From d3a70eca24db49ce1ab06fcd90982f730944bf0d Mon Sep 17 00:00:00 2001
From: Lino Schmidt <linoschmidt@lino3d.de>
Date: Wed, 21 Oct 2026 19:17:23 +0200
Subject: [PATCH] phpcheck: fall back to sudo for docker automatically

---
 README.md              |  8 +-------
 playbooks/phpcheck.yml | 41 ++++++++++++++++++++++++++++++++---------
 2 files changed, 33 insertions(+), 16 deletions(-)

diff --git a/README.md b/README.md
index 9757073..4da8edb 100644
--- a/README.md
+++ b/README.md
@@ -20,18 +20,12 @@ run a playbook with sudo:
 ansible-playbook playbooks/<playbook_name>.yml -K
 ```
 
-check PHP versions on hosts and in running Docker containers:
+check PHP versions on hosts and in running Docker containers (falls back to sudo for Docker if needed, add `-K` if sudo requires a password):
 
 ```bash
 ansible-playbook playbooks/phpcheck.yml
 ```
 
-with sudo (e.g. if the user is not in the docker group):
-
-```bash
-ansible-playbook playbooks/phpcheck.yml -K -e phpcheck_become=true
-```
-
 ## WSL Setup Instructions
 
 To use Ansible on Windows, you need to set up Windows Subsystem for Linux (WSL).
diff --git a/playbooks/phpcheck.yml b/playbooks/phpcheck.yml
index 01a1c16..88ae41a 100644
--- a/playbooks/phpcheck.yml
+++ b/playbooks/phpcheck.yml
@@ -2,9 +2,8 @@
 - name: Check PHP versions
   hosts: all
   gather_facts: false
-  become: "{{ phpcheck_become }}"
+  become: false
   vars:
-    phpcheck_become: false
     phpcheck_oldest_branch: "8.2"
     phpcheck_min_versions:
       "8.2": "8.2.35"
@@ -32,14 +31,30 @@
       failed_when: false
       when: phpcheck_docker.rc == 0
 
+    - name: List running containers with sudo
+      ansible.builtin.command: docker ps --format '{% raw %}{{.Names}}{% endraw %}'
+      become: true
+      register: phpcheck_containers_sudo
+      changed_when: false
+      ignore_errors: true
+      when:
+        - phpcheck_docker.rc == 0
+        - phpcheck_containers.rc != 0
+        - phpcheck_containers.stderr is search('permission denied|docker\.sock|docker daemon', ignorecase=true)
+
+    - name: Select container list
+      ansible.builtin.set_fact:
+        phpcheck_use_become: "{{ phpcheck_containers_sudo is not skipped }}"
+        phpcheck_list: "{{ phpcheck_containers_sudo if phpcheck_containers_sudo is not skipped else phpcheck_containers }}"
+
     - name: Get container PHP versions
       ansible.builtin.command:
         argv: [docker, exec, "{{ item }}", php, -r, "echo PHP_VERSION;"]
-      loop: "{{ phpcheck_containers.stdout_lines | default([]) }}"
+      become: "{{ phpcheck_use_become }}"
+      loop: "{{ phpcheck_list.stdout_lines | default([]) if phpcheck_list.rc | default(1) == 0 else [] }}"
       register: phpcheck_container_php
       changed_when: false
       failed_when: false
-      when: phpcheck_containers.rc | default(1) == 0
 
     - name: Evaluate PHP versions
       ansible.builtin.set_fact:
@@ -61,8 +76,16 @@
 
     - name: Print PHP versions
       ansible.builtin.debug:
-        msg: >-
-          {{ phpcheck_report
-             + (['docker: not installed'] if phpcheck_docker.rc != 0 else [])
-             + (['docker: not accessible (' ~ phpcheck_containers.stderr | default('') | trim ~ ')']
-                if phpcheck_docker.rc == 0 and phpcheck_containers.rc | default(0) != 0 else []) }}
+        msg: "{{ phpcheck_report + ([phpcheck_docker_line] if phpcheck_docker_line else []) }}"
+      vars:
+        phpcheck_sudo_msg: "{{ phpcheck_list.msg | default('') if phpcheck_list is failed else '' }}"
+        phpcheck_need_k: "{{ phpcheck_sudo_msg is search('password is required|terminal is required|missing sudo password', ignorecase=true) }}"
+        phpcheck_wrong_pw: "{{ phpcheck_sudo_msg is search('incorrect|sorry, try again|duplicate become password', ignorecase=true) }}"
+        phpcheck_docker_line: >-
+          {{ 'docker: not installed' if phpcheck_docker.rc != 0
+             else 'docker: no access, run with -K' if phpcheck_need_k
+             else 'docker: no access, wrong sudo password' if phpcheck_wrong_pw
+             else 'docker: error (' ~ (phpcheck_list.stderr | default('', true) or phpcheck_sudo_msg) | trim ~ ')'
+                  if phpcheck_list.rc | default(1) != 0
+             else 'docker: no running containers' if phpcheck_list.stdout_lines | default([]) | length == 0
+             else '' }}