Forem: sdeseille

Building a Container-Optimized VM Template with Ignition on Proxmox 8.x

sdeseille — Sat, 02 Mar 2024 10:22:21 +0000

In my recent endeavors, I set up a lab machine powered by a second-hand Dell Optiplex 7040 Mini, featuring an i7 6700t processor. Despite its compact size and silent operation, this machine offers sufficient performance to host multiple virtual machines concurrently. I utilize this setup to experiment with various prototypes, such as running podman containers in rootless mode on an openSUSE Leap VM hosted within it.

A few months ago, I embarked on a journey to learn about building and utilizing Kubernetes infrastructure. Following the course "Architecting with Google Kubernetes Engine" on Coursera provided invaluable insights and knowledge.

Now, it's time to put that knowledge into practice and gain hands-on experience. To kickstart my journey into Kubernetes, I need to establish a foundation—a VM template that will serve as the cornerstone of my endeavors.

Obtaining a Container-Optimized System

To create our VM template, we first need to acquire system images from a distribution of our choice. Given my previous experience with podman on openSUSE Leap, I opted to explore the container-optimized system from openSUSE, known as MicroOS. You can find more information about it here.

Downloading the openSUSE-MicroOS.x86_64-ContainerHost Image

After selecting our distribution, we navigate to the Proxmox Web interface. Accessing the Shell interface of our standalone Cluster node, we encounter a system prompt like the one below.

Linux midgard 6.5.11-7-pve #1 SMP PREEMPT_DYNAMIC PMX 6.5.11-7 (2023-12-05T09:44Z) x86_64
...

Execute the following command to download the image:

wget https://download.opensuse.org/tumbleweed/appliances/openSUSE-MicroOS.x86_64-ContainerHost-kvm-and-xen.qcow2

This command fetches the desired image, which includes support for the qemu guest agent.

Creating and Configuring the Initial VM for MicroOS

Following the guidance provided in the Proxmox documentation, I executed the command below to create a new VM with specific configurations:

qm create 9001 --memory 2048 --net0 virtio,bridge=vmbr1,tag=10 --scsihw virtio-scsi-pci

Importing the MicroOS Image to Local-LVM Storage

To make use of the downloaded openSUSE MicroOS disk image, it needs to be imported into the local-lvm storage and attached as a SCSI drive. The following command accomplishes this task:

qm set 9001 --scsi0 local-lvm:0,import-from=/root/openSUSE-MicroOS.x86_64-ContainerHost-kvm-and-xen.qcow2

A warning is issued regarding the potentially large size of the disk.

Customizing the Template

As the default Proxmox setup utilizes cloud-init for template customization, adjustments were made to accommodate Ignition instead.

Set Display device

It is possible to use default display (vga) hors to use qxl (spice). I choosed qxl.

qm set 9001 --vga qxl

Activating qemu-guest-agent

To facilitate interaction between the host and guest machine, the qemu-guest-agent package needed activation within the VM template:

qm set 9001 --agent 1

Adding a CD-ROM Device

To load Ignition settings from ignition.iso, a cdrom device was added to the VM template:

qm set 9001 --ide2 none,media=cdrom

Setting Boot Order to scsi0

The boot order was configured to prioritize scsi0 to ensure the VM boots directly from it:

qm set 9001 --boot order=scsi0

Finalizing the openSUSE MicroOS VM Template

To transform the VM into a template for future use, the VM was named and then converted using the following commands:

qm set 9001 --name template-opensuse-MicroOS-202403
qm template 9001

Validating the VM Template

First Boot Setting with Ignition

This section outlines the process of configuring the first boot settings for the VM using Ignition. Ignition is a tool used to configure the initial settings of a machine, such as users, passwords, and network configuration, in an automated and reproducible manner. Follow these steps to create and apply the Ignition configuration:

1. Prepare the Ignition Configuration Template

Start by creating an Ignition configuration template file. This file will contain the initial settings you want to apply to the VM upon first boot. Here's how to create the template file:

mkdir -p iso/ignition
touch config.tpl

Edit the config.tpl file to define the desired configuration settings using JSON format. Include details such as user accounts, passwords, SSH keys, and any other system configurations required for your environment.

{
  "ignition": {
    "version": "3.1.0"
  },
  "passwd": {
    "users": [
      {
        "name": "root",
        "passwordHash": "<password_hash>",
        "sshAuthorizedKeys": [
          "<ssh_public_key>"
        ]
      }
    ]
  },
  "storage": {
    "files": [{
      "filesystem": "root",
      "path": "/etc/hostname",
      "mode": 420,
      "overwrite": true,
      "contents": {
        "source": "data:,HOSTNAME_TO_REPLACE"
      }
    }]
  }
}

Replace <password_hash> with the hashed password for the root user and <ssh_public_key> with the SSH public key you want to authorize for remote access. Additionally, replace HOSTNAME_TO_REPLACE with the desired hostname for the VM.

2. Generate the Ignition Configuration File

Once you've defined the configuration settings in the template file, use sed to replace placeholders in the template with actual values and generate the Ignition configuration file (config.ign).

sed 's/HOSTNAME_TO_REPLACE/<hostname_of_vm>/' config.tpl > iso/ignition/config.ign

Replace <hostname_of_vm> with the hostname you want to assign to the VM.

3. Create the Ignition ISO

Next, create an ISO image containing the Ignition configuration file (config.ign). Use the mkisofs command to generate the ISO image.

mkisofs -o ignition.iso -V ignition iso

This command creates an ISO image named ignition.iso in the iso directory.

4. Apply the Ignition Configuration to the VM

Now that you have the Ignition ISO image, you can apply the configuration to the VM. Follow these steps:

Copy the ignition.iso file to the directory used to store ISO images in Proxmox (/var/lib/vz/template/iso/).
```
cp ignition.iso /var/lib/vz/template/iso/
```
Create a VM from the template.
```
qm clone 9001 108 --name test-vm-auto
```
Set the CD-ROM drive of the VM to boot from the ignition.iso file.
```
qm set <id_of_vm> --ide2 local:iso/ignition.iso,media=cdrom
```
Replace <id_of_vm> with the ID of the VM.

5. Start the VM

Start the VM to initiate the first boot process. Ignition will automatically apply the configuration settings defined in the config.ign file during the boot process.

qm start <id_of_vm>

Replace <id_of_vm> with the ID of the VM.

After completing these steps, the VM will boot with the specified configuration settings applied, allowing for automated and consistent provisioning of new VM instances.

Upon successful boot, the VM was accessible via SSH using the configured Public Key.

Using username "root".
Authenticating with public key "imported-openssh-key"
Last login: Mon Feb  5 14:45:43 UTC 2024 from 192.168.3.10 on ssh

test-vm-auto:~ # cat /etc/os-release
NAME="openSUSE MicroOS"
# VERSION="20240228"
ID="opensuse-microos"
ID_LIKE="suse opensuse opensuse-tumbleweed"
VERSION_ID="20240228"
PRETTY_NAME="openSUSE MicroOS"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:opensuse:microos:20240228"
BUG_REPORT_URL="https://bugzilla.opensuse.org"
SUPPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://www.opensuse.org/"
DOCUMENTATION_URL="https://en.opensuse.org/Portal:MicroOS"
LOGO="distributor-logo-MicroOS"
test-vm-auto:~ #

Conclusion

Congratulations on reaching the end of this guide! By following the steps outlined here, you've successfully created your first VM template with Proxmox, paving the way for efficient VM deployment and management. Whether you're setting up a small lab environment or preparing for larger-scale deployments, understanding how to create and customize VM templates is a valuable skill.

As you've seen, Proxmox offers powerful tools and features for creating and managing VM templates, including support for Ignition configuration and automated provisioning. While this guide focused on using Ignition for initial VM configuration, Proxmox also supports other configuration methods such as Cloud-init, providing flexibility to meet different requirements.

I'd like to note that this article has been improved with the assistance of ChatGPT, an AI language model developed by OpenAI. By leveraging ChatGPT's capabilities, the content was refined to ensure clarity, accuracy, and reader engagement. This collaboration demonstrates the potential of AI-driven tools to enhance the quality and effectiveness of technical documentation.

Thank you for taking the time to explore this guide. I hope you found it informative and valuable for your virtualization projects. If you have any questions or feedback, feel free to reach out. Happy virtualizing!

All files referenced in this article are available on my GitHub Account.

Preparing Podman environment with Vagrant and ansible_local provisioner

sdeseille — Sat, 08 Jul 2023 22:16:45 +0000

A year ago, I wrote this article Preparing Docker environment with Vagrant and ansible_local provisioner

Recently, I discovered Podman, so I decided to git it a try and that's what my article is about. You will see lots of similarities with my previous article. It is volontary. I practice laziness. :p

Prerequisites

I mentioned that I practice laziness, but don't worry. I won't simply copy and paste the original text. It is more a capitalization of the knowledge I've acquired.

Here's my toolbox with the specified versions used.

Microsoft Windows: 10 Version 22H2
Oracle VirtualBox: 7.0.8 r156879 url
Vagrant: 2.3.7 url
Vagrant Box [ubuntu/jammy64]: 20230616 url

Vagrantfile initialisation

Last time, we used Ubuntu Focal64. A new stable version of Ubuntu is available now. We choose this new version named Ubuntu Jammy64.

vagrant init ubuntu/jammy64

PS D:\vagrant_projects\ubuntu_env> vagrant init ubuntu/jammy64
A `Vagrantfile` has been placed in this directory. You are now
ready to `vagrant up` your first virtual environment! Please read
the comments in the Vagrantfile as well as documentation on
`vagrantup.com` for more information on using Vagrant.
PS D:\vagrant_projects\ubuntu_env>

Content of the Vagrantfile

PS D:\vagrant_projects\ubuntu_env> type .\Vagrantfile

# -*- mode: ruby -*-
# vi: set ft=ruby :

# All Vagrant configuration is done below. The "2" in Vagrant.configure
# configures the configuration version (we support older styles for
# backwards compatibility). Please don't change it unless you know what
# you're doing.
Vagrant.configure("2") do |config|
  # The most common configuration options are documented and commented below.
  # For a complete reference, please see the online documentation at
  # https://docs.vagrantup.com.

  # Every Vagrant development environment requires a box. You can search for
  # boxes at https://vagrantcloud.com/search.
  config.vm.box = "ubuntu/jammy64"

  # Disable automatic box update checking. If you disable this, then
  # boxes will only be checked for updates when the user runs
  # `vagrant box outdated`. This is not recommended.
  # config.vm.box_check_update = false

  # Create a forwarded port mapping which allows access to a specific port
  # within the machine from a port on the host machine. In the example below,
  # accessing "localhost:8080" will access port 80 on the guest machine.
  # NOTE: This will enable public access to the opened port
  # config.vm.network "forwarded_port", guest: 80, host: 8080

  # Create a forwarded port mapping which allows access to a specific port
  # within the machine from a port on the host machine and only allow access
  # via 127.0.0.1 to disable public access
  # config.vm.network "forwarded_port", guest: 80, host: 8080, host_ip: "127.0.0.1"

  # Create a private network, which allows host-only access to the machine
  # using a specific IP.
  # config.vm.network "private_network", ip: "192.168.33.10"

  # Create a public network, which generally matched to bridged network.
  # Bridged networks make the machine appear as another physical device on
  # your network.
  # config.vm.network "public_network"

  # Share an additional folder to the guest VM. The first argument is
  # the path on the host to the actual folder. The second argument is
  # the path on the guest to mount the folder. And the optional third
  # argument is a set of non-required options.
  # config.vm.synced_folder "../data", "/vagrant_data"

  # Provider-specific configuration so you can fine-tune various
  # backing providers for Vagrant. These expose provider-specific options.
  # Example for VirtualBox:
  #
  # config.vm.provider "virtualbox" do |vb|
  #   # Display the VirtualBox GUI when booting the machine
  #   vb.gui = true
  #
  #   # Customize the amount of memory on the VM:
  #   vb.memory = "1024"
  # end
  #
  # View the documentation for the provider you are using for more
  # information on available options.

  # Enable provisioning with a shell script. Additional provisioners such as
  # Ansible, Chef, Docker, Puppet and Salt are also available. Please see the
  # documentation for more information about their specific syntax and use.
  # config.vm.provision "shell", inline: <<-SHELL
  #   apt-get update
  #   apt-get install -y apache2
  # SHELL
end

Provisioner ansible_local

We don't change what works well. My Desktop environment is still Microsoft Windows. Obviously, we'll be using [ansible_local]. As a reminder, when this provisioner is selected, vagrant installs Ansible on the guest system and automaticaly runs your playbook on it.

See the Official documentation.

The minimal configuration for ansible_local is to defined a [playbook.yml] file that is read from the current project directory.

  # Run Ansible from the Vagrant VM
  config.vm.provision "ansible_local" do |ansible|
    ansible.playbook = "playbook.yml"
  end

Last time, I used Python 2.7 and had some warnings about deprecation of this version. Let see, if I can use Python 3 now. After, some tries and fail, you can find a working version of vagrant provisioner settings below.

  config.vm.provision "ansible_local" do |ansible|
    ansible.playbook = "playbook.yml"
    ansible.galaxy_role_file = "requirements.yml"
    ansible.galaxy_command = "ansible-galaxy collection install -r %{role_file}"
  end

Minimal validation playbook

As I initialize the environment, my playbook content is very short to start.

---
- hosts: all
  become: true
  vars:
    default_container_name: podman
    default_container_image: alpine
    default_container_command: sleep 1
  tasks:
    - name: Get uptime information
      ansible.builtin.shell: /usr/bin/uptime
      register: result

    - name: Print return information from the previous task
      ansible.builtin.debug:
        var: result

First execution of playbook

Below, you can see the result.

PS D:\vagrant_projects\ubuntu_env> vagrant status
Current machine states:

default                   not created (virtualbox)

The environment has not yet been created. Run `vagrant up` to
create the environment. If a machine is not created, only the
default provider will be shown. So if a provider is not listed,
then the machine is not created for that environment.
PS D:\vagrant_projects\ubuntu_env> vagrant up
Bringing machine 'default' up with 'virtualbox' provider...
==> default: Importing base box 'ubuntu/jammy64'...
==> default: Matching MAC address for NAT networking...
==> default: Checking if box 'ubuntu/jammy64' version '20230616.0.0' is up to date...
==> default: Setting the name of the VM: ubuntu_env_default_1688317157246_80318
==> default: Clearing any previously set network interfaces...
==> default: Preparing network interfaces based on configuration...
    default: Adapter 1: nat
==> default: Forwarding ports...
    default: 22 (guest) => 2222 (host) (adapter 1)
==> default: Running 'pre-boot' VM customizations...
==> default: Booting VM...
==> default: Waiting for machine to boot. This may take a few minutes...
    default: SSH address: 127.0.0.1:2222
    default: SSH username: vagrant
    default: SSH auth method: private key
    default: Warning: Connection reset. Retrying...
    default: Warning: Connection aborted. Retrying...
    default: Warning: Connection reset. Retrying...
    default:
    default: Vagrant insecure key detected. Vagrant will automatically replace
    default: this with a newly generated keypair for better security.
    default:
    default: Inserting generated public key within guest...
    default: Removing insecure key from the guest if it's present...
    default: Key inserted! Disconnecting and reconnecting using new SSH key...
==> default: Machine booted and ready!
==> default: Checking for guest additions in VM...
    default: The guest additions on this VM do not match the installed version of
    default: VirtualBox! In most cases this is fine, but in rare cases it can
    default: prevent things such as shared folders from working properly. If you see
    default: shared folder errors, please make sure the guest additions within the
    default: virtual machine match the version of VirtualBox you have installed on
    default: your host and reload your VM.
    default:
    default: Guest Additions Version: 6.0.0 r127566
    default: VirtualBox Version: 7.0
==> default: Mounting shared folders...
    default: /vagrant => D:/vagrant_projects/ubuntu_env
==> default: Running provisioner: ansible_local...
    default: Installing Ansible...
    default: Running ansible-galaxy...
Starting galaxy collection install process
Process install dependency map
Starting collection install process
Downloading https://galaxy.ansible.com/download/containers-podman-1.10.2.tar.gz to /home/vagrant/.ansible/tmp/ansible-local-3302p92f9kmj/tmp410gn7sq/containers-podman-1.10.2-l85_wdjl
Installing 'containers.podman:1.10.2' to '/home/vagrant/.ansible/collections/ansible_collections/containers/podman'
containers.podman:1.10.2 was installed successfully
    default: Running ansible-playbook...

PLAY [all] *********************************************************************

TASK [Gathering Facts] *********************************************************
ok: [default]

TASK [Get uptime information] **************************************************
changed: [default]

TASK [Print return information from the previous task] *************************
ok: [default] => {
    "result": {
        "changed": true,
        "cmd": "/usr/bin/uptime",
        "delta": "0:00:00.095920",
        "end": "2023-07-02 17:03:12.577458",
        "failed": false,
        "msg": "",
        "rc": 0,
        "start": "2023-07-02 17:03:12.481538",
        "stderr": "",
        "stderr_lines": [],
        "stdout": " 17:03:12 up 3 min,  0 users,  load average: 1.27, 0.81, 0.35",
        "stdout_lines": [
            " 17:03:12 up 3 min,  0 users,  load average: 1.27, 0.81, 0.35"
        ]
    }
}

PLAY RECAP *********************************************************************
default                    : ok=3    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

PS D:\vagrant_projects\ubuntu_env>

You can observe that I installed ansible collection containers.podman during the process of provisioning. It is done with the file [requirements.yml].

---
collections:
  - name: containers.podman

playbook for Podman

I used the previous docker example and adapted it to work with podman. The modified ansible playbook is still short.

---
- hosts: all
  become: true
  vars:
    default_container_name: podman
    default_container_image: "hello-world"
    default_container_command: sleep 1
  tasks:
    - name: Installing podman
      ansible.builtin.package:
        name: "podman"
        state: present

    - name: Pull an image
      containers.podman.podman_image:
        name: "{{ default_container_image }}"

    - name: Run container
      containers.podman.podman_container:
        name: "{{default_container_name}}"
        image: "{{ default_container_image }}"
        state: started
      register: container_result

    - name: Print return information from the previous task
      ansible.builtin.debug:
        var: container_result

As you can see, I pull up the well-known docker image [hello-world]. After that, I start a container and finally print the content of the registered variable [container_result]. In this variable, I am able to retrieve the container dict return by running [containers.podman.podman_container] module. The Official documentation explains this very well.

Issues when trying to vagrant up

I encountered several issues when executing the command:

vagrant up

PS D:\vagrant_projects\ubuntu_env> vagrant up
Bringing machine 'default' up with 'virtualbox' provider...
==> default: Importing base box 'ubuntu/jammy64'...
==> default: Matching MAC address for NAT networking...
==> default: Checking if box 'ubuntu/jammy64' version '20230616.0.0' is up to date...
==> default: Setting the name of the VM: ubuntu_env_default_1688834174097_92269
==> default: Clearing any previously set network interfaces...
==> default: Preparing network interfaces based on configuration...
    default: Adapter 1: nat
==> default: Forwarding ports...
    default: 22 (guest) => 2222 (host) (adapter 1)
==> default: Running 'pre-boot' VM customizations...
==> default: Booting VM...
==> default: Waiting for machine to boot. This may take a few minutes...
    default: SSH address: 127.0.0.1:2222
    default: SSH username: vagrant
    default: SSH auth method: private key
Timed out while waiting for the machine to boot. This means that
Vagrant was unable to communicate with the guest machine within
the configured ("config.vm.boot_timeout" value) time period.

If you look above, you should be able to see the error(s) that
Vagrant had when attempting to connect to the machine. These errors
are usually good hints as to what may be wrong.

If you're using a custom box, make sure that networking is properly
working and you're able to connect to the machine. It is a common
problem that networking isn't setup properly in these boxes.
Verify that authentication configurations are also setup properly,
as well.

If the box appears to be booting properly, you may want to increase
the timeout ("config.vm.boot_timeout") value.

I first tried to increase the value associated to [config.vm.boot_timeout] attribute. I set it to [600] without success.

The machine worked but the network was not configured and no playbook ran.

PS D:\vagrant_projects\ubuntu_env> vagrant status
Current machine states:

default                   running (virtualbox)

The VM is running. To stop this VM, you can run `vagrant halt` to
shut it down forcefully, or you can run `vagrant suspend` to simply
suspend the virtual machine. In either case, to restart it again,
simply run `vagrant up`.

If I tried to connet in ssh mode, nothing happened.

PS D:\vagrant_projects\ubuntu_env> vagrant ssh

PS D:\vagrant_projects\ubuntu_env> $?
False

After examining my laptop settings and searching on the web, I began to suspect something linked with Windows firewall rules.
I exmined my settings and discovered that the network profile for my ethernet interface was set to [Public]. I remembered that firewall blocked traffic on this network profile. Since my laptop is at home, I changed the network profile to [private]. I destroyed the box that wasn't working.

PS D:\vagrant_projects\ubuntu_env> vagrant destroy
    default: Are you sure you want to destroy the 'default' VM? [y/N] y
==> default: Forcing shutdown of VM...
==> default: Destroying VM and associated drives...


PS D:\vagrant_projects\ubuntu_env> vagrant status
Current machine states:

default                   not created (virtualbox)

The environment has not yet been created. Run `vagrant up` to
create the environment. If a machine is not created, only the
default provider will be shown. So if a provider is not listed,
then the machine is not created for that environment.

After correcting the network type of my ethernet card (from public to private), provisionning worked as expected.

PS D:\vagrant_projects\ubuntu_env> vagrant up
Bringing machine 'default' up with 'virtualbox' provider...
==> default: Importing base box 'ubuntu/jammy64'...
==> default: Matching MAC address for NAT networking...
==> default: Checking if box 'ubuntu/jammy64' version '20230616.0.0' is up to date...
==> default: Setting the name of the VM: ubuntu_env_default_1688822696174_94691
==> default: Clearing any previously set network interfaces...
==> default: Preparing network interfaces based on configuration...
    default: Adapter 1: nat
==> default: Forwarding ports...
    default: 22 (guest) => 2222 (host) (adapter 1)
==> default: Running 'pre-boot' VM customizations...
==> default: Booting VM...
==> default: Waiting for machine to boot. This may take a few minutes...
    default: SSH address: 127.0.0.1:2222
    default: SSH username: vagrant
    default: SSH auth method: private key
    default: Warning: Connection reset. Retrying...
    default: Warning: Connection aborted. Retrying...
    default: Warning: Connection reset. Retrying...
    default:
    default: Vagrant insecure key detected. Vagrant will automatically replace
    default: this with a newly generated keypair for better security.
    default:
    default: Inserting generated public key within guest...
    default: Removing insecure key from the guest if it's present...
    default: Key inserted! Disconnecting and reconnecting using new SSH key...
==> default: Machine booted and ready!
==> default: Checking for guest additions in VM...
    default: The guest additions on this VM do not match the installed version of
    default: VirtualBox! In most cases this is fine, but in rare cases it can
    default: prevent things such as shared folders from working properly. If you see
    default: shared folder errors, please make sure the guest additions within the
    default: virtual machine match the version of VirtualBox you have installed on
    default: your host and reload your VM.
    default:
    default: Guest Additions Version: 6.0.0 r127566
    default: VirtualBox Version: 7.0
==> default: Mounting shared folders...
    default: /vagrant => D:/vagrant_projects/ubuntu_env
==> default: Running provisioner: ansible_local...
    default: Installing Ansible...
    default: Running ansible-galaxy...
Starting galaxy collection install process
Process install dependency map
Starting collection install process
Downloading https://galaxy.ansible.com/download/containers-podman-1.10.2.tar.gz to /home/vagrant/.ansible/tmp/ansible-local-3338y_lay1dt/tmpu3elz2h1/containers-podman-1.10.2-r9azj1n_
Installing 'containers.podman:1.10.2' to '/home/vagrant/.ansible/collections/ansible_collections/containers/podman'
containers.podman:1.10.2 was installed successfully
    default: Running ansible-playbook...

PLAY [all] *********************************************************************

TASK [Gathering Facts] *********************************************************
ok: [default]

TASK [Installing podman] *******************************************************
changed: [default]

TASK [Pull an image] ***********************************************************
changed: [default]

TASK [Run container] ***********************************************************
changed: [default]

TASK [Print return information from the previous task] *************************
ok: [default] => {
    "container_result": {
        "actions": [
            "started podman"
        ],
        "changed": true,
        "container": {
            "AppArmorProfile": "containers-default-0.44.4",
            "Args": [
                "/hello"
            ],
            "BoundingCaps": [
                "CAP_CHOWN",
                "CAP_DAC_OVERRIDE",
                "CAP_FOWNER",
                "CAP_FSETID",
                "CAP_KILL",
                "CAP_NET_BIND_SERVICE",
                "CAP_SETFCAP",
                "CAP_SETGID",
                "CAP_SETPCAP",
                "CAP_SETUID",
                "CAP_SYS_CHROOT"
            ],
            "Config": {
                "Annotations": {
                    "io.container.manager": "libpod",
                    "io.kubernetes.cri-o.Created": "2023-07-08T13:28:42.432362679Z",
                    "io.kubernetes.cri-o.TTY": "false",
                    "io.podman.annotations.autoremove": "FALSE",
                    "io.podman.annotations.init": "FALSE",
                    "io.podman.annotations.privileged": "FALSE",
                    "io.podman.annotations.publish-all": "FALSE",
                    "org.opencontainers.image.stopSignal": "15"
                },
                "AttachStderr": false,
                "AttachStdin": false,
                "AttachStdout": false,
                "Cmd": [
                    "/hello"
                ],
                "CreateCommand": [
                    "podman",
                    "container",
                    "run",
                    "--name",
                    "podman",
                    "--detach=True",
                    "hello-world"
                ],
                "Domainname": "",
                "Entrypoint": "",
                "Env": [
                    "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                    "TERM=xterm",
                    "container=podman",
                    "HOSTNAME=90b5486779a6"
                ],
                "Hostname": "90b5486779a6",
                "Image": "docker.io/library/hello-world:latest",
                "Labels": null,
                "OnBuild": null,
                "OpenStdin": false,
                "StdinOnce": false,
                "StopSignal": 15,
                "StopTimeout": 10,
                "Timeout": 0,
                "Tty": false,
                "Umask": "0022",
                "User": "",
                "Volumes": null,
                "WorkingDir": "/"
            },
            "ConmonPidFile": "/run/containers/storage/overlay-containers/90b5486779a6a9c5780a76a985da10da2c0179acb8410ef2ce77f8b806cf978a/userdata/conmon.pid",
            "Created": "2023-07-08T13:28:42.432362679Z",
            "Dependencies": [],
            "Driver": "overlay",
            "EffectiveCaps": [
                "CAP_CHOWN",
                "CAP_DAC_OVERRIDE",
                "CAP_FOWNER",
                "CAP_FSETID",
                "CAP_KILL",
                "CAP_NET_BIND_SERVICE",
                "CAP_SETFCAP",
                "CAP_SETGID",
                "CAP_SETPCAP",
                "CAP_SETUID",
                "CAP_SYS_CHROOT"
            ],
            "ExecIDs": [],
            "ExitCommand": [
                "/usr/bin/podman",
                "--root",
                "/var/lib/containers/storage",
                "--runroot",
                "/run/containers/storage",
                "--log-level",
                "warning",
                "--cgroup-manager",
                "systemd",
                "--tmpdir",
                "/run/libpod",
                "--runtime",
                "crun",
                "--events-backend",
                "journald",
                "container",
                "cleanup",
                "90b5486779a6a9c5780a76a985da10da2c0179acb8410ef2ce77f8b806cf978a"
            ],
            "GraphDriver": {
                "Data": {
                    "LowerDir": "/var/lib/containers/storage/overlay/01bb4fce3eb1b56b05adf99504dafd31907a5aadac736e36b27595c8b92f07f1/diff",
                    "UpperDir": "/var/lib/containers/storage/overlay/15a506e2bcf599cf6450ec63392af4334501948cddf9f1e5a89d6db5c46826f5/diff",
                    "WorkDir": "/var/lib/containers/storage/overlay/15a506e2bcf599cf6450ec63392af4334501948cddf9f1e5a89d6db5c46826f5/work"
                },
                "Name": "overlay"
            },
            "HostConfig": {
                "AutoRemove": false,
                "Binds": [],
                "BlkioDeviceReadBps": null,
                "BlkioDeviceReadIOps": null,
                "BlkioDeviceWriteBps": null,
                "BlkioDeviceWriteIOps": null,
                "BlkioWeight": 0,
                "BlkioWeightDevice": null,
                "CapAdd": [],
                "CapDrop": [
                    "CAP_AUDIT_WRITE",
                    "CAP_MKNOD",
                    "CAP_NET_RAW"
                ],
                "Cgroup": "",
                "CgroupConf": null,
                "CgroupManager": "systemd",
                "CgroupMode": "private",
                "CgroupParent": "",
                "Cgroups": "default",
                "ConsoleSize": [
                    0,
                    0
                ],
                "ContainerIDFile": "",
                "CpuCount": 0,
                "CpuPercent": 0,
                "CpuPeriod": 0,
                "CpuQuota": 0,
                "CpuRealtimePeriod": 0,
                "CpuRealtimeRuntime": 0,
                "CpuShares": 0,
                "CpusetCpus": "",
                "CpusetMems": "",
                "Devices": [],
                "DiskQuota": 0,
                "Dns": [],
                "DnsOptions": [],
                "DnsSearch": [],
                "ExtraHosts": [],
                "GroupAdd": [],
                "IOMaximumBandwidth": 0,
                "IOMaximumIOps": 0,
                "IpcMode": "private",
                "Isolation": "",
                "KernelMemory": 0,
                "Links": null,
                "LogConfig": {
                    "Config": null,
                    "Path": "",
                    "Size": "0B",
                    "Tag": "",
                    "Type": "journald"
                },
                "Memory": 0,
                "MemoryReservation": 0,
                "MemorySwap": 0,
                "MemorySwappiness": 0,
                "NanoCpus": 0,
                "NetworkMode": "bridge",
                "OomKillDisable": false,
                "OomScoreAdj": 0,
                "PidMode": "private",
                "PidsLimit": 2048,
                "PortBindings": {},
                "Privileged": false,
                "PublishAllPorts": false,
                "ReadonlyRootfs": false,
                "RestartPolicy": {
                    "MaximumRetryCount": 0,
                    "Name": ""
                },
                "Runtime": "oci",
                "SecurityOpt": [],
                "ShmSize": 65536000,
                "Tmpfs": {},
                "UTSMode": "private",
                "Ulimits": [
                    {
                        "Hard": 1048576,
                        "Name": "RLIMIT_NOFILE",
                        "Soft": 1048576
                    },
                    {
                        "Hard": 4194304,
                        "Name": "RLIMIT_NPROC",
                        "Soft": 4194304
                    }
                ],
                "UsernsMode": "",
                "VolumeDriver": "",
                "VolumesFrom": null
            },
            "HostnamePath": "/run/containers/storage/overlay-containers/90b5486779a6a9c5780a76a985da10da2c0179acb8410ef2ce77f8b806cf978a/userdata/hostname",
            "HostsPath": "/run/containers/storage/overlay-containers/90b5486779a6a9c5780a76a985da10da2c0179acb8410ef2ce77f8b806cf978a/userdata/hosts",
            "Id": "90b5486779a6a9c5780a76a985da10da2c0179acb8410ef2ce77f8b806cf978a",
            "Image": "9c7a54a9a43cca047013b82af109fe963fde787f63f9e016fdc3384500c2823d",
            "ImageName": "docker.io/library/hello-world:latest",
            "IsInfra": false,
            "MountLabel": "",
            "Mounts": [],
            "Name": "podman",
            "Namespace": "",
            "NetworkSettings": {
                "Bridge": "",
                "EndpointID": "",
                "Gateway": "",
                "GlobalIPv6Address": "",
                "GlobalIPv6PrefixLen": 0,
                "HairpinMode": false,
                "IPAddress": "",
                "IPPrefixLen": 0,
                "IPv6Gateway": "",
                "LinkLocalIPv6Address": "",
                "LinkLocalIPv6PrefixLen": 0,
                "MacAddress": "",
                "Networks": {
                    "podman": {
                        "DriverOpts": null,
                        "EndpointID": "",
                        "Gateway": "",
                        "GlobalIPv6Address": "",
                        "GlobalIPv6PrefixLen": 0,
                        "IPAMConfig": null,
                        "IPAddress": "",
                        "IPPrefixLen": 0,
                        "IPv6Gateway": "",
                        "Links": null,
                        "MacAddress": "",
                        "NetworkID": "podman"
                    }
                },
                "Ports": {},
                "SandboxID": "",
                "SandboxKey": ""
            },
            "OCIConfigPath": "/var/lib/containers/storage/overlay-containers/90b5486779a6a9c5780a76a985da10da2c0179acb8410ef2ce77f8b806cf978a/userdata/config.json",
            "OCIRuntime": "crun",
            "Path": "/hello",
            "PidFile": "/run/containers/storage/overlay-containers/90b5486779a6a9c5780a76a985da10da2c0179acb8410ef2ce77f8b806cf978a/userdata/pidfile",
            "Pod": "",
            "ProcessLabel": "",
            "ResolvConfPath": "/run/containers/storage/overlay-containers/90b5486779a6a9c5780a76a985da10da2c0179acb8410ef2ce77f8b806cf978a/userdata/resolv.conf",
            "RestartCount": 0,
            "Rootfs": "",
            "State": {
                "Dead": false,
                "Error": "",
                "ExitCode": 0,
                "FinishedAt": "2023-07-08T13:28:43.979040512Z",
                "Healthcheck": {
                    "FailingStreak": 0,
                    "Log": null,
                    "Status": ""
                },
                "OOMKilled": false,
                "OciVersion": "1.0.2-dev",
                "Paused": false,
                "Pid": 0,
                "Restarting": false,
                "Running": false,
                "StartedAt": "2023-07-08T13:28:43.975121172Z",
                "Status": "exited"
            },
            "StaticDir": "/var/lib/containers/storage/overlay-containers/90b5486779a6a9c5780a76a985da10da2c0179acb8410ef2ce77f8b806cf978a/userdata"
        },
        "failed": false,
        "podman_actions": [
            "podman run --name podman --detach=True hello-world"
        ],
        "podman_systemd": {
            "container-podman": "# container-podman.service\n# autogenerated by Podman 3.4.4\n# Sat Jul  8 13:28:45 UTC 2023\n\n[Unit]\nDescription=Podman container-podman.service\nDocumentation=man:podman-generate-systemd(1)\nWants=network-online.target\nAfter=network-online.target\nRequiresMountsFor=/run/containers/storage\n\n[Service]\nEnvironment=PODMAN_SYSTEMD_UNIT=%n\nRestart=on-failure\nTimeoutStopSec=70\nExecStart=/usr/bin/podman start podman\nExecStop=/usr/bin/podman stop -t 10 podman\nExecStopPost=/usr/bin/podman stop -t 10 podman\nPIDFile=/run/containers/storage/overlay-containers/90b5486779a6a9c5780a76a985da10da2c0179acb8410ef2ce77f8b806cf978a/userdata/conmon.pid\nType=forking\n\n[Install]\nWantedBy=default.target\n"
        },
        "stderr": "",
        "stderr_lines": [],
        "stdout": "90b5486779a6a9c5780a76a985da10da2c0179acb8410ef2ce77f8b806cf978a\n",
        "stdout_lines": [
            "90b5486779a6a9c5780a76a985da10da2c0179acb8410ef2ce77f8b806cf978a"
        ]
    }
}

PLAY RECAP *********************************************************************
default                    : ok=5    changed=3    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

PS D:\vagrant_projects\ubuntu_env>

But... it's still not enough

I systematically check that my hypotheses are correct and reproducible. I try again to destroy and up my box after that. The symptom reappears. I spend more time searching and trying to understand what's wrong. In fact, once I've destroyed the box, if I up it immediately afterwards, the problem occurs. If I wait a bit before Up it, everything's fine. I found an old vagrant issue in github mentioning my symptom and someone suggested the following command to solve this problem.

netsh winsock reset

The command must be executed in cmd or powershell as administrator.

I found others articles about the winsock issue in Windows 10.

And indeed, after running the command, I can up my boxe after destroying it. So if you are patient enough, you wait a little while before recreating the boxe after destroying it, or you use the command right after destroying the box.

connecting to provisionned boxe

You use following command to connect to vagrant box.

vagrant ssh

PS D:\vagrant_projects\ubuntu_env> vagrant ssh
Welcome to Ubuntu 22.04.2 LTS (GNU/Linux 5.15.0-75-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Sat Jul  8 19:59:04 UTC 2023

  System load:  0.3203125         Processes:                    105
  Usage of /:   5.7% of 38.70GB   Users logged in:              0
  Memory usage: 16%               IPv4 address for cni-podman0: 10.88.0.1
  Swap usage:   0%                IPv4 address for enp0s3:      10.0.2.15


Expanded Security Maintenance for Applications is not enabled.

20 updates can be applied immediately.
16 of these updates are standard security updates.
To see these additional updates run: apt list --upgradable

1 additional security update can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm


vagrant@ubuntu-jammy:~$

Executing podman with sudo

You can use following command to run the hello-world container example with sudo.

sudo podman run hello-world

vagrant@ubuntu-jammy:~$ sudo podman run hello-world

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (amd64)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/

For more examples and ideas, visit:
 https://docs.docker.com/get-started/

Executing podman as user

You can also use following command to run the hello-world container example as unprivileged user.

podman run hello-world

vagrant@ubuntu-jammy:~$ id
uid=1000(vagrant) gid=1000(vagrant) groups=1000(vagrant)

vagrant@ubuntu-jammy:~$ podman run hello-world
Resolved "hello-world" as an alias (/etc/containers/registries.conf.d/shortnames.conf)
Trying to pull docker.io/library/hello-world:latest...
Getting image source signatures
Copying blob 719385e32844 done
Copying config 9c7a54a9a4 done
Writing manifest to image destination
Storing signatures

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (amd64)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/

For more examples and ideas, visit:
 https://docs.docker.com/get-started/

Conclusion

Replacing docker with podman is interesting. The fact, that podman doesn't require a daemon to run makes it easier to use with unprivileged user profiles. The tool's syntax makes it easy to make the transition from docker. In fact, it's often enough to replace docker with podman in the command line, retaining all the arguments inherited from docker, and it works.

All files are available from my GitHub Account Here.
I'll be working in more depth with podman and will certainly write an article on using podman in rootless mode.

Preparing Docker environment with Vagrant and ansible_local provisioner

sdeseille — Tue, 09 Aug 2022 10:01:19 +0000

I use Vagrant to build and experiment with my work. It allows me to try and fail often and quickly to find the best architecture for my projects. I learned how to build a minimal kubernetes cluster with it. I defined the best path to migrate an openldap infrastructure for 200K users.

Vagrant has been in my toolbox since 2014 or so. It has been a long time and I am still happy to use it.

Recently, I have been working more with Ansible for the need of a project. Previously, I was one of those who wrote shell scripts to automate the installation steps. But hey, I can do better by adding Ansible in my tool belt.

The main purpose of this article is to share how i prepared a docker environment with Vagrant and ansible_local provisioner. When this environment is ready, i can work on an opensource project i want to contribute to.

Prerequisites

Did I mention that we'll use Vagrant ? Certainly. So you will need a hypervisor. I use a Microsoft operating system, so I need a hypervisor. Currently I am using Oracle's VirtualBox.
The guest system I have installed is Ubuntu Focal64.
As i said, I went through several iterations in order to get a solution that works. I ran into errors at various times when i tried to build the environment. What I found is that we need the followings tools with the specified version to have our environment.

Microsoft Windows: 10 Version 21H2
Oracle VirtualBox: 6.1.36 r152435 url
Vagrant: 2.2.19 url
Vagrant Box [ubuntu/focal64]: 20220804 url

Vagrantfile initialisation

Our Docker environment will be based on Ubuntu Focal64. We use following command to init Vagrant.

vagrant init ubuntu/focal64

PS D:\vagrant_projects\ubuntu_env> vagrant init ubuntu/focal64
A `Vagrantfile` has been placed in this directory. You are now
ready to `vagrant up` your first virtual environment! Please read
the comments in the Vagrantfile as well as documentation on
`vagrantup.com` for more information on using Vagrant.

Content of the Vagrantfile

PS D:\vagrant_projects\ubuntu_env> type .\Vagrantfile

# -*- mode: ruby -*-
# vi: set ft=ruby :

# All Vagrant configuration is done below. The "2" in Vagrant.configure
# configures the configuration version (we support older styles for
# backwards compatibility). Please don't change it unless you know what
# you're doing.
Vagrant.configure("2") do |config|
  # The most common configuration options are documented and commented below.
  # For a complete reference, please see the online documentation at
  # https://docs.vagrantup.com.

  # Every Vagrant development environment requires a box. You can search for
  # boxes at https://vagrantcloud.com/search.
  config.vm.box = "ubuntu/focal64"

  # Disable automatic box update checking. If you disable this, then
  # boxes will only be checked for updates when the user runs
  # `vagrant box outdated`. This is not recommended.
  # config.vm.box_check_update = false

  # Create a forwarded port mapping which allows access to a specific port
  # within the machine from a port on the host machine. In the example below,
  # accessing "localhost:8080" will access port 80 on the guest machine.
  # NOTE: This will enable public access to the opened port
  # config.vm.network "forwarded_port", guest: 80, host: 8080

  # Create a forwarded port mapping which allows access to a specific port
  # within the machine from a port on the host machine and only allow access
  # via 127.0.0.1 to disable public access
  # config.vm.network "forwarded_port", guest: 80, host: 8080, host_ip: "127.0.0.1"

  # Create a private network, which allows host-only access to the machine
  # using a specific IP.
  # config.vm.network "private_network", ip: "192.168.33.10"

  # Create a public network, which generally matched to bridged network.
  # Bridged networks make the machine appear as another physical device on
  # your network.
  # config.vm.network "public_network"

  # Share an additional folder to the guest VM. The first argument is
  # the path on the host to the actual folder. The second argument is
  # the path on the guest to mount the folder. And the optional third
  # argument is a set of non-required options.
  # config.vm.synced_folder "../data", "/vagrant_data"

  # Provider-specific configuration so you can fine-tune various
  # backing providers for Vagrant. These expose provider-specific options.
  # Example for VirtualBox:
  #
  # config.vm.provider "virtualbox" do |vb|
  #   # Display the VirtualBox GUI when booting the machine
  #   vb.gui = true
  #
  #   # Customize the amount of memory on the VM:
  #   vb.memory = "1024"
  # end
  #
  # View the documentation for the provider you are using for more
  # information on available options.

  # Enable provisioning with a shell script. Additional provisioners such as
  # Ansible, Chef, Docker, Puppet and Salt are also available. Please see the
  # documentation for more information about their specific syntax and use.
  # config.vm.provision "shell", inline: <<-SHELL
  #   apt-get update
  #   apt-get install -y apache2
  # SHELL
end

Provisioner ansible_local

I decided to use Ansible to set the environment. Vagrant offers two provisioners. The classical [ansible] which required the host system to be linux based or the other choice when it is not the case [ansible_local]. When you use this provisioner, Vagrant will automaticaly install Ansible on the guest system and run the playbooks directly on it.
See the Official documentation.

The minimal configuration for ansible_local is to defined a [playbook.yml] file that is read from the current project directory.

  # Run Ansible from the Vagrant VM
  config.vm.provision "ansible_local" do |ansible|
    ansible.playbook = "playbook.yml"
  end

After some iterations, I found that it is necessary to add some specifics options. They are needed to make the installation of pip with python 2.7. You should got following configuration.

  # Run Ansible from the Vagrant VM
  config.vm.provision "ansible_local" do |ansible|
    ansible.playbook = "playbook.yml"
    ansible.install_mode = "pip"
    ansible.pip_install_cmd = "curl https://bootstrap.pypa.io/pip/2.7/get-pip.py | sudo python"
  end

Playbook for Docker

I followed the current article from Digital Ocean in order to build the playbook. The article is well explained, thanks to authors Tony Tran and Erika Heidi.

The whole playbook worked well until the task [Pull default Docker image]. I had an error about the community.docker collection being messing. I made some additional research and studied the article from XLAB SteamPunk as well as the detailed documentation for Vagrant and Ansible. With all this information, I finally figured out how to define my Vagrantfile.

  config.vm.provision "ansible_local" do |ansible|
    ansible.playbook = "playbook.yml"
    ansible.install_mode = "pip"
    ansible.pip_install_cmd = "curl https://bootstrap.pypa.io/pip/2.7/get-pip.py | sudo python"
    ansible.galaxy_role_file = "requirements.yml"
    ansible.galaxy_command = "ansible-galaxy collection install -r %{role_file}"
  end

Working configuration

When everything is set up, you will be happy to get the following results with the command:

vagrant up

PS D:\vagrant_projects\vagrant-ansible-docker-env> vagrant up
Bringing machine 'default' up with 'virtualbox' provider...
==> default: Importing base box 'ubuntu/focal64'...
==> default: Matching MAC address for NAT networking...
==> default: Checking if box 'ubuntu/focal64' version '20220804.0.0' is up to date...
==> default: Setting the name of the VM: vagrant-ansible-docker-env_default_1659985304505_52969
==> default: Clearing any previously set network interfaces...
==> default: Preparing network interfaces based on configuration...
    default: Adapter 1: nat
==> default: Forwarding ports...
    default: 3000 (guest) => 3000 (host) (adapter 1)
    default: 22 (guest) => 2222 (host) (adapter 1)
==> default: Running 'pre-boot' VM customizations...
==> default: Booting VM...
==> default: Waiting for machine to boot. This may take a few minutes...
    default: SSH address: 127.0.0.1:2222
    default: SSH username: vagrant
    default: SSH auth method: private key
    default: Warning: Connection reset. Retrying...
    default: Warning: Connection aborted. Retrying...
    default: Warning: Connection reset. Retrying...
    default: Warning: Connection aborted. Retrying...
    default:
    default: Vagrant insecure key detected. Vagrant will automatically replace
    default: this with a newly generated keypair for better security.
    default:
    default: Inserting generated public key within guest...
    default: Removing insecure key from the guest if it's present...
    default: Key inserted! Disconnecting and reconnecting using new SSH key...
==> default: Machine booted and ready!
==> default: Checking for guest additions in VM...
==> default: Mounting shared folders...
    default: /vagrant => D:/vagrant_projects/vagrant-ansible-docker-env
==> default: Running provisioner: ansible_local...
    default: Installing Ansible...
    default: Installing pip... (for Ansible installation)
    default: Running ansible-galaxy...
[DEPRECATION WARNING]: Ansible will require Python 3.8 or newer on the
controller starting with Ansible 2.12. Current version: 2.7.18 (default, Jul  1
 2022, 12:27:04) [GCC 9.4.0]. This feature will be removed from ansible-core in
 version 2.12. Deprecation warnings can be disabled by setting
deprecation_warnings=False in ansible.cfg.
/usr/local/lib/python2.7/dist-packages/ansible/parsing/vault/__init__.py:44: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.exceptions import InvalidSignature
Starting galaxy collection install process
Process install dependency map
Starting collection install process
Downloading https://galaxy.ansible.com/download/community-docker-2.7.0.tar.gz to /home/vagrant/.ansible/tmp/ansible-local-8337dY3egI/tmpOS1yA1/community-docker-2.7.0-wm2luu
Installing 'community.docker:2.7.0' to '/home/vagrant/.ansible/collections/ansible_collections/community/docker'
community.docker:2.7.0 was installed successfully
    default: Running ansible-playbook...
[DEPRECATION WARNING]: Ansible will require Python 3.8 or newer on the
controller starting with Ansible 2.12. Current version: 2.7.18 (default, Jul  1
 2022, 12:27:04) [GCC 9.4.0]. This feature will be removed from ansible-core in
 version 2.12. Deprecation warnings can be disabled by setting
deprecation_warnings=False in ansible.cfg.
/usr/local/lib/python2.7/dist-packages/ansible/parsing/vault/__init__.py:44: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.exceptions import InvalidSignature

PLAY [all] *********************************************************************

TASK [Gathering Facts] *********************************************************
[DEPRECATION WARNING]: Distribution Ubuntu 20.04 on host default should use
/usr/bin/python3, but is using /usr/bin/python for backward compatibility with
prior Ansible releases. A future Ansible release will default to using the
discovered platform python for this host. See https://docs.ansible.com/ansible-
core/2.11/reference_appendices/interpreter_discovery.html for more information.
 This feature will be removed in version 2.12. Deprecation warnings can be
disabled by setting deprecation_warnings=False in ansible.cfg.
ok: [default]

TASK [Install aptitude] ********************************************************
changed: [default]

TASK [Install required system packages] ****************************************
changed: [default]

TASK [Add Docker GPG apt Key] **************************************************
changed: [default]

TASK [Add Docker Repository] ***************************************************
changed: [default]

TASK [Update apt and install docker-ce] ****************************************
changed: [default]

TASK [Install Docker Module for Python] ****************************************
changed: [default]

TASK [Pull default Docker image] ***********************************************
changed: [default]

PLAY RECAP *********************************************************************
default                    : ok=8    changed=7    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

PS D:\vagrant_projects\vagrant-ansible-docker-env>

Validate our Docker environment

You connect to your vagrant guest with ssh and start the well known [Hello World] container example.

Connect to Vagrant guest

The connection with vagrant is made with the command:

vagrant ssh

PS D:\vagrant_projects\vagrant-ansible-docker-env> vagrant ssh
Welcome to Ubuntu 20.04.4 LTS (GNU/Linux 5.4.0-122-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Mon Aug  8 22:06:38 UTC 2022

  System load:  0.08              Processes:                119
  Usage of /:   8.0% of 38.70GB   Users logged in:          0
  Memory usage: 28%               IPv4 address for docker0: 172.17.0.1
  Swap usage:   0%                IPv4 address for enp0s3:  10.0.2.15


2 updates can be applied immediately.
1 of these updates is a standard security update.
To see these additional updates run: apt list --upgradable

Run the container hello-world

You just have to use following command:

sudo docker run hello-world

vagrant@ubuntu-focal:~$ sudo docker run hello-world
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
2db29710123e: Pull complete
Digest: sha256:53f1bbee2f52c39e41682ee1d388285290c5c8a76cc92b42687eecf38e0af3f0
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (amd64)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/

For more examples and ideas, visit:
 https://docs.docker.com/get-started/

vagrant@ubuntu-focal:~$

Conclusion

All files are available from my GitHub Account Here.
I will soon work on improving the settings to eliminate the warnings about the version of Python used.