refactor(molecule): use docker instead of podman

The scenario now starts its containers with community.docker instead of containers.podman, because docker is the
container runtime available on the CI runner. The connection plugin, the login command and the declared collections
were adjusted accordingly and the docker SDK for python is installed in the workflow, since the module requires it.

Co-authored-by: Copilot <copilot@github.com>

.gitea/workflows/molecule.yaml

@@ -24,7 +24,7 @@ jobs:
       run: |
         apt update --yes
         apt install --yes python3-pip
-        pip3 install --break-system-packages molecule
+        pip3 install --break-system-packages molecule docker
     - name: Run molecule
       run: molecule test
       working-directory: certificate_authority

README.md

@@ -33,16 +33,16 @@ certificate_authority_client_subject_alternative_names:
 
 ## Tests
 
-The role is tested with [Molecule](https://ansible.readthedocs.io/projects/molecule/). The scenario starts one podman
+The role is tested with [Molecule](https://ansible.readthedocs.io/projects/molecule/). The scenario starts one docker
 container per supported distribution family, applies the role, asserts that a second run reports no change and finally
 verifies the issued certificates with `openssl verify`, their file permissions and the anchor in the systems trust
 store.
 
-Molecule ships only its `default` driver, therefore `podman` is required besides molecule itself. The collections are
+Molecule ships only its `default` driver, therefore `docker` is required besides molecule itself. The collections are
 declared in `molecule/default/collections.yml` and installed by molecule.
 
 ```bash
-pip install molecule
+pip install molecule docker
 ```
 
 The complete sequence creates the containers, tests them and removes them afterwards.

molecule/default/collections.yml

@@ -2,4 +2,4 @@
 
 collections:
 - name: community.crypto
-- name: containers.podman
+- name: community.docker

molecule/default/create.yml

@@ -5,7 +5,7 @@
   gather_facts: false
   tasks:
   - name: Start a container per platform
-    containers.podman.podman_container:
+    community.docker.docker_container:
       name: "{{ item.name }}"
       image: "{{ item.image }}"
       command: "sleep infinity"
@@ -19,7 +19,7 @@
       content: |
         {% for platform in molecule_yml.platforms %}
         - instance: {{ platform.name }}
-          connection: containers.podman.podman
+          connection: community.docker.docker
         {% endfor %}
       dest: "{{ molecule_instance_config }}"
       mode: "0600"

molecule/default/destroy.yml

@@ -5,7 +5,7 @@
   gather_facts: false
   tasks:
   - name: Remove the container of every platform
-    containers.podman.podman_container:
+    community.docker.docker_container:
       name: "{{ item.name }}"
       state: absent
     loop: "{{ molecule_yml.platforms }}"

molecule/default/molecule.yml

@@ -4,7 +4,7 @@ driver:
   name: default
   options:
     managed: true
-    login_cmd_template: "podman exec --interactive --tty {instance} bash"
+    login_cmd_template: "docker exec --interactive --tty {instance} bash"
 
 platforms:
 - name: certificate-authority-archlinux

molecule/default/prepare.yml

@@ -16,7 +16,7 @@
         dnf install --assumeyes ca-certificates gawk openssl python3
       fi
   tasks:
-  # The podman connection plugin splits raw commands instead of passing them to a shell.
+  # The raw command is wrapped explicitly, because the bootstrap relies on shell builtins.
   - name: Bootstrap the python interpreter and the tools required by the role
     ansible.builtin.raw: "/bin/sh -c {{ _bootstrap | quote }}"
     changed_when: true

requirements.yaml

@@ -2,4 +2,4 @@
 
 collections:
 - name: community.crypto
-- name: containers.podman
+- name: community.docker