Playbook #6

/home/zuul/src/opendev.org/opendev/system-config/playbooks/service-gitea-lb.yaml

Report Status CLI Date Duration Controller User Versions Hosts Plays Tasks Results Files Records
27 Oct 2025 19:38:19 +0000 00:01:25.72 bridge99.opendev.org root Ansible 2.15.13 ara 1.7.3 (client), 1.7.3 (server) Python 3.10.12 1 1 55 54 16 0
check:False tags:all

File: /home/zuul/src/opendev.org/opendev/system-config/playbooks/roles/install-docker/tasks/Ubuntu.noble.yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
# We currently only install docker-compose-v2 and podman from the distro
# on Ubuntu Noble. This also pulls in the docker runtime from the distro
# which we're going to not use. This approach may change if the combo
# stops working.

- name: Install docker-compose-v2 and podman and friends
  become: true
  apt:
    name:
      - docker-compose-v2
      # "new" releases of docker-compose-v2 don't depend on this
      # but our playbooks rely on it being there.
      - docker.io
      - podman
      - uidmap
      - slirp4netns
      - fuse-overlayfs
      - containernetworking-plugins
      # This enables container network dns resolution:
      - golang-github-containernetworking-plugin-dnsname
      # TODO do we need these extra tools?
      - buildah
      - skopeo
      # Production nodes have apparmor but CI nodes don't. List it
      # explicitly here to resolve the delta. The old docker upstream
      # install path also installed apparmor.
      - apparmor
    state: present

- name: Disable docker daemon service
  # We want /usr/bin/docker but don't need or want the docker service
  become: true
  service:
    name: docker
    state: stopped
    enabled: false

- name: Disable docker socket service
  # We want /usr/bin/docker but don't need or want the docker socket
  become: true
  service:
    name: docker.socket
    state: stopped
    enabled: false

# We add this config so that if docker starts it doesn't conflict
# with podman. Mostly belts and suspenders here.
- name: Add docker socket override config
  become: true
  copy:
    src: docker.socket.override.conf
    dest: /etc/systemd/system/docker.socket
    owner: root
    group: root
    mode: '0644'

# Configure the podman socket to pretend to be a docker socket
- name: Add podman socket override config
  become: true
  copy:
    src: podman.socket.override.conf
    dest: /etc/systemd/system/podman.socket
    owner: root
    group: root
    mode: '0644'
  register: write_podman_sock_config

- name: Reconfigure the podman services
  # We use the podman service instead
  become: true
  systemd_service:
    name: podman.socket
    daemon_reload: true
    state: restarted
    enabled: true
  when: write_podman_sock_config.changed

# Currently we assume container management will be performed by root.
# For this reason we don't do any special group management. However,
# if this changes this is a good location to update groups and reset
# the ansible ssh connection.

- name: Add docker-compose to docker compose shim
  become: true
  copy:
    src: docker-compose.shim
    dest: /usr/local/bin/docker-compose
    owner: root
    group: root
    mode: '0755'