jfxs/terraform-ansible repository overview

⁠Docker alpine Terraform Ansible

A fully automated, multi‑architecture (amd64/arm64) Docker image that bundles Terraform⁠ and Ansible⁠, with continuous builds, regression testing, and CI‑ready tooling for reproducible infrastructure workflows.

• mitogen⁠ to 1.25x - 7x speedup playbook execution,
• multiarch with support of amd64 and arm64,
• automatically kept up to date by Renovate⁠ (base image and Terraform version),
• image signed with Cosign⁠,
• a software bill of materials (SBOM) attestation added using Syft⁠,
• available on Docker Hub and Quay.io.

The main repository.

The Docker Hub registry.

The Quay.io registry.

Since Ansible version 2.10, the Docker image has only ansible-base without any collection. It could be necessary to install them. This image includes:

• terraform⁠
• ansible-core⁠
• ansible-lint⁠
• go-task⁠
• hvac⁠
• jc⁠
• mitogen⁠
• testinfra⁠
• yamllint⁠
• yq⁠

⁠Running Terraform

Example to run Terraform commands on your current directory:

docker run -it --rm -v $(pwd):/ansible jfxs/terraform-ansible terraform init

docker run -it --rm -v $(pwd):/ansible jfxs/terraform-ansible terraform plan

docker run -it --rm -v $(pwd):/ansible jfxs/terraform-ansible terraform apply

To check the Terraform version bundled in the image:

docker run -t --rm jfxs/terraform-ansible terraform version

⁠Running Ansible

Example to run Ansible playbooks in your current directory:

docker run -it --rm -v $(pwd):/ansible jfxs/terraform-ansible ansible-playbook playbook.yml

To install collections:

docker run -it --rm -v $(pwd):/ansible jfxs/terraform-ansible /bin/sh -c "ansible-galaxy collection install ansible.utils && ansible-playbook playbook.yml"

To test playbooks in your current directory with ansible-lint:

docker run -it --rm -v $(pwd):/ansible jfxs/terraform-ansible ansible-lint playbook.yml

The image ships /etc/ssh/ssh_config with StrictHostKeyChecking no and UserKnownHostsFile /dev/null for all hosts, so ansible-playbook never stops on an unknown or changed host key — convenient for short-lived infrastructure whose host keys change on every provisioning, at the cost of no protection against a man-in-the-middle on the SSH connection. Mount your own ssh_config over /etc/ssh/ssh_config (or point ANSIBLE_SSH_ARGS/ansible.cfg at a different one) if that trade-off does not fit your use case.

⁠Using Mitogen

This image includes mitogen⁠ to speed up Ansible playbooks.

⁠Configuration via ansible.cfg

To enable Mitogen by default, configure it in your ansible.cfg file:

[defaults]
strategy_plugins = /usr/local/lib/python3/site-packages/ansible_mitogen/plugins/strategy
strategy         = mitogen_linear

⁠Configuration via Environment Variables in docker run

If you do not want to configure a custom ansible.cfg file, you can pass environment variables in docker run:

docker run -it --rm \
  -v $(pwd):/ansible \
  -e ANSIBLE_STRATEGY_PLUGINS="/usr/local/lib/python3/site-packages/ansible_mitogen/plugins/strategy" \
  -e ANSIBLE_STRATEGY="mitogen_linear" \
  jfxs/terraform-ansible ansible-playbook playbook.yml

⁠Configuration via Environment Variables in container shell

You can also set environment variables in the container shell before running ansible-playbook:

docker run -it --rm -v $(pwd):/ansible jfxs/terraform-ansible /bin/sh

export ANSIBLE_STRATEGY_PLUGINS="/usr/local/lib/python3/site-packages/ansible_mitogen/plugins/strategy"
export ANSIBLE_STRATEGY="mitogen_linear"
ansible-playbook playbook.yml

⁠Built with

Docker latest tag is 1.16.5-003, 1.16, 1⁠.

The complete software bill of materials (SBOM) of each published image, with its known vulnerabilities, is collected in the sbom-docker⁠ repository, under the component docker-terraform-ansible.

Dockerhub Overview page⁠ has the details of the last published image.

⁠Versioning

Docker tag definition:

• the Terraform version used,
• a dash
• an increment to differentiate build with the same version starting at 001

<terraform_version>-<increment>

Example: 1.15.7-001

⁠Signature and attestation

Cosign⁠ public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEa3yV6+yd/l4zh/tfT6Tx+zn0dhy3
BhFqSad1norLeKSCN2MILv4fZ9GA6ODOlJOw+7vzUvzZVr9IXnxEdjoWJw==
-----END PUBLIC KEY-----

The public key is also available online: https://gitlab.com/op_so/docker/cosign-public-key/-/raw/main/cosign.pub⁠.

To verify an image:

cosign verify --key cosign.pub $IMAGE_URI

To verify and get the SBOM attestation:

cosign verify-attestation --key cosign.pub --type spdxjson $IMAGE_URI | jq '.payload | @base64d | fromjson | .predicate'

⁠Authors

• FX Soubirou - Initial work - GitLab repositories⁠

⁠License

This program is free software: you can redistribute it and/or modify it under the terms of the MIT License (MIT). See the LICENSE⁠ for details.