| Field | Value |
|---|---|
| Readme update: | 2026-03-19 |
| Version: | v0.9.4 |
Description: hardened setup for Docker on Linux, client TLS for TCP port access to the daemon
ansible-galaxy role install rmenage.hardened_docker
---
- name: Example Usage
hosts: all
gather_facts: true # Disable if your role does not rely on facts
tasks:
- name: Update apt cache.
apt: update_cache=yes cache_valid_time=600
when: ansible_facts.os_family == 'Debian'
- name: Install docker
ansible.builtin.import_role:
name: geerlingguy.docker
vars:
docker_service_manage: true
docker_daemon_options:
log-opts:
max-size: "50m"
max-file: "3"
- name: Secure Docker with client TLS
ansible.builtin.include_role:
name: rmenage.hardened_docker
vars:
rhd_server_cert_path: /etc/docker
rhd_client_cert_path: /vagrant/docker-client-certs
rhd_host: "0.0.0.0"
rhd_secured_tcp_listener: yes
These are static variables with lower priority
| Var | Type | Value |
|---|---|---|
| rhd_restart_docker | bool | True |
| rhd_docker_restart_handler_state | str | restarted |
| rhd_secured_tcp_listener | bool | False |
| rhd_system_tmp | str | /tmp |
| rhd_country | str | XX |
| rhd_state | str | Default State |
| rhd_locality | str | Default City |
| rhd_organization | str | Default Company |
| rhd_host | str | 127.0.0.1 |
| rhd_common_name | str | {{ rhd_host }} |
| rhd_passphrase | str | changeme |
| rhd_server_cert_path | str | /etc/docker |
| rhd_client_cert_path | str | ~/.docker |
| rhd_days | int | 365 |
| rhd_ca_days | str | {{ rhd_days }} |
| rhd_server_days | str | {{ rhd_days }} |
| rhd_client_days | str | {{ rhd_days }} |
| rhd_ca_cert_subj | str | /C={{ rhd_country }}/ST={{ rhd_state }}/L={{ rhd_locality }}/O={{ rhd_organization }}/CN={{ rhd_common_name }} |
rmenage
MIT
2.15.1
- Debian: ['bookworm', 'trixie']
- EL: ['9', '10']