LoginSign Up
← Back to all sparks
N

Nomad

INFRA · APIS
Velocity5.0

Workload orchestrator for deploying containers and legacy applications

www.nomadproject.io ↗

Nomad's July release closed two Docker CVEs that let tasks escape their own driver configuration.

orchestrationcontainer-isolationcve-responsenamespace-boundariesconsul-vault
◆Current state
HashiCorp is cutting 1.11.x and 1.10.x Enterprise releases in matched pairs, seconds apart, with identical content. July's pair carried two Docker CVEs — one where allowed_modes or allow_privileged was not enforced before setting host namespace modes, one where a symlink let a task bypass volumes.enabled=false — plus a dynamic host volume bug that let a namespace-scoped delete permission remove another namespace's claims.
◆Where it's heading
All three July fixes are the same failure: a boundary that was declared in configuration but not enforced at the point of use. Alongside that, the improvements are about degraded-mode operation — falling back to the client agent's Consul token when workload identity is unavailable, Vault token renewal retries, an optional Init hook for task driver plugins. Nomad is hardening the seams between the scheduler and the systems it delegates to.
◆Prediction
Expect the paired Enterprise releases to continue at monthly cadence, with further fixes concentrated in the Docker driver and dynamic host volumes, where the isolation boundaries are newest.

◆Recent moves

  1. 24d ago

    Two Docker CVEs and a cross-namespace volume delete

    Host namespace modes could be set without the configured allowed_modes or allow_privileged check, and a symlink could bypass volumes.enabled=false — two ways a task escaped its own driver configuration. A third fix stops a namespace-scoped host-volume-delete permission from removing another namespace's claims.

    View source ↗
  2. 24d ago

    Same CVE batch backported to the 1.10 line

    The 1.10 Enterprise counterpart, cut in the same minute with identical content. The paired release habit means both supported lines close container-isolation gaps simultaneously rather than on separate schedules.

    View source ↗
  3. 1mo ago

    Debug bundle redaction, Vault retries, template restart fix

    Tokens and certificate key flags are now redacted when writing a debug bundle — the file operators routinely hand to support. Also fixes tasks getting killed mid-restart on template re-render, and audit logs marking browser-originated exec requests as anonymous.

    View source ↗
  4. 1mo ago

    1.11 twin of the June maintenance release

    Byte-identical to its 1.10 counterpart released in the same minute. It appears separately in the feed but carries no distinct content.

    View source ↗
  5. 2mo ago

    Three web UI rendering fixes

    Client detail, topology and evaluation detail pages all failed to render, fixed here. A UI-only release with no scheduler or driver changes.

    View source ↗
  6. 2mo ago

    1.11 twin of the May UI fix release

    The same three UI rendering fixes, cut thirty seconds apart on the other supported line. Duplicate content in the feed.

    View source ↗