diff --git a/docs/ansible.md b/docs/ansible.md
index 513ed0dce..17c998de8 100644
--- a/docs/ansible.md
+++ b/docs/ansible.md
@@ -51,7 +51,6 @@ The main variables to change are located in the directory ```inventory/group_var
 
 Ansible tags
 ------------
-
 The following tags are defined in playbooks:
 
 |                 Tag name | Used for
@@ -63,7 +62,7 @@ The following tags are defined in playbooks:
 |                    canal | Network plugin Canal
 |           cloud-provider | Cloud-provider related tasks
 |                  dnsmasq | Configuring DNS stack for hosts and K8s apps
-|                 download | Fetching container images
+|                 download | Fetching container images to a delegate host
 |                     etcd | Configuring etcd cluster
 |         etcd-pre-upgrade | Upgrading etcd cluster
 |             etcd-secrets | Configuring etcd certs/keys
@@ -81,6 +80,7 @@ The following tags are defined in playbooks:
 |                  kubelet | Configuring kubelet service
 |               kube-proxy | Configuring self-hosted kube-proxy
 |           kube-scheduler | Configuring self-hosted kube-scheduler
+|                localhost | Special steps for the localhost (ansible runner)
 |                   master | Configuring K8s master node role
 |               netchecker | Installing netchecker K8s app
 |                  network | Configuring networking plugins for K8s
@@ -90,12 +90,15 @@ The following tags are defined in playbooks:
 |               preinstall | Preliminary configuration steps
 |               resolvconf | Configuring /etc/resolv.conf for hosts/apps
 |                  upgrade | Upgrading, f.e. container images/binaries
+|                   upload | Distributing images/binaries across hosts
 |                    weave | Network plugin Weave
 
 Note: Use the ``bash scripts/gen_tags.sh`` command to generate a list of all
 tags found in the codebase. New tags will be listed with the empty "Used for"
 field.
 
+Example commands
+----------------
 Example command to filter and apply only DNS configuration tasks and skip
 everything else related to host OS configuration and downloading images of containers:
 
@@ -106,5 +109,12 @@ And this play only removes the K8s cluster DNS resolver IP from hosts' /etc/reso
 ```
 ansible-playbook -i inventory/inventory.ini -e dns_server='' cluster.yml --tags resolvconf
 ```
+And this prepares all container images localy (at the ansible runner node) without installing
+or upgrading related stuff or trying to upload container to K8s cluster nodes:
+```
+ansible-playbook -i inventory/inventory.ini cluster.yaml \
+    -e download_run_once=true -e download_localhost=true \
+    --tags download --skip-tags upload,upgrade
+```
 
 Note: use `--tags` and `--skip-tags` wise and only if you're 100% sure what you're doing.
diff --git a/roles/download/tasks/main.yml b/roles/download/tasks/main.yml
index a7e8c7201..aa2572ee7 100644
--- a/roles/download/tasks/main.yml
+++ b/roles/download/tasks/main.yml
@@ -7,6 +7,7 @@
 - name: Create dest directories
   file: path={{local_release_dir}}/{{download.dest|dirname}} state=directory recurse=yes
   when: "{{ download.enabled|bool and not download.container|bool }}"
+  tags: bootstrap-os
 
 - name: Download items
   get_url:
@@ -50,6 +51,7 @@
 - name: Create dest directory for saved/loaded container images
   file: path="{{local_release_dir}}/containers" state=directory recurse=yes mode=0755 owner={{ansible_ssh_user|default(ansible_user_id)}}
   when: "{{ download.enabled|bool and download.container|bool }}"
+  tags: bootstrap-os
 
 # This is required for the download_localhost delegate to work smooth with CoreOS cluster nodes
 - name: Hack python binary path for localhost
@@ -58,6 +60,7 @@
   delegate_to: localhost
   ignore_errors: true
   run_once: true
+  tags: localhost
 
 - name: Download | create local directory for saved/loaded container images
   file: path="{{local_release_dir}}/containers" state=directory recurse=yes
@@ -65,6 +68,7 @@
   become: false
   run_once: true
   when: "{{ download_run_once|bool and download.enabled|bool and download.container|bool and download_delegate == 'localhost' }}"
+  tags: localhost
 
 #NOTE(bogdando) this brings no docker-py deps for nodes
 - name: Download containers
@@ -101,6 +105,7 @@
   delegate_to: "{{ download_delegate }}"
   become: false
   run_once: true
+  tags: facts
 
 - name: Download | save container images
   shell: docker save "{{ download.repo }}:{{ download.tag }}" | gzip -{{ download_compress }} > "{{ fname }}"
@@ -130,7 +135,9 @@
   retries: 4
   delay: "{{ retry_stagger | random + 3 }}"
   when: (ansible_os_family != "CoreOS" and inventory_hostname != groups['kube-master'][0] or download_delegate == "localhost") and download_run_once|bool and download.enabled|bool and download.container|bool
+  tags: [upload, upgrade]
 
 - name: Download | load container images
   shell: docker load < "{{ fname }}"
   when: (ansible_os_family != "CoreOS" and inventory_hostname != groups['kube-master'][0] or download_delegate == "localhost") and download_run_once|bool and download.enabled|bool and download.container|bool
+  tags: [upload, upgrade]