Lab: infrastructure as code with Terraform basics

Aim and what you need

Infrastructure as code (IaC) means describing servers, networks and services in version-controlled files instead of clicking in a console. The aim of this lab is to learn the Terraform workflow safely: you will manage an nginx container on your own machine, which costs nothing, then apply the same habits to cloud resources later.

• Docker installed and running.
• Terraform installed from HashiCorp's official packages. OpenTofu, an open-source fork, accepts the same commands with tofu in place of terraform.
• A text editor and Git if you want to version your work.

Steps

1. Create an empty folder tf-lab and a file main.tf with the content below.
2. Run terraform init to download the Docker provider.
3. Format and validate the file.
4. Run terraform plan and read every line: it should say two resources to add.
5. Apply, type yes, then browse to http://localhost:8085.
6. Change the external port to 8086, plan again and notice it will replace the container.

terraform {
  required_providers {
    docker = {
      source  = "kreuzwerker/docker"
      version = "~> 3.0"
    }
  }
}

provider "docker" {}

resource "docker_image" "nginx" {
  name = "nginx:alpine"
}

resource "docker_container" "web" {
  name  = "tf-web"
  image = docker_image.nginx.image_id
  ports {
    internal = 80
    external = 8085
  }
}

output "container_name" {
  value = docker_container.web.name
}

terraform init
terraform fmt
terraform validate
terraform plan
terraform apply
terraform state list
terraform show
terraform output

How to verify and troubleshoot

After apply, docker ps should show tf-web and the browser should show the nginx page. terraform state list shows the two resources Terraform now tracks. Try deleting the container by hand with docker rm -f tf-web, then run terraform plan: Terraform notices the drift and offers to recreate it.

• Provider download fails: check internet access and proxy settings, then rerun init.
• Cannot connect to Docker: start Docker; on Windows you may need to set the provider's host setting.
• Port already in use: change the external port.
• State confusion: never edit terraform.tfstate by hand. Add it to .gitignore, because in cloud projects it can contain secrets.

Clean-up and moving to the cloud

terraform plan -destroy
terraform destroy

When you later use a cloud provider, the same workflow applies, but with extra rules: set a budget alert first, protect the account with MFA, never put access keys in .tf files (use the provider's CLI login or environment variables), keep state in a protected remote backend for team work, and always finish with terraform destroy and a console check that nothing is left behind.

Tip: a small Terraform repository with a clear README is an excellent portfolio piece. See building a GitHub portfolio.