I have automated the setup of several docker containers with ansible. This works pretty well but there are certain recurring tasks that have to be executed within the docker containers.

It is possible to implement this using the docker connection driver for ansible but this only seems to work when ansible is running on the host that is the docker runner. This is not the case and I don't want to run ansible on multiple hosts if possible. Is there a better way to use ansible to execute playbooks within containers?

// I tried it out of curiosity and it works pretty well using ansible directly on the docker runner,... anyway not my favorite solution.

  • 1
    How about this stackoverflow.com/a/41626257/3888850 ?
    – Levi
    Jul 4 '18 at 16:45
  • Well thank you! Wonder why I didn't find that post on my own,.... o.O That would have some security implications but I could deal with that! Im going to report back on it when I had the opportunity to try it out,...
    – davidb
    Jul 4 '18 at 18:02
  • 1
    @Levi: thanks for your help I answered my own post describing it in a more understandable way.
    – davidb
    Jul 4 '18 at 19:54
  • In my opinion docker images should be immutable and stateless.
    – 030
    Jul 5 '18 at 5:05
  • @030 Well I think that depends on the application in the container. In my scenario signature updates & actions of the application need to be triggered centrally and I need to validate if the progress of the process in the docker container from the outside to trigger SDN Functionallities
    – davidb
    Jul 5 '18 at 6:05

With the help of @Levi (refered to Stackoverflow) I managed to find a way to connect straigt into the docker containers using ansibles docker connection driver and the remote API capability of Docker.

First of all you have to expose the API which is by default not the case. Simply add -H tcp:// to the ExecStart constant of the systemd script. Then reload the start script and restart the docker service. (From this blogpost)

Then you can list the containers in the inventory file like this:

container-name ansible_connection=docker ansible_docker_extra_args="-H tcp://"

And execute any playbook like your used to.

ansible-playbook -i docker_inventory playbooks/my_playbook.yml

The upside of this way of implementing it this way is that you can mix up "real" hosts/vms that are maintained through SSH and Docker containers. One negative thing I have to mention is that the docker API is much slower than using SSH as a control tunnel.

This setup is of cause horribly insecure and its only purpose is to explain the concept. Before using it in production you should read into the security features and limit access to the daemon as far as possible.

  • As you said insecure for remote, but for local development is a great solution! +1 Apr 4 '20 at 15:13

It can be three step process

  1. Create a playbook with following command -

    docker exec mycontainer /bin/sh -c "cmd1;cmd2;...;cmdn"

    or Docker file entrypoint option

    FROM ubuntu
    ENTRYPOINT ["top", "-b"]
    CMD ["-c"]
  2. ansible-playbook playbooks/PLAYBOOK_NAME.yml --limit "mycontainer"

  • 2
    I fail to see how this answer the question, you should edit to add some explanation on how this works remotely (not on the docker host)
    – Tensibai
    Jul 4 '18 at 15:23
  • 1
    I think you kind of missunderstood the question. I know how I can execute commands in a docker container from the host system but I don't only want to execute commands. I want to be able to use Ansible for docker containers as if they where standalone hosts.
    – davidb
    Jul 4 '18 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.