# Community Execution Environment Image: content and location **URL:** \ **Category:** Project Discussions\ **Tags:** feedback-wanted, community, community-meeting, collections\ **Created:** [September 5, 2023, 11:29am UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262 "2023-09-05T11:29:01Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![anwesha](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/anwesha/32/20_2.png) [@anwesha](https://forum.ansible.com/u/anwesha)\ **Post date:** [September 5, 2023, 11:29am UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/1 "2023-09-05T11:29:01Z")
Ansible Community team has been working on the community Execution Environment (EE) image. To more and in details about the EE, please have a look at the the [Getting started guide](https://docs.ansible.com/ansible/devel/getting_started_ee/index.html). The power of Execution Environments unfolds when users build their images themselves but we’d like to provide a very basic community image for our users to play with when learning EEs or for those users who want to use EEs but they use only ansible-core, so there’ll be one ready to use. IMPORTANT: the goal is not to provide an EE with `community.*` collections included. Now we are seeking feedback from the community on the following questions: 1. In which repository do we want to have its configuration stored, i.e. the `execution-environment.yml` file? As an option, it could be [GitHub - ansible-community/images: Ansible container image definitions meant for ansible-test and Execution Environments](https://github.com/ansible-community/images/). 2. Where do we want to publish it (as a GitHub package): under the `ansible` or `ansible-community` GitHub organizations that will affect the package namespace in its URL. 3. What do we want the image to contain? Only `ansible-core` or `ansible-core` + selected collections? For now we’re considering the following collections: - ansible.netcommon - ansible.posix - ansible.utils - ansible.windows The criteria is that those ones are very basic and general: e.g. `ansible.posix` provides the `firewalld` module. We would like to keep the set of the collections as minimal as possible to avoid dependency conflicts, though having only `ansible-core` would be also acceptable. We could also throw out some or add something else (but please keep the goal of the image in mind when suggesting). 4. How often we want to built it? As an option, it could be bound to Ansible package minor releases. Please share what you think on the aforesaid questions. If you need more context: > > > \### Summary > > Discuss community EE's: > > 1) prebuilt and published? > 2) just sa…mple manifest files? > 3) discipline specific? > > > Additional thoughts: > > This does not need to be a voting issue, probably best a conversation to surface thoughts and questions. > > Some possible discussion topics: > > What would the goal of embracing EEs be within the community: > > \- Encourage the use of EEs with navigator and AWX? > \- Experience and familiarity? > \- Alternate packaging format for community edition Ansible? > > How far down the EE path? > \- Full build and publish to quay? (plug and play) > \- Reference definition files? > \- Common repo for definitions? (EE def as code) > \- A schema "describing" each EE > \- Grouping and scope of EEs? > \- Testing and validation? > \- Frequency of build, if build? > \- naming convention, labels (eg source URL to definition) > \- What would the suggested base image be > > From comments: > \- doc implications/impact > \- Encourage/suggest a \`requirements.txt\` per collection to aid in EE creation > \- ansible-builder support for test removal during build to minimize size > > Maybe related: > \- Can/Should the community assist in the definition/default EE for ansible-navigator? > > > Should one or more steering committee members sponsor this effort and represent it moving forward? > > > EE guides: add run\_community\_ee\_image.rst > > Rationale: in case users want just …try it w/o building a custom one [https://github.com/ansible-community/ansible-build-data/pull/278https://github.com/ansible-community/community-team/issues/301](https://github.com/ansible-community/ansible-build-data/pull/278https://github.com/ansible-community/community-team/issues/301) ---
**Author:** ![gwmngilfen](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gwmngilfen/32/6_2.png) [@gwmngilfen](https://forum.ansible.com/u/gwmngilfen)\ **Post date:** [September 6, 2023, 8:48am UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/2 "2023-09-06T08:48:19Z")
3 posts were merged into an existing topic: [What to rename “community-topics” to as a forum tag](https://forum.ansible.com/t/what-to-rename-community-topics-to-as-a-forum-tag/135/10) ---
**Author:** ![Andersson007](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/andersson007/32/89_2.png) [@Andersson007](https://forum.ansible.com/u/Andersson007)\ **Post date:** [September 6, 2023, 8:26am UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/5 "2023-09-06T08:26:57Z")
In answer to the questions asked, 1. `ansible-community/images`: +1 2. `ansible-community` GH org packages: +1 3. `ansible-core + those collections`: +1 because they cover a lot of **base** stuff many may want but at the same it’s not much, so it satisfies the goal of the image. Having only `ansible-core` should be also fine. ---
**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\ **Post date:** [September 6, 2023, 7:08pm UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/6 "2023-09-06T19:08:45Z")
1. +1 for `ansible-community/images` 2. Considering that [quay.io](http://quay.io) seems to be moving ([https://lists.fedoraproject.org/archives/list/infrastructure@lists.fedoraproject.org/message/UXOYLWFV5MZOOHKBSDWLW2E5TOMLE3AJ/](https://lists.fedoraproject.org/archives/list/infrastructure@lists.fedoraproject.org/message/UXOYLWFV5MZOOHKBSDWLW2E5TOMLE3AJ/)) and the current publish process for ansible-test images needs Zuul, I wouldn’t mind using GHCR instead of [quay.io](http://quay.io). Another option brought up during today’s meeting is [beta-galaxy.ansible.com](http://beta-galaxy.ansible.com) if it comes with a EE registry, but there is no indication this is planned to happen. So GHCR is fine for me, and if so I prefer the `ansible-community` namespace. 3. I would create two EEs: a truly **minimal** with just ansible-core, and a **base** one with ansible-core, ansible.utils, ansible.posix, and ansible.windows. All generally useful parts of ansible.netcommon have been moved to ansible.utils (like all the useful filters and tests for working with IP addresses). Also with at least one it should be easy to add more community EEs. 4. I would rebuild the EEs nightly, to make sure that the system packages in the images are fresh. Only rebuilding weekly or even less frequent can quickly result in an accumulation of security vulnerabilities. ---
**Author:** ![Andersson007](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/andersson007/32/89_2.png) [@Andersson007](https://forum.ansible.com/u/Andersson007)\ **Post date:** [September 7, 2023, 7:17am UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/7 "2023-09-07T07:17:10Z")
@felixfontein thanks for the really great feedback! +1 from me to all the stuff (+GHCR) ---
**Author:** ![Andersson007](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/andersson007/32/89_2.png) [@Andersson007](https://forum.ansible.com/u/Andersson007)\ **Post date:** [September 8, 2023, 5:57am UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/8 "2023-09-08T05:57:52Z")
I like @Spredzy 's suggestion to call them: `community-ee-minimal` (with core only), and `community-ee-base` (with those several collections @felixfontein mentioned) ---
**Author:** ![Leo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/leo/32/23_2.png) [@Leo](https://forum.ansible.com/u/Leo)\ **Post date:** [September 8, 2023, 3:48pm UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/9 "2023-09-08T15:48:07Z")
> 1. In which repository do we want to have its configuration stored, i.e. the `execution-environment.yml` file? 1. Another +1 for `ansible-community/images` > 1. Where do we want to publish it (as a GitHub package): under the `ansible` or `ansible-community` GitHub organizations that will affect the package namespace in its URL. 1. @felixfontein I’m not sure the interpretation of the [linked Quay Jira issue](https://issues.redhat.com/browse/PROJQUAY-5434) in the mailing list is correct, it looks more like Red Hat will be adding a “[Quay.io](http://Quay.io) view into [console.redhat.com](http://console.redhat.com)”, than actually moving [Quay.io](http://Quay.io). Currently a lot of containers are hosted there for [Ansible](https://quay.io/organization/ansible) itself, including [awx-ee](https://quay.io/repository/ansible/awx-ee) and [creator-ee](https://quay.io/repository/ansible/creator-ee). I will be reaching out to try to confirm what’s the real objective behind the issue and if [Quay.io](http://Quay.io) is actually being moved. Maybe the [@AWX](https://forum.ansible.com/groups/awx) team can chime in on the topic considering their `awx-ee` is hosted there as well. I would +1 [Quay.io](http://Quay.io) unless GitHub Container Registry (GHCR) provides enough workflow benefits to outweigh having yet another community dependency on it. If GHCR it is, then +1 to `ansible-community` namespace. > 1. What do we want the image to contain? Only `ansible-core` or `ansible-core` + selected collections? 1. +1 to having two ee, a minimal and a base one. Although I would suggest `base` to have a few more collections considering we are doing a `minimal` one, they both look quite _minimal_ otherwise… we could aim to what seemed to be the most used collections according to the stats shown in Ansible Community Day Boston 2023 by the Galaxy team. Adding to `ansible.posix`, `ansible.utils`, `ansible.windows`, we could consider the following: - community.general (it’s a big one, but also, the most used, why not include it? really curious about this considering we have a minimal alternative) - community.docker - kubernetes.core - community.crypto > 1. How often we want to built it? As an option, it could be bound to Ansible package minor releases. +1 to nightly. ---
**Author:** ![gotmax23](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gotmax23/32/106_2.png) [@gotmax23](https://forum.ansible.com/u/gotmax23)\ **Post date:** [September 9, 2023, 12:06am UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/10 "2023-09-09T00:06:48Z")
How about `community-ee-minimal` and `community-ee` (no `-base`). It’s not a base EE if it has other collections in it and the terms `base` and `core` are already kind of overloaded. ---
**Author:** ![gotmax23](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gotmax23/32/106_2.png) [@gotmax23](https://forum.ansible.com/u/gotmax23)\ **Post date:** [September 9, 2023, 12:08am UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/11 "2023-09-09T00:08:22Z")
> [@felixfontein](#): > > a **base** one with ansible-core, ansible.utils, ansible.posix, and ansible.windows I would leave out `ansible.windows`. It would be better in a purpose-built collection with `winrm` and other necessary dependencies to interact with Windows hosts and perhaps `community.windows` as well. ---
**Author:** ![Andersson007](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/andersson007/32/89_2.png) [@Andersson007](https://forum.ansible.com/u/Andersson007)\ **Post date:** [September 11, 2023, 5:42am UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/12 "2023-09-11T05:42:46Z")
@Leo the set of collections should be as minimal as possible to avoid dependency conflicts (because Builder also installs all dependencies specified in their requirements’txt’s) @gotmax23 I’m not sure if `base` is still associated with core widely. I would prefer keeping some prefix there for consistency in naming. About `ansible.windows`: +0 for having/leaving as it won’t probably conflict in terms of dependencies with other stuff. If there’s a demand in future for windows specialized EE, we can build it but for the purpose of the image it’s imo fine to have it there. Remember, the power of EE unfolds when you build it;) ---
**Author:** ![samccann](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/samccann/32/18_2.png) [@samccann](https://forum.ansible.com/u/samccann)\ **Post date:** [September 12, 2023, 4:17pm UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/13 "2023-09-12T16:17:59Z")
> [@Leo](#): > > I will be reaching out to try to confirm what’s the real objective behind the issue and if [Quay.io](http://Quay.io) is actually being moved. Maybe the [@AWX](https://forum.ansible.com/groups/awx) team can chime in on the topic considering their `awx-ee` is hosted there as well. @Leo any update here on if we can use [Quay.io](http://Quay.io)? ---
**Author:** ![samccann](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/samccann/32/18_2.png) [@samccann](https://forum.ansible.com/u/samccann)\ **Post date:** [September 12, 2023, 4:24pm UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/14 "2023-09-12T16:24:07Z")
Trying to summarize here: 1 repo for the execution environment - [GitHub - ansible-community/images](https://github.com/ansible-community/images/) 2 quay vs GHCR still TBD 3 two EEs - `ommunity-ee-minimal` with core only and `community-ee-base` with core, `ansible.utils`, and `ansible.posix` (TBD) 4 - publish nightly So other than Quay, can we finalize: - name of the second ee? (with or without -base or something else) - final list of included collections. Seems like we don’t NEED to have the ansible.windows included so maybe we keep it out and at some point consider a third windows-focused collection? ---
**Author:** ![Leo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/leo/32/23_2.png) [@Leo](https://forum.ansible.com/u/Leo)\ **Post date:** [September 12, 2023, 4:35pm UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/15 "2023-09-12T16:35:43Z")
> [@samccann](#): > > @Leo any update here on if we can use [Quay.io](http://Quay.io)? I didn’t get any concrete replies yet, just left a message for the AWX/Controller team to see how they are interpreting the message and how it affects awx-ee. Let’s see if they are aware and what’s their take. If they don’t know I will try to reach the actual people in the ticket and seek clarification from them. ---
**Author:** ![samccann](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/samccann/32/18_2.png) [@samccann](https://forum.ansible.com/u/samccann)\ **Post date:** [September 13, 2023, 6:29pm UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/16 "2023-09-13T18:29:50Z")
Summarizing from today’s community WG meeting: - Let’s release `community-ee-minimal` as soon as we can… based on the most recent stable-2.15 core release, and assuming people can pull it from [Quay.io](http://Quay.io) w/o the need for a login, let’s use that for now. ---
**Author:** ![Andersson007](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/andersson007/32/89_2.png) [@Andersson007](https://forum.ansible.com/u/Andersson007)\ **Post date:** [September 18, 2023, 9:31am UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/17 "2023-09-18T09:31:56Z")
now `community-ee-minimal` is now available as `ghcr.io/ansible-community/community-ee-minimal:latest`. what is the goal of having it exactly on [quay.io](http://quay.io)? Let’s maybe have it on `ghcr` permanently? ---
**Author:** ![anwesha](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/anwesha/32/20_2.png) [@anwesha](https://forum.ansible.com/u/anwesha)\ **Post date:** [September 19, 2023, 10:15am UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/18 "2023-09-19T10:15:38Z")
I guess it is now time to decide on why and if we want [Quay.io](https://quay.io/) or ghcr (under `ansible-community` namespace)? What are problems that [Quay.io](https://quay.io/) is solving and ghcr is not? Folks please share your feedback and vote in here and the supportive reasons for the choice in the thread. _Poll ([view on site](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/18))_ ---
**Author:** ![sean\_sullivan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sean_sullivan/32/274_2.png) [@sean\_sullivan](https://forum.ansible.com/u/sean_sullivan)\ **Post date:** [September 19, 2023, 12:31pm UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/19 "2023-09-19T12:31:04Z")
I’d opt for [quay.io](http://quay.io) just off the dogfood principle, however I am not against [ghcr.io](http://ghcr.io). Right now people know to look for redhat related images on quay, so that makes sense, but do we have a reason to move to [ghcr.io](http://ghcr.io)? atm at least as a container registery, What are the advantages? ---
**Author:** ![ansibehl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ansibehl/32/4556_2.png) [@ansibehl](https://forum.ansible.com/u/ansibehl)\ **Post date:** [September 19, 2023, 5:22pm UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/20 "2023-09-19T17:22:40Z")
I will say an important point to raise that the creator-ee is hosted on [ghcr.io](http://ghcr.io), I am not opposed to either quay or ghcr but we should stick to one hosting platform and possibly in a single repo so its easier for users to subscribe if there are updates. EDIT: Looks like the creator-ee is duplicated between ghcr and quay but the default setting in the extension points to [ghcr.io](http://ghcr.io) ---
**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\ **Post date:** [September 20, 2023, 6:22pm UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/21 "2023-09-20T18:22:02Z")
I have no preference for ghcr vs. quay. As long as it’s not Docker Hub… 😉 Traditionally most ansible related images were on quay, but that doesn’t mean we have to use it forever. ---
**Author:** ![gotmax23](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gotmax23/32/106_2.png) [@gotmax23](https://forum.ansible.com/u/gotmax23)\ **Post date:** [September 21, 2023, 4:44am UTC](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262/22 "2023-09-21T04:44:35Z")
GHCR might be easier if we’re using Github Actions to build images, as we won’t have to deal with auth tokens and such. We could also easily push the image to both registries if we want to make it more available or just can’t decide 😉. [Next page](https://forum.ansible.com/t/community-execution-environment-image-content-and-location/262.md?page=2)