hashicorp / hashicorp/nomad

allow `raw_exec` tasks to drop client environment variables

Open
#17,650 9 comments 0 reactions 0 assignees View on GitHub
hcc/jira stage/accepted theme/driver/raw_exec type/enhancement
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

### Nomad version
`v1.5.3`

### Operating system and Environment details

No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 20.04.5 LTS
Release: 20.04
Codename: focal

Kernel: 5.4.0-149-generic

### Issue

When an environment variable is set in a client's artifact config, it leaks into the allocations created on that client. This is happening for `raw_exec`. I haven't tested it for other driver types.

```
client {
artifact {
set_environment_variables = "https_proxy"
}
}
```

In this particular context, the `https_proxy` environment variable is set to enable a forward proxy to cache packages downloads. I only really want this for downloading packages.

However, this is leaking into `raw_exec` allocations and makes it so that any running applications refer to the proxy.

### Reproduction steps

1. Set the Nomad client configuration so that an artifact environment variable is used for go-getter.
2. Create an allocation using `raw_exec` and use exec to open up a shell and print out the environment variable.

#### Expected Result

That environment variables used to download an artifact are only used to download an artifact.

#### Actual Result

Environment variables that are useful for downloading artifacts interfere with running applications.

### Job file (if appropriate)

No job file as the job doesn't actually matter.

### Nomad Server logs (if appropriate)

N/A

### Nomad Client logs (if appropriate)

N/A

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the raw_exec execution path and the client artifact configuration described in the report; trace how go-getter's environment reaches allocations. Reproduce the issue with https_proxy configured for artifact downloads, then verify that it is available during downloading but absent from the raw_exec application environment.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.