How can I conditionally select a host-specific ansible_python_interpreter without causing recursion?

I encountered an issue where my Ansible plays failed due to a RedHat backported CVE patch that was incompatible with the python docker-py library via requests. The fix (introduced in docker-py 7.1.0) requires Python 3.8, but upgrading our system Python isn’t an option since we rely on selinux, which is only supported on Python 3.6.

I needed different Python instances for different tasks. For tasks requiring the custom interpreter (e.g., within a Docker-related task), I specified the interpreter like this:

YAMLCopied
- name: Fetch image info for preexisting copy of {{ fully_qualified_image }}
  community.docker.docker_image_info:
    name: "{{ fully_qualified_image }}"
  register: preexisting_image_info
  failed_when: false
  vars:
    # ansible_python_interpreter_docker points to a python venv containing the necessary
    # docker lib
    ansible_python_interpreter: "{{ ansible_python_interpreter_docker }}"

However, not all hosts require a special interpreter; some should use the default. I attempted to set this in group_vars/all/vars.yml:

YAMLCopied
ansible_python_interpreter_docker: "{{ ansible_python_interpreter }}"

This works for hosts that need the custom interpreter, but for others it creates an infinite recursion:

YAMLCopied
...
Error was a <class 'ansible.errors.AnsibleError'>, original message: An unhandled exception occurred while templating '{{ ansible_python_interpreter }}'.
Error was a <class 'ansible.errors.AnsibleError'>, original message: An unhandled exception occurred while templating '{{ ansible_python_interpreter_docker }}'.
Error was a <class 'ansible.errors.AnsibleError'>, original message: recursive loop detected in template string: {{ ansible_python_interpreter_docker }}

I then tested a workaround with a play that conditionally chooses the interpreter based on the existence of the docker-specific variable:

YAMLCopied
---
- hosts: host-with-system-docker,host-with-venv-docker
  gather_facts: true

  tasks:
  - block:
    - name: do a docker thing with system python
      debug:
        msg: "{{ ansible_python_interpreter }}"
      when: ansible_python_interpreter_docker is not defined
    - name: do a docker thing with docker specific python
      debug:
        msg: "{{ ansible_python_interpreter }}"
      vars:
        ansible_python_interpreter: "{{ ansible_python_interpreter_docker }}"
      when: ansible_python_interpreter_docker is defined
  - debug:
      msg: "YAY"

But I feel there must be a cleaner approach. As an update, following @β.εηοιτ.βε's suggestion, I tried using the omit filter:

YAMLCopied
---
- hosts: host-with-system-docker,host-with-venv-docker
  gather_facts: true

  tasks:
  - block:
    - name: dont override at all
      debug:
        msg: "{{ ansible_python_interpreter }}"

    - name: use omit
      debug:
        msg: "{{ ansible_python_interpreter }}"
      vars:
        ansible_python_interpreter: "{{ ansible_python_interpreter_docker | default(omit) }}"

This resulted in a strange outcome:

BASHCopied
TASK [dont override at all] ****************************************************************************************************************************************************************************************************************************************************************************
Monday 27 January 2025  10:18:24 -0500 (0:00:02.976)       0:00:03.062 ********
ok: [host-with-venv-docker] => {
    "msg": "/usr/bin/python3"
}
ok: [host-with-system-docker] => {
    "msg": "/home/ltheisen/.ansible-venvs/d58c1d218f1f70fa8eedf52a851e15d9/bin/python"
}

TASK [use omit] ****************************************************************************************************************************************************************************************************************************************************************************************
Monday 27 January 2025  10:18:24 -0500 (0:00:00.071)       0:00:03.134 ********
ok: [host-with-venv-docker] => {
    "msg": "/usr/local/lib/ansible/python3.8-venv-docker/bin/python"
}
ok: [host-with-system-docker] => {
    "msg": "Hello world!"
}

I'm looking for a cleaner solution that avoids recursion and correctly selects the proper interpreter for each host. The accepted answer suggests defining a separate variable (or early set_fact) to avoid circular references; only define ansible_python_interpreter_docker for hosts that require the custom interpreter and then use a default filter in tasks.

Any advice or better approaches to handle this conditional interpreter selection?