Back to Dashboard

opentofu

1.13.1-alpine
Source GHCR Docker Hub

Multi-version retention (3 latest). OpenTofu with AWS, Azure and GCP CLI flavors and daily monitoring of tracked dependencies.

Trust posture

📋 SBOM ATTESTED🛡 0 open alerts🏗 AMD64 + ARM64 🔗 9/9 deps tracked daily 🔍 REPRODUCE THESE CHECKS LOCALLY
PULLS 13.4K 0 to 13416 pulls across 23 recorded days 2026-09-25: 0 pulls2026-09-26: 662 pulls2026-09-27: 662 pulls2026-09-28: 906 pulls2026-09-29: 908 pulls2026-09-30: 1215 pulls2026-10-01: 2246 pulls2026-10-02: 3971 pulls2026-10-03: 5643 pulls2026-10-04: 5773 pulls2026-10-05: 5789 pulls2026-10-06: 6300 pulls2026-10-07: 8864 pulls2026-10-08: 8870 pulls2026-10-09: 11073 pulls2026-10-10: 11172 pulls2026-10-11: 11174 pulls2026-10-12: 11176 pulls2026-10-13: 11216 pulls2026-10-14: 11216 pulls2026-10-15: 12315 pulls2026-10-16: 13267 pulls2026-10-17: 13416 pulls
STARS 0
COVERAGE 15 variants · 3 versions · amd64+arm64

VERIFIABLE TRUST ARTIFACTS

Provenance

Build commit
43b72a4
Build digest
sha256:f08e0fca09532041704c1dcf09aeac4ee53d8ce2f456bc9e23534752952d2afb
Index digest
sha256:519e1749fdbb23ac93dee4774efe48679069bcd51ad8dbd41f80ec1650aef448
Manifest digest (amd64)
sha256:63d9dadc1bcdd51c03b73900ae837fdec1f6bf87e5af1cce0eda3b498c887b98
Manifest digest (arm64)
sha256:6ea47bdf4625f20b884690f8b49b1e5f261467fe70fd705c2fa73009f554fcf1
SBOM attestation
56231493…
Trivy evidence
Code Scanning fetched 2026-10-17 11:24 UTC
Base image
ghcr.io/oorabona/library/alpine:latest
Verify
gh attestation verify oci://ghcr.io/oorabona/opentofu:1.13.1-alpine-base --owner oorabona guide →

Security evidence

Trivy · Code Scanning for image 1.13.1-alpine-base fetched 2026-10-17

0 open Code Scanning alerts · fetched 2026-10-17 · advisory mode (does not block builds)

Code Scanning: 0 open alerts · fetched 2026-10-17Recorded scan: 200 findings · scanned 2026-10-15
0Critical
0High
0Medium
0Low
0Info

No open Code Scanning alerts as of 2026-10-17.

Top advisories (upstream, advisory)

    → See verification steps.

    Explore

    Available variants

    TagSize (amd64) Build statusVersion
    1.13.1-alpine-base213.9MB OK1.13.1-alpine-base
    1.13.1-alpine-aws233.8MB OK1.13.1-alpine-base
    1.13.1-alpine-azure321.7MB OK1.13.1-alpine-base
    1.13.1-alpine-gcp528.6MB OK1.13.1-alpine-base
    1.13.1-alpine default655.4MB OK1.13.1-alpine-base
    1.13.0-alpine-base212.9MB OK1.13.0-alpine-base
    1.13.0-alpine-aws232.5MB OK1.13.0-alpine-base
    1.13.0-alpine-azure319.4MB OK1.13.0-alpine-base
    1.13.0-alpine-gcp374.9MB OK1.13.0-alpine-base
    1.13.0-alpine default500.2MB OK1.13.0-alpine-base
    1.12.6-alpine-base212.4MB OK1.12.6-alpine-base
    1.12.6-alpine-aws232.0MB OK1.12.6-alpine-base
    1.12.6-alpine-azure318.9MB OK1.12.6-alpine-base
    1.12.6-alpine-gcp374.4MB OK1.12.6-alpine-base
    1.12.6-alpine default499.7MB OK1.12.6-alpine-base
    Build lineagef08e0fca0953
    Build Lineage
    Build Digest sha256:f08e0fca09532041704c1dcf09aeac4ee53d8ce2f456bc9e23534752952d2afb
    Base Image ghcr.io/oorabona/library/alpine:latest
    TFLINT_VERSION 0.64.0
    TRIVY_VERSION 0.76.0
    TERRAGRUNT_VERSION 1.1.6
    TERRAFORM_DOCS_VERSION 0.24.0
    INFRACOST_VERSION 0.10.46
    GITHUB_CLI_VERSION 2.102.0
    AWS_CLI_VERSION 1.46.1
    AZURE_CLI_VERSION 2.91.0
    GCP_CLI_VERSION latest
    JINJA2_CLI_VERSION 1.0.1
    VERSION 1.13.1-alpine
    MAJOR_VERSION 1
    UPSTREAM_VERSION 1.13.1
    FLAVOR full
    REMOTE_CR ghcr.io/oorabona
    Package summary 1625 packages
    Recent changes +0 −2 ~83
    Build history 9 builds
    Dependency health all up to date

    Dependency Health

    all up to date
    9/9 dependencies monitored
    Up-to-date dependencies
    TFLINT_VERSION 0.64.0 TRIVY_VERSION 0.76.0 TERRAGRUNT_VERSION 1.1.6 TERRAFORM_DOCS_VERSION 0.24.0 INFRACOST_VERSION 0.10.46 GITHUB_CLI_VERSION 2.102.0 AWS_CLI_VERSION 1.46.1 AZURE_CLI_VERSION 2.91.0 JINJA2_CLI_VERSION 1.0.1
    Upstream Monitor Workflow

    Documentation

    README

    OpenTofu

    OpenTofu CLI with the same security, DevOps, and cloud-provider toolset as the repository’s Terraform image. It is published to GHCR in focused AWS, Azure, GCP, base, and full flavors.

    OpenTofu is licensed under MPL-2.0. During the build, the tofu binary is checksum-checked against the release’s SHA256SUMS before it is extracted. This is an integrity check of the release manifest; signature verification is not part of this image build.

    GHCR Build

    Quick start

    # Full flavor with all cloud CLIs
docker pull ghcr.io/oorabona/opentofu:1.12.6-alpine

# Smallest flavor; no cloud CLI
docker pull ghcr.io/oorabona/opentofu:1.12.6-alpine-base

docker run --rm -v "$(pwd)":/data \
  ghcr.io/oorabona/opentofu:1.12.6-alpine init

    Tags and flavors

    Tag Cloud CLIs
    <version>-alpine-base None
    <version>-alpine-aws AWS CLI
    <version>-alpine-azure Azure CLI
    <version>-alpine-gcp Google Cloud SDK
    <version>-alpine AWS CLI, Azure CLI, Google Cloud SDK

    All flavors contain OpenTofu, TFLint, Trivy, Terragrunt, terraform-docs, Infracost, GitHub CLI, jinja2-cli, Git, Jq, Yq, Bash, Curl, and Python 3. Terragrunt is configured to invoke OpenTofu through TG_TF_PATH=tofu.

    Usage

    # Plan an OpenTofu configuration
docker run --rm -v "$(pwd)":/data \
  ghcr.io/oorabona/opentofu:1.12.6-alpine plan

# Generate module documentation
docker run --rm -v "$(pwd)":/data --entrypoint terraform-docs \
  ghcr.io/oorabona/opentofu:1.12.6-alpine markdown table .

# Scan the current configuration
docker run --rm -v "$(pwd)":/data --entrypoint trivy \
  ghcr.io/oorabona/opentofu:1.12.6-alpine config .

    The entrypoint renders *.tf.j2 templates using CONFIGFILE (default: config.json) before passing its arguments to tofu.

    Build arguments

    config.yaml pins the shared tool versions. VERSION is the public tag such as 1.12.6-alpine; the build hook derives and passes UPSTREAM_VERSION so the Dockerfile downloads the matching OpenTofu release tarball for TARGETARCH.