Support for triggers or run_when_changed or something like it on docker_container or a new docker_container_ephemeral resource

[djryanj]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Currently, I use an ephemeral docker container to do something as part of my Terraform build that my system (or the CI/CD pipeline system) does not have installed locally (to complete the picture, in my case it's the smallstep CLI). This container runs, does something, then shuts down, and is not expected to continue running (so using the must_run = false is needed).

However, each run of the container changes the output. This is expected, but also undesirable in this case, because the output is a certificate that has a long life that doesn't need to change every time I run my Terraform.

Instead, it would be beneficial to be able to specify triggers under which the container should run, perhaps tied to a time resource like time_rotating. For an example of this in use, see https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_password#example-usage (look at the time-based rotation section).

Perhaps it may make sense to create a new resource type, like docker_container_ephemeral or docker_container_job which can be used for these sorts of use cases.

New or Affected Resource(s)

• docker_container, or;
• docker_container_ephemeral, or;
• docker_container_job

Potential Terraform Configuration

resource "time_rotating" "ca_cert" {
  rotation_years = 5
}

resource "docker_container" "linkerd_root_cert" {
  name  = "step"
  image = var.step_image_tag
  rm    = true
  command = ["step",
    "certificate",
    "create",
    "root.linkerd.cluster.local",
    "/app/keys/ca.crt",
    "/app/keys/ca.key",
    "--profile",
    "root-ca",
    "--no-password",
    "--insecure",
  ]
  must_run = false
  volumes {
    host_path      = local.root_path
    container_path = "/app/keys/"
  }
  run_when_changed = {
    trigger = time_rotating.ca_cert.id
  }
}

(Note that I can see plenty of ways we could accomplish this).

References

None.