community.docker.nsenter connection – execute on host running controller container


This connection plugin is part of the community.docker collection (version 3.11.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install community.docker.

To use it in a playbook, specify: community.docker.nsenter.

New in community.docker 1.9.0


  • This connection plugin allows Ansible, running in a privileged container, to execute tasks on the container host instead of in the container itself.

  • This is useful for running Ansible in a pull model, while still keeping the Ansible control node containerized.

  • It relies on having privileged access to run nsenter in the host’s PID namespace, allowing it to enter the namespaces of the provided PID (default PID 1, or init/systemd).






PID to attach with using nsenter.

The default should be fine unless you are attaching as a non-root user.

Default: 1


  • INI entry:

    nsenter_pid = 1
  • Environment variable: ANSIBLE_NSENTER_PID

  • Variable: ansible_nsenter_pid



  • The remote user is ignored; this plugin always runs as root.

  • This plugin requires the Ansible controller container to be launched in the following way: (1) The container image contains the nsenter program; (2) The container is launched in privileged mode; (3) The container is launched in the host’s PID namespace (--pid host).


  • Jeff Goldschrafe (@jgoldschrafe)


Configuration entries for each entry type have a low to high priority order. For example, a variable that is lower in the list will override a variable that is higher up.