Back to Dashboard

terraform

1.16.6-alpine
Source GHCR Docker Hub

Multi-version retention (3 latest). AWS, Azure and GCP CLI flavors. Daily upstream monitoring of tracked dependencies.

Trust posture

📋 SBOM ATTESTED🛡 0 open alerts🏗 AMD64 + ARM64 🔗 9/9 deps tracked daily 🔍 REPRODUCE THESE CHECKS LOCALLY
PULLS 142.0K 107670 to 142067 pulls across 30 recorded days 2026-09-18: 107670 pulls2026-09-19: 107739 pulls2026-09-20: 108957 pulls2026-09-21: 109998 pulls2026-09-22: 111225 pulls2026-09-23: 112022 pulls2026-09-24: 112115 pulls2026-09-25: 116014 pulls2026-09-26: 122303 pulls2026-09-27: 122517 pulls2026-09-28: 123282 pulls2026-09-29: 123529 pulls2026-09-30: 124367 pulls2026-10-01: 125780 pulls2026-10-02: 127614 pulls2026-10-03: 129382 pulls2026-10-04: 130666 pulls2026-10-05: 130723 pulls2026-10-06: 131270 pulls2026-10-07: 134355 pulls2026-10-08: 134585 pulls2026-10-09: 137388 pulls2026-10-10: 137819 pulls2026-10-11: 137937 pulls2026-10-12: 138090 pulls2026-10-13: 138090 pulls2026-10-14: 138714 pulls2026-10-15: 141005 pulls2026-10-16: 142062 pulls2026-10-17: 142067 pulls
STARS 0
COVERAGE 15 variants · 3 versions · amd64+arm64

VERIFIABLE TRUST ARTIFACTS

Provenance

Build commit
43b72a4
Build digest
sha256:9b974539d0121238759fcfdfc2652e39bcac4b862cff7c0fb2ae176306fb0de2
Index digest
sha256:11786d009bbb141027e93e792379d5b49d774af38057884c7b5863bf502d3e0c
Manifest digest (amd64)
sha256:e9a1bf29c838f736717b2326c848c29e57f55c059ba421258341375f804da9ee
Manifest digest (arm64)
sha256:2d22364710156eb45ab3eb303e710539a4552b048c7610850ad2cb200d1cc637
SBOM attestation
56231497…
Trivy evidence
Code Scanning fetched 2026-10-17 11:24 UTC
Base image
ghcr.io/oorabona/hashicorp/terraform:1.16.6
Verify
gh attestation verify oci://ghcr.io/oorabona/terraform:1.16.6-alpine-base --owner oorabona guide →

Security evidence

Trivy · Code Scanning for image 1.16.6-alpine-base fetched 2026-10-17

0 open Code Scanning alerts · fetched 2026-10-17 · advisory mode (does not block builds)

Code Scanning: 0 open alerts · fetched 2026-10-17Recorded scan: 192 findings · scanned 2026-10-15
0Critical
0High
0Medium
0Low
0Info

No open Code Scanning alerts as of 2026-10-17.

Top advisories (upstream, advisory)

    → See verification steps.

    Explore

    Available variants

    TagSize (amd64) Build statusVersion
    1.16.6-alpine-base214.6MB OK1.16.6-alpine-base
    1.16.6-alpine-aws234.6MB OK1.16.6-alpine-base
    1.16.6-alpine-azure322.4MB OK1.16.6-alpine-base
    1.16.6-alpine-gcp529.3MB OK1.16.6-alpine-base
    1.16.6-alpine default656.1MB OK1.16.6-alpine-base
    1.16.5-alpine-base213.6MB OK1.16.5-alpine-base
    1.16.5-alpine-aws233.2MB OK1.16.5-alpine-base
    1.16.5-alpine-azure320.1MB OK1.16.5-alpine-base
    1.16.5-alpine-gcp375.6MB OK1.16.5-alpine-base
    1.16.5-alpine default500.9MB OK1.16.5-alpine-base
    1.16.4-alpine-base213.6MB OK1.16.4-alpine-base
    1.16.4-alpine-aws233.2MB OK1.16.4-alpine-base
    1.16.4-alpine-azure320.1MB OK1.16.4-alpine-base
    1.16.4-alpine-gcp375.6MB OK1.16.4-alpine-base
    1.16.4-alpine default500.9MB OK1.16.4-alpine-base
    Build lineage9b974539d012
    Build Lineage
    Build Digest sha256:9b974539d0121238759fcfdfc2652e39bcac4b862cff7c0fb2ae176306fb0de2
    Base Image ghcr.io/oorabona/hashicorp/terraform:1.16.6
    TFLINT_VERSION 0.64.0
    TRIVY_VERSION 0.76.0
    TERRAGRUNT_VERSION 1.1.6
    TERRAFORM_DOCS_VERSION 0.24.0
    INFRACOST_VERSION 0.10.46
    GITHUB_CLI_VERSION 2.102.0
    AWS_CLI_VERSION 1.46.1
    AZURE_CLI_VERSION 2.91.0
    GCP_CLI_VERSION latest
    JINJA2_CLI_VERSION 1.0.1
    VERSION 1.16.6-alpine
    MAJOR_VERSION 1
    UPSTREAM_VERSION 1.16.6
    FLAVOR full
    REMOTE_CR ghcr.io/oorabona
    Package summary 1631 packages
    Recent changes +0 −2 ~83
    Build history 3 builds
    Dependency health all up to date

    Dependency Health

    all up to date
    9/9 dependencies monitored
    Up-to-date dependencies
    TFLINT_VERSION 0.64.0 TRIVY_VERSION 0.76.0 TERRAGRUNT_VERSION 1.1.6 TERRAFORM_DOCS_VERSION 0.24.0 INFRACOST_VERSION 0.10.46 GITHUB_CLI_VERSION 2.102.0 AWS_CLI_VERSION 1.46.1 AZURE_CLI_VERSION 2.91.0 JINJA2_CLI_VERSION 1.0.1
    Upstream Monitor Workflow

    Documentation

    README

    Terraform

    Enterprise-grade Terraform container with comprehensive DevOps tooling for multi-cloud infrastructure as code. Available in multiple flavors optimized for AWS, Azure, GCP, or all clouds.

    Docker Hub GHCR Build

    Verify this image

    Every build ships a Sigstore-signed SBOM and a full Trivy scan — verify them yourself, no login required:

    gh attestation verify oci://ghcr.io/oorabona/terraform:latest --owner oorabona

    Full walkthrough (SBOM payload, Trivy findings, multi-arch manifest inspection, upstream dependency tracking) → https://oorabona.github.io/docker-containers/verify-images/

    Quick Start

    # Full flavor with all cloud CLIs (recommended for development)
docker pull ghcr.io/oorabona/terraform:latest

# Base flavor (smallest image, no cloud CLIs)
docker pull ghcr.io/oorabona/terraform:latest-base

# AWS-specific flavor
docker pull ghcr.io/oorabona/terraform:latest-aws

# Azure-specific flavor
docker pull ghcr.io/oorabona/terraform:latest-azure

# GCP-specific flavor
docker pull ghcr.io/oorabona/terraform:latest-gcp

    Available Flavors

    All flavors include the core security and DevOps toolkit. The difference is which cloud CLIs are included:

    Flavor Description Cloud CLIs Use Case
    base Core tools only None Smallest image, cloud-agnostic
    aws AWS optimized AWS CLI AWS-only infrastructure
    azure Azure optimized Azure CLI Azure-only infrastructure
    gcp GCP optimized Google Cloud SDK GCP-only infrastructure
    full All clouds AWS CLI + Azure CLI + Google Cloud SDK Multi-cloud or development

    Jinja2 templating (jinja2-cli) is bundled in every flavor — the entrypoint renders *.tf.j2 files unconditionally.

    Flavor Details

    Base (*-base)

    Includes Terraform, security scanning, linting, and documentation tools. No cloud provider CLIs installed. Smallest image size.

    Tools:

    • Terraform
    • TFLint (linting)
    • Trivy (security scanning)
    • Terragrunt (orchestration)
    • terraform-docs (documentation generation)
    • Infracost (cost estimation)
    • GitHub CLI
    • jinja2-cli (Jinja2 templating)
    • Git, Jq, Yq

    AWS (*-aws)

    Includes base + AWS CLI for Amazon Web Services infrastructure.

    Additional tools:

    • AWS CLI (pinned version for reproducibility)

    Azure (*-azure)

    Includes base + Azure CLI for Microsoft Azure infrastructure.

    Additional tools:

    • Azure CLI (pinned version for reproducibility)

    GCP (*-gcp)

    Includes base + Google Cloud SDK for Google Cloud Platform infrastructure.

    Additional tools:

    • Google Cloud SDK (always latest - GCP installer doesn’t support version pinning)
    • gcloud, gsutil, bq commands

    Full (*-full)

    Includes all cloud CLIs. Recommended for:

    • Multi-cloud environments
    • Development and testing
    • CI/CD pipelines
    • Template-based infrastructure

    Additional tools:

    • AWS CLI
    • Azure CLI
    • Google Cloud SDK

    Image Tags

    ghcr.io/oorabona/terraform:{version}-{flavor}

    Examples:

    • latest or latest-full - Latest Terraform, all clouds
    • latest-base - Latest Terraform, no cloud CLIs
    • latest-aws - Latest Terraform with AWS CLI
    • 1.10.3-azure - Terraform 1.10.3 with Azure CLI

    Tools Reference

    All versions are pinned and automatically monitored for updates:

    Tool Version Description Flavors
    Terraform (upstream) Infrastructure as code All
    TFLint 0.60.0 Terraform linter All
    Trivy 0.69.1 Security scanner All
    Terragrunt 0.99.1 Terraform orchestration All
    terraform-docs 0.21.0 Documentation generator All
    Infracost 0.10.43 Cloud cost estimation All
    GitHub CLI 2.86.0 GitHub automation All
    AWS CLI 1.44.33 Amazon Web Services CLI aws, full
    Azure CLI 2.83.0 Microsoft Azure CLI azure, full
    Google Cloud SDK latest Google Cloud Platform CLI gcp, full
    jinja2-cli 1.0.1 Jinja2 templating CLI All

    Built-in Utilities

    All flavors include:

    • Git - Version control
    • Jq - JSON processor
    • Yq - YAML processor
    • jinja2-cli - Jinja2 templating
    • Bash - Shell scripting
    • Curl - HTTP client
    • Python 3 - Scripting runtime

    Usage

    services:
  terraform:
    image: ghcr.io/oorabona/terraform:latest
    user: "1000:1000"
    volumes:
      - .:/data
      - ~/.aws:/home/terraform/.aws:ro  # AWS credentials (read-only)
      - ~/.azure:/home/terraform/.azure:ro  # Azure credentials (read-only)
      - ~/.config/gcloud:/home/terraform/.config/gcloud:ro  # GCP credentials (read-only)
    environment:
      # Pass credentials from environment, never hardcode
      - AWS_ACCESS_KEY_ID
      - AWS_SECRET_ACCESS_KEY
      - AWS_DEFAULT_REGION
      - AZURE_SUBSCRIPTION_ID
      - AZURE_TENANT_ID
      - AZURE_CLIENT_ID
      - AZURE_CLIENT_SECRET
      - GOOGLE_APPLICATION_CREDENTIALS
      - TF_VAR_project_id

    Docker Run

    # Initialize and plan
docker run --rm \
  -v $(pwd):/data \
  -v ~/.aws:/home/terraform/.aws:ro \
  ghcr.io/oorabona/terraform:latest-aws \
  init

docker run --rm \
  -v $(pwd):/data \
  -v ~/.aws:/home/terraform/.aws:ro \
  -e AWS_DEFAULT_REGION \
  ghcr.io/oorabona/terraform:latest-aws \
  plan

# Apply with environment credentials
docker run --rm -it \
  -v $(pwd):/data \
  -e AWS_ACCESS_KEY_ID \
  -e AWS_SECRET_ACCESS_KEY \
  -e AWS_DEFAULT_REGION \
  ghcr.io/oorabona/terraform:latest-aws \
  apply

    Jinja2 Templating

    Every flavor includes jinja2-cli for template-based infrastructure. The entrypoint renders any *.tf.j2 files in the working directory to *.tf (using $CONFIGFILE, default config.json) before running Terraform:

    # Create templated Terraform files with .j2 extension
# Example: main.tf.j2
resource "aws_instance" "" {
  instance_type = ""
  ami           = ""
}

# Create config.json with template variables
{
  "instance_name": "web-server",
  "instance_type": "t3.micro",
  "ami_id": "ami-12345678"
}

# Process templates
docker run --rm \
  -v $(pwd):/data \
  ghcr.io/oorabona/terraform:latest \
  bash -c "for f in *.tf.j2; do jinja2 \$f config.json > \${f%.j2}; done && terraform plan"

    Security Scanning

    # Scan Terraform configurations for misconfigurations
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  trivy config .

# Scan with detailed output
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  trivy config --format table --severity HIGH,CRITICAL .

# Scan for sensitive data
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  trivy fs --scanners secret .

    Linting

    # Initialize TFLint plugins
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  tflint --init

# Lint Terraform files
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  tflint

# Lint with AWS plugin
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest-aws \
  tflint --config=.tflint.hcl

    Documentation Generation

    # Generate README.md from Terraform modules
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  terraform-docs markdown table . > README.md

# Generate JSON output
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  terraform-docs json . > module.json

    Cost Estimation

    # Generate cost breakdown
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  infracost breakdown --path .

# Compare costs between branches
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  infracost diff --path .

    Building Locally

    # Build specific flavor
docker build --build-arg VERSION=latest --build-arg FLAVOR=aws -t terraform:aws .

# Build full flavor (default)
docker build --build-arg VERSION=latest -t terraform:full .

# Build base flavor
docker build --build-arg VERSION=latest --build-arg FLAVOR=base -t terraform:base .

    Build Arguments

    Argument Description Default
    VERSION Terraform version latest
    UPSTREAM_VERSION Raw Terraform version (without suffix) (derived from VERSION)
    FLAVOR Flavor to build full
    TFLINT_VERSION TFLint version 0.60.0
    TRIVY_VERSION Trivy version 0.69.1
    TERRAGRUNT_VERSION Terragrunt version 0.99.1
    TERRAFORM_DOCS_VERSION terraform-docs version 0.21.0
    INFRACOST_VERSION Infracost version 0.10.43
    GITHUB_CLI_VERSION GitHub CLI version 2.86.0
    AWS_CLI_VERSION AWS CLI version 1.44.33
    AZURE_CLI_VERSION Azure CLI version 2.83.0
    GCP_CLI_VERSION GCP SDK version latest
    JINJA2_CLI_VERSION jinja2-cli version 1.0.1

    Environment Variables

    Variable Description Default
    CONFIGFILE Jinja2 template data file (all flavors) config.json
    TERRAFORM_FLAVOR Flavor identifier (set during build)
    AWS_ACCESS_KEY_ID AWS credentials (pass from environment)
    AWS_SECRET_ACCESS_KEY AWS credentials (pass from environment)
    AWS_DEFAULT_REGION AWS region (pass from environment)
    AZURE_SUBSCRIPTION_ID Azure subscription (pass from environment)
    AZURE_TENANT_ID Azure tenant (pass from environment)
    AZURE_CLIENT_ID Azure service principal (pass from environment)
    AZURE_CLIENT_SECRET Azure service principal (pass from environment)
    GOOGLE_APPLICATION_CREDENTIALS GCP credentials file path (pass from environment)
    TF_VAR_* Terraform variables (user-defined)

    Volumes

    Path Purpose Notes
    /data Terraform working directory WORKDIR + VOLUME
    /home/terraform/.aws AWS credentials Mount read-only
    /home/terraform/.azure Azure credentials Mount read-only
    /home/terraform/.config/gcloud GCP credentials Mount read-only
    /.terraform.d Terraform plugins/cache Use tmpfs for security
    /.config Tool configuration Use tmpfs for security
    /tmp Temporary files Use tmpfs for security

    Security

    Base Security

    • Multi-stage build minimizes attack surface
    • Alpine-based final image for minimal footprint
    • Regular security updates through automated rebuilds
    • Includes Trivy for security scanning
    • Non-root execution by default
    • No shell access for terraform user (/sbin/nologin)

    Credential Security (CRITICAL)

    NEVER hardcode credentials in docker-compose.yml or Dockerfiles:

    # BAD - Never do this:
environment:
  AWS_ACCESS_KEY_ID: AKIAIOSFODNN7EXAMPLE

# GOOD - Use environment variables:
environment:
  AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
  AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}

# BETTER - Use credential files mounted read-only:
volumes:
  - ~/.aws:/home/terraform/.aws:ro

    services:
  terraform:
    image: ghcr.io/oorabona/terraform:latest
    user: "1000:1000"  # terraform:terraform
    read_only: true
    tmpfs:
      - /.terraform.d
      - /.config
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    volumes:
      - .:/data:ro  # Read-only if only planning
      - ~/.aws:/home/terraform/.aws:ro
    environment:
      # Pass credentials from environment, never hardcode
      - AWS_ACCESS_KEY_ID
      - AWS_SECRET_ACCESS_KEY
      - AWS_DEFAULT_REGION

    Scanning Your Infrastructure

    # Scan for security issues before applying
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  trivy config --severity HIGH,CRITICAL .

# Scan for common Terraform mistakes
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  tflint --enable-rule=terraform_deprecated_interpolation

# Check for secrets in code
docker run --rm -v $(pwd):/data ghcr.io/oorabona/terraform:latest \
  trivy fs --scanners secret .

    Dependencies

    All tool versions are pinned and automatically monitored for updates:

    Dependency Version Source Monitoring License
    Terraform upstream hashicorp/terraform Docker Hub MPL-2.0
    TFLint 0.60.0 terraform-linters/tflint GitHub Releases MPL-2.0
    Trivy 0.69.1 aquasecurity/trivy GitHub Releases Apache-2.0
    Terragrunt 0.99.1 gruntwork-io/terragrunt GitHub Releases MIT
    terraform-docs 0.21.0 terraform-docs/terraform-docs GitHub Releases MIT
    Infracost 0.10.43 infracost/infracost GitHub Releases Apache-2.0
    GitHub CLI 2.86.0 cli/cli GitHub Releases MIT
    AWS CLI 1.44.33 awscli PyPI Apache-2.0
    Azure CLI 2.83.0 azure-cli PyPI MIT
    Google Cloud SDK latest N/A Not tracked* Apache-2.0

    *Google Cloud SDK installer always fetches the latest version - version pinning is not supported by the GCP installer. The GCP_CLI_VERSION in config.yaml is for reference only.

    Architecture

    terraform/
├── Dockerfile                 # Multi-stage, multi-flavor build
├── docker-entrypoint.sh       # Entrypoint script
├── docker-compose.yml         # Example composition
├── config.yaml               # Tool version configuration
├── version.sh                # Upstream version discovery
└── build                     # Build script with auto-version detection

    Multi-stage Build

    The Dockerfile uses a multi-stage build process:

    1. terraform stage - Extracts Terraform binary from HashiCorp image
    2. security-tools stage - Downloads TFLint and Trivy
    3. devops-tools stage - Downloads Terragrunt, terraform-docs, Infracost, GitHub CLI
    4. cloud-tools-gcp stage - Conditionally installs Google Cloud SDK (only for gcp/full flavors)
    5. Final stage - Assembles tools based on FLAVOR argument and installs cloud CLIs via pip

    This approach:

    • Minimizes final image size
    • Enables parallel builds of independent stages
    • Allows conditional inclusion of cloud-specific tools
    • Maintains clean separation of concerns

    Flavor Selection

    Build-time FLAVOR argument determines:

    • Which cloud CLIs are installed via pip (AWS, Azure)
    • Whether Google Cloud SDK is copied from cloud-tools-gcp stage
    • Contents of environment variable TERRAFORM_FLAVOR

    (jinja2-cli is installed in every flavor, independent of FLAVOR.)

    CI/CD Integration

    GitHub Actions

    - name: Terraform Plan
  uses: docker://ghcr.io/oorabona/terraform:latest-aws
  with:
    args: plan -out=tfplan
  env:
    AWS_ACCESS_KEY_ID: $
    AWS_SECRET_ACCESS_KEY: $
    AWS_DEFAULT_REGION: us-east-1

- name: Security Scan
  uses: docker://ghcr.io/oorabona/terraform:latest
  with:
    args: trivy config --exit-code 1 --severity HIGH,CRITICAL .

- name: Cost Estimation
  uses: docker://ghcr.io/oorabona/terraform:latest
  with:
    args: infracost breakdown --path .
  env:
    INFRACOST_API_KEY: $

    GitLab CI

    terraform:
  image: ghcr.io/oorabona/terraform:latest-aws
  script:
    - terraform init
    - terraform plan
    - trivy config .
  variables:
    AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
    AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY

    Troubleshooting

    Permission Denied

    # Ensure proper user ownership
docker run --rm -it --user 1000:1000 \
  -v $(pwd):/data \
  ghcr.io/oorabona/terraform:latest init

# Or fix permissions on host
sudo chown -R 1000:1000 .terraform/

    Plugin Installation Issues

    # Clear plugin cache
rm -rf .terraform/
docker run --rm -v $(pwd):/data \
  ghcr.io/oorabona/terraform:latest init -upgrade

    Cloud Provider Authentication

    # AWS - Verify credentials
docker run --rm \
  -e AWS_ACCESS_KEY_ID \
  -e AWS_SECRET_ACCESS_KEY \
  ghcr.io/oorabona/terraform:latest-aws \
  aws sts get-caller-identity

# Azure - Verify login
docker run --rm \
  -v ~/.azure:/home/terraform/.azure:ro \
  ghcr.io/oorabona/terraform:latest-azure \
  az account show

# GCP - Verify authentication
docker run --rm \
  -v ~/.config/gcloud:/home/terraform/.config/gcloud:ro \
  ghcr.io/oorabona/terraform:latest-gcp \
  gcloud auth list