如何将基础Docker-Compose.yml转换为等价Terraform配置文件？

背景 #

我正处于学习阶段，从基础入手尝试将简单的Docker-Compose.yml转换为等价Terraform配置文件。已知生产环境不会如此操作，但需掌握基础用法。

现有Docker Compose配置 #

services:
 myapp:
   container_name: myapp
   image: myapphub/myapp
   network_mode: host
   cap_add:
     - NET_ADMIN
   devices:
     - /dev/net/tun
   environment:
     MYAPP_ENROLMENT_KEY: ?? how do i get this from variables.tf ??
   volumes:
     - myapp-config:/etc/myapp/profiles
     - myapp-logs:/var/log/myapp
   restart: unless-stopped  
 watchtower:
   image: containrrr/watchtower
   volumes:
     - /var/run/docker.sock:/var/run/docker.sock
   restart: unless-stopped

volumes:
 myapp-config:
 myapp-logs:

当前Terraform配置 #

main.tf #

resource "docker_container" "myapp" {
  name  = "myapp"
  image = "myapphub/myapp"
}

variables.tf（注：当前文件存在语法错误，资源与变量不能混写） #

resource "docker_volume" "my_volume" {
  name       = "my-volume"

  variable "container_name" {
  description = "Value of the name for the Docker container"
  type        = string
  default     = "ExampleNginxContainer"
}

问题 #

1. 如何将docker-compose.yml中的额外指令（如network_mode、cap_add等）添加到Terraform配置？
2. MYAPP_ENROLMENT_KEY如何从variables.tf取值？
3. 这种转换是否可行？

解决方案 #

1. 转换可行性 #

完全可行，Terraform的Docker Provider支持几乎所有Docker Compose中的配置项，非常适合学习阶段熟悉Terraform的资源定义逻辑。

2. 修正variables.tf语法 #

variables.tf中不能同时存放resource和variable定义，需拆分调整：

# variables.tf
variable "myapp_enrolment_key" {
  description = "Enrolment key for myapp service"
  type        = string
}

variable "container_name" {
  description = "Name of the myapp Docker container"
  type        = string
  default     = "myapp"
}

3. 完整main.tf配置（覆盖所有Docker Compose指令） #

# 定义Docker卷，对应Compose中的volumes块
resource "docker_volume" "myapp_config" {
  name = "myapp-config"
}

resource "docker_volume" "myapp_logs" {
  name = "myapp-logs"
}

# myapp容器配置
resource "docker_container" "myapp" {
  name  = var.container_name
  image = "myapphub/myapp"

  # 对应network_mode: host
  network_mode = "host"

  # 对应cap_add: [NET_ADMIN]
  capabilities {
    add = ["NET_ADMIN"]
  }

  # 对应devices: [/dev/net/tun]
  devices {
    host_path      = "/dev/net/tun"
    container_path = "/dev/net/tun"
    permissions    = "rwm" # 默认读写权限，可按需调整
  }

  # 对应environment块，从变量取值
  environment = {
    MYAPP_ENROLMENT_KEY = var.myapp_enrolment_key
  }

  # 对应volumes挂载
  volumes {
    volume_name    = docker_volume.myapp_config.name
    container_path = "/etc/myapp/profiles"
  }

  volumes {
    volume_name    = docker_volume.myapp_logs.name
    container_path = "/var/log/myapp"
  }

  # 对应restart: unless-stopped
  restart = "unless-stopped"
}

# watchtower容器配置
resource "docker_container" "watchtower" {
  image = "containrrr/watchtower"

  volumes {
    host_path      = "/var/run/docker.sock"
    container_path = "/var/run/docker.sock"
  }

  restart = "unless-stopped"
}

4. 使用说明 #

• 运行Terraform前，需传递myapp_enrolment_key变量值，两种方式可选：

  # 方式1：通过环境变量传递
  export TF_VAR_myapp_enrolment_key="your-actual-key"
  
  # 方式2：创建terraform.tfvars文件
  echo 'myapp_enrolment_key = "your-actual-key"' > terraform.tfvars
  

• 执行常规Terraflow流程：terraform init初始化 → terraform plan预览变更 → terraform apply创建资源

内容的提问来源于stack exchange，提问作者bigmojo