# Consul Connect Envoy without Docker **URL:** \ **Category:** Nomad\ **Created:** [December 30, 2019, 10:16pm UTC](https://discuss.hashicorp.com/t/consul-connect-envoy-without-docker/4824 "2019-12-30T22:16:22Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![jcouvret](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jcouvret/32/3791_2.png) [@jcouvret](https://discuss.hashicorp.com/u/jcouvret)\ **Post date:** [December 30, 2019, 10:16pm UTC](https://discuss.hashicorp.com/t/consul-connect-envoy-without-docker/4824/1 "2019-12-30T22:16:22Z")
I have spend the last couple weeks learning Consul Connect and trying to use it with Nomad. However, nearly all examples I’ve seen involve using the Docker driver. Are there any good examples or walkthroughs of setting up Consul Connect with Envoy in Nomad with the raw\_exec or exec drivers? I have gotten Consul Connect with the built-in proxy to work by explicitly defining the proxies as separate tasks within Nomad jobs. I have also gotten Consul Connect with Envoy and adjusted this walkthrough to work without Docker, but can’t seem to figure out how to wrap it in Nomad: > **[Use Envoy with Connect | Consul - HashiCorp Learn](https://learn.hashicorp.com/consul/developer-mesh/connect-envoy)** > > This guide walks though getting started running Envoy as a Connect Proxy. And of course there is this guide, But I can’t quite figure out how to extrapolate this walkthrough to a non-docker solution: > **[Consul Connect - Nomad by HashiCorp](https://www.nomadproject.io/guides/integrations/consul-connect/index.html)** > > Learn how to use Nomad with Consul Connect to enable secure service to service communication Thanks in advance! ---
**Author:** ![blake](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/blake/32/27620_2.png) [@blake](https://discuss.hashicorp.com/u/blake)\ **Post date:** [January 6, 2020, 12:10am UTC](https://discuss.hashicorp.com/t/consul-connect-envoy-without-docker/4824/2 "2020-01-06T00:10:35Z")
Hi, I have not tested this, but it looks like you should be able to use the [`sidecar_task`](https://www.nomadproject.io/docs/job-specification/sidecar_task.html) stanza to define that the sidecar should use the `exec` or `raw_exec` task driver. The Envoy binary will need to be preinstalled on the server, or downloaded using `artifact`. [GetEnvoy.io](https://www.getenvoy.io/) provides Envoy binaries for a number of operating system distributions, and is probably the easiest way to obtain a binary outside of exporting it from the Docker image. Hope this helps. ---
**Author:** ![tgross](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/tgross/32/3015_2.png) [@tgross](https://discuss.hashicorp.com/u/tgross)\ **Post date:** [January 6, 2020, 9:12pm UTC](https://discuss.hashicorp.com/t/consul-connect-envoy-without-docker/4824/3 "2020-01-06T21:12:27Z")
@jcouvret I’ve got a couple of examples using Connect with exec and java drivers: - exec: [https://gist.github.com/tgross/c7ed0688a6af9bd288e6c7d1626e14db](https://gist.github.com/tgross/c7ed0688a6af9bd288e6c7d1626e14db) - java: [https://gist.github.com/tgross/0baf098b1599475876b3ca371a4042cd](https://gist.github.com/tgross/0baf098b1599475876b3ca371a4042cd) If you’re asking about having a non-Docker Envoy sidecar, then @blake has the right approach that you’ll want to use the `sidecar_task`. I’ll admit that’s not an approach we’ve heavily tested to date but I’d love to see if you manage to get it working. ---
**Author:** ![coryjamesfisher](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/coryjamesfisher/32/8709_2.png) [@coryjamesfisher](https://discuss.hashicorp.com/u/coryjamesfisher)\ **Post date:** [June 28, 2020, 1:39am UTC](https://discuss.hashicorp.com/t/consul-connect-envoy-without-docker/4824/4 "2020-06-28T01:39:30Z")
I’d love to be able to have services deployed by nomad (raw\_exec) to be able to leverage connect+envoy without docker. I was able to easily get consul+connect+envoy running with envoy standalone… But I really like nomad and would like to continue using it, so I’m at an impasse. Right now I’m considering some mechanism to dump a consul config file, loading the envoy proxy as a separate task, and linking them together… but with little experience with nomad, I’m finding it challenging. Any advice would be appreciated. ---
**Author:** ![efbar](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/efbar/32/9806_2.png) [@efbar](https://discuss.hashicorp.com/u/efbar)\ **Post date:** [July 28, 2020, 9:58pm UTC](https://discuss.hashicorp.com/t/consul-connect-envoy-without-docker/4824/5 "2020-07-28T21:58:10Z")
Hi everybody, in our context we are trying to deploy jobs with sidecars in mode “no-docker”, so with “exec” driver (through sidecar\_task stanza). We found that we can do it and it works flawlessly when we use “docker” as driver of the task the sidecar is next to. But when we use a “java” or “exec” driver in the task, then we have some problems, and envoy logs are: ``` [2020-07-28 17:03:00.148][13055][info][main] [external/envoy/source/server/server.cc:255] initializing epoch 0 (hot restart version=11.104) [2020-07-28 17:03:00.148][13055][info][main] [external/envoy/source/server/server.cc:257] statically linked extensions: ... ... [2020-07-28 17:03:00.156][13055][info][main] [external/envoy/source/server/server.cc:340] admin address: 127.0.0.1:19001 [2020-07-28 17:03:00.156][13055][critical][main] [external/envoy/source/server/server.cc:95] error initializing configuration '/secrets/envoy_bootstrap.json': cannot bind '127.0.0.1:19001': Cannot assign requested address [2020-07-28 17:03:00.156][13055][info][main] [external/envoy/source/server/server.cc:606] exiting cannot bind '127.0.0.1:19001': Cannot assign requested address ``` In the job we create a network at group level in `bridge` mode. Could that, along with “non-docker” task driver, be the problem? Thank you Francesco ---
**Author:** ![gfdsa](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/gfdsa/32/10165_2.png) [@gfdsa](https://discuss.hashicorp.com/u/gfdsa)\ **Post date:** [August 4, 2020, 6:37pm UTC](https://discuss.hashicorp.com/t/consul-connect-envoy-without-docker/4824/6 "2020-08-04T18:37:48Z")
```auto [2020-07-28 17:03:00.156][13055][info][main] [external/envoy/source/server/server.cc:606] exiting cannot bind '127.0.0.1:19001': Cannot assign requested address ``` Turns out to be a problem with missing loopback interface. I don’t know if this is an intended “feature” but any process (as far as I could test) started with exec isolation, only has eth0 bridged interface visible. Running `ifup lo` as a prestart hook makes the symptom go away. ---
**Author:** ![jcouvret](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jcouvret/32/3791_2.png) [@jcouvret](https://discuss.hashicorp.com/u/jcouvret)\ **Post date:** [August 26, 2020, 8:25pm UTC](https://discuss.hashicorp.com/t/consul-connect-envoy-without-docker/4824/7 "2020-08-26T20:25:31Z")
Thank you @gfdsa - that was nice find. I would be curious if anyone here from HashiCorp might be able to let us know if this is expected behavior or a bug. To help anyone else out searching how to do this, this is an example of a portion of the countdash job with no docker required. Based on my testing, it appears that Nomad tasks utilizing Consul Connect cannot be raw\_exec. I would be interested if anyone else figures out how to use raw\_exec. ``` job "countdash" { datacenters = ["dc1"] group "api" { network { mode = "bridge" } service { name = "count-api" port = "9001" connect { sidecar_service {} sidecar_task { driver = "exec" config { command = "/bin/envoy" args = [ "-c", "${NOMAD_SECRETS_DIR}/envoy_bootstrap.json", "-l", "${meta.connect.log_level}" ] } resources { cpu = 50 memory = 50 } } } } task "init_lo" { driver = "raw_exec" user = "root" config { command = "/usr/sbin/ifup" args = ["lo"] } lifecycle { hook = "prestart" } } task "web" { driver = "exec" env { PORT = "9001" } config { command = "/bin/counting-service" } } } } ``` ---
**Author:** ![gfdsa](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/gfdsa/32/10165_2.png) [@gfdsa](https://discuss.hashicorp.com/u/gfdsa)\ **Post date:** [August 27, 2020, 8:18am UTC](https://discuss.hashicorp.com/t/consul-connect-envoy-without-docker/4824/8 "2020-08-27T08:18:16Z")
> [@jcouvret](#): > > I would be interested if anyone else figures out how to use raw\_exec. Hypothetically there can be use cases when a sidecar proxy is running without isolation. But I wouldn’t feel safe with having no way of authentication of the non-native client running on the same localhost. And the port numbers… Just my two cents. ---
**Author:** ![primeos-work](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/primeos-work/32/27835_2.png) [@primeos-work](https://discuss.hashicorp.com/u/primeos-work)\ **Post date:** [May 2, 2022, 4:15pm UTC](https://discuss.hashicorp.com/t/consul-connect-envoy-without-docker/4824/9 "2022-05-02T16:15:40Z")
> [@jcouvret](#): > > I would be curious if anyone here from HashiCorp might be able to let us know if this is expected behavior or a bug. I’m very late to the party but there’s a confirmed bug report for it now: [When running container via containerd-driver plugin in the bridge mode, there is no ip address(127.0.0.1/8) in the lo network · Issue #10014 · hashicorp/nomad · GitHub](https://github.com/hashicorp/nomad/issues/10014) (Still no fix for it though, unfortunately.)