Create and use group without restart

You can use an (ansible.builtin.)meta: reset_connection task:

- name: add user to docker group
  ansible.builtin.user:
    name: USERNAME
    groups: docker
    append: yes
- name: reset ssh connection to allow user changes to affect ansible user
  ansible.builtin.meta:
    reset_connection

Note that you can not use a variable to only run the task when the ansible.builtin.user task did a change as “reset_connection task does not support when conditional”, see #27565.

The reset_connection meta task was added in Ansible 2.3, but remained a bit buggy until excluding v2.5.8, see #27520.