World T4: Modules & Pipelines

Capstone mission 8: Blueprint Kedai Kancil

You will learn: to write Kedai Kancil's web counter as a blueprint, build it on your own Docker, and plan it on a pull request.

Checked with OpenTofu 1.13 on 1 Nov 2026

The problem

Mission 8: write Kedai Kancil’s web counter as a blueprint. Docker on your own laptop is the building site. What will your very first tofu plan show?

Try it

Step 1: tools and a folder. Then write providers.tf (below). It uses the Docker provider, version 4.6 or a newer 4.x.

Real mission

Install OpenTofu 1.13 (see Go deeper for the link). Check it.
tofu version
Start Docker on your laptop. Check it answers.
docker info
Make the project folder and a Git repo.
mkdir kedai-blueprint && cd kedai-blueprint && git init
Save providers.tf with the lines below.

0 of 4 steps done · Your ticks are saved.

terraform {
  required_providers {
    docker = {
      source  = "kreuzwerker/docker"
      version = "~> 4.6"
    }
  }
}

provider "docker" {}

Try it

Step 2: the blueprint. Which line opens the shop on your laptop’s port 8080?

Save this as main.tf. Add outputs.tf too: output "url" { value = "http://localhost:8080" }.

resource "docker_image" "web" {
  name         = "nginx:1.30-alpine"
  keep_locally = true
}

resource "docker_container" "web" {
  name  = "kedai-kancil-web"
  image = docker_image.web.image_id

  ports {
    internal = 80
    external = 8080
  }
}

Try it

Step 3: build it on your laptop. Plan first, always.

Real mission

Get the Docker provider. It writes the lock file.
tofu init
Check layout and typos.
tofu fmt -check && tofu validate
Read the plan: 2 to add, 0 to destroy.
tofu plan
Build it. Type yes after reading.
tofu apply
Open http://localhost:8080 in your browser. Kedai Kancil is open!

0 of 5 steps done · Your ticks are saved.

Try it

Step 4: the plan workflow. Build it, then save it as .github/workflows/plan.yml.

Tap blocks to add them. Put them in order.

Blocks

Your workflow

Tap a block above to start.

Workflow file .github/workflows/

name: Plan

What runs

Nothing to run yet.

Try it

Step 5: push it, then open a pull request that changes the port.

Real mission

Keep the register and downloads out of Git.
printf "*.tfstate\n*.tfstate.*\n.terraform/\n" > .gitignore
Commit the blueprint, the lock file and the workflow.
git add . && git commit -m "Blueprint Kedai Kancil"
Make an empty public repo called kedai-blueprint on GitHub. Push main to it (use your username).
git remote add origin https://github.com/YOUR-NAME/kedai-blueprint.git && git push -u origin main
On a new branch, change external to 8081. Commit and push.
git switch -c port-8081
Open a pull request. Wait for the plan check, then read its log.

0 of 5 steps done · Your ticks are saved.

Check

Let GitHub’s public API confirm it. Type your username, then check.

Check it on GitHub

Your kedai-blueprint repo is publicNot checked yet
It has main.tfNot checked yet
It has the lock fileNot checked yet
It has the plan workflowNot checked yet
The workflow ran at least onceNot checked yet
You opened a pull request thereNot checked yet

Check

The API can’t see everything. Check these yourself, then clean up.

Real mission

The CI log shows a plan with 2 to add. (CI has no register, so it plans everything.)
terraform.tfstate is not in your repo. The lock file is.
No passwords or keys are in any file.
Tear it down on your laptop. Read the plan, then yes.
tofu destroy
Check the container is gone.
docker ps -a --filter name=kedai-kancil-web

0 of 5 steps done · Your ticks are saved.

You did it!

You can now blueprint a real service, build it, and plan every change in CI.

Go deeper (optional)

Safety: only your own laptop, port 8080 free, and tofu destroy at the end. Install OpenTofu: opentofu.org/docs/intro/install. With kind instead, the kubernetes provider works the same way. Where the story breaks: CI planned with an empty register. Real teams give CI the shared backend (T3·1), so its plan matches the building.