diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
index c22d935423..c9032e6d40 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
@@ -1,6 +1,3 @@
-DIST iproute2-6.11.0.tar.xz 923736 BLAKE2B 1a360d7cb9a70f5cde184abe934f2d08e9c0d2196c4ec10015636af3984abe2738d9dd8d6c7a69569fc7449e9933829f4eccd593ab8c041ce7b6385adaed63cc SHA512 06bedd7ae573fe5cf9c72af698987ba03e53dc6fce5f41813bf5bb155b683490e5c75cc835ce5ba4509e491eb6138e96da162204c28ea1b3d80887107997a3b3
-DIST iproute2-6.12.0.tar.xz 925392 BLAKE2B 95aee769662e21c8c6223d09ee0ec365fcdeb7a10d01e89e33aa3039a6dfac11401cbdca4bf436544fc05ed709ad90871ac91eaf17dc553d7ca157b98577a7b7 SHA512 dbd6afb8162a6086e4be9045b8dc53aa563bd4b7abaf43ee13cd7d493730ff0b90e6985f68c6f42d64f4af6a692d0589e0cefd2f24045ec1c10418cfb73940b2
-DIST iproute2-6.13.0.tar.xz 927416 BLAKE2B bbebc44d1a7e35c410869a2a5884df09698ea3950acd126e5736a938718d40e57d539ff88ecd7827cbdf2f9481c3d728fff3948a61c2ba3e1483c5b7a7616577 SHA512 2e392a8ddc3d7662c3a72bba1c845587df85b7afc6efabf7df0ec2830bb1d4b16cac5bfb7a43dc3ac73adf0ea3fe3670824674d4f32209c6d1aa638a7cb7cd6c
-DIST iproute2-6.14.0.tar.xz 929092 BLAKE2B 18bd180c608b657694f4713bf915d45006c97a7206a3260ac52149d4c976422e1949ada425d4989c5a7e327e3d8eb45ea990de25f3645bb1308ac2531bf834d2 SHA512 e79049bdca0e0381f0a93a40e4d597ce59fb509dabc6e8b04a510ff9953f091c67577d6faa62967bd197bf62ab6e56d928558270a1390621431acb237b77fa46
 DIST iproute2-6.15.0.tar.xz 930908 BLAKE2B 50247f293e194601bd138418e55e2dc63421d2a5da863973e9ff78f2c76ba051350523559f2b7b7983af05a827f292135353adbf6c857ea32b7071f69940f73f SHA512 1a438941cd939e1c8e32cfe8c40e6fd826c89185f1bb0c623eaad7380a66afd9fa9e0d7cdc5e5b193d2761b7dbdc78fd0811537eecc500be633730c32ff55ad4
 DIST iproute2-6.16.0.tar.xz 931124 BLAKE2B d1c66f4d63edd6fa2701c92dbc47f8c4388d6a660d541d528e3463e8e261fda64df4a7f8930f510718c71ee82438b5c4859f072eb08c8ff1e4d1d65223108005 SHA512 88930ea1a3a901594a69dc04e533bfd1de0f5b79f176dedb45f11f01035bd680edccc8e04e56d0922ee430580581c646473a3baa941254739878f7ab946f17df
+DIST iproute2-6.17.0.tar.xz 940952 BLAKE2B 49b88fd1eaea34376b086be02e72505ca62f52f3c53f3ee29cd273532521fabe8d38062277852dcc69f78b86b9460b213bbeedc9c51ce20d3bb1fd35d86b6fc8 SHA512 3d83d49233c1d984f15d285a46e2ec0eeb820c7cb84cfc84866921f37e8a57d31bc3953be07e8c79ed6079f326a25c3a85f591b0d67f9f689c0c70ccdb0fef77
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.10.0-musl-1.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.10.0-musl-1.patch
deleted file mode 100644
index c1b7788deb..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.10.0-musl-1.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From fbbe03cbc4fa8c801967aac2e2c444e93b2ca96a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Andreas=20K=2E=20H=C3=BCttel?= <dilfridge@gentoo.org>
-Date: Sun, 4 Aug 2024 16:22:07 +0200
-Subject: [PATCH 1/2] libnetlink.h: Include <endian.h> explicitly for musl
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The code added in "f_flower: implement pfcp opts" uses h2be64,
-defined in endian.h. While this is pulled in around some corners
-for glibc (see below), that's not the case for musl and an
-explicit include is required there.
-
-. /usr/include/libmnl/libmnl.h
-.. /usr/include/sys/socket.h
-... /usr/include/bits/socket.h
-.... /usr/include/sys/types.h
-..... /usr/include/endian.h
-
-Fixes: 976dca372 ("f_flower: implement pfcp opts")
-Bug: https://bugs.gentoo.org/936234
-Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
----
- include/libnetlink.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/include/libnetlink.h b/include/libnetlink.h
-index 30f0c2d2..7074e913 100644
---- a/include/libnetlink.h
-+++ b/include/libnetlink.h
-@@ -4,6 +4,7 @@
- 
- #include <stdio.h>
- #include <string.h>
-+#include <endian.h>
- #include <asm/types.h>
- #include <linux/netlink.h>
- #include <linux/rtnetlink.h>
--- 
-2.44.2
-
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.11.0-musl-fixes.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.11.0-musl-fixes.patch
deleted file mode 100644
index cc1370a3a6..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.11.0-musl-fixes.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From https://bugs.gentoo.org/939811
-From: Holger Hoffstätte <holger@applied-asynchrony.com>
-
---- a/bridge/mst.c
-+++ b/bridge/mst.c
-@@ -4,8 +4,6 @@
-  */
- 
- #include <stdio.h>
--#include <linux/if_bridge.h>
--#include <net/if.h>
- 
- #include "libnetlink.h"
- #include "json_print.h"
-@@ -13,6 +11,9 @@
- 
- #include "br_common.h"
- 
-+#include <linux/if_bridge.h>
-+#include <net/if.h>
-+
- #define MST_ID_LEN 9
- 
- #define __stringify_1(x...) #x
---- a/include/json_print.h
-+++ b/include/json_print.h
-@@ -11,6 +11,8 @@
- #include "json_writer.h"
- #include "color.h"
- 
-+struct timeval;
-+
- #define _IS_JSON_CONTEXT(type) (is_json_context() && (type & PRINT_JSON || type & PRINT_ANY))
- #define _IS_FP_CONTEXT(type)   (!is_json_context() && (type & PRINT_FP || type & PRINT_ANY))
- 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.12.0-musl-3.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.12.0-musl-3.patch
deleted file mode 100644
index 37eeb84aa3..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.12.0-musl-3.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-https://github.com/iproute2/iproute2/pull/71
-
-From cdc6a1759ea1858d65fdbbfe825999b3d4ed377e Mon Sep 17 00:00:00 2001
-From: David Seifert <soap@gentoo.org>
-Date: Sun, 8 Dec 2024 13:19:14 +0100
-Subject: [PATCH] musl: include <limits.h> for PATH_MAX macro
-
-https://bugs.gentoo.org/946088
----
- ip/iplink.c  | 1 +
- ip/ipnetns.c | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/ip/iplink.c b/ip/iplink.c
-index aa2332fcc..27863b981 100644
---- a/ip/iplink.c
-+++ b/ip/iplink.c
-@@ -21,6 +21,7 @@
- #include <string.h>
- #include <sys/ioctl.h>
- #include <stdbool.h>
-+#include <limits.h>
- #include <linux/mpls.h>
- 
- #include "rt_names.h"
-diff --git a/ip/ipnetns.c b/ip/ipnetns.c
-index 5c9434009..de16b2790 100644
---- a/ip/ipnetns.c
-+++ b/ip/ipnetns.c
-@@ -15,6 +15,7 @@
- #include <errno.h>
- #include <unistd.h>
- #include <ctype.h>
-+#include <limits.h>
- #include <linux/limits.h>
- 
- #include <linux/net_namespace.h>
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.11.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.11.0-r2.ebuild
deleted file mode 100644
index 33103fa221..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.11.0-r2.ebuild
+++ /dev/null
@@ -1,215 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit edo toolchain-funcs flag-o-matic
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
-	inherit git-r3
-else
-	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
-fi
-
-DESCRIPTION="kernel routing and traffic control utilities"
-HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux"
-# Needs root
-RESTRICT="test"
-
-# We could make libmnl optional, but it's tiny, so eh
-RDEPEND="
-	!minimal? ( net-libs/libmnl:= )
-	atm? ( net-dialup/linux-atm )
-	berkdb? ( sys-libs/db:= )
-	bpf? ( >=dev-libs/libbpf-0.6:= )
-	caps? ( sys-libs/libcap )
-	elf? ( virtual/libelf:= )
-	iptables? ( >=net-firewall/iptables-1.4.20:= )
-	nfs? ( net-libs/libtirpc:= )
-	selinux? ( sys-libs/libselinux )
-"
-# We require newer linux-headers for ipset support (bug #549948) and some defines (bug #553876)
-DEPEND="
-	${RDEPEND}
-	>=sys-kernel/linux-headers-3.16
-"
-BDEPEND="
-	app-arch/xz-utils
-	>=sys-devel/bison-2.4
-	app-alternatives/lex
-	virtual/pkgconfig
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-6.10.0-musl-1.patch # bug #936234
-	"${FILESDIR}"/${PN}-6.10.0-musl-2.patch # bug #926341
-	"${FILESDIR}"/${PN}-6.9.0-mtu.patch # bug #291907
-	"${FILESDIR}"/${PN}-6.8.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
-	"${FILESDIR}"/${PN}-6.8.0-disable-libbsd-fallback.patch # bug #911727
-	"${FILESDIR}"/${PN}-6.11.0-musl-fixes.patch # bug #939811
-)
-
-src_prepare() {
-	default
-
-	# Fix version if necessary
-	local versionfile="include/version.h"
-	if [[ ${PV} != 9999 ]] && ! grep -Fq "${PV}" ${versionfile} ; then
-		einfo "Fixing version string"
-		sed -i "s@\"[[:digit:]\.]\+\"@\"${PV}\"@" \
-			${versionfile} || die
-	fi
-
-	# echo -n is not POSIX compliant
-	sed -i 's@echo -n@printf@' configure || die
-
-	sed -i \
-		-e '/^CC :\?=/d' \
-		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
-		-e "s|-O2|${CFLAGS} ${CPPFLAGS}|" \
-		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
-		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
-		Makefile || die
-
-	# Build against system headers
-	rm -r include/netinet || die #include/linux include/ip{,6}tables{,_common}.h include/libiptc
-	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
-
-	if use minimal ; then
-		sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile || die
-	fi
-}
-
-src_configure() {
-	tc-export AR CC PKG_CONFIG
-
-	# This sure is ugly. Should probably move into toolchain-funcs at some point.
-	local setns
-	pushd "${T}" >/dev/null || die
-	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c || die
-	if ${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null ; then
-		setns=y
-	else
-		setns=n
-	fi
-
-	echo 'int main(){return 0;}' > test.c || die
-	if ! ${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null ; then
-		sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile || die
-	fi
-	popd >/dev/null || die
-
-	# build system does not pass CFLAGS to LDFLAGS, as is recommended by GCC upstream
-	# https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-flto
-	# https://bugs.gentoo.org/929233
-	append-ldflags ${CFLAGS}
-
-	# run "configure" script first which will create "config.mk"...
-	# Using econf breaks since 5.14.0 (a9c3d70d902a0473ee5c13336317006a52ce8242)
-	eval "local -a EXTRA_ECONF=(${EXTRA_ECONF})"
-	edo ./configure --libbpf_force $(usex bpf on off) "${EXTRA_ECONF[@]}"
-
-	# Remove the definitions made by configure and allow them to be overridden
-	# by USE flags below.
-	# We have to do the cheesy only-sed-if-disabled because otherwise
-	# the *_FLAGS etc stuff found by configure will be used but result
-	# in a broken build.
-	if ! use berkdb ; then
-		sed -i -e '/HAVE_BERKELEY_DB/d' config.mk || die
-	fi
-
-	if ! use caps ; then
-		sed -i -e '/HAVE_CAP/d' config.mk || die
-	fi
-
-	if use minimal ; then
-		sed -i -e '/HAVE_MNL/d' config.mk || die
-	fi
-
-	if ! use elf ; then
-		sed -i -e '/HAVE_ELF/d' config.mk || die
-	fi
-
-	if ! use nfs ; then
-		sed -i -e '/HAVE_RPC/d' config.mk || die
-	fi
-
-	if ! use selinux ; then
-		sed -i -e '/HAVE_SELINUX/d' config.mk || die
-	fi
-
-	# ...Now switch on/off requested features via USE flags
-	# this is only useful if the test did not set other things, per bug #643722
-	# Keep in sync with ifs above, or refactor to be unified.
-	cat <<-EOF >> config.mk
-	TC_CONFIG_ATM := $(usex atm y n)
-	TC_CONFIG_XT  := $(usex iptables y n)
-	TC_CONFIG_NO_XT := $(usex iptables n y)
-	# We've locked in recent enough kernel headers, bug #549948
-	TC_CONFIG_IPSET := y
-	HAVE_BERKELEY_DB := $(usex berkdb y n)
-	HAVE_CAP      := $(usex caps y n)
-	HAVE_MNL      := $(usex minimal n y)
-	HAVE_ELF      := $(usex elf y n)
-	HAVE_RPC      := $(usex nfs y n)
-	HAVE_SELINUX  := $(usex selinux y n)
-	IP_CONFIG_SETNS := ${setns}
-	# Use correct iptables dir, bug #144265, bug #293709
-	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
-	EOF
-}
-
-src_compile() {
-	emake V=1 NETNS_RUN_DIR=/run/netns
-}
-
-src_test() {
-	emake check
-}
-
-src_install() {
-	if use minimal ; then
-		into /
-		dosbin tc/tc
-		dobin ip/ip
-		return 0
-	fi
-
-	emake \
-		DESTDIR="${D}" \
-		PREFIX="${EPREFIX}/usr" \
-		LIBDIR="${EPREFIX}"/$(get_libdir) \
-		SBINDIR="${EPREFIX}"/sbin \
-		CONFDIR="${EPREFIX}"/etc/iproute2 \
-		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
-		MANDIR="${EPREFIX}"/usr/share/man \
-		ARPDDIR="${EPREFIX}"/var/lib/arpd \
-		install
-
-	dodir /bin
-	mv "${ED}"/{s,}bin/ip || die # bug #330115
-	mv "${ED}"/{s,}bin/ss || die # bug #547264
-
-	dolib.a lib/libnetlink.a
-	insinto /usr/include
-	doins include/libnetlink.h
-
-	# Collides with net-analyzer/ifstat
-	# https://bugs.gentoo.org/868321
-	mv "${ED}"/sbin/ifstat{,-iproute2} || die
-
-	if use berkdb ; then
-		keepdir /var/lib/arpd
-		# bug #47482, arpd doesn't need to be in /sbin
-		dodir /usr/bin
-		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
-	elif [[ -d "${ED}"/var/lib/arpd ]]; then
-		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.12.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.12.0.ebuild
deleted file mode 100644
index 73c7a16e2e..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.12.0.ebuild
+++ /dev/null
@@ -1,215 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit edo toolchain-funcs flag-o-matic
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
-	inherit git-r3
-else
-	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
-fi
-
-DESCRIPTION="kernel routing and traffic control utilities"
-HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux"
-# Needs root
-RESTRICT="test"
-
-# We could make libmnl optional, but it's tiny, so eh
-RDEPEND="
-	!minimal? ( net-libs/libmnl:= )
-	atm? ( net-dialup/linux-atm )
-	berkdb? ( sys-libs/db:= )
-	bpf? ( >=dev-libs/libbpf-0.6:= )
-	caps? ( sys-libs/libcap )
-	elf? ( virtual/libelf:= )
-	iptables? ( >=net-firewall/iptables-1.4.20:= )
-	nfs? ( net-libs/libtirpc:= )
-	selinux? ( sys-libs/libselinux )
-"
-# We require newer linux-headers for ipset support (bug #549948) and some defines (bug #553876)
-DEPEND="
-	${RDEPEND}
-	>=sys-kernel/linux-headers-3.16
-"
-BDEPEND="
-	app-arch/xz-utils
-	>=sys-devel/bison-2.4
-	app-alternatives/lex
-	virtual/pkgconfig
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-6.10.0-musl-1.patch # bug #936234
-	"${FILESDIR}"/${PN}-6.10.0-musl-2.patch # bug #926341
-	"${FILESDIR}"/${PN}-6.12.0-musl-3.patch # bug #946088
-	"${FILESDIR}"/${PN}-6.9.0-mtu.patch # bug #291907
-	"${FILESDIR}"/${PN}-6.8.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
-	"${FILESDIR}"/${PN}-6.8.0-disable-libbsd-fallback.patch # bug #911727
-)
-
-src_prepare() {
-	default
-
-	# Fix version if necessary
-	local versionfile="include/version.h"
-	if [[ ${PV} != 9999 ]] && ! grep -Fq "${PV}" ${versionfile} ; then
-		einfo "Fixing version string"
-		sed -i "s@\"[[:digit:]\.]\+\"@\"${PV}\"@" \
-			${versionfile} || die
-	fi
-
-	# echo -n is not POSIX compliant
-	sed -i 's@echo -n@printf@' configure || die
-
-	sed -i \
-		-e '/^CC :\?=/d' \
-		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
-		-e "s|-O2|${CFLAGS} ${CPPFLAGS}|" \
-		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
-		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
-		Makefile || die
-
-	# Build against system headers
-	rm -r include/netinet || die #include/linux include/ip{,6}tables{,_common}.h include/libiptc
-	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
-
-	if use minimal ; then
-		sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile || die
-	fi
-}
-
-src_configure() {
-	tc-export AR CC PKG_CONFIG
-
-	# This sure is ugly. Should probably move into toolchain-funcs at some point.
-	local setns
-	pushd "${T}" >/dev/null || die
-	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c || die
-	if ${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null ; then
-		setns=y
-	else
-		setns=n
-	fi
-
-	echo 'int main(){return 0;}' > test.c || die
-	if ! ${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null ; then
-		sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile || die
-	fi
-	popd >/dev/null || die
-
-	# build system does not pass CFLAGS to LDFLAGS, as is recommended by GCC upstream
-	# https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-flto
-	# https://bugs.gentoo.org/929233
-	append-ldflags ${CFLAGS}
-
-	# run "configure" script first which will create "config.mk"...
-	# Using econf breaks since 5.14.0 (a9c3d70d902a0473ee5c13336317006a52ce8242)
-	eval "local -a EXTRA_ECONF=(${EXTRA_ECONF})"
-	edo ./configure --libbpf_force $(usex bpf on off) "${EXTRA_ECONF[@]}"
-
-	# Remove the definitions made by configure and allow them to be overridden
-	# by USE flags below.
-	# We have to do the cheesy only-sed-if-disabled because otherwise
-	# the *_FLAGS etc stuff found by configure will be used but result
-	# in a broken build.
-	if ! use berkdb ; then
-		sed -i -e '/HAVE_BERKELEY_DB/d' config.mk || die
-	fi
-
-	if ! use caps ; then
-		sed -i -e '/HAVE_CAP/d' config.mk || die
-	fi
-
-	if use minimal ; then
-		sed -i -e '/HAVE_MNL/d' config.mk || die
-	fi
-
-	if ! use elf ; then
-		sed -i -e '/HAVE_ELF/d' config.mk || die
-	fi
-
-	if ! use nfs ; then
-		sed -i -e '/HAVE_RPC/d' config.mk || die
-	fi
-
-	if ! use selinux ; then
-		sed -i -e '/HAVE_SELINUX/d' config.mk || die
-	fi
-
-	# ...Now switch on/off requested features via USE flags
-	# this is only useful if the test did not set other things, per bug #643722
-	# Keep in sync with ifs above, or refactor to be unified.
-	cat <<-EOF >> config.mk
-	TC_CONFIG_ATM := $(usex atm y n)
-	TC_CONFIG_XT  := $(usex iptables y n)
-	TC_CONFIG_NO_XT := $(usex iptables n y)
-	# We've locked in recent enough kernel headers, bug #549948
-	TC_CONFIG_IPSET := y
-	HAVE_BERKELEY_DB := $(usex berkdb y n)
-	HAVE_CAP      := $(usex caps y n)
-	HAVE_MNL      := $(usex minimal n y)
-	HAVE_ELF      := $(usex elf y n)
-	HAVE_RPC      := $(usex nfs y n)
-	HAVE_SELINUX  := $(usex selinux y n)
-	IP_CONFIG_SETNS := ${setns}
-	# Use correct iptables dir, bug #144265, bug #293709
-	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
-	EOF
-}
-
-src_compile() {
-	emake V=1 NETNS_RUN_DIR=/run/netns
-}
-
-src_test() {
-	emake check
-}
-
-src_install() {
-	if use minimal ; then
-		into /
-		dosbin tc/tc
-		dobin ip/ip
-		return 0
-	fi
-
-	emake \
-		DESTDIR="${D}" \
-		PREFIX="${EPREFIX}/usr" \
-		LIBDIR="${EPREFIX}"/$(get_libdir) \
-		SBINDIR="${EPREFIX}"/sbin \
-		CONFDIR="${EPREFIX}"/etc/iproute2 \
-		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
-		MANDIR="${EPREFIX}"/usr/share/man \
-		ARPDDIR="${EPREFIX}"/var/lib/arpd \
-		install
-
-	dodir /bin
-	mv "${ED}"/{s,}bin/ip || die # bug #330115
-	mv "${ED}"/{s,}bin/ss || die # bug #547264
-
-	dolib.a lib/libnetlink.a
-	insinto /usr/include
-	doins include/libnetlink.h
-
-	# Collides with net-analyzer/ifstat
-	# https://bugs.gentoo.org/868321
-	mv "${ED}"/sbin/ifstat{,-iproute2} || die
-
-	if use berkdb ; then
-		keepdir /var/lib/arpd
-		# bug #47482, arpd doesn't need to be in /sbin
-		dodir /usr/bin
-		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
-	elif [[ -d "${ED}"/var/lib/arpd ]]; then
-		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.13.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.13.0.ebuild
deleted file mode 100644
index 2f70fe23a1..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.13.0.ebuild
+++ /dev/null
@@ -1,213 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit edo toolchain-funcs flag-o-matic
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
-	inherit git-r3
-else
-	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
-fi
-
-DESCRIPTION="kernel routing and traffic control utilities"
-HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux"
-# Needs root
-RESTRICT="test"
-
-# We could make libmnl optional, but it's tiny, so eh
-RDEPEND="
-	!minimal? ( net-libs/libmnl:= )
-	atm? ( net-dialup/linux-atm )
-	berkdb? ( sys-libs/db:= )
-	bpf? ( >=dev-libs/libbpf-0.6:= )
-	caps? ( sys-libs/libcap )
-	elf? ( virtual/libelf:= )
-	iptables? ( >=net-firewall/iptables-1.4.20:= )
-	nfs? ( net-libs/libtirpc:= )
-	selinux? ( sys-libs/libselinux )
-"
-# We require newer linux-headers for ipset support (bug #549948) and some defines (bug #553876)
-DEPEND="
-	${RDEPEND}
-	>=sys-kernel/linux-headers-3.16
-"
-BDEPEND="
-	app-arch/xz-utils
-	>=sys-devel/bison-2.4
-	app-alternatives/lex
-	virtual/pkgconfig
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-6.10.0-musl-2.patch # bug #926341
-	"${FILESDIR}"/${PN}-6.9.0-mtu.patch # bug #291907
-	"${FILESDIR}"/${PN}-6.8.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
-	"${FILESDIR}"/${PN}-6.8.0-disable-libbsd-fallback.patch # bug #911727
-)
-
-src_prepare() {
-	default
-
-	# Fix version if necessary
-	local versionfile="include/version.h"
-	if [[ ${PV} != 9999 ]] && ! grep -Fq "${PV}" ${versionfile} ; then
-		einfo "Fixing version string"
-		sed -i "s@\"[[:digit:]\.]\+\"@\"${PV}\"@" \
-			${versionfile} || die
-	fi
-
-	# echo -n is not POSIX compliant
-	sed -i 's@echo -n@printf@' configure || die
-
-	sed -i \
-		-e '/^CC :\?=/d' \
-		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
-		-e "s|-O2|${CFLAGS} ${CPPFLAGS}|" \
-		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
-		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
-		Makefile || die
-
-	# Build against system headers
-	rm -r include/netinet || die #include/linux include/ip{,6}tables{,_common}.h include/libiptc
-	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
-
-	if use minimal ; then
-		sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile || die
-	fi
-}
-
-src_configure() {
-	tc-export AR CC PKG_CONFIG
-
-	# This sure is ugly. Should probably move into toolchain-funcs at some point.
-	local setns
-	pushd "${T}" >/dev/null || die
-	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c || die
-	if ${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null ; then
-		setns=y
-	else
-		setns=n
-	fi
-
-	echo 'int main(){return 0;}' > test.c || die
-	if ! ${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null ; then
-		sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile || die
-	fi
-	popd >/dev/null || die
-
-	# build system does not pass CFLAGS to LDFLAGS, as is recommended by GCC upstream
-	# https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-flto
-	# https://bugs.gentoo.org/929233
-	append-ldflags ${CFLAGS}
-
-	# run "configure" script first which will create "config.mk"...
-	# Using econf breaks since 5.14.0 (a9c3d70d902a0473ee5c13336317006a52ce8242)
-	eval "local -a EXTRA_ECONF=(${EXTRA_ECONF})"
-	edo ./configure --libbpf_force $(usex bpf on off) "${EXTRA_ECONF[@]}"
-
-	# Remove the definitions made by configure and allow them to be overridden
-	# by USE flags below.
-	# We have to do the cheesy only-sed-if-disabled because otherwise
-	# the *_FLAGS etc stuff found by configure will be used but result
-	# in a broken build.
-	if ! use berkdb ; then
-		sed -i -e '/HAVE_BERKELEY_DB/d' config.mk || die
-	fi
-
-	if ! use caps ; then
-		sed -i -e '/HAVE_CAP/d' config.mk || die
-	fi
-
-	if use minimal ; then
-		sed -i -e '/HAVE_MNL/d' config.mk || die
-	fi
-
-	if ! use elf ; then
-		sed -i -e '/HAVE_ELF/d' config.mk || die
-	fi
-
-	if ! use nfs ; then
-		sed -i -e '/HAVE_RPC/d' config.mk || die
-	fi
-
-	if ! use selinux ; then
-		sed -i -e '/HAVE_SELINUX/d' config.mk || die
-	fi
-
-	# ...Now switch on/off requested features via USE flags
-	# this is only useful if the test did not set other things, per bug #643722
-	# Keep in sync with ifs above, or refactor to be unified.
-	cat <<-EOF >> config.mk
-	TC_CONFIG_ATM := $(usex atm y n)
-	TC_CONFIG_XT  := $(usex iptables y n)
-	TC_CONFIG_NO_XT := $(usex iptables n y)
-	# We've locked in recent enough kernel headers, bug #549948
-	TC_CONFIG_IPSET := y
-	HAVE_BERKELEY_DB := $(usex berkdb y n)
-	HAVE_CAP      := $(usex caps y n)
-	HAVE_MNL      := $(usex minimal n y)
-	HAVE_ELF      := $(usex elf y n)
-	HAVE_RPC      := $(usex nfs y n)
-	HAVE_SELINUX  := $(usex selinux y n)
-	IP_CONFIG_SETNS := ${setns}
-	# Use correct iptables dir, bug #144265, bug #293709
-	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
-	EOF
-}
-
-src_compile() {
-	emake V=1 NETNS_RUN_DIR=/run/netns
-}
-
-src_test() {
-	emake check
-}
-
-src_install() {
-	if use minimal ; then
-		into /
-		dosbin tc/tc
-		dobin ip/ip
-		return 0
-	fi
-
-	emake \
-		DESTDIR="${D}" \
-		PREFIX="${EPREFIX}/usr" \
-		LIBDIR="${EPREFIX}"/$(get_libdir) \
-		SBINDIR="${EPREFIX}"/sbin \
-		CONFDIR="${EPREFIX}"/etc/iproute2 \
-		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
-		MANDIR="${EPREFIX}"/usr/share/man \
-		ARPDDIR="${EPREFIX}"/var/lib/arpd \
-		install
-
-	dodir /bin
-	mv "${ED}"/{s,}bin/ip || die # bug #330115
-	mv "${ED}"/{s,}bin/ss || die # bug #547264
-
-	dolib.a lib/libnetlink.a
-	insinto /usr/include
-	doins include/libnetlink.h
-
-	# Collides with net-analyzer/ifstat
-	# https://bugs.gentoo.org/868321
-	mv "${ED}"/sbin/ifstat{,-iproute2} || die
-
-	if use berkdb ; then
-		keepdir /var/lib/arpd
-		# bug #47482, arpd doesn't need to be in /sbin
-		dodir /usr/bin
-		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
-	elif [[ -d "${ED}"/var/lib/arpd ]]; then
-		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.14.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.17.0.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.14.0.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.17.0.ebuild
index c85303511b..24b326f4fb 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.14.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.17.0.ebuild
@@ -10,7 +10,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
 DESCRIPTION="kernel routing and traffic control utilities"
@@ -88,6 +88,9 @@ src_configure() {
 	tc-export AR CC PKG_CONFIG
 	lto-guarantee-fat
 
+	tc-export_build_env
+	export CBUILD_CFLAGS=${BUILD_CFLAGS}
+
 	# This sure is ugly. Should probably move into toolchain-funcs at some point.
 	local setns
 	pushd "${T}" >/dev/null || die