Vagrant .gitignore template

.vagrant is the working directory created beside the Vagrantfile the first time you bring a machine up. It records the identifier the provider assigned to each machine, which provider is in use, and the state the tool believes each machine is in. Those identifiers refer to virtual machines that exist only on one person's computer, so a committed copy points at machines nobody else has.

It also holds a generated private key. On first boot the tool replaces the well known default key pair with a freshly generated one and stores the private half inside that directory. Committing it publishes a working SSH key, and although it only opens a local development machine, it is a private key in a repository, which is worth avoiding on principle and on any security scan.

*.box covers packaged base images. A box is a compressed disk image of an entire operating system, typically hundreds of megabytes and often several gigabytes. They are downloaded from a registry or built by a packaging tool, and they are the single fastest way to make a repository unusable if one gets committed by accident.

The Vagrantfile itself is deliberately not ignored. It is the definition of the environment: which box, how much memory, which ports are forwarded, which provisioning scripts run. It is source in the same sense a Dockerfile is, and it is the file that makes the whole arrangement reproducible.

What the template does not cover is a provisioning script holding credentials. Shell provisioners are ordinary files in the repository, and a line exporting a real API key into the machine is a normal way for a secret to end up tracked without anyone thinking about it.