A Container Instance that Is Private, Non-Root and Health-Checked
A container with no health check is restarted only when its process exits, so a deadlocked one stays; containers run as root unless the security context says otherwise; and a public IP on the instance is an internet-facing container with only an NSG in front. Every container gets a check that restarts it and runs non-root on a read-only filesystem; the instance stays private.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "container_instances" {
source = "www.iac-bazaar.com/iac-bazaar/oci-container-instances/oci"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
oci-container-instances
A container instance with no public address, non-root containers, a health
check, and a restart policy. Works with Terraform and OpenTofu
(>= 1.6), oci provider >= 8.0, < 9.0.
No public IP unless you say so. A container instance is reached through
a load balancer or from inside the VCN; a public IP on it is an
internet-facing container with only an NSG in front. accept_public_ip
otherwise, and an NSG is expected (accept_no_nsg).
A container with no health check is restarted only when it exits. A
deadlocked or 500-returning container stays. Every container here has an
HTTP or TCP check that kills and restarts it; none needs
accept_no_health_check.
Containers run as root unless the security context says otherwise.
Non-root with a read-only root filesystem and all capabilities dropped by
default; root needs accept_root_containers.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
oci-functions-app
Serverless Fn application with functions, provisioned concurrency, invoke logging and Events-rule trigger wiring.
azure-container-apps
Container Apps environment with workload profiles, Dapr, KEDA scale rules, ACR pull identity and custom domain.
azure-container-instances
Runs one or more containers on Azure Container Instances without VMs or an orchestrator - secure by default with no privileged containers, redacted secret fields, and an optional managed identity.
gcp-cloud-run-job
A Cloud Run v2 Job for batch and run-to-completion workloads with a dedicated runtime service account, auto-wired Secret Manager accessor grants, VPC egress, bounded retries and per-task timeout.
gcp-cloud-run-service
Cloud Run v2 service with autoscaling, secret and VPC egress wiring, custom domain and invoker IAM done right.
do-app-platform
Declarative App Platform deployment with services, workers, domains, and alerts.