jfxs/terraform-inventory repository overview

⁠Docker Terraform Inventory

A Terraform⁠ Docker image:

• lightweight image based on Alpine Linux,
• multiarch with support of amd64 and arm64,
• non-root container user,
• automatically kept up to date by Renovate⁠ (base image, Terraform, packages and state2inventory),
• image signed with Cosign⁠,
• a software bill of materials (SBOM) attestation added using Syft⁠,
• available on Docker Hub and Quay.io.

The main repository.

The Docker Hub registry.

The Quay.io registry.

Terraform is no longer pinned to the fixed 1.5.* series; it now tracks the official upstream releases.

This image also includes a Python program state2inventory⁠ to generate an Ansible inventory from an infrastructure state.

⁠Running terraform and state2inventory

docker run -t --rm jfxs/terraform-inventory terraform version
docker run -t --rm jfxs/terraform-inventory state2inventory terraform --help

or

docker run -t --rm quay.io/ifxs/terraform-inventory terraform version
docker run -t --rm quay.io/ifxs/terraform-inventory state2inventory terraform --help

To generate an Ansible inventory from a Terraform state, mount your working directory (the container user is non-root and may have an arbitrary uid, so pass yours with the group 0):

terraform show -json > state.json
docker run --rm --user "$(id -u):0" -v "$PWD":/work -w /work jfxs/terraform-inventory \
  state2inventory terraform -s state.json -o inventory.ini

HOME is /tmp: it's writable whatever the uid, but it doesn't persist between runs.

⁠Built with

Docker latest tag is 1.16.5-001, 1.16, 1⁠.

The complete software bill of materials (SBOM) of each published image, with its known vulnerabilities, is collected in the sbom-docker⁠ repository, under the component docker-terraform-inventory.

Dockerhub Overview page⁠ has the details of the last published image.

⁠Versioning

Docker tag definition:

• the Terraform version used,
• a dash
• an increment to differentiate build with the same version starting at 001

<terraform_version>-<increment>

Example: 1.16.4-003

Each publication also moves the tags <major>.<minor> (for example 1.16), <major> (for example 1) and latest.

⁠Development

Requirements: Docker⁠ and Task⁠. The task templates in Taskfile.d/ aren't versioned: download them first.

task install-templates          # download the task templates (Taskfile.d/)
task 00:10-build-local          # build the image, terraform version read from the Dockerfile (ARG VERSION)
task 00:40-test-local           # versions and tests/test-image.sh, as the default user and as an arbitrary uid
task 00:999-pre-commit          # all the linters

Every dependency of the Dockerfile is pinned and kept up to date by Renovate (see renovate.json). The apk pins follow the Alpine branch of the base image tag: when this tag moves to a newer Alpine, update the alpine-main and alpine-community URLs in renovate.json and every apk pin together.

⁠GitLab pipeline

The pipeline uses the op_so GitLab CI components⁠ (lint, renovate, docker). Variables to set in the project settings (protected, and masked when possible):

Renovate runs from a scheduled pipeline with the variable RENOVATE=true; set DISABLE_JOBS=true on this schedule so that no other job runs.

⁠Signature and attestation

Cosign⁠ public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEa3yV6+yd/l4zh/tfT6Tx+zn0dhy3
BhFqSad1norLeKSCN2MILv4fZ9GA6ODOlJOw+7vzUvzZVr9IXnxEdjoWJw==
-----END PUBLIC KEY-----

The public key is also available online: https://gitlab.com/op_so/docker/cosign-public-key/-/raw/main/cosign.pub⁠.

To verify an image:

cosign verify --key cosign.pub $IMAGE_URI

To verify and get the software bill of materials (SBOM) attestation:

cosign verify-attestation --key cosign.pub --type spdxjson $IMAGE_URI | jq '.payload | @base64d | fromjson | .predicate'

⁠Authors

• FX Soubirou - Initial work - GitLab repositories⁠

⁠License

This program is free software: you can redistribute it and/or modify it under the terms of the MIT License (MIT). See the LICENSE⁠ for details.