houstonj1/terraform repository overview

⁠houstonj1/terraform

The latest-stable Terraform binary on a hardened debian:bookworm-slim base, bundled with AWS CLI v2 — a small, ready-to-run image for planning and applying Terraform from CI or your shell.

The design goal is freshness. The Terraform version is resolved at build time to the newest stable release (pre-releases rejected) and the image is rebuilt weekly, so latest always tracks current stable Terraform. Security comes from frequent rebuilds (fresh tool + base patches) gated by container scanning, not from version pinning.

⁠Tags

The -slim suffix marks the Debian-slim base on version-pinned tags; latest is unsuffixed. Platforms: linux/amd64, linux/arm64.

⁠Usage

docker run --rm -it houstonj1/terraform terraform version

# Run a plan against a project mounted from the host
docker run --rm -it -v "$PWD":/app houstonj1/terraform terraform plan

The image runs as the non-root terraform user with WORKDIR /app; the default command drops you into bash.

⁠What's inside

• debian:bookworm-slim
• Terraform (latest stable, checksum-verified download)
• AWS CLI v2 (architecture-aware, checksum-verified install)

⁠Security posture

• Latest-stable, not pinned — Terraform version resolved at build, rebuilt weekly.
• Patched slim base — apt-get upgrade applied at build, --no-install-recommends, cleaned apt lists, multi-stage build so build tooling never ships.
• Hardened — runs non-root, setuid/setgid bits stripped, OCI labels, and default builds carry SBOM + provenance attestations.
• Scanned — every published image is gated by container scanning.