diff --git a/inventory/sample/group_vars/all/docker.yml b/inventory/sample/group_vars/all/docker.yml
index 46859ebd56eb6aa6befe820a4e54aee14bcb3278..c8b042a74954ebe46a5af0b12bc5abdad43f7221 100644
--- a/inventory/sample/group_vars/all/docker.yml
+++ b/inventory/sample/group_vars/all/docker.yml
@@ -25,6 +25,10 @@ docker_log_opts: "--log-opt max-size=50m --log-opt max-file=5"
 # define docker bin_dir
 docker_bin_dir: "/usr/bin"
 
+# keep docker packages after installation; speeds up repeated ansible provisioning runs when '1'
+# kubespray deletes the docker package on each run, so caching the package makes sense
+docker_rpm_keepcache: 0
+
 ## An obvious use case is allowing insecure-registry access to self hosted registries.
 ## Can be ipaddress and domain_name.
 ## example define 172.19.16.11 or mirror.registry.io
diff --git a/roles/container-engine/docker/tasks/main.yml b/roles/container-engine/docker/tasks/main.yml
index e9750f692754d6cd69b78a859fb0cbfa9fd722d4..1b3c629bd9808b51168f9138f809d976531e53e5 100644
--- a/roles/container-engine/docker/tasks/main.yml
+++ b/roles/container-engine/docker/tasks/main.yml
@@ -124,7 +124,6 @@
     line: 'obsoletes=0'
   when: ansible_distribution in ["CentOS","RedHat"] and not is_atomic
 
-
 - name: ensure docker packages are installed
   action: "{{ docker_package_info.pkg_mgr }}"
   args:
diff --git a/roles/container-engine/docker/templates/rh_docker.repo.j2 b/roles/container-engine/docker/templates/rh_docker.repo.j2
index fe2aeac1c2ee316444819fe79268ab09fa8a004b..98936a66af581e6475dcb5a3956941b84e1f0b4e 100644
--- a/roles/container-engine/docker/templates/rh_docker.repo.j2
+++ b/roles/container-engine/docker/templates/rh_docker.repo.j2
@@ -3,6 +3,7 @@ name=Docker-CE Repository
 baseurl={{ docker_rh_repo_base_url }}
 enabled=1
 gpgcheck=1
+keepcache={{ docker_rpm_keepcache | default('1') }}
 gpgkey={{ docker_rh_repo_gpgkey }}
 {% if http_proxy is defined %}proxy={{ http_proxy }}{% endif %}
 
@@ -11,5 +12,6 @@ name=Docker-Engine Repository
 baseurl={{ dockerproject_rh_repo_base_url }}
 enabled=1
 gpgcheck=1
+keepcache={{ docker_rpm_keepcache | default('1') }}
 gpgkey={{ dockerproject_rh_repo_gpgkey }}
 {% if http_proxy is defined %}proxy={{ http_proxy }}{% endif %}