Packer — Machine Image Builder Guide

Build identical, immutable machine images for AWS, GCP, Azure, VMware, and Docker from a single HCL2 template. HashiCorp Packer codifies your golden image pipeline.

What is Packer?

HashiCorp Packer is an open-source tool that automates the creation of machine images across multiple platforms. Given a single template, Packer can build an AWS AMI, a GCP Image, an Azure Managed Image, and a VMware OVA simultaneously — all from the same provisioning code. Released in 2013 by Mitchell Hashimoto (co-founder of HashiCorp), Packer is a cornerstone of immutable infrastructure pipelines used by engineering teams worldwide.

The workflow is simple: Packer launches a temporary VM (or container) using a base image, runs provisioners (shell scripts, Ansible playbooks, Chef recipes) to install software and configure the OS, then captures a snapshot as an immutable image. The temporary VM is destroyed. The resulting image becomes your golden artifact — versioned, tested, and ready to deploy to auto-scaling groups or Kubernetes nodes without any post-boot configuration.

Key Features

• Multi-builder — build for AWS, GCP, Azure, VMware, VirtualBox, QEMU, Docker in parallel
• HCL2 templates — typed variables, for_each build matrices, better error messages
• Provisioners — shell, Ansible, Chef, Puppet, Salt, PowerShell, Windows shell
• Post-processors — manifest, compress, shell-local, amazon-import, Vagrant box
• packer validate — catch template errors before starting expensive cloud builds
• packer fmt — format HCL2 templates consistently (like terraform fmt)
• Variable files — .pkrvars.hcl files for per-environment configuration
• Plugin system — first-class and community-maintained builder/provisioner plugins

HCL2 Template: AWS AMI with Ansible

# ubuntu-web.pkr.hcl
packer {
  required_version = ">= 1.9.0"
  required_plugins {
    amazon = {
      version = ">= 1.3.0"
      source  = "github.com/hashicorp/amazon"
    }
    ansible = {
      version = ">= 1.1.0"
      source  = "github.com/hashicorp/ansible"
    }
  }
}

variable "aws_region" {
  type    = string
  default = "us-east-1"
}

variable "ami_name_prefix" {
  type    = string
  default = "my-app"
}

variable "app_version" {
  type    = string
  description = "Application version tag to embed in the image"
}

locals {
  timestamp = regex_replace(timestamp(), "[: TZ]", "")
  ami_name  = "${var.ami_name_prefix}-${var.app_version}-${local.timestamp}"
}

source "amazon-ebs" "ubuntu" {
  region        = var.aws_region
  instance_type = "t3.medium"
  ami_name      = local.ami_name

  source_ami_filter {
    filters = {
      name                = "ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"
      root-device-type    = "ebs"
      virtualization-type = "hvm"
    }
    most_recent = true
    owners      = ["099720109477"] # Canonical
  }

  ssh_username = "ubuntu"

  tags = {
    Name        = local.ami_name
    AppVersion  = var.app_version
    BuildTime   = local.timestamp
    ManagedBy   = "Packer"
  }

  launch_block_device_mappings {
    device_name           = "/dev/sda1"
    volume_size           = 20
    volume_type           = "gp3"
    delete_on_termination = true
  }
}

build {
  name    = "ubuntu-web-server"
  sources = ["source.amazon-ebs.ubuntu"]

  # Shell provisioner for initial setup
  provisioner "shell" {
    inline = [
      "sudo apt-get update -y",
      "sudo apt-get install -y python3 python3-pip",
      "sudo apt-get clean",
    ]
  }

  # Ansible provisioner for full configuration
  provisioner "ansible" {
    playbook_file   = "./ansible/site.yml"
    roles_path      = "./ansible/roles"
    extra_arguments = [
      "--extra-vars", "app_version=${var.app_version}",
      "--become",
    ]
  }

  # Write AMI ID to manifest file for downstream use
  post-processor "manifest" {
    output     = "manifest.json"
    strip_path = true
  }

  # Run local script after build (e.g., update Terraform variable)
  post-processor "shell-local" {
    inline = ["echo 'Build complete. AMI ID written to manifest.json'"]
  }
}

Validate, format, and build:

packer init .                                           # download plugins
packer fmt .                                            # format templates
packer validate -var 'app_version=1.2.3' .             # validate before build
packer build -var 'app_version=1.2.3' ubuntu-web.pkr.hcl  # run the build
cat manifest.json | jq '.builds[-1].artifact_id'       # extract AMI ID

Packer vs Alternatives

Use Cases

• Building golden AMIs for EC2 Auto Scaling Groups — pre-baked images start in seconds instead of minutes
• Immutable infrastructure pipelines where every deploy creates new instances from a fresh image
• Multi-cloud image distribution — build once for AWS and GCP from the same Packer template
• Security baseline images with hardened OS configurations, compliance agents, and monitoring pre-installed
• Kubernetes node images with custom container runtimes, kernel parameters, and tooling
• CI/CD integration — Packer builds triggered by git tags, new AMI IDs fed to Terraform for deployment

Pros and Cons