chore(deps): update dependency konstruktoid.hardening to v4.6.0

install-docker-rootless.yml

@@ -56,6 +56,25 @@
       become: true
       tags: [docker-setup, packages]
 
+    # konstruktoid.hardening v4.4.0+ sets kernel.unprivileged_userns_clone=0 and
+    # user.max_user_namespaces=0 (STIG V-257816) in /usr/lib/sysctl.d/zz-main-hardening.conf,
+    # which breaks rootless Docker. Must run BEFORE the role so its restart handler can
+    # bring docker.service up. The "zzz-" prefix wins alphanumerically against the hardening file
+    # so the override persists across reboots.
+    - name: Override hardening sysctls to keep user namespaces enabled for rootless Docker
+      ansible.posix.sysctl:
+        name: "{{ item.name }}"
+        value: "{{ item.value }}"
+        sysctl_set: true
+        sysctl_file: /etc/sysctl.d/zzz-docker-rootless-userns.conf
+        state: present
+        reload: true
+      loop:
+        - { name: kernel.unprivileged_userns_clone, value: "1" }
+        - { name: user.max_user_namespaces, value: "28633" }
+      become: true
+      tags: [docker-setup, sysctl]
+
     - name: Ensure Docker user exists before enabling lingering
       ansible.builtin.user:
         name: "{{ DOCKER_USER | default('dockeruser') }}"

requirements-lint.yml

@@ -24,7 +24,7 @@ collections:
 
 roles:
   - name: konstruktoid.hardening
-    version: 'v4.3.0'
+    version: 'v4.6.0'
     src: https://github.com/konstruktoid/ansible-role-hardening.git
     scm: git
   - name: konstruktoid.docker_rootless

setup-playbook.yml

@@ -129,7 +129,7 @@
       ansible.builtin.git:
         repo: https://github.com/konstruktoid/ansible-role-hardening.git
         dest: "{{ lookup('env', 'HOME') }}/.ansible/roles/konstruktoid.hardening"
-        version: '4da78c8723d7792dbce73ce5aea47d8144f4596f'  # v4.3.0
+        version: '1c0a9f0954b88694281812167e799c6a4f45214f'  # v4.6.0
       delegate_to: localhost
       run_once: true
       tags: [hardening, setup, role-download]

testing/requirements.yml

@@ -1,7 +1,7 @@
 ---
 roles:
   - name: konstruktoid.hardening
-    version: 'v4.3.0'
+    version: 'v4.6.0'
     src: https://github.com/konstruktoid/ansible-role-hardening.git
     scm: git
   - name: konstruktoid.docker_rootless