Ansible Docker container image

The goal of this project is to provide an up-to-date version of Ansible and agru that people can run in a (Docker) container.

This project was created for spantaleev/matrix-docker-ansible-deploy (see Using Ansible via Docker).

Building

If you need to build it yourself, instead of using the ghcr.io/devture/ansible image that we publish to Docker Hub.

docker build -t ghcr.io/devture/ansible:latest -f Dockerfile .

Usage

Usage against a remote SSH host

If you can connect to the remote server using SSH, use the following command:

cd /some/ansible-project

docker run \
-it \
--rm \
-w /work \
--mount type=bind,src=`pwd`,dst=/work \
--mount type=bind,src=$HOME/.ssh/id_ed25519,dst=/root/.ssh/id_ed25519,ro \
--entrypoint=/bin/sh \
ghcr.io/devture/ansible:latest

You can execute ansible-playbook commands as per normal now.

Usage against the same host

If you'd like to run Ansible in a container on the server, and then target that same server from inside the container, use this:

cd /some/ansible-project

docker run \
-it \
--rm \
--privileged \
--pid=host \
-w /work \
--mount type=bind,src=`pwd`,dst=/work \
--entrypoint=/bin/sh \
ghcr.io/devture/ansible:latest

When invoking the ansible-playbook commands, ensure that:

• you either add --connection=community.docker.nsenter to the command (e.g. ansible-playbook --connection=community.docker.nsenter ...)

• or that you've set ansible_connection=community.docker.nsenter for each host that needs it in your Ansible hosts file

SSH host keys and passphrases

Since Ansible 2.21, forked workers lose the controlling terminal, so SSH cannot prompt you (neither to confirm an unknown host key, nor for the passphrase of an SSH key).

This image therefore sets StrictHostKeyChecking accept-new: keys of previously unknown hosts are accepted automatically and a changed host key still fails loudly. To verify host keys yourself, mount your own known_hosts file (--mount type=bind,src=$HOME/.ssh/known_hosts,dst=/root/.ssh/known_hosts,ro).

For a passphrase-protected SSH key, use an ssh-agent instead of mounting the key: --mount type=bind,src=$SSH_AUTH_SOCK,dst=/ssh-agent --env SSH_AUTH_SOCK=/ssh-agent.