Terraform and Docker

# CHAPTER 12

Terraform and Docker #

1. Introduction #

2. Learning Objectives #

• Understand how Terraform interacts with the Docker Daemon API.

• Configure the kreuzwerker/docker provider.

• Use Terraform to pull Docker images from remote registries.

• Provision and configure Docker containers using HCL.

• Manage container networking and port mapping via Terraform.

3. Beginner-Friendly Explanation #

• The Old Way (Docker CLI): You stand in the yard with a megaphone, yelling: "Bring me a blue shipping container! Put it on port 80! Now bring me a red container!" If you go home and come back the next day, you have to yell all the instructions again to get the same setup.

• The Terraform Way: You write a manifest (HCL code) listing exactly which containers you want and where they should sit. You hand the manifest to the yard manager (Terraform). The manager reads the list, moves the containers perfectly into place, and ensures they never move.

4. Configuring the Docker Provider #

terraform {
  required_providers {
    docker = {
      source  = "kreuzwerker/docker"
      version = "~> 3.0.1"
    }
  }
}

# Configure the provider to talk to the local Docker engine
provider "docker" {
  host = "npipe:////./pipe/docker_engine" # Windows Path
  # host = "unix:///var/run/docker.sock" # Linux/Mac Path
}

5. Managing Images and Containers #

# 1. Pull the Image from Docker Hub
resource "docker_image" "nginx_image" {
  name         = "nginx:latest"
  keep_locally = false # Delete the image when the container is destroyed
}

# 2. Run the Container
resource "docker_container" "nginx_container" {
  name  = "my-terraform-webserver"
  image = docker_image.nginx_image.image_id # Implicit dependency!
  
  # Map Port 80 inside the container to Port 8080 on your laptop
  ports {
    internal = 80
    external = 8080
  }
}

6. Mini Project: Deploy Docker Containers using Terraform #

Step-by-Step Architecture Concept:

# Pull Images
resource "docker_image" "mysql" { name = "mysql:5.7" }
resource "docker_image" "wordpress" { name = "wordpress:latest" }

# Create a Docker Network so they can talk to each other
resource "docker_network" "wp_net" {
  name = "wordpress_network"
}

# Build the Database
resource "docker_container" "db" {
  name  = "wp_database"
  image = docker_image.mysql.image_id
  
  # Connect to the custom network
  networks_advanced { name = docker_network.wp_net.name }
  
  env = [
    "MYSQL_ROOT_PASSWORD=somewordpress",
    "MYSQL_DATABASE=wordpress"
  ]
}

# Build the Website
resource "docker_container" "wp" {
  name  = "wp_website"
  image = docker_image.wordpress.image_id
  networks_advanced { name = docker_network.wp_net.name }
  
  ports {
    internal = 80
    external = 8080
  }
  
  env = [
    "WORDPRESS_DB_HOST=wp_database:3306", # Matches the DB container name!
    "WORDPRESS_DB_USER=root",
    "WORDPRESS_DB_PASSWORD=somewordpress"
  ]
}

*Run terraform apply. Open your browser to localhost:8080. You will see a fully functioning WordPress installation! When you are done, run terraform destroy to instantly wipe the database, the website, and the network.*

7. Real-World Scenarios #

8. Best Practices #

• Terraform vs. Docker Compose: The mini-project above looks very similar to a docker-compose.yml file. If you are *only* managing local containers, docker-compose is usually better. However, if your architecture requires creating an AWS RDS Database, an S3 bucket, *and* a local Docker container for testing, Terraform is vastly superior because it can orchestrate all three providers simultaneously in the exact same state file.

9. Security Recommendations #

• Registry Authentication: In our examples, we pulled public images from Docker Hub. In an enterprise, images are stored in private registries (like AWS ECR). You must explicitly configure the docker provider block with a registryauth block, supplying the username and password required to securely pull your company's proprietary code.

1. 1. What is the purpose of the keeplocally = false argument in the dockerimage resource?

13. Interview Questions #

• Q: Contrast the operational use cases of docker-compose versus the Terraform Docker provider. When would an engineering team prioritize one tool over the other?

• Q: Describe the HCL configuration required to provision a multi-container architecture where a frontend container securely communicates with a backend database container via an isolated Docker network.

14. Summary #

15. Next Chapter Recommendation #