# Delegate via remote host

**URL:** <https://forum.ansible.com/t/delegate-via-remote-host/19575>\
**Category:** Ansible Project\
**Created:** [October 21, 2015, 12:36pm UTC](https://forum.ansible.com/t/delegate-via-remote-host/19575 "2015-10-21T12:36:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thomas\_Steinbach](https://avatars.discourse-cdn.com/v4/letter/t/df788c/32.png) [@Thomas\_Steinbach](https://forum.ansible.com/u/Thomas_Steinbach)\
**Post date:** [October 21, 2015, 12:36pm UTC](https://forum.ansible.com/t/delegate-via-remote-host/19575/1 "2015-10-21T12:36:10Z")

</div>

Is it possible to delegate a role/task to a remote hosts remote host? An example:

On a remote host (e.g. testserver) I have created a docker container. The containers IP is known on the testserver and he is accessible just from the testservers private docker network. Now I want to execute a role inside the testservers docker container. But without making the docker container public accessible. So I want to delegate the role execution via the remote testserver to the remote docker container.

Is this possible with Ansible? And if not, would that be a good feature?

Greetings - Thomas

---

<div class="post-metadata">

**Author:** ![Vikas\_Kumar](https://avatars.discourse-cdn.com/v4/letter/v/ecb155/32.png) [@Vikas\_Kumar](https://forum.ansible.com/u/Vikas_Kumar)\
**Post date:** [October 22, 2015, 2:37am UTC](https://forum.ansible.com/t/delegate-via-remote-host/19575/2 "2015-10-22T02:37:59Z")

</div>

Hi Thomas,

You have something called **delgate\_to** to do this.

`

- shell: echo hello  
delegate\_to: [abc.server.com](http://abc.server.com)  
`

So basically if your playbook is running on a particular host (or set of hosts), above task will run on [abc.server.com](http://abc.server.com).

Regards,  
Vikas

---

<div class="post-metadata">

**Author:** ![Thomas\_Steinbach](https://avatars.discourse-cdn.com/v4/letter/t/df788c/32.png) [@Thomas\_Steinbach](https://forum.ansible.com/u/Thomas_Steinbach)\
**Post date:** [October 22, 2015, 11:56am UTC](https://forum.ansible.com/t/delegate-via-remote-host/19575/3 "2015-10-22T11:56:26Z")

</div>

Hi Vikas,

**delegate\_to** won’t do the trick, because it would delegate the role/tasks from the control machine to [abc.server.com](http://abc.server.com). Imagine [abc.server.com](http://abc.server.com) is just visible within the private network of [main.server.com](http://main.server.com) which is accessible from the outside. So I want to delegate the role/tasks from my private laptop via [main.server.com](http://main.server.com) to the [abc.server.com](http://abc.server.com) without **delegate\_to** [abc.server.com](http://abc.server.com) directly.

---

<div class="post-metadata">

**Author:** ![Thomas\_Steinbach](https://avatars.discourse-cdn.com/v4/letter/t/df788c/32.png) [@Thomas\_Steinbach](https://forum.ansible.com/u/Thomas_Steinbach)\
**Post date:** [October 22, 2015, 12:00pm UTC](https://forum.ansible.com/t/delegate-via-remote-host/19575/4 "2015-10-22T12:00:03Z")

</div>

I have got the solution - port forwarding will do the trick. Here are the parts of my playbook:

`

- name: prepare docker container for roles  
hosts: [test.server.org](http://test.server.org)

tasks:

…

- name: create client container  
sudo: yes  
docker:  
image: my\_ssh\_container  
name: test\_container  
detach: False  
state: running

- name: create connection string  
set\_fact:  
connection\_command: “ssh -p {{ ansible\_ssh\_port }} -f -N -L 3456:{{ docker\_containers[0].NetworkSettings.IPAddress }}:22 {{ ansible\_ssh\_user}}@{{ ansible\_ssh\_host }}”

- name: create local port forwarding to remote docker container  
command: “{{ connection\_command }}”  
delegate\_to: localhost

- name: run roles inside the client container  
hosts: docker\_container\_tunnel

# SET VARIABLE HERE!

roles:

- { role: thomass.java }

- name: quit ssh tunnel  
hosts: [test.server.org](http://test.server.org)  
tasks:

- name: recreate connection string  
set\_fact:  
connection\_command: “ssh -p {{ ansible\_ssh\_port }} -f -N -L 3456:{{ docker\_containers[0].NetworkSettings.IPAddress }}:22 {{ ansible\_ssh\_user}}@{{ ansible\_ssh\_host }}”

- name: destroy local port forwarding to remote docker container  
command: “pkill -f "{{ connection\_command }}"”  
delegate\_to: localhost

`