baredevcontainer/terraform repository overview

⁠terraform

Dev container image for infrastructure-as-code development, with the Terraform⁠ CLI and terraform-ls⁠ language server installed, built on the debian⁠ base image.

Like every image in this repository, it is minimal, built only from upstreams verified at build time, and published with SLSA provenance, a GitHub artifact attestation, and an SBOM; it runs as the non-root user dev. Why these images⁠ explains the reasoning, and Verifying the image⁠ below shows how to check a build.

⁠Image

ghcr.io/bare-devcontainer/terraform:<tag>

Reference it from .devcontainer/devcontainer.json, pinning the digest as well as the tag:

{
  "image": "ghcr.io/bare-devcontainer/terraform:1@sha256:<digest>"
}

⁠Dev Container Template

A ready-to-use Dev Container template for this image is available at bare-devcontainer/templates⁠. It provides the recommended configuration for this image, including security hardening and volume mounts that persist cache directories for faster rebuilds.

⁠Tags

Tags are also published with a date suffix on each build (e.g., 1.16.4-trixie-<YYYYMMDD>).

⁠Installed software

Everything from the debian⁠ base image, plus:

• Terraform⁠ (terraform)
• terraform-ls⁠ (terraform-ls)

Under a Dev Container client, TF_PLUGIN_CACHE_DIR points at ~/.terraform.d/plugin-cache, so providers are downloaded once and shared across working directories. Persisting that directory as a volume keeps them across container rebuilds. Running the image without such a client (docker run, a CI job's container:) leaves the variable unset.

⁠Not installed

• No cloud provider CLIs. aws, gcloud, and az are absent. Add the one the project needs through a Dev Container Feature or your own Dockerfile.
• No credential helpers or authentication. Nothing in the image logs in to a cloud account; supply credentials the way you would outside a container.
• No adjacent Terraform tooling. terragrunt, tflint, tfsec, and similar are left to the project.

⁠Supply chain

terraform and terraform-ls are downloaded directly from HashiCorp's release server⁠. Each binary's checksum is verified against its SHA256SUMS, whose GPG signature (SHA256SUMS.sig) is verified against HashiCorp's release signing key before installation. The key (terraform/hashicorp-signing-key.asc) is committed to this repository, so signatures are checked against a key reviewed here rather than one fetched at build time.

Note that this covers the CLI. Providers that terraform init downloads at runtime come from the Terraform Registry under Terraform's own checksum and signature verification, outside this image's build pipeline.

⁠Verifying the image

Every build is published with SLSA provenance, a GitHub artifact attestation, and an SBOM. The attestation confirms that an image was built by the release workflow of this repository and has not been altered since:

gh attestation verify oci://ghcr.io/bare-devcontainer/terraform:<tag>@sha256:<digest> \
  --owner bare-devcontainer

The Docker Hub mirror carries the same digests, so the same command verifies an image pulled from docker.io/baredevcontainer/terraform. Verifying Published Images⁠ covers inspecting the provenance and the SBOM as well.