Compare commits
2 commits
8cd887ee21
...
5d11468327
Author | SHA1 | Date | |
---|---|---|---|
Ludovic Poujol | 5d11468327 | ||
Ludovic Poujol | a41e78b556 |
|
@ -40,6 +40,8 @@ The **patch** part is incremented if multiple releases happen the same month
|
|||
|
||||
### Removed
|
||||
|
||||
* docker-host: Removed setting docker_conf_use_iptables (iptable usage forced to true)
|
||||
|
||||
### Security
|
||||
|
||||
## [24.03] 2024-03-01
|
||||
|
|
|
@ -3,28 +3,25 @@
|
|||
docker_home: /var/lib/docker
|
||||
docker_tmpdir: "{{ docker_home }}/tmp"
|
||||
|
||||
# Chose to use iptables instead of docker-proxy userland process
|
||||
docker_conf_use_iptables: False
|
||||
|
||||
# Disable the possibility for containers processes to gain new privileges
|
||||
docker_conf_no_newprivileges: False
|
||||
docker_conf_no_newprivileges: false
|
||||
|
||||
# Toggle live restore (need to be disabled in swarm mode)
|
||||
docker_conf_live_restore: True
|
||||
docker_conf_live_restore: true
|
||||
|
||||
# Toggle user namespace
|
||||
docker_conf_user_namespace: True
|
||||
docker_conf_user_namespace: true
|
||||
|
||||
# Disable all default network connectivity
|
||||
docker_conf_disable_default_networking: False
|
||||
docker_conf_disable_default_networking: false
|
||||
|
||||
# Remote access
|
||||
docker_remote_access_enabled: False
|
||||
docker_remote_access_enabled: false
|
||||
docker_daemon_port: 2376
|
||||
docker_daemon_listening_ip: 0.0.0.0
|
||||
|
||||
# TLS
|
||||
docker_tls_enabled: False
|
||||
docker_tls_enabled: false
|
||||
docker_tls_path: "{{ docker_home }}/tls"
|
||||
docker_tls_ca: ca/ca.pem
|
||||
docker_tls_ca_key: ca/ca-key.pem
|
||||
|
@ -32,4 +29,4 @@ docker_tls_cert: server/cert.pem
|
|||
docker_tls_key: server/key.pem
|
||||
docker_tls_csr: server/server.csr
|
||||
|
||||
apt_keyring_dir: "{{ ansible_distribution_major_version is version('12', '<') | ternary('/etc/apt/trusted.gpg.d', '/etc/apt/keyrings') }}"
|
||||
apt_keyring_dir: "{{ ansible_distribution_major_version is version('12', '<') | ternary('/etc/apt/trusted.gpg.d', '/etc/apt/keyrings') }}"
|
||||
|
|
|
@ -1,5 +1,14 @@
|
|||
# This role installs the docker daemon
|
||||
---
|
||||
|
||||
- name: Fail if docker_conf_use_iptables is defined
|
||||
ansible.builtin.fail:
|
||||
msg: "Variable docker_conf_use_iptables is deprecated and not configurable anymore. Please remove it from your variables. Also double-check the daemon.json config for docker"
|
||||
when:
|
||||
- docker_conf_use_iptables is defined
|
||||
tags:
|
||||
- always
|
||||
|
||||
- name: Remove older docker packages
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
|
@ -23,7 +32,7 @@
|
|||
when: ansible_distribution_major_version is version('10', '<')
|
||||
|
||||
- name: "Ensure {{ apt_keyring_dir }} directory exists"
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: "{{ apt_keyring_dir }}"
|
||||
state: directory
|
||||
mode: "755"
|
||||
|
@ -44,35 +53,34 @@
|
|||
repo: 'deb [signed-by={{ apt_keyring_dir }}/docker-debian.asc] https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable'
|
||||
filename: docker
|
||||
state: present
|
||||
update_cache: yes
|
||||
update_cache: true
|
||||
when: ansible_distribution_major_version is version('12', '<')
|
||||
|
||||
- name: Add Docker repository (Debian >=12)
|
||||
ansible.builtin.template:
|
||||
src: docker.sources.j2
|
||||
dest: /etc/apt/sources.list.d/docker.sources
|
||||
register: docker_sources
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when: ansible_distribution_major_version is version('12', '>=')
|
||||
|
||||
- name: Update APT cache
|
||||
ansible.builtin.apt:
|
||||
update_cache: yes
|
||||
when: docker_sources is changed
|
||||
|
||||
- name: Install Docker
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
update_cache: true
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: python-docker is installed
|
||||
- name: Package python-docker is installed
|
||||
ansible.builtin.apt:
|
||||
name: python-docker
|
||||
state: present
|
||||
when: ansible_python_version is version('3', '<')
|
||||
|
||||
- name: python3-docker is installed
|
||||
- name: Package python3-docker is installed
|
||||
ansible.builtin.apt:
|
||||
name: python3-docker
|
||||
state: present
|
||||
|
@ -82,6 +90,9 @@
|
|||
ansible.builtin.template:
|
||||
src: daemon.json.j2
|
||||
dest: /etc/docker/daemon.json
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify: restart docker
|
||||
|
||||
- name: Creating Docker tmp directory
|
||||
|
|
|
@ -1,5 +1,6 @@
|
|||
{
|
||||
"debug": false
|
||||
,"iptables": true
|
||||
{# Docker data-dir (default to /var/lib/docker) #}
|
||||
,"data-root": "{{ docker_home }}"
|
||||
{# Keep containers running while docker daemon downtime #}
|
||||
|
@ -7,11 +8,6 @@
|
|||
{% if docker_conf_user_namespace %}
|
||||
{# Turn on user namespace remaping #}
|
||||
,"userns-remap": "default"
|
||||
{% endif %}
|
||||
{% if docker_conf_use_iptables %}
|
||||
{# Use iptables instead of docker-proxy #}
|
||||
,"userland-proxy": false
|
||||
,"iptables": true
|
||||
{% endif %}
|
||||
{# Disable the possibility for containers processes to gain new privileges #}
|
||||
,"no-new-privileges": {{ docker_conf_no_newprivileges | to_json }}
|
||||
|
|
Loading…
Reference in a new issue