diff --git a/roles/docker/defaults/main.yml b/roles/docker/defaults/main.yml
new file mode 100644
index 0000000..2569c9a
--- /dev/null
+++ b/roles/docker/defaults/main.yml
@@ -0,0 +1,18 @@
+---
+docker_packages:
+  - docker-ce
+  - docker-ce-cli
+  - containerd.io
+  - docker-buildx-plugin
+  - docker-compose-plugin
+
+docker_daemon_config:
+  log-driver: json-file
+  log-opts:
+    max-size: "10m"
+    max-file: "5"
+  iptables: true
+  userland-proxy: false
+  live-restore: true
+
+docker_disable_ipv6: false
diff --git a/roles/docker/handlers/main.yml b/roles/docker/handlers/main.yml
new file mode 100644
index 0000000..eeab2a2
--- /dev/null
+++ b/roles/docker/handlers/main.yml
@@ -0,0 +1,5 @@
+---
+- name: Restart Docker
+  systemd:
+    name: docker
+    state: restarted
diff --git a/roles/docker/tasks/main.yml b/roles/docker/tasks/main.yml
new file mode 100644
index 0000000..37bf949
--- /dev/null
+++ b/roles/docker/tasks/main.yml
@@ -0,0 +1,98 @@
+---
+# Remove conflicting packages (per Docker docs)
+- name: Remove conflicting Docker packages
+  apt:
+    name:
+      - docker.io
+      - docker-doc
+      - docker-compose
+      - docker-compose-v2
+      - podman-docker
+      - containerd
+      - runc
+    state: absent
+
+# Prerequisites
+- name: Install Docker prerequisites
+  apt:
+    name:
+      - ca-certificates
+      - curl
+      - gnupg
+    state: present
+    update_cache: true
+
+# Keyrings directory
+- name: Create Docker APT keyrings directory
+  file:
+    path: /etc/apt/keyrings
+    state: directory
+    mode: "0755"
+
+# Docker GPG key (must be dearmored for apt signed-by)
+- name: Add Docker GPG key
+  shell: |
+    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+  args:
+    creates: /etc/apt/keyrings/docker.gpg
+
+# Docker repository
+- name: Add Docker APT repository
+  apt_repository:
+    repo: >
+      deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg]
+      https://download.docker.com/linux/ubuntu
+      {{ ansible_distribution_release }} stable
+    filename: docker
+    state: present
+
+# Install Docker
+- name: Install Docker Engine and plugins
+  apt:
+    name: "{{ docker_packages }}"
+    state: present
+    update_cache: true
+
+# Docker daemon configuration
+- name: Configure Docker daemon
+  copy:
+    dest: /etc/docker/daemon.json
+    content: "{{ docker_daemon_config | to_nice_json }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart Docker
+
+# Enable Docker
+- name: Enable and start Docker
+  systemd:
+    name: docker
+    enabled: true
+    state: started
+
+# Non-root Docker usage
+- name: Add user to docker group
+  user:
+    name: "{{ ansible_user }}"
+    groups: docker
+    append: true
+
+# Kernel forwarding (required)
+- name: Enable IP forwarding
+  sysctl:
+    name: net.ipv4.ip_forward
+    value: "1"
+    state: present
+    reload: true
+
+# Optional IPv6 disable
+- name: Disable IPv6 (optional)
+  sysctl:
+    name: "{{ item }}"
+    value: "1"
+    state: present
+    reload: true
+  loop:
+    - net.ipv6.conf.all.disable_ipv6
+    - net.ipv6.conf.default.disable_ipv6
+  when: docker_disable_ipv6