Instead of running a lot of things via the shell module, invoking chroot, I think it may be more prudent to at least temporarily start an sshd instance in the chrooted system (on a different port or possibly tunneled through the main host), then allow further plays to be executed on that sshd instance. This would also allow the user to add their roles to the playbook and allows separating out some of the more advanced features.
Instead of running a lot of things via the
shell
module, invoking chroot, I think it may be more prudent to at least temporarily start ansshd
instance in the chrooted system (on a different port or possibly tunneled through the main host), then allow further plays to be executed on that sshd instance. This would also allow the user to add their roles to the playbook and allows separating out some of the more advanced features.