docker-compose.yml

# docker-compose.yml — LocalStack for the OpenTofu workshop.
#
# LocalStack emulates AWS locally so learners need NO AWS account and pay
# nothing. Start it with `task lab:up` (waits for healthy); stop with
# `task lab:down`. The endpoint is http://localhost:4566 for every service.
#
# Toolchain pins live in versions.env — pass `--env-file versions.env` (Taskfile
# does this automatically). The optional `terratest` service (US-0-GOTT) is a
# pinned Go+OpenTofu runner on the same compose network. Prefer
# `task lab:terratest DIR=…` — do not add it to `lab:up` (learners without Go
# labs should not pull the image).
services:
  localstack:
    image: localstack/localstack:${LOCALSTACK_VERSION}
    container_name: opentofu-workshop-localstack
    ports:
      - "4566:4566" # unified edge port for all AWS service APIs
    environment:
      # Only the services the labs touch — keeps startup fast and memory low.
      SERVICES: "s3,dynamodb,iam,sqs,sns,kms,logs"
      DEBUG: "0"
      # Persist nothing between runs → every `task lab:down`/`up` is a clean slate.
      PERSISTENCE: "0"
      AWS_DEFAULT_REGION: "us-east-1"
    # No /var/run/docker.sock mount: labs do not use Lambda-in-docker (or other
    # LocalStack features that need the host Docker daemon). Omitting the sock
    # shrinks the container's host privilege surface. Re-add under a compose
    # profile if a future lab needs it.
    healthcheck:
      # LocalStack exposes readiness at /_localstack/health.
      test: ["CMD-SHELL", "curl -fsS http://localhost:4566/_localstack/health || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 10s

  # Pinned Terratest runner (Go + OpenTofu from versions.env). Profile keeps
  # `docker compose up` / `task lab:up` from building it accidentally.
  terratest:
    profiles: ["terratest"]
    build:
      context: setup/terratest
      dockerfile: Dockerfile
      args:
        GO_IMAGE: golang:${GO_VERSION}-bookworm
        TOFU_VERSION: ${TOFU_VERSION}
    image: opentofu-workshop-terratest:go${GO_VERSION}-tofu${TOFU_VERSION}
    working_dir: /workspace
    volumes:
      - .:/workspace
    environment:
      AWS_ACCESS_KEY_ID: test
      AWS_SECRET_ACCESS_KEY: test
      AWS_DEFAULT_REGION: us-east-1
      # Compose DNS name — reaches LocalStack on the project network.
      AWS_ENDPOINT_URL: http://localstack:4566
    depends_on:
      localstack:
        condition: service_healthy