sincecutoff.com
/v1/json /v1/md llms.txt
← all changes

terragrunt oci experiment downloads modules from OCI registries

Introduced 2026-07-29 · score 0.95

HOW TO USE IT

When using Terragrunt v1.1.2 to fetch an OpenTofu module from an OCI registry, enable the `oci` experiment and set `terraform.source` to an `oci://` URL. Pin it with `tag` or `digest`; omitting both selects `latest`.

terraform { source = "oci://<registry>/<repository>/<module>?tag=<tag>" }
terragrunt --experiment oci run -- init

WHY THIS HELPS

When configuring an OpenTofu module from an OCI registry, set its OCI source in the Terragrunt configuration and fetch it with the `oci` experiment enabled.

REQUIREMENTS AND LIMITATIONS

  • Version: v1.1.2
  • Availability: experiment
  • `--experiment oci` (required): Enables the OCI experiment; v1.1.2 leaves `oci://` sources unsupported when it is disabled.
  • `terraform.source` (required): Accepts an `oci://` source URL.
  • `tag`: Pins the artifact to a tag. Use `tag` or `digest`; the release note does not say they may be combined.
  • `digest`: Pins the artifact to a digest. Use `tag` or `digest`; the release note does not say they may be combined.
  • `//subdir` selector: Selects a subdirectory within the artifact.
  • `TG_TMP_OCI_*`: Interim environment-variable family for static OCI credentials; the release note does not document individual variable names or values.
  • `TG_TMP_OCI_REGISTRY`: Limits static credentials to one registry; without it, configured credentials may be offered to any registry contacted by the process.
  • Prerequisite: Use Terragrunt v1.1.2 or later for the described change; enable the `oci` experiment for the source to work.
  • Prerequisite: For authentication, v1.1.2 supports static credentials through interim environment variables and read-only discovery of Docker and containers auth files. Credential helpers are not invoked; a registry needing per-run token minting requires an externally obtained login in an ambient file.
  • When the experiment is disabled, `oci://` sources remain unsupported.
  • Static credentials can be limited to one registry with `TG_TMP_OCI_REGISTRY`; without it, configured credentials may be offered to any registry the process contacts.
  • Credential helpers are not invoked yet; registries that need per-run token minting only work while an externally obtained login is present in an ambient file.
  • Artifacts follow the publishing contract OpenTofu 1.10 consumes natively.
  • Docs conflict: Current active-experiment docs describe later behavior: OCI sources work by default, and configured credential helpers may be invoked. Those statements differ from v1.1.2; the release-specific behavior above follows the v1.1.2 release note.

FIRST-PARTY EVIDENCE

Check the installed version and the source before using it. Entry JSON

Report a problem with this card