{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/packer/issues/6348","repository_url":"https://api.github.com/repos/hashicorp/packer","labels_url":"https://api.github.com/repos/hashicorp/packer/issues/6348/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/packer/issues/6348/comments","events_url":"https://api.github.com/repos/hashicorp/packer/issues/6348/events","html_url":"https://github.com/hashicorp/packer/issues/6348","id":329789200,"node_id":"MDU6SXNzdWUzMjk3ODkyMDA=","number":6348,"title":"Ansible chroot communicator must be run as root","user":{"login":"SteveTalbot","id":2563189,"node_id":"MDQ6VXNlcjI1NjMxODk=","avatar_url":"https://avatars3.githubusercontent.com/u/2563189?v=4","gravatar_id":"","url":"https://api.github.com/users/SteveTalbot","html_url":"https://github.com/SteveTalbot","followers_url":"https://api.github.com/users/SteveTalbot/followers","following_url":"https://api.github.com/users/SteveTalbot/following{/other_user}","gists_url":"https://api.github.com/users/SteveTalbot/gists{/gist_id}","starred_url":"https://api.github.com/users/SteveTalbot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SteveTalbot/subscriptions","organizations_url":"https://api.github.com/users/SteveTalbot/orgs","repos_url":"https://api.github.com/users/SteveTalbot/repos","events_url":"https://api.github.com/users/SteveTalbot/events{/privacy}","received_events_url":"https://api.github.com/users/SteveTalbot/received_events","type":"User","site_admin":false},"labels":[{"id":126745464,"node_id":"MDU6TGFiZWwxMjY3NDU0NjQ=","url":"https://api.github.com/repos/hashicorp/packer/labels/builder/amazon","name":"builder/amazon","color":"d4c5f9","default":false},{"id":1157227138,"node_id":"MDU6TGFiZWwxMTU3MjI3MTM4","url":"https://api.github.com/repos/hashicorp/packer/labels/community-supported%20plugin","name":"community-supported plugin","color":"91ead2","default":false},{"id":194731574,"node_id":"MDU6TGFiZWwxOTQ3MzE1NzQ=","url":"https://api.github.com/repos/hashicorp/packer/labels/docs","name":"docs","color":"fbca04","default":false},{"id":45643873,"node_id":"MDU6TGFiZWw0NTY0Mzg3Mw==","url":"https://api.github.com/repos/hashicorp/packer/labels/need-more-info","name":"need-more-info","color":"fbca04","default":false},{"id":337720756,"node_id":"MDU6TGFiZWwzMzc3MjA3NTY=","url":"https://api.github.com/repos/hashicorp/packer/labels/provisioner/ansible-remote","name":"provisioner/ansible-remote","color":"c7def8","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-06-06T09:30:22Z","updated_at":"2018-12-11T00:37:45Z","closed_at":null,"author_association":"NONE","body":"**Affected version:** Packer 1.2.4\r\n**Host platform:** Ubuntu 16.04 LTS, Jenkins slave\r\n**Builder:** `amazon-chroot`\r\n**Provisioner:** `ansible` with Ansible v2.5.4.0\r\n\r\n[Packer's documentation for using the Ansible chroot communicator](https://www.packer.io/docs/provisioners/ansible.html#chroot-communicator) provides an example configuration that did not work for me, when used in conjunction with the amazon-chroot builder.\r\n\r\n`ansible-playbook` needs to be run as root in order to access the chroot.\r\n\r\nI found it was not possible to set the \"command\" option of the ansible provisioner to `sudo -E ansible-playbook` or `sudo -E /usr/bin/ansible-playbook`.  This caused a file not found error in our environment, although your mileage may vary.\r\n\r\nTo get this working, I needed to:\r\n* Manually construct the inventory file\r\n* Create a small bash script `sudo-ansible-playbook.sh` to do the privilege escalation\r\n\r\nSo an example working configuration would be:\r\n\r\n```\r\n{\r\n  \"builders\": [\r\n    {\r\n      \"type\": \"amazon-chroot\",\r\n      \"name\": \"example-build\",\r\n      \"command_wrapper\": \"sudo {{.Command}}\",\r\n      \"mount_path\": \"/mnt/packer-amazon-chroot-volumes/{{build_name}}\",\r\n      \"region\": \"us-east-1\",\r\n      \"source_ami\": \"ami-123456\"\r\n    }\r\n  ],\r\n  \"provisioners\": [\r\n    {\r\n      \"type\": \"ansible\",\r\n      \"ansible_env_vars\": [\r\n        \"ANSIBLE_FORCE_COLOR=1\",\r\n        \"PYTHONUNBUFFERED=1\",\r\n        \"ANSIBLE_LOCAL_TEMP=/tmp/ansible\",\r\n        \"ANSIBLE_REMOTE_TEMP=/tmp/ansible-managed\",\r\n        \"ANSIBLE_ROLES_PATH={{template_dir}}/ansible/galaxy_roles:/etc/ansible/roles\"\r\n      ],\r\n      \"command\": \"{{template_dir}}/sudo-ansible-playbook.sh\",\r\n      \"inventory_file\": \"{{template_dir}}/inventory.ini\",\r\n      \"playbook_file\": \"{{template_dir}}/ansible/playbook.yml\"\r\n      \"extra_arguments\": [\r\n        \"--limit={{build_name}}\",\r\n        \"-vvv\"\r\n      ]\r\n    }\r\n  ]\r\n}\r\n```\r\n\r\nThe `sudo-ansible-playbook.sh` script contains:\r\n```\r\n#!/usr/bin/env bash\r\nsudo -E ansible-playbook \"$@\"\r\nexit $?\r\n```\r\n\r\nAnd the inventory file would look something like the following, where the build name has been used as the Ansible host alias:\r\n```\r\nexample-build ansible_connection=chroot ansible_host=/mnt/packer-amazon-chroot-volumes/example-build\r\n\r\n[group1]\r\nexample-build\r\n\r\n[group2]\r\nexample-build\r\n```\r\n\r\nA small change to the documentation, to mention the use of sudo, would help others to avoid or work around this problem.\r\n\r\nIt also seems a bit unnecessary to create the bash script; I'd prefer if it were possible to specify `\"command\": \"sudo -E ansible-playbook\"` in the provisioner configuration.\r\n"},"comment":{"url":"https://api.github.com/repos/hashicorp/packer/issues/comments/446028636","html_url":"https://github.com/hashicorp/packer/issues/6348#issuecomment-446028636","issue_url":"https://api.github.com/repos/hashicorp/packer/issues/6348","id":446028636,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NjAyODYzNg==","user":{"login":"SwampDragons","id":1008838,"node_id":"MDQ6VXNlcjEwMDg4Mzg=","avatar_url":"https://avatars2.githubusercontent.com/u/1008838?v=4","gravatar_id":"","url":"https://api.github.com/users/SwampDragons","html_url":"https://github.com/SwampDragons","followers_url":"https://api.github.com/users/SwampDragons/followers","following_url":"https://api.github.com/users/SwampDragons/following{/other_user}","gists_url":"https://api.github.com/users/SwampDragons/gists{/gist_id}","starred_url":"https://api.github.com/users/SwampDragons/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SwampDragons/subscriptions","organizations_url":"https://api.github.com/users/SwampDragons/orgs","repos_url":"https://api.github.com/users/SwampDragons/repos","events_url":"https://api.github.com/users/SwampDragons/events{/privacy}","received_events_url":"https://api.github.com/users/SwampDragons/received_events","type":"User","site_admin":false},"created_at":"2018-12-11T00:37:45Z","updated_at":"2018-12-11T00:37:45Z","author_association":"MEMBER","body":"Do you think you could give me an example of how to better document this in a way that would have helped you?"}}
{"actor":{"display_login":"SwampDragons"}}