Sample Solutions

These solutions show expected reasoning patterns for Trust-Modell, Box-Provenienz, SSH, Secrets, Plugins, Netzwerkexposition und Incident Response. They are grading rubrics, not the only possible answers.

Answers

Answer 01: Check the box source in the HCP Vagrant Registry or an internal registry

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant init when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 02: Version the Vagrantfile and review changes like infrastructure code

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant validate when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 03: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant up when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 04: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant status when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 05: Write provisioners idempotently and keep package installation reproducible

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant ssh when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 06: Limit synced folders to the minimum required paths and never sync secrets

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant ssh-config when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 07: Roll out box updates through controlled testing instead of implicit team upgrades

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant provision when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 08: Treat plugins as supply-chain components and document their versions

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant reload when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 09: Use snapshots as lab helpers, not as a backup replacement

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant halt when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 10: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant destroy when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 11: Check the box source in the HCP Vagrant Registry or an internal registry

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant box list when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 12: Version the Vagrantfile and review changes like infrastructure code

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant box update when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 13: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant plugin list when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 14: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant snapshot save when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 15: Write provisioners idempotently and keep package installation reproducible

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant init when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 16: Limit synced folders to the minimum required paths and never sync secrets

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant validate when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 17: Roll out box updates through controlled testing instead of implicit team upgrades

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant up when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 18: Treat plugins as supply-chain components and document their versions

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant status when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 19: Use snapshots as lab helpers, not as a backup replacement

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant ssh when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 20: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant ssh-config when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 21: Check the box source in the HCP Vagrant Registry or an internal registry

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant provision when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 22: Version the Vagrantfile and review changes like infrastructure code

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant reload when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 23: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant halt when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 24: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant destroy when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 25: Write provisioners idempotently and keep package installation reproducible

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant box list when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 26: Limit synced folders to the minimum required paths and never sync secrets

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant box update when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 27: Roll out box updates through controlled testing instead of implicit team upgrades

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant plugin list when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 28: Treat plugins as supply-chain components and document their versions

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant snapshot save when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 29: Use snapshots as lab helpers, not as a backup replacement

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant init when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 30: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant validate when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 31: Check the box source in the HCP Vagrant Registry or an internal registry

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant up when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 32: Version the Vagrantfile and review changes like infrastructure code

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant status when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 33: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant ssh when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 34: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant ssh-config when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 35: Write provisioners idempotently and keep package installation reproducible

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant provision when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 36: Limit synced folders to the minimum required paths and never sync secrets

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant reload when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 37: Roll out box updates through controlled testing instead of implicit team upgrades

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant halt when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 38: Treat plugins as supply-chain components and document their versions

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant destroy when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 39: Use snapshots as lab helpers, not as a backup replacement

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant box list when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 40: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant box update when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 41: Check the box source in the HCP Vagrant Registry or an internal registry

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant plugin list when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 42: Version the Vagrantfile and review changes like infrastructure code

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant snapshot save when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 43: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant init when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 44: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant validate when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 45: Write provisioners idempotently and keep package installation reproducible

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant up when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 46: Limit synced folders to the minimum required paths and never sync secrets

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant status when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 47: Roll out box updates through controlled testing instead of implicit team upgrades

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant ssh when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 48: Treat plugins as supply-chain components and document their versions

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant ssh-config when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 49: Use snapshots as lab helpers, not as a backup replacement

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant provision when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 50: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant reload when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 51: Check the box source in the HCP Vagrant Registry or an internal registry

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant halt when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 52: Version the Vagrantfile and review changes like infrastructure code

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant destroy when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 53: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant box list when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 54: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant box update when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 55: Write provisioners idempotently and keep package installation reproducible

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant plugin list when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 56: Limit synced folders to the minimum required paths and never sync secrets

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant snapshot save when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 57: Roll out box updates through controlled testing instead of implicit team upgrades

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant init when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 58: Treat plugins as supply-chain components and document their versions

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant validate when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 59: Use snapshots as lab helpers, not as a backup replacement

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant up when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Answer 60: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Review the Vagrantfile first and explain whether box, provider and networks match the scenario.
• Use vagrant status when local state or configuration must be evidenced.
• Document secrets, open ports, synced folders, root provisioning and plugin dependencies separately.
• A good rollback explains whether vagrant reload, vagrant halt, vagrant destroy or a box/plugin rollback is appropriate.

Practice Appendix: Advanced Security assessment review

The following cards are intended for repetition, review and coaching. Each card has a concrete Vagrant angle and can be used as a short exercise, pairing prompt or pull-request comment.

Card 001: Check the box source in the HCP Vagrant Registry or an internal registry

• Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant init.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 002: Version the Vagrantfile and review changes like infrastructure code

• Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant validate.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 003: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant up.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 004: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant status.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 005: Write provisioners idempotently and keep package installation reproducible

• Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 006: Limit synced folders to the minimum required paths and never sync secrets

• Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh-config.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 007: Roll out box updates through controlled testing instead of implicit team upgrades

• Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant provision.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 008: Treat plugins as supply-chain components and document their versions

• Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant reload.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 009: Use snapshots as lab helpers, not as a backup replacement

• Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant halt.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 010: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant destroy.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 011: Check the box source in the HCP Vagrant Registry or an internal registry

• Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box list.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 012: Version the Vagrantfile and review changes like infrastructure code

• Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box update.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 013: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant plugin list.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 014: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant snapshot save.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 015: Write provisioners idempotently and keep package installation reproducible

• Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant init.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 016: Limit synced folders to the minimum required paths and never sync secrets

• Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant validate.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 017: Roll out box updates through controlled testing instead of implicit team upgrades

• Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant up.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 018: Treat plugins as supply-chain components and document their versions

• Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant status.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 019: Use snapshots as lab helpers, not as a backup replacement

• Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 020: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh-config.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 021: Check the box source in the HCP Vagrant Registry or an internal registry

• Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant provision.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 022: Version the Vagrantfile and review changes like infrastructure code

• Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant reload.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 023: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant halt.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 024: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant destroy.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 025: Write provisioners idempotently and keep package installation reproducible

• Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box list.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 026: Limit synced folders to the minimum required paths and never sync secrets

• Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box update.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 027: Roll out box updates through controlled testing instead of implicit team upgrades

• Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant plugin list.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 028: Treat plugins as supply-chain components and document their versions

• Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant snapshot save.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 029: Use snapshots as lab helpers, not as a backup replacement

• Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant init.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 030: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant validate.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 031: Check the box source in the HCP Vagrant Registry or an internal registry

• Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant up.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 032: Version the Vagrantfile and review changes like infrastructure code

• Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant status.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 033: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 034: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh-config.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 035: Write provisioners idempotently and keep package installation reproducible

• Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant provision.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 036: Limit synced folders to the minimum required paths and never sync secrets

• Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant reload.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 037: Roll out box updates through controlled testing instead of implicit team upgrades

• Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant halt.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 038: Treat plugins as supply-chain components and document their versions

• Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant destroy.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 039: Use snapshots as lab helpers, not as a backup replacement

• Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box list.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 040: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box update.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 041: Check the box source in the HCP Vagrant Registry or an internal registry

• Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant plugin list.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 042: Version the Vagrantfile and review changes like infrastructure code

• Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant snapshot save.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 043: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant init.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 044: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant validate.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 045: Write provisioners idempotently and keep package installation reproducible

• Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant up.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 046: Limit synced folders to the minimum required paths and never sync secrets

• Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant status.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 047: Roll out box updates through controlled testing instead of implicit team upgrades

• Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 048: Treat plugins as supply-chain components and document their versions

• Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh-config.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 049: Use snapshots as lab helpers, not as a backup replacement

• Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant provision.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 050: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant reload.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 051: Check the box source in the HCP Vagrant Registry or an internal registry

• Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant halt.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 052: Version the Vagrantfile and review changes like infrastructure code

• Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant destroy.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 053: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box list.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 054: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box update.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 055: Write provisioners idempotently and keep package installation reproducible

• Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant plugin list.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 056: Limit synced folders to the minimum required paths and never sync secrets

• Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant snapshot save.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 057: Roll out box updates through controlled testing instead of implicit team upgrades

• Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant init.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 058: Treat plugins as supply-chain components and document their versions

• Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant validate.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 059: Use snapshots as lab helpers, not as a backup replacement

• Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant up.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 060: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant status.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.