---
id: TECH-DEPLOYMENT
type: technical
status: active
title: Deployment (Runtime Environment)
created: '2026-09-09'
updated: '2026-10-11'
tags:
- technical
- deployment
- docker
related:
- TECH-ARCHITECTURE
source_paths:
- execute.sh
- docker/Dockerfile
- docker/requirements.yml
- docker/ansible-functs.sh
- ansible.cfg
- README.md
confidence: confirmed
---

# Deployment (Runtime Environment)

## Docker Image

- `docker/Dockerfile`: `debian:trixie-slim`, `TZ=Europe/Berlin`,
  `ANSIBLE_VERSION=2.20.6` → `pip3 install ansible-core~=2.20.6`.
- Utilities: nano, git, wget, unzip, curl, python3-pip, tzdata, openssh-client,
  ping, vim, less.
- Bakes SSH client policy: `StrictHostKeyChecking no`,
  `UserKnownHostsFile /dev/null` (`/etc/ssh/ssh_config.d/99-no-hostkey-check.conf`).
- Installs pinned collections from `docker/requirements.yml`:
  `ansible.posix` 2.2.0, `community.general` 13.0.1, `community.docker`
  5.2.0, `community.zabbix` 4.2.0.
- Copies `ansible-functs.sh` into `/root/.bashrc.d/` providing aliases
  `ap` (ansible-playbook), `ag` (ansible-galaxy), `av` (ansible-vault).

## Launch Flow (execute.sh)

1. Resolve `SSH_KEY_DIR` (default `$HOME/.ssh`) and reject a missing or
   unreadable directory before invoking Docker. Relative paths are resolved
   against the current working directory.
2. Pick next free container name `ansible-<n>`.
3. Ensure IPv6-enabled bridge network `ansible-dualstack` (fails fast with
   a clear message if the network exists without IPv6).
4. Run the container detached: repo mounted at `/ansible` (workdir), local
   SSH directory bind-mounted read-only at `/root/.ssh`, env
   `ANSIBLE_HOST_KEY_CHECKING=False`, `ANSIBLE_CONFIG=./ansible.cfg`.
   Abort if `docker run` fails.
5. Print name/IPv4/IPv6/OS, then `docker attach` for interactive use.

The launcher preserves the local SSH configuration and permissions. Standard
key names are discovered by OpenSSH; other filenames require `IdentityFile`
or Ansible's `--private-key /root/.ssh/<filename>`. Host-specific absolute
paths in SSH configuration must also exist inside the container. Encrypted
keys can be loaded into an agent started inside the container with
`eval "$(ssh-agent -s)"` followed by `ssh-add /root/.ssh/<filename>`.

## Controller-Side Artifacts

- `.zabbix-psk/` and `logs/` are written by delegation from the container
  into the mounted repo (git-ignored).

## Operational Notes

- Changing collections requires updating `docker/requirements.yml` and an
  image rebuild (AGENTS.md).
- Default image tag: `ansible:deb13`.
- Build from the repository root with `docker build -t ansible:deb13 docker/`.
- SSH keys are supplied at runtime, not embedded in the image.