Best Practices: Vagrant (EN)

Overview

This document covers Best Practices for Vagrant. Focus: Versionierung, Review, Team-Konventionen und sichere Defaults.

Best Practices is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Core Model

Vagrant is a CLI-oriented tool for reproducible development environments.
The central file is the Vagrantfile; it is both Ruby DSL and infrastructure contract.
Boxes provide the base image and must be managed like external dependencies.
Providers implement the environment concretely, for example VirtualBox, Docker, Hyper-V, VMware or libvirt.
Provisioners bring the guest into the desired state, for example with shell, Ansible, file upload or cloud-init.
Synced folders and networks connect host and guest and are therefore core security and operations decisions.

Work Patterns

Pattern 1: Check the box source in the HCP Vagrant Registry or an internal registry

Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Check field	Guiding question
Review	Which box is used, who maintains it and which version is approved?
Review	Which provider is required and which host permissions does it need?
Review	Which forwarded ports, private networks or public networks are opened?
Review	Which files are synced between host and guest?
Review	Which provisioners run with root privileges and are they idempotent?
Review	Which plugins are required and how are they versioned?
Review	Which host resources are consumed during vagrant up?
Review	What is the recovery path for a broken VM, box regression or SSH failure?

vagrant validate
vagrant status
vagrant ssh-config

Pattern 2: Version the Vagrantfile and review changes like infrastructure code

Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Check field	Guiding question
Review	Which box is used, who maintains it and which version is approved?
Review	Which provider is required and which host permissions does it need?
Review	Which forwarded ports, private networks or public networks are opened?
Review	Which files are synced between host and guest?
Review	Which provisioners run with root privileges and are they idempotent?
Review	Which plugins are required and how are they versioned?
Review	Which host resources are consumed during vagrant up?
Review	What is the recovery path for a broken VM, box regression or SSH failure?

vagrant validate
vagrant status
vagrant ssh-config

Pattern 3: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Check field	Guiding question
Review	Which box is used, who maintains it and which version is approved?
Review	Which provider is required and which host permissions does it need?
Review	Which forwarded ports, private networks or public networks are opened?
Review	Which files are synced between host and guest?
Review	Which provisioners run with root privileges and are they idempotent?
Review	Which plugins are required and how are they versioned?
Review	Which host resources are consumed during vagrant up?
Review	What is the recovery path for a broken VM, box regression or SSH failure?

vagrant validate
vagrant status
vagrant ssh-config

Pattern 4: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Check field	Guiding question
Review	Which box is used, who maintains it and which version is approved?
Review	Which provider is required and which host permissions does it need?
Review	Which forwarded ports, private networks or public networks are opened?
Review	Which files are synced between host and guest?
Review	Which provisioners run with root privileges and are they idempotent?
Review	Which plugins are required and how are they versioned?
Review	Which host resources are consumed during vagrant up?
Review	What is the recovery path for a broken VM, box regression or SSH failure?

vagrant validate
vagrant status
vagrant ssh-config

Pattern 5: Write provisioners idempotently and keep package installation reproducible

Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Check field	Guiding question
Review	Which box is used, who maintains it and which version is approved?
Review	Which provider is required and which host permissions does it need?
Review	Which forwarded ports, private networks or public networks are opened?
Review	Which files are synced between host and guest?
Review	Which provisioners run with root privileges and are they idempotent?
Review	Which plugins are required and how are they versioned?
Review	Which host resources are consumed during vagrant up?
Review	What is the recovery path for a broken VM, box regression or SSH failure?

vagrant validate
vagrant status
vagrant ssh-config

Pattern 6: Limit synced folders to the minimum required paths and never sync secrets

Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Check field	Guiding question
Review	Which box is used, who maintains it and which version is approved?
Review	Which provider is required and which host permissions does it need?
Review	Which forwarded ports, private networks or public networks are opened?
Review	Which files are synced between host and guest?
Review	Which provisioners run with root privileges and are they idempotent?
Review	Which plugins are required and how are they versioned?
Review	Which host resources are consumed during vagrant up?
Review	What is the recovery path for a broken VM, box regression or SSH failure?

vagrant validate
vagrant status
vagrant ssh-config

Pattern 7: Roll out box updates through controlled testing instead of implicit team upgrades

Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Check field	Guiding question
Review	Which box is used, who maintains it and which version is approved?
Review	Which provider is required and which host permissions does it need?
Review	Which forwarded ports, private networks or public networks are opened?
Review	Which files are synced between host and guest?
Review	Which provisioners run with root privileges and are they idempotent?
Review	Which plugins are required and how are they versioned?
Review	Which host resources are consumed during vagrant up?
Review	What is the recovery path for a broken VM, box regression or SSH failure?

vagrant validate
vagrant status
vagrant ssh-config

Pattern 8: Treat plugins as supply-chain components and document their versions

Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Check field	Guiding question
Review	Which box is used, who maintains it and which version is approved?
Review	Which provider is required and which host permissions does it need?
Review	Which forwarded ports, private networks or public networks are opened?
Review	Which files are synced between host and guest?
Review	Which provisioners run with root privileges and are they idempotent?
Review	Which plugins are required and how are they versioned?
Review	Which host resources are consumed during vagrant up?
Review	What is the recovery path for a broken VM, box regression or SSH failure?

vagrant validate
vagrant status
vagrant ssh-config

Pattern 9: Use snapshots as lab helpers, not as a backup replacement

Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Check field	Guiding question
Review	Which box is used, who maintains it and which version is approved?
Review	Which provider is required and which host permissions does it need?
Review	Which forwarded ports, private networks or public networks are opened?
Review	Which files are synced between host and guest?
Review	Which provisioners run with root privileges and are they idempotent?
Review	Which plugins are required and how are they versioned?
Review	Which host resources are consumed during vagrant up?
Review	What is the recovery path for a broken VM, box regression or SSH failure?

vagrant validate
vagrant status
vagrant ssh-config

Pattern 10: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Check field	Guiding question
Review	Which box is used, who maintains it and which version is approved?
Review	Which provider is required and which host permissions does it need?
Review	Which forwarded ports, private networks or public networks are opened?
Review	Which files are synced between host and guest?
Review	Which provisioners run with root privileges and are they idempotent?
Review	Which plugins are required and how are they versioned?
Review	Which host resources are consumed during vagrant up?
Review	What is the recovery path for a broken VM, box regression or SSH failure?

vagrant validate
vagrant status
vagrant ssh-config

References

Practice Appendix: Best Practices review cards

The following cards are intended for repetition, review and coaching. Each card has a concrete Vagrant angle and can be used as a short exercise, pairing prompt or pull-request comment.

Card 001: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant init.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 002: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant validate.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 003: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant up.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 004: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant status.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 005: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 006: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh-config.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 007: Roll out box updates through controlled testing instead of implicit team upgrades

Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant provision.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 008: Treat plugins as supply-chain components and document their versions

Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant reload.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 009: Use snapshots as lab helpers, not as a backup replacement

Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant halt.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 010: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant destroy.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 011: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box list.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 012: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box update.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 013: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant plugin list.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 014: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant snapshot save.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 015: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant init.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 016: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant validate.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 017: Roll out box updates through controlled testing instead of implicit team upgrades

Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant up.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 018: Treat plugins as supply-chain components and document their versions

Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant status.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 019: Use snapshots as lab helpers, not as a backup replacement

Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 020: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh-config.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 021: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant provision.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 022: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant reload.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 023: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant halt.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 024: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant destroy.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 025: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box list.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 026: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box update.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 027: Roll out box updates through controlled testing instead of implicit team upgrades

Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant plugin list.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 028: Treat plugins as supply-chain components and document their versions

Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant snapshot save.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 029: Use snapshots as lab helpers, not as a backup replacement

Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant init.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 030: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant validate.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 031: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant up.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 032: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant status.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 033: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 034: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh-config.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 035: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant provision.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 036: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant reload.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 037: Roll out box updates through controlled testing instead of implicit team upgrades

Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant halt.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 038: Treat plugins as supply-chain components and document their versions

Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant destroy.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 039: Use snapshots as lab helpers, not as a backup replacement

Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box list.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 040: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box update.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 041: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant plugin list.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 042: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant snapshot save.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 043: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant init.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 044: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant validate.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 045: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant up.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 046: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant status.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 047: Roll out box updates through controlled testing instead of implicit team upgrades

Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 048: Treat plugins as supply-chain components and document their versions

Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh-config.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 049: Use snapshots as lab helpers, not as a backup replacement

Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant provision.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 050: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant reload.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 051: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant halt.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 052: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant destroy.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 053: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box list.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 054: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box update.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 055: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant plugin list.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 056: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant snapshot save.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 057: Roll out box updates through controlled testing instead of implicit team upgrades

Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant init.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 058: Treat plugins as supply-chain components and document their versions

Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant validate.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 059: Use snapshots as lab helpers, not as a backup replacement

Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant up.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 060: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant status.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 061: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 062: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh-config.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 063: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant provision.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 064: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant reload.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 065: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant halt.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 066: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant destroy.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 067: Roll out box updates through controlled testing instead of implicit team upgrades

Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box list.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 068: Treat plugins as supply-chain components and document their versions

Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box update.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 069: Use snapshots as lab helpers, not as a backup replacement

Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant plugin list.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 070: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant snapshot save.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 071: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant init.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 072: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant validate.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 073: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant up.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 074: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant status.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 075: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 076: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh-config.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 077: Roll out box updates through controlled testing instead of implicit team upgrades

Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant provision.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 078: Treat plugins as supply-chain components and document their versions

Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant reload.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 079: Use snapshots as lab helpers, not as a backup replacement

Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant halt.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 080: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant destroy.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 081: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box list.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 082: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box update.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 083: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant plugin list.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 084: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant snapshot save.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 085: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant init.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 086: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant validate.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 087: Roll out box updates through controlled testing instead of implicit team upgrades

Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant up.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 088: Treat plugins as supply-chain components and document their versions

Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant status.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 089: Use snapshots as lab helpers, not as a backup replacement

Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 090: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh-config.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 091: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant provision.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 092: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant reload.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 093: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant halt.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 094: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant destroy.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 095: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box list.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 096: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box update.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 097: Roll out box updates through controlled testing instead of implicit team upgrades

Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant plugin list.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 098: Treat plugins as supply-chain components and document their versions

Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant snapshot save.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 099: Use snapshots as lab helpers, not as a backup replacement

Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant init.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 100: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant validate.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 101: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant up.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 102: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant status.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 103: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 104: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh-config.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 105: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant provision.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 106: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant reload.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 107: Roll out box updates through controlled testing instead of implicit team upgrades

Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant halt.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 108: Treat plugins as supply-chain components and document their versions

Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant destroy.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 109: Use snapshots as lab helpers, not as a backup replacement

Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box list.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 110: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box update.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 111: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant plugin list.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 112: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant snapshot save.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 113: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant init.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 114: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant validate.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 115: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant up.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 116: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant status.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.