Nojam compared with other Terraform runners
Each page says what the other tool does better, where Nojam differs for a Vault estate, and when to choose which. Facts about other tools come from their own pages, read on 7 November 2026.
Compare Nojam with
- AtlantisSelf-hosted, open-source pull request bot for Terraform.
- HCP TerraformHashiCorp’s hosted Terraform platform, now part of IBM; Terraform Enterprise is the self-hosted edition.
- SpaceliftHosted infrastructure-as-code platform with private worker pools.
- env0Hosted platform for Terraform and other infrastructure tools, priced by run.
- StateGraphTerraform state kept as a graph in PostgreSQL, with plans run in your own CI.
Who holds the apply credential
For a Vault estate, the most useful question to ask of any runner is where Terraform runs and which credential it runs with.
| Tool | Model | Where Terraform runs | Apply credential | Audit |
|---|---|---|---|---|
| Nojam | Self-hosted binary on PostgreSQL | Podman containers on your runner hosts | A per-job, per-phase Vault credential, revoked at the end | Hash-chained, signed, streamed to your store |
| Atlantis | Self-hosted bot | On the Atlantis server | The server’s standing credentials | None; plans on disk |
| HCP Terraform | Hosted; Terraform Enterprise self-hosted | HashiCorp’s VMs, or agents you run | Workload identity, or static variables | Premium tier |
| Spacelift | Hosted; private workers | Spacelift’s containers or your worker pools | Short-lived cloud tokens by OIDC | Enterprise tier |
| env0 | Hosted | Runners | The credentials you supply | Listed as a feature; details not stated |
| StateGraph | Hosted, single-tenant or self-hosted | Your CI or a laptop | Your CI’s secret store | Attributed history, 30 or 365 days |
Compare them on your own Vault
A pilot runs next to your current pipeline in shadow mode, so you can compare on real changes.