Adding metadata

author: root <root@alpha.trunkmasters.com> 2026-06-12 19:09:37 -0500
committer: root <root@alpha.trunkmasters.com> 2026-06-12 19:09:37 -0500
commit: b590c8d7572b727d565cc0b8ff660d43569845de (patch)
tree: 06f7a4102ea4e845df8b66660f252920d52952f9 /app-containers
parent: 24f9cbfc4c34fdb6a6e03311674414e881ceab47 (diff)
download: baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.tar.gz
baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.tar.xz
baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.zip
372 files changed, 18576 insertions, 0 deletions
diff --git a/app-containers/aardvark-dns/Manifest b/app-containers/aardvark-dns/Manifest
new file mode 100644
index 000000000000..9d55d9815e7c
--- /dev/null
+++ b/app-containers/aardvark-dns/Manifest
@@ -0,0 +1,6 @@
+DIST aardvark-dns-1.15.0.crate 59884 BLAKE2B 6be0126b526359b1c402a6f10cfe9b28b9d351621b0f1e9556150fb2477a2c468938dbac1c11bde3eff6deb258ccfa6ed05e6f2a01206d3e08f1e88193016432 SHA512 963d68a662439ea920fbeec08eaa3b9fb486f5e61e46b702b0c9211241c3b1057ce573bac1f75ed558faa0cc99b0f36b7f5299c296e30b6ce6ed046a02cd9782
+DIST aardvark-dns-1.17.0.crate 62370 BLAKE2B 7105e4c96e973d6cbda48d7db957423a0743330c53fd694be14951b85ba162624ffa3d96d6737856d7e5d39910a26403a4ab11e912317d6449a85642c8c5d236 SHA512 f8cc4f39b9a16106a7fbe08c94558507e0519018709ceb80474696be24328626f76aedf9bdd12c853be0728f4e9c57e945b442e7f66c22042e25410a690b69e0
+DIST aardvark-dns-1.17.1.crate 62779 BLAKE2B 487b8de4d01df37ca8eef8b911f8231db1df4417a61b921e1c109661af0270115b8941d56493a468a6ecd58174c0074a5c8687c8d4ae6d21bfc028efae45d663 SHA512 eee8ecd47626093dd2f0a60f862593c035efc87fd4ba9fc209c93f75ca624300bc70ecc11a3828198eb36ff97ab0bb32ba090c0708793279117793876ede47a3
+DIST aardvark-dns-v1.15.0-vendor.tar.gz 9910590 BLAKE2B 876be4b719cf7d364dbd8ce04a3984d32b24dfba81ece1ce56d1f3e3f80f2607eefd77ff7dece2a678240b1f996cb498ae81f1be06c8f7eaa696eb6001090e4b SHA512 fbe6e77a2d412ed34bcf2c710db3aa8989a5887ab475988c393fb1c49584cac5b09a34b82e880eebe81c59af7817985af87391ffb8421da07abf080704cae5c0
+DIST aardvark-dns-v1.17.0-vendor.tar.gz 10267613 BLAKE2B 72b5da08584c5a35188d50646ec98b6463578b09520121224807e3770d6e911b12f61597ca5852be75a8e9de9ade02d507f490ff3a414e681fe31076930dde78 SHA512 b7ec2a2a34d5bb36dbcc55611dc9ec0ff2c1bed4469cc4b12d4eb0bd78bb7d6cae6f80a02ac32ade5c435fdd11e22ddd99646aa4de504c8369ee56cfa470e6a5
+DIST aardvark-dns-v1.17.1-vendor.tar.gz 10267576 BLAKE2B 984a27b5dbd773d9fa2db7123e8bd16f59407249caa1ab203d76bd1626b63e7bbadcf9a32e46b087d8cbb38442e7203bd810ce8d45c988e24c3237ea282def0a SHA512 ce6768f90a731a55511fdb78f8048ed3c5ff4b058d3edfc7832430330a239b58b6250851c6a268706f24b4fc94f47afd6ce4c1e4cbb1132e0dc7a2d0127d62ff
diff --git a/app-containers/aardvark-dns/aardvark-dns-1.15.0.ebuild b/app-containers/aardvark-dns/aardvark-dns-1.15.0.ebuild
new file mode 100644
index 000000000000..bdd917d608eb
--- /dev/null
+++ b/app-containers/aardvark-dns/aardvark-dns-1.15.0.ebuild
@@ -0,0 +1,47 @@
+# Copyright 2023-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+[[ ${PV} == 9999* ]] || CRATES="${PN}@${PV}"
+inherit cargo
+
+DESCRIPTION="A container-focused DNS server"
+HOMEPAGE="https://github.com/containers/aardvark-dns"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/aardvark-dns.git"
+else
+	SRC_URI="${CARGO_CRATE_URIS}"
+	SRC_URI+="https://github.com/containers/aardvark-dns/releases/download/v${PV}/${PN}-v${PV}-vendor.tar.gz"
+	KEYWORDS="amd64 arm64 ~loong ~ppc64 ~riscv"
+fi
+
+# main
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" 0BSD Apache-2.0-with-LLVM-exceptions MIT Unlicense Unicode-DFS-2016 ZLIB"
+SLOT="0"
+QA_FLAGS_IGNORED="usr/libexec/podman/${PN}"
+QA_PRESTRIPPED="usr/libexec/podman/${PN}"
+ECARGO_VENDOR="${WORKDIR}/vendor"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		cargo_live_src_unpack
+	else
+		cargo_src_unpack
+	fi
+}
+
+src_prepare() {
+	default
+	sed -i -e "s|m0755 bin|m0755 $(cargo_target_dir)|g;" Makefile || die
+}
+
+src_install() {
+	export PREFIX="${EPREFIX}"/usr
+	default
+}
diff --git a/app-containers/aardvark-dns/aardvark-dns-1.17.0.ebuild b/app-containers/aardvark-dns/aardvark-dns-1.17.0.ebuild
new file mode 100644
index 000000000000..923193403ec5
--- /dev/null
+++ b/app-containers/aardvark-dns/aardvark-dns-1.17.0.ebuild
@@ -0,0 +1,49 @@
+# Copyright 2023-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+RUST_MIN_VER="1.87.0"
+[[ ${PV} == 9999* ]] || CRATES="${PN}@${PV}"
+inherit cargo
+
+DESCRIPTION="A container-focused DNS server"
+HOMEPAGE="https://github.com/containers/aardvark-dns"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/aardvark-dns.git"
+else
+	SRC_URI="${CARGO_CRATE_URIS}"
+	SRC_URI+="https://github.com/containers/aardvark-dns/releases/download/v${PV}/${PN}-v${PV}-vendor.tar.gz"
+	KEYWORDS="amd64 arm64 ~loong ~ppc64 ~riscv"
+fi
+
+# main
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" 0BSD Apache-2.0-with-LLVM-exceptions MIT Unlicense Unicode-DFS-2016 ZLIB"
+SLOT="0"
+
+QA_FLAGS_IGNORED="usr/libexec/podman/${PN}"
+QA_PRESTRIPPED="usr/libexec/podman/${PN}"
+ECARGO_VENDOR="${WORKDIR}/vendor"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		cargo_live_src_unpack
+	else
+		cargo_src_unpack
+	fi
+}
+
+src_prepare() {
+	default
+	sed -i -e "s|m0755 bin|m0755 $(cargo_target_dir)|g;" Makefile || die
+}
+
+src_install() {
+	local -x PREFIX="${EPREFIX}"/usr
+	default
+}
diff --git a/app-containers/aardvark-dns/aardvark-dns-1.17.1.ebuild b/app-containers/aardvark-dns/aardvark-dns-1.17.1.ebuild
new file mode 100644
index 000000000000..7eae965ad9c9
--- /dev/null
+++ b/app-containers/aardvark-dns/aardvark-dns-1.17.1.ebuild
@@ -0,0 +1,49 @@
+# Copyright 2023-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+RUST_MIN_VER="1.88.0"
+[[ ${PV} == 9999* ]] || CRATES="${PN}@${PV}"
+inherit cargo
+
+DESCRIPTION="A container-focused DNS server"
+HOMEPAGE="https://github.com/containers/aardvark-dns"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/aardvark-dns.git"
+else
+	SRC_URI="${CARGO_CRATE_URIS}"
+	SRC_URI+="https://github.com/containers/aardvark-dns/releases/download/v${PV}/${PN}-v${PV}-vendor.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv"
+fi
+
+# main
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" 0BSD Apache-2.0-with-LLVM-exceptions MIT Unlicense Unicode-DFS-2016 ZLIB"
+SLOT="0"
+
+QA_FLAGS_IGNORED="usr/libexec/podman/${PN}"
+QA_PRESTRIPPED="usr/libexec/podman/${PN}"
+ECARGO_VENDOR="${WORKDIR}/vendor"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		cargo_live_src_unpack
+	else
+		cargo_src_unpack
+	fi
+}
+
+src_prepare() {
+	default
+	sed -i -e "s|m0755 bin|m0755 $(cargo_target_dir)|g;" Makefile || die
+}
+
+src_install() {
+	local -x PREFIX="${EPREFIX}"/usr
+	default
+}
diff --git a/app-containers/aardvark-dns/aardvark-dns-9999.ebuild b/app-containers/aardvark-dns/aardvark-dns-9999.ebuild
new file mode 100644
index 000000000000..1272b60d0939
--- /dev/null
+++ b/app-containers/aardvark-dns/aardvark-dns-9999.ebuild
@@ -0,0 +1,49 @@
+# Copyright 2023-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+RUST_MIN_VER="1.87.0"
+[[ ${PV} == 9999* ]] || CRATES="${PN}@${PV}"
+inherit cargo
+
+DESCRIPTION="A container-focused DNS server"
+HOMEPAGE="https://github.com/containers/aardvark-dns"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/aardvark-dns.git"
+else
+	SRC_URI="${CARGO_CRATE_URIS}"
+	SRC_URI+="https://github.com/containers/aardvark-dns/releases/download/v${PV}/${PN}-v${PV}-vendor.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv"
+fi
+
+# main
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" 0BSD Apache-2.0-with-LLVM-exceptions MIT Unlicense Unicode-DFS-2016 ZLIB"
+SLOT="0"
+
+QA_FLAGS_IGNORED="usr/libexec/podman/${PN}"
+QA_PRESTRIPPED="usr/libexec/podman/${PN}"
+ECARGO_VENDOR="${WORKDIR}/vendor"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		cargo_live_src_unpack
+	else
+		cargo_src_unpack
+	fi
+}
+
+src_prepare() {
+	default
+	sed -i -e "s|m0755 bin|m0755 $(cargo_target_dir)|g;" Makefile || die
+}
+
+src_install() {
+	local -x PREFIX="${EPREFIX}"/usr
+	default
+}
diff --git a/app-containers/aardvark-dns/metadata.xml b/app-containers/aardvark-dns/metadata.xml
new file mode 100644
index 000000000000..b0a56b84a777
--- /dev/null
+++ b/app-containers/aardvark-dns/metadata.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <maintainer type="person" proxied="yes">
+    <email>me@rahil.rocks</email>
+    <name>Rahil Bhimjiani</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <longdescription lang="en">
+		Aardvark-dns is an authoritative dns server for A/AAAA container
+		records. It can forward other requests to configured resolvers.
+	</longdescription>
+  <upstream>
+    <bugs-to>https://github.com/containers/aardvark-dns/issues</bugs-to>
+    <doc>https://github.com/containers/aardvark-dns/blob/main/README.md</doc>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/amazon-ecr-credential-helper/Manifest b/app-containers/amazon-ecr-credential-helper/Manifest
new file mode 100644
index 000000000000..a0ee72e35f20
--- /dev/null
+++ b/app-containers/amazon-ecr-credential-helper/Manifest
@@ -0,0 +1,3 @@
+DIST amazon-ecr-credential-helper-0.10.1.tar.gz 1991258 BLAKE2B 3b5175de0e66167fa18896304683951486d0ef3b00ed4edeb280fc70728235c587bb78b9d13fe0340ee11d6d6e06e8531f3f64c9256ada5e2a86c1ce381f5a3a SHA512 13b1be582a2c8bbb45c87ae3d0f7f1dc5606378454bb50d4f2ff7e587a916079f15b53908fa6689174a6c9ac12188201acc8359a530f06ca0c621f968d22f1bb
+DIST amazon-ecr-credential-helper-0.11.0.tar.gz 2010561 BLAKE2B d358b296f4fb44cf4a83a9b362fa876122c5e6f27bf126565fb29d630cb98e6558b550e591b94d8154d5b7e7cb0f0a67de06b34ce84d90e4dc4a50058a600f94 SHA512 f2d087c16b4c3be9bb37e4064c509e5571a02cb31b9d0f31a9f0fe70ba537b9249d106866af0af9e382cee340d09424be7e9b210fd8cb53241c8f88b4483fff5
+DIST amazon-ecr-credential-helper-0.12.0.tar.gz 2062385 BLAKE2B c34adc5c5ee462c43b19014ad4bbbde75622323ad55e1a9ecaec5b7b653c94c21eb7e00681eb9ce94b86ffadf5acf32ee013c67e223472e463f9776695c28c0b SHA512 67b81d8d4dfa2a1737efdda5b31ed8f44b8ec70f7a2eda2669de405a7e18cfaa37ee66c195567c8bde74a08d589bdc35803fc9879994d695fecd435aebd81d8e
diff --git a/app-containers/amazon-ecr-credential-helper/amazon-ecr-credential-helper-0.10.1.ebuild b/app-containers/amazon-ecr-credential-helper/amazon-ecr-credential-helper-0.10.1.ebuild
new file mode 100644
index 000000000000..e3b165f88fff
--- /dev/null
+++ b/app-containers/amazon-ecr-credential-helper/amazon-ecr-credential-helper-0.10.1.ebuild
@@ -0,0 +1,29 @@
+# Copyright 2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+DESCRIPTION="Automatically gets credentials for Amazon ECR on docker push/docker pull"
+HOMEPAGE="https://github.com/awslabs/amazon-ecr-credential-helper"
+SRC_URI="https://${PN}-releases.s3.us-east-2.amazonaws.com/${PV}/release.tar.gz -> ${P}.tar.gz"
+S=${WORKDIR}/ecr-login
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+src_compile() {
+	ego build ./cli/docker-credential-ecr-login
+}
+
+src_test() {
+	ego test ./...
+}
+
+src_install() {
+	dobin docker-credential-ecr-login
+	doman ../docs/docker-credential-ecr-login.1
+	dodoc ../README.md
+}
diff --git a/app-containers/amazon-ecr-credential-helper/amazon-ecr-credential-helper-0.11.0.ebuild b/app-containers/amazon-ecr-credential-helper/amazon-ecr-credential-helper-0.11.0.ebuild
new file mode 100644
index 000000000000..e3b165f88fff
--- /dev/null
+++ b/app-containers/amazon-ecr-credential-helper/amazon-ecr-credential-helper-0.11.0.ebuild
@@ -0,0 +1,29 @@
+# Copyright 2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+DESCRIPTION="Automatically gets credentials for Amazon ECR on docker push/docker pull"
+HOMEPAGE="https://github.com/awslabs/amazon-ecr-credential-helper"
+SRC_URI="https://${PN}-releases.s3.us-east-2.amazonaws.com/${PV}/release.tar.gz -> ${P}.tar.gz"
+S=${WORKDIR}/ecr-login
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+src_compile() {
+	ego build ./cli/docker-credential-ecr-login
+}
+
+src_test() {
+	ego test ./...
+}
+
+src_install() {
+	dobin docker-credential-ecr-login
+	doman ../docs/docker-credential-ecr-login.1
+	dodoc ../README.md
+}
diff --git a/app-containers/amazon-ecr-credential-helper/amazon-ecr-credential-helper-0.12.0.ebuild b/app-containers/amazon-ecr-credential-helper/amazon-ecr-credential-helper-0.12.0.ebuild
new file mode 100644
index 000000000000..afaf97e8e39b
--- /dev/null
+++ b/app-containers/amazon-ecr-credential-helper/amazon-ecr-credential-helper-0.12.0.ebuild
@@ -0,0 +1,29 @@
+# Copyright 2025-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+DESCRIPTION="Automatically gets credentials for Amazon ECR on docker push/docker pull"
+HOMEPAGE="https://github.com/awslabs/amazon-ecr-credential-helper"
+SRC_URI="https://${PN}-releases.s3.us-east-2.amazonaws.com/${PV}/release.tar.gz -> ${P}.tar.gz"
+S=${WORKDIR}/ecr-login
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+src_compile() {
+	ego build ./cli/docker-credential-ecr-login
+}
+
+src_test() {
+	ego test ./...
+}
+
+src_install() {
+	dobin docker-credential-ecr-login
+	doman ../docs/docker-credential-ecr-login.1
+	dodoc ../README.md
+}
diff --git a/app-containers/amazon-ecr-credential-helper/metadata.xml b/app-containers/amazon-ecr-credential-helper/metadata.xml
new file mode 100644
index 000000000000..1950a5c6c687
--- /dev/null
+++ b/app-containers/amazon-ecr-credential-helper/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>arthurzam@gentoo.org</email>
+    <name>Arthur Zamarin</name>
+  </maintainer>
+  <upstream>
+    <changelog>https://github.com/awslabs/amazon-ecr-credential-helper/blob/main/CHANGELOG.md</changelog>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/apptainer/Manifest b/app-containers/apptainer/Manifest
new file mode 100644
index 000000000000..04acd344c69a
--- /dev/null
+++ b/app-containers/apptainer/Manifest
@@ -0,0 +1 @@
+DIST apptainer-1.4.5.tar.gz 17465884 BLAKE2B 109132837e5fb35df8875a2a351833a3175c3b175d850e460dfbb0b1f746ed523a19c7668b1b24e65f1fc7ffffc439153031a2b158108a54a4057776f52baf48 SHA512 cb27f4ed51a5ea831720e1367066b9509010aba56353a8b6ba7e35fbc7077e737c760afbf106ed32de7c82bd86ec51eb4d8f78c73f0454cf90ee950eea26a5d7
diff --git a/app-containers/apptainer/apptainer-1.4.5.ebuild b/app-containers/apptainer/apptainer-1.4.5.ebuild
new file mode 100644
index 000000000000..eb7879146fa8
--- /dev/null
+++ b/app-containers/apptainer/apptainer-1.4.5.ebuild
@@ -0,0 +1,89 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit eapi9-ver linux-info toolchain-funcs
+
+DESCRIPTION="The container system for secure high-performance computing"
+HOMEPAGE="https://apptainer.org/"
+SRC_URI="https://github.com/apptainer/${PN}/releases/download/v${PV}/${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="amd64 ~riscv ~x86"
+IUSE="+network rootless +seccomp suid systemd"
+
+# Do not complain about CFLAGS etc. since go projects do not use them.
+QA_FLAGS_IGNORED='.*'
+
+DEPEND="app-crypt/gpgme
+	>=dev-lang/go-1.23.6
+	dev-libs/openssl
+	sys-apps/util-linux
+	sys-fs/cryptsetup
+	sys-fs/squashfs-tools
+	rootless? ( sys-apps/shadow:= )
+	seccomp? ( sys-libs/libseccomp )
+	!suid? (
+		sys-fs/e2fsprogs[fuse]
+		sys-fs/squashfuse
+	)"
+RDEPEND="${DEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+CONFIG_CHECK="~SQUASHFS"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.0.2-trim_upstream_cflags.patch
+)
+
+DOCS=( README.md CONTRIBUTORS.md CONTRIBUTING.md )
+
+src_configure() {
+	tc-export PKG_CONFIG
+	local myconfargs=(
+		-c "$(tc-getBUILD_CC)"
+		-x "$(tc-getBUILD_CXX)"
+		-C "$(tc-getCC)"
+		-X "$(tc-getCXX)"
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir="${EPREFIX}"/etc
+		--runstatedir="${EPREFIX}"/run
+		--localstatedir="${EPREFIX}"/var
+		$(usev !network --without-network)
+		$(usev !seccomp --without-seccomp)
+		$(usev !rootless --without-libsubid)
+		$(use_with suid)
+	)
+	./mconfig -v ${myconfargs[@]} || die "Error invoking mconfig"
+}
+
+src_compile() {
+	emake -C builddir
+}
+
+src_install() {
+	emake DESTDIR="${D}" -C builddir install
+	keepdir /var/${PN}/mnt/session
+
+	if use systemd; then
+		sed -i -e '/systemd cgroups/ s/no/yes/' "${ED}"/etc/${PN}/${PN}.conf \
+			|| die "Failed to enable systemd use in configuration"
+	else
+		sed -i -e '/systemd cgroups/ s/yes/no/' "${ED}"/etc/${PN}/${PN}.conf \
+			|| die "Failed to disable systemd use in configuration"
+	fi
+
+	einstalldocs
+	dodoc -r examples
+}
+
+pkg_postinst() {
+	if ! use suid; then
+		if ver_replacing -lt 1.1.0; then
+			ewarn "Since version 1.1.0 ${PN} no longer installs setuid-root components by default, relying on unprivileged user namespaces instead. For details, see https://apptainer.org/docs/admin/main/user_namespace.html"
+			ewarn "Make sure user namespaces (possibly except network ones for improved security) are enabled on your system, or re-enable installation of setuid root components by passing USE=suid to ${CATEGORY}/${PN}"
+		fi
+	fi
+}
diff --git a/app-containers/apptainer/files/apptainer-1.0.2-trim_upstream_cflags.patch b/app-containers/apptainer/files/apptainer-1.0.2-trim_upstream_cflags.patch
new file mode 100644
index 000000000000..b1329b5d9d3e
--- /dev/null
+++ b/app-containers/apptainer/files/apptainer-1.0.2-trim_upstream_cflags.patch
@@ -0,0 +1,24 @@
+--- a/mconfig
++++ b/mconfig
+@@ -42,14 +42,14 @@
+ 
+ # user_cflags - user-defined CFLAGS without all the cflags_opts
+ user_cflags="$CFLAGS"
+-cflags_opts="-Wall -Werror -Wfatal-errors -Wno-unknown-warning-option \
++cflags_opts="-Wall -Wfatal-errors -Wno-unknown-warning-option \
+ -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast \
+ -Woverlength-strings -Wframe-larger-than=2047 \
+ -Wno-sign-compare -Wclobbered -Wempty-body -Wmissing-parameter-type \
+ -Wtype-limits -Wunused-parameter -Wunused-but-set-parameter \
+ -Wno-discarded-qualifiers -Wno-incompatible-pointer-types \
+ -pipe -fmessage-length=0 -fPIC"
+-cflags="$CFLAGS -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -fstack-protector --param ssp-buffer-size=4"
++cflags="$CFLAGS -Wformat -Wformat-security -fstack-protector --param ssp-buffer-size=4"
+ ldflags=$LDFLAGS
+ 
+ package_name=apptainer
+--- a/mlocal/frags/go_runtime_opts.mk
++++ b/mlocal/frags/go_runtime_opts.mk
+@@ -1 +1 @@
+-CGO_CFLAGS += -O2 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -fstack-protector --param ssp-buffer-size=4
++CGO_CFLAGS += -O2 -Wformat -Wformat-security -fstack-protector --param ssp-buffer-size=4
diff --git a/app-containers/apptainer/metadata.xml b/app-containers/apptainer/metadata.xml
new file mode 100644
index 000000000000..dc67b808c6fd
--- /dev/null
+++ b/app-containers/apptainer/metadata.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <use>
+    <flag name="network">Install network plug-ins</flag>
+    <flag name="rootless">Enable libsubid (subuid/subgid mapping) for rootless</flag>
+    <flag name="suid">Install SUID helper binary</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/buildah/Manifest b/app-containers/buildah/Manifest
new file mode 100644
index 000000000000..f5593f73ce69
--- /dev/null
+++ b/app-containers/buildah/Manifest
@@ -0,0 +1,3 @@
+DIST buildah-1.40.0.tar.gz 12321438 BLAKE2B 3d923ddd249fd93476a8e88b72b1989b4bead9b282657d372c2aa04da0d787ee8e807cb74bface8a165ae0282ead791eb3da20a73751b63e3cfe7ee6ab34bd94 SHA512 bb96d04a17ab5a77e5d984dca369e3890131044c505ae3b030d95ffd66378df22da33315a50c9e500e783345ded23ebacdfa0965002a18e1d929c5fa3ce39311
+DIST buildah-1.40.1.tar.gz 12329760 BLAKE2B dd5be8e27be8c37b211dd3009d8533f44d234ef6bc8f5405a258931b51f0b79a1b5dc456e3e0269ca9b4c4e981c226c97ff51876ae2f1836bc16c974838f5615 SHA512 6b37b6cc5fa3d7972800cfaef5919df8ee6c9220e8635850ee9d8356645b08afa4252d688f4316b3265e5f6aef6fa0647fb4f7602b7add292fc8b56a74c4fa1f
+DIST buildah-1.41.0.tar.gz 11971274 BLAKE2B af197271bf519f84d1e7d08cbaab6a4aef3d1bdc234eaf8127f33e1fdd0c3f66c09262bf1aef9776d8d3fdfd853ae23cccd4ae6fcd06b2f86b7769d82f71617a SHA512 50be5c400a5063c12d5b97dc285d4969e50e88fa21de537f1c2317df36a1ccabf26ba70ece9e3e5c891e76ee8d85ab946029dc240de40ec88c86ad678e963823
diff --git a/app-containers/buildah/buildah-1.40.0.ebuild b/app-containers/buildah/buildah-1.40.0.ebuild
new file mode 100644
index 000000000000..4bb018ff5a38
--- /dev/null
+++ b/app-containers/buildah/buildah-1.40.0.ebuild
@@ -0,0 +1,107 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info toolchain-funcs
+
+DESCRIPTION="A tool that facilitates building OCI images"
+HOMEPAGE="https://github.com/containers/buildah"
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+
+SLOT="0"
+IUSE="apparmor btrfs +seccomp systemd test"
+RESTRICT="test"
+DOCS=(
+	"CHANGELOG.md"
+	"troubleshooting.md"
+	"docs/tutorials"
+)
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/buildah.git"
+else
+	SRC_URI="https://github.com/containers/buildah/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 arm64"
+fi
+
+RDEPEND="
+	systemd? ( sys-apps/systemd )
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp:= )
+	apparmor? ( sys-libs/libapparmor:= )
+	>=app-containers/containers-common-0.58.0-r1
+	app-crypt/gpgme:=
+	dev-libs/libgpg-error:=
+	dev-libs/libassuan:=
+	sys-apps/shadow:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-go/go-md2man"
+
+pkg_pretend() {
+	local CONFIG_CHECK=""
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	check_extra_config
+
+	linux_config_exists || ewarn "Cannot determine configuration of your kernel."
+}
+
+src_prepare() {
+	default
+
+	# ensure all  necessary files are there
+	local file
+	for file in docs/Makefile hack/libsubid_tag.sh hack/apparmor_tag.sh \
+		hack/systemd_tag.sh btrfs_installed_tag.sh btrfs_tag.sh; do
+		[[ -f "${file}" ]] || die
+	done
+
+	sed -i -e "s|/usr/local|/usr|g" Makefile docs/Makefile || die
+	echo -e '#!/usr/bin/env bash\necho libsubid' > hack/libsubid_tag.sh || die
+
+	cat <<-EOF > hack/apparmor_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex apparmor 'echo apparmor' echo)
+	EOF
+
+	use seccomp || eapply "${FILESDIR}/${PN}-1.37.5-disable-seccomp.patch"
+
+	cat <<-EOF > hack/systemd_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex systemd 'echo systemd' echo)
+	EOF
+
+	echo -e "#!/usr/bin/env bash\n echo" > btrfs_installed_tag.sh || die
+	cat <<-EOF > btrfs_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex btrfs echo 'echo exclude_graphdriver_btrfs btrfs_noversion')
+	EOF
+
+	use test || eapply "${FILESDIR}/${PN}-1.38.0-disable-tests.patch"
+}
+
+src_compile() {
+	# For non-live versions, prevent git operations which causes sandbox violations
+	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
+	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT=""
+
+	tc-export AS LD STRIP
+	export GOMD2MAN="$(command -v go-md2man)"
+	export SELINUXOPT=
+	default
+}
+
+src_test() {
+	emake test-unit
+}
+
+src_install() {
+	emake DESTDIR="${ED}" SELINUXOPT= install install.completions
+	einstalldocs
+}
diff --git a/app-containers/buildah/buildah-1.40.1.ebuild b/app-containers/buildah/buildah-1.40.1.ebuild
new file mode 100644
index 000000000000..5418098db860
--- /dev/null
+++ b/app-containers/buildah/buildah-1.40.1.ebuild
@@ -0,0 +1,107 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info toolchain-funcs
+
+DESCRIPTION="A tool that facilitates building OCI images"
+HOMEPAGE="https://github.com/containers/buildah"
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+
+SLOT="0"
+IUSE="apparmor btrfs +seccomp systemd test"
+RESTRICT="test"
+DOCS=(
+	"CHANGELOG.md"
+	"troubleshooting.md"
+	"docs/tutorials"
+)
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/buildah.git"
+else
+	SRC_URI="https://github.com/containers/buildah/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64"
+fi
+
+RDEPEND="
+	systemd? ( sys-apps/systemd )
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp:= )
+	apparmor? ( sys-libs/libapparmor:= )
+	>=app-containers/containers-common-0.58.0-r1
+	app-crypt/gpgme:=
+	dev-libs/libgpg-error:=
+	dev-libs/libassuan:=
+	sys-apps/shadow:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-go/go-md2man"
+
+pkg_pretend() {
+	local CONFIG_CHECK=""
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	check_extra_config
+
+	linux_config_exists || ewarn "Cannot determine configuration of your kernel."
+}
+
+src_prepare() {
+	default
+
+	# ensure all  necessary files are there
+	local file
+	for file in docs/Makefile hack/libsubid_tag.sh hack/apparmor_tag.sh \
+		hack/systemd_tag.sh btrfs_installed_tag.sh btrfs_tag.sh; do
+		[[ -f "${file}" ]] || die
+	done
+
+	sed -i -e "s|/usr/local|/usr|g" Makefile docs/Makefile || die
+	echo -e '#!/usr/bin/env bash\necho libsubid' > hack/libsubid_tag.sh || die
+
+	cat <<-EOF > hack/apparmor_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex apparmor 'echo apparmor' echo)
+	EOF
+
+	use seccomp || eapply "${FILESDIR}/${PN}-1.37.5-disable-seccomp.patch"
+
+	cat <<-EOF > hack/systemd_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex systemd 'echo systemd' echo)
+	EOF
+
+	echo -e "#!/usr/bin/env bash\n echo" > btrfs_installed_tag.sh || die
+	cat <<-EOF > btrfs_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex btrfs echo 'echo exclude_graphdriver_btrfs')
+	EOF
+
+	use test || eapply "${FILESDIR}/${PN}-1.40.1-disable-tests.patch"
+}
+
+src_compile() {
+	# For non-live versions, prevent git operations which causes sandbox violations
+	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
+	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT=""
+
+	tc-export AS LD STRIP
+	export GOMD2MAN="$(command -v go-md2man)"
+	export SELINUXOPT=
+	default
+}
+
+src_test() {
+	emake test-unit
+}
+
+src_install() {
+	emake DESTDIR="${ED}" SELINUXOPT= install install.completions
+	einstalldocs
+}
diff --git a/app-containers/buildah/buildah-1.41.0.ebuild b/app-containers/buildah/buildah-1.41.0.ebuild
new file mode 100644
index 000000000000..5580d6d8b390
--- /dev/null
+++ b/app-containers/buildah/buildah-1.41.0.ebuild
@@ -0,0 +1,115 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info toolchain-funcs
+
+DESCRIPTION="A tool that facilitates building OCI images"
+HOMEPAGE="https://github.com/containers/buildah"
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+
+SLOT="0"
+IUSE="apparmor btrfs +seccomp systemd test"
+RESTRICT="test"
+DOCS=(
+	"CHANGELOG.md"
+	"troubleshooting.md"
+	"docs/tutorials"
+)
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/buildah.git"
+else
+	SRC_URI="https://github.com/containers/buildah/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 arm64"
+fi
+
+RDEPEND="
+	systemd? ( sys-apps/systemd )
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp:= )
+	apparmor? ( sys-libs/libapparmor:= )
+	>=app-containers/containers-common-0.58.0-r1
+	app-crypt/gpgme:=
+	dev-db/sqlite:3=
+	dev-libs/libgpg-error:=
+	dev-libs/libassuan:=
+	sys-apps/shadow:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-go/go-md2man"
+
+pkg_pretend() {
+	local CONFIG_CHECK=""
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	check_extra_config
+
+	linux_config_exists || ewarn "Cannot determine configuration of your kernel."
+}
+
+src_prepare() {
+	default
+
+	# ensure all  necessary files are there
+	local file
+	for file in docs/Makefile hack/libsubid_tag.sh hack/apparmor_tag.sh \
+		hack/systemd_tag.sh hack/sqlite_tag.sh btrfs_installed_tag.sh; do
+		[[ -f "${file}" ]] || die
+	done
+
+	sed -i -e "s|/usr/local|/usr|g" Makefile docs/Makefile || die
+	echo -e '#!/usr/bin/env bash\necho libsubid' > hack/libsubid_tag.sh || die
+
+	cat <<-EOF > hack/apparmor_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex apparmor 'echo apparmor' echo)
+	EOF
+
+	use seccomp || eapply "${FILESDIR}/${PN}-1.37.5-disable-seccomp.patch"
+
+	cat <<-EOF > hack/systemd_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex systemd 'echo systemd' echo)
+	EOF
+
+	cat <<-EOF > btrfs_installed_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex btrfs echo 'echo exclude_graphdriver_btrfs')
+	EOF
+
+	# instead of statically compiling sqlite into binary dynamically link it
+	# for better security and smaller binary size.
+	# Refer https://github.com/containers/buildah/commit/e5b8765
+	cat <<-EOF > hack/sqlite_tag.sh || die
+	#!/usr/bin/env bash
+	echo libsqlite3
+	EOF
+
+	use test || eapply "${FILESDIR}/${PN}-1.41.0-disable-tests.patch"
+}
+
+src_compile() {
+	# For non-live versions, prevent git operations which causes sandbox violations
+	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
+	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT=""
+
+	tc-export AS LD STRIP
+	export GOMD2MAN="$(command -v go-md2man)"
+	export SELINUXOPT=
+	default
+}
+
+src_test() {
+	emake test-unit
+}
+
+src_install() {
+	emake DESTDIR="${ED}" SELINUXOPT= install install.completions
+	einstalldocs
+}
diff --git a/app-containers/buildah/buildah-9999.ebuild b/app-containers/buildah/buildah-9999.ebuild
new file mode 100644
index 000000000000..74266c13ab8f
--- /dev/null
+++ b/app-containers/buildah/buildah-9999.ebuild
@@ -0,0 +1,115 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info toolchain-funcs
+
+DESCRIPTION="A tool that facilitates building OCI images"
+HOMEPAGE="https://github.com/containers/buildah"
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+
+SLOT="0"
+IUSE="apparmor btrfs +seccomp systemd test"
+RESTRICT="test"
+DOCS=(
+	"CHANGELOG.md"
+	"troubleshooting.md"
+	"docs/tutorials"
+)
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/buildah.git"
+else
+	SRC_URI="https://github.com/containers/buildah/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64"
+fi
+
+RDEPEND="
+	systemd? ( sys-apps/systemd )
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp:= )
+	apparmor? ( sys-libs/libapparmor:= )
+	>=app-containers/containers-common-0.58.0-r1
+	app-crypt/gpgme:=
+	dev-db/sqlite:3=
+	dev-libs/libgpg-error:=
+	dev-libs/libassuan:=
+	sys-apps/shadow:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-go/go-md2man"
+
+pkg_pretend() {
+	local CONFIG_CHECK=""
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	check_extra_config
+
+	linux_config_exists || ewarn "Cannot determine configuration of your kernel."
+}
+
+src_prepare() {
+	default
+
+	# ensure all  necessary files are there
+	local file
+	for file in docs/Makefile hack/libsubid_tag.sh hack/apparmor_tag.sh \
+		hack/systemd_tag.sh hack/sqlite_tag.sh btrfs_installed_tag.sh; do
+		[[ -f "${file}" ]] || die
+	done
+
+	sed -i -e "s|/usr/local|/usr|g" Makefile docs/Makefile || die
+	echo -e '#!/usr/bin/env bash\necho libsubid' > hack/libsubid_tag.sh || die
+
+	cat <<-EOF > hack/apparmor_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex apparmor 'echo apparmor' echo)
+	EOF
+
+	use seccomp || eapply "${FILESDIR}/${PN}-1.37.5-disable-seccomp.patch"
+
+	cat <<-EOF > hack/systemd_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex systemd 'echo systemd' echo)
+	EOF
+
+	cat <<-EOF > btrfs_installed_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex btrfs echo 'echo exclude_graphdriver_btrfs')
+	EOF
+
+	# instead of statically compiling sqlite into binary dynamically link it
+	# for better security and smaller binary size.
+	# Refer https://github.com/containers/buildah/commit/e5b8765
+	cat <<-EOF > hack/sqlite_tag.sh || die
+	#!/usr/bin/env bash
+	echo libsqlite3
+	EOF
+
+	use test || eapply "${FILESDIR}/${PN}-1.41.0-disable-tests.patch"
+}
+
+src_compile() {
+	# For non-live versions, prevent git operations which causes sandbox violations
+	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
+	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT=""
+
+	tc-export AS LD STRIP
+	export GOMD2MAN="$(command -v go-md2man)"
+	export SELINUXOPT=
+	default
+}
+
+src_test() {
+	emake test-unit
+}
+
+src_install() {
+	emake DESTDIR="${ED}" SELINUXOPT= install install.completions
+	einstalldocs
+}
diff --git a/app-containers/buildah/files/buildah-1.37.5-disable-seccomp.patch b/app-containers/buildah/files/buildah-1.37.5-disable-seccomp.patch
new file mode 100644
index 000000000000..eaac7c8ed251
--- /dev/null
+++ b/app-containers/buildah/files/buildah-1.37.5-disable-seccomp.patch
@@ -0,0 +1,5 @@
+--- a/Makefile
++++ b/Makefile
+@@ -5 +5 @@
+-SECURITYTAGS ?= seccomp $(APPARMORTAG)
++SECURITYTAGS ?= $(APPARMORTAG)
diff --git a/app-containers/buildah/files/buildah-1.38.0-disable-tests.patch b/app-containers/buildah/files/buildah-1.38.0-disable-tests.patch
new file mode 100644
index 000000000000..a3a73f01d9cd
--- /dev/null
+++ b/app-containers/buildah/files/buildah-1.38.0-disable-tests.patch
@@ -0,0 +1,8 @@
+--- a/Makefile
++++ b/Makefile
+@@ -56 +56 @@
+-all: bin/buildah bin/imgtype bin/copy bin/inet bin/tutorial docs
++all: bin/buildah docs
+@@ -122 +122 @@
+-docs: install.tools ## build the docs on the host
++docs: ## build the docs on the host
diff --git a/app-containers/buildah/files/buildah-1.40.1-disable-tests.patch b/app-containers/buildah/files/buildah-1.40.1-disable-tests.patch
new file mode 100644
index 000000000000..bde0d1648b58
--- /dev/null
+++ b/app-containers/buildah/files/buildah-1.40.1-disable-tests.patch
@@ -0,0 +1,8 @@
+--- a/Makefile
++++ b/Makefile
+@@ -56,1 +56,1 @@
+-all: bin/buildah bin/imgtype bin/copy bin/inet bin/tutorial bin/dumpspec docs
++all: bin/buildah docs
+@@ -122 +122 @@
+-docs: install.tools ## build the docs on the host
++docs: ## build the docs on the host
diff --git a/app-containers/buildah/files/buildah-1.41.0-disable-tests.patch b/app-containers/buildah/files/buildah-1.41.0-disable-tests.patch
new file mode 100644
index 000000000000..5dc44589b1df
--- /dev/null
+++ b/app-containers/buildah/files/buildah-1.41.0-disable-tests.patch
@@ -0,0 +1,8 @@
+--- a/Makefile
++++ b/Makefile
+@@ -62,1 +62,1 @@
+-all: bin/buildah bin/imgtype bin/copy bin/inet bin/tutorial bin/dumpspec bin/passwd docs
++all: bin/buildah docs
+@@ -122 +122 @@
+-docs: install.tools ## build the docs on the host
++docs: ## build the docs on the host
diff --git a/app-containers/buildah/metadata.xml b/app-containers/buildah/metadata.xml
new file mode 100644
index 000000000000..173b977e3c9b
--- /dev/null
+++ b/app-containers/buildah/metadata.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <maintainer type="person" proxied="yes">
+    <email>me@rahil.rocks</email>
+    <name>Rahil Bhimjiani</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:buildah_project:buildah</remote-id>
+  </upstream>
+  <use>
+    <flag name="btrfs">
+		Enables dependencies for the "btrfs" graph driver, including
+		necessary kernel flags.
+	</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/cadvisor/Manifest b/app-containers/cadvisor/Manifest
new file mode 100644
index 000000000000..9689fd9002af
--- /dev/null
+++ b/app-containers/cadvisor/Manifest
@@ -0,0 +1,6 @@
+DIST cadvisor-0.49.2-deps.tar.xz 101993792 BLAKE2B c76a951b0741b513b7a700d9a31b6a0c49d0ae747375e9e968e77035d119a9351ba09e83c7d5d34bd081924e1fdccfd8851c9c7215d049c27da7469c63aab578 SHA512 2a104a236749bfcc1b785bf13352d217633c835beddf0c98219dd7dad602a36a934a2acf21975db06e72456ba15a01a5b685b9019f05f0d19e4eb562861478aa
+DIST cadvisor-0.49.2.tar.gz 1198084 BLAKE2B 7d4a28a22404f324c8cc0d956959bd397426b4fef8462d85bfd3cd5a1f9ec6f5add26c996cce9fb7e2edc382b592ca4cf1ff984371e32ad4fbc3daab050bfc67 SHA512 b789ab9d1b96b63edeeba2b474e9d6fb23bfb3c7e4778811fc92cc9b39084a70aaea991aa859b863a44d57934d0231c8ff5c48abfa6dce4b020827f6db3b5cb4
+DIST cadvisor-0.53.0-deps.tar.xz 89910284 BLAKE2B 448c6a0f87e23b5274b3f3478fde62e8b6b5900795486d06730b4f32f5722125796b2b4ee24fdfd968719fed9233de20eff10f5bbdc1c258c603725df68a5247 SHA512 288567f5fd39a624f3a6c2db3a43636bfc516fd7ffd602b94e6cb53c2386743db98a6752ab6f1bde86f25faaf85b2736667e7bcfdf68d9785a8ff18502621526
+DIST cadvisor-0.53.0.tar.gz 992998 BLAKE2B 3cb8e8ed487811e44aee652084fc173f8274eb98e28f32ddab5e26f2f225dc41dee6fddcde66035447849dac49f28991e993e9faa37b2ae965627fb8cde3c6ec SHA512 b14b0d4025c0b53a4299a38706cc1c5fec181554b3875ab1aa5ca2e80ca4070aa057521812a19e3fb6b175e1ea05ef37af613f69cf84dd131dc82f218fa6ff9c
+DIST cadvisor-0.56.2-deps.tar.xz 91038580 BLAKE2B a2ac7627c8c27247ceb6762aa3bb29600a1fd9dd0373f8cc8296f84d5a668bcea53431d7c79a15cc19fc9db56394bbcc73bc9615a36d4af864428102b94e48fd SHA512 e5df929d718fa5f6765c09bf603fd52ed34b259b57abecc3236a49ef10333e803bb031fb3d636fc8c0d0fba42fba15cbfb1320bd30723dea2a36455a3ecd7369
+DIST cadvisor-0.56.2.tar.gz 1010039 BLAKE2B c6f98f9c7e8818977290f9044084b26768dac49b9c76edc00e65e87f48fb0b0ba5ef91fea18f5b1e63de1e4e4f8bd6e5852910c7054748c3e5298aefd74b8593 SHA512 9c8424be5868f97bbd026f1a976abc6a40d0a2b8bfa40f56c03c2a7b416537dec2680fcdcb2076414c3b7aa110955d2d456d6756f1b0eec40afc49837a581152
diff --git a/app-containers/cadvisor/cadvisor-0.49.2.ebuild b/app-containers/cadvisor/cadvisor-0.49.2.ebuild
new file mode 100644
index 000000000000..93c595db33e9
--- /dev/null
+++ b/app-containers/cadvisor/cadvisor-0.49.2.ebuild
@@ -0,0 +1,47 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module systemd
+
+COMMIT=6876475afe3755d62b65df0d32b005047fc69377
+
+DESCRIPTION="Analyzes resource usage and performance characteristics of running containers"
+HOMEPAGE="https://github.com/google/cadvisor"
+SRC_URI="https://github.com/google/cadvisor/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~arthurzam/distfiles/app-containers/${PN}/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0 BSD BSD-2 ISC MIT"
+SLOT="0"
+KEYWORDS="~amd64"
+
+COMMON_DEPEND="acct-group/cadvisor
+	acct-user/cadvisor"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}"
+
+src_prepare() {
+	default
+	sed -i build/assets.sh -e "/go install/d"  || die
+	sed -i build/build.sh \
+		-e "/^version=/s/=.*/=${PV}/" \
+		-e "/^revision=/s/=.*/=${COMMIT}/" \
+		-e "/^branch=/s/=.*/=v${PV}/" || die
+}
+
+src_compile() {
+	GO_FLAGS="${GOFLAGS}" VERBOSE="true" emake build
+}
+
+src_test() {
+	GO_FLAGS="${GOFLAGS}" VERBOSE="true" emake test
+}
+
+src_install() {
+	newinitd "${FILESDIR}"/${PN}.initd-r1 ${PN}
+	systemd_dounit "${FILESDIR}/${PN}.service"
+	dobin _output/${PN}
+	keepdir /var/log/${PN}
+	fowners ${PN}:${PN} /var/log/${PN}
+}
diff --git a/app-containers/cadvisor/cadvisor-0.53.0.ebuild b/app-containers/cadvisor/cadvisor-0.53.0.ebuild
new file mode 100644
index 000000000000..8ed563f4e2b1
--- /dev/null
+++ b/app-containers/cadvisor/cadvisor-0.53.0.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module systemd
+
+COMMIT=85d18c6139a3f1fd48120c49ae44eac5aa352d86
+
+DESCRIPTION="Analyzes resource usage and performance characteristics of running containers"
+HOMEPAGE="https://github.com/google/cadvisor"
+SRC_URI="https://github.com/google/cadvisor/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://github.com/gentoo-golang-dist/${PN}/releases/download/v${PV}/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+# Dependent licenses
+LICENSE+=" Apache-2.0 BSD BSD-2 ISC MIT"
+SLOT="0"
+KEYWORDS="~amd64"
+
+DEPEND="
+	acct-group/cadvisor
+	acct-user/cadvisor
+"
+RDEPEND="${DEPEND}"
+
+src_prepare() {
+	default
+	sed -i build/assets.sh -e "/go install/d"  || die
+	sed -i build/build.sh \
+		-e "/^version=/s/=.*/=${PV}/" \
+		-e "/^revision=/s/=.*/=${COMMIT}/" \
+		-e "/^branch=/s/=.*/=v${PV}/" || die
+}
+
+src_compile() {
+	GO_FLAGS="${GOFLAGS}" VERBOSE="true" emake build
+}
+
+src_test() {
+	GO_FLAGS="${GOFLAGS}" VERBOSE="true" emake test
+}
+
+src_install() {
+	dobin _output/${PN}
+
+	newinitd "${FILESDIR}"/${PN}.initd-r2 ${PN}
+	systemd_dounit "${FILESDIR}/${PN}.service"
+
+	keepdir /var/log/${PN}
+	fowners ${PN}:${PN} /var/log/${PN}
+}
diff --git a/app-containers/cadvisor/cadvisor-0.56.2.ebuild b/app-containers/cadvisor/cadvisor-0.56.2.ebuild
new file mode 100644
index 000000000000..8b32a4c1bd2c
--- /dev/null
+++ b/app-containers/cadvisor/cadvisor-0.56.2.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module systemd
+
+COMMIT=7cbdee9260c4292d5d27d00416ce8a7dc1dc12a0
+
+DESCRIPTION="Analyzes resource usage and performance characteristics of running containers"
+HOMEPAGE="https://github.com/google/cadvisor"
+SRC_URI="https://github.com/google/cadvisor/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://github.com/gentoo-golang-dist/${PN}/releases/download/v${PV}/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+# Dependent licenses
+LICENSE+=" Apache-2.0 BSD BSD-2 ISC MIT"
+SLOT="0"
+KEYWORDS="~amd64"
+
+DEPEND="
+	acct-group/cadvisor
+	acct-user/cadvisor
+"
+RDEPEND="${DEPEND}"
+
+src_prepare() {
+	default
+	sed -i build/assets.sh -e "/go install/d"  || die
+	sed -i build/build.sh \
+		-e "/^version=/s/=.*/=${PV}/" \
+		-e "/^revision=/s/=.*/=${COMMIT}/" \
+		-e "/^branch=/s/=.*/=v${PV}/" || die
+}
+
+src_compile() {
+	GO_FLAGS="${GOFLAGS}" VERBOSE="true" emake build
+}
+
+src_test() {
+	GO_FLAGS="${GOFLAGS}" VERBOSE="true" emake test
+}
+
+src_install() {
+	dobin _output/${PN}
+
+	newinitd "${FILESDIR}"/${PN}.initd-r2 ${PN}
+	systemd_dounit "${FILESDIR}/${PN}.service"
+
+	keepdir /var/log/${PN}
+	fowners ${PN}:${PN} /var/log/${PN}
+}
diff --git a/app-containers/cadvisor/files/cadvisor.initd-r1 b/app-containers/cadvisor/files/cadvisor.initd-r1
new file mode 100644
index 000000000000..97a593dcd066
--- /dev/null
+++ b/app-containers/cadvisor/files/cadvisor.initd-r1
@@ -0,0 +1,19 @@
+#!/sbin/openrc-run
+# Copyright 2016-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+description="cAdvisor - Analyzes resource usage and performance characteristics of running containers"
+pidfile=${pidfile:-"/run/${SVCNAME}.pid"}
+user=${user:-${SVCNAME}}
+group=${group:-${SVCNAME}}
+
+command="/usr/bin/cadvisor"
+command_background="true"
+start_stop_daemon_args="--user ${user} --group ${group} \
+	--stdout /var/log/${SVCNAME}/${SVCNAME}.log \
+	--stderr /var/log/${SVCNAME}/${SVCNAME}.log"
+
+depend() {
+	after net
+	use docker
+}
diff --git a/app-containers/cadvisor/files/cadvisor.initd-r2 b/app-containers/cadvisor/files/cadvisor.initd-r2
new file mode 100644
index 000000000000..aae28dfc629a
--- /dev/null
+++ b/app-containers/cadvisor/files/cadvisor.initd-r2
@@ -0,0 +1,17 @@
+#!/sbin/openrc-run
+# Copyright 2016-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+description="cAdvisor - Analyzes resource usage and performance characteristics of running containers"
+pidfile=${pidfile:-"/run/${RC_SVCNAME}.pid"}
+command_user=${user:-${RC_SVCNAME}}:${group:-${RC_SVCNAME}}
+output_log=/var/log/${RC_SVCNAME}/${RC_SVCNAME}.log
+error_log=/var/log/${RC_SVCNAME}/${RC_SVCNAME}.log
+
+command="/usr/bin/cadvisor"
+command_background="true"
+
+depend() {
+	after net
+	use docker
+}
diff --git a/app-containers/cadvisor/files/cadvisor.service b/app-containers/cadvisor/files/cadvisor.service
new file mode 100644
index 000000000000..13966305156f
--- /dev/null
+++ b/app-containers/cadvisor/files/cadvisor.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=cAdvisor - Analyzes resource usage and performance characteristics of running containers
+Documentation=https://github.com/google/cadvisor
+After=network-online.target docker.socket
+
+[Service]
+User=cadvisor
+Restart=on-failure
+ExecStart=/usr/bin/cadvisor
+TimeoutStopSec=20s
+
+[Install]
+WantedBy=multi-user.target
diff --git a/app-containers/cadvisor/metadata.xml b/app-containers/cadvisor/metadata.xml
new file mode 100644
index 000000000000..17492b5107c4
--- /dev/null
+++ b/app-containers/cadvisor/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/catatonit/Manifest b/app-containers/catatonit/Manifest
new file mode 100644
index 000000000000..bfb6f6685ece
--- /dev/null
+++ b/app-containers/catatonit/Manifest
@@ -0,0 +1,2 @@
+DIST catatonit-0.2.0.tar.gz 16608 BLAKE2B 27b6ed1148aaef963140c42e2cb6a7a8c9c25f01eef62cf519c3b1c230c8f30838f5b9cb54bf0b37b1194084f3f0c750e20316738a330d6a01c830b71b45623c SHA512 115e72002e35bb2a03919f9422a9cb2d9a0e4f087862d4ffd20e9508af6d67efc359a577ec059574f2f6c98966a1f080b65dffc8dfb83b3c2ed48e63e2aeac3b
+DIST catatonit-0.2.1.tar.gz 18479 BLAKE2B df489287a3c134fa0f9188a1c8bfd05b085b2173b733be3d3bc8f7e99ac2bd8529815a2fe33e09e15a6609e8310cda7ff3f6b51270ed687a4f217d40dd603655 SHA512 39fb66900e9c9541470a70bec66dc77cf04ef237aa69bbc4fbb4025ef3de5c335f8b28cb41d60cd4525683a61d270dc8582b200606c474817035a0ffd9afb849
diff --git a/app-containers/catatonit/catatonit-0.2.0.ebuild b/app-containers/catatonit/catatonit-0.2.0.ebuild
new file mode 100644
index 000000000000..e87fb8dd631d
--- /dev/null
+++ b/app-containers/catatonit/catatonit-0.2.0.ebuild
@@ -0,0 +1,31 @@
+# Copyright 2022-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="A container init that is so simple it's effectively brain-dead"
+HOMEPAGE="https://github.com/openSUSE/catatonit"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/openSUSE/catatonit.git"
+else
+	SRC_URI="https://github.com/openSUSE/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 arm64 ~loong ~ppc64 ~riscv"
+fi
+
+LICENSE="GPL-2+"
+SLOT="0"
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_install() {
+	default
+	dodir /usr/libexec/podman
+	dosym -r /usr/bin/"${PN}" /usr/libexec/podman/"${PN}"
+}
diff --git a/app-containers/catatonit/catatonit-0.2.1.ebuild b/app-containers/catatonit/catatonit-0.2.1.ebuild
new file mode 100644
index 000000000000..84db532ec57d
--- /dev/null
+++ b/app-containers/catatonit/catatonit-0.2.1.ebuild
@@ -0,0 +1,31 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="A container init that is so simple it's effectively brain-dead"
+HOMEPAGE="https://github.com/openSUSE/catatonit"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/openSUSE/catatonit.git"
+else
+	SRC_URI="https://github.com/openSUSE/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 arm64 ~loong ~ppc64 ~riscv"
+fi
+
+LICENSE="GPL-2+"
+SLOT="0"
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_install() {
+	default
+	dodir /usr/libexec/podman
+	dosym -r /usr/bin/"${PN}" /usr/libexec/podman/"${PN}"
+}
diff --git a/app-containers/catatonit/catatonit-9999.ebuild b/app-containers/catatonit/catatonit-9999.ebuild
new file mode 100644
index 000000000000..a15fe9fe0ace
--- /dev/null
+++ b/app-containers/catatonit/catatonit-9999.ebuild
@@ -0,0 +1,31 @@
+# Copyright 2022-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="A container init that is so simple it's effectively brain-dead"
+HOMEPAGE="https://github.com/openSUSE/catatonit"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/openSUSE/catatonit.git"
+else
+	SRC_URI="https://github.com/openSUSE/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv"
+fi
+
+LICENSE="GPL-2+"
+SLOT="0"
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_install() {
+	default
+	dodir /usr/libexec/podman
+	dosym -r /usr/bin/"${PN}" /usr/libexec/podman/"${PN}"
+}
diff --git a/app-containers/catatonit/metadata.xml b/app-containers/catatonit/metadata.xml
new file mode 100644
index 000000000000..54723aadafaf
--- /dev/null
+++ b/app-containers/catatonit/metadata.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+  </maintainer>
+  <maintainer type="person" proxied="yes">
+    <email>me@rahil.rocks</email>
+    <name>Rahil Bhimjiani</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <upstream>
+    <bugs-to>https://github.com/openSUSE/catatonit/issues</bugs-to>
+    <doc>https://github.com/openSUSE/catatonit/blob/main/README.md</doc>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/cni-plugins/Manifest b/app-containers/cni-plugins/Manifest
new file mode 100644
index 000000000000..05dc72369569
--- /dev/null
+++ b/app-containers/cni-plugins/Manifest
@@ -0,0 +1,4 @@
+DIST cni-plugins-1.3.0.tar.gz 3684138 BLAKE2B c5599f1d8ac3bffb802877ae8c49024a9dea1940923316e534397a8dc7e467f6fe3ceef514a41522611a8f06c4f4ba0788105081e68a4712e2eefade33226c7b SHA512 87e186b3cd64f66280f5b2293dcdd1fc22cb8f51a248124fb622adc48a893348419ba4c29c4769dede4d9e60f2e9fea5d4198f10badb4ecd20a1551e0b344e10
+DIST cni-plugins-1.5.1.tar.gz 3808203 BLAKE2B 481e6c3e929d9169c643596ba48e008151aef10ff670cac9fa00294a3fe98bc5d7c9ee9f83394becb4c127290abb3b082c4124d332b32c8d97f44fcb01b7e3cf SHA512 d2e01958dd8328407164cb6be9d962321742dae7011ce7cd7b2342f5e4b4bbcd992d8249c53d3d81250a60c27f049969bbf329a75440524f52c1f1466b6e7132
+DIST cni-plugins-1.6.1.tar.gz 3940454 BLAKE2B eaeb9d48645efe680f259c3b6d295134459a79a8890cb8645dd4e0e32215decb44f6f72d8b8f575daedc34f0a55a517e213f505639c0a203b0479ca1067b5e38 SHA512 62b4e2c5c4bf6a9b21880e7b145547bec153f591926419d9960345cc7fb7d499ae44b0236928bbfeb46e383f38018d7504e58da1dd8a6ad39ef4ae3122b3be56
+DIST cni-plugins-1.6.2.tar.gz 3940423 BLAKE2B b53061312cf96f0e4a385a63433e76695f4c8b419e18a14296644cc435cf49be5f76021cadc4186955c99af74cf0b06c46c344b0368355f47e4fe9fd6773d8c3 SHA512 ee577e3fe39558d6a6296754c97de6608f95152805c01b8053e2958d16634ab57d147eea7c950fcc4d1a98d6733a85717adf7078ee2dffff007ec3b063386c24
diff --git a/app-containers/cni-plugins/cni-plugins-1.3.0.ebuild b/app-containers/cni-plugins/cni-plugins-1.3.0.ebuild
new file mode 100644
index 000000000000..906712b7b306
--- /dev/null
+++ b/app-containers/cni-plugins/cni-plugins-1.3.0.ebuild
@@ -0,0 +1,36 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module linux-info systemd
+
+DESCRIPTION="Standard networking plugins for container networking"
+HOMEPAGE="https://github.com/containernetworking/plugins"
+SRC_URI="https://github.com/containernetworking/plugins/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 arm64 ~ppc64 ~riscv"
+
+RDEPEND="net-firewall/iptables"
+
+CONFIG_CHECK="~BRIDGE_VLAN_FILTERING ~NETFILTER_XT_MATCH_COMMENT
+	~NETFILTER_XT_MATCH_MULTIPORT"
+
+S="${WORKDIR}/plugins-${PV}"
+
+src_compile() {
+	./build_linux.sh || die
+}
+
+src_install() {
+	exeinto /opt/cni/bin
+	doexe bin/*
+	dodoc README.md
+	local i
+	for i in plugins/{meta/{bandwidth,firewall,flannel,portmap,sbr,tuning},main/{bridge,host-device,ipvlan,loopback,macvlan,ptp,vlan},ipam/{dhcp,host-local,static},sample}; do
+		newdoc README.md ${i##*/}.README.md
+	done
+	systemd_dounit plugins/ipam/dhcp/systemd/cni-dhcp.{service,socket}
+	newinitd "${FILESDIR}"/cni-dhcp.initd cni-dhcp
+}
diff --git a/app-containers/cni-plugins/cni-plugins-1.5.1.ebuild b/app-containers/cni-plugins/cni-plugins-1.5.1.ebuild
new file mode 100644
index 000000000000..91b46b73b1e7
--- /dev/null
+++ b/app-containers/cni-plugins/cni-plugins-1.5.1.ebuild
@@ -0,0 +1,36 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module linux-info systemd
+
+DESCRIPTION="Standard networking plugins for container networking"
+HOMEPAGE="https://github.com/containernetworking/plugins"
+SRC_URI="https://github.com/containernetworking/plugins/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64 ~ppc64 ~riscv"
+
+RDEPEND="net-firewall/iptables"
+
+CONFIG_CHECK="~BRIDGE_VLAN_FILTERING ~NETFILTER_XT_MATCH_COMMENT
+	~NETFILTER_XT_MATCH_MULTIPORT"
+
+S="${WORKDIR}/plugins-${PV}"
+
+src_compile() {
+	./build_linux.sh || die
+}
+
+src_install() {
+	exeinto /opt/cni/bin
+	doexe bin/*
+	dodoc README.md
+	local i
+	for i in plugins/{meta/{bandwidth,firewall,flannel,portmap,sbr,tuning},main/{bridge,host-device,ipvlan,loopback,macvlan,ptp,vlan},ipam/{dhcp,host-local,static},sample}; do
+		newdoc README.md ${i##*/}.README.md
+	done
+	systemd_dounit plugins/ipam/dhcp/systemd/cni-dhcp.{service,socket}
+	newinitd "${FILESDIR}"/cni-dhcp.initd cni-dhcp
+}
diff --git a/app-containers/cni-plugins/cni-plugins-1.6.1.ebuild b/app-containers/cni-plugins/cni-plugins-1.6.1.ebuild
new file mode 100644
index 000000000000..906712b7b306
--- /dev/null
+++ b/app-containers/cni-plugins/cni-plugins-1.6.1.ebuild
@@ -0,0 +1,36 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module linux-info systemd
+
+DESCRIPTION="Standard networking plugins for container networking"
+HOMEPAGE="https://github.com/containernetworking/plugins"
+SRC_URI="https://github.com/containernetworking/plugins/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 arm64 ~ppc64 ~riscv"
+
+RDEPEND="net-firewall/iptables"
+
+CONFIG_CHECK="~BRIDGE_VLAN_FILTERING ~NETFILTER_XT_MATCH_COMMENT
+	~NETFILTER_XT_MATCH_MULTIPORT"
+
+S="${WORKDIR}/plugins-${PV}"
+
+src_compile() {
+	./build_linux.sh || die
+}
+
+src_install() {
+	exeinto /opt/cni/bin
+	doexe bin/*
+	dodoc README.md
+	local i
+	for i in plugins/{meta/{bandwidth,firewall,flannel,portmap,sbr,tuning},main/{bridge,host-device,ipvlan,loopback,macvlan,ptp,vlan},ipam/{dhcp,host-local,static},sample}; do
+		newdoc README.md ${i##*/}.README.md
+	done
+	systemd_dounit plugins/ipam/dhcp/systemd/cni-dhcp.{service,socket}
+	newinitd "${FILESDIR}"/cni-dhcp.initd cni-dhcp
+}
diff --git a/app-containers/cni-plugins/cni-plugins-1.6.2.ebuild b/app-containers/cni-plugins/cni-plugins-1.6.2.ebuild
new file mode 100644
index 000000000000..1f8967a780dd
--- /dev/null
+++ b/app-containers/cni-plugins/cni-plugins-1.6.2.ebuild
@@ -0,0 +1,47 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info systemd
+
+DESCRIPTION="Standard networking plugins for container networking"
+HOMEPAGE="https://github.com/containernetworking/plugins"
+SRC_URI="https://github.com/containernetworking/plugins/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+S=${WORKDIR}/plugins-${PV}
+
+LICENSE="Apache-2.0"
+# Dependent licenses
+LICENSE+=" Apache-2.0 BSD BSD-2 MIT"
+SLOT="0"
+KEYWORDS="amd64 arm64 ~ppc64 ~riscv"
+
+RDEPEND="net-firewall/iptables"
+
+CONFIG_CHECK="~BRIDGE_VLAN_FILTERING ~NETFILTER_XT_MATCH_COMMENT
+	~NETFILTER_XT_MATCH_MULTIPORT"
+
+src_compile() {
+	local f
+	for f in plugins/{meta,main,ipam}/*; do
+		[[ ${f} == *windows* ]] && continue
+		einfo "Building ${f}"
+		ego build -mod=vendor -o "bin/${f##*/}" "./${f}"
+	done
+}
+
+src_install() {
+	exeinto /opt/cni/bin
+	doexe bin/*
+
+	dodoc README.md
+	local f
+	for f in plugins/{meta,main,ipam}/*/README.md; do
+		[[ ${f} == *windows* ]] && continue
+		f=${f%/*}
+		newdoc "${f}/README.md" "${f##*/}.README.md"
+	done
+
+	systemd_dounit plugins/ipam/dhcp/systemd/cni-dhcp.{service,socket}
+	newinitd "${FILESDIR}"/cni-dhcp.initd cni-dhcp
+}
diff --git a/app-containers/cni-plugins/files/cni-dhcp.initd b/app-containers/cni-plugins/files/cni-dhcp.initd
new file mode 100644
index 000000000000..26b838c516bd
--- /dev/null
+++ b/app-containers/cni-plugins/files/cni-dhcp.initd
@@ -0,0 +1,20 @@
+#!/sbin/openrc-run
+
+name="CNI-DHCP"
+description="virtual dhcp server for containers"
+command="/opt/cni/bin/dhcp"
+command_args="daemon"
+command_background=true
+pidfile="/run/${RC_SVCNAME}.pid"
+
+depend() {
+	need net
+}
+
+stop_post() {
+	if [ -e /run/cni/dhcp.sock ]; then
+		ebegin "Cleaning socket for ${name}"
+		rm -f /run/cni/dhcp.sock
+		eend $? "Failed to cleanup socket"
+	fi
+}
diff --git a/app-containers/cni-plugins/metadata.xml b/app-containers/cni-plugins/metadata.xml
new file mode 100644
index 000000000000..17492b5107c4
--- /dev/null
+++ b/app-containers/cni-plugins/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/conmon/Manifest b/app-containers/conmon/Manifest
new file mode 100644
index 000000000000..f5dc825381cb
--- /dev/null
+++ b/app-containers/conmon/Manifest
@@ -0,0 +1,3 @@
+DIST conmon-2.1.11-make-docs-target-not-depend-on-install.tools.patch 985 BLAKE2B f2f34ca9a6f067f88f39726b52c5d476946413e84a93bfff2b9d4e9a0b9b117bf25a903455c3a762895746c5bca6eb93bf2ac7c2c6123d7b9bca9c345aba6230 SHA512 a9716057b0127d2b5aaca303e6d26484a5dbe91b9114259b2fded2a0c803568749b725e816004c80cb8b47ddff7a2fbcc231edd2df1d78a56ecaf6d3020c7fd7
+DIST conmon-2.1.11.tar.gz 121573 BLAKE2B 600a3e13eee5f71ef5f7aa21d9cf0184dd01c8e5e68d31aa35efcb08c3cf4305313fcfcf0aba3eedb243fe36f0e1e27f68a71627e2050c8ed4a73de273b98131 SHA512 47952f6cbbb810591d78c67856100be0edbf96d30328a10f22c3ec927bc6d1187540824c388d1fc7f3bb16fb7414339f3f20311d1baffb1fae1e38c4d5e7249c
+DIST conmon-2.1.13.tar.gz 116624 BLAKE2B b6e707521a1d4f1f843b07af7e861f7e2ef29f5f7f52a2cd73add16718b8d9c71659c620d236ce9287cf75048d0427139bfcc798c5eeb6a91e8c20bb9448a826 SHA512 cb98b26b3c5f5e5f0b09f5373bd58dc958b66ac4edcac2aa509f48be8b7e9a33001428016290944c4002ddbf63e11fb4657aaad879c89c5776f8c8031f4d1d08
diff --git a/app-containers/conmon/conmon-2.1.11.ebuild b/app-containers/conmon/conmon-2.1.11.ebuild
new file mode 100644
index 000000000000..bbd81e5153d5
--- /dev/null
+++ b/app-containers/conmon/conmon-2.1.11.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+DESCRIPTION="An OCI container runtime monitor"
+HOMEPAGE="https://github.com/containers/conmon"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/conmon.git"
+else
+	SRC_URI="
+		https://github.com/containers/conmon/archive/v${PV}.tar.gz
+			-> ${P}.tar.gz
+		https://github.com/Flowdalic/conmon/commit/ff8794c5bc0805cc430229728befde16da47b68c.patch
+			-> ${PN}-2.1.11-make-docs-target-not-depend-on-install.tools.patch
+	"
+	KEYWORDS="amd64 arm64 ~loong ~ppc64 ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="+seccomp selinux systemd"
+RESTRICT="test"
+
+RDEPEND="dev-libs/glib:=
+	seccomp? ( sys-libs/libseccomp )
+	systemd? ( sys-apps/systemd:= )"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-go/go-md2man"
+RDEPEND+=" selinux? ( sec-policy/selinux-podman )"
+
+PATCHES=(
+	# https://github.com/containers/conmon/pull/507
+	"${DISTDIR}"/${PN}-2.1.11-make-docs-target-not-depend-on-install.tools.patch
+)
+
+src_prepare() {
+	# https://github.com/containers/conmon/pull/505
+	echo "${PV}" > VERSION || die
+
+	default
+	sed -i -e "s|shell.*--exists libsystemd.* && echo \"0\"|shell echo $(usex systemd 0 1)|g;" Makefile || die
+	echo -e "#!/usr/bin/env bash\necho $(usex seccomp 0 1)" > hack/seccomp-notify.sh || die
+}
+
+src_compile() {
+	tc-export CC PKG_CONFIG
+	export PREFIX="${EPREFIX}/usr" GOMD2MAN=$(command -v go-md2man)
+	default
+}
+
+src_install() {
+	default
+	dodir /usr/libexec/podman
+	dosym ../../bin/"${PN}" /usr/libexec/podman/"${PN}"
+}
diff --git a/app-containers/conmon/conmon-2.1.13.ebuild b/app-containers/conmon/conmon-2.1.13.ebuild
new file mode 100644
index 000000000000..ad06b4ce2103
--- /dev/null
+++ b/app-containers/conmon/conmon-2.1.13.ebuild
@@ -0,0 +1,47 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+DESCRIPTION="An OCI container runtime monitor"
+HOMEPAGE="https://github.com/containers/conmon"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/conmon.git"
+else
+	SRC_URI="https://github.com/containers/conmon/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 arm64 ~loong ~ppc64 ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="+seccomp selinux systemd"
+RESTRICT="test"
+
+RDEPEND="dev-libs/glib:=
+	seccomp? ( sys-libs/libseccomp )
+	systemd? ( sys-apps/systemd:= )"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-go/go-md2man"
+RDEPEND+=" selinux? ( sec-policy/selinux-podman )"
+
+src_prepare() {
+	default
+	sed -i -e "s|shell.*--exists libsystemd.* && echo \"0\"|shell echo $(usex systemd 0 1)|g;" Makefile || die
+	echo -e "#!/usr/bin/env bash\necho $(usex seccomp 0 1)" > hack/seccomp-notify.sh || die
+}
+
+src_compile() {
+	tc-export CC PKG_CONFIG
+	export PREFIX="${EPREFIX}/usr" GOMD2MAN=$(command -v go-md2man)
+	default
+}
+
+src_install() {
+	default
+	dodir /usr/libexec/podman
+	dosym ../../bin/"${PN}" /usr/libexec/podman/"${PN}"
+}
diff --git a/app-containers/conmon/conmon-9999.ebuild b/app-containers/conmon/conmon-9999.ebuild
new file mode 100644
index 000000000000..0c40a76b571b
--- /dev/null
+++ b/app-containers/conmon/conmon-9999.ebuild
@@ -0,0 +1,47 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+DESCRIPTION="An OCI container runtime monitor"
+HOMEPAGE="https://github.com/containers/conmon"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/conmon.git"
+else
+	SRC_URI="https://github.com/containers/conmon/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="+seccomp selinux systemd"
+RESTRICT="test"
+
+RDEPEND="dev-libs/glib:=
+	seccomp? ( sys-libs/libseccomp )
+	systemd? ( sys-apps/systemd:= )"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-go/go-md2man"
+RDEPEND+=" selinux? ( sec-policy/selinux-podman )"
+
+src_prepare() {
+	default
+	sed -i -e "s|shell.*--exists libsystemd.* && echo \"0\"|shell echo $(usex systemd 0 1)|g;" Makefile || die
+	echo -e "#!/usr/bin/env bash\necho $(usex seccomp 0 1)" > hack/seccomp-notify.sh || die
+}
+
+src_compile() {
+	tc-export CC PKG_CONFIG
+	export PREFIX="${EPREFIX}/usr" GOMD2MAN=$(command -v go-md2man)
+	default
+}
+
+src_install() {
+	default
+	dodir /usr/libexec/podman
+	dosym ../../bin/"${PN}" /usr/libexec/podman/"${PN}"
+}
diff --git a/app-containers/conmon/metadata.xml b/app-containers/conmon/metadata.xml
new file mode 100644
index 000000000000..ae22878e1a0b
--- /dev/null
+++ b/app-containers/conmon/metadata.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <maintainer type="person" proxied="yes">
+    <email>me@rahil.rocks</email>
+    <name>Rahil Bhimjiani</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <upstream>
+    <bugs-to>https://github.com/containers/conmon/issues</bugs-to>
+    <doc>https://github.com/containers/conmon/blob/main/README.md</doc>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/containerd/Manifest b/app-containers/containerd/Manifest
new file mode 100644
index 000000000000..7a06eedb6846
--- /dev/null
+++ b/app-containers/containerd/Manifest
@@ -0,0 +1,13 @@
+DIST containerd-2.0.2.tar.gz 10379986 BLAKE2B aee39f749f056965b899f6525bebe00d46b72b6c437efbd01ed890c5ae9c5d812464bc6d10e32aea20fd0c6df00d98cd30502dd73f9a27b0d8d143a5542976d9 SHA512 86eb24acfa5d4d87ae396f8888e2484693823fad897a29f1a5ada78e2318640927cfcff1e85415bfd6c66f5417e582203eb94976d52e3dd373997e6e2cbae354
+DIST containerd-2.0.3.tar.gz 10450757 BLAKE2B 5dec56a40dc2874fb0b6fd4d72704f6417858eefd983c8ec5dfb2c9ef8be1e9e309cff83395e03c2d5fef30ed5c0561329ffbcd3dfba91e40d8017f7a605771b SHA512 9528a65d9d9f13d15d861f7ce71ab483958020bda83947d18868b477204e9e2e33eccc69280502c54b2be9ce577724e3e2b1772229c99636099b04bac1079ac1
+DIST containerd-2.0.4.tar.gz 10450939 BLAKE2B f82ed40eab0f1d186f4fb04217b8f75a9da8e33b1140c0b5866dcc61e17fe1040f31ef09bdb07ad98a52def5e9eb12cfeb635e96b2c5f64fdb4d8cfb6c84b885 SHA512 f84e0cc0b82313df010b95989faf56e81ebfbbc321585b968c8c706917b91a9f0d895692fa5046f24f1c370de7a74b50daf83da617fe0595e5a8ff69ed658727
+DIST containerd-2.0.5.tar.gz 10452563 BLAKE2B bf03316c9211eaa17a3b40b1fc9f9aca42fe3e621e086e612eb07c286c6b62bc7a0a2426ce7b6742dce2924d570ab599aefb43463c4fa6be277e562bad79668f SHA512 af89a5c9ad5f931c5fee33c75c13c296fc9ec966f2c64ec244897695eebb365bcb542f6b431e60d4ef7213f0ea11d3a8896d1b7f033ed445e6b521b7ddbffe6f
+DIST containerd-2.0.7.tar.gz 10465656 BLAKE2B 656787c91e913fee32af282bfe82dd78a2732b113ff06adb157787efd5ddca31d13e7acf26e5e59ef51d233ecdee8b89200a9a8048e8422b6d4bd272a047c1ac SHA512 393e6f6357806367b7e007da7f2a951fb4330750d4e16c8e612f49c9b5d62a9f6a2b866dc12317da11dc75f2f2cd7e2e9b5118a3f07e5a68d3475d0449844a4f
+DIST containerd-2.1.0.tar.gz 10610618 BLAKE2B 147c21b4650543af9b0e533e381a0505ba927d6e9270b9b03a09016eb3ccf29875db7fa274944fea2ff7b029b6a05a17d14c61e24b5f3426b31f320831eeb46a SHA512 e9bb128917bb6b2e21a8e05344af3fdcdda8620be20e54407bc2c73046278a88a77bcbed6ef7a59099c9ee3303283db46b90b71afdd45236d3c534749ba844e0
+DIST containerd-2.1.1.tar.gz 10610787 BLAKE2B acc2d769752c783643795d228c0d267b0802e09166dc783e84087da0029a822a64688f5e59c047c47b25f50ca2a1ccb7f5b6216ad6beeb4489df308e525e9716 SHA512 542f7cae61e1ef2e1b529b0bea66d7ad9016d4605de73de9c9c8a738e50ec6f470b939d1546482320515b77424bffe1cf24b721173ac0c0ecd0100c92817cfb1
+DIST containerd-2.1.4.tar.gz 10614131 BLAKE2B b8f4007b4bb368a1fa04c913d606f65d2ea4a17a6419ce12f2b6112eee2574d7a09fb8e2500d1c2f21bef8792dc047df4d63446211ae006662e616facda91f24 SHA512 a9f84784e917621ee5ea38ad20b8106e642fbf463a00d319b73a1a8e4d1fdd5be2fba0789b6a5d31107ef239d3713eced99ce979d4b2764714271a63c0936c15
+DIST containerd-2.1.5.tar.gz 10622156 BLAKE2B b612e9606554d492f59d4665dcbd85b0fdfa3316ecff3a2122357f8d8ef68991a2b77c367e3a7143efb768e9a78ee82ace9ffdc0832a9eb4ec37e98b0f827840 SHA512 6376228edf615b1ff3d40287622d4f72793be091d59d5d7e97f7bdc4f265aa4412f4a5dd1937ef795e54aa5ee8a87d785e859d7c6525a25fa86631b878cefc59
+DIST containerd-2.2.0.tar.gz 11475770 BLAKE2B 154d7d547d52925ff46431cea20db38dc72ec87ef90fd112472cb3ec7f2ebd8cfb121f98a3bc3870f8452473b35c3e1c84671b9fc31347f98259b34a70e740f9 SHA512 3121a1e0401e0283ff9d8454e945b427bcb0214e7e67271815117cb82dee1488c4d963c2193eb9c0ab5d395dd2e2705975ac31ce3e400264933d05d62fd0faac
+DIST containerd-2.2.1.tar.gz 11492859 BLAKE2B 5ee7a5388ec5a247a530be505068162318505741e77ab2a103ba8a33c3e76fbac55a64504429f9c636e41cb4826e1acc6b7f817398928a0d6b8ebd94797b8b7b SHA512 6bbfe356bdb0fd70c5b3ca0d932b790bb34b40832392e6a309a907351dc344e3b6059e2cd583145200aab218b4e8f5160d698f2b3a84d05bbf834d023eea4bd3
+DIST containerd-2.2.2.tar.gz 11531809 BLAKE2B 6605d5d2de275c9485dd92d4e56fc87853a4fe45cdc78e0a5f7d5178525f6e6925ea765e29bf3a4891dc318062a7577c7628fd63df451a2ba404852e0b5f0224 SHA512 4471047360cd1430a189829a74d605dbe89abe092f0e0ba53ad5954269f253c7c277b8097c5d12acb9e0592a39e50e1808c92e73596e3d2d97cf945f15063ca0
+DIST containerd-2.3.1.tar.gz 11871291 BLAKE2B 7c5632f1fec3467fe489c54430b2f5700e1834584d973ae205eb2667cf211ae04b59a5dfb9f5f0d081c26be53a70c1224a8751a1e9da618eec852322c3361982 SHA512 a0dbb73c73267205a5e880afa370371b84cbb45d3c64071b9e6f9b8124377c0833a20799e4492df0636781f0af7016703475e96d4750ce235f9706c9d90f5191
diff --git a/app-containers/containerd/containerd-2.0.2-r1.ebuild b/app-containers/containerd/containerd-2.0.2-r1.ebuild
new file mode 100644
index 000000000000..7c00dd938011
--- /dev/null
+++ b/app-containers/containerd/containerd-2.0.2-r1.ebuild
@@ -0,0 +1,90 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module systemd
+GIT_REVISION=c507a0257ea6462fbd6f5ba4f5c74facb04021f4
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.2.4[apparmor?,seccomp?]
+	selinux? ( sec-policy/selinux-docker )
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		-e "s/-mod=readonly//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	# we need to explicitly specify GOFLAGS for "go run" to use vendor source
+	emake "${myemakeargs[@]}" man -j1 #nowarn
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/app-containers/containerd/containerd-2.0.3-r1.ebuild b/app-containers/containerd/containerd-2.0.3-r1.ebuild
new file mode 100644
index 000000000000..8466f204d3db
--- /dev/null
+++ b/app-containers/containerd/containerd-2.0.3-r1.ebuild
@@ -0,0 +1,90 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module systemd
+GIT_REVISION=06b99ca80cdbfbc6cc8bd567021738c9af2b36ce
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.2.5[apparmor?,seccomp?]
+	selinux? ( sec-policy/selinux-docker )
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		-e "s/-mod=readonly//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	# we need to explicitly specify GOFLAGS for "go run" to use vendor source
+	emake "${myemakeargs[@]}" man -j1 #nowarn
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/app-containers/containerd/containerd-2.0.4-r1.ebuild b/app-containers/containerd/containerd-2.0.4-r1.ebuild
new file mode 100644
index 000000000000..8466f204d3db
--- /dev/null
+++ b/app-containers/containerd/containerd-2.0.4-r1.ebuild
@@ -0,0 +1,90 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module systemd
+GIT_REVISION=06b99ca80cdbfbc6cc8bd567021738c9af2b36ce
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.2.5[apparmor?,seccomp?]
+	selinux? ( sec-policy/selinux-docker )
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		-e "s/-mod=readonly//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	# we need to explicitly specify GOFLAGS for "go run" to use vendor source
+	emake "${myemakeargs[@]}" man -j1 #nowarn
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/app-containers/containerd/containerd-2.0.5-r1.ebuild b/app-containers/containerd/containerd-2.0.5-r1.ebuild
new file mode 100644
index 000000000000..1f5c4a5d6aad
--- /dev/null
+++ b/app-containers/containerd/containerd-2.0.5-r1.ebuild
@@ -0,0 +1,90 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module systemd
+GIT_REVISION=fb4c30d4ede3531652d86197bf3fc9515e5276d9
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.2.6[apparmor?,seccomp?]
+	selinux? ( sec-policy/selinux-docker )
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		-e "s/-mod=readonly//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	# we need to explicitly specify GOFLAGS for "go run" to use vendor source
+	emake "${myemakeargs[@]}" man -j1 #nowarn
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/app-containers/containerd/containerd-2.0.7-r1.ebuild b/app-containers/containerd/containerd-2.0.7-r1.ebuild
new file mode 100644
index 000000000000..f8f3ad9af4c7
--- /dev/null
+++ b/app-containers/containerd/containerd-2.0.7-r1.ebuild
@@ -0,0 +1,90 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module systemd
+GIT_REVISION=fb4c30d4ede3531652d86197bf3fc9515e5276d9
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.3.3[apparmor?,seccomp?]
+	selinux? ( sec-policy/selinux-docker )
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		-e "s/-mod=readonly//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	# we need to explicitly specify GOFLAGS for "go run" to use vendor source
+	emake "${myemakeargs[@]}" man -j1 #nowarn
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/app-containers/containerd/containerd-2.1.0-r1.ebuild b/app-containers/containerd/containerd-2.1.0-r1.ebuild
new file mode 100644
index 000000000000..925d8131cd19
--- /dev/null
+++ b/app-containers/containerd/containerd-2.1.0-r1.ebuild
@@ -0,0 +1,90 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module systemd
+GIT_REVISION=061792f0ecf3684fb30a3a0eb006799b8c6638a7
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.3.0[apparmor?,seccomp?]
+	selinux? ( sec-policy/selinux-docker )
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		-e "s/-mod=readonly//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	# we need to explicitly specify GOFLAGS for "go run" to use vendor source
+	emake "${myemakeargs[@]}" man -j1 #nowarn
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/app-containers/containerd/containerd-2.1.1-r1.ebuild b/app-containers/containerd/containerd-2.1.1-r1.ebuild
new file mode 100644
index 000000000000..25bc0fd3230c
--- /dev/null
+++ b/app-containers/containerd/containerd-2.1.1-r1.ebuild
@@ -0,0 +1,95 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-env go-module systemd toolchain-funcs
+GIT_REVISION=cb1076646aa3740577fafbf3d914198b7fe8e3f7
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.3.0[apparmor?,seccomp?]
+	selinux? ( sec-policy/selinux-docker )
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		-e "s/-mod=readonly//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# The Go env is already set, but reset it for CBUILD in a subshell to allow
+	# building the man pages when cross-compiling.
+	(
+		CHOST="${CBUILD}" go-env_set_compile_environment
+		# race condition in man target https://bugs.gentoo.org/765100
+		tc-env_build emake "${myemakeargs[@]}" man -j1 #nowarn
+	)
+
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/app-containers/containerd/containerd-2.1.4-r1.ebuild b/app-containers/containerd/containerd-2.1.4-r1.ebuild
new file mode 100644
index 000000000000..9d01e3a62129
--- /dev/null
+++ b/app-containers/containerd/containerd-2.1.4-r1.ebuild
@@ -0,0 +1,94 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-env go-module systemd toolchain-funcs
+GIT_REVISION=75cb2b7193e4e490e9fbdc236c0e811ccaba3376
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.3.0[apparmor?,seccomp?]
+	selinux? ( sec-policy/selinux-docker )
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# The Go env is already set, but reset it for CBUILD in a subshell to allow
+	# building the man pages when cross-compiling.
+	(
+		CHOST="${CBUILD}" go-env_set_compile_environment
+		# race condition in man target https://bugs.gentoo.org/765100
+		tc-env_build emake "${myemakeargs[@]}" man -j1 #nowarn
+	)
+
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/app-containers/containerd/containerd-2.1.5-r1.ebuild b/app-containers/containerd/containerd-2.1.5-r1.ebuild
new file mode 100644
index 000000000000..27de7849eb7d
--- /dev/null
+++ b/app-containers/containerd/containerd-2.1.5-r1.ebuild
@@ -0,0 +1,94 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-env go-module systemd toolchain-funcs
+GIT_REVISION=75cb2b7193e4e490e9fbdc236c0e811ccaba3376
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.3.3[apparmor?,seccomp?]
+	selinux? ( sec-policy/selinux-docker )
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# The Go env is already set, but reset it for CBUILD in a subshell to allow
+	# building the man pages when cross-compiling.
+	(
+		CHOST="${CBUILD}" go-env_set_compile_environment
+		# race condition in man target https://bugs.gentoo.org/765100
+		tc-env_build emake "${myemakeargs[@]}" man -j1 #nowarn
+	)
+
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/app-containers/containerd/containerd-2.2.0-r1.ebuild b/app-containers/containerd/containerd-2.2.0-r1.ebuild
new file mode 100644
index 000000000000..22284b9cc59e
--- /dev/null
+++ b/app-containers/containerd/containerd-2.2.0-r1.ebuild
@@ -0,0 +1,94 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-env go-module systemd toolchain-funcs
+GIT_REVISION=1c4457e00facac03ce1d75f7b6777a7a851e5c41
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.3.0[apparmor?,seccomp?]
+	selinux? ( sec-policy/selinux-docker )
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# The Go env is already set, but reset it for CBUILD in a subshell to allow
+	# building the man pages when cross-compiling.
+	(
+		CHOST="${CBUILD}" go-env_set_compile_environment
+		# race condition in man target https://bugs.gentoo.org/765100
+		tc-env_build emake "${myemakeargs[@]}" man -j1 #nowarn
+	)
+
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/app-containers/containerd/containerd-2.2.1-r1.ebuild b/app-containers/containerd/containerd-2.2.1-r1.ebuild
new file mode 100644
index 000000000000..8d1f5d5ab7dc
--- /dev/null
+++ b/app-containers/containerd/containerd-2.2.1-r1.ebuild
@@ -0,0 +1,88 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-env go-module systemd toolchain-funcs
+GIT_REVISION=dea7da592f5d1d2b7755e3a161be07f43fad8f75
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.3.4[apparmor?,seccomp?]
+	selinux? ( sec-policy/selinux-docker )
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	emake "${myemakeargs[@]}" all
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	tc-env_build go-env_run emake "${myemakeargs[@]}" man -j1 #nowarn
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/app-containers/containerd/containerd-2.2.2-r1.ebuild b/app-containers/containerd/containerd-2.2.2-r1.ebuild
new file mode 100644
index 000000000000..0e4cf8230750
--- /dev/null
+++ b/app-containers/containerd/containerd-2.2.2-r1.ebuild
@@ -0,0 +1,82 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module systemd toolchain-funcs
+
+GIT_REVISION=301b2dac98f15c27117da5c8af12118a041a31d9
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
+# tests require root or docker
+RESTRICT="test"
+
+DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="${DEPEND}
+	>=app-containers/runc-1.3.4[apparmor?,seccomp?]
+"
+BDEPEND="
+	selinux? ( sec-policy/selinux-docker )
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	local myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	emake "${myemakeargs[@]}" all
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	tc-env_build go-env_run emake "${myemakeargs[@]}" man -j1 #nowarn
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/app-containers/containerd/containerd-2.3.1.ebuild b/app-containers/containerd/containerd-2.3.1.ebuild
new file mode 100644
index 000000000000..bbec41fb6511
--- /dev/null
+++ b/app-containers/containerd/containerd-2.3.1.ebuild
@@ -0,0 +1,83 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module systemd toolchain-funcs
+
+GIT_REVISION=64b425cf570b3b8dd1d4cc46da7c1fce65c6651a
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
+# tests require root or docker
+RESTRICT="test"
+
+DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="${DEPEND}
+	>=app-containers/runc-1.3.4[apparmor?,seccomp?]
+"
+BDEPEND="
+	selinux? ( sec-policy/selinux-docker )
+	dev-go/go-md2man
+	>=dev-lang/go-1.26.3
+	virtual/pkgconfig
+"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	local myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	emake "${myemakeargs[@]}" all
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	tc-env_build go-env_run emake "${myemakeargs[@]}" man -j1 #nowarn
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/app-containers/containerd/files/containerd.confd b/app-containers/containerd/files/containerd.confd
new file mode 100644
index 000000000000..22ef83205e26
--- /dev/null
+++ b/app-containers/containerd/files/containerd.confd
@@ -0,0 +1,3 @@
+# This is the delay to be used in the start_post function to wait for
+# the socket to be active.
+#containerd_socket_delay=5
diff --git a/app-containers/containerd/files/containerd.initd b/app-containers/containerd/files/containerd.initd
new file mode 100644
index 000000000000..143305c03336
--- /dev/null
+++ b/app-containers/containerd/files/containerd.initd
@@ -0,0 +1,26 @@
+#!/sbin/openrc-run
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+description="Containerd container runtime"
+command="/usr/bin/containerd"
+command_args="${command_args:-}"
+command_background="true"
+pidfile="${pidfile:-/run/${RC_SVCNAME}.pid}"
+start_stop_daemon_args="--stderr /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log --stdout /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log"
+
+start_pre() {
+	checkpath -m 0750 -d "/var/log/${RC_SVCNAME}"
+
+	ulimit -n 1048576
+
+	# Having non-zero limits causes performance problems due to accounting overhead
+	# in the kernel. We recommend using cgroups to do container-local accounting.
+	ulimit -u unlimited
+
+	return 0
+}
+
+start_post() {
+	ewaitfile ${containerd_socket_delay:-5} /run/containerd/containerd.sock
+}
diff --git a/app-containers/containerd/metadata.xml b/app-containers/containerd/metadata.xml
new file mode 100644
index 000000000000..77f3298c0f5f
--- /dev/null
+++ b/app-containers/containerd/metadata.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <longdescription>
+		Containerd is a daemon with an API and a command line client, to manage
+		containers on one machine. It uses runC to run containers according to
+		the OCI specification. Containerd has advanced features such as seccomp
+		and user namespace support as well as checkpoint and restore for cloning
+		and live migration of containers.
+	</longdescription>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <use>
+    <flag name="btrfs">Support for BTRFS snapshot driver</flag>
+    <flag name="cri">Support for Kubernetes CRI</flag>
+    <flag name="device-mapper">Support for device mapper snapshot driver</flag>
+  </use>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:linuxfoundation:containerd</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/containers-common/Manifest b/app-containers/containers-common/Manifest
new file mode 100644
index 000000000000..fe54370efff7
--- /dev/null
+++ b/app-containers/containers-common/Manifest
@@ -0,0 +1,2 @@
+DIST containers-common-0.63.0.tar.gz 13516320 BLAKE2B f9d57d11210041065f2d5479d68d0318d5d49c634038f7db8601becc1c6bb801314a5aaacb6392f3f802ed8acde60284d78d49351ea8a8f9eaa3a3c449ba5727 SHA512 5d09a5d5fda8a3bafc2b1954b8b82cbc73747e9a088f220090d790cca203f330d0dbe45148a6ea2808448705506f4ff13ca05c85a2c2643cceff41cbe0f5ce9f
+DIST containers-common-0.64.2.tar.gz 13131015 BLAKE2B a4dc8484d9f1002c9e94a38396a767771df2260a15e371d20981db98d6ded7f563b4e25a2ff8f6912789264bfd4586826dd1821df2807f9c1d16baeab9601b8d SHA512 658044746d338de46b41577d7ae929b45b6de639dc33e671b2901527d9c069354fe586a7595ba514938fcedd9400c0ce47b10a3af92c4dc6aa29443d89a83ef5
diff --git a/app-containers/containers-common/containers-common-0.63.0.ebuild b/app-containers/containers-common/containers-common-0.63.0.ebuild
new file mode 100644
index 000000000000..05d73bee3871
--- /dev/null
+++ b/app-containers/containers-common/containers-common-0.63.0.ebuild
@@ -0,0 +1,83 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit readme.gentoo-r1
+
+DESCRIPTION="Common config files and docs for Containers stack"
+HOMEPAGE="https://github.com/containers/common"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/common.git"
+else
+	SRC_URI="https://github.com/containers/common/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="amd64 arm64 ~loong ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+RESTRICT="test"
+RDEPEND="
+	>=app-containers/aardvark-dns-1.12.0
+	>=app-containers/crun-1.17
+	>=app-containers/containers-image-5.32.0
+	>=app-containers/containers-storage-1.55.0
+	app-containers/containers-shortnames
+	>=app-containers/netavark-1.12.0
+	net-firewall/nftables
+	net-firewall/iptables[nftables]
+	>=net-misc/passt-2024.09.06
+	>=sys-fs/fuse-overlayfs-1.14
+"
+
+BDEPEND="
+	>=dev-go/go-md2man-2.0.3
+"
+
+PATCHES=(
+	"${FILESDIR}/examplify-mounts-conf.patch"
+)
+
+DOC_CONTENTS="\n
+For rootless operations, one needs to configure subuid(5) and subgid(5)\n
+See /etc/sub{uid,gid} to check whether rootless user is already configured\n
+If not, quickly configure it with:\n
+usermod --add-subuids 1065536-1131071 <rootless user>\n
+usermod --add-subgids 1065536-1131071 <rootless user>\n
+"
+
+src_prepare() {
+	default
+
+	[[ -f docs/Makefile && -f Makefile ]] || die
+	sed -i -e 's|/usr/local|/usr|g;' docs/Makefile Makefile || die
+}
+
+src_compile() {
+	emake docs
+	touch {images,layers}.lock || die
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install
+	readme.gentoo_create_doc
+
+	insinto /usr/share/containers
+	doins pkg/seccomp/seccomp.json pkg/subscriptions/mounts.conf
+
+	keepdir /etc/containers/{certs.d,oci/hooks.d,networks,systemd} /var/lib/containers/sigstore \
+			/usr/lib/containers/storage
+	diropts -m0700
+	dodir /usr/lib/containers/storage/overlay-{images,layers}
+	for i in images layers; do
+		insinto /usr/lib/containers/storage/overlay-"${i}"
+		doins "${i}".lock
+	done
+}
+
+pkg_postinst() {
+	readme.gentoo_print_elog
+}
diff --git a/app-containers/containers-common/containers-common-0.64.2.ebuild b/app-containers/containers-common/containers-common-0.64.2.ebuild
new file mode 100644
index 000000000000..7223a5d44ae0
--- /dev/null
+++ b/app-containers/containers-common/containers-common-0.64.2.ebuild
@@ -0,0 +1,83 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit readme.gentoo-r1
+
+DESCRIPTION="Common config files and docs for Containers stack"
+HOMEPAGE="https://github.com/containers/common"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/common.git"
+else
+	SRC_URI="https://github.com/containers/common/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="amd64 arm64 ~loong ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+RESTRICT="test"
+RDEPEND="
+	>=app-containers/aardvark-dns-1.12.0
+	>=app-containers/crun-1.17
+	>=app-containers/containers-image-5.32.0
+	>=app-containers/containers-storage-1.55.0
+	app-containers/containers-shortnames
+	>=app-containers/netavark-1.12.0
+	net-firewall/nftables
+	net-firewall/iptables[nftables]
+	>=net-misc/passt-2024.09.06
+	>=sys-fs/fuse-overlayfs-1.14
+"
+
+BDEPEND="
+	>=dev-go/go-md2man-2.0.3
+"
+
+PATCHES=(
+	"${FILESDIR}/examplify-mounts-conf.patch"
+)
+
+DOC_CONTENTS="\n
+For rootless operations, one needs to configure subuid(5) and subgid(5)\n
+See /etc/sub{uid,gid} to check whether rootless user is already configured\n
+If not, quickly configure it with:\n
+usermod --add-subuids 1065536-1131071 <rootless user>\n
+usermod --add-subgids 1065536-1131071 <rootless user>\n
+"
+
+src_prepare() {
+	default
+
+	[[ -f docs/Makefile && -f Makefile ]] || die
+	sed -i -e 's|/usr/local|/usr|g;' docs/Makefile Makefile || die
+}
+
+src_compile() {
+	emake docs
+	touch {images,layers}.lock || die
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install
+	readme.gentoo_create_doc
+
+	insinto /usr/share/containers
+	doins pkg/seccomp/seccomp.json pkg/subscriptions/mounts.conf
+
+	keepdir /etc/containers/{certs.d,oci/hooks.d,networks,systemd} /var/lib/containers/sigstore \
+			/usr/lib/containers/storage
+	diropts -m0700
+	dodir /usr/lib/containers/storage/overlay-{images,layers}
+	for i in images layers; do
+		insinto /usr/lib/containers/storage/overlay-"${i}"
+		doins "${i}".lock
+	done
+}
+
+pkg_postinst() {
+	readme.gentoo_print_elog
+}
diff --git a/app-containers/containers-common/containers-common-9999.ebuild b/app-containers/containers-common/containers-common-9999.ebuild
new file mode 100644
index 000000000000..d4f8c244621b
--- /dev/null
+++ b/app-containers/containers-common/containers-common-9999.ebuild
@@ -0,0 +1,83 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit readme.gentoo-r1
+
+DESCRIPTION="Common config files and docs for Containers stack"
+HOMEPAGE="https://github.com/containers/common"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/common.git"
+else
+	SRC_URI="https://github.com/containers/common/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="~amd64 ~arm64 ~loong ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+RESTRICT="test"
+RDEPEND="
+	>=app-containers/aardvark-dns-1.12.0
+	>=app-containers/crun-1.17
+	>=app-containers/containers-image-5.32.0
+	>=app-containers/containers-storage-1.55.0
+	app-containers/containers-shortnames
+	>=app-containers/netavark-1.12.0
+	net-firewall/nftables
+	net-firewall/iptables[nftables]
+	>=net-misc/passt-2024.09.06
+	>=sys-fs/fuse-overlayfs-1.14
+"
+
+BDEPEND="
+	>=dev-go/go-md2man-2.0.3
+"
+
+PATCHES=(
+	"${FILESDIR}/examplify-mounts-conf.patch"
+)
+
+DOC_CONTENTS="\n
+For rootless operations, one needs to configure subuid(5) and subgid(5)\n
+See /etc/sub{uid,gid} to check whether rootless user is already configured\n
+If not, quickly configure it with:\n
+usermod --add-subuids 1065536-1131071 <rootless user>\n
+usermod --add-subgids 1065536-1131071 <rootless user>\n
+"
+
+src_prepare() {
+	default
+
+	[[ -f docs/Makefile && -f Makefile ]] || die
+	sed -i -e 's|/usr/local|/usr|g;' docs/Makefile Makefile || die
+}
+
+src_compile() {
+	emake docs
+	touch {images,layers}.lock || die
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install
+	readme.gentoo_create_doc
+
+	insinto /usr/share/containers
+	doins pkg/seccomp/seccomp.json pkg/subscriptions/mounts.conf
+
+	keepdir /etc/containers/{certs.d,oci/hooks.d,networks,systemd} /var/lib/containers/sigstore \
+			/usr/lib/containers/storage
+	diropts -m0700
+	dodir /usr/lib/containers/storage/overlay-{images,layers}
+	for i in images layers; do
+		insinto /usr/lib/containers/storage/overlay-"${i}"
+		doins "${i}".lock
+	done
+}
+
+pkg_postinst() {
+	readme.gentoo_print_elog
+}
diff --git a/app-containers/containers-common/files/examplify-mounts-conf.patch b/app-containers/containers-common/files/examplify-mounts-conf.patch
new file mode 100644
index 000000000000..eeaca09d5f1e
--- /dev/null
+++ b/app-containers/containers-common/files/examplify-mounts-conf.patch
@@ -0,0 +1,7 @@
+--- a/pkg/subscriptions/mounts.conf
++++ a/pkg/subscriptions/mounts.conf
+@@ -1 +1,3 @@
+-/usr/share/rhel/secrets:/run/secrets
++# Refer to containers-mounts.conf(5)
++# Example:
++# /usr/share/rhel/secrets:/run/secrets
diff --git a/app-containers/containers-common/metadata.xml b/app-containers/containers-common/metadata.xml
new file mode 100644
index 000000000000..03634bb96f07
--- /dev/null
+++ b/app-containers/containers-common/metadata.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>me@rahil.rocks</email>
+    <name>Rahil Bhimjiani</name>
+  </maintainer>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <upstream>
+    <bugs-to>https://github.com/containers/common/issues</bugs-to>
+    <doc>https://github.com/containers/common/blob/main/README.md</doc>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/containers-image/Manifest b/app-containers/containers-image/Manifest
new file mode 100644
index 000000000000..a05fe0131364
--- /dev/null
+++ b/app-containers/containers-image/Manifest
@@ -0,0 +1,3 @@
+DIST containers-image-5.34.2.tar.gz 766227 BLAKE2B 27593e4d0035aee9eabc1011a837f16369d7985558ae1275e6726ff1b859d09ab036f150dc978ab0290cee7ba2b0878c50edcb131a2eb63ff947567fa1f10c2a SHA512 7e7cc5bfd2e8d71c332f08aab34c1b1cccadcf9f313d9519a294e9dfc370fd48d18f1e00dd0d74a19edf40ac511a544033fc27cf9537dcbb9458f721d88d564d
+DIST containers-image-5.35.0.tar.gz 766486 BLAKE2B c1708dd15eb9e8fdff739425542b5ead5f1e782e62b609b0d81fe4b5ad7ed5c61fe99bb4d9e29ea6d772bb9f093a286ed13c354cab48ad2681e111a073d124d6 SHA512 0acd064451184aa91d331bf113b934de10bf2e9225236b907c86006aed51cf4a8604cc57c73a2ae80848bc090b661548a7127b8b5112143f57c030ef5820333e
+DIST containers-image-5.36.2.tar.gz 764570 BLAKE2B eefd4dbdbc8e4ccf0123e641bf38287667e7b0999672349739f8d589609652254a6a93be5ee471d43a0f7433548d7a2bea304dc2868e180f663f5354706f521d SHA512 14355b1e97d5f1f778442758c5547e0892e1c6919fd33ff604ec2065198addb89e504a29fac447816e0d8479bba9a06364887cd854db475a4a28d8562cce0777
diff --git a/app-containers/containers-image/containers-image-5.34.2.ebuild b/app-containers/containers-image/containers-image-5.34.2.ebuild
new file mode 100644
index 000000000000..e588d895ad53
--- /dev/null
+++ b/app-containers/containers-image/containers-image-5.34.2.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Default config and docs related to Containers' images"
+HOMEPAGE="https://github.com/containers/image"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/image.git"
+else
+	SRC_URI="https://github.com/containers/image/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="amd64 arm64 ~loong ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+# https://github.com/gentoo/gentoo/pull/35012#discussion_r1473740969
+RESTRICT='test'
+BDEPEND=">=dev-go/go-md2man-2.0.3"
+RDEPEND="!<=app-containers/containers-common-0.57.0"
+PATCHES=(
+	"${FILESDIR}"/remove-go-as-bdepend-5.34.2.patch
+)
+
+src_compile() {
+	emake docs
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install
+
+	insinto /etc/containers
+	doins registries.conf
+}
diff --git a/app-containers/containers-image/containers-image-5.35.0.ebuild b/app-containers/containers-image/containers-image-5.35.0.ebuild
new file mode 100644
index 000000000000..e588d895ad53
--- /dev/null
+++ b/app-containers/containers-image/containers-image-5.35.0.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Default config and docs related to Containers' images"
+HOMEPAGE="https://github.com/containers/image"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/image.git"
+else
+	SRC_URI="https://github.com/containers/image/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="amd64 arm64 ~loong ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+# https://github.com/gentoo/gentoo/pull/35012#discussion_r1473740969
+RESTRICT='test'
+BDEPEND=">=dev-go/go-md2man-2.0.3"
+RDEPEND="!<=app-containers/containers-common-0.57.0"
+PATCHES=(
+	"${FILESDIR}"/remove-go-as-bdepend-5.34.2.patch
+)
+
+src_compile() {
+	emake docs
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install
+
+	insinto /etc/containers
+	doins registries.conf
+}
diff --git a/app-containers/containers-image/containers-image-5.36.2.ebuild b/app-containers/containers-image/containers-image-5.36.2.ebuild
new file mode 100644
index 000000000000..c9df2d46cc8a
--- /dev/null
+++ b/app-containers/containers-image/containers-image-5.36.2.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Default config and docs related to Containers' images"
+HOMEPAGE="https://github.com/containers/image"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/image.git"
+else
+	SRC_URI="https://github.com/containers/image/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="amd64 arm64 ~loong ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+# https://github.com/gentoo/gentoo/pull/35012#discussion_r1473740969
+RESTRICT='test'
+BDEPEND=">=dev-go/go-md2man-2.0.3"
+RDEPEND="!<=app-containers/containers-common-0.57.0"
+PATCHES=(
+	"${FILESDIR}"/remove-go-as-bdepend-5.34.2.patch
+)
+
+src_compile() {
+	emake docs
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install
+
+	insinto /etc/containers
+	doins registries.conf
+}
diff --git a/app-containers/containers-image/containers-image-9999.ebuild b/app-containers/containers-image/containers-image-9999.ebuild
new file mode 100644
index 000000000000..921fadc2e303
--- /dev/null
+++ b/app-containers/containers-image/containers-image-9999.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Default config and docs related to Containers' images"
+HOMEPAGE="https://github.com/containers/image"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/image.git"
+else
+	SRC_URI="https://github.com/containers/image/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="~amd64 ~arm64 ~loong ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+# https://github.com/gentoo/gentoo/pull/35012#discussion_r1473740969
+RESTRICT='test'
+BDEPEND=">=dev-go/go-md2man-2.0.3"
+RDEPEND="!<=app-containers/containers-common-0.57.0"
+PATCHES=(
+	"${FILESDIR}"/remove-go-as-bdepend-5.34.2.patch
+)
+
+src_compile() {
+	emake docs
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install
+
+	insinto /etc/containers
+	doins registries.conf
+}
diff --git a/app-containers/containers-image/files/remove-go-as-bdepend-5.34.2.patch b/app-containers/containers-image/files/remove-go-as-bdepend-5.34.2.patch
new file mode 100644
index 000000000000..a128d64787cb
--- /dev/null
+++ b/app-containers/containers-image/files/remove-go-as-bdepend-5.34.2.patch
@@ -0,0 +1,22 @@
+--- a/Makefile
++++ b/Makefile
+@@ -3,11 +3,6 @@
+ export GOPROXY=https://proxy.golang.org
+ 
+ 
+-GOBIN := $(shell go env GOBIN)
+-ifeq ($(GOBIN),)
+-GOBIN := $(shell go env GOPATH)/bin
+-endif
+-
+ # when cross compiling _for_ a Darwin or windows host, then we must use openpgp
+ BUILD_TAGS_WINDOWS_CROSS = containers_image_openpgp
+ BUILD_TAGS_DARWIN_CROSS = containers_image_openpgp
+@@ -15,7 +10,6 @@ BUILD_TAGS_DARWIN_CROSS = containers_image_openpgp
+ BUILDTAGS = btrfs_noversion libdm_no_deferred_remove
+ BUILDFLAGS := -tags "$(BUILDTAGS)"
+ 
+-PACKAGES := $(shell go list $(BUILDFLAGS) ./...)
+ SOURCE_DIRS = $(shell echo $(PACKAGES) | awk 'BEGIN{FS="/"; RS=" "}{print $$4}' | uniq)
+ 
+ PREFIX ?= ${DESTDIR}/usr
diff --git a/app-containers/containers-image/metadata.xml b/app-containers/containers-image/metadata.xml
new file mode 100644
index 000000000000..a8383f433ffa
--- /dev/null
+++ b/app-containers/containers-image/metadata.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>me@rahil.rocks</email>
+    <name>Rahil Bhimjiani</name>
+  </maintainer>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <upstream>
+    <bugs-to>https://github.com/containers/image/issues</bugs-to>
+    <doc>https://github.com/containers/image/blob/main/README.md</doc>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/containers-shortnames/Manifest b/app-containers/containers-shortnames/Manifest
new file mode 100644
index 000000000000..af4583389d78
--- /dev/null
+++ b/app-containers/containers-shortnames/Manifest
@@ -0,0 +1,2 @@
+DIST containers-shortnames-2023.02.20.tar.gz 13527 BLAKE2B 165a4c51bd284078990c94059145bb6b4bd5de4d8595eb2ccd2acc6fe8561e7edc300b7edadc684675ee281d7ada1c3a6d5aa0117c640ec22c2d2ef7e46486b5 SHA512 856dbbeb2acda276e9605bd1ecec0f8d65952c597ee2af61dd8909d7d3c04e5ef06c40b69ec4a98f79e623c536850f614c1b0af3a19637e300e7d3a285933193
+DIST containers-shortnames-2025.03.19.tar.gz 13672 BLAKE2B a72160f65aa13316c33b984173e151f0519720ec9617395980f0d7c5f25dc14b400aafbcb2fa8769eace9c1e51d4f1ddbe783e68fc0e40280743f90fbce30aa9 SHA512 edadadda8920ac4880f2c44f396e5d4c844bf15c964d7ef5d14c68637ac43e0df91f4efd2be747bca74bd0da959ea21cc3200ab14b2b57aba5975cff8f2fbefa
diff --git a/app-containers/containers-shortnames/containers-shortnames-2023.02.20.ebuild b/app-containers/containers-shortnames/containers-shortnames-2023.02.20.ebuild
new file mode 100644
index 000000000000..2baab9c7d15a
--- /dev/null
+++ b/app-containers/containers-shortnames/containers-shortnames-2023.02.20.ebuild
@@ -0,0 +1,36 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Configures default shortnames (aliases) for Containers"
+HOMEPAGE="https://github.com/containers/shortnames"
+
+if [[ ${PV} == *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/shortnames.git"
+else
+	SRC_URI="https://github.com/containers/shortnames/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="amd64 arm64 ~loong ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+src_configure() {
+	return
+}
+
+src_compile() {
+	return
+}
+
+src_test() {
+	return
+}
+
+src_install() {
+	insinto /etc/containers/registries.conf.d
+	newins shortnames.conf 000-shortnames.conf
+}
diff --git a/app-containers/containers-shortnames/containers-shortnames-2025.03.19.ebuild b/app-containers/containers-shortnames/containers-shortnames-2025.03.19.ebuild
new file mode 100644
index 000000000000..ba60f2eb93a8
--- /dev/null
+++ b/app-containers/containers-shortnames/containers-shortnames-2025.03.19.ebuild
@@ -0,0 +1,36 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Configures default shortnames (aliases) for Containers"
+HOMEPAGE="https://github.com/containers/shortnames"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/shortnames.git"
+else
+	SRC_URI="https://github.com/containers/shortnames/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="amd64 arm64 ~loong ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+src_configure() {
+	return
+}
+
+src_compile() {
+	return
+}
+
+src_test() {
+	return
+}
+
+src_install() {
+	insinto /etc/containers/registries.conf.d
+	newins shortnames.conf 000-shortnames.conf
+}
diff --git a/app-containers/containers-shortnames/containers-shortnames-9999.ebuild b/app-containers/containers-shortnames/containers-shortnames-9999.ebuild
new file mode 100644
index 000000000000..4188ec539c48
--- /dev/null
+++ b/app-containers/containers-shortnames/containers-shortnames-9999.ebuild
@@ -0,0 +1,36 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Configures default shortnames (aliases) for Containers"
+HOMEPAGE="https://github.com/containers/shortnames"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/shortnames.git"
+else
+	SRC_URI="https://github.com/containers/shortnames/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="~amd64 ~arm64 ~loong ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+src_configure() {
+	return
+}
+
+src_compile() {
+	return
+}
+
+src_test() {
+	return
+}
+
+src_install() {
+	insinto /etc/containers/registries.conf.d
+	newins shortnames.conf 000-shortnames.conf
+}
diff --git a/app-containers/containers-shortnames/metadata.xml b/app-containers/containers-shortnames/metadata.xml
new file mode 100644
index 000000000000..4d84433f2cc2
--- /dev/null
+++ b/app-containers/containers-shortnames/metadata.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>me@rahil.rocks</email>
+    <name>Rahil Bhimjiani</name>
+  </maintainer>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <upstream>
+    <bugs-to>https://github.com/containers/shortnames/issues</bugs-to>
+    <doc>https://github.com/containers/shortnames/blob/main/README.md</doc>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/containers-storage/Manifest b/app-containers/containers-storage/Manifest
new file mode 100644
index 000000000000..02a604e3ce8d
--- /dev/null
+++ b/app-containers/containers-storage/Manifest
@@ -0,0 +1,3 @@
+DIST containers-storage-1.55.1.tar.gz 4197824 BLAKE2B 5859e2267096541449aeff8576ad1dc00a72993d123ec5571e775f0081a6bc9cfc588bfd522bf7742bd417314e3a699d51e57127f66c152abb7cf805ffe61464 SHA512 3ba244d28e25c6a88f01a73ff26a4a0747c71124a6191d086d8521e1622f36740cfa0b1cbac56f7699a5af9a7001382e71c32fd0644960a53a97c00fd09a754e
+DIST containers-storage-1.57.2.tar.gz 4258308 BLAKE2B 1d068aaeb984060d1934c55e71824520963f32fe00c19b978e317032408c555c7f0ac028c9900e840a4ba7d1369892669cca15acb4f2d4ce9bdae77e3c29c636 SHA512 f092df52d2b8512d453ca4964304363481ef6bda3d05998654a2e3269fc9494af3a9c7c98f2a6895f6595c43733a4e9ebd39e3b62e1575a036134a8547dc3081
+DIST containers-storage-1.59.1.tar.gz 4606021 BLAKE2B a9814a21fa8937af0fcbc9f08d7ac7ee926be91014edfae4ab39df8417d0fbf6eefa910136451e23f5d8873fadcd4f92a451999bdba5bc41d3ade4715a9a0f50 SHA512 966dfec3cbf2210a07ebbfed481d7f546fb1bd649cfe4166238986dc92772b93748b8c9083dd8b8f6c303fac15c82e369337404d5d0dd5c4caa0b670b4f59298
diff --git a/app-containers/containers-storage/containers-storage-1.55.1.ebuild b/app-containers/containers-storage/containers-storage-1.55.1.ebuild
new file mode 100644
index 000000000000..360694b3adcd
--- /dev/null
+++ b/app-containers/containers-storage/containers-storage-1.55.1.ebuild
@@ -0,0 +1,32 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Default config and docs related to Containers' storage"
+HOMEPAGE="https://github.com/containers/storage"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/storage.git"
+else
+	SRC_URI="https://github.com/containers/storage/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="amd64 arm64 ~loong ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+BDEPEND=">=dev-go/go-md2man-2.0.2"
+
+src_compile() {
+	emake -C docs GOMD2MAN=go-md2man containers-storage.conf.5
+}
+
+src_install() {
+	emake DESTDIR="${ED}" -C docs install
+
+	insinto /etc/containers
+	doins storage.conf
+}
diff --git a/app-containers/containers-storage/containers-storage-1.57.2.ebuild b/app-containers/containers-storage/containers-storage-1.57.2.ebuild
new file mode 100644
index 000000000000..c0b8e4939c00
--- /dev/null
+++ b/app-containers/containers-storage/containers-storage-1.57.2.ebuild
@@ -0,0 +1,32 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Default config and docs related to Containers' storage"
+HOMEPAGE="https://github.com/containers/storage"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/storage.git"
+else
+	SRC_URI="https://github.com/containers/storage/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="amd64 arm64 ~loong ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+BDEPEND=">=dev-go/go-md2man-2.0.2"
+
+src_compile() {
+	emake -C docs GOMD2MAN=go-md2man containers-storage.conf.5
+}
+
+src_install() {
+	emake DESTDIR="${ED}" -C docs install
+
+	insinto /usr/share/containers
+	doins storage.conf
+}
diff --git a/app-containers/containers-storage/containers-storage-1.59.1.ebuild b/app-containers/containers-storage/containers-storage-1.59.1.ebuild
new file mode 100644
index 000000000000..9dea1a17790e
--- /dev/null
+++ b/app-containers/containers-storage/containers-storage-1.59.1.ebuild
@@ -0,0 +1,32 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Default config and docs related to Containers' storage"
+HOMEPAGE="https://github.com/containers/storage"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/storage.git"
+else
+	SRC_URI="https://github.com/containers/storage/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="amd64 arm64 ~loong ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+BDEPEND=">=dev-go/go-md2man-2.0.2"
+
+src_compile() {
+	emake -C docs GOMD2MAN=go-md2man containers-storage.conf.5
+}
+
+src_install() {
+	emake DESTDIR="${ED}" -C docs install
+
+	insinto /usr/share/containers
+	doins storage.conf
+}
diff --git a/app-containers/containers-storage/containers-storage-9999.ebuild b/app-containers/containers-storage/containers-storage-9999.ebuild
new file mode 100644
index 000000000000..b4037bbeac14
--- /dev/null
+++ b/app-containers/containers-storage/containers-storage-9999.ebuild
@@ -0,0 +1,32 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Default config and docs related to Containers' storage"
+HOMEPAGE="https://github.com/containers/storage"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/storage.git"
+else
+	SRC_URI="https://github.com/containers/storage/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P#containers-}"
+	KEYWORDS="~amd64 ~arm64 ~loong ~riscv"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+BDEPEND=">=dev-go/go-md2man-2.0.2"
+
+src_compile() {
+	emake -C docs GOMD2MAN=go-md2man containers-storage.conf.5
+}
+
+src_install() {
+	emake DESTDIR="${ED}" -C docs install
+
+	insinto /usr/share/containers
+	doins storage.conf
+}
diff --git a/app-containers/containers-storage/metadata.xml b/app-containers/containers-storage/metadata.xml
new file mode 100644
index 000000000000..1085e7581ab2
--- /dev/null
+++ b/app-containers/containers-storage/metadata.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <maintainer type="person" proxied="yes">
+    <email>me@rahil.rocks</email>
+    <name>Rahil Bhimjiani</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <upstream>
+    <bugs-to>https://github.com/containers/storage/issues</bugs-to>
+    <doc>https://github.com/containers/storage/blob/main/README.md</doc>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/cosign/Manifest b/app-containers/cosign/Manifest
new file mode 100644
index 000000000000..e8b60d4f3534
--- /dev/null
+++ b/app-containers/cosign/Manifest
@@ -0,0 +1,6 @@
+DIST cosign-2.5.0-deps.tar.xz 153839268 BLAKE2B 50fab18892824fe7a5b51827ed32b25a215d27a8460d67668afa8746a7e4b2008837d1cfa16cab447bbd99d983b720f1e5939a3a006d54c8c04753f371ed3a7c SHA512 8eafd5123c00fc2a0dd918b30d9957edb5555cef154515ece6b00edcc287647462e8159ac63fcccc8c59de741feb55fff07354e300ea07e925b22490b8aa88a6
+DIST cosign-2.5.0.tar.gz 896846 BLAKE2B bcf36d3ab4c158a02ade51685a2879e0f2092b94ab160f8dd20e28de7f422156e605ca0a943017d99d1a125694bb06243cb267cc7b575cdc452ad11fcef67cff SHA512 af67ab24f5fbf3ebdff5a4ead7243c8a64ce4e9f2bdc9afcd222dd230f50049a6ee6288dcb53440be41baf7608a21964ff772d24ba258039252a366480622ba0
+DIST cosign-2.6.1-deps.tar.xz 147025452 BLAKE2B 6addec265e7b674214a88361b4a83dce54b2b853973a69b66ffd36257caeb86623bb3dc3a4cb42c59cbae2a392551cd4365b5d2fb13a4ddbe43387b2aebaf269 SHA512 24c2d91ee9e4f88b1c6069e1764cb24f4d8048fe2f63280ee6e3763661fe94ec9b12adea4882c8bb2b4722807d7a338e49822880ab869d9ebaba70a2497e7861
+DIST cosign-2.6.1.tar.gz 987321 BLAKE2B a5c01899ab3a2f69c40fa3a80206334497c772c7a197fc2923b75db560583504abba072972cab4623feb82f4bb5f99293dcce33099fe0a193cbbcbfeebfcef98 SHA512 1498ef9504c10f0787927ca5841c8b158fec69902e59bac55b28409d21f241a787ceee7052e846570b192faa9181bea792d8a1d6099ef183420e620b0bb4ae28
+DIST cosign-3.0.3-deps.tar.xz 147117736 BLAKE2B 8dfd5140715e19adc3daedcf974f94ddcfe53e84af8c17334be003789f3fef87d6b778fdb8c38eb9ecb2f714857b40bf34dcea84071b9619f4f74c77f538410c SHA512 f638eb23ba58ca80f2fa3095d36a9205b04438325a003666573355167c515581843f1a92ff016b748c7d210f4cd42c19e61b57c610cf6bf54c7d861c65303c02
+DIST cosign-3.0.3.tar.gz 949214 BLAKE2B c41a776f5967c4692e84764f450340707f14c3a12dcbf6ded45bbb3d9b5cef59f291aaf5b56b56229a47f58baeee2b5efeff6529f3327d76eec86dee367b9dd0 SHA512 bbb0a248ad858a0c867e8760a752030cbe957682686f3f3cfaf1bd7ae350832df2e6d6fe9388f7323353d7377ae9920a99006c3be27610e5d89bfa9b737ab343
diff --git a/app-containers/cosign/cosign-2.5.0.ebuild b/app-containers/cosign/cosign-2.5.0.ebuild
new file mode 100644
index 000000000000..577ed0b332d3
--- /dev/null
+++ b/app-containers/cosign/cosign-2.5.0.ebuild
@@ -0,0 +1,32 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module
+GIT_HASH=38bb98697005cdc5c092f031594c0e45d039f4a0
+SOURCE_DATE_EPOCH=1744058029
+
+DESCRIPTION="container signing utility"
+HOMEPAGE="https://sigstore.dev"
+SRC_URI="https://github.com/sigstore/cosign/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64"
+
+RESTRICT="test"
+
+src_compile() {
+	emake \
+		GIT_HASH=${GIT_HASH} \
+		GIT_VERSION=v${PV} \
+		GIT_TREESTATE=clean \
+		SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
+}
+
+src_install() {
+	dobin cosign
+	einstalldocs
+dodoc CHANGELOG.md
+}
diff --git a/app-containers/cosign/cosign-2.6.1.ebuild b/app-containers/cosign/cosign-2.6.1.ebuild
new file mode 100644
index 000000000000..27ca584fb35c
--- /dev/null
+++ b/app-containers/cosign/cosign-2.6.1.ebuild
@@ -0,0 +1,32 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module
+GIT_HASH=634fabe54f9fbbab55d821a83ba93b2d25bdba5f
+SOURCE_DATE_EPOCH=1758907476
+
+DESCRIPTION="container signing utility"
+HOMEPAGE="https://sigstore.dev"
+SRC_URI="https://github.com/sigstore/cosign/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64"
+
+RESTRICT="test"
+
+src_compile() {
+	emake \
+		GIT_HASH=${GIT_HASH} \
+		GIT_VERSION=v${PV} \
+		GIT_TREESTATE=clean \
+		SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
+}
+
+src_install() {
+	dobin cosign
+	einstalldocs
+dodoc CHANGELOG.md
+}
diff --git a/app-containers/cosign/cosign-3.0.3.ebuild b/app-containers/cosign/cosign-3.0.3.ebuild
new file mode 100644
index 000000000000..46802019b1ca
--- /dev/null
+++ b/app-containers/cosign/cosign-3.0.3.ebuild
@@ -0,0 +1,32 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module
+GIT_HASH=3f32cea203c59a93323a6bebfebff03417520143
+SOURCE_DATE_EPOCH=1765324943
+
+DESCRIPTION="container signing utility"
+HOMEPAGE="https://sigstore.dev"
+SRC_URI="https://github.com/sigstore/cosign/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64"
+
+RESTRICT="test"
+
+src_compile() {
+	emake \
+		GIT_HASH=${GIT_HASH} \
+		GIT_VERSION=v${PV} \
+		GIT_TREESTATE=clean \
+		SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
+}
+
+src_install() {
+	dobin cosign
+	einstalldocs
+dodoc CHANGELOG.md
+}
diff --git a/app-containers/cosign/metadata.xml b/app-containers/cosign/metadata.xml
new file mode 100644
index 000000000000..07b4839da7be
--- /dev/null
+++ b/app-containers/cosign/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:sigstore:cosign</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/cri-o/Manifest b/app-containers/cri-o/Manifest
new file mode 100644
index 000000000000..a766d9de0763
--- /dev/null
+++ b/app-containers/cri-o/Manifest
@@ -0,0 +1,3 @@
+DIST cri-o-1.31.2.tar.gz 19921920 BLAKE2B 4e60c15d73691dabab8f7f1229b0b8e534393128a53cd31639509454286ec237cf5e6bf258c8e06478b76b872b6e1e8d3481b19a277be4c0bf756b1a6d858d95 SHA512 be42d08ee2a9d030d9279dee269d121822de5c74aafa765688c91383a284cda890aa969a5a2b0649835893bd3b382e6bf2a1f81991710b479b4159877e0626aa
+DIST cri-o-1.31.4.tar.gz 19919611 BLAKE2B b9c2a855c8f8b780e4f77172dab0070cf9fa96216c1b03d1c06b42ac1385dbd9e57e4dadd88a54c4c0dde8366dda95293c1763c3fec554b79573ddd8da02aa6e SHA512 c10cb633a2bbc7c3d0fdbae7b5541fc948804ca797a71532e0dcd783d0e56158650ea93d3cce36995922e04f9f22c27c4255bc40a81930e263ebb0c710372a06
+DIST cri-o-1.34.3.tar.gz 21788931 BLAKE2B 2c4c87d5a07f479d306c8f511257a3194fde907aea7af10745cbd909c972c875c8d9b81f9ce922ba89b2451d47ae31f62ae5bcb7038aa525fb8a79bfdfb4b28f SHA512 031396b4e5ac49a484c32857ed156b51940025d973996b69db9b40cb96305072d68e980222d9f23185dd7fb9bb25a21b4858b87ceb46bbe45ff34034f5eaeea9
diff --git a/app-containers/cri-o/cri-o-1.31.2.ebuild b/app-containers/cri-o/cri-o-1.31.2.ebuild
new file mode 100644
index 000000000000..dc7fce58874d
--- /dev/null
+++ b/app-containers/cri-o/cri-o-1.31.2.ebuild
@@ -0,0 +1,103 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+EGIT_COMMIT=920af25f2b6fd4f52bced0e73f696e48464da543
+
+inherit go-module
+
+DESCRIPTION="OCI-based implementation of Kubernetes Container Runtime Interface"
+HOMEPAGE="https://cri-o.io/"
+SRC_URI="https://github.com/cri-o/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+IUSE="btrfs +device-mapper selinux systemd"
+
+COMMON_DEPEND="
+	app-crypt/gpgme:=
+	app-containers/conmon
+	app-containers/runc
+	dev-libs/glib:=
+	dev-libs/libassuan:=
+	dev-libs/libgpg-error:=
+	net-firewall/conntrack-tools
+	net-firewall/iptables
+	app-containers/cni-plugins
+	net-misc/socat
+	sys-apps/iproute2
+	sys-libs/libseccomp:=
+	btrfs? ( sys-fs/btrfs-progs )
+	device-mapper? ( sys-fs/lvm2:= )
+	selinux? ( sys-libs/libselinux:= )
+	systemd? ( sys-apps/systemd:= )"
+DEPEND="
+	${COMMON_DEPEND}
+	dev-go/go-md2man"
+RDEPEND="${COMMON_DEPEND}
+	!<app-containers/podman-1.3.2-r1
+	selinux? ( sec-policy/selinux-crio )"
+BDEPEND="sys-apps/which"
+
+src_prepare() {
+	default
+
+	sed -e '/^export GOPROXY=/d' \
+		-e '/^GIT_.*/d' \
+		-e '/	git diff --exit-code/d' \
+		-e 's/$(GO) build -i/$(GO) build -v -work -x/' \
+		-e 's/\${GIT_COMMIT}/'${EGIT_COMMIT}'/' \
+		-e "s|^GIT_COMMIT := .*|GIT_COMMIT := ${EGIT_COMMIT}|" \
+		-e "s|^COMMIT_NO := .*|COMMIT_NO := ${EGIT_COMMIT}|" \
+		-i Makefile || die
+
+	echo ".NOTPARALLEL: binaries docs" >> Makefile || die
+
+	sed -e 's:/usr/local/bin:/usr/bin:' \
+		-i contrib/systemd/* || die
+}
+
+src_compile() {
+	[[ -f hack/btrfs_installed_tag.sh ]] || die
+	use btrfs || { echo -e "#!/bin/sh\necho exclude_graphdriver_btrfs" > \
+		hack/btrfs_installed_tag.sh || die; }
+
+	[[ -f hack/libdm_installed.sh ]] || die
+	use device-mapper || { echo -e "#!/bin/sh\necho exclude_graphdriver_devicemapper" > \
+		hack/libdm_installed.sh || die; }
+
+	[[ -f hack/selinux_tag.sh ]] || die
+	use selinux || { echo -e "#!/bin/sh\ntrue" > \
+		hack/selinux_tag.sh || die; }
+
+	mkdir -p bin || die
+	emake all \
+		GOBIN="${S}/bin" \
+		GO_BUILD="go build ${GOFLAGS}" \
+		GO_MD2MAN="$(which go-md2man)"
+}
+
+src_install() {
+	emake install install.config install.systemd \
+		DESTDIR="${D}" \
+		GO_MD2MAN="$(which go-md2man)" \
+		PREFIX="${D}${EPREFIX}/usr"
+	keepdir /etc/crio
+	mv "${ED}/etc/crio/crio.conf"{,.example} || die
+
+	newinitd "${FILESDIR}/crio.initd" crio
+
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}/${PN}.logrotated" "${PN}"
+
+	# Suppress crio log error messages triggered if these don't exist.
+	keepdir /etc/containers/oci/hooks.d
+	keepdir /usr/share/containers/oci/hooks.d
+
+	# Suppress crio "Missing CNI default network" log message.
+	keepdir /etc/cni/net.d
+	insinto /etc/cni/net.d
+	doins contrib/cni/99-loopback.conflist
+}
diff --git a/app-containers/cri-o/cri-o-1.31.4.ebuild b/app-containers/cri-o/cri-o-1.31.4.ebuild
new file mode 100644
index 000000000000..3bc77ec3ed72
--- /dev/null
+++ b/app-containers/cri-o/cri-o-1.31.4.ebuild
@@ -0,0 +1,103 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+EGIT_COMMIT=33d75981bee230f791709975125d7386fe2c530a
+
+inherit go-module
+
+DESCRIPTION="OCI-based implementation of Kubernetes Container Runtime Interface"
+HOMEPAGE="https://cri-o.io/"
+SRC_URI="https://github.com/cri-o/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+IUSE="btrfs +device-mapper selinux systemd"
+
+COMMON_DEPEND="
+	app-crypt/gpgme:=
+	app-containers/conmon
+	app-containers/runc
+	dev-libs/glib:=
+	dev-libs/libassuan:=
+	dev-libs/libgpg-error:=
+	net-firewall/conntrack-tools
+	net-firewall/iptables
+	app-containers/cni-plugins
+	net-misc/socat
+	sys-apps/iproute2
+	sys-libs/libseccomp:=
+	btrfs? ( sys-fs/btrfs-progs )
+	device-mapper? ( sys-fs/lvm2:= )
+	selinux? ( sys-libs/libselinux:= )
+	systemd? ( sys-apps/systemd:= )"
+DEPEND="
+	${COMMON_DEPEND}
+	dev-go/go-md2man"
+RDEPEND="${COMMON_DEPEND}
+	!<app-containers/podman-1.3.2-r1
+	selinux? ( sec-policy/selinux-crio )"
+BDEPEND="sys-apps/which"
+
+src_prepare() {
+	default
+
+	sed -e '/^export GOPROXY=/d' \
+		-e '/^GIT_.*/d' \
+		-e '/	git diff --exit-code/d' \
+		-e 's/$(GO) build -i/$(GO) build -v -work -x/' \
+		-e 's/\${GIT_COMMIT}/'${EGIT_COMMIT}'/' \
+		-e "s|^GIT_COMMIT := .*|GIT_COMMIT := ${EGIT_COMMIT}|" \
+		-e "s|^COMMIT_NO := .*|COMMIT_NO := ${EGIT_COMMIT}|" \
+		-i Makefile || die
+
+	echo ".NOTPARALLEL: binaries docs" >> Makefile || die
+
+	sed -e 's:/usr/local/bin:/usr/bin:' \
+		-i contrib/systemd/* || die
+}
+
+src_compile() {
+	[[ -f hack/btrfs_installed_tag.sh ]] || die
+	use btrfs || { echo -e "#!/bin/sh\necho exclude_graphdriver_btrfs" > \
+		hack/btrfs_installed_tag.sh || die; }
+
+	[[ -f hack/libdm_installed.sh ]] || die
+	use device-mapper || { echo -e "#!/bin/sh\necho exclude_graphdriver_devicemapper" > \
+		hack/libdm_installed.sh || die; }
+
+	[[ -f hack/selinux_tag.sh ]] || die
+	use selinux || { echo -e "#!/bin/sh\ntrue" > \
+		hack/selinux_tag.sh || die; }
+
+	mkdir -p bin || die
+	emake all \
+		GOBIN="${S}/bin" \
+		GO_BUILD="go build ${GOFLAGS}" \
+		GO_MD2MAN="$(which go-md2man)"
+}
+
+src_install() {
+	emake install install.config install.systemd \
+		DESTDIR="${D}" \
+		GO_MD2MAN="$(which go-md2man)" \
+		PREFIX="${D}${EPREFIX}/usr"
+	keepdir /etc/crio
+	mv "${ED}/etc/crio/crio.conf"{,.example} || die
+
+	newinitd "${FILESDIR}/crio.initd" crio
+
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}/${PN}.logrotated" "${PN}"
+
+	# Suppress crio log error messages triggered if these don't exist.
+	keepdir /etc/containers/oci/hooks.d
+	keepdir /usr/share/containers/oci/hooks.d
+
+	# Suppress crio "Missing CNI default network" log message.
+	keepdir /etc/cni/net.d
+	insinto /etc/cni/net.d
+	doins contrib/cni/99-loopback.conflist
+}
diff --git a/app-containers/cri-o/cri-o-1.34.3.ebuild b/app-containers/cri-o/cri-o-1.34.3.ebuild
new file mode 100644
index 000000000000..1d535f44d1d4
--- /dev/null
+++ b/app-containers/cri-o/cri-o-1.34.3.ebuild
@@ -0,0 +1,99 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+EGIT_COMMIT=067a88aedf5d7c658a2acb81afe82d6c3a367a52
+
+inherit go-module
+
+DESCRIPTION="OCI-based implementation of Kubernetes Container Runtime Interface"
+HOMEPAGE="https://cri-o.io/"
+SRC_URI="https://github.com/cri-o/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+IUSE="btrfs +device-mapper selinux systemd"
+
+COMMON_DEPEND="
+	app-crypt/gpgme:=
+	app-containers/conmon
+	app-containers/runc
+	dev-libs/glib:=
+	dev-libs/libassuan:=
+	dev-libs/libgpg-error:=
+	net-firewall/conntrack-tools
+	net-firewall/iptables
+	app-containers/cni-plugins
+	net-misc/socat
+	sys-apps/iproute2
+	sys-libs/libseccomp:=
+	btrfs? ( sys-fs/btrfs-progs )
+	device-mapper? ( sys-fs/lvm2:= )
+	selinux? ( sys-libs/libselinux:= )
+	systemd? ( sys-apps/systemd:= )"
+DEPEND="
+	${COMMON_DEPEND}
+	dev-go/go-md2man"
+RDEPEND="${COMMON_DEPEND}
+	!<app-containers/podman-1.3.2-r1
+	selinux? ( sec-policy/selinux-crio )"
+BDEPEND="sys-apps/which"
+
+src_prepare() {
+	default
+
+	sed -e '/^export GOPROXY=/d' \
+		-e '/^GIT_.*/d' \
+		-e '/	git diff --exit-code/d' \
+		-e 's/$(GO) build -i/$(GO) build -v -work -x/' \
+		-e 's/\${GIT_COMMIT}/'${EGIT_COMMIT}'/' \
+		-e "s|^GIT_COMMIT := .*|GIT_COMMIT := ${EGIT_COMMIT}|" \
+		-e "s|^COMMIT_NO := .*|COMMIT_NO := ${EGIT_COMMIT}|" \
+		-i Makefile || die
+
+	echo ".NOTPARALLEL: binaries docs" >> Makefile || die
+
+	sed -e 's:/usr/local/bin:/usr/bin:' \
+		-i contrib/systemd/* || die
+}
+
+src_compile() {
+	[[ -f hack/btrfs_installed_tag.sh ]] || die
+	use btrfs || { echo -e "#!/bin/sh\necho exclude_graphdriver_btrfs" > \
+		hack/btrfs_installed_tag.sh || die; }
+
+	[[ -f hack/selinux_tag.sh ]] || die
+	use selinux || { echo -e "#!/bin/sh\ntrue" > \
+		hack/selinux_tag.sh || die; }
+
+	mkdir -p bin || die
+	emake all \
+		GOBIN="${S}/bin" \
+		GO_BUILD="go build ${GOFLAGS}" \
+		GO_MD2MAN="$(which go-md2man)"
+}
+
+src_install() {
+	emake install install.config install.systemd \
+		DESTDIR="${D}" \
+		GO_MD2MAN="$(which go-md2man)" \
+		PREFIX="${D}${EPREFIX}/usr"
+	keepdir /etc/crio
+	mv "${ED}/etc/crio/crio.conf"{,.example} || die
+
+	newinitd "${FILESDIR}/crio.initd" crio
+
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}/${PN}.logrotated" "${PN}"
+
+	# Suppress crio log error messages triggered if these don't exist.
+	keepdir /etc/containers/oci/hooks.d
+	keepdir /usr/share/containers/oci/hooks.d
+
+	# Suppress crio "Missing CNI default network" log message.
+	keepdir /etc/cni/net.d
+	insinto /etc/cni/net.d
+	doins contrib/cni/99-loopback.conflist
+}
diff --git a/app-containers/cri-o/files/cri-o.logrotated b/app-containers/cri-o/files/cri-o.logrotated
new file mode 100644
index 000000000000..fb0b8b14a8a1
--- /dev/null
+++ b/app-containers/cri-o/files/cri-o.logrotated
@@ -0,0 +1,7 @@
+/var/log/crio/crio.log {
+	missingok
+	size 5M
+	rotate 3
+	compress
+	copytruncate
+}
diff --git a/app-containers/cri-o/files/crio.initd b/app-containers/cri-o/files/crio.initd
new file mode 100644
index 000000000000..9e6383ac976b
--- /dev/null
+++ b/app-containers/cri-o/files/crio.initd
@@ -0,0 +1,35 @@
+#!/sbin/openrc-run
+# Copyright 2015-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+description="OCI Kubernetes Container Runtime daemon"
+pidfile=${pidfile:-"/run/${RC_SVCNAME}.pid"}
+extra_started_commands="reload"
+command="/usr/bin/${RC_SVCNAME}"
+command_args="${command_args}"
+command_background="true"
+start_stop_daemon_args=" \
+	--stdout /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log \
+	--stderr /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log"
+
+depend() {
+	need net
+}
+
+checkconfig() {
+	checkpath --directory --owner root:root --mode 0775 \
+		/var/log/${RC_SVCNAME}
+	checkpath --file --owner root:root --mode 0644 \
+		/var/log/${RC_SVCNAME}/${RC_SVCNAME}.log
+}
+
+start() {
+	checkconfig
+	default_start
+}
+
+reload() {
+	ebegin "Reloading ${RC_SVCNAME}"
+	start-stop-daemon --signal HUP --pidfile "${pidfile}"
+	eend $?
+}
diff --git a/app-containers/cri-o/metadata.xml b/app-containers/cri-o/metadata.xml
new file mode 100644
index 000000000000..6bd3cb4815d1
--- /dev/null
+++ b/app-containers/cri-o/metadata.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <longdescription lang="en">
+		CRI-O is meant to provide an integration path between
+		OCI conformant runtimes and the kubelet. Specifically, it
+		implements the Kubelet Container Runtime Interface (CRI)
+		using OCI conformant runtimes. The scope of CRI-O is tied to
+		the scope of the CRI.
+	</longdescription>
+  <use>
+    <flag name="btrfs">
+			Enables dependencies for the "btrfs" graph driver, including
+			necessary kernel flags.
+		</flag>
+    <flag name="device-mapper">
+			Enables dependencies for the "devicemapper" graph driver, including
+			necessary kernel flags.
+		</flag>
+  </use>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:kubernetes:cri-o</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/cri-tools/Manifest b/app-containers/cri-tools/Manifest
new file mode 100644
index 000000000000..b036db60590a
--- /dev/null
+++ b/app-containers/cri-tools/Manifest
@@ -0,0 +1,3 @@
+DIST cri-tools-1.33.0.tar.gz 7754304 BLAKE2B 42011726997a07842fd3c9769335a71e37e1689e443a0d1a99916b5729cc22092593928a6b94bbc3718a0e5f89f3818c3b6d6155970de21e8eee30fc979a294d SHA512 0252243147e32e06328c192f77397461a729aec621bee92083dcf3899e9ffbb62386a944795535cc4a0deb5c88d1017082db8bf221f6627feb7dcd100dc70457
+DIST cri-tools-1.35.0.tar.gz 8074824 BLAKE2B a91dcfc326857e0dc43867189f0c2fac2a12ce112a4439eba61cfe655fba1dec455a3070bd5068cf4934487bf94255cd60197c3f7fd4aa20465ebb1bd4f63b7c SHA512 ea34e736b457f851b610e8091ebbb608ac0f790c80156ad3e1a7080c76df4ea759091300b7ee6b5812a42ec93e165d71b6fa06f12424f46b4b181f5059b100bb
+DIST cri-tools-1.36.0.tar.gz 7432869 BLAKE2B 57711c75ee1f54a99e087afa67d20e9b1f0a38e9a5da5e5c85724e84a95cb4d0b32b0e0b2ffa6d8aad60218684fe95d6445b6b57f253447cc7c09ddca43a5835 SHA512 5daa05ad977c85c5656c0fd1a6d4dd0b4596bf9d05038229fa522941e51793fff4272bb7c403b6bff6b6dde80d6f45f161e979861547bf5fb91095a096726967
diff --git a/app-containers/cri-tools/cri-tools-1.33.0.ebuild b/app-containers/cri-tools/cri-tools-1.33.0.ebuild
new file mode 100644
index 000000000000..5248a34ec7cf
--- /dev/null
+++ b/app-containers/cri-tools/cri-tools-1.33.0.ebuild
@@ -0,0 +1,40 @@
+# Copyright 2021-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module shell-completion sysroot
+
+DESCRIPTION="CLI and validation tools for Kubelet Container Runtime (CRI)"
+HOMEPAGE="https://github.com/kubernetes-sigs/cri-tools"
+SRC_URI="https://github.com/kubernetes-sigs/cri-tools/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~arm64"
+RESTRICT="test"
+
+BDEPEND=">=dev-lang/go-1.24.1"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-goflags.patch
+)
+
+DOCS=( docs {README,RELEASE,CHANGELOG,CONTRIBUTING}.md )
+
+src_compile() {
+	local GOOS=$(go-env_goos)
+	CRICTL="build/bin/${GOOS}/${GOARCH}/crictl"
+	emake VERSION="${PV}"
+
+	sysroot_try_run_prefixed "${CRICTL}" completion bash > crictl.bash || die
+	sysroot_try_run_prefixed "${CRICTL}" completion zsh > crictl.zsh || die
+}
+
+src_install() {
+	einstalldocs
+	dobin "${CRICTL}"
+
+	[[ -s crictl.bash ]] && newbashcomp crictl.bash crictl
+	[[ -s crictl.zsh ]] && newzshcomp crictl.zsh _crictl
+}
diff --git a/app-containers/cri-tools/cri-tools-1.35.0.ebuild b/app-containers/cri-tools/cri-tools-1.35.0.ebuild
new file mode 100644
index 000000000000..70c8c7c98277
--- /dev/null
+++ b/app-containers/cri-tools/cri-tools-1.35.0.ebuild
@@ -0,0 +1,39 @@
+# Copyright 2021-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module shell-completion sysroot
+
+DESCRIPTION="CLI and validation tools for Kubelet Container Runtime (CRI)"
+HOMEPAGE="https://github.com/kubernetes-sigs/cri-tools"
+SRC_URI="https://github.com/kubernetes-sigs/cri-tools/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+RESTRICT="test"
+
+BDEPEND=">=dev-lang/go-1.26.2"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-goflags.patch
+)
+
+DOCS=( docs {README,RELEASE,CHANGELOG,CONTRIBUTING}.md )
+
+src_compile() {
+	CRICTL="build/bin/${GOOS}/${GOARCH}/crictl"
+	emake VERSION="${PV}"
+
+	sysroot_try_run_prefixed "${CRICTL}" completion bash > crictl.bash || die
+	sysroot_try_run_prefixed "${CRICTL}" completion zsh > crictl.zsh || die
+}
+
+src_install() {
+	einstalldocs
+	dobin "${CRICTL}"
+
+	[[ -s crictl.bash ]] && newbashcomp crictl.bash crictl
+	[[ -s crictl.zsh ]] && newzshcomp crictl.zsh _crictl
+}
diff --git a/app-containers/cri-tools/cri-tools-1.36.0.ebuild b/app-containers/cri-tools/cri-tools-1.36.0.ebuild
new file mode 100644
index 000000000000..70c8c7c98277
--- /dev/null
+++ b/app-containers/cri-tools/cri-tools-1.36.0.ebuild
@@ -0,0 +1,39 @@
+# Copyright 2021-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module shell-completion sysroot
+
+DESCRIPTION="CLI and validation tools for Kubelet Container Runtime (CRI)"
+HOMEPAGE="https://github.com/kubernetes-sigs/cri-tools"
+SRC_URI="https://github.com/kubernetes-sigs/cri-tools/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+RESTRICT="test"
+
+BDEPEND=">=dev-lang/go-1.26.2"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-goflags.patch
+)
+
+DOCS=( docs {README,RELEASE,CHANGELOG,CONTRIBUTING}.md )
+
+src_compile() {
+	CRICTL="build/bin/${GOOS}/${GOARCH}/crictl"
+	emake VERSION="${PV}"
+
+	sysroot_try_run_prefixed "${CRICTL}" completion bash > crictl.bash || die
+	sysroot_try_run_prefixed "${CRICTL}" completion zsh > crictl.zsh || die
+}
+
+src_install() {
+	einstalldocs
+	dobin "${CRICTL}"
+
+	[[ -s crictl.bash ]] && newbashcomp crictl.bash crictl
+	[[ -s crictl.zsh ]] && newzshcomp crictl.zsh _crictl
+}
diff --git a/app-containers/cri-tools/files/cri-tools-goflags.patch b/app-containers/cri-tools/files/cri-tools-goflags.patch
new file mode 100644
index 000000000000..63c68ec2ac99
--- /dev/null
+++ b/app-containers/cri-tools/files/cri-tools-goflags.patch
@@ -0,0 +1,44 @@
+From a1fa6b1f1d54c0739c5940e4da0b9153b3455db3 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <jlecuirot@microsoft.com>
+Date: Mon, 13 Apr 2026 11:20:12 +0100
+Subject: [PATCH] Makefile: Don't explicitly pass GOFLAGS to go commands
+
+go automatically checks GOFLAGS and filters unknown flags for you, e.g.
+it will drop the go run -exec flag when doing go build. Explicitly
+passing GOFLAGS breaks this filtering.
+
+Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
+--- a/Makefile
++++ b/Makefile
+@@ -38,6 +38,7 @@ VERSION ?= $(shell git describe --tags --dirty --always | sed 's/^v//')
+ CGO_ENABLED ?= 0
+ GOFLAGS ?= -trimpath
+ GO_LDFLAGS := $(GO_LDFLAGS) -X $(PROJECT)/pkg/version.Version=$(VERSION)
++export GOFLAGS
+ 
+ BUILD_PATH := $(shell pwd)/build
+ BUILD_BIN_PATH := $(BUILD_PATH)/bin/$(GOOS)/$(GOARCH)
+@@ -100,7 +101,6 @@ critest: ## Build the critest binary.
+ $(CRITEST):
+ 	CGO_ENABLED=$(CGO_ENABLED) $(GO_TEST) -c -o $@ \
+ 		-ldflags '$(GO_LDFLAGS)' \
+-		$(GOFLAGS) \
+ 	     $(PROJECT)/cmd/critest
+ 
+ .PHONY: crictl
+@@ -110,7 +110,6 @@ crictl: ## Build the crictl binary.
+ $(CRICTL):
+ 	CGO_ENABLED=$(CGO_ENABLED) $(GO_BUILD) -o $@ \
+ 		-ldflags '$(GO_LDFLAGS)' \
+-		$(GOFLAGS) \
+ 		$(PROJECT)/cmd/crictl
+ 
+ .PHONY: clean
+@@ -200,7 +199,6 @@ test-crictl: $(GINKGO) ## Run the crictl test suite.
+ 	# Run go test for templates_test.go and util_test.go
+ 	CGO_ENABLED=$(CGO_ENABLED) $(GO_TEST) \
+ 		-ldflags '$(GO_LDFLAGS)' \
+-		$(GOFLAGS) \
+ 		$(PROJECT)/cmd/crictl
+ 	$(GINKGO) $(TESTFLAGS) \
+ 		-r -p \
diff --git a/app-containers/cri-tools/metadata.xml b/app-containers/cri-tools/metadata.xml
new file mode 100644
index 000000000000..591131b1265f
--- /dev/null
+++ b/app-containers/cri-tools/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/crun/Manifest b/app-containers/crun/Manifest
new file mode 100644
index 000000000000..e96945bc72d7
--- /dev/null
+++ b/app-containers/crun/Manifest
@@ -0,0 +1,5 @@
+DIST crun-1.19.1.tar.gz 1786019 BLAKE2B 555f7c917c9e9ed80919b708cd711890d47c395b5b6fa1c2b542d311176941c5ece23bd7ff0cb4c3dcf81be4f46fec21fa8127da57092657157707537771dfe1 SHA512 6cb6148a3b6e18b4dbb0178ea23eaaa57c040781a34b5c5c5dac71be513941717011fe996a7400b9dee0a73f7f0dd2fc36544fe72382a3f2543e4de90589fe6a
+DIST crun-1.20.tar.gz 1787750 BLAKE2B 4f31c21056c6c764c76021d3121dfaa4dd9b91f17def977238df831af02f27aff267cf22c3f1ade4f332d757ffc50cc98a480aea7cd67b3552f19ba5c810c3f8 SHA512 759326768a9a141ecaec5824e3c30cade0a0c7d848935d434cada4fdc5a59a992f1916515141a84387cdb95ee1307f5bec471679d7ff9b403b0cb2b10c7dfd74
+DIST crun-1.21.tar.gz 1788933 BLAKE2B bc854f8eb24566d608e90b44cb7dd2509b59cf6594eef244839f15beef2d241eab7149aabcf2156694043ab00367e312f58599deb324b85493555958eedaf849 SHA512 dbec4b55645587046a83903822a00b93092b26fdf36d6df9b086674815b53a9a60f907c1611eb9535f3186a03d6e8a98ae6e40e9f4e287855ea17745c3578d4f
+DIST crun-1.25.1.tar.gz 1867772 BLAKE2B 8bd15f34d867800838514d6fcc1fe90de5488ad29addb483148ab15027bcebaa7d5eb23dfe9d939679e1f0168c7104e0a3de1eaedc13de898faa1e116761b92f SHA512 46ec1efbd0532c2c531daad770670082bb57c5d11959f328ee6d20c4e4d6ba2a050150883fd01475f94850eb3ee8ce4bc8654f76cee3f83edebf208cd32d1cf8
+DIST crun-1.28.tar.gz 1585077 BLAKE2B bc7d7cdaad87ad4131247f07fc947de69c51a7f6f909939f8b3e49035493dc87648d01340d9a1495af3c84741e4a619815ad6c012099fb3391958fdfda1bde8c SHA512 b27af828aaf8d7911669ab2df396ba8e314f6a14e31c7d40e19d79e9ba3f9e301e70e82a1d56def5aef171d2b69ac40ec7624ccd4cfd060f06e7762f801037ec
diff --git a/app-containers/crun/crun-1.19.1.ebuild b/app-containers/crun/crun-1.19.1.ebuild
new file mode 100644
index 000000000000..e0ad2932d80b
--- /dev/null
+++ b/app-containers/crun/crun-1.19.1.ebuild
@@ -0,0 +1,90 @@
+# Copyright 2019-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit autotools libtool python-any-r1
+
+DESCRIPTION="A fast and low-memory footprint OCI Container Runtime fully written in C"
+HOMEPAGE="https://github.com/containers/crun"
+
+if [[ "$PV" == *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/${PN}.git"
+else
+	SRC_URI="https://github.com/containers/${PN}/releases/download/${PV}/${P}.tar.gz"
+	KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv"
+fi
+
+LICENSE="GPL-2+ LGPL-2.1+"
+SLOT="0"
+IUSE="+bpf +caps criu +seccomp selinux systemd static-libs"
+
+DEPEND="
+	dev-libs/yajl:=
+	sys-kernel/linux-headers
+	caps? ( sys-libs/libcap )
+	criu? ( >=sys-process/criu-3.15 )
+	seccomp? ( sys-libs/libseccomp )
+	systemd? ( sys-apps/systemd:= )
+"
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/pkgconfig
+"
+
+src_prepare() {
+	default
+	elibtoolize
+
+	# https://github.com/containers/crun/pull/1887
+	sed -i -E '/AC_CHECK_HEADERS\(\[error.h/{
+		s/error\.h[[:space:]]*//g
+		a\
+		AC_CHECK_HEADER([error.h], [AC_CHECK_FUNC([error], AC_DEFINE([HAVE_ERROR_H], [1], [Define if error.h is usable]))])
+	}' configure.ac || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--cache-file="${S}"/config.cache
+		$(use_enable bpf)
+		$(use_enable caps)
+		$(use_enable criu)
+		$(use_enable seccomp)
+		$(use_enable systemd)
+		$(usex static-libs '--enable-shared --enable-static' '--enable-shared --disable-static' '' '')
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	emake check-TESTS -C ./libocispec
+
+	# the crun test suite is comprehensive to the extent that tests will fail
+	# within a sandbox environment, due to the nature of the privileges
+	# required to create linux "containers".
+	local supported_tests=(
+		"tests/tests_libcrun_utils"
+		"tests/tests_libcrun_errors"
+		"tests/tests_libcrun_intelrdt"
+		"tests/test_oci_features"
+	)
+	emake check-TESTS TESTS="${supported_tests[*]}"
+}
+
+src_install() {
+	emake "DESTDIR=${D}" install-exec
+	doman crun.1
+	einstalldocs
+
+	einfo "Cleaning up .la files"
+	find "${ED}" -name '*.la' -delete || die
+}
diff --git a/app-containers/crun/crun-1.20.ebuild b/app-containers/crun/crun-1.20.ebuild
new file mode 100644
index 000000000000..ac72026c7ac1
--- /dev/null
+++ b/app-containers/crun/crun-1.20.ebuild
@@ -0,0 +1,88 @@
+# Copyright 2019-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit autotools libtool python-any-r1
+
+DESCRIPTION="A fast and low-memory footprint OCI Container Runtime fully written in C"
+HOMEPAGE="https://github.com/containers/crun"
+
+if [[ "$PV" == *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/${PN}.git"
+else
+	SRC_URI="https://github.com/containers/${PN}/releases/download/${PV}/${P}.tar.gz"
+	KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv"
+fi
+
+LICENSE="GPL-2+ LGPL-2.1+"
+SLOT="0"
+IUSE="+bpf +caps criu +seccomp selinux systemd static-libs"
+
+DEPEND="
+	dev-libs/yajl:=
+	sys-kernel/linux-headers
+	caps? ( sys-libs/libcap )
+	criu? ( >=sys-process/criu-3.15 )
+	seccomp? ( sys-libs/libseccomp )
+	systemd? ( sys-apps/systemd:= )
+"
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/pkgconfig
+"
+
+src_prepare() {
+	default
+	elibtoolize
+
+	# https://github.com/containers/crun/pull/1887
+	sed -i -E '/AC_CHECK_HEADERS\(\[error.h/{
+		s/error\.h[[:space:]]*//g
+		a\
+		AC_CHECK_HEADER([error.h], [AC_CHECK_FUNC([error], AC_DEFINE([HAVE_ERROR_H], [1], [Define if error.h is usable]))])
+	}' configure.ac || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--cache-file="${S}"/config.cache
+		$(use_enable bpf)
+		$(use_enable caps)
+		$(use_enable criu)
+		$(use_enable seccomp)
+		$(use_enable systemd)
+		--enable-shared
+		$(use_enable static-libs static)
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	emake check-TESTS -C ./libocispec
+
+	# the crun test suite is comprehensive to the extent that tests will fail
+	# within a sandbox environment, due to the nature of the privileges
+	# required to create linux "containers".
+	local supported_tests=(
+		"tests/tests_libcrun_utils"
+		"tests/tests_libcrun_errors"
+		"tests/tests_libcrun_intelrdt"
+	)
+	emake check-TESTS TESTS="${supported_tests[*]}"
+}
+
+src_install() {
+	emake "DESTDIR=${D}" install-exec
+	doman crun.1
+	einstalldocs
+
+	find "${ED}" -name '*.la' -type f -delete || die
+}
diff --git a/app-containers/crun/crun-1.21.ebuild b/app-containers/crun/crun-1.21.ebuild
new file mode 100644
index 000000000000..15ed5f8007b9
--- /dev/null
+++ b/app-containers/crun/crun-1.21.ebuild
@@ -0,0 +1,91 @@
+# Copyright 2019-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit autotools libtool python-any-r1
+
+DESCRIPTION="Fast and low-memory footprint OCI Container Runtime fully written in C"
+HOMEPAGE="https://github.com/containers/crun"
+
+if [[ "${PV}" == *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/${PN}.git"
+else
+	SRC_URI="https://github.com/containers/${PN}/releases/download/${PV}/${P}.tar.gz"
+	KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv"
+fi
+
+LICENSE="GPL-2+ LGPL-2.1+"
+SLOT="0"
+IUSE="+bpf +caps criu +seccomp selinux systemd static-libs"
+
+DEPEND="
+	dev-libs/yajl:=
+	sys-kernel/linux-headers
+	caps? ( sys-libs/libcap )
+	criu? ( >=sys-process/criu-3.15 )
+	seccomp? ( sys-libs/libseccomp )
+	systemd? ( sys-apps/systemd:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-container )
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/pkgconfig
+"
+
+src_prepare() {
+	default
+	elibtoolize
+
+	# https://github.com/containers/crun/pull/1887
+	sed -i -E '/AC_CHECK_HEADERS\(\[error.h/{
+		s/error\.h[[:space:]]*//g
+		a\
+		AC_CHECK_HEADER([error.h], [AC_CHECK_FUNC([error], AC_DEFINE([HAVE_ERROR_H], [1], [Define if error.h is usable]))])
+	}' configure.ac || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--cache-file="${S}"/config.cache
+		$(use_enable bpf)
+		$(use_enable caps)
+		$(use_enable criu)
+		$(use_enable seccomp)
+		$(use_enable systemd)
+		--enable-shared
+		$(use_enable static-libs static)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	emake check-TESTS -C ./libocispec
+
+	# The crun test suite is comprehensive to the extent that tests will fail
+	# within a sandbox environment, due to the nature of the privileges
+	# required to create linux "containers".
+	local supported_tests=(
+		"tests/tests_libcrun_utils"
+		"tests/tests_libcrun_errors"
+		"tests/tests_libcrun_intelrdt"
+	)
+	emake check-TESTS TESTS="${supported_tests[*]}" CFLAGS="${CFLAGS} -std=gnu17"
+}
+
+src_install() {
+	emake "DESTDIR=${D}" install-exec
+	doman crun.1
+	einstalldocs
+
+	find "${ED}" -name '*.la' -type f -delete || die
+}
diff --git a/app-containers/crun/crun-1.25.1.ebuild b/app-containers/crun/crun-1.25.1.ebuild
new file mode 100644
index 000000000000..d7845d066be4
--- /dev/null
+++ b/app-containers/crun/crun-1.25.1.ebuild
@@ -0,0 +1,91 @@
+# Copyright 2019-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit autotools libtool python-any-r1
+
+DESCRIPTION="Fast and low-memory footprint OCI Container Runtime fully written in C"
+HOMEPAGE="https://github.com/containers/crun"
+
+if [[ "${PV}" == *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/${PN}.git"
+else
+	SRC_URI="https://github.com/containers/${PN}/releases/download/${PV}/${P}.tar.gz"
+	KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv"
+fi
+
+LICENSE="GPL-2+ LGPL-2.1+"
+SLOT="0"
+IUSE="+bpf +caps criu +seccomp selinux systemd static-libs"
+
+DEPEND="
+	dev-libs/yajl:=
+	sys-kernel/linux-headers
+	caps? ( sys-libs/libcap )
+	criu? ( >=sys-process/criu-3.15 )
+	seccomp? ( sys-libs/libseccomp )
+	systemd? ( sys-apps/systemd:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-container )
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/pkgconfig
+"
+
+src_prepare() {
+	default
+	elibtoolize
+
+	# https://github.com/containers/crun/pull/1887
+	sed -i -E '/AC_CHECK_HEADERS\(\[error.h/{
+		s/error\.h[[:space:]]*//g
+		a\
+		AC_CHECK_HEADER([error.h], [AC_CHECK_FUNC([error], AC_DEFINE([HAVE_ERROR_H], [1], [Define if error.h is usable]))])
+	}' configure.ac || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--cache-file="${S}"/config.cache
+		$(use_enable bpf)
+		$(use_enable caps)
+		$(use_enable criu)
+		$(use_enable seccomp)
+		$(use_enable systemd)
+		--enable-shared
+		$(use_enable static-libs static)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	emake check-TESTS -C ./libocispec
+
+	# The crun test suite is comprehensive to the extent that tests will fail
+	# within a sandbox environment, due to the nature of the privileges
+	# required to create linux "containers".
+	local supported_tests=(
+		"tests/tests_libcrun_utils"
+		"tests/tests_libcrun_errors"
+		"tests/tests_libcrun_intelrdt"
+	)
+	emake check-TESTS TESTS="${supported_tests[*]}" CFLAGS="${CFLAGS} -std=gnu17"
+}
+
+src_install() {
+	emake "DESTDIR=${D}" install-exec
+	doman crun.1
+	einstalldocs
+
+	find "${ED}" -name '*.la' -type f -delete || die
+}
diff --git a/app-containers/crun/crun-1.28.ebuild b/app-containers/crun/crun-1.28.ebuild
new file mode 100644
index 000000000000..b64fe81788ea
--- /dev/null
+++ b/app-containers/crun/crun-1.28.ebuild
@@ -0,0 +1,91 @@
+# Copyright 2019-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit autotools libtool python-any-r1 flag-o-matic toolchain-funcs
+
+DESCRIPTION="Fast and low-memory footprint OCI Container Runtime fully written in C"
+HOMEPAGE="https://github.com/containers/crun"
+
+if [[ "${PV}" == *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/${PN}.git"
+else
+	SRC_URI="https://github.com/containers/${PN}/releases/download/${PV}/${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv"
+fi
+
+LICENSE="GPL-2+ LGPL-2.1+"
+SLOT="0"
+IUSE="+bpf +caps criu +seccomp selinux systemd static-libs"
+
+DEPEND="
+	dev-libs/json-c:=
+	sys-kernel/linux-headers
+	caps? ( sys-libs/libcap )
+	criu? ( >=sys-process/criu-3.15 )
+	elibc_musl? ( sys-libs/error-standalone )
+	seccomp? ( sys-libs/libseccomp )
+	systemd? ( sys-apps/systemd:= )
+"
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-container )
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-export-json_gen.patch
+)
+
+src_prepare() {
+	default
+	elibtoolize
+	eautoreconf
+}
+
+src_configure() {
+	if use elibc_musl ; then
+		append-cflags "$($(tc-getPKG_CONFIG) --cflags error-standalone)"
+		append-libs "$($(tc-getPKG_CONFIG) --libs error-standalone)"
+	fi
+	local myeconfargs=(
+		--cache-file="${S}"/config.cache
+		$(use_enable bpf)
+		$(use_enable caps)
+		$(use_enable criu)
+		$(use_enable seccomp)
+		$(use_enable systemd)
+		--enable-shared
+		$(use_enable static-libs static)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	emake check-TESTS -C ./libocispec
+
+	# The crun test suite is comprehensive to the extent that tests will fail
+	# within a sandbox environment, due to the nature of the privileges
+	# required to create linux "containers".
+	local supported_tests=(
+		"tests/tests_libcrun_utils"
+		"tests/tests_libcrun_errors"
+		"tests/tests_libcrun_intelrdt"
+	)
+	emake check-TESTS TESTS="${supported_tests[*]}" CFLAGS="${CFLAGS} -std=gnu17"
+}
+
+src_install() {
+	emake "DESTDIR=${D}" install-exec
+	doman crun.1
+	einstalldocs
+
+	find "${ED}" -name '*.la' -type f -delete || die
+}
diff --git a/app-containers/crun/files/crun-1.28-export-json_gen.patch b/app-containers/crun/files/crun-1.28-export-json_gen.patch
new file mode 100644
index 000000000000..9e28a5c588d3
--- /dev/null
+++ b/app-containers/crun/files/crun-1.28-export-json_gen.patch
@@ -0,0 +1,15 @@
+https://github.com/containers/crun/pull/2102
+Subject: [PATCH] build: export json_gen_* symbols
+
+Closes: https://github.com/containers/crun/issues/2101
+Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
+--- a/libcrun.lds
++++ b/libcrun.lds
+@@ -6,5 +6,6 @@
+         runtime_spec_*;
+         free_runtime_spec_*;
+         make_runtime_spec_*;
++        json_gen_*;
+   local: *;
+ };
+
diff --git a/app-containers/crun/metadata.xml b/app-containers/crun/metadata.xml
new file mode 100644
index 000000000000..c32855bb0546
--- /dev/null
+++ b/app-containers/crun/metadata.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>robert@gnzler.io</email>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <longdescription lang="en">
+		While most of the tools used in the Linux containers ecosystem are written in
+		Go, crun authors believe C is a better fit for a lower level tool like a
+		container runtime. runc; the most used implementation of the OCI runtime specs
+		written in Go, re-execs itself and use a module written in C for setting up
+		the environment before the container process starts.
+
+		crun aims to be also usable as a library that can be easily included in
+		programs without requiring an external process for managing OCI containers.
+	</longdescription>
+  <upstream>
+    <changelog>https://github.com/containers/crun/releases</changelog>
+    <remote-id type="cpe">cpe:/a:crun_project:crun</remote-id>
+  </upstream>
+  <use>
+    <flag name="bpf">Enable in Kernel, eBPF (enhanced Berkley Packet Filter)
+			support for managing device controllers.
+		</flag>
+    <flag name="criu">Enable CRIU based checkpoint/restore support</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/devcontainer/Manifest b/app-containers/devcontainer/Manifest
new file mode 100644
index 000000000000..8dc04820915b
--- /dev/null
+++ b/app-containers/devcontainer/Manifest
@@ -0,0 +1,3 @@
+DIST devcontainer-0.85.0.npm.tgz 603683 BLAKE2B 52c0caad18b8f691ead41b09ada171f93a5d4bf866a9643fce47884b556652bb6ff49bf90227986093ddadcb61c38d3ce94eea1e57032c9f6ee414302f24a320 SHA512 9516d30ed0ee14f4f167ab67557cf709baf301a2d043862cf4b229162948166a3acc3d62ba11ecb02fd85c49aee5605b1aba3d3e581c14e9a021401612b7dadd
+DIST devcontainer-0.86.1.npm.tgz 604527 BLAKE2B 794ae5ce43dd3a9d6d4c58c0c84e7d9df449183bba21c570dfa932f26dd39e313730c5d4cf1ea3ab13204c6fe5a7d8ff43b63c255bcfaca5458ae81ce7662406 SHA512 e1554947ff42baf91d837b8e0fa9d3b299d9ce9c6a8de690ed8cd08e54a75f79726fe2d47b23bc4957476b6e0a3413e9e7136ef0f5aae9a458e64d4a20bc321d
+DIST devcontainer-0.87.0.npm.tgz 607057 BLAKE2B dbf720a3c4c044231e6af9f5e1e4d1176fdcbe6b55aae08d623f4c99b6074e26874d2a38b242ec5852ae2cd3d2890aaf01ea6ad6fcecc3ab4702b5259c0510f3 SHA512 395c232342c7e9c622968d8c5eb9ea6002ed0b028cd1db1da6136c220bb0d04491046f2cd703c88c36cf8833b9b5ac4f4deddc2ec86c4185596355292ad15a24
diff --git a/app-containers/devcontainer/devcontainer-0.85.0.ebuild b/app-containers/devcontainer/devcontainer-0.85.0.ebuild
new file mode 100644
index 000000000000..5a795320c94e
--- /dev/null
+++ b/app-containers/devcontainer/devcontainer-0.85.0.ebuild
@@ -0,0 +1,47 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Reference implementation of the Development Containers specification"
+HOMEPAGE="https://containers.dev/
+	https://github.com/devcontainers/cli/"
+
+SRC_URI="https://registry.npmjs.org/@devcontainers/cli/-/cli-${PV}.tgz
+	-> ${P}.npm.tgz"
+S="${WORKDIR}/package"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="amd64 ~x86"
+
+RDEPEND="
+	net-libs/nodejs
+"
+BDEPEND="
+	net-libs/nodejs[npm]
+"
+
+DOCS=( CHANGELOG.md README.md )
+
+src_compile() {
+	# Skip, nothing to compile here.
+	:
+}
+
+src_install() {
+	local -a my_npm_opts=(
+		--audit false
+		--color false
+		--foreground-scripts
+		--global
+		--offline
+		--omit dev
+		--prefix "${ED}/usr"
+		--progress false
+		--verbose
+	)
+	npm "${my_npm_opts[@]}" install "${DISTDIR}/${P}.npm.tgz" || die "npm install failed"
+
+	einstalldocs
+}
diff --git a/app-containers/devcontainer/devcontainer-0.86.1.ebuild b/app-containers/devcontainer/devcontainer-0.86.1.ebuild
new file mode 100644
index 000000000000..bac2c2365968
--- /dev/null
+++ b/app-containers/devcontainer/devcontainer-0.86.1.ebuild
@@ -0,0 +1,48 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=9
+
+DESCRIPTION="Reference implementation of the Development Containers specification"
+HOMEPAGE="https://containers.dev/
+	https://github.com/devcontainers/cli/
+	https://registry.npmjs.org/@devcontainers/cli/"
+
+SRC_URI="https://registry.npmjs.org/@devcontainers/cli/-/cli-${PV}.tgz
+	-> ${P}.npm.tgz"
+S="${WORKDIR}/package"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+RDEPEND="
+	net-libs/nodejs
+"
+BDEPEND="
+	net-libs/nodejs[npm]
+"
+
+DOCS=( CHANGELOG.md README.md )
+
+src_compile() {
+	# Skip, nothing to compile here.
+	:
+}
+
+src_install() {
+	local -a my_npm_opts=(
+		--prefix="${ED}/usr"
+		--omit="dev"
+		--audit="false"
+		--color="false"
+		--progress="false"
+		--foreground-scripts
+		--global
+		--offline
+		--verbose
+	)
+	npm "${my_npm_opts[@]}" install "${DISTDIR}/${P}.npm.tgz" || die "npm install failed"
+
+	einstalldocs
+}
diff --git a/app-containers/devcontainer/devcontainer-0.87.0.ebuild b/app-containers/devcontainer/devcontainer-0.87.0.ebuild
new file mode 100644
index 000000000000..bac2c2365968
--- /dev/null
+++ b/app-containers/devcontainer/devcontainer-0.87.0.ebuild
@@ -0,0 +1,48 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=9
+
+DESCRIPTION="Reference implementation of the Development Containers specification"
+HOMEPAGE="https://containers.dev/
+	https://github.com/devcontainers/cli/
+	https://registry.npmjs.org/@devcontainers/cli/"
+
+SRC_URI="https://registry.npmjs.org/@devcontainers/cli/-/cli-${PV}.tgz
+	-> ${P}.npm.tgz"
+S="${WORKDIR}/package"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+RDEPEND="
+	net-libs/nodejs
+"
+BDEPEND="
+	net-libs/nodejs[npm]
+"
+
+DOCS=( CHANGELOG.md README.md )
+
+src_compile() {
+	# Skip, nothing to compile here.
+	:
+}
+
+src_install() {
+	local -a my_npm_opts=(
+		--prefix="${ED}/usr"
+		--omit="dev"
+		--audit="false"
+		--color="false"
+		--progress="false"
+		--foreground-scripts
+		--global
+		--offline
+		--verbose
+	)
+	npm "${my_npm_opts[@]}" install "${DISTDIR}/${P}.npm.tgz" || die "npm install failed"
+
+	einstalldocs
+}
diff --git a/app-containers/devcontainer/metadata.xml b/app-containers/devcontainer/metadata.xml
new file mode 100644
index 000000000000..6ebd724c458e
--- /dev/null
+++ b/app-containers/devcontainer/metadata.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>xgqt@gentoo.org</email>
+    <name>Maciej Barć</name>
+  </maintainer>
+  <longdescription>
+    A Development Container (or Dev Container for short) allows you to use a
+    container as a full-featured development environment. It can be used to run
+    an application, to separate tools, libraries, or runtimes needed for
+    working with a codebase, and to aid in continuous integration and testing.
+    Dev containers can be run locally or remotely, in a private or public
+    cloud, in a variety of supporting tools and editors.
+  </longdescription>
+  <upstream>
+    <bugs-to>https://github.com/devcontainers/cli/issues/</bugs-to>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/distrobox/Manifest b/app-containers/distrobox/Manifest
new file mode 100644
index 000000000000..53c6dc820067
--- /dev/null
+++ b/app-containers/distrobox/Manifest
@@ -0,0 +1,2 @@
+DIST distrobox-1.8.2.4.gh.tar.gz 2004397 BLAKE2B 36aff4e87eae2108cce5ebdb8c5ff754af32c57caa3d01ec38f8106d141acca876967a39648c86753897bcabe4ae1e69782f754afe060f7d99df5c3713f3b48c SHA512 c7c567a6006dd0657da46640598cbe02e8bb432db8b181de0b13f04f85966d2eeff35b6dcdb8bb8592573bb81518bdc8d3b63b0ae6288c0c3f1a83937fa948e0
+DIST distrobox-1.8.2.5.gh.tar.gz 2047489 BLAKE2B 5fa251eb0fbfcfc24f4e123fbbe891a312a3bf4ed852f379b88c7f5bb9c59de6e908aae13e66788404edf92717bff41aa1e26d4e0e8b1ceb5c338d8fa82334a6 SHA512 f4dcd9a2edd2db8de6af50e3b6df4e43e793d9baff28529879dcbe3a05cbebf8ad02bef1c8a6b8951c9855e82e6991bd17a8cf2025e1ca285b7dbe80396b1da6
diff --git a/app-containers/distrobox/distrobox-1.8.2.4.ebuild b/app-containers/distrobox/distrobox-1.8.2.4.ebuild
new file mode 100644
index 000000000000..e5fa37e43534
--- /dev/null
+++ b/app-containers/distrobox/distrobox-1.8.2.4.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit xdg-utils
+
+DESCRIPTION="Use any Linux distribution inside your terminal (powered by docker/podman)"
+HOMEPAGE="https://distrobox.it/
+	https://github.com/89luca89/distrobox/"
+
+if [[ "${PV}" == *9999* ]] ; then
+	inherit git-r3
+
+	EGIT_REPO_URI="https://github.com/89luca89/${PN}"
+else
+	SRC_URI="https://github.com/89luca89/${PN}/archive/${PV}.tar.gz
+		-> ${P}.gh.tar.gz"
+
+	KEYWORDS="amd64 ~arm ~arm64 ~riscv ~x86"
+fi
+
+LICENSE="GPL-3"  # GPL-3.0-only !
+SLOT="0"
+IUSE="gui"
+
+RDEPEND="
+	|| (
+		app-containers/docker
+		app-containers/podman
+	)
+"
+
+src_install() {
+	sh ./install --prefix "${ED}/usr" || die "${PN} install script failed"
+
+	if use gui ; then
+		:
+	else
+		rm -r "${ED}/usr/share/icons" || die
+	fi
+
+	dodoc *.md
+}
+
+pkg_postinst() {
+	if use gui ; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+	fi
+}
+
+pkg_postrm() {
+	if use gui ; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+	fi
+}
diff --git a/app-containers/distrobox/distrobox-1.8.2.5.ebuild b/app-containers/distrobox/distrobox-1.8.2.5.ebuild
new file mode 100644
index 000000000000..e5fa37e43534
--- /dev/null
+++ b/app-containers/distrobox/distrobox-1.8.2.5.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit xdg-utils
+
+DESCRIPTION="Use any Linux distribution inside your terminal (powered by docker/podman)"
+HOMEPAGE="https://distrobox.it/
+	https://github.com/89luca89/distrobox/"
+
+if [[ "${PV}" == *9999* ]] ; then
+	inherit git-r3
+
+	EGIT_REPO_URI="https://github.com/89luca89/${PN}"
+else
+	SRC_URI="https://github.com/89luca89/${PN}/archive/${PV}.tar.gz
+		-> ${P}.gh.tar.gz"
+
+	KEYWORDS="amd64 ~arm ~arm64 ~riscv ~x86"
+fi
+
+LICENSE="GPL-3"  # GPL-3.0-only !
+SLOT="0"
+IUSE="gui"
+
+RDEPEND="
+	|| (
+		app-containers/docker
+		app-containers/podman
+	)
+"
+
+src_install() {
+	sh ./install --prefix "${ED}/usr" || die "${PN} install script failed"
+
+	if use gui ; then
+		:
+	else
+		rm -r "${ED}/usr/share/icons" || die
+	fi
+
+	dodoc *.md
+}
+
+pkg_postinst() {
+	if use gui ; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+	fi
+}
+
+pkg_postrm() {
+	if use gui ; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+	fi
+}
diff --git a/app-containers/distrobox/distrobox-9999.ebuild b/app-containers/distrobox/distrobox-9999.ebuild
new file mode 100644
index 000000000000..85813e3c6f3f
--- /dev/null
+++ b/app-containers/distrobox/distrobox-9999.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit xdg-utils
+
+DESCRIPTION="Use any Linux distribution inside your terminal (powered by docker/podman)"
+HOMEPAGE="https://distrobox.it/
+	https://github.com/89luca89/distrobox/"
+
+if [[ "${PV}" == *9999* ]] ; then
+	inherit git-r3
+
+	EGIT_REPO_URI="https://github.com/89luca89/${PN}"
+else
+	SRC_URI="https://github.com/89luca89/${PN}/archive/${PV}.tar.gz
+		-> ${P}.gh.tar.gz"
+
+	KEYWORDS="~amd64 ~arm ~arm64 ~riscv ~x86"
+fi
+
+LICENSE="GPL-3"  # GPL-3.0-only !
+SLOT="0"
+IUSE="gui"
+
+RDEPEND="
+	|| (
+		app-containers/docker
+		app-containers/podman
+	)
+"
+
+src_install() {
+	sh ./install --prefix "${ED}/usr" || die "${PN} install script failed"
+
+	if use gui ; then
+		:
+	else
+		rm -r "${ED}/usr/share/icons" || die
+	fi
+
+	dodoc *.md
+}
+
+pkg_postinst() {
+	if use gui ; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+	fi
+}
+
+pkg_postrm() {
+	if use gui ; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+	fi
+}
diff --git a/app-containers/distrobox/metadata.xml b/app-containers/distrobox/metadata.xml
new file mode 100644
index 000000000000..558f23f1dcee
--- /dev/null
+++ b/app-containers/distrobox/metadata.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>xgqt@gentoo.org</email>
+    <name>Maciej Barć</name>
+  </maintainer>
+  <longdescription>
+    Use any Linux distribution inside your terminal. Enable both backward and
+    forward compatibility with software and freedom to use whatever
+    distribution you’re more comfortable with. Distrobox uses podman or docker
+    to create containers using the Linux distribution of your choice. The
+    created container will be tightly integrated with the host, allowing
+    sharing of the HOME directory of the user, external storage, external USB
+    devices and graphical apps (X11/Wayland), and audio.
+  </longdescription>
+  <upstream>
+    <bugs-to>https://github.com/89luca89/distrobox/issues/</bugs-to>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/distrobuilder/Manifest b/app-containers/distrobuilder/Manifest
new file mode 100644
index 000000000000..bf843e52af42
--- /dev/null
+++ b/app-containers/distrobuilder/Manifest
@@ -0,0 +1,10 @@
+DIST distrobuilder-2.1.tar.gz 5599048 BLAKE2B 90e82a20a3ef61d13148951956bb1f74cc3494ca86e339c188a1c9009dcb27c0cb9a298c639c6de891df67915b48d107557f6b698a45cbe35c54d41a45bac1ab SHA512 80184d27305f5659f1367563161220b966b1957810da61e8f3b9f32cf408795319b43dd650bc9f867b3ac73ef2b3251972bb11999d92feb34bfd9cdae7ff7b7b
+DIST distrobuilder-2.1.tar.gz.asc 833 BLAKE2B fb3aadbc989438b0606c88e74fdd86e809b6373b907b37372cbbc0ca99415821f61772205967e0a7aa26b0bdaceb66df4ab39da1f08c339edeb84e66a04aab56 SHA512 0220fa34d966e2b3a244af21a894f5db7556b891ee3205b605ef633699553f0f53d876412c855010a0ef685fcfe376997790cf51d59fd46b7c9ba539507de4e3
+DIST distrobuilder-3.0.tar.gz 6135124 BLAKE2B 71cf594cdece46890418ea58af06205c59beaecce46a977efadcb336b93f0e1ed85ba4c1563a1f9f95937e935f844c91b6e45dfc73c0210f134ba3a694adea1d SHA512 c2218e6312257e5f15077d8380b9b49f7b8afd7ed5e43d46ac5d18a8cc332b096ab50c7301f74eb93769548c10f273e21a584ab2e908260ead4d2b219683bd1c
+DIST distrobuilder-3.0.tar.gz.asc 833 BLAKE2B 9a6fba0101eaea411a1b56359265c02533739a180c095ef2edd07dbe65c1d3bd2c1deab46e0cfdab362a282b85843659c8876853252b7ab1ab49e9f3f3dc1e8f SHA512 238a0a93575cb05fcd13fc32b5faed7592ff3345ae91d07fc1ede5696903f2e4da3d6d79bf39bc05ac16f0c8e04afe3eefa0e96b2c789992f55859bac6fd56d0
+DIST distrobuilder-3.1.tar.gz 6184215 BLAKE2B 2cb88f90c4459f71a2878824f7cb8f1d982f960ef498251561f58a57948d4dca35e67c85b15fff584db9ba369da07055d4854689f6d01a8f0f22dff97e813424 SHA512 5b0853a5f9a31b635f2d5160e918af8b7a66812570a1e50e70a515ef581bffe3904f6cf2487fa3d6691ed76ff34f97cd24b645b5f5ba146fec2127c3d9f21558
+DIST distrobuilder-3.1.tar.gz.asc 833 BLAKE2B 6986484fd6efa20eb625ace7a8395abef82c4bc685e45792072cfe3c78bf060bc5e5ec776a801fac4ac32f49088f13029a4dd3fbd41fc008df7100f1a3c805e6 SHA512 7b1c9d7dcb59dfe93635bb8fe5b2a65c030a5da5cacb3c22fb2cdadffec1252ad68901b92efc0eedb0f8aac26cb14a9b5f934caa920d77039d150fe817bd1e21
+DIST distrobuilder-3.2.tar.gz 6053978 BLAKE2B a46048800419d9a6f71957472db984d27f33d2fdb9ae47e758495167673faf02ec0cc384dba83c08a0acf86719121157daaf77b6ddf4722b59aade7391ca0c03 SHA512 9ed62c8c7307d0df4f06d8cf77e936cc4a2c6e7c058441abf675ac86bb387a0fc8e8598ff03df0776b549092ebc8e64e766d32122f79f0e2f8ec9ee595493383
+DIST distrobuilder-3.2.tar.gz.asc 833 BLAKE2B 6bb56aeb77555930681ca75737e544dfe6ca5bc89b082ccb08ad273400253f666c51de7a5a172098ec0bff111d4ef6ed5b38592b0fe1c577fc8c23d4a348acdc SHA512 0eca6807c6116ad15dba4ee2ffb45a8e2a00af28860833e01cf6e22d57b0a17641af438d3e66979c8cc2c743ebe1c0831df82e0d7e4a1454df970d84cb09a983
+DIST distrobuilder-3.3.1.tar.gz 10920767 BLAKE2B 020950c033b3856cbb92bc295fac6ebbc644e7b7ba4e396b928aaca971aa322f9097aac862ad917caa2b5bef055c39f6c987ccb5479db0852c6df5af20f6de16 SHA512 b873f8c0754c2b361c326493d23be8f5f6df0a96d51cad6e119bb248964db3ee4a3e8b0531ba8299d7957ee2a556205fe3780fc41c4640953c64f74f8dd21cb0
+DIST distrobuilder-3.3.1.tar.gz.asc 833 BLAKE2B cda73c3c0f2469b200020110f875a98b99fe53e44643ab2c603866b43d805d6119efbd2a07071b00fc3aeb2ca944226b444d3df012ef6fbc45db6ef4e16706ac SHA512 4b68c7d0d9c87de1ed1301ffff1d8825ff21081a0dbec1d67a8c29762ab41c1d0649159c60aad2024c2dffce0e9637522f041017b8fd64d3b955c4a831713146
diff --git a/app-containers/distrobuilder/distrobuilder-2.1.ebuild b/app-containers/distrobuilder/distrobuilder-2.1.ebuild
new file mode 100644
index 000000000000..db14d40b98fa
--- /dev/null
+++ b/app-containers/distrobuilder/distrobuilder-2.1.ebuild
@@ -0,0 +1,51 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+DESCRIPTION="System container image builder for LXC and LXD"
+HOMEPAGE="https://linuxcontainers.org/distrobuilder/introduction/"
+
+SRC_URI="https://linuxcontainers.org/downloads/distrobuilder/distrobuilder-${PV}.tar.gz
+	verify-sig? ( https://linuxcontainers.org/downloads/distrobuilder/distrobuilder-${PV}.tar.gz.asc )"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~ppc64"
+IUSE="verify-sig"
+
+RDEPEND="app-crypt/gnupg
+	dev-util/debootstrap
+	dev-vcs/git
+	net-misc/rsync
+	sys-fs/squashfs-tools"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+# Test deps aren't vendored.
+RESTRICT="test"
+
+CONFIG_CHECK="~OVERLAY_FS"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+PATCHES=( "${FILESDIR}"/distrobuilder-2.1-glibc-2.36-fix.patch )
+
+GOPATH="${S}/_dist"
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	emake
+}
+
+src_test() {
+	export GOPATH="${S}/_dist"
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+	dobin ${GOPATH}/bin/distrobuilder
+	dodoc -r doc/*
+}
diff --git a/app-containers/distrobuilder/distrobuilder-3.0-r1.ebuild b/app-containers/distrobuilder/distrobuilder-3.0-r1.ebuild
new file mode 100644
index 000000000000..5742553c4b9a
--- /dev/null
+++ b/app-containers/distrobuilder/distrobuilder-3.0-r1.ebuild
@@ -0,0 +1,50 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+DESCRIPTION="System container image builder for LXC and incus"
+HOMEPAGE="https://linuxcontainers.org/distrobuilder/introduction/"
+
+SRC_URI="https://linuxcontainers.org/downloads/distrobuilder/distrobuilder-${PV}.tar.gz
+	verify-sig? ( https://linuxcontainers.org/downloads/distrobuilder/distrobuilder-${PV}.tar.gz.asc )"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~ppc64"
+IUSE="verify-sig"
+
+RDEPEND="app-cdr/cdrtools
+	app-crypt/gnupg
+	dev-util/debootstrap
+	dev-vcs/git
+	net-misc/rsync
+	sys-fs/squashfs-tools"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+# Test deps aren't vendored.
+RESTRICT="test"
+
+CONFIG_CHECK="~OVERLAY_FS"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+GOPATH="${S}/_dist"
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	emake
+}
+
+src_test() {
+	export GOPATH="${S}/_dist"
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+	dobin ${GOPATH}/bin/distrobuilder
+	dodoc -r doc/*
+}
diff --git a/app-containers/distrobuilder/distrobuilder-3.1.ebuild b/app-containers/distrobuilder/distrobuilder-3.1.ebuild
new file mode 100644
index 000000000000..b8331783130d
--- /dev/null
+++ b/app-containers/distrobuilder/distrobuilder-3.1.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info optfeature
+
+DESCRIPTION="System container image builder for LXC and incus"
+HOMEPAGE="https://linuxcontainers.org/distrobuilder/introduction/"
+
+SRC_URI="https://linuxcontainers.org/downloads/distrobuilder/distrobuilder-${PV}.tar.gz
+	verify-sig? ( https://linuxcontainers.org/downloads/distrobuilder/distrobuilder-${PV}.tar.gz.asc )"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~ppc64"
+IUSE="verify-sig"
+
+RDEPEND="app-cdr/cdrtools
+	app-crypt/gnupg
+	dev-util/debootstrap
+	dev-vcs/git
+	net-misc/rsync
+	sys-fs/squashfs-tools"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+# Test deps aren't vendored.
+RESTRICT="test"
+
+CONFIG_CHECK="~OVERLAY_FS"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+GOPATH="${S}/_dist"
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	emake
+}
+
+src_test() {
+	export GOPATH="${S}/_dist"
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+	dobin ${GOPATH}/bin/distrobuilder
+	dodoc -r doc/*
+}
+
+pkg_postinst() {
+	optfeature_header "Optional support"
+	optfeature "building MS Windows images" app-arch/wimlib app-misc/hivex
+}
diff --git a/app-containers/distrobuilder/distrobuilder-3.2.ebuild b/app-containers/distrobuilder/distrobuilder-3.2.ebuild
new file mode 100644
index 000000000000..b8331783130d
--- /dev/null
+++ b/app-containers/distrobuilder/distrobuilder-3.2.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info optfeature
+
+DESCRIPTION="System container image builder for LXC and incus"
+HOMEPAGE="https://linuxcontainers.org/distrobuilder/introduction/"
+
+SRC_URI="https://linuxcontainers.org/downloads/distrobuilder/distrobuilder-${PV}.tar.gz
+	verify-sig? ( https://linuxcontainers.org/downloads/distrobuilder/distrobuilder-${PV}.tar.gz.asc )"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~ppc64"
+IUSE="verify-sig"
+
+RDEPEND="app-cdr/cdrtools
+	app-crypt/gnupg
+	dev-util/debootstrap
+	dev-vcs/git
+	net-misc/rsync
+	sys-fs/squashfs-tools"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+# Test deps aren't vendored.
+RESTRICT="test"
+
+CONFIG_CHECK="~OVERLAY_FS"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+GOPATH="${S}/_dist"
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	emake
+}
+
+src_test() {
+	export GOPATH="${S}/_dist"
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+	dobin ${GOPATH}/bin/distrobuilder
+	dodoc -r doc/*
+}
+
+pkg_postinst() {
+	optfeature_header "Optional support"
+	optfeature "building MS Windows images" app-arch/wimlib app-misc/hivex
+}
diff --git a/app-containers/distrobuilder/distrobuilder-3.3.1.ebuild b/app-containers/distrobuilder/distrobuilder-3.3.1.ebuild
new file mode 100644
index 000000000000..353d24e35df2
--- /dev/null
+++ b/app-containers/distrobuilder/distrobuilder-3.3.1.ebuild
@@ -0,0 +1,56 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info optfeature
+
+DESCRIPTION="System container image builder for LXC and incus"
+HOMEPAGE="https://linuxcontainers.org/distrobuilder/introduction/"
+
+SRC_URI="https://linuxcontainers.org/downloads/distrobuilder/distrobuilder-${PV}.tar.gz
+	verify-sig? ( https://linuxcontainers.org/downloads/distrobuilder/distrobuilder-${PV}.tar.gz.asc )"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~ppc64"
+IUSE="verify-sig"
+
+RDEPEND="app-cdr/cdrtools
+	app-crypt/gnupg
+	dev-util/debootstrap
+	dev-vcs/git
+	net-misc/rsync
+	sys-fs/squashfs-tools"
+BDEPEND=">=dev-lang/go-1.25.6
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+# Test deps aren't vendored.
+RESTRICT="test"
+
+CONFIG_CHECK="~OVERLAY_FS"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+GOPATH="${S}/_dist"
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	emake
+}
+
+src_test() {
+	export GOPATH="${S}/_dist"
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+	dobin ${GOPATH}/bin/distrobuilder
+	dodoc -r doc/*
+}
+
+pkg_postinst() {
+	optfeature_header "Optional support"
+	optfeature "building MS Windows images" app-arch/wimlib app-misc/hivex
+}
diff --git a/app-containers/distrobuilder/files/distrobuilder-2.1-glibc-2.36-fix.patch b/app-containers/distrobuilder/files/distrobuilder-2.1-glibc-2.36-fix.patch
new file mode 100644
index 000000000000..5fd5ade014bb
--- /dev/null
+++ b/app-containers/distrobuilder/files/distrobuilder-2.1-glibc-2.36-fix.patch
@@ -0,0 +1,34 @@
+diff --git a/vendor/github.com/lxc/lxd/lxd/include/syscall_wrappers.h b/vendor/github.com/lxc/lxd/lxd/include/syscall_wrappers.h
+index 2c28133a8..a6975ab4d 100644
+--- a/vendor/github.com/lxc/lxd/lxd/include/syscall_wrappers.h
++++ b/vendor/github.com/lxc/lxd/lxd/include/syscall_wrappers.h
+@@ -26,10 +26,10 @@ static inline int lxd_close_range(unsigned int fd, unsigned int max_fd, unsigned
+ 	return syscall(__NR_close_range, fd, max_fd, flags);
+ }
+ 
+-static inline int open_tree(int dfd, const char *filename, unsigned int flags)
++/* static inline int open_tree(int dfd, const char *filename, unsigned int flags)
+ {
+ 	return syscall(__NR_open_tree, dfd, filename, flags);
+-}
++}*/
+ 
+ /*
+  * mount_setattr()
+@@ -40,7 +40,7 @@ struct lxc_mount_attr {
+ 	__u64 propagation;
+ 	__u64 userns_fd;
+ };
+-
++/*
+ static inline int mount_setattr(int dfd, const char *path, unsigned int flags,
+ 				struct lxc_mount_attr *attr, size_t size)
+ {
+@@ -53,6 +53,7 @@ static inline int move_mount(int from_dfd, const char *from_pathname, int to_dfd
+ 	return syscall(__NR_move_mount, from_dfd, from_pathname, to_dfd,
+ 		       to_pathname, flags);
+ }
++*/
+ 
+ /* arg1 of prctl() */
+ #ifndef PR_SCHED_CORE
diff --git a/app-containers/distrobuilder/metadata.xml b/app-containers/distrobuilder/metadata.xml
new file mode 100644
index 000000000000..c58dbb87f450
--- /dev/null
+++ b/app-containers/distrobuilder/metadata.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <maintainer type="person" proxied="yes">
+    <email>posting@vodacomm.ca</email>
+    <name>Stephen Bosch</name>
+  </maintainer>
+  <maintainer type="project">
+    <email>virtualization@gentoo.org</email>
+    <name>Gentoo Virtualization Project</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/dive/Manifest b/app-containers/dive/Manifest
new file mode 100644
index 000000000000..5baffabf39ae
--- /dev/null
+++ b/app-containers/dive/Manifest
@@ -0,0 +1,2 @@
+DIST dive-0.13.1-deps.tar.xz 47305832 BLAKE2B 8c505313be0b9d98deef4fa4e26307d3cef79232e52976adfb605f41ab3d9e441f576fdb47a934f28820a3cefad175108a45c9ed4f3b3713c92bb3de7244afe0 SHA512 bfaaf73c70fed682d3ea4109e5d3c773ad62552209181f75fddc106b01424b512d8609cc8c9c6b320336a9255b1ffcbcc6513228dbdeb8ca4a878b62ebdefa4c
+DIST dive-0.13.1.tar.gz 5873218 BLAKE2B af742ce8404b9b1fad59517ea2c99896f9fc777282336b048692ddde178be81dda602823f6f5d4fd04dac121e36c3b1f400109d1a2d31fe7f9146028e8870ceb SHA512 570a7e185d4594e7dabd783b9b68c1985a0c5c0bdafba51e3c5a6e3a93a305bc23559c5d44324e9f82d0226fcf2a624a3d50307a19e82464a88e42eae0abbed0
diff --git a/app-containers/dive/dive-0.13.1.ebuild b/app-containers/dive/dive-0.13.1.ebuild
new file mode 100644
index 000000000000..0976779c33fc
--- /dev/null
+++ b/app-containers/dive/dive-0.13.1.ebuild
@@ -0,0 +1,36 @@
+# Copyright 2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+# update this on every bump
+GIT_COMMIT=fe98c8a2
+
+DESCRIPTION="terminal based UI to manage kubernetes clusters"
+HOMEPAGE="https://github.com/wagoodman/dive"
+SRC_URI="https://github.com/wagoodman/dive/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://github.com/gentoo-golang-dist/dive/releases/download/v${PV}/${P}-deps.tar.xz"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64"
+RESTRICT="test" # no tests
+
+BDEPEND=">=dev-lang/go-1.24.1"
+
+src_compile() {
+	local ldflags=(
+		-w
+		-X main.version=${PV}
+		-X main.commit=${GIT_COMMIT}
+		-X main.buildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+	)
+	ego build -o bin/dive -ldflags "${ldflags[*]}" .
+}
+
+src_install() {
+	dobin bin/dive
+	einstalldocs
+}
diff --git a/app-containers/dive/metadata.xml b/app-containers/dive/metadata.xml
new file mode 100644
index 000000000000..b82a9d768074
--- /dev/null
+++ b/app-containers/dive/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>arthurzam@gentoo.org</email>
+    <name>Arthur Zamarin</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/docker-bench-security/Manifest b/app-containers/docker-bench-security/Manifest
new file mode 100644
index 000000000000..92912d764def
--- /dev/null
+++ b/app-containers/docker-bench-security/Manifest
@@ -0,0 +1,2 @@
+DIST docker-bench-security-1.6.0.tar.gz 349131 BLAKE2B ce4700e3b7448365420adfb20ca3fa1fa5316157b1f587c40a1ea24e45312ac059a31f5fb152838442e19822c977855323f528d8ddca95eb11347a74606e5913 SHA512 1f3391946dd93540f99e8ea212c9d907d7939d248105082e81845e62eb2a08c4c5a1a32d13c93676ca31df1ee76079a804d36de1874341ed5da64806ea1c7c7b
+DIST docker-bench-security-1.6.1.tar.gz 349343 BLAKE2B f12a3bb5e2dc8ec2462c7ebed64ce3569e9f269e27be588d5b7c3dad5ab934b6ae78bb9b3e396a916a1a352856ae271eea10b19d5c614c25c2a79896ad9fb452 SHA512 6209c1126d53910968c02b0f4b936f486597c0e36ad80667520c6f943308223819197cd870f16af500159baa6d2c688ef72f8855c6a78485fad0d7ba92bc19e7
diff --git a/app-containers/docker-bench-security/docker-bench-security-1.6.0.ebuild b/app-containers/docker-bench-security/docker-bench-security-1.6.0.ebuild
new file mode 100644
index 000000000000..45778b2f8d60
--- /dev/null
+++ b/app-containers/docker-bench-security/docker-bench-security-1.6.0.ebuild
@@ -0,0 +1,24 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Test for best practices around deploying docker containers"
+HOMEPAGE="https://github.com/docker/docker-bench-security"
+SRC_URI="https://github.com/docker/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+RDEPEND=">=app-containers/docker-1.13"
+
+src_install() {
+	dobin "${FILESDIR}/docker-bench-security"
+	exeinto /usr/lib/${PN}
+	doexe ${PN}.sh
+	insinto /usr/lib/${PN}
+	doins -r functions/*.sh tests
+	dodoc -r img/benchmark_log.png CONTRIBUTING.md docker-compose.yml \
+		  Dockerfile MAINTAINERS README.md
+}
diff --git a/app-containers/docker-bench-security/docker-bench-security-1.6.1.ebuild b/app-containers/docker-bench-security/docker-bench-security-1.6.1.ebuild
new file mode 100644
index 000000000000..930f66d035d9
--- /dev/null
+++ b/app-containers/docker-bench-security/docker-bench-security-1.6.1.ebuild
@@ -0,0 +1,27 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Test for best practices around deploying docker containers"
+HOMEPAGE="https://github.com/docker/docker-bench-security"
+SRC_URI="https://github.com/docker/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+RDEPEND=">=app-containers/docker-1.13"
+
+src_install() {
+	dobin "${FILESDIR}/docker-bench-security"
+
+	exeinto /usr/lib/${PN}
+	doexe ${PN}.sh
+
+	insinto /usr/lib/${PN}
+	doins -r functions/*.sh tests
+
+	dodoc -r img/benchmark_log.png CONTRIBUTING.md docker-compose.yml \
+		  Dockerfile MAINTAINERS README.md
+}
diff --git a/app-containers/docker-bench-security/files/docker-bench-security b/app-containers/docker-bench-security/files/docker-bench-security
new file mode 100644
index 000000000000..3a79d1b3af4d
--- /dev/null
+++ b/app-containers/docker-bench-security/files/docker-bench-security
@@ -0,0 +1,7 @@
+#!/bin/sh
+if [ $(id -u) -ne 0 ]; then
+	printf "%s\n" "This script must be run as root."
+	exit 1
+fi
+cd "$(dirname $0)/../lib/docker-bench-security"
+./docker-bench-security.sh
diff --git a/app-containers/docker-bench-security/metadata.xml b/app-containers/docker-bench-security/metadata.xml
new file mode 100644
index 000000000000..7b5ba55e8eae
--- /dev/null
+++ b/app-containers/docker-bench-security/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <longdescription lang="en">
+		The Docker Bench for Security is a script that checks for dozens of
+		common best-practices around deploying Docker containers in production.
+	</longdescription>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/docker-buildx/Manifest b/app-containers/docker-buildx/Manifest
new file mode 100644
index 000000000000..2e7e8c4b3c7b
--- /dev/null
+++ b/app-containers/docker-buildx/Manifest
@@ -0,0 +1,6 @@
+DIST docker-buildx-0.11.2.tar.gz 10342565 BLAKE2B 1e034e9a07f36b46096f8f035869adc93b63af46cd9886f5ed4bc0939ce2f76b7f029a11ee536a34be23952e5c85251d757cec9ff05df172e3a26ea82a1bf0b1 SHA512 6f3718edf1e86c4422e1419580e4c38cf378a59555067be2aa6fac3e7f8878afe39d777765ace274cd9c47630f39cbacfacfdc4ecadd6ff46d5ee37d8f9bc75c
+DIST docker-buildx-0.14.0.tar.gz 11120356 BLAKE2B 01fec6b29665088a4778cb6a926f071c1beacb22d7a50593d55afff1225d0e74d083a82eaab4ae96ffee8a6f653ce048fd81b3410e7113bc29da210d77042b64 SHA512 bc09f29096cfd08c60efd8fca7976a1db896f0ed08d33dfc64dfca2c6487a1dc1722b3fe80b6a175ebebeacf8b460bcc214806d0c7a637f17ed5d09793d8c9d8
+DIST docker-buildx-0.19.1.tar.gz 11691424 BLAKE2B 40cc5e68eb85e8693bc6cd7bf91fe3a6300644d9934a3ff84b89c79dba31d475dce5ac4366075127391c5230905591a83bd59c762cf9f9f4bde0931834633473 SHA512 cc811eb93910bfb5a4668cc3dc59ab6c13a1308c0fa49707a81d1d733e834d209677502786e951ce3c8f098c387b559054dd3cd9933edafbecae610d1ef321e6
+DIST docker-buildx-0.20.1.tar.gz 12049522 BLAKE2B cc370f8a6bc82d9358cb59f99645447e83a4c84c656ae75409a504d0e0a973027791129d6eeb55827eb98904300d04c34685be993309e80f547514b76566fb2e SHA512 75c47204a2f11773ed978678735637fb8248ad87bb745e0b878ad7db161dea4d000dbfb98c83b03225efed126cc04b31d3a9ca500f8d3ac414620c7f980fa9cc
+DIST docker-buildx-0.21.2.tar.gz 13608048 BLAKE2B 8229fe6d8d1b2b9f35213ae0ae879d90d7f96ca4688c787e7dcbb88e0aaa4444519c4e5fca51acf9e9d6f2bf697adf74b2c2d8440eec1660dbf10496eb76c243 SHA512 a90a9af1a9b986f99a08f3e53ca06cfac64378a92ab887653d3aa9e1538ef87fec4fbd719c5087782cf7dc5eb8845c9c0786605e7386d759c0e33ef5f121fbba
+DIST docker-buildx-0.34.1.tar.gz 15417849 BLAKE2B b302d1f2331ba7f76c79358be197436ac37e3d4ebea154ae441fc05b787544d9cd037bff2ae8140f9475ddfa3cad77e0a136b1a423d29cb73bdb42218ade5da0 SHA512 be69ff92a136e169456710c369099bd33ed0ae17271133fe0322fe1664c868ad76dd74265879fa783fa257a6ed6dca37c213d1153de9e903833b59cde4181d0b
diff --git a/app-containers/docker-buildx/docker-buildx-0.11.2.ebuild b/app-containers/docker-buildx/docker-buildx-0.11.2.ebuild
new file mode 100644
index 000000000000..859c9d9d75b2
--- /dev/null
+++ b/app-containers/docker-buildx/docker-buildx-0.11.2.ebuild
@@ -0,0 +1,61 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+MY_PN="buildx"
+DESCRIPTION="Docker CLI plugin for extended build capabilities with BuildKit"
+HOMEPAGE="https://github.com/docker/buildx"
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/docker/buildx.git"
+else
+	SRC_URI="https://github.com/docker/buildx/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+	S="${WORKDIR}/${MY_PN}-${PV}"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+# This gives us the ability to neatly `-skip` tests.
+# not required once ::gentoo is all > 1.20
+RESTRICT="!test? ( test )"
+IUSE="test"
+
+BDEPEND="
+	test? ( >=dev-lang/go-1.20 )
+"
+RDEPEND="app-containers/docker-cli"
+
+src_compile() {
+	local _buildx_r='github.com/docker/buildx'
+	local version=${PV}
+	if [[ ${PV} == 9999 ]]; then
+		version="$(git rev-parse --short HEAD)"
+	fi
+	ego build -o docker-buildx \
+		-ldflags "-linkmode=external
+		-X $_buildx_r/version.Version=${version}
+		-X $_buildx_r/version.Revision=$(date -u +%FT%T%z)
+		-X $_buildx_r/version.Package=$_buildx_r" \
+		./cmd/buildx
+}
+
+src_test() {
+	# TestGit can't work in a source tarball; TestReadTargets fails seemingly due to parallelism.
+	if [[ ${PV} == 9999 ]]; then
+		ego test ./... -skip "TestReadTargets|TestIntegration"
+	else
+		ego test ./... -skip "TestGit|TestReadTargets|TestIntegration"
+	fi
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe docker-buildx
+
+	dodoc README.md
+}
diff --git a/app-containers/docker-buildx/docker-buildx-0.14.0.ebuild b/app-containers/docker-buildx/docker-buildx-0.14.0.ebuild
new file mode 100644
index 000000000000..74d0e476d21e
--- /dev/null
+++ b/app-containers/docker-buildx/docker-buildx-0.14.0.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+MY_PN="buildx"
+DESCRIPTION="Docker CLI plugin for extended build capabilities with BuildKit"
+HOMEPAGE="https://github.com/docker/buildx"
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/docker/buildx.git"
+else
+	SRC_URI="https://github.com/docker/buildx/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+	S="${WORKDIR}/${MY_PN}-${PV}"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+IUSE="test"
+
+# This gives us the ability to neatly `-skip` tests.
+# not required once ::gentoo is all > 1.20
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	test? ( >=dev-lang/go-1.20 )
+"
+RDEPEND="app-containers/docker-cli"
+
+src_compile() {
+	local _buildx_r='github.com/docker/buildx'
+	local version=${PV}
+	if [[ ${PV} == 9999 ]]; then
+		version="$(git rev-parse --short HEAD)"
+	fi
+	ego build -o docker-buildx \
+		-ldflags "-linkmode=external
+		-X $_buildx_r/version.Version=${version}
+		-X $_buildx_r/version.Revision=$(date -u +%FT%T%z)
+		-X $_buildx_r/version.Package=$_buildx_r" \
+		./cmd/buildx
+}
+
+src_test() {
+	# TestGit can't work in a source tarball; TestReadTargets fails seemingly due to parallelism.
+	if [[ ${PV} == 9999 ]]; then
+		ego test ./... -skip "TestReadTargets|TestIntegration"
+	else
+		ego test ./... -skip "TestGit|TestReadTargets|TestIntegration"
+	fi
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe docker-buildx
+
+	dodoc README.md
+}
diff --git a/app-containers/docker-buildx/docker-buildx-0.19.1.ebuild b/app-containers/docker-buildx/docker-buildx-0.19.1.ebuild
new file mode 100644
index 000000000000..197e965fc5e3
--- /dev/null
+++ b/app-containers/docker-buildx/docker-buildx-0.19.1.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+MY_PN="buildx"
+DESCRIPTION="Docker CLI plugin for extended build capabilities with BuildKit"
+HOMEPAGE="https://github.com/docker/buildx"
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/docker/buildx.git"
+else
+	SRC_URI="https://github.com/docker/buildx/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+	S="${WORKDIR}/${MY_PN}-${PV}"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+IUSE="test"
+
+# This gives us the ability to neatly `-skip` tests.
+# not required once ::gentoo is all > 1.20
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	test? ( >=dev-lang/go-1.20 )
+"
+RDEPEND="app-containers/docker-cli"
+
+src_compile() {
+	local _buildx_r='github.com/docker/buildx'
+	local version=${PV}
+	if [[ ${PV} == 9999 ]]; then
+		version="$(git rev-parse --short HEAD)"
+	fi
+	ego build -o docker-buildx \
+		-ldflags "-linkmode=external
+		-X $_buildx_r/version.Version=${version}
+		-X $_buildx_r/version.Revision=$(date -u +%FT%T%z)
+		-X $_buildx_r/version.Package=$_buildx_r" \
+		./cmd/buildx
+}
+
+src_test() {
+	# TestGit can't work in a source tarball; TestReadTargets fails seemingly due to parallelism.
+	if [[ ${PV} == 9999 ]]; then
+		ego test ./... -skip "TestReadTargets|TestIntegration"
+	else
+		ego test ./... -skip "TestGit|TestReadTargets|TestIntegration"
+	fi
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe docker-buildx
+
+	dodoc README.md
+}
diff --git a/app-containers/docker-buildx/docker-buildx-0.20.1.ebuild b/app-containers/docker-buildx/docker-buildx-0.20.1.ebuild
new file mode 100644
index 000000000000..385833c044c7
--- /dev/null
+++ b/app-containers/docker-buildx/docker-buildx-0.20.1.ebuild
@@ -0,0 +1,53 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+MY_PN="buildx"
+DESCRIPTION="Docker CLI plugin for extended build capabilities with BuildKit"
+HOMEPAGE="https://github.com/docker/buildx"
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/docker/buildx.git"
+else
+	SRC_URI="https://github.com/docker/buildx/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+	S="${WORKDIR}/${MY_PN}-${PV}"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+RDEPEND="app-containers/docker-cli"
+
+src_compile() {
+	local _buildx_r='github.com/docker/buildx'
+	local version=${PV}
+	if [[ ${PV} == 9999 ]]; then
+		version="$(git rev-parse --short HEAD)"
+	fi
+	ego build -o docker-buildx \
+		-ldflags "-linkmode=external
+		-X $_buildx_r/version.Version=${version}
+		-X $_buildx_r/version.Revision=$(date -u +%FT%T%z)
+		-X $_buildx_r/version.Package=$_buildx_r" \
+		./cmd/buildx
+}
+
+src_test() {
+	# TestGit can't work in a source tarball; TestReadTargets fails seemingly due to parallelism.
+	if [[ ${PV} == 9999 ]]; then
+		ego test ./... -skip "TestReadTargets|TestIntegration"
+	else
+		ego test ./... -skip "TestGit|TestReadTargets|TestIntegration"
+	fi
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe docker-buildx
+
+	dodoc README.md
+}
diff --git a/app-containers/docker-buildx/docker-buildx-0.21.2.ebuild b/app-containers/docker-buildx/docker-buildx-0.21.2.ebuild
new file mode 100644
index 000000000000..890c3a6cdadc
--- /dev/null
+++ b/app-containers/docker-buildx/docker-buildx-0.21.2.ebuild
@@ -0,0 +1,56 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+DESCRIPTION="Docker CLI plugin for extended build capabilities with BuildKit"
+HOMEPAGE="https://github.com/docker/buildx"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/docker/buildx.git"
+else
+	SRC_URI="https://github.com/docker/buildx/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+	S=${WORKDIR}/${P#docker-}
+fi
+
+LICENSE="Apache-2.0"
+# Dependent licenses
+LICENSE+=" Apache-2.0 BSD BSD-2 ISC MIT MPL-2.0"
+SLOT="0"
+
+RDEPEND="app-containers/docker-cli"
+
+src_compile() {
+	local _buildx_r='github.com/docker/buildx'
+	local version=${PV}
+	if [[ ${PV} == 9999 ]]; then
+		version="$(git rev-parse --short HEAD)"
+	fi
+	local go_ldflags=(
+		"-linkmode=external"
+		-X "${_buildx_r}/version.Version=${version}"
+		-X "${_buildx_r}/version.Revision=$(date -u +%FT%T%z)"
+		-X "${_buildx_r}/version.Package=${_buildx_r}"
+	)
+	ego build -o docker-buildx -ldflags "${go_ldflags[*]}" ./cmd/buildx
+}
+
+src_test() {
+	# TestGit can't work in a source tarball; TestReadTargets fails seemingly due to parallelism.
+	if [[ ${PV} == 9999 ]]; then
+		ego test ./... -skip "TestReadTargets|TestIntegration"
+	else
+		ego test ./... -skip "TestGit|TestReadTargets|TestIntegration"
+	fi
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe docker-buildx
+
+	einstalldocs
+}
diff --git a/app-containers/docker-buildx/docker-buildx-0.34.1.ebuild b/app-containers/docker-buildx/docker-buildx-0.34.1.ebuild
new file mode 100644
index 000000000000..07dd51e70a08
--- /dev/null
+++ b/app-containers/docker-buildx/docker-buildx-0.34.1.ebuild
@@ -0,0 +1,57 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=9
+
+inherit go-module
+
+DESCRIPTION="Docker CLI plugin for extended build capabilities with BuildKit"
+HOMEPAGE="https://github.com/docker/buildx"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/docker/buildx.git"
+else
+	SRC_URI="https://github.com/docker/buildx/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+	S=${WORKDIR}/${P#docker-}
+fi
+
+LICENSE="Apache-2.0"
+# Dependent licenses
+LICENSE+=" Apache-2.0 BSD BSD-2 ISC MIT MPL-2.0"
+SLOT="0"
+
+RDEPEND="app-containers/docker-cli"
+BDEPEND=">=dev-lang/go-1.25.5"
+
+src_compile() {
+	local _buildx_r='github.com/docker/buildx'
+	local version=${PV}
+	if [[ ${PV} == 9999 ]]; then
+		version="$(git rev-parse --short HEAD)"
+	fi
+	local go_ldflags=(
+		"-linkmode=external"
+		-X "${_buildx_r}/version.Version=${version}"
+		-X "${_buildx_r}/version.Revision=$(date -u +%FT%T%z)"
+		-X "${_buildx_r}/version.Package=${_buildx_r}"
+	)
+	ego build -o docker-buildx -ldflags "${go_ldflags[*]}" ./cmd/buildx
+}
+
+src_test() {
+	# TestGit can't work in a source tarball; TestReadTargets fails seemingly due to parallelism.
+	if [[ ${PV} == 9999 ]]; then
+		ego test ./... -skip "TestReadTargets|TestIntegration"
+	else
+		ego test ./... -skip "TestGit|TestReadTargets|TestIntegration"
+	fi
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe docker-buildx
+
+	einstalldocs
+}
diff --git a/app-containers/docker-buildx/docker-buildx-9999.ebuild b/app-containers/docker-buildx/docker-buildx-9999.ebuild
new file mode 100644
index 000000000000..07dd51e70a08
--- /dev/null
+++ b/app-containers/docker-buildx/docker-buildx-9999.ebuild
@@ -0,0 +1,57 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=9
+
+inherit go-module
+
+DESCRIPTION="Docker CLI plugin for extended build capabilities with BuildKit"
+HOMEPAGE="https://github.com/docker/buildx"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/docker/buildx.git"
+else
+	SRC_URI="https://github.com/docker/buildx/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+	S=${WORKDIR}/${P#docker-}
+fi
+
+LICENSE="Apache-2.0"
+# Dependent licenses
+LICENSE+=" Apache-2.0 BSD BSD-2 ISC MIT MPL-2.0"
+SLOT="0"
+
+RDEPEND="app-containers/docker-cli"
+BDEPEND=">=dev-lang/go-1.25.5"
+
+src_compile() {
+	local _buildx_r='github.com/docker/buildx'
+	local version=${PV}
+	if [[ ${PV} == 9999 ]]; then
+		version="$(git rev-parse --short HEAD)"
+	fi
+	local go_ldflags=(
+		"-linkmode=external"
+		-X "${_buildx_r}/version.Version=${version}"
+		-X "${_buildx_r}/version.Revision=$(date -u +%FT%T%z)"
+		-X "${_buildx_r}/version.Package=${_buildx_r}"
+	)
+	ego build -o docker-buildx -ldflags "${go_ldflags[*]}" ./cmd/buildx
+}
+
+src_test() {
+	# TestGit can't work in a source tarball; TestReadTargets fails seemingly due to parallelism.
+	if [[ ${PV} == 9999 ]]; then
+		ego test ./... -skip "TestReadTargets|TestIntegration"
+	else
+		ego test ./... -skip "TestGit|TestReadTargets|TestIntegration"
+	fi
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe docker-buildx
+
+	einstalldocs
+}
diff --git a/app-containers/docker-buildx/metadata.xml b/app-containers/docker-buildx/metadata.xml
new file mode 100644
index 000000000000..48330166b099
--- /dev/null
+++ b/app-containers/docker-buildx/metadata.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>nic@boet.cc</email>
+    <name>Nic Boet</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <maintainer type="project">
+    <email>containers@gentoo.org</email>
+    <name>Containers</name>
+  </maintainer>
+  <longdescription lang="en">
+		buildx is a Docker CLI plugin for extended build capabilities with BuildKit.
+		BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
+	</longdescription>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/docker-cli/Manifest b/app-containers/docker-cli/Manifest
new file mode 100644
index 000000000000..68d5672b3a7c
--- /dev/null
+++ b/app-containers/docker-cli/Manifest
@@ -0,0 +1,11 @@
+DIST docker-cli-28.0.1-man.tar.xz 70360 BLAKE2B 395736a74b314530fbbd6bf4016f7f211a3ee4754179cde0d8edf16f489c3fd92565cf73033defb80fd8280e4ef1e2add15541102944401123cfb251b06492f9 SHA512 b72e4f35a80d72d18f701edcace46eb11fbcf1ba40a1ab8efa913edc74e265dafbdc58c7c0d442293d71ce2cfc952fcbed5afee5d5f3ba52d9d25741d5a12593
+DIST docker-cli-28.0.1.tar.gz 7413092 BLAKE2B 69075ba24eb7c46593d7c4ab80499b67994119af8096409f55eec9524173cb8d37263159cd834e3cfaf4e8d169b568232d400633b2d9b08112ced05c78338f92 SHA512 c3d7ca21b88c5f6925f6c99519a67581fd6c264cc96e6c0bc00751f87de6580a2d443cbe59b2e36771e37a78fe05ea054e292675e19bc4d73fcacfda047e0490
+DIST docker-cli-28.0.4-man.tar.xz 70440 BLAKE2B 676eeafda725c759074124e1ccef693d3f0232e2acf3c2b468d28f48e7228b36c885d690cf041bab775b8410e65c1c6f1403b712a869a5610a03ae788f175a0b SHA512 e36dccb3ea043b722993001ebc36180874b65df5fdd446c52ad2902812097a456ee5d1d432e4c5f5db553213c9956c1f2ef3d07e171760f1e29248f3a6dedf9f
+DIST docker-cli-28.0.4.tar.gz 7504883 BLAKE2B c975eff2bb4c0dd5430a67418804e8649c733a59ac6b2beb9f2a454a8e8839e12afbf61afccb1e3bd0cb2e38c51fbd59fee3de45490a02ec9ad074cd365ece2c SHA512 fd7562815686fece20a0ea95501612e049e90192305464b06770643ae864baa87b0fb87fddadeb4f9beb33352940cef63ffd24af8b989e309cd5be5f32eddf62
+DIST docker-cli-28.1.1-man.tar.xz 69976 BLAKE2B 497c0874a5ed72c3d2dff6c77b687f012c6a6d4dda67f138e3bf051bf019914efda53d85ffde003e5aea11f849dc199a34b17a1325d439b74e3ccc6f4e324d11 SHA512 06a2e65fe376dcb84474f116f6b2fd04afb6ce5fcd2ed5d3a27e4f7a2f5e849ff0317720936bb75b300ef85eacbf41cd9b9af34345e35c5254ff8c1036e25d7f
+DIST docker-cli-28.1.1.tar.gz 7518124 BLAKE2B 2d9a1b620d4cffa718571cef9aa1825b57600630624715ccdae50a1bbcc44821d599ea2f6e6c66628434740904d53218e101f69b4fd0865b4197ef19d9c2d4fe SHA512 39ff5f982779b70311d4fce5f829e52199b058cedf92c0e650786a52004edbf3935f8673db98527affc57f0e33be435f8a8af624c2e06f28c7f8f405ed570746
+DIST docker-cli-28.2.2-man.tar.xz 69888 BLAKE2B bee8b296ee94c57c34cfa268fde015aff15b6b269905275d47cce73ab94c7bed7edc9ba4d5b9d730dea78d149306736e14186c8a9c782047094511771ec8d105 SHA512 ce608b60915a0b7b15302260ec500b433ba6c9174fa82b34a4ae8ad7bb9d2f6abe45d4e43c0e3978b2f5bb440425e08d416ab9f613cdf64eb6294254765aa37b
+DIST docker-cli-28.2.2.tar.gz 7531638 BLAKE2B cb7d2766e4a6c444169f8462379b8524e0433a29541837c1acbefa62f4b303b6ce1dd629fbb2ed6e154ea51b72ac17c8452284a5e26c9716217e8cbf169374bb SHA512 1ba62398322c65e6994c0c6821b912c9a9b215083593d63557c5255064c407bd25f72044336ebb19977fe6d03215ec47174c6617890a817b9e34ed010535fb6b
+DIST docker-cli-28.4.0.tar.gz 7612765 BLAKE2B acfa0ee4cdeb6eec31ae92eb8c0a41357aa0ff3cb34bd497307ce5f136a6f1dd4d78cbbea27b1c48b0d5995262f1e039548a725c106bcc91f48f01932354e8dc SHA512 ab35867bdcaa07909cfd24e9bc4f5cde10b6930fa42e87d61d4544bb20b365fff146713239483169ef989cacfae7d7493d7f42d269b0f37f86c0c14a9373b445
+DIST docker-cli-29.1.3.tar.gz 7303915 BLAKE2B 3d45206f91f3675171f054f5159ec38034a9d7125d1742346a9b0819af26a50616198d87640ec6e6cb0a017aa801c677d5bb85c7faf7cfbd1de81cb4f886c932 SHA512 f37a5d125eb93639db8527c826078571ef5938be6bb33d132ccf693bf0810e3b9bb354074488021e129760a44b7fc51cd8295c6c6fe79211b70736231f47320e
+DIST docker-cli-29.5.2.tar.gz 6828313 BLAKE2B c62bf6acd83a6db72dbf3f65be34e0738b38e6ade12ae15c1b1bcc69b648628b85dac523bd876c0f473cd9d12408c738b1728b8e33aab87034a76ec0aec36388 SHA512 3c569dbbcef6e9720a126147175f67297acab9a4ae8dd2af544b48eca70519dfd3c5312bf4ffab777e59a251cfdc5965217b0d3ca4c2eb41117c2e3b465bbb8a
diff --git a/app-containers/docker-cli/docker-cli-28.0.1.ebuild b/app-containers/docker-cli/docker-cli-28.0.1.ebuild
new file mode 100644
index 000000000000..658b89cd7fd2
--- /dev/null
+++ b/app-containers/docker-cli/docker-cli-28.0.1.ebuild
@@ -0,0 +1,65 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit shell-completion go-module
+MY_PV=${PV/_/-}
+
+# update this on every bump
+GIT_COMMIT=068a01ea9470df6494cc92d9e64e240805ae47a7
+
+DESCRIPTION="the command line binary for docker"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/docker/cli/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-man.tar.xz"
+S="${WORKDIR}/cli-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv ~x86"
+IUSE="selinux"
+
+RDEPEND="selinux? ( sec-policy/selinux-docker )"
+
+RESTRICT="installsources strip test"
+
+src_unpack() {
+	default
+	cd "${S}"
+	ln -s vendor.mod go.mod
+	ln -s vendor.sum go.sum
+}
+
+src_prepare() {
+	default
+	sed -i 's@dockerd\?\.exe@@g' contrib/completion/bash/docker || die
+}
+
+src_compile() {
+	export DISABLE_WARN_OUTSIDE_CONTAINER=1
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+		emake \
+		VERSION="${PV}" \
+		GITCOMMIT="${GIT_COMMIT}" \
+		dynbinary
+}
+
+src_install() {
+	dobin build/docker
+	doman "${WORKDIR}"/man/man?/*
+	dobashcomp contrib/completion/bash/docker
+	bashcomp_alias docker dockerd
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
+}
+
+pkg_postinst() {
+	has_version "app-containers/docker-buildx" && return
+	ewarn "the 'docker build' command is deprecated and will be removed in a"
+	ewarn "future release. If you need this functionality, install"
+	ewarn "app-containers/docker-buildx."
+}
diff --git a/app-containers/docker-cli/docker-cli-28.0.4.ebuild b/app-containers/docker-cli/docker-cli-28.0.4.ebuild
new file mode 100644
index 000000000000..5966bc5a1731
--- /dev/null
+++ b/app-containers/docker-cli/docker-cli-28.0.4.ebuild
@@ -0,0 +1,71 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit shell-completion go-module
+MY_PV=${PV/_/-}
+
+# update this on every bump
+GIT_COMMIT=b8034c0ed70494a90c133461d145cd072d920d7c
+
+# To create the man pages tarball, run the following in the git source
+# directory:
+#git checkout ${PV}
+# make manpages
+# tar -acf ${P}-man.tar.xz man/man?
+
+DESCRIPTION="the command line binary for docker"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/docker/cli/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-man.tar.xz"
+S="${WORKDIR}/cli-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv ~x86"
+IUSE="selinux"
+
+RDEPEND="selinux? ( sec-policy/selinux-docker )"
+
+RESTRICT="installsources strip test"
+
+src_unpack() {
+	default
+	cd "${S}"
+	ln -s vendor.mod go.mod
+	ln -s vendor.sum go.sum
+}
+
+src_prepare() {
+	default
+	sed -i 's@dockerd\?\.exe@@g' contrib/completion/bash/docker || die
+}
+
+src_compile() {
+	export DISABLE_WARN_OUTSIDE_CONTAINER=1
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+		emake \
+		VERSION="${PV}" \
+		GITCOMMIT="${GIT_COMMIT}" \
+		dynbinary
+}
+
+src_install() {
+	dobin build/docker
+	doman "${WORKDIR}"/man/man?/*
+	dobashcomp contrib/completion/bash/docker
+	bashcomp_alias docker dockerd
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
+}
+
+pkg_postinst() {
+	has_version "app-containers/docker-buildx" && return
+	ewarn "the 'docker build' command is deprecated and will be removed in a"
+	ewarn "future release. If you need this functionality, install"
+	ewarn "app-containers/docker-buildx."
+}
diff --git a/app-containers/docker-cli/docker-cli-28.1.1.ebuild b/app-containers/docker-cli/docker-cli-28.1.1.ebuild
new file mode 100644
index 000000000000..b3d0324e49a8
--- /dev/null
+++ b/app-containers/docker-cli/docker-cli-28.1.1.ebuild
@@ -0,0 +1,71 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit shell-completion go-module
+MY_PV=${PV/_/-}
+
+# update this on every bump
+GIT_COMMIT=4eba3773274f9d21ba90ae5bc719c3f1e4bb07a1
+
+# To create the man pages tarball, run the following in the git source
+# directory:
+#git checkout ${PV}
+# make manpages
+# tar -acf ${P}-man.tar.xz man/man?
+
+DESCRIPTION="the command line binary for docker"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/docker/cli/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-man.tar.xz"
+S="${WORKDIR}/cli-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+IUSE="selinux"
+
+RDEPEND="selinux? ( sec-policy/selinux-docker )"
+
+RESTRICT="installsources strip test"
+
+src_unpack() {
+	default
+	cd "${S}"
+	ln -s vendor.mod go.mod
+	ln -s vendor.sum go.sum
+}
+
+src_prepare() {
+	default
+	sed -i 's@dockerd\?\.exe@@g' contrib/completion/bash/docker || die
+}
+
+src_compile() {
+	export DISABLE_WARN_OUTSIDE_CONTAINER=1
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+		emake \
+		VERSION="${PV}" \
+		GITCOMMIT="${GIT_COMMIT}" \
+		dynbinary
+}
+
+src_install() {
+	dobin build/docker
+	doman "${WORKDIR}"/man/man?/*
+	dobashcomp contrib/completion/bash/docker
+	bashcomp_alias docker dockerd
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
+}
+
+pkg_postinst() {
+	has_version "app-containers/docker-buildx" && return
+	ewarn "the 'docker build' command is deprecated and will be removed in a"
+	ewarn "future release. If you need this functionality, install"
+	ewarn "app-containers/docker-buildx."
+}
diff --git a/app-containers/docker-cli/docker-cli-28.2.2.ebuild b/app-containers/docker-cli/docker-cli-28.2.2.ebuild
new file mode 100644
index 000000000000..975942afaba0
--- /dev/null
+++ b/app-containers/docker-cli/docker-cli-28.2.2.ebuild
@@ -0,0 +1,71 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit shell-completion go-module
+MY_PV=${PV/_/-}
+
+# update this on every bump
+GIT_COMMIT=879ac3f88fe137c2058afe995298832eb2ff1546
+
+# To create the man pages tarball, run the following in the git source
+# directory:
+#git checkout ${PV}
+# make manpages
+# tar -acf ${P}-man.tar.xz man/man?
+
+DESCRIPTION="the command line binary for docker"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/docker/cli/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-man.tar.xz"
+S="${WORKDIR}/cli-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+IUSE="selinux"
+
+RDEPEND="selinux? ( sec-policy/selinux-docker )"
+
+RESTRICT="installsources strip test"
+
+src_unpack() {
+	default
+	cd "${S}"
+	ln -s vendor.mod go.mod
+	ln -s vendor.sum go.sum
+}
+
+src_prepare() {
+	default
+	sed -i 's@dockerd\?\.exe@@g' contrib/completion/bash/docker || die
+}
+
+src_compile() {
+	export DISABLE_WARN_OUTSIDE_CONTAINER=1
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+		emake \
+		VERSION="${PV}" \
+		GITCOMMIT="${GIT_COMMIT}" \
+		dynbinary
+}
+
+src_install() {
+	dobin build/docker
+	doman "${WORKDIR}"/man/man?/*
+	dobashcomp contrib/completion/bash/docker
+	bashcomp_alias docker dockerd
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
+}
+
+pkg_postinst() {
+	has_version "app-containers/docker-buildx" && return
+	ewarn "the 'docker build' command is deprecated and will be removed in a"
+	ewarn "future release. If you need this functionality, install"
+	ewarn "app-containers/docker-buildx."
+}
diff --git a/app-containers/docker-cli/docker-cli-28.4.0.ebuild b/app-containers/docker-cli/docker-cli-28.4.0.ebuild
new file mode 100644
index 000000000000..67619a487c9c
--- /dev/null
+++ b/app-containers/docker-cli/docker-cli-28.4.0.ebuild
@@ -0,0 +1,70 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit shell-completion go-module
+MY_PV=${PV/_/-}
+
+# update this on every bump
+GIT_COMMIT=d8eb465f86cfceeb57f8582e373d41a558d35503
+
+# To create the man pages tarball, run the following in the git source
+# directory:
+#git checkout ${PV}
+# make manpages
+# tar -acf ${P}-man.tar.xz man/man?
+
+DESCRIPTION="the command line binary for docker"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/docker/cli/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/cli-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv ~x86"
+IUSE="selinux"
+
+RDEPEND="selinux? ( sec-policy/selinux-docker )"
+
+RESTRICT="installsources strip test"
+
+src_unpack() {
+	default
+	cd "${S}"
+	ln -s vendor.mod go.mod
+	ln -s vendor.sum go.sum
+}
+
+src_prepare() {
+	default
+	sed -i 's@dockerd\?\.exe@@g' contrib/completion/bash/docker || die
+}
+
+src_compile() {
+	export DISABLE_WARN_OUTSIDE_CONTAINER=1
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+		emake \
+		VERSION="${PV}" \
+		GITCOMMIT="${GIT_COMMIT}" \
+		dynbinary manpages
+}
+
+src_install() {
+	dobin build/docker
+	doman man/man?/*
+	dobashcomp contrib/completion/bash/docker
+	bashcomp_alias docker dockerd
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
+}
+
+pkg_postinst() {
+	has_version "app-containers/docker-buildx" && return
+	ewarn "the 'docker build' command is deprecated and will be removed in a"
+	ewarn "future release. If you need this functionality, install"
+	ewarn "app-containers/docker-buildx."
+}
diff --git a/app-containers/docker-cli/docker-cli-29.1.3.ebuild b/app-containers/docker-cli/docker-cli-29.1.3.ebuild
new file mode 100644
index 000000000000..2670336679be
--- /dev/null
+++ b/app-containers/docker-cli/docker-cli-29.1.3.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit shell-completion go-env go-module toolchain-funcs
+MY_PV=${PV/_/-}
+
+# update this on every bump
+GIT_COMMIT=f52814d454173982e6692dd7e290a41b828d9cbc
+
+DESCRIPTION="the command line binary for docker"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/docker/cli/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/cli-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv ~x86"
+IUSE="selinux"
+
+RDEPEND="selinux? ( sec-policy/selinux-docker )"
+BDEPEND="dev-go/go-md2man"
+
+RESTRICT="installsources strip test"
+
+src_prepare() {
+	default
+	sed -i 's@dockerd\?\.exe@@g' contrib/completion/bash/docker || die
+	ln -s vendor.mod go.mod
+	ln -s vendor.sum go.sum
+}
+
+src_compile() {
+	export DISABLE_WARN_OUTSIDE_CONTAINER=1
+
+	myemakeargs=(
+		VERSION="${PV}"
+		GITCOMMIT="${GIT_COMMIT}"
+	)
+
+	emake "${myemakeargs[@]}" dynbinary
+	tc-env_build go-env_run emake "${myemakeargs[@]}" manpages
+}
+
+src_install() {
+	dobin build/docker
+	doman man/man?/*
+	dobashcomp contrib/completion/bash/docker
+	bashcomp_alias docker dockerd
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
+}
+
+pkg_postinst() {
+	has_version "app-containers/docker-buildx" && return
+	ewarn "the 'docker build' command is deprecated and will be removed in a"
+	ewarn "future release. If you need this functionality, install"
+	ewarn "app-containers/docker-buildx."
+}
diff --git a/app-containers/docker-cli/docker-cli-29.5.2.ebuild b/app-containers/docker-cli/docker-cli-29.5.2.ebuild
new file mode 100644
index 000000000000..a492870e7e0a
--- /dev/null
+++ b/app-containers/docker-cli/docker-cli-29.5.2.ebuild
@@ -0,0 +1,63 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit shell-completion go-env go-module toolchain-funcs
+MY_PV=${PV/_/-}
+
+# update this on every bump
+GIT_COMMIT=79eb04c7d8e1d73247cb7fe011eecc645063e0f0
+
+DESCRIPTION="the command line binary for docker"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/docker/cli/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/cli-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+IUSE="selinux"
+
+RDEPEND="selinux? ( sec-policy/selinux-docker )"
+BDEPEND="
+	dev-go/go-md2man
+	>=dev-lang/go-1.25.0
+"
+
+RESTRICT="installsources strip test"
+
+src_prepare() {
+	default
+	sed -i 's@dockerd\?\.exe@@g' contrib/completion/bash/docker || die
+	ln -s vendor.mod go.mod || die
+	ln -s vendor.sum go.sum || die
+}
+
+src_compile() {
+	export DISABLE_WARN_OUTSIDE_CONTAINER=1
+
+	myemakeargs=(
+		VERSION="${PV}"
+		GITCOMMIT="${GIT_COMMIT}"
+	)
+
+	emake "${myemakeargs[@]}" dynbinary
+	tc-env_build go-env_run emake "${myemakeargs[@]}" manpages
+}
+
+src_install() {
+	dobin build/docker
+	doman man/man?/*
+	dobashcomp contrib/completion/bash/docker
+	bashcomp_alias docker dockerd
+	dofishcomp contrib/completion/fish/docker.fish
+	dozshcomp contrib/completion/zsh/_*
+}
+
+pkg_postinst() {
+	has_version "app-containers/docker-buildx" && return
+	ewarn "the 'docker build' command is deprecated and will be removed in a"
+	ewarn "future release. If you need this functionality, install"
+	ewarn "app-containers/docker-buildx."
+}
diff --git a/app-containers/docker-cli/metadata.xml b/app-containers/docker-cli/metadata.xml
new file mode 100644
index 000000000000..a0c754ce4726
--- /dev/null
+++ b/app-containers/docker-cli/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:docker:command_line_interface</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/docker-compose/Manifest b/app-containers/docker-compose/Manifest
new file mode 100644
index 000000000000..0ce26d1309a1
--- /dev/null
+++ b/app-containers/docker-compose/Manifest
@@ -0,0 +1,11 @@
+DIST compose-5.1.4-vendor.tar.xz 3753076 BLAKE2B 4fca50a6638ae928f33787d987edf9444df1992056a929c2fe8514c63023454476bb490f76399022297d570b376a8657029f17ca98f8d637c06a9fb7561773df SHA512 ee5ef37bb76eead1b221920f5ae7788a50c0c705eb2e51118c7b6d31fd7725a9ffed1cc785039170ab78c4a71a03ecb7fc6486ed3822a2adef2efea6d68ec9f0
+DIST docker-compose-1.29.2.gh.tar.gz 320320 BLAKE2B 2d1a6375127fa09661822f7148665161b45bbd234c93444ae31c1d926513fcbc9fb845f8af01d8f11788f24b7517bff5f6cea2a5da9ade897891f2dd728f26bd SHA512 09f2ae2ae7a17ab5fb3e22580f7a80f1a8253f7ad9fc8f29aca432911bcde46ed22030ff3073cdd7eff3d55aaba17f56e628a178ec05c3a9b4f28495d6045111
+DIST docker-compose-2.34.0-deps.tar.xz 61127872 BLAKE2B e676e93203ae0e670d7cedb6b8771aea01d501246bd9e2c997fc1f03ae6db16fc7816e05ae69bfda6fc83f912d5ccd82a1b7f22781cb5fce4910c326b63f93c7 SHA512 a7f7d710b03e52c3559c84e48e2171e9aa7d2f7c357f1a44963de396a4491a53fdea9e138c57d092572e1a6833e7d3e9ea50ea7e17885c7e37f9ded6cad1cf5e
+DIST docker-compose-2.34.0.gh.tar.gz 397231 BLAKE2B e500fcbb8e6d7ffb08ff43f667faf73dcc29c6084a8a105d1b3c3d0733681ed2499312f056406c6f95d108359f07d92c21e8e2384bd309514b7140bd8a939269 SHA512 8e2ca8cd3b23328a6655c235c6c515343cc848fb1d139a1e981c81a88595edfed4e9d6450f98eebfb8ff73c02c7fbf2aac6206e8fe90eb7883cb6edc6ec0682c
+DIST docker-compose-2.39.3-deps.tar.xz 61486084 BLAKE2B 1e1398f30992b2b8777d78ad13361a684ef83c8036e9d0a24a2d74fc81354e5fab7e9c2f27c695580b839237ec8d99ad7a08976b3308349905e03a390e08e25e SHA512 a20c66e0536b0ac40c34f043e63d73b1f6838e841de52ada307ba5f9793bbb41cfb00333fc0681764818386c483ce9f25c5f123ceba6a6c1d05d386c2b5a8b79
+DIST docker-compose-2.39.3.gh.tar.gz 422961 BLAKE2B f401925f01e279fd2ce564770ee82d4e032bd08102d943b8383d33d65d6c16eeec349b4dab591d95f4a009a14502810fa85a18caba63e5a460eaf73ae0769896 SHA512 c9d4c01411036b21c7773156e10d02fe67dd67dd261d0c7f31b8fe2853d8355a91167a6252b32f6588cd4108e297e79cae070cb5ae0ea377b9733f94170f1ad0
+DIST docker-compose-2.40.3-deps.tar.xz 61492824 BLAKE2B dff3216d99c1659a5375157f646ca621f4964389dfffd0915e7ac2d85705d01d1fadd88ddab034c2cc042dfd807f37fdf056f40a2fa8f536f48f4bd2b1c69fca SHA512 a30ceec9a02003c0966cd976c68f63cbcbaab9a69609f3e17079370df8d03e751c07144b72fef92b57b1bb663d0ee102cf1d2fc6aa937cc7039021b0e5464e95
+DIST docker-compose-2.40.3.gh.tar.gz 430320 BLAKE2B a4272a1b65a372adb25caf1363c76c4104a3e20f0cd3013df8d4da7a34099483fdc8322b07dff3006c9c991e4b63c69f20511aeb62604d196c9a60b064e56121 SHA512 aea731cae9e230b5bdf9ad576cf6b04e6edf3233ca8e309b16dbf5a2469aa80ed3082790750d84a6dae981d581e6148e7fba49ddf8d30d7b3c6efcf90576fbe1
+DIST docker-compose-5.0.1-deps.tar.xz 56998332 BLAKE2B bbef3088ba0f766201a3b0126ecf72526d25c4c6dc5395ca51a85871c3e8b8cf8c695644017adeb8295c3cbeffe99caec7bcacef172ab5471b60510bf805e25d SHA512 88f30c0241ad28558ab42206e59b1c6ff76c7dbe7abd113ffdb22fc0aaa045352e3e01d572655dff7dce0280b4aa931497ba1aeced3860fef9cde7a71878252d
+DIST docker-compose-5.0.1.gh.tar.gz 429760 BLAKE2B 57cc76dfae0c4289153d8518430c9b43a883a2ea6f21b1e6fc91ff56b84a2513cbdc1994a27bff97d8ec3c00bdd25dbb8011d4e74f9b24c704556267c0468ec1 SHA512 d9f5d3fa85bf39076c3b3f2d73a19bec95565c92481b061e78c3d1a8fa575022ef854f5f52ea6c10e13fbc6e06e4ab7bcd1e11bee49ed2e13a5d8dfec69ce4e5
+DIST docker-compose-5.1.4.gh.tar.gz 461373 BLAKE2B 5c7155de714767535f06b407a5bf4784fbd4429845025fde1ebaba277887f8a4341f252569c14db8ee34d5a115720c8594f4c481f41ea8a929a322febbe853a6 SHA512 b9cc1c74251f97b4eef6448f66e58613c3b22b683ea92bebb6d8279b00739c285170d6cdc059e7341cb419c197b47958c6ad446ca763c93121ee524e57412a68
diff --git a/app-containers/docker-compose/docker-compose-1.29.2-r8.ebuild b/app-containers/docker-compose/docker-compose-1.29.2-r8.ebuild
new file mode 100644
index 000000000000..db47ea6671e5
--- /dev/null
+++ b/app-containers/docker-compose/docker-compose-1.29.2-r8.ebuild
@@ -0,0 +1,79 @@
+# Copyright 2018-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit distutils-r1 shell-completion
+
+MY_PV=${PV/_/-}
+DESCRIPTION="Multi-container orchestration for Docker"
+HOMEPAGE="https://github.com/docker/compose"
+SRC_URI="https://github.com/docker/compose/archive/${MY_PV}.tar.gz -> ${P}.gh.tar.gz"
+
+S="${WORKDIR}/compose-${MY_PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 arm64"
+
+RDEPEND="
+	>=dev-python/distro-1.5.0[${PYTHON_USEDEP}]
+	>=dev-python/docker-7[${PYTHON_USEDEP}]
+	>=dev-python/dockerpty-0.4.1[${PYTHON_USEDEP}]
+	>=dev-python/docopt-0.6.1[${PYTHON_USEDEP}]
+	>=dev-python/python-dotenv-0.13.0[${PYTHON_USEDEP}]
+	>=dev-python/jsonschema-2.5.1[${PYTHON_USEDEP}]
+	dev-python/paramiko[${PYTHON_USEDEP}]
+	>=dev-python/pysocks-1.6.0[${PYTHON_USEDEP}]
+	>=dev-python/pyyaml-3.10[${PYTHON_USEDEP}]
+	>=dev-python/requests-2.20.0[${PYTHON_USEDEP}]
+	>=dev-python/six-1.3.0[${PYTHON_USEDEP}]
+	>=dev-python/texttable-0.9.0[${PYTHON_USEDEP}]
+	>=dev-python/websocket-client-0.32.0[${PYTHON_USEDEP}]"
+
+DEPEND="${RDEPEND}
+	test? (
+		>=dev-python/pytest-5[${PYTHON_USEDEP}]
+		>=dev-python/ddt-1.2.2[${PYTHON_USEDEP}]
+		dev-python/py[${PYTHON_USEDEP}]
+	)"
+
+EPYTEST_DESELECT=(
+	# These are not ready for >=dev-python/docker-7
+	tests/unit/cli/docker_client_test.py::TLSConfigTestCase::
+)
+
+distutils_enable_tests pytest
+
+PATCHES=(
+	# Bug #679968 -- https://bugs.gentoo.org/679968
+	# Bug #681002 -- https://bugs.gentoo.org/681002
+	"${FILESDIR}"/${PN}-1.29.0-setup-py.patch
+	"${FILESDIR}"/${P}-tests-unit-cli-test-py.patch
+	# Bug #920631 -- https://bugs.gentoo.org/920631
+	"${FILESDIR}"/${P}-docker-7.patch
+	"${FILESDIR}"/${P}-python-3.13.patch
+)
+
+DOCS=( CHANGELOG.md README.md )
+
+src_prepare() {
+	# Address QA issue "docker-compose.exe: missing alias (symlink) for completed command."
+	sed 's,^\(complete.*\) docker-compose\.exe\(.*\),\1\2,' -i contrib/completion/bash/docker-compose || die
+
+	default
+}
+
+python_test() {
+	epytest tests/unit/
+}
+
+python_install_all() {
+	dobashcomp contrib/completion/bash/${PN}
+	dozshcomp contrib/completion/zsh/_${PN}
+
+	distutils-r1_python_install_all
+}
diff --git a/app-containers/docker-compose/docker-compose-2.34.0-r1.ebuild b/app-containers/docker-compose/docker-compose-2.34.0-r1.ebuild
new file mode 100644
index 000000000000..d38d7def3dba
--- /dev/null
+++ b/app-containers/docker-compose/docker-compose-2.34.0-r1.ebuild
@@ -0,0 +1,56 @@
+# Copyright 2018-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit eapi9-ver go-module
+MY_PV=${PV/_/-}
+
+DESCRIPTION="Multi-container orchestration for Docker"
+HOMEPAGE="https://github.com/docker/compose"
+SRC_URI="https://github.com/docker/compose/archive/v${MY_PV}.tar.gz -> ${P}.gh.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+S="${WORKDIR}/compose-${MY_PV}"
+
+LICENSE="Apache-2.0"
+SLOT="2"
+KEYWORDS="amd64 arm64"
+
+RDEPEND=">=app-containers/docker-cli-23.0.0"
+
+RESTRICT="test"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-2.34.0-revert-secrets-file-mode.patch"
+)
+
+src_prepare() {
+	default
+	# do not strip
+	sed -i -e 's/-s -w//' Makefile || die
+}
+
+src_compile() {
+	emake VERSION=v${PV}
+}
+
+src_test() {
+	emake test
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe bin/build/docker-compose
+	dodoc README.md
+}
+
+pkg_postinst() {
+	ver_replacing -ge 2 && return
+	ewarn
+	ewarn "docker-compose 2.x is a sub command of docker"
+	ewarn "Use 'docker compose' from the command line instead of"
+	ewarn "'docker-compose'"
+	ewarn "If you need to keep 1.x around, please run the following"
+	ewarn "command before your next --depclean"
+	ewarn "# emerge --noreplace docker-compose:0"
+}
diff --git a/app-containers/docker-compose/docker-compose-2.39.3.ebuild b/app-containers/docker-compose/docker-compose-2.39.3.ebuild
new file mode 100644
index 000000000000..a011aa70c800
--- /dev/null
+++ b/app-containers/docker-compose/docker-compose-2.39.3.ebuild
@@ -0,0 +1,51 @@
+# Copyright 2018-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit eapi9-ver go-module
+MY_PV=${PV/_/-}
+
+DESCRIPTION="Multi-container orchestration for Docker"
+HOMEPAGE="https://github.com/docker/compose"
+SRC_URI="https://github.com/docker/compose/archive/v${MY_PV}.tar.gz -> ${P}.gh.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+S="${WORKDIR}/compose-${MY_PV}"
+
+LICENSE="Apache-2.0"
+SLOT="2"
+KEYWORDS="amd64 arm64"
+
+RDEPEND="|| (
+	>=app-containers/docker-cli-23.0.0
+	app-containers/podman[wrapper(+)]
+)"
+BDEPEND=">=dev-lang/go-1.24.7"
+
+RESTRICT="test"
+
+src_compile() {
+	emake VERSION=v${PV}
+}
+
+src_test() {
+	emake test
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe bin/build/docker-compose
+	dodoc README.md
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 2; then
+		ewarn
+		ewarn "docker-compose 2.x is a sub command of docker"
+		ewarn "Use 'docker compose' from the command line instead of"
+		ewarn "'docker-compose'"
+		ewarn "If you need to keep 1.x around, please run the following"
+		ewarn "command before your next --depclean"
+		ewarn "# emerge --noreplace docker-compose:0"
+	fi
+}
diff --git a/app-containers/docker-compose/docker-compose-2.40.3.ebuild b/app-containers/docker-compose/docker-compose-2.40.3.ebuild
new file mode 100644
index 000000000000..63e19f1d0ee8
--- /dev/null
+++ b/app-containers/docker-compose/docker-compose-2.40.3.ebuild
@@ -0,0 +1,51 @@
+# Copyright 2018-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit eapi9-ver go-module
+MY_PV=${PV/_/-}
+
+DESCRIPTION="Multi-container orchestration for Docker"
+HOMEPAGE="https://github.com/docker/compose"
+SRC_URI="https://github.com/docker/compose/archive/v${MY_PV}.tar.gz -> ${P}.gh.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+S="${WORKDIR}/compose-${MY_PV}"
+
+LICENSE="Apache-2.0"
+SLOT="2"
+KEYWORDS="~amd64 ~arm64"
+
+RDEPEND="|| (
+	>=app-containers/docker-cli-23.0.0
+	app-containers/podman[wrapper(+)]
+)"
+BDEPEND=">=dev-lang/go-1.24.7"
+
+RESTRICT="test"
+
+src_compile() {
+	emake VERSION=v${PV}
+}
+
+src_test() {
+	emake test
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe bin/build/docker-compose
+	dodoc README.md
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 2; then
+		ewarn
+		ewarn "docker-compose 2.x is a sub command of docker"
+		ewarn "Use 'docker compose' from the command line instead of"
+		ewarn "'docker-compose'"
+		ewarn "If you need to keep 1.x around, please run the following"
+		ewarn "command before your next --depclean"
+		ewarn "# emerge --noreplace docker-compose:0"
+	fi
+}
diff --git a/app-containers/docker-compose/docker-compose-5.0.1-r2.ebuild b/app-containers/docker-compose/docker-compose-5.0.1-r2.ebuild
new file mode 100644
index 000000000000..95bb06b764dd
--- /dev/null
+++ b/app-containers/docker-compose/docker-compose-5.0.1-r2.ebuild
@@ -0,0 +1,55 @@
+# Copyright 2018-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit eapi9-ver go-module optfeature
+MY_PV=${PV/_/-}
+
+DESCRIPTION="Multi-container orchestration for Docker"
+HOMEPAGE="https://github.com/docker/compose"
+SRC_URI="https://github.com/docker/compose/archive/v${MY_PV}.tar.gz -> ${P}.gh.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+S="${WORKDIR}/compose-${MY_PV}"
+
+LICENSE="Apache-2.0"
+SLOT="2"
+KEYWORDS="amd64 arm64"
+
+RDEPEND="
+|| (
+	>=app-containers/docker-cli-23.0.0
+	app-containers/podman[wrapper(+)]
+)
+"
+BDEPEND=">=dev-lang/go-1.24.7"
+
+RESTRICT="test"
+
+src_compile() {
+	emake VERSION=v${PV}
+}
+
+src_test() {
+	emake test
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe bin/build/docker-compose
+	dodoc README.md
+}
+
+pkg_postinst() {
+	optfeature "credential store support" app-containers/docker-credential-helpers
+
+	if ver_replacing -lt 2; then
+		ewarn
+		ewarn "docker-compose 2.x is a sub command of docker"
+		ewarn "Use 'docker compose' from the command line instead of"
+		ewarn "'docker-compose'"
+		ewarn "If you need to keep 1.x around, please run the following"
+		ewarn "command before your next --depclean"
+		ewarn "# emerge --noreplace docker-compose:0"
+	fi
+}
diff --git a/app-containers/docker-compose/docker-compose-5.1.4-r1.ebuild b/app-containers/docker-compose/docker-compose-5.1.4-r1.ebuild
new file mode 100644
index 000000000000..182562bd89be
--- /dev/null
+++ b/app-containers/docker-compose/docker-compose-5.1.4-r1.ebuild
@@ -0,0 +1,53 @@
+# Copyright 2018-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit eapi9-ver optfeature
+
+DESCRIPTION="Multi-container orchestration for Docker"
+HOMEPAGE="https://github.com/docker/compose"
+SRC_URI="https://github.com/docker/compose/archive/v${PV}.tar.gz -> ${P}.gh.tar.gz"
+SRC_URI+=" https://github.com/gentoo-golang-dist/compose/releases/download/v${PV}/compose-${PV}-vendor.tar.xz"
+S="${WORKDIR}/compose-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="2"
+KEYWORDS="~amd64 ~arm64"
+RESTRICT="test"
+
+RDEPEND="
+	|| (
+		>=app-containers/docker-cli-29.5.2
+		app-containers/podman[wrapper(+)]
+	)
+"
+BDEPEND=">=dev-lang/go-1.25.5"
+
+src_compile() {
+	emake VERSION=v${PV}
+}
+
+src_test() {
+	emake test
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe bin/build/docker-compose
+	dodoc README.md
+}
+
+pkg_postinst() {
+	optfeature "credential store support" app-containers/docker-credential-helpers
+
+	if ver_replacing -lt 2; then
+		ewarn
+		ewarn "docker-compose 2.x is a sub command of docker"
+		ewarn "Use 'docker compose' from the command line instead of"
+		ewarn "'docker-compose'"
+		ewarn "If you need to keep 1.x around, please run the following"
+		ewarn "command before your next --depclean"
+		ewarn "# emerge --noreplace docker-compose:0"
+	fi
+}
diff --git a/app-containers/docker-compose/files/docker-compose-1.29.0-setup-py.patch b/app-containers/docker-compose/files/docker-compose-1.29.0-setup-py.patch
new file mode 100644
index 000000000000..5b42159a1342
--- /dev/null
+++ b/app-containers/docker-compose/files/docker-compose-1.29.0-setup-py.patch
@@ -0,0 +1,66 @@
+From 6829b2c1885b3a0ff758751db2c936ef384d00f9 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Wed, 7 Apr 2021 00:46:38 +0200
+Subject: [PATCH] setup.py: Drop generic upper version boundaries
+
+---
+ setup.py | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/setup.py b/setup.py
+index aaf33f7..74be464 100644
+--- a/setup.py
++++ b/setup.py
+@@ -25,33 +25,33 @@ def find_version(*file_paths):
+ 
+ 
+ install_requires = [
+-    'docopt >= 0.6.1, < 1',
+-    'PyYAML >= 3.10, < 6',
+-    'requests >= 2.20.0, < 3',
+-    'texttable >= 0.9.0, < 2',
+-    'websocket-client >= 0.32.0, < 1',
+-    'distro >= 1.5.0, < 2',
++    'docopt >= 0.6.1',
++    'PyYAML >= 3.10',
++    'requests >= 2.20.0',
++    'texttable >= 0.9.0',
++    'websocket-client >= 0.32.0',
++    'distro >= 1.5.0',
+     'docker[ssh] >= 5',
+-    'dockerpty >= 0.4.1, < 1',
+-    'jsonschema >= 2.5.1, < 4',
+-    'python-dotenv >= 0.13.0, < 1',
++    'dockerpty >= 0.4.1',
++    'jsonschema >= 2.5.1',
++    'python-dotenv >= 0.13.0',
+ ]
+ 
+ 
+ tests_require = [
+-    'ddt >= 1.2.2, < 2',
+-    'pytest < 6',
++    'ddt >= 1.2.2',
++    'pytest',
+ ]
+ 
+ 
+ if sys.version_info[:2] < (3, 4):
+-    tests_require.append('mock >= 1.0.1, < 4')
++    tests_require.append('mock >= 1.0.1')
+ 
+ extras_require = {
+-    ':python_version < "3.5"': ['backports.ssl_match_hostname >= 3.5, < 4'],
+-    ':python_version < "3.8"': ['cached-property >= 1.2.0, < 2'],
+-    ':sys_platform == "win32"': ['colorama >= 0.4, < 1'],
+-    'socks': ['PySocks >= 1.5.6, != 1.5.7, < 2'],
++    ':python_version < "3.5"': ['backports.ssl_match_hostname >= 3.5'],
++    ':python_version < "3.8"': ['cached-property >= 1.2.0'],
++    ':sys_platform == "win32"': ['colorama >= 0.4'],
++    'socks': ['PySocks >= 1.5.6, != 1.5.7'],
+     'tests': tests_require,
+ }
+ 
+-- 
+2.31.1
+
diff --git a/app-containers/docker-compose/files/docker-compose-1.29.2-docker-7.patch b/app-containers/docker-compose/files/docker-compose-1.29.2-docker-7.patch
new file mode 100644
index 000000000000..aafa7a7dddde
--- /dev/null
+++ b/app-containers/docker-compose/files/docker-compose-1.29.2-docker-7.patch
@@ -0,0 +1,36 @@
+From 1e838052b7ccc2a5bb6b674154450a4411de9e15 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Mon, 8 Jan 2024 21:28:27 +0100
+Subject: [PATCH] compose/cli/docker_client.py: Quickfix for
+ >=dev-python/docker-7
+
+Symptom was:
+> # docker-compose build
+> Traceback (most recent call last):
+> [..]
+>   File "[..]/python3.12/site-packages/compose/cli/docker_client.py", line 124, in docker_client
+>     kwargs = kwargs_from_env(environment=environment, ssl_version=tls_version)
+>              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+> TypeError: kwargs_from_env() got an unexpected keyword argument 'ssl_version'
+
+Related: https://stackoverflow.com/a/77638834/11626624
+---
+ compose/cli/docker_client.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/compose/cli/docker_client.py b/compose/cli/docker_client.py
+index e4a0fea..f550e20 100644
+--- a/compose/cli/docker_client.py
++++ b/compose/cli/docker_client.py
+@@ -121,7 +121,7 @@ def docker_client(environment, version=None, context=None, tls_version=None):
+     according to the same logic as the official Docker client.
+     """
+     try:
+-        kwargs = kwargs_from_env(environment=environment, ssl_version=tls_version)
++        kwargs = kwargs_from_env(environment=environment)
+     except TLSParameterError:
+         raise UserError(
+             "TLS configuration is invalid - make sure your DOCKER_TLS_VERIFY "
+-- 
+2.43.0
+
diff --git a/app-containers/docker-compose/files/docker-compose-1.29.2-python-3.13.patch b/app-containers/docker-compose/files/docker-compose-1.29.2-python-3.13.patch
new file mode 100644
index 000000000000..15bcef2d9a07
--- /dev/null
+++ b/app-containers/docker-compose/files/docker-compose-1.29.2-python-3.13.patch
@@ -0,0 +1,35 @@
+From e84ec8f7ed416df359b8e26f86232b5c8c1b41d4 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Fri, 28 Mar 2025 19:42:43 +0100
+Subject: [PATCH] Replace pipes.quote by shlex.quote for Python 3.13
+
+---
+ compose/cli/main.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/compose/cli/main.py b/compose/cli/main.py
+index fabd608..fe6ccc2 100644
+--- a/compose/cli/main.py
++++ b/compose/cli/main.py
+@@ -2,8 +2,8 @@ import contextlib
+ import functools
+ import json
+ import logging
+-import pipes
+ import re
++import shlex
+ import subprocess
+ import sys
+ from distutils.spawn import find_executable
+@@ -1579,7 +1579,7 @@ def call_docker(args, dockeropts, environment):
+         )
+ 
+     args = [executable_path] + tls_options + args
+-    log.debug(" ".join(map(pipes.quote, args)))
++    log.debug(" ".join(map(shlex.quote, args)))
+ 
+     filtered_env = {k: v for k, v in environment.items() if v is not None}
+ 
+-- 
+2.48.1
+
diff --git a/app-containers/docker-compose/files/docker-compose-1.29.2-tests-unit-cli-test-py.patch b/app-containers/docker-compose/files/docker-compose-1.29.2-tests-unit-cli-test-py.patch
new file mode 100644
index 000000000000..0d6cf44c1887
--- /dev/null
+++ b/app-containers/docker-compose/files/docker-compose-1.29.2-tests-unit-cli-test-py.patch
@@ -0,0 +1,33 @@
+From 988f954a7e185c521e7c0f720684e8a53068b136 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Thu, 15 Dec 2022 18:11:03 +0100
+Subject: [PATCH] tests/unit/cli_test.py: Fix access to
+ py._path.local.LocalPath
+
+.. for test CLITestCase.test_default_project_name:
+
+> class CLITestCase(unittest.TestCase):
+>
+>     def test_default_project_name(self):
+>         test_dir = py._path.local.LocalPath('tests/fixtures/simple-composefile')
+>         [..]
+---
+ tests/unit/cli_test.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/unit/cli_test.py b/tests/unit/cli_test.py
+index fa6e767..83ecef8 100644
+--- a/tests/unit/cli_test.py
++++ b/tests/unit/cli_test.py
+@@ -4,7 +4,7 @@ import tempfile
+ from io import StringIO
+ 
+ import docker
+-import py
++import py._path.local
+ import pytest
+ from docker.constants import DEFAULT_DOCKER_API_VERSION
+ 
+-- 
+2.39.0
+
diff --git a/app-containers/docker-compose/files/docker-compose-2.34.0-revert-secrets-file-mode.patch b/app-containers/docker-compose/files/docker-compose-2.34.0-revert-secrets-file-mode.patch
new file mode 100644
index 000000000000..2f42298b7415
--- /dev/null
+++ b/app-containers/docker-compose/files/docker-compose-2.34.0-revert-secrets-file-mode.patch
@@ -0,0 +1,24 @@
+From 9c7ddf217747baf414aea1ef7242b0a219180e39 Mon Sep 17 00:00:00 2001
+From: Suleiman Dibirov <idsulik@gmail.com>
+Date: Tue, 25 Mar 2025 04:23:35 +0200
+Subject: [PATCH] fix(secrets): Reverted secrets file mode 440 -> 444
+
+Signed-off-by: Suleiman Dibirov <idsulik@gmail.com>
+---
+ pkg/compose/secrets.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/pkg/compose/secrets.go b/pkg/compose/secrets.go
+index 2ebaa0e6bb..e8064cca8b 100644
+--- a/pkg/compose/secrets.go
++++ b/pkg/compose/secrets.go
+@@ -110,7 +110,7 @@ func createTar(env string, config types.FileReferenceConfig) (bytes.Buffer, erro
+ 	value := []byte(env)
+ 	b := bytes.Buffer{}
+ 	tarWriter := tar.NewWriter(&b)
+-	mode := types.FileMode(0o440)
++	mode := types.FileMode(0o444)
+ 	if config.Mode != nil {
+ 		mode = *config.Mode
+ 	}
+
diff --git a/app-containers/docker-compose/metadata.xml b/app-containers/docker-compose/metadata.xml
new file mode 100644
index 000000000000..f62571d81c76
--- /dev/null
+++ b/app-containers/docker-compose/metadata.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer restrict="&gt;=app-containers/docker-compose-2" type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+    <description>Version 2.x.x (Golang)</description>
+  </maintainer>
+  <maintainer restrict="&lt;app-containers/docker-compose-2" type="person">
+    <email>sping@gentoo.org</email>
+    <name>Sebastian Pipping</name>
+    <description>Version 1.x.x (Python)</description>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/docker-credential-helpers/Manifest b/app-containers/docker-credential-helpers/Manifest
new file mode 100644
index 000000000000..e93fd1c19939
--- /dev/null
+++ b/app-containers/docker-credential-helpers/Manifest
@@ -0,0 +1,3 @@
+DIST docker-credential-helpers-0.8.2.tar.gz 283816 BLAKE2B 334ca059b619e5e3528864a99b07eea61b98083989aa8e8b619c83d781caad97fbf5f3ed60879adacf27d81e0b991a38567e1fa2bc27b9a772d86b51437a6e03 SHA512 ca04b7fe78871389c9f968b730c18e2aca2d2a818ce87c1f138efb7dafbfdea7b83c2c16504131d04c295428debee2187036e603dba711369b5de1a3993c2e8c
+DIST docker-credential-helpers-0.9.2.tar.gz 295411 BLAKE2B ad0814447c92b37ef16049e06e1f894e5e80c2235a26826f3f154714fed5558fdd2e0a45161e4f9e2cd8e14da39f41f72671aeccceb41009134edb7989faf19d SHA512 12f5445a99cdb1e3d61fb6e629d0c3acfc6111d1f770bf44e7d5f8f0b7a1c9c757076bcd9d1df3ee3ad80a898d4e4768b34008d3085f754665bd47b3b96bc13c
+DIST docker-credential-helpers-0.9.3.tar.gz 295607 BLAKE2B 4b59acf426cba27abe0f024b9479331f967bece8fd97bf3104ffcf17fc3a1f02e8248142177a19325a8941e71e5f26acc5fbdc1daa067e47ca29a98bb60af8c4 SHA512 01f58de113a402319e2695aba140322be13b03d234e2582c438735e178dfb999fa6e15abfcef4431490b2def87e7d1cb27d6ae855d348f30a878caf21d7f9a02
diff --git a/app-containers/docker-credential-helpers/docker-credential-helpers-0.8.2.ebuild b/app-containers/docker-credential-helpers/docker-credential-helpers-0.8.2.ebuild
new file mode 100644
index 000000000000..dfb6fe190584
--- /dev/null
+++ b/app-containers/docker-credential-helpers/docker-credential-helpers-0.8.2.ebuild
@@ -0,0 +1,50 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+DESCRIPTION="Suite of programs to use native stores to keep Docker credentials safe"
+HOMEPAGE="https://github.com/docker/docker-credential-helpers"
+SRC_URI="https://github.com/docker/docker-credential-helpers/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="amd64 arm64"
+
+IUSE="keyring pass"
+REQUIRED_USE="|| ( keyring pass )"
+RESTRICT="test"
+
+DEPEND="keyring? ( app-crypt/libsecret )"
+RDEPEND="${DEPEND}
+	pass? ( app-admin/pass )
+"
+
+src_compile() {
+	local mymakeflags=(
+		VERSION="${PV}"
+		REVISION="v${PV}"
+	)
+	use keyring && mymakeflags+=( secretservice )
+	use pass && mymakeflags+=( pass )
+	emake -j1 "${mymakeflags[@]}"
+}
+
+src_install() {
+	dobin bin/build/*
+	dodoc MAINTAINERS README.md
+}
+
+pkg_postinst() {
+	if use keyring; then
+		elog "For keyring/kwallet add:\n"
+		elog '		"credStore": "secretservice"'"\n"
+	fi
+	if use pass; then
+		elog "For 'pass' add:\n"
+		elog '		"credStore": "pass"'"\n"
+	fi
+	elog "to your ~/.docker/config.json"
+}
diff --git a/app-containers/docker-credential-helpers/docker-credential-helpers-0.9.2.ebuild b/app-containers/docker-credential-helpers/docker-credential-helpers-0.9.2.ebuild
new file mode 100644
index 000000000000..dfb6fe190584
--- /dev/null
+++ b/app-containers/docker-credential-helpers/docker-credential-helpers-0.9.2.ebuild
@@ -0,0 +1,50 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+DESCRIPTION="Suite of programs to use native stores to keep Docker credentials safe"
+HOMEPAGE="https://github.com/docker/docker-credential-helpers"
+SRC_URI="https://github.com/docker/docker-credential-helpers/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="amd64 arm64"
+
+IUSE="keyring pass"
+REQUIRED_USE="|| ( keyring pass )"
+RESTRICT="test"
+
+DEPEND="keyring? ( app-crypt/libsecret )"
+RDEPEND="${DEPEND}
+	pass? ( app-admin/pass )
+"
+
+src_compile() {
+	local mymakeflags=(
+		VERSION="${PV}"
+		REVISION="v${PV}"
+	)
+	use keyring && mymakeflags+=( secretservice )
+	use pass && mymakeflags+=( pass )
+	emake -j1 "${mymakeflags[@]}"
+}
+
+src_install() {
+	dobin bin/build/*
+	dodoc MAINTAINERS README.md
+}
+
+pkg_postinst() {
+	if use keyring; then
+		elog "For keyring/kwallet add:\n"
+		elog '		"credStore": "secretservice"'"\n"
+	fi
+	if use pass; then
+		elog "For 'pass' add:\n"
+		elog '		"credStore": "pass"'"\n"
+	fi
+	elog "to your ~/.docker/config.json"
+}
diff --git a/app-containers/docker-credential-helpers/docker-credential-helpers-0.9.3.ebuild b/app-containers/docker-credential-helpers/docker-credential-helpers-0.9.3.ebuild
new file mode 100644
index 000000000000..dfb6fe190584
--- /dev/null
+++ b/app-containers/docker-credential-helpers/docker-credential-helpers-0.9.3.ebuild
@@ -0,0 +1,50 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+DESCRIPTION="Suite of programs to use native stores to keep Docker credentials safe"
+HOMEPAGE="https://github.com/docker/docker-credential-helpers"
+SRC_URI="https://github.com/docker/docker-credential-helpers/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="amd64 arm64"
+
+IUSE="keyring pass"
+REQUIRED_USE="|| ( keyring pass )"
+RESTRICT="test"
+
+DEPEND="keyring? ( app-crypt/libsecret )"
+RDEPEND="${DEPEND}
+	pass? ( app-admin/pass )
+"
+
+src_compile() {
+	local mymakeflags=(
+		VERSION="${PV}"
+		REVISION="v${PV}"
+	)
+	use keyring && mymakeflags+=( secretservice )
+	use pass && mymakeflags+=( pass )
+	emake -j1 "${mymakeflags[@]}"
+}
+
+src_install() {
+	dobin bin/build/*
+	dodoc MAINTAINERS README.md
+}
+
+pkg_postinst() {
+	if use keyring; then
+		elog "For keyring/kwallet add:\n"
+		elog '		"credStore": "secretservice"'"\n"
+	fi
+	if use pass; then
+		elog "For 'pass' add:\n"
+		elog '		"credStore": "pass"'"\n"
+	fi
+	elog "to your ~/.docker/config.json"
+}
diff --git a/app-containers/docker-credential-helpers/metadata.xml b/app-containers/docker-credential-helpers/metadata.xml
new file mode 100644
index 000000000000..0b0b4b1396a9
--- /dev/null
+++ b/app-containers/docker-credential-helpers/metadata.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <longdescription>
+		A suite of programs to use native stores to keep Docker credentials
+		safe.  Currently provides docker-credential-secretservice to use the
+		D-Bus secret service APIs, and docker-credential-pass to use the
+		pass framework.
+	</longdescription>
+  <maintainer type="person" proxied="yes">
+    <email>rkitover@gmail.com</email>
+    <name>Rafael Kitover</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <use>
+    <flag name="pass">
+			Build pass helper for the pass utility.
+		</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/docker-pushrm/Manifest b/app-containers/docker-pushrm/Manifest
new file mode 100644
index 000000000000..54f1fe3b74b9
--- /dev/null
+++ b/app-containers/docker-pushrm/Manifest
@@ -0,0 +1,2 @@
+DIST docker-pushrm-1.9.0-deps.tar.xz 121551972 BLAKE2B 2798ea5c23cfe300719ec99d1f76746dae379d9ea041e791f6b227c97678c2f0a017c3e4880a62cb6f40511c482997b1da4c4692c7ebad82435edbad30eaea2c SHA512 496f9d059951057f4a3f8d97ef7d50574e9634e29082dae471ce9f7139da40b730db744cbf420ae8da88592d62f4d52b1a24c30b877f1de639f7b5b52f2f6217
+DIST docker-pushrm-1.9.0.tar.gz 211628 BLAKE2B b8b470a97a0580596cfc90ce65ee289e32f49b2cb8a216138f534aac23c21f6007ef5b6d0bc2e9513a6800c7bda22e44ec0bb56ee3e7abe59961f4385928c98a SHA512 c9f3258b9d8660808a55f53ae30eca05d7725cb313a6c46018d7bbfd1feea28a2bfea2153700dfd43a7d4239683eb126f5daa2b29c88467d66620701b0244726
diff --git a/app-containers/docker-pushrm/docker-pushrm-1.9.0.ebuild b/app-containers/docker-pushrm/docker-pushrm-1.9.0.ebuild
new file mode 100644
index 000000000000..76bccc9ef6fc
--- /dev/null
+++ b/app-containers/docker-pushrm/docker-pushrm-1.9.0.ebuild
@@ -0,0 +1,36 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+DESCRIPTION="Docker CLI plugin to update container repository documentation"
+HOMEPAGE="https://github.com/docker/buildx"
+SRC_URI="
+	https://github.com/christian-korneck/${PN}/archive/refs/tags/v${PV}.tar.gz
+		-> ${P}.tar.gz
+	https://dev.gentoo.org/~xgqt/distfiles/deps/${P}-deps.tar.xz
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+RDEPEND="
+	app-containers/docker-cli
+"
+
+src_compile() {
+	local -a go_build_opts=(
+		-o ./bin/
+	)
+	ego build "${go_build_opts[@]}"
+}
+
+src_install() {
+	exeinto /usr/libexec/docker/cli-plugins
+	doexe "bin/${PN}"
+
+	einstalldocs
+}
diff --git a/app-containers/docker-pushrm/metadata.xml b/app-containers/docker-pushrm/metadata.xml
new file mode 100644
index 000000000000..72bff985e70e
--- /dev/null
+++ b/app-containers/docker-pushrm/metadata.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>xgqt@gentoo.org</email>
+    <name>Maciej Barć</name>
+  </maintainer>
+  <upstream>
+    <bugs-to>https://github.com/christian-korneck/docker-pushrm/issues/</bugs-to>
+  </upstream>
+  <longdescription lang="en">
+    docker-pushrm is a Docker CLI plugin that adds a new docker pushrm
+    command to Docker.  It pushes the README file from the current working
+    directory to a container registry server where it appears as repo
+    description in the web interface.  It currently supports Docker Hub, Red
+    Hat Quay and Harbor v2.  For most registry types docker-pushrm uses
+    authentication info from the Docker credentials store - so it "just
+    works" for registry servers that you're already logged into with Docker.
+  </longdescription>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/docker-registry/Manifest b/app-containers/docker-registry/Manifest
new file mode 100644
index 000000000000..5aff53b4192a
--- /dev/null
+++ b/app-containers/docker-registry/Manifest
@@ -0,0 +1,2 @@
+DIST docker-registry-3.0.0_rc2.tar.gz 13978331 BLAKE2B 0890b6128898d3fd036f95032f84641e4394b2ab4fc657116fe8a96e40ceccbc418847fac14f425a2649b9417ff7ae5eff1cea6a02f0eb525f5bc46e5e92edb9 SHA512 8a00939d0f9c1fc49e2d1fc2f8f8ba155e1e39a9bb9c19baeadf4070277a36fac29b11e2fc709c151b884eca7e36d11fa304ae02eea1faccdb29015083828448
+DIST docker-registry-3.0.0_rc3.tar.gz 13985046 BLAKE2B 08956601c9d07f33fd478e7dac11fa4a7ff003ba00b319dfd485ea93e893dfd5064afd82bddbbbe50f6446b34c07587be56acfc25e4b4519ff7ed3f61483c01e SHA512 41883d1b5187fd1ad77cf859e8d28367864c6608021b80ab302510c1e1d9df518653d0d869da61f8f21e73cfca2a69534918d2bddcafbbeda3cb0fcd23825bb7
diff --git a/app-containers/docker-registry/docker-registry-3.0.0_rc2.ebuild b/app-containers/docker-registry/docker-registry-3.0.0_rc2.ebuild
new file mode 100644
index 000000000000..066a7086bef0
--- /dev/null
+++ b/app-containers/docker-registry/docker-registry-3.0.0_rc2.ebuild
@@ -0,0 +1,56 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module systemd
+
+MY_PV=${PV/_rc/-rc.}
+EGIT_COMMIT="4890d9e03616d563083fa944aaa083cc49b54ff5"
+
+DESCRIPTION="Docker Registry 2.0"
+HOMEPAGE="https://github.com/docker/distribution"
+SRC_URI="https://github.com/docker/distribution/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S=${WORKDIR}/distribution-${MY_PV}
+
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 MIT ZLIB"
+SLOT="0"
+KEYWORDS="amd64 ~arm64"
+
+DEPEND="
+	acct-group/registry
+	acct-user/registry
+"
+RDEPEND="${DEPEND}"
+
+src_prepare() {
+	default
+
+	sed -e "s/-s -w/-w/" -i Makefile || die
+
+	# bug 949973
+	sed -e "s/TestHTTPChecker/_&/" -i health/checks/checks_test.go || die
+}
+
+src_compile() {
+	local -x GO_BUILD_FLAGS="-v -mod=vendor"
+	emake VERSION="${MY_PV}" REVISION="${EGIT_COMMIT}" binaries
+}
+
+src_install() {
+	exeinto /usr/libexec/${PN}
+	doexe bin/*
+
+	insinto /etc/docker/registry
+	newins cmd/registry/config-example.yml config.yml.example
+
+	newinitd "${FILESDIR}/registry.initd" registry
+	newconfd "${FILESDIR}/registry.confd" registry
+	systemd_dounit "${FILESDIR}/registry.service"
+
+	keepdir /var/log/registry
+	fowners registry:registry /var/log/registry
+
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}/registry.logrotated" registry
+}
diff --git a/app-containers/docker-registry/docker-registry-3.0.0_rc3.ebuild b/app-containers/docker-registry/docker-registry-3.0.0_rc3.ebuild
new file mode 100644
index 000000000000..138aad6c0d04
--- /dev/null
+++ b/app-containers/docker-registry/docker-registry-3.0.0_rc3.ebuild
@@ -0,0 +1,56 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module systemd
+
+MY_PV=${PV/_rc/-rc.}
+EGIT_COMMIT="51bdcb7bac069f263ce238db6bd0610759c2635f"
+
+DESCRIPTION="Docker Registry 2.0"
+HOMEPAGE="https://github.com/docker/distribution"
+SRC_URI="https://github.com/docker/distribution/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S=${WORKDIR}/distribution-${MY_PV}
+
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 MIT ZLIB"
+SLOT="0"
+KEYWORDS="amd64 ~arm64"
+
+DEPEND="
+	acct-group/registry
+	acct-user/registry
+"
+RDEPEND="${DEPEND}"
+
+src_prepare() {
+	default
+
+	sed -e "s/-s -w/-w/" -i Makefile || die
+
+	# bug 949973
+	sed -e "s/TestHTTPChecker/_&/" -i health/checks/checks_test.go || die
+}
+
+src_compile() {
+	local -x GO_BUILD_FLAGS="-v -mod=vendor"
+	emake VERSION="${MY_PV}" REVISION="${EGIT_COMMIT}" binaries
+}
+
+src_install() {
+	exeinto /usr/libexec/${PN}
+	doexe bin/*
+
+	insinto /etc/docker/registry
+	newins cmd/registry/config-example.yml config.yml.example
+
+	newinitd "${FILESDIR}/registry.initd" registry
+	newconfd "${FILESDIR}/registry.confd" registry
+	systemd_dounit "${FILESDIR}/registry.service"
+
+	keepdir /var/log/registry
+	fowners registry:registry /var/log/registry
+
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}/registry.logrotated" registry
+}
diff --git a/app-containers/docker-registry/files/registry.confd b/app-containers/docker-registry/files/registry.confd
new file mode 100644
index 000000000000..bfa97f127ef1
--- /dev/null
+++ b/app-containers/docker-registry/files/registry.confd
@@ -0,0 +1,2 @@
+# arguments for docker-registry
+command_args="serve /etc/docker/registry/config.yml"
diff --git a/app-containers/docker-registry/files/registry.initd b/app-containers/docker-registry/files/registry.initd
new file mode 100644
index 000000000000..b81303c624d1
--- /dev/null
+++ b/app-containers/docker-registry/files/registry.initd
@@ -0,0 +1,19 @@
+#!/sbin/openrc-run
+# Copyright 2016-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+description="Docker Registry 2.0"
+pidfile=${pidfile:-"/run/${RC_SVCNAME}.pid"}
+user=${user:-${RC_SVCNAME}}
+group=${group:-${RC_SVCNAME}}
+
+command="/usr/libexec/docker-${RC_SVCNAME}/${RC_SVCNAME}"
+command_args="${command_args:-serve /etc/docker/registry/config.yml}"
+command_background="true"
+start_stop_daemon_args="--user ${user} --group ${group} \
+	--stdout /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log \
+	--stderr /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log"
+
+depend() {
+	need net
+}
diff --git a/app-containers/docker-registry/files/registry.logrotated b/app-containers/docker-registry/files/registry.logrotated
new file mode 100644
index 000000000000..3cb63f949a08
--- /dev/null
+++ b/app-containers/docker-registry/files/registry.logrotated
@@ -0,0 +1,7 @@
+/var/log/registry/registry.log {
+	missingok
+	size 5M
+	rotate 3
+	compress
+	copytruncate
+}
diff --git a/app-containers/docker-registry/files/registry.service b/app-containers/docker-registry/files/registry.service
new file mode 100644
index 000000000000..14ff5f9c0b77
--- /dev/null
+++ b/app-containers/docker-registry/files/registry.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=Docker Registry 2.0
+Requires=network-online.target
+After=network-online.target
+
+[Service]
+User=registry
+PrivateDevices=Yes
+Environment="DOCKER_REGISTRY_ARGS=serve /etc/docker/registry/config.yml"
+ExecStart=/usr/libexec/docker-registry/registry $DOCKER_REGISTRY_ARGS
+
+[Install]
+WantedBy=multi-user.target
diff --git a/app-containers/docker-registry/metadata.xml b/app-containers/docker-registry/metadata.xml
new file mode 100644
index 000000000000..70602bb7776b
--- /dev/null
+++ b/app-containers/docker-registry/metadata.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+  </maintainer>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:docker:docker_registry</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/docker-swarm/Manifest b/app-containers/docker-swarm/Manifest
new file mode 100644
index 000000000000..e67d6adbf65b
--- /dev/null
+++ b/app-containers/docker-swarm/Manifest
@@ -0,0 +1 @@
+DIST docker-swarm-1.2.9.tar.gz 1532493 BLAKE2B 243a3cb6d2e9f719d81947429c6616e93cf1b08187685922ad5daf732e61db12bd626fa26f30174af7e779c8ba45ecce7d2cfb33835ef985bdd57657e30e2228 SHA512 cc0e0e27d0ed4845abd99d1554630cc8e2ab0645d40a76358a83b2ea6d1bc5287dbf5d1aefdd2eb4302aeef3894725e75cae3f5da2353b045492a4357631daa2
diff --git a/app-containers/docker-swarm/docker-swarm-1.2.9.ebuild b/app-containers/docker-swarm/docker-swarm-1.2.9.ebuild
new file mode 100644
index 000000000000..5ca267108edf
--- /dev/null
+++ b/app-containers/docker-swarm/docker-swarm-1.2.9.ebuild
@@ -0,0 +1,54 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit go-module
+
+KEYWORDS="~amd64"
+EGO_PN=github.com/docker/swarm
+EGIT_COMMIT="527a849cc6b8297690f478905083fc77951da2a7"
+MY_PN=classicswarm
+SRC_URI="https://github.com/docker/classicswarm/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+DESCRIPTION="Swarm Classic: a container clustering system"
+HOMEPAGE="https://docs.docker.com/swarm"
+LICENSE="Apache-2.0 CC-BY-SA-4.0 BSD BSD-2 ISC MIT MPL-2.0 WTFPL-2"
+SLOT="0"
+IUSE=""
+RESTRICT="test"
+
+S="${WORKDIR}/${MY_PN}-${PV}"
+
+src_prepare() {
+	# It would require internet access to run `go mod vendor`, so
+	# generate approximate go.mod and vendor/modules.txt from the
+	# content of vendor.conf. Use a dummy vendor_version that is
+	# good enough for go to recognize as a valid version.
+	rm -f go.mod vendor/modules.txt || die
+	local x vendor_version=v1.0.0
+	printf -- 'module %s\n' "${EGO_PN}" >> go.mod || die
+	printf -- 'go 1.14\n' >> go.mod || die
+	printf -- 'require (\n' >> go.mod || die
+	while read -r x; do
+		printf -- '\t%s %s\n' "${x}" "${vendor_version}" >> go.mod || die
+		printf -- '# %s %s\n' "${x}" "${vendor_version}" >> vendor/modules.txt || die
+		printf -- '## explicit\n' >> vendor/modules.txt || die
+		printf -- '%s\n' "${x}" >> vendor/modules.txt || die
+	done < <(grep -Eo "^[^#[:space:]]+" vendor.conf)
+	printf -- ')\n' >> go.mod || die
+	default
+}
+
+src_compile() {
+	GOBIN="${S}/bin" \
+		go install -v -work -x -mod=vendor -x \
+		-ldflags "-w -X github.com/docker/swarm/version.GITCOMMIT=${EGIT_COMMIT} \
+		-X github.com/docker/swarm/version.BUILDTIME=$(date -u +%FT%T%z)" \
+		./... || die
+}
+
+src_install() {
+	dobin bin/swarm
+	dosym swarm /usr/bin/docker-swarm
+	dodoc CHANGELOG.md CONTRIBUTING.md logo.png README.md
+}
diff --git a/app-containers/docker-swarm/metadata.xml b/app-containers/docker-swarm/metadata.xml
new file mode 100644
index 000000000000..b5c78a8ab61b
--- /dev/null
+++ b/app-containers/docker-swarm/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/docker/Manifest b/app-containers/docker/Manifest
new file mode 100644
index 000000000000..d3b72581dc0e
--- /dev/null
+++ b/app-containers/docker/Manifest
@@ -0,0 +1,7 @@
+DIST docker-28.0.1.tar.gz 17553228 BLAKE2B 8c172d58fb75d307983ace06b509e86ed533729d75a27af114939cad9022980f692368249f6ef514912aa90f1fa09998fd658377e28d2e2577d53b6f745cf5db SHA512 58c77ae139e5d32c4c263fa14ec4457f50240a15cd7934b4d2576af0295bfb5b62abbeef0ba78815f9041a01dbe3a8b35351eaebea1f584f54ef0d4192734048
+DIST docker-28.0.4.tar.gz 17579330 BLAKE2B 3b1ecb6ddceea0fe772bd597bf6b3c4b5867b691e35bbb0b05ad6ab0c4dc79193dbde02cdcb45c607c0dd704aeaa9629deffb098a0d1533dd3f5e9fb882ef34f SHA512 dfa6bc18c7cecf82c80e45c6a615e0cccb866a993ad2b6c3134e0f0d5d069b5abb0b8201029019a5396353f666252b5fd36b6a34080723af46291d3fda1c2608
+DIST docker-28.1.1.tar.gz 17719438 BLAKE2B 95307e9c03e4c1ad436fffe321f69c269c0fba9fea22c56963b503a051360b9a38170c865e42674ca17adde6690ed14da5039539e7f8d082e1304191d25c9ddb SHA512 15de0a10dc9d60be5c6047a30be5065ee69b9cde938654363cd27d71103057cc78510f546f7b161ba5f0b8b764dc6167e4ffebbcc9e69b171fe49ee1e09e97b2
+DIST docker-28.2.2.tar.gz 17861904 BLAKE2B 6f55e96d653579b749908080550ebee0635549fafd25c775fd59126018820a30f5234c680834a7ece897cb0f38f92f5afe3684d5dbc43694837516528c79f19b SHA512 e63ce38bb7badb01de918f678ad9fb216b279170177fe7d7c4120c8a1196add485cc974f9dff239a274220ebab60a2dc6852f07dc2ddafe8cec07c65dbd19a49
+DIST docker-28.4.0.tar.gz 18066393 BLAKE2B 70c9910bec169994ddd39f46e4a7042e5f38a3b76e8a43389ee934fb7f3c75ae686f32ad7f3cbc0dcff210b5c0eeed24674db0fdf4e845e78c330cf6c2b75918 SHA512 a98f8012547dc1e61e6a4f420355d29fbd6f6ddb5642601d8762099768e0b284fcf129ee31af155049731f61f43ff4efe42313467055dae32337dc5cc8c8cf78
+DIST docker-29.1.3.tar.gz 19491833 BLAKE2B ded1a1832b1ce037776e04855a0ea7c3f45981df41bdace54c3b84496a2990b0450ed62b34a6f3c289dec2643d28a7563c9afba55c88fc0e1cc4fb7855220800 SHA512 e3fa96057beb2849fea6e4fd480b08ffbe9b74b851060901e54e57aa62938888b260b7cef4cee33d4cffd965fabc0db7fc0aa5aeeae9aa6b9870c3dbcf7b6ec3
+DIST docker-29.5.2.tar.gz 21115630 BLAKE2B f47b730a470c0ab4868beb6d4187b9ff34d06ecf4f381f3e89b89e6f9b18b5bf4c9220ee2e0d6977d4b2b0dfddd4fb9f7e171316dcb2935428bfc9ca350dd17f SHA512 c5cbb956711e9ce8dbab010bf1eab3fd9b35e35806188e3030a3bbeafb545f4024504577df7c39588672c8d5252f6ab071bcfd6377867f4668b75855571469fb
diff --git a/app-containers/docker/docker-28.0.1.ebuild b/app-containers/docker/docker-28.0.1.ebuild
new file mode 100644
index 000000000000..df0dfd40bb1e
--- /dev/null
+++ b/app-containers/docker/docker-28.0.1.ebuild
@@ -0,0 +1,334 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+MY_PV=${PV/_/-}
+
+inherit go-module linux-info optfeature systemd toolchain-funcs udev
+
+GIT_COMMIT=bbd0a17ccc67e48d4a69393287b7fcc4f0578683
+
+DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/moby-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs +container-init cuda +overlay2 seccomp selinux systemd"
+
+DEPEND="
+	acct-group/docker
+	>=dev-db/sqlite-3.7.9:3
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
+	seccomp? ( >=sys-libs/libseccomp-2.2.1 )
+	systemd? ( sys-apps/systemd )
+"
+
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
+RDEPEND="
+	${DEPEND}
+	>=net-firewall/iptables-1.4
+	sys-process/procps
+	>=dev-vcs/git-1.7
+	>=app-arch/xz-utils-4.9
+	>=app-containers/containerd-2.0.2[apparmor?,btrfs?,seccomp?]
+	>=app-containers/runc-1.2.3[apparmor?,seccomp?]
+	!app-containers/docker-proxy
+	!<app-containers/docker-cli-${PV}
+	container-init? ( >=sys-process/tini-0.19.0[static] )
+	cuda? ( app-containers/nvidia-container-toolkit )
+	selinux? ( sec-policy/selinux-docker )
+"
+
+# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+# tests require running dockerd as root and downloading containers
+RESTRICT="installsources strip test"
+
+# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
+pkg_setup() {
+	# this is based on "contrib/check-config.sh" from upstream's sources
+	# required features.
+	CONFIG_CHECK="
+		~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
+		~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
+		~KEYS
+		~VETH ~BRIDGE ~BRIDGE_NETFILTER
+		~IP_NF_FILTER ~IP_NF_RAW ~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~NETFILTER_XT_MARK
+		~IP_NF_NAT ~NF_NAT
+		~POSIX_MQUEUE
+	"
+	WARNING_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: is required for bind-mounting /dev/mqueue into containers"
+
+	if kernel_is lt 4 8; then
+		CONFIG_CHECK+="
+			~DEVPTS_MULTIPLE_INSTANCES
+		"
+	fi
+
+	if kernel_is le 5 1; then
+		CONFIG_CHECK+="
+			~NF_NAT_IPV4
+		"
+	fi
+
+	if kernel_is le 5 2; then
+		CONFIG_CHECK+="
+			~NF_NAT_NEEDED
+		"
+	fi
+
+	if kernel_is ge 4 15; then
+		CONFIG_CHECK+="
+			~CGROUP_BPF
+		"
+	fi
+
+	# optional features
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	if use seccomp; then
+		CONFIG_CHECK+="
+			~SECCOMP ~SECCOMP_FILTER
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+			"
+	fi
+
+	if kernel_is le 5 8; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP_ENABLED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NATIVE
+		"
+	if kernel_is lt 5 19; then
+		CONFIG_CHECK+="
+			~LEGACY_VSYSCALL_EMULATE
+			"
+	fi
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NONE
+		"
+	WARNING_LEGACY_VSYSCALL_NONE="CONFIG_LEGACY_VSYSCALL_NONE enabled: \
+		Containers with <=glibc-2.13 will not work"
+
+	if kernel_is le 4 5; then
+		CONFIG_CHECK+="
+			~MEMCG_KMEM
+		"
+	fi
+
+	if kernel_is lt 5; then
+		CONFIG_CHECK+="
+			~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP ~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP ~CGROUP_NET_PRIO
+		~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		"
+
+	if use selinux; then
+		CONFIG_CHECK+="
+			~SECURITY_SELINUX
+			"
+	fi
+
+	if use apparmor; then
+		CONFIG_CHECK+="
+			~SECURITY_APPARMOR
+			"
+	fi
+
+	# if ! is_set EXT4_USE_FOR_EXT2; then
+	#	check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
+	#	if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
+	#		echo "    $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
+	#	fi
+	# fi
+
+	CONFIG_CHECK+="
+		~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
+	"
+
+	# if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
+	#	if is_set EXT4_USE_FOR_EXT2; then
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
+	#	else
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
+	#	fi
+	# fi
+
+	# network drivers
+	CONFIG_CHECK+="
+		~VXLAN ~BRIDGE_VLAN_FILTERING
+		~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH
+		~XFRM ~XFRM_USER ~XFRM_ALGO ~INET_ESP
+	"
+	if kernel_is le 5 3; then
+		CONFIG_CHECK+="
+			~INET_XFRM_MODE_TRANSPORT
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~IPVLAN
+		"
+	CONFIG_CHECK+="
+		~MACVLAN ~DUMMY
+		"
+	CONFIG_CHECK+="
+		~NF_NAT_FTP ~NF_CONNTRACK_FTP ~NF_NAT_TFTP ~NF_CONNTRACK_TFTP
+	"
+
+	# storage drivers
+	if use btrfs; then
+		CONFIG_CHECK+="
+			~BTRFS_FS
+			~BTRFS_FS_POSIX_ACL
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~OVERLAY_FS
+	"
+
+	linux-info_pkg_setup
+}
+
+src_unpack() {
+	default
+	go-module_src_unpack
+	cd "${S}"
+	[[ -f go.mod ]] || ln -s vendor.mod go.mod || die
+	[[ -f go.sum ]] || ln -s vendor.sum go.sum || die
+}
+
+src_compile() {
+	export DOCKER_GITCOMMIT="${GIT_COMMIT}"
+	export VERSION=${PV}
+	tc-export PKG_CONFIG
+
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+
+	# let's set up some optional features :)
+	export DOCKER_BUILDTAGS=''
+	for gd in btrfs overlay2; do
+		if ! use $gd; then
+			DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
+		fi
+	done
+
+	for tag in apparmor seccomp; do
+		if use $tag; then
+			DOCKER_BUILDTAGS+=" $tag"
+		fi
+	done
+
+	export AUTO_GOPATH=1
+	export EXCLUDE_AUTO_BUILDTAG_JOURNALD=$(usex systemd '' 'y')
+	export GO_MD2MAN=/usr/bin/go-md2man
+
+	# build binaries
+	./hack/make.sh dynbinary || die 'dynbinary failed'
+
+	# build man page
+	cd man || die
+	emake || die
+}
+
+src_install() {
+	dosym containerd /usr/bin/docker-containerd
+	dosym containerd-shim-runc-v2 /usr/bin/docker-containerd-shim
+	dosym runc /usr/bin/docker-runc
+	use container-init && dosym tini /usr/bin/docker-init
+	dobin bundles/dynbinary-daemon/dockerd
+	dobin bundles/dynbinary-daemon/docker-proxy
+	for f in dockerd-rootless-setuptool.sh dockerd-rootless.sh; do
+		dosym ../share/docker/contrib/${f} /usr/bin/${f}
+	done
+
+	newinitd contrib/init/openrc/docker.initd docker
+	newconfd contrib/init/openrc/docker.confd docker
+
+	systemd_dounit contrib/init/systemd/docker.{service,socket}
+
+	udev_dorules contrib/udev/*.rules
+
+	dodoc AUTHORS CONTRIBUTING.md NOTICE README.md
+	dodoc -r docs/*
+	doman man/man8/dockerd.8
+
+	# note: intentionally not using "doins" so that we preserve +x bits
+	dodir /usr/share/${PN}/contrib
+	cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
+}
+
+pkg_postinst() {
+	udev_reload
+
+	elog
+	elog "To use Docker, the Docker daemon must be running as root. To automatically"
+	elog "start the Docker daemon at boot:"
+	if systemd_is_booted || has_version sys-apps/systemd; then
+		elog "  systemctl enable docker.service"
+	else
+		elog "  rc-update add docker default"
+	fi
+	elog
+	elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
+	elog '  usermod -aG docker <youruser>'
+	elog
+
+	if has_version sys-fs/zfs; then
+		elog " ZFS storage driver is available"
+		elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
+		elog
+	fi
+
+	optfeature "rootless mode support" sys-apps/shadow
+	optfeature "rootless mode support" sys-apps/rootlesskit
+	optfeature_header "for rootless mode you also need a network stack"
+	optfeature "rootless mode network stack" app-containers/slirp4netns
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/app-containers/docker/docker-28.0.4.ebuild b/app-containers/docker/docker-28.0.4.ebuild
new file mode 100644
index 000000000000..bff285e3e5fa
--- /dev/null
+++ b/app-containers/docker/docker-28.0.4.ebuild
@@ -0,0 +1,334 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+MY_PV=${PV/_/-}
+
+inherit go-module linux-info optfeature systemd toolchain-funcs udev
+
+GIT_COMMIT=6430e49a55babd9b8f4d08e70ecb2b68900770fe
+
+DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/moby-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs +container-init cuda +overlay2 seccomp selinux systemd"
+
+DEPEND="
+	acct-group/docker
+	>=dev-db/sqlite-3.7.9:3
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
+	seccomp? ( >=sys-libs/libseccomp-2.2.1 )
+	systemd? ( sys-apps/systemd )
+"
+
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
+RDEPEND="
+	${DEPEND}
+	>=net-firewall/iptables-1.4
+	sys-process/procps
+	>=dev-vcs/git-1.7
+	>=app-arch/xz-utils-4.9
+	>=app-containers/containerd-2.0.4[apparmor?,btrfs?,seccomp?]
+	>=app-containers/runc-1.2.5[apparmor?,seccomp?]
+	!app-containers/docker-proxy
+	!<app-containers/docker-cli-${PV}
+	container-init? ( >=sys-process/tini-0.19.0[static] )
+	cuda? ( app-containers/nvidia-container-toolkit )
+	selinux? ( sec-policy/selinux-docker )
+"
+
+# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+# tests require running dockerd as root and downloading containers
+RESTRICT="installsources strip test"
+
+# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
+pkg_setup() {
+	# this is based on "contrib/check-config.sh" from upstream's sources
+	# required features.
+	CONFIG_CHECK="
+		~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
+		~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
+		~KEYS
+		~VETH ~BRIDGE ~BRIDGE_NETFILTER
+		~IP_NF_FILTER ~IP_NF_RAW ~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~NETFILTER_XT_MARK
+		~IP_NF_NAT ~NF_NAT
+		~POSIX_MQUEUE
+	"
+	WARNING_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: is required for bind-mounting /dev/mqueue into containers"
+
+	if kernel_is lt 4 8; then
+		CONFIG_CHECK+="
+			~DEVPTS_MULTIPLE_INSTANCES
+		"
+	fi
+
+	if kernel_is le 5 1; then
+		CONFIG_CHECK+="
+			~NF_NAT_IPV4
+		"
+	fi
+
+	if kernel_is le 5 2; then
+		CONFIG_CHECK+="
+			~NF_NAT_NEEDED
+		"
+	fi
+
+	if kernel_is ge 4 15; then
+		CONFIG_CHECK+="
+			~CGROUP_BPF
+		"
+	fi
+
+	# optional features
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	if use seccomp; then
+		CONFIG_CHECK+="
+			~SECCOMP ~SECCOMP_FILTER
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+		"
+	fi
+
+	if kernel_is le 5 8; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP_ENABLED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NATIVE
+	"
+	if kernel_is lt 5 19; then
+		CONFIG_CHECK+="
+			~LEGACY_VSYSCALL_EMULATE
+		"
+	fi
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NONE
+	"
+	WARNING_LEGACY_VSYSCALL_NONE="CONFIG_LEGACY_VSYSCALL_NONE enabled: \
+		Containers with <=glibc-2.13 will not work"
+
+	if kernel_is le 4 5; then
+		CONFIG_CHECK+="
+			~MEMCG_KMEM
+		"
+	fi
+
+	if kernel_is lt 5; then
+		CONFIG_CHECK+="
+			~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP ~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP ~CGROUP_NET_PRIO
+		~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+	"
+
+	if use selinux; then
+		CONFIG_CHECK+="
+			~SECURITY_SELINUX
+		"
+	fi
+
+	if use apparmor; then
+		CONFIG_CHECK+="
+			~SECURITY_APPARMOR
+		"
+	fi
+
+	# if ! is_set EXT4_USE_FOR_EXT2; then
+	#	check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
+	#	if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
+	#		echo "    $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
+	#	fi
+	# fi
+
+	CONFIG_CHECK+="
+		~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
+	"
+
+	# if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
+	#	if is_set EXT4_USE_FOR_EXT2; then
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
+	#	else
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
+	#	fi
+	# fi
+
+	# network drivers
+	CONFIG_CHECK+="
+		~VXLAN ~BRIDGE_VLAN_FILTERING
+		~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH
+		~XFRM ~XFRM_USER ~XFRM_ALGO ~INET_ESP
+	"
+	if kernel_is le 5 3; then
+		CONFIG_CHECK+="
+			~INET_XFRM_MODE_TRANSPORT
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~IPVLAN
+	"
+	CONFIG_CHECK+="
+		~MACVLAN ~DUMMY
+	"
+	CONFIG_CHECK+="
+		~NF_NAT_FTP ~NF_CONNTRACK_FTP ~NF_NAT_TFTP ~NF_CONNTRACK_TFTP
+	"
+
+	# storage drivers
+	if use btrfs; then
+		CONFIG_CHECK+="
+			~BTRFS_FS
+			~BTRFS_FS_POSIX_ACL
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~OVERLAY_FS
+	"
+
+	linux-info_pkg_setup
+}
+
+src_unpack() {
+	default
+	go-module_src_unpack
+	cd "${S}"
+	[[ -f go.mod ]] || ln -s vendor.mod go.mod || die
+	[[ -f go.sum ]] || ln -s vendor.sum go.sum || die
+}
+
+src_compile() {
+	export DOCKER_GITCOMMIT="${GIT_COMMIT}"
+	export VERSION=${PV}
+	tc-export PKG_CONFIG
+
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+
+	# let's set up some optional features :)
+	export DOCKER_BUILDTAGS=''
+	for gd in btrfs overlay2; do
+		if ! use $gd; then
+			DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
+		fi
+	done
+
+	for tag in apparmor seccomp; do
+		if use $tag; then
+			DOCKER_BUILDTAGS+=" $tag"
+		fi
+	done
+
+	export AUTO_GOPATH=1
+	export EXCLUDE_AUTO_BUILDTAG_JOURNALD=$(usex systemd '' 'y')
+	export GO_MD2MAN=/usr/bin/go-md2man
+
+	# build binaries
+	./hack/make.sh dynbinary || die 'dynbinary failed'
+
+	# build man page
+	cd man || die
+	emake || die
+}
+
+src_install() {
+	dosym containerd /usr/bin/docker-containerd
+	dosym containerd-shim-runc-v2 /usr/bin/docker-containerd-shim
+	dosym runc /usr/bin/docker-runc
+	use container-init && dosym tini /usr/bin/docker-init
+	dobin bundles/dynbinary-daemon/dockerd
+	dobin bundles/dynbinary-daemon/docker-proxy
+	for f in dockerd-rootless-setuptool.sh dockerd-rootless.sh; do
+		dosym ../share/docker/contrib/${f} /usr/bin/${f}
+	done
+
+	newinitd contrib/init/openrc/docker.initd docker
+	newconfd contrib/init/openrc/docker.confd docker
+
+	systemd_dounit contrib/init/systemd/docker.{service,socket}
+
+	udev_dorules contrib/udev/*.rules
+
+	dodoc AUTHORS CONTRIBUTING.md NOTICE README.md
+	dodoc -r docs/*
+	doman man/man8/dockerd.8
+
+	# note: intentionally not using "doins" so that we preserve +x bits
+	dodir /usr/share/${PN}/contrib
+	cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
+}
+
+pkg_postinst() {
+	udev_reload
+
+	elog
+	elog "To use Docker, the Docker daemon must be running as root. To automatically"
+	elog "start the Docker daemon at boot:"
+	if systemd_is_booted || has_version sys-apps/systemd; then
+		elog "  systemctl enable docker.service"
+	else
+		elog "  rc-update add docker default"
+	fi
+	elog
+	elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
+	elog '  usermod -aG docker <youruser>'
+	elog
+
+	if has_version sys-fs/zfs; then
+		elog " ZFS storage driver is available"
+		elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
+		elog
+	fi
+
+	optfeature "rootless mode support" sys-apps/shadow
+	optfeature "rootless mode support" sys-apps/rootlesskit
+	optfeature_header "for rootless mode you also need a network stack"
+	optfeature "rootless mode network stack" app-containers/slirp4netns
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/app-containers/docker/docker-28.1.1.ebuild b/app-containers/docker/docker-28.1.1.ebuild
new file mode 100644
index 000000000000..8de456bb7bc2
--- /dev/null
+++ b/app-containers/docker/docker-28.1.1.ebuild
@@ -0,0 +1,334 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+MY_PV=${PV/_/-}
+
+inherit go-module linux-info optfeature systemd toolchain-funcs udev
+
+GIT_COMMIT=01f442b84d6a669c1e335b800d4670997cd5aa93
+
+DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/moby-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs +container-init cuda +overlay2 seccomp selinux systemd"
+
+DEPEND="
+	acct-group/docker
+	>=dev-db/sqlite-3.7.9:3
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
+	seccomp? ( >=sys-libs/libseccomp-2.2.1 )
+	systemd? ( sys-apps/systemd )
+"
+
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
+RDEPEND="
+	${DEPEND}
+	>=net-firewall/iptables-1.4
+	sys-process/procps
+	>=dev-vcs/git-1.7
+	>=app-arch/xz-utils-4.9
+	>=app-containers/containerd-2.0.5[apparmor?,btrfs?,seccomp?]
+	>=app-containers/runc-1.2.5[apparmor?,seccomp?]
+	!app-containers/docker-proxy
+	!<app-containers/docker-cli-${PV}
+	container-init? ( >=sys-process/tini-0.19.0[static] )
+	cuda? ( app-containers/nvidia-container-toolkit )
+	selinux? ( sec-policy/selinux-docker )
+"
+
+# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+# tests require running dockerd as root and downloading containers
+RESTRICT="installsources strip test"
+
+# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
+pkg_setup() {
+	# this is based on "contrib/check-config.sh" from upstream's sources
+	# required features.
+	CONFIG_CHECK="
+		~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
+		~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
+		~KEYS
+		~VETH ~BRIDGE ~BRIDGE_NETFILTER
+		~IP_NF_FILTER ~IP_NF_RAW ~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~NETFILTER_XT_MARK
+		~IP_NF_NAT ~NF_NAT
+		~POSIX_MQUEUE
+	"
+	WARNING_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: is required for bind-mounting /dev/mqueue into containers"
+
+	if kernel_is lt 4 8; then
+		CONFIG_CHECK+="
+			~DEVPTS_MULTIPLE_INSTANCES
+		"
+	fi
+
+	if kernel_is le 5 1; then
+		CONFIG_CHECK+="
+			~NF_NAT_IPV4
+		"
+	fi
+
+	if kernel_is le 5 2; then
+		CONFIG_CHECK+="
+			~NF_NAT_NEEDED
+		"
+	fi
+
+	if kernel_is ge 4 15; then
+		CONFIG_CHECK+="
+			~CGROUP_BPF
+		"
+	fi
+
+	# optional features
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	if use seccomp; then
+		CONFIG_CHECK+="
+			~SECCOMP ~SECCOMP_FILTER
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+			"
+	fi
+
+	if kernel_is le 5 8; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP_ENABLED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NATIVE
+		"
+	if kernel_is lt 5 19; then
+		CONFIG_CHECK+="
+			~LEGACY_VSYSCALL_EMULATE
+			"
+	fi
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NONE
+		"
+	WARNING_LEGACY_VSYSCALL_NONE="CONFIG_LEGACY_VSYSCALL_NONE enabled: \
+		Containers with <=glibc-2.13 will not work"
+
+	if kernel_is le 4 5; then
+		CONFIG_CHECK+="
+			~MEMCG_KMEM
+		"
+	fi
+
+	if kernel_is lt 5; then
+		CONFIG_CHECK+="
+			~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP ~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP ~CGROUP_NET_PRIO
+		~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		"
+
+	if use selinux; then
+		CONFIG_CHECK+="
+			~SECURITY_SELINUX
+			"
+	fi
+
+	if use apparmor; then
+		CONFIG_CHECK+="
+			~SECURITY_APPARMOR
+			"
+	fi
+
+	# if ! is_set EXT4_USE_FOR_EXT2; then
+	#	check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
+	#	if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
+	#		echo "    $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
+	#	fi
+	# fi
+
+	CONFIG_CHECK+="
+		~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
+	"
+
+	# if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
+	#	if is_set EXT4_USE_FOR_EXT2; then
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
+	#	else
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
+	#	fi
+	# fi
+
+	# network drivers
+	CONFIG_CHECK+="
+		~VXLAN ~BRIDGE_VLAN_FILTERING
+		~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH
+		~XFRM ~XFRM_USER ~XFRM_ALGO ~INET_ESP
+	"
+	if kernel_is le 5 3; then
+		CONFIG_CHECK+="
+			~INET_XFRM_MODE_TRANSPORT
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~IPVLAN
+		"
+	CONFIG_CHECK+="
+		~MACVLAN ~DUMMY
+		"
+	CONFIG_CHECK+="
+		~NF_NAT_FTP ~NF_CONNTRACK_FTP ~NF_NAT_TFTP ~NF_CONNTRACK_TFTP
+	"
+
+	# storage drivers
+	if use btrfs; then
+		CONFIG_CHECK+="
+			~BTRFS_FS
+			~BTRFS_FS_POSIX_ACL
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~OVERLAY_FS
+	"
+
+	linux-info_pkg_setup
+}
+
+src_unpack() {
+	default
+	go-module_src_unpack
+	cd "${S}"
+	[[ -f go.mod ]] || ln -s vendor.mod go.mod || die
+	[[ -f go.sum ]] || ln -s vendor.sum go.sum || die
+}
+
+src_compile() {
+	export DOCKER_GITCOMMIT="${GIT_COMMIT}"
+	export VERSION=${PV}
+	tc-export PKG_CONFIG
+
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+
+	# let's set up some optional features :)
+	export DOCKER_BUILDTAGS=''
+	for gd in btrfs overlay2; do
+		if ! use $gd; then
+			DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
+		fi
+	done
+
+	for tag in apparmor seccomp; do
+		if use $tag; then
+			DOCKER_BUILDTAGS+=" $tag"
+		fi
+	done
+
+	export AUTO_GOPATH=1
+	export EXCLUDE_AUTO_BUILDTAG_JOURNALD=$(usex systemd '' 'y')
+	export GO_MD2MAN=/usr/bin/go-md2man
+
+	# build binaries
+	./hack/make.sh dynbinary || die 'dynbinary failed'
+
+	# build man page
+	cd man || die
+	emake || die
+}
+
+src_install() {
+	dosym containerd /usr/bin/docker-containerd
+	dosym containerd-shim-runc-v2 /usr/bin/docker-containerd-shim
+	dosym runc /usr/bin/docker-runc
+	use container-init && dosym tini /usr/bin/docker-init
+	dobin bundles/dynbinary-daemon/dockerd
+	dobin bundles/dynbinary-daemon/docker-proxy
+	for f in dockerd-rootless-setuptool.sh dockerd-rootless.sh; do
+		dosym ../share/docker/contrib/${f} /usr/bin/${f}
+	done
+
+	newinitd contrib/init/openrc/docker.initd docker
+	newconfd contrib/init/openrc/docker.confd docker
+
+	systemd_dounit contrib/init/systemd/docker.{service,socket}
+
+	udev_dorules contrib/udev/*.rules
+
+	dodoc AUTHORS CONTRIBUTING.md NOTICE README.md
+	dodoc -r docs/*
+	doman man/man8/dockerd.8
+
+	# note: intentionally not using "doins" so that we preserve +x bits
+	dodir /usr/share/${PN}/contrib
+	cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
+}
+
+pkg_postinst() {
+	udev_reload
+
+	elog
+	elog "To use Docker, the Docker daemon must be running as root. To automatically"
+	elog "start the Docker daemon at boot:"
+	if systemd_is_booted || has_version sys-apps/systemd; then
+		elog "  systemctl enable docker.service"
+	else
+		elog "  rc-update add docker default"
+	fi
+	elog
+	elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
+	elog '  usermod -aG docker <youruser>'
+	elog
+
+	if has_version sys-fs/zfs; then
+		elog " ZFS storage driver is available"
+		elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
+		elog
+	fi
+
+	optfeature "rootless mode support" sys-apps/shadow
+	optfeature "rootless mode support" sys-apps/rootlesskit
+	optfeature_header "for rootless mode you also need a network stack"
+	optfeature "rootless mode network stack" app-containers/slirp4netns
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/app-containers/docker/docker-28.2.2.ebuild b/app-containers/docker/docker-28.2.2.ebuild
new file mode 100644
index 000000000000..b53064922478
--- /dev/null
+++ b/app-containers/docker/docker-28.2.2.ebuild
@@ -0,0 +1,334 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+MY_PV=${PV/_/-}
+
+inherit go-module linux-info optfeature systemd toolchain-funcs udev
+
+GIT_COMMIT=45873be4ae3f5488c9498b3d9f17deaddaf609f4
+
+DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/moby-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs +container-init cuda +overlay2 seccomp selinux systemd"
+
+DEPEND="
+	acct-group/docker
+	>=dev-db/sqlite-3.7.9:3
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
+	seccomp? ( >=sys-libs/libseccomp-2.2.1 )
+	systemd? ( sys-apps/systemd )
+"
+
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
+RDEPEND="
+	${DEPEND}
+	>=net-firewall/iptables-1.4
+	sys-process/procps
+	>=dev-vcs/git-1.7
+	>=app-arch/xz-utils-4.9
+	>=app-containers/containerd-1.7.27[apparmor?,btrfs?,seccomp?]
+	>=app-containers/runc-1.2.6[apparmor?,seccomp?]
+	!app-containers/docker-proxy
+	!<app-containers/docker-cli-${PV}
+	container-init? ( >=sys-process/tini-0.19.0[static] )
+	cuda? ( app-containers/nvidia-container-toolkit )
+	selinux? ( sec-policy/selinux-docker )
+"
+
+# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+# tests require running dockerd as root and downloading containers
+RESTRICT="installsources strip test"
+
+# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
+pkg_setup() {
+	# this is based on "contrib/check-config.sh" from upstream's sources
+	# required features.
+	CONFIG_CHECK="
+		~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
+		~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
+		~KEYS
+		~VETH ~BRIDGE ~BRIDGE_NETFILTER
+		~IP_NF_FILTER ~IP_NF_RAW ~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~NETFILTER_XT_MARK
+		~IP_NF_NAT ~NF_NAT
+		~POSIX_MQUEUE
+	"
+	WARNING_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: is required for bind-mounting /dev/mqueue into containers"
+
+	if kernel_is lt 4 8; then
+		CONFIG_CHECK+="
+			~DEVPTS_MULTIPLE_INSTANCES
+		"
+	fi
+
+	if kernel_is le 5 1; then
+		CONFIG_CHECK+="
+			~NF_NAT_IPV4
+		"
+	fi
+
+	if kernel_is le 5 2; then
+		CONFIG_CHECK+="
+			~NF_NAT_NEEDED
+		"
+	fi
+
+	if kernel_is ge 4 15; then
+		CONFIG_CHECK+="
+			~CGROUP_BPF
+		"
+	fi
+
+	# optional features
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	if use seccomp; then
+		CONFIG_CHECK+="
+			~SECCOMP ~SECCOMP_FILTER
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+			"
+	fi
+
+	if kernel_is le 5 8; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP_ENABLED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NATIVE
+		"
+	if kernel_is lt 5 19; then
+		CONFIG_CHECK+="
+			~LEGACY_VSYSCALL_EMULATE
+			"
+	fi
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NONE
+		"
+	WARNING_LEGACY_VSYSCALL_NONE="CONFIG_LEGACY_VSYSCALL_NONE enabled: \
+		Containers with <=glibc-2.13 will not work"
+
+	if kernel_is le 4 5; then
+		CONFIG_CHECK+="
+			~MEMCG_KMEM
+		"
+	fi
+
+	if kernel_is lt 5; then
+		CONFIG_CHECK+="
+			~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP ~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP ~CGROUP_NET_PRIO
+		~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		"
+
+	if use selinux; then
+		CONFIG_CHECK+="
+			~SECURITY_SELINUX
+			"
+	fi
+
+	if use apparmor; then
+		CONFIG_CHECK+="
+			~SECURITY_APPARMOR
+			"
+	fi
+
+	# if ! is_set EXT4_USE_FOR_EXT2; then
+	#	check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
+	#	if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
+	#		echo "    $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
+	#	fi
+	# fi
+
+	CONFIG_CHECK+="
+		~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
+	"
+
+	# if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
+	#	if is_set EXT4_USE_FOR_EXT2; then
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
+	#	else
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
+	#	fi
+	# fi
+
+	# network drivers
+	CONFIG_CHECK+="
+		~VXLAN ~BRIDGE_VLAN_FILTERING
+		~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH
+		~XFRM ~XFRM_USER ~XFRM_ALGO ~INET_ESP
+	"
+	if kernel_is le 5 3; then
+		CONFIG_CHECK+="
+			~INET_XFRM_MODE_TRANSPORT
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~IPVLAN
+		"
+	CONFIG_CHECK+="
+		~MACVLAN ~DUMMY
+		"
+	CONFIG_CHECK+="
+		~NF_NAT_FTP ~NF_CONNTRACK_FTP ~NF_NAT_TFTP ~NF_CONNTRACK_TFTP
+	"
+
+	# storage drivers
+	if use btrfs; then
+		CONFIG_CHECK+="
+			~BTRFS_FS
+			~BTRFS_FS_POSIX_ACL
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~OVERLAY_FS
+	"
+
+	linux-info_pkg_setup
+}
+
+src_unpack() {
+	default
+	go-module_src_unpack
+	cd "${S}"
+	[[ -f go.mod ]] || ln -s vendor.mod go.mod || die
+	[[ -f go.sum ]] || ln -s vendor.sum go.sum || die
+}
+
+src_compile() {
+	export DOCKER_GITCOMMIT="${GIT_COMMIT}"
+	export VERSION=${PV}
+	tc-export PKG_CONFIG
+
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+
+	# let's set up some optional features :)
+	export DOCKER_BUILDTAGS=''
+	for gd in btrfs overlay2; do
+		if ! use $gd; then
+			DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
+		fi
+	done
+
+	for tag in apparmor seccomp; do
+		if use $tag; then
+			DOCKER_BUILDTAGS+=" $tag"
+		fi
+	done
+
+	export AUTO_GOPATH=1
+	export EXCLUDE_AUTO_BUILDTAG_JOURNALD=$(usex systemd '' 'y')
+	export GO_MD2MAN=/usr/bin/go-md2man
+
+	# build binaries
+	./hack/make.sh dynbinary || die 'dynbinary failed'
+
+	# build man page
+	cd man || die
+	emake || die
+}
+
+src_install() {
+	dosym containerd /usr/bin/docker-containerd
+	dosym containerd-shim-runc-v2 /usr/bin/docker-containerd-shim
+	dosym runc /usr/bin/docker-runc
+	use container-init && dosym tini /usr/bin/docker-init
+	dobin bundles/dynbinary-daemon/dockerd
+	dobin bundles/dynbinary-daemon/docker-proxy
+	for f in dockerd-rootless-setuptool.sh dockerd-rootless.sh; do
+		dosym ../share/docker/contrib/${f} /usr/bin/${f}
+	done
+
+	newinitd contrib/init/openrc/docker.initd docker
+	newconfd contrib/init/openrc/docker.confd docker
+
+	systemd_dounit contrib/init/systemd/docker.{service,socket}
+
+	udev_dorules contrib/udev/*.rules
+
+	dodoc AUTHORS CONTRIBUTING.md NOTICE README.md
+	dodoc -r docs/*
+	doman man/man8/dockerd.8
+
+	# note: intentionally not using "doins" so that we preserve +x bits
+	dodir /usr/share/${PN}/contrib
+	cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
+}
+
+pkg_postinst() {
+	udev_reload
+
+	elog
+	elog "To use Docker, the Docker daemon must be running as root. To automatically"
+	elog "start the Docker daemon at boot:"
+	if systemd_is_booted || has_version sys-apps/systemd; then
+		elog "  systemctl enable docker.service"
+	else
+		elog "  rc-update add docker default"
+	fi
+	elog
+	elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
+	elog '  usermod -aG docker <youruser>'
+	elog
+
+	if has_version sys-fs/zfs; then
+		elog " ZFS storage driver is available"
+		elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
+		elog
+	fi
+
+	optfeature "rootless mode support" sys-apps/shadow
+	optfeature "rootless mode support" sys-apps/rootlesskit
+	optfeature_header "for rootless mode you also need a network stack"
+	optfeature "rootless mode network stack" app-containers/slirp4netns
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/app-containers/docker/docker-28.4.0.ebuild b/app-containers/docker/docker-28.4.0.ebuild
new file mode 100644
index 000000000000..8b62ad787d37
--- /dev/null
+++ b/app-containers/docker/docker-28.4.0.ebuild
@@ -0,0 +1,341 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+MY_PV=${PV/_/-}
+
+inherit go-module linux-info optfeature systemd toolchain-funcs udev
+
+GIT_COMMIT=249d679a6baf8a32bb6d72d6ac5cc7ab9c90b4ea
+
+DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/moby-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs +container-init cuda +overlay2 seccomp selinux systemd"
+
+DEPEND="
+	acct-group/docker
+	>=dev-db/sqlite-3.7.9:3
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
+	seccomp? ( >=sys-libs/libseccomp-2.2.1 )
+	systemd? ( sys-apps/systemd )
+"
+
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
+RDEPEND="
+	${DEPEND}
+	>=net-firewall/iptables-1.4
+	sys-process/procps
+	>=dev-vcs/git-1.7
+	>=app-arch/xz-utils-4.9
+	>=app-containers/containerd-2.1.4[apparmor?,btrfs?,seccomp?]
+	>=app-containers/runc-1.2.6[apparmor?,seccomp?]
+	!app-containers/docker-proxy
+	!<app-containers/docker-cli-${PV}
+	container-init? ( >=sys-process/tini-0.19.0[static] )
+	cuda? ( app-containers/nvidia-container-toolkit )
+	selinux? ( sec-policy/selinux-docker )
+"
+
+# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+# tests require running dockerd as root and downloading containers
+RESTRICT="installsources strip test"
+
+# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
+pkg_setup() {
+	# this is based on "contrib/check-config.sh" from upstream's sources
+	# required features.
+	CONFIG_CHECK="
+		~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
+		~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
+		~KEYS
+		~VETH ~BRIDGE ~BRIDGE_NETFILTER
+		~IP_NF_FILTER ~IP_NF_RAW ~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~NETFILTER_XT_MARK
+		~IP_NF_NAT ~NF_NAT
+		~POSIX_MQUEUE
+	"
+	WARNING_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: is required for bind-mounting /dev/mqueue into containers"
+
+	if kernel_is ge 6 17; then
+		CONFIG_CHECK+="
+			~IP_NF_IPTABLES_LEGACY
+			~NETFILTER_XTABLES_LEGACY
+		"
+	fi
+
+	if kernel_is lt 4 8; then
+		CONFIG_CHECK+="
+			~DEVPTS_MULTIPLE_INSTANCES
+		"
+	fi
+
+	if kernel_is le 5 1; then
+		CONFIG_CHECK+="
+			~NF_NAT_IPV4
+		"
+	fi
+
+	if kernel_is le 5 2; then
+		CONFIG_CHECK+="
+			~NF_NAT_NEEDED
+		"
+	fi
+
+	if kernel_is ge 4 15; then
+		CONFIG_CHECK+="
+			~CGROUP_BPF
+		"
+	fi
+
+	# optional features
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	if use seccomp; then
+		CONFIG_CHECK+="
+			~SECCOMP ~SECCOMP_FILTER
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+			"
+	fi
+
+	if kernel_is le 5 8; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP_ENABLED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NATIVE
+		"
+	if kernel_is lt 5 19; then
+		CONFIG_CHECK+="
+			~LEGACY_VSYSCALL_EMULATE
+			"
+	fi
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NONE
+		"
+	WARNING_LEGACY_VSYSCALL_NONE="CONFIG_LEGACY_VSYSCALL_NONE enabled: \
+		Containers with <=glibc-2.13 will not work"
+
+	if kernel_is le 4 5; then
+		CONFIG_CHECK+="
+			~MEMCG_KMEM
+		"
+	fi
+
+	if kernel_is lt 5; then
+		CONFIG_CHECK+="
+			~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP ~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP ~CGROUP_NET_PRIO
+		~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		"
+
+	if use selinux; then
+		CONFIG_CHECK+="
+			~SECURITY_SELINUX
+			"
+	fi
+
+	if use apparmor; then
+		CONFIG_CHECK+="
+			~SECURITY_APPARMOR
+			"
+	fi
+
+	# if ! is_set EXT4_USE_FOR_EXT2; then
+	#	check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
+	#	if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
+	#		echo "    $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
+	#	fi
+	# fi
+
+	CONFIG_CHECK+="
+		~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
+	"
+
+	# if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
+	#	if is_set EXT4_USE_FOR_EXT2; then
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
+	#	else
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
+	#	fi
+	# fi
+
+	# network drivers
+	CONFIG_CHECK+="
+		~VXLAN ~BRIDGE_VLAN_FILTERING
+		~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH
+		~XFRM ~XFRM_USER ~XFRM_ALGO ~INET_ESP
+	"
+	if kernel_is le 5 3; then
+		CONFIG_CHECK+="
+			~INET_XFRM_MODE_TRANSPORT
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~IPVLAN
+		"
+	CONFIG_CHECK+="
+		~MACVLAN ~DUMMY
+		"
+	CONFIG_CHECK+="
+		~NF_NAT_FTP ~NF_CONNTRACK_FTP ~NF_NAT_TFTP ~NF_CONNTRACK_TFTP
+	"
+
+	# storage drivers
+	if use btrfs; then
+		CONFIG_CHECK+="
+			~BTRFS_FS
+			~BTRFS_FS_POSIX_ACL
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~OVERLAY_FS
+	"
+
+	linux-info_pkg_setup
+}
+
+src_unpack() {
+	default
+	go-module_src_unpack
+	cd "${S}"
+	[[ -f go.mod ]] || ln -s vendor.mod go.mod || die
+	[[ -f go.sum ]] || ln -s vendor.sum go.sum || die
+}
+
+src_compile() {
+	export DOCKER_GITCOMMIT="${GIT_COMMIT}"
+	export VERSION=${PV}
+	tc-export PKG_CONFIG
+
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+
+	# let's set up some optional features :)
+	export DOCKER_BUILDTAGS=''
+	for gd in btrfs overlay2; do
+		if ! use $gd; then
+			DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
+		fi
+	done
+
+	for tag in apparmor seccomp; do
+		if use $tag; then
+			DOCKER_BUILDTAGS+=" $tag"
+		fi
+	done
+
+	export AUTO_GOPATH=1
+	export EXCLUDE_AUTO_BUILDTAG_JOURNALD=$(usex systemd '' 'y')
+	export GO_MD2MAN=/usr/bin/go-md2man
+
+	# build binaries
+	./hack/make.sh dynbinary || die 'dynbinary failed'
+
+	# build man page
+	cd man || die
+	emake || die
+}
+
+src_install() {
+	dosym containerd /usr/bin/docker-containerd
+	dosym containerd-shim-runc-v2 /usr/bin/docker-containerd-shim
+	dosym runc /usr/bin/docker-runc
+	use container-init && dosym tini /usr/bin/docker-init
+	dobin bundles/dynbinary-daemon/dockerd
+	dobin bundles/dynbinary-daemon/docker-proxy
+	for f in dockerd-rootless-setuptool.sh dockerd-rootless.sh; do
+		dosym ../share/docker/contrib/${f} /usr/bin/${f}
+	done
+
+	newinitd contrib/init/openrc/docker.initd docker
+	newconfd contrib/init/openrc/docker.confd docker
+
+	systemd_dounit contrib/init/systemd/docker.{service,socket}
+
+	udev_dorules contrib/udev/*.rules
+
+	dodoc AUTHORS CONTRIBUTING.md NOTICE README.md
+	dodoc -r docs/*
+	doman man/man8/dockerd.8
+
+	# note: intentionally not using "doins" so that we preserve +x bits
+	dodir /usr/share/${PN}/contrib
+	cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
+}
+
+pkg_postinst() {
+	udev_reload
+
+	elog
+	elog "To use Docker, the Docker daemon must be running as root. To automatically"
+	elog "start the Docker daemon at boot:"
+	if systemd_is_booted || has_version sys-apps/systemd; then
+		elog "  systemctl enable docker.service"
+	else
+		elog "  rc-update add docker default"
+	fi
+	elog
+	elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
+	elog '  usermod -aG docker <youruser>'
+	elog
+
+	if has_version sys-fs/zfs; then
+		elog " ZFS storage driver is available"
+		elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
+		elog
+	fi
+
+	optfeature "rootless mode support" sys-apps/shadow
+	optfeature "rootless mode support" sys-apps/rootlesskit
+	optfeature_header "for rootless mode you also need a network stack"
+	optfeature "rootless mode network stack" app-containers/slirp4netns
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/app-containers/docker/docker-29.1.3-r1.ebuild b/app-containers/docker/docker-29.1.3-r1.ebuild
new file mode 100644
index 000000000000..195f3a9b38e7
--- /dev/null
+++ b/app-containers/docker/docker-29.1.3-r1.ebuild
@@ -0,0 +1,335 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+MY_PV=${PV/_/-}
+
+inherit go-module linux-info optfeature systemd toolchain-funcs udev
+
+GIT_COMMIT=fbf3ed25f893e6ce21336f1101590e40a13934f4
+
+DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/moby/moby/archive/${PN}-v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/moby-${PN}-v${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs +container-init cuda +overlay2 seccomp selinux systemd"
+
+DEPEND="
+	acct-group/docker
+	>=dev-db/sqlite-3.7.9:3
+	net-firewall/nftables:=
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
+	seccomp? ( >=sys-libs/libseccomp-2.2.1 )
+	systemd? ( sys-apps/systemd )
+"
+
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
+RDEPEND="
+	${DEPEND}
+	sys-process/procps
+	>=dev-vcs/git-1.7
+	>=app-arch/xz-utils-4.9
+	>=app-containers/containerd-2.2.0[apparmor?,btrfs?,seccomp?]
+	>=app-containers/runc-1.2.6[apparmor?,seccomp?]
+	!app-containers/docker-proxy
+	!<app-containers/docker-cli-${PV}
+	container-init? ( >=sys-process/tini-0.19.0[static] )
+	cuda? ( app-containers/nvidia-container-toolkit )
+	selinux? ( sec-policy/selinux-docker )
+"
+
+# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+# tests require running dockerd as root and downloading containers
+RESTRICT="installsources strip test"
+
+# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
+pkg_setup() {
+	# this is based on "contrib/check-config.sh" from upstream's sources
+	# required features.
+	CONFIG_CHECK="
+		~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
+		~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
+		~KEYS
+		~VETH ~BRIDGE ~BRIDGE_NETFILTER
+		~IP_NF_FILTER ~IP_NF_RAW ~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~NETFILTER_XT_MARK
+		~IP_NF_NAT ~NF_NAT
+		~POSIX_MQUEUE
+	"
+	WARNING_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: is required for bind-mounting /dev/mqueue into containers"
+
+	if kernel_is ge 6 17; then
+		CONFIG_CHECK+="
+			~IP_NF_IPTABLES_LEGACY
+			~NETFILTER_XTABLES_LEGACY
+		"
+	fi
+
+	if kernel_is lt 4 8; then
+		CONFIG_CHECK+="
+			~DEVPTS_MULTIPLE_INSTANCES
+		"
+	fi
+
+	if kernel_is le 5 1; then
+		CONFIG_CHECK+="
+			~NF_NAT_IPV4
+		"
+	fi
+
+	if kernel_is le 5 2; then
+		CONFIG_CHECK+="
+			~NF_NAT_NEEDED
+		"
+	fi
+
+	if kernel_is ge 4 15; then
+		CONFIG_CHECK+="
+			~CGROUP_BPF
+		"
+	fi
+
+	# optional features
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	if use seccomp; then
+		CONFIG_CHECK+="
+			~SECCOMP ~SECCOMP_FILTER
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+			"
+	fi
+
+	if kernel_is le 5 8; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP_ENABLED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NATIVE
+		"
+	if kernel_is lt 5 19; then
+		CONFIG_CHECK+="
+			~LEGACY_VSYSCALL_EMULATE
+			"
+	fi
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NONE
+		"
+	WARNING_LEGACY_VSYSCALL_NONE="CONFIG_LEGACY_VSYSCALL_NONE enabled: \
+		Containers with <=glibc-2.13 will not work"
+
+	if kernel_is le 4 5; then
+		CONFIG_CHECK+="
+			~MEMCG_KMEM
+		"
+	fi
+
+	if kernel_is lt 5; then
+		CONFIG_CHECK+="
+			~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP ~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP ~CGROUP_NET_PRIO
+		~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		"
+
+	if use selinux; then
+		CONFIG_CHECK+="
+			~SECURITY_SELINUX
+			"
+	fi
+
+	if use apparmor; then
+		CONFIG_CHECK+="
+			~SECURITY_APPARMOR
+			"
+	fi
+
+	# if ! is_set EXT4_USE_FOR_EXT2; then
+	#	check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
+	#	if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
+	#		echo "    $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
+	#	fi
+	# fi
+
+	CONFIG_CHECK+="
+		~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
+	"
+
+	# if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
+	#	if is_set EXT4_USE_FOR_EXT2; then
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
+	#	else
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
+	#	fi
+	# fi
+
+	# network drivers
+	CONFIG_CHECK+="
+		~VXLAN ~BRIDGE_VLAN_FILTERING
+		~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH
+		~XFRM ~XFRM_USER ~XFRM_ALGO ~INET_ESP
+	"
+	if kernel_is le 5 3; then
+		CONFIG_CHECK+="
+			~INET_XFRM_MODE_TRANSPORT
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~IPVLAN
+		"
+	CONFIG_CHECK+="
+		~MACVLAN ~DUMMY
+		"
+	CONFIG_CHECK+="
+		~NF_NAT_FTP ~NF_CONNTRACK_FTP ~NF_NAT_TFTP ~NF_CONNTRACK_TFTP
+	"
+
+	# storage drivers
+	if use btrfs; then
+		CONFIG_CHECK+="
+			~BTRFS_FS
+			~BTRFS_FS_POSIX_ACL
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~OVERLAY_FS
+	"
+
+	linux-info_pkg_setup
+}
+
+src_unpack() {
+	default
+	go-module_src_unpack
+	cd "${S}"
+	[[ -f go.mod ]] || ln -s vendor.mod go.mod || die
+	[[ -f go.sum ]] || ln -s vendor.sum go.sum || die
+}
+
+src_compile() {
+	export DOCKER_GITCOMMIT="${GIT_COMMIT}"
+	export VERSION=${PV}
+	tc-export PKG_CONFIG
+
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+
+	# let's set up some optional features :)
+	export DOCKER_BUILDTAGS=''
+	for gd in btrfs overlay2; do
+		if ! use $gd; then
+			DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
+		fi
+	done
+
+	for tag in apparmor seccomp; do
+		if use $tag; then
+			DOCKER_BUILDTAGS+=" $tag"
+		fi
+	done
+
+	export AUTO_GOPATH=1
+	export EXCLUDE_AUTO_BUILDTAG_JOURNALD=$(usex systemd '' 'y')
+	export GO_MD2MAN=/usr/bin/go-md2man
+
+	# build binaries
+	./hack/make.sh dynbinary || die 'dynbinary failed'
+
+	# build man page
+	cd man || die
+	emake || die
+}
+
+src_install() {
+	dosym containerd /usr/bin/docker-containerd
+	dosym containerd-shim-runc-v2 /usr/bin/docker-containerd-shim
+	dosym runc /usr/bin/docker-runc
+	use container-init && dosym tini /usr/bin/docker-init
+	dobin bundles/dynbinary-daemon/dockerd
+	dobin bundles/dynbinary-daemon/docker-proxy
+	for f in dockerd-rootless-setuptool.sh dockerd-rootless.sh; do
+		dosym ../share/docker/contrib/${f} /usr/bin/${f}
+	done
+
+	newinitd contrib/init/openrc/docker.initd docker
+	newconfd contrib/init/openrc/docker.confd docker
+
+	systemd_dounit contrib/init/systemd/docker.{service,socket}
+
+	dodoc AUTHORS CONTRIBUTING.md NOTICE README.md
+	dodoc -r docs/*
+	doman man/man8/dockerd.8
+
+	# note: intentionally not using "doins" so that we preserve +x bits
+	dodir /usr/share/${PN}/contrib
+	cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
+}
+
+pkg_postinst() {
+	udev_reload
+
+	elog
+	elog "To use Docker, the Docker daemon must be running as root. To automatically"
+	elog "start the Docker daemon at boot:"
+	if systemd_is_booted || has_version sys-apps/systemd; then
+		elog "  systemctl enable docker.service"
+	else
+		elog "  rc-update add docker default"
+	fi
+	elog
+	elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
+	elog '  usermod -aG docker <youruser>'
+	elog
+
+	if has_version sys-fs/zfs; then
+		elog " ZFS storage driver is available"
+		elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
+		elog
+	fi
+
+	optfeature "rootless mode support" sys-apps/shadow
+	optfeature "rootless mode support" sys-apps/rootlesskit
+	optfeature_header "for rootless mode you also need a network stack"
+	optfeature "rootless mode network stack" app-containers/slirp4netns
+}
diff --git a/app-containers/docker/docker-29.5.2.ebuild b/app-containers/docker/docker-29.5.2.ebuild
new file mode 100644
index 000000000000..56db6666c11c
--- /dev/null
+++ b/app-containers/docker/docker-29.5.2.ebuild
@@ -0,0 +1,336 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+MY_PV=${PV/_/-}
+
+inherit go-module linux-info optfeature systemd toolchain-funcs udev
+
+GIT_COMMIT=568f755ebeb1ac9c6a8febbda6cd371ea0a9630b
+
+DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/moby/moby/archive/${PN}-v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/moby-${PN}-v${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs +container-init cuda +overlay2 seccomp selinux systemd"
+
+DEPEND="
+	acct-group/docker
+	>=dev-db/sqlite-3.7.9:3
+	net-firewall/nftables:=
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
+	seccomp? ( >=sys-libs/libseccomp-2.2.1 )
+	systemd? ( sys-apps/systemd )
+"
+
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
+RDEPEND="
+	${DEPEND}
+	sys-process/procps
+	>=dev-vcs/git-1.7
+	>=app-arch/xz-utils-4.9
+	>=app-containers/containerd-2.2.0[apparmor?,btrfs?,seccomp?]
+	>=app-containers/runc-1.2.6[apparmor?,seccomp?]
+	!app-containers/docker-proxy
+	!<app-containers/docker-cli-${PV}
+	container-init? ( >=sys-process/tini-0.19.0[static] )
+	cuda? ( app-containers/nvidia-container-toolkit )
+	selinux? ( sec-policy/selinux-docker )
+"
+
+# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+	>=dev-lang/go-1.25.5
+"
+# tests require running dockerd as root and downloading containers
+RESTRICT="installsources strip test"
+
+# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
+pkg_setup() {
+	# this is based on "contrib/check-config.sh" from upstream's sources
+	# required features.
+	CONFIG_CHECK="
+		~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
+		~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
+		~KEYS
+		~VETH ~BRIDGE ~BRIDGE_NETFILTER
+		~IP_NF_FILTER ~IP_NF_RAW ~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~NETFILTER_XT_MARK
+		~IP_NF_NAT ~NF_NAT
+		~POSIX_MQUEUE
+	"
+	WARNING_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: is required for bind-mounting /dev/mqueue into containers"
+
+	if kernel_is ge 6 17; then
+		CONFIG_CHECK+="
+			~IP_NF_IPTABLES_LEGACY
+			~NETFILTER_XTABLES_LEGACY
+		"
+	fi
+
+	if kernel_is lt 4 8; then
+		CONFIG_CHECK+="
+			~DEVPTS_MULTIPLE_INSTANCES
+		"
+	fi
+
+	if kernel_is le 5 1; then
+		CONFIG_CHECK+="
+			~NF_NAT_IPV4
+		"
+	fi
+
+	if kernel_is le 5 2; then
+		CONFIG_CHECK+="
+			~NF_NAT_NEEDED
+		"
+	fi
+
+	if kernel_is ge 4 15; then
+		CONFIG_CHECK+="
+			~CGROUP_BPF
+		"
+	fi
+
+	# optional features
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	if use seccomp; then
+		CONFIG_CHECK+="
+			~SECCOMP ~SECCOMP_FILTER
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+			"
+	fi
+
+	if kernel_is le 5 8; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP_ENABLED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NATIVE
+		"
+	if kernel_is lt 5 19; then
+		CONFIG_CHECK+="
+			~LEGACY_VSYSCALL_EMULATE
+			"
+	fi
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NONE
+		"
+	WARNING_LEGACY_VSYSCALL_NONE="CONFIG_LEGACY_VSYSCALL_NONE enabled: \
+		Containers with <=glibc-2.13 will not work"
+
+	if kernel_is le 4 5; then
+		CONFIG_CHECK+="
+			~MEMCG_KMEM
+		"
+	fi
+
+	if kernel_is lt 5; then
+		CONFIG_CHECK+="
+			~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP ~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP ~CGROUP_NET_PRIO
+		~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		"
+
+	if use selinux; then
+		CONFIG_CHECK+="
+			~SECURITY_SELINUX
+			"
+	fi
+
+	if use apparmor; then
+		CONFIG_CHECK+="
+			~SECURITY_APPARMOR
+			"
+	fi
+
+	# if ! is_set EXT4_USE_FOR_EXT2; then
+	#	check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
+	#	if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
+	#		echo "    $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
+	#	fi
+	# fi
+
+	CONFIG_CHECK+="
+		~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
+	"
+
+	# if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
+	#	if is_set EXT4_USE_FOR_EXT2; then
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
+	#	else
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
+	#	fi
+	# fi
+
+	# network drivers
+	CONFIG_CHECK+="
+		~VXLAN ~BRIDGE_VLAN_FILTERING
+		~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH
+		~XFRM ~XFRM_USER ~XFRM_ALGO ~INET_ESP
+	"
+	if kernel_is le 5 3; then
+		CONFIG_CHECK+="
+			~INET_XFRM_MODE_TRANSPORT
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~IPVLAN
+		"
+	CONFIG_CHECK+="
+		~MACVLAN ~DUMMY
+		"
+	CONFIG_CHECK+="
+		~NF_NAT_FTP ~NF_CONNTRACK_FTP ~NF_NAT_TFTP ~NF_CONNTRACK_TFTP
+	"
+
+	# storage drivers
+	if use btrfs; then
+		CONFIG_CHECK+="
+			~BTRFS_FS
+			~BTRFS_FS_POSIX_ACL
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~OVERLAY_FS
+	"
+
+	linux-info_pkg_setup
+}
+
+src_unpack() {
+	default
+	go-module_src_unpack
+	cd "${S}"
+	[[ -f go.mod ]] || ln -s vendor.mod go.mod || die
+	[[ -f go.sum ]] || ln -s vendor.sum go.sum || die
+}
+
+src_compile() {
+	export DOCKER_GITCOMMIT="${GIT_COMMIT}"
+	export VERSION=${PV}
+	tc-export PKG_CONFIG
+
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+
+	# let's set up some optional features :)
+	export DOCKER_BUILDTAGS=''
+	for gd in btrfs overlay2; do
+		if ! use $gd; then
+			DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
+		fi
+	done
+
+	for tag in apparmor seccomp; do
+		if use $tag; then
+			DOCKER_BUILDTAGS+=" $tag"
+		fi
+	done
+
+	export AUTO_GOPATH=1
+	export EXCLUDE_AUTO_BUILDTAG_JOURNALD=$(usex systemd '' 'y')
+	export GO_MD2MAN=/usr/bin/go-md2man
+
+	# build binaries
+	./hack/make.sh dynbinary || die 'dynbinary failed'
+
+	# build man page
+	cd man || die
+	emake || die
+}
+
+src_install() {
+	dosym containerd /usr/bin/docker-containerd
+	dosym containerd-shim-runc-v2 /usr/bin/docker-containerd-shim
+	dosym runc /usr/bin/docker-runc
+	use container-init && dosym tini /usr/bin/docker-init
+	dobin bundles/dynbinary-daemon/dockerd
+	dobin bundles/dynbinary-daemon/docker-proxy
+	for f in dockerd-rootless-setuptool.sh dockerd-rootless.sh; do
+		dosym ../share/docker/contrib/${f} /usr/bin/${f}
+	done
+
+	newinitd contrib/init/openrc/docker.initd docker
+	newconfd contrib/init/openrc/docker.confd docker
+
+	systemd_dounit contrib/init/systemd/docker.{service,socket}
+
+	dodoc AUTHORS CONTRIBUTING.md NOTICE README.md
+	dodoc -r docs/*
+	doman man/man8/dockerd.8
+
+	# note: intentionally not using "doins" so that we preserve +x bits
+	dodir /usr/share/${PN}/contrib
+	cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
+}
+
+pkg_postinst() {
+	udev_reload
+
+	elog
+	elog "To use Docker, the Docker daemon must be running as root. To automatically"
+	elog "start the Docker daemon at boot:"
+	if systemd_is_booted || has_version sys-apps/systemd; then
+		elog "  systemctl enable docker.service"
+	else
+		elog "  rc-update add docker default"
+	fi
+	elog
+	elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
+	elog '  usermod -aG docker <youruser>'
+	elog
+
+	if has_version sys-fs/zfs; then
+		elog " ZFS storage driver is available"
+		elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
+		elog
+	fi
+
+	optfeature "rootless mode support" sys-apps/shadow
+	optfeature "rootless mode support" sys-apps/rootlesskit
+	optfeature_header "for rootless mode you also need a network stack"
+	optfeature "rootless mode network stack" app-containers/slirp4netns
+}
diff --git a/app-containers/docker/metadata.xml b/app-containers/docker/metadata.xml
new file mode 100644
index 000000000000..b86496e3ccf2
--- /dev/null
+++ b/app-containers/docker/metadata.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <longdescription>
+		Docker is an open-source project to easily create lightweight,
+		portable, self-sufficient containers from any application. The same
+		container that a developer builds and tests on a laptop can run at
+		scale, in production, on VMs, bare metal, OpenStack clusters, public
+		clouds and more.
+	</longdescription>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <use>
+    <flag name="btrfs">
+			Enables dependencies for the "btrfs" graph driver, including
+			necessary kernel flags.
+		</flag>
+    <flag name="container-init">
+			Makes the a staticly-linked init system tini available inside a
+			container.
+		</flag>
+    <flag name="overlay2">
+			Enables dependencies for the "overlay2" graph driver, including
+			necessary kernel flags.
+		</flag>
+  </use>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:docker:docker</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/earthly/Manifest b/app-containers/earthly/Manifest
new file mode 100644
index 000000000000..562346d72c54
--- /dev/null
+++ b/app-containers/earthly/Manifest
@@ -0,0 +1,2 @@
+DIST earthly-0.8.15-deps.tar.xz 163782812 BLAKE2B 09a9cb196206e787a48c2c2082a066a31c0bd8dba8785e379bfb86ac56ccf4f8eb34195c8577b866bc1153657008e4fae142eb7a6e21d2791fe92e9cdfa76e2d SHA512 65afc0bd89b6a54bb3e4cc4d7f39522eddbb79266b25afb33ffc3c6571b57952bc2ceafe00ce196098d1c4185ab2672f8a80d9ecd4d6d07dc06a18ba39da3941
+DIST earthly-0.8.16.gh.tar.gz 8264195 BLAKE2B 595fe686fdd8d56ea32909f7d8c8417b234ab65a16d42a4bf30f367a87363e3c61d2e555b99444c42eea3e5ae8b1bca2198ff5c4954ee5319776507ac099d77a SHA512 bb27e941f1afb12c4c6808ff11d18f1a784899d7904070ae8f7110a2e53b9e9a70b28f7ade687a864a46a8043f144862601e89fdd7e72f9ba3d1c3532cc66049
diff --git a/app-containers/earthly/earthly-0.8.16-r1.ebuild b/app-containers/earthly/earthly-0.8.16-r1.ebuild
new file mode 100644
index 000000000000..24ff888640da
--- /dev/null
+++ b/app-containers/earthly/earthly-0.8.16-r1.ebuild
@@ -0,0 +1,74 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=9
+
+# Git commit SHA is needed at runtime by earthly to pull and bootstrap images.
+if [[ "${PV}" == "0.8.16" ]] ; then
+	COMMIT_SHA="c48905267920d5599e849e8e043f801c6baab94a"
+else
+	die 'Could not detect "COMMIT_SHA", please update the ebuild.'
+fi
+
+inherit go-module
+
+DESCRIPTION="Build automation tool that executes in containers"
+HOMEPAGE="https://earthly.dev/
+	https://github.com/earthly/earthly/"
+SRC_URI="
+	https://github.com/${PN}/${PN}/archive/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+	https://dev.gentoo.org/~xgqt/distfiles/deps/${PN}-0.8.15-deps.tar.xz
+"
+
+LICENSE="MPL-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~x86"
+
+RDEPEND="
+	|| (
+		app-containers/docker
+		app-containers/podman
+	)
+"
+BDEPEND="
+	>=dev-lang/go-1.21.0
+"
+
+DOCS=( CHANGELOG.md CONTRIBUTING.md README.md )
+
+src_compile() {
+	local -r go_tags="dfrunmount,dfrunsecurity,dfsecrets,dfssh,dfrunnetwork,dfheredoc,forceposix"
+	local -r go_ldflags="
+		-X main.DefaultBuildkitdImage=docker.io/earthly/buildkitd:v${PV}
+		-X main.GitSha=${COMMIT_SHA}
+		-X main.Version=v${PV}
+	"
+	local -a -r go_buildargs=(
+		-tags "${go_tags}"
+		-ldflags "${go_ldflags}"
+		-o ./bin/
+	)
+	ego build "${go_buildargs[@]}" ./cmd/...
+}
+
+src_install() {
+	exeinto /usr/bin
+	doexe bin/earthly
+	newexe bin/debugger earthly-debugger
+
+	einstalldocs
+}
+
+pkg_postinst() {
+	if has_version "app-containers/podman" ; then
+		ewarn "Podman is supported but not recommended."
+		ewarn "If issues arise, then please try running earthly with docker."
+	fi
+
+	if has_version "app-containers/podman[rootless]" ; then
+		ewarn "Running podman in rootless mode is not supported because"
+		ewarn "earthly/dind and earthly/buildkit require privileged access."
+		ewarn "For more info see: https://docs.earthly.dev/docs/guides/podman/"
+	fi
+}
diff --git a/app-containers/earthly/metadata.xml b/app-containers/earthly/metadata.xml
new file mode 100644
index 000000000000..57e7fea23a7b
--- /dev/null
+++ b/app-containers/earthly/metadata.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>xgqt@gentoo.org</email>
+    <name>Maciej Barć</name>
+  </maintainer>
+  <longdescription>
+    Earthly is a versatile, approachable CI/CD framework that runs every
+    pipeline inside containers, giving you repeatable builds that you write
+    once and run anywhere. It has a super simple, instantly recognizable syntax
+    that is easy to write and understand – like Dockerfile and Makefile had a
+    baby. And it leverages and augments popular build tools instead of
+    replacing them, so you don’t have to rewrite all your builds no matter what
+    languages you use.
+  </longdescription>
+  <upstream>
+    <bugs-to>https://github.com/earthly/earthly/issues/</bugs-to>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/flannel/Manifest b/app-containers/flannel/Manifest
new file mode 100644
index 000000000000..f7bd8cb37e14
--- /dev/null
+++ b/app-containers/flannel/Manifest
@@ -0,0 +1,2 @@
+DIST flannel-0.26.3-deps.tar.xz 4762164 BLAKE2B c6fcbc0bf9b99f36332af3ddbbfcc10f150da36f3464ab44ad04170aff1cdec49e4bde89065e2945260fd4e8ecb8aebcfa31f1800985269a47ea12a6ba743318 SHA512 f0d78ea6351b0851491b2d00bfeac5e12acbbc7baf387162617f9330a56a7e6b80f11ba6e3c9c895624c8df6969c214721aea3d63156420418044d3280fb5cbe
+DIST flannel-0.26.3.tar.gz 2344640 BLAKE2B 6671f64ca90804cbe9293a66d9611fd276ddc8be886bd7bffc4d11b3ef4c5ca9119d8494a7719c578f402713f11ab2c6d19a3688a8897ba4c549abe71f55e284 SHA512 7888f28b2994fa0ae6036e54d0291e57aef54cbfb8db5869bd62e33ae092fe028adb3780acfdb2017187ba035f7c3310cc51d0214aa78713321f062343364bcb
diff --git a/app-containers/flannel/files/flannel-docker.conf b/app-containers/flannel/files/flannel-docker.conf
new file mode 100644
index 000000000000..8f5517776b89
--- /dev/null
+++ b/app-containers/flannel/files/flannel-docker.conf
@@ -0,0 +1,2 @@
+[Service]
+EnvironmentFile=-/run/flannel/docker
diff --git a/app-containers/flannel/files/flannel.tmpfilesd b/app-containers/flannel/files/flannel.tmpfilesd
new file mode 100644
index 000000000000..98e5abd9b20f
--- /dev/null
+++ b/app-containers/flannel/files/flannel.tmpfilesd
@@ -0,0 +1 @@
+d /run/flannel 0755 root root
diff --git a/app-containers/flannel/files/flanneld.confd b/app-containers/flannel/files/flanneld.confd
new file mode 100644
index 000000000000..18686aa5d223
--- /dev/null
+++ b/app-containers/flannel/files/flanneld.confd
@@ -0,0 +1,2 @@
+# arguments for flannel
+command_args=""
diff --git a/app-containers/flannel/files/flanneld.initd b/app-containers/flannel/files/flanneld.initd
new file mode 100644
index 000000000000..d5d966a40d30
--- /dev/null
+++ b/app-containers/flannel/files/flanneld.initd
@@ -0,0 +1,19 @@
+#!/sbin/openrc-run
+# Copyright 2016-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+description="Flannel Network Fabric for Containers"
+pidfile=${pidfile:-"/run/${RC_SVCNAME}.pid"}
+user=${user:-root}
+group=${group:-root}
+
+command="/usr/bin/${RC_SVCNAME}"
+command_args="${command_args}"
+command_background="true"
+start_stop_daemon_args="--user ${user} --group ${group} \
+	--stdout /var/log/flannel/flannel.log \
+	--stderr /var/log/flannel/flannel.log"
+
+depend() {
+	need net
+}
diff --git a/app-containers/flannel/files/flanneld.logrotated b/app-containers/flannel/files/flanneld.logrotated
new file mode 100644
index 000000000000..4108e6305578
--- /dev/null
+++ b/app-containers/flannel/files/flanneld.logrotated
@@ -0,0 +1,7 @@
+/var/log/flannel/* {
+	missingok
+	size 5M
+	rotate 3
+	compress
+	copytruncate
+}
diff --git a/app-containers/flannel/files/flanneld.service b/app-containers/flannel/files/flanneld.service
new file mode 100644
index 000000000000..86e69a49e73f
--- /dev/null
+++ b/app-containers/flannel/files/flanneld.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=Flanneld overlay address etcd agent
+After=network.target
+Before=docker.service
+
+[Service]
+Type=notify
+Environment=FLANNEL_ETCD=http://127.0.0.1:4001,http://127.0.0.1:2379 FLANNEL_ETCD_KEY=/coreos.com/network
+ExecStart=/usr/bin/flanneld -etcd-endpoints=${FLANNEL_ETCD} -etcd-prefix=${FLANNEL_ETCD_KEY} $FLANNEL_OPTIONS
+ExecStartPost=/usr/libexec/flannel/mk-docker-opts.sh -k DOCKER_NETWORK_OPTIONS -d /run/flannel/docker
+
+[Install]
+RequiredBy=docker.service
diff --git a/app-containers/flannel/flannel-0.26.3.ebuild b/app-containers/flannel/flannel-0.26.3.ebuild
new file mode 100644
index 000000000000..7bf15b18f9ac
--- /dev/null
+++ b/app-containers/flannel/flannel-0.26.3.ebuild
@@ -0,0 +1,54 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module systemd tmpfiles
+
+KEYWORDS="~amd64 ~arm64"
+DESCRIPTION="An etcd backed network fabric for containers"
+HOMEPAGE="https://github.com/flannel-io/flannel"
+SRC_URI="https://github.com/flannel-io/flannel/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz
+	https://dev.gentoo.org/~zmedico/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+LICENSE+=" BSD ISC LGPL-3 MIT"
+SLOT="0"
+
+RESTRICT+=" test"
+
+src_prepare() {
+	default
+	sed -e "s:^var Version =.*:var Version = \"${PV}\":" \
+		-i "${S}/pkg/version/version.go" || die
+}
+
+src_compile() {
+	ego build -o dist/flanneld -ldflags "
+		-X github.com/flannel-io/flannel/version.Version=v${PV}
+		-extldflags \"-static\"" . || die
+}
+
+src_test() {
+	GOPATH="${WORKDIR}/${P}" \
+		ego test -v -work -x "${EGO_PN}" || die
+}
+
+src_install() {
+	dobin dist/${PN}d
+	exeinto /usr/libexec/flannel
+	doexe dist/mk-docker-opts.sh
+	insinto /etc/systemd/system/docker.service.d
+	newins "${FILESDIR}/flannel-docker.conf" flannel.conf
+	newinitd "${FILESDIR}"/flanneld.initd flanneld
+	newconfd "${FILESDIR}"/flanneld.confd flanneld
+	keepdir /var/log/${PN}
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}"/flanneld.logrotated flanneld
+	newtmpfiles "${FILESDIR}/flannel.tmpfilesd" flannel.conf
+	systemd_dounit "${FILESDIR}/flanneld.service"
+	dodoc README.md
+}
+
+pkg_postinst() {
+	tmpfiles_process flannel.conf
+}
diff --git a/app-containers/flannel/metadata.xml b/app-containers/flannel/metadata.xml
new file mode 100644
index 000000000000..b5c78a8ab61b
--- /dev/null
+++ b/app-containers/flannel/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/grype/Manifest b/app-containers/grype/Manifest
new file mode 100644
index 000000000000..f92d78054435
--- /dev/null
+++ b/app-containers/grype/Manifest
@@ -0,0 +1,12 @@
+DIST grype-0.59.1-deps.tar.xz 555292828 BLAKE2B ce132ecd42efd2c76bce1843b1da2ff763494a0206c8618c95ec03ae9d73a77378a68e503de9115c73efd6acbab4cc30bf222676c7888aafb08de8454351fb2b SHA512 aa627bfbf52c218786d009dee6e37bc09d70fd98ad10b8c07ec91db9d15380a1fbc35f380ee22fae8b6e7b090d1aabfebf58bc1ea6bca2bd179dcaa74b52a2c0
+DIST grype-0.59.1.tar.gz 1021093 BLAKE2B 0c5b0a8a14e297e123965d451daff082cbabb01f766ec355a37d54d7044b865430aa7cbec20d8002feac33f93e24565ebe6346a8559e8a25bf3df1dcc8ca217e SHA512 8f219ade9d7369f124dd8c035f3bef6ce5055e318d7ab1578f7f98a7fa6e842dad26fae8b2337884d4af3773b2c590b61485a490f98c66dfcbd82ef73d8b766b
+DIST grype-0.61.0-deps.tar.xz 562038080 BLAKE2B cb780751f50f9c74ac9f9a7064e489211bdfbd3d9df5fbd3fd51aa6081a48cac38b5efcaf524708cb010b3767c7bf31eaf8151e96f610ae84a814de767beec8e SHA512 eca6b813c140af26533154ca10f50a44351bef921e6140c3ae02c8b888d4e43bd7163954684463c19acf3c11b7ee93c1531b4b1042f0cd3886e1da36f384c029
+DIST grype-0.61.0.tar.gz 1021705 BLAKE2B 32ff98f3f240ee5d883edb568ff9caa7614053e76ea9bd8a774a5abb92091e4356e25c10b94d9aaf4a17a2f8c4c7d0f26e2ceec8a089ca079029893d255a7480 SHA512 ce4b1805f17bccd3281a218673156669ae632418bdfabf95c310b973bc224b89b7e0e3ca57a8c7e1df444074e034092d963df3b11cbf393e500fe1786f707ed5
+DIST grype-0.72.0-deps.tar.xz 599210536 BLAKE2B 4912cf4278488e78c7a174654da20f640c4975b5e98741e7caa94d9865ae51013a410863ee68c520805985afc19ca0b2b2175b8f2241724ceac86217719efd82 SHA512 1a91f1b46dc5a206025554c32f5420019ff0f8de564b67ad91070bdbe46abb71f08d409856799672cc31a7d753e151343d925147332caeb044f3cfd81318ff08
+DIST grype-0.72.0.tar.gz 1114440 BLAKE2B 931f4bdd883471e8b34b09dd1df53d4e67df96fc0d7be5224d1acfecc618cb068ee268f4b269e5a7f5e01a6605b9e01f8bb6a150819e8410a6b4f0daa12877ff SHA512 8335de5cba0b11500df1404afeee311be50c7e55d1a57c85cbebe830c9e8d9d21ff7b35ab6110200e57f464e999576f395814a56485115f8c7ed7b6e9f7dafb9
+DIST grype-0.73.0-deps.tar.xz 627765660 BLAKE2B 3d3949922a635d0654120aaf05edef38e7ae998c7beab89a7f13de994ab5f34bd6ade6a67145f5a366a2956ffb124a94a952b426a71cb50a7a30f65a7d721784 SHA512 f2e0ba2da0c196e705a23efc9e989ed3525d3465d661a2d5ce832c0663b0226a885541d91a773922f32de4d849030b73c307487eec00d0498368925213b9444d
+DIST grype-0.73.0.tar.gz 1124082 BLAKE2B 835b1833e6809510821f07906df06c55b418f7226dba190b4bf4f32ae603c006842496512d5e788eef8f2ce7e215a923bc338a1c55f089a3942476275663a6b2 SHA512 06be60104f23be38578660a79d3c593e988e2c5fce646b00dedec9af4d3442f204f81d063806944cfdaa04daffdff256ac71b52ed94d8ae07acde1e15c442f08
+DIST grype-0.79.3-deps.tar.xz 219363916 BLAKE2B 7396b4f0bd734504b30c971c592dae49a7ebc118db6efdb668d412622708797b8ef0ebded3a1d0474e3fb2fc1d6a3ac078b11de9fb38f5d15cc5edcbd57276be SHA512 b037535208652b64dd424a2daf9caf5232e40e0dba344c62600c0065f342206edc2797b9e155a5830f013744c3aa1d6564e623261a0cd6c1c3124eaae3f80899
+DIST grype-0.79.3.tar.gz 1165282 BLAKE2B 016e2a0ccad51757be83146fd6d187929e61f37531881bf811b6058daf935733f6a6ed23a9fac818a6a6ef815227fa045806c79ef2820a9ee78711cb417c0698 SHA512 0fbae679e8fd43efc2440d6db2f46a51ea4b6acd76f72a69d278b9eec85204b2b36d9077963fea2541bb4ada168802349fc066ffa260678e13429301cecac960
+DIST grype-0.86.1-deps.tar.xz 195229268 BLAKE2B 79fcd429fef63abdc640e326025f4f722ab52b9936d50560a0b5876e48c8058b565551c40569466077c1c02caedbbfeb772508c1e92820e6eadba5fe62edf21e SHA512 3d03679899316ffe7adccaf4341eb3c56f89d794c0341bee1531907818d687de8d96522c4e4b16c62277135c09226b4701d224e8eafc680727bebe47136f354a
+DIST grype-0.86.1.tar.gz 1224651 BLAKE2B 28c514402e3d7c40867048f1b5497b39036b2a69a60202344f2dfdcafda6bbbedeadb57feef8cadd120b494d90b8f25fd032b5a5b80efc00ba057d835c33f567 SHA512 3ee482eca7c67b2e5ab25107614c9336bbeaa428e7ecaa1d602378ecd4173918da16b8ea7ef3829fc6524035f3bad0097a241cf5f34f8a83902db9fb6c7ba192
diff --git a/app-containers/grype/grype-0.59.1.ebuild b/app-containers/grype/grype-0.59.1.ebuild
new file mode 100644
index 000000000000..3ce88f7f6d9d
--- /dev/null
+++ b/app-containers/grype/grype-0.59.1.ebuild
@@ -0,0 +1,33 @@
+# Copyright 2022-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module
+GIT_COMMIT=29b646568901d1ef48a528cf35f67f3cead49c9f
+SYFT_VERSION=0.74.1
+
+DESCRIPTION="A vulnerability scanner for container images and filesystems"
+HOMEPAGE="https://www.anchore.com"
+SRC_URI="https://github.com/anchore/grype/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+# tests require a running docker
+RESTRICT="test"
+
+src_compile() {
+	ego build -o bin/grype -ldflags "
+		-extldflags '-static'
+		-X github.com/anchore/grype/internal/version.version=${PV}
+		-X github.com/anchore/grype/internal/version.syftVersion=${SYFT_VERSION}
+		-X github.com/anchore/grype/internal/version.gitCommit=${GIT_COMMIT}
+			-X github.com/anchore/grype/internal/version.buildDate=${BUILD_DATE}
+			-X github.com/anchore/grype/internal/version.gitDescription=v${PV}"
+}
+
+src_install() {
+	dobin bin/grype
+}
diff --git a/app-containers/grype/grype-0.61.0.ebuild b/app-containers/grype/grype-0.61.0.ebuild
new file mode 100644
index 000000000000..99ae14b81d3c
--- /dev/null
+++ b/app-containers/grype/grype-0.61.0.ebuild
@@ -0,0 +1,33 @@
+# Copyright 2022-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module
+GIT_COMMIT=d8c0c0805b59659c4d6e49d6806a0eba11bdc2ee
+SYFT_VERSION=0.76.0
+
+DESCRIPTION="A vulnerability scanner for container images and filesystems"
+HOMEPAGE="https://www.anchore.com"
+SRC_URI="https://github.com/anchore/grype/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+# tests require a running docker
+RESTRICT="test"
+
+src_compile() {
+	ego build -o bin/grype -ldflags "
+		-extldflags '-static'
+		-X github.com/anchore/grype/internal/version.version=${PV}
+		-X github.com/anchore/grype/internal/version.syftVersion=${SYFT_VERSION}
+		-X github.com/anchore/grype/internal/version.gitCommit=${GIT_COMMIT}
+			-X github.com/anchore/grype/internal/version.buildDate=${BUILD_DATE}
+			-X github.com/anchore/grype/internal/version.gitDescription=v${PV}"
+}
+
+src_install() {
+	dobin bin/grype
+}
diff --git a/app-containers/grype/grype-0.72.0.ebuild b/app-containers/grype/grype-0.72.0.ebuild
new file mode 100644
index 000000000000..acccd2982d3f
--- /dev/null
+++ b/app-containers/grype/grype-0.72.0.ebuild
@@ -0,0 +1,34 @@
+# Copyright 2022-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module
+GIT_COMMIT=04df28051b7694a5e4a28fc5b2ea2068f24ef213
+SYFT_VERSION=0.94.0
+
+DESCRIPTION="A vulnerability scanner for container images and filesystems"
+HOMEPAGE="https://www.anchore.com"
+SRC_URI="https://github.com/anchore/grype/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+# tests require a running docker
+RESTRICT="test"
+
+src_compile() {
+	ego build -o bin/grype -ldflags "
+		-extldflags '-static'
+		-X github.com/anchore/grype/internal/version.version=${PV}
+		-X github.com/anchore/grype/internal/version.syftVersion=${SYFT_VERSION}
+		-X github.com/anchore/grype/internal/version.gitCommit=${GIT_COMMIT}
+		-X github.com/anchore/grype/internal/version.buildDate=${BUILD_DATE}
+		-X github.com/anchore/grype/internal/version.gitDescription=v${PV}
+		" ./cmd/grype
+}
+
+src_install() {
+	dobin bin/grype
+}
diff --git a/app-containers/grype/grype-0.73.0.ebuild b/app-containers/grype/grype-0.73.0.ebuild
new file mode 100644
index 000000000000..a2befc0a8c0d
--- /dev/null
+++ b/app-containers/grype/grype-0.73.0.ebuild
@@ -0,0 +1,34 @@
+# Copyright 2022-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module
+GIT_COMMIT=15432488224b3d7a557798fd258828f618dadc90
+SYFT_VERSION=0.95.0
+
+DESCRIPTION="A vulnerability scanner for container images and filesystems"
+HOMEPAGE="https://www.anchore.com"
+SRC_URI="https://github.com/anchore/grype/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+# tests require a running docker
+RESTRICT="test"
+
+src_compile() {
+	ego build -o bin/grype -ldflags "
+		-extldflags '-static'
+		-X github.com/anchore/grype/internal/version.version=${PV}
+		-X github.com/anchore/grype/internal/version.syftVersion=${SYFT_VERSION}
+		-X github.com/anchore/grype/internal/version.gitCommit=${GIT_COMMIT}
+		-X github.com/anchore/grype/internal/version.buildDate=${BUILD_DATE}
+		-X github.com/anchore/grype/internal/version.gitDescription=v${PV}
+		" ./cmd/grype
+}
+
+src_install() {
+	dobin bin/grype
+}
diff --git a/app-containers/grype/grype-0.79.3.ebuild b/app-containers/grype/grype-0.79.3.ebuild
new file mode 100644
index 000000000000..1458a1b7ff9d
--- /dev/null
+++ b/app-containers/grype/grype-0.79.3.ebuild
@@ -0,0 +1,34 @@
+# Copyright 2022-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module
+GIT_COMMIT=45b7236e948ef973a8a6ffbac52dff28be0fd70e
+SYFT_VERSION=1.9.0
+
+DESCRIPTION="A vulnerability scanner for container images and filesystems"
+HOMEPAGE="https://www.anchore.com"
+SRC_URI="https://github.com/anchore/grype/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+# tests require a running docker
+RESTRICT="test"
+
+src_compile() {
+	ego build -o bin/grype -ldflags "
+		-extldflags '-static'
+		-X github.com/anchore/grype/internal/version.version=${PV}
+		-X github.com/anchore/grype/internal/version.syftVersion=${SYFT_VERSION}
+		-X github.com/anchore/grype/internal/version.gitCommit=${GIT_COMMIT}
+		-X github.com/anchore/grype/internal/version.buildDate=${BUILD_DATE}
+		-X github.com/anchore/grype/internal/version.gitDescription=v${PV}
+		" ./cmd/grype
+}
+
+src_install() {
+	dobin bin/grype
+}
diff --git a/app-containers/grype/grype-0.86.1.ebuild b/app-containers/grype/grype-0.86.1.ebuild
new file mode 100644
index 000000000000..cf2b08010f9b
--- /dev/null
+++ b/app-containers/grype/grype-0.86.1.ebuild
@@ -0,0 +1,34 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module
+GIT_COMMIT=5c4fee7b1170976ab435de052fc3611bc955f1f1
+SYFT_VERSION=1.18.1
+
+DESCRIPTION="A vulnerability scanner for container images and filesystems"
+HOMEPAGE="https://www.anchore.com"
+SRC_URI="https://github.com/anchore/grype/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+# tests require a running docker
+RESTRICT="test"
+
+src_compile() {
+	ego build -o bin/grype -ldflags "
+		-extldflags '-static'
+		-X github.com/anchore/grype/internal/version.version=${PV}
+		-X github.com/anchore/grype/internal/version.syftVersion=${SYFT_VERSION}
+		-X github.com/anchore/grype/internal/version.gitCommit=${GIT_COMMIT}
+		-X github.com/anchore/grype/internal/version.buildDate=${BUILD_DATE}
+		-X github.com/anchore/grype/internal/version.gitDescription=v${PV}
+		" ./cmd/grype
+}
+
+src_install() {
+	dobin bin/grype
+}
diff --git a/app-containers/grype/metadata.xml b/app-containers/grype/metadata.xml
new file mode 100644
index 000000000000..17492b5107c4
--- /dev/null
+++ b/app-containers/grype/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/img/Manifest b/app-containers/img/Manifest
new file mode 100644
index 000000000000..fcf3e28d9654
--- /dev/null
+++ b/app-containers/img/Manifest
@@ -0,0 +1 @@
+DIST img-0.5.11.tar.gz 4743864 BLAKE2B 6e08ddce536d666539bca9d06fc14c8a01cedb012024ee7f970a7c4ea5a701f28b52a0b247e9f681e72bff1aab354e6f6d02d12bdde4d434aa2dd6ff92de949c SHA512 de80c2c26dd2fb780fb0447f07b5478e1571067ec934fb2adb32dff1aa3853ff872388b9c9c168c139194ab5d38672fb3b4c76c4f77fd8e61ce48bde8cae8c1b
diff --git a/app-containers/img/img-0.5.11.ebuild b/app-containers/img/img-0.5.11.ebuild
new file mode 100644
index 000000000000..d8709e615dbd
--- /dev/null
+++ b/app-containers/img/img-0.5.11.ebuild
@@ -0,0 +1,32 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+DESCRIPTION="Standalone daemon-less unprivileged Dockerfile and OCI container image builder"
+HOMEPAGE="https://github.com/genuinetools/img"
+SRC_URI="https://github.com/genuinetools/img/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+KEYWORDS="~amd64"
+LICENSE="MIT"
+SLOT="0"
+IUSE="seccomp"
+
+DEPEND="seccomp? ( sys-libs/libseccomp )"
+RDEPEND="${DEPEND}
+	app-containers/runc"
+
+src_compile() {
+	IMG_DISABLE_EMBEDDED_RUNC=1 \
+		ego build \
+		-mod=vendor \
+		-tags "noembed $(usev seccomp)" \
+		-ldflags="-X version.VERSION=${PV}"
+}
+
+src_install() {
+	dobin img
+	dodoc README.md AUTHORS
+}
diff --git a/app-containers/img/metadata.xml b/app-containers/img/metadata.xml
new file mode 100644
index 000000000000..5f33304011d5
--- /dev/null
+++ b/app-containers/img/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/incus/Manifest b/app-containers/incus/Manifest
new file mode 100644
index 000000000000..b8084d727d4e
--- /dev/null
+++ b/app-containers/incus/Manifest
@@ -0,0 +1,12 @@
+DIST incus-6.0.5.tar.xz 12532820 BLAKE2B a256c37c309d82f6326ede3d90e20522ff91317b1bce0a4dc1c391c2694599c7f3f6ab06368757a12e85133f82bd85ea4d50906dc250f43563a6ff765850b874 SHA512 b209dde671b13e101ccdf0daf975ae8547d050ec95e67ad1ee17aa99761e8ed3327e7edace0c4394aa79932d11b846e0f1edf5f95b2ad0b56eafca9905e844c8
+DIST incus-6.0.5.tar.xz.asc 833 BLAKE2B 1e8818fdb2edf9ff0d0288d2a7d61585571a0fdfe514e1bdf05b27b607560115168c07d420f8384d07d216fdc8dc1f31113fa5afa4838042743636974bf76151 SHA512 d0412fe8850ff5783d4c3cee982ff8beac74f19c5dc538438fc210b9f7421bcb6e663e4c32f9a2604f1a5e2f42d8bb8d3f8e599f15a0fa1b5fa6f1bc1982b1dd
+DIST incus-6.0.6.tar.xz 13164068 BLAKE2B 91df6acd3549c9e9c2023889fd4f9a3d91bb93c59c1912992a4b26323c813042973a26b036e0b9412ba7f69a1e5dab7912174947a6c5e3cfede99b6d7d9e75e8 SHA512 e3c33801add7be08be0220808647f28b7e449e08bf6b7d219ad33eb9632db84c861317da9ac51a81887bfbcd1a1a4ae9a1e2c3cbf16ad079caa5497cba4a6698
+DIST incus-6.0.6.tar.xz.asc 833 BLAKE2B 10d317e0cdeb30920d446c54893ca04a1e7b2aeee3dbbc8dde4de976bf83d6fc777ca700369d9a9b0b9be98bb4877f2ee20a5081f9f47daeea9508854f9d3264 SHA512 7015845e75d509e8ba9ca26ef18baf8cd52c964867df47b3f3c7967f78219bc12233894e654c06a9eb79451c5d2698ec9e9b73868e7a377b0d5a6d3c88ebd863
+DIST incus-6.21.tar.xz 13298940 BLAKE2B ae898643c02e4e4ba41d7c9326ff67fdaed21f0583268cdd810602c5b244b00bfb9fdaa626149ca20782595ba35b3b820774605417f0c3c74ee2acda9494ff88 SHA512 eff179f176d4f2ccf7e6c2db57a63358370c53b4c8255d8d3a56ddca16df17339ec1f7455cc63b38dc9e28f7ae658349c325c92ba32687f9f4acd5573c56f06d
+DIST incus-6.21.tar.xz.asc 833 BLAKE2B 14aad1deb9976528e0e75426cb46017525fba5f1a728dc34192e0defd417bf93f20fd12ef4005c7111a9be6891af1ff077f34abab9b824451b938ea7d1e92026 SHA512 6baaf74e7f4eb16fcd183ab435235b491081afa35f94b86ea63d4ac51aa63fe0a10f2aa493987c261664c8ef7fdcb2ed09e7265c5bf063e828b40d3618fd4f8c
+DIST incus-6.22.tar.xz 13452548 BLAKE2B d55cde93ae4b0893eba177711e067c62101d29d9d65a6af043e301b9a6389d1d4ea3027365879777cb3d6cd4044e24d1bdfc044c55be632e25fa5d3ce51b91a7 SHA512 4c945a9ca7ecbbc0f833fb2b768f23ee79b4f3c0975ad6afe1f1887418adcd246c4b6c029238c5447930e2dcf675942552e4d8d33222417e4fef1f5e4b43a849
+DIST incus-6.22.tar.xz.asc 833 BLAKE2B 628281aa44f521f44bc8e22725793b656a8b662f2a2ada724fb8b17b99352ab6d46ad85b99319840166d6c45ede11d72b2e69c535fd769411c5c750e30367ba5 SHA512 57dd75642f9875800da09b18995dac60e97f441caa82272fe22bff8120c412f646fae81e0d9e63996bb6945c5ebc2ce4ab820372337e36e04e3f2de4ccb0fe1a
+DIST incus-6.23.tar.xz 13510328 BLAKE2B c9c433e32e301518c92dd1ab570871d3a0cf623528ea6ed59c194a4a622f8fa09a98be384b8f52d15b66513e8bdad9258ac586a630e2474002b60773a3fe4bb9 SHA512 1080eb0b6571c6fec8169ee6338feab9020bc2d5cf12bc258532b5d9a0ee3f25118ad73e0eb4fba202dd6ab4c66bae73b8309caff6d5c18d2bbd295825b7b1e3
+DIST incus-6.23.tar.xz.asc 833 BLAKE2B 6f086c10b5bb6ca45f304e16caa76adbdf0a316b500283bcb15c2f4e4d0d86d2ddddba02d470481e3cacc47667c5e4a64db71df078225124eacdb4f2041d95b7 SHA512 1bf734d120b98d1758d900884975234cafa90e1602dcc29e89c8a34915058e2ae1fbe7bbca2f20e9e2018be161c9493786d70a8a46f769c0aee132c3b00548f8
+DIST incus-7.0.0.tar.xz 13911008 BLAKE2B 5906168618bf98434a270a4123cf62ce06d3ccf4a2b99f9d8e50df26dc12a495e479fa061c3c60d0ab3d74b35faf80d63c064904cda1768e097f2ce59e46585c SHA512 02c366a7f19c01e88578e7c2982633935fd8b53ebbf9a89ebab8290523341c5577b77dbf9a4c47db11558a4582d60ad370f34d706808d6f04bbb1675a5867444
+DIST incus-7.0.0.tar.xz.asc 833 BLAKE2B c2b0bf82f37487686fa6051818fbacf4ccac8a8121b467a9c92963c0dce8d9297cd3bf6612c19b180fb944d96ec349bd3e50eb1279b0e75fcb49f4fe2a3cc94d SHA512 4a37b66a85c40242d66ac0ead4aef842b26138e010b880bd4367958ae1068c96d5cb82d8e875acce1c05cf6b53d4eae2f61bbfcbc87139df500e4e9cb9940721
diff --git a/app-containers/incus/files/90incus.envd b/app-containers/incus/files/90incus.envd
new file mode 100644
index 000000000000..24ef28508176
--- /dev/null
+++ b/app-containers/incus/files/90incus.envd
@@ -0,0 +1,2 @@
+INCUS_AGENT_PATH=/usr/libexec/incus/agents
+INCUS_EDK2_PATH=/usr/share/edk2-ovmf
diff --git a/app-containers/incus/files/incus-0.4.socket b/app-containers/incus/files/incus-0.4.socket
new file mode 100644
index 000000000000..741fadd0309d
--- /dev/null
+++ b/app-containers/incus/files/incus-0.4.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=Incus - Daemon (unix socket)
+
+[Socket]
+ListenStream=/var/lib/incus/unix.socket
+SocketGroup=incus-admin
+SocketMode=0660
+Service=incus.service
+
+[Install]
+WantedBy=sockets.target
diff --git a/app-containers/incus/files/incus-6.0.confd b/app-containers/incus/files/incus-6.0.confd
new file mode 100644
index 000000000000..d75a9071aca2
--- /dev/null
+++ b/app-containers/incus/files/incus-6.0.confd
@@ -0,0 +1,27 @@
+## "INCUS_OPTIONS+=" is not POSIX-compliant, so we use
+## "INCUS_OPTIONS="${INCUS_OPTIONS}"" to not rely on bashmisms.
+## bgo#929138
+
+# Group which owns the shared socket
+INCUS_OPTIONS="${INCUS_OPTIONS} --group incus-admin"
+
+# Enable cpu profiling into the specified file
+#INCUS_OPTIONS="${INCUS_OPTIONS} --cpuprofile /tmp/lxc_cpu_profile"
+
+# Enable memory profiling into the specified file
+#INCUS_OPTIONS="${INCUS_OPTIONS} --memprofile /tmp/lxc_mem_profile"
+
+# Enable debug mode
+#INCUS_OPTIONS="${INCUS_OPTIONS} --debug"
+
+# For debugging, print a complete stack trace every n seconds
+#INCUS_OPTIONS="${INCUS_OPTIONS} --print-goroutines-every 5"
+
+# Enable verbose mode
+#INCUS_OPTIONS="${INCUS_OPTIONS} -v"
+
+# Logfile to log to
+#INCUS_OPTIONS="${INCUS_OPTIONS} --logfile /var/log/incus/incus.log"
+
+# Enable syslog logging
+#INCUS_OPTIONS="${INCUS_OPTIONS} --syslog"
diff --git a/app-containers/incus/files/incus-6.0.initd b/app-containers/incus/files/incus-6.0.initd
new file mode 100644
index 000000000000..fb0d80ee7987
--- /dev/null
+++ b/app-containers/incus/files/incus-6.0.initd
@@ -0,0 +1,63 @@
+#!/sbin/openrc-run
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+DAEMON=/usr/sbin/incusd
+PIDFILE=/run/incus.pid
+
+depend() {
+	need net
+	need lxcfs
+}
+
+start() {
+	ebegin "Starting incus daemon service"
+
+	modprobe -f loop > /dev/null 2>&1
+
+	# Call prlimit from the init.d file instead of ulimit through rc_ulimit,
+	# bgo#929138
+	prlimit --nofile=1048576 --memlock=unlimited --pid=$$
+
+	# Fix permissions on /var/lib/incus and make sure it exists.
+	# Create a log directory for incus with correct permissions.
+	install -d /var/lib/incus --group incus-admin --owner root --mode 0775
+	install -d /var/log/incus --group incus-admin --owner root
+
+	start-stop-daemon --start \
+		--pidfile ${PIDFILE} \
+		--exec ${DAEMON} \
+		--background \
+		--make-pidfile \
+		-- \
+		${INCUS_OPTIONS}
+	eend ${?}
+
+	# Create necessary systemd paths in order for systemd containers to work on openrc host.
+	# /etc/rc.conf should have following values:
+	#   rc_cgroup_mode="hybrid"
+	if [ -d /sys/fs/cgroup/unified ] &&
+	[ ! -d /sys/fs/cgroup/systemd ]; then
+		install -d /sys/fs/cgroup/systemd --group incus-admin --owner root
+		mount -t cgroup -o none,name=systemd systemd /sys/fs/cgroup/systemd
+	fi
+}
+
+stop() {
+	if [ "${RC_CMD}" = restart ]; then
+		ebegin "Stopping incus daemon service (but not containers)"
+		# start-stop-daemon sends SIGTERM with a timeout of 5s by default.
+		# SIGTERM indicates to INCUS that it will be stopped temporarily.
+		# Instances will keep running.
+		start-stop-daemon --stop --quiet -p "${PIDFILE}"
+		eend ${?}
+	else
+		ebegin "Stopping incus daemon service and containers, waiting 40s"
+		# SIGPWR indicates to INCUS that the host is going down.
+		# LXD will do a clean shutdown of all instances.
+		# After 30s all remaining instances will be killed.
+		# We wait up to 40s for INCUS.
+		start-stop-daemon --stop --quiet -R SIGPWR/40 -p "${PIDFILE}"
+		eend ${?}
+	fi
+}
diff --git a/app-containers/incus/files/incus-6.14-r1.service b/app-containers/incus/files/incus-6.14-r1.service
new file mode 100644
index 000000000000..e356a9e6d700
--- /dev/null
+++ b/app-containers/incus/files/incus-6.14-r1.service
@@ -0,0 +1,22 @@
+[Unit]
+Description=Incus - main daemon
+After=network-online.target lxcfs.service incus.socket
+Requires=network-online.target lxcfs.service incus.socket
+
+[Service]
+ExecStart=/usr/sbin/incusd --group incus-admin --syslog
+ExecStartPost=/usr/sbin/incusd waitready --timeout=600
+ExecStartPre=/bin/mkdir -p /var/log/incus
+ExecStartPre=/bin/chown -R root:incus-admin /var/log/incus
+KillMode=process
+EnvironmentFile=/etc/env.d/90incus
+PermissionsStartOnly=true
+TimeoutStartSec=600s
+TimeoutStopSec=30s
+Restart=on-failure
+LimitNOFILE=1048576
+LimitNPROC=infinity
+TasksMax=infinity
+
+[Install]
+Also=incus-startup.service incus.socket
diff --git a/app-containers/incus/files/incus-CVE-2026-23953.patch b/app-containers/incus/files/incus-CVE-2026-23953.patch
new file mode 100644
index 000000000000..59277fd797c7
--- /dev/null
+++ b/app-containers/incus/files/incus-CVE-2026-23953.patch
@@ -0,0 +1,42 @@
+From d6f0a77dd26df4c1ced80ffa63848279fd4330cc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber@stgraber.org>
+Date: Tue, 20 Jan 2026 23:27:25 -0500
+Subject: [PATCH] internal/instance: Prevent line breaks in environment
+ variables
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+LXC doesn't currently have a syntax to hold a multi-line environment
+variable in its configuration. The use of multi-line environment
+variables leads to a corrupted configuration file and to a security
+issue where additional lines may be added by an unprivileged user to
+escalate their privileges.
+
+This fixes CVE-2026-23953.
+
+Reported-by: Rory McNamara <rory.mcnamara@snyk.io>
+Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
+---
+ internal/instance/config.go | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/internal/instance/config.go b/internal/instance/config.go
+index a282f99e478..2c6c779205b 100644
+--- a/internal/instance/config.go
++++ b/internal/instance/config.go
+@@ -1376,7 +1376,13 @@ func ConfigKeyChecker(key string, instanceType api.InstanceType) (func(value str
+ 	//  liveupdate: yes
+ 	//  shortdesc: Free-form environment key/value
+ 	if strings.HasPrefix(key, "environment.") {
+-		return validate.IsAny, nil
++		return func(val string) error {
++			if strings.Contains(val, "\n") {
++				return errors.New("Environment variables cannot contain line breaks")
++			}
++
++			return nil
++		}, nil
+ 	}
+ 
+ 	// gendoc:generate(entity=instance, group=miscellaneous, key=user.*)
diff --git a/app-containers/incus/files/incus-CVE-2026-23954.patch b/app-containers/incus/files/incus-CVE-2026-23954.patch
new file mode 100644
index 000000000000..930a8d8be45e
--- /dev/null
+++ b/app-containers/incus/files/incus-CVE-2026-23954.patch
@@ -0,0 +1,113 @@
+From 92ac6ac999a4928cfdb92c485a048e4d51f471d0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber@stgraber.org>
+Date: Wed, 21 Jan 2026 00:04:37 -0500
+Subject: [PATCH] incusd/instance/lxc: Restrict path of template files and
+ targets
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This fixes three security issues related to file templates:
+
+ - The template target path could be made to be relative or gothrough
+   symlinks in a way that could lead to arbitrary write to the host
+   filesystem.
+
+ - The template directory could be relative, allowing for arbitrary read
+   from the host filesystem.
+
+ - The template file itself could be made relative, allowing for
+   arbitrary reads from the host filesystem.
+
+In the case of the template target path, the new logic makes use of the
+kernel's openat2 system call which brings a variety of flags that can be
+used to restrict path resolution and detect potential issues.
+
+For the template path itself, we now validate that it is a simple local
+file and that the template directory isn't a symlink.
+
+This fixes CVE-2026-23954
+
+Reported-by: Rory McNamara <rory.mcnamara@snyk.io>
+Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
+---
+ .../server/instance/drivers/driver_lxc.go     | 58 ++++++++++++++++++-
+ 1 file changed, 57 insertions(+), 1 deletion(-)
+
+diff --git a/internal/server/instance/drivers/driver_lxc.go b/internal/server/instance/drivers/driver_lxc.go
+index b6d8cb9a0a7..a1e4f6bbe0d 100644
+--- a/internal/server/instance/drivers/driver_lxc.go
++++ b/internal/server/instance/drivers/driver_lxc.go
+@@ -6841,6 +6841,32 @@ func (d *lxc) templateApplyNow(trigger instance.TemplateTrigger) error {
+ 		containerMeta["privileged"] = "false"
+ 	}
+ 
++	// Setup security check.
++	rootfsPath, err := os.OpenFile(d.RootfsPath(), unix.O_PATH, 0)
++	if err != nil {
++		return fmt.Errorf("Failed to open instance rootfs path: %w", err)
++	}
++
++	defer func() { _ = rootfsPath.Close() }()
++
++	checkBeneath := func(targetPath string) error {
++		fd, err := unix.Openat2(int(rootfsPath.Fd()), targetPath, &unix.OpenHow{
++			Flags:   unix.O_PATH | unix.O_CLOEXEC,
++			Resolve: unix.RESOLVE_BENEATH | unix.RESOLVE_NO_MAGICLINKS,
++		})
++		if err != nil {
++			if errors.Is(err, unix.EXDEV) {
++				return errors.New("Template is attempting access to path outside of container")
++			}
++
++			return nil
++		}
++
++		_ = unix.Close(fd)
++
++		return nil
++	}
++
+ 	// Go through the templates
+ 	for tplPath, tpl := range metadata.Templates {
+ 		err = func(tplPath string, tpl *api.ImageMetadataTemplate) error {
+@@ -6853,8 +6879,38 @@ func (d *lxc) templateApplyNow(trigger instance.TemplateTrigger) error {
+ 				return nil
+ 			}
+ 
++			// Perform some security checks.
++			relPath := strings.TrimLeft(tplPath, "/")
++
++			err = checkBeneath(relPath)
++			if err != nil {
++				return err
++			}
++
++			if filepath.Base(tpl.Template) != tpl.Template {
++				return errors.New("Template path is attempting to read outside of template directory")
++			}
++
++			tplDirStat, err := os.Lstat(d.TemplatesPath())
++			if err != nil {
++				return fmt.Errorf("Couldn't access template directory: %w", err)
++			}
++
++			if !tplDirStat.IsDir() {
++				return errors.New("Template directory isn't a regular directory")
++			}
++
++			tplFileStat, err := os.Lstat(filepath.Join(d.TemplatesPath(), tpl.Template))
++			if err != nil {
++				return fmt.Errorf("Couldn't access template file: %w", err)
++			}
++
++			if tplFileStat.Mode()&os.ModeSymlink == os.ModeSymlink {
++				return errors.New("Template file is a symlink")
++			}
++
+ 			// Open the file to template, create if needed
+-			fullpath := filepath.Join(d.RootfsPath(), strings.TrimLeft(tplPath, "/"))
++			fullpath := filepath.Join(d.RootfsPath(), relPath)
+ 			if util.PathExists(fullpath) {
+ 				if tpl.CreateOnly {
+ 					return nil
diff --git a/app-containers/incus/files/incus-startup-0.4.service b/app-containers/incus/files/incus-startup-0.4.service
new file mode 100644
index 000000000000..8838bdc4949d
--- /dev/null
+++ b/app-containers/incus/files/incus-startup-0.4.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=Incus - Startup check
+After=incus.socket incus.service
+Requires=incus.socket
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/incus-startup start
+ExecStop=/usr/sbin/incus-startup stop
+TimeoutStartSec=600s
+TimeoutStopSec=600s
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/app-containers/incus/files/incus-startup-0.4.sh b/app-containers/incus/files/incus-startup-0.4.sh
new file mode 100644
index 000000000000..6b19f22e4cb5
--- /dev/null
+++ b/app-containers/incus/files/incus-startup-0.4.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    start)
+      systemctl is-active incus -q && exit 0
+      exec incusd activateifneeded
+    ;;
+
+    stop)
+      systemctl is-active incus -q || exit 0
+      exec incusd shutdown
+    ;;
+
+    *)
+        echo "unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+exit 0
diff --git a/app-containers/incus/files/incus-user-0.4.initd b/app-containers/incus/files/incus-user-0.4.initd
new file mode 100644
index 000000000000..7d81d298f584
--- /dev/null
+++ b/app-containers/incus/files/incus-user-0.4.initd
@@ -0,0 +1,37 @@
+#!/sbin/openrc-run
+# Copyright 2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+name="incus-user socket daemon"
+description="incus-user socket daemon"
+
+DAEMON=/usr/sbin/incus-user
+PIDFILE=/run/incus-user.pid
+
+depend() {
+	need incus
+	need net
+}
+
+start() {
+	ebegin "Starting incus-user socket daemon"
+
+	start-stop-daemon --start \
+		--pidfile ${PIDFILE} \
+		--exec ${DAEMON} \
+		--background \
+		--make-pidfile \
+		-- \
+		--group incus
+	eend ${?}
+}
+
+stop() {
+	if [ "${RC_CMD}" = restart ]; then
+		start-stop-daemon --stop --quiet -p "${PIDFILE}"
+		eend ${?}
+	else
+		start-stop-daemon --stop --quiet -p "${PIDFILE}"
+		eend ${?}
+	fi
+}
diff --git a/app-containers/incus/files/incus-user-0.4.service b/app-containers/incus/files/incus-user-0.4.service
new file mode 100644
index 000000000000..4cb4d44263cb
--- /dev/null
+++ b/app-containers/incus/files/incus-user-0.4.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Incus - User daemon
+After=incus-user.socket incus.service
+Requires=incus-user.socket
+
+[Service]
+EnvironmentFile=-/etc/environment
+ExecStart=/usr/sbin/incus-user --group incus
+Restart=on-failure
+
+[Install]
+Also=incus-user.socket
diff --git a/app-containers/incus/files/incus-user-0.4.socket b/app-containers/incus/files/incus-user-0.4.socket
new file mode 100644
index 000000000000..5c14276fc6c6
--- /dev/null
+++ b/app-containers/incus/files/incus-user-0.4.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=Incus - Daemon (user unix socket)
+
+[Socket]
+ListenStream=/var/lib/incus/unix.socket.user
+SocketGroup=incus
+SocketMode=0660
+Service=incus-user.service
+
+[Install]
+WantedBy=sockets.target
diff --git a/app-containers/incus/incus-6.0.5-r1.ebuild b/app-containers/incus/incus-6.0.5-r1.ebuild
new file mode 100644
index 000000000000..dedc3b33981f
--- /dev/null
+++ b/app-containers/incus/incus-6.0.5-r1.ebuild
@@ -0,0 +1,268 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
+SRC_URI="https://linuxcontainers.org/downloads/incus/${P}.tar.xz
+	verify-sig? ( https://linuxcontainers.org/downloads/incus/${P}.tar.xz.asc )"
+
+LICENSE="Apache-2.0 BSD LGPL-3 MIT"
+SLOT="0/lts"
+KEYWORDS="amd64 ~arm64"
+IUSE="apparmor fuidshift nls qemu"
+
+DEPEND="acct-group/incus
+	acct-group/incus-admin
+	app-arch/xz-utils
+	>=app-containers/lxc-5.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/cowsql-1.15.9
+	dev-libs/lzo
+	>=dev-libs/raft-0.22.1:=[lz4]
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+		net-firewall/iptables
+		net-firewall/nftables[json]
+	)
+	fuidshift? ( !app-containers/lxd )
+	net-firewall/ebtables
+	sys-apps/iproute2
+	sys-fs/fuse:*
+	>=sys-fs/lxcfs-5.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
+	qemu? (
+		app-cdr/cdrtools
+		app-emulation/qemu[spice,usbredir,virtfs]
+		sys-apps/gptfdisk
+	)"
+BDEPEND=">=dev-lang/go-1.21
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+CONFIG_CHECK="
+	~AIO
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_AIO="CONFIG_AIO is required."
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/incus
+	/usr/bin/incus-agent
+	/usr/bin/incus-benchmark
+	/usr/bin/incus-migrate
+	/usr/bin/lxc-to-incus
+	/usr/sbin/fuidshift
+	/usr/sbin/incusd
+	/usr/sbin/lxd-to-incus"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+PATCHES=( "${FILESDIR}"/incus-CVE-2026-23953.patch
+	"${FILESDIR}"/incus-CVE-2026-23954.patch )
+
+src_unpack() {
+	verify-sig_src_unpack
+	go-module_src_unpack
+}
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/incus:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
+		internal/server/instance/drivers/edk2/driver_edk2.go || die "Failed to fix hardcoded ovmf paths."
+
+	cp "${FILESDIR}"/incus-6.14-r1.service "${T}"/incus.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/incus.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+incus_get_bindir() {
+	local host_arch=${1}
+	if [[ "${GOARCH}" != "${host_arch}" ]]; then
+		echo "_dist/bin/linux_${GOARCH}"
+	else
+		echo "_dist/bin"
+	fi
+}
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in incus-benchmark incus-simplestreams incus-user incus lxc-to-incus lxd-to-incus ; do
+		ego install -v -x "${S}/cmd/${k}"
+	done
+
+	if use fuidshift ; then
+		ego install -v -x "${S}/cmd/fuidshift"
+	fi
+
+	ego install -v -x -tags libsqlite3 "${S}"/cmd/incusd
+
+	CGO_ENABLED=0 go install -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-migrate
+
+	local bindir=$(incus_get_bindir "$(go-env_goarch "${CBUILD}")")
+
+	# Build the VM agents, statically too
+	if use amd64 ; then
+		GOARCH=amd64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=amd64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	elif use arm64 ; then
+		GOARCH=arm64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=arm64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	else
+		echo "No VM support for this arch."
+		return
+	fi
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	local bindir=$(incus_get_bindir "${GOHOSTARCH}")
+
+	newsbin "${FILESDIR}"/incus-startup-0.4.sh incus-startup
+
+	# Admin tools
+	for l in incusd incus-user lxd-to-incus ; do
+		dosbin "${bindir}/${l}"
+	done
+
+	# User tools
+	for m in incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
+		dobin "${bindir}/${m}"
+	done
+
+	# VM Agents
+	if use amd64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.x86_64
+		doexe ${bindir}/incus-agent.linux.i686
+		doexe ${bindir}/incus-agent.windows.x86_64
+		doexe ${bindir}/incus-agent.windows.i686
+	elif use arm64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.aarch64
+		doexe ${bindir}/incus-agent.windows.aarch64
+	fi
+
+	# fuidshift, should be moved under admin tools at some point
+	if use fuidshift ; then
+		dosbin ${bindir}/fuidshift
+	fi
+
+	newconfd "${FILESDIR}"/incus-6.0.confd incus
+	newinitd "${FILESDIR}"/incus-6.0.initd incus
+	newinitd "${FILESDIR}"/incus-user-0.4.initd incus-user
+
+	systemd_dounit "${T}"/incus.service
+	systemd_newunit "${FILESDIR}"/incus-0.4.socket incus.socket
+	systemd_newunit "${FILESDIR}"/incus-startup-0.4.service incus-startup.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.service incus-user.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.socket incus-user.socket
+
+	if ! tc-is-cross-compiler; then
+		# Generate and install shell completion files.
+		mkdir -p "${D}"/usr/share/{bash-completion/completions/,fish/vendor_completions.d/,zsh/site-functions/} || die
+		"${bindir}"/incus completion bash > "${D}"/usr/share/bash-completion/completions/incus || die
+		"${bindir}"/incus completion fish > "${D}"/usr/share/fish/vendor_completions.d/incus.fish || die
+		"${bindir}"/incus completion zsh > "${D}"/usr/share/zsh/site-functions/_incus || die
+	else
+		ewarn "Shell completion files not installed! Install them manually with incus completion --help"
+	fi
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+
+	# Incus needs INCUS_EDK2_PATH in env to find OVMF files for virtual machines, #946184,
+	# and INCUS_AGENT_PATH to find multi-setup agents for VMs, #959878.
+	newenvd "${FILESDIR}"/90incus.envd 90incus
+}
+
+pkg_postinst() {
+	elog
+	elog "Please see"
+	elog "  https://wiki.gentoo.org/wiki/Incus"
+	elog "  https://wiki.gentoo.org/wiki/Incus#Migrating_from_LXD"
+	elog
+	optfeature "OCI container images support" app-containers/skopeo app-containers/umoci
+	optfeature "support for ACME certificate issuance" app-crypt/lego
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full incus-migrate support" net-misc/rsync
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the incus group."
+	elog
+}
diff --git a/app-containers/incus/incus-6.0.6.ebuild b/app-containers/incus/incus-6.0.6.ebuild
new file mode 100644
index 000000000000..2a361cd0d714
--- /dev/null
+++ b/app-containers/incus/incus-6.0.6.ebuild
@@ -0,0 +1,265 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
+SRC_URI="https://linuxcontainers.org/downloads/incus/${P}.tar.xz
+	verify-sig? ( https://linuxcontainers.org/downloads/incus/${P}.tar.xz.asc )"
+
+LICENSE="Apache-2.0 BSD LGPL-3 MIT"
+SLOT="0/lts"
+KEYWORDS="~amd64 ~arm64"
+IUSE="apparmor fuidshift nls qemu"
+
+DEPEND="acct-group/incus
+	acct-group/incus-admin
+	app-arch/xz-utils
+	>=app-containers/lxc-5.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/cowsql-1.15.9
+	dev-libs/lzo
+	>=dev-libs/raft-0.22.1:=[lz4]
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+		net-firewall/iptables
+		net-firewall/nftables[json]
+	)
+	fuidshift? ( !app-containers/lxd )
+	net-firewall/ebtables
+	sys-apps/iproute2
+	sys-fs/fuse:*
+	>=sys-fs/lxcfs-5.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
+	qemu? (
+		app-cdr/cdrtools
+		app-emulation/qemu[spice,usbredir,virtfs]
+		sys-apps/gptfdisk
+	)"
+BDEPEND=">=dev-lang/go-1.21
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+CONFIG_CHECK="
+	~AIO
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_AIO="CONFIG_AIO is required."
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/incus
+	/usr/bin/incus-agent
+	/usr/bin/incus-benchmark
+	/usr/bin/incus-migrate
+	/usr/bin/lxc-to-incus
+	/usr/sbin/fuidshift
+	/usr/sbin/incusd
+	/usr/sbin/lxd-to-incus"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_unpack() {
+	verify-sig_src_unpack
+	go-module_src_unpack
+}
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/incus:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
+		internal/server/instance/drivers/edk2/driver_edk2.go || die "Failed to fix hardcoded ovmf paths."
+
+	cp "${FILESDIR}"/incus-6.14-r1.service "${T}"/incus.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/incus.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+incus_get_bindir() {
+	local host_arch=${1}
+	if [[ "${GOARCH}" != "${host_arch}" ]]; then
+		echo "_dist/bin/linux_${GOARCH}"
+	else
+		echo "_dist/bin"
+	fi
+}
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in incus-benchmark incus-simplestreams incus-user incus lxc-to-incus lxd-to-incus ; do
+		ego install -v -x "${S}/cmd/${k}"
+	done
+
+	if use fuidshift ; then
+		ego install -v -x "${S}/cmd/fuidshift"
+	fi
+
+	ego install -v -x -tags libsqlite3 "${S}"/cmd/incusd
+
+	CGO_ENABLED=0 go install -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-migrate
+
+	local bindir=$(incus_get_bindir "$(go-env_goarch "${CBUILD}")")
+
+	# Build the VM agents, statically too
+	if use amd64 ; then
+		GOARCH=amd64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=amd64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	elif use arm64 ; then
+		GOARCH=arm64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=arm64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	else
+		echo "No VM support for this arch."
+		return
+	fi
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	local bindir=$(incus_get_bindir "${GOHOSTARCH}")
+
+	newsbin "${FILESDIR}"/incus-startup-0.4.sh incus-startup
+
+	# Admin tools
+	for l in incusd incus-user lxd-to-incus ; do
+		dosbin "${bindir}/${l}"
+	done
+
+	# User tools
+	for m in incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
+		dobin "${bindir}/${m}"
+	done
+
+	# VM Agents
+	if use amd64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.x86_64
+		doexe ${bindir}/incus-agent.linux.i686
+		doexe ${bindir}/incus-agent.windows.x86_64
+		doexe ${bindir}/incus-agent.windows.i686
+	elif use arm64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.aarch64
+		doexe ${bindir}/incus-agent.windows.aarch64
+	fi
+
+	# fuidshift, should be moved under admin tools at some point
+	if use fuidshift ; then
+		dosbin ${bindir}/fuidshift
+	fi
+
+	newconfd "${FILESDIR}"/incus-6.0.confd incus
+	newinitd "${FILESDIR}"/incus-6.0.initd incus
+	newinitd "${FILESDIR}"/incus-user-0.4.initd incus-user
+
+	systemd_dounit "${T}"/incus.service
+	systemd_newunit "${FILESDIR}"/incus-0.4.socket incus.socket
+	systemd_newunit "${FILESDIR}"/incus-startup-0.4.service incus-startup.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.service incus-user.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.socket incus-user.socket
+
+	if ! tc-is-cross-compiler; then
+		# Generate and install shell completion files.
+		mkdir -p "${D}"/usr/share/{bash-completion/completions/,fish/vendor_completions.d/,zsh/site-functions/} || die
+		"${bindir}"/incus completion bash > "${D}"/usr/share/bash-completion/completions/incus || die
+		"${bindir}"/incus completion fish > "${D}"/usr/share/fish/vendor_completions.d/incus.fish || die
+		"${bindir}"/incus completion zsh > "${D}"/usr/share/zsh/site-functions/_incus || die
+	else
+		ewarn "Shell completion files not installed! Install them manually with incus completion --help"
+	fi
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+
+	# Incus needs INCUS_EDK2_PATH in env to find OVMF files for virtual machines, #946184,
+	# and INCUS_AGENT_PATH to find multi-setup agents for VMs, #959878.
+	newenvd "${FILESDIR}"/90incus.envd 90incus
+}
+
+pkg_postinst() {
+	elog
+	elog "Please see"
+	elog "  https://wiki.gentoo.org/wiki/Incus"
+	elog "  https://wiki.gentoo.org/wiki/Incus#Migrating_from_LXD"
+	elog
+	optfeature "OCI container images support" app-containers/skopeo app-containers/umoci
+	optfeature "support for ACME certificate issuance" app-crypt/lego
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full incus-migrate support" net-misc/rsync
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the incus group."
+	elog
+}
diff --git a/app-containers/incus/incus-6.21.ebuild b/app-containers/incus/incus-6.21.ebuild
new file mode 100644
index 000000000000..3e097c140192
--- /dev/null
+++ b/app-containers/incus/incus-6.21.ebuild
@@ -0,0 +1,282 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
+
+if [[ "${PV}" == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/lxc/incus.git"
+else
+	SRC_URI="https://linuxcontainers.org/downloads/incus/${P}.tar.xz
+		verify-sig? ( https://linuxcontainers.org/downloads/incus/${P}.tar.xz.asc )"
+	KEYWORDS="~amd64 ~arm64"
+fi
+
+LICENSE="Apache-2.0 BSD LGPL-3 MIT"
+SLOT="0/stable"
+IUSE="apparmor fuidshift nls qemu selinux"
+
+DEPEND="acct-group/incus
+	acct-group/incus-admin
+	app-arch/xz-utils
+	>=app-containers/lxc-5.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/cowsql-1.15.7
+	dev-libs/lzo
+	>=dev-libs/raft-0.22.1:=[lz4]
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+		net-firewall/iptables
+		net-firewall/nftables[json]
+	)
+	fuidshift? ( !app-containers/lxd )
+	net-firewall/ebtables
+	sys-apps/iproute2
+	sys-fs/fuse:*
+	>=sys-fs/lxcfs-5.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
+	qemu? (
+		app-cdr/cdrtools
+		app-emulation/qemu[spice,usbredir,virtfs]
+		sys-apps/gptfdisk
+	)"
+BDEPEND=">=dev-lang/go-1.24.7
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+CONFIG_CHECK="
+	~AIO
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_AIO="CONFIG_AIO is required."
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/incus
+	/usr/bin/incus-agent
+	/usr/bin/incus-benchmark
+	/usr/bin/incus-migrate
+	/usr/bin/lxc-to-incus
+	/usr/sbin/fuidshift
+	/usr/sbin/incusd
+	/usr/sbin/lxd-to-incus"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_unpack() {
+	if [[ "${PV}" == 9999* ]]; then
+		git-r3_src_unpack
+		go-module_live_vendor
+		go-env_set_compile_environment
+	else
+		verify-sig_src_unpack
+		go-module_src_unpack
+	fi
+}
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/incus:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
+		internal/server/instance/drivers/edk2/driver_edk2.go || die "Failed to fix hardcoded ovmf paths."
+
+	cp "${FILESDIR}"/incus-6.14-r1.service "${T}"/incus.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/incus.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+incus_get_bindir() {
+	local host_arch=${1}
+	if [[ "${GOARCH}" != "${host_arch}" ]]; then
+		echo "_dist/bin/linux_${GOARCH}"
+	else
+		echo "_dist/bin"
+	fi
+}
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in incus-benchmark incus-simplestreams incus-user incus lxc-to-incus lxd-to-incus ; do
+		ego install -v -x "${S}/cmd/${k}"
+	done
+
+	if use fuidshift ; then
+		ego install -v -x "${S}/cmd/fuidshift"
+	fi
+
+	ego install -v -x -tags libsqlite3 "${S}"/cmd/incusd
+
+	# Needs to be built statically
+	CGO_ENABLED=0 go install -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-migrate
+
+	local bindir=$(incus_get_bindir "$(go-env_goarch "${CBUILD}")")
+
+	# Build the VM agents, statically too
+	if use amd64 ; then
+		GOARCH=amd64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=amd64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	elif use arm64 ; then
+		GOARCH=arm64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=arm64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	else
+		echo "No VM support for this arch."
+		return
+	fi
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	local bindir=$(incus_get_bindir "${GOHOSTARCH}")
+
+	newsbin "${FILESDIR}"/incus-startup-0.4.sh incus-startup
+
+	# Admin tools
+	for l in incusd incus-user lxd-to-incus ; do
+		dosbin "${bindir}/${l}"
+	done
+
+	# User tools
+	for m in incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
+		dobin "${bindir}/${m}"
+	done
+
+	# VM Agents
+	if use amd64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.x86_64
+		doexe ${bindir}/incus-agent.linux.i686
+		doexe ${bindir}/incus-agent.windows.x86_64
+		doexe ${bindir}/incus-agent.windows.i686
+	elif use arm64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.aarch64
+		doexe ${bindir}/incus-agent.windows.aarch64
+	fi
+
+	# fuidshift, should be moved under admin tools at some point
+	if use fuidshift ; then
+		dosbin ${bindir}/fuidshift
+	fi
+
+	newconfd "${FILESDIR}"/incus-6.0.confd incus
+	newinitd "${FILESDIR}"/incus-6.0.initd incus
+	newinitd "${FILESDIR}"/incus-user-0.4.initd incus-user
+
+	systemd_dounit "${T}"/incus.service
+	systemd_newunit "${FILESDIR}"/incus-0.4.socket incus.socket
+	systemd_newunit "${FILESDIR}"/incus-startup-0.4.service incus-startup.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.service incus-user.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.socket incus-user.socket
+
+	if ! tc-is-cross-compiler; then
+		# Generate and install shell completion files.
+		mkdir -p "${D}"/usr/share/{bash-completion/completions/,fish/vendor_completions.d/,zsh/site-functions/} || die
+		"${bindir}"/incus completion bash > "${D}"/usr/share/bash-completion/completions/incus || die
+		"${bindir}"/incus completion fish > "${D}"/usr/share/fish/vendor_completions.d/incus.fish || die
+		"${bindir}"/incus completion zsh > "${D}"/usr/share/zsh/site-functions/_incus || die
+	else
+		ewarn "Shell completion files not installed! Install them manually with incus completion --help"
+	fi
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+
+	# Incus needs INCUS_EDK2_PATH in env to find OVMF files for virtual machines, #946184,
+	# and INCUS_AGENT_PATH to find multi-setup agents for VMs, #959878,
+	# and INCUS_SECURITY_SELINUX=true to enable selinux support (until its enabled by default)
+	newenvd "${FILESDIR}"/90incus.envd 90incus
+	if use selinux; then
+		echo "INCUS_SECURITY_SELINUX=true" >> "${D}"/etc/env.d/90incus
+	fi
+}
+
+pkg_postinst() {
+	elog
+	elog "Please see"
+	elog "  https://wiki.gentoo.org/wiki/Incus"
+	elog "  https://wiki.gentoo.org/wiki/Incus#Migrating_from_LXD"
+	elog
+	optfeature "OCI container images support" app-containers/skopeo app-containers/umoci
+	optfeature "support for ACME certificate issuance" app-crypt/lego
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full incus-migrate support" net-misc/rsync
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the incus group."
+	elog
+}
diff --git a/app-containers/incus/incus-6.22.ebuild b/app-containers/incus/incus-6.22.ebuild
new file mode 100644
index 000000000000..3e097c140192
--- /dev/null
+++ b/app-containers/incus/incus-6.22.ebuild
@@ -0,0 +1,282 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
+
+if [[ "${PV}" == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/lxc/incus.git"
+else
+	SRC_URI="https://linuxcontainers.org/downloads/incus/${P}.tar.xz
+		verify-sig? ( https://linuxcontainers.org/downloads/incus/${P}.tar.xz.asc )"
+	KEYWORDS="~amd64 ~arm64"
+fi
+
+LICENSE="Apache-2.0 BSD LGPL-3 MIT"
+SLOT="0/stable"
+IUSE="apparmor fuidshift nls qemu selinux"
+
+DEPEND="acct-group/incus
+	acct-group/incus-admin
+	app-arch/xz-utils
+	>=app-containers/lxc-5.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/cowsql-1.15.7
+	dev-libs/lzo
+	>=dev-libs/raft-0.22.1:=[lz4]
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+		net-firewall/iptables
+		net-firewall/nftables[json]
+	)
+	fuidshift? ( !app-containers/lxd )
+	net-firewall/ebtables
+	sys-apps/iproute2
+	sys-fs/fuse:*
+	>=sys-fs/lxcfs-5.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
+	qemu? (
+		app-cdr/cdrtools
+		app-emulation/qemu[spice,usbredir,virtfs]
+		sys-apps/gptfdisk
+	)"
+BDEPEND=">=dev-lang/go-1.24.7
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+CONFIG_CHECK="
+	~AIO
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_AIO="CONFIG_AIO is required."
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/incus
+	/usr/bin/incus-agent
+	/usr/bin/incus-benchmark
+	/usr/bin/incus-migrate
+	/usr/bin/lxc-to-incus
+	/usr/sbin/fuidshift
+	/usr/sbin/incusd
+	/usr/sbin/lxd-to-incus"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_unpack() {
+	if [[ "${PV}" == 9999* ]]; then
+		git-r3_src_unpack
+		go-module_live_vendor
+		go-env_set_compile_environment
+	else
+		verify-sig_src_unpack
+		go-module_src_unpack
+	fi
+}
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/incus:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
+		internal/server/instance/drivers/edk2/driver_edk2.go || die "Failed to fix hardcoded ovmf paths."
+
+	cp "${FILESDIR}"/incus-6.14-r1.service "${T}"/incus.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/incus.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+incus_get_bindir() {
+	local host_arch=${1}
+	if [[ "${GOARCH}" != "${host_arch}" ]]; then
+		echo "_dist/bin/linux_${GOARCH}"
+	else
+		echo "_dist/bin"
+	fi
+}
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in incus-benchmark incus-simplestreams incus-user incus lxc-to-incus lxd-to-incus ; do
+		ego install -v -x "${S}/cmd/${k}"
+	done
+
+	if use fuidshift ; then
+		ego install -v -x "${S}/cmd/fuidshift"
+	fi
+
+	ego install -v -x -tags libsqlite3 "${S}"/cmd/incusd
+
+	# Needs to be built statically
+	CGO_ENABLED=0 go install -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-migrate
+
+	local bindir=$(incus_get_bindir "$(go-env_goarch "${CBUILD}")")
+
+	# Build the VM agents, statically too
+	if use amd64 ; then
+		GOARCH=amd64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=amd64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	elif use arm64 ; then
+		GOARCH=arm64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=arm64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	else
+		echo "No VM support for this arch."
+		return
+	fi
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	local bindir=$(incus_get_bindir "${GOHOSTARCH}")
+
+	newsbin "${FILESDIR}"/incus-startup-0.4.sh incus-startup
+
+	# Admin tools
+	for l in incusd incus-user lxd-to-incus ; do
+		dosbin "${bindir}/${l}"
+	done
+
+	# User tools
+	for m in incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
+		dobin "${bindir}/${m}"
+	done
+
+	# VM Agents
+	if use amd64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.x86_64
+		doexe ${bindir}/incus-agent.linux.i686
+		doexe ${bindir}/incus-agent.windows.x86_64
+		doexe ${bindir}/incus-agent.windows.i686
+	elif use arm64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.aarch64
+		doexe ${bindir}/incus-agent.windows.aarch64
+	fi
+
+	# fuidshift, should be moved under admin tools at some point
+	if use fuidshift ; then
+		dosbin ${bindir}/fuidshift
+	fi
+
+	newconfd "${FILESDIR}"/incus-6.0.confd incus
+	newinitd "${FILESDIR}"/incus-6.0.initd incus
+	newinitd "${FILESDIR}"/incus-user-0.4.initd incus-user
+
+	systemd_dounit "${T}"/incus.service
+	systemd_newunit "${FILESDIR}"/incus-0.4.socket incus.socket
+	systemd_newunit "${FILESDIR}"/incus-startup-0.4.service incus-startup.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.service incus-user.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.socket incus-user.socket
+
+	if ! tc-is-cross-compiler; then
+		# Generate and install shell completion files.
+		mkdir -p "${D}"/usr/share/{bash-completion/completions/,fish/vendor_completions.d/,zsh/site-functions/} || die
+		"${bindir}"/incus completion bash > "${D}"/usr/share/bash-completion/completions/incus || die
+		"${bindir}"/incus completion fish > "${D}"/usr/share/fish/vendor_completions.d/incus.fish || die
+		"${bindir}"/incus completion zsh > "${D}"/usr/share/zsh/site-functions/_incus || die
+	else
+		ewarn "Shell completion files not installed! Install them manually with incus completion --help"
+	fi
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+
+	# Incus needs INCUS_EDK2_PATH in env to find OVMF files for virtual machines, #946184,
+	# and INCUS_AGENT_PATH to find multi-setup agents for VMs, #959878,
+	# and INCUS_SECURITY_SELINUX=true to enable selinux support (until its enabled by default)
+	newenvd "${FILESDIR}"/90incus.envd 90incus
+	if use selinux; then
+		echo "INCUS_SECURITY_SELINUX=true" >> "${D}"/etc/env.d/90incus
+	fi
+}
+
+pkg_postinst() {
+	elog
+	elog "Please see"
+	elog "  https://wiki.gentoo.org/wiki/Incus"
+	elog "  https://wiki.gentoo.org/wiki/Incus#Migrating_from_LXD"
+	elog
+	optfeature "OCI container images support" app-containers/skopeo app-containers/umoci
+	optfeature "support for ACME certificate issuance" app-crypt/lego
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full incus-migrate support" net-misc/rsync
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the incus group."
+	elog
+}
diff --git a/app-containers/incus/incus-6.23.ebuild b/app-containers/incus/incus-6.23.ebuild
new file mode 100644
index 000000000000..ec2cb83449c6
--- /dev/null
+++ b/app-containers/incus/incus-6.23.ebuild
@@ -0,0 +1,283 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
+
+if [[ "${PV}" == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/lxc/incus.git"
+else
+	SRC_URI="https://linuxcontainers.org/downloads/incus/${P}.tar.xz
+		verify-sig? ( https://linuxcontainers.org/downloads/incus/${P}.tar.xz.asc )"
+	KEYWORDS="~amd64 ~arm64"
+fi
+
+LICENSE="Apache-2.0 BSD LGPL-3 MIT"
+SLOT="0/stable"
+IUSE="apparmor fuidshift nls qemu selinux"
+
+DEPEND="acct-group/incus
+	acct-group/incus-admin
+	app-arch/xz-utils
+	>=app-containers/lxc-5.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/cowsql-1.15.7
+	dev-libs/lzo
+	>=dev-libs/raft-0.22.1:=[lz4]
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+		net-firewall/iptables
+		net-firewall/nftables[json]
+	)
+	fuidshift? ( !app-containers/lxd )
+	net-firewall/ebtables
+	sys-apps/iproute2
+	sys-fs/fuse:*
+	>=sys-fs/lxcfs-5.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
+	qemu? (
+		app-cdr/cdrtools
+		app-emulation/qemu[spice,usbredir,virtfs]
+		sys-apps/gptfdisk
+	)
+	selinux? ( sec-policy/selinux-incus )"
+BDEPEND=">=dev-lang/go-1.24.7
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+CONFIG_CHECK="
+	~AIO
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_AIO="CONFIG_AIO is required."
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/incus
+	/usr/bin/incus-agent
+	/usr/bin/incus-benchmark
+	/usr/bin/incus-migrate
+	/usr/bin/lxc-to-incus
+	/usr/sbin/fuidshift
+	/usr/sbin/incusd
+	/usr/sbin/lxd-to-incus"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_unpack() {
+	if [[ "${PV}" == 9999* ]]; then
+		git-r3_src_unpack
+		go-module_live_vendor
+		go-env_set_compile_environment
+	else
+		verify-sig_src_unpack
+		go-module_src_unpack
+	fi
+}
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/incus:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
+		internal/server/instance/drivers/edk2/driver_edk2.go || die "Failed to fix hardcoded ovmf paths."
+
+	cp "${FILESDIR}"/incus-6.14-r1.service "${T}"/incus.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/incus.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+incus_get_bindir() {
+	local host_arch=${1}
+	if [[ "${GOARCH}" != "${host_arch}" ]]; then
+		echo "_dist/bin/linux_${GOARCH}"
+	else
+		echo "_dist/bin"
+	fi
+}
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in incus-benchmark incus-simplestreams incus-user incus lxc-to-incus lxd-to-incus ; do
+		ego install -v -x "${S}/cmd/${k}"
+	done
+
+	if use fuidshift ; then
+		ego install -v -x "${S}/cmd/fuidshift"
+	fi
+
+	ego install -v -x -tags libsqlite3 "${S}"/cmd/incusd
+
+	# Needs to be built statically
+	CGO_ENABLED=0 go install -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-migrate
+
+	local bindir=$(incus_get_bindir "$(go-env_goarch "${CBUILD}")")
+
+	# Build the VM agents, statically too
+	if use amd64 ; then
+		GOARCH=amd64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=amd64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	elif use arm64 ; then
+		GOARCH=arm64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=arm64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	else
+		echo "No VM support for this arch."
+		return
+	fi
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	local bindir=$(incus_get_bindir "${GOHOSTARCH}")
+
+	newsbin "${FILESDIR}"/incus-startup-0.4.sh incus-startup
+
+	# Admin tools
+	for l in incusd incus-user lxd-to-incus ; do
+		dosbin "${bindir}/${l}"
+	done
+
+	# User tools
+	for m in incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
+		dobin "${bindir}/${m}"
+	done
+
+	# VM Agents
+	if use amd64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.x86_64
+		doexe ${bindir}/incus-agent.linux.i686
+		doexe ${bindir}/incus-agent.windows.x86_64
+		doexe ${bindir}/incus-agent.windows.i686
+	elif use arm64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.aarch64
+		doexe ${bindir}/incus-agent.windows.aarch64
+	fi
+
+	# fuidshift, should be moved under admin tools at some point
+	if use fuidshift ; then
+		dosbin ${bindir}/fuidshift
+	fi
+
+	newconfd "${FILESDIR}"/incus-6.0.confd incus
+	newinitd "${FILESDIR}"/incus-6.0.initd incus
+	newinitd "${FILESDIR}"/incus-user-0.4.initd incus-user
+
+	systemd_dounit "${T}"/incus.service
+	systemd_newunit "${FILESDIR}"/incus-0.4.socket incus.socket
+	systemd_newunit "${FILESDIR}"/incus-startup-0.4.service incus-startup.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.service incus-user.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.socket incus-user.socket
+
+	if ! tc-is-cross-compiler; then
+		# Generate and install shell completion files.
+		mkdir -p "${D}"/usr/share/{bash-completion/completions/,fish/vendor_completions.d/,zsh/site-functions/} || die
+		"${bindir}"/incus completion bash > "${D}"/usr/share/bash-completion/completions/incus || die
+		"${bindir}"/incus completion fish > "${D}"/usr/share/fish/vendor_completions.d/incus.fish || die
+		"${bindir}"/incus completion zsh > "${D}"/usr/share/zsh/site-functions/_incus || die
+	else
+		ewarn "Shell completion files not installed! Install them manually with incus completion --help"
+	fi
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+
+	# Incus needs INCUS_EDK2_PATH in env to find OVMF files for virtual machines, #946184,
+	# and INCUS_AGENT_PATH to find multi-setup agents for VMs, #959878,
+	# and INCUS_SECURITY_SELINUX=true to enable selinux support (until its enabled by default)
+	newenvd "${FILESDIR}"/90incus.envd 90incus
+	if use selinux; then
+		echo "INCUS_SECURITY_SELINUX=true" >> "${D}"/etc/env.d/90incus
+	fi
+}
+
+pkg_postinst() {
+	elog
+	elog "Please see"
+	elog "  https://wiki.gentoo.org/wiki/Incus"
+	elog "  https://wiki.gentoo.org/wiki/Incus#Migrating_from_LXD"
+	elog
+	optfeature "OCI container images support" app-containers/skopeo app-containers/umoci
+	optfeature "support for ACME certificate issuance" app-crypt/lego
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full incus-migrate support" net-misc/rsync
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the incus group."
+	elog
+}
diff --git a/app-containers/incus/incus-7.0.0.ebuild b/app-containers/incus/incus-7.0.0.ebuild
new file mode 100644
index 000000000000..67330b13161f
--- /dev/null
+++ b/app-containers/incus/incus-7.0.0.ebuild
@@ -0,0 +1,271 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
+SRC_URI="https://linuxcontainers.org/downloads/incus/${P}.tar.xz
+	verify-sig? ( https://linuxcontainers.org/downloads/incus/${P}.tar.xz.asc )"
+
+LICENSE="Apache-2.0 BSD LGPL-3 MIT"
+SLOT="0/lts"
+KEYWORDS="~amd64 ~arm64"
+IUSE="apparmor fuidshift nls qemu selinux"
+
+DEPEND="acct-group/incus
+	acct-group/incus-admin
+	app-arch/xz-utils
+	>=app-containers/lxc-6.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/cowsql-1.15.9
+	dev-libs/lzo
+	>=dev-libs/raft-0.22.1:=[lz4]
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+		net-firewall/iptables
+		net-firewall/nftables[json]
+	)
+	fuidshift? ( !app-containers/lxd )
+	net-firewall/ebtables
+	sys-apps/iproute2
+	sys-fs/fuse:*
+	>=sys-fs/lxcfs-6.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
+	qemu? (
+		app-cdr/cdrtools
+		app-emulation/qemu[spice,usbredir,virtfs]
+		sys-apps/gptfdisk
+	)
+	selinux? ( sec-policy/selinux-incus )"
+BDEPEND=">=dev-lang/go-1.25.6
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+CONFIG_CHECK="
+	~AIO
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_AIO="CONFIG_AIO is required."
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/incus
+	/usr/bin/incus-agent
+	/usr/bin/incus-benchmark
+	/usr/bin/incus-migrate
+	/usr/bin/lxc-to-incus
+	/usr/sbin/fuidshift
+	/usr/sbin/incusd
+	/usr/sbin/lxd-to-incus"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_unpack() {
+	verify-sig_src_unpack
+	go-module_src_unpack
+}
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/incus:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
+		internal/server/instance/drivers/edk2/driver_edk2.go || die "Failed to fix hardcoded ovmf paths."
+
+	cp "${FILESDIR}"/incus-6.14-r1.service "${T}"/incus.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/incus.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+incus_get_bindir() {
+	local host_arch=${1}
+	if [[ "${GOARCH}" != "${host_arch}" ]]; then
+		echo "_dist/bin/linux_${GOARCH}"
+	else
+		echo "_dist/bin"
+	fi
+}
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in incus-benchmark incus-simplestreams incus-user incus lxc-to-incus lxd-to-incus ; do
+		ego install -v -x "${S}/cmd/${k}"
+	done
+
+	if use fuidshift ; then
+		ego install -v -x "${S}/cmd/fuidshift"
+	fi
+
+	ego install -v -x -tags libsqlite3 "${S}"/cmd/incusd
+
+	# Needs to be built statically
+	CGO_ENABLED=0 go install -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-migrate
+
+	local bindir=$(incus_get_bindir "$(go-env_goarch "${CBUILD}")")
+
+	# Build the VM agents, statically too
+	if use amd64 ; then
+		GOARCH=amd64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=amd64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	elif use arm64 ; then
+		GOARCH=arm64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=arm64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	else
+		echo "No VM support for this arch."
+		return
+	fi
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	local bindir=$(incus_get_bindir "${GOHOSTARCH}")
+
+	newsbin "${FILESDIR}"/incus-startup-0.4.sh incus-startup
+
+	# Admin tools
+	for l in incusd incus-user lxd-to-incus ; do
+		dosbin "${bindir}/${l}"
+	done
+
+	# User tools
+	for m in incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
+		dobin "${bindir}/${m}"
+	done
+
+	# VM Agents
+	if use amd64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.x86_64
+		doexe ${bindir}/incus-agent.linux.i686
+		doexe ${bindir}/incus-agent.windows.x86_64
+		doexe ${bindir}/incus-agent.windows.i686
+	elif use arm64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.aarch64
+		doexe ${bindir}/incus-agent.windows.aarch64
+	fi
+
+	# fuidshift, should be moved under admin tools at some point
+	if use fuidshift ; then
+		dosbin ${bindir}/fuidshift
+	fi
+
+	newconfd "${FILESDIR}"/incus-6.0.confd incus
+	newinitd "${FILESDIR}"/incus-6.0.initd incus
+	newinitd "${FILESDIR}"/incus-user-0.4.initd incus-user
+
+	systemd_dounit "${T}"/incus.service
+	systemd_newunit "${FILESDIR}"/incus-0.4.socket incus.socket
+	systemd_newunit "${FILESDIR}"/incus-startup-0.4.service incus-startup.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.service incus-user.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.socket incus-user.socket
+
+	if ! tc-is-cross-compiler; then
+		# Generate and install shell completion files.
+		mkdir -p "${D}"/usr/share/{bash-completion/completions/,fish/vendor_completions.d/,zsh/site-functions/} || die
+		"${bindir}"/incus completion bash > "${D}"/usr/share/bash-completion/completions/incus || die
+		"${bindir}"/incus completion fish > "${D}"/usr/share/fish/vendor_completions.d/incus.fish || die
+		"${bindir}"/incus completion zsh > "${D}"/usr/share/zsh/site-functions/_incus || die
+	else
+		ewarn "Shell completion files not installed! Install them manually with incus completion --help"
+	fi
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+
+	# Incus needs INCUS_EDK2_PATH in env to find OVMF files for virtual machines, #946184,
+	# and INCUS_AGENT_PATH to find multi-setup agents for VMs, #959878,
+	# and INCUS_SECURITY_SELINUX=true to enable selinux support (until its enabled by default)
+	newenvd "${FILESDIR}"/90incus.envd 90incus
+	if use selinux; then
+		echo "INCUS_SECURITY_SELINUX=true" >> "${D}"/etc/env.d/90incus
+	fi
+}
+
+pkg_postinst() {
+	elog
+	elog "Please see"
+	elog "  https://wiki.gentoo.org/wiki/Incus"
+	elog "  https://wiki.gentoo.org/wiki/Incus#Migrating_from_LXD"
+	elog
+	optfeature "OCI container images support" app-containers/skopeo app-containers/umoci
+	optfeature "support for ACME certificate issuance" app-crypt/lego
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full incus-migrate support" net-misc/rsync
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the incus group."
+	elog
+}
diff --git a/app-containers/incus/incus-9999.ebuild b/app-containers/incus/incus-9999.ebuild
new file mode 100644
index 000000000000..ec2cb83449c6
--- /dev/null
+++ b/app-containers/incus/incus-9999.ebuild
@@ -0,0 +1,283 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
+
+if [[ "${PV}" == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/lxc/incus.git"
+else
+	SRC_URI="https://linuxcontainers.org/downloads/incus/${P}.tar.xz
+		verify-sig? ( https://linuxcontainers.org/downloads/incus/${P}.tar.xz.asc )"
+	KEYWORDS="~amd64 ~arm64"
+fi
+
+LICENSE="Apache-2.0 BSD LGPL-3 MIT"
+SLOT="0/stable"
+IUSE="apparmor fuidshift nls qemu selinux"
+
+DEPEND="acct-group/incus
+	acct-group/incus-admin
+	app-arch/xz-utils
+	>=app-containers/lxc-5.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/cowsql-1.15.7
+	dev-libs/lzo
+	>=dev-libs/raft-0.22.1:=[lz4]
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+		net-firewall/iptables
+		net-firewall/nftables[json]
+	)
+	fuidshift? ( !app-containers/lxd )
+	net-firewall/ebtables
+	sys-apps/iproute2
+	sys-fs/fuse:*
+	>=sys-fs/lxcfs-5.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
+	qemu? (
+		app-cdr/cdrtools
+		app-emulation/qemu[spice,usbredir,virtfs]
+		sys-apps/gptfdisk
+	)
+	selinux? ( sec-policy/selinux-incus )"
+BDEPEND=">=dev-lang/go-1.24.7
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+CONFIG_CHECK="
+	~AIO
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_AIO="CONFIG_AIO is required."
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/incus
+	/usr/bin/incus-agent
+	/usr/bin/incus-benchmark
+	/usr/bin/incus-migrate
+	/usr/bin/lxc-to-incus
+	/usr/sbin/fuidshift
+	/usr/sbin/incusd
+	/usr/sbin/lxd-to-incus"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_unpack() {
+	if [[ "${PV}" == 9999* ]]; then
+		git-r3_src_unpack
+		go-module_live_vendor
+		go-env_set_compile_environment
+	else
+		verify-sig_src_unpack
+		go-module_src_unpack
+	fi
+}
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/incus:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
+		internal/server/instance/drivers/edk2/driver_edk2.go || die "Failed to fix hardcoded ovmf paths."
+
+	cp "${FILESDIR}"/incus-6.14-r1.service "${T}"/incus.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/incus.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+incus_get_bindir() {
+	local host_arch=${1}
+	if [[ "${GOARCH}" != "${host_arch}" ]]; then
+		echo "_dist/bin/linux_${GOARCH}"
+	else
+		echo "_dist/bin"
+	fi
+}
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in incus-benchmark incus-simplestreams incus-user incus lxc-to-incus lxd-to-incus ; do
+		ego install -v -x "${S}/cmd/${k}"
+	done
+
+	if use fuidshift ; then
+		ego install -v -x "${S}/cmd/fuidshift"
+	fi
+
+	ego install -v -x -tags libsqlite3 "${S}"/cmd/incusd
+
+	# Needs to be built statically
+	CGO_ENABLED=0 go install -v -tags agent,netgo,static -buildmode default "${S}"/cmd/incus-migrate
+
+	local bindir=$(incus_get_bindir "$(go-env_goarch "${CBUILD}")")
+
+	# Build the VM agents, statically too
+	if use amd64 ; then
+		GOARCH=amd64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=amd64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.x86_64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=386 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.i686 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	elif use arm64 ; then
+		GOARCH=arm64 CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.linux.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+		GOARCH=arm64 GOOS=windows CGO_ENABLED=0 ego build -o "${bindir}"/incus-agent.windows.aarch64 -v \
+			-tags agent,netgo,static -buildmode default "${S}"/cmd/incus-agent
+	else
+		echo "No VM support for this arch."
+		return
+	fi
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	local bindir=$(incus_get_bindir "${GOHOSTARCH}")
+
+	newsbin "${FILESDIR}"/incus-startup-0.4.sh incus-startup
+
+	# Admin tools
+	for l in incusd incus-user lxd-to-incus ; do
+		dosbin "${bindir}/${l}"
+	done
+
+	# User tools
+	for m in incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
+		dobin "${bindir}/${m}"
+	done
+
+	# VM Agents
+	if use amd64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.x86_64
+		doexe ${bindir}/incus-agent.linux.i686
+		doexe ${bindir}/incus-agent.windows.x86_64
+		doexe ${bindir}/incus-agent.windows.i686
+	elif use arm64 ; then
+		exeinto /usr/libexec/incus/agents
+		doexe ${bindir}/incus-agent.linux.aarch64
+		doexe ${bindir}/incus-agent.windows.aarch64
+	fi
+
+	# fuidshift, should be moved under admin tools at some point
+	if use fuidshift ; then
+		dosbin ${bindir}/fuidshift
+	fi
+
+	newconfd "${FILESDIR}"/incus-6.0.confd incus
+	newinitd "${FILESDIR}"/incus-6.0.initd incus
+	newinitd "${FILESDIR}"/incus-user-0.4.initd incus-user
+
+	systemd_dounit "${T}"/incus.service
+	systemd_newunit "${FILESDIR}"/incus-0.4.socket incus.socket
+	systemd_newunit "${FILESDIR}"/incus-startup-0.4.service incus-startup.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.service incus-user.service
+	systemd_newunit "${FILESDIR}"/incus-user-0.4.socket incus-user.socket
+
+	if ! tc-is-cross-compiler; then
+		# Generate and install shell completion files.
+		mkdir -p "${D}"/usr/share/{bash-completion/completions/,fish/vendor_completions.d/,zsh/site-functions/} || die
+		"${bindir}"/incus completion bash > "${D}"/usr/share/bash-completion/completions/incus || die
+		"${bindir}"/incus completion fish > "${D}"/usr/share/fish/vendor_completions.d/incus.fish || die
+		"${bindir}"/incus completion zsh > "${D}"/usr/share/zsh/site-functions/_incus || die
+	else
+		ewarn "Shell completion files not installed! Install them manually with incus completion --help"
+	fi
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+
+	# Incus needs INCUS_EDK2_PATH in env to find OVMF files for virtual machines, #946184,
+	# and INCUS_AGENT_PATH to find multi-setup agents for VMs, #959878,
+	# and INCUS_SECURITY_SELINUX=true to enable selinux support (until its enabled by default)
+	newenvd "${FILESDIR}"/90incus.envd 90incus
+	if use selinux; then
+		echo "INCUS_SECURITY_SELINUX=true" >> "${D}"/etc/env.d/90incus
+	fi
+}
+
+pkg_postinst() {
+	elog
+	elog "Please see"
+	elog "  https://wiki.gentoo.org/wiki/Incus"
+	elog "  https://wiki.gentoo.org/wiki/Incus#Migrating_from_LXD"
+	elog
+	optfeature "OCI container images support" app-containers/skopeo app-containers/umoci
+	optfeature "support for ACME certificate issuance" app-crypt/lego
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full incus-migrate support" net-misc/rsync
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the incus group."
+	elog
+}
diff --git a/app-containers/incus/metadata.xml b/app-containers/incus/metadata.xml
new file mode 100644
index 000000000000..e84e0c6ab0ce
--- /dev/null
+++ b/app-containers/incus/metadata.xml
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>juippis@gentoo.org</email>
+    <name>Joonas Niilola</name>
+  </maintainer>
+  <maintainer type="person">
+    <email>mschiff@gentoo.org</email>
+    <name>Marc Schiffbauer</name>
+  </maintainer>
+  <maintainer type="project">
+    <email>virtualization@gentoo.org</email>
+    <name>Gentoo Virtualization Project</name>
+  </maintainer>
+  <use>
+    <flag name="fuidshift">Install the fuidshift binary - currently conflicts with app-containers/lxd</flag>
+    <flag name="qemu">Pull dependencies needed to manage QEMU-based virtual machines with Incus</flag>
+  </use>
+  <longdescription>
+    Incus is a modern, secure and powerful system container and virtual machine manager.
+    Incus is a community fork from Canonical's LXD.
+
+    It provides a unified experience for running and managing full Linux systems inside containers
+    or virtual machines. Incus supplies images for a wide number of Linux distributions and is built
+    around a very powerful, yet pretty simple, REST API. Incus scales from one instance on a single
+    machine to a cluster in a full data center rack, making it suitable for running workloads both
+    for development and in production.
+
+    Incus allows you to easily set up a system that feels like a small private cloud. You can run any
+    type of workload in an efficient way while keeping your resources optimized.
+
+    You should consider using Incus if you want to containerize different environments or run virtual
+    machines, or in general run and manage your infrastructure in a cost-effective way.
+  </longdescription>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/k3d/Manifest b/app-containers/k3d/Manifest
new file mode 100644
index 000000000000..accf3dea1bdf
--- /dev/null
+++ b/app-containers/k3d/Manifest
@@ -0,0 +1 @@
+DIST k3d-5.8.3.tar.gz 9542510 BLAKE2B d6b2e6701c576ff7cc25b979c18284e6e4dbe4fc8078f3669297b6aa0acddb6ad7e256255d8f8d8a97aef981b20f81529f621237d2f183c58aa37bfd58645b71 SHA512 e942a895b31c7906264380851e5f450e4f4b8bba5552d6693baf3428d2b8c7198f94d62b2791571867f24adda3a3edbac73253d04e13b8f5f3adba56310f6936
diff --git a/app-containers/k3d/k3d-5.8.3.ebuild b/app-containers/k3d/k3d-5.8.3.ebuild
new file mode 100644
index 000000000000..0998be1b3330
--- /dev/null
+++ b/app-containers/k3d/k3d-5.8.3.ebuild
@@ -0,0 +1,52 @@
+# Copyright 2021-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit shell-completion go-module
+
+K3D_K3S_TAG=v1.31.5-k3s1
+
+DESCRIPTION="k3d creates k3s clusters in docker"
+HOMEPAGE="https://github.com/rancher/k3d"
+SRC_URI="https://github.com/rancher/k3d/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="MIT Apache-2.0 BSD BSD-2 MPL-2.0 ISC"
+SLOT="0"
+KEYWORDS="amd64"
+IUSE="doc"
+
+src_prepare() {
+	default
+	rm Makefile || die
+}
+
+src_compile() {
+	local ldflags=(
+		-w -s
+		-X "github.com/k3d-io/k3d/v5/version.Version=v${PV}"
+		-X "github.com/k3d-io/k3d/v5/version.K3sVersion=${K3D_K3S_TAG}"
+	)
+	local -x GOWORK="" CGO_ENABLED=1
+	ego build -mod=vendor -ldflags "${ldflags[*]}" -o bin/k3d
+
+	./bin/k3d completion bash > ${PN}.bash || die
+	./bin/k3d completion zsh > ${PN}.zsh || die
+	./bin/k3d completion fish > ${PN}.fish || die
+}
+
+src_test() {
+	ego test -v ./... -skip "TestGetK3sVersion"
+}
+
+src_install() {
+	dobin bin/${PN}
+
+	newbashcomp ${PN}.bash ${PN}
+	newzshcomp ${PN}.zsh _${PN}
+	dofishcomp ${PN}.fish
+
+	DOCS=( *.md )
+	use doc && DOCS+=( docs )
+	default_src_install
+}
diff --git a/app-containers/k3d/metadata.xml b/app-containers/k3d/metadata.xml
new file mode 100644
index 000000000000..591131b1265f
--- /dev/null
+++ b/app-containers/k3d/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/kompose/Manifest b/app-containers/kompose/Manifest
new file mode 100644
index 000000000000..989b367b354a
--- /dev/null
+++ b/app-containers/kompose/Manifest
@@ -0,0 +1,4 @@
+DIST kompose-1.35.0-deps.tar.xz 48368152 BLAKE2B 1432b4085b945ba47c13dafcfcfafa5fc47b367cf75910d8c9c8ec79379d7ab730fcc53711f196f6dd57b11a8df4b53aa0c5d2e53fdce654d3aa061658fbc5a3 SHA512 abe32489d1d7c1e49986bca530cc9dfdfcd26493abfbe5e8ee71db3586d20af236629ab82a5a64cd0dc6fb99d799227a3dc6ec84dd0c91c5bcac7a2fccf56ac5
+DIST kompose-1.35.0.tar.gz 17992643 BLAKE2B 5220a4a553addc05a027da936e6e2f1c03629a1dee05c8703534a4cdb0db98a8e435e23d34dfe4b57383c57af8cda3e37140a01da053b017a10391ddc9c7d3de SHA512 023e4e5b328e69efee5ac5de4dde44652f57f5a17cf6158283dda218a5e8ed43368cb7fb08cea75655f2a04e6be0cfcc017ad8293c9eee2ad38721d2985893f2
+DIST kompose-1.38.0-vendor.tar.xz 2666508 BLAKE2B 15bd54f55ea7e54683f0d04e8e63274899c74028ee549d5f37dd776e76260b4feca23be6cb197160b7d7a8e71e2e001acc179edb7874ae1eaf7978ca2869003b SHA512 65e436d369547cf39e351f5ea2e57fe1e07251a1f183a406175d06fccf0b169079c91668e0549b817e2f2ba815b6469ad59bfca7a7882b9cf2c54dac0f40d2f7
+DIST kompose-1.38.0.tar.gz 17994819 BLAKE2B 67f5ef32d97b43d45b3ec0b459e13396b97ee26446361cfaea65a66345831d4c239a53db021601a50c170c25479abdd17d0978f59a62c89c2012dd3664e9b6e3 SHA512 84d7fa05ac35502b2d3016385092c92ce31ccd3c8a8af33929d45e7d429ff226fe1a2026c9e8876a6de37d6b9f2b5dad48d2335bdb16e1a8d756395b6a8f9a5f
diff --git a/app-containers/kompose/kompose-1.35.0.ebuild b/app-containers/kompose/kompose-1.35.0.ebuild
new file mode 100644
index 000000000000..05c66bc89dcd
--- /dev/null
+++ b/app-containers/kompose/kompose-1.35.0.ebuild
@@ -0,0 +1,51 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module toolchain-funcs shell-completion
+
+GIT_COMMIT=9532ceef
+
+DESCRIPTION="Tool to move from docker-compose to Kubernetes"
+HOMEPAGE="https://github.com/kubernetes/kompose https://kompose.io"
+SRC_URI="https://github.com/kubernetes/kompose/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~arthurzam/distfiles/app-containers/${PN}/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+# Dependent licenses
+LICENSE+=" BSD BSD-2 MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+src_compile() {
+	local -x CGO_ENABLED=0
+	local myegoargs=(
+		-ldflags="-X github.com/kubernetes/kompose/pkg/version.GITCOMMIT=${GIT_COMMIT}"
+	)
+	ego build "${myegoargs[@]}" -o ${PN} main.go
+
+	if ! tc-is-cross-compiler; then
+		einfo "generating shell completion files"
+		./kompose completion bash > ${PN}.bash || die
+		./kompose completion zsh > ${PN}.zsh || die
+		./kompose completion fish > ${PN}.fish || die
+	fi
+}
+
+src_test() {
+	ego test -v ./...
+}
+
+src_install() {
+	dobin ${PN}
+	dodoc -r docs README.md
+
+	if ! tc-is-cross-compiler; then
+		newbashcomp ${PN}.bash ${PN}
+		newzshcomp ${PN}.zsh _${PN}
+		dofishcomp ${PN}.fish
+	else
+		ewarn "Shell completion files not installed! Install them manually with '${PN} completion --help'"
+	fi
+}
diff --git a/app-containers/kompose/kompose-1.38.0.ebuild b/app-containers/kompose/kompose-1.38.0.ebuild
new file mode 100644
index 000000000000..67a857d4c3b6
--- /dev/null
+++ b/app-containers/kompose/kompose-1.38.0.ebuild
@@ -0,0 +1,45 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module shell-completion sysroot
+
+GIT_COMMIT=a8f5d1cb
+
+DESCRIPTION="Tool to move from docker-compose to Kubernetes"
+HOMEPAGE="https://kompose.io https://github.com/kubernetes/kompose"
+SRC_URI="https://github.com/kubernetes/kompose/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://github.com/gentoo-golang-dist/${PN}/releases/download/v${PV}/${P}-vendor.tar.xz"
+
+LICENSE="Apache-2.0"
+# Dependent licenses
+LICENSE+=" Apache-2.0 BSD BSD-2 MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+src_compile() {
+	local -x CGO_ENABLED=0
+	local myegoargs=(
+		-ldflags="-X github.com/kubernetes/kompose/pkg/version.GITCOMMIT=${GIT_COMMIT}"
+	)
+	ego build "${myegoargs[@]}" -o ${PN} main.go
+
+	einfo "generating shell completion files"
+	sysroot_try_run_prefixed ./kompose completion bash > ${PN}.bash || die
+	sysroot_try_run_prefixed ./kompose completion zsh > ${PN}.zsh || die
+	sysroot_try_run_prefixed ./kompose completion fish > ${PN}.fish || die
+}
+
+src_test() {
+	ego test -v ./...
+}
+
+src_install() {
+	dobin ${PN}
+	dodoc -r docs README.md
+
+	[[ -s ${PN}.bash ]] && newbashcomp ${PN}.bash ${PN}
+	[[ -s ${PN}.zsh ]] && newzshcomp ${PN}.zsh _${PN}
+	[[ -s ${PN}.fish ]] && dofishcomp ${PN}.fish
+}
diff --git a/app-containers/kompose/metadata.xml b/app-containers/kompose/metadata.xml
new file mode 100644
index 000000000000..17492b5107c4
--- /dev/null
+++ b/app-containers/kompose/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/lxc-templates/Manifest b/app-containers/lxc-templates/Manifest
new file mode 100644
index 000000000000..f270d30790dc
--- /dev/null
+++ b/app-containers/lxc-templates/Manifest
@@ -0,0 +1 @@
+DIST lxc-templates-3.0.4_p20240917.tar.gz 161974 BLAKE2B c3c3bee881197779a09d931c5bdd53ef14a58ee4e38dc1bc44cf4f048bf7bd4c78a3e499633ca705299d24675b67f16ab99e3680b8a9b485155a2bf386fe863e SHA512 a4365024ab0cfa6c6558b00e1904c13aaab2e998dba4f8a5f78e6091d8c5f633d42a66234512a90c1695a9bd05f24fb87d7a7085d0680b2331a4c814138f28bd
diff --git a/app-containers/lxc-templates/lxc-templates-3.0.4_p20240917.ebuild b/app-containers/lxc-templates/lxc-templates-3.0.4_p20240917.ebuild
new file mode 100644
index 000000000000..e640730d194c
--- /dev/null
+++ b/app-containers/lxc-templates/lxc-templates-3.0.4_p20240917.ebuild
@@ -0,0 +1,28 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+MY_COMMIT="da14466ce09afa3b39adb2b324be20084b776eb7"
+DESCRIPTION="Old style template scripts for LXC"
+HOMEPAGE="https://linuxcontainers.org/ https://github.com/lxc/lxc-templates"
+SRC_URI="https://github.com/lxc/lxc-templates/archive/${MY_COMMIT}.tar.gz -> ${P}.tar.gz"
+
+KEYWORDS="amd64 ~arm ~arm64 ~ppc64 ~riscv x86"
+
+LICENSE="LGPL-3"
+SLOT="0"
+
+RDEPEND=">=app-containers/lxc-3.0"
+DEPEND="${RDEPEND}"
+
+DOCS=()
+
+S="${WORKDIR}/lxc-templates-${MY_COMMIT}"
+
+src_prepare() {
+	default
+	eautoreconf
+}
diff --git a/app-containers/lxc-templates/metadata.xml b/app-containers/lxc-templates/metadata.xml
new file mode 100644
index 000000000000..333d2a1f6a64
--- /dev/null
+++ b/app-containers/lxc-templates/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>juippis@gentoo.org</email>
+    <name>Joonas Niilola</name>
+  </maintainer>
+  <maintainer type="project">
+    <email>virtualization@gentoo.org</email>
+    <name>Gentoo Virtualization Project</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/lxc/Manifest b/app-containers/lxc/Manifest
new file mode 100644
index 000000000000..84a951404c16
--- /dev/null
+++ b/app-containers/lxc/Manifest
@@ -0,0 +1,8 @@
+DIST lxc-5.0.3.tar.gz 975269 BLAKE2B 533d97fe4d986acbf5d562bb2c295a63df2a9a8bfc27aeff5056e4235f667102500debc586c5698482ec048c1b222a0fdc234db6fd6648c4b649f87a85de18f8 SHA512 0553be317431ab7ec0c450c0f85724a53de1f251c39c9716168e17cda6a8daec70b8221228c4be64027df28a327e0f1fd508e6bb48348ab540bbfeaf2b9ac974
+DIST lxc-5.0.3.tar.gz.asc 833 BLAKE2B c35278ed17cad76d2ea94b3985e0110731efea751fb5f1c2d1c9db71486e4844285f372a94c8611dcfe91fdb16459694843b9e0a8273cfc68a56f549c7162cfb SHA512 a5ce5769d49abdf35d94de8273fd3e9c2a8ba4fafea71cf33ee6bce1d83531c8b550d972f7080409a4cc5a92e9d04ece50ed108f92c6aec4868d150e58d7d11a
+DIST lxc-6.0.5.tar.gz 958966 BLAKE2B 74ee775f8a23467049f38f0973a24eb12b34b7c758549294342470b7b6b8e95eaef118c493f62b6394c435a5c86389fde4454199107e90743dd40d3a5bf373fd SHA512 3674397e789ed9eda7e37d4e22c42ab02687c0ab6a12f6c234a3393bdfb3f048aa0ded419c5c2f435d653d3dd70f47ae19d28b7a46838f12004d00b05c54a26d
+DIST lxc-6.0.5.tar.gz.asc 833 BLAKE2B ac1480c0b5588b290ab1ec81bf7bf85990df98a650832363529e9ede8afb7594bd21b58a4a79e7fe9519c381d4860d7a33f4090582612ffff7c448c77e641929 SHA512 8c28da0ebc280ae491bab815105f3c58f2c9cd742586ce86f9b1d2032724db4893811d689f7278bfc8c5570dc45ca6071e4c25b77647d762c77eca59249a15b5
+DIST lxc-6.0.6.tar.gz 963412 BLAKE2B 3bd9575f4c1a4b96ce5bea767e6a6b3c15a3021c62ebaf7421065ca55d2093ca467a8e9e86ce5d8316dab4fc9cde0c96dc1acedb73ccf167bd5c3e5484e5ceff SHA512 1d28aa749711be8a439de5e76019960d78e21bf576724bce7e8973ba4f6a3995c040cdc184e3c3a30814eb4cd2daec6851d26422c7d6d9d64ccd95add6c2eb30
+DIST lxc-6.0.6.tar.gz.asc 833 BLAKE2B 622a7c53629b3e5117bad956923824662073955ca8c6b3c6fba61b9d37c3b76fa48d55ecfd460fad4a5fe88c074264ad4c97b4193342d9c3a5fa322814a212fd SHA512 3ddaf0796e6888c15a5124141439ffa09c2d611f185cf3c8b2106eea530485a013846548bf9bd5ea9d0b69ee52aad2de9281b293a323ba2510db925c38cce98f
+DIST lxc-7.0.0.tar.gz 962710 BLAKE2B 025583e58ba2613bced13fbc7929ecbbf0eb0cd373cc59c80d1794b9398db109ecf35a2797cd08092d72e5718c406dd953d676ca0f29390fc139817c49886bee SHA512 5c7a9fba7313e2d19be649bf906067d99240cf5700e88892dcdb09a216206671db73d647fabad558af3a594ec24054f69627ea5e44638c187c4a0c07067e441a
+DIST lxc-7.0.0.tar.gz.asc 833 BLAKE2B e76eef4ca3485f88b1033ff2e044fc89806dfb11b1d0cfe6b73ab7b5ebb487818e2426f8fb21e8165e6633bc16186664cf0a5af6c72f0dc9e41df75c4cd92727 SHA512 6bb8cd64a73ef828275b98ac1657a9d8a4de878fff9fb6f63123974efec17e5143f4829f1d5275a47155005a28b4ea23774a9e5713f930cd4ed4cd951cc1fb06
diff --git a/app-containers/lxc/files/lxc-6.0.5-fix-openat2-include-typo.patch b/app-containers/lxc/files/lxc-6.0.5-fix-openat2-include-typo.patch
new file mode 100644
index 000000000000..2903cc5de57f
--- /dev/null
+++ b/app-containers/lxc/files/lxc-6.0.5-fix-openat2-include-typo.patch
@@ -0,0 +1,25 @@
+From 511e4db8f2a5b47cdd41eef482647492ce5b0f77 Mon Sep 17 00:00:00 2001
+From: Joonas Niilola <juippis@gentoo.org>
+Date: Sun, 15 Feb 2026 17:42:39 +0200
+Subject: [PATCH] meson.build: fix openat2 include typo, fix with glibc-2.43
+ +FORTIFY
+
+Closes: https://github.com/lxc/lxc/issues/4641
+Signed-off-by: Joonas Niilola <juippis@gentoo.org>
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index eef4e6900c..df40d7516a 100644
+--- a/meson.build
++++ b/meson.build
+@@ -571,7 +571,7 @@ foreach ident: [
+     ['move_mount',        '''#include <sys/mount.h>'''],
+     ['openat2',           '''#include <sys/types.h>
+                              #include <sys/stat.h>
+-                             #include <fctnl.h>'''],
++                             #include <fcntl.h>'''],
+     ['open_tree',         '''#include <sys/mount.h>'''],
+     ['personality',       '''#include <sys/personality.h>'''],
+     ['pidfd_open',        '''#include <stdlib.h>
diff --git a/app-containers/lxc/files/lxc-monitord.service.5.0.0 b/app-containers/lxc/files/lxc-monitord.service.5.0.0
new file mode 100644
index 000000000000..ff4a201152c0
--- /dev/null
+++ b/app-containers/lxc/files/lxc-monitord.service.5.0.0
@@ -0,0 +1,11 @@
+[Unit]
+Description=LXC Container Monitoring Daemon
+After=syslog.service network.target
+Documentation=man:lxc
+
+[Service]
+Type=simple
+ExecStart=/usr/libexec/lxc/lxc-monitord --daemon
+
+[Install]
+WantedBy=multi-user.target
diff --git a/app-containers/lxc/files/lxc-net.service.5.0.0 b/app-containers/lxc/files/lxc-net.service.5.0.0
new file mode 100644
index 000000000000..8a037fcb7614
--- /dev/null
+++ b/app-containers/lxc/files/lxc-net.service.5.0.0
@@ -0,0 +1,15 @@
+[Unit]
+Description=LXC network bridge setup
+After=network-online.target
+Before=lxc.service
+Documentation=man:lxc
+ConditionVirtualization=!lxc
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/libexec/lxc/lxc-net start
+ExecStop=/usr/libexec/lxc/lxc-net stop
+
+[Install]
+WantedBy=multi-user.target
diff --git a/app-containers/lxc/files/lxc.initd.9 b/app-containers/lxc/files/lxc.initd.9
new file mode 100644
index 000000000000..4958fbcbbc7b
--- /dev/null
+++ b/app-containers/lxc/files/lxc.initd.9
@@ -0,0 +1,132 @@
+#!/sbin/openrc-run
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+CONTAINER=${SVCNAME#*.}
+
+LXC_PATH=`lxc-config lxc.lxcpath`
+
+lxc_get_configfile() {
+	if [ -f "${LXC_PATH}/${CONTAINER}.conf" ]; then
+		echo "${LXC_PATH}/${CONTAINER}.conf"
+	elif [ -f "${LXC_PATH}/${CONTAINER}/config" ]; then
+		echo "${LXC_PATH}/${CONTAINER}/config"
+	else
+		eerror "Unable to find a suitable configuration file."
+		eerror "If you set up the container in a non-standard"
+		eerror "location, please set the CONFIGFILE variable."
+		return 1
+	fi
+}
+
+[ $CONTAINER != $SVCNAME ] && CONFIGFILE=${CONFIGFILE:-$(lxc_get_configfile)}
+
+lxc_get_var() {
+	awk 'BEGIN { FS="[ \t]*=[ \t]*" } $1 == "'$1'" { print $2; exit }' ${CONFIGFILE}
+}
+
+lxc_get_net_link_type() {
+		# gentoo bugfix 909640, drop commented lines before awk
+		grep -v '^#' ${CONFIGFILE} | awk 'BEGIN { FS="[ \t]*=[ \t]*"; _link=""; _type="" }
+		$1 == "lxc.network.type" {_type=$2;}
+		$1 == "lxc.network.link" {_link=$2;}
+		match($1, /lxc\.net\.[[:digit:]]+\.type/) {_type=$2;}
+		match($1, /lxc\.net\.[[:digit:]]+\.link/) {_link=$2;}
+		{if(_link != "" && _type != ""){
+			printf("%s:%s\n", _link, _type );
+			_link=""; _type="";
+		}; }'
+}
+
+checkconfig() {
+	if [ ${CONTAINER} = ${SVCNAME} ]; then
+		eerror "You have to create an init script for each container:"
+		eerror " ln -s lxc /etc/init.d/lxc.container"
+		return 1
+	fi
+
+	# no need to output anything, the function takes care of that.
+	[ -z "${CONFIGFILE}" ] && return 1
+
+	utsname=$(lxc_get_var lxc.uts.name)
+	if [ -z "$utsname" ] ; then
+		utsname=$(lxc_get_var lxc.utsname)
+	fi
+
+	if [ "${CONTAINER}" != "${utsname}" ]; then
+	    eerror "You should use the same name for the service and the"
+	    eerror "container. Right now the container is called ${utsname}"
+	    return 1
+	fi
+}
+
+depend() {
+	# be quiet, since we have to run depend() also for the
+	# non-muxed init script, unfortunately.
+	checkconfig 2>/dev/null || return 0
+
+	config ${CONFIGFILE}
+	need localmount
+	use lxcfs
+
+	local _x _if
+	for _x in $(lxc_get_net_link_type); do
+		_if=${_x%:*}
+		case "${_x##*:}" in
+			# when the network type is set to phys, we can make use of a
+			# network service (for instance to set it up before we disable
+			# the net_admin capability), but we might also  not set it up
+			# at all on the host and leave the net_admin capable service
+			# to take care of it.
+			phys)	use net.${_if} ;;
+			*)	need net.${_if} ;;
+		esac
+	done
+}
+
+start() {
+	checkconfig || return 1
+	rm -f /var/log/lxc/${CONTAINER}.log
+
+	rootpath=$(lxc_get_var lxc.rootfs)
+
+	# Check the format of our init and the chroot's init, to see
+	# if we have to use linux32 or linux64; always use setarch
+	# when required, as that makes it easier to deal with
+	# x32-based containers.
+	case $(scanelf -BF '%a#f' ${rootpath}/sbin/init) in
+		EM_X86_64)	setarch=linux64;;
+		EM_386)		setarch=linux32;;
+	esac
+
+	ebegin "Starting LXC container ${CONTAINER}"
+	env -i ${setarch} $(which lxc-start) -n ${CONTAINER} -f ${CONFIGFILE} -d -o /var/log/lxc/${CONTAINER}.log
+	sleep 1
+
+	# lxc-start -d will _always_ report a correct startup, even if it
+	# failed, so rather than trust that, check that the cgroup exists.
+	# fix for LXC 3.1	
+
+	STATE="$(lxc-info -s -H ${CONTAINER})"
+	[ "$STATE" = "RUNNING" ]
+	
+	eend $?
+}
+
+stop() {
+	checkconfig || return 1
+
+	STATE="$(lxc-info -s -H ${CONTAINER})"
+	
+	if ! [ "$STATE" = "RUNNING" ]; then
+	    ewarn "${CONTAINER} doesn't seem to be started."
+	    return 0
+	fi
+
+	# 30s should be enough to shut everything down
+	# lxc-stop will return back anyway as soon as successful shutdown
+	# after 30s, lxc-stop sends SIGKILL (dirty shotdown)
+	ebegin "Stopping LXC container ${CONTAINER}"
+	lxc-stop -t 30 -n ${CONTAINER}
+	eend $?
+}
diff --git a/app-containers/lxc/files/lxc.service-5.0.0 b/app-containers/lxc/files/lxc.service-5.0.0
new file mode 100644
index 000000000000..35d0dff241d0
--- /dev/null
+++ b/app-containers/lxc/files/lxc.service-5.0.0
@@ -0,0 +1,19 @@
+[Unit]
+Description=LXC Container Initialization and Autoboot Code
+After=network.target lxc-net.service remote-fs.target
+Wants=lxc-net.service
+Documentation=man:lxc-autostart man:lxc
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStartPre=/usr/libexec/lxc/lxc-apparmor-load
+ExecStart=/usr/libexec//lxc/lxc-containers start
+ExecStop=/usr/libexec/lxc/lxc-containers stop
+ExecReload=/usr/libexec/lxc/lxc-apparmor-load
+# Environment=BOOTUP=serial
+# Environment=CONSOLETYPE=serial
+Delegate=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/app-containers/lxc/files/lxc_at.service.5.0.0 b/app-containers/lxc/files/lxc_at.service.5.0.0
new file mode 100644
index 000000000000..447b6c87ec5d
--- /dev/null
+++ b/app-containers/lxc/files/lxc_at.service.5.0.0
@@ -0,0 +1,19 @@
+[Unit]
+Description=LXC Container: %i
+# This pulls in apparmor, dev-setup, lxc-net
+After=lxc.service
+Wants=lxc.service
+Documentation=man:lxc-start man:lxc
+
+[Service]
+Type=simple
+KillMode=mixed
+TimeoutStopSec=120s
+ExecStart=/usr/bin/lxc-start -F -n %i
+ExecStop=/usr/bin/lxc-stop -n %i
+# Environment=BOOTUP=serial
+# Environment=CONSOLETYPE=serial
+Delegate=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/app-containers/lxc/lxc-5.0.3.ebuild b/app-containers/lxc/lxc-5.0.3.ebuild
new file mode 100644
index 000000000000..4fdedaf083a2
--- /dev/null
+++ b/app-containers/lxc/lxc-5.0.3.ebuild
@@ -0,0 +1,169 @@
+# Copyright 2022-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit bash-completion-r1 linux-info meson optfeature systemd toolchain-funcs verify-sig
+
+DESCRIPTION="A userspace interface for the Linux kernel containment features"
+HOMEPAGE="https://linuxcontainers.org/ https://github.com/lxc/lxc"
+SRC_URI="https://linuxcontainers.org/downloads/lxc/${P}.tar.gz
+	verify-sig? ( https://linuxcontainers.org/downloads/lxc/${P}.tar.gz.asc )"
+
+LICENSE="GPL-2 LGPL-2.1 LGPL-3"
+SLOT="0/1.502" # SONAME liblxc.so.1 + ${PV//./} _if_ breaking ABI change while bumping.
+KEYWORDS="amd64 ~arm ~arm64 ~ppc64 ~riscv x86"
+IUSE="apparmor +caps examples io-uring lto man pam seccomp selinux ssl systemd test +tools"
+
+RDEPEND="acct-group/lxc
+	acct-user/lxc
+	apparmor? ( sys-libs/libapparmor )
+	caps? ( sys-libs/libcap[static-libs] )
+	io-uring? ( >=sys-libs/liburing-2:= )
+	pam? ( sys-libs/pam )
+	seccomp? ( sys-libs/libseccomp )
+	selinux? ( sys-libs/libselinux )
+	ssl? ( dev-libs/openssl:0= )
+	systemd? ( sys-apps/systemd:= )
+	tools? ( sys-libs/libcap[static-libs] )"
+DEPEND="${RDEPEND}
+	sys-kernel/linux-headers"
+BDEPEND="virtual/pkgconfig
+	man? ( app-text/docbook2X )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+RESTRICT="!test? ( test )"
+
+CONFIG_CHECK="~!NETPRIO_CGROUP
+	~CGROUPS
+	~CGROUP_CPUACCT
+	~CGROUP_DEVICE
+	~CGROUP_FREEZER
+
+	~CGROUP_SCHED
+	~CPUSETS
+	~IPC_NS
+	~MACVLAN
+
+	~MEMCG
+	~NAMESPACES
+	~NET_NS
+	~PID_NS
+
+	~POSIX_MQUEUE
+	~USER_NS
+	~UTS_NS
+	~VETH"
+
+ERROR_CGROUP_FREEZER="CONFIG_CGROUP_FREEZER: needed to freeze containers"
+ERROR_MACVLAN="CONFIG_MACVLAN: needed for internal (inter-container) networking"
+ERROR_MEMCG="CONFIG_MEMCG: needed for memory resource control in containers"
+ERROR_NET_NS="CONFIG_NET_NS: needed for unshared network"
+ERROR_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: needed for lxc-execute command"
+ERROR_UTS_NS="CONFIG_UTS_NS: needed to unshare hostnames and uname info"
+ERROR_VETH="CONFIG_VETH: needed for internal (host-to-container) networking"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+DOCS=( AUTHORS CONTRIBUTING MAINTAINERS README.md doc/FAQ.txt )
+
+pkg_setup() {
+	linux-info_pkg_setup
+}
+
+src_configure() {
+	local emesonargs=(
+		--localstatedir "${EPREFIX}/var"
+
+		-Dcoverity-build=false
+		-Doss-fuzz=false
+
+		-Dcommands=true
+		-Dmemfd-rexec=true
+		-Dthread-safety=true
+
+		$(meson_use apparmor)
+		$(meson_use caps capabilities)
+		$(meson_use examples)
+		$(meson_use io-uring io-uring-event-loop)
+		$(meson_use lto b_lto)
+		$(meson_use man)
+		$(meson_use pam pam-cgroup)
+		$(meson_use seccomp)
+		$(meson_use selinux)
+		$(meson_use ssl openssl)
+		$(meson_use test tests)
+		$(meson_use tools)
+
+		-Ddata-path=/var/lib/lxc
+		-Ddoc-path=/usr/share/doc/${PF}
+		-Dlog-path=/var/log/lxc
+		-Drootfs-mount-path=/var/lib/lxc/rootfs
+		-Druntime-path=/run
+	)
+
+	if use systemd; then
+		local emesonargs+=( -Dinit-script="systemd" )
+		local emesonargs+=( -Dsd-bus=enabled )
+	else
+		local emesonargs+=( -Dinit-script="sysvinit" )
+		local emesonargs+=( -Dsd-bus=disabled )
+	fi
+
+	use tools && local emesonargs+=( -Dcapabilities=true )
+
+	if $(tc-ld-is-gold) || $(tc-ld-is-lld); then
+		local emesonargs+=( -Db_lto_mode=thin )
+	else
+		local emesonargs+=( -Db_lto_mode=default )
+	fi
+
+	meson_src_configure
+}
+
+src_install() {
+	meson_src_install
+
+	# The main bash-completion file will collide with lxd, need to relocate and update symlinks.
+	mkdir -p "${ED}"/$(get_bashcompdir) || die "Failed to create bashcompdir."
+
+	if use tools; then
+		bashcomp_alias lxc-start lxc-{attach,autostart,cgroup,checkpoint,config,console,copy,create,destroy,device,execute,freeze,info,ls,monitor,snapshot,stop,top,unfreeze,unshare,usernsexec,wait}
+	else
+		bashcomp_alias lxc-start lxc-usernsexec
+	fi
+
+	keepdir /var/lib/cache/lxc /var/lib/lib/lxc
+
+	find "${ED}" -name '*.la' -delete -o -name '*.a' -delete || die
+
+	# Replace upstream sysvinit/systemd files.
+	if use systemd; then
+		rm -r "${D}$(systemd_get_systemunitdir)" || die "Failed to remove systemd lib dir"
+	else
+		rm "${ED}"/etc/init.d/lxc-{containers,net} || die "Failed to remove sysvinit scripts"
+	fi
+
+	newinitd "${FILESDIR}/${PN}.initd.9" ${PN}
+	systemd_newunit "${FILESDIR}"/lxc-monitord.service.5.0.0 lxc-monitord.service
+	systemd_newunit "${FILESDIR}"/lxc-net.service.5.0.0 lxc-net.service
+	systemd_newunit "${FILESDIR}"/lxc.service-5.0.0 lxc.service
+	systemd_newunit "${FILESDIR}"/lxc_at.service.5.0.0 "lxc@.service"
+
+	if ! use apparmor; then
+		sed -i '/lxc-apparmor-load/d' "${D}$(systemd_get_systemunitdir)/lxc.service" ||
+			die "Failed to remove apparmor references from lxc.service systemd unit."
+	fi
+}
+
+pkg_postinst() {
+	elog "Please refer to "
+	elog "https://wiki.gentoo.org/wiki/LXC for introduction and usage guide."
+	elog
+	elog "Run 'lxc-checkconfig' to see optional kernel features."
+	elog
+
+	optfeature "automatic template scripts" app-containers/lxc-templates
+	optfeature "Debian-based distribution container image support" dev-util/debootstrap
+	optfeature "snapshot & restore functionality" sys-process/criu
+}
diff --git a/app-containers/lxc/lxc-6.0.5.ebuild b/app-containers/lxc/lxc-6.0.5.ebuild
new file mode 100644
index 000000000000..400acf79c30c
--- /dev/null
+++ b/app-containers/lxc/lxc-6.0.5.ebuild
@@ -0,0 +1,170 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit bash-completion-r1 linux-info meson optfeature systemd verify-sig
+
+DESCRIPTION="A userspace interface for the Linux kernel containment features"
+HOMEPAGE="https://linuxcontainers.org/ https://github.com/lxc/lxc"
+SRC_URI="https://linuxcontainers.org/downloads/lxc/${P}.tar.gz
+	verify-sig? ( https://linuxcontainers.org/downloads/lxc/${P}.tar.gz.asc )"
+
+LICENSE="GPL-2 LGPL-2.1 LGPL-3"
+SLOT="0/1.8" # SONAME liblxc.so.1 + ${PV//./} _if_ breaking ABI change while bumping.
+KEYWORDS="amd64 ~arm ~arm64 ~ppc64 ~riscv x86"
+IUSE="apparmor +caps examples io-uring man pam seccomp selinux ssl systemd test +tools"
+
+RDEPEND="acct-group/lxc
+	acct-user/lxc
+	apparmor? ( sys-libs/libapparmor )
+	caps? ( sys-libs/libcap )
+	io-uring? ( >=sys-libs/liburing-2:= )
+	pam? ( sys-libs/pam )
+	seccomp? ( sys-libs/libseccomp )
+	selinux? ( sys-libs/libselinux )
+	ssl? ( dev-libs/openssl:0= )
+	systemd? (
+		sys-apps/dbus
+		sys-apps/systemd:=
+	)
+	tools? ( sys-libs/libcap )"
+DEPEND="${RDEPEND}
+	caps? ( sys-libs/libcap[static-libs] )
+	tools? ( sys-libs/libcap[static-libs] )
+	sys-kernel/linux-headers"
+BDEPEND="virtual/pkgconfig
+	man? ( app-text/docbook2X )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+RESTRICT="!test? ( test )"
+
+CONFIG_CHECK="~!NETPRIO_CGROUP
+	~CGROUPS
+	~CGROUP_CPUACCT
+	~CGROUP_DEVICE
+	~CGROUP_FREEZER
+
+	~CGROUP_SCHED
+	~CPUSETS
+	~IPC_NS
+	~MACVLAN
+
+	~MEMCG
+	~NAMESPACES
+	~NET_NS
+	~PID_NS
+
+	~POSIX_MQUEUE
+	~USER_NS
+	~UTS_NS
+	~VETH"
+
+ERROR_CGROUP_FREEZER="CONFIG_CGROUP_FREEZER: needed to freeze containers"
+ERROR_MACVLAN="CONFIG_MACVLAN: needed for internal (inter-container) networking"
+ERROR_MEMCG="CONFIG_MEMCG: needed for memory resource control in containers"
+ERROR_NET_NS="CONFIG_NET_NS: needed for unshared network"
+ERROR_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: needed for lxc-execute command"
+ERROR_UTS_NS="CONFIG_UTS_NS: needed to unshare hostnames and uname info"
+ERROR_VETH="CONFIG_VETH: needed for internal (host-to-container) networking"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+DOCS=( AUTHORS CONTRIBUTING MAINTAINERS README.md doc/FAQ.txt )
+
+PATCHES=( "${FILESDIR}"/lxc-6.0.5-fix-openat2-include-typo.patch )
+
+pkg_setup() {
+	linux-info_pkg_setup
+}
+
+src_configure() {
+
+	# -Dtools-multicall=false: will create a single binary called 'lxc' that conflicts with LXD.
+	local emesonargs=(
+		--localstatedir "${EPREFIX}/var"
+
+		-Dcoverity-build=false
+		-Dinstall-state-dirs=false
+		-Doss-fuzz=false
+		-Dspecfile=false
+		-Dtools-multicall=false
+
+		-Dcommands=true
+		-Dinstall-init-files=true
+		-Dmemfd-rexec=true
+		-Dthread-safety=true
+
+		$(meson_use apparmor)
+		$(meson_use caps capabilities)
+		$(meson_use examples)
+		$(meson_use io-uring io-uring-event-loop)
+		$(meson_use man)
+		$(meson_use pam pam-cgroup)
+		$(meson_use seccomp)
+		$(meson_use selinux)
+		$(meson_use ssl openssl)
+		$(meson_use test tests)
+		$(meson_use tools)
+
+		$(usex systemd -Ddbus=true -Ddbus=false)
+		$(usex systemd -Dinit-script="systemd" -Dinit-script="sysvinit")
+
+		-Ddata-path=/var/lib/lxc
+		-Ddoc-path=/usr/share/doc/${PF}
+		-Dlog-path=/var/log/lxc
+		-Drootfs-mount-path=/var/lib/lxc/rootfs
+		-Druntime-path=/run
+	)
+
+	use tools && local emesonargs+=( -Dcapabilities=true )
+
+	meson_src_configure
+}
+
+src_install() {
+	meson_src_install
+
+	# The main bash-completion file will collide with lxd, need to relocate and update symlinks.
+	local lxcbashcompdir="${D}/$(get_bashcompdir)"
+	mkdir -p "${lxcbashcompdir}" || die "Failed to create bashcompdir."
+	mv "${lxcbashcompdir}"/_lxc "${lxcbashcompdir}"/lxc-start || die "Failed to move _lxc bash completion file."
+
+	# Build system will install all bash completion files regardless of our 'tools' use flag.
+	# Though installing them all will add bash completions for commands that don't exist, it's
+	# cleaner than dealing with individual files based on the use flag status.
+	bashcomp_alias lxc-start lxc-{attach,autostart,cgroup,checkpoint,config,console,copy,create,destroy,device,execute,freeze,info,ls,monitor,snapshot,stop,top,unfreeze,unshare,update-config,usernsexec,wait}
+
+	find "${ED}" -name '*.la' -delete -o -name '*.a' -delete || die
+
+	# Replace upstream sysvinit/systemd files.
+	if use systemd ; then
+		rm -r "${D}$(systemd_get_systemunitdir)" || die "Failed to remove systemd lib dir"
+	else
+		rm "${ED}"/etc/init.d/lxc-{containers,net} || die "Failed to remove sysvinit scripts"
+	fi
+
+	newinitd "${FILESDIR}/${PN}.initd.9" ${PN}
+	systemd_newunit "${FILESDIR}"/lxc-monitord.service.5.0.0 lxc-monitord.service
+	systemd_newunit "${FILESDIR}"/lxc-net.service.5.0.0 lxc-net.service
+	systemd_newunit "${FILESDIR}"/lxc.service-5.0.0 lxc.service
+	systemd_newunit "${FILESDIR}"/lxc_at.service.5.0.0 "lxc@.service"
+
+	if ! use apparmor; then
+		sed -i '/lxc-apparmor-load/d' "${D}$(systemd_get_systemunitdir)/lxc.service" ||
+			die "Failed to remove apparmor references from lxc.service systemd unit."
+	fi
+}
+
+pkg_postinst() {
+	elog "Please refer to "
+	elog "https://wiki.gentoo.org/wiki/LXC for introduction and usage guide."
+	elog
+	elog "Run 'lxc-checkconfig' to see optional kernel features."
+	elog
+
+	optfeature "creating your own LXC containers" app-containers/distrobuilder
+	optfeature "automatic template scripts" app-containers/lxc-templates
+	optfeature "Debian-based distribution container image support" dev-util/debootstrap
+	optfeature "snapshot & restore functionality" sys-process/criu
+}
diff --git a/app-containers/lxc/lxc-6.0.6.ebuild b/app-containers/lxc/lxc-6.0.6.ebuild
new file mode 100644
index 000000000000..1e29cd2d9f02
--- /dev/null
+++ b/app-containers/lxc/lxc-6.0.6.ebuild
@@ -0,0 +1,174 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit bash-completion-r1 linux-info meson optfeature systemd verify-sig
+
+DESCRIPTION="A userspace interface for the Linux kernel containment features"
+HOMEPAGE="https://linuxcontainers.org/ https://github.com/lxc/lxc"
+SRC_URI="https://linuxcontainers.org/downloads/lxc/${P}.tar.gz
+	verify-sig? ( https://linuxcontainers.org/downloads/lxc/${P}.tar.gz.asc )"
+
+LICENSE="GPL-2 LGPL-2.1 LGPL-3" # LGPL-2.1+ is listed, but it's covered by "LGPL-3"
+SLOT="0/1.606" # SONAME liblxc.so.1 + ${PV//./} _if_ breaking ABI change while bumping.
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor +caps doc examples io-uring man pam seccomp selinux ssl systemd test +tools"
+
+RDEPEND="acct-group/lxc
+	acct-user/lxc
+	apparmor? ( sys-libs/libapparmor )
+	caps? ( sys-libs/libcap )
+	io-uring? ( >=sys-libs/liburing-2:= )
+	pam? ( sys-libs/pam )
+	seccomp? ( sys-libs/libseccomp )
+	selinux? ( sys-libs/libselinux )
+	ssl? ( dev-libs/openssl:0= )
+	systemd? (
+		sys-apps/dbus
+		sys-apps/systemd:=
+	)
+	tools? ( sys-libs/libcap )"
+DEPEND="${RDEPEND}
+	caps? ( sys-libs/libcap[static-libs] )
+	tools? ( sys-libs/libcap[static-libs] )
+	sys-kernel/linux-headers"
+BDEPEND="virtual/pkgconfig
+	doc? ( app-text/doxygen )
+	man? ( app-text/docbook2X )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+RESTRICT="!test? ( test )"
+
+CONFIG_CHECK="~!NETPRIO_CGROUP
+	~CGROUPS
+	~CGROUP_CPUACCT
+	~CGROUP_DEVICE
+	~CGROUP_FREEZER
+
+	~CGROUP_SCHED
+	~CPUSETS
+	~IPC_NS
+	~MACVLAN
+
+	~MEMCG
+	~NAMESPACES
+	~NET_NS
+	~PID_NS
+
+	~POSIX_MQUEUE
+	~USER_NS
+	~UTS_NS
+	~VETH"
+
+ERROR_CGROUP_FREEZER="CONFIG_CGROUP_FREEZER: needed to freeze containers"
+ERROR_MACVLAN="CONFIG_MACVLAN: needed for internal (inter-container) networking"
+ERROR_MEMCG="CONFIG_MEMCG: needed for memory resource control in containers"
+ERROR_NET_NS="CONFIG_NET_NS: needed for unshared network"
+ERROR_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: needed for lxc-execute command"
+ERROR_UTS_NS="CONFIG_UTS_NS: needed to unshare hostnames and uname info"
+ERROR_VETH="CONFIG_VETH: needed for internal (host-to-container) networking"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+DOCS=( AUTHORS MAINTAINERS README.md doc/FAQ.txt )
+
+pkg_setup() {
+	linux-info_pkg_setup
+}
+
+src_configure() {
+
+	# -Dtools-multicall=false: will create a single binary called 'lxc' that conflicts with LXD.
+	local emesonargs=(
+		--localstatedir "${EPREFIX}/var"
+
+		-Dcoverity-build=false
+		-Dinstall-state-dirs=false
+		-Doss-fuzz=false
+		-Dspecfile=false
+		-Dtools-multicall=false
+
+		-Dcommands=true
+		-Dinstall-init-files=true
+		-Dmemfd-rexec=true
+		-Dthread-safety=true
+
+		$(meson_use apparmor)
+		$(meson_use caps capabilities)
+		$(meson_use doc api-docs)
+		$(meson_use examples)
+		$(meson_use io-uring io-uring-event-loop)
+		$(meson_use man)
+		$(meson_use pam pam-cgroup)
+		$(meson_use seccomp)
+		$(meson_use selinux)
+		$(meson_use ssl openssl)
+		$(meson_use test tests)
+		$(meson_use tools)
+
+		$(usex systemd -Ddbus=true -Ddbus=false)
+		$(usex systemd -Dinit-script="systemd" -Dinit-script="openrc")
+
+		-Ddata-path=/var/lib/lxc
+		-Ddoc-path=/usr/share/doc/${PF}
+		-Dlog-path=/var/log/lxc
+		-Drootfs-mount-path=/var/lib/lxc/rootfs
+		-Druntime-path=/run
+	)
+
+	use tools && local emesonargs+=( -Dcapabilities=true )
+
+	meson_src_configure
+}
+
+src_install() {
+	if use doc ; then
+		local HTML_DOCS=( "${BUILD_DIR}/html/"* )
+	fi
+	meson_src_install
+
+	# The main bash-completion file will collide with lxd, need to relocate and update symlinks.
+	local lxcbashcompdir="${D}/$(get_bashcompdir)"
+	mkdir -p "${lxcbashcompdir}" || die "Failed to create bashcompdir."
+	mv "${lxcbashcompdir}"/_lxc "${lxcbashcompdir}"/lxc-start || die "Failed to move _lxc bash completion file."
+
+	# Build system will install all bash completion files regardless of our 'tools' use flag.
+	# Though installing them all will add bash completions for commands that don't exist, it's
+	# cleaner than dealing with individual files based on the use flag status.
+	bashcomp_alias lxc-start lxc-{attach,autostart,cgroup,checkpoint,config,console,copy,create,destroy,device,execute,freeze,info,ls,monitor,snapshot,stop,top,unfreeze,unshare,update-config,usernsexec,wait}
+
+	find "${ED}" -name '*.la' -delete -o -name '*.a' -delete || die
+
+	# Replace upstream systemd files.
+	if use systemd ; then
+		rm -r "${D}$(systemd_get_systemunitdir)" || die "Failed to remove systemd lib dir"
+	else
+		# The openrc files aren't installed with correct permissions.
+		fperms 0755 /etc/init.d/lxc-{containers,net}
+	fi
+
+	newinitd "${FILESDIR}/${PN}.initd.9" ${PN}
+	systemd_newunit "${FILESDIR}"/lxc-monitord.service.5.0.0 lxc-monitord.service
+	systemd_newunit "${FILESDIR}"/lxc-net.service.5.0.0 lxc-net.service
+	systemd_newunit "${FILESDIR}"/lxc.service-5.0.0 lxc.service
+	systemd_newunit "${FILESDIR}"/lxc_at.service.5.0.0 "lxc@.service"
+
+	if ! use apparmor; then
+		sed -i '/lxc-apparmor-load/d' "${D}$(systemd_get_systemunitdir)/lxc.service" ||
+			die "Failed to remove apparmor references from lxc.service systemd unit."
+	fi
+}
+
+pkg_postinst() {
+	elog "Please refer to "
+	elog "https://wiki.gentoo.org/wiki/LXC for introduction and usage guide."
+	elog
+	elog "Run 'lxc-checkconfig' to see optional kernel features."
+	elog
+
+	optfeature "creating your own LXC containers" app-containers/distrobuilder
+	optfeature "automatic template scripts" app-containers/lxc-templates
+	optfeature "Debian-based distribution container image support" dev-util/debootstrap
+	optfeature "snapshot & restore functionality" sys-process/criu
+}
diff --git a/app-containers/lxc/lxc-7.0.0.ebuild b/app-containers/lxc/lxc-7.0.0.ebuild
new file mode 100644
index 000000000000..7331b85f0e61
--- /dev/null
+++ b/app-containers/lxc/lxc-7.0.0.ebuild
@@ -0,0 +1,180 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit bash-completion-r1 linux-info meson optfeature systemd verify-sig
+
+DESCRIPTION="A userspace interface for the Linux kernel containment features"
+HOMEPAGE="https://linuxcontainers.org/ https://github.com/lxc/lxc"
+SRC_URI="https://linuxcontainers.org/downloads/lxc/${P}.tar.gz
+	verify-sig? ( https://linuxcontainers.org/downloads/lxc/${P}.tar.gz.asc )"
+
+LICENSE="GPL-2 LGPL-2.1 LGPL-3" # LGPL-2.1+ is listed, but it's covered by "LGPL-3"
+SLOT="0/1.700" # SONAME liblxc.so.1 + ${PV//./} _if_ breaking ABI change while bumping.
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor +caps doc examples io-uring landlock man pam seccomp selinux ssl systemd test +tools"
+
+REQUIRED_USE="landlock? ( seccomp )"
+
+RDEPEND="acct-group/lxc
+	acct-user/lxc
+	apparmor? ( sys-libs/libapparmor )
+	caps? ( sys-libs/libcap )
+	io-uring? ( >=sys-libs/liburing-2:= )
+	pam? ( sys-libs/pam )
+	seccomp? ( sys-libs/libseccomp )
+	selinux? ( sys-libs/libselinux )
+	ssl? ( dev-libs/openssl:0= )
+	systemd? (
+		sys-apps/dbus
+		sys-apps/systemd:=
+	)
+	tools? ( sys-libs/libcap )"
+DEPEND="${RDEPEND}
+	caps? ( sys-libs/libcap[static-libs] )
+	tools? ( sys-libs/libcap[static-libs] )
+	sys-kernel/linux-headers"
+BDEPEND="virtual/pkgconfig
+	doc? ( app-text/doxygen )
+	man? ( app-text/docbook2X )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+RESTRICT="!test? ( test )"
+
+CONFIG_CHECK="~!NETPRIO_CGROUP
+	~CGROUPS
+	~CGROUP_CPUACCT
+	~CGROUP_DEVICE
+	~CGROUP_FREEZER
+
+	~CGROUP_SCHED
+	~CPUSETS
+	~IPC_NS
+	~MACVLAN
+
+	~MEMCG
+	~NAMESPACES
+	~NET_NS
+	~PID_NS
+
+	~POSIX_MQUEUE
+	~USER_NS
+	~UTS_NS
+	~VETH"
+
+ERROR_CGROUP_FREEZER="CONFIG_CGROUP_FREEZER: needed to freeze containers"
+ERROR_MACVLAN="CONFIG_MACVLAN: needed for internal (inter-container) networking"
+ERROR_MEMCG="CONFIG_MEMCG: needed for memory resource control in containers"
+ERROR_NET_NS="CONFIG_NET_NS: needed for unshared network"
+ERROR_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: needed for lxc-execute command"
+ERROR_UTS_NS="CONFIG_UTS_NS: needed to unshare hostnames and uname info"
+ERROR_VETH="CONFIG_VETH: needed for internal (host-to-container) networking"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+DOCS=( AUTHORS MAINTAINERS README.md doc/FAQ.txt )
+
+pkg_setup() {
+	if use landlock ; then
+		WARNING_SECURITY_LANDLOCK="CONFIG_SECURITY_LANDLOCK: needed with landlock"
+	fi
+	linux-info_pkg_setup
+}
+
+src_configure() {
+
+	# -Dtools-multicall=false: will create a single binary called 'lxc' that conflicts with LXD.
+	local emesonargs=(
+		--localstatedir "${EPREFIX}/var"
+
+		-Dcoverity-build=false
+		-Dinstall-state-dirs=false
+		-Doss-fuzz=false
+		-Dspecfile=false
+		-Dtools-multicall=false
+
+		-Dcommands=true
+		-Dinstall-init-files=true
+		-Dmemfd-rexec=true
+		-Dthread-safety=true
+
+		$(meson_use apparmor)
+		$(meson_use caps capabilities)
+		$(meson_use doc api-docs)
+		$(meson_use examples)
+		$(meson_use io-uring io-uring-event-loop)
+		$(meson_use landlock landlock-monitor)
+		$(meson_use man)
+		$(meson_use pam pam-cgroup)
+		$(meson_use seccomp)
+		$(meson_use selinux)
+		$(meson_use ssl openssl)
+		$(meson_use test tests)
+		$(meson_use tools)
+
+		$(usex systemd -Ddbus=true -Ddbus=false)
+		$(usex systemd -Dinit-script="systemd" -Dinit-script="openrc")
+
+		-Ddata-path=/var/lib/lxc
+		-Ddoc-path=/usr/share/doc/${PF}
+		-Dlog-path=/var/log/lxc
+		-Drootfs-mount-path=/var/lib/lxc/rootfs
+		-Druntime-path=/run
+	)
+
+	use tools && local emesonargs+=( -Dcapabilities=true )
+
+	meson_src_configure
+}
+
+src_install() {
+	if use doc ; then
+		local HTML_DOCS=( "${BUILD_DIR}/html/"* )
+	fi
+	meson_src_install
+
+	# The main bash-completion file will collide with lxd, need to relocate and update symlinks.
+	local lxcbashcompdir="${D}/$(get_bashcompdir)"
+	mkdir -p "${lxcbashcompdir}" || die "Failed to create bashcompdir."
+	mv "${lxcbashcompdir}"/_lxc "${lxcbashcompdir}"/lxc-start || die "Failed to move _lxc bash completion file."
+
+	# Build system will install all bash completion files regardless of our 'tools' use flag.
+	# Though installing them all will add bash completions for commands that don't exist, it's
+	# cleaner than dealing with individual files based on the use flag status.
+	bashcomp_alias lxc-start lxc-{attach,autostart,cgroup,checkpoint,config,console,copy,create,destroy,device,execute,freeze,info,ls,monitor,snapshot,stop,top,unfreeze,unshare,update-config,usernsexec,wait}
+
+	find "${ED}" -name '*.la' -delete -o -name '*.a' -delete || die
+
+	# Replace upstream systemd files.
+	if use systemd ; then
+		rm -r "${D}$(systemd_get_systemunitdir)" || die "Failed to remove systemd lib dir"
+	else
+		# The openrc files aren't installed with correct permissions.
+		fperms 0755 /etc/init.d/lxc-{containers,net}
+	fi
+
+	newinitd "${FILESDIR}/${PN}.initd.9" ${PN}
+	systemd_newunit "${FILESDIR}"/lxc-monitord.service.5.0.0 lxc-monitord.service
+	systemd_newunit "${FILESDIR}"/lxc-net.service.5.0.0 lxc-net.service
+	systemd_newunit "${FILESDIR}"/lxc.service-5.0.0 lxc.service
+	systemd_newunit "${FILESDIR}"/lxc_at.service.5.0.0 "lxc@.service"
+
+	if ! use apparmor; then
+		sed -i '/lxc-apparmor-load/d' "${D}$(systemd_get_systemunitdir)/lxc.service" ||
+			die "Failed to remove apparmor references from lxc.service systemd unit."
+	fi
+}
+
+pkg_postinst() {
+	elog "Please refer to "
+	elog "https://wiki.gentoo.org/wiki/LXC for introduction and usage guide."
+	elog
+	elog "Run 'lxc-checkconfig' to see optional kernel features."
+	elog
+
+	optfeature "creating your own LXC containers" app-containers/distrobuilder
+	optfeature "automatic template scripts" app-containers/lxc-templates
+	optfeature "Debian-based distribution container image support" dev-util/debootstrap
+	optfeature "snapshot & restore functionality" sys-process/criu
+}
diff --git a/app-containers/lxc/metadata.xml b/app-containers/lxc/metadata.xml
new file mode 100644
index 000000000000..e3b165af83d7
--- /dev/null
+++ b/app-containers/lxc/metadata.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>juippis@gentoo.org</email>
+    <name>Joonas Niilola</name>
+  </maintainer>
+  <maintainer type="project">
+    <email>virtualization@gentoo.org</email>
+    <name>Gentoo Virtualization Project</name>
+  </maintainer>
+  <use>
+    <flag name="landlock">Use Landlock to restrict what the monitor API handlers can do on the system</flag>
+    <flag name="tools">Build and install additional command line tools</flag>
+  </use>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:linuxcontainers:lxc</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/lxd/Manifest b/app-containers/lxd/Manifest
new file mode 100644
index 000000000000..e39f1e300970
--- /dev/null
+++ b/app-containers/lxd/Manifest
@@ -0,0 +1,8 @@
+DIST lxd-5.21.1.tar.gz 23753867 BLAKE2B 102f3c83faa956f6a5f052912417f595a7374c13ff1da21e43b76e267908323f3db05aed8b83fb99a0b70ee03af9b1df0551a2c535db146d5ea6f415f7671e7a SHA512 809099d16ffd12b785a03ad3ed527fa6f0c7503a41b7c93d41fd3418d18f8c68c79e5a689c8df2ed4157d434742bfb5cc267a5afb9734091b224be644a3a6958
+DIST lxd-5.21.1.tar.gz.asc 833 BLAKE2B 1c43b7750e505ef66d4f9fcf3723abf28a7b4e2785866604b88f6dfa80f7e3d0ed33734bc49606ecff16659de9dabfbeb08ba71c36eafc8d05a28397e3e73a89 SHA512 8ec81d1df6d3b9aec58cbde08306a865f9c27e86be04da11a2b5566c78865b51f91edb6fa26e8b5d25202bf33657bd0f867ec986e4e8b39f379b25e03cd6a5d3
+DIST lxd-5.21.4.tar.gz 37255971 BLAKE2B 57df5d9fcb521d651eb09dbf806a6ee3c8235075c2306e99bd76d97d30c7691a0884b258eed815027d8e35bc96966f826c72a6f99b886f7f4b43c6a9aa38f624 SHA512 3b92abe156d5d7c6257cb6a5f6e18c2756476ed5d7828789bbe7f33d3d03557757e1dd94008dc48ca737af447f79bcc26ed4f36e325d95b6a179a42c9f512eb0
+DIST lxd-5.21.4.tar.gz.asc 833 BLAKE2B acc30156852163ded902fd2a9245a06d2052bcdbb67ae12f238344aff7149d204db7354621216bf0fa63a4ce3e220aaa1ca5f462f5bc1aefba282391c90e51b9 SHA512 c02354165e87089e327791d20a0dc5f1ffc538938158928b62261f97b7699796286aef8fac5f4d00e7bfc1afa4206065b60015f561d00a74a934df70054e40f1
+DIST lxd-6.3.tar.gz 33286388 BLAKE2B 2f66ebfea94a262fc162b958ea031b6d82d35ea75e20445e8f5a5308689f5a37730aa18d8cf2fe6507cdc88c39a063a2ed295a3a7f8b0537e76835bc92116739 SHA512 0ec8bc8a55529258848045c2ff2e946de78989d8fd8ec2110c3fda15f9da9f56b8343460270d8d1661956bbf8c79dca4422212a4b23e4fe50398a47619834b62
+DIST lxd-6.3.tar.gz.asc 833 BLAKE2B 0778cdda82dacb3de31723b956a99e1c3c3d8317a87b2bfe35d2ff1516ebd65c0e5d42820bac8e15d6e03f15028556c37ea23234becd296963371be238e56e02 SHA512 8dca8e128b4c19e311a3b1084dbed79e9eea7e9c17306c2618fbcba358c1b540600610c7be8218eb3f8d8f5f4e2ce240c06470a2aa8baf9c3431edd807430720
+DIST lxd-6.5.tar.gz 36814768 BLAKE2B b176c2ec0784bac97d901e457676d3563552271e67936a1b87404f0ff46d8d38ffbadf2599c8718fb3b47a87235e530e6f8a9b6d27ede539add8c8601f0b44df SHA512 f2282da0acaf0adcc5b9438257aeb4cc456b4a3683f21e241338df4fff2fda30fa05b4cfe7d68d20ace84c08fbb06b0a8e6cd677d0db2112dfb29935c53c77af
+DIST lxd-6.5.tar.gz.asc 833 BLAKE2B 04a8d5c8c990821640e2ab2bfa3a53eb2a2f7a022365194ce78fd9fd7d2070e9dd6baaa5a682d7568b940722503b74638a255061ee782717d64ca0e51e58b6e5 SHA512 be402e69417c3cee5e5db724bc7680ec48f432b51f79bf7ec3baa5402e5cb68f7299edcf3d1604d4ac10d7eee7361bcdf70f737b6db12f8b80dd75c626b1f2d8
diff --git a/app-containers/lxd/files/lxd-4.0.0.confd b/app-containers/lxd/files/lxd-4.0.0.confd
new file mode 100644
index 000000000000..68cf344995be
--- /dev/null
+++ b/app-containers/lxd/files/lxd-4.0.0.confd
@@ -0,0 +1,23 @@
+# Group which owns the shared socket
+LXD_OPTIONS+=" --group lxd"
+
+# Enable cpu profiling into the specified file
+#LXD_OPTIONS+=" --cpuprofile /tmp/lxc_cpu_profile"
+
+# Enable memory profiling into the specified file
+#LXD_OPTIONS+=" --memprofile /tmp/lxc_mem_profile"
+
+# Enable debug mode
+#LXD_OPTIONS+=" --debug"
+
+# For debugging, print a complete stack trace every n seconds
+#LXD_OPTIONS+=" --print-goroutines-every 5"
+
+# Enable verbose mode
+#LXD_OPTIONS+=" -v"
+
+# Logfile to log to
+#LXD_OPTIONS+=" --logfile /var/log/lxd/lxd.log"
+
+# Enable syslog logging
+#LXD_OPTIONS+=" --syslog"
diff --git a/app-containers/lxd/files/lxd-4.0.0.socket b/app-containers/lxd/files/lxd-4.0.0.socket
new file mode 100644
index 000000000000..3207c9453d11
--- /dev/null
+++ b/app-containers/lxd/files/lxd-4.0.0.socket
@@ -0,0 +1,12 @@
+[Unit]
+Description=LXD - unix socket
+Documentation=man:lxd(1)
+
+[Socket]
+ListenStream=/var/lib/lxd/unix.socket
+SocketGroup=lxd
+SocketMode=0660
+Service=lxd.service
+
+[Install]
+WantedBy=sockets.target
diff --git a/app-containers/lxd/files/lxd-4.0.9-r1.service b/app-containers/lxd/files/lxd-4.0.9-r1.service
new file mode 100644
index 000000000000..480940dab7a3
--- /dev/null
+++ b/app-containers/lxd/files/lxd-4.0.9-r1.service
@@ -0,0 +1,23 @@
+[Unit]
+Description=LXD - main daemon
+After=network-online.target lxcfs.service lxd.socket
+Requires=network-online.target lxcfs.service lxd.socket
+Documentation=man:lxd(1)
+
+[Service]
+EnvironmentFile=-/etc/environment
+ExecStart=/usr/sbin/lxd --group lxd --syslog
+ExecStartPost=/usr/sbin/lxd waitready --timeout=600
+ExecStartPre=/bin/mkdir -p /var/log/lxd
+ExecStartPre=/bin/chown -R root:lxd /var/log/lxd
+KillMode=process
+PermissionsStartOnly=true
+TimeoutStartSec=600s
+TimeoutStopSec=30s
+Restart=on-failure
+LimitNOFILE=1048576
+LimitNPROC=infinity
+TasksMax=infinity
+
+[Install]
+Also=lxd-containers.service lxd.socket
diff --git a/app-containers/lxd/files/lxd-5.0.2-r1.initd b/app-containers/lxd/files/lxd-5.0.2-r1.initd
new file mode 100644
index 000000000000..7c74c0fdc308
--- /dev/null
+++ b/app-containers/lxd/files/lxd-5.0.2-r1.initd
@@ -0,0 +1,59 @@
+#!/sbin/openrc-run
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+DAEMON=/usr/sbin/lxd
+PIDFILE=/run/lxd.pid
+
+depend() {
+	need net
+	need lxcfs
+}
+
+start() {
+	ebegin "Starting lxd service"
+
+	modprobe -f loop > /dev/null 2>&1
+
+	# Fix permissions on /var/lib/lxd and make sure it exists.
+	# Create a log directory for lxd with correct permissions.
+	install -d /var/lib/lxd --group lxd --owner root --mode 0775
+	install -d /var/log/lxd --group lxd --owner root
+
+	start-stop-daemon --start \
+		--pidfile ${PIDFILE} \
+		--exec ${DAEMON} \
+		--background \
+		--make-pidfile \
+		-- \
+		${LXD_OPTIONS}
+	eend ${?}
+
+	# Create necessary systemd paths in order for systemd containers to work on openrc host.
+	# /etc/rc.conf should have following values:
+	#   rc_cgroup_mode="hybrid"
+	if [ -d /sys/fs/cgroup/unified ] &&
+	[ ! -d /sys/fs/cgroup/systemd ]; then
+		install -d /sys/fs/cgroup/systemd --group lxd --owner root
+		mount -t cgroup -o none,name=systemd systemd /sys/fs/cgroup/systemd
+	fi
+}
+
+stop() {
+	if [ "${RC_CMD}" = restart ]; then
+		ebegin "Stopping lxd service (but not containers)"
+		# start-stop-daemon sends SIGTERM with a timeout of 5s by default.
+		# SIGTERM indicates to LXD that it will be stopped temporarily.
+		# Instances will keep running.
+		start-stop-daemon --stop --quiet -p "${PIDFILE}"
+		eend ${?}
+	else
+		ebegin "Stopping lxd service and containers, waiting 40s"
+		# SIGPWR indicates to LXD that the host is going down.
+		# LXD will do a clean shutdown of all instances.
+		# After 30s all remaining instances will be killed.
+		# We wait up to 40s for LXD.
+		start-stop-daemon --stop --quiet -R SIGPWR/40 -p "${PIDFILE}"
+		eend ${?}
+	fi
+}
diff --git a/app-containers/lxd/files/lxd-containers-4.0.0.service b/app-containers/lxd/files/lxd-containers-4.0.0.service
new file mode 100644
index 000000000000..894760c3506b
--- /dev/null
+++ b/app-containers/lxd/files/lxd-containers-4.0.0.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=LXD - container startup/shutdown
+Documentation=man:lxd(1)
+After=lxd.socket lxd.service
+Requires=lxd.socket
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/lxd activateifneeded
+ExecStop=/usr/sbin/lxd shutdown
+TimeoutStartSec=600s
+TimeoutStopSec=600s
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/app-containers/lxd/lxd-5.21.1-r1.ebuild b/app-containers/lxd/lxd-5.21.1-r1.ebuild
new file mode 100644
index 000000000000..12cdb9a81965
--- /dev/null
+++ b/app-containers/lxd/lxd-5.21.1-r1.ebuild
@@ -0,0 +1,187 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit bash-completion-r1 go-module linux-info optfeature systemd verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://ubuntu.com/lxd https://github.com/canonical/lxd"
+SRC_URI="https://github.com/canonical/lxd/releases/download/${P}/${P}.tar.gz
+	verify-sig? ( https://github.com/canonical/lxd/releases/download/${P}/${P}.tar.gz.asc
+)"
+
+LICENSE="Apache-2.0 AGPL-3+ BSD LGPL-3 MIT"
+SLOT="0/lts"
+KEYWORDS="amd64 ~arm64 ~x86"
+IUSE="apparmor nls"
+
+DEPEND="acct-group/lxd
+	app-arch/xz-utils
+	>=app-containers/lxc-5.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/dqlite-1.16.4:=[lz4]
+	dev-libs/lzo
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+			net-firewall/nftables[json]
+			(
+				net-firewall/ebtables
+				net-firewall/iptables
+			)
+	)
+	sys-apps/iproute2
+	sys-fs/fuse:3
+	>=sys-fs/lxcfs-5.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl"
+BDEPEND=">=dev-lang/go-1.22
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-canonical )"
+
+CONFIG_CHECK="
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/fuidshift
+	/usr/bin/lxc
+	/usr/bin/lxc-to-lxd
+	/usr/bin/lxd-agent
+	/usr/bin/lxd-benchmark
+	/usr/bin/lxd-migrate
+	/usr/sbin/lxd"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/canonical.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/lxd:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	# Fix hardcoded ovmf file path, see bug 763180
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
+		doc/environment.md \
+		lxd/apparmor/instance.go \
+		lxd/apparmor/instance_qemu.go \
+		lxd/instance/drivers/driver_qemu.go || die "Failed to fix hardcoded ovmf paths."
+
+	# Fix hardcoded virtfs-proxy-helper file path, see bug 798924
+	sed -i \
+		-e "s:/usr/lib/qemu/virtfs-proxy-helper:/usr/libexec/virtfs-proxy-helper:g" \
+		lxd/device/device_utils_disk.go || die "Failed to fix virtfs-proxy-helper path."
+
+	cp "${FILESDIR}"/lxd-4.0.9-r1.service "${T}"/lxd.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/lxd.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in fuidshift lxd-benchmark lxc lxc-to-lxd; do
+		go install -v -x "${S}/${k}" || die "failed compiling ${k}"
+	done
+
+	go install -v -x -tags libsqlite3 "${S}"/lxd || die "Failed to build the daemon"
+
+	# Needs to be built statically
+	CGO_ENABLED=0 go install -v -tags netgo "${S}"/lxd-migrate
+	CGO_ENABLED=0 go install -v -tags agent,netgo "${S}"/lxd-agent
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+	local bindir="_dist/bin"
+
+	dosbin ${bindir}/lxd
+
+	for l in fuidshift lxd-agent lxd-benchmark lxd-migrate lxc lxc-to-lxd; do
+		dobin ${bindir}/${l}
+	done
+
+	newbashcomp scripts/bash/lxd-client lxc
+
+	newconfd "${FILESDIR}"/lxd-4.0.0.confd lxd
+	newinitd "${FILESDIR}"/lxd-5.0.2-r1.initd lxd
+
+	systemd_dounit "${T}"/lxd.service
+	systemd_newunit "${FILESDIR}"/lxd-containers-4.0.0.service lxd-containers.service
+	systemd_newunit "${FILESDIR}"/lxd-4.0.0.socket lxd.socket
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+}
+
+pkg_postinst() {
+	elog
+	elog "Consult https://wiki.gentoo.org/wiki/LXD for more information,"
+	elog "including a Quick Start."
+	elog "For virtual machine support, see:"
+	elog "https://wiki.gentoo.org/wiki/LXD#Virtual_machines"
+	elog
+	elog "Please run 'lxc-checkconfig' to see all optional kernel features."
+	elog
+	optfeature "virtual machine support" app-emulation/qemu[spice,usbredir,virtfs]
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full lxd-migrate support" net-misc/rsync
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the lxd group."
+}
diff --git a/app-containers/lxd/lxd-5.21.4.ebuild b/app-containers/lxd/lxd-5.21.4.ebuild
new file mode 100644
index 000000000000..892198607b19
--- /dev/null
+++ b/app-containers/lxd/lxd-5.21.4.ebuild
@@ -0,0 +1,180 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info optfeature systemd verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://ubuntu.com/lxd https://github.com/canonical/lxd"
+SRC_URI="https://github.com/canonical/lxd/releases/download/${P}/${P}.tar.gz
+	verify-sig? ( https://github.com/canonical/lxd/releases/download/${P}/${P}.tar.gz.asc
+)"
+
+LICENSE="Apache-2.0 AGPL-3+ BSD LGPL-3 MIT"
+SLOT="0/lts"
+KEYWORDS="~amd64 ~arm64 ~x86"
+IUSE="apparmor nls"
+
+DEPEND="acct-group/lxd
+	app-arch/xz-utils
+	>=app-containers/lxc-5.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/dqlite-1.16.4:=[lz4]
+	dev-libs/lzo
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+			net-firewall/nftables[json]
+			(
+				net-firewall/ebtables
+				net-firewall/iptables
+			)
+	)
+	sys-apps/iproute2
+	sys-fs/fuse:3
+	>=sys-fs/lxcfs-5.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl"
+BDEPEND=">=dev-lang/go-1.22
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-canonical )"
+
+CONFIG_CHECK="
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/fuidshift
+	/usr/bin/lxc
+	/usr/bin/lxd-agent
+	/usr/bin/lxd-benchmark
+	/usr/bin/lxd-migrate
+	/usr/sbin/lxd"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/canonical.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/lxd:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	# Fix hardcoded ovmf file path, see bug 763180
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		lxd/instance/drivers/edk2/edk2.go || die "Failed to fix hardcoded ovmf paths."
+
+	# Fix hardcoded virtfs-proxy-helper file path, see bug 798924
+	sed -i \
+		-e "s:/usr/lib/qemu/virtfs-proxy-helper:/usr/libexec/virtfs-proxy-helper:g" \
+		lxd/device/device_utils_disk.go || die "Failed to fix virtfs-proxy-helper path."
+
+	cp "${FILESDIR}"/lxd-4.0.9-r1.service "${T}"/lxd.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/lxd.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in fuidshift lxd-benchmark lxc; do
+		go install -v -x "${S}/${k}" || die "failed compiling ${k}"
+	done
+
+	go install -v -x -tags libsqlite3 "${S}"/lxd || die "Failed to build the daemon"
+
+	# Needs to be built statically
+	CGO_ENABLED=0 go install -v -tags netgo "${S}"/lxd-migrate
+	CGO_ENABLED=0 go install -v -tags agent,netgo "${S}"/lxd-agent
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+	local bindir="_dist/bin"
+
+	dosbin ${bindir}/lxd
+
+	for l in fuidshift lxd-agent lxd-benchmark lxd-migrate lxc; do
+		dobin ${bindir}/${l}
+	done
+
+	newconfd "${FILESDIR}"/lxd-4.0.0.confd lxd
+	newinitd "${FILESDIR}"/lxd-5.0.2-r1.initd lxd
+
+	systemd_dounit "${T}"/lxd.service
+	systemd_newunit "${FILESDIR}"/lxd-containers-4.0.0.service lxd-containers.service
+	systemd_newunit "${FILESDIR}"/lxd-4.0.0.socket lxd.socket
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+}
+
+pkg_postinst() {
+	elog
+	elog "Consult https://wiki.gentoo.org/wiki/LXD for more information,"
+	elog "including a Quick Start."
+	elog "For virtual machine support, see:"
+	elog "https://wiki.gentoo.org/wiki/LXD#Virtual_machines"
+	elog
+	elog "Please run 'lxc-checkconfig' to see all optional kernel features."
+	elog
+	optfeature "virtual machine support" app-emulation/qemu[spice,usbredir,virtfs]
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full lxd-migrate support" net-misc/rsync
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the lxd group."
+}
diff --git a/app-containers/lxd/lxd-6.3.ebuild b/app-containers/lxd/lxd-6.3.ebuild
new file mode 100644
index 000000000000..690866145a14
--- /dev/null
+++ b/app-containers/lxd/lxd-6.3.ebuild
@@ -0,0 +1,190 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info optfeature systemd verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://ubuntu.com/lxd https://github.com/canonical/lxd"
+SRC_URI="https://github.com/canonical/lxd/releases/download/${P}/${P}.tar.gz
+	verify-sig? ( https://github.com/canonical/lxd/releases/download/${P}/${P}.tar.gz.asc
+)"
+
+LICENSE="Apache-2.0 AGPL-3+ BSD LGPL-3 MIT"
+SLOT="0/stable"
+KEYWORDS="~amd64 ~arm64 ~x86"
+IUSE="apparmor nls"
+
+DEPEND="acct-group/lxd
+	app-arch/xz-utils
+	>=app-containers/lxc-5.0.0:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/dqlite-1.18.0:=[lz4]
+	dev-libs/lzo
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+			net-firewall/nftables[json]
+			(
+				net-firewall/ebtables
+				net-firewall/iptables
+			)
+	)
+	sys-apps/iproute2
+	sys-fs/fuse:3
+	>=sys-fs/lxcfs-5.0.0
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl"
+BDEPEND=">=dev-lang/go-1.22.4
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-canonical )"
+
+CONFIG_CHECK="
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/fuidshift
+	/usr/bin/lxc
+	/usr/bin/lxc-to-lxd
+	/usr/bin/lxd-agent
+	/usr/bin/lxd-benchmark
+	/usr/bin/lxd-migrate
+	/usr/sbin/lxd"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/canonical.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/lxd:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	# Fix hardcoded ovmf file path, see bug 763180
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		-e "s:OVMF_VARS.ms.fd:OVMF_VARS.fd:g" \
+		doc/environment.md \
+		lxd/apparmor/instance.go \
+		lxd/apparmor/instance_qemu.go \
+		lxd/instance/drivers/driver_qemu.go || die "Failed to fix hardcoded ovmf paths."
+
+	# Fix hardcoded virtfs-proxy-helper file path, see bug 798924
+	sed -i \
+		-e "s:/usr/lib/qemu/virtfs-proxy-helper:/usr/libexec/virtfs-proxy-helper:g" \
+		lxd/device/device_utils_disk.go || die "Failed to fix virtfs-proxy-helper path."
+
+	cp "${FILESDIR}"/lxd-4.0.9-r1.service "${T}"/lxd.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/lxd.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in fuidshift lxd-benchmark lxc lxc-to-lxd; do
+		go install -v -x "${S}/${k}" || die "failed compiling ${k}"
+	done
+
+	go install -v -x -tags libsqlite3 "${S}"/lxd || die "Failed to build the daemon"
+
+	# Needs to be built statically
+	CGO_ENABLED=0 go install -v -tags netgo "${S}"/lxd-migrate
+	CGO_ENABLED=0 go install -v -tags agent,netgo "${S}"/lxd-agent
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+	local bindir="_dist/bin"
+
+	dosbin ${bindir}/lxd
+
+	for l in fuidshift lxd-agent lxd-benchmark lxd-migrate lxc lxc-to-lxd; do
+		dobin ${bindir}/${l}
+	done
+
+	newconfd "${FILESDIR}"/lxd-4.0.0.confd lxd
+	newinitd "${FILESDIR}"/lxd-5.0.2-r1.initd lxd
+
+	systemd_dounit "${T}"/lxd.service
+	systemd_newunit "${FILESDIR}"/lxd-containers-4.0.0.service lxd-containers.service
+	systemd_newunit "${FILESDIR}"/lxd-4.0.0.socket lxd.socket
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+
+	# LXD needs LXD_QEMU_FW_PATH in env to find OVMF files for virtual machines
+	newenvd - 90lxd <<- _EOF_
+		LXD_QEMU_FW_PATH=${EPREFIX}/usr/share/edk2-ovmf
+	_EOF_
+}
+
+pkg_postinst() {
+	elog
+	elog "Consult https://wiki.gentoo.org/wiki/LXD for more information,"
+	elog "including a Quick Start."
+	elog "For virtual machine support, see:"
+	elog "https://wiki.gentoo.org/wiki/LXD#Virtual_machines"
+	elog
+	elog "Please run 'lxc-checkconfig' to see all optional kernel features."
+	elog
+	optfeature "virtual machine support" app-emulation/qemu[spice,usbredir,virtfs]
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full lxd-migrate support" net-misc/rsync
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the lxd group."
+}
diff --git a/app-containers/lxd/lxd-6.5.ebuild b/app-containers/lxd/lxd-6.5.ebuild
new file mode 100644
index 000000000000..ce137e164bf2
--- /dev/null
+++ b/app-containers/lxd/lxd-6.5.ebuild
@@ -0,0 +1,185 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info optfeature systemd verify-sig
+
+DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
+HOMEPAGE="https://ubuntu.com/lxd https://github.com/canonical/lxd"
+SRC_URI="https://github.com/canonical/lxd/releases/download/${P}/${P}.tar.gz
+	verify-sig? ( https://github.com/canonical/lxd/releases/download/${P}/${P}.tar.gz.asc
+)"
+
+LICENSE="Apache-2.0 AGPL-3+ BSD LGPL-3 MIT"
+SLOT="0/stable"
+KEYWORDS="~amd64 ~arm64 ~x86"
+IUSE="apparmor nls"
+
+DEPEND="acct-group/lxd
+	app-arch/xz-utils
+	>=app-containers/lxc-6.0.4:=[apparmor?,seccomp(+)]
+	dev-db/sqlite:3
+	>=dev-libs/dqlite-1.18.2:=[lz4]
+	dev-libs/lzo
+	>=dev-util/xdelta-3.0[lzma(+)]
+	net-dns/dnsmasq[dhcp]
+	sys-libs/libcap
+	virtual/udev"
+RDEPEND="${DEPEND}
+	|| (
+			net-firewall/nftables[json]
+			(
+				net-firewall/ebtables
+				net-firewall/iptables
+			)
+	)
+	sys-apps/iproute2
+	sys-fs/fuse:3
+	>=sys-fs/lxcfs-6.0.4
+	sys-fs/squashfs-tools[lzma]
+	virtual/acl"
+BDEPEND=">=dev-lang/go-1.24.4
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-canonical )"
+
+CONFIG_CHECK="
+	~CGROUPS
+	~IPC_NS
+	~NET_NS
+	~PID_NS
+
+	~SECCOMP
+	~USER_NS
+	~UTS_NS
+
+	~KVM
+	~MACVTAP
+	~VHOST_VSOCK
+"
+
+ERROR_IPC_NS="CONFIG_IPC_NS is required."
+ERROR_NET_NS="CONFIG_NET_NS is required."
+ERROR_PID_NS="CONFIG_PID_NS is required."
+ERROR_SECCOMP="CONFIG_SECCOMP is required."
+ERROR_UTS_NS="CONFIG_UTS_NS is required."
+
+WARNING_KVM="CONFIG_KVM and CONFIG_KVM_AMD/-INTEL is required for virtual machines."
+WARNING_MACVTAP="CONFIG_MACVTAP is required for virtual machines."
+WARNING_VHOST_VSOCK="CONFIG_VHOST_VSOCK is required for virtual machines."
+
+# Go magic.
+QA_PREBUILT="/usr/bin/fuidshift
+	/usr/bin/lxc
+	/usr/bin/lxd-agent
+	/usr/bin/lxd-benchmark
+	/usr/bin/lxd-migrate
+	/usr/sbin/lxd"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/canonical.asc
+
+# The testsuite must be run as root.
+# make: *** [Makefile:156: check] Error 1
+RESTRICT="test"
+
+GOPATH="${S}/_dist"
+
+src_prepare() {
+	export GOPATH="${S}/_dist"
+
+	default
+
+	sed -i \
+		-e "s:\./configure:./configure --prefix=/usr --libdir=${EPREFIX}/usr/lib/lxd:g" \
+		-e "s:make:make ${MAKEOPTS}:g" \
+		Makefile || die
+
+	# Fix hardcoded ovmf file path, see bug 763180
+	sed -i \
+		-e "s:/usr/share/OVMF:/usr/share/edk2/OvmfX64:g" \
+		lxd/instance/drivers/edk2/edk2.go || die "Failed to fix hardcoded ovmf paths."
+
+	# Fix hardcoded virtfs-proxy-helper file path, see bug 798924
+	sed -i \
+		-e "s:/usr/lib/qemu/virtfs-proxy-helper:/usr/libexec/virtfs-proxy-helper:g" \
+		lxd/device/device_utils_disk.go || die "Failed to fix virtfs-proxy-helper path."
+
+	cp "${FILESDIR}"/lxd-4.0.9-r1.service "${T}"/lxd.service || die
+	if use apparmor; then
+		sed -i \
+			'/^EnvironmentFile=.*/a ExecStartPre=\/usr\/libexec\/lxc\/lxc-apparmor-load' \
+			"${T}"/lxd.service || die
+	fi
+
+	# Disable -Werror's from go modules.
+	find "${S}" -name "cgo.go" -exec sed -i "s/ -Werror / /g" {} + || die
+}
+
+src_configure() { :; }
+
+src_compile() {
+	export GOPATH="${S}/_dist"
+	export CGO_LDFLAGS_ALLOW="-Wl,-z,now"
+
+	for k in fuidshift lxd-benchmark lxc; do
+		go install -v -x "${S}/${k}" || die "failed compiling ${k}"
+	done
+
+	go install -v -x -tags libsqlite3 "${S}"/lxd || die "Failed to build the daemon"
+
+	# Needs to be built statically
+	CGO_ENABLED=0 go install -v -tags netgo "${S}"/lxd-migrate
+	CGO_ENABLED=0 go install -v -tags agent,netgo "${S}"/lxd-agent
+
+	use nls && emake build-mo
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	export GOPATH="${S}/_dist"
+	local bindir="_dist/bin"
+
+	dosbin ${bindir}/lxd
+
+	for l in fuidshift lxd-agent lxd-benchmark lxd-migrate lxc; do
+		dobin ${bindir}/${l}
+	done
+
+	newconfd "${FILESDIR}"/lxd-4.0.0.confd lxd
+	newinitd "${FILESDIR}"/lxd-5.0.2-r1.initd lxd
+
+	systemd_dounit "${T}"/lxd.service
+	systemd_newunit "${FILESDIR}"/lxd-containers-4.0.0.service lxd-containers.service
+	systemd_newunit "${FILESDIR}"/lxd-4.0.0.socket lxd.socket
+
+	dodoc AUTHORS
+	dodoc -r doc/*
+	use nls && domo po/*.mo
+
+	# LXD needs LXD_QEMU_FW_PATH in env to find OVMF files for virtual machines
+	newenvd - 90lxd <<- _EOF_
+		LXD_QEMU_FW_PATH=${EPREFIX}/usr/share/edk2-ovmf
+	_EOF_
+}
+
+pkg_postinst() {
+	elog
+	elog "Consult https://wiki.gentoo.org/wiki/LXD for more information,"
+	elog "including a Quick Start."
+	elog "For virtual machine support, see:"
+	elog "https://wiki.gentoo.org/wiki/LXD#Virtual_machines"
+	elog
+	elog "Please run 'lxc-checkconfig' to see all optional kernel features."
+	elog
+	optfeature "virtual machine support" app-emulation/qemu[spice,usbredir,virtfs]
+	optfeature "btrfs storage backend" sys-fs/btrfs-progs
+	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
+	optfeature "full lxd-migrate support" net-misc/rsync
+	optfeature "lvm2 storage backend" sys-fs/lvm2
+	optfeature "zfs storage backend" sys-fs/zfs
+	elog
+	elog "Be sure to add your local user to the lxd group."
+}
diff --git a/app-containers/lxd/metadata.xml b/app-containers/lxd/metadata.xml
new file mode 100644
index 000000000000..745298081a32
--- /dev/null
+++ b/app-containers/lxd/metadata.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <longdescription>
+    LXD is a modern, secure and powerful system container and virtual machine manager.
+
+    It provides a unified experience for running and managing full Linux systems inside containers
+    or virtual machines. LXD supplies images for a wide number of Linux distributions and is built
+    around a very powerful, yet pretty simple, REST API. LXD scales from one instance on a single
+    machine to a cluster in a full data center rack, making it suitable for running workloads both
+    for development and in production.
+
+    LXD allows you to easily set up a system that feels like a small private cloud. You can run any
+    type of workload in an efficient way while keeping your resources optimized.
+
+    You should consider using LXD if you want to containerize different environments or run virtual
+    machines, or in general run and manage your infrastructure in a cost-effective way.
+  </longdescription>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:linuxcontainers:lxd</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/nerdctl/Manifest b/app-containers/nerdctl/Manifest
new file mode 100644
index 000000000000..a8f80fd3e4e8
--- /dev/null
+++ b/app-containers/nerdctl/Manifest
@@ -0,0 +1,6 @@
+DIST nerdctl-2.0.2-go-mod-vendor.tar.gz 7348723 BLAKE2B 8f9b96193b45f2006ffaa205f2c265462ed759652163272e31ecbef76f6752adb2288a843902faa27b42e5d2215e44521101d7017e3a4c6cb78660e288c27fb6 SHA512 a8b587b502dfacc14bef9d70e7233c53561ce39ea3612794086951c022daba445e2a4d429f3f40686e9c55deaac05848f4e6646f59f1df166dc5efb61ec75a67
+DIST nerdctl-2.0.2.tar.gz 1328952 BLAKE2B 4ffa3cdf3e6c2ec2ee2ece0c214b3219f3a068c9d34cf17eff12660421219470b1309f701bcfadea6623e3a7693f9f2cf0c732f882e97866d6e75945176ce5a5 SHA512 bab4358279ba8edf119062b494bf1b393e22c8ee483aa16d502e6656ed56a9775e024bc1c30cbdc2185840fbb7d8a8d7da7e30a0f1905b5a436024472619d2c3
+DIST nerdctl-2.0.3-go-mod-vendor.tar.gz 7404790 BLAKE2B 5b28dc9b154d9709764941b000fa09ca83acd567db1d6ffce17e950fa095336bc7132ae8695af7fe12385c1b53c6d9571b04579bb9557e8c5ea943c6f31d0ba5 SHA512 bc0b09f8d132ffb7c9d497561a40ed83196f4c7c10135f85430f1a5c4684854976a27067ee8d64b0f73e3b482064d49e44c3724aee4c22f4d85049a26b2eb660
+DIST nerdctl-2.0.3.tar.gz 1345686 BLAKE2B bd9b2e1979931de5882d64fa51c094a532023f8c7be1f9b397dbb998d6bf428a6b9839d3682ce66ddddb8887e432027f8704d97e06ead2f4d870ef8e2cd9b1a9 SHA512 32467f3b75e443104d7b49c40bb27df72080ae6c40c9c085968b8f8e3d839095f2047c4fd1cff540bcb785639b79a0874f9a50a5af9feb2a690a7c22621ab98d
+DIST nerdctl-2.2.1-go-mod-vendor.tar.gz 8108003 BLAKE2B 73fe63c9af84829392cb356381c0f24c63946c6eb35a8bad4f150bb3c33116eca93ad00661dfbc7b08c0fa9494836ed0a7f21a2227bc851ae451c86ef9f3389d SHA512 59ca6e6d529f02496f0a4cd98ffb62e6b104104f1a7a3c79705a0f6e8bcc9ac2a1788ec7e20a004e8ccbcff987d42dbd4970ef74a145edec157c7b26025bb556
+DIST nerdctl-2.2.1.tar.gz 1521355 BLAKE2B 1399a5a0ef2ce6dd46ce289cc1ccb8f40c5f7530ae5da0f8155e89b6d858dcb8efdfeb5d10e6a10eb6e7ec66ce10b06e633a15879320bcbf59d0fcf20f2a7189 SHA512 2b25061c0673633e28e42cb082e1cd5d86a31127c83ff23621c742a05b7b3314fca51acf20cc4a45f00400624d17d52b480e6803e886f59ac92cf38470ba983a
diff --git a/app-containers/nerdctl/metadata.xml b/app-containers/nerdctl/metadata.xml
new file mode 100644
index 000000000000..0f6332c92f4b
--- /dev/null
+++ b/app-containers/nerdctl/metadata.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <use>
+    <flag name="rootless">
+			Enables dependencies for running in rootless mode.
+		</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/nerdctl/nerdctl-2.0.2.ebuild b/app-containers/nerdctl/nerdctl-2.0.2.ebuild
new file mode 100644
index 000000000000..bac4c17e9e5d
--- /dev/null
+++ b/app-containers/nerdctl/nerdctl-2.0.2.ebuild
@@ -0,0 +1,53 @@
+# Copyright 2021-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+EGIT_COMMIT="1220ce7ec2701d485a9b1beeea63dae3da134fb5"
+
+DESCRIPTION="Docker-compatible CLI for containerd, with support for Compose"
+HOMEPAGE="https://github.com/containerd/nerdctl"
+SRC_URI="
+	https://github.com/containerd/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz
+	https://github.com/containerd/${PN}/releases/download/v${PV}/${P}-go-mod-vendor.tar.gz
+"
+
+LICENSE="Apache-2.0"
+LICENSE+=" BSD BSD-2 ISC MIT"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE="rootless"
+
+DEPEND="
+	rootless? (
+		app-containers/slirp4netns
+		sys-apps/rootlesskit
+	)
+"
+RDEPEND="${DEPEND}"
+
+src_unpack() {
+	unpack "${P}.tar.gz"
+	cd "${S}"
+	unpack "${P}-go-mod-vendor.tar.gz"
+	mv home/runner/work/nerdctl/nerdctl/vendor . || die
+}
+
+src_compile() {
+	emake VERSION=v${PV} REVISION="${EGIT_COMMIT}"
+}
+
+src_install() {
+	local emake_args=(
+		DESTDIR="${D}"
+		VERSION=v${PV}
+		REVISION="${EGIT_COMMIT}"
+		DOCDIR="${EPREFIX}/usr/share/doc/${PF}"
+		PREFIX="${EPREFIX}/usr"
+	)
+	emake "${emake_args[@]}" install
+	local DOCS=( README.md docs/* examples )
+	einstalldocs
+}
diff --git a/app-containers/nerdctl/nerdctl-2.0.3.ebuild b/app-containers/nerdctl/nerdctl-2.0.3.ebuild
new file mode 100644
index 000000000000..70f83edb1db6
--- /dev/null
+++ b/app-containers/nerdctl/nerdctl-2.0.3.ebuild
@@ -0,0 +1,53 @@
+# Copyright 2021-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+EGIT_COMMIT="1220ce7ec2701d485a9b1beeea63dae3da134fb5"
+
+DESCRIPTION="Docker-compatible CLI for containerd, with support for Compose"
+HOMEPAGE="https://github.com/containerd/nerdctl"
+SRC_URI="
+	https://github.com/containerd/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz
+	https://github.com/containerd/${PN}/releases/download/v${PV}/${P}-go-mod-vendor.tar.gz
+"
+
+LICENSE="Apache-2.0"
+LICENSE+=" BSD BSD-2 ISC MIT"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE="rootless"
+
+DEPEND="
+	rootless? (
+		app-containers/slirp4netns
+		sys-apps/rootlesskit
+	)
+"
+RDEPEND="${DEPEND}"
+
+src_unpack() {
+	unpack "${P}.tar.gz"
+	cd "${S}"
+	unpack "${P}-go-mod-vendor.tar.gz"
+	mv home/runner/work/nerdctl/nerdctl/vendor . || die
+}
+
+src_compile() {
+	emake VERSION=v${PV} REVISION="${EGIT_COMMIT}"
+}
+
+src_install() {
+	local emake_args=(
+		DESTDIR="${D}"
+		VERSION=v${PV}
+		REVISION="${EGIT_COMMIT}"
+		DOCDIR="${EPREFIX}/usr/share/doc/${PF}"
+		PREFIX="${EPREFIX}/usr"
+	)
+	emake "${emake_args[@]}" install
+	local DOCS=( README.md docs/* examples )
+	einstalldocs
+}
diff --git a/app-containers/nerdctl/nerdctl-2.2.1.ebuild b/app-containers/nerdctl/nerdctl-2.2.1.ebuild
new file mode 100644
index 000000000000..08d6dc459fc2
--- /dev/null
+++ b/app-containers/nerdctl/nerdctl-2.2.1.ebuild
@@ -0,0 +1,53 @@
+# Copyright 2021-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+EGIT_COMMIT="1220ce7ec2701d485a9b1beeea63dae3da134fb5"
+
+DESCRIPTION="Docker-compatible CLI for containerd, with support for Compose"
+HOMEPAGE="https://github.com/containerd/nerdctl"
+SRC_URI="
+	https://github.com/containerd/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz
+	https://github.com/containerd/${PN}/releases/download/v${PV}/${P}-go-mod-vendor.tar.gz
+"
+
+LICENSE="Apache-2.0"
+LICENSE+=" BSD BSD-2 ISC MIT"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE="rootless"
+
+DEPEND="
+	rootless? (
+		app-containers/slirp4netns
+		sys-apps/rootlesskit
+	)
+"
+RDEPEND="${DEPEND}"
+
+src_unpack() {
+	unpack "${P}.tar.gz"
+	cd "${S}"
+	unpack "${P}-go-mod-vendor.tar.gz"
+	mv home/runner/work/nerdctl/nerdctl/vendor . || die
+}
+
+src_compile() {
+	emake VERSION=v${PV} REVISION="${EGIT_COMMIT}"
+}
+
+src_install() {
+	local emake_args=(
+		DESTDIR="${D}"
+		VERSION=v${PV}
+		REVISION="${EGIT_COMMIT}"
+		DOCDIR="${EPREFIX}/usr/share/doc/${PF}"
+		PREFIX="${EPREFIX}/usr"
+	)
+	emake "${emake_args[@]}" install
+	local DOCS=( README.md docs/* examples )
+	einstalldocs
+}
diff --git a/app-containers/netavark/Manifest b/app-containers/netavark/Manifest
new file mode 100644
index 000000000000..b68e78136999
--- /dev/null
+++ b/app-containers/netavark/Manifest
@@ -0,0 +1,12 @@
+DIST netavark-1.14.1.crate 167516 BLAKE2B b6ec5eaef66798416fc0fc82f6de81d07feb52a95946a3844a9f4b34c16bfaa37bc3b5228e38b912d40381d30940f7e49bf052426989f20fffc712e2c4499ebb SHA512 ae7892858e85fda499742e9c9553f7e5e887bd62f155832b630c4b4fc0b32f52469d72d901d9b222816f324ec4f877cb758c9edad22e282eee77e05d98b05fc6
+DIST netavark-1.15.2.crate 169643 BLAKE2B fcc3a3b691a4bc0dfcbc180408ee9d8c7f15275c8ec0b8ae27f63a6d84ff425a0035ab4c17328d31f4b6a9dbbeaab0f48188111f82ddf6e3be9994eff3944e5b SHA512 6b9880b4150b52818f7bb2179acf2b4ffe87ab36a0aa8cf0c4442781f818842236d4acb41077729e8a25d134b96639cd311f0a505d276df02e5cd5e0a83cce82
+DIST netavark-1.16.1.crate 173635 BLAKE2B c2d45164e5c7a6689e5dae4921163a128e7525eef75a5b98a810539c13988a4880727831c22252e418bf3c987e1e729a6bb001e9dacb48b1c73603053fd0abc4 SHA512 8d20e5cc1bd8d80eaf7a9263985478f27b994dbff0da9b4378e4be0beb71121624348b152d3891b78512e598e2887815534c806518e64ff8f95eed305fa33132
+DIST netavark-1.17.0.crate 174623 BLAKE2B c39e9388185345541d0b8f2ddf6f3f14648499892aaab4b820d5d45f5620a24b31a7c24092832396fd04dd1e05828e933af9900f4228a8d03d90447c9269d970 SHA512 135cda6367d04c1d7a6b12882540bcf095acc5e42c43096a01be55f300d14b70ee6eeb6679fac5892d764d700bbfa2109f5c7c39e521ed8d8be1e61403f92258
+DIST netavark-1.17.1.crate 174659 BLAKE2B a31fd13f31b671274000ae6a43ceefb0b0d1cd32026fd86ac01dc30acb55cf25b28016e5a8e7c91760384e61bb62d6edfcd48b163abc2000ff43201edac7e054 SHA512 dff64afaf982ba38c8a991ffafffbba2dce7abf70b4763eba662ef82f01629f265e2421d622a27a1db9e26ea44f33b5c8dbab2fdcf9b643b3d845b8ca624ba57
+DIST netavark-1.17.2.crate 175788 BLAKE2B 94f6f202eca445267f063d53a47e572055fa6a7b2839d5e95246ff93dad0c55866571456459600cd57f42001dd75b4ae5bbdad6e7b95fa9b95616137fd87f03d SHA512 7a6a12fb58a190462d6a2171ac28df03686d09d371cb84e702278cda190111c24603060048f8cf7bd9a8ad334dc056efaa901604d08145009adf9e10eabf1aee
+DIST netavark-v1.14.1-vendor.tar.gz 18508797 BLAKE2B 8b63673700f26e19ac2c2274e71a803bf99ba7aec58d8f66320e0cdd7c72c016f16083df46b0b454bd91df5e62e5c4170bcb2ee636c094a5578951bd8f38eb24 SHA512 84545bcb791a698a20d3b1f41502beaa568a5e519156cbb6e9d28bef34a24ed006a87cd77c8d972f63ad9c3ef9049637b15bd0d446d80c88dcdd9f268486959a
+DIST netavark-v1.15.2-vendor.tar.gz 21528390 BLAKE2B b1cc108b27e9c545baff6e52a17189200b3757216a35954b370ebf1dede2344094fad1885559c6397234387535cb921361b289ca938021d97544e2fd13d4dd54 SHA512 52f3512dae21f54a364e2287e43ea47d6ef36d291522ddf36a4c5ae24a40d1f0997ea4902ad0e28a466fc2a058d5122d405d2b675d3250599b8ca49deb771d19
+DIST netavark-v1.16.1-vendor.tar.gz 22434836 BLAKE2B d1b6d4954b54bfd9088428f82098a8f78ef5bec500643a0c2c570827e74be1e4fbfe9f516cf7a9506325b847ee8b6ab07fa47b9b0936b2e462ee1b52e27edfda SHA512 fdfb63c58314e89ee1ef1b95a34b07aec82c15958dfc379e3ee4475c13f9864b6c02e33b45ea59a17fd9921669fd7c0c3d9078d319983cfbd1f76ea22afd5be4
+DIST netavark-v1.17.0-vendor.tar.gz 17711878 BLAKE2B acb3fe2c85230271bd7a0145b7f3b89bbb7aef1e86d73494df9e237fa444a6ca93cfe270af47c12428544e43d55ba22cc91e34ce266727b1db923e48b685557b SHA512 130cf586d19430b4d604af24496d33589f9763c3e403bf1f2bb39fe3821ace14519e8a93aff95f08cff5c3eeb3814d6aa1d29456985d49e1ce6d569fac934776
+DIST netavark-v1.17.1-vendor.tar.gz 17711446 BLAKE2B d3b7030d411a4bd848127508e43a65e278a75a1ffcdca7b9e8ea46180d2e8da26be5e4eaa21fad22197f9eb9fd28413dc21a7d10b42f98d882990eeb750bb737 SHA512 9f7e5ee54b776ec27511a937e6ebb30b70a527f9232d635a9755459afee569fc37d715626b92ea2aa08637d6e63dada4f55ad6757f3a0a7aae753637349f6193
+DIST netavark-v1.17.2-vendor.tar.gz 17711355 BLAKE2B a4967f3496635da375aa9adb22b9d5cdef2b5463b53b7bb31c1d0236c84edb36727a391cdbf8c81a7b2caa2675c173ff01ee3974465d4143c139d956951ff774 SHA512 2d34a237c540acd05590c09f07e57b1b0a765b746332cbc27337a4c31e2db4b92861629b1418a9c3990a0f25c659d537a8c7b7d2e63247fa3df39c092e80a59d
diff --git a/app-containers/netavark/metadata.xml b/app-containers/netavark/metadata.xml
new file mode 100644
index 000000000000..3b42a0c35252
--- /dev/null
+++ b/app-containers/netavark/metadata.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <maintainer type="person" proxied="yes">
+    <email>me@rahil.rocks</email>
+    <name>Rahil Bhimjiani</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <longdescription lang="en">
+		Netavark is a rust based network stack for containers. It is
+		being designed to work with Podman but is also applicable for
+		other OCI container management applications.
+	</longdescription>
+  <upstream>
+    <bugs-to>https://github.com/containers/netavark/issues</bugs-to>
+    <doc>https://github.com/containers/netavark/blob/main/README.md</doc>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/netavark/netavark-1.14.1.ebuild b/app-containers/netavark/netavark-1.14.1.ebuild
new file mode 100644
index 000000000000..a3660b4bd9db
--- /dev/null
+++ b/app-containers/netavark/netavark-1.14.1.ebuild
@@ -0,0 +1,59 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+[[ ${PV} == 9999* ]] || CRATES="${PN}@${PV}"
+
+inherit cargo systemd
+
+DESCRIPTION="A container network stack"
+HOMEPAGE="https://github.com/containers/netavark"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/netavark.git"
+else
+	SRC_URI="${CARGO_CRATE_URIS} https://github.com/containers/netavark/releases/download/v${PV}/${PN}-v${PV}-vendor.tar.gz"
+	KEYWORDS="amd64 arm64 ~loong ~ppc64 ~riscv"
+fi
+
+# main
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" Apache-2.0-with-LLVM-exceptions BSD BSD-2 Boost-1.0 MIT Unicode-DFS-2016 Unlicense ZLIB"
+SLOT="0"
+BDEPEND="dev-go/go-md2man
+	dev-libs/protobuf[protoc(+)]"
+
+QA_FLAGS_IGNORED="
+	usr/libexec/podman/${PN}"
+QA_PRESTRIPPED="
+	usr/libexec/podman/${PN}"
+
+ECARGO_VENDOR="${WORKDIR}/vendor"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		cargo_live_src_unpack
+	else
+		cargo_src_unpack
+	fi
+}
+
+src_prepare() {
+	default
+	sed -i -e "s|m0755 bin|m0755 $(cargo_target_dir)|g;" Makefile || die
+}
+
+src_compile() {
+	cargo_src_compile
+	export PREFIX="${EPREFIX}"/usr SYSTEMDDIR="$(systemd_get_systemunitdir)"
+	emake docs
+}
+
+# Following is needed because we want to use `make install` instead of `cargo install` (exported by cargo.eclass)
+src_install() {
+	default
+}
diff --git a/app-containers/netavark/netavark-1.15.2.ebuild b/app-containers/netavark/netavark-1.15.2.ebuild
new file mode 100644
index 000000000000..a3660b4bd9db
--- /dev/null
+++ b/app-containers/netavark/netavark-1.15.2.ebuild
@@ -0,0 +1,59 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+[[ ${PV} == 9999* ]] || CRATES="${PN}@${PV}"
+
+inherit cargo systemd
+
+DESCRIPTION="A container network stack"
+HOMEPAGE="https://github.com/containers/netavark"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/netavark.git"
+else
+	SRC_URI="${CARGO_CRATE_URIS} https://github.com/containers/netavark/releases/download/v${PV}/${PN}-v${PV}-vendor.tar.gz"
+	KEYWORDS="amd64 arm64 ~loong ~ppc64 ~riscv"
+fi
+
+# main
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" Apache-2.0-with-LLVM-exceptions BSD BSD-2 Boost-1.0 MIT Unicode-DFS-2016 Unlicense ZLIB"
+SLOT="0"
+BDEPEND="dev-go/go-md2man
+	dev-libs/protobuf[protoc(+)]"
+
+QA_FLAGS_IGNORED="
+	usr/libexec/podman/${PN}"
+QA_PRESTRIPPED="
+	usr/libexec/podman/${PN}"
+
+ECARGO_VENDOR="${WORKDIR}/vendor"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		cargo_live_src_unpack
+	else
+		cargo_src_unpack
+	fi
+}
+
+src_prepare() {
+	default
+	sed -i -e "s|m0755 bin|m0755 $(cargo_target_dir)|g;" Makefile || die
+}
+
+src_compile() {
+	cargo_src_compile
+	export PREFIX="${EPREFIX}"/usr SYSTEMDDIR="$(systemd_get_systemunitdir)"
+	emake docs
+}
+
+# Following is needed because we want to use `make install` instead of `cargo install` (exported by cargo.eclass)
+src_install() {
+	default
+}
diff --git a/app-containers/netavark/netavark-1.16.1.ebuild b/app-containers/netavark/netavark-1.16.1.ebuild
new file mode 100644
index 000000000000..d3753217a0c6
--- /dev/null
+++ b/app-containers/netavark/netavark-1.16.1.ebuild
@@ -0,0 +1,61 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+[[ ${PV} == 9999* ]] || CRATES="${PN}@${PV}"
+
+RUST_MIN_VER="1.83"
+
+inherit cargo systemd
+
+DESCRIPTION="A container network stack"
+HOMEPAGE="https://github.com/containers/netavark"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/netavark.git"
+else
+	SRC_URI="${CARGO_CRATE_URIS} https://github.com/containers/netavark/releases/download/v${PV}/${PN}-v${PV}-vendor.tar.gz"
+	KEYWORDS="amd64 arm64 ~loong ~ppc64 ~riscv"
+fi
+
+# main
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" Apache-2.0-with-LLVM-exceptions BSD BSD-2 Boost-1.0 MIT Unicode-DFS-2016 Unlicense ZLIB"
+SLOT="0"
+BDEPEND="dev-go/go-md2man
+	dev-libs/protobuf[protoc(+)]"
+
+QA_FLAGS_IGNORED="
+	usr/libexec/podman/${PN}"
+QA_PRESTRIPPED="
+	usr/libexec/podman/${PN}"
+
+ECARGO_VENDOR="${WORKDIR}/vendor"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		cargo_live_src_unpack
+	else
+		cargo_src_unpack
+	fi
+}
+
+src_prepare() {
+	default
+	sed -i -e "s|m0755 bin|m0755 $(cargo_target_dir)|g;" Makefile || die
+}
+
+src_compile() {
+	cargo_src_compile
+	export PREFIX="${EPREFIX}"/usr SYSTEMDDIR="$(systemd_get_systemunitdir)"
+	emake docs
+}
+
+# Following is needed because we want to use `make install` instead of `cargo install` (exported by cargo.eclass)
+src_install() {
+	default
+}
diff --git a/app-containers/netavark/netavark-1.17.0.ebuild b/app-containers/netavark/netavark-1.17.0.ebuild
new file mode 100644
index 000000000000..c0d9aae5fdad
--- /dev/null
+++ b/app-containers/netavark/netavark-1.17.0.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+[[ ${PV} == 9999* ]] || CRATES="${PN}@${PV}"
+RUST_MIN_VER="1.86"
+
+inherit cargo systemd
+
+DESCRIPTION="A container network stack"
+HOMEPAGE="https://github.com/containers/netavark"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/netavark.git"
+else
+	SRC_URI="${CARGO_CRATE_URIS} https://github.com/containers/netavark/releases/download/v${PV}/${PN}-v${PV}-vendor.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv"
+fi
+
+# main
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" Apache-2.0-with-LLVM-exceptions BSD BSD-2 Boost-1.0 MIT Unicode-DFS-2016 Unlicense ZLIB"
+SLOT="0"
+BDEPEND="dev-go/go-md2man
+	dev-libs/protobuf[protoc(+)]"
+
+QA_FLAGS_IGNORED="
+	usr/libexec/podman/${PN}"
+QA_PRESTRIPPED="
+	usr/libexec/podman/${PN}"
+
+ECARGO_VENDOR="${WORKDIR}/vendor"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		cargo_live_src_unpack
+	else
+		cargo_src_unpack
+	fi
+}
+
+src_prepare() {
+	default
+	sed -i -e "s|m0755 bin|m0755 $(cargo_target_dir)|g;" Makefile || die
+}
+
+src_compile() {
+	cargo_src_compile
+	export PREFIX="${EPREFIX}"/usr SYSTEMDDIR="$(systemd_get_systemunitdir)"
+	emake docs
+}
+
+# Following is needed because we want to use `make install` instead of `cargo install` (exported by cargo.eclass)
+src_install() {
+	default
+}
diff --git a/app-containers/netavark/netavark-1.17.1.ebuild b/app-containers/netavark/netavark-1.17.1.ebuild
new file mode 100644
index 000000000000..7e44e616c710
--- /dev/null
+++ b/app-containers/netavark/netavark-1.17.1.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+[[ ${PV} == 9999* ]] || CRATES="${PN}@${PV}"
+RUST_MIN_VER="1.86"
+
+inherit cargo systemd
+
+DESCRIPTION="A container network stack"
+HOMEPAGE="https://github.com/containers/netavark"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/netavark.git"
+else
+	SRC_URI="${CARGO_CRATE_URIS} https://github.com/containers/netavark/releases/download/v${PV}/${PN}-v${PV}-vendor.tar.gz"
+	KEYWORDS="amd64 arm64 ~loong ~ppc64 ~riscv"
+fi
+
+# main
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" Apache-2.0-with-LLVM-exceptions BSD BSD-2 Boost-1.0 MIT Unicode-DFS-2016 Unlicense ZLIB"
+SLOT="0"
+BDEPEND="dev-go/go-md2man
+	dev-libs/protobuf[protoc(+)]"
+
+QA_FLAGS_IGNORED="
+	usr/libexec/podman/${PN}"
+QA_PRESTRIPPED="
+	usr/libexec/podman/${PN}"
+
+ECARGO_VENDOR="${WORKDIR}/vendor"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		cargo_live_src_unpack
+	else
+		cargo_src_unpack
+	fi
+}
+
+src_prepare() {
+	default
+	sed -i -e "s|m0755 bin|m0755 $(cargo_target_dir)|g;" Makefile || die
+}
+
+src_compile() {
+	cargo_src_compile
+	export PREFIX="${EPREFIX}"/usr SYSTEMDDIR="$(systemd_get_systemunitdir)"
+	emake docs
+}
+
+# Following is needed because we want to use `make install` instead of `cargo install` (exported by cargo.eclass)
+src_install() {
+	default
+}
diff --git a/app-containers/netavark/netavark-1.17.2.ebuild b/app-containers/netavark/netavark-1.17.2.ebuild
new file mode 100644
index 000000000000..2f40e1f6acd2
--- /dev/null
+++ b/app-containers/netavark/netavark-1.17.2.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+[[ ${PV} == 9999* ]] || CRATES="${PN}@${PV}"
+RUST_MIN_VER="1.86"
+
+inherit cargo systemd
+
+DESCRIPTION="A container network stack"
+HOMEPAGE="https://github.com/containers/netavark"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/netavark.git"
+else
+	SRC_URI="${CARGO_CRATE_URIS} https://github.com/containers/netavark/releases/download/v${PV}/${PN}-v${PV}-vendor.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv"
+fi
+
+# main
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" Apache-2.0-with-LLVM-exceptions BSD BSD-2 Boost-1.0 MIT Unicode-DFS-2016 Unlicense ZLIB"
+SLOT="0"
+BDEPEND="dev-go/go-md2man
+	dev-libs/protobuf[protoc(+)]"
+
+QA_FLAGS_IGNORED="
+	usr/libexec/podman/${PN}"
+QA_PRESTRIPPED="
+	usr/libexec/podman/${PN}"
+
+ECARGO_VENDOR="${WORKDIR}/vendor"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		cargo_live_src_unpack
+	else
+		cargo_src_unpack
+	fi
+}
+
+src_prepare() {
+	default
+	sed -i -e "s|m0755 bin|m0755 $(cargo_target_dir)|g;" Makefile || die
+}
+
+src_compile() {
+	cargo_src_compile
+	export PREFIX="${EPREFIX}"/usr SYSTEMDDIR="$(systemd_get_systemunitdir)"
+	emake docs
+}
+
+# Following is needed because we want to use `make install` instead of `cargo install` (exported by cargo.eclass)
+src_install() {
+	default
+}
diff --git a/app-containers/netavark/netavark-9999.ebuild b/app-containers/netavark/netavark-9999.ebuild
new file mode 100644
index 000000000000..6cfed97bbf3f
--- /dev/null
+++ b/app-containers/netavark/netavark-9999.ebuild
@@ -0,0 +1,59 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+[[ ${PV} == 9999* ]] || CRATES="${PN}@${PV}"
+
+inherit cargo systemd
+
+DESCRIPTION="A container network stack"
+HOMEPAGE="https://github.com/containers/netavark"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/netavark.git"
+else
+	SRC_URI="${CARGO_CRATE_URIS} https://github.com/containers/netavark/releases/download/v${PV}/${PN}-v${PV}-vendor.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv"
+fi
+
+# main
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" Apache-2.0-with-LLVM-exceptions BSD BSD-2 Boost-1.0 MIT Unicode-DFS-2016 Unlicense ZLIB"
+SLOT="0"
+BDEPEND="dev-go/go-md2man
+	dev-libs/protobuf[protoc(+)]"
+
+QA_FLAGS_IGNORED="
+	usr/libexec/podman/${PN}"
+QA_PRESTRIPPED="
+	usr/libexec/podman/${PN}"
+
+ECARGO_VENDOR="${WORKDIR}/vendor"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		cargo_live_src_unpack
+	else
+		cargo_src_unpack
+	fi
+}
+
+src_prepare() {
+	default
+	sed -i -e "s|m0755 bin|m0755 $(cargo_target_dir)|g;" Makefile || die
+}
+
+src_compile() {
+	cargo_src_compile
+	export PREFIX="${EPREFIX}"/usr SYSTEMDDIR="$(systemd_get_systemunitdir)"
+	emake docs
+}
+
+# Following is needed because we want to use `make install` instead of `cargo install` (exported by cargo.eclass)
+src_install() {
+	default
+}
diff --git a/app-containers/nvidia-container-toolkit/Manifest b/app-containers/nvidia-container-toolkit/Manifest
new file mode 100644
index 000000000000..c984bf3820e5
--- /dev/null
+++ b/app-containers/nvidia-container-toolkit/Manifest
@@ -0,0 +1,2 @@
+DIST nvidia-container-toolkit-1.18.0.tar.gz 5752931 BLAKE2B 0ac6d294b80ea6cffd6d9fc4794e0b4048da425de7d115de645afb3a585e4862e42e2bf092f2333312ea2e117db1b0d488d51aab986d96c52e008dcc423e6b02 SHA512 5cfe75b385ae9950c7668ffca540e9d5c1ce770dd8d786314e4145463610b5ee3c4a2dc541df8fee203a9c0300380d71b2ba196e0796d4592d6bfccc7730aa38
+DIST nvidia-container-toolkit-1.19.0.tar.gz 37605698 BLAKE2B 1515ccecae03f90b20446a49db76b09772215faac83c45e4fb44daf8fc2696dad98d026143a22cce0cadecb462767d381f47696c651a639d077509b61d8936be SHA512 5d7b08af43ec8e82f2dc1c1ff1eb5eb9451cbe69add6d58d721d59b5da35d008eaa37463d615ae742b50d4e9e12ad6e02dd3d5eb03b83cc8717b18fa7f5b12b9
diff --git a/app-containers/nvidia-container-toolkit/files/config.toml b/app-containers/nvidia-container-toolkit/files/config.toml
new file mode 100644
index 000000000000..cf5c0a8fe979
--- /dev/null
+++ b/app-containers/nvidia-container-toolkit/files/config.toml
@@ -0,0 +1,39 @@
+#accept-nvidia-visible-devices-as-volume-mounts = false
+#accept-nvidia-visible-devices-envvar-when-unprivileged = true
+disable-require = false
+supported-driver-capabilities = "compat32,compute,display,graphics,ngx,utility,video"
+#swarm-resource = "DOCKER_RESOURCE_GPU"
+
+[nvidia-container-cli]
+#debug = "/var/log/nvidia-container-toolkit.log"
+environment = []
+#ldcache = "/etc/ld.so.cache"
+ldconfig = "@/sbin/ldconfig"
+load-kmods = true
+#no-cgroups = false
+#path = "/usr/bin/nvidia-container-cli"
+#root = "/run/nvidia/driver"
+user = "root:video"
+
+[nvidia-container-runtime]
+#debug = "/var/log/nvidia-container-runtime.log"
+log-level = "info"
+mode = "auto"
+runtimes = ["docker-runc", "runc", "crun"]
+
+[nvidia-container-runtime.modes]
+
+[nvidia-container-runtime.modes.cdi]
+annotation-prefixes = ["cdi.k8s.io/"]
+default-kind = "nvidia.com/gpu"
+spec-dirs = ["/etc/cdi", "/var/run/cdi"]
+
+[nvidia-container-runtime.modes.csv]
+mount-spec-path = "/etc/nvidia-container-runtime/host-files-for-container.d"
+
+[nvidia-container-runtime-hook]
+path = "nvidia-container-runtime-hook"
+skip-mode-detection = false
+
+[nvidia-ctk]
+path = "nvidia-ctk"
diff --git a/app-containers/nvidia-container-toolkit/files/nvidia-container-toolkit-1.19.0-no-prestrip.patch b/app-containers/nvidia-container-toolkit/files/nvidia-container-toolkit-1.19.0-no-prestrip.patch
new file mode 100644
index 000000000000..f4ae30c9bf1a
--- /dev/null
+++ b/app-containers/nvidia-container-toolkit/files/nvidia-container-toolkit-1.19.0-no-prestrip.patch
@@ -0,0 +1,20 @@
+Don't strip symbols and DWARF at link time; let portage handle stripping
+so QA0020 (pre-stripped files) does not trigger and FEATURES=splitdebug
+still works as expected.
+
+The -X options are reordered before '-extldflags=...' because Go's
+-ldflags parser rejects values that start with a single quote.
+
+Bug: https://bugs.gentoo.org/976193
+
+--- a/Makefile
++++ b/Makefile
+@@ -65,7 +65,7 @@ else
+ EXTLDFLAGS = -Wl,-undefined,dynamic_lookup
+ endif
+ $(CMD_TARGETS): cmd-%:
+-	go build -ldflags "-s -w '-extldflags=$(EXTLDFLAGS)' -X $(CLI_VERSION_PACKAGE).gitCommit=$(GIT_COMMIT) -X $(CLI_VERSION_PACKAGE).version=$(CLI_VERSION)" $(COMMAND_BUILD_OPTIONS) $(MODULE)/cmd/$(*)
++	go build -ldflags "-X $(CLI_VERSION_PACKAGE).gitCommit=$(GIT_COMMIT) -X $(CLI_VERSION_PACKAGE).version=$(CLI_VERSION) '-extldflags=$(EXTLDFLAGS)'" $(COMMAND_BUILD_OPTIONS) $(MODULE)/cmd/$(*)
+
+ build:
+ 	go build ./...
diff --git a/app-containers/nvidia-container-toolkit/metadata.xml b/app-containers/nvidia-container-toolkit/metadata.xml
new file mode 100644
index 000000000000..817cc9a5988d
--- /dev/null
+++ b/app-containers/nvidia-container-toolkit/metadata.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>vowstar@gmail.com</email>
+    <name>Huang Rui</name>
+  </maintainer>
+  <maintainer type="person" proxied="yes">
+    <email>zhixu.liu@gmail.com</email>
+    <name>Z. Liu</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <longdescription lang="en">
+		NVIDIA container runtime toolkit, build and run containers leveraging
+		NVIDIA GPUs. tl;dr: nvidia-docker is deprecated because docker now has
+		native gpu support, which this package is required to use. The NVIDIA
+		Container Toolkit (formerly known as NVIDIA Docker) allows containers to
+		access full GPU acceleration. OpenGL, OpenCL and CUDA are supported for
+		production use. Vulkan support is currently in beta. This only works for
+		Linux containers running on Linux host systems with NVIDIA GPUs.
+	</longdescription>
+  <longdescription lang="zh">
+		NVIDIA容器运行时工具包，构建和运行利用NVIDIA GPU的容器。简而言之：
+		nvidia-docker已经过时，因为docker现在具有原生的GPU支持，而这个包是使用它
+		所必需的。NVIDIA容器工具包（以前称为NVIDIA Docker）允许容器访问完整的
+		GPU加速。OpenGL、OpenCL和CUDA支持生产使用。Vulkan支持目前处于测试阶段。
+		这只适用于在配备NVIDIA GPU的Linux主机系统上运行的Linux容器。
+	</longdescription>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/nvidia-container-toolkit/nvidia-container-toolkit-1.18.0.ebuild b/app-containers/nvidia-container-toolkit/nvidia-container-toolkit-1.18.0.ebuild
new file mode 100644
index 000000000000..108800c91fa2
--- /dev/null
+++ b/app-containers/nvidia-container-toolkit/nvidia-container-toolkit-1.18.0.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+EGO_PN="github.com/NVIDIA/${PN}"
+
+inherit go-module
+
+DESCRIPTION="NVIDIA container runtime toolkit"
+HOMEPAGE="https://github.com/NVIDIA/nvidia-container-toolkit"
+
+if [[ "${PV}" == "9999" ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/NVIDIA/${PN}.git"
+else
+	SRC_URI="
+		https://github.com/NVIDIA/${PN}/archive/v${PV/_rc/-rc.}.tar.gz -> ${P}.tar.gz
+	"
+	S="${WORKDIR}/${PN}-${PV/_rc/-rc.}"
+	KEYWORDS="amd64"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0/${PV}"
+
+# Some tests may require specific environmental setups or additional hardware.
+RESTRICT="test" # Bug 831702
+
+# Bug 950233 version should not be newer than libnvidia-container
+RDEPEND="
+	~sys-libs/libnvidia-container-${PV}
+"
+
+src_compile() {
+	emake binaries
+}
+
+src_install() {
+	dobin nvidia-cdi-hook \
+		nvidia-container-runtime \
+		nvidia-container-runtime.cdi \
+		nvidia-container-runtime.legacy \
+		nvidia-container-runtime-hook \
+		nvidia-ctk
+	insinto "/etc/nvidia-container-runtime"
+	doins "${FILESDIR}/config.toml"
+}
+
+pkg_postinst() {
+	elog "Your docker or containerd (if applicable) service may need restart"
+	elog "after install this package:"
+	elog "OpenRC: rc-service containerd restart; rc-service docker restart"
+	elog "systemd: systemctl restart containerd; systemctl restart docker"
+	elog "You may need to edit your /etc/nvidia-container-runtime/config.toml"
+	elog "file before running ${PN} for the first time."
+	elog "For details, please see the NVIDIA docker manual page."
+}
diff --git a/app-containers/nvidia-container-toolkit/nvidia-container-toolkit-1.19.0.ebuild b/app-containers/nvidia-container-toolkit/nvidia-container-toolkit-1.19.0.ebuild
new file mode 100644
index 000000000000..9611a3f953c3
--- /dev/null
+++ b/app-containers/nvidia-container-toolkit/nvidia-container-toolkit-1.19.0.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+EGO_PN="github.com/NVIDIA/${PN}"
+
+inherit go-module
+
+DESCRIPTION="NVIDIA container runtime toolkit"
+HOMEPAGE="https://github.com/NVIDIA/nvidia-container-toolkit"
+
+if [[ "${PV}" == "9999" ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/NVIDIA/${PN}.git"
+else
+	SRC_URI="
+		https://github.com/NVIDIA/${PN}/archive/v${PV/_rc/-rc.}.tar.gz -> ${P}.tar.gz
+	"
+	S="${WORKDIR}/${PN}-${PV/_rc/-rc.}"
+	KEYWORDS="~amd64"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0/${PV}"
+
+# Some tests may require specific environmental setups or additional hardware.
+RESTRICT="test" # Bug 831702
+
+# Bug 950233 version should not be newer than libnvidia-container
+RDEPEND="
+	~sys-libs/libnvidia-container-${PV}
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.19.0-no-prestrip.patch"
+)
+
+src_compile() {
+	emake binaries
+}
+
+src_install() {
+	dobin nvidia-cdi-hook \
+		nvidia-container-runtime \
+		nvidia-container-runtime.cdi \
+		nvidia-container-runtime.legacy \
+		nvidia-container-runtime-hook \
+		nvidia-ctk
+	insinto "/etc/nvidia-container-runtime"
+	doins "${FILESDIR}/config.toml"
+}
+
+pkg_postinst() {
+	elog "Your docker or containerd (if applicable) service may need restart"
+	elog "after install this package:"
+	elog "OpenRC: rc-service containerd restart; rc-service docker restart"
+	elog "systemd: systemctl restart containerd; systemctl restart docker"
+	elog "You may need to edit your /etc/nvidia-container-runtime/config.toml"
+	elog "file before running ${PN} for the first time."
+	elog "For details, please see the NVIDIA docker manual page."
+}
diff --git a/app-containers/nvidia-container-toolkit/nvidia-container-toolkit-9999.ebuild b/app-containers/nvidia-container-toolkit/nvidia-container-toolkit-9999.ebuild
new file mode 100644
index 000000000000..98102b96b01b
--- /dev/null
+++ b/app-containers/nvidia-container-toolkit/nvidia-container-toolkit-9999.ebuild
@@ -0,0 +1,57 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+EGO_PN="github.com/NVIDIA/${PN}"
+
+inherit go-module
+
+DESCRIPTION="NVIDIA container runtime toolkit"
+HOMEPAGE="https://github.com/NVIDIA/nvidia-container-toolkit"
+
+if [[ "${PV}" == "9999" ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/NVIDIA/${PN}.git"
+else
+	SRC_URI="
+		https://github.com/NVIDIA/${PN}/archive/v${PV/_rc/-rc.}.tar.gz -> ${P}.tar.gz
+	"
+	S="${WORKDIR}/${PN}-${PV/_rc/-rc.}"
+	KEYWORDS="~amd64"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0/${PV}"
+
+# Some tests may require specific environmental setups or additional hardware.
+RESTRICT="test" # Bug 831702
+
+RDEPEND="
+	sys-libs/libnvidia-container
+"
+
+src_compile() {
+	emake binaries
+}
+
+src_install() {
+	dobin nvidia-cdi-hook \
+		nvidia-container-runtime \
+		nvidia-container-runtime.cdi \
+		nvidia-container-runtime.legacy \
+		nvidia-container-runtime-hook \
+		nvidia-ctk
+	insinto "/etc/nvidia-container-runtime"
+	doins "${FILESDIR}/config.toml"
+}
+
+pkg_postinst() {
+	elog "Your docker or containerd (if applicable) service may need restart"
+	elog "after install this package:"
+	elog "OpenRC: rc-service containerd restart; rc-service docker restart"
+	elog "systemd: systemctl restart containerd; systemctl restart docker"
+	elog "You may need to edit your /etc/nvidia-container-runtime/config.toml"
+	elog "file before running ${PN} for the first time."
+	elog "For details, please see the NVIDIA docker manual page."
+}
diff --git a/app-containers/podman-compose/Manifest b/app-containers/podman-compose/Manifest
new file mode 100644
index 000000000000..791670ffd48b
--- /dev/null
+++ b/app-containers/podman-compose/Manifest
@@ -0,0 +1 @@
+DIST podman-compose-1.5.0.gh.tar.gz 128890 BLAKE2B 77a1acad78662358240ac638cfec95bff447d287f0f85d3d940989cdd1d4b4cbbf5ea24b21286e36031a0406e34f42a5ac0fbf8b7b31653ba89775059a202a93 SHA512 903b37b2233b0cb5965ef7730df11e2c2b69f5b2bce946004cbd728858ac7c068fd64c4e08c4860c97a10bb297de7d9d9f9a54cf74075e34f870d29f1b4f3d25
diff --git a/app-containers/podman-compose/metadata.xml b/app-containers/podman-compose/metadata.xml
new file mode 100644
index 000000000000..591131b1265f
--- /dev/null
+++ b/app-containers/podman-compose/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/podman-compose/podman-compose-1.5.0.ebuild b/app-containers/podman-compose/podman-compose-1.5.0.ebuild
new file mode 100644
index 000000000000..8b94925202cd
--- /dev/null
+++ b/app-containers/podman-compose/podman-compose-1.5.0.ebuild
@@ -0,0 +1,40 @@
+# Copyright 2023-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{13..14} )
+inherit distutils-r1
+
+DESCRIPTION="A script to run docker-compose.yml using Podman"
+HOMEPAGE="https://github.com/containers/podman-compose"
+SRC_URI="https://github.com/containers/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.gh.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64"
+
+DEPEND="
+	app-containers/aardvark-dns
+	app-containers/netavark
+	app-containers/podman
+"
+
+RDEPEND="
+	${DEPEND}
+	dev-python/pyaml[${PYTHON_USEDEP}]
+	dev-python/python-dotenv[${PYTHON_USEDEP}]
+"
+
+BDEPEND="
+	test? (
+		dev-python/parameterized[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+python_test() {
+	epytest tests/unit
+}
diff --git a/app-containers/podman-tui/Manifest b/app-containers/podman-tui/Manifest
new file mode 100644
index 000000000000..8ef0aef7d694
--- /dev/null
+++ b/app-containers/podman-tui/Manifest
@@ -0,0 +1,3 @@
+DIST podman-tui-1.5.0.tar.gz 20129613 BLAKE2B fb2da2fa77adf7f7b7476144c4e3f4d96829063f1a48cc219f1bd90629744dde53d73a0ceb8adbed385e8acd77d2e5614f932bef902185d5923987e035de4625 SHA512 a67acb15d292692cbe7e1e6e3b55c471a6d3a6ee9e777dcccd9b76bb26906117587b32bb7b6555e87a6079b9154b2355b9ddf00761b25046000578527107fffe
+DIST podman-tui-1.6.1.tar.gz 20301501 BLAKE2B 8e1f2ce6ee35adc236429703158d4df378b3e17783008d81296c21e033cd2b46389f9f7dd2d2210783525ea84def948fb0932087eba163b03dedc929125ef7f5 SHA512 dc7caf7e19440e0b72a19310ff80be979e103793ebbaf1060455632cffaefea3afb01d4c906b83bca13ce4e399680309c6a5142394b32cf76924af8c3c88ed14
+DIST podman-tui-1.9.0.tar.gz 18771918 BLAKE2B 8d548af6c064b55499077001b417e733fdecbfbbc927c3335efbc53c2725cb2947994c04df47f8aa2327ee932d130f038985fe480968437f7a57da5ad6f99049 SHA512 0fdd4cab2479251fa5f24ed0a1485319c604fdcec19cf83257a6c93bb81174e81d2930717393937998396913e56e553f960e37394d960a16141753bd29f40140
diff --git a/app-containers/podman-tui/metadata.xml b/app-containers/podman-tui/metadata.xml
new file mode 100644
index 000000000000..ccae96b5aab3
--- /dev/null
+++ b/app-containers/podman-tui/metadata.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>me@rahil.rocks</email>
+    <name>Rahil Bhimjiani</name>
+  </maintainer>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <upstream>
+    <bugs-to>https://github.com/containers/podman-tui/issues</bugs-to>
+    <doc>https://github.com/containers/podman-tui/blob/main/README.md</doc>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/podman-tui/podman-tui-1.5.0.ebuild b/app-containers/podman-tui/podman-tui-1.5.0.ebuild
new file mode 100644
index 000000000000..7d0076fdcbb8
--- /dev/null
+++ b/app-containers/podman-tui/podman-tui-1.5.0.ebuild
@@ -0,0 +1,34 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+DESCRIPTION="Terminal UI frontend for Podman"
+HOMEPAGE="https://github.com/containers/podman-tui"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/podman-tui.git"
+else
+	SRC_URI="https://github.com/containers/podman-tui/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64"
+fi
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD-2 BSD MIT MPL-2.0"
+SLOT="0"
+RESTRICT="test"
+
+src_compile() {
+	# parse tags from Makefile & make them comma-seperated as space-seperated list is deprecated
+	local BUILDTAGS=$(grep 'BUILDTAGS :=' Makefile | awk -F\" '{ print $2; }' | sed -e 's| |,|g;')
+	ego build -tags "${BUILDTAGS}"
+}
+
+src_install() {
+	dobin "${PN}"
+	einstalldocs
+}
diff --git a/app-containers/podman-tui/podman-tui-1.6.1.ebuild b/app-containers/podman-tui/podman-tui-1.6.1.ebuild
new file mode 100644
index 000000000000..7d0076fdcbb8
--- /dev/null
+++ b/app-containers/podman-tui/podman-tui-1.6.1.ebuild
@@ -0,0 +1,34 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+DESCRIPTION="Terminal UI frontend for Podman"
+HOMEPAGE="https://github.com/containers/podman-tui"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/podman-tui.git"
+else
+	SRC_URI="https://github.com/containers/podman-tui/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64"
+fi
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD-2 BSD MIT MPL-2.0"
+SLOT="0"
+RESTRICT="test"
+
+src_compile() {
+	# parse tags from Makefile & make them comma-seperated as space-seperated list is deprecated
+	local BUILDTAGS=$(grep 'BUILDTAGS :=' Makefile | awk -F\" '{ print $2; }' | sed -e 's| |,|g;')
+	ego build -tags "${BUILDTAGS}"
+}
+
+src_install() {
+	dobin "${PN}"
+	einstalldocs
+}
diff --git a/app-containers/podman-tui/podman-tui-1.9.0.ebuild b/app-containers/podman-tui/podman-tui-1.9.0.ebuild
new file mode 100644
index 000000000000..68c0131ca6e5
--- /dev/null
+++ b/app-containers/podman-tui/podman-tui-1.9.0.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+DESCRIPTION="Terminal UI frontend for Podman"
+HOMEPAGE="https://github.com/containers/podman-tui"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/podman-tui.git"
+else
+	SRC_URI="https://github.com/containers/podman-tui/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64"
+fi
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD-2 BSD MIT MPL-2.0"
+SLOT="0"
+RESTRICT="test"
+
+src_compile() {
+	# parse tags from Makefile & make them comma-seperated as space-seperated list is deprecated
+	local BUILDTAGS=$(grep 'BUILDTAGS :=' Makefile | awk -F\" '{ print $2; }' | tr ' ' ',')
+	ego build -tags "${BUILDTAGS}"
+}
+
+src_install() {
+	dobin "${PN}"
+	einstalldocs
+}
diff --git a/app-containers/podman-tui/podman-tui-9999.ebuild b/app-containers/podman-tui/podman-tui-9999.ebuild
new file mode 100644
index 000000000000..7d0076fdcbb8
--- /dev/null
+++ b/app-containers/podman-tui/podman-tui-9999.ebuild
@@ -0,0 +1,34 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+DESCRIPTION="Terminal UI frontend for Podman"
+HOMEPAGE="https://github.com/containers/podman-tui"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/podman-tui.git"
+else
+	SRC_URI="https://github.com/containers/podman-tui/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64"
+fi
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD-2 BSD MIT MPL-2.0"
+SLOT="0"
+RESTRICT="test"
+
+src_compile() {
+	# parse tags from Makefile & make them comma-seperated as space-seperated list is deprecated
+	local BUILDTAGS=$(grep 'BUILDTAGS :=' Makefile | awk -F\" '{ print $2; }' | sed -e 's| |,|g;')
+	ego build -tags "${BUILDTAGS}"
+}
+
+src_install() {
+	dobin "${PN}"
+	einstalldocs
+}
diff --git a/app-containers/podman/Manifest b/app-containers/podman/Manifest
new file mode 100644
index 000000000000..37d181a5059a
--- /dev/null
+++ b/app-containers/podman/Manifest
@@ -0,0 +1 @@
+DIST podman-5.7.1.tar.gz 21266433 BLAKE2B 59adb23b18fe453d45d92b0dac22a2fc8db1b1d02074f5eabc65d95bf7764f43a1d835f7316fbd61bbb7d98f3aeb6a3306d53963c5f83b8f55d879c182518534 SHA512 81fd4c27ff1d16dcb85229d4e4fd2cb06943ddfe966b5324fa8a8a957b2d2ec2aed7c5da05d6c009148f53b76545b27b0cba506622c8861f70bf7cad6c214a08
diff --git a/app-containers/podman/files/podman-5.0.0_rc4.confd b/app-containers/podman/files/podman-5.0.0_rc4.confd
new file mode 100644
index 000000000000..eafaee7fddef
--- /dev/null
+++ b/app-containers/podman/files/podman-5.0.0_rc4.confd
@@ -0,0 +1,11 @@
+# Config file for /etc/init.d/podman
+
+# Sets the API service daemon log level
+# valid levels: debug, info, warn, error, fatal or panic
+#LOG_LEVEL="error"
+
+# Sets the API service daemon socket
+#SOCKET="unix:///run/podman/podman.sock"
+
+# Configure the user[:group] the API service daemon will run as
+#RUN_AS_USER="root:root"
diff --git a/app-containers/podman/files/podman-5.0.0_rc4.initd b/app-containers/podman/files/podman-5.0.0_rc4.initd
new file mode 100644
index 000000000000..53026a54176d
--- /dev/null
+++ b/app-containers/podman/files/podman-5.0.0_rc4.initd
@@ -0,0 +1,21 @@
+#!/sbin/openrc-run
+# Copyright 2015-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+description="Podman API Service"
+
+LOG_PATH="/var/log/${RC_SVCNAME}"
+output_log="${LOG_PATH}/${RC_SVCNAME}.log"
+error_log="${LOG_PATH}/${RC_SVCNAME}.log"
+RUN_PATH="/run/${RC_SVCNAME}"
+pidfile="${RUN_PATH}/${RC_SVCNAME}.pid"
+
+command_user="${RUN_AS_USER:=root:root}"
+command="/usr/bin/podman"
+command_args="--log-level ${LOG_LEVEL:-error} system service --time 0 ${SOCKET:-unix://${RUN_PATH}/${RC_SVCNAME}.sock}"
+command_background="true"
+
+start() {
+	checkpath -o "${RUN_AS_USER}" -d "${RUN_PATH}" "${LOG_PATH}"
+	default_start
+}
diff --git a/app-containers/podman/files/podman-5.0.0_rc4.user.confd b/app-containers/podman/files/podman-5.0.0_rc4.user.confd
new file mode 100644
index 000000000000..6d08beeaf282
--- /dev/null
+++ b/app-containers/podman/files/podman-5.0.0_rc4.user.confd
@@ -0,0 +1,6 @@
+# Config file for /etc/user/init.d/podman
+
+# Sets the API service daemon log level
+# valid levels: debug, info, warn, error, fatal or panic
+#LOG_LEVEL="error"
+
diff --git a/app-containers/podman/files/podman-5.0.0_rc4.user.initd b/app-containers/podman/files/podman-5.0.0_rc4.user.initd
new file mode 100644
index 000000000000..5b47d68c7fd3
--- /dev/null
+++ b/app-containers/podman/files/podman-5.0.0_rc4.user.initd
@@ -0,0 +1,23 @@
+#!/sbin/openrc-run
+# Copyright 2015-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+supervisor=supervise-daemon
+description="Podman API Service"
+
+RUN_PATH="${XDG_RUNTIME_DIR}/podman"
+LOG_PATH="${RUN_PATH}/log"
+output_log="${LOG_PATH}/${RC_SVCNAME}.log"
+error_log="${LOG_PATH}/${RC_SVCNAME}.log"
+pidfile="${RUN_PATH}/${RC_SVCNAME}.pid"
+socket="unix://${RUN_PATH}/${RC_SVCNAME}.sock"
+
+# command_user="${RUN_AS_USER:=root:root}"
+command="/usr/bin/podman"
+command_args="--log-level ${LOG_LEVEL:-error} system service --time 0 ${socket}"
+command_background="true"
+
+start() {
+	checkpath -o $USER -d "${RUN_PATH}" "${LOG_PATH}"
+	default_start
+}
diff --git a/app-containers/podman/files/podman-5.5.2-togglable-seccomp.patch b/app-containers/podman/files/podman-5.5.2-togglable-seccomp.patch
new file mode 100644
index 000000000000..43abe10797e4
--- /dev/null
+++ b/app-containers/podman/files/podman-5.5.2-togglable-seccomp.patch
@@ -0,0 +1,11 @@
+don't add seccomp buildtag for all, instead only add it in ebuild if +seccomp
+--- a/Makefile
++++ b/Makefile
+@@ -64,7 +64,6 @@
+ 	$(shell hack/btrfs_tag.sh) \
+ 	$(shell hack/systemd_tag.sh) \
+ 	$(shell hack/libsubid_tag.sh) \
+-	$(if $(filter linux,$(GOOS)), seccomp,)
+ # allow downstreams to easily add build tags while keeping our defaults
+ BUILDTAGS += ${EXTRA_BUILDTAGS}
+ # N/B: This value is managed by Renovate, manual changes are
diff --git a/app-containers/podman/files/podman-auto-update-5.0.0.cron b/app-containers/podman/files/podman-auto-update-5.0.0.cron
new file mode 100644
index 000000000000..509146e0aa56
--- /dev/null
+++ b/app-containers/podman/files/podman-auto-update-5.0.0.cron
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+# podman-auto-update(1)
+# uncomment following to auto update containers according to their auto-update policy
+# /usr/bin/podman auto-update && /usr/bin/podman image prune -f
diff --git a/app-containers/podman/files/podman-clean-transient-5.0.0_rc6.confd b/app-containers/podman/files/podman-clean-transient-5.0.0_rc6.confd
new file mode 100644
index 000000000000..e85d8d51ff8e
--- /dev/null
+++ b/app-containers/podman/files/podman-clean-transient-5.0.0_rc6.confd
@@ -0,0 +1,8 @@
+# Config file for /etc/init.d/podman-clean-transient
+
+# Sets the podman log level
+# valid levels: debug, info, warn, error, fatal or panic
+#LOG_LEVEL="info"
+
+# Configure the user[:group] the podman will run as
+#RUN_AS_USER="root:root"
diff --git a/app-containers/podman/files/podman-clean-transient-5.0.0_rc6.initd b/app-containers/podman/files/podman-clean-transient-5.0.0_rc6.initd
new file mode 100644
index 000000000000..cd759c7eafc0
--- /dev/null
+++ b/app-containers/podman/files/podman-clean-transient-5.0.0_rc6.initd
@@ -0,0 +1,17 @@
+#!/sbin/openrc-run
+# Copyright 2015-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# This service runs once each boot to remove potential leftover
+# container state from previous boots.
+
+# This is needed when using transient storage mode in podman where the
+# database and other configs are stored in tmpfs, but some other files
+# are not. If we don't run this after an unclean boot then there may
+# be some leftover files that grow over time.
+
+description="Clean up podman transient data"
+
+command_user="${RUN_AS_USER:-root:root}"
+command="/usr/bin/podman"
+command_args="--log-level ${LOG_LEVEL:-info} system prune --external"
diff --git a/app-containers/podman/files/podman-restart-5.0.0_rc4.confd b/app-containers/podman/files/podman-restart-5.0.0_rc4.confd
new file mode 100644
index 000000000000..4d63848cb16f
--- /dev/null
+++ b/app-containers/podman/files/podman-restart-5.0.0_rc4.confd
@@ -0,0 +1,9 @@
+# Config file for /etc/init.d/podman-restart
+
+# Sets the podman log level
+# valid levels: debug, info, warn, error, fatal or panic
+#LOG_LEVEL="info"
+
+# Configure the user[:group] the podman will run as
+# Can be useful to manage rootful or rootless containers
+#RUN_AS_USER="root:root"
diff --git a/app-containers/podman/files/podman-restart-5.0.0_rc4.initd b/app-containers/podman/files/podman-restart-5.0.0_rc4.initd
new file mode 100644
index 000000000000..62bea5bc12de
--- /dev/null
+++ b/app-containers/podman/files/podman-restart-5.0.0_rc4.initd
@@ -0,0 +1,22 @@
+#!/sbin/openrc-run
+# Copyright 2015-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+description="Start all containers with restart-policy set to always or unless-stopped"
+
+command_user="${RUN_AS_USER:=root:root}"
+command="/usr/bin/podman"
+command_args="--log-level ${LOG_LEVEL:=info} start --all --filter restart-policy=always --filter restart-policy=unless-stopped"
+
+depend() {
+	after net
+}
+
+stop() {
+	ebegin "Stopping all containers with restart-policy set to always or unless-stopped"
+	${command} \
+		--log-level ${LOG_LEVEL} \
+		stop \
+		$(${command} container ls --filter restart-policy=always --filter restart-policy=unless-stopped -q)
+	eend $? "Failed to stop containers with restart-policy set to always or unless-stopped"
+}
diff --git a/app-containers/podman/files/podman.logrotated b/app-containers/podman/files/podman.logrotated
new file mode 100644
index 000000000000..b9d723451b0a
--- /dev/null
+++ b/app-containers/podman/files/podman.logrotated
@@ -0,0 +1,7 @@
+/var/log/podman/podman.log {
+	missingok
+	size 5M
+	rotate 3
+	compress
+	copytruncate
+}
diff --git a/app-containers/podman/metadata.xml b/app-containers/podman/metadata.xml
new file mode 100644
index 000000000000..804682c1d1ea
--- /dev/null
+++ b/app-containers/podman/metadata.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <maintainer type="person" proxied="yes">
+    <email>me@rahil.rocks</email>
+    <name>Rahil Bhimjiani</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <longdescription lang="en">
+		Podman (the POD MANager) is a tool for managing containers
+		and images, volumes mounted into those containers, and pods
+		made from groups of containers. Podman is based on libpod,
+		a library for container lifecycle management that is also
+		contained in this repository. The libpod library provides
+		APIs for managing containers, pods, container images,
+		and volumes.
+	</longdescription>
+  <use>
+    <flag name="btrfs">
+			Enable btrfs support (graph driver) in Podman
+		</flag>
+    <flag name="wrapper">
+			Install a wrapper to allow using `podman` as a drop-in replacement for `docker`
+		</flag>
+  </use>
+  <upstream>
+    <bugs-to>https://github.com/containers/podman/issues</bugs-to>
+    <doc>https://podman.io/docs</doc>
+    <remote-id type="cpe">cpe:/a:podman_project:podman</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/podman/podman-5.7.1.ebuild b/app-containers/podman/podman-5.7.1.ebuild
new file mode 100644
index 000000000000..7c0c158542cc
--- /dev/null
+++ b/app-containers/podman/podman-5.7.1.ebuild
@@ -0,0 +1,139 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit go-module python-any-r1 tmpfiles toolchain-funcs linux-info
+
+DESCRIPTION="A tool for managing OCI containers and pods with Docker-compatible CLI"
+HOMEPAGE="https://github.com/containers/podman/ https://podman.io/"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/podman.git"
+else
+	SRC_URI="https://github.com/containers/podman/archive/v${PV/_rc/-rc}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P/_rc/-rc}"
+	[[ ${PV} != *rc* ]] && \
+		KEYWORDS="amd64 arm64 ~loong ~riscv"
+fi
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+IUSE="apparmor btrfs +seccomp selinux systemd wrapper"
+RESTRICT="test"
+
+RDEPEND="
+	app-containers/catatonit
+	>=app-containers/conmon-2.1.10
+	>=app-containers/containers-common-0.58.0-r1
+	app-crypt/gpgme:=
+	dev-db/sqlite:3
+	dev-libs/libassuan:=
+	dev-libs/libgpg-error:=
+	sys-apps/shadow:=
+
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( sys-fs/btrfs-progs )
+	wrapper? ( !app-containers/docker-cli )
+	seccomp? ( sys-libs/libseccomp:= )
+	selinux? ( sec-policy/selinux-podman sys-libs/libselinux:= )
+	systemd? ( sys-apps/systemd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	${PYTHON_DEPS}
+	dev-go/go-md2man
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-5.5.2-togglable-seccomp.patch
+)
+
+CONFIG_CHECK="
+	~USER_NS
+"
+
+pkg_setup() {
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	linux-info_pkg_setup
+	python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# assure necessary files are present
+	local file
+	for file in apparmor_tag btrfs_installed_tag systemd_tag; do
+		[[ -f hack/"${file}".sh ]] || die
+	done
+
+	local feature
+	for feature in apparmor systemd; do
+		cat <<-EOF > hack/"${feature}"_tag.sh || die
+		#!/usr/bin/env bash
+		$(usex ${feature} "echo ${feature}" echo)
+		EOF
+	done
+
+	cat <<-EOF > hack/btrfs_installed_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex btrfs echo 'echo exclude_graphdriver_btrfs')
+	EOF
+}
+
+src_compile() {
+	export ETCDIR="${EPREFIX}/etc" PREFIX="${EPREFIX}/usr" BUILD_ORIGIN="Gentoo Portage"
+
+	# For non-live versions, prevent git operations which causes sandbox violations
+	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
+	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT="" EPOCH_TEST_COMMIT=""
+
+	# Use proper pkg-config to get gpgme cflags and ldflags when
+	# cross-compiling, bug 930982.
+	if tc-is-cross-compiler; then
+		tc-export PKG_CONFIG
+	fi
+
+	emake BUILDFLAGS="-v -work -x" GOMD2MAN="go-md2man" EXTRA_BUILDTAGS="$(usev seccomp)" SELINUXOPT= \
+		  all $(usev wrapper docker-docs)
+}
+
+src_install() {
+	emake DESTDIR="${D}" SELINUXOPT= install install.completions $(usev wrapper install.docker-full)
+
+	if use !systemd; then
+		newconfd "${FILESDIR}"/podman-5.0.0_rc4.confd podman
+		newinitd "${FILESDIR}"/podman-5.0.0_rc4.initd podman
+
+		newinitd "${FILESDIR}"/podman-restart-5.0.0_rc4.initd podman-restart
+		newconfd "${FILESDIR}"/podman-restart-5.0.0_rc4.confd podman-restart
+
+		newinitd "${FILESDIR}"/podman-clean-transient-5.0.0_rc6.initd podman-clean-transient
+		newconfd "${FILESDIR}"/podman-clean-transient-5.0.0_rc6.confd podman-clean-transient
+
+		exeinto /etc/cron.daily
+		newexe "${FILESDIR}"/podman-auto-update-5.0.0.cron podman-auto-update
+
+		insinto /etc/logrotate.d
+		newins "${FILESDIR}/podman.logrotated" podman
+
+		exeinto /etc/user/init.d
+		newexe "${FILESDIR}/podman-5.0.0_rc4.user.initd" podman
+
+		insinto /etc/user/conf.d
+		newins "${FILESDIR}/podman-5.0.0_rc4.user.confd" podman
+	fi
+
+	keepdir /var/lib/containers
+}
+
+pkg_postinst() {
+	tmpfiles_process podman.conf $(usev wrapper podman-docker.conf)
+}
diff --git a/app-containers/podman/podman-9999.ebuild b/app-containers/podman/podman-9999.ebuild
new file mode 100644
index 000000000000..2fa050d8ef36
--- /dev/null
+++ b/app-containers/podman/podman-9999.ebuild
@@ -0,0 +1,138 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit go-module python-any-r1 tmpfiles toolchain-funcs linux-info
+
+DESCRIPTION="A tool for managing OCI containers and pods with Docker-compatible CLI"
+HOMEPAGE="https://github.com/containers/podman/ https://podman.io/"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/podman.git"
+else
+	SRC_URI="https://github.com/containers/podman/archive/v${PV/_rc/-rc}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${P/_rc/-rc}"
+	[[ ${PV} != *rc* ]] && \
+		KEYWORDS="~amd64 ~arm64 ~loong ~riscv"
+fi
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+IUSE="apparmor btrfs +seccomp selinux systemd wrapper"
+RESTRICT="test"
+
+RDEPEND="
+	app-containers/catatonit
+	>=app-containers/conmon-2.1.10
+	>=app-containers/containers-common-0.58.0-r1
+	app-crypt/gpgme:=
+	dev-libs/libassuan:=
+	dev-libs/libgpg-error:=
+	sys-apps/shadow:=
+
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( sys-fs/btrfs-progs )
+	wrapper? ( !app-containers/docker-cli )
+	seccomp? ( sys-libs/libseccomp:= )
+	selinux? ( sec-policy/selinux-podman sys-libs/libselinux:= )
+	systemd? ( sys-apps/systemd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	${PYTHON_DEPS}
+	dev-go/go-md2man
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-5.5.2-togglable-seccomp.patch
+)
+
+CONFIG_CHECK="
+	~USER_NS
+"
+
+pkg_setup() {
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	linux-info_pkg_setup
+	python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# assure necessary files are present
+	local file
+	for file in apparmor_tag btrfs_installed_tag systemd_tag; do
+		[[ -f hack/"${file}".sh ]] || die
+	done
+
+	local feature
+	for feature in apparmor systemd; do
+		cat <<-EOF > hack/"${feature}"_tag.sh || die
+		#!/usr/bin/env bash
+		$(usex ${feature} "echo ${feature}" echo)
+		EOF
+	done
+
+	cat <<-EOF > hack/btrfs_installed_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex btrfs echo 'echo exclude_graphdriver_btrfs')
+	EOF
+}
+
+src_compile() {
+	export ETCDIR="${EPREFIX}/etc" PREFIX="${EPREFIX}/usr" BUILD_ORIGIN="Gentoo Portage"
+
+	# For non-live versions, prevent git operations which causes sandbox violations
+	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
+	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT="" EPOCH_TEST_COMMIT=""
+
+	# Use proper pkg-config to get gpgme cflags and ldflags when
+	# cross-compiling, bug 930982.
+	if tc-is-cross-compiler; then
+		tc-export PKG_CONFIG
+	fi
+
+	emake BUILDFLAGS="-v -work -x" GOMD2MAN="go-md2man" EXTRA_BUILDTAGS="$(usev seccomp)" SELINUXOPT= \
+		  all $(usev wrapper docker-docs)
+}
+
+src_install() {
+	emake DESTDIR="${D}" SELINUXOPT= install install.completions $(usev wrapper install.docker-full)
+
+	if use !systemd; then
+		newconfd "${FILESDIR}"/podman-5.0.0_rc4.confd podman
+		newinitd "${FILESDIR}"/podman-5.0.0_rc4.initd podman
+
+		newinitd "${FILESDIR}"/podman-restart-5.0.0_rc4.initd podman-restart
+		newconfd "${FILESDIR}"/podman-restart-5.0.0_rc4.confd podman-restart
+
+		newinitd "${FILESDIR}"/podman-clean-transient-5.0.0_rc6.initd podman-clean-transient
+		newconfd "${FILESDIR}"/podman-clean-transient-5.0.0_rc6.confd podman-clean-transient
+
+		exeinto /etc/cron.daily
+		newexe "${FILESDIR}"/podman-auto-update-5.0.0.cron podman-auto-update
+
+		insinto /etc/logrotate.d
+		newins "${FILESDIR}/podman.logrotated" podman
+
+		exeinto /etc/user/init.d
+		newexe "${FILESDIR}/podman-5.0.0_rc4.user.initd" podman
+
+		insinto /etc/user/conf.d
+		newins "${FILESDIR}/podman-5.0.0_rc4.user.confd" podman
+	fi
+
+	keepdir /var/lib/containers
+}
+
+pkg_postinst() {
+	tmpfiles_process podman.conf $(usev wrapper podman-docker.conf)
+}
diff --git a/app-containers/reg/Manifest b/app-containers/reg/Manifest
new file mode 100644
index 000000000000..5c060ef79ca1
--- /dev/null
+++ b/app-containers/reg/Manifest
@@ -0,0 +1,2 @@
+DIST reg-0.16.1-deps.tar.xz 64969744 BLAKE2B 40cc07bc6b24660e945f0a20ea8a8de98e987c23fb44bfc2793ff808b7ef86b01956dbb17af70d13071ffa8ca1301409ca2ad350c73297263b7b24224f816642 SHA512 7c3c41c9b891118504b03c0996d2b6f50928e6f0d9300a2430574d4f39a810c2f8fa0f3d2c2405d4ef5a17509e84d2a19b040f89195885eacd7ae33c9ef67c50
+DIST reg-0.16.1.tar.gz 3163977 BLAKE2B b161200e7b96b26054e121853bafb4751865de1146f07fa48418a6624beeebd10eb8fcde1af90f9dd3c20ffd8d5807a106d012bf996944c96b5ff841b0079fb4 SHA512 77fbd543de6e94c504e98a0364895b19099e3cde55a85a4413730de58de8e84f50889fdcfaffa1c76ae412a603ed6d5f4b1d57566ec814cf88df70278e91aee6
diff --git a/app-containers/reg/files/reg-0.16.1-config.patch b/app-containers/reg/files/reg-0.16.1-config.patch
new file mode 100644
index 000000000000..717861dfab38
--- /dev/null
+++ b/app-containers/reg/files/reg-0.16.1-config.patch
@@ -0,0 +1,296 @@
+From ce4b2828ec800f0d1782b97b9400bd71154e5bbf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Manuel=20R=C3=BCger?= <manuel@rueg.eu>
+Date: Tue, 18 Sep 2018 15:42:24 +0200
+Subject: [PATCH] server: Read config from file
+
+---
+ README.md          |   4 ++
+ config.yml.example |  37 ++++++++++++++++
+ go.mod             |   1 +
+ go.sum             |   4 ++
+ server.go          | 107 +++++++++++++++++++++++++++++++--------------
+ 5 files changed, 119 insertions(+), 34 deletions(-)
+ create mode 100644 config.yml.example
+
+diff --git a/README.md b/README.md
+index 3c93191a..23b1b33c 100644
+--- a/README.md
++++ b/README.md
+@@ -212,6 +212,7 @@ Flags:
+   -u, --username       username for the registry (default: <none>)
+   --listen-address     address to listen on (default: <none>)
+   --asset-path         Path to assets and templates (default: <none>)
++  --config             Path to config file (default: <none>)
+   -f, --force-non-ssl  force allow use of non-ssl (default: false)
+   --once               generate the templates once and then exit (default: false)
+   --skip-ping          skip pinging the registry while establishing connection (default: false)
+@@ -227,6 +228,9 @@ Flags:
+   -p, --password       password for the registry (default: <none>)
+ ```
+ 
++Alternatively you can provide configuration to `reg server` via a file passed to
++`reg server` via as `--config`. See also config.yml.example in this repository.
++
+ **Screenshots:**
+ 
+ ![home.png](server/home.png)
+diff --git a/config.yml.example b/config.yml.example
+new file mode 100644
+index 00000000..9d4be25f
+--- /dev/null
++++ b/config.yml.example
+@@ -0,0 +1,37 @@
++### Reg Server Settings
++
++## Path to server TLS certificate:
++# cert:
++## Path to server TLS key:
++# key:
++## Address to listen on:
++# listen-address: 0.0.0.0
++## Port to listen on:
++# port: 8080
++## Path Assets are stored under:
++# asset-path: /var/lib/reg
++## Generate static website and exit:
++# once: false
++## Refresh interval:
++# interval: 1h0m0s
++## Debug output
++# debug: false
++## Skip initial ping
++# skip-ping: false
++## Timeout
++# timeout: 1m0s
++
++
++### Registry and Clair Server Settings
++## Registry Server:
++# registry: r.j3ss.co
++## Username to authenticate against registry server
++# username:
++## Password to authenticate against registry server
++# password:
++## If true, do not verify TLS certificates
++# insecure: false
++## Force allow use of non-TLS connections
++# force-nonssl: false
++## Clair Server:
++# clair:
+diff --git a/go.mod b/go.mod
+index 4e7583e8..914297a8 100644
+--- a/go.mod
++++ b/go.mod
+@@ -35,5 +35,6 @@ require (
+ 	github.com/sirupsen/logrus v1.4.2
+ 	golang.org/x/time v0.0.0-20190308202827-9d24e82272b4 // indirect
+ 	google.golang.org/grpc v1.23.1
++	gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7
+ 	gotest.tools v2.2.0+incompatible // indirect
+ )
+diff --git a/go.sum b/go.sum
+index 71f46e16..ff078b3f 100644
+--- a/go.sum
++++ b/go.sum
+@@ -54,8 +54,10 @@ github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQL
+ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+ github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
+ github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
++github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
+ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
++github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+ github.com/mitchellh/go-wordwrap v1.0.0 h1:6GlHJ/LTGMrIJbwgdqdl2eEH8o+Exx/0m8ir9Gns0u4=
+ github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
+@@ -115,8 +117,10 @@ google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoA
+ google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+ google.golang.org/grpc v1.23.1 h1:q4XQuHFC6I28BKZpo6IYyb3mNO+l7lSOxRuYTCiDfXk=
+ google.golang.org/grpc v1.23.1/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
++gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
+ gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+ gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
++gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7 h1:+t9dhfO+GNOIGJof6kPOAenx7YgrZMTdRPV+EsnPabk=
+ gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
+ gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
+ gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
+diff --git a/server.go b/server.go
+index fcd4cd71..0c84d85d 100644
+--- a/server.go
++++ b/server.go
+@@ -4,7 +4,9 @@ import (
+ 	"context"
+ 	"flag"
+ 	"fmt"
++	"gopkg.in/yaml.v2"
+ 	"html/template"
++	"io/ioutil"
+ 	"net/http"
+ 	"os"
+ 	"path/filepath"
+@@ -29,39 +31,76 @@ func (cmd *serverCommand) LongHelp() string  { return serverHelp }
+ func (cmd *serverCommand) Hidden() bool      { return false }
+ 
+ func (cmd *serverCommand) Register(fs *flag.FlagSet) {
+-	fs.DurationVar(&cmd.interval, "interval", time.Hour, "interval to generate new index.html's at")
++	fs.DurationVar(&cmd.Interval, "interval", time.Hour, "interval to generate new index.html's at")
+ 
+-	fs.StringVar(&cmd.registryServer, "registry", "", "URL to the private registry (ex. r.j3ss.co)")
+-	fs.StringVar(&cmd.registryServer, "r", "", "URL to the private registry (ex. r.j3ss.co)")
++	fs.StringVar(&cmd.RegistryServer, "registry", "", "URL to the private registry (ex. r.j3ss.co)")
++	fs.StringVar(&cmd.RegistryServer, "r", "", "URL to the private registry (ex. r.j3ss.co)")
+ 
+-	fs.StringVar(&cmd.clairServer, "clair", "", "url to clair instance")
++	fs.StringVar(&cmd.ClairServer, "clair", "", "url to clair instance")
+ 
+-	fs.StringVar(&cmd.cert, "cert", "", "path to ssl cert")
+-	fs.StringVar(&cmd.key, "key", "", "path to ssl key")
+-	fs.StringVar(&cmd.listenAddress, "listen-address", "", "address to listen on")
+-	fs.StringVar(&cmd.port, "port", "8080", "port for server to run on")
+-	fs.StringVar(&cmd.assetPath, "asset-path", "", "Path to assets and templates")
++	fs.StringVar(&cmd.Cert, "cert", "", "path to ssl cert")
++	fs.StringVar(&cmd.Key, "key", "", "path to ssl key")
++	fs.StringVar(&cmd.ListenAddress, "listen-address", "", "address to listen on")
++	fs.StringVar(&cmd.Port, "port", "8080", "port for server to run on")
+ 
+-	fs.BoolVar(&cmd.generateAndExit, "once", false, "generate the templates once and then exit")
++	fs.StringVar(&cmd.AssetPath, "asset-path", "", "Path to assets and templates")
++	fs.StringVar(&cmd.configPath, "config", "", "Path to config file")
++
++	fs.BoolVar(&cmd.GenerateAndExit, "once", false, "generate the templates once and then exit")
+ }
+ 
+ type serverCommand struct {
+-	interval       time.Duration
+-	registryServer string
+-	clairServer    string
+-
+-	generateAndExit bool
+-
+-	cert          string
+-	key           string
+-	listenAddress string
+-	port          string
+-	assetPath     string
++	Interval        time.Duration `yaml:"interval"`
++	RegistryServer  string        `yaml:"registry"`
++	ClairServer     string        `yaml:"clair"`
++	GenerateAndExit bool          `yaml:"once"`
++	Cert            string        `yaml:"cert"`
++	Key             string        `yaml:"key"`
++	ListenAddress   string        `yaml:"listen-address"`
++	Port            string        `yaml:"port"`
++	AssetPath       string        `yaml:"asset-path"`
++	configPath      string
++
++	Password    string        `yaml:"password"`
++	Username    string        `yaml:"username"`
++	Insecure    bool          `yaml:"insecure"`
++	Debug       bool          `yaml:"debug"`
++	SkipPing    bool          `yaml:"skip-ping"`
++	ForceNonSSL bool          `yaml:"force-nonssl"`
++	Timeout     time.Duration `yaml:"timeout"`
+ }
+ 
+ func (cmd *serverCommand) Run(ctx context.Context, args []string) error {
+ 	// Create the registry client.
+-	r, err := createRegistryClient(ctx, cmd.registryServer)
++	if len(cmd.configPath) > 0 {
++		config, err := ioutil.ReadFile(cmd.configPath)
++		if err != nil {
++			return err
++		}
++		yaml.Unmarshal(config, cmd)
++		if err != nil {
++			return err
++		}
++		if len(cmd.Username) > 0 {
++			username = cmd.Username
++		}
++		if len(cmd.Password) > 0 {
++			password = cmd.Password
++		}
++		if cmd.Debug {
++			debug = cmd.Debug
++		}
++		if cmd.Insecure {
++			insecure = cmd.Insecure
++		}
++		if cmd.SkipPing {
++			skipPing = cmd.SkipPing
++		}
++		if cmd.Timeout != 0 {
++			timeout = cmd.Timeout
++		}
++	}
++	r, err := createRegistryClient(ctx, cmd.RegistryServer)
+ 	if err != nil {
+ 		return err
+ 	}
+@@ -69,25 +108,25 @@ func (cmd *serverCommand) Run(ctx context.Context, args []string) error {
+ 	// Create the registry controller for the handlers.
+ 	rc := registryController{
+ 		reg:          r,
+-		generateOnly: cmd.generateAndExit,
++		generateOnly: cmd.GenerateAndExit,
+ 	}
+ 
+ 	// Create a clair client if the user passed in a server address.
+-	if len(cmd.clairServer) > 0 {
+-		rc.cl, err = clair.New(cmd.clairServer, clair.Opt{
++	if len(cmd.ClairServer) > 0 {
++		rc.cl, err = clair.New(cmd.ClairServer, clair.Opt{
+ 			Insecure: insecure,
+ 			Debug:    debug,
+ 			Timeout:  timeout,
+ 		})
+ 		if err != nil {
+-			return fmt.Errorf("creation of clair client at %s failed: %v", cmd.clairServer, err)
++			return fmt.Errorf("creation of clair client at %s failed: %v", cmd.ClairServer, err)
+ 		}
+ 	} else {
+ 		rc.cl = nil
+ 	}
+ 	// Get the path to the asset directory.
+-	assetDir := cmd.assetPath
+-	if len(cmd.assetPath) <= 0 {
++	assetDir := cmd.AssetPath
++	if len(cmd.AssetPath) <= 0 {
+ 		assetDir, err = os.Getwd()
+ 		if err != nil {
+ 			return err
+@@ -131,12 +170,12 @@ func (cmd *serverCommand) Run(ctx context.Context, args []string) error {
+ 		return fmt.Errorf("creating index failed: %v", err)
+ 	}
+ 
+-	if cmd.generateAndExit {
++	if cmd.GenerateAndExit {
+ 		logrus.Info("output generated, exiting...")
+ 		return nil
+ 	}
+ 
+-	rc.interval = cmd.interval
++	rc.interval = cmd.Interval
+ 	ticker := time.NewTicker(rc.interval)
+ 	go func() {
+ 		// Create more indexes every X minutes based off interval.
+@@ -174,12 +213,12 @@ func (cmd *serverCommand) Run(ctx context.Context, args []string) error {
+ 
+ 	// Set up the server.
+ 	server := &http.Server{
+-		Addr:    cmd.listenAddress + ":" + cmd.port,
++		Addr:    cmd.ListenAddress + ":" + cmd.Port,
+ 		Handler: mux,
+ 	}
+-	logrus.Infof("Starting server on port %q", cmd.port)
+-	if len(cmd.cert) > 0 && len(cmd.key) > 0 {
+-		return server.ListenAndServeTLS(cmd.cert, cmd.key)
++	logrus.Infof("Starting server on port %q", cmd.Port)
++	if len(cmd.Cert) > 0 && len(cmd.Key) > 0 {
++		return server.ListenAndServeTLS(cmd.Cert, cmd.Key)
+ 	}
+ 	return server.ListenAndServe()
+ }
+-- 
+2.34.1
+
diff --git a/app-containers/reg/files/reg.confd b/app-containers/reg/files/reg.confd
new file mode 100644
index 000000000000..1bd2475decc4
--- /dev/null
+++ b/app-containers/reg/files/reg.confd
@@ -0,0 +1,2 @@
+# arguments for reg server
+command_args="--asset-path=/var/lib/reg"
diff --git a/app-containers/reg/files/reg.initd b/app-containers/reg/files/reg.initd
new file mode 100644
index 000000000000..7759f44f376c
--- /dev/null
+++ b/app-containers/reg/files/reg.initd
@@ -0,0 +1,19 @@
+#!/sbin/openrc-run
+# Copyright 2016-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+description="Reg server - providing a UI for Docker Registry"
+pidfile=${pidfile:-"/run/${RC_SVCNAME}.pid"}
+user=${user:-${RC_SVCNAME}}
+group=${group:-${RC_SVCNAME}}
+
+command="/usr/bin/reg server"
+command_args="${command_args:---asset-path=/var/lib/reg}"
+command_background="true"
+start_stop_daemon_args="--user ${user} --group ${group} \
+	--stdout /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log \
+	--stderr /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log"
+
+depend() {
+	after net
+}
diff --git a/app-containers/reg/metadata.xml b/app-containers/reg/metadata.xml
new file mode 100644
index 000000000000..17492b5107c4
--- /dev/null
+++ b/app-containers/reg/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/reg/reg-0.16.1-r1.ebuild b/app-containers/reg/reg-0.16.1-r1.ebuild
new file mode 100644
index 000000000000..a7f35b0e2b85
--- /dev/null
+++ b/app-containers/reg/reg-0.16.1-r1.ebuild
@@ -0,0 +1,46 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+GIT_COMMIT=4203e559f331009df04a3ca47820989c6c43e138
+inherit go-module
+
+DESCRIPTION="Docker registry v2 command line client"
+HOMEPAGE="https://github.com/genuinetools/reg"
+SRC_URI="https://github.com/genuinetools/reg/archive/${GIT_COMMIT}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="MIT Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC"
+SLOT="0"
+KEYWORDS="~amd64"
+
+DEPEND="acct-group/reg
+	acct-user/reg
+"
+RDEPEND="${DEPEND}"
+
+RESTRICT+=" test "
+S="${WORKDIR}/${PN}-${GIT_COMMIT}"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-config.patch
+)
+
+src_compile() {
+	export -n XDG_CACHE_HOME
+	ego build -ldflags "
+		-X ${EGO_PN}/version.GITCOMMIT=${GIT_COMMIT}
+		-X ${EGO_PN}/version.VERSION=${PV}" \
+			-o reg .
+}
+
+src_install() {
+	dobin reg
+	dodoc README.md
+	insinto /var/lib/${PN}
+	doins -r server/*
+	newinitd "${FILESDIR}"/reg.initd reg
+	newconfd "${FILESDIR}"/reg.confd reg
+	keepdir /var/log/reg
+	fowners -R reg:reg /var/log/reg /var/lib/reg/static
+}
diff --git a/app-containers/runc/Manifest b/app-containers/runc/Manifest
new file mode 100644
index 000000000000..73d51c4be1fc
--- /dev/null
+++ b/app-containers/runc/Manifest
@@ -0,0 +1,4 @@
+DIST runc-1.2.8.tar.gz 2834651 BLAKE2B 5f76e40ee8bda4668758dce318625af1dbb13c0d33a17c9c872bc68aefd6311cac570ed934a69b92b4a327c6084ff6d6d55f8914b105513f9484bbc903107a4d SHA512 8d29a2ca179320f9a01c37383506f10aea1764e18b3321c507787556e3a531e23221f8369696d8caaf30124a523a68d0ad3609bae5ab06aa6c519e644d54d4ef
+DIST runc-1.3.3.tar.gz 2929410 BLAKE2B 1feddc154836eff606a685a0c0d606c1bbcd5a1a1ec8a288233581a88e0b3b6a95f446125688a8dca5efd5a275bf22931553cb9ab894f6aa0826d5a1274b6f91 SHA512 9ce0af1b79163c44913979c0483322247b154109871a113726163f64c6354141e7cefb5fb6e1225eaa4bb48a1e33ba9a6049cb45cb2af8793134647dad18c8dc
+DIST runc-1.4.0.tar.gz 2958986 BLAKE2B 9a363986a05c2c19646373373b94944642bf9f74a2a9f10d201baff7d76d54e39e273d6ceb9f94449926246ec22c2b863812ca1e4e8910cb166294b7ea7c4068 SHA512 a5b52d8494a4210d9ff4caefd0513b94b80ef9dd16c6eb369761cde2fce30214f765eee01c3cbb2e0cfd933371362fd89b08656b434d76038ffe1f8a59dea215
+DIST runc-1.4.2.tar.gz 2961237 BLAKE2B 440771f2cf21ba47c3a6c368179bb28bb50b794913e9ad1a6f8ffc3f06bcdf2d99a000ce261b0ea70bf3a2f998acd2f6ff7770ebc17915501f63b46f08c1f77c SHA512 93bd1d6641b55afa7fa415d26fd898371c63f3caae353c6bea7318eeac49835a29df0331f62d54bf2ab1a640105c541c7eb04c32bc3d1006df53d857d113775e
diff --git a/app-containers/runc/metadata.xml b/app-containers/runc/metadata.xml
new file mode 100644
index 000000000000..df57b4da2772
--- /dev/null
+++ b/app-containers/runc/metadata.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <longdescription lang="en">
+		runc is a CLI tool for spawning and running containers according
+		to the OCF (Open Container Format) specification.
+	</longdescription>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <use>
+    <flag name="kmem">
+			Enable Kernel Memory Accounting.
+		</flag>
+  </use>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:linuxfoundation:runc</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/runc/runc-1.2.8.ebuild b/app-containers/runc/runc-1.2.8.ebuild
new file mode 100644
index 000000000000..66d15d185cff
--- /dev/null
+++ b/app-containers/runc/runc-1.2.8.ebuild
@@ -0,0 +1,71 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+# update on bump, look for commit ID on release tag.
+# https://github.com/opencontainers/runc
+RUNC_COMMIT=eeb7e6024f9ee43876301b1d23c353384fa6dcdd
+
+CONFIG_CHECK="~USER_NS"
+
+DESCRIPTION="runc container cli tools"
+HOMEPAGE="https://github.com/opencontainers/runc/"
+MY_PV="${PV/_/-}"
+SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="Apache-2.0 BSD-2 BSD MIT"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+IUSE="apparmor +kmem +seccomp selinux test"
+
+COMMON_DEPEND="
+	apparmor? ( sys-libs/libapparmor )
+	seccomp? ( sys-libs/libseccomp )"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	!app-emulation/docker-runc
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	dev-go/go-md2man
+	test? ( "${RDEPEND}" )"
+
+# tests need busybox binary, and portage namespace
+# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
+# majority of tests pass
+RESTRICT+=" test"
+
+src_compile() {
+	# build up optional flags
+	local options=(
+		$(usev apparmor)
+		$(usev seccomp)
+		$(usex kmem '' 'nokmem')
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		COMMIT="${RUNC_COMMIT}"
+	)
+
+	emake "${myemakeargs[@]}" runc man
+}
+
+src_install() {
+	myemakeargs+=(
+		PREFIX="${ED}/usr"
+		BINDIR="${ED}/usr/bin"
+		MANDIR="${ED}/usr/share/man"
+	)
+	emake "${myemakeargs[@]}" install install-man install-bash
+
+	local DOCS=( README.md PRINCIPLES.md docs/. )
+	einstalldocs
+}
+
+src_test() {
+	emake "${myemakeargs[@]}" localunittest
+}
diff --git a/app-containers/runc/runc-1.3.3.ebuild b/app-containers/runc/runc-1.3.3.ebuild
new file mode 100644
index 000000000000..9cb7d6103355
--- /dev/null
+++ b/app-containers/runc/runc-1.3.3.ebuild
@@ -0,0 +1,152 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+# update on bump, look for commit ID on release tag.
+# https://github.com/opencontainers/runc
+RUNC_COMMIT=d842d7719497cc3b774fd71620278ac9e17710e0
+
+DESCRIPTION="runc container cli tools"
+HOMEPAGE="https://github.com/opencontainers/runc/"
+MY_PV="${PV/_/-}"
+SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="Apache-2.0 BSD-2 BSD MIT"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+IUSE="apparmor +kmem +seccomp selinux test"
+
+COMMON_DEPEND="
+	apparmor? ( sys-libs/libapparmor )
+	seccomp? ( sys-libs/libseccomp )"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	!app-emulation/docker-runc
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	dev-go/go-md2man
+	test? ( "${RDEPEND}" )"
+
+# tests need busybox binary, and portage namespace
+# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
+# majority of tests pass
+RESTRICT+=" test"
+
+# Please refer:
+# https://github.com/opencontainers/runc/blob/main/script/check-config.sh
+pkg_setup() {
+	CONFIG_CHECK="
+		~NAMESPACES
+		~NET_NS
+		~PID_NS
+		~IPC_NS
+		~UTS_NS
+		~CGROUPS
+		~CGROUP_CPUACCT
+		~CGROUP_DEVICE
+		~CGROUP_FREEZER
+		~CGROUP_SCHED
+		~CPUSETS
+		~MEMCG
+		~KEYS
+		~VETH
+		~BRIDGE
+		~BRIDGE_NETFILTER
+		~IP_NF_FILTER
+		~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_COMMENT
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~IP_NF_NAT
+		~NF_NAT
+		~POSIX_MQUEUE
+		~OVERLAY_FS
+	"
+
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	use seccomp && CONFIG_CHECK+="
+		~SECCOMP
+		~SECCOMP_FILTER
+	"
+	WARNING_SECCOMP="CONFIG_SECCOMP is required as optional feature"
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+	WARNING_CGROUP_PIDS="CONFIG_CGROUP_PIDS is required as optional feature"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP
+		~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP
+		~CFS_BANDWIDTH
+		~FAIR_GROUP_SCHED
+		~RT_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		~CHECKPOINT_RESTORE
+		~CGROUP_NET_PRIO
+	"
+
+	use selinux && CONFIG_CHECK+="
+		~SECURITY_SELINUX"
+
+	use apparmor && CONFIG_CHECK+="
+		~SECURITY_APPARMOR"
+
+	if [[ -n ${CONFIG_CHECK} ]]; then
+		linux-info_pkg_setup
+	fi
+}
+
+src_compile() {
+	# build up optional flags
+	local options=(
+		$(usev apparmor)
+		$(usev seccomp)
+		$(usex kmem '' 'nokmem')
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		COMMIT="${RUNC_COMMIT}"
+	)
+
+	emake "${myemakeargs[@]}" runc man
+}
+
+src_install() {
+	myemakeargs+=(
+		PREFIX="${ED}/usr"
+		BINDIR="${ED}/usr/bin"
+		MANDIR="${ED}/usr/share/man"
+	)
+	emake "${myemakeargs[@]}" install install-man install-bash
+
+	local DOCS=( README.md PRINCIPLES.md docs/. )
+	einstalldocs
+}
+
+src_test() {
+	emake "${myemakeargs[@]}" localunittest
+}
diff --git a/app-containers/runc/runc-1.4.0-r1.ebuild b/app-containers/runc/runc-1.4.0-r1.ebuild
new file mode 100644
index 000000000000..783ec475a00d
--- /dev/null
+++ b/app-containers/runc/runc-1.4.0-r1.ebuild
@@ -0,0 +1,154 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+# update on bump, look for commit ID on release tag.
+# https://github.com/opencontainers/runc
+RUNC_COMMIT=8bd78a9977e604c4d5f67a7415d7b8b8c109cdc4
+
+CONFIG_CHECK="~USER_NS"
+
+DESCRIPTION="runc container cli tools"
+HOMEPAGE="https://github.com/opencontainers/runc/"
+MY_PV="${PV/_/-}"
+SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="Apache-2.0 BSD-2 BSD MIT"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+IUSE="apparmor +kmem +seccomp selinux test"
+
+COMMON_DEPEND="
+	apparmor? ( sys-libs/libapparmor )
+	seccomp? ( sys-libs/libseccomp )"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	!app-emulation/docker-runc
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	dev-go/go-md2man
+	test? ( "${RDEPEND}" )"
+
+# tests need busybox binary, and portage namespace
+# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
+# majority of tests pass
+RESTRICT+=" test"
+
+# Please refer:
+# https://github.com/opencontainers/runc/blob/main/script/check-config.sh
+pkg_setup() {
+	CONFIG_CHECK="
+		~NAMESPACES
+		~NET_NS
+		~PID_NS
+		~IPC_NS
+		~UTS_NS
+		~CGROUPS
+		~CGROUP_CPUACCT
+		~CGROUP_DEVICE
+		~CGROUP_FREEZER
+		~CGROUP_SCHED
+		~CPUSETS
+		~MEMCG
+		~KEYS
+		~VETH
+		~BRIDGE
+		~BRIDGE_NETFILTER
+		~IP_NF_FILTER
+		~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_COMMENT
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~IP_NF_NAT
+		~NF_NAT
+		~POSIX_MQUEUE
+		~OVERLAY_FS
+	"
+
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	use seccomp && CONFIG_CHECK+="
+		~SECCOMP
+		~SECCOMP_FILTER
+	"
+	WARNING_SECCOMP="CONFIG_SECCOMP is required as optional feature"
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+	WARNING_CGROUP_PIDS="CONFIG_CGROUP_PIDS is required as optional feature"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP
+		~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP
+		~CFS_BANDWIDTH
+		~FAIR_GROUP_SCHED
+		~RT_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		~CHECKPOINT_RESTORE
+		~CGROUP_NET_PRIO
+	"
+
+	use selinux && CONFIG_CHECK+="
+		~SECURITY_SELINUX"
+
+	use apparmor && CONFIG_CHECK+="
+		~SECURITY_APPARMOR"
+
+	if [[ -n ${CONFIG_CHECK} ]]; then
+		linux-info_pkg_setup
+	fi
+}
+
+src_compile() {
+	# build up optional flags
+	local options=(
+		$(usev apparmor)
+		$(usev seccomp)
+		$(usex kmem '' 'nokmem')
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		COMMIT="${RUNC_COMMIT}"
+	)
+
+	emake "${myemakeargs[@]}" runc man
+}
+
+src_install() {
+	myemakeargs+=(
+		PREFIX="${ED}/usr"
+		BINDIR="${ED}/usr/bin"
+		MANDIR="${ED}/usr/share/man"
+	)
+	emake "${myemakeargs[@]}" install install-man install-bash
+
+	local DOCS=( README.md PRINCIPLES.md docs/. )
+	einstalldocs
+}
+
+src_test() {
+	emake "${myemakeargs[@]}" localunittest
+}
diff --git a/app-containers/runc/runc-1.4.2.ebuild b/app-containers/runc/runc-1.4.2.ebuild
new file mode 100644
index 000000000000..91247b87fcd1
--- /dev/null
+++ b/app-containers/runc/runc-1.4.2.ebuild
@@ -0,0 +1,154 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+# update on bump, look for commit ID on release tag.
+# https://github.com/opencontainers/runc
+RUNC_COMMIT=c241c0bb5e60a8e8c1b2e53d4eca8d0068d8d57e
+
+CONFIG_CHECK="~USER_NS"
+
+DESCRIPTION="runc container cli tools"
+HOMEPAGE="https://github.com/opencontainers/runc/"
+MY_PV="${PV/_/-}"
+SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="Apache-2.0 BSD-2 BSD MIT"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+IUSE="apparmor +kmem +seccomp selinux test"
+
+COMMON_DEPEND="
+	apparmor? ( sys-libs/libapparmor )
+	seccomp? ( sys-libs/libseccomp )"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	!app-emulation/docker-runc
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	dev-go/go-md2man
+	test? ( "${RDEPEND}" )"
+
+# tests need busybox binary, and portage namespace
+# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
+# majority of tests pass
+RESTRICT+=" test"
+
+# Please refer:
+# https://github.com/opencontainers/runc/blob/main/script/check-config.sh
+pkg_setup() {
+	CONFIG_CHECK="
+		~NAMESPACES
+		~NET_NS
+		~PID_NS
+		~IPC_NS
+		~UTS_NS
+		~CGROUPS
+		~CGROUP_CPUACCT
+		~CGROUP_DEVICE
+		~CGROUP_FREEZER
+		~CGROUP_SCHED
+		~CPUSETS
+		~MEMCG
+		~KEYS
+		~VETH
+		~BRIDGE
+		~BRIDGE_NETFILTER
+		~IP_NF_FILTER
+		~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_COMMENT
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~IP_NF_NAT
+		~NF_NAT
+		~POSIX_MQUEUE
+		~OVERLAY_FS
+	"
+
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	use seccomp && CONFIG_CHECK+="
+		~SECCOMP
+		~SECCOMP_FILTER
+	"
+	WARNING_SECCOMP="CONFIG_SECCOMP is required as optional feature"
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+	WARNING_CGROUP_PIDS="CONFIG_CGROUP_PIDS is required as optional feature"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP
+		~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP
+		~CFS_BANDWIDTH
+		~FAIR_GROUP_SCHED
+		~RT_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		~CHECKPOINT_RESTORE
+		~CGROUP_NET_PRIO
+	"
+
+	use selinux && CONFIG_CHECK+="
+		~SECURITY_SELINUX"
+
+	use apparmor && CONFIG_CHECK+="
+		~SECURITY_APPARMOR"
+
+	if [[ -n ${CONFIG_CHECK} ]]; then
+		linux-info_pkg_setup
+	fi
+}
+
+src_compile() {
+	# build up optional flags
+	local options=(
+		$(usev apparmor)
+		$(usev seccomp)
+		$(usex kmem '' 'nokmem')
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		COMMIT="${RUNC_COMMIT}"
+	)
+
+	emake "${myemakeargs[@]}" runc man
+}
+
+src_install() {
+	myemakeargs+=(
+		PREFIX="${ED}/usr"
+		BINDIR="${ED}/usr/bin"
+		MANDIR="${ED}/usr/share/man"
+	)
+	emake "${myemakeargs[@]}" install install-man install-bash
+
+	local DOCS=( README.md PRINCIPLES.md docs/. )
+	einstalldocs
+}
+
+src_test() {
+	emake "${myemakeargs[@]}" localunittest
+}
diff --git a/app-containers/s6-overlay/Manifest b/app-containers/s6-overlay/Manifest
new file mode 100644
index 000000000000..b5a39bab89bf
--- /dev/null
+++ b/app-containers/s6-overlay/Manifest
@@ -0,0 +1 @@
+DIST s6-overlay-2.1.0.2.tar.gz 30688 BLAKE2B 14d631a23be831d9dbc62a7e5ca341320eb8a0f46ae94d243bba4d6ba8fe9f6102dc818555398af64a207ea3056eb2cbbe045b5ec3baaf7d3a058217ad20e4f7 SHA512 6ff18566c64031fca985b36d6cbba646c3fb5c7f16a9d2dcca74e66ed4de5f10399c2142453e550c4e711f716158b91dd5777c7f6a03a91ed61ca9e81d6cef30
diff --git a/app-containers/s6-overlay/metadata.xml b/app-containers/s6-overlay/metadata.xml
new file mode 100644
index 000000000000..17492b5107c4
--- /dev/null
+++ b/app-containers/s6-overlay/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/s6-overlay/s6-overlay-2.1.0.2-r1.ebuild b/app-containers/s6-overlay/s6-overlay-2.1.0.2-r1.ebuild
new file mode 100644
index 000000000000..17960297fa00
--- /dev/null
+++ b/app-containers/s6-overlay/s6-overlay-2.1.0.2-r1.ebuild
@@ -0,0 +1,61 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+if [[ ${PV} = 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/just-containers/${PN}"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/just-containers/${PN}/archive/v${PV}.tar.gz ->
+	${P}.tar.gz"
+	KEYWORDS="~amd64"
+fi
+
+DESCRIPTION="an s6-based init system for containers"
+HOMEPAGE="https://github.com/just-containers/s6-overlay"
+
+LICENSE="ISC"
+SLOT="0"
+IUSE=""
+
+DEPEND=""
+RDEPEND="sys-apps/s6
+	sys-apps/s6-portable-utils"
+
+src_install() {
+	dodoc *.md
+	cd builder/overlay-rootfs
+	dobin usr/bin/{fix-attrs,logutil*,print*,with*}
+
+	insinto /
+	doins -r etc init
+
+	# create must exist directories
+	dodir /etc/{cont-init.d,cont-finish.d,fix-attrs.d,services.d}
+	dodir /etc/s6/init/env-stage2
+
+	# create "supervise" directory in fdholder, its needed for no-catchall
+	# stage2 wake up
+	dodir /etc/s6/services/s6-fdholderd/supervise
+	fperms 0700 /etc/s6/services/s6-fdholderd/supervise
+
+	# fix misc permissions
+	fperms 0755 /init
+	fperms 0755 /etc/s6/init/init-stage1 \
+		/etc/s6/init/init-stage2 \
+		/etc/s6/init/init-stage2-redirfd \
+		/etc/s6/init/init-stage3
+	fperms 0755 /etc/s6/init-catchall/init-stage1 \
+		/etc/s6/init-catchall/init-stage2
+	fperms 0755 /etc/s6/init-no-catchall/init-stage1 \
+		/etc/s6/init-no-catchall/init-stage2
+	fperms 0755 /etc/s6/services/.s6-svscan/crash
+	fperms 0755 /etc/s6/services/.s6-svscan/finish
+	fperms 0755 /etc/s6/services/s6-fdholderd/run
+	fperms 0755 /etc/s6/services/s6-svscan-log/run
+
+	# create a stub for the s6-overlay-preinit setuid program, since
+	# it's really not needed when permissions are already correct
+	dosym true /bin/s6-overlay-preinit
+}
diff --git a/app-containers/sen/Manifest b/app-containers/sen/Manifest
new file mode 100644
index 000000000000..7c5b759afe95
--- /dev/null
+++ b/app-containers/sen/Manifest
@@ -0,0 +1,2 @@
+DIST sen-0.8.0.tar.gz 1931211 BLAKE2B a8c6a4fc3343fd90c03ab9d0dfa85ff39639a21bb807a2122d29e000c6df1832b2277553b3d3cf88bbc0ef51a0105a5f9246f1e9b05439dd7f1ea71fcadc49cf SHA512 03fa23c5e5e8e4d556f6b2154db5a4128a8a51c60ea57792a11080ac7870af6bd128e374f682fc7ba1c206148c2a146bc81233b36306a27da77f09f8a508713f
+DIST sen-0.8.1.tar.gz 1933646 BLAKE2B cf6944da654c490b7e589a699a9ed4403fd990b71af3fbbd08349309cc4e4ecbbcc9cdb09c13792912b5f3b8134de792c8ea37e311b6a3736662c9ac6cf2790c SHA512 e51042455be25c8b39c070441804be44cc2ec1bfd8ab1732c79b29997197de6180635517db856021fd46ee88364df3e830e68013a1ec81f6230c0c01f36f7cec
diff --git a/app-containers/sen/files/sen-0.8.1-include-subpackages.patch b/app-containers/sen/files/sen-0.8.1-include-subpackages.patch
new file mode 100644
index 000000000000..ec1cfae5f473
--- /dev/null
+++ b/app-containers/sen/files/sen-0.8.1-include-subpackages.patch
@@ -0,0 +1,25 @@
+From: Colin Watson <cjwatson@debian.org>
+Date: Tue, 9 Sep 2025 17:47:21 +0100
+Subject: Include subpackages in wheel
+
+Otherwise modern installation methods omit everything under `sen.tui`
+and so are broken.
+
+Forwarded: https://github.com/TomasTomecek/sen/pull/190
+Last-Update: 2025-09-09
+---
+ pyproject.toml | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pyproject.toml b/pyproject.toml
+index 230dc08..94f7ee7 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -36,5 +36,5 @@ Repository = "https://github.com/TomasTomecek/sen/"
+ [project.scripts]
+ sen = "sen.cli:main"
+ 
+-[tool.setuptools]
+-packages = ["sen"]
++[tool.setuptools.packages.find]
++include = ["sen*"]
diff --git a/app-containers/sen/files/sen-0.8.1-urwid-import.patch b/app-containers/sen/files/sen-0.8.1-urwid-import.patch
new file mode 100644
index 000000000000..713b4fdb3c9b
--- /dev/null
+++ b/app-containers/sen/files/sen-0.8.1-urwid-import.patch
@@ -0,0 +1,12 @@
+https://github.com/TomasTomecek/sen/issues/192
+--- a/tests/test_widgets.py~	2021-11-01 10:02:44.000000000 +0100
++++ b/tests/test_widgets.py	2026-05-14 10:48:56.201370414 +0200
+@@ -4,7 +4,7 @@
+ 
+ import pytest
+ from flexmock import flexmock
+-from urwid.listbox import SimpleListWalker
++from urwid import SimpleListWalker
+ 
+ from sen.tui.widgets.list.base import WidgetBase
+ from sen.tui.widgets.list.common import ScrollableListBox, AsyncScrollableListBox
diff --git a/app-containers/sen/metadata.xml b/app-containers/sen/metadata.xml
new file mode 100644
index 000000000000..5f33304011d5
--- /dev/null
+++ b/app-containers/sen/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/sen/sen-0.8.0.ebuild b/app-containers/sen/sen-0.8.0.ebuild
new file mode 100644
index 000000000000..dac2fb245efb
--- /dev/null
+++ b/app-containers/sen/sen-0.8.0.ebuild
@@ -0,0 +1,33 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{13..14} )
+inherit distutils-r1 pypi
+
+DESCRIPTION="Terminal User Interface for docker engine"
+HOMEPAGE="https://github.com/TomasTomecek/sen"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64"
+
+RDEPEND="
+	dev-python/urwid[${PYTHON_USEDEP}]
+	dev-python/urwidtrees[${PYTHON_USEDEP}]
+	dev-python/docker[${PYTHON_USEDEP}]
+"
+BDEPEND="${RDEPEND}
+	test? (
+		dev-python/flexmock[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+python_install_all() {
+	distutils-r1_python_install_all
+	dodoc -r docs
+}
diff --git a/app-containers/sen/sen-0.8.1.ebuild b/app-containers/sen/sen-0.8.1.ebuild
new file mode 100644
index 000000000000..dfd04982ebf8
--- /dev/null
+++ b/app-containers/sen/sen-0.8.1.ebuild
@@ -0,0 +1,39 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{13..14} )
+inherit distutils-r1 pypi
+
+DESCRIPTION="Terminal User Interface for docker engine"
+HOMEPAGE="https://github.com/TomasTomecek/sen"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64"
+
+RDEPEND="
+	>=dev-python/urwid-2.6.14[${PYTHON_USEDEP}]
+	dev-python/urwidtrees[${PYTHON_USEDEP}]
+	>=dev-python/docker-7.1.0[${PYTHON_USEDEP}]
+	>=dev-python/requests-2.32.4[${PYTHON_USEDEP}]
+"
+BDEPEND="${RDEPEND}
+	test? (
+		dev-python/flexmock[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+PATCHES=(
+	"${FILESDIR}/${PN}-0.8.1-include-subpackages.patch"
+	"${FILESDIR}/${PN}-0.8.1-urwid-import.patch"
+)
+
+python_install_all() {
+	distutils-r1_python_install_all
+	dodoc -r docs
+}
diff --git a/app-containers/skopeo/Manifest b/app-containers/skopeo/Manifest
new file mode 100644
index 000000000000..2dbed9fe0f9e
--- /dev/null
+++ b/app-containers/skopeo/Manifest
@@ -0,0 +1,5 @@
+DIST skopeo-1.18.0.tar.gz 10790607 BLAKE2B ebbd9c481fd9ae03ff853042276037a521a7911ded67006faa1b11d6a70affadce35bdcea67209250cde36196ae87f1206ba654f9a52c7ec833cb25fe6c0af1e SHA512 7d56d78b4e0299c187eb2ea46a2d6ac41a4ad30848e9f5fe43285af74c5207f6fc4ee98c15bd5114de7a660e52846f75c26632ae1aa3ccf656b504798a6b1d56
+DIST skopeo-1.19.0.tar.gz 10819827 BLAKE2B c413bdc58634e144bcd1ee64afcba5cbd472fb08791c6eb8acb1cc84fdc9a62ef16fcd52123ac3364b1473f2aa285b97007d440b99385f8503120b412294f17c SHA512 2e297a193e8414f0482b06b7e2aaa027c4510963e91e4675c00b8113e58b82abf26943f36a60584dc47fd7f3abd80c452fb9c92f29e1b82d4c329bd422a399ee
+DIST skopeo-1.21.0.tar.gz 10187308 BLAKE2B 7a173e99e940c64e27e541575880a13132d0784cf4187e5d5ca871a75a1c71d8cbbe04e8f462a58e9f5e9fafaa610af69db42f28bc2cb6329f21bebd972b7c20 SHA512 2d1bc2e991d11b2060f7d2d4869aa30bb281794c3a5fa8aa6c5e333fc9c0190eb716d1855f6554ab0ee810b93e1638fcfde48e58f1e3e01ac5474c329ac041c7
+DIST skopeo-1.22.0.tar.gz 10191616 BLAKE2B f763954cd209c5d3770da1bfd71ab3be485920326ada83770b4b190149b712e67c2d200ca4af442f317cf19f8048e90f7c7b4b03761d3e43b57b4e68e6e8d006 SHA512 d4030c4dca7288e8a80a31fadd37532990bdf16ad5ff7c5e8e2ef922cc1a3185f1a6c32ac9906bd07a826cc6968a68dfd6df4d7e10e8ee22d87dba3ac5bfd3b9
+DIST skopeo-1.22.2.tar.gz 10327855 BLAKE2B f3c6d5eafe98c54b0e8f4b69d75472cfe4367152a915ed4daf16dc8d0604547863d62acaf3ef3c50d82a7ab4996d9ee9c25b87300aefccbebc74c664de4ee515 SHA512 d65134f568bf49cabc1ec7564bc98a5debb9e6b16a6e5351cebc583534a56b6a16c0eb69356f8466681e68df5445172c34c9d34bcb362bc2a89bfe9288002066
diff --git a/app-containers/skopeo/metadata.xml b/app-containers/skopeo/metadata.xml
new file mode 100644
index 000000000000..c71e8f8725c3
--- /dev/null
+++ b/app-containers/skopeo/metadata.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <maintainer type="person" proxied="yes">
+    <email>me@rahil.rocks</email>
+    <name>Rahil Bhimjiani</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <use>
+    <flag name="btrfs">Enables dependencies for the "btrfs" graph driver.</flag>
+    <flag name="rootless">Compiles with libsubid</flag>
+  </use>
+  <upstream>
+    <bugs-to>https://github.com/containers/skopeo/issues</bugs-to>
+    <doc>https://github.com/containers/skopeo/blob/main/README.md</doc>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/skopeo/skopeo-1.18.0-r1.ebuild b/app-containers/skopeo/skopeo-1.18.0-r1.ebuild
new file mode 100644
index 000000000000..17315ff35c5f
--- /dev/null
+++ b/app-containers/skopeo/skopeo-1.18.0-r1.ebuild
@@ -0,0 +1,60 @@
+# Copyright 2023-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module linux-info
+
+DESCRIPTION="Work with remote container images registries"
+HOMEPAGE="https://github.com/containers/skopeo"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/skopeo.git"
+else
+	SRC_URI="https://github.com/containers/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 arm64"
+fi
+
+# main
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT"
+SLOT="0"
+IUSE="btrfs rootless"
+RESTRICT="test"
+
+DEPEND="
+	>=app-crypt/gpgme-1.5.5:=
+	btrfs? ( >=sys-fs/btrfs-progs-4.0.1 )
+	rootless? ( sys-apps/shadow:= )
+"
+RDEPEND="${DEPEND}
+	app-containers/containers-common
+"
+BDEPEND="dev-go/go-md2man"
+
+pkg_setup() {
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	linux-info_pkg_setup
+}
+
+run_make() {
+	local emakeflags=(
+		BTRFS_BUILD_TAG="$(usex btrfs '' 'btrfs_noversion exclude_graphdriver_btrfs')"
+		CONTAINERSCONFDIR="${EPREFIX}/etc/containers"
+		LIBSUBID_BUILD_TAG="$(usex rootless 'libsubid' '')"
+		PREFIX="${EPREFIX}/usr"
+	)
+	emake "${emakeflags[@]}" "$@"
+}
+
+src_compile() {
+	run_make all completions
+}
+
+src_install() {
+	# The install target in the Makefile tries to rebuild the binary and
+	# installs things that are already installed by containers-common.
+	dobin bin/skopeo
+	einstalldocs
+	doman docs/*.1
+	run_make "DESTDIR=${D}" install-completions
+}
diff --git a/app-containers/skopeo/skopeo-1.19.0.ebuild b/app-containers/skopeo/skopeo-1.19.0.ebuild
new file mode 100644
index 000000000000..bd98d6c352d6
--- /dev/null
+++ b/app-containers/skopeo/skopeo-1.19.0.ebuild
@@ -0,0 +1,60 @@
+# Copyright 2023-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module linux-info
+
+DESCRIPTION="Work with remote container images registries"
+HOMEPAGE="https://github.com/containers/skopeo"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/skopeo.git"
+else
+	SRC_URI="https://github.com/containers/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 arm64"
+fi
+
+# main
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT"
+SLOT="0"
+IUSE="btrfs rootless"
+RESTRICT="test"
+
+DEPEND="
+	>=app-crypt/gpgme-1.5.5:=
+	btrfs? ( >=sys-fs/btrfs-progs-4.0.1 )
+	rootless? ( sys-apps/shadow:= )
+"
+RDEPEND="${DEPEND}
+	app-containers/containers-common
+"
+BDEPEND="dev-go/go-md2man"
+
+pkg_setup() {
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	linux-info_pkg_setup
+}
+
+run_make() {
+	local emakeflags=(
+		BTRFS_BUILD_TAG="$(usex btrfs '' 'exclude_graphdriver_btrfs')"
+		CONTAINERSCONFDIR="${EPREFIX}/etc/containers"
+		LIBSUBID_BUILD_TAG="$(usex rootless 'libsubid' '')"
+		PREFIX="${EPREFIX}/usr"
+	)
+	emake "${emakeflags[@]}" "$@"
+}
+
+src_compile() {
+	run_make all completions
+}
+
+src_install() {
+	# The install target in the Makefile tries to rebuild the binary and
+	# installs things that are already installed by containers-common.
+	dobin bin/skopeo
+	einstalldocs
+	doman docs/*.1
+	run_make "DESTDIR=${D}" install-completions
+}
diff --git a/app-containers/skopeo/skopeo-1.21.0.ebuild b/app-containers/skopeo/skopeo-1.21.0.ebuild
new file mode 100644
index 000000000000..462168600f12
--- /dev/null
+++ b/app-containers/skopeo/skopeo-1.21.0.ebuild
@@ -0,0 +1,62 @@
+# Copyright 2023-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+DESCRIPTION="Work with remote container images registries"
+HOMEPAGE="https://github.com/containers/skopeo"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/skopeo.git"
+else
+	SRC_URI="https://github.com/containers/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 arm64"
+fi
+
+# main
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT"
+SLOT="0"
+IUSE="btrfs rootless"
+RESTRICT="test"
+
+DEPEND="
+	>=app-crypt/gpgme-1.5.5:=
+	dev-db/sqlite:3
+	btrfs? ( >=sys-fs/btrfs-progs-4.0.1 )
+	rootless? ( sys-apps/shadow:= )
+"
+RDEPEND="${DEPEND}
+	app-containers/containers-common
+"
+BDEPEND="dev-go/go-md2man"
+
+pkg_setup() {
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	linux-info_pkg_setup
+}
+
+run_make() {
+	local emakeflags=(
+		BTRFS_BUILD_TAG="$(usex btrfs '' 'exclude_graphdriver_btrfs')"
+		CONTAINERSCONFDIR="${EPREFIX}/etc/containers"
+		LIBSUBID_BUILD_TAG="$(usex rootless 'libsubid' '')"
+		PREFIX="${EPREFIX}/usr"
+	)
+	emake "${emakeflags[@]}" "$@"
+}
+
+src_compile() {
+	run_make all completions
+}
+
+src_install() {
+	# The install target in the Makefile tries to rebuild the binary and
+	# installs things that are already installed by containers-common.
+	dobin bin/skopeo
+	einstalldocs
+	doman docs/*.1
+	run_make "DESTDIR=${D}" install-completions
+}
diff --git a/app-containers/skopeo/skopeo-1.22.0.ebuild b/app-containers/skopeo/skopeo-1.22.0.ebuild
new file mode 100644
index 000000000000..1f4415f9e052
--- /dev/null
+++ b/app-containers/skopeo/skopeo-1.22.0.ebuild
@@ -0,0 +1,62 @@
+# Copyright 2023-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+DESCRIPTION="Work with remote container images registries"
+HOMEPAGE="https://github.com/containers/skopeo"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/skopeo.git"
+else
+	SRC_URI="https://github.com/containers/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64"
+fi
+
+# main
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT"
+SLOT="0"
+IUSE="btrfs rootless"
+RESTRICT="test"
+
+DEPEND="
+	>=app-crypt/gpgme-1.5.5:=
+	dev-db/sqlite:3
+	btrfs? ( >=sys-fs/btrfs-progs-4.0.1 )
+	rootless? ( sys-apps/shadow:= )
+"
+RDEPEND="${DEPEND}
+	app-containers/containers-common
+"
+BDEPEND="dev-go/go-md2man"
+
+pkg_setup() {
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	linux-info_pkg_setup
+}
+
+run_make() {
+	local emakeflags=(
+		BTRFS_BUILD_TAG="$(usex btrfs '' 'exclude_graphdriver_btrfs')"
+		CONTAINERSCONFDIR="${EPREFIX}/etc/containers"
+		LIBSUBID_BUILD_TAG="$(usex rootless 'libsubid' '')"
+		PREFIX="${EPREFIX}/usr"
+	)
+	emake "${emakeflags[@]}" "$@"
+}
+
+src_compile() {
+	run_make all completions
+}
+
+src_install() {
+	# The install target in the Makefile tries to rebuild the binary and
+	# installs things that are already installed by containers-common.
+	dobin bin/skopeo
+	einstalldocs
+	doman docs/*.1
+	run_make "DESTDIR=${D}" install-completions
+}
diff --git a/app-containers/skopeo/skopeo-1.22.2.ebuild b/app-containers/skopeo/skopeo-1.22.2.ebuild
new file mode 100644
index 000000000000..1f4415f9e052
--- /dev/null
+++ b/app-containers/skopeo/skopeo-1.22.2.ebuild
@@ -0,0 +1,62 @@
+# Copyright 2023-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+DESCRIPTION="Work with remote container images registries"
+HOMEPAGE="https://github.com/containers/skopeo"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/skopeo.git"
+else
+	SRC_URI="https://github.com/containers/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64"
+fi
+
+# main
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT"
+SLOT="0"
+IUSE="btrfs rootless"
+RESTRICT="test"
+
+DEPEND="
+	>=app-crypt/gpgme-1.5.5:=
+	dev-db/sqlite:3
+	btrfs? ( >=sys-fs/btrfs-progs-4.0.1 )
+	rootless? ( sys-apps/shadow:= )
+"
+RDEPEND="${DEPEND}
+	app-containers/containers-common
+"
+BDEPEND="dev-go/go-md2man"
+
+pkg_setup() {
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	linux-info_pkg_setup
+}
+
+run_make() {
+	local emakeflags=(
+		BTRFS_BUILD_TAG="$(usex btrfs '' 'exclude_graphdriver_btrfs')"
+		CONTAINERSCONFDIR="${EPREFIX}/etc/containers"
+		LIBSUBID_BUILD_TAG="$(usex rootless 'libsubid' '')"
+		PREFIX="${EPREFIX}/usr"
+	)
+	emake "${emakeflags[@]}" "$@"
+}
+
+src_compile() {
+	run_make all completions
+}
+
+src_install() {
+	# The install target in the Makefile tries to rebuild the binary and
+	# installs things that are already installed by containers-common.
+	dobin bin/skopeo
+	einstalldocs
+	doman docs/*.1
+	run_make "DESTDIR=${D}" install-completions
+}
diff --git a/app-containers/skopeo/skopeo-9999.ebuild b/app-containers/skopeo/skopeo-9999.ebuild
new file mode 100644
index 000000000000..94322380c7c4
--- /dev/null
+++ b/app-containers/skopeo/skopeo-9999.ebuild
@@ -0,0 +1,60 @@
+# Copyright 2023-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module linux-info
+
+DESCRIPTION="Work with remote container images registries"
+HOMEPAGE="https://github.com/containers/skopeo"
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/skopeo.git"
+else
+	SRC_URI="https://github.com/containers/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64"
+fi
+
+# main
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT"
+SLOT="0"
+IUSE="btrfs rootless"
+RESTRICT="test"
+
+DEPEND="
+	>=app-crypt/gpgme-1.5.5:=
+	btrfs? ( >=sys-fs/btrfs-progs-4.0.1 )
+	rootless? ( sys-apps/shadow:= )
+"
+RDEPEND="${DEPEND}
+	app-containers/containers-common
+"
+BDEPEND="dev-go/go-md2man"
+
+pkg_setup() {
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	linux-info_pkg_setup
+}
+
+run_make() {
+	local emakeflags=(
+		BTRFS_BUILD_TAG="$(usex btrfs '' 'exclude_graphdriver_btrfs')"
+		CONTAINERSCONFDIR="${EPREFIX}/etc/containers"
+		LIBSUBID_BUILD_TAG="$(usex rootless 'libsubid' '')"
+		PREFIX="${EPREFIX}/usr"
+	)
+	emake "${emakeflags[@]}" "$@"
+}
+
+src_compile() {
+	run_make all completions
+}
+
+src_install() {
+	# The install target in the Makefile tries to rebuild the binary and
+	# installs things that are already installed by containers-common.
+	dobin bin/skopeo
+	einstalldocs
+	doman docs/*.1
+	run_make "DESTDIR=${D}" install-completions
+}
diff --git a/app-containers/slirp4netns/Manifest b/app-containers/slirp4netns/Manifest
new file mode 100644
index 000000000000..cb82ca099497
--- /dev/null
+++ b/app-containers/slirp4netns/Manifest
@@ -0,0 +1,2 @@
+DIST slirp4netns-1.3.3.tar.gz 65051 BLAKE2B 2c6b2b7ec8aabcc6c4dcb715454b4ef3efc68aab3e671dfccc171d48b020e3ed32d065a9c6f88f83913fbc3f76c2af47c7e4367273004e1874ed7b8be0faf56e SHA512 beaf42697d7657444f1970bb08fa6e9cf9eab8454eb214bd856215b38dcedf331fef64e3ea530cd19d100b5b56e16936e184fc69ce597e201b8accba0274fd60
+DIST slirp4netns-1.3.4.tar.gz 65089 BLAKE2B 9743780cb4a050f3e113101fa2d698ec9a3ec31b205b2a353af7e0fff0c7190119f49d907833166838ca5331d731ecd547a1d0fdd2dca276e4a1841ebe5acd12 SHA512 dd821b69a5fa74469b15b7ceaf5d0346fe6b42b908420d8c4de95515616462df6e072dc6f6cf29b5ce17f865320bd0e1047e171e5ec03596c9f180356fb238f7
diff --git a/app-containers/slirp4netns/metadata.xml b/app-containers/slirp4netns/metadata.xml
new file mode 100644
index 000000000000..3c42e0df81fb
--- /dev/null
+++ b/app-containers/slirp4netns/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <maintainer type="person" proxied="yes">
+    <email>g.braeunlich@disroot.org</email>
+    <name>Gerhard Bräunlich</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/slirp4netns/slirp4netns-1.3.3.ebuild b/app-containers/slirp4netns/slirp4netns-1.3.3.ebuild
new file mode 100644
index 000000000000..fd2989f69dbb
--- /dev/null
+++ b/app-containers/slirp4netns/slirp4netns-1.3.3.ebuild
@@ -0,0 +1,40 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="User-mode networking for unprivileged network namespaces"
+HOMEPAGE="https://github.com/rootless-containers/slirp4netns"
+SRC_URI="https://github.com/rootless-containers/slirp4netns/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 arm64 ~ppc64 ~riscv"
+RESTRICT="test"
+
+DEPEND="
+	dev-libs/glib:2=
+	net-libs/libslirp:=
+	sys-libs/libseccomp:=
+	sys-libs/libcap:=
+"
+RDEPEND="${DEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+src_prepare() {
+	default
+
+	# Respect AR variable for bug 722162.
+	sed -e 's|^AC_PROG_CC$|AC_DEFUN([AC_PROG_AR], [AC_CHECK_TOOL(AR, ar, :)])\nAC_PROG_AR\n\0|' \
+		-i configure.ac || die
+	eautoreconf
+}
+
+pkg_postinst() {
+	if [[ -z ${REPLACING_VERSIONS} ]]; then
+		elog "You need to have the tun kernel module loaded in order to have"
+		elog "slirp4netns working"
+	fi
+}
diff --git a/app-containers/slirp4netns/slirp4netns-1.3.4.ebuild b/app-containers/slirp4netns/slirp4netns-1.3.4.ebuild
new file mode 100644
index 000000000000..597cd0fdfcff
--- /dev/null
+++ b/app-containers/slirp4netns/slirp4netns-1.3.4.ebuild
@@ -0,0 +1,40 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=9
+
+inherit autotools
+
+DESCRIPTION="User-mode networking for unprivileged network namespaces"
+HOMEPAGE="https://github.com/rootless-containers/slirp4netns"
+SRC_URI="https://github.com/rootless-containers/slirp4netns/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64 ~ppc64 ~riscv"
+RESTRICT="test"
+
+DEPEND="
+	dev-libs/glib:2=
+	net-libs/libslirp:=
+	sys-libs/libseccomp:=
+	sys-libs/libcap:=
+"
+RDEPEND="${DEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+src_prepare() {
+	default
+
+	# Respect AR variable for bug 722162.
+	sed -e 's|^AC_PROG_CC$|AC_DEFUN([AC_PROG_AR], [AC_CHECK_TOOL(AR, ar, :)])\nAC_PROG_AR\n\0|' \
+		-i configure.ac || die
+	eautoreconf
+}
+
+pkg_postinst() {
+	if [[ -z ${REPLACING_VERSIONS} ]]; then
+		elog "You need to have the tun kernel module loaded in order to have"
+		elog "slirp4netns working"
+	fi
+}
diff --git a/app-containers/snapd/Manifest b/app-containers/snapd/Manifest
new file mode 100644
index 000000000000..70b0dfc56188
--- /dev/null
+++ b/app-containers/snapd/Manifest
@@ -0,0 +1,2 @@
+DIST snapd-2.63-bug-933073-GNU_SOURCE.patch 870 BLAKE2B acc2a9ec7ca16849736701b37e51f238be5700cf0cd40dac6493f126a48235ffc1f103096d546313d05a2262f8bdb6f84966cbb79c4cf3f5c1cdf4dfd5dc231e SHA512 5e4018d1972e18496666cf60c6e132f8655d8f0f4d6f8a77f9a7e5d2063b823f97a17bf26b562e6ab93ea32f081a90df6969a617e77114f37553a350f44f11fb
+DIST snapd-2.63.tar.xz 7502152 BLAKE2B 8ae38699227b7f0e6b512526fc8857b3e50ed220ac95860c372ca0a4b26f5a034bd9309688217696444254e41cc70fe3a45c0bf026c84e5f950e7df8aebd47a0 SHA512 956ee142ab6cb5de522307f7844819c861b2831e22dab56f7bfca16ff7f947093f8a8727d49370cc000ed71f3af9c57cff9c4be93ebf199e8c631a152a68ec5b
diff --git a/app-containers/snapd/files/README.gentoo b/app-containers/snapd/files/README.gentoo
new file mode 100644
index 000000000000..f2e34601802e
--- /dev/null
+++ b/app-containers/snapd/files/README.gentoo
@@ -0,0 +1,56 @@
+*Security Alert*
+
+Application confinement may be automatically disabled if snapd
+fails to detect the required features. If you would like to disable
+this automatic behavior, causing snapd to panic if its confinement
+feature detection fails, then use this setting in package.use:
+
+    app-emulation/snapd -forced-devmode
+
+Use this command to enable the snapd service:
+
+	systemctl enable snapd.socket
+
+You can source /etc/profile.d/snapd.sh in your shell in order to
+update PATH and XDG_DATA_DIRS environment variables to include
+installed snaps.
+
+Once you have snapd running (first refer to the *AppArmor Section*
+below if you have that enabled), see the snap-store installation
+instructions here:
+
+	https://snapcraft.io/docs/installing-snap-store-app
+
+If snap-store does not work correctly then it may be due to a temporary
+service outage which will hopefully be reported on this page:
+
+	https://status.snapcraft.io/
+
+When snap-store is not working due to a service outage, it may still
+be possible to install apps via the snap cli. See snap --help for
+details. Many apps can be installed without a snap store (Ubuntu One)
+account. The snap login, logout, and whoami subcommands are available
+to manage snap store account details.
+
+Note that you will need a polkit authentication agent running in
+order to authenticate as root when installing snaps as a non-root user.
+The agent is typically started by a desktop entry found in
+/etc/xdg/autostart such as one of these:
+
+	polkit-gnome-authentication-agent-1.desktop
+	polkit-kde-authentication-agent-1.desktop
+
+*AppArmor Section*
+
+When apparmor is enabled you should enable these services:
+
+	systemctl enable apparmor.service snapd.apparmor.service
+
+You also need it enabled in your kernel and you may need to add these
+kernel parameters to your boot loader configuration:
+
+	apparmor=1 security=apparmor
+
+Refer here for more information about apparmor:
+
+	https://wiki.gentoo.org/wiki/AppArmor
diff --git a/app-containers/snapd/metadata.xml b/app-containers/snapd/metadata.xml
new file mode 100644
index 000000000000..10d86172f9f6
--- /dev/null
+++ b/app-containers/snapd/metadata.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zmedico@gentoo.org</email>
+    <name>Zac Medico</name>
+  </maintainer>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:canonical:snapd</remote-id>
+  </upstream>
+  <use>
+    <flag name="forced-devmode">
+			Automatically disable application confinement if feature detection fails.
+		</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/snapd/snapd-2.63.ebuild b/app-containers/snapd/snapd-2.63.ebuild
new file mode 100644
index 000000000000..6da4ee8c69a5
--- /dev/null
+++ b/app-containers/snapd/snapd-2.63.ebuild
@@ -0,0 +1,181 @@
+# Copyright 2020-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools bash-completion-r1 flag-o-matic go-module linux-info readme.gentoo-r1 systemd tmpfiles xdg-utils
+
+DESCRIPTION="Service and tools for management of snap packages"
+HOMEPAGE="http://snapcraft.io/"
+
+SRC_URI="https://github.com/snapcore/snapd/releases/download/${PV}/snapd_${PV}.vendor.tar.xz -> ${P}.tar.xz"
+SRC_URI+=" https://github.com/snapcore/snapd/commit/1b035da5d873518ee4be31dacb1191c77ce0b644.patch -> ${P}-bug-933073-GNU_SOURCE.patch"
+PATCHES=("${DISTDIR}/${P}-bug-933073-GNU_SOURCE.patch")
+MY_PV=${PV}
+LICENSE="GPL-3 Apache-2.0 BSD BSD-2 LGPL-3-with-linking-exception MIT"
+SLOT="0"
+KEYWORDS="amd64"
+
+IUSE="apparmor +forced-devmode gtk kde systemd"
+REQUIRED_USE="!forced-devmode? ( apparmor ) systemd"
+
+CONFIG_CHECK="~CGROUPS
+		~CGROUP_DEVICE
+		~CGROUP_FREEZER
+		~NAMESPACES
+		~SQUASHFS
+		~SQUASHFS_ZLIB
+		~SQUASHFS_LZO
+		~SQUASHFS_XZ
+		~BLK_DEV_LOOP
+		~SECCOMP
+		~SECCOMP_FILTER"
+
+RDEPEND="
+	sys-libs/libseccomp:=
+	apparmor? (
+		sec-policy/apparmor-profiles
+		sys-apps/apparmor:=
+	)
+	dev-libs/glib
+	virtual/libudev
+	systemd? ( sys-apps/systemd )
+	sys-libs/libcap:=
+	sys-fs/squashfs-tools[lzma,lzo]"
+
+DEPEND="${RDEPEND}"
+
+BDEPEND="
+	>=dev-lang/go-1.9
+	dev-python/docutils
+	sys-devel/gettext
+	sys-fs/xfsprogs"
+
+PDEPEND="sys-auth/polkit[gtk?,kde?]"
+
+README_GENTOO_SUFFIX=""
+
+pkg_setup() {
+	if use apparmor; then
+		CONFIG_CHECK+=" ~SECURITY_APPARMOR"
+	fi
+	linux-info_pkg_setup
+
+	# Seems to have issues building with -O3, switch to -O2
+	replace-flags -O3 -O2
+}
+
+src_prepare() {
+	default
+	# Update apparmor profile to allow libtinfow.so*
+	sed -i 's/libtinfo/libtinfo{,w}/' \
+		"cmd/snap-confine/snap-confine.apparmor.in" || die
+
+	if ! use forced-devmode; then
+		sed -e 's#return !apparmorFull#if !apparmorFull {\n\t\tpanic("USE=forced-devmode is disabled")\n\t}\n\treturn false#' \
+			-i "sandbox/forcedevmode.go" || die
+		grep -q 'panic("USE=forced-devmode is disabled")' "sandbox/forcedevmode.go" || die "failed to disable forced-devmode"
+	fi
+
+	sed -i 's:command -v git >/dev/null:false:' -i "mkversion.sh" || die
+
+	./mkversion.sh "${PV}"
+	pushd "cmd" >/dev/null || die
+	eautoreconf
+}
+
+src_configure() {
+	SNAPD_MAKEARGS=(
+		"BINDIR=${EPREFIX}/usr/bin"
+		"DBUSSERVICESDIR=${EPREFIX}/usr/share/dbus-1/services"
+		"LIBEXECDIR=${EPREFIX}/usr/lib"
+		"SNAP_MOUNT_DIR=${EPREFIX}/var/lib/snapd/snap"
+		"SYSTEMDSYSTEMUNITDIR=$(systemd_get_systemunitdir)"
+	)
+	export CGO_ENABLED="1"
+	export CGO_CFLAGS="${CFLAGS}"
+	export CGO_CPPFLAGS="${CPPFLAGS}"
+	export CGO_CXXFLAGS="${CXXFLAGS}"
+
+	pushd "${S}/cmd" >/dev/null || die
+	econf --libdir="${EPREFIX}/usr/lib" \
+		--libexecdir="${EPREFIX}/usr/lib/snapd" \
+		$(use_enable apparmor) \
+		--enable-nvidia-biarch \
+		--with-snap-mount-dir="${EPREFIX}/var/lib/snapd/snap"
+}
+
+src_compile() {
+	export -n GOCACHE XDG_CACHE_HOME
+	export GOBIN="${S}/bin"
+
+	local file
+	for file in "${S}/po/"*.po; do
+		msgfmt "${file}" -o "${file%.po}.mo" || die
+	done
+
+	emake -C "${S}/data" "${SNAPD_MAKEARGS[@]}"
+
+	local -a flags=(-buildmode=pie -ldflags "-s -linkmode external -extldflags '${LDFLAGS}'" -trimpath)
+	local -a staticflags=(-buildmode=pie -ldflags "-s -linkmode external -extldflags '${LDFLAGS} -static'" -trimpath)
+
+	local cmd
+	for cmd in snap snapd snapd-apparmor snap-bootstrap snap-failure snap-preseed snap-recovery-chooser snap-repair snap-seccomp; do
+		go build ${GOFLAGS} -mod=vendor -o "${GOBIN}/${cmd}" "${flags[@]}" \
+		    -v -x "github.com/snapcore/${PN}/cmd/${cmd}"
+		[[ -e "${GOBIN}/${cmd}" ]] || die "failed to build ${cmd}"
+	done
+	for cmd in snapctl snap-exec snap-update-ns; do
+		go build ${GOFLAGS} -mod=vendor -o "${GOBIN}/${cmd}" "${staticflags[@]}" \
+		    -v -x "github.com/snapcore/${PN}/cmd/${cmd}"
+		[[ -e "${GOBIN}/${cmd}" ]] || die "failed to build ${cmd}"
+	done
+}
+
+src_install() {
+	emake -C "${S}/data" install "${SNAPD_MAKEARGS[@]}" DESTDIR="${D}"
+	emake -C "${S}/cmd" install "${SNAPD_MAKEARGS[@]}" DESTDIR="${D}"
+
+	if use apparmor; then
+		mv "${ED}/etc/apparmor.d/usr.lib.snapd.snap-confine"{,.real} || die
+		keepdir /var/lib/snapd/apparmor/profiles
+	fi
+	keepdir /var/lib/snapd/{apparmor/snap-confine,cache,cookie,snap,void}
+	fperms 700 /var/lib/snapd/{cache,cookie}
+
+	dobin "${GOBIN}/"{snap,snapctl}
+	ln "${ED}/usr/bin/snapctl" "${ED}/usr/lib/snapd/snapctl" || die
+
+	exeinto /usr/lib/snapd
+	doexe "${GOBIN}/"{snapd,snapd-apparmor,snap-bootstrap,snap-failure,snap-exec,snap-preseed,snap-recovery-chooser,snap-repair,snap-seccomp,snap-update-ns} \
+		"${S}/"{cmd/snap-discard-ns/snap-discard-ns,cmd/snap-gdb-shim/snap-gdb-shim,cmd/snap-mgmt/snap-mgmt} \
+		"${S}/data/completion/bash/"{complete.sh,etelpmoc.sh,}
+
+	dobashcomp "${S}/data/completion/bash/snap"
+
+	insinto /usr/share/zsh/site-functions
+	doins "${S}/data/completion/zsh/_snap"
+
+	insinto "/usr/share/polkit-1/actions"
+	doins "${S}/data/polkit/io.snapcraft.snapd.policy"
+
+	dodoc "${S}/packaging/ubuntu-16.04/changelog"
+	domo "${S}/po/"*.mo
+
+	readme.gentoo_create_doc
+}
+
+pkg_postinst() {
+	readme.gentoo_print_elog
+	xdg_desktop_database_update
+	tmpfiles_process snapd.conf
+
+	if use apparmor && [[ -z ${ROOT} && -e /sys/kernel/security/apparmor/profiles &&
+		$(wc -l < /sys/kernel/security/apparmor/profiles) -gt 0 ]]; then
+		apparmor_parser -r "${EPREFIX}/etc/apparmor.d/usr.lib.snapd.snap-confine.real"
+	fi
+}
+
+pkg_postrm() {
+	xdg_desktop_database_update
+}
diff --git a/app-containers/syft/Manifest b/app-containers/syft/Manifest
new file mode 100644
index 000000000000..917a175b7a60
--- /dev/null
+++ b/app-containers/syft/Manifest
@@ -0,0 +1,12 @@
+DIST syft-0.75.0-deps.tar.xz 449464772 BLAKE2B 60329a7054917079ea2ad683019933b5a5b02441f7ec6823f64b83fd5c353b7096a21113d91d3b9fc1ecaa0870ccef4ee39c60a250f193bef35e15ea1e1b5598 SHA512 1605a7dd830d648e48049bf918c67bbc542dc790c09097db52e578bb826c994ca0364cc42ae510a6411febd90e395715b8a5317e82d424481ae3b835fae98357
+DIST syft-0.75.0.tar.gz 5714462 BLAKE2B 4513fb5ce8c9b432d9042e31c13032428db7ae2b7637f25d391c572094706a1bcfa7dc971a96a8630b3d226504000c79219c0cbc6e1372558c6d08c3ff41dfa4 SHA512 4b8f7cc2823ace1fb2a57a5a989690967ac2b0caf2358dd61a85eca418050ff3fb8ea0409fa694754e595f85168f7f2b192fd407f651f48e05932a73b18fa379
+DIST syft-0.76.0-deps.tar.xz 457367140 BLAKE2B 8d05372361e6051b8102bec3b775eb00f9f24c5d6cddcee39d5d5b0a8f8db5260173d17aa3922b625885c1dddba42f2c2ecb6afe39b03c61a04a9a9577c4a9c6 SHA512 20f32db12c11a15eb323016fb0df09ec0ad823882344006fd30c4450e25feb9db17b8784581a01ed5a3fd68597ad05749082413c4196deff4b908af56c72b04e
+DIST syft-0.76.0.tar.gz 5726316 BLAKE2B debf5c9764994c616fceb7b69c42e87d6399ceb4b2f878935901f626256723177cc3e23b38f6dbce40a59c6586cb5589e82ed3c2a9811117486d9a1ced2f2260 SHA512 86f82455ff0d78864f56f2575bb2acb311ab658c23161b44f342242e88470948581097c2d928fae96ed01ad52843cb26d4682e22e5f81818a83a35cca1eff69e
+DIST syft-0.94.0-deps.tar.xz 502576092 BLAKE2B 35c13d34a7a4b2afafb9b73502f4258b379db737d9482d3f2fc8c0748cda67733e198df25237b6622e7450055f6681de7e7031cf0d5c0f7d422b268e64608da2 SHA512 1018cbd7e22b44ca8626747ddce2a4672b7f6e0ff359d30e36877ac00e093cea8709d6880093850afe107aef7333b6f928ababc1dbb3cb5741c466b95ac69268
+DIST syft-0.94.0.tar.gz 5266343 BLAKE2B 892c7bf90a1d15fd926207acd1a28e8bd907ae5869be763e48ccd8d3279975c2ec84d9ec5842e3799460a823b5aa611a028982d8d40d90248c1cfad25415c672 SHA512 171b23271f03e1e824dcac41a563f7947d004797a21e762eea883ea680e0de65a532e03e4b245a4021288fec60142da8c1c16d6520eadece65728728b9d15f91
+DIST syft-0.95.0-deps.tar.xz 525784260 BLAKE2B 8aa9da529a605725ecbcc4ec98bef651218ee7b1ed08564fae0911fc83f78a13f7773c8c6e7c12f0ecb4b979477e1ea1a89354c11de932ef2e0a45b1fb80ec10 SHA512 0571b3586d27d1cf76a6bfd4c3fd5c06f796bd94feea63303c8464c602ce91f94e4bdc0002eb7241ff967e4146ec2a91cce428ad495d89dfda078a968e43d63f
+DIST syft-0.95.0.tar.gz 5328311 BLAKE2B 555844c771dc57dd396f4016095a8e462b5088abf7d7dc2f77b14dcd98bd77fb58598c1011145ce001117ea3059cf93f2b4a1d2a7c01914cd1e5b855e79394cc SHA512 6509d7a505ff1adc37386bccfefb8ce106ff8c1ffe267ee768f731ef865c731dec3603c055d094363aae8b0ad6dd09547cb4b7e5a8d6993d7f8e09ef47f195c3
+DIST syft-1.18.1-deps.tar.xz 162627924 BLAKE2B c68a14ede812e6573f90d3e6ebeb3e60f26e3caa92d71f008d3706921f3f873d78305f3c24ede226ee67d1ac39ac3cc2412e6c03a3386a89ee7cfd75e7df80b1 SHA512 df2a1182200074ec0bd5be08340e3fdddc4ee76a857741359a2c0a2469b16dface84e1f3540fe3034dab89562a1adb8ba341d42521686d7566b8d81f39da9217
+DIST syft-1.18.1.tar.gz 5951602 BLAKE2B d73714c11143ca8f84e8b3167c4416417845af736a677369703d7aa334cfc69fb71bd0de05dc6cd21e5282e3df3c1548c8d1306c3311054c02266a19ece37d1e SHA512 05693eb5d13be1dc5682c91906027b67de881fb5513667f98d40302130a10bd082cc1c4df006cdd5d09968e3d77ec97d8cc620d0a816d325e3571f67e98b0143
+DIST syft-1.9.0-deps.tar.xz 207469280 BLAKE2B 38b428c8062f006586c0b7f1b8aeb2af09063d9f665a5a18c50dbe3848436cac80da2d2fd441a07d76787cb8e66d35fd322c7f9d1254662bf34fd29d05116e22 SHA512 34aa74de4befc2d097cb01e0ff3b37fd30cfca60b4d916f3fe7578848b6f2bb4ea263431adff7852b2b70dc9a4f7b50e75cfd58ee6ea3c604d03f7bde5ab10e6
+DIST syft-1.9.0.tar.gz 5825322 BLAKE2B e6b0808de2179a8956a1ba30138bcf11b0fead1c154a8d432cd852d6be2753075491c43f238943883d1c8080f7c24fc9a617daff4457aba6731831c619ff9223 SHA512 0a116accd3762fa6c43475b52c85d9a103423aa5f747b86209f128a2484b54e20d17d0dce7ec88c412e95f6685f8a47032bbfe812e6fceb39451cf1faa9e7fbb
diff --git a/app-containers/syft/metadata.xml b/app-containers/syft/metadata.xml
new file mode 100644
index 000000000000..17492b5107c4
--- /dev/null
+++ b/app-containers/syft/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/syft/syft-0.75.0.ebuild b/app-containers/syft/syft-0.75.0.ebuild
new file mode 100644
index 000000000000..1dc3782ce80c
--- /dev/null
+++ b/app-containers/syft/syft-0.75.0.ebuild
@@ -0,0 +1,34 @@
+# Copyright 2022-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module
+GIT_COMMIT=cc0a376aba43e7f9c5fe66320643f72088533838
+
+DESCRIPTION="Generate a Software Bill of Materials from container images and filesystems"
+HOMEPAGE="https://www.anchore.com"
+SRC_URI="https://github.com/anchore/syft/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+
+# tests require a running docker daemon
+RESTRICT="test"
+
+src_compile() {
+	local BUILD_DATE
+	BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+	ego build -o bin/syft -ldflags "
+		-extldflags '-static'
+		-X github.com/anchore/syft/internal/version.version=${PV}
+		-X github.com/anchore/syft/internal/version.gitCommit=${GIT_COMMIT}
+			-X github.com/anchore/syft/internal/version.buildDate=${BUILD_DATE}
+			-X github.com/anchore/syft/internal/version.gitDescription=v${PV}
+		" ./cmd/syft
+}
+
+src_install() {
+	dobin bin/*
+}
diff --git a/app-containers/syft/syft-0.76.0.ebuild b/app-containers/syft/syft-0.76.0.ebuild
new file mode 100644
index 000000000000..f2d767a1a229
--- /dev/null
+++ b/app-containers/syft/syft-0.76.0.ebuild
@@ -0,0 +1,34 @@
+# Copyright 2022-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module
+GIT_COMMIT=dfcc07e5122217ca9e2fc75817c593356fc0c405
+
+DESCRIPTION="Generate a Software Bill of Materials from container images and filesystems"
+HOMEPAGE="https://www.anchore.com"
+SRC_URI="https://github.com/anchore/syft/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+
+# tests require a running docker daemon
+RESTRICT="test"
+
+src_compile() {
+	local BUILD_DATE
+	BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+	ego build -o bin/syft -ldflags "
+		-extldflags '-static'
+		-X github.com/anchore/syft/internal/version.version=${PV}
+		-X github.com/anchore/syft/internal/version.gitCommit=${GIT_COMMIT}
+			-X github.com/anchore/syft/internal/version.buildDate=${BUILD_DATE}
+			-X github.com/anchore/syft/internal/version.gitDescription=v${PV}
+		" ./cmd/syft
+}
+
+src_install() {
+	dobin bin/*
+}
diff --git a/app-containers/syft/syft-0.94.0.ebuild b/app-containers/syft/syft-0.94.0.ebuild
new file mode 100644
index 000000000000..b5c24f11d18c
--- /dev/null
+++ b/app-containers/syft/syft-0.94.0.ebuild
@@ -0,0 +1,34 @@
+# Copyright 2022-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module
+GIT_COMMIT=8f6bdde6662aa8050a71eadbdb7bd5a3b079a56d
+
+DESCRIPTION="Generate a Software Bill of Materials from container images and filesystems"
+HOMEPAGE="https://www.anchore.com"
+SRC_URI="https://github.com/anchore/syft/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+
+# tests require a running docker daemon
+RESTRICT="test"
+
+src_compile() {
+	local BUILD_DATE
+	BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+	ego build -o bin/syft -ldflags "
+		-extldflags '-static'
+		-X github.com/anchore/syft/internal/version.version=${PV}
+		-X github.com/anchore/syft/internal/version.gitCommit=${GIT_COMMIT}
+			-X github.com/anchore/syft/internal/version.buildDate=${BUILD_DATE}
+			-X github.com/anchore/syft/internal/version.gitDescription=v${PV}
+		" ./cmd/syft
+}
+
+src_install() {
+	dobin bin/*
+}
diff --git a/app-containers/syft/syft-0.95.0.ebuild b/app-containers/syft/syft-0.95.0.ebuild
new file mode 100644
index 000000000000..a3a0542d8fa7
--- /dev/null
+++ b/app-containers/syft/syft-0.95.0.ebuild
@@ -0,0 +1,34 @@
+# Copyright 2022-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module
+GIT_COMMIT=9b98785aab9346999a0b5e9f5e4b4e63a1b1916c
+
+DESCRIPTION="Generate a Software Bill of Materials from container images and filesystems"
+HOMEPAGE="https://www.anchore.com"
+SRC_URI="https://github.com/anchore/syft/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+
+# tests require a running docker daemon
+RESTRICT="test"
+
+src_compile() {
+	local BUILD_DATE
+	BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+	ego build -o bin/syft -ldflags "
+		-extldflags '-static'
+		-X github.com/anchore/syft/internal/version.version=${PV}
+		-X github.com/anchore/syft/internal/version.gitCommit=${GIT_COMMIT}
+			-X github.com/anchore/syft/internal/version.buildDate=${BUILD_DATE}
+			-X github.com/anchore/syft/internal/version.gitDescription=v${PV}
+		" ./cmd/syft
+}
+
+src_install() {
+	dobin bin/*
+}
diff --git a/app-containers/syft/syft-1.18.1.ebuild b/app-containers/syft/syft-1.18.1.ebuild
new file mode 100644
index 000000000000..20e8cdef9dff
--- /dev/null
+++ b/app-containers/syft/syft-1.18.1.ebuild
@@ -0,0 +1,36 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module
+GIT_COMMIT=5e16e5031a13f8a11057feb8544decebfc43b4ed
+
+DESCRIPTION="Generate a Software Bill of Materials from container images and filesystems"
+HOMEPAGE="https://www.anchore.com"
+SRC_URI="https://github.com/anchore/syft/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+
+# tests require a running docker daemon
+RESTRICT="test"
+
+src_compile() {
+	local BUILD_DATE
+	BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+	ego build -o bin/syft -ldflags "
+		-extldflags '-static'
+		-X github.com/anchore/syft/internal/version.version=${PV}
+		-X github.com/anchore/syft/internal/version.gitCommit=${GIT_COMMIT}
+			-X github.com/anchore/syft/internal/version.buildDate=${BUILD_DATE}
+			-X github.com/anchore/syft/internal/version.gitDescription=v${PV}
+		" ./cmd/syft
+}
+
+src_install() {
+	dobin bin/*
+	insinto /usr/share/"${PN}"
+	doins -r examples
+}
diff --git a/app-containers/syft/syft-1.9.0.ebuild b/app-containers/syft/syft-1.9.0.ebuild
new file mode 100644
index 000000000000..da16f3691897
--- /dev/null
+++ b/app-containers/syft/syft-1.9.0.ebuild
@@ -0,0 +1,36 @@
+# Copyright 2022-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module
+GIT_COMMIT=4e09908ba124dca7e6f1f6e7dc4f4663fae658ca
+
+DESCRIPTION="Generate a Software Bill of Materials from container images and filesystems"
+HOMEPAGE="https://www.anchore.com"
+SRC_URI="https://github.com/anchore/syft/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+
+# tests require a running docker daemon
+RESTRICT="test"
+
+src_compile() {
+	local BUILD_DATE
+	BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+	ego build -o bin/syft -ldflags "
+		-extldflags '-static'
+		-X github.com/anchore/syft/internal/version.version=${PV}
+		-X github.com/anchore/syft/internal/version.gitCommit=${GIT_COMMIT}
+			-X github.com/anchore/syft/internal/version.buildDate=${BUILD_DATE}
+			-X github.com/anchore/syft/internal/version.gitDescription=v${PV}
+		" ./cmd/syft
+}
+
+src_install() {
+	dobin bin/*
+	insinto /usr/share/"${PN}"
+	doins -r examples
+}
diff --git a/app-containers/umoci/Manifest b/app-containers/umoci/Manifest
new file mode 100644
index 000000000000..40a41e8ab4a3
--- /dev/null
+++ b/app-containers/umoci/Manifest
@@ -0,0 +1 @@
+DIST umoci-0.4.7.tar.gz 2515579 BLAKE2B 595fdaf8b3e8c330a2966bdb70a4915964fa6b8823572b0bc7dfc797fce47771732cdf24514f3458833a048c155155920306838eab8654a547553897458d5013 SHA512 bb76c6c74766bc6558fa414b66a626194c60a9dee49aee050ad459590675bd79032b8e8c390439c0aa74c09abc921a6789fac57fc996ef958a376bc1c675d9fc
diff --git a/app-containers/umoci/metadata.xml b/app-containers/umoci/metadata.xml
new file mode 100644
index 000000000000..4b16d4cae759
--- /dev/null
+++ b/app-containers/umoci/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>williamh@gentoo.org</email>
+    <name>William Hubbs</name>
+  </maintainer>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:linuxfoundation:umoci</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-containers/umoci/umoci-0.4.7.ebuild b/app-containers/umoci/umoci-0.4.7.ebuild
new file mode 100644
index 000000000000..691522485c5b
--- /dev/null
+++ b/app-containers/umoci/umoci-0.4.7.ebuild
@@ -0,0 +1,37 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit edo go-module
+
+COMMIT=17f38511d61846e2fb8ec01a1532f3ef5525e71d
+
+DESCRIPTION="Manipulation tool for OCI images"
+HOMEPAGE="https://github.com/opencontainers/umoci"
+SRC_URI="https://github.com/opencontainers/umoci/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+RESTRICT="test"
+
+BDEPEND="dev-go/go-md2man"
+
+src_compile() {
+	ego build -buildmode=pie -mod=vendor \
+		-ldflags "-w -X main.gitCommit=${COMMIT} -X main.version=${PV}" \
+		-o "bin/${PN}" ./cmd/${PN}
+
+	cd doc/man || die
+	for f in *.1.md; do
+		edo go-md2man -in ${f} -out ${f%%.md}
+	done
+}
+
+src_install() {
+	dobin bin/${PN}
+	doman doc/man/*.1
+	local DOCS=( CHANGELOG.md README.md )
+	einstalldocs
+}
author	root <root@alpha.trunkmasters.com>	2026-06-12 19:09:37 -0500
committer	root <root@alpha.trunkmasters.com>	2026-06-12 19:09:37 -0500
commit	b590c8d7572b727d565cc0b8ff660d43569845de (patch)
tree	06f7a4102ea4e845df8b66660f252920d52952f9 /app-containers
parent	24f9cbfc4c34fdb6a6e03311674414e881ceab47 (diff)
download	baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.tar.gz baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.tar.xz baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.zip