OpenTofu
The community fork of Terraform under the Linux Foundation, MPL-licensed and governed by many companies rather than one
Quick Overview
| Company | Linux Foundation (OpenTofu project) |
|---|---|
| Category | DevOps & Infrastructure as Code |
| Headquarters | Distributed, Open Source |
| Founded | 2023 |
| EU Presence | Vendor-neutral; no single jurisdiction |
| Data Location | Runs wherever you run it |
| Open Source | Yes (MPL 2.0) |
| GDPR Compliant | Yes - no vendor processing involved |
| Self-Hosting | Yes - a CLI you run yourself |
| Main Features | Terraform-compatible HCL, state encryption, provider and module registry, for_each on providers, drop-in migration, no telemetry |
| Pricing | Free and open source |
| Best For | Any team that wants infrastructure-as-code without a single-vendor licence risk |
| Replaces | Terraform (BSL), Pulumi |
Detailed Review
When HashiCorp moved Terraform to the Business Source Licence in 2023, a large part of the ecosystem concluded that a decade of infrastructure code should not depend on one company's licensing decisions. OpenTofu is the result: a fork of Terraform 1.5, donated to the Linux Foundation, governed by a technical steering committee drawn from many organisations.
IBM's subsequent acquisition of HashiCorp did not change the licence, but it did reinforce the argument for a neutrally governed alternative.
Drop-In Compatibility
For most estates, migrating is replacing the binary. OpenTofu reads the same HCL, uses the same state format and works with the same providers, because it forked from Terraform 1.5.x before the licence change. Teams typically validate on a non-production stack and then switch.
Friction appears where you depend on Terraform features added after the fork, or on modules pinned to HashiCorp's registry. Both are usually solvable, but they are the things to check before committing.
Features HashiCorp Has Not Shipped
OpenTofu has not simply tracked Terraform. State encryption — encrypting state files at rest and in transit with your own keys — addresses a long-standing complaint, since state files routinely contain secrets. Provider iteration with for_each and early variable evaluation are similarly practical additions.
That divergence matters: OpenTofu is now a project with its own direction rather than a defensive copy.
Governance
Being under the Linux Foundation with multi-company governance means no single vendor can relicense it. For European public sector and regulated organisations that need to justify long-term technology choices, that governance model is often easier to defend than a commercially controlled tool.
Limitations to Consider
The provider and module ecosystem still centres on HashiCorp's registry, and while OpenTofu maintains its own, some third-party modules assume Terraform. Commercial tooling around IaC has been slower to certify OpenTofu than to support Terraform. And OpenTofu is only the engine — you still need somewhere to run it, which is where Spacelift or Digger come in.
Who Should Use OpenTofu
Any team using Terraform that is uncomfortable with the BSL, and any organisation that needs to justify a long-term infrastructure-as-code choice on governance grounds rather than on features alone.
Pros and Cons
Pros
- Drop-in replacement for Terraform 1.5+
- MPL 2.0, cannot be relicensed by one vendor
- State encryption built in
- Linux Foundation governance
- No telemetry
Cons
- Ecosystem still gravitates to HashiCorp registry
- Some commercial tooling slower to certify it
- Engine only, no execution platform
Alternatives to OpenTofu
Other European devops & infrastructure as code worth comparing before you decide:
Spacelift
Poland · Managed CI/CD for OpenTofu, Terraform, Pulumi and Ansible
NixOS
Netherlands · Declarative, reproducible system configuration
Buddy Works
Poland · Pipeline automation with an unusually approachable UI
Terramate
Germany · Orchestration and code generation for large IaC estates
See all European devops & infrastructure as code or compare them directly against Terraform (BSL) on our alternatives page.
Frequently Asked Questions
For most estates it is a binary swap: same HCL, same state format, same providers. Check for reliance on Terraform features added after the 1.5 fork and for modules pinned to HashiCorp's registry, and validate on a non-production stack first.
The Business Source Licence restricts using Terraform to build competing products and can be changed by its owner. MPL 2.0 under Linux Foundation governance cannot be unilaterally revoked, which is a materially different long-term risk profile.
Yes, notably client-side state encryption with your own keys, provider iteration with for_each, and early variable evaluation. It is developing its own direction rather than only tracking Terraform.
Yes. OpenTofu is a CLI. For team workflows with policy, approvals and drift detection you need an execution platform such as Spacelift, Terramate or Digger.