# Building Custom AWX EE image **URL:** \ **Category:** Get Help\ **Tags:** awx, ee\ **Created:** [August 28, 2025, 11:23pm UTC](https://forum.ansible.com/t/building-custom-awx-ee-image/44389 "2025-08-28T23:23:29Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mani3887](https://avatars.discourse-cdn.com/v4/letter/m/9f8e36/32.png) [@mani3887](https://forum.ansible.com/u/mani3887)\ **Post date:** [August 28, 2025, 11:23pm UTC](https://forum.ansible.com/t/building-custom-awx-ee-image/44389/1 "2025-08-28T23:23:29Z")
Hi Team, How do we build custom execution environments with ansible-builder v3 when Galaxy collections include loose dependencies like `ansible-pylibssh>=0.2.0`? Pip is always invoked with `--require-hashes`, which rejects any non-`==` specifiers. Should users be pinning these themselves, or is ansible-builder expected to handle this case? Any help on how to create a custom AWX EE image would really help as I have been stuck in this for over a week. Thanks in advance! ---
**Author:** ![Lyle\_McKarns](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/lyle_mckarns/32/8142_2.png) [@Lyle\_McKarns](https://forum.ansible.com/u/Lyle_McKarns)\ **Post date:** [August 29, 2025, 2:00pm UTC](https://forum.ansible.com/t/building-custom-awx-ee-image/44389/2 "2025-08-29T14:00:40Z")
> [@mani3887](#): > > ansible-builde Can you post a snippet of a config, and the error its generating for more context? \ Based on [this page](https://docs.ansible.com/ansible/latest/getting_started_ee/build_execution_environment.html) you should be able to list any python dependencies like ```auto # List any python dependencies python: - pyvmomi>=6.7.1 ``` And it should build without issue (depending on your image) ---
**Author:** ![prateektl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/prateektl/32/8985_2.png) [@prateektl](https://forum.ansible.com/u/prateektl)\ **Post date:** [August 31, 2025, 3:52pm UTC](https://forum.ansible.com/t/building-custom-awx-ee-image/44389/3 "2025-08-31T15:52:10Z")
I have used podman/docker (chose anyone) to build the image and then store it in registry (in my case JFrog) and configured the AWX to pull the images. Its working as expected and also i was able to customize the images to ensure the size is not huge. Let me know if further details is required. ---
**Author:** ![mani3887](https://avatars.discourse-cdn.com/v4/letter/m/9f8e36/32.png) [@mani3887](https://forum.ansible.com/u/mani3887)\ **Post date:** [September 2, 2025, 4:41pm UTC](https://forum.ansible.com/t/building-custom-awx-ee-image/44389/4 "2025-09-02T16:41:36Z")
Thanks for your response. The error I am getting is: 32.42 + /usr/bin/python3.11 -m pip install --cache-dir=/output/wheels -r /tmp/src/requirements.txt 33.13 Collecting **ansible-pylibssh\>=0.2.0** (from -r /tmp/src/requirements.txt (line 1)) 33.25 ERROR: In --require-hashes mode, all requirements must have their versions pinned with ==. These do not: 33.25 ansible-pylibssh\>=0.2.0 from [https://files.pythonhosted.org/packages/93/ad/4b5bf86a4c6882f43d259684bded42620c705c92e86f992022f41acfbd95/ansible\_pylibssh-1.2.2-cp311-cp311-manylinux\_2\_28\_x86\_64.whl](https://files.pythonhosted.org/packages/93/ad/4b5bf86a4c6882f43d259684bded42620c705c92e86f992022f41acfbd95/ansible_pylibssh-1.2.2-cp311-cp311-manylinux_2_28_x86_64.whl) (from -r /tmp/src/requirements.txt (line 1)) The issue is that **ansible-builder enforces `--require-hashes`** during pip installs. Even though I explicitly pin `ansible-pylibssh==1.2.2` in my `execution-environment.yml`, the `>=0.2.0` requirement still gets pulled in by an Ansible collection (via `ansible.netcommon`), so the generated `requirements.txt` contains an unpinned `>=` line. As a result: - pip refuses to install because hashes + ranges (`>=`) are not allowed. - Editing the Dockerfile or my own `requirements.txt` doesn’t help, since ansible-builder regenerates `/tmp/src/requirements.txt` from the collections each time. - I can’t disable the `--require-hashes` flag when ansible-builder runs pip. This makes it impossible to build the EE image with ansible-builder v3 if any collection depends on `ansible-pylibssh>=0.2.0`. ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [September 2, 2025, 4:46pm UTC](https://forum.ansible.com/t/building-custom-awx-ee-image/44389/5 "2025-09-02T16:46:05Z")
ansible-builder does not enforce use of `--require-hashes`, that must be some other collection that has that in `requirements.txt` that is specifying that. ---
**Author:** ![shrews](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shrews/32/10142_2.png) [@shrews](https://forum.ansible.com/u/shrews)\ **Post date:** [September 2, 2025, 6:37pm UTC](https://forum.ansible.com/t/building-custom-awx-ee-image/44389/6 "2025-09-02T18:37:06Z")
As @sivel says, builder does not use `--require-hashes` unless you tell it to do so through PIP\_OPTS or maybe a custom pip config. The [pip docs state](https://pip.pypa.io/en/stable/topics/secure-installs/#hash-checking-mode) that if the `--hash` option is used with any requirement, then hash checking mode is enabled globally. I suspect one or more requirements from one of your collections is using `--hash` and thus turning it on. You’ll have to dig to identify which one, then possibly use the `exclude` keyword within the `dependencies` section of your EE to ignore those requirements. Requirements files are expected to follow the PEP 508 standard, as [outlined in the builder 3.1 porting guide](https://ansible.readthedocs.io/projects/builder/en/latest/porting_guides/porting_guide_v3.1/#pep-508-standard). Anything outside of that standard is fed straight through to pip.