Goal

These exercises train Provider, Netzwerke, synced folders, Provisioner und Multi-Machine-Topologien. Each task requires traceable evidence instead of just a command.

Rules

• Work in a dedicated branch.
• Do not start a VM when the task only asks for static analysis.
• Document box, provider, network, provisioner and rollback.
• Check shell scripts with bash -n and Vagrantfiles with the local example checks.

Tasks

Task 01: Check the box source in the HCP Vagrant Registry or an internal registry

Scenario: A team changes a Vagrant environment. Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which box is used, who maintains it and which version is approved?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 02: Version the Vagrantfile and review changes like infrastructure code

Scenario: A team changes a Vagrant environment. Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which provider is required and which host permissions does it need?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 03: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Scenario: A team changes a Vagrant environment. Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which forwarded ports, private networks or public networks are opened?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 04: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Scenario: A team changes a Vagrant environment. Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which files are synced between host and guest?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 05: Write provisioners idempotently and keep package installation reproducible

Scenario: A team changes a Vagrant environment. Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which provisioners run with root privileges and are they idempotent?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 06: Limit synced folders to the minimum required paths and never sync secrets

Scenario: A team changes a Vagrant environment. Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which plugins are required and how are they versioned?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 07: Roll out box updates through controlled testing instead of implicit team upgrades

Scenario: A team changes a Vagrant environment. Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which host resources are consumed during vagrant up?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 08: Treat plugins as supply-chain components and document their versions

Scenario: A team changes a Vagrant environment. Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: What is the recovery path for a broken VM, box regression or SSH failure?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 09: Use snapshots as lab helpers, not as a backup replacement

Scenario: A team changes a Vagrant environment. Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which box is used, who maintains it and which version is approved?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 10: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Scenario: A team changes a Vagrant environment. Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which provider is required and which host permissions does it need?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 11: Check the box source in the HCP Vagrant Registry or an internal registry

Scenario: A team changes a Vagrant environment. Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which forwarded ports, private networks or public networks are opened?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 12: Version the Vagrantfile and review changes like infrastructure code

Scenario: A team changes a Vagrant environment. Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which files are synced between host and guest?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 13: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Scenario: A team changes a Vagrant environment. Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which provisioners run with root privileges and are they idempotent?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 14: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Scenario: A team changes a Vagrant environment. Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which plugins are required and how are they versioned?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 15: Write provisioners idempotently and keep package installation reproducible

Scenario: A team changes a Vagrant environment. Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which host resources are consumed during vagrant up?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 16: Limit synced folders to the minimum required paths and never sync secrets

Scenario: A team changes a Vagrant environment. Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: What is the recovery path for a broken VM, box regression or SSH failure?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 17: Roll out box updates through controlled testing instead of implicit team upgrades

Scenario: A team changes a Vagrant environment. Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which box is used, who maintains it and which version is approved?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 18: Treat plugins as supply-chain components and document their versions

Scenario: A team changes a Vagrant environment. Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which provider is required and which host permissions does it need?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 19: Use snapshots as lab helpers, not as a backup replacement

Scenario: A team changes a Vagrant environment. Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which forwarded ports, private networks or public networks are opened?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 20: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Scenario: A team changes a Vagrant environment. Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which files are synced between host and guest?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 21: Check the box source in the HCP Vagrant Registry or an internal registry

Scenario: A team changes a Vagrant environment. Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which provisioners run with root privileges and are they idempotent?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 22: Version the Vagrantfile and review changes like infrastructure code

Scenario: A team changes a Vagrant environment. Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which plugins are required and how are they versioned?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 23: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Scenario: A team changes a Vagrant environment. Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which host resources are consumed during vagrant up?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 24: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Scenario: A team changes a Vagrant environment. Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: What is the recovery path for a broken VM, box regression or SSH failure?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 25: Write provisioners idempotently and keep package installation reproducible

Scenario: A team changes a Vagrant environment. Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which box is used, who maintains it and which version is approved?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 26: Limit synced folders to the minimum required paths and never sync secrets

Scenario: A team changes a Vagrant environment. Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which provider is required and which host permissions does it need?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 27: Roll out box updates through controlled testing instead of implicit team upgrades

Scenario: A team changes a Vagrant environment. Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which forwarded ports, private networks or public networks are opened?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 28: Treat plugins as supply-chain components and document their versions

Scenario: A team changes a Vagrant environment. Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which files are synced between host and guest?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 29: Use snapshots as lab helpers, not as a backup replacement

Scenario: A team changes a Vagrant environment. Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which provisioners run with root privileges and are they idempotent?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 30: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Scenario: A team changes a Vagrant environment. Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which plugins are required and how are they versioned?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 31: Check the box source in the HCP Vagrant Registry or an internal registry

Scenario: A team changes a Vagrant environment. Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which host resources are consumed during vagrant up?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 32: Version the Vagrantfile and review changes like infrastructure code

Scenario: A team changes a Vagrant environment. Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: What is the recovery path for a broken VM, box regression or SSH failure?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 33: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Scenario: A team changes a Vagrant environment. Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which box is used, who maintains it and which version is approved?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 34: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Scenario: A team changes a Vagrant environment. Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which provider is required and which host permissions does it need?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 35: Write provisioners idempotently and keep package installation reproducible

Scenario: A team changes a Vagrant environment. Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which forwarded ports, private networks or public networks are opened?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 36: Limit synced folders to the minimum required paths and never sync secrets

Scenario: A team changes a Vagrant environment. Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which files are synced between host and guest?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 37: Roll out box updates through controlled testing instead of implicit team upgrades

Scenario: A team changes a Vagrant environment. Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which provisioners run with root privileges and are they idempotent?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 38: Treat plugins as supply-chain components and document their versions

Scenario: A team changes a Vagrant environment. Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which plugins are required and how are they versioned?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 39: Use snapshots as lab helpers, not as a backup replacement

Scenario: A team changes a Vagrant environment. Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: Which host resources are consumed during vagrant up?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Task 40: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Scenario: A team changes a Vagrant environment. Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

1. Open the matching example under examples/.
2. Review Vagrantfile, provisioners and policy files.
3. Run ./run.sh inside the example.
4. Create a short evidence note with risk and rollback.

Review question: What is the recovery path for a broken VM, box regression or SSH failure?

Expected evidence:

• checked file path
• relevant command output
• assessed risk
• safe next action

Practice Appendix: Intermediate exercise questions

The following cards are intended for repetition, review and coaching. Each card has a concrete Vagrant angle and can be used as a short exercise, pairing prompt or pull-request comment.

Card 001: Check the box source in the HCP Vagrant Registry or an internal registry

• Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant init.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 002: Version the Vagrantfile and review changes like infrastructure code

• Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant validate.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 003: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant up.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 004: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant status.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 005: Write provisioners idempotently and keep package installation reproducible

• Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 006: Limit synced folders to the minimum required paths and never sync secrets

• Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh-config.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 007: Roll out box updates through controlled testing instead of implicit team upgrades

• Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant provision.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 008: Treat plugins as supply-chain components and document their versions

• Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant reload.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 009: Use snapshots as lab helpers, not as a backup replacement

• Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant halt.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 010: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant destroy.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 011: Check the box source in the HCP Vagrant Registry or an internal registry

• Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box list.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 012: Version the Vagrantfile and review changes like infrastructure code

• Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box update.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 013: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant plugin list.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 014: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant snapshot save.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 015: Write provisioners idempotently and keep package installation reproducible

• Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant init.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 016: Limit synced folders to the minimum required paths and never sync secrets

• Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant validate.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 017: Roll out box updates through controlled testing instead of implicit team upgrades

• Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant up.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 018: Treat plugins as supply-chain components and document their versions

• Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant status.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 019: Use snapshots as lab helpers, not as a backup replacement

• Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 020: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh-config.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 021: Check the box source in the HCP Vagrant Registry or an internal registry

• Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant provision.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 022: Version the Vagrantfile and review changes like infrastructure code

• Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant reload.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 023: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant halt.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 024: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant destroy.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 025: Write provisioners idempotently and keep package installation reproducible

• Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box list.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 026: Limit synced folders to the minimum required paths and never sync secrets

• Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box update.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 027: Roll out box updates through controlled testing instead of implicit team upgrades

• Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant plugin list.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 028: Treat plugins as supply-chain components and document their versions

• Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant snapshot save.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 029: Use snapshots as lab helpers, not as a backup replacement

• Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant init.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 030: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant validate.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 031: Check the box source in the HCP Vagrant Registry or an internal registry

• Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant up.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 032: Version the Vagrantfile and review changes like infrastructure code

• Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant status.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 033: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 034: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh-config.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 035: Write provisioners idempotently and keep package installation reproducible

• Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant provision.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 036: Limit synced folders to the minimum required paths and never sync secrets

• Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant reload.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 037: Roll out box updates through controlled testing instead of implicit team upgrades

• Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant halt.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 038: Treat plugins as supply-chain components and document their versions

• Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant destroy.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 039: Use snapshots as lab helpers, not as a backup replacement

• Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box list.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 040: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box update.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 041: Check the box source in the HCP Vagrant Registry or an internal registry

• Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant plugin list.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 042: Version the Vagrantfile and review changes like infrastructure code

• Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant snapshot save.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 043: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant init.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 044: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant validate.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 045: Write provisioners idempotently and keep package installation reproducible

• Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant up.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 046: Limit synced folders to the minimum required paths and never sync secrets

• Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant status.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 047: Roll out box updates through controlled testing instead of implicit team upgrades

• Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 048: Treat plugins as supply-chain components and document their versions

• Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh-config.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 049: Use snapshots as lab helpers, not as a backup replacement

• Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant provision.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 050: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant reload.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 051: Check the box source in the HCP Vagrant Registry or an internal registry

• Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant halt.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 052: Version the Vagrantfile and review changes like infrastructure code

• Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant destroy.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 053: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box list.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 054: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box update.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 055: Write provisioners idempotently and keep package installation reproducible

• Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant plugin list.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 056: Limit synced folders to the minimum required paths and never sync secrets

• Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant snapshot save.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 057: Roll out box updates through controlled testing instead of implicit team upgrades

• Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant init.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 058: Treat plugins as supply-chain components and document their versions

• Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant validate.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 059: Use snapshots as lab helpers, not as a backup replacement

• Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant up.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 060: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant status.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 061: Check the box source in the HCP Vagrant Registry or an internal registry

• Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 062: Version the Vagrantfile and review changes like infrastructure code

• Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant ssh-config.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 063: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

• Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant provision.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 064: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

• Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant reload.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 065: Write provisioners idempotently and keep package installation reproducible

• Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant halt.
• Review question: Which box is used, who maintains it and which version is approved?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 066: Limit synced folders to the minimum required paths and never sync secrets

• Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant destroy.
• Review question: Which provider is required and which host permissions does it need?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 067: Roll out box updates through controlled testing instead of implicit team upgrades

• Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box list.
• Review question: Which forwarded ports, private networks or public networks are opened?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 068: Treat plugins as supply-chain components and document their versions

• Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant box update.
• Review question: Which files are synced between host and guest?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 069: Use snapshots as lab helpers, not as a backup replacement

• Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant plugin list.
• Review question: Which provisioners run with root privileges and are they idempotent?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 070: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

• Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant snapshot save.
• Review question: Which plugins are required and how are they versioned?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 071: Check the box source in the HCP Vagrant Registry or an internal registry

• Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant init.
• Review question: Which host resources are consumed during vagrant up?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 072: Version the Vagrantfile and review changes like infrastructure code

• Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
• Check command: vagrant validate.
• Review question: What is the recovery path for a broken VM, box regression or SSH failure?
• Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
• Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.