c3d4.
  
Verify the driver is reported as docker:

nomad alloc status -verbose a1b2c3d4 | grep -i driver
Expected output:
Driver = docker

Confirm the task is running:
nomad alloc status a1b2c3d4

Look for Task State = running. Finally, inspect container logs to verify the application started correctly:
nomad alloc logs a1b2c3d4


Limitations and Verification
The Docker driver requires the Nomad client to access the Docker socket (/var/run/docker.sock). Unrestricted access can enable privileged container escapes. Restrict socket ownership to a dedicated group and ensure the Nomad client runs as a member of that group.
Confirm the node can communicate with Docker:
nomad node status -self | grep -i driver

The output should list Driver = docker under the node details. If the output shows Driver = raw_exec or Driver = exec, the Docker daemon is unreachable or the client lacks the necessary privileges.
After validation, clean up the test job:
nomad job stop -purge nginx