Adding metadata

22 files changed, 668 insertions, 180 deletions

diff --git a/app-containers/containerd/Manifest b/app-containers/containerd/Manifest
index 29f0808de0f7..e36b92d58383 100644
--- a/app-containers/containerd/Manifest
+++ b/app-containers/containerd/Manifest
@@ -2,3 +2,4 @@ DIST containerd-2.2.5.tar.gz 10922595 BLAKE2B 2f6a4653d3b5dcb7a82e9255e7557d5e92
 DIST containerd-2.3.2.tar.gz 11653431 BLAKE2B eae465cfa0f2a3a4bb231dcf9e18b93e9644be6ff11fb04d712367a74adce5456a3f15811fcbb0c1f78ca9b5ae32077d8e8a476d09c7913ffab82fe23d00369d SHA512 2ce4744e0a93917fa45c2930c22853315577f217fe66d4761a96f4289241cdc930b52e8f646a28e0277747396f031964085c03885824a2f12dd6950ab651b348
 DIST containerd-2.3.3.tar.gz 11655312 BLAKE2B 9ddc68a0e6c0dd844e6f27a3df4e4e2c461ba1feb473f76b3da4f1d23a25bd6c159695d57a9775d8d638c2bd353a622eb8462124015f993008c763b7d2809473 SHA512 a2a8a30d5251b5d0f9be75f44972509e05ce2b206c3b488b8fb15828e44982aeec6c54cfb65ddc3309c974293496f77b096f0c2ee541b3ece8ef81f36abec6b8
 DIST containerd-2.3.4.tar.gz 11667896 BLAKE2B ad83ac029cefa3cb2dcc5989450cc00cfa51f0d9d8b08427da1bb09c59e2582df111cfe28356f31a52927aafe6a23e1caa88c6b2b9247b4c0241f6c97d6a1086 SHA512 cf8be1759399fb9e3b7c84d353a876b8f599b74fb3094a288333cf0b61a743b74484cbde7eab96576b214c92caf7de65ef94813bb3670e079585c371a438f6b4
+DIST containerd-2.3.5.tar.gz 11672104 BLAKE2B e2d39989c58f5b0c932421d4d18785917d8f96567bb9db692cc1974efd56e7437a9f5d414f13c8f948233a574447c305b86093b50b0e43d099ada8a32cec7134 SHA512 87255f36b2b2fb5fc2cb7abaadae33c2ea85b5f7a1259c8c52cc3cf3efffa64525886a220eadf804b7c6414babe7310d39fddc6a24e79b707770fb621323f5c8
diff --git a/app-containers/containerd/containerd-2.3.3.ebuild b/app-containers/containerd/containerd-2.3.3.ebuild
index 90c2b5437e51..d0148ad2ed40 100644
--- a/app-containers/containerd/containerd-2.3.3.ebuild
+++ b/app-containers/containerd/containerd-2.3.3.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
 IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
 # tests require root or docker
 RESTRICT="test"
diff --git a/app-containers/containerd/containerd-2.3.5.ebuild b/app-containers/containerd/containerd-2.3.5.ebuild
new file mode 100644
index 000000000000..42a8e3bb0e23
--- /dev/null
+++ b/app-containers/containerd/containerd-2.3.5.ebuild
@@ -0,0 +1,83 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module systemd toolchain-funcs
+
+GIT_REVISION=1294c24a7da8e5a793ed378161673abe94118892
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
+# tests require root or docker
+RESTRICT="test"
+
+DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="${DEPEND}
+	>=app-containers/runc-1.4.3[apparmor?,seccomp?]
+	selinux? ( sec-policy/selinux-docker )
+"
+BDEPEND="
+	dev-go/go-md2man
+	>=dev-lang/go-1.26.3
+	virtual/pkgconfig
+"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	local myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	emake "${myemakeargs[@]}" all
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	tc-env_build go-env_run emake "${myemakeargs[@]}" man -j1 #nowarn
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/app-containers/containerd/metadata.xml b/app-containers/containerd/metadata.xml
index 77f3298c0f5f..24de60446e15 100644
--- a/app-containers/containerd/metadata.xml
+++ b/app-containers/containerd/metadata.xml
@@ -12,6 +12,10 @@
     <email>williamh@gentoo.org</email>
     <name>William Hubbs</name>
   </maintainer>
+  <maintainer type="person">
+    <email>arthurzam@gentoo.org</email>
+    <name>Arthur Zamarin</name>
+  </maintainer>
   <use>
     <flag name="btrfs">Support for BTRFS snapshot driver</flag>
     <flag name="cri">Support for Kubernetes CRI</flag>
diff --git a/app-containers/cri-o/Manifest b/app-containers/cri-o/Manifest
index 31a11cdf1eaa..82f11be1b7fe 100644
--- a/app-containers/cri-o/Manifest
+++ b/app-containers/cri-o/Manifest
@@ -1 +1,2 @@
 DIST cri-o-1.36.1.tar.gz 21684722 BLAKE2B 5b60a98889f502068db449381fdce4d28cb7ce513fa95058fcf704709f3aac46dd07f74e252053208a82d40f577fb6c05b0e1ef296a237ea285121abb6044f72 SHA512 3ab9dd8c202a9d3048e6c6262b5390d10b3d04d0bc6c52e874b5742435c3ecdac45559f47747918d907c469cc81f0fd7ae2146128e5d0af15db0212395da431f
+DIST cri-o-1.36.5.tar.gz 21578714 BLAKE2B bf3e95c76869e029a7c14d0f44df54b7dba7ad3204d30becde7a8b591870c40a2c1715b5f65aa868dbab3c89b6612d267ab214b97719e74d58c5cc6b45106ede SHA512 846993f86eb08b14b8ff9b4194d0b56f579cf31d80c610c291e6eb9e083eac37ff13d1bf8f684c0ba18ba9a72261f2e714c2f08a47d07fa6039baae7fb80e801
diff --git a/app-containers/cri-o/cri-o-1.36.5.ebuild b/app-containers/cri-o/cri-o-1.36.5.ebuild
new file mode 100644
index 000000000000..44914c23aa33
--- /dev/null
+++ b/app-containers/cri-o/cri-o-1.36.5.ebuild
@@ -0,0 +1,100 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=9
+
+EGIT_COMMIT=dcd680fd83e792a9b625d38cc03c609722bd0baf
+
+inherit go-module
+
+DESCRIPTION="OCI-based implementation of Kubernetes Container Runtime Interface"
+HOMEPAGE="https://cri-o.io/"
+SRC_URI="https://github.com/cri-o/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+IUSE="btrfs +device-mapper selinux systemd"
+
+DEPEND="
+	app-crypt/gpgme:=
+	app-containers/conmon
+	>=app-containers/container-libs-0.68.0
+	app-containers/runc
+	dev-libs/glib:=
+	dev-libs/libassuan:=
+	dev-libs/libgpg-error:=
+	net-firewall/conntrack-tools
+	net-firewall/iptables
+	app-containers/cni-plugins
+	net-misc/socat
+	sys-apps/iproute2
+	sys-libs/libseccomp:=
+	btrfs? ( sys-fs/btrfs-progs )
+	device-mapper? ( sys-fs/lvm2:= )
+	selinux? ( sys-libs/libselinux:= )
+	systemd? ( sys-apps/systemd:= )
+"
+RDEPEND="${DEPEND}
+	!<app-containers/podman-1.3.2-r1
+	selinux? ( sec-policy/selinux-crio )
+"
+BDEPEND="
+	dev-go/go-md2man
+	>=dev-lang/go-1.26.4
+	sys-apps/which
+"
+
+src_prepare() {
+	default
+
+	echo ".NOTPARALLEL: binaries docs" >> Makefile || die
+
+	sed -e '/STRIP/d' -e 's/ -Werror / /' -i pinns/Makefile || die
+
+	sed -e 's:/usr/local/bin:/usr/bin:' \
+		-i contrib/systemd/* || die
+}
+
+src_compile() {
+	[[ -f hack/btrfs_installed_tag.sh ]] || die
+	use btrfs || { echo -e "#!/bin/sh\necho exclude_graphdriver_btrfs" > \
+		hack/btrfs_installed_tag.sh || die; }
+
+	[[ -f hack/selinux_tag.sh ]] || die
+	use selinux || { echo -e "#!/bin/sh\ntrue" > \
+		hack/selinux_tag.sh || die; }
+
+	mkdir -p bin || die
+	emake all \
+		GOBIN="${S}/bin" \
+		GO_BUILD="go build ${GOFLAGS}" \
+		BUILD_COMMIT="${EGIT_COMMIT}" \
+		SHRINKFLAGS="-w" \
+		GO_MD2MAN="$(which go-md2man)"
+}
+
+src_install() {
+	emake install install.config install.systemd \
+		DESTDIR="${D}" \
+		BUILD_COMMIT="${EGIT_COMMIT}" \
+		GO_MD2MAN="$(which go-md2man)" \
+		PREFIX="${D}${EPREFIX}/usr"
+	keepdir /etc/crio
+	mv "${ED}/etc/crio/crio.conf"{,.example} || die
+
+	newinitd "${FILESDIR}/crio.initd" crio
+
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}/${PN}.logrotated" "${PN}"
+
+	# Suppress crio log error messages triggered if these don't exist.
+	keepdir /etc/containers/oci/hooks.d
+	keepdir /usr/share/containers/oci/hooks.d
+
+	# Suppress crio "Missing CNI default network" log message.
+	keepdir /etc/cni/net.d
+	insinto /etc/cni/net.d
+	doins contrib/cni/99-loopback.conflist
+	dosym -r /usr/share/containers/policy.json /etc/containers/policy.json #979676
+}
diff --git a/app-containers/cri-tools/Manifest b/app-containers/cri-tools/Manifest
index b036db60590a..26e7763daed0 100644
--- a/app-containers/cri-tools/Manifest
+++ b/app-containers/cri-tools/Manifest
@@ -1,3 +1,4 @@
 DIST cri-tools-1.33.0.tar.gz 7754304 BLAKE2B 42011726997a07842fd3c9769335a71e37e1689e443a0d1a99916b5729cc22092593928a6b94bbc3718a0e5f89f3818c3b6d6155970de21e8eee30fc979a294d SHA512 0252243147e32e06328c192f77397461a729aec621bee92083dcf3899e9ffbb62386a944795535cc4a0deb5c88d1017082db8bf221f6627feb7dcd100dc70457
 DIST cri-tools-1.35.0.tar.gz 8074824 BLAKE2B a91dcfc326857e0dc43867189f0c2fac2a12ce112a4439eba61cfe655fba1dec455a3070bd5068cf4934487bf94255cd60197c3f7fd4aa20465ebb1bd4f63b7c SHA512 ea34e736b457f851b610e8091ebbb608ac0f790c80156ad3e1a7080c76df4ea759091300b7ee6b5812a42ec93e165d71b6fa06f12424f46b4b181f5059b100bb
 DIST cri-tools-1.36.0.tar.gz 7432869 BLAKE2B 57711c75ee1f54a99e087afa67d20e9b1f0a38e9a5da5e5c85724e84a95cb4d0b32b0e0b2ffa6d8aad60218684fe95d6445b6b57f253447cc7c09ddca43a5835 SHA512 5daa05ad977c85c5656c0fd1a6d4dd0b4596bf9d05038229fa522941e51793fff4272bb7c403b6bff6b6dde80d6f45f161e979861547bf5fb91095a096726967
+DIST cri-tools-1.37.0.tar.gz 7960600 BLAKE2B 9c69a27d3af6a6afcbe77b1af8f3af2200d363c91c60fc3387ceefd5b8e156d2bd5ebba38d606b2fef7861a34c3f1f14616f9237e31aa730ea28c301f1c24bf5 SHA512 1895be8ba45d3c8f2e5189b795eb61139957c001e0b760a610163bd3aa8260c187a1a2ffe5cd182f88d7379a5875cf357b839e95604a03d5eb29ff1667731370
diff --git a/app-containers/cri-tools/cri-tools-1.36.0.ebuild b/app-containers/cri-tools/cri-tools-1.36.0.ebuild
index 70c8c7c98277..2320edcfdf0c 100644
--- a/app-containers/cri-tools/cri-tools-1.36.0.ebuild
+++ b/app-containers/cri-tools/cri-tools-1.36.0.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/kubernetes-sigs/cri-tools/archive/v${PV}.tar.gz -> $
 
 LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
 SLOT="0"
-KEYWORDS="~amd64 ~arm64"
+KEYWORDS="amd64 ~arm64"
 RESTRICT="test"
 
 BDEPEND=">=dev-lang/go-1.26.2"
diff --git a/app-containers/cri-tools/cri-tools-1.37.0.ebuild b/app-containers/cri-tools/cri-tools-1.37.0.ebuild
new file mode 100644
index 000000000000..d6de12e86371
--- /dev/null
+++ b/app-containers/cri-tools/cri-tools-1.37.0.ebuild
@@ -0,0 +1,37 @@
+# Copyright 2021-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module shell-completion sysroot
+
+DESCRIPTION="CLI and validation tools for Kubelet Container Runtime (CRI)"
+HOMEPAGE="https://github.com/kubernetes-sigs/cri-tools"
+SRC_URI="https://github.com/kubernetes-sigs/cri-tools/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+RESTRICT="test"
+
+BDEPEND=">=dev-lang/go-1.26.6"
+
+DOCS=( docs {README,RELEASE,CHANGELOG,CONTRIBUTING}.md )
+
+src_compile() {
+	CRICTL="build/bin/${GOOS}/${GOARCH}/crictl"
+	emake VERSION="${PV}"
+
+	sysroot_try_run_prefixed "${CRICTL}" completion bash > crictl.bash || die
+	sysroot_try_run_prefixed "${CRICTL}" completion zsh > crictl.zsh || die
+	sysroot_try_run_prefixed "${CRICTL}" completion fish > crictl.fish || die
+}
+
+src_install() {
+	einstalldocs
+	dobin "${CRICTL}"
+
+	[[ -s crictl.bash ]] && newbashcomp crictl.bash crictl
+	[[ -s crictl.zsh ]] && newzshcomp crictl.zsh _crictl
+	[[ -s crictl.fish ]] && dofishcomp crictl.fish
+}
diff --git a/app-containers/docker-cli/docker-cli-29.7.2.ebuild b/app-containers/docker-cli/docker-cli-29.7.2.ebuild
index f87be5bce152..a58a8e2a74c4 100644
--- a/app-containers/docker-cli/docker-cli-29.7.2.ebuild
+++ b/app-containers/docker-cli/docker-cli-29.7.2.ebuild
@@ -16,7 +16,7 @@ S="${WORKDIR}/cli-${PV}"
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm arm64 ~loong ppc64 ~riscv ~x86"
 IUSE="selinux"
 
 RDEPEND="selinux? ( sec-policy/selinux-docker )"
diff --git a/app-containers/docker-compose/docker-compose-5.4.0.ebuild b/app-containers/docker-compose/docker-compose-5.4.0.ebuild
index 9d806b03aab0..20d47db8e2de 100644
--- a/app-containers/docker-compose/docker-compose-5.4.0.ebuild
+++ b/app-containers/docker-compose/docker-compose-5.4.0.ebuild
@@ -15,7 +15,7 @@ LICENSE="Apache-2.0"
 # Dependent licenses
 LICENSE+=" Apache-2.0 BSD BSD-2 MIT MPL-2.0"
 SLOT="2"
-KEYWORDS="~amd64 ~arm64"
+KEYWORDS="amd64 arm64"
 RESTRICT="test"
 
 RDEPEND="
diff --git a/app-containers/docker/docker-29.7.2.ebuild b/app-containers/docker/docker-29.7.2.ebuild
index 045910e450c0..cfc2ed2212d7 100644
--- a/app-containers/docker/docker-29.7.2.ebuild
+++ b/app-containers/docker/docker-29.7.2.ebuild
@@ -16,7 +16,7 @@ S="${WORKDIR}/moby-${PN}-v${PV}"
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
 IUSE="apparmor btrfs +container-init cuda +overlay2 seccomp selinux systemd"
 
 DEPEND="
diff --git a/app-containers/incus/incus-7.4.ebuild b/app-containers/incus/incus-7.4-r1.ebuild
index 6874100f2e65..7e113b04c86b 100644
--- a/app-containers/incus/incus-7.4.ebuild
+++ b/app-containers/incus/incus-7.4-r1.ebuild
@@ -40,7 +40,7 @@ RDEPEND="${DEPEND}
 	sys-apps/iproute2
 	sys-fs/fuse:*
 	>=sys-fs/lxcfs-5.0.0
-	sys-fs/squashfs-tools[lzma]
+	sys-fs/squashfs-tools[lzma,zstd]
 	virtual/acl
 	apparmor? ( sec-policy/apparmor-profiles )
 	qemu? (
diff --git a/app-containers/incus/incus-9999.ebuild b/app-containers/incus/incus-9999.ebuild
index 6874100f2e65..7e113b04c86b 100644
--- a/app-containers/incus/incus-9999.ebuild
+++ b/app-containers/incus/incus-9999.ebuild
@@ -40,7 +40,7 @@ RDEPEND="${DEPEND}
 	sys-apps/iproute2
 	sys-fs/fuse:*
 	>=sys-fs/lxcfs-5.0.0
-	sys-fs/squashfs-tools[lzma]
+	sys-fs/squashfs-tools[lzma,zstd]
 	virtual/acl
 	apparmor? ( sec-policy/apparmor-profiles )
 	qemu? (
diff --git a/app-containers/lxc/files/lxc-7.0.0-glibc-2.43-const-fix.patch b/app-containers/lxc/files/lxc-7.0.0-glibc-2.43-const-fix.patch
new file mode 100644
index 000000000000..0da98e6ce3ec
--- /dev/null
+++ b/app-containers/lxc/files/lxc-7.0.0-glibc-2.43-const-fix.patch
@@ -0,0 +1,134 @@
+https://bugs.gentoo.org/972401
+https://github.com/lxc/lxc/issues/4710
+https://github.com/lxc/lxc/pull/4711
+https://github.com/lxc/lxc/commit/c2809b067bbd5c63f0f78a5acd6f7af4e77e584c
+
+From c2809b067bbd5c63f0f78a5acd6f7af4e77e584c Mon Sep 17 00:00:00 2001
+From: Adrian Ratiu <adrian.ratiu@collabora.com>
+Date: Sat, 18 Jul 2026 23:11:52 +0300
+Subject: [PATCH] tree-wide: fix const-correctness issues exposed by glibc 2.43
+
+glibc 2.43 implements strchr(3), strrchr(3) and strstr(3) as
+C23-style _Generic macros which propagate the const qualifier
+of the input string to the return type.
+
+For example, a 'const char *' input now produces 'const char *'
+output types and vice-versa (non-const -> non-const).
+
+Building with clang and -Werror=incompatible-pointer-types fails:
+
+  src/lxc/confile.c:2690:4: error: assigning to 'char *' from
+      'const char *' discards qualifiers
+      [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
+
+Constify the result pointers where they are only read. Where the
+code intentionally writes through the result into caller-owned
+writable storage, drop the bogus const from the parameter instead
+of casting it away: update_hwaddr() (and thus its caller
+append_unexp_config_line()) modify the string in-place via
+rand_complete_hwaddr(), so 'char *' is the honest type. The two
+call sites already pass writable buffers (a strdup()'d line and an
+internally built one), so no cast is needed.
+
+The one remaining cast is in cgroup1-only pam_cgfs code
+(cgv1_handle_cpuset_hierarchy) where the writable buffer is passed
+down through a const 'cgroup' parameter; that hierarchy is slated
+for removal, so the minimal cast is kept there.
+
+This is just a build fix, the runtime behavior is unchanged.
+
+Fixes: #4710
+Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com>
+--- a/src/lxc/confile.c
++++ b/src/lxc/confile.c
+@@ -2675,7 +2675,7 @@ static int set_config_console_size(const char *key, const char *value,
+  * lxc.include.
+  * 'x' and 'X' are substituted in-place.
+  */
+-static void update_hwaddr(const char *line)
++static void update_hwaddr(char *line)
+ {
+ 	char *p;
+ 
+@@ -2701,7 +2701,7 @@ static void update_hwaddr(const char *line)
+ 	rand_complete_hwaddr(p);
+ }
+ 
+-int append_unexp_config_line(const char *line, struct lxc_conf *conf)
++int append_unexp_config_line(char *line, struct lxc_conf *conf)
+ {
+ 	size_t linelen;
+ 	size_t len = conf->unexpanded_len;
+@@ -4213,7 +4213,7 @@ static int get_config_uts_name(const char *key, char *retv, int inlen,
+ static int get_config_hooks(const char *key, char *retv, int inlen,
+ 			    struct lxc_conf *c, void *data)
+ {
+-	char *subkey;
++	const char *subkey;
+ 	int len, fulllen = 0, found = -1;
+ 	struct string_entry *entry;
+ 	int i;
+--- a/src/lxc/confile.h
++++ b/src/lxc/confile.h
+@@ -75,7 +75,7 @@ __hidden extern int lxc_list_net(struct lxc_conf *c, const char *key, char *retv
+ 
+ __hidden extern int lxc_config_read(const char *file, struct lxc_conf *conf, bool from_include);
+ 
+-__hidden extern int append_unexp_config_line(const char *line, struct lxc_conf *conf);
++__hidden extern int append_unexp_config_line(char *line, struct lxc_conf *conf);
+ 
+ extern int lxc_config_define_add(struct lxc_list *defines, char *arg);
+ 
+--- a/src/lxc/confile_utils.c
++++ b/src/lxc/confile_utils.c
+@@ -903,7 +903,7 @@ int lxc_inherit_namespace(const char *nsfd_path, const char *lxcpath,
+ {
+ 	__do_free char *dup = NULL;
+ 	int fd, pid;
+-	char *lastslash;
++	const char *lastslash;
+ 
+ 	if (nsfd_path[0] == '/') {
+ 		return open(nsfd_path, O_RDONLY | O_CLOEXEC);
+--- a/src/lxc/pam/pam_cgfs.c
++++ b/src/lxc/pam/pam_cgfs.c
+@@ -362,7 +362,7 @@ static char *copy_to_eol(char *s)
+ /* Check if given entry under /proc/<pid>/mountinfo is a fuse.lxcfs mount. */
+ static bool is_lxcfs(const char *line)
+ {
+-	char *p = strstr(line, " - ");
++	const char *p = strstr(line, " - ");
+ 	if (!p)
+ 		return false;
+ 
+@@ -1914,7 +1914,7 @@ static bool cgv1_handle_cpuset_hierarchy(struct cgv1_hierarchy *h,
+ 
+ 	if (*cgroup == '/')
+ 		cgroup++;
+-	slash = strchr(cgroup, '/');
++	slash = (char *)strchr(cgroup, '/');
+ 	if (slash)
+ 		*slash = '\0';
+ 
+--- a/src/lxc/storage/nbd.c
++++ b/src/lxc/storage/nbd.c
+@@ -291,7 +291,7 @@ static void nbd_detach(const char *path)
+  */
+ static int nbd_get_partition(const char *src)
+ {
+-	char *p = strchr(src, ':');
++	const char *p = strchr(src, ':');
+ 	if (!p)
+ 		return 0;
+ 
+--- a/src/lxc/storage/zfs.c
++++ b/src/lxc/storage/zfs.c
+@@ -461,7 +461,7 @@ int zfs_clonepaths(struct lxc_storage *orig, struct lxc_storage *new,
+ 			orig_src = cmd_output;
+ 		}
+ 
+-		tmp = strrchr(orig_src, '/');
++		tmp = (char *)strrchr(orig_src, '/');
+ 		if (!tmp) {
+ 			ERROR("Failed to detect \"/\" in \"%s\"", orig_src);
+ 			return -1;
diff --git a/app-containers/lxc/lxc-7.0.0-r1.ebuild b/app-containers/lxc/lxc-7.0.0-r1.ebuild
new file mode 100644
index 000000000000..9ccba4ca6e9c
--- /dev/null
+++ b/app-containers/lxc/lxc-7.0.0-r1.ebuild
@@ -0,0 +1,297 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit linux-info meson optfeature shell-completion systemd xdg-utils verify-sig
+
+DESCRIPTION="A userspace interface for the Linux kernel containment features"
+HOMEPAGE="https://linuxcontainers.org/ https://github.com/lxc/lxc"
+SRC_URI="https://linuxcontainers.org/downloads/lxc/${P}.tar.gz
+	verify-sig? ( https://linuxcontainers.org/downloads/lxc/${P}.tar.gz.asc )"
+
+LICENSE="GPL-2 LGPL-2.1 LGPL-3" # LGPL-2.1+ is listed, but it's covered by "LGPL-3"
+SLOT="0/1.700" # SONAME liblxc.so.1 + ${PV//./} _if_ breaking ABI change while bumping.
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor +caps doc examples io-uring landlock man pam seccomp selinux ssl systemd test test-install +tools"
+
+REQUIRED_USE="landlock? ( seccomp )"
+RESTRICT="!test? ( test )"
+
+RDEPEND="acct-group/lxc
+	acct-user/lxc
+	apparmor? ( sys-libs/libapparmor )
+	caps? ( sys-libs/libcap )
+	io-uring? ( >=sys-libs/liburing-2:= )
+	pam? ( sys-libs/pam )
+	seccomp? ( sys-libs/libseccomp )
+	selinux? ( sys-libs/libselinux )
+	ssl? ( dev-libs/openssl:0= )
+	systemd? (
+		sys-apps/dbus
+		sys-apps/systemd:=
+	)
+	tools? ( sys-libs/libcap )"
+DEPEND="${RDEPEND}
+	caps? ( sys-libs/libcap[static-libs] )
+	tools? ( sys-libs/libcap[static-libs] )
+	sys-kernel/linux-headers"
+BDEPEND="virtual/pkgconfig
+	doc? ( app-text/doxygen )
+	man? ( app-text/docbook2X )
+	verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
+
+CONFIG_CHECK="~!NETPRIO_CGROUP
+	~CGROUPS
+	~CGROUP_CPUACCT
+	~CGROUP_DEVICE
+	~CGROUP_FREEZER
+
+	~CGROUP_SCHED
+	~CPUSETS
+	~IPC_NS
+	~MACVLAN
+
+	~MEMCG
+	~NAMESPACES
+	~NET_NS
+	~PID_NS
+
+	~POSIX_MQUEUE
+	~USER_NS
+	~UTS_NS
+	~VETH"
+
+ERROR_CGROUP_FREEZER="CONFIG_CGROUP_FREEZER: needed to freeze containers"
+ERROR_MACVLAN="CONFIG_MACVLAN: needed for internal (inter-container) networking"
+ERROR_MEMCG="CONFIG_MEMCG: needed for memory resource control in containers"
+ERROR_NET_NS="CONFIG_NET_NS: needed for unshared network"
+ERROR_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: needed for lxc-execute command"
+ERROR_UTS_NS="CONFIG_UTS_NS: needed to unshare hostnames and uname info"
+ERROR_VETH="CONFIG_VETH: needed for internal (host-to-container) networking"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
+
+DOCS=( AUTHORS MAINTAINERS README.md doc/FAQ.txt )
+
+PATCHES=(
+	"${FILESDIR}"/lxc-7.0.0-glibc-2.43-const-fix.patch
+)
+
+pkg_setup() {
+	if use landlock ; then
+		WARNING_SECURITY_LANDLOCK="CONFIG_SECURITY_LANDLOCK: needed with landlock"
+	fi
+	linux-info_pkg_setup
+}
+
+src_configure() {
+
+	# -Dtools-multicall=false: will create a single binary called 'lxc' that conflicts with LXD.
+	local emesonargs=(
+		--localstatedir "${EPREFIX}/var"
+
+		-Dcoverity-build=false
+		-Dinstall-state-dirs=false
+		-Doss-fuzz=false
+		-Dspecfile=false
+		-Dtools-multicall=false
+
+		-Dcommands=true
+		-Dinstall-init-files=true
+		-Dmemfd-rexec=true
+		-Dthread-safety=true
+
+		$(meson_use apparmor)
+		$(meson_use caps capabilities)
+		$(meson_use doc api-docs)
+		$(meson_use examples)
+		$(meson_use io-uring io-uring-event-loop)
+		$(meson_use landlock landlock-monitor)
+		$(meson_use man)
+		$(meson_use pam pam-cgroup)
+		$(meson_use seccomp)
+		$(meson_use selinux)
+		$(meson_use ssl openssl)
+		$(meson_use test-install tests)
+		$(meson_use $(usex test test test-install) tests)
+		$(meson_use tools)
+
+		$(usex systemd -Ddbus=true -Ddbus=false)
+		$(usex systemd -Dinit-script="systemd" -Dinit-script="openrc")
+
+		-Ddata-path=/var/lib/lxc
+		-Ddoc-path=/usr/share/doc/${PF}
+		-Dlog-path=/var/log/lxc
+		-Drootfs-mount-path=/var/lib/lxc/rootfs
+		-Druntime-path=/run
+	)
+
+	use tools && local emesonargs+=( -Dcapabilities=true )
+
+	meson_src_configure
+}
+
+src_test() {
+	# tests not hooked into meson test
+	# See:
+	# https://github.com/lxc/lxc/blob/main/.github/workflows/tests.yml
+	# https://github.com/lxc/lxc-ci/blob/main/deps/lxc-exercise
+
+	local -a skip_tests=(
+		# problematic tests per upstream
+		lxc-test-concurrent
+		lxc-test-share-ns
+		# skipped by upstream for containers
+		lxc-test-apparmor
+		lxc-test-device-add-remove
+		lxc-test-reboot
+		lxc-test-unpriv
+		lxc-test-usernic
+		# Skips due to required arguments
+		lxc-test-may-control
+		# Required apt and messes with system users
+		lxc-test-usernic-2
+		# Tries to mount kernel module + snaps
+		lxc-test-snapdeps
+		# Unpriviledged containers need to touch uid mappings + root chown
+		lxc-test-autostart
+		lxc-test-cloneconfig
+		lxc-test-createconfig
+		lxc-test-cve-2019-5736
+		lxc-test-destroytest
+		lxc-test-exit-code
+		lxc-test-lxc-attach
+		lxc-test-no-new-privs
+		lxc-test-procsys
+		lxc-test-rootfs
+		# Wants to create a symlink in /var/lib
+		lxc-test-symlink
+		# Must run as root
+		lxc-test-checkpoint-restore
+		# failed to create container
+		lxc-test-clonetest
+		lxc-test-console-log
+		lxc-test-createtest
+		lxc-test-get_item
+		lxc-test-rootfs-options
+		lxc-test-shutdowntest
+		lxc-test-snapshot
+		lxc-test-sys-mixed
+		lxc-test-sysctls
+		# need allocated subuids, subgids
+		lxc-test-api-reboot
+		lxc-test-attach
+		lxc-test-capabilities
+		lxc-test-proc-pid
+		lxc-test-saveconfig
+		lxc-test-shortlived
+		lxc-test-startone
+		lxc-test-state-server
+		lxc-test-usernsexec
+		# failed to set config
+		lxc-test-parse-config-file
+		# failed to mount
+		lxc-test-mount-injection
+		# could not unshare mount namespace
+		lxc-test-utils
+		# filename not created
+		lxc-test-locktests
+		# config path needs to match
+		lxc-test-containertests
+		# wants a configured network interface
+		lxc-test-apparmor-mount
+	)
+	if use !apparmor; then
+		skip_tests+=(
+			lxc-test-apparmor-generated
+		)
+	fi
+
+	mkdir -p "${HOME}"/.config/lxc || die
+	touch "${HOME}"/.config/lxc/default.conf || die
+
+	# silence complaints about unset XDG_RUNTIME_DIR
+	xdg_environment_reset
+
+	local -a passes_tests=()
+	local -a failed_tests=()
+	local ret testfile
+	pushd "${BUILD_DIR}"/src/tests >/dev/null || die
+	for testfile in $(find . -maxdepth 1 -name "lxc-test-*" -type f); do
+		if [[ ${skip_tests[@]} =~ ${testfile#./} ]]; then
+			continue
+		fi
+		einfo "Running ${testfile}"
+		"${testfile}"
+		ret="${?}"
+		if [[ ${ret} == 0 ]]; then
+			einfo "${testfile} passed"
+			passed_tests+=( "${testfile#./}" )
+		else
+			eerror "${testfile} failed"
+			failed_tests+=( "${testfile#./}" )
+		fi
+	done
+	popd >/dev/null || die
+
+	einfo "Tests passed: ${passed_tests[@]}"
+	if [[ ${#failed_tests[@]} -gt 0 ]]; then
+		die "Tests failed: ${failed_tests[@]}"
+	fi
+}
+
+src_install() {
+	if use doc ; then
+		local HTML_DOCS=( "${BUILD_DIR}/html/"* )
+	fi
+	meson_src_install
+
+	# The main bash-completion file will collide with lxd, need to relocate and update symlinks.
+	local lxcbashcompdir="${D}/$(get_bashcompdir)"
+	mkdir -p "${lxcbashcompdir}" || die "Failed to create bashcompdir."
+	mv "${lxcbashcompdir}"/_lxc "${lxcbashcompdir}"/lxc-start || die "Failed to move _lxc bash completion file."
+
+	# Build system will install all bash completion files regardless of our 'tools' use flag.
+	# Though installing them all will add bash completions for commands that don't exist, it's
+	# cleaner than dealing with individual files based on the use flag status.
+	bashcomp_alias lxc-start lxc-{attach,autostart,cgroup,checkpoint,config,console,copy,create,destroy,device,execute,freeze,info,ls,monitor,snapshot,stop,top,unfreeze,unshare,update-config,usernsexec,wait}
+
+	find "${ED}" -name '*.la' -delete -o -name '*.a' -delete || die
+
+	# Replace upstream systemd files.
+	if use systemd ; then
+		rm -r "${D}$(systemd_get_systemunitdir)" || die "Failed to remove systemd lib dir"
+	else
+		# The openrc files aren't installed with correct permissions.
+		fperms 0755 /etc/init.d/lxc-{containers,net}
+	fi
+
+	newinitd "${FILESDIR}/${PN}.initd.9" ${PN}
+	systemd_newunit "${FILESDIR}"/lxc-monitord.service.5.0.0 lxc-monitord.service
+	systemd_newunit "${FILESDIR}"/lxc-net.service.5.0.0 lxc-net.service
+	systemd_newunit "${FILESDIR}"/lxc.service-5.0.0 lxc.service
+	systemd_newunit "${FILESDIR}"/lxc_at.service.5.0.0 "lxc@.service"
+
+	if ! use apparmor; then
+		sed -i '/lxc-apparmor-load/d' "${D}$(systemd_get_systemunitdir)/lxc.service" ||
+			die "Failed to remove apparmor references from lxc.service systemd unit."
+	fi
+
+	if use !test-install; then
+		find "${ED}"/usr/bin -name "lxc-test-*" -delete || die
+	fi
+}
+
+pkg_postinst() {
+	elog "Please refer to "
+	elog "https://wiki.gentoo.org/wiki/LXC for introduction and usage guide."
+	elog
+	elog "Run 'lxc-checkconfig' to see optional kernel features."
+	elog
+
+	optfeature "creating your own LXC containers" app-containers/distrobuilder
+	optfeature "automatic template scripts" app-containers/lxc-templates
+	optfeature "Debian-based distribution container image support" dev-util/debootstrap
+	optfeature "snapshot & restore functionality" sys-process/criu
+}
diff --git a/app-containers/nerdctl/Manifest b/app-containers/nerdctl/Manifest
index 803633071e88..1f2c6f10078d 100644
--- a/app-containers/nerdctl/Manifest
+++ b/app-containers/nerdctl/Manifest
@@ -1,12 +1,6 @@
-DIST nerdctl-2.0.2-go-mod-vendor.tar.gz 7348723 BLAKE2B 8f9b96193b45f2006ffaa205f2c265462ed759652163272e31ecbef76f6752adb2288a843902faa27b42e5d2215e44521101d7017e3a4c6cb78660e288c27fb6 SHA512 a8b587b502dfacc14bef9d70e7233c53561ce39ea3612794086951c022daba445e2a4d429f3f40686e9c55deaac05848f4e6646f59f1df166dc5efb61ec75a67
-DIST nerdctl-2.0.2.tar.gz 1328952 BLAKE2B 4ffa3cdf3e6c2ec2ee2ece0c214b3219f3a068c9d34cf17eff12660421219470b1309f701bcfadea6623e3a7693f9f2cf0c732f882e97866d6e75945176ce5a5 SHA512 bab4358279ba8edf119062b494bf1b393e22c8ee483aa16d502e6656ed56a9775e024bc1c30cbdc2185840fbb7d8a8d7da7e30a0f1905b5a436024472619d2c3
-DIST nerdctl-2.0.3-go-mod-vendor.tar.gz 7404790 BLAKE2B 5b28dc9b154d9709764941b000fa09ca83acd567db1d6ffce17e950fa095336bc7132ae8695af7fe12385c1b53c6d9571b04579bb9557e8c5ea943c6f31d0ba5 SHA512 bc0b09f8d132ffb7c9d497561a40ed83196f4c7c10135f85430f1a5c4684854976a27067ee8d64b0f73e3b482064d49e44c3724aee4c22f4d85049a26b2eb660
-DIST nerdctl-2.0.3.tar.gz 1345686 BLAKE2B bd9b2e1979931de5882d64fa51c094a532023f8c7be1f9b397dbb998d6bf428a6b9839d3682ce66ddddb8887e432027f8704d97e06ead2f4d870ef8e2cd9b1a9 SHA512 32467f3b75e443104d7b49c40bb27df72080ae6c40c9c085968b8f8e3d839095f2047c4fd1cff540bcb785639b79a0874f9a50a5af9feb2a690a7c22621ab98d
-DIST nerdctl-2.2.1-go-mod-vendor.tar.gz 8108003 BLAKE2B 73fe63c9af84829392cb356381c0f24c63946c6eb35a8bad4f150bb3c33116eca93ad00661dfbc7b08c0fa9494836ed0a7f21a2227bc851ae451c86ef9f3389d SHA512 59ca6e6d529f02496f0a4cd98ffb62e6b104104f1a7a3c79705a0f6e8bcc9ac2a1788ec7e20a004e8ccbcff987d42dbd4970ef74a145edec157c7b26025bb556
-DIST nerdctl-2.2.1.tar.gz 1521355 BLAKE2B 1399a5a0ef2ce6dd46ce289cc1ccb8f40c5f7530ae5da0f8155e89b6d858dcb8efdfeb5d10e6a10eb6e7ec66ce10b06e633a15879320bcbf59d0fcf20f2a7189 SHA512 2b25061c0673633e28e42cb082e1cd5d86a31127c83ff23621c742a05b7b3314fca51acf20cc4a45f00400624d17d52b480e6803e886f59ac92cf38470ba983a
-DIST nerdctl-2.3.1-go-mod-vendor.tar.gz 7460204 BLAKE2B 099df61da3ba0f41786dad0e626109202a70768762cfa4de4a83af8b85dad80e27a23a5a9c83cf821dc5dddecd3fac7a91510f26a2a84dcce3fe876b6dc1b730 SHA512 21da94fcd7742e618cf57b95a7873148d12650de06b21433dfe8785fcbfd0bc47a7c7d8131a26ec7f0c2381ad5f145e7a3c8b6713799e153dcc17a51aeeee27c
-DIST nerdctl-2.3.1.tar.gz 1550447 BLAKE2B 4fb82e89d0100134ebced289d4b638dfe37063b533613899d67a6a9c07d805d64eaca2b6056b10cbdbc53c3ae9166d1f90b1769de958b86db72170c66af8337b SHA512 862be6d25232f71b1f53729084ca0806b2021f0ce2faa98890b70185fbcb237682a01cfc46035930f5e3f9ec971e0640704fdf9c31738bfab2c7b4f5be5f4124
 DIST nerdctl-2.3.3-go-mod-vendor.tar.gz 7391465 BLAKE2B 5ad35c1d53a75ebed0dd2979941baf9c79adcde921293e86fa5e4d3d5419358154ac7454900a5ecfc562577aa140383c2a5f799f9e9617be5327e2c2e39fd85e SHA512 bbdc3ffb2c95ff0c9c7c79a49f9e52ac5879514afbc2d2fb67f393dd31c5300973dc66b349b29c5e76292b09dd6509cdad3bd212e7bd3eeafb063fc9e65b456f
 DIST nerdctl-2.3.3.tar.gz 1552038 BLAKE2B 3d45c42a43f2e200783f3463e00947c0f5169e7a9fb9df453c2ede5d67fad488241150f705a3f156e56411f376a9b406e3df6286732665cc8a148bf7e1764866 SHA512 d1ff0aa6865b11238ccbd250a1c16b3afb7cbd9aaa47169834a5751e78d1c83e746e7879bd2d9b0991feee8249419ebbaaf2edc8ba4d58b484b69afe594fce34
 DIST nerdctl-2.3.4-go-mod-vendor.tar.gz 7403796 BLAKE2B 24875c3982dcad5f11cec28c98f1a4173a9a8cdafae3f0fa35d7e9e710041bbf524aed27543ba0d3614db88cc228456b00a5f6be422322fda8549593292d0c6a SHA512 ec51be48de26b8a04adbdc2a2bf3b39d8a4dd5d0687a16c9617e5a5ba41d28bf0431c9bc339469b44a8afd2f5f44cdca600ff05548f47bdd8a4353fc3ff7ad4e
 DIST nerdctl-2.3.4.tar.gz 1558225 BLAKE2B 69cfa6f6c3de4dc4d9ac6f976408fad7798b181ef2dfa6b9118055aef4d1b802b0ca0b67d54b260994834de405be39098d7f83a364814d3e42d8bef4b04c5087 SHA512 22a0ed9ff6cffccfaf3786c8c1bb32103fb69608e4de2f8b6eb103fb5cda2cc23fbdfdbfcfa36757f395aa8e5758f52ebb82c3608448c823881e43e600063957
+DIST nerdctl-2.3.5-go-mod-vendor.tar.gz 7417080 BLAKE2B c13b7e0a29b25a4c04ed5774f30aa4507d7d83dde9ec3bc6356d8ef2ba73ce22d2dca4b498db5c17dc39d6a78f46410e2422e68db7d2a74379e776faa0c19f34 SHA512 250150f717a3a2020c8865a4e1ab12194d1509018562ae11946434bdba3e59567f748ab7abc516f659dea7d517d61cb36efd90c59f9ff36b481ceec5baf01f0c
+DIST nerdctl-2.3.5.tar.gz 1558562 BLAKE2B e2a98a76084999733fb4e7aa7421af0babe393db74ac0c4cc44c08fd9eb561bc3898452ab0bbb0d47612939a95b24e2d9a326aa4ac7db1f7483edeeffa1788ee SHA512 12fabf3b7b6d39e6dd331a35cd305d2c0996dbb85bf0ec6d5a3b4bfa516dfc7019ee6ff03403c0fd237b34d6b88bf329cf34dee3fe79ee292ad9eb026815395c
diff --git a/app-containers/nerdctl/metadata.xml b/app-containers/nerdctl/metadata.xml
index 0f6332c92f4b..591131b1265f 100644
--- a/app-containers/nerdctl/metadata.xml
+++ b/app-containers/nerdctl/metadata.xml
@@ -5,10 +5,5 @@
     <email>zmedico@gentoo.org</email>
     <name>Zac Medico</name>
   </maintainer>
-  <use>
-    <flag name="rootless">
-			Enables dependencies for running in rootless mode.
-		</flag>
-  </use>
   <origin>baldeagleos-repo</origin>
 </pkgmetadata>
diff --git a/app-containers/nerdctl/nerdctl-2.0.2.ebuild b/app-containers/nerdctl/nerdctl-2.0.2.ebuild
deleted file mode 100644
index bac4c17e9e5d..000000000000
--- a/app-containers/nerdctl/nerdctl-2.0.2.ebuild
+++ /dev/null
@@ -1,53 +0,0 @@
-# Copyright 2021-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit go-module
-
-EGIT_COMMIT="1220ce7ec2701d485a9b1beeea63dae3da134fb5"
-
-DESCRIPTION="Docker-compatible CLI for containerd, with support for Compose"
-HOMEPAGE="https://github.com/containerd/nerdctl"
-SRC_URI="
-	https://github.com/containerd/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz
-	https://github.com/containerd/${PN}/releases/download/v${PV}/${P}-go-mod-vendor.tar.gz
-"
-
-LICENSE="Apache-2.0"
-LICENSE+=" BSD BSD-2 ISC MIT"
-SLOT="0"
-KEYWORDS="~amd64"
-IUSE="rootless"
-
-DEPEND="
-	rootless? (
-		app-containers/slirp4netns
-		sys-apps/rootlesskit
-	)
-"
-RDEPEND="${DEPEND}"
-
-src_unpack() {
-	unpack "${P}.tar.gz"
-	cd "${S}"
-	unpack "${P}-go-mod-vendor.tar.gz"
-	mv home/runner/work/nerdctl/nerdctl/vendor . || die
-}
-
-src_compile() {
-	emake VERSION=v${PV} REVISION="${EGIT_COMMIT}"
-}
-
-src_install() {
-	local emake_args=(
-		DESTDIR="${D}"
-		VERSION=v${PV}
-		REVISION="${EGIT_COMMIT}"
-		DOCDIR="${EPREFIX}/usr/share/doc/${PF}"
-		PREFIX="${EPREFIX}/usr"
-	)
-	emake "${emake_args[@]}" install
-	local DOCS=( README.md docs/* examples )
-	einstalldocs
-}
diff --git a/app-containers/nerdctl/nerdctl-2.0.3.ebuild b/app-containers/nerdctl/nerdctl-2.0.3.ebuild
deleted file mode 100644
index 70f83edb1db6..000000000000
--- a/app-containers/nerdctl/nerdctl-2.0.3.ebuild
+++ /dev/null
@@ -1,53 +0,0 @@
-# Copyright 2021-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit go-module
-
-EGIT_COMMIT="1220ce7ec2701d485a9b1beeea63dae3da134fb5"
-
-DESCRIPTION="Docker-compatible CLI for containerd, with support for Compose"
-HOMEPAGE="https://github.com/containerd/nerdctl"
-SRC_URI="
-	https://github.com/containerd/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz
-	https://github.com/containerd/${PN}/releases/download/v${PV}/${P}-go-mod-vendor.tar.gz
-"
-
-LICENSE="Apache-2.0"
-LICENSE+=" BSD BSD-2 ISC MIT"
-SLOT="0"
-KEYWORDS="~amd64"
-IUSE="rootless"
-
-DEPEND="
-	rootless? (
-		app-containers/slirp4netns
-		sys-apps/rootlesskit
-	)
-"
-RDEPEND="${DEPEND}"
-
-src_unpack() {
-	unpack "${P}.tar.gz"
-	cd "${S}"
-	unpack "${P}-go-mod-vendor.tar.gz"
-	mv home/runner/work/nerdctl/nerdctl/vendor . || die
-}
-
-src_compile() {
-	emake VERSION=v${PV} REVISION="${EGIT_COMMIT}"
-}
-
-src_install() {
-	local emake_args=(
-		DESTDIR="${D}"
-		VERSION=v${PV}
-		REVISION="${EGIT_COMMIT}"
-		DOCDIR="${EPREFIX}/usr/share/doc/${PF}"
-		PREFIX="${EPREFIX}/usr"
-	)
-	emake "${emake_args[@]}" install
-	local DOCS=( README.md docs/* examples )
-	einstalldocs
-}
diff --git a/app-containers/nerdctl/nerdctl-2.2.1.ebuild b/app-containers/nerdctl/nerdctl-2.2.1.ebuild
deleted file mode 100644
index 08d6dc459fc2..000000000000
--- a/app-containers/nerdctl/nerdctl-2.2.1.ebuild
+++ /dev/null
@@ -1,53 +0,0 @@
-# Copyright 2021-2026 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit go-module
-
-EGIT_COMMIT="1220ce7ec2701d485a9b1beeea63dae3da134fb5"
-
-DESCRIPTION="Docker-compatible CLI for containerd, with support for Compose"
-HOMEPAGE="https://github.com/containerd/nerdctl"
-SRC_URI="
-	https://github.com/containerd/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz
-	https://github.com/containerd/${PN}/releases/download/v${PV}/${P}-go-mod-vendor.tar.gz
-"
-
-LICENSE="Apache-2.0"
-LICENSE+=" BSD BSD-2 ISC MIT"
-SLOT="0"
-KEYWORDS="~amd64"
-IUSE="rootless"
-
-DEPEND="
-	rootless? (
-		app-containers/slirp4netns
-		sys-apps/rootlesskit
-	)
-"
-RDEPEND="${DEPEND}"
-
-src_unpack() {
-	unpack "${P}.tar.gz"
-	cd "${S}"
-	unpack "${P}-go-mod-vendor.tar.gz"
-	mv home/runner/work/nerdctl/nerdctl/vendor . || die
-}
-
-src_compile() {
-	emake VERSION=v${PV} REVISION="${EGIT_COMMIT}"
-}
-
-src_install() {
-	local emake_args=(
-		DESTDIR="${D}"
-		VERSION=v${PV}
-		REVISION="${EGIT_COMMIT}"
-		DOCDIR="${EPREFIX}/usr/share/doc/${PF}"
-		PREFIX="${EPREFIX}/usr"
-	)
-	emake "${emake_args[@]}" install
-	local DOCS=( README.md docs/* examples )
-	einstalldocs
-}
diff --git a/app-containers/nerdctl/nerdctl-2.3.1.ebuild b/app-containers/nerdctl/nerdctl-2.3.5.ebuild
index 773e493c25ec..8c599415e76a 100644
--- a/app-containers/nerdctl/nerdctl-2.3.1.ebuild
+++ b/app-containers/nerdctl/nerdctl-2.3.5.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 inherit go-module optfeature shell-completion sysroot
 
-EGIT_COMMIT="04f63fe15f3f8d77fe41e56ab7ff1d1f3e312860"
+EGIT_COMMIT="347782c28efe1753d5cc9652f6304752ed431221"
 
 DESCRIPTION="Docker-compatible CLI for containerd, with support for Compose"
 HOMEPAGE="https://github.com/containerd/nerdctl"