S Shan DevOps
← Portal Home

# ansible / lab / docker

Build a Local Ansible Lab with Docker & SSH

Learning Ansible requires target nodes. Instead of paying for cloud VMs, this guide shows you how to spin up Ubuntu Docker containers and secure them with PEM authentication so they act exactly like real servers.

Start Building →Jump to verification
$ ssh -i ansible-key.pem devops@server1✓
OutputWelcome to Ubuntu 22.04 LTS
AuthenticationPublic Key (RSA)
RoleAnsible Managed Node
StatusReady for automation
2
Containers
Local
Network
# step-01

Host Preparation

First, we need to ensure the host machine has the required software (Docker and Ansible) and generate the SSH key pair that Ansible will use to authenticate with the containers.

security

Why a PEM key?

We use a 4096-bit RSA key to mimic enterprise environments where password authentication is strictly disabled. The .pem file is your private key, keep its permissions locked down (400).

terminal (host machine)
# 1. Update and install Docker
$ sudo apt update
$ sudo apt install -y docker.io
$ sudo systemctl start docker && sudo systemctl enable docker
# 2. Install Ansible
$ sudo apt install -y ansible
$ ansible --version && docker --version
# 3. Generate SSH Key Pair (PEM)
$ ssh-keygen -t rsa -b 4096 -f ansible-key.pem
$ chmod 400 ansible-key.pem
↳ Generates ansible-key.pem (private) and ansible-key.pem.pub (public)
# step-02

Spawn the Nodes

terminal (host machine)
# 1. Create a dedicated bridge network
$ docker network create ansible-lab
$ docker pull ubuntu:22.04
# 2. Spin up Server 1
$ docker run -dit --name ubuntu-server-1 \
> --hostname server1 \
> --network ansible-lab ubuntu:22.04
# 3. Spin up Server 2
$ docker run -dit --name ubuntu-server-2 \
> --hostname server2 \
> --network ansible-lab ubuntu:22.04
architecture

A Private Network

By creating a custom Docker network (ansible-lab), we ensure both containers can communicate with each other securely, and the host machine can route traffic to them.

# step-03

Configure SSH Inside Containers

Base Ubuntu containers do not come with SSH installed. We need to exec into the containers, install the OpenSSH server, create our devops user, and inject the public key we generated earlier.

The Internal Config Flow

  • Enter

    Execute bash inside the running container.

  • Install

    Download and install openssh-server.

  • User

    Create the devops user with a home directory and bash shell.

  • Keys

    Create the .ssh directory and authorize the public key.

  • Daemon

    Harden sshd_config and start the SSH service.

terminal (inside ubuntu-server-1)
# Enter the container
$ docker exec -it ubuntu-server-1 bash
 
# Install SSH
root@server1:/# apt update && apt install -y openssh-server
root@server1:/# mkdir /var/run/sshd
 
# Setup the devops user & keys
root@server1:/# useradd -m -s /bin/bash devops
root@server1:/# mkdir /home/devops/.ssh
root@server1:/# chmod 700 /home/devops/.ssh
 
# Add your public key (paste the contents of ansible-key.pem.pub)
root@server1:/# echo "ssh-rsa AAAAB3..." > /home/devops/.ssh/authorized_keys
root@server1:/# chmod 600 /home/devops/.ssh/authorized_keys
root@server1:/# chown -R devops:devops /home/devops/.ssh
 
# Harden SSH config
root@server1:/# sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
root@server1:/# sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin no/' /etc/ssh/sshd_config
root@server1:/# sed -i 's/#PubkeyAuthentication yes/PubkeyAuthentication yes/' /etc/ssh/sshd_config
 
# Start the service and exit
root@server1:/# service ssh start
root@server1:/# exit
# step-04

Verify Connection

terminal (host machine)
# Find the IP Addresses of the containers
$ docker inspect ubuntu-server-1 | grep IPAddress
"IPAddress": "172.18.0.2"
$ docker inspect ubuntu-server-2 | grep IPAddress
"IPAddress": "172.18.0.3"
# Test SSH connection using the PEM key
$ ssh -i ansible-key.pem devops@172.18.0.2
Welcome to Ubuntu 22.04 LTS...
devops@server1:~$

You must repeat the internal SSH configuration steps for ubuntu-server-2. Once both are configured, you can add their IPs to your Ansible i