Resource: yet_cloud_container

A container a Docker runtime keeps running, plainly — no orchestrator, no ingress: CI runners and the Docker they build in, a tool the team keeps up. Its runtime's agent makes it again whenever its definition changes.

Note: Only Cloud admins define containers: one may be privileged, and runs on a machine of the company's with Docker's own powers.

Note: A secret's value is sealed in Cloud and never shown again: the state keeps what was said, and an imported container's secrets are empty until set.

Example Usage

resource "yet_cloud_runtime" "ci" {
  name      = "box-docker"
  stack     = "local:docker"
  server_id = yet_cloud_server.box.id
}

# Docker in Docker, for CI runners to build in.
resource "yet_cloud_container" "dind" {
  runtime_id = yet_cloud_runtime.ci.id
  name       = "dind"
  image      = "docker:27-dind"
  privileged = true
  volumes    = ["dind-cache:/var/lib/docker"]

  env = {
    DOCKER_TLS_CERTDIR = ""
  }
}

variable "registry_token" {
  type      = string
  sensitive = true
}

# Three runners alike, each taking a job.
resource "yet_cloud_container" "runner" {
  runtime_id = yet_cloud_runtime.ci.id
  name       = "runner"
  image      = "ghcr.io/acme/ci-runner:2"
  replicas   = 3

  env = {
    DOCKER_HOST = "tcp://dind:2375"
  }
  secrets = {
    REGISTRY_TOKEN = var.registry_token
  }
}

Schema

Required

image (String) The image it runs: docker:27-dind.
name (String) Its name on the runtime: lowercase letters, digits and dashes, up to 32, starting with a letter.
runtime_id (String) The Docker runtime (local:docker) it runs on.

Optional

command (List of String) What it runs, in place of its image's own.
enabled (Boolean) Whether it runs. Turned off, the agent takes it away — its definition kept, secrets and all.
env (Map of String) Its environment, by name.
privileged (Boolean) Whether it runs privileged — as Docker in Docker must. false unless set.
replicas (Number) How many alike it runs as — CI runners, each taking a job: 1 to 20, 1 unless set.
secrets (Map of String, Sensitive) Its environment's secrets, by name: sealed in Cloud, never shown again.
volumes (List of String) Named volumes, kept across its recreations: cache:/var/lib/docker.

Read-Only

id (String) The ID of this resource.
message (String) What the agent last said of it, when something is wrong.
state (String) How it is, as the runtime's agent last said: pending, running, disabled…

Import

In Terraform v1.5.0 and later, with an import block:

import {
  to = yet_cloud_container.dind
  id = "01J9Z8K3V7Q2M4N6P8R0S2T4V6/01J9Z8M1A2B3C4D5E6F7G8H9J0"
}

With terraform import:

# <runtime_id>/<container_id>
terraform import yet_cloud_container.dind 01J9Z8K3V7Q2M4N6P8R0S2T4V6/01J9Z8M1A2B3C4D5E6F7G8H9J0