@@ -116,6 +116,16 @@ CONFIG_CRYPTO_GCM=y
 CONFIG_CRYPTO_AES=y
 CONFIG_CRYPTO_CHACHA20POLY1305=y
 
+# Read-only OCI layer indexes over verified userspace storage. Preserve layer
+# xattrs, ACLs and security labels when used as overlayfs lower directories.
+CONFIG_EROFS_FS=y
+CONFIG_EROFS_FS_XATTR=y
+CONFIG_EROFS_FS_POSIX_ACL=y
+CONFIG_EROFS_FS_SECURITY=y
+# Alternative to loop/FUSE for userspace-backed layer devices.
+CONFIG_BLK_DEV_UBLK=y
+CONFIG_IO_URING=y
+
 CONFIG_EXT4_FS=y
 CONFIG_SQUASHFS=y
 CONFIG_SQUASHFS_ZSTD=y