Ansible on Ubuntu 26.04 — What Changed

Introduction

Ubuntu 26.04 LTS "Resolute Raccoon" ships changes that directly affect how Ansible manages Ubuntu hosts. The headline: sudo-rs is now the default sudo provider — a full Rust rewrite of the binary that handles every privilege escalation on your fleet. If you run Ansible with become: true (and you do), this matters. This article covers what changed, what breaks, what doesn't, and how to update your playbooks and base images.

What Changed in Ubuntu 26.04 LTS

Change	Impact on Ansible
sudo-rs replaces sudo (C)	`become_method: sudo` works unchanged — same `/etc/sudoers` format
Kernel 7.0	Intel TDX confidential computing, broader hardware support
APT 3.2 with transaction rollback	New `apt history-rollback` command; `ansible.builtin.apt` works as before
Wayland-only (X11 removed)	No impact on headless servers; affects desktop automation
ROCm in official repos	`apt install rocm` — AMD GPU compute is a one-liner
Ptyxis replaces GNOME Terminal	Desktop only — no server impact
LTS until 2031	5 years standard, 10 years with Ubuntu Pro

sudo-rs: Why It Matters

sudo is the binary that runs as root on every Linux machine you manage. The original C implementation dates to 1980 and has had critical CVEs — most notably Baron Samedit (CVE-2021-3156) in 2021, which allowed local privilege escalation and had been exploitable for over 10 years across most Linux distros.

sudo-rs is a complete rewrite in Rust:

Same /etc/sudoers config — your existing sudoers files work
Same CLI interface — sudo, visudo, sudoedit all behave identically
Drop-in replacement — Ansible's become_method: sudo requires zero changes
Memory safety — Rust's ownership model eliminates the class of bugs that caused Baron Samedit
Audited — passed a full security audit in 2023; the sudo-rs team collaborated with the original sudo maintainer

Ubuntu 26.04 making sudo-rs the default is the signal it's production-ready.

Verify sudo-rs on Your Fleet

---
- name: Verify sudo-rs on Ubuntu 26.04
  hosts: ubuntu_2604
  become: true
  tasks:
    - name: Check sudo version
      ansible.builtin.command: sudo --version
      register: sudo_version
      changed_when: false

    - name: Display sudo implementation
      ansible.builtin.debug:
        msg: >-
          {% if 'sudo-rs' in sudo_version.stdout %}
          ✅ sudo-rs (Rust) — {{ sudo_version.stdout_lines[0] }}
          {% else %}
          ⚠️ Original sudo (C) — {{ sudo_version.stdout_lines[0] }}
          {% endif %}

    - name: Verify sudoers syntax is valid
      ansible.builtin.command: visudo -c
      register: sudoers_check
      changed_when: false
      failed_when: sudoers_check.rc != 0

Ansible Privilege Escalation — No Changes Needed

# This works identically on sudo-rs and original sudo
- name: Install packages
  hosts: webservers
  become: true                    # Uses sudo-rs transparently
  become_method: sudo             # Default — same as before
  tasks:
    - name: Install nginx
      ansible.builtin.apt:
        name: nginx
        state: present

sudo-rs reads the same /etc/sudoers and /etc/sudoers.d/ files. Your NOPASSWD rules, user aliases, and command restrictions all carry over.

APT 3.2: Transaction Rollback

APT 3.2 introduces a transaction log with full rollback capability — apt history-rollback undoes any package operation. This is significant for Ansible fleet management.

How It Works

# View transaction history
apt history list

# Rollback the last transaction
apt history-rollback last

# Rollback a specific transaction
apt history-rollback 42

Ansible Playbook for Safe Package Updates with Rollback

---
- name: Safe package update with rollback capability
  hosts: ubuntu_2604
  become: true
  vars:
    rollback_on_failure: true
  tasks:
    - name: Record APT transaction ID before update
      ansible.builtin.shell: |
        apt history list --json 2>/dev/null | python3 -c "
        import sys, json
        data = json.load(sys.stdin)
        print(data[0]['id'] if data else 0)
        "
      register: pre_update_id
      changed_when: false

    - name: Update all packages
      ansible.builtin.apt:
        upgrade: safe
        update_cache: true
        cache_valid_time: 3600
      register: apt_result

    - name: Run post-update validation
      ansible.builtin.command: systemctl is-system-running
      register: system_health
      changed_when: false
      failed_when: false

    - name: Rollback if system is degraded
      ansible.builtin.command: apt history-rollback {{ pre_update_id.stdout | int + 1 }}
      when:
        - rollback_on_failure
        - system_health.stdout != 'running'
        - apt_result.changed
      register: rollback_result

    - name: Report rollback
      ansible.builtin.debug:
        msg: "⚠️ Rolled back package update on {{ inventory_hostname }}"
      when: rollback_result is defined and rollback_result.changed

Upgrade from 24.04 to 26.04

---
- name: Upgrade Ubuntu 24.04 to 26.04 LTS
  hosts: ubuntu_2404
  become: true
  serial: 1                        # One host at a time
  tasks:
    - name: Verify current version
      ansible.builtin.assert:
        that:
          - ansible_distribution == 'Ubuntu'
          - ansible_distribution_version == '24.04'
        fail_msg: "Host is not Ubuntu 24.04"

    - name: Update all current packages
      ansible.builtin.apt:
        upgrade: dist
        update_cache: true

    - name: Install update-manager-core
      ansible.builtin.apt:
        name: update-manager-core
        state: present

    - name: Run do-release-upgrade
      ansible.builtin.command: do-release-upgrade -f DistUpgradeViewNonInteractive
      register: upgrade_result
      async: 3600
      poll: 60

    - name: Reboot after upgrade
      ansible.builtin.reboot:
        reboot_timeout: 600

    - name: Verify upgrade
      ansible.builtin.assert:
        that:
          - ansible_distribution_version == '26.04'
        fail_msg: "Upgrade failed — still on {{ ansible_distribution_version }}"

    - name: Verify sudo-rs is active
      ansible.builtin.command: sudo --version
      register: sudo_check
      changed_when: false

    - name: Display post-upgrade status
      ansible.builtin.debug:
        msg: |
          ✅ {{ inventory_hostname }} upgraded to Ubuntu {{ ansible_distribution_version }}
          sudo: {{ sudo_check.stdout_lines[0] }}

Install Ansible on Ubuntu 26.04

Via APT (System Package)

# Ubuntu 26.04 ships ansible-core in universe
sudo apt update
sudo apt install ansible-core

# Verify
ansible --version

Via pip (Latest Version)

# Install in a virtual environment (recommended)
sudo apt install python3-venv python3-pip
python3 -m venv ~/ansible-venv
source ~/ansible-venv/bin/activate
pip install ansible

ansible --version

Via PPA (Ansible Team)

sudo apt-add-repository ppa:ansible/ansible
sudo apt update
sudo apt install ansible

Ansible Playbook: Bootstrap Ubuntu 26.04

---
- name: Bootstrap Ubuntu 26.04 for Ansible management
  hosts: new_ubuntu_hosts
  become: true
  gather_facts: true
  tasks:
    - name: Verify Ubuntu 26.04
      ansible.builtin.assert:
        that: ansible_distribution_version == '26.04'

    - name: Update package cache
      ansible.builtin.apt:
        update_cache: true
        cache_valid_time: 3600

    - name: Install essential packages
      ansible.builtin.apt:
        name:
          - python3
          - python3-apt
          - openssh-server
          - ca-certificates
          - curl
          - gnupg
        state: present

    - name: Create ansible user
      ansible.builtin.user:
        name: ansible
        groups: sudo
        shell: /bin/bash
        create_home: true
        system: true

    - name: Configure passwordless sudo for ansible user
      ansible.builtin.copy:
        dest: /etc/sudoers.d/ansible
        content: "ansible ALL=(ALL) NOPASSWD: ALL\n"
        mode: '0440'
        validate: 'visudo -cf %s'

    - name: Deploy SSH authorized key
      ansible.posix.authorized_key:
        user: ansible
        key: "{{ lookup('file', '~/.ssh/id_ed25519.pub') }}"
        state: present

Playbook workflow

Generate a complete playbook from this tutorial

Use Ansible on Ubuntu 26.04 — What Changed as the starting context and generate an editable Ansible playbook in the playground.

One anonymous generation is available. Do not paste passwords, private keys, tokens, or customer secrets.

Generate a playbook

Kernel 7.0 — What Matters for Automation

Feature	Ansible Relevance
Intel TDX	Confidential VMs — facts may show `tdx_guest: true`
Broader hardware support	Fewer driver issues on newer servers
io_uring improvements	Better async I/O for high-throughput tasks
cgroup v2 only	`ansible_cgroup_version` will always be `v2`

ROCm in Official Repos

AMD GPU compute is now a one-liner on Ubuntu 26.04:

- name: Install ROCm for AMD GPU compute
  ansible.builtin.apt:
    name: rocm
    state: present
  when: "'amdgpu' in ansible_facts.devices | default({})"

Previously, ROCm required adding third-party repos and managing complex dependencies. Now it's a standard package.

Wayland-Only — Desktop Automation Impact

Ubuntu 26.04 fully removes X11 — no more Xorg fallback session in GDM. For headless servers (the majority of Ansible-managed hosts), this has zero impact.

For desktop automation using Ansible:

# X11-based tools no longer work
# ❌ xdotool, xclip, xrandr
# ✅ Use Wayland equivalents
- name: Install Wayland-compatible tools
  ansible.builtin.apt:
    name:
      - wl-clipboard       # Replaces xclip
      - wlr-randr           # Replaces xrandr
    state: present
  when: ansible_env.XDG_SESSION_TYPE | default('') == 'wayland'

Base Image Hardening Checklist

If you're building hardened Ubuntu 26.04 base images for your fleet, validate these two things first:

1. sudo-rs Configuration

- name: Harden sudo-rs configuration
  ansible.builtin.copy:
    dest: /etc/sudoers.d/hardening
    content: |
      # Require password for non-ansible users
      Defaults timestamp_timeout=5
      Defaults passwd_tries=3
      Defaults logfile=/var/log/sudo.log
      Defaults log_input,log_output
      # Ansible service account
      ansible ALL=(ALL) NOPASSWD: ALL
    mode: '0440'
    validate: 'visudo -cf %s'

2. APT Rollback Validation

- name: Verify APT rollback capability
  block:
    - name: Install test package
      ansible.builtin.apt:
        name: cowsay
        state: present

    - name: Verify installation
      ansible.builtin.command: which cowsay
      changed_when: false

    - name: Rollback test installation
      ansible.builtin.command: apt history-rollback last -y

    - name: Verify rollback
      ansible.builtin.command: which cowsay
      register: rollback_check
      failed_when: rollback_check.rc == 0
      changed_when: false

    - name: Rollback works
      ansible.builtin.debug:
        msg: "✅ APT rollback verified on {{ inventory_hostname }}"

Version Comparison

Feature	Ubuntu 24.04 LTS	Ubuntu 26.04 LTS
Kernel	6.8	7.0
sudo	sudo (C)	sudo-rs (Rust)
APT	2.7	3.2 (rollback)
Python	3.12	3.14
Display	X11 + Wayland	Wayland only
ROCm	Third-party repo	Official repo
Terminal	GNOME Terminal	Ptyxis
Support	Until 2029 (2034 Pro)	Until 2031 (2036 Pro)
cgroups	v1 + v2	v2 only

Conclusion

Ubuntu 26.04 LTS brings two changes that matter for Ansible fleet management: sudo-rs as the default privilege escalation binary (same config, same interface, memory-safe Rust rewrite) and APT 3.2 with transaction rollback (undo any package operation). Your existing Ansible playbooks with become: true work unchanged — sudo-rs is a drop-in replacement. The APT rollback capability enables safer automated patching with built-in undo. Validate both on your base images before rolling out to your fleet.