# Ansible playbook for hardening a Docker host **URL:** \ **Category:** Collection Development\ **Tags:** security, docker, ubuntu, molecule\ **Created:** [August 3, 2026, 5:17pm UTC](https://forum.ansible.com/t/ansible-playbook-for-hardening-a-docker-host/46123 "2026-08-03T17:17:01Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![jezmn](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jezmn/32/11011_2.png) [@jezmn](https://forum.ansible.com/u/jezmn)\ **Post date:** [August 3, 2026, 5:17pm UTC](https://forum.ansible.com/t/ansible-playbook-for-hardening-a-docker-host/46123/1 "2026-08-03T17:17:01Z")
Hi, I’ve been wanting to automate the server setup I usually do manually on fresh ubuntu server for a while now. Repetitive stuff like SSH hardening, Docker setup, firewall rules, fail2ban, etc. Figured it was time to just automate it instead of doing it by hand every time. I came across _guillaumebriday/kamal-ansible-manager_ and used it as a starting point, then built on top of it. Added more hardening mapped to CIS benchmark, tested with Molecule, cleaned things up to use fully-qualified collection names (FQCN) throughout, and wrote out proper docs along the way. **Repository:** [jezmn/ansible-hardened-docker-host](https://github.com/jezmn/ansible-hardened-docker-host) Still pretty new, so any feedback is welcome. Thanks for reading. ---
**Author:** ![kks](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kks/32/10352_2.png) [@kks](https://forum.ansible.com/u/kks)\ **Post date:** [August 5, 2026, 6:26am UTC](https://forum.ansible.com/t/ansible-playbook-for-hardening-a-docker-host/46123/2 "2026-08-05T06:26:45Z")
1. That is very nice ansible collection with single purpose. And that is great. 2. roles/bootstrap/defaults/main.yml ```yaml --- bootstrap_user: name: ansible ``` There is general recommendation to use plain (not nested) variables - bootstrap\_user\_name, bootstrap\_user\_ssh\_public\_key\_path, not bootstrap\_user dict with keys. Imagine users want to set public key, but use default name for bootstrap user. They would have to define complete dict (name and public key). So default is basically useless here. 1. There is no guarantee that all the playbooks will be executed with gather\_facts: true, so I would add task to collect necessary facts to the roles (where required). 2. ansible.builtin.command: swapoff {{ swap\_file\_path }}, there is injection possible with swap\_file\_path, it is better use argv: [ansible.builtin.command module – Execute commands on targets — Ansible Community Documentation](https://docs.ansible.com/projects/ansible/latest/collections/ansible/builtin/command_module.html#parameter-argv) 3. You have to get rid of ansible cfg and use FQCN for content (playbooks, roles). So playbook runs do not depend on your current working directory. 4. playbooks/site.yml I would use fully qualified names for roles, so it is evident that they are from certain collection. Above are my personal preferences, these are not hard stops. This is a very good start! ---
**Author:** ![jezmn](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jezmn/32/11011_2.png) [@jezmn](https://forum.ansible.com/u/jezmn)\ **Post date:** [August 5, 2026, 11:50pm UTC](https://forum.ansible.com/t/ansible-playbook-for-hardening-a-docker-host/46123/3 "2026-08-05T23:50:40Z")
Thanks for the detailed feedback, getting to it. ---
**Author:** ![jezmn](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jezmn/32/11011_2.png) [@jezmn](https://forum.ansible.com/u/jezmn)\ **Post date:** [September 11, 2026, 4:06am UTC](https://forum.ansible.com/t/ansible-playbook-for-hardening-a-docker-host/46123/4 "2026-09-11T04:06:37Z")
Circling back on this, I addressed the last two points and the collection is also now published on ansible galaxy, thanks again btw. ---
**Author:** ![kks](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kks/32/10352_2.png) [@kks](https://forum.ansible.com/u/kks)\ **Post date:** [September 11, 2026, 5:35am UTC](https://forum.ansible.com/t/ansible-playbook-for-hardening-a-docker-host/46123/5 "2026-09-11T05:35:56Z")
You are welcome