Ansible and Docker

# CHAPTER 11

Ansible and Docker #

1. Introduction #

• Deploy and manage Docker containers using the dockercontainer module.

• Manage Docker networks and volumes via Ansible.

3. Beginner-Friendly Explanation #

• Docker Compose: A crane operator who only works at ONE specific shipping dock. They can move containers around, but only at their specific dock (your local machine or a single server).

• Ansible: The CEO of the entire global shipping company. Ansible can fly to 50 different shipping docks around the world simultaneously, tell the local crews to build the cranes (Install Docker), and then instruct all 50 cranes to move the shipping containers into the exact perfect position.

Ansible orchestrates Docker at scale.

4. Setting up the Docker Environment #

*On your Control Node terminal, install the collection:*

ansible-galaxy collection install community.docker

*In your Playbook, prepare the Managed Node:*

---
- name: Prepare Docker Environment
  hosts: webservers
  become: yes

  tasks:
    - name: Install Docker prerequisites
      apt:
        name: 
          - apt-transport-https
          - ca-certificates
          - curl
          - software-properties-common
          - python3-pip
        state: present

    # Ansible needs the Python Docker library to talk to the Docker API
    - name: Install Docker SDK for Python
      pip:
        name: docker
        state: present

*(Note: A full Docker installation playbook is longer, requiring adding GPG keys and the Docker repository. For brevity, assume Docker is installed).*

5. Orchestrating Containers #

    - name: Run a simple Nginx container
      community.docker.docker_container:
        name: my_web_app
        image: nginx:latest
        state: started
        restart_policy: always
        
        # Map port 80 in the container to port 8080 on the host server
        published_ports:
          - "8080:80"
          
        # Mount a local directory into the container
        volumes:
          - "/var/www/html:/usr/share/nginx/html:ro"

6. Mini Project: Deploy a Containerized Database #

Step-by-Step Architecture Concept:

---
- name: Deploy Containerized Database
  hosts: databases
  become: yes
  vars:
    db_password: "SuperSecretPassword"

  tasks:
    # 1. Create a Docker Volume for persistent storage
    - name: Create PostgreSQL volume
      community.docker.docker_volume:
        name: pgdata

    # 2. Deploy the Database Container
    - name: Launch PostgreSQL container
      community.docker.docker_container:
        name: main_db
        image: postgres:14
        state: started
        
        # Security: Do not publish port 5432 to the host! Keep it isolated.
        
        # Attach the volume we just created
        volumes:
          - "pgdata:/var/lib/postgresql/data"
          
        # Inject the secure password variable into the container environment
        env:
          POSTGRES_USER: admin
          POSTGRES_PASSWORD: "{{ db_password }}"
          POSTGRES_DB: company_data

7. Real-World Scenarios #

8. Best Practices #

• Immutable Containers: Never use Ansible to connect *inside* a running Docker container to install software or edit files. This violates the core philosophy of Docker (Immutability). A container should be built complete. Ansible should only be used to manage the *host* server, pull the pre-built image, and pass environment variables to the container at launch.

9. Security Recommendations #

• Avoid Docker Socket Mounting: Sometimes developers mount /var/run/docker.sock into a container so the container can control Docker. Avoid doing this via Ansible unless absolutely necessary (like for a Traefik router). Giving a container access to the Docker socket gives it effective root access to the entire host server.

10. Troubleshooting Tips #

• Python Library Conflicts: If Ansible throws Failed to import the required Python library (Docker API), it usually means the python3-docker package is not installed on the *Managed Node*, or it is installed for the wrong version of Python. Ensure you are using the pip module to install the docker package for the exact Python interpreter Ansible is utilizing.

11. Exercises #

1. 1. What is the operational purpose of installing the docker Python SDK via the pip module before attempting to use the docker_container Ansible module?

1. 2. Explain why mapping a Docker Volume to a database container is critical for production data integrity.

12. FAQs #

13. Interview Questions #

• Q: Explain the intersection of Configuration Management (Ansible) and Containerization (Docker). In a modern DevOps pipeline, what operational responsibilities should be assigned to Ansible versus the Dockerfile?

• Q: Describe the Ansible Playbook logic required to securely deploy a Dockerized database, ensuring data persistence and the secure injection of runtime credentials without exposing the database port to the host's public interface.

14. Summary #

15. Next Chapter Recommendation #