Vagrant Share Risk Review: Vagrant (EN)

Goal

Freigabe- und Expositionsrisiken dokumentieren.

Vagrant Share Risk Review is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Files

Vagrantfile: declarative contract for box, provider, network, sync and provisioning
scripts/provision.sh: idempotent sample provisioner
scripts/verify.sh: local checks in the lab context
config/box-policy.yaml: box and provider policy
baseline.json: machine-readable expectation for review and CI
run.sh: non-destructive runner without VM start

Flow

./run.sh
find work/evidence -maxdepth 1 -type f -print

Review Points

Which box is used, who maintains it and which version is approved?
Which provider is required and which host permissions does it need?
Which forwarded ports, private networks or public networks are opened?
Which files are synced between host and guest?
Which provisioners run with root privileges and are they idempotent?
Which plugins are required and how are they versioned?
Which host resources are consumed during vagrant up?
What is the recovery path for a broken VM, box regression or SSH failure?

Vagrantfile Snippet

Vagrant.configure("2") do |config|
  config.vm.box = ENV.fetch("VAGRANT_WORKSHOP_BOX", "bento/ubuntu-24.04")
  config.vm.network "forwarded_port", guest: 8080, host: 18080, host_ip: "127.0.0.1"
  config.vm.provision "shell", path: "scripts/provision.sh", privileged: false
end

Security Notes

The sample box is an exchangeable lab value. Real teams must document a maintained box with version, source and approval.
host_ip: "127.0.0.1" prevents forwarded ports from becoming visible on the LAN without review.
Synced folders must not contain SSH keys, tokens, .env files or customer data.
Provisioners must be repeatable; one-off shell hacks are not an operations standard.

Tasks

Task 01: Write provisioners idempotently and keep package installation reproducible

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 02: Limit synced folders to the minimum required paths and never sync secrets

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 03: Roll out box updates through controlled testing instead of implicit team upgrades

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 04: Treat plugins as supply-chain components and document their versions

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 05: Use snapshots as lab helpers, not as a backup replacement

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 06: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 07: Check the box source in the HCP Vagrant Registry or an internal registry

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 08: Version the Vagrantfile and review changes like infrastructure code

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 09: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 10: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 11: Write provisioners idempotently and keep package installation reproducible

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 12: Limit synced folders to the minimum required paths and never sync secrets

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 13: Roll out box updates through controlled testing instead of implicit team upgrades

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 14: Treat plugins as supply-chain components and document their versions

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 15: Use snapshots as lab helpers, not as a backup replacement

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 16: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 17: Check the box source in the HCP Vagrant Registry or an internal registry

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 18: Version the Vagrantfile and review changes like infrastructure code

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 19: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 20: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 21: Write provisioners idempotently and keep package installation reproducible

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 22: Limit synced folders to the minimum required paths and never sync secrets

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 23: Roll out box updates through controlled testing instead of implicit team upgrades

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 24: Treat plugins as supply-chain components and document their versions

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 25: Use snapshots as lab helpers, not as a backup replacement

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 26: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 27: Check the box source in the HCP Vagrant Registry or an internal registry

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 28: Version the Vagrantfile and review changes like infrastructure code

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 29: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 30: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 31: Write provisioners idempotently and keep package installation reproducible

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 32: Limit synced folders to the minimum required paths and never sync secrets

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 33: Roll out box updates through controlled testing instead of implicit team upgrades

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 34: Treat plugins as supply-chain components and document their versions

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 35: Use snapshots as lab helpers, not as a backup replacement

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 36: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 37: Check the box source in the HCP Vagrant Registry or an internal registry

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 38: Version the Vagrantfile and review changes like infrastructure code

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 39: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 40: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 41: Write provisioners idempotently and keep package installation reproducible

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 42: Limit synced folders to the minimum required paths and never sync secrets

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

Task 43: Roll out box updates through controlled testing instead of implicit team upgrades

Check where this pattern is implemented or deliberately documented in the example.
Run ./run.sh and open the evidence files.
Record one improvement to the Vagrantfile or policy.
Explain whether the change must be reviewed before vagrant up.

The following cards are intended for repetition, review and coaching. Each card has a concrete Vagrant angle and can be used as a short exercise, pairing prompt or pull-request comment.

Card 001: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant init.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 002: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant validate.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 003: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant up.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 004: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant status.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 005: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 006: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh-config.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 007: Roll out box updates through controlled testing instead of implicit team upgrades

Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant provision.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 008: Treat plugins as supply-chain components and document their versions

Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant reload.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 009: Use snapshots as lab helpers, not as a backup replacement

Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant halt.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 010: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant destroy.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 011: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box list.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 012: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box update.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 013: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant plugin list.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 014: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant snapshot save.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 015: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant init.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 016: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant validate.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 017: Roll out box updates through controlled testing instead of implicit team upgrades

Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant up.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 018: Treat plugins as supply-chain components and document their versions

Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant status.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 019: Use snapshots as lab helpers, not as a backup replacement

Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 020: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh-config.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 021: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant provision.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 022: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant reload.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 023: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant halt.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 024: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant destroy.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 025: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box list.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 026: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box update.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 027: Roll out box updates through controlled testing instead of implicit team upgrades

Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant plugin list.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 028: Treat plugins as supply-chain components and document their versions

Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant snapshot save.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 029: Use snapshots as lab helpers, not as a backup replacement

Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant init.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 030: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant validate.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 031: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant up.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 032: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant status.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 033: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 034: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant ssh-config.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 035: Write provisioners idempotently and keep package installation reproducible

Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant provision.
Review question: Which forwarded ports, private networks or public networks are opened?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 036: Limit synced folders to the minimum required paths and never sync secrets

Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant reload.
Review question: Which files are synced between host and guest?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 037: Roll out box updates through controlled testing instead of implicit team upgrades

Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant halt.
Review question: Which provisioners run with root privileges and are they idempotent?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 038: Treat plugins as supply-chain components and document their versions

Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant destroy.
Review question: Which plugins are required and how are they versioned?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 039: Use snapshots as lab helpers, not as a backup replacement

Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box list.
Review question: Which host resources are consumed during vagrant up?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 040: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant box update.
Review question: What is the recovery path for a broken VM, box regression or SSH failure?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 041: Check the box source in the HCP Vagrant Registry or an internal registry

Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant plugin list.
Review question: Which box is used, who maintains it and which version is approved?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 042: Version the Vagrantfile and review changes like infrastructure code

Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
Check command: vagrant snapshot save.
Review question: Which provider is required and which host permissions does it need?
Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.