Using runner image with pre-downloaded providers

[artem-nefedov]

Just wanted to share my experience of creating runner image with pre-downloaded providers on a filesystem mirror, so people can avoid having same problems. Reasons why you may want to use pre-downloaded providers: security/compliance, network limitations, startup performance, etc.

Originally, I just built the image and put .terraformrc with "provider_installation" section into "/home/runner". Testing it just by running terraform init inside the image seemed to work (as seen by Installed ... (unauthenticated) messages). However, during the actual runner pod execution when applying Terraform resource, providers were still downloaded from the internet. Turns out, the reason is the fact that runner Pod manifest overrides existing "/home/runner" by mounting emptyDir volume there.

The solution I came up with is generating .terraformrc at startup.
Below is the whole setup (it also changes terraform executable version):

1. Dockerfile

ARG BASE_RUNNER_VERSION=v0.16.0-rc.5

FROM ghcr.io/flux-iac/tf-runner:${BASE_RUNNER_VERSION}

USER 0:0

ARG TF_VERSION=1.12.1
ARG TARGETARCH

RUN wget https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_${TARGETARCH}.zip \
  && unzip terraform_${TF_VERSION}_linux_${TARGETARCH}.zip \
  && mv -v terraform /usr/local/bin/terraform \
  && chmod +x /usr/local/bin/terraform \
  && rm -f terraform_${TF_VERSION}_linux_${TARGETARCH}.zip

COPY entrypoint.sh required_providers.tf /

ENV TF_PLUGIN_CACHE_DIR="/opt/terraform.d/plugin-cache"

# Cache the providers so that terraform does not download them every time.
# Optimize for small image size by symlinking the cache as the providers
# using the "Unpacked layout" as described in the terraform documentation.
# https://developer.hashicorp.com/terraform/cli/config/config-file#provider-installation
RUN mkdir -p /opt/terraform.d/plugin-cache \
  && terraform init \
  && rm -rf required_providers.tf /.terraform /.terraform.lock.hcl /LICENSE.txt \
  && chown -R 65532:65532 /opt/terraform.d \
  && rm -rf /opt/providers \
  && ln -s /opt/terraform.d/plugin-cache /opt/providers

USER 65532:65532

ENTRYPOINT ["/entrypoint.sh"]

2. required_providers.tf (this is where provider versions are specified)

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "5.98.0"
    }
    http = {
      source  = "hashicorp/http"
      version = "3.5.0"
    }
  }
}

3. entrypoint.sh (just write rc file and restore original entrypoint)

#!/usr/bin/env sh

set -e

echo '
provider_installation {
  filesystem_mirror {
    path = "/opt/providers"
  }
}
plugin_cache_dir = "/opt/terraform.d/plugin-cache"
plugin_cache_may_break_dependency_lock_file = true
' > ~/.terraformrc

exec /sbin/tini -- tf-runner "$@"

[tomhuang12]

Thank you for sharing!

[artem-nefedov]

Updated for improved setup that avoids copying providers into node filesystem and supports multiarch build.
Compared to old version which used terraform providers mirror command, new version uses terraform init with unpacked layout, and a couple more options in terraformrc related to plugin cache.