[haytok]

Summary

• Follow up to: Update module github.com/rootless-containers/rootlesskit/v3 to v3.1.0 #53326

#53326 updated the Go module only, so the RootlessKit binary built by the Dockerfile and hack/dockerfile/install/rootlesskit.installer is still pinned to v3.0.2.

Updated RootlessKit from v3.0.2 to v3.1.0: rootless-containers/rootlesskit@v3.0.2...v3.1.0

Therefore, following the release of a new version of RootlessKit, we should update the related versions (Dockerfile and rootlesskit.installer) and documentation in contrib/dockerd-rootless.sh.

---

This version adds a new port driver, pesto, and I confirmed the new port-driver works on moby.

Details

I've set Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_NET=pasta and Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=pesto into the systemd service unit file for dockerd.

$ docker version
Client: Docker Engine - Community
 Version:           29.1.2
 API version:       1.52
 Go version:        go1.25.5
 Git commit:        890dcca
 Built:             Tue Dec  2 21:56:10 2025
 OS/Arch:           linux/arm64
 Context:           rootless

Server:
 Engine:
  Version:          dev
  API version:      1.55 (minimum version 1.40)
  Go version:       go1.26.5
  Git commit:       e456107947c1d554ae1ad0645ed6e13978aa1c2d
  Built:            Tue Aug 11 11:33:56 2026
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          v2.2.0
  GitCommit:        1c4457e00facac03ce1d75f7b6777a7a851e5c41
 runc:
  Version:          1.3.4
  GitCommit:        v1.3.4-0-gd6d73eb8
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
 rootlesskit:
  Version:          3.1.0
  ApiVersion:       1.1.2
  NetworkDriver:    pasta
  PortDriver:       pesto
  StateDir:         /run/user/501/dockerd-rootless

(host) $ docker run -d -p 8080:80 nginx:alpine
6b63ca313380bc354ae9031b9534b1686ca67c2eae0d5f9890d990cb198c6654

(host) $ docker ps
CONTAINER ID   IMAGE          COMMAND                  CREATED              STATUS              PORTS                  NAMES
6b63ca313380   nginx:alpine   "/docker-entrypoint.…"   About a minute ago   Up About a minute   0.0.0.0:8080->80/tcp   dazzling_payne

(host) $ curl localhost:8080
<!DOCTYPE html>
<html>
...

reference: rootless-containers/rootlesskit#611

Note that pesto is opt-in and it is never selected automatically. It's used only when pesto is set to DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER together with the pasta network driver.

Release notes (optional)

- Update RootlessKit to v3.1.0, adding support for the `pesto` port driver in rootless mode. Set `DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=pesto` to use it; it requires the `pasta` network driver and supports IPv4 only.
- Fix `--disable-host-loopback` not being enforced for the `pasta` network driver in rootless mode.

A picture of a cute animal (not mandatory but encouraged)

[haytok]

CC: @AkihiroSuda

[vvoland]

LGTM, thanks!

[thaJeztah]

LGTM, thank you!