oorabona/terraform repository overview

gh attestation verify oci://ghcr.io/oorabona/terraform:latest --owner oorabona

# Full flavor with all cloud CLIs (recommended for development)
docker pull ghcr.io/oorabona/terraform:latest

# Base flavor (smallest image, no cloud CLIs)
docker pull ghcr.io/oorabona/terraform:latest-base

# AWS-specific flavor
docker pull ghcr.io/oorabona/terraform:latest-aws

# Azure-specific flavor
docker pull ghcr.io/oorabona/terraform:latest-azure

# GCP-specific flavor
docker pull ghcr.io/oorabona/terraform:latest-gcp

ghcr.io/oorabona/terraform:{version}-{flavor}

services:
  terraform:
    image: ghcr.io/oorabona/terraform:latest
    user: "1000:1000"
    volumes:
      - .:/data
      - ~/.aws:/home/terraform/.aws:ro  # AWS credentials (read-only)
      - ~/.azure:/home/terraform/.azure:ro  # Azure credentials (read-only)
      - ~/.config/gcloud:/home/terraform/.config/gcloud:ro  # GCP credentials (read-only)
    environment:
      # Pass credentials from environment, never hardcode
      - AWS_ACCESS_KEY_ID
      - AWS_SECRET_ACCESS_KEY
      - AWS_DEFAULT_REGION
      - AZURE_SUBSCRIPTION_ID
      - AZURE_TENANT_ID
      - AZURE_CLIENT_ID
      - AZURE_CLIENT_SECRET
      - GOOGLE_APPLICATION_CREDENTIALS
      - TF_VAR_project_id

# Initialize and plan
docker run --rm \
  -v $(pwd):/data \
  -v ~/.aws:/home/terraform/.aws:ro \
  ghcr.io/oorabona/terraform:latest-aws \
  init

docker run --rm \
  -v $(pwd):/data \
  -v ~/.aws:/home/terraform/.aws:ro \
  -e AWS_DEFAULT_REGION \
  ghcr.io/oorabona/terraform:latest-aws \
  plan

# Apply with environment credentials
docker run --rm -it \
  -v $(pwd):/data \
  -e AWS_ACCESS_KEY_ID \
  -e AWS_SECRET_ACCESS_KEY \
  -e AWS_DEFAULT_REGION \
  ghcr.io/oorabona/terraform:latest-aws \
  apply

# Create templated Terraform files with .j2 extension
# Example: main.tf.j2
resource "aws_instance" "{{ instance_name }}" {
  instance_type = "{{ instance_type }}"
  ami           = "{{ ami_id }}"
}

# Create config.json with template variables
{
  "instance_name": "web-server",
  "instance_type": "t3.micro",
  "ami_id": "ami-12345678"
}

# Process templates
docker run --rm \
  -v $(pwd):/data \
  ghcr.io/oorabona/terraform:latest \
  bash -c "for f in *.tf.j2; do jinja2 \$f config.json > \${f%.j2}; done && terraform plan"

# Scan Terraform configurations for misconfigurations
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  trivy config .

# Scan with detailed output
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  trivy config --format table --severity HIGH,CRITICAL .

# Scan for sensitive data
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  trivy fs --scanners secret .

# Initialize TFLint plugins
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  tflint --init

# Lint Terraform files
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  tflint

# Lint with AWS plugin
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest-aws \
  tflint --config=.tflint.hcl

# Generate README.md from Terraform modules
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  terraform-docs markdown table . > README.md

# Generate JSON output
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  terraform-docs json . > module.json

# Generate cost breakdown
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  infracost breakdown --path .

# Compare costs between branches
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  infracost diff --path .

# Build specific flavor
docker build --build-arg VERSION=latest --build-arg FLAVOR=aws -t terraform:aws .

# Build full flavor (default)
docker build --build-arg VERSION=latest -t terraform:full .

# Build base flavor
docker build --build-arg VERSION=latest --build-arg FLAVOR=base -t terraform:base .

# BAD - Never do this:
environment:
  AWS_ACCESS_KEY_ID: AKIAIOSFODNN7EXAMPLE

# GOOD - Use environment variables:
environment:
  AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
  AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}

# BETTER - Use credential files mounted read-only:
volumes:
  - ~/.aws:/home/terraform/.aws:ro

services:
  terraform:
    image: ghcr.io/oorabona/terraform:latest
    user: "1000:1000"  # terraform:terraform
    read_only: true
    tmpfs:
      - /.terraform.d
      - /.config
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    volumes:
      - .:/data:ro  # Read-only if only planning
      - ~/.aws:/home/terraform/.aws:ro
    environment:
      # Pass credentials from environment, never hardcode
      - AWS_ACCESS_KEY_ID
      - AWS_SECRET_ACCESS_KEY
      - AWS_DEFAULT_REGION

# Scan for security issues before applying
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  trivy config --severity HIGH,CRITICAL .

# Scan for common Terraform mistakes
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  tflint --enable-rule=terraform_deprecated_interpolation

# Check for secrets in code
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  trivy fs --scanners secret .

terraform/
├── Dockerfile                 # Multi-stage, multi-flavor build
├── docker-entrypoint.sh       # Entrypoint script
├── docker-compose.yml         # Example composition
├── config.yaml               # Tool version configuration
├── version.sh                # Upstream version discovery
└── build                     # Build script with auto-version detection

- name: Terraform Plan
  uses: docker://ghcr.io/oorabona/terraform:latest-aws
  with:
    args: plan -out=tfplan
  env:
    AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
    AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    AWS_DEFAULT_REGION: us-east-1

- name: Security Scan
  uses: docker://ghcr.io/oorabona/terraform:latest
  with:
    args: trivy config --exit-code 1 --severity HIGH,CRITICAL .

- name: Cost Estimation
  uses: docker://ghcr.io/oorabona/terraform:latest
  with:
    args: infracost breakdown --path .
  env:
    INFRACOST_API_KEY: ${{ secrets.INFRACOST_API_KEY }}

terraform:
  image: ghcr.io/oorabona/terraform:latest-aws
  script:
    - terraform init
    - terraform plan
    - trivy config .
  variables:
    AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
    AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY

# Ensure proper user ownership
docker run --rm -it --user 1000:1000 \
  -v $(pwd):/data \
  ghcr.io/oorabona/terraform:latest init

# Or fix permissions on host
sudo chown -R 1000:1000 .terraform/

# Clear plugin cache
rm -rf .terraform/
docker run --rm -v $(pwd):/data \
  ghcr.io/oorabona/terraform:latest init -upgrade

# AWS - Verify credentials
docker run --rm \
  -e AWS_ACCESS_KEY_ID \
  -e AWS_SECRET_ACCESS_KEY \
  ghcr.io/oorabona/terraform:latest-aws \
  aws sts get-caller-identity

# Azure - Verify login
docker run --rm \
  -v ~/.azure:/home/terraform/.azure:ro \
  ghcr.io/oorabona/terraform:latest-azure \
  az account show

# GCP - Verify authentication
docker run --rm \
  -v ~/.config/gcloud:/home/terraform/.config/gcloud:ro \
  ghcr.io/oorabona/terraform:latest-gcp \
  gcloud auth list