From 055b7ed6377c2d365a905e612eb85e5df9c07473 Mon Sep 17 00:00:00 2001 From: sebasnallar Date: Mon, 10 Aug 2026 09:33:30 -0300 Subject: [PATCH] fix(docker): install OpenTofu >= 1.10 instead of alpine's 1.7.2 The lambda scope inits its S3 backend with use_lockfile=true (lambda/scope/tofu/provider/aws/setup), which requires OpenTofu 1.10+. alpine 3.20's apk package is 1.7.2, so create-scope would fail at tofu init. Pull the official static tofu binary (pinned 1.10.6, per build arch) instead. Restores parity with the mise-based test image (.mise.toml opentofu=latest). --- Dockerfile | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 20e20be..58a2470 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,8 +7,17 @@ FROM public.ecr.aws/nullplatform/scopes/worker-bridge:1.0.0 # Cloud tooling the lambda steps call (the bridge base stays minimal on purpose): -# aws + opentofu (tofu) + gomplate. bash, jq, np, base64 and curl ship in the base. -RUN apk add --no-cache aws-cli opentofu gomplate +# aws + gomplate from apk. bash, jq, np, base64 and curl ship in the base. +RUN apk add --no-cache aws-cli gomplate + +# OpenTofu >= 1.10 — the scope inits its S3 backend with use_lockfile=true +# (lambda/scope/tofu/provider/aws/setup), which needs tofu 1.10+. alpine 3.20 +# only packages 1.7.2, so pull the official static binary for the build arch. +ARG TOFU_VERSION=1.10.6 +ARG TARGETARCH +RUN curl -fsSL "https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_linux_${TARGETARCH}.tar.gz" \ + | tar -xz -C /usr/local/bin tofu \ + && tofu version # Bake the scope in and point the bridge at the lambda entrypoint + service path. COPY . /app/pkg