jswank/container-tofu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
6 commits 1 branch 0 tags 33 KiB
  • Dockerfile 100%
Find a file
Exact
Jason Swank 38f87ef1fe chore: test webhook trigger
2026-10-02 09:01:32 -04:00
.cloudbuild cloudbuild 2026-09-30 22:27:36 -04:00
ctx add ctx directory 2026-10-01 08:24:49 -04:00
Dockerfile Add cfv 2026-09-27 22:21:08 -04:00
LICENSE initial commit 2026-09-27 21:47:44 -04:00
NOTICE initial commit 2026-09-27 21:47:44 -04:00
README.md initial commit 2026-09-27 21:47:44 -04:00
Taskfile.yml initial commit 2026-09-27 21:47:44 -04:00

README.md

container-tofu

A minimal, multi-stage OCI container containing OpenTofu, Task, TFLint, and Config File Validator. This container is designed to be highly secure, lightweight, and fast for infrastructure pipelines (such as Dagger CI pipelines or standalone pipeline steps).

Quickstart

Start an ephemeral container:

$ podman run -ti --rm ghcr.io/jswank/container-tofu:3

Or run individual binaries inside the container:

$ podman run -ti --rm ghcr.io/jswank/container-tofu:3 tofu --version
$ podman run -ti --rm ghcr.io/jswank/container-tofu:3 task --version
$ podman run -ti --rm ghcr.io/jswank/container-tofu:3 tflint --version
$ podman run -ti --rm ghcr.io/jswank/container-tofu:3 validator --version

Design & Multi-Stage Build

The container is built in two stages:

  1. Installer stage (alpine:3 + curl + bash): Downloads the latest versions of the required binaries securely using the installation scripts hosted at jswank.github.io/install.
  2. Runtime stage (alpine:3): An extremely minimal runtime containing only vital execution dependencies:
    • bash (as the default shell / task interpreter)
    • git and openssh-client (required by OpenTofu to fetch modules from remote VCS)
    • ca-certificates (for secure API endpoints/TLS requests)
    • libc6-compat (for glibc compatibility on Alpine) The pre-compiled binaries are copied directly into /usr/local/bin/. A non-root user cli is provided for running workloads securely.

Installed Binaries

Binary Source Repository Purpose
tofu opentofu/opentofu Open source Infrastructure-as-Code tool
task go-task/task A task runner / build tool (substitute for Make)
tflint terraform-linters/tflint A linter for Terraform/OpenTofu code
validator Boeing/config-file-validator A configuration validator for various file formats

Helper Script

The directory bin/cli contains a helper script (using casey/just) that makes it easy to run ephemeral or persistent versions of the container. See bin/cli for options.

License

MIT