diff --git a/tasks/docker-update.yml b/tasks/docker-update.yml
new file mode 100644
index 0000000..7e889ed
--- /dev/null
+++ b/tasks/docker-update.yml
@@ -0,0 +1,28 @@
+# tasks file for ansible-role-container-registry
+# the tasks will ensure docker is up to date.
+
+- name: can docker be updated
+  shell: yum check-update docker
+  register: docker_check_update
+  failed_when: docker_check_update.rc not in [0, 100]
+  changed_when: docker_check_update.rc == 100
+
+- name: set docker_rpm_needs_update fact
+  set_fact: docker_rpm_needs_update={{ docker_check_update.rc == 100 }}
+
+- name: stop all containers before update
+  # xargs is preferable to docker stop $(docker ps -q) as that might generate a
+  # a too long command line
+  shell: docker ps -q | xargs --no-run-if-empty -n1 docker stop
+  when: docker_rpm_needs_update
+
+- name: ensure docker is installed
+  yum:
+    name: docker
+    state: present
+  when: docker_rpm_needs_update
+
+- name: update the docker package
+  yum: name=docker state=latest update_cache=yes # cache for https://bugs.launchpad.net/tripleo/+bug/1703830
+  when: docker_rpm_needs_update
+  notify: restart docker service