jfxs/opentofu-inventory repository overview

⁠Docker OpenTofu Inventory

An OpenTofu⁠ Docker image:

• lightweight image based on Alpine Linux, ~70 MB compressed (~300 MB on disk),
• multiarch with support of amd64 and arm64,
• non-root container user,
• includes curl, git, jq and task⁠ for CI usage,
• automatically kept up to date by Renovate⁠ (base image, OpenTofu, packages), then rebuilt and republished,
• image signed with Cosign⁠,
• a software bill of materials (SBOM) attestation added using Syft⁠,
• available on Docker Hub and Quay.io.

The main repository.

The Docker Hub registry.

The Quay.io registry.

This image also includes a Python program state2inventory⁠ to generate an Ansible⁠ inventory from an infrastructure state.

⁠Running OpenTofu and state2inventory

docker run -t --rm jfxs/opentofu-inventory tofu version
docker run -t --rm jfxs/opentofu-inventory state2inventory terraform --help

or

docker run -t --rm quay.io/ifxs/opentofu-inventory tofu version
docker run -t --rm quay.io/ifxs/opentofu-inventory state2inventory terraform --help

The container runs as the non-root user 10010 (group 0). With an arbitrary uid (for example --user 1234:0 or OpenShift) a passwd entry named $USER_NAME (default default; letters, digits, _ and - only) is created at start-up. The group must be 0: with another group /etc/passwd is read-only and the uid stays without a name.

The working directory is /workspace and HOME is /home/tofu, both writable by the container user (HOME is kept apart so that credentials and user configuration never land in a mounted project). To work on local files:

docker run -t --rm --user "$(id -u):0" -v "$PWD":/workspace jfxs/opentofu-inventory tofu version

Files created in the mounted directory belong to your user and to group 0.

⁠Built with

Docker latest tag is 1.13.1-003, 1.13, 1⁠.

The complete software bill of materials (SBOM) of each published image, with its known vulnerabilities, is collected in the sbom-docker⁠ repository, under the component opentofu-inventory.

Dockerhub Overview page⁠ has the details of the last published image.

⁠Versioning

Docker tag definition:

• the OpenTofu version used,
• a dash
• an increment to differentiate build with the same version starting at 001

<opentofu_version>-<increment>

Example: 1.6.0-003

⁠Signature and attestation

Cosign⁠ public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEa3yV6+yd/l4zh/tfT6Tx+zn0dhy3
BhFqSad1norLeKSCN2MILv4fZ9GA6ODOlJOw+7vzUvzZVr9IXnxEdjoWJw==
-----END PUBLIC KEY-----

The public key is also available online: https://gitlab.com/op_so/docker/cosign-public-key/-/raw/main/cosign.pub⁠.

To verify an image:

cosign verify --key cosign.pub $IMAGE_URI

To verify and get the software bill of materials (SBOM) attestation:

cosign verify-attestation --key cosign.pub --type spdxjson $IMAGE_URI | jq '.payload | @base64d | fromjson | .predicate'

⁠Authors

• FX Soubirou - Initial work - GitLab repositories⁠

⁠License

This program is free software: you can redistribute it and/or modify it under the terms of the MIT License (MIT). See the LICENSE⁠ for details.