Remote state and remote runs for your Terraform configuration.
Point the cloud block you already have at runners.io. Plans and applies execute with OpenTofu, state is versioned with a diff, a rollback and a 30-day window to bring back what was deleted, and every run lands on the same timeline and the same bill as your GitHub Actions jobs.
How it works
One block, and a token
The terraform or tofu CLI you already run talks to us through the same API it talks to HCP Terraform with. A workspace named in the block is created on first use. Copy a token from your dashboard into TF_TOKEN_tf_runners_io — terraform login is not supported, because its browser step is on a path our edge does not serve.
Runs execute OpenTofu
Terraform 1.6 and later are licensed in a way that forbids hosting them competitively, so your configuration is run by tofu, on our machines or on a self-hosted agent of your own — which runs OpenTofu too. Your lock file is never written back to your repository, and providers come from our mirror of the builds you pinned.
One timeline, one bill
Terraform runs appear on the same timeline as your CI jobs, and they draw on the same allowance of run-minutes, at the rate a 2 vCPU CI job pays. You are billed for the minutes a run takes, not for the number of resources your state happens to hold. One meter, one invoice.
What it does today
Everything here works now. The ones marked API have no screen in the dashboard yet; you reach them through the Terraform Enterprise API or the tfe provider.
Runs and state
- Remote plan and apply
- Apply or discard a plan; auto-apply on or off
- Remote state, with locking and versions
- A diff between state versions
- Roll back to an earlier state version
- Restore a deleted state version
- Variables and variable sets, including sensitive values
- Run triggers between workspacesAPI
- Sharing state outputs with other workspacesAPI
Access
- Organisation roles
- Teams, with per-workspace accessAPI
- User, team and organisation API tokens
- Self-hosted agents and agent pools
- Dynamic provider credentials
VCS and registry
- VCS providers
- Runs on push to a connected repositoryAPI
- A plan on every pull requestAPI
- Private module registry
Integrations
- The cloud block, from the terraform or tofu CLI
- The tfe provider and go-tfe
- Run notificationsAPI
Against HCP Terraform, row by row
Including every row where the answer is “not yet”. If one of those is load-bearing for you, we would rather you read it here than find it three weeks into a migration.
| runners.io | HCP Terraform | |
|---|---|---|
| Runs and state | ||
| Remote plan and apply | YesRuns execute OpenTofu, on our machines or on an agent of your own. | YesRuns execute Terraform.their docs |
| Apply or discard a plan; auto-apply on or off | YesFrom the run's page and the workspace's settings. | Yestheir docs |
| Remote state, with locking and versions | Yes | Yestheir docs |
| A diff between state versions | YesResource addresses and changed attribute names — never a value. | YesOn each state version's page.their docs |
| Roll back to an earlier state version | YesWrites a new version; history is never edited. | YesIn the UI and the API.their docs |
| Restore a deleted state version | YesWithin 30 days, from the State tab. | NoTheir docs say restore is Terraform Enterprise only.their docs |
| Variables and variable sets, including sensitive values | Yes | Yestheir docs |
| Run triggers between workspaces | Via the API | Yestheir docs |
| Sharing state outputs with other workspaces | Via the APIWith every workspace in the organisation, not with a chosen few. | YesWith all workspaces, a project, or chosen workspaces.their docs |
| Projects | Not yetWorkspaces belong to the organisation directly. | Yestheir docs |
| Drift detection | Not yetPlanned, not started. | YesHealth assessments, on Standard and Premium.their docs |
| Policy as code | Not yetOPA is planned. Sentinel is HashiCorp's own and will not be offered. | YesSentinel and OPA.their docs |
| Cost estimation | Not yetPlanned. | YesOn Standard and Premium.their docs |
| Access | ||
| Organisation roles | YesOwner, Admin, Member and Billing, under Settings → People. | YesWorkspace roles from Read to Admin; custom permissions on Essentials and above.their docs |
| Teams, with per-workspace access | Via the APIA team's token is issued in the dashboard. | YesOn Essentials and above.their docs |
| User, team and organisation API tokens | YesIssued and revoked in the dashboard. | Yestheir docs |
| Single sign-on (SAML) | Not yetPlanned. Today: an email and password, or GitHub, with an optional authenticator app. | YesSAML, on every plan.their docs |
| SCIM provisioning | Not yetPlanned. | YesOn Essentials and above, with Okta or Entra ID.their docs |
| Self-hosted agents and agent pools | YesPools are organisation-wide, under Settings → Integrations. Agents run OpenTofu too. | YesHow many depends on the plan.their docs |
| Dynamic provider credentials | YesAWS, Google Cloud and Azure, set on the workspace's variables. | YesAWS, GCP, Azure, Vault, Kubernetes and Tencent Cloud.their docs |
| VCS and registry | ||
| VCS providers | YesGitHub, GitLab and Forgejo, each added with an access token under Settings → Integrations. | YesGitHub, GitLab, Bitbucket and Azure DevOps.their docs |
| Runs on push to a connected repository | Via the APIA workspace is connected to its repository over the API or with the tfe provider. | Yestheir docs |
| A plan on every pull request | Via the APIFollows the repository connection. Reported as a commit status, not a comment. | YesReported as a status check that links to the run.their docs |
| Private module registry | YesPublished from a repository's version tags, in the dashboard. | Yestheir docs |
| Private provider registry | Not yetPlanned. Public providers are served from our mirror. | Yestheir docs |
| No-code modules | Not yetPlanned. | YesOn Standard and Premium.their docs |
| Integrations | ||
| The cloud block, from the terraform or tofu CLI | YesAuthenticate with a token from the dashboard; terraform login is not supported. | YesIncluding terraform login.their docs |
| The tfe provider and go-tfe | YesAgainst the same API. Where we differ is documented. | Yestheir docs |
| Run notifications | Via the APIA webhook, Slack or Google Cloud Pub/Sub. | YesA webhook, Slack, Microsoft Teams or email.their docs |
| Notifications by email or to Microsoft Teams | Not yetA webhook into whatever already receives your alerts works meanwhile. | Yestheir docs |
| Run tasks | Not yetPlanned. | YesOn every plan; one integration on Free.their docs |
Yes works today, in the dashboard or the CLI · Via the API works today through the Terraform Enterprise API or the tfe provider, with no screen yet · Not yet cannot be had today, and the note says whether it is planned · Not published means we could not find it in their documentation, which is not the same as it not existing. HCP Terraform’s column was read from HashiCorp’s own documentation on 2026-10-14, and several of its features depend on the plan; the note says which where the docs do. If we have something wrong we would rather hear it than leave it up.
Where we genuinely differ
One meter, one bill, both halves
CI jobs and Terraform runs draw on one allowance of run-minutes and arrive on one invoice. HCP Terraform runs Terraform; your CI is somebody else’s bill.
Priced by the minute, not by the estate
HCP Terraform prices its paid plans per managed resource, every hour, whether or not anything ran. We price the minutes a run takes. What that means for your bill, plan by plan, is on HCP Terraform pricing.
A deleted state version comes back
Both of us show a diff between state versions and let you roll back. Delete one here and it can be restored for 30 days; HashiCorp’s documentation lists restoring a deleted state version as Terraform Enterprise only.
The longer version — what carries over unchanged, what we add, and the full list of what we do not have — is on an alternative to HCP Terraform.