A Container Instance that Is Private, Non-Root and Health-Checked
A container with no health check is restarted only when its process exits, so a deadlocked one stays; containers run as root unless the security context says otherwise; and a public IP on the instance is an internet-facing container with only an NSG in front. Every container gets a check that restarts it and runs non-root on a read-only filesystem; the instance stays private.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "container_instances" {
source = "www.iac-bazaar.com/iac-bazaar/oci-container-instances/oci"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/oci-container-instances?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, static-verified on IaC Bazaar: [A Container Instance that Is Private, Non-Root and Health-Checked](https://www.iac-bazaar.com/catalog/oci-container-instances?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "container_instances" {
source = "www.iac-bazaar.com/iac-bazaar/oci-container-instances/oci"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
oci-container-instances
A container instance with no public address, non-root containers, a health
check, and a restart policy. Works with Terraform and OpenTofu
(>= 1.6), oci provider >= 8.0, < 9.0.
No public IP unless you say so. A container instance is reached through
a load balancer or from inside the VCN; a public IP on it is an
internet-facing container with only an NSG in front. accept_public_ip
otherwise, and an NSG is expected (accept_no_nsg).
A container with no health check is restarted only when it exits. A
deadlocked or 500-returning container stays. Every container here has an
HTTP or TCP check that kills and restarts it; none needs
accept_no_health_check.
Containers run as root unless the security context says otherwise.
Non-root with a read-only root filesystem and all capabilities dropped by
default; root needs accept_root_containers.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
oci-functions-app
Serverless Fn application with functions, provisioned concurrency, invoke logging and Events-rule trigger wiring.
ibm-code-engine-app
A Code Engine project and application with managed_domain_mappings local_private, because the field defaults to local_public and an application deployed with no opinion about it answers the world. scale_min_instances is one rather than zero, run_as_user is not root, and a private image without its pull secret is refused - that failure otherwise arrives long after the apply.
alicloud-sae-application
A Serverless App Engine namespace and application with auto_config false, which makes the VPC, vSwitch and security group required rather than letting SAE create three resources that live in your account and nobody's Terraform. Two replicas so a deploy is not an outage, min_ready_instances set so a rollout is actually rolling, and typed liveness and readiness probes.
azure-container-apps
Container Apps environment with workload profiles, Dapr, KEDA scale rules, ACR pull identity and custom domain.
azure-container-instances
Runs one or more containers on Azure Container Instances without VMs or an orchestrator - secure by default with no privileged containers, redacted secret fields, and an optional managed identity.
gcp-cloud-run-job
A Cloud Run v2 Job for batch and run-to-completion workloads with a dedicated runtime service account, auto-wired Secret Manager accessor grants, VPC egress, bounded retries and per-task timeout.