HashiCorp Nomad

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

sudo emisar pack install nomad --hash sha256:393bd9e4b925fc151924604c1e57a241ee6e9e92bdbb8ed335ee74ee7babff79

• nomad.acl_policies exec low

  nomad acl policy list

  List all ACL policy names.

  View source on GitHub
• nomad.acl_token_self exec low

  nomad acl token self

  Show the runner's own token — name, type, policies, expiration. The Secret ID the CLI prints is redacted from the output.

  View source on GitHub
• nomad.agent_force_leave exec high

  nomad server force-leave <node>

  Forces a server out of the gossip pool. Use when a dead server can't leave on its own.

  View source on GitHub
• nomad.agent_info exec low

  nomad agent-info

  Show per-agent stats — runtime, raft, serf, vault, consul subsystems.

  View source on GitHub
• nomad.agent_members exec low

  nomad server members

  List the Serf gossip pool members.

  View source on GitHub
• nomad.agent_self exec low

  GET /v1/agent/self

  Show this agent's effective config (member name, region, datacenter, tags).

  View source on GitHub
• nomad.alloc_checks script low

  nomad alloc checks <id>

  Show the Nomad-native service health-check results for one allocation — each check's name, group/task/service, status (success | failure | pending), and output. This is the Nomad-side health view with no Consul: is the alloc's service actually passing its checks, or failing one? Needs the allocation ID (get it from nomad.job_allocations or nomad.alloc_status). Requires a Nomad token with the read-job capability on the namespace.

  View source on GitHub
• nomad.alloc_exec_redis_info exec medium

  Show Redis INFO inside an allocation (nomad alloc exec redis-cli info)

  Show one section of Redis INFO from inside an allocation's task — runs the fixed command `redis-cli info <section>` via `nomad alloc exec`, with section bounded to the INFO enum. This is for the incident where Redis is only reachable inside the alloc (no direct REDIS_URL from the runner); use the redis pack's redis.info when you can reach it directly. The command is fixed except the enum section — no freeform command, shell, host, port, or password is accepted, so it reads the task's local redis-cli default (127.0.0.1:6379) and returns NOAUTH on a password-protected instance. risk:medium, not low: `nomad alloc exec` runs inside the running container and INFO exposes memory/stats/ replication topology, so it is policy-gated even though the command only reads. Requires the alloc-exec namespace capability (alloc-node-exec for raw_exec/ raw-driver tasks).

  View source on GitHub
• nomad.alloc_exec_redis_ping exec medium

  Ping Redis inside an allocation (nomad alloc exec redis-cli ping)

  Check whether the Redis inside one allocation's task is alive — runs the fixed command `redis-cli ping` via `nomad alloc exec` and returns PONG. This is for the incident where Redis is only reachable inside the alloc (no direct REDIS_URL from the runner); use the redis pack's redis.ping when you can reach it directly. The command is fixed — no freeform command, shell, host, port, or password is accepted, so it connects to the task's local redis-cli default (127.0.0.1:6379) and returns NOAUTH on a password-protected instance (itself a signal). risk:medium, not low: `nomad alloc exec` runs inside the running container and can expose internal state, so it is policy-gated even though the command only reads. Requires the alloc-exec namespace capability (alloc-node-exec for raw_exec/raw-driver tasks).

  View source on GitHub
• nomad.alloc_fs_ls exec low

  List a directory in an allocation (nomad fs/ls API)

  List a directory inside one allocation's filesystem — each entry's name, IsDir, size, file mode, and modtime. This is the "what files did my task write to local/ or alloc/logs" read for debugging, with no local CLI session. It calls Nomad's fs/ls API endpoint, which returns directory metadata only and NEVER streams file contents, so it cannot leak a rendered-secret template the way `nomad alloc fs <file>` (cat) would. path defaults to the alloc root (/), is relative to it (Nomad contains it to the alloc dir), and rejects "..", absolute host paths, and shell metacharacters. Requires a Nomad token with the read-fs capability on the namespace.

  View source on GitHub
• nomad.alloc_fs_stat exec low

  Stat a path in an allocation (nomad fs/stat API)

  Show the stat metadata of one path inside an allocation's filesystem — name, IsDir, size, file mode, modtime, and content type. This is the "does this file exist / how big is it / when was it written" read. It calls Nomad's fs/stat API endpoint, which returns metadata only and NEVER streams file contents, so it cannot leak a rendered-secret template the way `nomad alloc fs <file>` (cat) would. path is relative to the alloc root (Nomad contains it to the alloc dir) and rejects "..", absolute host paths, and shell metacharacters. Requires a Nomad token with the read-fs capability on the namespace.

  View source on GitHub
• nomad.alloc_list_by_meta script low

  List allocations by job meta (GET /v1/allocations?filter=Job.Meta[…])

  List allocations cluster-wide whose JOB's `meta` stanza has a key equal to a value — e.g. every allocation of terraform-managed jobs (managed_by=terraform) in one call, instead of walking jobs one by one with nomad.job_allocations. The filter runs server-side against the job embedded in each allocation; alloc rows themselves carry no meta, so use nomad.job_list_by_meta to see the labels. Omit meta_key/meta_value to list every allocation. Requires jq on the runner host.

  View source on GitHub
• nomad.alloc_logs script low

  Tail a task's application logs — stdout (nomad alloc logs)

  Tail application logs (stdout) from one task in a Nomad allocation — the last N lines the app/service/container wrote to stdout. This is the read for "show me the app logs" or "tail the service output" during an incident or cutover preflight, instead of a local CLI session. Needs the allocation ID and task name: when you only have the job name, call nomad.job_allocations first to list its allocations and pick the running one. Use nomad.alloc_logs_stderr for the stderr stream (errors, stack traces, panics).

  View source on GitHub
• nomad.alloc_logs_stderr script low

  Tail a task's application logs — stderr (nomad alloc logs -stderr)

  Tail application error logs (stderr) from one task in a Nomad allocation — the last N lines the app/service/container wrote to stderr (errors, stack traces, panics, crash output). This is the read for "show me the error logs" or "why did it crash" during an incident or cutover preflight, instead of a local CLI session. Needs the allocation ID and task name: when you only have the job name, call nomad.job_allocations first to list its allocations and pick the running one. Use nomad.alloc_logs for the stdout stream.

  View source on GitHub
• nomad.alloc_restart exec high

  nomad alloc restart <id> [task]

  Restarts one task (or all tasks if not specified) in one allocation.

  View source on GitHub
• nomad.alloc_signal exec high

  nomad alloc signal -s <signal> <id> [task]

  Send a UNIX signal to one task (or all tasks). Common uses: SIGHUP to reload config, SIGUSR1 for app-specific behavior.

  View source on GitHub
• nomad.alloc_stats exec low

  GET /v1/client/allocation/<id>/stats

  Show CPU + memory + network stats for one allocation.

  View source on GitHub
• nomad.alloc_status script low

  nomad alloc status <id>

  Show one allocation's full state — task states, restarts, last events.

  View source on GitHub
• nomad.alloc_stop exec high

  nomad alloc stop <id>

  Stops one allocation. The scheduler reschedules it (per the job's reschedule stanza).

  View source on GitHub
• nomad.csi_volume_list exec low

  nomad volume status

  List all registered CSI volumes with claim count + state.

  View source on GitHub
• nomad.csi_volume_status exec low

  nomad volume status <id>

  Show one CSI volume's full state — claims, allocations using it, plugin status.

  View source on GitHub
• nomad.deployment_fail exec high

  nomad deployment fail <id>

  Manually fail an in-progress deployment — halts the rollout immediately and, if the job's update stanza has auto_revert, rolls back to the last stable version. The "abort this bad rollout now" verb. Get the deployment ID from nomad.deployment_list or nomad.job_deployments.

  View source on GitHub
• nomad.deployment_list script low

  nomad deployment list

  List all deployments cluster-wide with their job, status, and description — the "what is rolling out right now" read. Use nomad.deployment_status for one deployment's full canary/health detail, or nomad.job_deployments for one job's history.

  View source on GitHub
• nomad.deployment_pause exec medium

  nomad deployment pause <id>

  Pause an in-progress deployment — placements stop where they are while you investigate; already-placed allocations keep running. Resume with nomad.deployment_resume or abort with nomad.deployment_fail.

  View source on GitHub
• nomad.deployment_resume exec medium

  nomad deployment resume <id>

  Resume a paused deployment — placements continue from where nomad.deployment_pause stopped them.

  View source on GitHub
• nomad.deployment_status exec low

  nomad deployment status <id>

  Show one deployment's state — per-task-group desired/placed/healthy/unhealthy.

  View source on GitHub
• nomad.eval_list exec low

  nomad eval list

  List all recent evaluations across the cluster.

  View source on GitHub
• nomad.eval_status exec low

  nomad eval status <id>

  Show one evaluation's status — placement failures, queued allocations, blocked count.

  View source on GitHub
• nomad.event_snapshot script low

  Snapshot recent Nomad events (bounded /v1/event/stream)

  Show a bounded snapshot of the Nomad event stream — recent Job, Allocation, Evaluation, Deployment, and Node events for incident triage, with no local CLI session. Nomad has no "last N events" query: /v1/event/stream is a forward feed whose only history is the broker's replay buffer (~100 events). This reads it from index=1 (replays the buffer, then live events) for `seconds` seconds, capped at 256 KiB, then returns — so it never hangs. Optionally filter to one `topic` or one `namespace`. Output is NDJSON: one {Index, Events:[...]} batch per line. Requires a token that can read the event stream.

  View source on GitHub
• nomad.host_volume_list exec low

  Host volumes from /v1/nodes

  List host-volume declarations across all client nodes.

  View source on GitHub
• nomad.job_action_run exec high

  nomad action -job <job> -group <group> -task <task> <name>

  Run a job-spec-defined action inside a running allocation (Nomad 1.7+). Nomad job authors declare named commands in the task's `action` blocks; this executes ONE of them by name — whatever command the job spec declares, with the task's own environment and filesystem. The pack fixes nothing about the command itself, so treat this as remote execution bounded by the job author, not by this pack. List a job's declared actions via nomad.job_inspect (TaskGroups[].Tasks[].Actions). Requires a token with alloc-exec.

  View source on GitHub
• nomad.job_allocations script low

  nomad job allocs <id>

  List all allocations for one job.

  View source on GitHub
• nomad.job_deployments exec low

  nomad job deployments <id>

  List deployment history for one job (rolling updates, canary, blue-green).

  View source on GitHub
• nomad.job_dispatch exec high

  nomad job dispatch <id>

  Dispatches a parameterized job with optional meta variables.

  View source on GitHub
• nomad.job_eval exec medium

  nomad job eval <id>

  Force a new evaluation for one job — kick the scheduler to retry placement now. With force_reschedule=true, failed allocations are rescheduled even if they are not currently eligible (past their reschedule backoff) — the "we fixed the cause, try again" verb after an incident.

  View source on GitHub
• nomad.job_evaluations exec medium

  nomad job eval <id> (force re-evaluation)

  Forces a fresh evaluation of one job — the scheduler re-checks placement and constraints and may reschedule allocations. NOT read-only: the CLI `nomad job eval` creates a new evaluation, it does not just list them.

  View source on GitHub
• nomad.job_history exec low

  nomad job history <id>

  List all versions of one job with submitter + timestamp.

  View source on GitHub
• nomad.job_inspect script low

  nomad job inspect <id>

  Dump one job's full spec as JSON. This surfaces the job's `env` and `template` blocks, which routinely carry injected secrets (DB URLs, API keys, rendered Vault templates). The runner's redaction is a fail-closed backstop, not a guarantee — it is pattern-bound and can miss a bespoke secret whose name and value match no rule.

  View source on GitHub
• nomad.job_list_by_meta script low

  List jobs with meta (GET /v1/jobs?meta=true [&filter])

  List jobs together with their `meta` stanza (managed_by, application, part_of, image_tag, …), optionally filtered server-side to the jobs whose meta key equals a value — e.g. every job with managed_by=terraform. This is the label-aware job discovery read: nomad.job_status_all shows no meta at all, and without this the only way to see a job's meta is nomad.job_inspect, one job at a time. Omit meta_key/meta_value to list every job with its meta. Requires jq on the runner host.

  View source on GitHub
• nomad.job_periodic_force exec medium

  nomad job periodic force <id>

  Force-runs one periodic job NOW, ignoring schedule.

  View source on GitHub
• nomad.job_promote exec high

  nomad job promote <id>

  Promotes a canary deployment — replaces the rest of the allocations with the new version.

  View source on GitHub
• nomad.job_resources script low

  nomad job inspect <id> (resource summary)

  List the CPU and memory reservation and the replica count for every task group and task in a job — the compact read companion to nomad.task_resources_set, so you can see current limits before vertical-scaling. Projects only the resource fields from the full jobspec: per task the CPU (MHz), cores, MemoryMB, and MemoryMaxMB, and per group the count.

  View source on GitHub
• nomad.job_restart script high

  nomad job restart <id>

  Restart one job's allocations in controlled batches, waiting for each batch to come back up before the next — the safe whole-job restart that replaces N hand-rolled per-alloc restarts. mode=in_place restarts tasks inside the existing allocations; mode=migrate stops each batch and lets the scheduler place replacements (possibly on other nodes). Runs non-interactively (-yes -on-error=fail: aborts on the first failed batch).

  View source on GitHub
• nomad.job_revert exec high

  nomad job revert <id> <version>

  Reverts a job to a prior version. Equivalent to re-submitting that version.

  View source on GitHub
• nomad.job_scale exec high

  nomad job scale <id> <group> <count>

  Adjusts the count for one task group.

  View source on GitHub
• nomad.job_start exec medium

  nomad job start <id>

  Start a stopped job — schedules a new version based on its most recent one. The inverse of nomad.job_stop: the job must still be registered (stopped, not purged). Requires Nomad 1.9+ on the server and CLI.

  View source on GitHub
• nomad.job_status_all script low

  nomad job status (all)

  List all jobs with their type, priority, status, and submit time.

  View source on GitHub
• nomad.job_status_one script low

  nomad job status <id>

  Show one job's full status — task groups, allocations, deployment.

  View source on GitHub
• nomad.job_stop exec high

  nomad job stop <id>

  Stops one job. All its allocations are stopped + GC'd. Use -purge to also remove from history.

  View source on GitHub
• nomad.leader exec low

  GET /v1/status/leader

  Show the current Raft leader address (host:port).

  View source on GitHub
• nomad.namespace_list exec low

  nomad namespace list

  List all namespaces in the cluster.

  View source on GitHub
• nomad.node_drain exec high

  nomad node drain -enable

  Enables drain mode on one node. Allocations migrate; new ones are blocked.

  View source on GitHub
• nomad.node_drain_done exec medium

  nomad node drain -disable

  Disables drain on one node. The node becomes eligible again (assuming eligibility wasn't separately disabled).

  View source on GitHub
• nomad.node_eligibility_disable exec high

  nomad node eligibility -disable

  Marks one node ineligible for new allocations. Existing allocations are not migrated.

  View source on GitHub
• nomad.node_eligibility_enable exec medium

  nomad node eligibility -enable

  Re-enables a node for new allocations.

  View source on GitHub
• nomad.node_eligibility_show exec low

  Nodes with eligibility != eligible

  List nodes that are ineligible for new allocations (drained or manually disabled).

  View source on GitHub
• nomad.node_pool_jobs script low

  nomad node pool jobs <pool>

  List the jobs scheduled into one node pool — which workloads land on that segment of the fleet (Nomad 1.6+).

  View source on GitHub
• nomad.node_pool_list script low

  nomad node pool list

  List all node pools with their descriptions — the fleet-segmentation view (Nomad 1.6+; the built-in pools are "default" and "all"). Use nomad.node_pool_nodes / nomad.node_pool_jobs to see what is inside one pool.

  View source on GitHub
• nomad.node_pool_nodes script low

  nomad node pool nodes <pool>

  List the client nodes in one node pool — ID, datacenter, status, drain and eligibility (Nomad 1.6+). Use "all" to see every node regardless of pool.

  View source on GitHub
• nomad.node_purge exec critical

  Purge a dead node (PUT /v1/node/<id>/purge)

  Removes a dead (down) node from the catalog; allocations on it are GC'd. There is no `nomad node purge` CLI subcommand — this is the HTTP API (PUT /v1/node/<id>/purge). Only valid for nodes that are down.

  View source on GitHub
• nomad.node_status_all exec low

  nomad node status

  List all clients (nodes) with status, datacenter, drain state, eligibility.

  View source on GitHub
• nomad.node_status_one exec low

  nomad node status <id>

  Show one node's full detail — resources, allocations, events, drivers.

  View source on GitHub
• nomad.operator_autopilot_get_config exec low

  nomad operator autopilot get-config

  Show the autopilot configuration (dead-server cleanup, redundancy zones, server stabilization).

  View source on GitHub
• nomad.operator_autopilot_state exec low

  GET /v1/operator/autopilot/health

  Show the autopilot health view — leader health, follower lag, server stabilization.

  View source on GitHub
• nomad.operator_raft_list_peers exec low

  nomad operator raft list-peers

  List the Raft peers — voter status, suffrage, address.

  View source on GitHub
• nomad.operator_raft_remove_peer exec critical

  nomad operator raft remove-peer

  Forcibly removes a server from Raft. Use ONLY when a server is permanently gone and autopilot hasn't cleaned it up.

  View source on GitHub
• nomad.operator_scheduler_get_config exec low

  nomad operator scheduler get-config

  Show the cluster's scheduler configuration — the scheduler algorithm (binpack/spread), memory oversubscription, preemption settings (system/batch/ service/sysbatch), job-registration rejection, and eval-broker pause state. This is the "why is placement behaving this way / is preemption on" read for incident triage. Read-only; requires a Nomad token with the operator:read capability.

  View source on GitHub
• nomad.plugin_status script low

  nomad plugin status [id]

  Show CSI plugin health — controller/node instance counts and whether the plugin is healthy. When a CSI volume is stuck, the answer is usually here, not in the volume itself. Omit plugin_id to list every plugin; pass one for its detail (from the list, or nomad.csi_volume_status's "Plugin ID").

  View source on GitHub
• nomad.quota_list exec low

  nomad quota list

  List resource quotas (Enterprise feature).

  View source on GitHub
• nomad.server_members exec low

  nomad server members (json)

  List the server members as JSON. Use for programmatic consumption.

  View source on GitHub
• nomad.service_info script low

  nomad service info <name>

  Show the live instances of one service in Nomad's native service discovery (no Consul) — each instance's address, port, node, and allocation ID. This is the "where is this service running, on what address" read for a registered service name (list them with nomad.service_list). Requires a Nomad token with the read-job capability on the namespace.

  View source on GitHub
• nomad.service_list script low

  nomad service list

  List the services registered in Nomad's native service discovery (no Consul) — the registered service names and their tags in the current namespace. This is the "what services does Nomad know about" read; use nomad.service_info to see the live instances (address, port, node, alloc) behind one service. Requires a Nomad token with the read-job capability on the namespace.

  View source on GitHub
• nomad.system_gc exec medium

  nomad system gc

  Forces a system-wide GC of jobs, allocations, evaluations, and deployments past their GC threshold.

  View source on GitHub
• nomad.task_resources_set script high

  nomad job inspect | set task CPU/memory | job run

  Vertical-scale one task: set its CPU and/or memory limits and re-register the job. Nomad has no atomic resource-change command, so this fetches the live jobspec, patches only the named task's CPU (MHz), MemoryMB, and MemoryMaxMB, and re-registers it with an optimistic JobModifyIndex check. The cloud never supplies jobspec JSON — only the bounded ids and integers below. Pair with nomad.job_resources to read current limits first, and nomad.job_scale to change the replica count.

  View source on GitHub
• nomad.var_list script low

  nomad var list [prefix]

  List Nomad variable METADATA — path, namespace, and modify time only, never the values. Answers "does the variable exist and when did it change" during a debugging session without touching secret material (there is deliberately no variable-read action in this pack). Optionally restrict to a path prefix.

  View source on GitHub