houstonj1/opentofu repository overview

⁠houstonj1/opentofu

The latest-stable OpenTofu binary on a hardened debian:bookworm-slim base, bundled with AWS CLI v2 — a small, ready-to-run image for planning and applying OpenTofu from CI or your shell. Same base and contents as houstonj1/terraform, but ships the tofu binary.

The design goal is freshness. The OpenTofu version is resolved at build time to the newest stable release (pre-releases rejected) and the image is rebuilt weekly, so latest always tracks current stable OpenTofu. Security comes from frequent rebuilds (fresh tool + base patches) gated by container scanning, not from version pinning.

⁠Tags

The -slim suffix marks the Debian-slim base on version-pinned tags; latest is unsuffixed. Platforms: linux/amd64, linux/arm64.

⁠Usage

docker run --rm -it houstonj1/opentofu tofu version

# Run a plan against a project mounted from the host
docker run --rm -it -v "$PWD":/app houstonj1/opentofu tofu plan

The image runs as the non-root opentofu user with WORKDIR /app; the default command drops you into bash.

⁠What's inside

• debian:bookworm-slim
• OpenTofu (tofu, latest stable, checksum-verified download)
• AWS CLI v2 (architecture-aware, checksum-verified install)

⁠Security posture

• Latest-stable, not pinned — OpenTofu version resolved at build, rebuilt weekly.
• Patched slim base — apt-get upgrade applied at build, --no-install-recommends, cleaned apt lists, multi-stage build so build tooling never ships.
• Hardened — runs non-root, setuid/setgid bits stripped, OCI labels, and default builds carry SBOM + provenance attestations.
• Scanned — every published image is gated by container scanning.