The OxygenFlow OpenTofu image

A root file system for deploy jobs (oxygenflow#56):

• Debian bookworm, slim, with CA certificates.
• OpenTofu 1.13.1, checked against its published SHA-256.
• A provider mirror in /opt/tofu/mirror: hashicorp/google 8.7.0, hashicorp/google-beta 8.7.0 (Firebase) and cloudflare/cloudflare 5.28.0, checked by tofu providers mirror against the registry's signed checksums when the image is built.
• /etc/tofu/cli.tfrc (set by TF_CLI_CONFIG_FILE) installs providers from the mirror only.
• TFLint 0.64.0 and its Google ruleset 0.40.0, each checked against its release's SHA-256, the ruleset in /opt/tflint/plugins (TFLINT_PLUGIN_DIR): a repository's .tflint.hcl enables it with plugin "google" { enabled = true version = "0.40.0" source = "github.com/terraform-linters/tflint-ruleset-google" }, and linting needs no tflint --init.

So tofu init, fmt and validate need no network; plan and apply reach the cloud's APIs through allow-listed egress (#55). The guest's environment is the pipeline's, so a job sets TF_CLI_CONFIG_FILE itself (below).

Building and importing

images/tofu/build.sh /path/to/oxygenflow-tofu.tar
scp /path/to/oxygenflow-tofu.tar claude@earth:/home/claude/flow/dl/
ssh claude@earth 'cd ~/flow && FLOW_HOME=~/flow bin/flow rootfs import dl/oxygenflow-tofu.tar'

Pin the printed hash in the pipelines that use it, and push it to the hub (flow rootfs push HASH) so every runner can fetch it.

A provider version in a pipeline's lock file must be in the mirror: bump mirror.tf, rebuild and re-pin when a lock file changes.

Using it

sandbox "tofu" {
    runtime "microvm"
    rootfs "cas://blob/<hash printed by flow rootfs import>"
    memory-limit "2GiB"
    cpu-limit 2
    network "isolated"
    env {
        TF_CLI_CONFIG_FILE "/etc/tofu/cli.tfrc"
        TF_IN_AUTOMATION "1"
        TFLINT_PLUGIN_DIR "/opt/tflint/plugins"
    }
}