diff --git a/docker/files/docker-prune b/docker/files/docker-prune
new file mode 100644
index 0000000..06ca6d4
--- /dev/null
+++ b/docker/files/docker-prune
@@ -0,0 +1,12 @@
+#!/bin/bash
+# Silent on success: cron mails all output to root, so mail arrives only when the prune fails.
+set -u
+
+output=$(docker system prune -af --filter "until=168h" 2>&1)
+rc=$?
+
+if [ "$rc" -ne 0 ]; then
+    printf '%s\n' "$output"
+    echo "docker system prune exited with rc=$rc"
+    exit "$rc"
+fi
diff --git a/docker/tasks/main.yml b/docker/tasks/main.yml
index bf3ee76..7d3fe18 100644
--- a/docker/tasks/main.yml
+++ b/docker/tasks/main.yml
@@ -65,3 +65,29 @@
     dest: "/usr/local/bin/docker-compose"
     mode: preserve
 
+- name: Check for docker binary
+  ansible.builtin.stat:
+      path: /usr/bin/docker
+  register: docker_binary
+  tags: docker_prune
+
+- name: Deploy docker-prune script
+  ansible.builtin.copy:
+      src: docker-prune
+      dest: /usr/local/sbin/docker-prune
+      owner: root
+      group: root
+      mode: "0755"
+  when: docker_binary.stat.exists
+  tags: docker_prune
+
+- name: Schedule hourly docker-prune
+  ansible.builtin.cron:
+      name: docker prune
+      cron_file: docker-prune
+      user: root
+      minute: "0"
+      job: /usr/local/sbin/docker-prune
+  when: docker_binary.stat.exists
+  tags: docker_prune
+