diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest
index bb7e59e2b5..aa42e30ebb 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest
@@ -1,2 +1,2 @@
 DIST docker-26.1.0.tar.gz 16390376 BLAKE2B 6703e9b153c430bc28aed2e7de7bada0203353d61f0a2ce3d49ddbd017eab196a685dd1ab1e719a6b287813eb5fa4f2c612e2cf1ab95789d6e79ebe5dac7ace3 SHA512 47b6b9af9947016884614b6bc25977e1db281da95c9b8b34c753c21c664a737a893f9fa65d92cbb897735aae3893567e106e6bababb5507e069b1e0981e48d50
-DIST docker-27.1.2.tar.gz 16608463 BLAKE2B 27d8ab2e917c838007f8bc286899ed65e9f9a16d67d77034845ec5b04ef2733887dec3a18c224130823516738fb40c6c731962538b61603e94746e2c32d721a5 SHA512 26f85a1437ba4361dc050861dd9c3ba900f80e4fdc0eaf2bfcba33b6419c5d981c9ee5ab3bea9af208502eca372a2f76c42325abe9e3d2c1b2f725fe7b10df92
+DIST docker-27.2.0.tar.gz 16689537 BLAKE2B faf0bae9f7da127d5b65b9989acd82dc726bc3f09ace502df151b9f03a84b6f1ec2a946d905263aaa7d2e7d7a3cd4ad1a09291dcfc6691e73cc9a8738f150d55 SHA512 97abaf56d2249c1514beacf17fc9096848b960846e064f1a9bd800a59762a1f1888b32e83b3e8289e23656496ca0293fea65931210d68faaa8a713aab6e48b65
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker/docker-27.1.2.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/docker/docker-27.2.0.ebuild
similarity index 91%
rename from sdk_container/src/third_party/portage-stable/app-containers/docker/docker-27.1.2.ebuild
rename to sdk_container/src/third_party/portage-stable/app-containers/docker/docker-27.2.0.ebuild
index 8b5a0a4250..4f5f1df2ab 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker/docker-27.1.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker/docker-27.2.0.ebuild
@@ -4,8 +4,8 @@
 EAPI=7
 EGO_PN=github.com/docker/docker
 MY_PV=${PV/_/-}
-inherit golang-vcs-snapshot linux-info systemd udev
-GIT_COMMIT=f9522e5e96c3ab5a6b8a643d15a92700ca864da6
+inherit golang-vcs-snapshot linux-info optfeature systemd udev
+GIT_COMMIT=3ab5c7d0036ca8fc43141e83b167456ec79828aa
 
 DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
 HOMEPAGE="https://www.docker.com/"
@@ -14,7 +14,7 @@ SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
 LICENSE="Apache-2.0"
 SLOT="0"
 KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
-IUSE="apparmor btrfs +container-init overlay seccomp selinux systemd"
+IUSE="apparmor btrfs +container-init +overlay2 seccomp selinux systemd"
 
 DEPEND="
 	acct-group/docker
@@ -33,7 +33,7 @@ RDEPEND="
 	sys-process/procps
 	>=dev-vcs/git-1.7
 	>=app-arch/xz-utils-4.9
-	>=app-containers/containerd-1.7.20[apparmor?,btrfs?,seccomp?]
+	>=app-containers/containerd-1.7.21[apparmor?,btrfs?,seccomp?]
 	>=app-containers/runc-1.1.13[apparmor?,seccomp?]
 	!app-containers/docker-proxy
 	container-init? ( >=sys-process/tini-0.19.0[static] )
@@ -246,7 +246,7 @@ src_compile() {
 
 	# let's set up some optional features :)
 	export DOCKER_BUILDTAGS=''
-	for gd in btrfs overlay; do
+	for gd in btrfs overlay2; do
 		if ! use $gd; then
 			DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
 		fi
@@ -271,6 +271,9 @@ src_install() {
 	use container-init && dosym tini /usr/bin/docker-init
 	dobin bundles/dynbinary-daemon/dockerd
 	dobin bundles/dynbinary-daemon/docker-proxy
+	for f in dockerd-rootless-setuptool.sh dockerd-rootless.sh; do
+		dosym ../share/docker/contrib/${f} /usr/bin/${f}
+	done
 
 	newinitd contrib/init/openrc/docker.initd docker
 	newconfd contrib/init/openrc/docker.confd docker
@@ -303,17 +306,16 @@ pkg_postinst() {
 	elog '  usermod -aG docker <youruser>'
 	elog
 
-	if use overlay; then
-		elog " Overlay storage driver/USEflag has been deprecated"
-		elog " in favor of overlay2 (enabled unconditionally)"
-		elog
-	fi
-
 	if has_version sys-fs/zfs; then
 		elog " ZFS storage driver is available"
 		elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
 		elog
 	fi
+
+	optfeature "rootless mode support" sys-apps/shadow
+	optfeature "rootless mode support" sys-apps/rootlesskit
+	optfeature_header "for rootless mode you also need a network stack"
+	optfeature "rootless mode network stack" app-containers/slirp4netns
 }
 
 pkg_postrm() {
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker/metadata.xml b/sdk_container/src/third_party/portage-stable/app-containers/docker/metadata.xml
index 63036f19e3..dfe5565275 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker/metadata.xml
@@ -25,6 +25,10 @@
 			Enables dependencies for the "overlay" graph driver, including
 			necessary kernel flags.
 		</flag>
+		<flag name="overlay2">
+			Enables dependencies for the "overlay2" graph driver, including
+			necessary kernel flags.
+		</flag>
 	</use>
 	<upstream>
 		<remote-id type="github">moby/moby</remote-id>