@@ -239,6 +239,7 @@ RUN cd /docker-py \

 	&& pip install yamllint==1.5.0 \

 	&& pip install -r test-requirements.txt

 COPY --from=rootlesskit /build/ /usr/local/bin/

+COPY --from=djs55/vpnkit@sha256:e508a17cfacc8fd39261d5b4e397df2b953690da577e2c987a47630cd0c42f8e /vpnkit /usr/local/bin/vpnkit.x86_64

 ENV PATH=/usr/local/cli:$PATH

 ENV DOCKER_BUILDTAGS apparmor seccomp selinux

@@ -8,4 +8,5 @@ DOCKER_CONTAINERD_SHIM_BINARY_NAME='containerd-shim'

 DOCKER_PROXY_BINARY_NAME='docker-proxy'

 DOCKER_INIT_BINARY_NAME='docker-init'

 DOCKER_ROOTLESSKIT_BINARY_NAME='rootlesskit'

+DOCKER_VPNKIT_BINARY_NAME='vpnkit'

 DOCKER_DAEMON_ROOTLESS_SH_BINARY_NAME='dockerd-rootless.sh'

@@ -20,6 +20,14 @@ copy_binaries() {

 			hash_files "$dir/$file"

 		fi

 	done

+

+	# vpnkit is amd64 only

+	if which "vpnkit.$(uname -m)" 2>&1 >/dev/null; then

+		cp -f `which "vpnkit.$(uname -m)"` "$dir/vpnkit"

+		if [ "$hash" == "hash" ]; then

+			hash_files "$dir/vpnkit"

+		fi

+	fi

 }

 [ -z "$KEEPDEST" ] && rm -rf "$DEST"

@@ -28,4 +28,7 @@ install_binary() {

 	install_binary "${DEST}/${DOCKER_INIT_BINARY_NAME}"

 	install_binary "${DEST}/${DOCKER_ROOTLESSKIT_BINARY_NAME}"

 	install_binary "${DEST}/${DOCKER_DAEMON_ROOTLESS_SH_BINARY_NAME}"

+	if [ -f "${DEST}/${DOCKER_VPNKIT_BINARY_NAME}" ]; then

+		install_binary "${DEST}/${DOCKER_VPNKIT_BINARY_NAME}"

+	fi

 )