{
  "slug": "nerdctl-rootless-networking-enables-ipv6-in-the-rootlesskit-namespace-6dd86a57c26c",
  "title": "nerdctl rootless networking enables IPv6 in the RootlessKit namespace",
  "tools": [
    "nerdctl"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-09-20T05:01:55.000Z",
  "announced_at": "2026-09-20T05:01:55.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When testing IPv6 for a rootless container, set `CONTAINERD_ROOTLESS_ROOTLESSKIT_IPV6=true` and restart rootless containerd, then create an IPv6-capable CNI network with `nerdctl network create --ipv6 --subnet <v6-subnet> <network>`. IPv6 mainly affects outgoing connections with `slirp4netns` and `pasta`; `gvisor-tap-vsock` does not support IPv6, and the built-in port driver does not forward IPv6 ports.",
    "examples": [
      "Environment=CONTAINERD_ROOTLESS_ROOTLESSKIT_IPV6=\"true\"",
      "systemctl --user daemon-reload && systemctl --user restart containerd",
      "nerdctl network create --ipv6 --subnet <v6-subnet> <network>"
    ],
    "gotchas": [
      "Version: v2.4.0",
      "CONTAINERD_ROOTLESS_ROOTLESSKIT_IPV6: Boolean setting for IPv6 inside the RootlessKit network namespace; defaults to false. Set to true to enable.",
      "--ipv6: Enables IPv6 on the network; use with a valid subnet.",
      "--subnet <v6-subnet>: Specifies a subnet in CIDR format; use a valid IPv6 subnet for this task.",
      "<network> (required): Network name positional argument for `nerdctl network create`.",
      "Prerequisite: Rootless containerd must be set up; the docs direct users to `containerd-rootless-setuptool.sh install`.",
      "Prerequisite: CNI plugins v1.1.0 or later are required to isolate the CNI bridge.",
      "The setting defaults to false.",
      "The setting mainly affects outgoing connections with `slirp4netns` and `pasta` network drivers.",
      "It does not affect port forwarding in the built-in port driver.",
      "The `gvisor-tap-vsock` network driver does not currently support IPv6.",
      "The change covers `--port-driver=builtin` (the default); `--port-driver=slirp4netns` does not yet support IPv6 port forwarding upstream."
    ]
  },
  "why_it_matters": "Test a rootless container's IPv6 networking in a development environment.",
  "before": "Use the rootless network namespace without IPv6 enabled.",
  "sources": [
    "https://github.com/containerd/nerdctl/releases/tag/v2.4.0",
    "https://github.com/containerd/nerdctl/pull/5055",
    "https://github.com/containerd/nerdctl/blob/v2.4.0/docs/rootless.md",
    "https://github.com/containerd/nerdctl/blob/v2.4.0/docs/command-reference.md"
  ],
  "rank": 0.9703,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-20261016",
    "verdict_id": "wave1b-20261016:wave1b-20261016-3f801b7d2cfa07da-4:gate",
    "evidence_hash": "4f747204ee167e35a8cd2aef04efaf0bda570f1ae35581db4cc0b3911d5e96f6"
  },
  "review": {
    "draft_hash": "6f49871071cde7e0453a84e5e2757f6e64918ed198f02e6c9ab46f82a167c0a8",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-20261016:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.97 >= 0.9; 2 needed) and Jev gave 0.63 (>= 0.6 needed)."
  }
}