Adding metadata

25 files changed, 802 insertions, 7 deletions

diff --git a/app-containers/aardvark-dns/Manifest b/app-containers/aardvark-dns/Manifest
index e2e843ecd4ed..6718d9ca55d1 100644
--- a/app-containers/aardvark-dns/Manifest
+++ b/app-containers/aardvark-dns/Manifest
@@ -1,4 +1,6 @@
 DIST aardvark-dns-1.17.1.crate 62779 BLAKE2B 487b8de4d01df37ca8eef8b911f8231db1df4417a61b921e1c109661af0270115b8941d56493a468a6ecd58174c0074a5c8687c8d4ae6d21bfc028efae45d663 SHA512 eee8ecd47626093dd2f0a60f862593c035efc87fd4ba9fc209c93f75ca624300bc70ecc11a3828198eb36ff97ab0bb32ba090c0708793279117793876ede47a3
 DIST aardvark-dns-2.0.0.crate 60884 BLAKE2B c883311c633b069a52fe07d0a6ccdd1958cfc79cb8d8d96373685e56ecf500119b7287680a0be46359125631442e0d5cd2a82e0a4ce181102c363612968e1257 SHA512 8ff50f93015ab1d343ce42a81bdbede016e77e5709f111f1085df2b1a9a683694ccde16d4267092055f1b30ac335f1dabb6d6b8932e0225159ebd9b2bfab9df2
+DIST aardvark-dns-2.1.0.crate 59419 BLAKE2B 455e2eefc6b99afe823e53051ebed0f26137c4ebb454e8362c4d194888b9237b926b262d120ff97259f586e9af8722295b54a609e0864f708424e2178bf33797 SHA512 b4355a809d1a61f2daead36f83f95a0ea4fb1e9002f0e84b22dbcf890134160fd4aa2b0fdf88ef260738b71bffddc9f437ce0b30faaf3ec0fe8907f8e420d72b
 DIST aardvark-dns-v1.17.1-vendor.tar.gz 10267576 BLAKE2B 984a27b5dbd773d9fa2db7123e8bd16f59407249caa1ab203d76bd1626b63e7bbadcf9a32e46b087d8cbb38442e7203bd810ce8d45c988e24c3237ea282def0a SHA512 ce6768f90a731a55511fdb78f8048ed3c5ff4b058d3edfc7832430330a239b58b6250851c6a268706f24b4fc94f47afd6ce4c1e4cbb1132e0dc7a2d0127d62ff
 DIST aardvark-dns-v2.0.0-vendor.tar.gz 10533784 BLAKE2B 96792ab9a38b0e7a1c05a8536a617ecaa5f2da5b1b3a530cd7fff4cae8f6a62739b3186c57be360d678bc0f024a876df4e9ddac030a828e1914796bf0d669189 SHA512 dc7d72dd8dc18031be55578e12c911f73137632e5c92a04a53a85bcf99b7dae4ad4faddc483a99e3cf5d5cab6a8e22d09bc47e6ae38ce15e7ba9b07fc10e9ea4
+DIST aardvark-dns-v2.1.0-vendor.tar.gz 10972640 BLAKE2B f10909a4c349993bbef80b76cca0b228c38bdbb7f248f932df333f5d6e7c75a24e1d47ce26a4414875e9b996f34729242b6431ef86a99ff1108f1c901be8452f SHA512 ce37fa79aabfc1d1bc1cc8db9c904930010d16eea082b9f525252294b5c318a717468729e3569cddd7c03d39f76b4627c0e09b8ea4df42bb11da588c871dd041
diff --git a/app-containers/aardvark-dns/aardvark-dns-2.1.0.ebuild b/app-containers/aardvark-dns/aardvark-dns-2.1.0.ebuild
new file mode 100644
index 000000000000..7eae965ad9c9
--- /dev/null
+++ b/app-containers/aardvark-dns/aardvark-dns-2.1.0.ebuild
@@ -0,0 +1,49 @@
+# Copyright 2023-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+RUST_MIN_VER="1.88.0"
+[[ ${PV} == 9999* ]] || CRATES="${PN}@${PV}"
+inherit cargo
+
+DESCRIPTION="A container-focused DNS server"
+HOMEPAGE="https://github.com/containers/aardvark-dns"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/aardvark-dns.git"
+else
+	SRC_URI="${CARGO_CRATE_URIS}"
+	SRC_URI+="https://github.com/containers/aardvark-dns/releases/download/v${PV}/${PN}-v${PV}-vendor.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv"
+fi
+
+# main
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" 0BSD Apache-2.0-with-LLVM-exceptions MIT Unlicense Unicode-DFS-2016 ZLIB"
+SLOT="0"
+
+QA_FLAGS_IGNORED="usr/libexec/podman/${PN}"
+QA_PRESTRIPPED="usr/libexec/podman/${PN}"
+ECARGO_VENDOR="${WORKDIR}/vendor"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		cargo_live_src_unpack
+	else
+		cargo_src_unpack
+	fi
+}
+
+src_prepare() {
+	default
+	sed -i -e "s|m0755 bin|m0755 $(cargo_target_dir)|g;" Makefile || die
+}
+
+src_install() {
+	local -x PREFIX="${EPREFIX}"/usr
+	default
+}
diff --git a/app-containers/cadvisor/Manifest b/app-containers/cadvisor/Manifest
index 9689fd9002af..5419673b1102 100644
--- a/app-containers/cadvisor/Manifest
+++ b/app-containers/cadvisor/Manifest
@@ -4,3 +4,5 @@ DIST cadvisor-0.53.0-deps.tar.xz 89910284 BLAKE2B 448c6a0f87e23b5274b3f3478fde62
 DIST cadvisor-0.53.0.tar.gz 992998 BLAKE2B 3cb8e8ed487811e44aee652084fc173f8274eb98e28f32ddab5e26f2f225dc41dee6fddcde66035447849dac49f28991e993e9faa37b2ae965627fb8cde3c6ec SHA512 b14b0d4025c0b53a4299a38706cc1c5fec181554b3875ab1aa5ca2e80ca4070aa057521812a19e3fb6b175e1ea05ef37af613f69cf84dd131dc82f218fa6ff9c
 DIST cadvisor-0.56.2-deps.tar.xz 91038580 BLAKE2B a2ac7627c8c27247ceb6762aa3bb29600a1fd9dd0373f8cc8296f84d5a668bcea53431d7c79a15cc19fc9db56394bbcc73bc9615a36d4af864428102b94e48fd SHA512 e5df929d718fa5f6765c09bf603fd52ed34b259b57abecc3236a49ef10333e803bb031fb3d636fc8c0d0fba42fba15cbfb1320bd30723dea2a36455a3ecd7369
 DIST cadvisor-0.56.2.tar.gz 1010039 BLAKE2B c6f98f9c7e8818977290f9044084b26768dac49b9c76edc00e65e87f48fb0b0ba5ef91fea18f5b1e63de1e4e4f8bd6e5852910c7054748c3e5298aefd74b8593 SHA512 9c8424be5868f97bbd026f1a976abc6a40d0a2b8bfa40f56c03c2a7b416537dec2680fcdcb2076414c3b7aa110955d2d456d6756f1b0eec40afc49837a581152
+DIST cadvisor-0.60.5-deps.tar.xz 85656580 BLAKE2B aa15899dfa657e0c14c8a99e6346d0287f0dbf650bfdace606bdd6402543ad508efe3c2b3b83b324928c27b03f6b485531193fa428318933de376c3738264b45 SHA512 8186b30121df70919f25222bce24db0633d0328d1a23f70faedfd7dce12fa2cef3a82a92016221e82c7b64b5c42f74654b0148f9fd67f9dde67d4e3648b11dcd
+DIST cadvisor-0.60.5.tar.gz 1048626 BLAKE2B a5b147960e24c748d61635fe8e23761c3d0260eeb3fb19f52e3f69bd0d1f69895d4229e779c7d180e62a0d1484afeb01c7364832ecf5d3797849d8b8f6f7372c SHA512 f4fe3b2f9cd0d2b631041cb476ef12c65780252d7fdcdb7f0e535b28d185aa05393bad3e28446cffe3f0741343250698ec4e6ddd6ec3389f9041c30e8dd115ac
diff --git a/app-containers/cadvisor/cadvisor-0.60.5.ebuild b/app-containers/cadvisor/cadvisor-0.60.5.ebuild
new file mode 100644
index 000000000000..03d7e93b40f5
--- /dev/null
+++ b/app-containers/cadvisor/cadvisor-0.60.5.ebuild
@@ -0,0 +1,53 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module systemd
+
+COMMIT=44b8e3062d678022939d40b2a2e9b259b07ebab0
+
+DESCRIPTION="Analyzes resource usage and performance characteristics of running containers"
+HOMEPAGE="https://github.com/google/cadvisor"
+SRC_URI="https://github.com/google/cadvisor/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://github.com/gentoo-golang-dist/${PN}/releases/download/v${PV}/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+# Dependent licenses
+LICENSE+=" Apache-2.0 BSD BSD-2 ISC MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+DEPEND="
+	acct-group/cadvisor
+	acct-user/cadvisor
+"
+RDEPEND="${DEPEND}"
+BDEPEND=">=dev-lang/go-1.25.0"
+
+src_prepare() {
+	default
+	sed -i build/assets.sh -e "/go install/d"  || die
+	sed -i build/build.sh \
+		-e "/^version=/s/=.*/=${PV}/" \
+		-e "/^revision=/s/=.*/=${COMMIT}/" \
+		-e "/^branch=/s/=.*/=v${PV}/" || die
+}
+
+src_compile() {
+	GO_FLAGS="${GOFLAGS}" VERBOSE="true" emake build
+}
+
+src_test() {
+	GO_FLAGS="${GOFLAGS}" VERBOSE="true" emake test
+}
+
+src_install() {
+	dobin _output/${PN}
+
+	newinitd "${FILESDIR}"/${PN}.initd-r2 ${PN}
+	systemd_dounit "${FILESDIR}/${PN}.service"
+
+	keepdir /var/log/${PN}
+	fowners ${PN}:${PN} /var/log/${PN}
+}
diff --git a/app-containers/containerd/containerd-2.3.2-r1.ebuild b/app-containers/containerd/containerd-2.3.2-r1.ebuild
index ebfcede63d97..bc58e0fee080 100644
--- a/app-containers/containerd/containerd-2.3.2-r1.ebuild
+++ b/app-containers/containerd/containerd-2.3.2-r1.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
 IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
 # tests require root or docker
 RESTRICT="test"
diff --git a/app-containers/cosign/Manifest b/app-containers/cosign/Manifest
index efc3e7990cc4..f71d93dcc5bb 100644
--- a/app-containers/cosign/Manifest
+++ b/app-containers/cosign/Manifest
@@ -6,3 +6,5 @@ DIST cosign-3.0.3-deps.tar.xz 147117736 BLAKE2B 8dfd5140715e19adc3daedcf974f94dd
 DIST cosign-3.0.3.tar.gz 949214 BLAKE2B c41a776f5967c4692e84764f450340707f14c3a12dcbf6ded45bbb3d9b5cef59f291aaf5b56b56229a47f58baeee2b5efeff6529f3327d76eec86dee367b9dd0 SHA512 bbb0a248ad858a0c867e8760a752030cbe957682686f3f3cfaf1bd7ae350832df2e6d6fe9388f7323353d7377ae9920a99006c3be27610e5d89bfa9b737ab343
 DIST cosign-3.1.0-vendor.tar.xz 10611608 BLAKE2B fdd9cabc98b7bafbab0fa256310861ca392f98170c7008e228e902bf6ed1cfcd73f0baa0c4d1ff827294ebe242e1b45ab72816fa5308574bfbc89b067f0ae226 SHA512 f7d403f098252e4db72634fa1a8d4778502bdf0e0df625b89aafd7cf03de6fbf063600605aaae41cf17cdfcf1c7d6341b05aa4ab26cfa5e45888c0d4dbdc6a64
 DIST cosign-3.1.0.tar.gz 973713 BLAKE2B 8891355686be3ccf29cff720bd1ea0adfac5058fd53c85152fa9a38de5960a9ce6b0977a37251eea026e74dcb1a51f3fda4f113e859174007906dd98ceceabf2 SHA512 c7154667ecbf76b97b1133d659c737b921df66297c2cb192b7f29407797de9055ecf8b91dd617017de6d8d0541df32474f6daadaeaaa7a964fc229903ef8a450
+DIST cosign-3.1.3-vendor.tar.xz 10244636 BLAKE2B fadc175acdedc3024c91c657a9791bdfccf3691ab654a8ea67647a46a1356afdbe285fe6d3a9a797f62e19f9a01de12be4b281d3fda7bdfe49d2900ca2d004e0 SHA512 42a4f711d7b6f3fce552f2d410358fcf07b445e0a2a4c85d05371b6c5a2a1297a2fd57def1b58462df86a9631dc903bab9f06d3dc8c24d2c07ac8e30a6304f80
+DIST cosign-3.1.3.tar.gz 962331 BLAKE2B 204ee0af61ca3430eb4cb94458a7bb51b15aea2327c9f696adf5a48c7739b67eaf4e2e923079ea145144d16abda59f4ec07900664ebf0817df3b01d11b17206f SHA512 d6f56502afb18ff8f4c4cde2c840bb926543a233a7bc6b71b00f53f1b95ec01e063ada30e7ddf4d16d8f34cb84e59b083e705ef81382456eb59d9e6d83032791
diff --git a/app-containers/cosign/cosign-3.1.0.ebuild b/app-containers/cosign/cosign-3.1.0.ebuild
index 7a50b0f7e12e..7ee5ab3d84b1 100644
--- a/app-containers/cosign/cosign-3.1.0.ebuild
+++ b/app-containers/cosign/cosign-3.1.0.ebuild
@@ -18,7 +18,7 @@ LICENSE="Apache-2.0"
 # Dependent licenses
 LICENSE+=" Apache-2.0 BSD BSD-2 ISC MIT MPL-2.0"
 SLOT="0"
-KEYWORDS="~amd64"
+KEYWORDS="amd64"
 RESTRICT="test"
 
 BDEPEND=">=dev-lang/go-1.26.0"
diff --git a/app-containers/cosign/cosign-3.1.3.ebuild b/app-containers/cosign/cosign-3.1.3.ebuild
new file mode 100644
index 000000000000..22add6ec8250
--- /dev/null
+++ b/app-containers/cosign/cosign-3.1.3.ebuild
@@ -0,0 +1,47 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module shell-completion sysroot
+
+GIT_HASH=11926fa5bbbbde47e88fc006b625a17769b743b2
+# checkout the tag and run `git log -1 --no-show-signature --pretty=%ct`
+SOURCE_DATE_EPOCH=1785973407
+
+DESCRIPTION="container signing utility"
+HOMEPAGE="https://sigstore.dev"
+SRC_URI="https://github.com/sigstore/cosign/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://github.com/gentoo-golang-dist/${PN}/releases/download/v${PV}/${P}-vendor.tar.xz"
+
+LICENSE="Apache-2.0"
+# Dependent licenses
+LICENSE+=" Apache-2.0 BSD BSD-2 ISC MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+RESTRICT="test"
+
+BDEPEND=">=dev-lang/go-1.26.0"
+
+src_compile() {
+	emake \
+		GIT_HASH=${GIT_HASH} \
+		GIT_VERSION=v${PV} \
+		GIT_TREESTATE=clean \
+		SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
+
+	einfo "generating shell completion files"
+	sysroot_try_run_prefixed ./cosign completion bash > ${PN}.bash || die
+	sysroot_try_run_prefixed ./cosign completion zsh > ${PN}.zsh || die
+	sysroot_try_run_prefixed ./cosign completion fish > ${PN}.fish || die
+}
+
+src_install() {
+	dobin cosign
+	einstalldocs
+	dodoc CHANGELOG.md
+
+	[[ -s ${PN}.bash ]] && newbashcomp ${PN}.bash ${PN}
+	[[ -s ${PN}.zsh ]] && newzshcomp ${PN}.zsh _${PN}
+	[[ -s ${PN}.fish ]] && dofishcomp ${PN}.fish
+}
diff --git a/app-containers/docker-buildx/Manifest b/app-containers/docker-buildx/Manifest
index 305006ff308b..a85c8ade34d4 100644
--- a/app-containers/docker-buildx/Manifest
+++ b/app-containers/docker-buildx/Manifest
@@ -5,3 +5,4 @@ DIST docker-buildx-0.20.1.tar.gz 12049522 BLAKE2B cc370f8a6bc82d9358cb59f9964544
 DIST docker-buildx-0.21.2.tar.gz 13608048 BLAKE2B 8229fe6d8d1b2b9f35213ae0ae879d90d7f96ca4688c787e7dcbb88e0aaa4444519c4e5fca51acf9e9d6f2bf697adf74b2c2d8440eec1660dbf10496eb76c243 SHA512 a90a9af1a9b986f99a08f3e53ca06cfac64378a92ab887653d3aa9e1538ef87fec4fbd719c5087782cf7dc5eb8845c9c0786605e7386d759c0e33ef5f121fbba
 DIST docker-buildx-0.34.1.tar.gz 15417849 BLAKE2B b302d1f2331ba7f76c79358be197436ac37e3d4ebea154ae441fc05b787544d9cd037bff2ae8140f9475ddfa3cad77e0a136b1a423d29cb73bdb42218ade5da0 SHA512 be69ff92a136e169456710c369099bd33ed0ae17271133fe0322fe1664c868ad76dd74265879fa783fa257a6ed6dca37c213d1153de9e903833b59cde4181d0b
 DIST docker-buildx-0.35.0.tar.gz 15243338 BLAKE2B d5529d81cd2745366e46da1f805da6b4b47a4002260c5f351cddafbba4cc55fbad3be182e94d89453de62fdda3adc7bde2713010122439ce72a7cc53e49b3f6f SHA512 208251fe59d016bbb1d34abacab4813169577c474ad62f47afdcce4f2484e8535a452bfa0b8dbadc465590cae935896bfeec2263934262cdb769a27b59b4c5de
+DIST docker-buildx-0.36.1.tar.gz 15022684 BLAKE2B c927c4e310cd72a9cbffb00d637e0c596828ea1ad1aee8725cdaa9163dc100a35c0898b25f7123ed1c926006f7b3e632c4b579eeeeb296cd25b331f9e7d64699 SHA512 669a1fa58570f56dfc6d5a0cf79f09e5a326b997a26a79e9bdbc263b1b847200d6bcc8fa1a37be43a77573d32c04d093959ec793cfd503cef524cbfdb9332339
diff --git a/app-containers/docker-buildx/docker-buildx-0.35.0.ebuild b/app-containers/docker-buildx/docker-buildx-0.35.0.ebuild
index 5e941c9e6119..39c2b485614a 100644
--- a/app-containers/docker-buildx/docker-buildx-0.35.0.ebuild
+++ b/app-containers/docker-buildx/docker-buildx-0.35.0.ebuild
@@ -13,7 +13,7 @@ if [[ ${PV} == 9999 ]]; then
 	EGIT_REPO_URI="https://github.com/docker/buildx.git"
 else
 	SRC_URI="https://github.com/docker/buildx/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+	KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
 	S=${WORKDIR}/${P#docker-}
 fi
 
diff --git a/app-containers/docker-buildx/docker-buildx-0.36.1.ebuild b/app-containers/docker-buildx/docker-buildx-0.36.1.ebuild
new file mode 100644
index 000000000000..a339148875b0
--- /dev/null
+++ b/app-containers/docker-buildx/docker-buildx-0.36.1.ebuild
@@ -0,0 +1,57 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=9
+
+inherit go-module
+
+DESCRIPTION="Docker CLI plugin for extended build capabilities with BuildKit"
+HOMEPAGE="https://github.com/docker/buildx"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/docker/buildx.git"
+else
+	SRC_URI="https://github.com/docker/buildx/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+	S=${WORKDIR}/${P#docker-}
+fi
+
+LICENSE="Apache-2.0"
+# Dependent licenses
+LICENSE+=" Apache-2.0 BSD BSD-2 ISC MIT MPL-2.0 Unicode-DFS-2016"
+SLOT="0"
+
+RDEPEND="app-containers/docker-cli"
+BDEPEND=">=dev-lang/go-1.26.3"
+
+src_compile() {
+	local _buildx_r='github.com/docker/buildx'
+	local version=${PV}
+	if [[ ${PV} == 9999 ]]; then
+		version="$(git rev-parse --short HEAD)"
+	fi
+	local go_ldflags=(
+		"-linkmode=external"
+		-X "${_buildx_r}/version.Version=${version}"
+		-X "${_buildx_r}/version.Revision=$(date -u +%FT%T%z)"
+		-X "${_buildx_r}/version.Package=${_buildx_r}"
+	)
+	ego build -o docker-buildx -ldflags "${go_ldflags[*]}" ./cmd/buildx
+}
+
+src_test() {
+	# TestGit can't work in a source tarball; TestReadTargets fails seemingly due to parallelism.
+	if [[ ${PV} == 9999 ]]; then
+		ego test ./... -skip "TestReadTargets|TestIntegration"
+	else
+		ego test ./... -skip "TestGit|TestReadTargets|TestIntegration"
+	fi
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe docker-buildx
+
+	einstalldocs
+}
diff --git a/app-containers/docker-cli/Manifest b/app-containers/docker-cli/Manifest
index 68d5672b3a7c..c90b074ab356 100644
--- a/app-containers/docker-cli/Manifest
+++ b/app-containers/docker-cli/Manifest
@@ -9,3 +9,4 @@ DIST docker-cli-28.2.2.tar.gz 7531638 BLAKE2B cb7d2766e4a6c444169f8462379b8524e0
 DIST docker-cli-28.4.0.tar.gz 7612765 BLAKE2B acfa0ee4cdeb6eec31ae92eb8c0a41357aa0ff3cb34bd497307ce5f136a6f1dd4d78cbbea27b1c48b0d5995262f1e039548a725c106bcc91f48f01932354e8dc SHA512 ab35867bdcaa07909cfd24e9bc4f5cde10b6930fa42e87d61d4544bb20b365fff146713239483169ef989cacfae7d7493d7f42d269b0f37f86c0c14a9373b445
 DIST docker-cli-29.1.3.tar.gz 7303915 BLAKE2B 3d45206f91f3675171f054f5159ec38034a9d7125d1742346a9b0819af26a50616198d87640ec6e6cb0a017aa801c677d5bb85c7faf7cfbd1de81cb4f886c932 SHA512 f37a5d125eb93639db8527c826078571ef5938be6bb33d132ccf693bf0810e3b9bb354074488021e129760a44b7fc51cd8295c6c6fe79211b70736231f47320e
 DIST docker-cli-29.5.2.tar.gz 6828313 BLAKE2B c62bf6acd83a6db72dbf3f65be34e0738b38e6ade12ae15c1b1bcc69b648628b85dac523bd876c0f473cd9d12408c738b1728b8e33aab87034a76ec0aec36388 SHA512 3c569dbbcef6e9720a126147175f67297acab9a4ae8dd2af544b48eca70519dfd3c5312bf4ffab777e59a251cfdc5965217b0d3ca4c2eb41117c2e3b465bbb8a
+DIST docker-cli-29.7.2.tar.gz 6893753 BLAKE2B f744e147e32eeea233398c35b998d1e7f7b17066cd2d9c4d0fe8a2e155ff0445ff90d844181f7758c85fcd87b57e0b9a702449e9fef2131a8d9d04f186081b3f SHA512 0b118d17e205277c15b90e29a2f9bad3b385f59ea3b8d6e32371c103ceadd0fb964e91f3d57f5b87dc0a1b0778afbc41680087e91fdb4c8037abab6b6e222b80
diff --git a/app-containers/docker-cli/docker-cli-29.5.2.ebuild b/app-containers/docker-cli/docker-cli-29.5.2.ebuild
index a492870e7e0a..26a997d780ae 100644
--- a/app-containers/docker-cli/docker-cli-29.5.2.ebuild
+++ b/app-containers/docker-cli/docker-cli-29.5.2.ebuild
@@ -16,7 +16,7 @@ S="${WORKDIR}/cli-${PV}"
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv ~x86"
 IUSE="selinux"
 
 RDEPEND="selinux? ( sec-policy/selinux-docker )"
diff --git a/app-containers/docker-cli/docker-cli-29.7.2.ebuild b/app-containers/docker-cli/docker-cli-29.7.2.ebuild
new file mode 100644
index 000000000000..f87be5bce152
--- /dev/null
+++ b/app-containers/docker-cli/docker-cli-29.7.2.ebuild
@@ -0,0 +1,63 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit shell-completion go-env go-module toolchain-funcs
+MY_PV=${PV/_/-}
+
+# update this on every bump
+GIT_COMMIT=a7dcaa6fdb6ed04aacbfdc76357fdae01605609e
+
+DESCRIPTION="the command line binary for docker"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/docker/cli/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/cli-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+IUSE="selinux"
+
+RDEPEND="selinux? ( sec-policy/selinux-docker )"
+BDEPEND="
+	dev-go/go-md2man
+	>=dev-lang/go-1.25.0
+"
+
+RESTRICT="installsources strip test"
+
+src_prepare() {
+	default
+	sed -i 's@dockerd\?\.exe@@g' contrib/completion/bash/docker || die
+	ln -s vendor.mod go.mod || die
+	ln -s vendor.sum go.sum || die
+}
+
+src_compile() {
+	export DISABLE_WARN_OUTSIDE_CONTAINER=1
+
+	myemakeargs=(
+		VERSION="${PV}"
+		GITCOMMIT="${GIT_COMMIT}"
+	)
+
+	emake "${myemakeargs[@]}" dynbinary
+	tc-env_build go-env_run emake "${myemakeargs[@]}" manpages
+}
+
+src_install() {
+	dobin build/docker
+	doman man/man?/*
+	dobashcomp contrib/completion/bash/docker
+	bashcomp_alias docker dockerd
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
+}
+
+pkg_postinst() {
+	has_version "app-containers/docker-buildx" && return
+	ewarn "the 'docker build' command is deprecated and will be removed in a"
+	ewarn "future release. If you need this functionality, install"
+	ewarn "app-containers/docker-buildx."
+}
diff --git a/app-containers/docker-compose/Manifest b/app-containers/docker-compose/Manifest
index afb08e5cf84f..dad85bc68407 100644
--- a/app-containers/docker-compose/Manifest
+++ b/app-containers/docker-compose/Manifest
@@ -1,4 +1,5 @@
 DIST compose-5.1.4-vendor.tar.xz 3753076 BLAKE2B 4fca50a6638ae928f33787d987edf9444df1992056a929c2fe8514c63023454476bb490f76399022297d570b376a8657029f17ca98f8d637c06a9fb7561773df SHA512 ee5ef37bb76eead1b221920f5ae7788a50c0c705eb2e51118c7b6d31fd7725a9ffed1cc785039170ab78c4a71a03ecb7fc6486ed3822a2adef2efea6d68ec9f0
+DIST compose-5.4.0-vendor.tar.xz 6229064 BLAKE2B 0dd8e4392040e234df76fb8cf304771bbb3d4656d6e18713563048cc6373b8fed53db9656a143f48272a91410ee61dd09bd29af4653d273774464adeed6312cb SHA512 dd6bb4e9c7fe9afde64f2c13bc3bbb6e000f68dad8ff69e58a19e2a61923c006532e0a03f193a3c7ed245f3105ca3bb49587e5ae9518fee67adf708c1173a183
 DIST docker-compose-2.34.0-deps.tar.xz 61127872 BLAKE2B e676e93203ae0e670d7cedb6b8771aea01d501246bd9e2c997fc1f03ae6db16fc7816e05ae69bfda6fc83f912d5ccd82a1b7f22781cb5fce4910c326b63f93c7 SHA512 a7f7d710b03e52c3559c84e48e2171e9aa7d2f7c357f1a44963de396a4491a53fdea9e138c57d092572e1a6833e7d3e9ea50ea7e17885c7e37f9ded6cad1cf5e
 DIST docker-compose-2.34.0.gh.tar.gz 397231 BLAKE2B e500fcbb8e6d7ffb08ff43f667faf73dcc29c6084a8a105d1b3c3d0733681ed2499312f056406c6f95d108359f07d92c21e8e2384bd309514b7140bd8a939269 SHA512 8e2ca8cd3b23328a6655c235c6c515343cc848fb1d139a1e981c81a88595edfed4e9d6450f98eebfb8ff73c02c7fbf2aac6206e8fe90eb7883cb6edc6ec0682c
 DIST docker-compose-2.39.3-deps.tar.xz 61486084 BLAKE2B 1e1398f30992b2b8777d78ad13361a684ef83c8036e9d0a24a2d74fc81354e5fab7e9c2f27c695580b839237ec8d99ad7a08976b3308349905e03a390e08e25e SHA512 a20c66e0536b0ac40c34f043e63d73b1f6838e841de52ada307ba5f9793bbb41cfb00333fc0681764818386c483ce9f25c5f123ceba6a6c1d05d386c2b5a8b79
@@ -8,3 +9,4 @@ DIST docker-compose-2.40.3.gh.tar.gz 430320 BLAKE2B a4272a1b65a372adb25caf1363c7
 DIST docker-compose-5.0.1-deps.tar.xz 56998332 BLAKE2B bbef3088ba0f766201a3b0126ecf72526d25c4c6dc5395ca51a85871c3e8b8cf8c695644017adeb8295c3cbeffe99caec7bcacef172ab5471b60510bf805e25d SHA512 88f30c0241ad28558ab42206e59b1c6ff76c7dbe7abd113ffdb22fc0aaa045352e3e01d572655dff7dce0280b4aa931497ba1aeced3860fef9cde7a71878252d
 DIST docker-compose-5.0.1.gh.tar.gz 429760 BLAKE2B 57cc76dfae0c4289153d8518430c9b43a883a2ea6f21b1e6fc91ff56b84a2513cbdc1994a27bff97d8ec3c00bdd25dbb8011d4e74f9b24c704556267c0468ec1 SHA512 d9f5d3fa85bf39076c3b3f2d73a19bec95565c92481b061e78c3d1a8fa575022ef854f5f52ea6c10e13fbc6e06e4ab7bcd1e11bee49ed2e13a5d8dfec69ce4e5
 DIST docker-compose-5.1.4.gh.tar.gz 461373 BLAKE2B 5c7155de714767535f06b407a5bf4784fbd4429845025fde1ebaba277887f8a4341f252569c14db8ee34d5a115720c8594f4c481f41ea8a929a322febbe853a6 SHA512 b9cc1c74251f97b4eef6448f66e58613c3b22b683ea92bebb6d8279b00739c285170d6cdc059e7341cb419c197b47958c6ad446ca763c93121ee524e57412a68
+DIST docker-compose-5.4.0.gh.tar.gz 537639 BLAKE2B 569a92593227bc924cf9944aa399f862f7ee8d8d82baccec1d4c6e5a5b6cbd08b6f0d3f1fbb9213cf641ca189aef7022edfdf515700f1a713dbf6b106bfe4d55 SHA512 46819486e3de32f3a07821acde6c2361dcfde307779247c55f51c5ed1cf4df1103d8d2475590d53999693cbfd2baf71404f81f05ebfc9fbb1adbf90f8800cdc5
diff --git a/app-containers/docker-compose/docker-compose-5.1.4-r1.ebuild b/app-containers/docker-compose/docker-compose-5.1.4-r1.ebuild
index 182562bd89be..1afbb0d95310 100644
--- a/app-containers/docker-compose/docker-compose-5.1.4-r1.ebuild
+++ b/app-containers/docker-compose/docker-compose-5.1.4-r1.ebuild
@@ -13,7 +13,7 @@ S="${WORKDIR}/compose-${PV}"
 
 LICENSE="Apache-2.0"
 SLOT="2"
-KEYWORDS="~amd64 ~arm64"
+KEYWORDS="amd64 arm64"
 RESTRICT="test"
 
 RDEPEND="
diff --git a/app-containers/docker-compose/docker-compose-5.4.0.ebuild b/app-containers/docker-compose/docker-compose-5.4.0.ebuild
new file mode 100644
index 000000000000..9d806b03aab0
--- /dev/null
+++ b/app-containers/docker-compose/docker-compose-5.4.0.ebuild
@@ -0,0 +1,55 @@
+# Copyright 2018-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=9
+
+inherit optfeature
+
+DESCRIPTION="Multi-container orchestration for Docker"
+HOMEPAGE="https://github.com/docker/compose"
+SRC_URI="https://github.com/docker/compose/archive/v${PV}.tar.gz -> ${P}.gh.tar.gz"
+SRC_URI+=" https://github.com/gentoo-golang-dist/compose/releases/download/v${PV}/compose-${PV}-vendor.tar.xz"
+S="${WORKDIR}/compose-${PV}"
+
+LICENSE="Apache-2.0"
+# Dependent licenses
+LICENSE+=" Apache-2.0 BSD BSD-2 MIT MPL-2.0"
+SLOT="2"
+KEYWORDS="~amd64 ~arm64"
+RESTRICT="test"
+
+RDEPEND="
+	|| (
+		>=app-containers/docker-cli-29.7.2
+		app-containers/podman[wrapper(+)]
+	)
+"
+BDEPEND=">=dev-lang/go-1.26.3"
+
+src_compile() {
+	emake VERSION=v${PV}
+}
+
+src_test() {
+	emake test
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe bin/build/docker-compose
+	dodoc README.md
+}
+
+pkg_postinst() {
+	optfeature "credential store support" app-containers/docker-credential-helpers
+
+	if ver_replacing -lt 2; then
+		ewarn
+		ewarn "docker-compose 2.x is a sub command of docker"
+		ewarn "Use 'docker compose' from the command line instead of"
+		ewarn "'docker-compose'"
+		ewarn "If you need to keep 1.x around, please run the following"
+		ewarn "command before your next --depclean"
+		ewarn "# emerge --noreplace docker-compose:0"
+	fi
+}
diff --git a/app-containers/docker-credential-helpers/Manifest b/app-containers/docker-credential-helpers/Manifest
index 3b8421432c95..0200f125812f 100644
--- a/app-containers/docker-credential-helpers/Manifest
+++ b/app-containers/docker-credential-helpers/Manifest
@@ -1,2 +1,3 @@
 DIST docker-credential-helpers-0.9.3.tar.gz 295607 BLAKE2B 4b59acf426cba27abe0f024b9479331f967bece8fd97bf3104ffcf17fc3a1f02e8248142177a19325a8941e71e5f26acc5fbdc1daa067e47ca29a98bb60af8c4 SHA512 01f58de113a402319e2695aba140322be13b03d234e2582c438735e178dfb999fa6e15abfcef4431490b2def87e7d1cb27d6ae855d348f30a878caf21d7f9a02
 DIST docker-credential-helpers-0.9.7.tar.gz 295449 BLAKE2B 6a02deb0031dfac2ef9f194b00f7e4b26391876091bcd6439192965e2373d7fbefea76ced069cc49f8e807dce75f00594f38d5c7585d8f7d1c890edd1f610a69 SHA512 cacfc2c7d68667df4a3e45bcb27a11e461734772a96cf6d0e7f4d91ccac745caccc311e12edfda3841ded7531b98c7d66c79fafd30e099094d40eb14c8030feb
+DIST docker-credential-helpers-0.9.8.tar.gz 295446 BLAKE2B fb704caf4c1d1fb1004650e10b9966acf75e238cc64be58e9375b988c13a18985b2f86300472eccddda649204167058330707d930b6688cdd01aee9b8d4b11c1 SHA512 9485e12c4b5e8fc44248d3777409220e39aa7a3b196cf57c9704bc8bba1cd98cf9dc92cef7095a4277b3e0f816ed180cdb286acb9d2b505458559e374dff91e4
diff --git a/app-containers/docker-credential-helpers/docker-credential-helpers-0.9.8.ebuild b/app-containers/docker-credential-helpers/docker-credential-helpers-0.9.8.ebuild
new file mode 100644
index 000000000000..456d6f7a44e4
--- /dev/null
+++ b/app-containers/docker-credential-helpers/docker-credential-helpers-0.9.8.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=9
+
+inherit go-module
+
+DESCRIPTION="Suite of programs to use native stores to keep Docker credentials safe"
+HOMEPAGE="https://github.com/docker/docker-credential-helpers"
+SRC_URI="https://github.com/docker/docker-credential-helpers/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+
+IUSE="keyring pass"
+REQUIRED_USE="|| ( keyring pass )"
+RESTRICT="test"
+
+DEPEND="keyring? ( app-crypt/libsecret )"
+RDEPEND="${DEPEND}
+	pass? ( app-admin/pass )
+"
+
+src_prepare() {
+	default
+	sed -e '/GO_LDFLAGS/s/ -s / /' -i Makefile || die
+}
+
+src_compile() {
+	local mymakeflags=(
+		VERSION="${PV}"
+		REVISION="v${PV}"
+	)
+	use keyring && mymakeflags+=( secretservice )
+	use pass && mymakeflags+=( pass )
+	emake -j1 "${mymakeflags[@]}"
+}
+
+src_install() {
+	dobin bin/build/*
+	dodoc MAINTAINERS README.md
+}
+
+pkg_postinst() {
+	if use keyring; then
+		elog "For keyring/kwallet add:\n"
+		elog '		"credStore": "secretservice"'"\n"
+	fi
+	if use pass; then
+		elog "For 'pass' add:\n"
+		elog '		"credStore": "pass"'"\n"
+	fi
+	elog "to your ~/.docker/config.json"
+}
diff --git a/app-containers/docker/Manifest b/app-containers/docker/Manifest
index d3b72581dc0e..eadb535aae5b 100644
--- a/app-containers/docker/Manifest
+++ b/app-containers/docker/Manifest
@@ -5,3 +5,4 @@ DIST docker-28.2.2.tar.gz 17861904 BLAKE2B 6f55e96d653579b749908080550ebee063554
 DIST docker-28.4.0.tar.gz 18066393 BLAKE2B 70c9910bec169994ddd39f46e4a7042e5f38a3b76e8a43389ee934fb7f3c75ae686f32ad7f3cbc0dcff210b5c0eeed24674db0fdf4e845e78c330cf6c2b75918 SHA512 a98f8012547dc1e61e6a4f420355d29fbd6f6ddb5642601d8762099768e0b284fcf129ee31af155049731f61f43ff4efe42313467055dae32337dc5cc8c8cf78
 DIST docker-29.1.3.tar.gz 19491833 BLAKE2B ded1a1832b1ce037776e04855a0ea7c3f45981df41bdace54c3b84496a2990b0450ed62b34a6f3c289dec2643d28a7563c9afba55c88fc0e1cc4fb7855220800 SHA512 e3fa96057beb2849fea6e4fd480b08ffbe9b74b851060901e54e57aa62938888b260b7cef4cee33d4cffd965fabc0db7fc0aa5aeeae9aa6b9870c3dbcf7b6ec3
 DIST docker-29.5.2.tar.gz 21115630 BLAKE2B f47b730a470c0ab4868beb6d4187b9ff34d06ecf4f381f3e89b89e6f9b18b5bf4c9220ee2e0d6977d4b2b0dfddd4fb9f7e171316dcb2935428bfc9ca350dd17f SHA512 c5cbb956711e9ce8dbab010bf1eab3fd9b35e35806188e3030a3bbeafb545f4024504577df7c39588672c8d5252f6ab071bcfd6377867f4668b75855571469fb
+DIST docker-29.7.2.tar.gz 22043949 BLAKE2B 78bd52de33f2ecbc4272150add52b4b293629aeae2aa746f32c5134c2905a93cfc92db65510f707621689d8794c6a759952b58bd50a3852149cbeeab3f29d12c SHA512 f04e264c499854525ed7ef694ebea3c9fd449c6a538ed449e228728b87b654c86962d639fad45081d328db749f58493e18286217d2d95ca492028b79c99c0beb
diff --git a/app-containers/docker/docker-29.5.2.ebuild b/app-containers/docker/docker-29.5.2.ebuild
index 56db6666c11c..8d1387f71863 100644
--- a/app-containers/docker/docker-29.5.2.ebuild
+++ b/app-containers/docker/docker-29.5.2.ebuild
@@ -15,7 +15,7 @@ S="${WORKDIR}/moby-${PN}-v${PV}"
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
 IUSE="apparmor btrfs +container-init cuda +overlay2 seccomp selinux systemd"
 
 DEPEND="
diff --git a/app-containers/docker/docker-29.7.2.ebuild b/app-containers/docker/docker-29.7.2.ebuild
new file mode 100644
index 000000000000..045910e450c0
--- /dev/null
+++ b/app-containers/docker/docker-29.7.2.ebuild
@@ -0,0 +1,337 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+MY_PV=${PV/_/-}
+
+inherit go-module linux-info optfeature systemd toolchain-funcs udev
+
+GIT_COMMIT=6a43e3d5afddf4111da0f864bbc7cae5d7e95001
+
+DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/moby/moby/archive/${PN}-v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/moby-${PN}-v${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs +container-init cuda +overlay2 seccomp selinux systemd"
+
+DEPEND="
+	acct-group/docker
+	>=dev-db/sqlite-3.7.9:3
+	net-firewall/nftables:=
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
+	seccomp? ( >=sys-libs/libseccomp-2.2.1 )
+	systemd? ( sys-apps/systemd )
+"
+
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
+RDEPEND="
+	${DEPEND}
+	sys-process/procps
+	>=dev-vcs/git-1.7
+	>=app-arch/xz-utils-4.9
+	>=app-containers/containerd-2.2.0[apparmor?,btrfs?,seccomp?]
+	>=app-containers/runc-1.2.6[apparmor?,seccomp?]
+	!app-containers/docker-proxy
+	!<app-containers/docker-cli-${PV}
+	container-init? ( >=sys-process/tini-0.19.0[static] )
+	cuda? ( app-containers/nvidia-container-toolkit )
+	selinux? ( sec-policy/selinux-docker )
+"
+
+# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+	>=dev-lang/go-1.26.3
+"
+# tests require running dockerd as root and downloading containers
+RESTRICT="installsources strip test"
+
+# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
+pkg_setup() {
+	# this is based on "contrib/check-config.sh" from upstream's sources
+	# required features.
+	CONFIG_CHECK="
+		~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
+		~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
+		~KEYS
+		~VETH ~BRIDGE ~BRIDGE_NETFILTER
+		~IP_NF_FILTER ~IP_NF_RAW ~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~NETFILTER_XT_MARK
+		~IP_NF_NAT ~NF_NAT
+		~POSIX_MQUEUE
+	"
+	WARNING_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: is required for bind-mounting /dev/mqueue into containers"
+
+	if kernel_is ge 6 17; then
+		CONFIG_CHECK+="
+			~IP_NF_IPTABLES_LEGACY
+			~NETFILTER_XTABLES_LEGACY
+		"
+	fi
+
+	if kernel_is lt 4 8; then
+		CONFIG_CHECK+="
+			~DEVPTS_MULTIPLE_INSTANCES
+		"
+	fi
+
+	if kernel_is le 5 1; then
+		CONFIG_CHECK+="
+			~NF_NAT_IPV4
+		"
+	fi
+
+	if kernel_is le 5 2; then
+		CONFIG_CHECK+="
+			~NF_NAT_NEEDED
+		"
+	fi
+
+	if kernel_is ge 4 15; then
+		CONFIG_CHECK+="
+			~CGROUP_BPF
+		"
+	fi
+
+	# optional features
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	if use seccomp; then
+		CONFIG_CHECK+="
+			~SECCOMP ~SECCOMP_FILTER
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+			"
+	fi
+
+	if kernel_is le 5 8; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP_ENABLED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NATIVE
+		"
+	if kernel_is lt 5 19; then
+		CONFIG_CHECK+="
+			~LEGACY_VSYSCALL_EMULATE
+			"
+	fi
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NONE
+		"
+	WARNING_LEGACY_VSYSCALL_NONE="CONFIG_LEGACY_VSYSCALL_NONE enabled: \
+		Containers with <=glibc-2.13 will not work"
+
+	if kernel_is le 4 5; then
+		CONFIG_CHECK+="
+			~MEMCG_KMEM
+		"
+	fi
+
+	if kernel_is lt 5; then
+		CONFIG_CHECK+="
+			~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP ~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP ~CGROUP_NET_PRIO
+		~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		"
+
+	if use selinux; then
+		CONFIG_CHECK+="
+			~SECURITY_SELINUX
+			"
+	fi
+
+	if use apparmor; then
+		CONFIG_CHECK+="
+			~SECURITY_APPARMOR
+			"
+	fi
+
+	# if ! is_set EXT4_USE_FOR_EXT2; then
+	#	check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
+	#	if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
+	#		echo "    $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
+	#	fi
+	# fi
+
+	CONFIG_CHECK+="
+		~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
+	"
+
+	# if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
+	#	if is_set EXT4_USE_FOR_EXT2; then
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
+	#	else
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
+	#	fi
+	# fi
+
+	# network drivers
+	CONFIG_CHECK+="
+		~VXLAN ~BRIDGE_VLAN_FILTERING
+		~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH
+		~XFRM ~XFRM_USER ~XFRM_ALGO ~INET_ESP
+	"
+	if kernel_is le 5 3; then
+		CONFIG_CHECK+="
+			~INET_XFRM_MODE_TRANSPORT
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~IPVLAN
+		"
+	CONFIG_CHECK+="
+		~MACVLAN ~DUMMY
+		"
+	CONFIG_CHECK+="
+		~NF_NAT_FTP ~NF_CONNTRACK_FTP ~NF_NAT_TFTP ~NF_CONNTRACK_TFTP
+	"
+
+	# storage drivers
+	if use btrfs; then
+		CONFIG_CHECK+="
+			~BTRFS_FS
+			~BTRFS_FS_POSIX_ACL
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~OVERLAY_FS
+	"
+
+	linux-info_pkg_setup
+}
+
+src_unpack() {
+	default
+	go-module_src_unpack
+	cd "${S}"
+	[[ -f go.mod ]] || ln -s vendor.mod go.mod || die
+	[[ -f go.sum ]] || ln -s vendor.sum go.sum || die
+}
+
+src_compile() {
+	export DOCKER_GITCOMMIT="${GIT_COMMIT}"
+	export VERSION=${PV}
+	tc-export PKG_CONFIG
+
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+
+	# let's set up some optional features :)
+	export DOCKER_BUILDTAGS=''
+	for gd in btrfs overlay2; do
+		if ! use $gd; then
+			DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
+		fi
+	done
+
+	for tag in apparmor seccomp; do
+		if use $tag; then
+			DOCKER_BUILDTAGS+=" $tag"
+		fi
+	done
+
+	export AUTO_GOPATH=1
+	export EXCLUDE_AUTO_BUILDTAG_JOURNALD=$(usex systemd '' 'y')
+	export GO_MD2MAN=/usr/bin/go-md2man
+
+	# build binaries
+	./hack/make.sh dynbinary || die 'dynbinary failed'
+
+	# build man page
+	cd man || die
+	emake || die
+}
+
+src_install() {
+	dosym containerd /usr/bin/docker-containerd
+	dosym containerd-shim-runc-v2 /usr/bin/docker-containerd-shim
+	dosym runc /usr/bin/docker-runc
+	use container-init && dosym tini /usr/bin/docker-init
+	dobin bundles/dynbinary-daemon/dockerd
+	dobin bundles/dynbinary-daemon/docker-proxy
+	for f in dockerd-rootless-setuptool.sh dockerd-rootless.sh; do
+		dosym ../share/docker/contrib/${f} /usr/bin/${f}
+	done
+
+	newinitd contrib/init/openrc/docker.initd docker
+	newconfd contrib/init/openrc/docker.confd docker
+
+	systemd_dounit contrib/init/systemd/docker.{service,socket}
+
+	dodoc AUTHORS CONTRIBUTING.md NOTICE README.md
+	dodoc -r docs/*
+	doman man/man8/dockerd.8
+
+	# note: intentionally not using "doins" so that we preserve +x bits
+	dodir /usr/share/${PN}/contrib
+	cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
+}
+
+pkg_postinst() {
+	udev_reload
+
+	elog
+	elog "To use Docker, the Docker daemon must be running as root. To automatically"
+	elog "start the Docker daemon at boot:"
+	if systemd_is_booted || has_version sys-apps/systemd; then
+		elog "  systemctl enable docker.service"
+	else
+		elog "  rc-update add docker default"
+	fi
+	elog
+	elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
+	elog '  usermod -aG docker <youruser>'
+	elog
+
+	if has_version sys-fs/zfs; then
+		elog " ZFS storage driver is available"
+		elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
+		elog
+	fi
+
+	optfeature "rootless mode support" sys-apps/shadow
+	optfeature "rootless mode support" sys-apps/rootlesskit
+	optfeature_header "for rootless mode you also need a network stack"
+	optfeature "rootless mode network stack" app-containers/slirp4netns
+}
diff --git a/app-containers/netavark/Manifest b/app-containers/netavark/Manifest
index cf3aac523d5e..2304d8acd94e 100644
--- a/app-containers/netavark/Manifest
+++ b/app-containers/netavark/Manifest
@@ -1,6 +1,8 @@
 DIST netavark-1.17.1.crate 174659 BLAKE2B a31fd13f31b671274000ae6a43ceefb0b0d1cd32026fd86ac01dc30acb55cf25b28016e5a8e7c91760384e61bb62d6edfcd48b163abc2000ff43201edac7e054 SHA512 dff64afaf982ba38c8a991ffafffbba2dce7abf70b4763eba662ef82f01629f265e2421d622a27a1db9e26ea44f33b5c8dbab2fdcf9b643b3d845b8ca624ba57
 DIST netavark-1.17.2.crate 175788 BLAKE2B 94f6f202eca445267f063d53a47e572055fa6a7b2839d5e95246ff93dad0c55866571456459600cd57f42001dd75b4ae5bbdad6e7b95fa9b95616137fd87f03d SHA512 7a6a12fb58a190462d6a2171ac28df03686d09d371cb84e702278cda190111c24603060048f8cf7bd9a8ad334dc056efaa901604d08145009adf9e10eabf1aee
 DIST netavark-2.0.0.crate 185348 BLAKE2B 591e413e2058c2df3b66fa06eb8d13f0d19a7b9b8c29cc804cd1c38932f7e1df4c6ac9033b3ed40b494053c1decb4a8d703404b13a89123ddbfb4d4ad1ad2511 SHA512 384940e713162f149ca8ebb8c03e4ac505cab8482155fbd622091d165ceb0f0101842e87fb11b57e57ed677cd31ce3a77f140b2cb8b2852754d31eea3962895a
+DIST netavark-2.1.0.crate 188118 BLAKE2B 2a1cf5a4236428f356635551a15f65e1d3604257a816c45641ac4d99a4aba09c85a69ea82e468d8f1bac7f5f4431e65b410e69e17c34145ebb48301e80b726b7 SHA512 68ebb930e96e5d3b2cbeb2f7fa42fcb98cc53dc0e9bccdba07c4927cf0c3ec8d5d6480fff5aa99265ee8cc41739499c554f91b1ff8b3d4ffa3cd263889467bf5
 DIST netavark-v1.17.1-vendor.tar.gz 17711446 BLAKE2B d3b7030d411a4bd848127508e43a65e278a75a1ffcdca7b9e8ea46180d2e8da26be5e4eaa21fad22197f9eb9fd28413dc21a7d10b42f98d882990eeb750bb737 SHA512 9f7e5ee54b776ec27511a937e6ebb30b70a527f9232d635a9755459afee569fc37d715626b92ea2aa08637d6e63dada4f55ad6757f3a0a7aae753637349f6193
 DIST netavark-v1.17.2-vendor.tar.gz 17711355 BLAKE2B a4967f3496635da375aa9adb22b9d5cdef2b5463b53b7bb31c1d0236c84edb36727a391cdbf8c81a7b2caa2675c173ff01ee3974465d4143c139d956951ff774 SHA512 2d34a237c540acd05590c09f07e57b1b0a765b746332cbc27337a4c31e2db4b92861629b1418a9c3990a0f25c659d537a8c7b7d2e63247fa3df39c092e80a59d
 DIST netavark-v2.0.0-vendor.tar.gz 20282162 BLAKE2B bed4a1023d20c88985fd8ad07e24a051f37483fab12e1770bf62a01cd092f1329b47a876fe989839db1543de317d16cbf985fd9730767908e0a0f1b5c970407b SHA512 125dcded2218e183020582c2bb1778667d812cb5009c6264fec14b0500329c493a57a01f0c72e1e2d7cc2cfef4462b0ccc68af1b4f745e35bddbcc1550835509
+DIST netavark-v2.1.0-vendor.tar.gz 20936193 BLAKE2B 12e94fb0b6f3af2f3128d5864ce6a371e4e901389e65ad6ba2dde44f713573cc7292ccc598e47e21ab27944d6c6edb5a39adf115bf35767e7dcef273851fdaa7 SHA512 175a93d38579bee64a9dcc1b834f5d229a8e3129184076ffe7e164a4a71ada514828ff8a63a78eaec0b607d89cabb045363ee86e11695122d76f99cc7bef1151
diff --git a/app-containers/netavark/netavark-2.1.0.ebuild b/app-containers/netavark/netavark-2.1.0.ebuild
new file mode 100644
index 000000000000..9d93db474e95
--- /dev/null
+++ b/app-containers/netavark/netavark-2.1.0.ebuild
@@ -0,0 +1,65 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+[[ ${PV} == 9999* ]] || CRATES="${PN}@${PV}"
+RUST_MIN_VER="1.88.0"
+
+inherit cargo systemd
+
+DESCRIPTION="A container network stack"
+HOMEPAGE="https://github.com/containers/netavark"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/netavark.git"
+else
+	SRC_URI="${CARGO_CRATE_URIS} https://github.com/containers/netavark/releases/download/v${PV}/${PN}-v${PV}-vendor.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv"
+fi
+
+# main
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" Apache-2.0-with-LLVM-exceptions BSD BSD-2 Boost-1.0 MIT Unicode-DFS-2016 Unlicense ZLIB"
+SLOT="0"
+
+RDEPEND="
+	>=app-containers/aardvark-dns-2.0.0
+	net-firewall/nftables[json]
+	!<app-containers/buildah-1.44.0
+	!<app-containers/podman-6.0.0
+"
+BDEPEND="dev-go/go-md2man
+	dev-libs/protobuf[protoc(+)]"
+
+QA_FLAGS_IGNORED="usr/libexec/podman/${PN}"
+QA_PRESTRIPPED="usr/libexec/podman/${PN}"
+
+ECARGO_VENDOR="${WORKDIR}/vendor"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		cargo_live_src_unpack
+	else
+		cargo_src_unpack
+	fi
+}
+
+src_prepare() {
+	default
+	sed -i -e "s|m0755 bin|m0755 $(cargo_target_dir)|g;" Makefile || die
+}
+
+src_compile() {
+	cargo_src_compile
+	export PREFIX="${EPREFIX}"/usr SYSTEMDDIR="$(systemd_get_systemunitdir)"
+	emake docs
+}
+
+# Following is needed because we want to use `make install` instead of `cargo install` (exported by cargo.eclass)
+src_install() {
+	default
+}
diff --git a/app-containers/runc/runc-1.4.3.ebuild b/app-containers/runc/runc-1.4.3.ebuild
index 5d640bb08977..54612d653df3 100644
--- a/app-containers/runc/runc-1.4.3.ebuild
+++ b/app-containers/runc/runc-1.4.3.ebuild
@@ -17,7 +17,7 @@ S="${WORKDIR}/${PN}-${MY_PV}"
 
 LICENSE="Apache-2.0 BSD-2 BSD MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
 IUSE="apparmor +seccomp selinux test"
 
 COMMON_DEPEND="