Rootless Docker cannot start containers that set domainname

[defangdevs]

Summary

The supervised rootless Docker daemon cannot start any container that sets a domain name.
This breaks Compose files using the standard domainname: field.

Minimal reproduction

Against the daemon agent-box provisions for the session user:

$ DOCKER_HOST=unix:///run/agent-box-docker/claude/docker.sock \
    docker run --rm --domainname pr1069.example alpine:3.22 \
    cat /proc/sys/kernel/domainname

docker: Error response from daemon: failed to create task for container:
failed to create shim task: OCI runtime create failed: runc create failed:
unable to start container process: error during container init:
open sysctl kernel.domainname file: reopen fd 8: permission denied

The same error occurs through Docker Compose for every service containing domainname:.
Removing only those fields lets the otherwise unchanged stack start successfully.

Expected

docker run --domainname ... and Compose domainname: should work with the supervised
rootless daemon. The minimal command above should print pr1069.example and exit 0.

Impact

This is a normal Compose field, and agent-box documents Docker Compose as supported. A user
asking an agent to run an existing Compose application gets an opaque OCI/runc failure before
the application starts. The only current workaround is to generate a local override clearing
every domainname: value, which means the agent is no longer exercising the supplied Compose
configuration literally.

Environment

• NixOS agent-box, running revision 894a9aed3dbb7ee583d9c0470401f653235a813c
• Current upstream agent-box-docker@.service checked at
  ffb41efb5c4d545c41e04bc00d1fe4055add29b9
• Docker client/server 29.8.0, API 1.56
• rootless mode, systemd cgroup driver, cgroup v2
• kernel 6.12.93, NixOS 25.11