Changing users when running Molecule in Docker via GitLab CI

[chriscroome]

I'm running Molecule tests via GitLab CI in Docker containers which have an ansible user with password-less sudo and this generally works fine.

However I have a PostgreSQL role which has:

- name: PostgreSQL info
  community.postgresql.postgresql_info:
    login_user: postgres
    filter:
      - databases
      - roles
      - version
  register: postgresql_info
  become: true
  become_user: postgres

I have set:

ANSIBLE_SHELL_ALLOW_WORLD_READABLE_TEMP: "1"

For GitLab CI to get around on issue but now I have:

[WARNING]: Using world-readable permissions for temporary files Ansible needs
to create when becoming an unprivileged user. This may be insecure. For
information on securing this, see https://docs.ansible.com/ansible-
core/2.15/user_guide/become.html#risks-of-becoming-an-unprivileged-user
fatal: [localhost]: FAILED! => {"changed": false, "module_stderr": "/bin/sh: line 1: /home/ansible/.local/pipx/venvs/ansible/bin/python: Permission denied\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 126}
TASK [postgresql : PostgreSQL info] ********************************************
PLAY RECAP *********************************************************************
localhost                  : ok=11   changed=1    unreachable=0    failed=1    skipped=3    rescued=0    ignored=0
CRITICAL Ansible return code was 2, command was: ['ansible-playbook', '--inventory', '/home/ansible/.cache/molecule/postgresql/default/inventory', '--skip-tags', 'molecule-notest,notest', '/home/ansible/builds/webarch/postgresql/molecule/default/converge.yml']

Am I correct in thinking that I need to install Ansible to, for example /usr/local/bin rather than ~/.local/bin because the postgres user can't access the venv where Ansible is installed for the ansible user?

[chriscroome]

Ansible did need to be installed somewhere where the ansible user could access it, however in order to get systemd running in the container it has to run as root in any case.