What the agent does
The agent reads the role's defaults and existing Molecule layout first. In geerlingguy/ansible-role-docker, defaults/main.yml sets docker_edition: 'ce', package lists for docker-ce / cli / rootless / containerd.io / buildx, docker_service_manage: true, docker_service_state: started, docker_service_enabled: true, docker_install_compose_plugin: true with docker_compose_package: docker-compose-plugin, optional legacy Compose at docker_compose_path: /usr/local/bin/docker-compose, and docker_users: []. Tasks in tasks/docker-users.yml append listed users to the docker group.
Molecule already exists at molecule/default/: molecule.yml uses the Docker driver with geerlingguy/docker-${MOLECULE_DISTRO:-rockylinux9}-ansible:latest, privileged mode and cgroup mounts; converge.yml applies the role; verify.yml currently runs docker version, systemctl is-active docker when systemd is the service manager, and docker pull hello-world, with docker run left commented because of Docker-in-Docker quirks on GitHub Actions. It does not yet assert docker_users group membership, systemctl is-enabled docker, or that docker compose version / the compose plugin works.
The agent extends verify.yml (and converge vars if needed) so a scenario that sets docker_users to a test account checks /etc/group or id for the docker group, asserts the unit is enabled when docker_service_enabled is true, and runs docker compose version when the compose plugin is installed. It keeps the existing version/service/pull checks and documents any step that must stay skipped under DinD.
It runs molecule test in the sandbox (with MOLECULE_DISTRO matching CI if the role documents one), iterates on verify failures, and opens a pull request that only touches Molecule playbooks and role defaults samples used by the scenario. It reads tasks/main.yml conditionals around docker_users | length > 0 and the compose plugin install path so verify assertions only fire when converge enabled those features. If the scenario needs a non-empty docker_users list, it sets that in molecule/default/converge.yml or a scenario vars file rather than changing role defaults for everyone.
Start it with one API call
POST https://api.prix.dev/o/{org}/sessions with this body:
{
"agent": "claude",
"input": "Add Molecule verify tests to this Ansible role that check Docker is installed, the service is running and enabled, the configured users are in the docker group and Compose works. Run molecule test in the sandbox and open a pull request.",
"resources": [
{
"url": "https://github.com/your-org/your-ansible-role"
}
]
}- Get an API key. In the console, open Settings, then API keys, and create a key for your org. Send it in the Authorization header as a Bearer token.
- Send the request. POST the body in request.json to https://api.prix.dev/o/{org}/sessions, with your repository as the resources URL. The run starts in its own cloud sandbox.
- Read what came back. Follow the run on its live stream or wait for the run.completed webhook, then read the result and its trajectory.
What comes back
What comes back is a pull request updating molecule/default/verify.yml and, if required, converge.yml or scenario vars to exercise docker_users and Compose. Role task files under tasks/ stay unchanged unless a clear bug blocks verification.
The pull request description names the molecule test command and distro image used, and calls out any assertion still skipped under Docker-in-Docker. The trajectory stores molecule's create/converge/verify/destroy logs for review.
Before merging, a reviewer checks that verify tasks use changed_when: false where appropriate, that group checks match tasks/docker-users.yml, and that CI's Molecule workflow still passes on the distros the role claims to support.
Run it on every role tasks or defaults changed
When a pull request edits tasks/*.yml or defaults/main.yml, POST this session request so verify coverage tracks new options (edition, rootless, compose plugin) in an isolated privileged sandbox.
Send Rush run.completed webhooks to your Ansible channel with the session URL. Queue runs when you exceed the key's max_concurrent limit; privileged Molecule containers are not something to overlap carelessly on one host key.
The use case this job follows, with its automation and trigger: Write the missing tests.
Why run it on Rush?
Molecule for this role needs a privileged Docker-backed instance and a full converge. That is heavy and slow on a laptop, and easy to leave half-destroyed. Rush gives the agent a sandbox where molecule test can create, converge, verify and destroy without touching your local Docker contexts. Galaxy metadata under meta/ is left alone; the pull request is about verify strength, not role packaging.
The pull request proves behaviour with verify asserts, not just "converge exited 0". Reviewers see group and Compose checks next to the existing hello-world pull, and several distros can be covered as separate runs.
Frequently asked questions
Does it replace my existing verify.yml?
It extends it. The docker version, active service and hello-world pull stay; enabled state, docker_users and Compose checks are added. Commented DinD-unsafe steps stay commented unless the sandbox can run them safely.
Which distro image is used?
The one in molecule/default/molecule.yml: geerlingguy/docker-${MOLECULE_DISTRO:-rockylinux9}-ansible:latest unless you set MOLECULE_DISTRO in the prompt. The agent records the value it used in the pull request.
Will it modify tasks/main.yml?
Only if verify cannot pass without fixing a real bug in the role. The default job is test-only; production task changes are called out explicitly in the pull request body.
How does it test Compose?
By asserting the compose plugin or binary the role installs (docker compose version or docker-compose at docker_compose_path) after converge with docker_install_compose_plugin enabled, matching defaults/main.yml.