{
  # rootless only: no root daemon and no root-equivalent docker group
  virtualisation.docker.rootless = {
    enable = true;
    setSocketVariable = true;
    daemon.settings = {
      dns = [
        "1.1.1.1"
        "8.8.8.8"
      ];
      log-driver = "journald";
      registry-mirrors = [ "https://mirror.gcr.io" ];
    };
  };

  # k3s/k3d in rootless docker needs the cpuset controller delegated to the user session
  systemd.services."user@".serviceConfig.Delegate = "cpu cpuset io memory pids";

  # let rootless docker publish ports 80/443 (e.g. k3d traefik ingress)
  boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 80;
}