7 files changed, 47 insertions, 42 deletions
diff --git a/roles/docker/README.md b/roles/docker/README.md
index 6b5ee4421..ea06fd41a 100644
--- a/roles/docker/README.md
+++ b/roles/docker/README.md
@@ -6,7 +6,7 @@ Ensures docker package is installed, and optionally raises timeout for systemd-u
 Requirements
 ------------
 
-None
+Ansible 2.2
 
 Role Variables
 --------------
@@ -17,7 +17,7 @@ docker_udev_workaround: raises udevd timeout to 5 minutes (https://bugzilla.redh
 Dependencies
 ------------
 
-None
+Depends on the os_firewall role.
 
 Example Playbook
 ----------------
diff --git a/roles/docker/handlers/main.yml b/roles/docker/handlers/main.yml
index aff905bc8..9ccb306fc 100644
--- a/roles/docker/handlers/main.yml
+++ b/roles/docker/handlers/main.yml
@@ -1,12 +1,13 @@
 ---
 
 - name: restart docker
-  service:
+  systemd:
     name: docker
     state: restarted
   when: not docker_service_status_changed | default(false) | bool
 
 - name: restart udev
-  service:
+  systemd:
     name: systemd-udevd
     state: restarted
+    daemon_reload: yes
diff --git a/roles/docker/meta/main.yml b/roles/docker/meta/main.yml
index 6e2c98601..ad28cece9 100644
--- a/roles/docker/meta/main.yml
+++ b/roles/docker/meta/main.yml
@@ -4,9 +4,10 @@ galaxy_info:
   description: docker package install
   company: Red Hat, Inc
   license: ASL 2.0
-  min_ansible_version: 1.2
+  min_ansible_version: 2.2
   platforms:
   - name: EL
     versions:
     - 7
-dependencies: []
+dependencies:
+- role: os_firewall
diff --git a/roles/docker/tasks/main.yml b/roles/docker/tasks/main.yml
index 7147aa2d4..a8935370a 100644
--- a/roles/docker/tasks/main.yml
+++ b/roles/docker/tasks/main.yml
@@ -1,7 +1,4 @@
 ---
-- stat: path=/etc/sysconfig/docker-storage
-  register: docker_storage_check
-
 - name: Get current installed Docker version
   command: "{{ repoquery_cmd }} --installed --qf '%{version}' docker"
   when: not openshift.common.is_atomic | bool
@@ -18,14 +15,6 @@
     msg: "Docker {{ docker_version }} requested, but >= 1.9.1 is required."
   when: docker_version is defined and docker_version | version_compare('1.9.1', '<')
 
-- name: Get latest available version of Docker
-  command: >
-    {{ repoquery_cmd }} --qf '%{version}' "docker"
-  register: avail_docker_version
-  failed_when: false
-  changed_when: false
-  when: docker_version is defined and not openshift.common.is_atomic | bool
-
 # If a docker_version was requested, sanity check that we can install or upgrade to it, and
 # no downgrade is required.
 - name: Fail if Docker version requested but downgrade is required
@@ -43,18 +32,21 @@
 # Make sure Docker is installed, but does not update a running version.
 # Docker upgrades are handled by a separate playbook.
 - name: Install Docker
-  action: "{{ ansible_pkg_mgr }} name=docker{{ '-' + docker_version if docker_version is defined else '' }} state=present"
+  package: name=docker{{ '-' + docker_version if docker_version is defined else '' }} state=present
   when: not openshift.common.is_atomic | bool
 
-- name: Start the Docker service
-  service:
-    name: docker
-    enabled: yes
-    state: started
-  register: start_result
+- block:
+  # Extend the default Docker service unit file when using iptables-services
+  - name: Ensure docker.service.d directory exists
+    file:
+      path: "{{ docker_systemd_dir }}"
+      state: directory
 
-- set_fact:
-    docker_service_status_changed: start_result | changed
+  - name: Configure Docker service unit file
+    template:
+      dest: "{{ docker_systemd_dir }}/custom.conf"
+      src: custom.conf.j2
+  when: not os_firewall_use_firewalld | default(True) | bool
 
 - include: udev_workaround.yml
   when: docker_udev_workaround | default(False) | bool
@@ -88,16 +80,16 @@
     line: "{{ item.reg_conf_var }}='{{ item.reg_fact_val }}'"
     state: "{{ 'present' if item.reg_fact_val != '' else 'absent'}}"
   with_items:
-    - reg_conf_var: HTTP_PROXY
-      reg_fact_val: "{{ docker_http_proxy | default('') }}"
-    - reg_conf_var: HTTPS_PROXY
-      reg_fact_val: "{{ docker_https_proxy | default('') }}"
-    - reg_conf_var: NO_PROXY
-      reg_fact_val: "{{ docker_no_proxy | default('') | join(',') }}"
+  - reg_conf_var: HTTP_PROXY
+    reg_fact_val: "{{ docker_http_proxy | default('') }}"
+  - reg_conf_var: HTTPS_PROXY
+    reg_fact_val: "{{ docker_https_proxy | default('') }}"
+  - reg_conf_var: NO_PROXY
+    reg_fact_val: "{{ docker_no_proxy | default('') | join(',') }}"
   notify:
-    - restart docker
+  - restart docker
   when:
-    - docker_check.stat.isreg is defined and docker_check.stat.isreg and '"http_proxy" in openshift.common or "https_proxy" in openshift.common'
+  - docker_check.stat.isreg is defined and docker_check.stat.isreg and '"http_proxy" in openshift.common or "https_proxy" in openshift.common'
 
 - name: Set various Docker options
   lineinfile:
@@ -111,6 +103,17 @@
       {% if docker_disable_push_dockerhub is defined %} --confirm-def-push={{ docker_disable_push_dockerhub | bool }}{% endif %}'"
   when: docker_check.stat.isreg is defined and docker_check.stat.isreg
   notify:
-    - restart docker
+  - restart docker
+
+- name: Start the Docker service
+  systemd:
+    name: docker
+    enabled: yes
+    state: started
+    daemon_reload: yes
+  register: start_result
+
+- set_fact:
+    docker_service_status_changed: start_result | changed
 
 - meta: flush_handlers
diff --git a/roles/docker/tasks/udev_workaround.yml b/roles/docker/tasks/udev_workaround.yml
index aa7af0cb3..257c3123d 100644
--- a/roles/docker/tasks/udev_workaround.yml
+++ b/roles/docker/tasks/udev_workaround.yml
@@ -21,10 +21,4 @@
     owner: root
     mode: "0644"
   notify:
-  - restart udev
-  register: udevw_override_conf
-
-- name: reload systemd config files
-  command: systemctl daemon-reload
-  when: udevw_override_conf | changed
- 
+    - restart udev
diff --git a/roles/docker/templates/custom.conf.j2 b/roles/docker/templates/custom.conf.j2
new file mode 100644
index 000000000..53ed56abc
--- /dev/null
+++ b/roles/docker/templates/custom.conf.j2
@@ -0,0 +1,5 @@
+# {{ ansible_managed }}
+
+[Unit]
+Requires=iptables.service
+After=iptables.service
diff --git a/roles/docker/vars/main.yml b/roles/docker/vars/main.yml
index f81f99e2b..5237ed8f2 100644
--- a/roles/docker/vars/main.yml
+++ b/roles/docker/vars/main.yml
@@ -1,2 +1,3 @@
 ---
 udevw_udevd_dir: /etc/systemd/system/systemd-udevd.service.d
+docker_systemd_dir: /etc/systemd/system/docker.service.d