Issues migrating DinD from Sysbox to gVisor on GKE – outbound networking/TLS failures without --network=host

### Description

**Context**
We are migrating our Docker-in-Docker (DinD) setup on GKE 1.33.5 from Sysbox to gVisor due to Sysbox compatibility and support concerns with newer GKE versions.

**Previous setup:** DinD running successfully on Sysbox
**New setup:** DinD running on gVisor
**Environment:** GKE Standard, private cluster

After switching to gVisor, we are facing networking issues inside DinD, specifically when Docker containers try to access Debian repositories (Artifactory / deb.debian.org) to update or install packages.

To simplify debugging, we are not building Dockerfiles but running a basic curl container.

**Test Case 1: DinD 27.5.1 on gVisor**
```
kubectl exec -it dind-in-gvisor -- bash
$docker run -it docker.io/curlimages/curl -v https://deb.debian.org/debian/dists/trixie/InRelease
* Host deb.debian.org:443 was resolved.
* IPv6: (none)
* IPv4: 1.72.95.9
* Trying 1.72.95.9:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust Anchors:
* CAfile: /cacert.pem
* Recv failure: Connection reset by peer
* TLS connect error: error:00000000:lib(0)::reason(0)
* OpenSSL SSL_connect: Connection reset by peer in connection to deb.debian.org:443
* closing connection #0
curl: (35) Recv failure: Connection reset by peer
```

**Test Case 2: DinD 28.5.2 on gVisor**
```
kubectl exec -it dind-in-gvisor -- bash
$docker run -it docker.io/curlimages/curl -v https://deb.debian.org/debian/dists/trixie/InRelease
docker: Error response from daemon: failed to set up container networking: failed to add interface veth97cf7cc to sandbox: failed to subscribe to link updates: permission denied
```

**Workaround That Works**
If we explicitly run containers with host networking:
```
docker run --network=host -it docker.io/curlimages/curl https://deb.debian.org/debian/dists/trixie/InRelease
```

**Problem**
We have hundreds of existing workflows that use docker run / docker build without --network=host
Asking all teams to update their pipelines is not practical
Docker does not support a global “default network = host” setting

This worked fine on Sysbox, but fails on gVisor

**Questions / Help Needed**

- Is this a known limitation or incompatibility of running DinD on gVisor with Docker bridge networking?
- Is there a supported workaround to avoid --network=host per container, or configure DinD / gVisor / container runtime so outbound networking works reliably?
- Is this behavior expected across DinD 27.x vs 28.x, or a regression?

Any guidance on how to make this migration viable without changing all existing workflows would be greatly appreciated.

Thanks!

### Is this feature related to a specific bug?

_No response_

### Do you have a specific solution in mind?

_No response_