docker

The docker role installs Docker CE and manages /etc/docker/daemon.json. The container roles (traefik, portainer, pulsix_manager, pulsix_worker) need it.

What it does

Adds the official Docker apt repository (signed with its key, as a deb822 source) for amd64 or arm64.
Installs docker-ce, docker-ce-cli, containerd.io, docker-buildx-plugin and docker-compose-plugin (docker_packages).
Writes daemon.json with the MTU, log driver and options, live restore, optional address pools, and any extra keys, then restarts Docker when the file changes.
Starts and enables the service, and adds docker_users to the docker group.

Key variables

Variable	Default	Meaning
`docker_mtu`	`1500`	MTU of the default bridge. Use 1450 on networks that need it, for example Hetzner private networks.
`docker_log_driver`	`local`	Default log driver.
`docker_log_opts`	`max-size: 20m`, `max-file: "5"`	Options of the log driver.
`docker_address_pools`	`[]`	`default-address-pools` entries (`base`, `size`).
`docker_live_restore`	`true`	Keep containers running while the daemon restarts.
`docker_daemon_extra`	`{}`	Further `daemon.json` keys, merged last.
`docker_users`	`[]`	Users added to the `docker` group.

All variables: docker in the reference.

Example

- hosts: servers
  become: true
  roles:
    - role: noixdev.infra.docker
      vars:
        docker_mtu: 1450
        docker_address_pools:
          - { base: 10.200.0.0/16, size: 24 }
        docker_users: [deploy]

Gotchas

Compose networks do not inherit the MTU of the default bridge. They need their own driver option. The compose projects of this collection set it from their own *_mtu variable (traefik_mtu, portainer_mtu, pulsix_manager_mtu, pulsix_worker_mtu); set them to the same value as docker_mtu.
A changed daemon.json restarts Docker. With docker_live_restore on, containers keep running; without it they restart.
Group membership applies at the next login. A user added to docker_users has to log in again before docker works without sudo. Anyone in the group has root-equivalent access to the host.
Run this role before crowdsec. CrowdSec’s bouncer decides whether to guard the DOCKER-USER chain by checking for /usr/bin/docker when it runs.