diff --git a/modules/nixos/docker.nix b/modules/nixos/docker.nix
index c06235c..bf2b1c6 100644
--- a/modules/nixos/docker.nix
+++ b/modules/nixos/docker.nix
@@ -12,4 +12,10 @@
       registry-mirrors = [ "https://mirror.gcr.io" ];
     };
   };
+
+  # k3s/k3d in rootless docker needs the cpuset controller delegated to the user session
+  systemd.services."user@".serviceConfig.Delegate = "cpu cpuset io memory pids";
+
+  # let rootless docker publish ports 80/443 (e.g. k3d traefik ingress)
+  boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 80;
 }