Execution environment definition
You define the content of your execution environment in a YAML file. By default, this file is called
execution-environment.yaml. This file tells Ansible Builder how to create the build instruction file
Containerfile for Podman,
Dockerfile for Docker) and build context for your container image.
This page documents the definition schema for Ansible Builder 3.x. If you are running an older version of Ansible Builder, you need an older schema version. Please consult older versions of the docs for more information. We recommend using version 3, which offers substantially more configurability and functionality than previous versions.
The Ansible Builder 3.x execution environment definition file accepts seven top-level sections:
Here is a sample version 3 EE file. To use Ansible Builder 3.x, you must specify the schema version. If your EE file does not specify
version: 3, Ansible Builder will assume you want version 1.
--- version: 3 build_arg_defaults: ANSIBLE_GALAXY_CLI_COLLECTION_OPTS: '--pre' dependencies: ansible_core: package_pip: ansible-core==2.14.4 ansible_runner: package_pip: ansible-runner galaxy: requirements.yml python: - six - psutil system: bindep.txt images: base_image: name: docker.io/redhat/ubi9:latest # Other available base images: # - quay.io/rockylinux/rockylinux:9 # - quay.io/centos/centos:stream9 # - registry.fedoraproject.org/fedora:38 # - registry.redhat.io/ansible-automation-platform-23/ee-minimal-rhel8:latest # (needs an account) # Custom package manager path for the RHEL based images # options: # package_manager_path: /usr/bin/microdnf additional_build_files: - src: files/ansible.cfg dest: configs additional_build_steps: prepend_base: - RUN echo This is a prepend base command! # Enable Non-default stream before packages provided by it can be installed. (optional) # - RUN $PKGMGR module enable postgresql:15 -y # - RUN $PKGMGR install -y postgresql prepend_galaxy: - COPY _build/configs/ansible.cfg /etc/ansible/ansible.cfg prepend_final: | RUN whoami RUN cat /etc/os-release append_final: - RUN echo This is a post-install command! - RUN ls -la /etc
You may use the configuration YAML keys listed here in your v3 execution environment definition file.
Specifies files to be added to the build context directory. These can
then be referenced or copied by additional_build_steps during any build stage.
The format is a list of dictionary values, each with a
dest key and value.
Each list item must be a dictionary containing the following (non-optional) keys:
Specifies the source file(s) to copy into the build context directory. This may either be an absolute path (e.g.,
/home/user/.ansible.cfg), or a path that is relative to the execution environment file. Relative paths may be a glob expression matching one or more files (e.g.
files/*.cfg). Note that an absolute path may not include a regular expression. If
srcis a directory, the entire contents of that directory are copied to
Specifies a subdirectory path underneath the
_buildsubdirectory of the build context directory that should contain the source file(s) (e.g.,
files/configs). This may not be an absolute path or contain
..within the path. This directory will be created for you if it does not exist.
Specifies custom build commands for any build phase. These commands will be inserted directly into the build instruction file for the container runtime (e.g., Containerfile or Dockerfile). The commands must conform to any rules required by the containerization tool.
You can add build steps before or after any stage of the image creation process. For example, if you need
git to be installed before you install your dependencies, you can add a build step at the end of the
base build stage.
Below are the valid keys for this section. Each supports either a multi-line string, or a list of strings.
Commands to insert before building of the base image.
Commands to insert after building of the base image.
Commands to insert before building of the galaxy image.
Commands to insert after building of the galaxy image.
Commands to insert before building of the builder image.
Commands to insert after building of the builder image.
Commands to insert before building of the final image.
Commands to insert after building of the final image.
Please make sure that you do not specify USER directives in these build steps. This may lead to failures while building the image. If you want to override the USER setting, consider using the options.user setting mentioned below.
Specifies default values for build args as a dictionary. This is an alternative to using the --build-arg CLI flag.
Build args used by
ansible-builder are the following:
This allows the user to pass the –pre flag (or others) to enable the installation of pre-release collections.
This allows the user to pass any flags, such as –no-deps, to the role installation.
This controls how often the package manager cache is cleared during the image build process. If this value is not set, which is the default, the cache is cleared frequently. If it is set to the string always, the cache is never cleared. Any other value forces the cache to be cleared only after the system dependencies are installed in the final build stage.
Ansible Builder hard-codes values given inside of
build_arg_defaults into the
build instruction file, so they will persist if you run your container build manually.
If you specify the same variable in the execution environment definition and at the command line with the CLI --build-arg flag, the CLI value will take higher precedence (the CLI value will override the value in the execution environment definition).
Specifies dependencies to install into the final image, including
ansible-runner, Python packages, system packages, and Ansible Collections. Ansible Builder automatically installs dependencies for any Ansible Collections you install.
In general, you can use standard syntax to constrain package versions. Use the same syntax you would pass to
ansible-galaxy, or any other package management utility. You can also define your packages or collections in separate files and reference those files in the
dependencies section of your execution environment definition file.
The following keys are valid for this section:
The version of the
ansible-corePython package to be installed. This value is a dictionary with a single key,
package_pipvalue is passed directly to pip for installation and can be in any format that pip supports. Below are some example values:ansible_core: package_pip: ansible-core ansible_core: package_pip: ansible-core==2.14.3 ansible_core: package_pip: https://github.com/example_user/ansible/archive/refs/heads/ansible.tar.gz
The version of the Ansible Runner Python package to be installed. This value is a dictionary with a single key,
package_pipvalue is passed directly to pip for installation and can be in any format that pip supports. Below are some example values:ansible_runner: package_pip: ansible-runner ansible_runner: package_pip: ansible-runner==2.3.2 ansible_runner: package_pip: https://github.com/example_user/ansible-runner/archive/refs/heads/ansible-runner.tar.gz
Ansible Collections to be installed from Galaxy. This may be a filename, a dictionary, or a multi-line string representation of an Ansible Galaxy
requirements.ymlfile (see below for examples). Read more about the requirements file format in the Galaxy user guide.
The Python installation requirements. This may either be a filename, or a list of requirements (see below for an example).
A dictionary that defines the Python system package name to be installed by
package_system) and/or a path to the Python interpreter to be used (
The system packages to be installed, in bindep format. This may either be a filename, or a list of requirements (see below for an example).
The following example uses filenames that contain various dependencies:
dependencies: python: requirements.txt system: bindep.txt galaxy: requirements.yml ansible_core: package_pip: ansible-core==2.14.2 ansible_runner: package_pip: ansible-runner==2.3.1 python_interpreter: package_system: "python310" python_path: "/usr/bin/python3.10"
And this example uses inline values:
dependencies: python: - pywinrm system: - iputils [platform:rpm] galaxy: collections: - name: community.windows - name: ansible.utils version: 2.10.1 ansible_core: package_pip: ansible-core==2.14.2 ansible_runner: package_pip: ansible-runner==2.3.1 python_interpreter: package_system: "python310" python_path: "/usr/bin/python3.10"
Specifies the base image to be used. At a minimum you MUST specify a source, image, and tag for the base image. The base image provides the operating system and may also provide some packages. We recommend using the standard
host/namespace/container:tag syntax to specify images. You may use Podman or Docker shortcut syntax instead, but the full definition is more reliable and portable.
Valid keys for this section are:
A dictionary defining the parent image for the execution environment. A
namekey must be supplied with the container image to use. Use the
signature_original_namekey if the image is mirrored within your repository, but signed with the original image’s signature key.
You can verify signed container images if you are using the
runtime. Set the --container-policy CLI option to control how this data is used with a Podman
file for container image signature validation.
ignore_allpolicy: Generate a policy.json file in the build context directory where no signature validation is performed.
systempolicy: Signature validation is performed using pre-existing policy.json files in standard system locations.
ansible-builderassumes no responsibility for the content within these files, and the user has complete control over the content.
ansible-builderwill use the container image definitions here to generate a policy.json file in the build context directory that will be used during the build to validate the images.
A dictionary of keywords/options that can affect builder runtime functionality. Valid keys for this section are:
A dictionary with keys that allow for customization of the container
CMDdirectives (and related behaviors). Customizing these behaviors is an advanced task, and may result in subtle, difficult-to-debug failures. As the provided defaults for this section control several intertwined behaviors, overriding any value will skip all remaining defaults in this dictionary. Valid keys are:
Literal value for the
CMDContainerfile directive. The default value is
Literal value for the
ENTRYPOINTContainerfile directive. The default entrypoint behavior handles signal propagation to subprocesses, as well as attempting to ensure at runtime that the container user has a proper environment with a valid writeable home directory, represented in
/etc/passwd, with the
HOMEenvvar set to match. The default entrypoint script may emit warnings to
stderrin cases where it is unable to suitably adjust the user runtime environment. This behavior can be ignored or elevated to a fatal error; consult the source for the
entrypointtarget script for more details. The default value is
Package to install via pip for entrypoint support. This package will be installed in the final build image. The default value is
A string with the path to the package manager (For example -
microdnf) to use. The default is
/usr/bin/dnf. This value will be used to install a Python interpreter, if specified in
dependencies, and during the build phase by the
This boolean value controls whether or not the check for an installation of Ansible and Ansible Runner is performed on the final image. Set this value to
Trueto not perform this check. The default is
This boolean value controls whether the
rootgroup (GID 0) is explicitly granted write permission to
/etc/passwdin the final container image. The default entrypoint script may attempt to update
/etc/passwdunder some container runtimes with dynamically created users to ensure a fully-functional POSIX user environment and home directory. Disabling this capability can cause failures of software features that require users to be listed in
/etc/passwdwith a valid and writeable home directory (eg,
asyncin ansible-core, and the
~usernameshell expansion). The default is
Default current working directory for new processes started under the final container image. Some container runtimes also use this value as
HOMEfor dynamically-created users in the
root(GID 0) group. When this value is specified, the directory will be created (if it doesn’t already exist), set to
rootgroup ownership, and
rwxgroup permissions recursively applied to it. The default value is
This sets the username or UID to use as the default user for the final container image. The default value
Specifies the names that are assigned to the resulting image if the build process completes successfully. The default value is
options: container_init: package_pip: dumb-init>=1.2.5 entrypoint: '["dumb-init"]' cmd: '["csh"]' package_manager_path: /usr/bin/microdnf relax_password_permissions: false skip_ansible_check: true workdir: /myworkdir user: bob tags: - ee_development:latest
An integer value that sets the schema version of the execution environment definition file. Defaults to
1. Must be
3 if you are using Ansible Builder 3.x.