terraform-docker

Terraform Docker image

Table of Contents

• Description
• What's Included
• Prerequisites
• Quick Start
• Tags
• Platform Support
• Usage
• Examples
• Customization
• Build & Refresh Schedule
• Security
• Contributing
• License

Description

Welcome to my Terraform Docker repo. I've built this image with Terraform development and CI/CD in mind. The image contains various popular utilities often used in Terraform development. Utility versions are pinned in the Dockerfile and kept current through dependency-update PRs; the image is rebuilt and published to Docker Hub weekly (Mondays) to pick up base-image security patches.

What's Included

The following utilities are included in this image:

• terraform: Software tool that enables you to safely and predictably create, change, and improve infrastructure
• terragrunt: A thin wrapper for Terraform that provides extra tools for working with multiple Terraform modules
• terraform-docs: Generate documentation from Terraform modules in various output formats
• tflint: A Pluggable Terraform Linter
• trivy: Security scanner for your Terraform code

Prerequisites

• Docker 20.10 or later
• Docker Buildx with BuildKit (required for multi-platform builds and the automatic platform args the Dockerfile relies on)

Quick Start

# Pull and run the latest version
docker pull hansohn/terraform:latest
docker run -it --rm hansohn/terraform:latest terraform version

# Run with your Terraform code mounted
docker run -it --rm -v $(pwd):/workspace -w /workspace hansohn/terraform:latest terraform plan

Tags

Docker images are tagged based on the pinned version of Terraform they include. A single Terraform version is published at a time (the version pinned in the Dockerfile), and it receives the full set of tags below:

# tag formats (for a pinned Terraform version of e.g. 1.15.7)
hansohn/terraform:latest        the currently published release
hansohn/terraform:1             the 1.x.x line
hansohn/terraform:1.15          the 1.15.x line
hansohn/terraform:1.15.7        the exact version

For reproducibility, pin by digest (hansohn/terraform@sha256:...); every image ships provenance attestations and an SBOM bound to that digest.

Platform Support

This image supports multiple platforms:

• linux/amd64 (x86_64)
• linux/arm64 (ARM64/Apple Silicon)

Docker will automatically pull the correct architecture for your system.

Usage

Published images can be run using the following syntax:

# run latest published version
docker run -it --rm hansohn/terraform:latest /bin/bash

Local images can be built and run using the following syntax:

# build and run local image
make

Additionally, a Makefile has been included in this repo to assist with common development-related functions. I've included the following make targets for convenience:

Available targets:

  clean                               Clean everything
  dev                                 Initialize development environment
  docker/build                        Docker build image
  docker/check                        Check if Docker daemon is running
  docker/clean                        Docker clean build images
  docker/lint                         Lint Dockerfile
  docker/push                         Docker push image
  docker/run                          Docker run image
  help                                Help screen
  help/all                            Display help for all targets
  help/short                          This help short screen

Examples

Initialize Terraform

docker run -it --rm -v $(pwd):/workspace -w /workspace \
  hansohn/terraform:latest terraform init

Plan with Terragrunt

docker run -it --rm -v $(pwd):/workspace -w /workspace \
  hansohn/terraform:latest terragrunt plan

Generate Documentation

docker run -it --rm -v $(pwd):/docs -w /docs \
  hansohn/terraform:latest terraform-docs markdown . > README.md

Run Security Scan

docker run -it --rm -v $(pwd):/src -w /src \
  hansohn/terraform:latest trivy config .

Run Linter

docker run -it --rm -v $(pwd):/src -w /src \
  hansohn/terraform:latest tflint

Customization

Utilities

Utility versions are pinned in the Dockerfile and kept current through automated dependency-update PRs. For a local build you can override any of them on the command line to target a specific version:

• TERRAFORM_VERSION
• TERRAGRUNT_VERSION
• TERRAFORM_DOCS_VERSION
• TFLINT_VERSION
• TRIVY_VERSION

# build against a specific Terraform version
TERRAFORM_VERSION=1.2.3 make docker/build

Note: Builds require BuildKit (the default in modern Docker). The Dockerfile uses BuildKit's automatic TARGETARCH/BUILDARCH args, so DOCKER_BUILDKIT=0 is not supported.

Build & Refresh Schedule

Images are automatically:

• Built and linted on every push (multi-platform, without publishing)
• Published when a version tag is pushed
• Refreshed every Monday at 7am UTC to pick up the latest base-image security patches

This ensures published images stay up-to-date with the latest base image security updates.

Security

• Images include provenance attestations and SBOM (Software Bill of Materials)
• Published images are scanned for vulnerabilities with Trivy
• Security vulnerabilities? See our Security Policy

Contributing

Contributions are welcome! Please see our Contributing Guide for details.

• Report bugs via Issues
• Request features via Feature Requests
• Submit PRs following our PR Template

License

This project is licensed under the terms specified in LICENSE.