Nojam and Atlantis
Atlantis is the open-source pull request bot many teams start with. It runs Terraform on its own server and comments the result on the pull request. Nojam is built for teams whose Terraform changes HashiCorp Vault and who need to prove each change afterwards.
What Atlantis does better
- It is open source under the Apache 2.0 licence, free, and has years of use and a large community behind it.
- It is simple to run: one server, configured in a file, with no database.
- It works with more Git hosts than GitHub. Nojam supports GitHub.com and GitHub Enterprise Server only.
- It treats every provider the same way. Nojam’s safety features are built for Vault.
Where Nojam differs
- Atlantis runs plans and applies on its own server with that server’s standing credentials. Nojam gives each job its own short-lived Vault credential in an isolated Podman container, and revokes it when the job ends.
- Atlantis keeps plans on disk and has no audit log. Nojam keeps a hash-chained, signed audit log and one export per change.
- In Atlantis, stopping authors from approving their own changes is a Conftest option, off by default. In Nojam the author can never approve, and production approval needs MFA.
- Atlantis published twelve security advisories on 25 October 2026, among them a critical fork-protection bypass. Nojam’s threat model goes to every pilot customer.
Which to choose
Choose Atlantis if
You want a free, open-source bot, your Terraform is mostly not Vault, or your code lives on GitLab or Bitbucket.
Choose Nojam if
Your Terraform manages Vault, and you need per-job credentials, assured approvals and an audit trail an auditor can verify.
Facts about Atlantis come from its own pages, read on 7 November 2026: Atlantis security, Atlantis security advisories. If something here is out of date, write to us and we’ll correct it.
Compare them on your own Vault
A pilot runs next to your current pipeline in shadow mode, so you can compare the two on real changes.