nnthanh101/terraform repository overview

⁠nnthanh101/terraform

A reproducible, audit-ready Terraform toolchain for teams that deliver on AWS, Azure and Kubernetes.

⁠Why this image exists

Toolchain drift costs infrastructure teams hours each week: the wrong Terraform version, a missing scanner, a CI job that differs from the laptop. This image gives every engineer, every CI runner and every HITL review the same verified binaries. Pin it by digest and the toolchain cannot change under you.

⁠Choose a tag

Pin the multi-arch index digest: nnthanh101/terraform:<version>-aws@sha256:<digest>. The aws tag leaves out the vendor coding CLI, model SDKs, Azure CLI, Ansible, Vault, Atlantis, ngrok, k3d, nginx, Go and Playwright. Every tag is built for linux/amd64 and linux/arm64. Measured on 2026-09-23, the aws tag is about 0.4 GB to pull.

⁠What is included

All versions come from .devcontainer/versions.env. Renovate proposes updates each week, after a 7-day waiting period.

Image version: 2.11.0 (from .devcontainer/terraform/VERSION).

Base image (every target): cgr.dev/chainguard/wolfi-base:latest@sha256:1d95114038f76513a9ace6fca107d5582b08c65981f81f61cb56bf7fd2ef216d

Wolfi = the signed Wolfi package, updated weekly. slim and full also carry task and Python from Wolfi. trivy is the cosign-verified release binary; checkov on aws is installed from a hash-locked lock file.

⁠Get started

docker run --rm --read-only --tmpfs /tmp --user "$(id -u):$(id -g)" -e HOME=/tmp \
  -v "$PWD:/workspace" -w /workspace \
  nnthanh101/terraform:aws terraform version

Pin what you tested. This prints the digest to use as nnthanh101/terraform@sha256:<digest>:

docker buildx imagetools inspect nnthanh101/terraform:aws --format '{{json .Manifest.Digest}}'

GitHub Actions job:

jobs:
  plan:
    runs-on: ubuntu-latest
    container:
      image: nnthanh101/terraform:<version>-aws@sha256:<digest>
      options: --user 0  # prevents EACCES on the runner's temporary directories
    steps:
      - uses: actions/checkout@<commit-sha> # pin actions by commit
      - run: terraform init && terraform plan

⁠Security

• No built-in keys: the image creates no SSH key and ships no SSH host keys; the release gate checks both, and that no build step ran ssh-keygen. Tags built before 2.11.0 contain an SSH private key made at build time; treat those keys as compromised.
• Verified downloads: each binary is checked against the vendor's SHA256 list, and with cosign or the HashiCorp release key where the vendor signs.
• Signed by CI: every release digest built by .github/workflows/docker-release-terraform.yml on main is signed keylessly with cosign. A digest published from a workstation with task docker:publish passes the same gate but is not signed; pin a signed digest for releases.
• Provenance and SBOM: each release carries build provenance (mode=max) and an SBOM.
• Blocking scan: Trivy stops a release on any fixable HIGH or CRITICAL finding. Findings that remain in a vendor's latest release are accepted only as dated entries in trivyignore.yaml (90 days or less; the 2.11.0 entries expire on 2026-12-22), and the gate fails again on expiry.
• Weekly rebuild: Wolfi package fixes reach the image every Monday.
• Non-root: user os (UID 11111).
• Air-gapped use: mirror the digest to a private registry and pin the mirror by the same digest; the image needs no network access to run.
• Known gap: the slim and full tags still install the vendor coding CLI with its installer script. The aws tag does not.

Verify a CI release before use (a digest published from a workstation is not signed, so this fails for it):

digest=$(docker buildx imagetools inspect nnthanh101/terraform:aws --format '{{json .Manifest.Digest}}' | tr -d '"')
cosign verify \
  --certificate-identity-regexp '^https://github.com/1xOps/adlc-framework/.github/workflows/docker-release-' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  "nnthanh101/terraform@$digest"

⁠Links

• GitHub source⁠
• ADLC Framework⁠
• Chainguard Wolfi⁠
• versions.env⁠