Docker* connection plugins: add working_dir and privileged options (#943)

* Add working_dir option.

* Add privileged option.

* Add basic tests.

* Also test privileged.

plugins/connection/docker.py

@@ -92,6 +92,33 @@ options:
           - name: ansible_docker_extra_env
         type: dict
         version_added: 3.12.0
+    working_dir:
+        description:
+          - The directory inside the container to run commands in.
+          - Requires Docker CLI version 18.06 or later.
+        env:
+          - name: ANSIBLE_DOCKER_WORKING_DIR
+        ini:
+          - key: working_dir
+            section: docker_connection
+        vars:
+          - name: ansible_docker_working_dir
+        type: string
+        version_added: 3.12.0
+    privileged:
+        description:
+          - Whether commands should be run with extended privileges.
+          - B(Note) that this allows command to potentially break out of the container. Use with care!
+        env:
+          - name: ANSIBLE_DOCKER_PRIVILEGED
+        ini:
+          - key: privileged
+            section: docker_connection
+        vars:
+          - name: ansible_docker_privileged
+        type: boolean
+        default: false
+        version_added: 3.12.0
 '''
 
 import fcntl
@@ -239,6 +266,18 @@ class Connection(ConnectionBase):
                         )
                 local_cmd += [b'-e', b'%s=%s' % (to_bytes(k, errors='surrogate_or_strict'), to_bytes(v, errors='surrogate_or_strict'))]
 
+        if self.get_option('working_dir') is not None:
+            local_cmd += [b'-w', to_bytes(self.get_option('working_dir'), errors='surrogate_or_strict')]
+            if self.docker_version != u'dev' and LooseVersion(self.docker_version) < LooseVersion(u'18.06'):
+                # https://github.com/docker/cli/pull/732, first appeared in release 18.06.0
+                raise AnsibleConnectionFailure(
+                    'Providing the working directory requires Docker CLI version 18.06 or newer. You have Docker CLI version {0}.'
+                    .format(self.docker_version)
+                )
+
+        if self.get_option('privileged'):
+            local_cmd += [b'--privileged']
+
         # -i is needed to keep stdin open which allows pipelining to work
         local_cmd += [b'-i', self.get_option('remote_addr')] + cmd