{
  # rootless only: no root daemon and no root-equivalent docker group
  virtualisation.docker.rootless = {
    enable = true;
    setSocketVariable = true;
    daemon.settings = {
      dns = [
        "1.1.1.1"
        "8.8.8.8"
      ];
      log-driver = "journald";
      registry-mirrors = [ "https://mirror.gcr.io" ];
    };
  };
}