Function can_rootless_overlay 

pub fn can_rootless_overlay(
    is_root: bool,
    has_cap_net_admin: bool,
    tun_device_available: bool,
    pasta_available: bool,
) -> bool

Decide whether the daemon can run the overlay in fully rootless mode: the overlay daemon wraps itself in its own user+network namespace (holding CAP_NET_ADMIN over its OWN netns only) and uses pasta for egress, instead of requiring host root or a setcap’d binary.

Rootless overlay is viable only when ALL hold:

• NOT already root (a root daemon should use the normal root overlay path),
• the process does NOT already hold effective CAP_NET_ADMIN (if it does, the setcap/root overlay path is simpler and gives host-level networking),
• /dev/net/tun is openable (boringtun needs it for the TUN device), and
• the pasta (passt) egress helper is available on the host.

Pure and side-effect-free so it can be unit-tested without namespaces.