terraform-provider-containerimages

README

terraform-provider-containerimages

This is not yet fit for consumption in real projects.

A small Terraform provider that enables users to transfer OCI/Docker container images between registries as part of IaC in builds.

Use case

While larger projects will likely implement their own solutions to the bulk storage and management of container images within private container registries, smaller projects will often benefit from being able to ensure the correct dependencies are stored within a private container registry as part of their IaC builds.

This becomes very useful if you are already managing resources in systems like ECS, or using the Kubernetes or Helm providers. It also can assist teams that are not able to use a dynamic image proxy due to security concerns or regulatory obligations. Providing only the required images explicitly can provide simple auditing capabilities as needed, and unused images can be easily destroyed.

The aim of this provider is to allow for efficient transfer and storage of container images in a container registry, where updates and configuration creep are handled as part of the build pipeline.

Potential example

Note: this is just a proof of concept, the final interface design has not yet been finalised.

The end goal is to be able to provide an interface to allow operations such as the following:

provider "containerimages" {
  registry {
    url = data.aws_ecr_authorization_token.auth.proxy_url
    basic_auth {
      username = data.aws_ecr_authorization_token.auth.username
      password = data.aws_ecr_authorization_token.auth.password
    }
  }
}

data "aws_ecr_authorization_token" "auth" {}

data "containerimages_manifest" "hello_world" {
  for_each   = toset(["latest"])
  repository = "docker.io/hello-world"
  tag        = each.key
  platform   = "linux/amd64"
}

resource "aws_ecr_repository" "hello_world" {
  name                 = "hello-world"
  image_tag_mutability = "MUTABLE"
}

resource "containerimages_manifest" "hello_world" {
  for_each   = data.containerimages_manifest.hello_world
  repository = aws_ecr_repository.hello_world.repository_url
  tag        = each.value.tag

  source_manifest {
    name   = each.value.name
    digest = each.value.digest
  }
}