Ansible: image ships ansible-core but no SSH client, so ansible-playbook cannot reach remote hosts

[matthew-on-git]

Type: bug · Area: image contents, ansible

Summary

The image ships ansible-core but no SSH client, so ansible-playbook cannot connect to any remote host. Ansible's default connection plugin is ssh; without it the image can lint Ansible but not run it anywhere except localhost.

Environment

• Image: ghcr.io/devrail-dev/dev-toolchain:v1
• Base: Debian GNU/Linux 12 (bookworm)
• ansible [core 2.19.11] present

Reproduction

$ docker run --rm ghcr.io/devrail-dev/dev-toolchain:v1 sh -c 'command -v ssh; command -v ssh-keyscan; ansible --version | head -1'
ansible [core 2.19.11]

Both command -v calls return nothing — neither binary exists.

Against a real inventory the failure surfaces late and unhelpfully, inside the play rather than at setup:

fatal: [nfs-01]: UNREACHABLE! => {"changed": false,
  "msg": "Failed to connect to the host via ssh: ...", "unreachable": true}

Impact

Any project using DevRail to run Ansible against remote hosts has to install the transport itself in before_script:

- apt-get update -qq && apt-get install -y -qq --no-install-recommends openssh-client

That is ~3s per job and easy to get wrong. It also isn't obvious that the image is the cause — the error reads like a credentials or networking problem on the target.

Note this is invisible to projects whose inventory is localhost ansible_connection=local (e.g. driving a device over its HTTP API), which may be why it hasn't come up.

Suggested fix

Add openssh-client to the image when the Ansible toolchain is installed. It is a small package and ssh is the default transport for the tool already bundled.

If running playbooks against remote hosts is considered out of scope for the image, documenting that explicitly would still help — the presence of ansible-core implies otherwise.

[matthew-on-git]

Fixed in #59.

Change: scripts/install-ansible.sh now installs openssh-client via apt-get before the pip installs. This is idempotent (skips if ssh binary already present). Verified during container build — package installed successfully in the Ansible stage.

Previously, the image shipped ansible-core but no SSH client, so ansible-playbook could not reach remote hosts. Users had to install openssh-client themselves in before_script.