gentoo auto-resync : 16:01:2025 - 06:41:40

12 files changed, 496 insertions, 145 deletions

diff --git a/app-containers/Manifest.gz b/app-containers/Manifest.gz
index 2bb2140ddd0e..6ed38303b291 100644
--- a/app-containers/Manifest.gz
+++ b/app-containers/Manifest.gz
diff --git a/app-containers/containerd/Manifest b/app-containers/containerd/Manifest
index 34a967d558e8..09485425200b 100644
--- a/app-containers/containerd/Manifest
+++ b/app-containers/containerd/Manifest
@@ -1,5 +1,7 @@
 AUX containerd.confd 124 BLAKE2B 25f72941a47374fa0de3a2dce3d8ca57420f013a0d7527e59697499490ed964b7606819c6d67b9eee1ac6691fa52a65750446d8e46ed9af708d946c24e86704b SHA512 66d891b0d2a541fee2017382ccbea6ea3f93d94c4ff15e1d8626ed84d3d7c0231b0939b2473804d41ac3ad2714267255347d1c671e1d99952d484a8b555948be
 AUX containerd.initd 794 BLAKE2B 88a1976615e4e9d67c10ed3748aadd74ae13ef4cf004bb5b5d45216275715e3acffa8c0c98309d81298795ac007bde02d2f3afd466c7c54e58012a12f156198f SHA512 f31b088e988beb84ef029992255018561417c0e92803dffe35ec481515e1be79ba4611cc139bb5000b0ac79a437f1a6dec3516d6f9580d4b384f1e0f092d8370
 DIST containerd-2.0.1.tar.gz 10423945 BLAKE2B 7f77678557bf649c71475d3ff08a57579b8959ef19a5f8fc1c27b8e8eacea01572d44d3f6dff1f53b72c1b7cf153413a5152391a78b0d5bd624a4c5267381144 SHA512 7875eee0fb274545acb4d62f5bca808105580177db6007e59164fd57830ea3e8ab646b8e227027016bf8dd4816341d38a620bfef48bb0fd83de006b1a91826b7
+DIST containerd-2.0.2.tar.gz 10379986 BLAKE2B aee39f749f056965b899f6525bebe00d46b72b6c437efbd01ed890c5ae9c5d812464bc6d10e32aea20fd0c6df00d98cd30502dd73f9a27b0d8d143a5542976d9 SHA512 86eb24acfa5d4d87ae396f8888e2484693823fad897a29f1a5ada78e2318640927cfcff1e85415bfd6c66f5417e582203eb94976d52e3dd373997e6e2cbae354
 EBUILD containerd-2.0.1.ebuild 2027 BLAKE2B a0a02d7e60d5673d03eac7eada811b7434e2ce58455b138e4cf6071a1d27681c0f1ae466d0eed112e97ba5f952dc5c4cda6e3cb4c471a2f6b42889b9695a85d4 SHA512 2e5806f163bdf790306dada370ce3d493a3dc62de3c72259b22fb07b6d9d9c4fa2a3301e0557b57fb04ba4927b936a75c7022f77d70ea133fa3d9778dac51c3b
+EBUILD containerd-2.0.2.ebuild 2030 BLAKE2B fa35e648ee9b73537ce24a20a6e6aee2c43ae87c42be3a19a5370f6da8284604db7b56b71f3ccbb7a74b8fc61c1fe91b79cb76aac32f632304dedc1a33454756 SHA512 b14cbb72f1d17ea33337f41a544a867650ccc494b0a1682af4c754f4a9fbd5aa70dc35d07058ff9e5042870f5adabded9b9c00bfbec0d1590409d730511b541d
 MISC metadata.xml 981 BLAKE2B 78f44dd46331f9159931ff289a5adfdc177cb5e0c1d12cf717fad4f227b15ae40f479f40554dc4855009342cb7d699aaa543a0fbcc962789fe100a1cc9b350c5 SHA512 a171a3fcd67d8b410148d3e99477ea69be7e84ba2a2d24739343bfde29b88f8f799530c3b1107829ebd52eb847b4f5c25e4d4701ea9a2bc196c761b0768906d1
diff --git a/app-containers/containerd/containerd-2.0.2.ebuild b/app-containers/containerd/containerd-2.0.2.ebuild
new file mode 100644
index 000000000000..37fb931e5186
--- /dev/null
+++ b/app-containers/containerd/containerd-2.0.2.ebuild
@@ -0,0 +1,90 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module systemd
+GIT_REVISION=c507a0257ea6462fbd6f5ba4f5c74facb04021f4
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri hardened +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.2.4[apparmor?,seccomp?]
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		-e "s/-mod=readonly//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	# we need to explicitly specify GOFLAGS for "go run" to use vendor source
+	emake "${myemakeargs[@]}" man -j1 #nowarn
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}
diff --git a/app-containers/containers-image/Manifest b/app-containers/containers-image/Manifest
index 29b8da3ec8c9..2bf02cf916e4 100644
--- a/app-containers/containers-image/Manifest
+++ b/app-containers/containers-image/Manifest
@@ -1,6 +1,4 @@
 AUX fix-warnings.patch 397 BLAKE2B a5922e061c825e25398fc3fccdf683abf8331b065337ff240227478d7d3ef5398957d56a430c0b04aa823033b56653e87c8186065e5898818e75310451b347e0 SHA512 a96ab3fea76be4751d6dc3893b4272b063c854503e1a65b4501819a5925f3911c285fbfb4ee6827795a41c696015cc06f446e4ddb1318e21cf0141e15804833e
-AUX moving-policy-json-default-yaml.patch 3285 BLAKE2B c0c9dd1380b6edec05162df127085ba74b7f426b00f7565bf4f14a2fe1809fe66fa13b19a84d84ae32dc3179ea0967aff8d8e24875ae706906f2427120fad801 SHA512 a3e8d2cbf3797e998636feaf963968b1e382ab1376b4d6a42bfa7187359e04d782aa043debd20f4ea2b1e4280d049029a71d8525a3fd2a87c780523eedcaf04f
-AUX prevent-downloading-mods-5.29.2.patch 322 BLAKE2B b3358abc9a9850a24153d188289068e3a8482a7b30e56b9440694ab78c04c37f10f5e3f31a24e82cbbe2f4c365d0df3dc5ccea1778df6dc9fe3dc12977169bf6 SHA512 1c78ae9dd35c7e8546984b32e149f29beaf955fe673264c0a3ea45b86046fa1628b5f74696f7224fcffbf54fc642d696848d0530beadf41be0084e4d77992a04
 DIST containers-image-5.30.0.tar.gz 719070 BLAKE2B 5952ab703b6df793f326dd4fc82f50c5f672e2b9d142e0bc706014092420e3563599d9f1c1f65f743e1a8144b91f92b2326d7bf4c3024b5efb466d777a8ad613 SHA512 89cd0d482bb5d70037ff51413b7abca01d36bc7f39e9dc130c78462e501dae32193137a367d81532afd216a7432e127728147e6e839d5d99eeb6b6680f31d4dc
 DIST containers-image-5.32.2.tar.gz 735422 BLAKE2B a0585c877b4679226d1760bf873ceeb5cba7f5177ab83fa6f8a161b1f3958f3d660445556b13b4221712c241cee94429cabdb1fd4186d4dc6edba7b032fce2bc SHA512 7498f9e446b2c205b033703641f7cfcb6c8bd8f097b12ef3f734c94772d63fc7b9b40a6700d53d93919d2c34772f079aa3cb7d9f9e5a130b6587f4fe2a558df6
 EBUILD containers-image-5.30.0.ebuild 876 BLAKE2B 33c68c540357f5741622eadc8d6052a9fe916aebc4b490048eb0fe567f339534e3c4905b6a0549a3a24c2ac84438e9f80fff77d185846489df015e8ac58b7433 SHA512 0cda4908a4dd9e1c369053bd62cd78cf06b9e3e3286d4935e1359e2688b3428bd278961a54a09ad0584e565764a95f4cf0ce9b3d3baf8ed66ff0405c8cf059a2
diff --git a/app-containers/containers-image/files/moving-policy-json-default-yaml.patch b/app-containers/containers-image/files/moving-policy-json-default-yaml.patch
deleted file mode 100644
index 1713839371a5..000000000000
--- a/app-containers/containers-image/files/moving-policy-json-default-yaml.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From 45441676e34e6410ae8af6dbb46b6161c5c81a7c Mon Sep 17 00:00:00 2001
-From: Rahil Bhimjiani <me@rahil.website>
-Date: Thu, 7 Dec 2023 14:12:26 +0530
-Subject: [PATCH] Moving policy.json and default.yaml from containers/skopeo
-
-It makes more sense to keep these 2 files along with their man
-pages...in c/image
-https://github.com/containers/common/pull/1757
-
-Signed-off-by: Rahil Bhimjiani <me@rahil.website>
----
- Makefile            | 11 +++++++++++
- default-policy.json | 14 ++++++++++++++
- default.yaml        | 27 +++++++++++++++++++++++++++
- 3 files changed, 52 insertions(+)
- create mode 100644 default-policy.json
- create mode 100644 default.yaml
-
-diff --git a/Makefile b/Makefile
-index f329ef083..5e9799b19 100644
---- a/Makefile
-+++ b/Makefile
-@@ -24,6 +24,13 @@ GOMD2MAN ?= $(shell command -v go-md2man || echo '$(GOBIN)/go-md2man')
- MANPAGES_MD = $(wildcard docs/*.5.md)
- MANPAGES ?= $(MANPAGES_MD:%.md=%)
- 
-+ifeq ($(shell uname -s),FreeBSD)
-+CONTAINERSCONFDIR ?= /usr/local/etc/containers
-+else
-+CONTAINERSCONFDIR ?= /etc/containers
-+endif
-+REGISTRIESDDIR ?= ${CONTAINERSCONFDIR}/registries.d
-+
- # N/B: This value is managed by Renovate, manual changes are
- # possible, as long as they don't disturb the formatting
- # (i.e. DO NOT ADD A 'v' prefix!)
-@@ -46,6 +53,10 @@ install-docs: docs
- 	install -m 644 docs/*.5 ${MANINSTALLDIR}/man5/
- 
- install: install-docs
-+	install -d -m 755 ${DESTDIR}${CONTAINERSCONFDIR}
-+	install -m 644 default-policy.json ${DESTDIR}${CONTAINERSCONFDIR}/policy.json
-+	install -d -m 755 ${DESTDIR}${REGISTRIESDDIR}
-+	install -m 644 default.yaml ${DESTDIR}${REGISTRIESDDIR}/default.yaml
- 
- cross:
- 	GOOS=windows $(MAKE) build BUILDTAGS="$(BUILDTAGS) $(BUILD_TAGS_WINDOWS_CROSS)"
-diff --git a/default-policy.json b/default-policy.json
-new file mode 100644
-index 000000000..dffc54a62
---- /dev/null
-+++ b/default-policy.json
-@@ -0,0 +1,14 @@
-+{
-+    "default": [
-+        {
-+            "type": "insecureAcceptAnything"
-+        }
-+    ],
-+    "transports":
-+        {
-+            "docker-daemon":
-+                {
-+                    "": [{"type":"insecureAcceptAnything"}]
-+                }
-+        }
-+}
-diff --git a/default.yaml b/default.yaml
-new file mode 100644
-index 000000000..9e892d760
---- /dev/null
-+++ b/default.yaml
-@@ -0,0 +1,27 @@
-+# This is a default registries.d configuration file.  You may
-+# add to this file or create additional files in registries.d/.
-+#
-+# lookaside: for reading/writing simple signing signatures
-+# lookaside-staging: for writing simple signing signatures, preferred over lookaside
-+#
-+# lookaside and lookaside-staging take a value of the following:
-+#   lookaside:  {schema}://location
-+#
-+# For reading signatures, schema may be http, https, or file.
-+# For writing signatures, schema may only be file.
-+
-+# The default locations are built-in, for both reading and writing:
-+# /var/lib/containers/sigstore for root, or
-+# ~/.local/share/containers/sigstore for non-root users.
-+default-docker:
-+#  lookaside: https://…
-+#  lookaside-staging: file:///…
-+
-+# The 'docker' indicator here is the start of the configuration
-+# for docker registries.
-+#
-+# docker:
-+#
-+#   privateregistry.com:
-+#    lookaside: https://privateregistry.com/sigstore/
-+#    lookaside-staging: /mnt/nfs/privateregistry/sigstore
diff --git a/app-containers/containers-image/files/prevent-downloading-mods-5.29.2.patch b/app-containers/containers-image/files/prevent-downloading-mods-5.29.2.patch
deleted file mode 100644
index 8d70156bfb6f..000000000000
--- a/app-containers/containers-image/files/prevent-downloading-mods-5.29.2.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/Makefile
-+++ b/Makefile
-@@ -15,7 +15,6 @@
- BUILDTAGS = btrfs_noversion libdm_no_deferred_remove
- BUILDFLAGS := -tags "$(BUILDTAGS)"
- 
--PACKAGES := $(shell GO111MODULE=on go list $(BUILDFLAGS) ./...)
- SOURCE_DIRS = $(shell echo $(PACKAGES) | awk 'BEGIN{FS="/"; RS=" "}{print $$4}' | uniq)
- 
- PREFIX ?= ${DESTDIR}/usr
diff --git a/app-containers/crun/Manifest b/app-containers/crun/Manifest
index cf7630ad7745..aaec6e70c803 100644
--- a/app-containers/crun/Manifest
+++ b/app-containers/crun/Manifest
@@ -1,4 +1,3 @@
-AUX crun-1.11.2-caps.patch 1149 BLAKE2B 241d7b26555d32d082e3c770a61b6c01285b4e3dcd9f54922c2fb38cc14581cf08c7b53f96d9e61b5a8f436725473df26008d04890c698cf23edbb60ae57d937 SHA512 73477342c4de8b28c02c7c2c57940e3800662a90d43849aeea90562582deccf06f2860cd41ba8ff9a45a0c68ce9aa751a9f19ad239b5d5f8009c0bf7e38b4d53
 DIST crun-1.14.3.tar.xz 750456 BLAKE2B 5a63b5da2f85ff1a83d4589be224c5b7a1123b6d7714b90a63c1907b78d42392aff25ffe5d9a4127173ac47026d57e9c93a39f5ba4b07de7f9f3722c14e6d203 SHA512 d6645c519ff00dda5def6d58240600d15e76969489918d51c0def2fee7dbad6374f83e5afc14a998d176aa2944765df5cd84c3031b265a1931ab23f2fc965fc1
 DIST crun-1.16.tar.gz 1759549 BLAKE2B 1dfdf9177ae52e627c92e70e48a558bb355c87f629e95f1debaf6b7d8c38802110bd796545d5b2dbe3cac7f8de1f9c94e9b5f046cc618e73afd4c434188d585c SHA512 718e17abdb8c2a9e1fdd39f09e7e3e435d88c5785cc13c1e67f492847d7d938cf399aecc055ecf88720fa8f73b8539f057e3b0e53f10f4e382f5664a2243b959
 DIST crun-1.17.tar.gz 1773153 BLAKE2B 9f75cb6879e0b8cd47bb8939c1cf6f88d5e13e6d8932c652ea20c64501bc69fbda84dd061866a9c08e353848f39d1022bf67fbc0d160d5ef7fdc08c1edec03f9 SHA512 7556467c5e0e93bb7321e2e88de8a2f537340e3e0acaa5501eab8deb0f4bb93c4561f8d063156789d3ee98fdd49069fc52c0ed0c773bd44db476eeeccc16aa1a
diff --git a/app-containers/crun/files/crun-1.11.2-caps.patch b/app-containers/crun/files/crun-1.11.2-caps.patch
deleted file mode 100644
index d32a4dd1a8f8..000000000000
--- a/app-containers/crun/files/crun-1.11.2-caps.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 767ba88ef363115e80e077ce312f89f20488da01 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Robert=20G=C3=BCnzler?= <r@gnzler.io>
-Date: Thu, 9 Nov 2023 14:16:08 +0100
-Subject: [PATCH] Fix build without libcap
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The work to support features introduced another point of dependency on
-libcap that previously wasn't guarded by ifdefs
-
-Refs: https://github.com/containers/crun/pull/1237
-Signed-off-by: Robert Günzler <r@gnzler.io>
----
- src/libcrun/container.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/libcrun/container.c b/src/libcrun/container.c
-index ed0fa29bb..7be1713ab 100644
---- a/src/libcrun/container.c
-+++ b/src/libcrun/container.c
-@@ -3925,8 +3925,10 @@ libcrun_container_get_features (libcrun_context_t *context, struct features_info
-   // Populate namespaces
-   populate_array_field (&((*info)->linux.namespaces), namespaces, num_namspaces);
- 
-+#ifdef HAVE_CAP
-   // Populate capabilities
-   populate_capabilities (*info, &capabilities, &num_capabilities);
-+#endif
- 
-   // Hardcode the values for cgroup
-   (*info)->linux.cgroup.v1 = true;
diff --git a/app-containers/docker-cli/Manifest b/app-containers/docker-cli/Manifest
index 300cb38e76b6..e95317e64a2d 100644
--- a/app-containers/docker-cli/Manifest
+++ b/app-containers/docker-cli/Manifest
@@ -1,4 +1,7 @@
 DIST docker-cli-27.4.1-man.tar.xz 70252 BLAKE2B 3fbefe359b39cfb7eda125830dc6c8e9e49685a833f7f46b111e9e7c0ed4d0009ab5a6ccdd27a97a1885453a7e43ae4f557c63f9201fc2604d0146f20f14763c SHA512 ddd7017fb0d5193e6f7b39e67f047edf3c98e86f299d0a7ab318efc3fb8b712a71ee5ac933ccf33945f846e2b20d2b1efc7fa9fcbd12f9a56b9d519bec4bcee1
 DIST docker-cli-27.4.1.tar.gz 7273057 BLAKE2B 3ebebe0e0918dd54d45c058c2922107fc2e82170c6e00540fde2c884c8f88945ceb5428fd5917014af5d35a554a0d9e83306d173ceea9c7461508b902f0023f8 SHA512 5880053d44e169b93fe50f3d4b13fa2f8f60de32a96f8ee2923a3291385532c1903027f0654a65a8eab51f29caf7b805857b491c0bfeee2e1983f822e579851e
+DIST docker-cli-27.5.0-man.tar.xz 70224 BLAKE2B 4c2a4025721fbfbb63c24e20bdbc68f3a8b2d355d57060a86190ea30ec4dc1e01eae1265a3de6077c3952e1c9d859c1c28c707caccf07260f6dabe8bf3ef5439 SHA512 4450669971503665ca644899a657c587e86edaf4462ef47bd49b09da961111e8bc27a61caf8a8dbf9a617427bb2ebf92ab8d7adb6c4f33001383e590b59cfff3
+DIST docker-cli-27.5.0.tar.gz 7462649 BLAKE2B 89ae65834c606d9ef4f8ebc9fee5052d3e12b8aa6d9f4df7c0415157b24a55e89d0758b4f5cf0e4f3f5b6ea2f9c46bfc010c604995cb5cf1d162c068ba679787 SHA512 3c7c709f38fffd4d4e134d2abd7e6dc606e1cba765d36924a53f9470d6077be2282983eb23995bd56d772da253a69a854fe3112fea1a7ed2c9a1b70d2cc45b57
 EBUILD docker-cli-27.4.1.ebuild 1832 BLAKE2B 6975315fa4240db27b3000c27aab79df8a91967325271848de92137514f6a5968e66643ded355623f1843919b6afd761c8f4fc52ee160641201e6021b268620f SHA512 baa43ace4afa141d34f4941819780a0bcb1634b70815120a4e44fab815cf451dffb55c84b93da6a3d5a01a8e025a55932bb89680fab5c1bb6234c6f543a940af
+EBUILD docker-cli-27.5.0.ebuild 1835 BLAKE2B 043a4ef5665847e6956cb2200bf4dea6ca6a2dd0cc2e506e620d58bdf7664faf01dc4f337d82b5065254964f292f13af8dfe20e0179eda4f80ad99aa89f09437 SHA512 4ad7316a4066bf0bd8dc7167aa8516279f62be7b5020c9bbb92b1332b45a16e293c675b16bdc7305968c575d0f11ca75bca06f98038db1553cc34bf1fc9f7817
 MISC metadata.xml 398 BLAKE2B f9cd5360fa32f30edeeb2fe1df0ea50fd0b061bf882c66c65f18d15ba56995deac8c054419ddbf2d6436bf90f6fb729dda9560b3766b558d45498ae2c8de486c SHA512 4b2cf7c3b38df8382680539e1a8121f6f2f75cbe70f1f92c589fb40dd4c368f2f207cf3567ead5620714c323c0c196c318a4c5ab947d49092668dc2a3a8a6a53
diff --git a/app-containers/docker-cli/docker-cli-27.5.0.ebuild b/app-containers/docker-cli/docker-cli-27.5.0.ebuild
new file mode 100644
index 000000000000..1ea57a7694f4
--- /dev/null
+++ b/app-containers/docker-cli/docker-cli-27.5.0.ebuild
@@ -0,0 +1,68 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit bash-completion-r1 go-module
+MY_PV=${PV/_/-}
+
+# update this on every bump
+GIT_COMMIT=a187fa5d2d0d5f12db920734e425afc758e98ead
+
+DESCRIPTION="the command line binary for docker"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/docker/cli/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-man.tar.xz"
+S="${WORKDIR}/cli-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+IUSE="hardened selinux"
+
+RDEPEND="selinux? ( sec-policy/selinux-docker )"
+
+RESTRICT="installsources strip test"
+
+src_unpack() {
+	default
+	cd "${S}"
+	ln -s vendor.mod go.mod
+	ln -s vendor.sum go.sum
+}
+
+src_prepare() {
+	default
+	sed -i 's@dockerd\?\.exe@@g' contrib/completion/bash/docker || die
+}
+
+src_compile() {
+	export DISABLE_WARN_OUTSIDE_CONTAINER=1
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+		emake \
+		LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')" \
+		VERSION="${PV}" \
+		GITCOMMIT="${GIT_COMMIT}" \
+		dynbinary
+}
+
+src_install() {
+	dobin build/docker
+	doman "${WORKDIR}"/man/man?/*
+	dobashcomp contrib/completion/bash/docker
+	bashcomp_alias docker dockerd
+	insinto /usr/share/fish/vendor_completions.d/
+	doins contrib/completion/fish/docker.fish
+	insinto /usr/share/zsh/site-functions
+	doins contrib/completion/zsh/_*
+}
+
+pkg_postinst() {
+	has_version "app-containers/docker-buildx" && return
+	ewarn "the 'docker build' command is deprecated and will be removed in a"
+	ewarn "future release. If you need this functionality, install"
+	ewarn "app-containers/docker-buildx."
+}
diff --git a/app-containers/docker/Manifest b/app-containers/docker/Manifest
index b1800222006c..6b46f22f14b9 100644
--- a/app-containers/docker/Manifest
+++ b/app-containers/docker/Manifest
@@ -1,3 +1,5 @@
 DIST docker-27.4.1.tar.gz 16837429 BLAKE2B da2e915944a0260619b1e036b43d40f5cbff66f07182153c0ae238ecbcecdfe2066473887882fdaaffa5ef29e2328211f1d07ba3a5239381f9e82d34d9da43fe SHA512 3d77708f7373c1b58b1c46428c2cfc9e8985076e494e40ab86709f37a686cf92b9e2c9db5aa34293f728bb7ccd6a7e08e0cbb1c6d20acfd025c4c787d5908dc0
+DIST docker-27.5.0.tar.gz 17076981 BLAKE2B 20dfdb9fb3d594520f063352c28ccc7a936ec2dc0cd6d04737c2d8c78c54db024ac33fc986ddf06cbe4f496b27bd6e63cc3a2532f3c36b83cf8f9eca0dbae3a2 SHA512 89245805edebd7d43d5b47a38aba115239c20448fc10bce5a1605f99951a303ba360456a54815ffc5346cdd97ddd08657df1881c97f79066e9e2bd075af542da
 EBUILD docker-27.4.1-r1.ebuild 7927 BLAKE2B 59c6bf3e2d95edc35089c4f03b2975903b239d2c63ee31da6f69438c0601bbb25957c1c0a478a1e22d53c76d7b75a426b9e02c53454c00d70b2a7eb6804a27ba SHA512 49b3b04edec78dc285a2f92ea42c9d1bffd95c8e049f602941d886229e22ea6f8f255915098b7b825a8005ca402bf1bd34489cd6b4c428e18064974d2a308c75
+EBUILD docker-27.5.0.ebuild 7930 BLAKE2B 9c72b8f58703a5b5d90e28952aaa1d3d55c366cf3bc94757a141a7c14e880afea5b39e8b63935651f46f88c1c9a0073fcd1e56f5a99de767363394eacf461ce5 SHA512 29f0f2b7d1d9d8d7b0100612801a5a005da2b13ec5d5d5a270e81d43eb0e56f72baef958490fd2fb7d75483def45397a8e36787491dad47092173eea5db8001b
 MISC metadata.xml 1102 BLAKE2B 948731b1e2f9474ab0067f2e88ad631152446bec327cfded22934da4ae8fe6c9572c382039c15cd845da9978d62fd5fb97fdb8a1bd66cf13c320f56668b07dfd SHA512 06fed86d03d7e1676583afd798bcf728e8866e8aa1f0daba61fbea1bd2f694d8ef370d68b3d72eff39c3df7e8d46469f16a07e15c8715b245e92eacc7444707f
diff --git a/app-containers/docker/docker-27.5.0.ebuild b/app-containers/docker/docker-27.5.0.ebuild
new file mode 100644
index 000000000000..852b70a8ce03
--- /dev/null
+++ b/app-containers/docker/docker-27.5.0.ebuild
@@ -0,0 +1,331 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+MY_PV=${PV/_/-}
+inherit go-module linux-info optfeature systemd toolchain-funcs udev
+GIT_COMMIT=38b84dce32c45732606fe09ffebef8b29a783644
+
+DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/moby-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs +container-init cuda +overlay2 seccomp selinux systemd"
+
+DEPEND="
+	acct-group/docker
+	>=dev-db/sqlite-3.7.9:3
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
+	seccomp? ( >=sys-libs/libseccomp-2.2.1 )
+	systemd? ( sys-apps/systemd )
+"
+
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
+RDEPEND="
+	${DEPEND}
+	>=net-firewall/iptables-1.4
+	sys-process/procps
+	>=dev-vcs/git-1.7
+	>=app-arch/xz-utils-4.9
+	>=app-containers/containerd-1.7.24[apparmor?,btrfs?,seccomp?]
+	>=app-containers/runc-1.2.2[apparmor?,seccomp?]
+	!app-containers/docker-proxy
+	!<app-containers/docker-cli-${PV}
+	container-init? ( >=sys-process/tini-0.19.0[static] )
+	cuda? ( app-containers/nvidia-container-toolkit )
+	selinux? ( sec-policy/selinux-docker )
+"
+
+# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+# tests require running dockerd as root and downloading containers
+RESTRICT="installsources strip test"
+
+# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
+pkg_setup() {
+	# this is based on "contrib/check-config.sh" from upstream's sources
+	# required features.
+	CONFIG_CHECK="
+		~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
+		~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
+		~KEYS
+		~VETH ~BRIDGE ~BRIDGE_NETFILTER
+		~IP_NF_FILTER ~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~NETFILTER_XT_MARK
+		~IP_NF_NAT ~NF_NAT
+		~POSIX_MQUEUE
+	"
+	WARNING_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: is required for bind-mounting /dev/mqueue into containers"
+
+	if kernel_is lt 4 8; then
+		CONFIG_CHECK+="
+			~DEVPTS_MULTIPLE_INSTANCES
+		"
+	fi
+
+	if kernel_is le 5 1; then
+		CONFIG_CHECK+="
+			~NF_NAT_IPV4
+		"
+	fi
+
+	if kernel_is le 5 2; then
+		CONFIG_CHECK+="
+			~NF_NAT_NEEDED
+		"
+	fi
+
+	if kernel_is ge 4 15; then
+		CONFIG_CHECK+="
+			~CGROUP_BPF
+		"
+	fi
+
+	# optional features
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	if use seccomp; then
+		CONFIG_CHECK+="
+			~SECCOMP ~SECCOMP_FILTER
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+			"
+	fi
+
+	if kernel_is le 5 8; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP_ENABLED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NATIVE
+		"
+	if kernel_is lt 5 19; then
+		CONFIG_CHECK+="
+			~LEGACY_VSYSCALL_EMULATE
+			"
+	fi
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NONE
+		"
+	WARNING_LEGACY_VSYSCALL_NONE="CONFIG_LEGACY_VSYSCALL_NONE enabled: \
+		Containers with <=glibc-2.13 will not work"
+
+	if kernel_is le 4 5; then
+		CONFIG_CHECK+="
+			~MEMCG_KMEM
+		"
+	fi
+
+	if kernel_is lt 5; then
+		CONFIG_CHECK+="
+			~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP ~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP ~CGROUP_NET_PRIO
+		~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		"
+
+	if use selinux; then
+		CONFIG_CHECK+="
+			~SECURITY_SELINUX
+			"
+	fi
+
+	if use apparmor; then
+		CONFIG_CHECK+="
+			~SECURITY_APPARMOR
+			"
+	fi
+
+	# if ! is_set EXT4_USE_FOR_EXT2; then
+	#	check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
+	#	if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
+	#		echo "    $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
+	#	fi
+	# fi
+
+	CONFIG_CHECK+="
+		~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
+	"
+
+	# if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
+	#	if is_set EXT4_USE_FOR_EXT2; then
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
+	#	else
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
+	#	fi
+	# fi
+
+	# network drivers
+	CONFIG_CHECK+="
+		~VXLAN ~BRIDGE_VLAN_FILTERING
+		~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH
+		~XFRM ~XFRM_USER ~XFRM_ALGO ~INET_ESP
+	"
+	if kernel_is le 5 3; then
+		CONFIG_CHECK+="
+			~INET_XFRM_MODE_TRANSPORT
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~IPVLAN
+		"
+	CONFIG_CHECK+="
+		~MACVLAN ~DUMMY
+		"
+	CONFIG_CHECK+="
+		~NF_NAT_FTP ~NF_CONNTRACK_FTP ~NF_NAT_TFTP ~NF_CONNTRACK_TFTP
+	"
+
+	# storage drivers
+	if use btrfs; then
+		CONFIG_CHECK+="
+			~BTRFS_FS
+			~BTRFS_FS_POSIX_ACL
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~OVERLAY_FS
+	"
+
+	linux-info_pkg_setup
+}
+
+src_unpack() {
+	default
+	cd "${S}"
+	[[ -f go.mod ]] || ln -s vendor.mod go.mod || die
+	[[ -f go.sum ]] || ln -s vendor.sum go.sum || die
+}
+
+src_compile() {
+	export DOCKER_GITCOMMIT="${GIT_COMMIT}"
+	export VERSION=${PV}
+	tc-export PKG_CONFIG
+
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+
+	# let's set up some optional features :)
+	export DOCKER_BUILDTAGS=''
+	for gd in btrfs overlay2; do
+		if ! use $gd; then
+			DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
+		fi
+	done
+
+	for tag in apparmor seccomp; do
+		if use $tag; then
+			DOCKER_BUILDTAGS+=" $tag"
+		fi
+	done
+
+	export AUTO_GOPATH=1
+	export EXCLUDE_AUTO_BUILDTAG_JOURNALD=$(usex systemd '' 'y')
+	export GO_MD2MAN=/usr/bin/go-md2man
+
+	# build binaries
+	./hack/make.sh dynbinary || die 'dynbinary failed'
+
+	# build man page
+	cd man || die
+	emake || die
+}
+
+src_install() {
+	dosym containerd /usr/bin/docker-containerd
+	dosym containerd-shim-runc-v2 /usr/bin/docker-containerd-shim
+	dosym runc /usr/bin/docker-runc
+	use container-init && dosym tini /usr/bin/docker-init
+	dobin bundles/dynbinary-daemon/dockerd
+	dobin bundles/dynbinary-daemon/docker-proxy
+	for f in dockerd-rootless-setuptool.sh dockerd-rootless.sh; do
+		dosym ../share/docker/contrib/${f} /usr/bin/${f}
+	done
+
+	newinitd contrib/init/openrc/docker.initd docker
+	newconfd contrib/init/openrc/docker.confd docker
+
+	systemd_dounit contrib/init/systemd/docker.{service,socket}
+
+	udev_dorules contrib/udev/*.rules
+
+	dodoc AUTHORS CONTRIBUTING.md NOTICE README.md
+	dodoc -r docs/*
+	doman man/man8/dockerd.8
+
+	# note: intentionally not using "doins" so that we preserve +x bits
+	dodir /usr/share/${PN}/contrib
+	cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
+}
+
+pkg_postinst() {
+	udev_reload
+
+	elog
+	elog "To use Docker, the Docker daemon must be running as root. To automatically"
+	elog "start the Docker daemon at boot:"
+	if systemd_is_booted || has_version sys-apps/systemd; then
+		elog "  systemctl enable docker.service"
+	else
+		elog "  rc-update add docker default"
+	fi
+	elog
+	elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
+	elog '  usermod -aG docker <youruser>'
+	elog
+
+	if has_version sys-fs/zfs; then
+		elog " ZFS storage driver is available"
+		elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
+		elog
+	fi
+
+	optfeature "rootless mode support" sys-apps/shadow
+	optfeature "rootless mode support" sys-apps/rootlesskit
+	optfeature_header "for rootless mode you also need a network stack"
+	optfeature "rootless mode network stack" app-containers/slirp4netns
+}
+
+pkg_postrm() {
+	udev_reload
+}