Run environment

The OpenTofu versions, regions, resources, network access, and limits available to every run.

Every plan and apply runs in a fresh, isolated Linux environment that is discarded when the phase ends. You don’t install or manage runners.

OpenTofu versions

Each workspace pins an exact OpenTofu version in its settings.

Any stable OpenTofu release from 1.6.0 onward is supported.
Use an exact version such as 1.8.5. Ranges, aliases such as latest, and prereleases aren’t accepted.
Terraform binaries aren’t supported. Most Terraform configurations run unchanged on OpenTofu.

A run uses the version set when it was created; changing it affects only new runs.

Regions

Each workspace has an execution region. Its runs always execute there and are never moved to another region, even when the region is busy.

Region	Region id	Where runs execute
North America East (default)	`na-east`	Eastern North America, such as the eastern United States and Canada
North America West	`na-west`	Western and central North America
Europe West	`eu-west`	Western European Union countries
Europe East	`eu-east`	Northern and eastern European Union countries
Asia-Pacific	`apac`	A broad area of the Asia-Pacific region, from Japan to India
South America	`sa`	South America

Regions are broad areas, not specific cities or data centers. The API and MCP server use the region id as the workspace’s execution_region.

Resources and limits

Resource	Limit
Operating system	Linux, `amd64`
CPU	1 vCPU
Memory	3 GiB
Disk	8 GB
Plan or apply duration	Up to 4 hours per phase. An apply still running after 3 hours 45 minutes is asked to stop at a safe point
Configuration upload	100 MB
Redacted plan changes shown in the dashboard	5,000 resources

The 4-hour duration is a limit, not a guarantee: a run can be interrupted by maintenance. See Interrupted runs.

Tools available to a run

Besides OpenTofu, runs can use git, curl, tar, gzip, and unzip, for example in local-exec provisioners or to fetch modules from Git sources. Installing other tools isn’t supported.

Network access

Plans and applies have unrestricted outbound internet access. Providers, modules, and local-exec commands can reach public endpoints such as cloud APIs, provider registries, and Git hosts.

Policy checks have no internet access; they can reach only StackShip.

Runs can’t reach private networks. Resources reachable only inside your VPC or on-premises network aren’t supported.

Any provider, module, or script in your configuration can use the credentials given to the run. Only use code you trust, prefer short-lived cloud federation over long-lived secrets, and grant the least access each workspace needs.

Credentials available to a run

Credential	When it’s available
Cloud federation (AWS, Google Cloud, Azure)	Plan and apply, scoped to the workspace’s credential profile
Generic secrets	Plan and apply, as environment variables
`TF_TOKEN_stackship_run`	Plan, for downloading modules from your module registry

Pull requests from forks never receive credentials, and their speculative plans can’t read the workspace’s state or your private module registry. Speculative plans from other pull requests receive no credentials unless you configure a separate speculative-plan federation profile, and never receive generic secrets or sensitive variables.

Secret values are redacted from run logs.

Providers and modules

The apply reuses the exact providers and modules downloaded during plan, so an approved apply always uses the versions you reviewed.

If your .terraform.lock.hcl was generated on macOS or Windows, the plan adds the Linux checksums it needs. You don’t need to run tofu providers lock for Linux first.

Not supported

Self-hosted or customer-operated runners
Access to private networks
Destroy runs (tofu destroy)
Custom run environments, or tools beyond OpenTofu and the ones listed above