Orthevs Orthevs Fathom new horizons
Menu

Workshop wiki · English

Vagrant Exercises: Advanced Security (EN)

These exercises train Trust-Modell, Box-Provenienz, SSH, Secrets, Plugins, Netzwerkexposition und Incident Response. Each task requires traceable evidence instead of just a command.

Content language · EnglishSize · 99.1 KBexercises/04-advanced-security-exercises-vagrant-EN.md
Workshop examples as ZIP files
Learning progress in the web app

Mark chapters as read, view reading progress and check off practice modules after enabling the optional web app. Workshop progress is calculated from chapters across all document pages. Your choices stay on this device; there is no account or server sync. Installation is not required. Withdrawing your choice in Privacy settings deletes the progress.

Reading progress0%
0%
0 / 4 chapters read
Other language versionGerman ↗Greek ↗

Vagrant Exercises: Advanced Security (EN)

Goal

These exercises train Trust-Modell, Box-Provenienz, SSH, Secrets, Plugins, Netzwerkexposition und Incident Response. Each task requires traceable evidence instead of just a command.

01 / 04

Rules

  • Work in a dedicated branch.
  • Do not start a VM when the task only asks for static analysis.
  • Document box, provider, network, provisioner and rollback.
  • Check shell scripts with bash -n and Vagrantfiles with the local example checks.
02 / 04

Tasks

Task 01: Check the box source in the HCP Vagrant Registry or an internal registry

Scenario: A team changes a Vagrant environment. Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which box is used, who maintains it and which version is approved?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 02: Version the Vagrantfile and review changes like infrastructure code

Scenario: A team changes a Vagrant environment. Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which provider is required and which host permissions does it need?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 03: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Scenario: A team changes a Vagrant environment. Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which forwarded ports, private networks or public networks are opened?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 04: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Scenario: A team changes a Vagrant environment. Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which files are synced between host and guest?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 05: Write provisioners idempotently and keep package installation reproducible

Scenario: A team changes a Vagrant environment. Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which provisioners run with root privileges and are they idempotent?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 06: Limit synced folders to the minimum required paths and never sync secrets

Scenario: A team changes a Vagrant environment. Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which plugins are required and how are they versioned?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 07: Roll out box updates through controlled testing instead of implicit team upgrades

Scenario: A team changes a Vagrant environment. Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which host resources are consumed during vagrant up?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 08: Treat plugins as supply-chain components and document their versions

Scenario: A team changes a Vagrant environment. Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: What is the recovery path for a broken VM, box regression or SSH failure?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 09: Use snapshots as lab helpers, not as a backup replacement

Scenario: A team changes a Vagrant environment. Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which box is used, who maintains it and which version is approved?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 10: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Scenario: A team changes a Vagrant environment. Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which provider is required and which host permissions does it need?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 11: Check the box source in the HCP Vagrant Registry or an internal registry

Scenario: A team changes a Vagrant environment. Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which forwarded ports, private networks or public networks are opened?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 12: Version the Vagrantfile and review changes like infrastructure code

Scenario: A team changes a Vagrant environment. Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which files are synced between host and guest?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 13: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Scenario: A team changes a Vagrant environment. Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which provisioners run with root privileges and are they idempotent?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 14: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Scenario: A team changes a Vagrant environment. Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which plugins are required and how are they versioned?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 15: Write provisioners idempotently and keep package installation reproducible

Scenario: A team changes a Vagrant environment. Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which host resources are consumed during vagrant up?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 16: Limit synced folders to the minimum required paths and never sync secrets

Scenario: A team changes a Vagrant environment. Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: What is the recovery path for a broken VM, box regression or SSH failure?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 17: Roll out box updates through controlled testing instead of implicit team upgrades

Scenario: A team changes a Vagrant environment. Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which box is used, who maintains it and which version is approved?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 18: Treat plugins as supply-chain components and document their versions

Scenario: A team changes a Vagrant environment. Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which provider is required and which host permissions does it need?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 19: Use snapshots as lab helpers, not as a backup replacement

Scenario: A team changes a Vagrant environment. Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which forwarded ports, private networks or public networks are opened?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 20: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Scenario: A team changes a Vagrant environment. Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which files are synced between host and guest?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 21: Check the box source in the HCP Vagrant Registry or an internal registry

Scenario: A team changes a Vagrant environment. Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which provisioners run with root privileges and are they idempotent?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 22: Version the Vagrantfile and review changes like infrastructure code

Scenario: A team changes a Vagrant environment. Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which plugins are required and how are they versioned?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 23: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Scenario: A team changes a Vagrant environment. Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which host resources are consumed during vagrant up?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 24: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Scenario: A team changes a Vagrant environment. Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: What is the recovery path for a broken VM, box regression or SSH failure?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 25: Write provisioners idempotently and keep package installation reproducible

Scenario: A team changes a Vagrant environment. Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which box is used, who maintains it and which version is approved?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 26: Limit synced folders to the minimum required paths and never sync secrets

Scenario: A team changes a Vagrant environment. Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which provider is required and which host permissions does it need?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 27: Roll out box updates through controlled testing instead of implicit team upgrades

Scenario: A team changes a Vagrant environment. Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which forwarded ports, private networks or public networks are opened?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 28: Treat plugins as supply-chain components and document their versions

Scenario: A team changes a Vagrant environment. Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which files are synced between host and guest?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 29: Use snapshots as lab helpers, not as a backup replacement

Scenario: A team changes a Vagrant environment. Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which provisioners run with root privileges and are they idempotent?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 30: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Scenario: A team changes a Vagrant environment. Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which plugins are required and how are they versioned?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 31: Check the box source in the HCP Vagrant Registry or an internal registry

Scenario: A team changes a Vagrant environment. Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which host resources are consumed during vagrant up?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 32: Version the Vagrantfile and review changes like infrastructure code

Scenario: A team changes a Vagrant environment. Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: What is the recovery path for a broken VM, box regression or SSH failure?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 33: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

Scenario: A team changes a Vagrant environment. Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which box is used, who maintains it and which version is approved?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 34: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

Scenario: A team changes a Vagrant environment. Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which provider is required and which host permissions does it need?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 35: Write provisioners idempotently and keep package installation reproducible

Scenario: A team changes a Vagrant environment. Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which forwarded ports, private networks or public networks are opened?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 36: Limit synced folders to the minimum required paths and never sync secrets

Scenario: A team changes a Vagrant environment. Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which files are synced between host and guest?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 37: Roll out box updates through controlled testing instead of implicit team upgrades

Scenario: A team changes a Vagrant environment. Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which provisioners run with root privileges and are they idempotent?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 38: Treat plugins as supply-chain components and document their versions

Scenario: A team changes a Vagrant environment. Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which plugins are required and how are they versioned?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 39: Use snapshots as lab helpers, not as a backup replacement

Scenario: A team changes a Vagrant environment. Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: Which host resources are consumed during vagrant up?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action

Task 40: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

Scenario: A team changes a Vagrant environment. Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.

Execution:

  1. Open the matching example under examples/.
  2. Review Vagrantfile, provisioners and policy files.
  3. Run ./run.sh inside the example.
  4. Create a short evidence note with risk and rollback.

Review question: What is the recovery path for a broken VM, box regression or SSH failure?

Expected evidence:

  • checked file path
  • relevant command output
  • assessed risk
  • safe next action
03 / 04

Practice Appendix: Advanced Security exercise questions

The following cards are intended for repetition, review and coaching. Each card has a concrete Vagrant angle and can be used as a short exercise, pairing prompt or pull-request comment.

Card 001: Check the box source in the HCP Vagrant Registry or an internal registry

  • Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant init.
  • Review question: Which box is used, who maintains it and which version is approved?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 002: Version the Vagrantfile and review changes like infrastructure code

  • Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant validate.
  • Review question: Which provider is required and which host permissions does it need?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 003: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

  • Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant up.
  • Review question: Which forwarded ports, private networks or public networks are opened?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 004: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

  • Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant status.
  • Review question: Which files are synced between host and guest?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 005: Write provisioners idempotently and keep package installation reproducible

  • Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant ssh.
  • Review question: Which provisioners run with root privileges and are they idempotent?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 006: Limit synced folders to the minimum required paths and never sync secrets

  • Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant ssh-config.
  • Review question: Which plugins are required and how are they versioned?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 007: Roll out box updates through controlled testing instead of implicit team upgrades

  • Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant provision.
  • Review question: Which host resources are consumed during vagrant up?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 008: Treat plugins as supply-chain components and document their versions

  • Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant reload.
  • Review question: What is the recovery path for a broken VM, box regression or SSH failure?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 009: Use snapshots as lab helpers, not as a backup replacement

  • Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant halt.
  • Review question: Which box is used, who maintains it and which version is approved?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 010: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

  • Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant destroy.
  • Review question: Which provider is required and which host permissions does it need?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 011: Check the box source in the HCP Vagrant Registry or an internal registry

  • Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant box list.
  • Review question: Which forwarded ports, private networks or public networks are opened?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 012: Version the Vagrantfile and review changes like infrastructure code

  • Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant box update.
  • Review question: Which files are synced between host and guest?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 013: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

  • Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant plugin list.
  • Review question: Which provisioners run with root privileges and are they idempotent?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 014: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

  • Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant snapshot save.
  • Review question: Which plugins are required and how are they versioned?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 015: Write provisioners idempotently and keep package installation reproducible

  • Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant init.
  • Review question: Which host resources are consumed during vagrant up?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 016: Limit synced folders to the minimum required paths and never sync secrets

  • Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant validate.
  • Review question: What is the recovery path for a broken VM, box regression or SSH failure?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 017: Roll out box updates through controlled testing instead of implicit team upgrades

  • Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant up.
  • Review question: Which box is used, who maintains it and which version is approved?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 018: Treat plugins as supply-chain components and document their versions

  • Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant status.
  • Review question: Which provider is required and which host permissions does it need?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 019: Use snapshots as lab helpers, not as a backup replacement

  • Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant ssh.
  • Review question: Which forwarded ports, private networks or public networks are opened?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 020: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

  • Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant ssh-config.
  • Review question: Which files are synced between host and guest?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 021: Check the box source in the HCP Vagrant Registry or an internal registry

  • Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant provision.
  • Review question: Which provisioners run with root privileges and are they idempotent?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 022: Version the Vagrantfile and review changes like infrastructure code

  • Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant reload.
  • Review question: Which plugins are required and how are they versioned?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 023: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

  • Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant halt.
  • Review question: Which host resources are consumed during vagrant up?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 024: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

  • Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant destroy.
  • Review question: What is the recovery path for a broken VM, box regression or SSH failure?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 025: Write provisioners idempotently and keep package installation reproducible

  • Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant box list.
  • Review question: Which box is used, who maintains it and which version is approved?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 026: Limit synced folders to the minimum required paths and never sync secrets

  • Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant box update.
  • Review question: Which provider is required and which host permissions does it need?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 027: Roll out box updates through controlled testing instead of implicit team upgrades

  • Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant plugin list.
  • Review question: Which forwarded ports, private networks or public networks are opened?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 028: Treat plugins as supply-chain components and document their versions

  • Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant snapshot save.
  • Review question: Which files are synced between host and guest?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 029: Use snapshots as lab helpers, not as a backup replacement

  • Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant init.
  • Review question: Which provisioners run with root privileges and are they idempotent?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 030: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

  • Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant validate.
  • Review question: Which plugins are required and how are they versioned?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 031: Check the box source in the HCP Vagrant Registry or an internal registry

  • Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant up.
  • Review question: Which host resources are consumed during vagrant up?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 032: Version the Vagrantfile and review changes like infrastructure code

  • Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant status.
  • Review question: What is the recovery path for a broken VM, box regression or SSH failure?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 033: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

  • Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant ssh.
  • Review question: Which box is used, who maintains it and which version is approved?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 034: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

  • Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant ssh-config.
  • Review question: Which provider is required and which host permissions does it need?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 035: Write provisioners idempotently and keep package installation reproducible

  • Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant provision.
  • Review question: Which forwarded ports, private networks or public networks are opened?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 036: Limit synced folders to the minimum required paths and never sync secrets

  • Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant reload.
  • Review question: Which files are synced between host and guest?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 037: Roll out box updates through controlled testing instead of implicit team upgrades

  • Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant halt.
  • Review question: Which provisioners run with root privileges and are they idempotent?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 038: Treat plugins as supply-chain components and document their versions

  • Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant destroy.
  • Review question: Which plugins are required and how are they versioned?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 039: Use snapshots as lab helpers, not as a backup replacement

  • Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant box list.
  • Review question: Which host resources are consumed during vagrant up?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 040: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

  • Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant box update.
  • Review question: What is the recovery path for a broken VM, box regression or SSH failure?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 041: Check the box source in the HCP Vagrant Registry or an internal registry

  • Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant plugin list.
  • Review question: Which box is used, who maintains it and which version is approved?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 042: Version the Vagrantfile and review changes like infrastructure code

  • Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant snapshot save.
  • Review question: Which provider is required and which host permissions does it need?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 043: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

  • Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant init.
  • Review question: Which forwarded ports, private networks or public networks are opened?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 044: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

  • Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant validate.
  • Review question: Which files are synced between host and guest?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 045: Write provisioners idempotently and keep package installation reproducible

  • Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant up.
  • Review question: Which provisioners run with root privileges and are they idempotent?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 046: Limit synced folders to the minimum required paths and never sync secrets

  • Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant status.
  • Review question: Which plugins are required and how are they versioned?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 047: Roll out box updates through controlled testing instead of implicit team upgrades

  • Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant ssh.
  • Review question: Which host resources are consumed during vagrant up?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 048: Treat plugins as supply-chain components and document their versions

  • Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant ssh-config.
  • Review question: What is the recovery path for a broken VM, box regression or SSH failure?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 049: Use snapshots as lab helpers, not as a backup replacement

  • Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant provision.
  • Review question: Which box is used, who maintains it and which version is approved?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 050: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

  • Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant reload.
  • Review question: Which provider is required and which host permissions does it need?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 051: Check the box source in the HCP Vagrant Registry or an internal registry

  • Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant halt.
  • Review question: Which forwarded ports, private networks or public networks are opened?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 052: Version the Vagrantfile and review changes like infrastructure code

  • Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant destroy.
  • Review question: Which files are synced between host and guest?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 053: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

  • Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant box list.
  • Review question: Which provisioners run with root privileges and are they idempotent?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 054: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

  • Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant box update.
  • Review question: Which plugins are required and how are they versioned?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 055: Write provisioners idempotently and keep package installation reproducible

  • Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant plugin list.
  • Review question: Which host resources are consumed during vagrant up?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 056: Limit synced folders to the minimum required paths and never sync secrets

  • Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant snapshot save.
  • Review question: What is the recovery path for a broken VM, box regression or SSH failure?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 057: Roll out box updates through controlled testing instead of implicit team upgrades

  • Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant init.
  • Review question: Which box is used, who maintains it and which version is approved?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 058: Treat plugins as supply-chain components and document their versions

  • Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant validate.
  • Review question: Which provider is required and which host permissions does it need?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 059: Use snapshots as lab helpers, not as a backup replacement

  • Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant up.
  • Review question: Which forwarded ports, private networks or public networks are opened?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 060: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

  • Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant status.
  • Review question: Which files are synced between host and guest?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 061: Check the box source in the HCP Vagrant Registry or an internal registry

  • Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant ssh.
  • Review question: Which provisioners run with root privileges and are they idempotent?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 062: Version the Vagrantfile and review changes like infrastructure code

  • Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant ssh-config.
  • Review question: Which plugins are required and how are they versioned?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 063: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt

  • Context: Document provider assumptions explicitly, especially VirtualBox, Docker, Hyper-V, VMware and libvirt is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant provision.
  • Review question: Which host resources are consumed during vagrant up?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 064: Bind forwarded ports to 127.0.0.1 by default and review public networks separately

  • Context: Bind forwarded ports to 127.0.0.1 by default and review public networks separately is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant reload.
  • Review question: What is the recovery path for a broken VM, box regression or SSH failure?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 065: Write provisioners idempotently and keep package installation reproducible

  • Context: Write provisioners idempotently and keep package installation reproducible is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant halt.
  • Review question: Which box is used, who maintains it and which version is approved?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 066: Limit synced folders to the minimum required paths and never sync secrets

  • Context: Limit synced folders to the minimum required paths and never sync secrets is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant destroy.
  • Review question: Which provider is required and which host permissions does it need?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 067: Roll out box updates through controlled testing instead of implicit team upgrades

  • Context: Roll out box updates through controlled testing instead of implicit team upgrades is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant box list.
  • Review question: Which forwarded ports, private networks or public networks are opened?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 068: Treat plugins as supply-chain components and document their versions

  • Context: Treat plugins as supply-chain components and document their versions is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant box update.
  • Review question: Which files are synced between host and guest?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 069: Use snapshots as lab helpers, not as a backup replacement

  • Context: Use snapshots as lab helpers, not as a backup replacement is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant plugin list.
  • Review question: Which provisioners run with root privileges and are they idempotent?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 070: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs

  • Context: Start troubleshooting with vagrant status, ssh-config, port, provision and provider-specific logs is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant snapshot save.
  • Review question: Which plugins are required and how are they versioned?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 071: Check the box source in the HCP Vagrant Registry or an internal registry

  • Context: Check the box source in the HCP Vagrant Registry or an internal registry is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant init.
  • Review question: Which host resources are consumed during vagrant up?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.

Card 072: Version the Vagrantfile and review changes like infrastructure code

  • Context: Version the Vagrantfile and review changes like infrastructure code is always part of a local infrastructure contract in Vagrant. A Vagrantfile describes not only a VM but also provider assumptions, box provenance, networks, sync paths, provisioning and the allowed host working area. Changes should therefore be handled like infrastructure code: reproducible, reviewable, reversible and without hidden secrets.
  • Check command: vagrant validate.
  • Review question: What is the recovery path for a broken VM, box regression or SSH failure?
  • Evidence: Record the Vagrantfile snippet, expected state, observed output and rollback decision.
  • Risk: Document whether host resources, network exposure, secrets, box trust or plugin supply chain are affected.
04 / 04

VAG · Orthevs Academy

31 modules as one continuous learning path.

The sequence remains unchanged: from the lab skeleton through technical foundations and operating models to final troubleshooting. The technical directory names are deliberately preserved.

Practice modules

Orthevs as an app

Install Orthevs

The Orthevs web app can be installed on supported mobile devices and desktop browsers.

iPhone and iPad

Open Orthevs in Safari. Tap Share, then Add to Home Screen. Enable Open as Web App if offered, then tap Add.

Android

For the web app, open the browser menu and choose Install app or Add to Home screen. Confirm the installation.

Desktop browser

Open the browser menu or the install icon in the address bar, then choose Install app or Add to Dock.

Web app installation depends on your browser. If no install prompt appears, follow the browser steps shown above.