opentofu VS Cap'n Proto

Note: New versions of Terraform will be placed under the BUSL license, but everything created before version 1.5.x stays open-source. OpenTofu is an open-source version of Terraform that will expand on Terraform's existing concepts and offerings. It is a viable alternative to HashiCorp's Terraform, being forked from Terraform version 1.5.6.

The OpenTofu initiative was launched with significant initial support, boasting over 18 full-time equivalents (FTEs) committed to the project from four companies. The manifesto has been endorsed by over 140 companies, involving 11 projects with the participation of over 700 individuals. Moreover, the manifesto has received more than 35,000 GitHub stars, and the fork itself has garnered over 6,000 stars in just one week.

Terraform/OpenTofu installed. We use Terraform in this article.

It's great to see more companies adopting OpenTofu!

As a side note, we've recently released OpenTofu 1.7 with end-to-end state encryption, enhanced provider-defined functions, and a bunch more[0].

If you've been holding out with the migration, now is the perfect moment to take another look, and join the many companies that have already migrated!

[0]: https://github.com/opentofu/opentofu/releases/tag/v1.7.0

Note: Tech Lead of the OpenTofu project

and more.

Hey!

> With OpenTofu exclusive features making such an early debut, is the intention to remain a superset of upstream Terraform functionality and spec, or allow OpenTofu to diverge and move in its own direction?

The intention is to let it diverge. There will surely be some amount of shared new features, but we're generally going our own way.

> Will you aim to stick to compatibility with Terraform providers/modules?

Yes.

Regarding providers, we might introduce some kind of superset protocol for providers at some point, for tofu-exclusive functionality, but we'll make sure to design it in a way where providers keep working with both Terraform and OpenTofu.

Regarding modules, this one will be more tricky, as there might Terraform languages features that aren't supported in OpenTofu and vice-versa. We have a proposal[0] to tackle this, and enable module authors to easily create modules with support for both, even when using some exclusive features of any one of them.

> Is the potential impact of community fragmentation on your mind as many commercial users who don’t care about open source ideology stick to the tried-and-true Hashicorp Terraform?

We've talked to a lot of people, and we've met many who see the license changes as a risk for them, while OpenTofu, with its open-source nature, is the less-risky choice. That includes large enterprises.

> Is there any intention to try and supplement the tooling around the core product to provide an answer to features like Terraform Cloud dashboard, sentinel policies and other things companies may want out of the product outside of the command line tool itself?

That's mostly covered by the companies sponsoring OpenTofu's development: Spacelift (I work here), env0, Scalr, Harness, Gruntworks.

[0]: https://github.com/opentofu/opentofu/issues/1328

Please remember to file in a calm and orderly fashion toward the exits and remember: IBM killed Centos for profit.

Terraform users can pick up their new alternative here:

https://opentofu.org/

and for those of you with Vault, you can find your new alternative here:

https://openbao.org/

OpenTofu v1.6

To be fair, if that's what you need ProtoBuf isn't the only option. Cap'n Proto[1], JSON Schema[2], or any other well supported message-definition language could probably achieve that as well, each with their own positives and negatives.

[1]: https://capnproto.org/

[2]: https://json-schema.org/

Yeah I pretty much only use my own alternate container implementations (from KJ[0]), which avoid these footguns, but the result is everyone complains our project is written in Kenton-Language rather than C++ and there's no Stack Overflow for it and we can't hire engineers who know how to write it... oops.

[0] https://github.com/capnproto/capnproto/blob/v2/kjdoc/tour.md

- may massively reduce the latency involved.

Those sharing Cap'n Proto-encoded data may have particular interest. Cap'n Proto (https://capnproto.org) is fantastic at its core task - in-place serialization with zero-copy - and we wanted to make the IPC (inter-process communication) involving capnp-serialized messages be zero-copy, end-to-end.

That said, we paid equal attention to other varieties of payload; it's not limited to capnp-encoded messages. For example there is painless (<-- I hope!) zero-copy transmission of arbitrary combinations of STL-compliant native C++ data structures.

To help determine whether Flow-IPC is relevant to you we wrote an intro blog post. It works through an example, summarizes the available features, and has some performance results. https://www.linode.com/blog/open-source/flow-ipc-introductio...

Of course there's nothing wrong with going straight to the GitHub link and getting into the README and docs.

Currently Flow-IPC is for Linux. (macOS/ARM64 and Windows support could follow soon, depending on demand/contributions.)

FWIW, my C++ toolkit library, KJ, does the same thing.[0]

But presumably you could still write a condition predicate which looks at things which aren't actually part of the mutex-wrapped structure? Or does is the Rust type system able to enforce that the callback can only consider the mutex-wrapped value and values that are constant over the lifetime of the wait? (You need the latter e.g. if you are waiting for the mutex-wrapped value to compare equal to some local variable...)

[0] https://github.com/capnproto/capnproto/blob/e6ad6f919aeb381b...

The second one is to encode data in such a way that you can read it and operate on it directly from the buffer. You write data in a layout that is the same, or easily transformed as types in memory. To do that you usually need to encode with a known schema, only Sized types to efficiently compute fields locations as offsets in the buffer, and you usually represent pointers as offset into the encode. You can look at capnproto protocol for instance https://capnproto.org/

Worked well for Cap'n Proto (the cerealization protocol)! https://capnproto.org/

With all due respect, you read completely wrong.

* The very first use case for which Cap'n Proto was designed was to be the protocol that Sandstorm.io used to talk between sandbox and supervisor -- an explicitly adversarial security scenario.

* The documentation explicitly calls out how implementations should manage resource exhaustion problems like deep recursion depth (stack overflow risk).

* The implementation has been fuzz-tested multiple ways, including as part of Google's oss-fuzz.

* When there are security bugs, I issue advisories like this:

https://github.com/capnproto/capnproto/tree/v2/security-advi...

* The primary aim of the entire project is to be a Capability-Based Security RPC protocol.