Build a Local Ansible Lab with Docker & SSH

Lesson 2 of 12 · 10 min · Beginner

Learning Ansible requires target nodes. Instead of paying for cloud VMs, this guide shows you how to spin up Ubuntu Docker containers and secure them with PEM authentication so they act exactly like real servers.

Host Preparation

First, we need to ensure the host machine has the required software (Docker and Ansible) and generate the SSH key pair that Ansible will use to authenticate with the containers.

Why a PEM key?

We use a 4096-bit RSA key to mimic enterprise environments where password authentication is strictly disabled. The .pem file is your private key, keep its permissions locked down (400).

terminal (host machine)

# 1. Update and install Docker
$ sudo apt update
$ sudo apt install -y docker.io
$ sudo systemctl start docker && sudo systemctl enable docker
# 2. Install Ansible
$ sudo apt install -y ansible
$ ansible --version && docker --version
# 3. Generate SSH Key Pair (PEM)
$ ssh-keygen -t rsa -b 4096 -f ansible-key.pem
$ chmod 400 ansible-key.pem
↳ Generates ansible-key.pem (private) and ansible-key.pem.pub (public)

Spawn the Nodes

terminal (host machine)

# 1. Create a dedicated bridge network
$ docker network create ansible-lab
$ docker pull ubuntu:22.04
# 2. Spin up Server 1
$ docker run -dit --name ubuntu-server-1 \
# 3. Spin up Server 2
$ docker run -dit --name ubuntu-server-2 \

A Private Network

By creating a custom Docker network (ansible-lab), we ensure both containers can communicate with each other securely, and the host machine can route traffic to them.

Configure SSH Inside Containers

Base Ubuntu containers do not come with SSH installed. We need to exec into the containers, install the OpenSSH server, create our devops user, and inject the public key we generated earlier.

The Internal Config Flow

Enter Execute bash inside the running container.
Install Download and install openssh-server.
User Create the devops user with a home directory and bash shell.
Keys Create the .ssh directory and authorize the public key.
Daemon Harden sshd_config and start the SSH service.

terminal (inside ubuntu-server-1)

# Enter the container
$ docker exec -it ubuntu-server-1 bash

# Install SSH
$ apt update && apt install -y openssh-server
$ mkdir /var/run/sshd

# Setup the devops user & keys
$ useradd -m -s /bin/bash devops
$ mkdir /home/devops/.ssh
$ chmod 700 /home/devops/.ssh

# Add your public key (paste the contents of ansible-key.pem.pub)
$ echo "ssh-rsa AAAAB3..." > /home/devops/.ssh/authorized_keys
$ chmod 600 /home/devops/.ssh/authorized_keys
$ chown -R devops:devops /home/devops/.ssh

# Harden SSH config
$ sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
$ sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin no/' /etc/ssh/sshd_config
$ sed -i 's/#PubkeyAuthentication yes/PubkeyAuthentication yes/' /etc/ssh/sshd_config

# Start the service and exit
$ service ssh start
$ exit

Verify Connection

terminal (host machine)

# Find the IP Addresses of the containers
$ docker inspect ubuntu-server-1 | grep IPAddress
"IPAddress": "172.18.0.2"
$ docker inspect ubuntu-server-2 | grep IPAddress
"IPAddress": "172.18.0.3"
# Test SSH connection using the PEM key
$ ssh -i ansible-key.pem devops@172.18.0.2
Welcome to Ubuntu 22.04 LTS...
$

You must repeat the internal SSH configuration steps for ubuntu-server-2. Once both are configured, you can add their IPs to your Ansible i ← Previous Lesson Introduction to Ansible Next Lesson → Ad-Hoc Commands