baredevcontainer/opentofu repository overview

⁠opentofu

Dev container image for infrastructure-as-code development, with the OpenTofu⁠ CLI and tofu-ls⁠ language server installed, built on the debian⁠ base image.

Like every image in this repository, it is minimal, built only from upstreams verified at build time, and published with SLSA provenance, a GitHub artifact attestation, and an SBOM; it runs as the non-root user dev. Why these images⁠ explains the reasoning, and Verifying the image⁠ below shows how to check a build.

⁠Image

ghcr.io/bare-devcontainer/opentofu:<tag>

Reference it from .devcontainer/devcontainer.json, pinning the digest as well as the tag:

{
  "image": "ghcr.io/bare-devcontainer/opentofu:1@sha256:<digest>"
}

⁠Dev Container Template

A ready-to-use Dev Container template for this image is available at bare-devcontainer/templates⁠. It provides the recommended configuration for this image, including security hardening and volume mounts that persist cache directories for faster rebuilds.

⁠Tags

Tags are also published with a date suffix on each build (e.g., 1.12.6-trixie-<YYYYMMDD>).

⁠Installed software

Everything from the debian⁠ base image, plus:

• OpenTofu⁠ (tofu)
• tofu-ls⁠ (tofu-ls)

Under a Dev Container client, TF_PLUGIN_CACHE_DIR points at ~/.terraform.d/plugin-cache, so providers are downloaded once and shared across working directories. Persisting that directory as a volume keeps them across container rebuilds. Running the image without such a client (docker run, a CI job's container:) leaves the variable unset.

⁠Not installed

• No cloud provider CLIs. aws, gcloud, and az are absent. Add the one the project needs through a Dev Container Feature or your own Dockerfile.
• No credential helpers or authentication. Nothing in the image logs in to a cloud account; supply credentials the way you would outside a container.
• No adjacent OpenTofu tooling. terragrunt, tflint, tfsec, and similar are left to the project.

⁠Supply chain

tofu is downloaded directly from the OpenTofu release page⁠. Its checksum is verified against its SHA256SUMS, whose GPG signature (SHA256SUMS.gpgsig) is verified against OpenTofu's release signing key before installation. The key (opentofu/opentofu-signing-key.asc) is committed to this repository, so signatures are checked against a key reviewed here rather than one fetched at build time.

tofu-ls publishes no signature, so its checksums.txt (opentofu/tofu-ls-checksums.txt) is committed to this repository instead and refreshed whenever the pinned version changes. The archive is verified against that reviewed copy rather than the one served from its own release.

Note that this covers the CLI. Providers that tofu init downloads at runtime come from the OpenTofu Registry under OpenTofu's own checksum and signature verification, outside this image's build pipeline.

⁠Verifying the image

Every build is published with SLSA provenance, a GitHub artifact attestation, and an SBOM. The attestation confirms that an image was built by the release workflow of this repository and has not been altered since:

gh attestation verify oci://ghcr.io/bare-devcontainer/opentofu:<tag>@sha256:<digest> \
  --owner bare-devcontainer

The Docker Hub mirror carries the same digests, so the same command verifies an image pulled from docker.io/baredevcontainer/opentofu. Verifying Published Images⁠ covers inspecting the provenance and the SBOM as well.