Sandbox – local testing¶

sandbox/ contains a Docker-based environment for testing playbooks against a throwaway container instead of a real server. Use it to validate changes before applying them to staging or production.

How it works¶

sandbox/init.sh does the following on every run:

1. Generates a temporary ed25519 SSH key pair.
2. Tears down and removes any existing container (and its local image).
3. Builds and starts a fresh container with the temporary public key injected.
4. Waits for SSH to be ready on 127.0.0.1:2222.
5. Runs ansible-playbook against the container.

The container is a plain Ubuntu image with sshd and sudo configured. It mimics a fresh server.

Some roles are disabled in sandbox mode because they require external services or elevated system access that is not available in a container: - auditd_enabled: false - cadvisor_enabled: false - cloudflare_enabled: false

Basic usage¶

Run the default playbook (site.local.yml) against the local container:

bash sandbox/init.sh

Examples¶

Run a specific playbook¶

bash sandbox/init.sh --playbook web.yml

Dry run (check mode)¶

bash sandbox/init.sh --playbook web.yml --check

Run a single role¶

bash sandbox/init.sh --role deployment

Use a real inventory (prod/stage) instead of local¶

Useful when you need real host variables (e.g. to test Cloudflare config):

bash sandbox/init.sh --inventory=prod --role=cloudflare --limit bkdk-web-01

Note: Ansible will still connect to the local container – the inventory is used only to load variables for the specified host.

Run a specific playbook against a real inventory host¶

bash sandbox/init.sh --inventory=prod web.yml --limit bkdk-web-01

Limitations¶

• --role and --playbook cannot be combined (the script will error).
• The container does not persist between runs – every init.sh call starts fresh.
• Roles that call external APIs (Cloudflare) will still make real API calls if not disabled.

Docker files¶

sandbox/
├── init.sh                  # Entry point
└── docker/
    ├── Dockerfile           # Ubuntu image with sshd + sudo
    └── docker-compose.yml   # Exposes port 2222 → 22

The SSH port is fixed at 2222 on the host. Make sure nothing else is bound to that port before running.