# Tomspiegl Hetzbot Hetzbot Docker

> docker

- Skill: `tomevault-io/tomspiegl-hetzbot-hetzbot-docker` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/tomspiegl-hetzbot-hetzbot-docker`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/tomspiegl-hetzbot-hetzbot-docker/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/tomspiegl-hetzbot-hetzbot-docker

---


# docker

Apt-installed Docker from the official `download.docker.com` repo.
Required by every stateful skill that ships a `docker-compose.yml`
(currently: postgres).

## Files

| File | Purpose |
|---|---|
| `install.sh` | Adds Docker's signed-by apt repo; installs docker-ce + compose plugin; writes `/etc/docker/daemon.json` with hardening + journald logging; enables unattended-upgrades for the Docker origin. Idempotent. |
| `review.sh` | Audits: daemon active, daemon.json contains the expected hardening keys, NetworkManager not fighting over docker0. |

## Hardening

`/etc/docker/daemon.json` written by install.sh:

```json
{
  "log-driver": "journald",
  "live-restore": true,
  "userland-proxy": false,
  "no-new-privileges": true
}
```

- `log-driver: journald` — container logs flow into journald, covered
  by `SystemMaxUse=2G` and journald's rotation. No per-container log
  files piling up under `/var/lib/docker/containers/`.
- `live-restore: true` — containers keep running across `dockerd`
  restart (security patches, reboot). Brief control-plane outage; no
  data plane gap for running services.
- `userland-proxy: false` — avoid docker-proxy processes per
  published port (saves RAM + removes an attack surface).
- `no-new-privileges: true` — default for all containers; per-compose
  `security_opt` still respected.

## When `install.sh` runs

`deploy.sh` calls this first (before any `docker compose up`). Idempotent.

## Review checks

- `CRITICAL` — daemon not active.
- `HIGH` — `/etc/docker/daemon.json` missing a hardening key.
- `OK` — daemon active with expected config.

---
> Source: [tomspiegl/hetzbot](https://github.com/tomspiegl/hetzbot) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-05-22 -->