The OpenTofu image for deploy jobs e3fd8257ce05

# The OxygenFlow OpenTofu image (oxygenflow#56): OpenTofu and the providers

# the deploy pipelines use, mirrored inside, so `tofu init` needs no

# registry. A job reaches a cloud's API only through allow-listed egress

# (#55); formatting and validation need no network at all.

# Download and check OpenTofu, and mirror the providers, with the tools

# only this stage needs.

FROM debian:bookworm-slim AS fetch

ARG TOFU_VERSION

ARG TOFU_SHA256

RUN apt-get update \

 && apt-get install -y --no-install-recommends ca-certificates curl unzip \

 && rm -rf /var/lib/apt/lists/*

RUN curl -fsSL -o /tmp/tofu.zip \

      "https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_linux_amd64.zip" \

 && echo "${TOFU_SHA256}  /tmp/tofu.zip" | sha256sum -c - \

 && unzip -q /tmp/tofu.zip tofu -d /usr/local/bin \

 && rm /tmp/tofu.zip

# The exact provider versions of the pipelines' lock files; `tofu

# providers mirror` checks each package against the registry's signed

# checksums as it downloads it.

COPY mirror.tf /tmp/mirror/

RUN cd /tmp/mirror && tofu providers mirror -platform=linux_amd64 /opt/tofu/mirror

FROM debian:bookworm-slim

RUN apt-get update \

 && apt-get install -y --no-install-recommends ca-certificates \

 && rm -rf /var/lib/apt/lists/*

COPY --from=fetch /usr/local/bin/tofu /usr/local/bin/tofu

COPY --from=fetch /opt/tofu/mirror /opt/tofu/mirror

# Providers come only from the mirror: a job never reaches a registry.

COPY cli.tfrc /etc/tofu/cli.tfrc

ENV TF_CLI_CONFIG_FILE=/etc/tofu/cli.tfrc

# The OxygenFlow OpenTofu image

A root file system for deploy jobs (oxygenflow#56):

- Debian bookworm, slim, with CA certificates.

- OpenTofu 1.13.1, checked against its published SHA-256.

- A provider mirror in `/opt/tofu/mirror`: `hashicorp/google` 8.7.0 and

  `cloudflare/cloudflare` 5.28.0, checked by `tofu providers mirror`

  against the registry's signed checksums when the image is built.

- `/etc/tofu/cli.tfrc` (set by `TF_CLI_CONFIG_FILE`) installs providers

  from the mirror only.

So `tofu init`, `fmt` and `validate` need no network; `plan` and `apply`

reach the cloud's APIs through allow-listed egress (#55). The guest's

environment is the pipeline's, so a job sets `TF_CLI_CONFIG_FILE` itself

(below).

## Building and importing

```

images/tofu/build.sh /path/to/oxygenflow-tofu.tar

scp /path/to/oxygenflow-tofu.tar claude@earth:/home/claude/flow/dl/

ssh claude@earth 'cd ~/flow && FLOW_HOME=~/flow bin/flow rootfs import dl/oxygenflow-tofu.tar'

```

Pin the printed hash in the pipelines that use it, and push it to the hub

(`flow rootfs push HASH`) so every runner can fetch it.

A provider version in a pipeline's lock file must be in the mirror: bump

`mirror.tf`, rebuild and re-pin when a lock file changes.

## Using it

```kdl

sandbox "tofu" {

    runtime "microvm"

    rootfs "cas://blob/<hash printed by flow rootfs import>"

    memory-limit "2GiB"

    cpu-limit 2

    network "isolated"

    env {

        TF_CLI_CONFIG_FILE "/etc/tofu/cli.tfrc"

        TF_IN_AUTOMATION "1"

    }

}

```

#!/bin/sh

# Build the OxygenFlow OpenTofu image and write it as a root file system

# tarball for `flow rootfs import`. Rebuild when OpenTofu or a pinned

# provider version changes (mirror.tf).

set -eu

here=$(cd "$(dirname "$0")" && pwd)

out=${1:-$here/oxygenflow-tofu.tar}

TOFU_VERSION=1.13.1

TOFU_SHA256=8ccbc6f8ee21d2827715f3c6e08a9b3e0209b1e62057c05067ef117e047c1a80

docker build -q -t oxygenflow-tofu \

    --build-arg TOFU_VERSION=$TOFU_VERSION --build-arg TOFU_SHA256=$TOFU_SHA256 "$here"

id=$(docker create oxygenflow-tofu)

docker export "$id" -o "$out"

docker rm "$id" >/dev/null

echo "$out"

provider_installation {

  filesystem_mirror {

    path    = "/opt/tofu/mirror"

    include = ["registry.opentofu.org/*/*"]

  }

  # Nothing is fetched from a registry: a provider missing from the

  # mirror fails `tofu init` instead of reaching out.

}

# The providers the image carries, at the versions the deploy pipelines

# lock. Bump here, rebuild, re-pin (README.md).

terraform {

  required_providers {

    google = {

      source  = "hashicorp/google"

      version = "8.7.0"

    }

    cloudflare = {

      source  = "cloudflare/cloudflare"

      version = "5.28.0"

    }

  }

}