| 1 |
# The OxygenFlow OpenTofu image |
| 2 |
|
| 3 |
A root file system for deploy jobs (oxygenflow#56): |
| 4 |
|
| 5 |
- Debian bookworm, slim, with CA certificates. |
| 6 |
- OpenTofu 1.13.1, checked against its published SHA-256. |
| 7 |
- A provider mirror in `/opt/tofu/mirror`: `hashicorp/google` 8.7.0 and |
| 8 |
`cloudflare/cloudflare` 5.28.0, checked by `tofu providers mirror` |
| 9 |
against the registry's signed checksums when the image is built. |
| 10 |
- `/etc/tofu/cli.tfrc` (set by `TF_CLI_CONFIG_FILE`) installs providers |
| 11 |
from the mirror only. |
| 12 |
- TFLint 0.64.0 and its Google ruleset 0.40.0, each checked against its |
| 13 |
release's SHA-256, the ruleset in `/opt/tflint/plugins` |
| 14 |
(`TFLINT_PLUGIN_DIR`): a repository's `.tflint.hcl` enables it with |
| 15 |
`plugin "google" { enabled = true version = "0.40.0" source = |
| 16 |
"github.com/terraform-linters/tflint-ruleset-google" }`, and linting |
| 17 |
needs no `tflint --init`. |
| 18 |
|
| 19 |
So `tofu init`, `fmt` and `validate` need no network; `plan` and `apply` |
| 20 |
reach the cloud's APIs through allow-listed egress (#55). The guest's |
| 21 |
environment is the pipeline's, so a job sets `TF_CLI_CONFIG_FILE` itself |
| 22 |
(below). |
| 23 |
|
| 24 |
## Building and importing |
| 25 |
|
| 26 |
``` |
| 27 |
images/tofu/build.sh /path/to/oxygenflow-tofu.tar |
| 28 |
scp /path/to/oxygenflow-tofu.tar claude@earth:/home/claude/flow/dl/ |
| 29 |
ssh claude@earth 'cd ~/flow && FLOW_HOME=~/flow bin/flow rootfs import dl/oxygenflow-tofu.tar' |
| 30 |
``` |
| 31 |
|
| 32 |
Pin the printed hash in the pipelines that use it, and push it to the hub |
| 33 |
(`flow rootfs push HASH`) so every runner can fetch it. |
| 34 |
|
| 35 |
A provider version in a pipeline's lock file must be in the mirror: bump |
| 36 |
`mirror.tf`, rebuild and re-pin when a lock file changes. |
| 37 |
|
| 38 |
## Using it |
| 39 |
|
| 40 |
```kdl |
| 41 |
sandbox "tofu" { |
| 42 |
runtime "microvm" |
| 43 |
rootfs "cas://blob/<hash printed by flow rootfs import>" |
| 44 |
memory-limit "2GiB" |
| 45 |
cpu-limit 2 |
| 46 |
network "isolated" |
| 47 |
env { |
| 48 |
TF_CLI_CONFIG_FILE "/etc/tofu/cli.tfrc" |
| 49 |
TF_IN_AUTOMATION "1" |
| 50 |
TFLINT_PLUGIN_DIR "/opt/tflint/plugins" |
| 51 |
} |
| 52 |
} |
| 53 |
``` |