In 2023, HashiCorp changed Terraform’s licence from the open-source MPL 2.0 to the Business Source License (BSL). In response, the community created OpenTofu: a fork of the last open-source Terraform version, now maintained under the Linux Foundation, and licensed MPL 2.0. For most users, OpenTofu is a drop-in replacement: same HCL language, same providers, same workflow, with the command tofu instead of terraform.

Why it exists

  • Licence: BSL restricts using Terraform in products that compete with HashiCorp. Many companies and tool vendors wanted a truly open-source option.
  • Governance: OpenTofu is community-governed, with features decided in public.

For an individual or company simply managing its own infrastructure, both licences generally allow usage. The choice is more about long-term openness, ecosystem, and features.

Compatibility

  • OpenTofu 1.6 was compatible with Terraform 1.6. Later versions added their own features, while keeping most configurations working.
  • Providers and modules from the public registries work (OpenTofu runs its own registry, which mirrors providers).
  • State files are compatible when migrating from the matching Terraform versions. Check the migration guide for your exact versions.

Install

# Debian/Ubuntu: the official installer script (review it first)
curl --proto '=https' --tlsv1.2 -fsSL https://get.opentofu.org/install-opentofu.sh -o install-opentofu.sh
chmod +x install-opentofu.sh
./install-opentofu.sh --install-method deb
tofu version

Packages also exist for RHEL-family systems, Homebrew, and as standalone binaries and a container image.

Migrate an existing Terraform project

  1. Back up the state (download it from your backend, or copy the local file). See Terraform state.
  2. Make sure terraform plan shows no changes on your current version.
  3. In the project directory:
tofu init          # downloads providers from the OpenTofu registry
tofu plan          # should also show no changes
  1. Apply a trivial change, to confirm the state is written correctly. Then switch your CI to tofu.

Keep the .terraform.lock.hcl file under version control. OpenTofu updates it with its own provider checksums. Rolling back to Terraform is possible if you haven’t used OpenTofu-only features and versions still match.

Notable OpenTofu features

Feature What it does
State and plan encryption Encrypts state files client-side (keys from a passphrase, or a KMS), so secrets in state are protected even in the bucket
Early variable evaluation Variables usable in places like backend and module source configuration
for_each on providers Simplifies multi-region/multi-account setups
Provider-defined functions, -exclude flag, and more Varies by version; see the release notes

Terraform, in turn, has its own new features (Terraform Stacks, HCP integrations). The projects are gradually diverging.

Which should you use?

Situation Suggestion
New project, want open-source and community governance OpenTofu
Heavy use of HCP Terraform / Terraform Cloud Terraform
Existing Terraform setup that works, no licence concerns Either. Migration is easy when you’re ready
Vendor tooling you build or sell OpenTofu (licence clarity)

Whichever you choose, the important practices are the same: remote state with locking, small modules, code review of plans, and secrets kept out of the code. See Terraform modules and Terraform basics.

Quick reference

Terraform OpenTofu
terraform init tofu init
terraform plan / apply tofu plan / apply
BSL 1.1 licence MPL 2.0 (open source)
HashiCorp Linux Foundation
registry.terraform.io registry.opentofu.org

Related: Pulumi basics and Linux configuration management.

  • Terraform
  • DevOps
  • Open Source