docker: enable live-restore by merging daemon options into daemon.json

docker/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+docker:
+  # Merged into /etc/docker/daemon.json; keys not listed here keep their host value.
+  daemon:
+    # Containers keep running while dockerd restarts or upgrades.
+    live-restore: true

docker/handlers/main.yml

@@ -2,3 +2,9 @@
   service:
       name: "docker"
       state: restarted
+
+# SIGHUP applies the reloadable daemon.json options without stopping containers.
+- name: reload_docker
+  service:
+      name: "docker"
+      state: reloaded

docker/tasks/main.yml

@@ -59,6 +59,29 @@
           - pass
       state: latest
 
+- name: Read daemon.json
+  ansible.builtin.slurp:
+      path: /etc/docker/daemon.json
+  register: docker_daemon_json
+  failed_when: false
+  tags: docker_daemon
+
+- name: Merge daemon options into daemon.json
+  vars:
+      docker_daemon_current: "{{ (docker_daemon_json.content | b64decode | from_json) if docker_daemon_json.content is defined else {} }}"
+      docker_daemon_merged: "{{ docker_daemon_current | combine(docker.daemon) }}"
+  ansible.builtin.copy:
+      content: "{{ docker_daemon_merged | to_nice_json(indent=4, sort_keys=False) }}\n"
+      dest: /etc/docker/daemon.json
+      owner: root
+      group: root
+      mode: "0644"
+      validate: dockerd --validate --config-file=%s
+  # Rewritten only on a value change, so hand-written formatting survives otherwise.
+  when: docker_daemon_merged != docker_daemon_current
+  notify: reload_docker
+  tags: docker_daemon
+
 - name: Deploy docker-compose command to new docker compose plugin
   ansible.builtin.copy:
     src: docker-compose