terraform plan deletes docker images

[PeddeF]

I'm quiet new to terraform and tested the example with nginx which works well.
Now I'm trying to create a MariaDB container with terraform which works well on first apply.

When I call terraform plan the container gets deleted although I made no changes in my terraform file. I searched the web for an answer but couldn't find an answer.
Why does a call to plan already delete the container (isn't it just a plan?) and why is the container deleted although I made no changes?

I hope you can give me a hint...

My main.tf looks as follows:

terraform {
  required_providers {
    docker = {
      source  = "kreuzwerker/docker"
      version = "~> 2.13.0"
    }
  }
}

provider "docker" {
  host = "npipe:////.//pipe//docker_engine"
}

resource "docker_image" "mariadb" {
  name         = "mariadb:latest"
  keep_locally = true
}

resource "docker_container" "keycloak_db" {
  image = docker_image.mariadb.latest
  name  = "keycloak_db"
  ports {
    internal = 3306
    external = 3306
  }
}

The output of terraform plan looks as follows:

docker_image.mariadb: Refreshing state... [id=sha256:100166b773f8bdb6f5bfcd16a5ae670bc02ec8a0b6f52f6f74cc560aad592fccmariadb:latest]
docker_container.keycloak_db: Refreshing state... [id=cd66d2ef7d678957b9f355e7d7b06158acd1f7d0b6f3b5eb985bd25844618fc1]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the last "terraform apply":

  # docker_container.keycloak_db has been deleted
  - resource "docker_container" "keycloak_db" {
      - attach            = false -> null
      - command           = [
          - "mariadbd",
        ] -> null
      - cpu_shares        = 0 -> null
      - entrypoint        = [
          - "docker-entrypoint.sh",
        ] -> null
      - env               = [] -> null
      - gateway           = "172.17.0.1" -> null
      - hostname          = "cd66d2ef7d67" -> null
      - id                = "cd66d2ef7d678957b9f355e7d7b06158acd1f7d0b6f3b5eb985bd25844618fc1" -> null
      - image             = "sha256:100166b773f8bdb6f5bfcd16a5ae670bc02ec8a0b6f52f6f74cc560aad592fcc" -> null
      - init              = false -> null
      - ip_address        = "172.17.0.2" -> null
      - ip_prefix_length  = 16 -> null
      - ipc_mode          = "private" -> null
      - log_driver        = "json-file" -> null
      - logs              = false -> null
      - max_retry_count   = 0 -> null
      - memory            = 0 -> null
      - memory_swap       = 0 -> null
      - must_run          = true -> null
      - name              = "keycloak_db" -> null
      - network_data      = [
          - {
              - gateway                   = "172.17.0.1"
              - global_ipv6_address       = ""
              - global_ipv6_prefix_length = 0
              - ip_address                = "172.17.0.2"
              - ip_prefix_length          = 16
              - ipv6_gateway              = ""
              - network_name              = "bridge"
            },
        ] -> null
      - network_mode      = "default" -> null
      - privileged        = false -> null
      - publish_all_ports = false -> null
      - read_only         = false -> null
      - remove_volumes    = true -> null
      - restart           = "no" -> null
      - rm                = false -> null
      - security_opts     = [] -> null
      - shm_size          = 64 -> null
      - start             = true -> null
      - stdin_open        = false -> null
      - tty               = false -> null

      - ports {
          - external = 3308 -> null
          - internal = 3306 -> null
          - ip       = "0.0.0.0" -> null
          - protocol = "tcp" -> null
        }
    }


Unless you have made equivalent changes to your configuration, or ignored the relevant attributes using ignore_changes, the following plan may include actions to undo or respond to these changes.

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # docker_container.keycloak_db will be created
  + resource "docker_container" "keycloak_db" {
      + attach           = false
      + bridge           = (known after apply)
      + command          = (known after apply)
      + container_logs   = (known after apply)
      + entrypoint       = (known after apply)
      + env              = (known after apply)
      + exit_code        = (known after apply)
      + gateway          = (known after apply)
      + hostname         = (known after apply)
      + id               = (known after apply)
      + image            = "sha256:100166b773f8bdb6f5bfcd16a5ae670bc02ec8a0b6f52f6f74cc560aad592fcc"
      + init             = (known after apply)
      + ip_address       = (known after apply)
      + ip_prefix_length = (known after apply)
      + ipc_mode         = (known after apply)
      + log_driver       = "json-file"
      + logs             = false
      + must_run         = true
      + name             = "keycloak_db"
      + network_data     = (known after apply)
      + read_only        = false
      + remove_volumes   = true
      + restart          = "no"
      + rm               = false
      + security_opts    = (known after apply)
      + shm_size         = (known after apply)
      + start            = true
      + stdin_open       = false
      + tty              = false

      + healthcheck {
          + interval     = (known after apply)
          + retries      = (known after apply)
          + start_period = (known after apply)
          + test         = (known after apply)
          + timeout      = (known after apply)
        }

      + labels {
          + label = (known after apply)
          + value = (known after apply)
        }

      + ports {
          + external = 3308
          + internal = 3306
          + ip       = "0.0.0.0"
          + protocol = "tcp"
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform apply" now.

[PeddeF]

I solved my problem...
I was missing the environment variables.

When setting e.g.
env = ["MARIADB_DATABASE=keycloak", "MARIADB_USER=keycloak", "MARIADB_PASSWORD=Password", "MARIADB_ROOT_PASSWORD=root_passw@rd"]

everything works as expected