Nomad — Dependencies#

Module info#

• Module: github.com/hashicorp/nomad
• Go version: 1.25.8
• Direct dependencies: 126
• Indirect dependencies: 220 (from the // indirect block in go.mod)
• go.sum entries: 1,180 lines (each entry appears once as hash + hash/go.mod)

Dependency categories#

Core infrastructure#

• github.com/hashicorp/go-hclog v1.6.3 — Structured, leveled logging; the standard logger across all HashiCorp projects. Used pervasively (aliased as log in server.go, hclog in client.go).
• github.com/hashicorp/cli v1.1.7 — CLI framework (HashiCorp’s fork of mitchellh/cli) for the nomad binary’s command dispatch.
• github.com/hashicorp/go-plugin v1.7.0 — RPC/gRPC-based plugin system for task drivers (Docker, exec, Java, QEMU). Nomad’s task driver isolation is built entirely on this.
• github.com/hashicorp/go-metrics v0.5.4 — Telemetry abstraction (wraps armon/go-metrics); backends for Prometheus, statsd, Circonus. Used for internal performance counters.
• github.com/hashicorp/cronexpr v1.1.3 — Cron expression parsing for Nomad’s periodic job scheduler.
• github.com/hashicorp/go-version v1.8.0 — Semantic version parsing and constraint matching (plugin API versioning, node version checks).
• github.com/hashicorp/go-checkpoint v0.5.0 — Background version-update checking (phones home to HashiCorp’s checkpoint service).
• github.com/hashicorp/go-discover v1.1.0 — Cloud provider auto-discovery for server addresses (AWS, GCP, Azure, etc.).
• github.com/hashicorp/go-envparse v0.1.0 — Parse .env style files for task environment injection.
• github.com/hashicorp/go-syslog v1.0.0 — Syslog sink for go-hclog.
• github.com/hashicorp/go-sockaddr v1.0.7 — Network address templates for bind_addr resolution.
• github.com/hashicorp/go-multierror v1.1.1 — Fan-in multiple errors into one; used extensively in validation and shutdown.
• github.com/hashicorp/go-uuid v1.0.3 — UUID generation for allocation/job/node IDs.
• github.com/hashicorp/go-connlimit v0.3.1 — Per-listener connection limiting for the HTTP API.
• github.com/hashicorp/go-netaddrs v0.1.0 — Network address discovery utilities.
• github.com/posener/complete v1.2.3 — Shell tab completion for the Nomad CLI.
• github.com/Masterminds/sprig/v3 v3.3.0 — Template functions library (used in consul-template and jobspec templating).
• github.com/mitchellh/go-homedir v1.1.0 — Cross-platform home directory resolution.
• github.com/LK4D4/joincontext v0.0.0 — Combine two context.Context values; used in plugin lifecycle management.
• oss.indeed.com/go/libtime v1.6.0 — Mockable time utilities for scheduler testing.

Consensus / Cluster#

• github.com/hashicorp/raft v1.7.3 — Raft consensus for server leader election and state replication; the foundation of Nomad’s strong consistency guarantees.
• github.com/hashicorp/raft-autopilot v0.1.6 — Automated Raft cluster management (dead server cleanup, voter promotion).
• github.com/hashicorp/raft-boltdb/v2 v2.3.1 — BoltDB-backed Raft log storage (traditional backend).
• github.com/hashicorp/raft-wal v0.4.2 — Write-ahead-log Raft backend (newer alternative to BoltDB; configurable).
• github.com/hashicorp/serf v0.10.2 — Gossip-based membership and failure detection for the Nomad cluster.
• github.com/hashicorp/memberlist v0.5.4 — Low-level gossip library underlying Serf.
• github.com/hashicorp/yamux v0.1.2 — Connection multiplexing over a single TCP stream (RPC and gRPC sharing one connection).
• go.etcd.io/bbolt v1.4.3 — BoltDB (the embedded B-tree database) for Raft log and FSM snapshots.

Networking / HTTP / RPC#

• github.com/hashicorp/net-rpc-msgpackrpc/v2 v2.0.1 — MessagePack-encoded net/rpc for the internal RPC layer between agents.
• github.com/hashicorp/go-msgpack/v2 v2.1.5 — MessagePack codec; the wire format for internal RPC messages.
• github.com/golang/snappy v1.0.0 — Snappy compression for RPC payloads (log entries, large responses).
• google.golang.org/grpc v1.79.3 — gRPC transport for the plugin system and CSI driver communication.
• google.golang.org/protobuf v1.36.11 — Protobuf v2 runtime.
• github.com/golang/protobuf v1.5.4 — Protobuf v1 shim (kept for go-plugin compatibility).
• github.com/gorilla/websocket v1.5.3 — WebSocket for streaming API endpoints (log streaming, exec sessions).
• github.com/gorilla/handlers v1.5.2 — HTTP middleware (logging, CORS, compression) for the HTTP API.
• github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 — gRPC interceptor chaining for plugin RPC.
• github.com/miekg/dns v1.1.72 — DNS client/server for Nomad’s built-in service discovery DNS.
• github.com/rs/cors v1.11.1 — CORS handling for the HTTP API.
• github.com/hashicorp/go-cleanhttp v0.5.2 — HTTP client with sensible defaults (no shared transport).

Data / Storage#

• github.com/hashicorp/go-memdb v1.3.5 — In-memory MVCC database; Nomad’s entire in-memory state store (jobs, allocations, nodes) is built on this.
• github.com/hashicorp/go-immutable-radix/v2 v2.1.0 — Immutable radix tree; the data structure backing go-memdb indexes.
• github.com/hashicorp/golang-lru/v2 v2.0.7 — LRU caches for plan results, ACL tokens, and other hot-path lookups.
• github.com/golang/snappy v1.0.0 — Compression of state snapshots and log entries.
• github.com/mitchellh/hashstructure v1.1.0 — Hash arbitrary Go structs to detect state changes (allocation diff detection).
• github.com/mitchellh/copystructure v1.2.0 — Deep-copy Go structs for safe mutation of scheduler state.

HCL / Configuration#

• github.com/hashicorp/hcl/v2 v2.20.2-nomad-1 — HCL2 parser for jobspec files (job.nomad). Nomad carries a fork with custom patches.
• github.com/hashicorp/hcl v1.0.1-nomad-1 — HCL1 for agent configuration files (nomad.hcl). Also a forked version.
• github.com/hashicorp/hil v0.0.0-20210521165536 — HashiCorp Interpolation Language (legacy; used in older jobspec {{ }} interpolation).
• github.com/zclconf/go-cty v1.18.0 — The type system powering HCL2 expressions.
• github.com/zclconf/go-cty-yaml v1.2.0 — YAML support for cty values.
• github.com/hashicorp/go-cty-funcs v0.1.0 — Standard function library for HCL2 expressions.
• github.com/hashicorp/go-bexpr v0.1.16 — Boolean expression evaluator for Nomad’s constraint DSL and filtering.
• github.com/go-viper/mapstructure/v2 v2.5.0 — Map-to-struct decoding for agent config parsing.
• github.com/mitchellh/pointerstructure v1.2.1 — Pointer-based struct field access for config patches.

HashiCorp Ecosystem#

• github.com/hashicorp/consul/api v1.33.5 — Consul HTTP client; used for service registration, health checks, and KV lookups.
• github.com/hashicorp/consul/sdk v0.17.3 — Shared Consul data types (service definitions, health check structs).
• github.com/hashicorp/consul-template v0.41.4 — Template rendering with Consul/Vault data; used in the template task stanza.
• github.com/hashicorp/vault/api v1.22.0 — Vault HTTP client for secret injection and token renewal.
• github.com/hashicorp/cap v0.12.0 — Auth capability library (OIDC, SAML, JWT) for Nomad’s auth methods.
• github.com/hashicorp/go-kms-wrapping/v2 v2.0.20 — Multi-cloud KMS abstraction for sealing/unsealing the keyring.
• github.com/hashicorp/go-kms-wrapping/wrappers/awskms/v2 — AWS KMS wrapper.
• github.com/hashicorp/go-kms-wrapping/wrappers/azurekeyvault/v2 — Azure Key Vault wrapper.
• github.com/hashicorp/go-kms-wrapping/wrappers/gcpckms/v2 — GCP Cloud KMS wrapper.
• github.com/hashicorp/go-kms-wrapping/wrappers/transit/v2 — Vault Transit KMS wrapper.
• github.com/hashicorp/nomad/api (self-replace) — The standalone Nomad API client module, used by command implementations.

Container / OCI / Linux#

• github.com/docker/docker v28.5.2 — Docker daemon API client for the Docker task driver.
• github.com/docker/cli v29.3.0 — Docker CLI types and helpers.
• github.com/docker/go-connections / go-units — Docker connection and unit helpers.
• github.com/opencontainers/runc v1.4.1 — runc integration for the exec and java task drivers.
• github.com/opencontainers/image-spec / runtime-spec / cgroups — OCI standards compliance.
• github.com/containerd/go-cni v1.1.13 — CNI (Container Network Interface) plugin management.
• github.com/containernetworking/cni v1.3.0 — CNI specification types.
• github.com/container-storage-interface/spec v1.12.0 — CSI specification types for the CSI plugin system.
• github.com/moby/sys/{capability,mount,mountinfo,term} — Linux capability and mount management.
• github.com/coreos/go-iptables v0.8.0 — iptables manipulation for network namespaces.
• github.com/creack/pty v1.1.24 — Pseudo-terminal allocation for interactive exec sessions.
• github.com/shoenig/go-landlock v1.2.2 — Linux Landlock LSM sandboxing for task isolation.
• github.com/opencontainers/image-spec v1.1.1 — OCI image spec for Docker driver image handling.
• github.com/distribution/reference v0.6.0 — Docker/OCI image reference parsing.
• github.com/Microsoft/go-winio v0.6.2 — Windows named pipe support (pinned to a fork for Nomad-specific patches).

Security / Auth#

• github.com/go-jose/go-jose/v3 v3.0.4 — JOSE (JWK, JWS, JWE) for Nomad’s workload identity JWKS endpoint.
• github.com/golang-jwt/jwt/v5 v5.3.1 — JWT token creation and validation for workload identities.
• github.com/spiffe/go-spiffe/v2 v2.6.0 — SPIFFE workload identity integration.
• github.com/hashicorp/go-secure-stdlib/listenerutil — TLS listener configuration.

Metrics / Observability#

• github.com/prometheus/client_golang v1.23.2 — Prometheus metrics exposition (the /v1/metrics?format=prometheus endpoint).
• github.com/prometheus/common v0.67.5 — Shared Prometheus client types.

Testing#

• github.com/stretchr/testify v1.11.1 — Primary test assertion library (assert + require + suite).
• github.com/shoenig/test v1.12.2 — Additional test helpers from the Shoenig library.
• github.com/google/go-cmp v0.7.0 — Deep equality comparison in tests.
• go.uber.org/goleak v1.3.0 — Goroutine leak detection in tests.
• pgregory.net/rapid v1.2.0 — Property-based (randomized) testing; used in scheduler property tests.
• github.com/kr/pretty v0.3.1 — Pretty-printing structs in test output.

Other notable#

• github.com/shirou/gopsutil/v3 v3.24.5 — Cross-platform system stats (CPU, memory, disk) for client fingerprinting.
• github.com/klauspost/cpuid/v2 v2.3.0 — CPU feature detection for scheduling constraints.
• github.com/shoenig/go-m1cpu v0.2.1 — Apple M1/M2 CPU detection.
• github.com/hpcloud/tail v1.0.1 — Log file tailing for the nomad alloc logs command.
• github.com/aws/aws-sdk-go-v2/config + feature/ec2/imds — AWS instance metadata for cloud auto-join.
• github.com/mitchellh/go-glint — Progress/spinner rendering in the CLI.
• github.com/muesli/reflow — Terminal text wrapping for the CLI output.
• github.com/gosuri/uilive — Terminal live-updating output for log streaming.
• github.com/dustin/go-humanize — Human-readable file sizes and numbers in the CLI.
• github.com/fatih/color / mattn/go-colorable — Colored terminal output.
• github.com/ryanuber/columnize — Column-aligned CLI output formatting.
• github.com/mitchellh/reflectwalk — Recursive struct traversal (used with copystructure).

Stdlib reliance#

Nomad makes heavy use of the Go standard library alongside its third-party deps. Visible in the two most complex files (nomad/server.go, client/client.go):

Heavily used stdlib packages:

• sync / sync/atomic — Mutex, RWMutex, atomic operations throughout the server and client.
• context — Context propagation for cancellation and timeouts is ubiquitous.
• net / net/rpc — Base network layer; net/rpc is the transport for internal agent-to-agent RPC.
• time — Timers and deadlines in the scheduler, heartbeat, and GC routines.
• encoding/json — JSON serialization for the HTTP API.
• crypto/tls / crypto/x509 — TLS configuration for mTLS between agents.
• os / path/filepath — File system operations for allocation directories and plugin paths.
• strings, fmt, errors — Everyday string and error handling.

The ratio of stdlib to third-party is roughly balanced — Nomad is not a stdlib-minimal project (it leans on the HashiCorp toolkit heavily), but neither is it entirely abstracted away from stdlib primitives. net/rpc (stdlib) is notably still used as the internal RPC layer rather than gRPC.

Shared dependencies#

Dependencies shared with other projects in the 50-repo set (high connection value for the book):

Vendoring#

Nomad does not vendor dependencies. There is no vendor/ directory. This is typical for a project of this size — vendoring 1,180 go.sum entries would be unwieldy. Nomad relies on the Go module proxy and go.sum checksum verification for reproducibility. The go.mod contains two notable pinned replacements:

1. github.com/Microsoft/go-winio → github.com/endocrimes/go-winio (fork with Nomad-specific Windows fixes)
2. github.com/hashicorp/hcl → a Nomad-patched version

These replace directives are documented as intentional in issue #11826.

Notable dependency decisions#

1. Two Raft storage backends in parallel: Nomad ships both raft-boltdb/v2 (traditional B-tree) and raft-wal (newer WAL design), allowing operators to choose. This is unusual — most Raft users commit to one backend. It signals active investment in Raft storage performance.

2. net/rpc over gRPC for agent RPC: Despite importing gRPC (for plugins and CSI), internal agent-to-server communication uses Go’s net/rpc with MessagePack encoding (net-rpc-msgpackrpc). This is a deliberate performance and simplicity choice that predates the gRPC ecosystem. The custom yamux multiplexer compensates for net/rpc’s lack of HTTP/2-style multiplexing.

3. Five HCL/config-related dependencies: hcl, hcl/v2, hil, go-cty, go-bexpr — this reveals the evolution of Nomad’s configuration language over time. HCL1 handles agent config, HCL2 handles modern jobspecs, HIL handles legacy interpolation, and go-bexpr handles filter expressions. This layering of language versions is a maintenance burden unique to Nomad’s age.

4. Four KMS wrappers as direct deps: AWS KMS, Azure Key Vault, GCP Cloud KMS, and Vault Transit are all direct dependencies. Nomad’s keyring sealing architecture (borrowed from Vault) supports all four backends, and since Go modules are not tree-shaken, all clouds ship in the single binary regardless of deployment.

5. go-discover for cloud auto-join: Rather than requiring operators to hardcode server addresses, go-discover queries cloud provider APIs (AWS EC2 tags, GCP labels, etc.) at startup to find peers. This is a first-class feature in the dependency graph.

6. pgregory.net/rapid for property-based testing: The scheduler package uses rapid for property-based (randomized) testing — a more sophisticated approach than table-driven tests alone. This dependency signals the scheduler team’s commitment to correctness under adversarial inputs.

7. Forked dependencies under replace: Both go-winio and hcl are forked rather than upstreamed. The comments reference a tracking issue (#11826), suggesting awareness of the debt but pragmatic short-term pinning.