Configuring docker container with ansible

Question

Is it a good or bad practice to configure docker container with ansible , from within the container, providing ansible command as an entrypoint? Using ansible it would be easier to configure things depending of some lookup conditions. This ansible command would also start the provided service. Is this a good or evil? Another option would be to use shell script, and third one to make all the configuration in Dockerfile (error prone). Last option would be to configure some base container from withing using any method (manual or CM) and commit changes (hard to reproduce). Which is the preferred way to configure containers?

IMO, using ansible would decouple business logic from docker platform, so same service could be easily ran at different virtualization platform or bare metal by just a singe ansible command. But is there drawbacks?

Also, is it endorsed to configure running containers with ansible, or does this violate docker doctrine?

Answer 1

Ansible is generally executed from outside the container but it doesn't have to be, it depends on what you want to achieve. For example Ansible installed locally is often used in small development environments such as on a developers laptop while a seperate server is used for something like a cloud environment where there are multiple systems, containers, etc.

Answer 2

I have just spent a few weeks looking at exactly this problem. For the same application (based on a tomee and mongo), I have done the following patterns:

• Just ansible deploying to one or more VMs
• Creating containers which then run ansible scripts inside themselves as you did
• Using ansible-container

I did them in that order because it meant going from simple to more complex. I am a product manager and my different customers are at different levels of maturity, so I had the same concerns as you. I wanted a repeatable script which would work both on VMs (or even bare metal), as well as on containerised environments.

The first solution is a good way to learn. The second solutions works, but it means that your containers are bigger than they should be. The third solution is better for the following reasons:

• It basically forces you to start using roles. If you haven't started using roles, you should.
• It effectively decouples the business logic from docker and keeps it in ansible (even more than the second solution)
• If you are deploying to VMs, you should be able to use the playbooks from the roles
• If you are deploying with docker-compose, you go up to ansible-container push and then supply your customer with a docker-compose file whey they can execute
• If you deploying to cloud, ansible-container creates a playbook to pull and run the containers (thought I am still working through this one)