---
id: TECH-DEPLOYMENT
type: technical
status: active
title: Deployment (Runtime Environment)
created: '2026-09-09'
updated: '2026-09-09'
tags:
- technical
- deployment
- docker
related:
- TECH-ARCHITECTURE
source_paths:
- execute.sh
- docker/Dockerfile
- docker/requirements.yml
- docker/ansible-functs.sh
- ansible.cfg
confidence: confirmed
---

# Deployment (Runtime Environment)

## Docker Image

- `docker/Dockerfile`: `debian:trixie-slim`, `TZ=Europe/Berlin`,
  `ANSIBLE_VERSION=2.20.6` → `pip3 install ansible-core~=2.20.6`.
- Utilities: nano, git, wget, unzip, curl, python3-pip, tzdata, openssh-client,
  ping, vim, less.
- Bakes SSH client policy: `StrictHostKeyChecking no`,
  `UserKnownHostsFile /dev/null` (`/etc/ssh/ssh_config.d/99-no-hostkey-check.conf`).
- Installs pinned collections from `docker/requirements.yml`:
  `ansible.posix` 2.2.0, `community.general` 13.0.1, `community.docker`
  5.2.0, `community.zabbix` 4.2.0.
- Copies `ansible-functs.sh` into `/root/.bashrc.d/` providing aliases
  `ap` (ansible-playbook), `ag` (ansible-galaxy), `av` (ansible-vault).

## Launch Flow (execute.sh)

1. Pick next free container name `ansible-<n>`.
2. Ensure IPv6-enabled bridge network `ansible-dualstack` (fails fast with
   a clear message if the network exists without IPv6).
3. Run the container detached: repo mounted at `/ansible` (workdir), SSH
   keys from the `ansible_ssh_keys` volume into `/root/.ssh`, env
   `ANSIBLE_HOST_KEY_CHECKING=False`, `ANSIBLE_CONFIG=./ansible.cfg`.
4. Write a per-container SSH client config, print name/IPv4/IPv6/OS, then
   `docker attach` for interactive use.

## Controller-Side Artifacts

- `.zabbix-psk/` and `logs/` are written by delegation from the container
  into the mounted repo (git-ignored).

## Operational Notes

- Changing collections requires updating `docker/requirements.yml` and an
  image rebuild (AGENTS.md).
- Default image tag: `ansible:deb13`.