pluggero/docker-archlinux-ansible repository overview

⁠Archlinux Ansible Test Image

Archlinux Docker container for Ansible playbook and role testing.

⁠⚠️ Security Warning

This box is intended for testing and development purposes only. DO NOT use in production environments.

This Docker Image contains:

• Public passwords visible in the repository
• Pre-configured users with known credentials

These are intentionally included for transparent testing but make this box completely insecure for production use.

⁠Tags

• latest: Latest stable version of Ansible, with Python 3.x.

⁠How to Use

1. Pull this image from Docker Hub: docker pull pluggero/docker-archlinux-ansible:latest
2. Run a container from the image:

docker run --name test-container -d --privileged \
  -v /sys/fs/cgroup:/sys/fs/cgroup:rw \
  --cgroupns=host \
  pluggero/docker-archlinux-ansible:latest

1. Use Ansible inside the container:

docker exec --tty test-container env TERM=xterm ansible --version
docker exec --tty test-container env TERM=xterm ansible-playbook /path/to/playbook.yml --syntax-check

To test Ansible roles, mount your role:

docker run --name test-container -d --privileged \
  -v /sys/fs/cgroup:/sys/fs/cgroup:rw \
  --cgroupns=host \
  --volume="$(pwd):/etc/ansible/roles/role_under_test:ro" \
  pluggero/docker-archlinux-ansible:latest

⁠How to build yourself

1. Install the required tools (Packer, Ansible, Docker).
2. Clone this repository and cd into it.
3. Run the build script:

./scripts/archlinux_builder.sh

The build process:

1. Runs a bootstrap script to install Python
2. Provisions the container with Ansible
3. Commits the image with the configured tag

⁠Build Requirements

• Packer⁠
• Ansible⁠
• Docker⁠

⁠Notes

I use Docker to test my Ansible roles and playbooks on multiple OSes using CI tools like Jenkins and Travis. This container allows me to test roles and playbooks using Ansible running locally inside the container.

⁠Verifying Image Provenance

To ensure the Docker image you download was built from this repository without modification, follow these verification steps:

⁠Step 1: Download the checksums file

# Download the checksums file from the GitHub Actions artifacts
# Visit: https://github.com/pluggero/docker-archlinux-ansible/actions/workflows/release.yml
# Click on the workflow run for your version
# Download the "checksums-VERSION" artifact

⁠Step 2: Verify the attestation

# Install GitHub CLI if not already installed: https://cli.github.com/

# Verify the checksums file was generated by our CI/CD pipeline
gh attestation verify checksums.txt --owner pluggero

This cryptographically proves the checksums file was created by our pipeline from a specific git commit.

⁠Step 3: Verify the image digest

# Get the digest from checksums.txt
cat checksums.txt

# Pull the image by digest (from checksums.txt)
docker pull pluggero/docker-archlinux-ansible@sha256:<digest-from-checksums.txt>

# Or verify your existing image digest matches
docker inspect --format='{{index .RepoDigests 0}}' pluggero/docker-archlinux-ansible:latest

The digest must match. If it doesn't, the image was modified after the build.

⁠What This Proves

• The checksums file was generated by our GitHub Actions pipeline (attestation)
• The image digest matches the one from the pipeline (manual verification)
• The image was built from a specific git commit (metadata in checksums.txt)
• The image uploaded to Docker Hub has not been tampered with