ansible-role-docker VS ansible-role-security

In this case, yeah sure, go ahead. Looks fine. But is the package really not available at all or rather called differently? (from my perspective packages named equally across a wide range of distros / package managers aren't to common) In the later case you would / could load a var file with a variable which contains distro-specific package names for Redhat and just reference the variable in your install task. (see for example https://github.com/geerlingguy/ansible-role-docker/blob/master/tasks/main.yml#L2 and https://github.com/geerlingguy/ansible-role-docker/tree/master/vars)

To install docker, there's multiple examples to find, I'd start with this role : https://github.com/geerlingguy/ansible-role-docker

You might want to check out https://github.com/geerlingguy/ansible-role-docker

before writing a playbook, check for an existing role to do the work for you

This might not be the answer you're looking for, but geerlingguy.docker is pretty good

I mark bugs, security-related issues, and planned features with appropriate labels, and the stale bot ignores those: https://github.com/geerlingguy/ansible-role-docker/blob/mast...

Not all maintainers do the same. And some even _lock issues_, which I hate, because even closed issues can have a very fruitful discussion long after the issue was originally posted.

As a teaching example, installing your own docker this way might be good.But it would be better to install using a role. One you design yourself, or even better use an existing role like geerlingguy.docker.

I use ansible to setup the docker VMs after provisioning (https://github.com/geerlingguy/ansible-role-docker)

PS. As a slight sidenote, I just wanted to thank you for your (many!) Ansible roles - today I was able to run Docker in Ansible in my side project because of your docker ansible role to investigate Opensearch. Just wanted to say thanks you very much

My playbook is only doing some software installation (openzfs, ...) and some SSH configuration (something really similar to jeff geerling : https://github.com/geerlingguy/ansible-role-security ), and it works perfectly without the tasks where I create groups and add user to these groups.

I suggest these resources: - Some fundamentals: https://www.cyberciti.biz/tips/linux-security.html - One of the best imho ( exhaustive list ): https://github.com/imthenachoman/How-To-Secure-A-Linux-Server - Ansible playbook to harden security by Jeff Geerling: https://github.com/geerlingguy/ansible-role-security - OAWSP Check list ( targeted for web apps... and honestly a bit overkill ): https://github.com/0xRadi/OWASP-Web-Checklist

THAT all being said. Check out this: https://github.com/geerlingguy/ansible-role-security. YOu can see everything Jeff Does. My guy is a mad genious :).

Solid advice, most of it is now covered by GeerlingGuy's Security Ansible role (https://github.com/geerlingguy/ansible-role-security) and the Firewall one (https://github.com/geerlingguy/ansible-role-firewall).

yea, what jessel0l said (or vlan) plus you could use something like chroot or podman to separate privileges. Remember to set up fail2ban sane and easy starting point might be https://github.com/geerlingguy/ansible-role-security