Podman-first: demote rootful Docker from core to an optional playbook

[LTSCommerce]

Why

This repo's own policy (CLAUDE/ContainerEngines.md) is Podman first, Docker only for compatibility (DDEV), yet playbook-main.yml imported play-docker.yml as a core, non-optional play. That contradicts the policy and it breaks podman-first hosts outright: docker-ce-cli package-conflicts with podman-docker (the docker CLI shim), so on a podman-only host carrying the shim — e.g. a headless podman-only CI host — dnf refuses the transaction and the main playbook cannot converge at all.

Per owner direction, this PR goes all-in on podman: rootful Docker is demoted from core to optional. Refs #41 (which tracks the remaining Docker/Podman coexistence concerns).

What

• git mv playbooks/imports/play-docker.yml playbooks/imports/optional/common/play-docker.yml; import removed from playbook-main.yml. The play itself is unchanged and fully functional.
• LXC dependency handling: play-lxc-install-config.yml previously hard-asserted "Docker must be installed first". It now probes /usr/bin/dockerd (deliberately not /usr/bin/docker, which podman-docker also ships — the probe must detect the rootful engine, not the CLI shim) and conditions the entire Docker-coexistence block (DOCKER-USER assertion, reconcile script, immediate apply, systemd persistence unit) on it:
  • Docker host: block runs, and a host with dockerd on disk but no DOCKER-USER chain still fails fast (half-configured Docker) with a pointer to the optional play. No error hiding.
  • Podman-only host: block skipped — without Docker there is no DOCKER-USER short-circuit and no FORWARD DROP policy, so lxc-net's own FORWARD/MASQUERADE rules suffice.
• All functional references updated to the optional path (play-ddev preflight fix messages, docs/installation.md, docs/ddev.md, docs/playbooks.md, docs/architecture.md, docs/containerization.md, docs/configuration.md, docs/README.md, CLAUDE/ContainerEngines.md). Files that already cited optional/common/play-docker.yml are now correct. Historical plan documents untouched.
• Also fixes a partial-become ansible-lint fatal in the LXC play (block-level become_user without become; behaviourally a no-op since the play is become: true).

Bundle decision

server-recommended.bundle is unchanged: it lists neither play-docker.yml nor play-ddev.yml, so it was already podman-first coherent. Docker stays out of the curated baseline; DDEV users opt in explicitly to both plays.

Interactive / headless discovery

No run.bash change needed: both the interactive optional menu and headless RUN_BASH_OPTIONAL_PLAYBOOKS discover plays by find over playbooks/imports/optional/, so play-docker.yml appears in the desktop menu (one keypress for DDEV users) and remains addressable by basename headlessly.

Migration notes for existing users

• Hosts with Docker already installed keep it — nothing uninstalls Docker; the LXC play detects it and keeps reconciling DOCKER-USER exactly as before.
• To keep converging Docker via Ansible, select play-docker.yml in the optional menu, or add it to RUN_BASH_OPTIONAL_PLAYBOOKS for headless runs.
• New podman-only hosts simply get no Docker, and playbook-main.yml now converges on hosts carrying podman-docker.

QA

qa-ansible-syntax (80 playbooks OK), qa-ansible, qa-patterns, qa-discovery all pass. qa-docs fails only on pre-existing .claude/rules/* links to a missing daemon-deployed doc, unrelated to this change. Remaining ansible-lint fatals under playbook-main.yml are pre-existing in untouched plays (terminal-emulators, toolbox, systemd-user-tweaks).

Supersedes PR #40 (RUN_BASH_SKIP_DOCKER env-var opt-out) — with Docker optional, a per-host skip flag is unnecessary.

Refs #41

🤖 Generated with Claude Code