Can I use OpenTofu and Terraform on the same project simultaneously?

Not safely in parallel—only one tool should own the state at a time. Both binaries can coexist on a machine, but pick one tool per project and stick with it to avoid lock file and state format conflicts.

Do all Terraform providers work with OpenTofu?

Yes. OpenTofu supports the same plugin protocol (v5 and v6) as Terraform. Every provider on the public registry works without modification, including AWS, Azure, Google, and thousands of community providers.

Is OpenTofu compatible with Terraform Cloud or Terraform Enterprise?

OpenTofu can use Terraform Cloud as a remote backend for state storage, but Terraform Cloud's native run environment executes Terraform, not OpenTofu. For OpenTofu-native CI/CD, use Spacelift, Scalr, env0, or self-hosted Atlantis.

What happens if I migrate to OpenTofu and later want to go back to Terraform?

Migrating back is possible as long as you haven't used OpenTofu-only features like state encryption or early-evaluated variables. Remove those features, then run terraform init against your existing state.

Does OpenTofu receive security patches promptly?

Yes. The OpenTofu project has a published security policy and a dedicated team that releases patches independently of HashiCorp. CVEs affecting the core engine are typically addressed within days.

Use OpenTofu (the Terraform Fork)

OpenTofu is the open-source fork of Terraform, born after HashiCorp relicensed Terraform under the Business Source License (BUSL) in August 2023. The Linux Foundation-hosted project maintains full compatibility with Terraform's HCL syntax and provider ecosystem up through the 1.5.x feature set, giving teams a drop-in migration path. If you're running Terraform today, switching costs very little. If you're starting fresh, OpenTofu is the community-backed choice with no licensing restrictions on commercial use.

Why OpenTofu Exists

HashiCorp's BUSL change means Terraform 1.6 and later cannot be used to build competing products or services without a commercial agreement. For most infrastructure teams that restriction doesn't matter operationally—but it creates legal uncertainty, especially in larger organizations. OpenTofu 1.6+ continues under the Mozilla Public License 2.0 (MPL-2.0) with active development adding features Terraform has not shipped, including early-evaluation variables and provider-defined functions. The OpenTofu registry mirrors the full public Terraform provider catalog.

Prerequisites

A 64-bit Linux system (amd64 or arm64) running a supported distro
Root or sudo access
An existing Terraform project to migrate, or a clean directory for a new one
Basic familiarity with HCL and provider configuration

Install OpenTofu

The OpenTofu project ships official packages for all major distro families. Choose the method that matches your system.

Debian and Ubuntu

sudo apt-get install -y curl gnupg
curl -fsSL https://get.opentofu.org/opentofu.gpg \
  | sudo gpg --dearmor -o /usr/share/keyrings/opentofu.gpg
curl -fsSL https://packages.opentofu.org/opentofu/tofu/gpgkey \
  | sudo gpg --dearmor -o /usr/share/keyrings/opentofu-repo.gpg
echo "deb [signed-by=/usr/share/keyrings/opentofu.gpg,/usr/share/keyrings/opentofu-repo.gpg] \
  https://packages.opentofu.org/opentofu/tofu/any/ any main" \
  | sudo tee /etc/apt/sources.list.d/opentofu.list
sudo apt-get update
sudo apt-get install -y opentofu

Fedora, RHEL 9, Rocky Linux

sudo dnf config-manager --add-repo \
  https://packages.opentofu.org/opentofu/tofu/config_file.repo
sudo dnf install -y opentofu

Arch Linux

OpenTofu is available from the Arch User Repository (AUR). Use your preferred AUR helper:

paru -S opentofu

Manual binary install (any distro)

Useful in minimal or air-gapped environments. Replace the version number as needed.

TOFU_VERSION="1.7.3"
curl -fsSL "https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_linux_amd64.zip" \
  -o tofu.zip
curl -fsSL "https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_SHA256SUMS" \
  -o SHA256SUMS
grep "tofu_${TOFU_VERSION}_linux_amd64.zip" SHA256SUMS | sha256sum -c
unzip tofu.zip tofu
sudo install -m 0755 tofu /usr/local/bin/tofu

Verify the installation

tofu version

You should see output like OpenTofu v1.7.3 on linux_amd64. The exact version varies.

Migrate an Existing Terraform Project

For projects that have not used any Terraform-only features introduced after 1.5.x, migration is typically a two-command process. Back up your state file before touching anything.

Step 1 — Back up state

If you use remote state (S3, GCS, Terraform Cloud, etc.), take a snapshot through your backend's native tooling. For local state:

cp terraform.tfstate terraform.tfstate.bak
cp terraform.tfstate.backup terraform.tfstate.backup.bak 2>/dev/null || true

Step 2 — Replace the required_providers source (if needed)

Providers sourced from registry.terraform.io work unchanged; OpenTofu transparently proxies them. However, if your required_providers block explicitly references registry.terraform.io hostnames, you may update them to registry.opentofu.org for clarity—this is optional, not mandatory.

# Optional: rewrite provider source hostnames in all .tf files
grep -rl 'registry.terraform.io' . | xargs sed -i \
  's|registry.terraform.io|registry.opentofu.org|g'

Step 3 — Run tofu init

OpenTofu reads your existing .terraform.lock.hcl and state files natively.

tofu init

If the lock file was generated by a newer Terraform version, add -upgrade to refresh provider checksums under OpenTofu's signing keys.

tofu init -upgrade

Step 4 — Validate and plan

tofu validate
tofu plan -out=migration.tfplan

A clean plan with no unexpected changes confirms a successful migration. If the plan shows drift unrelated to your change, investigate before applying—this is pre-existing drift, not caused by the switch.

Step 5 — Apply (when ready)

tofu apply migration.tfplan

Provider Compatibility

OpenTofu supports the full Terraform provider protocol (plugin framework v5 and v6). Every provider published to the public registry works without modification. The OpenTofu registry at registry.opentofu.org is a read-through mirror of the HashiCorp registry for community providers. HashiCorp's own first-party providers (AWS, Azure, Google) are MPL-licensed and are mirrored as well.

If you use a private registry or Terraform Enterprise, configure the TF_CLI_CONFIG_FILE or ~/.tofurc (OpenTofu's equivalent of ~/.terraformrc) to point at your internal registry hostname:

cat > ~/.tofurc <<'EOF'
credentials "registry.example.internal" {
  token = "your-registry-token"
}
EOF

OpenTofu-Specific Features Worth Knowing

OpenTofu has diverged from Terraform in a few useful ways:

Early-evaluation of variables and locals — lets you reference variables inside backend and module blocks without workarounds.
Provider-defined functions — providers can expose custom HCL functions callable directly in your configuration.
State encryption — built-in AES-GCM or AWS KMS encryption of local and remote state, configured in a terraform { encryption {} } block. Terraform has no equivalent.
Removed block improvements — finer control over resource removal lifecycle without deleting state entries.

State encryption is opt-in and particularly valuable for local state files on shared build machines. Enable it with a key provider block:

cat >> main.tf <<'EOF'
terraform {
  encryption {
    key_provider "pbkdf2" "local" {
      passphrase = var.state_passphrase
    }
    method "aes_gcm" "default" {
      keys = key_provider.pbkdf2.local
    }
    state {
      method = method.aes_gcm.default
    }
  }
}
EOF

Store the passphrase in a secret manager or environment variable, never in source control.

Troubleshooting

Lock file checksum mismatch

If tofu init fails with a checksum error on the lock file, the file was written by Terraform and contains HashiCorp-issued signatures OpenTofu cannot verify. Delete and regenerate it:

rm .terraform.lock.hcl
tofu providers lock -platform=linux_amd64 -platform=darwin_arm64

Commit the new lock file. Add additional -platform flags for every platform your team runs on.

tofu and terraform coexist on the same machine

The tofu binary is entirely independent of terraform. Both can be installed simultaneously. They maintain separate plugin caches; set TF_PLUGIN_CACHE_DIR and TF_PLUGIN_CACHE_MAY_BREAK_DEPENDENCY_LOCK_FILE for Terraform, and the OpenTofu equivalent TF_PLUGIN_CACHE_DIR still works for tofu. Separate plugin cache directories avoid cross-contamination on machines running both tools.

Module source using git references

Module sources using git::https:// or SSH work identically to Terraform, but require git to be installed on the host. On minimal container images:

# Debian/Ubuntu
sudo apt-get install -y git

# Fedora/RHEL
sudo dnf install -y git