bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8): No such file or directory

title: Architecture weight: 6

Overview

┌─────────────────────────────────────────────┐
│                     np CLI                    │
│    deploy · status · logs · scale · stop     │
└──────────┬──────────────────────────────────┘
           │
           ▼
┌─────────────────────────────────────────────┐
│                  Nomad Server                 │
│    scheduler · job state · rolling updates   │
└──────┬──────────────────┬───────────────────┘
       │                  │
       ▼                  ▼
┌─────────────┐   ┌─────────────┐
│ Nomad Client │   │ Nomad Client │   ...
│  (node 1)   │   │  (node 2)   │
│             │   │             │
│ ┌─────────┐ │   │ ┌─────────┐ │
│ │ alloc 1 │ │   │ │ alloc 3 │ │
│ │ alloc 2 │ │   │ │ alloc 4 │ │
│ └─────────┘ │   │ └─────────┘ │
└──────┬──────┘   └──────┬──────┘
       │                  │
       ▼                  ▼
┌─────────────────────────────────────────────┐
│                  Consul                       │
│    service registry · health checks · DNS    │
└─────────────────────────────────────────────┘
       │
       ▼
┌─────────────────────────────────────────────┐
│                  Traefik                      │
│    ingress · routing · TLS · load balancing  │
└─────────────────────────────────────────────┘
       │
       ▼
┌─────────────────────────────────────────────┐
│               OpenObserve                     │
│    logs · metrics · dashboards · alerts      │
└─────────────────────────────────────────────┘

Component Roles

Container Runtime: Why Podman + crun

np defaults to Podman with crun as the low-level OCI runtime. This is not an arbitrary choice — it flows from first principles.

The four things a container runtime actually does

1. Unpack an OCI image
2. Create namespaces (pid, net, mnt, uts, ipc, user, cgroup)
3. Configure cgroup resource limits
4. Execute the entrypoint

That’s it. Docker wraps these four steps in a daemon architecture born in 2013 — dockerd (~150 MB resident), containerd (~80 MB), and containerd-shim (~10 MB per container). None of this is structurally necessary in a modern Linux environment with systemd socket activation.

Podman + crun vs Docker

What this means for an SME node

On a typical 8 GB node running 50 services:

Net savings: ~680 MB — 8.5% of total memory. That memory runs 10-15 more services instead of infrastructure overheard.

The safety net

np does not lock you in. Set NP_CONTAINER_RUNTIME=docker to switch back. Per-service override is supported in np.yaml:

services:
  - name: legacy-app
    type: container
    source: my-image:latest
    runtime: docker   # use Docker for this specific service

Why this matters for security

Podman’s rootless-by-default model changes the threat equation. A container breakout under Docker means root on the host. Under Podman rootless, the attacker lands in an unprivileged user namespace. For SMEs without dedicated security teams, “secure by default” matters more than “configurable security.”

The dependency calculus

Podman introduces one external dependency: nomad-driver-podman, a third-party Nomad plugin. This is a real trade-off. But the cost is hedged: if the plugin ever becomes unmaintained or incompatible, np can fall back to Docker via one environment variable. No user workloads are affected.

How deployment works

np deploy my-app
  │
  ├─→  Read np.yaml → generate Nomad job spec
  │
  ├─→  Submit job to Nomad (PUT /v1/jobs)
  │
  ├─→  Nomad schedules allocations to clients
  │
  ├─→  Wait for all allocations → "running"
  │
  ├─→  Health check: GET {health_check}
  │         ✅ 200 OK → done
  │         ❌ Error → report + wait

Node requirements

Next: FAQ →