Security-focused OpenTofu dev container with tofu-ls and a plugin cache volume.

Options

Getting Started

See Getting Started in the repository README for how to apply this template.

Image Variants

The imageVariant option selects the tag of the ghcr.io/bare-devcontainer/opentofu base image, which pairs an OpenTofu version with a Debian release: trixie is Debian 13 and bookworm is Debian 12.

The values offered when applying the template are proposals, not a closed list — any published tag can be entered, including narrower ones such as an OpenTofu patch version or a dated build for tighter pinning. See the published tags for what is currently available.

Security Hardening

This template applies the shared hardening defaults of Bare Dev Container Templates:

• Builds on ghcr.io/bare-devcontainer/opentofu, a minimal image from bare-devcontainer/images with pinned digests, SLSA provenance, and an SPDX SBOM for supply-chain transparency.
• Runs as the non-root dev user.
• Drops all Linux capabilities (--cap-drop=ALL) and sets the no-new-privileges security option, so processes cannot gain elevated privileges inside the container. Remove no-new-privileges from securityOpt if you need su/sudo.
• Starts an init process ("init": true) to reap zombie processes.

After applying the template, we recommend pinning the image to a digest so every rebuild uses exactly the image you expect — see Pinning Images to a Digest.

Persistent Caches

The OpenTofu plugin cache directory is persisted in a named volume, so rebuilding the container to pick up image updates doesn't require re-downloading providers:

Editor Integration

• Installs the opentofu.vscode-opentofu and hashicorp.hcl VS Code extensions, with the language server paths preconfigured to the tofu-ls and tofu binaries shipped in the image, and format-on-save enabled for .tf and .tfvars files.
• Forks of VS Code (Cursor, Windsurf, VSCodium, code-server) read the same customizations.vscode block, but resolve extension IDs against Open VSX rather than the Visual Studio Marketplace, where availability depends on the publisher having opted in.
• Editors without dev container integration (Neovim, Helix, Emacs, ...) can attach to the running container with devcontainer exec --workspace-folder . <command> and use the tooling in the image directly: tofu-ls at /usr/local/bin/tofu-ls and tofu at /usr/local/bin/tofu.

Tips

• If you use VS Code, uncomment the remoteEnv block in devcontainer.json to open $EDITOR/$VISUAL/$GIT_EDITOR (e.g. git commit) in a VS Code tab.

Note: This file was auto-generated from the devcontainer-template.json. Add additional notes to a NOTES.md.