Does Watchtower support Hashicorp Nomad?

[sbrl]

Does Watchtower support Hashicorp Nomad?

For example, if I were to spin up instances of Watchtower using the system scheduler to run a watchtower instance on every client now, would watchtower be able to keep my Nomad job docker containers updated without interfering with Nomad?

[zoispag]

As far as I know, Nomad is an orchestrator, so it also supports Rolling updates etc. What made you consider Watchtower for this, over native Nomad ?
We may have to start introducing a recipes section in the documentation. In the meantime, I personally haven't used Nomad, so I cannot answer for sure.

would watchtower be able to keep my Nomad job docker containers updated

As long as containers are running using Docker daemon, watchtower should be able to control them.

without interfering with Nomad?

What the interference would be? What is Nomad doing with these containers?

[sbrl]

Hey there! Thanks for the reply. The problem with Nomad's upgrade system is that it requires - as far as I know - a new version of the job spec file for it to trigger an update. I want to do incremental security patch updates to libraries inside my containers with apt, without touching the jobspec file.

We may have to start introducing a recipes section in the documentation

That sound be great :-)

As long as containers are running using Docker daemon, watchtower should be able to control them.

Cool!

What the interference would be? What is Nomad doing with these containers?

Ah, sorry I wasn't clear. In particular I'm concerned that while Watchtower is restarting the job Nomad might detect that the job has stopped when Watchtower brings the container down to restart it, and then reschedule it elsewhere on the cluster.

[simskij]

Watchtower does not have any official support for Nomad. With that said, some things might work on Nomad as well, but we leave no guarantees for your mileage.

As @zoispag already mentioned, it would likely be better if you tried to use nomad's native rolling upgrades feature instead. See https://learn.hashicorp.com/tutorials/nomad/job-rolling-update for more info. Maybe you could have your CI change the jobspec files to trigger updates?

[sbrl]

Ah, I see. Hrm, I'll investigate that and see if that works. I've also discovered that you can restart an allocation with the HTTP API in-place which I'll investigate too, but the docs are unclear as to whether that re-fetches the docker image from the registry or not, and my Hashicorp Discuss post has gone unanswered.........

If that avenue doesn't work, then I suppose I could trigger it with my CI by changing a meaningless variable or something - but that's an ugly solution.

[simskij]

You could add a metadata variable containing the hash for the commit building the jobspec. That could even make sense to have available while debugging. 😅