OXYGENHUB

OpenTofu image: TFLint and its Google ruleset 1c9afa928691

TFLint 0.64.0 and tflint-ruleset-google 0.40.0, each checked against its
release's SHA-256, the ruleset in /opt/tflint/plugins (TFLINT_PLUGIN_DIR)
so linting needs no tflint --init and no network. Imported on Earth and
pushed as cas://blob/54d2046dc06731ac56c3cbc0e13da839a03ec3e0838f9bf71da2f02b2db83329.

Refs #56
Author
Andy McCall @andymccall <[email protected]>
via
agent Claude Code <[email protected]> · delegate for changes, until 2026-11-13 19:00Z · key ea5f78160088
When
· 2026-10-15 13:43 UTC
Signature
✔ signed by Claude Code
Hash
1c9afa928691a6d0cbbce9173cff7b4a872de3490e2d021bad05f352626f4b3e
Depends on
e3fd8257ce05
Depended on by
nothing yet
In bookmarks
main
In tags
v0.2.0 v0.3.0 v0.3.1 v0.4.0 v0.5.0 v0.5.1 v0.5.2 v0.5.3
Edits
10 atoms, 0 tree operations, 3 files

Browse the tree at this change

hide whitespace changes
modified images/tofu/Dockerfile +21 −1
… 
20 unchanged lines
21 21 
# checksums as it downloads it.
22 22 
COPY mirror.tf /tmp/mirror/
23 23 
RUN cd /tmp/mirror && tofu providers mirror -platform=linux_amd64 /opt/tofu/mirror
24 + 
# TFLint and its Google ruleset (HCL linting), each checked against its
25 + 
# release's SHA-256; the ruleset where TFLint looks for plugins, so
26 + 
# linting needs no `tflint --init` and no network.
27 + 
ARG TFLINT_VERSION
28 + 
ARG TFLINT_SHA256
29 + 
ARG TFLINT_GOOGLE_VERSION
30 + 
ARG TFLINT_GOOGLE_SHA256
31 + 
RUN curl -fsSL -o /tmp/tflint.zip \
32 + 
      "https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/tflint_linux_amd64.zip" \
33 + 
 && echo "${TFLINT_SHA256}  /tmp/tflint.zip" | sha256sum -c - \
34 + 
 && unzip -q /tmp/tflint.zip tflint -d /usr/local/bin \
35 + 
 && curl -fsSL -o /tmp/google.zip \
36 + 
      "https://github.com/terraform-linters/tflint-ruleset-google/releases/download/v${TFLINT_GOOGLE_VERSION}/tflint-ruleset-google_linux_amd64.zip" \
37 + 
 && echo "${TFLINT_GOOGLE_SHA256}  /tmp/google.zip" | sha256sum -c - \
38 + 
 && d=/opt/tflint/plugins/github.com/terraform-linters/tflint-ruleset-google/${TFLINT_GOOGLE_VERSION} \
39 + 
 && mkdir -p "$d" && unzip -q /tmp/google.zip -d "$d" \
40 + 
 && rm /tmp/tflint.zip /tmp/google.zip
24 41 

    

  
    

      25
      42
       
      
FROM debian:bookworm-slim

    

  
    

      26
      43
       
      
RUN apt-get update \

    

  
    

      
      
      …
      
1 unchanged lines

    

  
    

      28
      45
       
      
 && rm -rf /var/lib/apt/lists/*

    

  
    

      29
      46
       
      
COPY --from=fetch /usr/local/bin/tofu /usr/local/bin/tofu

    

  
    

      30
      47
       
      
COPY --from=fetch /opt/tofu/mirror /opt/tofu/mirror

    

  
    

      
      48
      +
      
COPY --from=fetch /usr/local/bin/tflint /usr/local/bin/tflint

    

  
    

      
      49
      +
      
COPY --from=fetch /opt/tflint/plugins /opt/tflint/plugins

    

  
    

      31
      50
       
      
# Providers come only from the mirror: a job never reaches a registry.

    

  
    

      32
      51
       
      
COPY cli.tfrc /etc/tofu/cli.tfrc

    

  
    

      33
      
      -
      
ENV TF_CLI_CONFIG_FILE=/etc/tofu/cli.tfrc

    

  
    

      
      52
      +
      
ENV TF_CLI_CONFIG_FILE=/etc/tofu/cli.tfrc \

    

  
    

      
      53
      +
      
    TFLINT_PLUGIN_DIR=/opt/tflint/plugins

    

  
  

  





  
    modified
    images/tofu/README.md
    +7 −0
  
  
  

  
    

      
      
      …
      
8 unchanged lines

    

  
    

      9
      9
       
      
  against the registry's signed checksums when the image is built.

    

  
    

      10
      10
       
      
- `/etc/tofu/cli.tfrc` (set by `TF_CLI_CONFIG_FILE`) installs providers

    

  
    

      11
      11
       
      
  from the mirror only.

    

  
    

      
      12
      +
      
- TFLint 0.64.0 and its Google ruleset 0.40.0, each checked against its

    

  
    

      
      13
      +
      
  release's SHA-256, the ruleset in `/opt/tflint/plugins`

    

  
    

      
      14
      +
      
  (`TFLINT_PLUGIN_DIR`): a repository's `.tflint.hcl` enables it with

    

  
    

      
      15
      +
      
  `plugin "google" { enabled = true  version = "0.40.0"  source =

    

  
    

      
      16
      +
      
  "github.com/terraform-linters/tflint-ruleset-google" }`, and linting

    

  
    

      
      17
      +
      
  needs no `tflint --init`.

    

  
    

      12
      18
       
      

    

  
    

      13
      19
       
      
So `tofu init`, `fmt` and `validate` need no network; `plan` and `apply`

    

  
    

      14
      20
       
      
reach the cloud's APIs through allow-listed egress (#55). The guest's

    

  
    

      
      
      …
      
26 unchanged lines

    

  
    

      41
      47
       
      
    env {

    

  
    

      42
      48
       
      
        TF_CLI_CONFIG_FILE "/etc/tofu/cli.tfrc"

    

  
    

      43
      49
       
      
        TF_IN_AUTOMATION "1"

    

  
    

      
      50
      +
      
        TFLINT_PLUGIN_DIR "/opt/tflint/plugins"

    

  
    

      44
      51
       
      
    }

    

  
    

      45
      52
       
      
}

    

  
    

      46
      53
       
      
```

    

  
  

  





  
    modified
    images/tofu/build.sh
    +9 −2
  
  
  

  
    

      1
      1
       
      
#!/bin/sh

    

  
    

      2
      2
       
      
# Build the OxygenFlow OpenTofu image and write it as a root file system

    

  
    

      3
      3
       
      
# tarball for `flow rootfs import`. Rebuild when OpenTofu or a pinned

    

  
    

      4
      
      -
      
# provider version changes (mirror.tf).

    

  
    

      
      4
      +
      
# provider version, TFLint or its Google ruleset changes.

    

  
    

      5
      5
       
      
set -eu

    

  
    

      6
      6
       
      
here=$(cd "$(dirname "$0")" && pwd)

    

  
    

      7
      7
       
      
out=${1:-$here/oxygenflow-tofu.tar}

    

  
    

      8
      8
       
      
TOFU_VERSION=1.13.1

    

  
    

      9
      9
       
      
TOFU_SHA256=8ccbc6f8ee21d2827715f3c6e08a9b3e0209b1e62057c05067ef117e047c1a80

    

  
    

      
      10
      +
      
TFLINT_VERSION=0.64.0

    

  
    

      
      11
      +
      
TFLINT_SHA256=cca9d13e2e1d7a2c627af60ff899a3c9b74212899416aeb96ec764d2ef954537

    

  
    

      
      12
      +
      
TFLINT_GOOGLE_VERSION=0.40.0

    

  
    

      
      13
      +
      
TFLINT_GOOGLE_SHA256=a5c02b3de937456de2521155831eaf1cc876014a21445bf7dd1621654511fe28

    

  
    

      10
      14
       
      

    

  
    

      11
      15
       
      
docker build -q -t oxygenflow-tofu \

    

  
    

      12
      
      -
      
    --build-arg TOFU_VERSION=$TOFU_VERSION --build-arg TOFU_SHA256=$TOFU_SHA256 "$here"

    

  
    

      
      16
      +
      
    --build-arg TOFU_VERSION=$TOFU_VERSION --build-arg TOFU_SHA256=$TOFU_SHA256 \

    

  
    

      
      17
      +
      
    --build-arg TFLINT_VERSION=$TFLINT_VERSION --build-arg TFLINT_SHA256=$TFLINT_SHA256 \

    

  
    

      
      18
      +
      
    --build-arg TFLINT_GOOGLE_VERSION=$TFLINT_GOOGLE_VERSION --build-arg TFLINT_GOOGLE_SHA256=$TFLINT_GOOGLE_SHA256 \

    

  
    

      
      19
      +
      
    "$here"

    

  
    

      13
      20
       
      
id=$(docker create oxygenflow-tofu)

    

  
    

      14
      21
       
      
docker export "$id" -o "$out"

    

  
    

      15
      22
       
      
docker rm "$id" >/dev/null

    

  
    

      
      
      …
      
1 unchanged lines