DriversRecommendedOutdated drivers can make a good PC feel brokenScan driver issues before chasing fixes manually.Scan NowOctober DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run Scan×
Skip to content
World desk12 min

How to Install and Set Up Docker on a Server With Ansible

Install Docker Engine on Debian, Ubuntu or RHEL with repeatable Ansible playbooks, then verify the daemon, configure the Python SDK, manage containers and handle firewall and troubleshooting concerns.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The reliable way to install Docker with Ansible is to configure Docker’s official repository for the server’s distribution, install the Engine packages, enable the service, and verify it with a disposable hello-world container. Then install the community.docker collection and Docker SDK for Python in the execution context used by your modules.

This guide covers Debian, Ubuntu and RHEL-style hosts, repeatable playbooks, architecture and version checks, container management, Compose workloads, firewall implications and the failures that most often stop an automated rollout.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What the Ansible installation should accomplish

An installation playbook is more than a package task. A production-ready run should leave each target in a known state:

  • The operating system and CPU architecture are supported by the Docker release you intend to use.
  • Conflicting distribution packages are removed when Docker’s instructions require it.
  • The official Docker repository and signing key are present with restrictive, correct permissions.
  • docker-ce, docker-ce-cli, containerd.io, docker-buildx-plugin and docker-compose-plugin are installed.
  • The Docker service is enabled at boot and running now.
  • A test container can start successfully.
  • The Ansible controller has the community.docker collection, while the Python interpreter that runs Docker modules has the Docker SDK.
  • Container definitions can be rerun without creating duplicates or changing healthy workloads unnecessarily.

Docker describes its Linux procedure as an Engine installation, while the Ansible Docker Working Group describes community.docker as a collection of modules and plugins for orchestrating containers and Docker Swarm. Keeping those layers separate makes failures easier to diagnose: package and service problems belong to the host setup; API, SDK and module problems belong to Ansible’s execution environment.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

Check the target before changing it

Supported distributions and releases

Docker’s support matrix changes over time and architecture support differs by distribution. At the time covered by the current manuals, Docker’s Debian instructions list Debian Trixie 13 and Bookworm 12, while the RHEL instructions list maintained RHEL 8, 9 and 10. Ubuntu, Fedora, CentOS and other platforms have their own repository paths and release names. Do not assume that a derivative uses the same codename or package metadata as its parent.

Host family Repository workflow Package manager Important qualification
Debian and Ubuntu Docker apt repository, keyring and signed source apt Use the distribution codename expected by Docker; derivatives may need a matching upstream codename.
RHEL Docker rpm repository dnf Use the repository branch matching the RHEL major release.
Other supported Linux systems Distribution-specific Docker repository Varies Keep repository URL, package names and architecture mapping in variables and validate them against Docker’s current support page before rollout.

Architecture and connectivity checks

Run a fact-gathering play first. Confirm ansible_facts.distribution, ansible_facts.distribution_major_version, ansible_facts.architecture and the codename or release string. The host needs outbound access to the repository and to the registry used for the verification image. If a server is behind a proxy, configure the package manager and Docker daemon proxy separately; a successful apt or dnf transaction does not prove that the daemon can reach a registry.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use a remote account with privilege escalation, Python available on the target, and a stable value for ansible_python_interpreter. Decide whether the Docker SDK will be installed into the system interpreter or a virtual environment before writing module tasks. That choice determines where Ansible must find the SDK.

Install Docker Engine on Debian or Ubuntu

Repository and package sequence

Docker’s Debian procedure requires an apt keyring, a signed repository entry and a metadata refresh before package installation. The following playbook is intentionally explicit. It removes common conflicting packages, creates the keyring directory, downloads the signing key, installs the repository, installs the Engine components, starts the service and runs a disposable test container.

The repository URL is selected from the distribution family. If you support a derivative, set its Docker-compatible codename explicitly rather than trusting an automatically detected value.

- name: Install Docker Engine on Debian-family hosts
  hosts: docker_hosts
  become: true
  gather_facts: true
  vars:
    docker_arch_map:
      x86_64: amd64
      aarch64: arm64
      armv7l: armhf
    docker_arch: '{{ docker_arch_map[ansible_facts.architecture] | default(ansible_facts.architecture) }}'
    docker_repo_base: 'https://download.docker.com/linux/{{ ansible_facts.distribution | lower }}'
    docker_repo_codename: '{{ ansible_facts.lsb.codename | default(ansible_facts.distribution_release) }}'
  tasks:
    - name: Remove packages that conflict with Docker Engine
      ansible.builtin.apt:
        name:
          - docker.io
          - docker-doc
          - docker-compose
          - podman-docker
          - containerd
          - runc
        state: absent
        purge: true
        update_cache: false

    - name: Install repository prerequisites
      ansible.builtin.apt:
        name:
          - ca-certificates
          - curl
        state: present
        update_cache: true
        cache_valid_time: 3600

    - name: Create Docker keyring directory
      ansible.builtin.file:
        path: /etc/apt/keyrings
        state: directory
        owner: root
        group: root
        mode: '0755'

    - name: Download Docker repository signing key
      ansible.builtin.get_url:
        url: '{{ docker_repo_base }}/gpg'
        dest: /etc/apt/keyrings/docker.asc
        owner: root
        group: root
        mode: '0644'
        force: true

    - name: Configure Docker apt repository
      ansible.builtin.apt_repository:
        repo: 'deb [arch={{ docker_arch }} signed-by=/etc/apt/keyrings/docker.asc] {{ docker_repo_base }} {{ docker_repo_codename }} stable'
        filename: docker
        state: present
        update_cache: true

    - name: Install Docker Engine and plugins
      ansible.builtin.apt:
        name:
          - docker-ce
          - docker-ce-cli
          - containerd.io
          - docker-buildx-plugin
          - docker-compose-plugin
        state: present

    - name: Enable and start Docker
      ansible.builtin.service:
        name: docker
        enabled: true
        state: started

    - name: Run Docker verification image
      ansible.builtin.command: docker run --rm hello-world
      register: docker_hello_world
      changed_when: true
      failed_when: docker_hello_world.rc != 0

On a first run, the verification task downloads the hello-world image, creates a container, prints Docker’s confirmation text and exits. It is not a persistent workload, so --rm removes the stopped container. A package change reports “changed”; subsequent runs should report no package or repository changes unless metadata, versions or service state actually differ.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Why the keyring permissions matter

The keyring directory must be searchable by the apt process, while the key file should be readable but not writable by ordinary users. A repository entry that omits signed-by can make trust broader than intended. If apt reports a missing public key, inspect both the path in the repository line and the file mode before recreating the key.

Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

Install Docker Engine on RHEL

RHEL hosts use dnf and Docker’s rpm repository. The maintained RHEL branch in the current manual covers major versions 8, 9 and 10. Repository installation is preferred when you want Docker’s normal update workflow rather than a potentially older distribution package.

- name: Install Docker Engine on RHEL
  hosts: docker_hosts
  become: true
  gather_facts: true
  tasks:
    - name: Remove conflicting Docker packages
      ansible.builtin.dnf:
        name:
          - docker
          - docker-client
          - docker-client-latest
          - docker-common
          - docker-latest
          - docker-latest-logrotate
          - docker-logrotate
          - docker-engine
        state: absent

    - name: Install Docker repository definition
      ansible.builtin.get_url:
        url: https://download.docker.com/linux/rhel/docker-ce.repo
        dest: /etc/yum.repos.d/docker-ce.repo
        owner: root
        group: root
        mode: '0644'

    - name: Install Docker Engine and plugins
      ansible.builtin.dnf:
        name:
          - docker-ce
          - docker-ce-cli
          - containerd.io
          - docker-buildx-plugin
          - docker-compose-plugin
        state: present
        update_cache: true

    - name: Enable and start Docker
      ansible.builtin.systemd:
        name: docker
        enabled: true
        state: started

Keep the repository task and package task separate so a failed repository download cannot be mistaken for a package-version problem. If your organization mirrors rpm content internally, replace the repository definition with the approved mirror while preserving the same package set and signature checks.

Verify the daemon independently of Ansible modules

When a run fails, test the host with the Docker CLI first. These commands distinguish a service failure from a Python or collection failure:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
systemctl status docker --no-pager
docker version
docker info
docker run --rm hello-world
  • systemctl status docker shows whether systemd started the daemon and includes recent startup errors.
  • docker version reports client and server API information. A client-only response usually means the Unix socket is unreachable.
  • docker info exposes storage-driver, cgroup, registry and runtime details useful for host troubleshooting.
  • docker run --rm hello-world checks image retrieval, daemon operation, container creation and cleanup in one small transaction.

Do not treat a successful CLI command as proof that every Ansible module is ready. Modules can run under a different Python interpreter, on a different machine, or through a different Docker socket.

Install the Ansible Docker collection and Python SDK

Collection on the controller

community.docker is separate from ansible-core. Install it wherever Ansible resolves collections, normally the controller or execution environment:

ansible-galaxy collection install community.docker

The current collection documentation identifies version 5.4.0 and requires ansible-core 2.17.0 or newer. For reproducible automation, pin the collection in requirements.yml and install it during image or control-node preparation:

collections:
  - name: community.docker
    version: 5.4.0
ansible-galaxy collection install -r requirements.yml

Pinning prevents an unattended collection update from changing module arguments or behavior. Schedule collection upgrades deliberately and test them against the same ansible-core version used in production.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

SDK on the machine that executes modules

Most community.docker modules require the Docker SDK for Python on the machine where the module runs. In a normal remote play, that is the target server, not the controller. Lookup plugins and other plugins execute in Ansible’s own context, so they may require the SDK on the controller or execution environment instead.

Install the SDK into the interpreter selected by ansible_python_interpreter. A system-package approach is simple on many distributions:

- name: Install Python package prerequisites
  ansible.builtin.apt:
    name:
      - python3
      - python3-docker
    state: present
  when: ansible_facts.os_family == 'Debian'

- name: Install Docker SDK in the selected interpreter
  ansible.builtin.pip:
    name: docker
    executable: pip3
  when: docker_use_pip | default(false)

Use either the distribution package or a controlled virtual environment, not an accidental mixture of both. If the module says that the Docker SDK is missing, print the interpreter path with ansible_python_interpreter, run that interpreter’s python -c 'import docker; print(docker.__version__)', and install the SDK there. Installing it only on the controller will not fix a module that executes on the target.

Manage a container with community.docker.docker_container

After the daemon, collection and SDK are ready, define containers declaratively. The module supports check mode and requires Docker API 1.25 or newer. This example keeps the image, name, restart policy and port mapping explicit:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
- name: Run the application container
  hosts: docker_hosts
  become: true
  collections:
    - community.docker
  tasks:
    - name: Ensure application container is present
      community.docker.docker_container:
        name: web
        image: nginx:stable
        state: started
        pull: true
        restart_policy: unless-stopped
        published_ports:
          - 127.0.0.1:8080:80

The loopback binding deliberately limits exposure to the host. Bind to 0.0.0.0 only after reviewing the service’s access requirements and firewall policy. Use state: absent for removal, and use explicit volume, environment and health-check settings for a real application rather than relying on image defaults.

Run a proposed change without applying it:

ansible-playbook site.yml --check --diff

Check mode predicts many container changes, but image pulls, registry access and runtime-generated values can still make predictions incomplete. Validate the result on a staging host before changing a production container.

Use Compose v2 modules for multi-container applications

A single container is easier to model with docker_container. A workload with a database, network, volumes and several dependent services is better represented by a Compose file and the collection’s Compose v2 modules. Install the Compose plugin as part of the Engine package set, place the version-controlled file on the host, and invoke the v2 module from Ansible.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- name: Deploy the Compose application
  community.docker.docker_compose_v2:
    project_src: /opt/myapp
    state: present
    pull: missing

Keep secrets out of the Compose file and playbook source. Supply them through an approved secret mechanism, restrict file permissions and make the project directory ownership explicit. Treat the Compose file as the source of truth; avoid making manual container changes that the next reconciliation will undo.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Make reruns safe and upgrades deliberate

Idempotence means the same playbook converges on the same host state. Use state: present for packages, enabled: true and state: started for the service, stable repository files, fixed keyring modes and declarative container definitions. Avoid shell commands for tasks that have a dedicated Ansible module; reserve command for verification or operations without a suitable module.

There are two separate version decisions:

Decision Latest packages Pinned packages
Benefit Receives new fixes through the repository workflow. Reproduces a tested host state across machines.
Cost A later repository update can change behavior without a playbook edit. Requires a maintenance process to review and advance versions.
Best fit Fast-moving development or hosts with frequent validation. Production fleets with change approval and rollback plans.

If reproducibility matters, pin Docker package versions, the collection version and application image tags, then document the upgrade procedure. Test Engine, containerd, Compose and SDK changes together because they share the Docker API path.

Firewall and exposure considerations

Docker warns that published container ports can bypass rules managed only through ufw or firewalld. Publishing a port is therefore a network-policy change, not merely a container setting. Before exposing a service, decide which interfaces should listen, which source networks are allowed and where filtering will occur.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Prefer loopback or a private interface when the service is consumed locally or through a reverse proxy.
  • Review Docker’s supported iptables or ip6tables integration instead of inserting ad hoc rules that the daemon may reorder.
  • Use the DOCKER-USER chain for host-level filtering that should be evaluated before Docker’s own forwarding rules.
  • Test both IPv4 and IPv6 if the host has both enabled.
  • Record published ports in the same change review as firewall rules.

A container that starts successfully can still be unintentionally reachable from the network. Verify from an allowed and a denied source after deployment.

Troubleshoot common failures

Apt reports an unsupported release or empty repository

Check the detected distribution and codename. Debian derivatives often identify themselves with a codename Docker does not publish. Set the repository codename to the supported upstream release only when Docker’s documentation says that mapping is valid; otherwise stop the rollout rather than installing packages from an unrelated branch.

The signing key is ignored

Confirm that /etc/apt/keyrings/docker.asc exists, is readable by apt, and matches the signed-by path character for character. Re-run the key download task and inspect the repository file for duplicate or stale entries.

The service will not start

Read journalctl -u docker -b and check for conflicts with an old container runtime, invalid daemon JSON, cgroup configuration or insufficient disk space. Removing conflicting packages does not remove a bad configuration file, so inspect /etc/docker/daemon.json separately.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Ansible says the Docker SDK is missing

Print the effective interpreter and install the SDK into that exact environment. Remember that a module running on a target needs the SDK on the target, while a plugin running in the controller context needs it on the controller or execution image.

Permission is denied on the Docker socket

The module is probably connecting to the Unix socket as a user outside the docker group, or it is using a different socket path. First test with privilege escalation. If non-root operation is required, manage group membership explicitly, reconnect the session so the new group is active, and understand that membership in the Docker group is effectively administrative access on the host.

hello-world cannot pull its image

Separate registry connectivity from daemon health. Check DNS, proxy settings, outbound firewall rules, registry credentials and the daemon’s journal. A successful package download proves only that the package manager can reach its repository.

The container module rejects the API

Compare the client and server values from docker version. The collection’s container module requires Docker API 1.25 or newer. Upgrade the Engine or use a collection/module combination compatible with the server instead of forcing an unsupported API setting.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

A practical rollout sequence

  1. Inventory hosts by distribution family, release, architecture and Python interpreter.
  2. Validate each host against Docker’s current support matrix and stop unsupported combinations.
  3. Run the Debian/Ubuntu or RHEL role that removes conflicts, configures the signed repository and installs the five Engine components.
  4. Enable the service and verify it with systemd, docker version and docker run --rm hello-world.
  5. Install and pin community.docker on the controller or execution environment.
  6. Install the Docker SDK in every interpreter that executes Docker modules or plugins.
  7. Deploy one non-critical container in check mode first, then apply it and inspect logs, ports and restart behavior.
  8. For multi-container applications, deploy the version-controlled Compose project with the Compose v2 module.
  9. Review firewall behavior from outside the host before publishing any production port.
  10. Record package, collection and image versions so upgrades can be tested and rolled back deliberately.

This sequence keeps operating-system changes, Ansible dependencies, container definitions and network exposure observable as separate steps. It also makes a failed run recoverable: fix the failing layer, rerun the idempotent role and verify the next layer only after the previous one is healthy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
Windows Errors? Fix Them Before They SpreadFree repair scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.