Apt-installed Docker from the official download.docker.com repo.
Required by every stateful skill that ships a docker-compose.yml
(currently: postgres).
Files
File
Purpose
install.sh
Adds Docker's signed-by apt repo; installs docker-ce + compose plugin; writes /etc/docker/daemon.json with hardening + journald logging; enables unattended-upgrades for the Docker origin. Idempotent.
review.sh
Audits: daemon active, daemon.json contains the expected hardening keys, NetworkManager not fighting over docker0.
log-driver: journald — container logs flow into journald, covered
by SystemMaxUse=2G and journald's rotation. No per-container log
files piling up under /var/lib/docker/containers/.
live-restore: true — containers keep running across dockerd
restart (security patches, reboot). Brief control-plane outage; no
data plane gap for running services.
userland-proxy: false — avoid docker-proxy processes per
published port (saves RAM + removes an attack surface).
no-new-privileges: true — default for all containers; per-compose
security_opt still respected.
When install.sh runs
deploy.sh calls this first (before any docker compose up). Idempotent.
Review checks
CRITICAL — daemon not active.
HIGH — /etc/docker/daemon.json missing a hardening key.
1---2name: tomspiegl-hetzbot-hetzbot-docker3description: docker4---56# docker78Apt-installed Docker from the official `download.docker.com` repo.9Required by every stateful skill that ships a `docker-compose.yml`10(currently: postgres).1112## Files1314| File | Purpose |15|---|---|16| `install.sh` | Adds Docker's signed-by apt repo; installs docker-ce + compose plugin; writes `/etc/docker/daemon.json` with hardening + journald logging; enables unattended-upgrades for the Docker origin. Idempotent. |17| `review.sh` | Audits: daemon active, daemon.json contains the expected hardening keys, NetworkManager not fighting over docker0. |1819## Hardening2021`/etc/docker/daemon.json` written by install.sh:2223```json24{25 "log-driver": "journald",26 "live-restore": true,27 "userland-proxy": false,28 "no-new-privileges": true29}30```3132- `log-driver: journald` — container logs flow into journald, covered33 by `SystemMaxUse=2G` and journald's rotation. No per-container log34 files piling up under `/var/lib/docker/containers/`.35- `live-restore: true` — containers keep running across `dockerd`36 restart (security patches, reboot). Brief control-plane outage; no37 data plane gap for running services.38- `userland-proxy: false` — avoid docker-proxy processes per39 published port (saves RAM + removes an attack surface).40- `no-new-privileges: true` — default for all containers; per-compose41 `security_opt` still respected.4243## When `install.sh` runs4445`deploy.sh` calls this first (before any `docker compose up`). Idempotent.4647## Review checks4849- `CRITICAL` — daemon not active.50- `HIGH` — `/etc/docker/daemon.json` missing a hardening key.51- `OK` — daemon active with expected config.5253---54> Source: [tomspiegl/hetzbot](https://github.com/tomspiegl/hetzbot) — distributed by [TomeVault](https://tomevault.io).55<!-- tomevault:4.0:skill_md:2026-05-22 -->
Run npx skillmds@latest add tomevault-io/tomspiegl-hetzbot-hetzbot-docker in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
docker It is listed under DevOps & Infra on SkillMD.
This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.
tomevault-io