diff --git a/docker/Dockerfile b/docker/Dockerfile
index afdb529e..b00b6d72 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,4 +1,30 @@
-FROM --platform=linux/amd64 ubuntu:rolling
+FROM ubuntu:rolling AS trafficserver-build
+
+# Rolling Ubuntu no longer packages ATS. Build a verified upstream release in a
+# separate stage so its compiler and development dependencies stay out of the image.
+ARG ATS_VERSION=10.2.0
+ARG ATS_SHA512=afdd02ea6b37dc344e24e985727add89e26d0bbce4ac7f91f2c51134c8219484d6739d9b5c7c4c177f913cd0a9f756cbc0c89bcb06ee21bc159c32046e38379e
+ARG ATS_BUILD_JOBS=4
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    build-essential ca-certificates cmake curl ninja-build pkg-config \
+    libcap-dev libpcre2-dev libssl-dev zlib1g-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /usr/src/trafficserver
+RUN curl -fL --retry 3 "https://archive.apache.org/dist/trafficserver/trafficserver-${ATS_VERSION}.tar.bz2" -o ats.tar.bz2 \
+    && echo "${ATS_SHA512}  ats.tar.bz2" | sha512sum -c - \
+    && tar -xjf ats.tar.bz2 --strip-components=1 \
+    && cmake -S . -B build -G Ninja \
+    -DCMAKE_BUILD_TYPE=Release \
+    -DCMAKE_INSTALL_PREFIX=/opt/trafficserver \
+    -DWITH_USER=trafficserver -DWITH_GROUP=trafficserver \
+    -DBUILD_REGRESSION_TESTING=OFF -DBUILD_TESTING=OFF \
+    && cmake --build build --parallel "${ATS_BUILD_JOBS}" \
+    && DESTDIR=/opt/ats-install cmake --install build
+
+FROM ubuntu:rolling
 LABEL maintainer="Mark Nottingham <mnot@mnot.net>"
 
 
@@ -9,7 +35,7 @@ RUN apt-get update \
     nodejs npm git openssh-client telnet \
     squid \
     nginx \
-    trafficserver \
+    libcap2 libpcre2-8-0 libssl3t64 zlib1g \
     apache2 \
     varnish \
     golang \
@@ -20,7 +46,9 @@ RUN apt-get update \
 
 # squid
 
-COPY squid/squid.conf /etc/squid/conf.d/cache-test.conf
+# Use the test configuration directly. Ubuntu's default access rules run before
+# conf.d and reject the link-local origin address used by rootless Podman.
+COPY squid/squid.conf /etc/squid/squid.conf
 
 ENV SQUID_CACHE_DIR=/var/spool/squid
 ENV SQUID_LOG_DIR=/var/log/squid
@@ -37,12 +65,16 @@ EXPOSE 8002
 
 # trafficserver
 
-COPY trafficserver/ip_allow.config /etc/trafficserver/ip_allow.config
-COPY trafficserver/records.config /etc/trafficserver/records.config
-COPY trafficserver/remap.config /etc/trafficserver/remap.config
+COPY --from=trafficserver-build /opt/ats-install/opt/trafficserver/ /opt/trafficserver/
+RUN groupadd --system trafficserver \
+    && useradd --system --gid trafficserver --home-dir /opt/trafficserver/var/trafficserver \
+    --shell /usr/sbin/nologin trafficserver
+COPY trafficserver/ip_allow.yaml /opt/trafficserver/etc/trafficserver/ip_allow.yaml
+COPY trafficserver/records.yaml /opt/trafficserver/etc/trafficserver/records.yaml
+COPY trafficserver/remap.config /opt/trafficserver/etc/trafficserver/remap.config
 
-ENV TS_CACHE_DIR=/var/run/trafficserver
-ENV TS_LOG_DIR=/var/log/trafficserver
+ENV TS_CACHE_DIR=/opt/trafficserver/var/trafficserver
+ENV TS_LOG_DIR=/opt/trafficserver/var/log/trafficserver
 ENV TS_USER=trafficserver
 EXPOSE 8003
 
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index 4bc3abc0..e8abca90 100755
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -5,14 +5,14 @@
 if [[ ! -z $1 ]] ; then
 
     # squid
-    sed -i s/localhost/$1/g /etc/squid/conf.d/cache-test.conf
+    sed -i s/localhost/$1/g /etc/squid/squid.conf
 
     # nginx
     sed -i s/localhost/$1/g /etc/nginx/sites-enabled/cache-test.conf
     sed -i s/worker_connections 768/worker_connections 2048/ /etc/nginx/nginx.conf
 
     # trafficserver
-    sed -i s/localhost:8000/$1:8000/g /etc/trafficserver/remap.config
+    sed -i s/localhost:8000/$1:8000/g /opt/trafficserver/etc/trafficserver/remap.config
 
     # apache
     sed -i s/localhost/$1/g /etc/apache2/sites-enabled/cache-test.conf
diff --git a/docker/serve.sh b/docker/serve.sh
index 265e29ee..46164f27 100755
--- a/docker/serve.sh
+++ b/docker/serve.sh
@@ -7,7 +7,7 @@ echo "* Starting nginx"
 /usr/sbin/nginx -g "daemon off;" &
 
 echo "* starting TrafficServer"
-/usr/bin/traffic_manager &
+/opt/trafficserver/bin/traffic_server &
 
 echo "* Starting Apache"
 source /etc/apache2/envvars
diff --git a/docker/trafficserver/ip_allow.config b/docker/trafficserver/ip_allow.config
deleted file mode 100644
index 7c6c93ab..00000000
--- a/docker/trafficserver/ip_allow.config
+++ /dev/null
@@ -1 +0,0 @@
-src_ip=0.0.0.0-255.255.255.255 action=ip_allow
diff --git a/docker/trafficserver/ip_allow.yaml b/docker/trafficserver/ip_allow.yaml
new file mode 100644
index 00000000..b4f5d138
--- /dev/null
+++ b/docker/trafficserver/ip_allow.yaml
@@ -0,0 +1,10 @@
+# Allow the test harness to exercise every HTTP method through the reverse proxy.
+ip_allow:
+  - apply: in
+    ip_addrs: 0/0
+    action: allow
+    methods: ALL
+  - apply: in
+    ip_addrs: ::/0
+    action: allow
+    methods: ALL
diff --git a/docker/trafficserver/records.config b/docker/trafficserver/records.config
deleted file mode 100644
index 1e9bca06..00000000
--- a/docker/trafficserver/records.config
+++ /dev/null
@@ -1,181 +0,0 @@
-##############################################################################
-# *NOTE*: All options covered in this file should be documented in the docs:
-#
-#    https://docs.trafficserver.apache.org/records.config
-##############################################################################
-
-##############################################################################
-# Thread configurations. Docs:
-#    https://docs.trafficserver.apache.org/records.config#thread-variables
-##############################################################################
-CONFIG proxy.config.exec_thread.autoconfig INT 1
-CONFIG proxy.config.exec_thread.autoconfig.scale FLOAT 1.5
-CONFIG proxy.config.exec_thread.limit INT 2
-CONFIG proxy.config.accept_threads INT 1
-CONFIG proxy.config.task_threads INT 2
-CONFIG proxy.config.cache.threads_per_disk INT 8
-CONFIG proxy.config.exec_thread.affinity INT 1
-
-##############################################################################
-# Specify server addresses and ports to bind for HTTP and HTTPS. Docs:
-#    https://docs.trafficserver.apache.org/records.config#proxy.config.http.server_ports
-##############################################################################
-CONFIG proxy.config.http.server_ports STRING 8003
-
-##############################################################################
-# Via: headers. Docs:
-#     https://docs.trafficserver.apache.org/records.config#proxy-config-http-insert-response-via-str
-##############################################################################
-CONFIG proxy.config.http.insert_request_via_str INT 1
-CONFIG proxy.config.http.insert_response_via_str INT 0
-
-##############################################################################
-# Parent proxy configuration, in addition to these settings also see parent.config. Docs:
-#    https://docs.trafficserver.apache.org/records.config#parent-proxy-configuration
-#    https://docs.trafficserver.apache.org/en/latest/admin-guide/files/parent.config.en.html
-##############################################################################
-CONFIG proxy.config.http.parent_proxy_routing_enable INT 0
-CONFIG proxy.config.http.parent_proxy.retry_time INT 300
-CONFIG proxy.config.http.parent_proxy.connect_attempts_timeout INT 30
-CONFIG proxy.config.http.forward.proxy_auth_to_parent INT 0
-CONFIG proxy.config.http.uncacheable_requests_bypass_parent INT 1
-
-##############################################################################
-# HTTP connection timeouts (secs). Docs:
-#    https://docs.trafficserver.apache.org/records.config#http-connection-timeouts
-##############################################################################
-CONFIG proxy.config.http.keep_alive_no_activity_timeout_in INT 120
-CONFIG proxy.config.http.keep_alive_no_activity_timeout_out INT 120
-CONFIG proxy.config.http.transaction_no_activity_timeout_in INT 30
-CONFIG proxy.config.http.transaction_no_activity_timeout_out INT 30
-CONFIG proxy.config.http.transaction_active_timeout_in INT 900
-CONFIG proxy.config.http.transaction_active_timeout_out INT 0
-CONFIG proxy.config.http.accept_no_activity_timeout INT 120
-CONFIG proxy.config.net.default_inactivity_timeout INT 86400
-
-##############################################################################
-# Origin server connect attempts. Docs:
-#    https://docs.trafficserver.apache.org/records.config#origin-server-connect-attempts
-##############################################################################
-CONFIG proxy.config.http.connect_attempts_max_retries INT 3
-CONFIG proxy.config.http.connect_attempts_max_retries_dead_server INT 1
-CONFIG proxy.config.http.connect_attempts_rr_retries INT 3
-CONFIG proxy.config.http.connect_attempts_timeout INT 30
-CONFIG proxy.config.http.post_connect_attempts_timeout INT 1800
-CONFIG proxy.config.http.down_server.cache_time INT 60
-CONFIG proxy.config.http.down_server.abort_threshold INT 10
-
-##############################################################################
-# Negative response caching, for redirects and errors. Docs:
-#    https://docs.trafficserver.apache.org/records.config#negative-response-caching
-##############################################################################
-CONFIG proxy.config.http.negative_caching_enabled INT 0
-CONFIG proxy.config.http.negative_caching_lifetime INT 1800
-
-##############################################################################
-# Proxy users variables. Docs:
-#    https://docs.trafficserver.apache.org/records.config#proxy-user-variables
-##############################################################################
-CONFIG proxy.config.http.insert_client_ip INT 1
-CONFIG proxy.config.http.insert_squid_x_forwarded_for INT 1
-
-##############################################################################
-# Security. Docs:
-#    https://docs.trafficserver.apache.org/records.config#security
-##############################################################################
-CONFIG proxy.config.http.push_method_enabled INT 0
-
-##############################################################################
-# Enable / disable HTTP caching. Useful for testing, but also as an
-# overridable (per remap) config
-##############################################################################
-CONFIG proxy.config.http.cache.http INT 1
-
-##############################################################################
-# Cache control. Docs:
-#    https://docs.trafficserver.apache.org/records.config#cache-control
-#    https://docs.trafficserver.apache.org/en/latest/admin-guide/files/cache.config.en.html
-##############################################################################
-CONFIG proxy.config.http.cache.ignore_client_cc_max_age INT 1
-CONFIG proxy.config.http.normalize_ae INT 1
-CONFIG proxy.config.http.cache.cache_responses_to_cookies INT 1
-CONFIG proxy.config.http.cache.cache_urls_that_look_dynamic INT 1
-    # https://docs.trafficserver.apache.org/records.config#proxy-config-http-cache-when-to-revalidate
-CONFIG proxy.config.http.cache.when_to_revalidate INT 0
-    # https://docs.trafficserver.apache.org/records.config#proxy-config-http-cache-required-headers
-CONFIG proxy.config.http.cache.required_headers INT 2
-
-##############################################################################
-# Heuristic cache expiration. Docs:
-#    https://docs.trafficserver.apache.org/records.config#heuristic-expiration
-##############################################################################
-CONFIG proxy.config.http.cache.heuristic_min_lifetime INT 3600
-CONFIG proxy.config.http.cache.heuristic_max_lifetime INT 86400
-CONFIG proxy.config.http.cache.heuristic_lm_factor FLOAT 0.10
-
-##############################################################################
-# Network. Docs:
-#    https://docs.trafficserver.apache.org/records.config#network
-##############################################################################
-CONFIG proxy.config.net.connections_throttle INT 30000
-CONFIG proxy.config.net.max_connections_in INT 30000
-CONFIG proxy.config.net.max_connections_active_in INT 10000
-
-##############################################################################
-# RAM and disk cache configurations. Docs:
-#    https://docs.trafficserver.apache.org/records.config#ram-cache
-#    https://docs.trafficserver.apache.org/en/latest/admin-guide/files/storage.config.en.html
-##############################################################################
-CONFIG proxy.config.cache.ram_cache.size INT -1
-CONFIG proxy.config.cache.ram_cache_cutoff INT 4194304
-    # https://docs.trafficserver.apache.org/records.config#proxy-config-cache-limits-http-max-alts
-CONFIG proxy.config.cache.limits.http.max_alts INT 5
-    # https://docs.trafficserver.apache.org/records.config#proxy-config-cache-max-doc-size
-CONFIG proxy.config.cache.max_doc_size INT 0
-CONFIG proxy.config.cache.min_average_object_size INT 8000
-
-##############################################################################
-# Logging Config. Docs:
-#    https://docs.trafficserver.apache.org/records.config#logging-configuration
-#    https://docs.trafficserver.apache.org/en/latest/admin-guide/files/logging.yaml.en.html
-##############################################################################
-CONFIG proxy.config.log.logging_enabled INT 3
-CONFIG proxy.config.log.max_space_mb_for_logs INT 25000
-CONFIG proxy.config.log.max_space_mb_headroom INT 1000
-CONFIG proxy.config.log.rolling_enabled INT 1
-CONFIG proxy.config.log.rolling_interval_sec INT 86400
-CONFIG proxy.config.log.rolling_size_mb INT 10
-CONFIG proxy.config.log.auto_delete_rolled_files INT 1
-CONFIG proxy.config.log.periodic_tasks_interval INT 5
-
-##############################################################################
-# These settings control remapping, and if the proxy allows (open) forward proxy or not. Docs:
-#    https://docs.trafficserver.apache.org/records.config#url-remap-rules
-#    https://docs.trafficserver.apache.org/en/latest/admin-guide/files/remap.config.en.html
-##############################################################################
-CONFIG proxy.config.url_remap.remap_required INT 1
-    # https://docs.trafficserver.apache.org/records.config#proxy-config-url-remap-pristine-host-hdr
-CONFIG proxy.config.url_remap.pristine_host_hdr INT 1
-    # https://docs.trafficserver.apache.org/records.config#reverse-proxy
-CONFIG proxy.config.reverse_proxy.enabled INT 1
-
-##############################################################################
-# SSL Termination. Docs:
-#    https://docs.trafficserver.apache.org/records.config#client-related-configuration
-#    https://docs.trafficserver.apache.org/en/latest/admin-guide/files/ssl_multicert.config.en.html
-##############################################################################
-CONFIG proxy.config.ssl.client.verify.server INT 0
-CONFIG proxy.config.ssl.client.CA.cert.filename STRING NULL
-CONFIG proxy.config.ssl.server.cipher_suite STRING ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
-
-##############################################################################
-# Debugging. Docs:
-#    https://docs.trafficserver.apache.org/records.config#diagnostic-logging-configuration
-##############################################################################
-CONFIG proxy.config.diags.debug.enabled INT 0
-CONFIG proxy.config.diags.debug.tags STRING http|dns
-# ToDo: Undocumented
-CONFIG proxy.config.dump_mem_info_frequency INT 0
-CONFIG proxy.config.http.slow.log.threshold INT 0
-
-CONFIG proxy.config.admin.user_id STRING trafficserver
diff --git a/docker/trafficserver/records.yaml b/docker/trafficserver/records.yaml
new file mode 100644
index 00000000..a164796d
--- /dev/null
+++ b/docker/trafficserver/records.yaml
@@ -0,0 +1,97 @@
+# ATS 10 configuration; retain the test settings from records.config.
+# Container runtimes put host.docker.internal in /etc/hosts, not DNS.
+records:
+  exec_thread:
+    autoconfig:
+      enabled: 1
+      scale: 1.5
+    limit: 2
+    affinity: 1
+  accept_threads: 1
+  task_threads: 2
+  cache:
+    threads_per_disk: 8
+    ram_cache:
+      size: -1
+    ram_cache_cutoff: 4194304
+    limits:
+      http:
+        max_alts: 5
+    max_doc_size: 0
+    min_average_object_size: 8000
+  http:
+    server_ports: "8003"
+    insert_request_via_str: 1
+    insert_response_via_str: 0
+    parent_proxy:
+      retry_time: 300
+    forward:
+      proxy_auth_to_parent: 0
+    uncacheable_requests_bypass_parent: 1
+    keep_alive_no_activity_timeout_in: 120
+    keep_alive_no_activity_timeout_out: 120
+    transaction_no_activity_timeout_in: 30
+    transaction_no_activity_timeout_out: 30
+    transaction_active_timeout_in: 900
+    transaction_active_timeout_out: 0
+    accept_no_activity_timeout: 120
+    connect_attempts_max_retries: 3
+    connect_attempts_max_retries_suspect_server: 1
+    connect_attempts_rr_retries: 3
+    connect_attempts_timeout: 30
+    down_server:
+      cache_time: 60
+    negative_caching_enabled: 0
+    negative_caching_lifetime: 1800
+    insert_client_ip: 1
+    insert_squid_x_forwarded_for: 1
+    push_method_enabled: 0
+    cache:
+      http: 1
+      ignore_client_cc_max_age: 1
+      cache_responses_to_cookies: 1
+      cache_urls_that_look_dynamic: 1
+      when_to_revalidate: 0
+      required_headers: 2
+      heuristic_min_lifetime: 3600
+      heuristic_max_lifetime: 86400
+      heuristic_lm_factor: 0.1
+    normalize_ae: 1
+    slow:
+      log:
+        threshold: 0
+  hostdb:
+    host_file:
+      path: "/etc/hosts"
+  net:
+    default_inactivity_timeout: 86400
+    connections_throttle: 30000
+    max_connections_in: 30000
+  log:
+    logging_enabled: 3
+    max_space_mb_for_logs: 25000
+    max_space_mb_headroom: 1000
+    rolling_enabled: 1
+    rolling_interval_sec: 86400
+    rolling_size_mb: 10
+    auto_delete_rolled_files: 1
+    periodic_tasks_interval: 5
+  url_remap:
+    remap_required: 1
+    pristine_host_hdr: 1
+  reverse_proxy:
+    enabled: 1
+  ssl:
+    client:
+      CA:
+        cert:
+          filename: null
+    server:
+      cipher_suite: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
+  diags:
+    debug:
+      enabled: 0
+      tags: "http|dns"
+  dump_mem_info_frequency: 0
+  admin:
+    user_id: "trafficserver"
diff --git a/test-docker.sh b/test-docker.sh
index c4cd3863..36bdc1c9 100755
--- a/test-docker.sh
+++ b/test-docker.sh
@@ -84,7 +84,11 @@ function test_proxy {
       ;;
   esac
 
-  echo "* ${PKG} $(docker container exec tmp_proxies /usr/bin/apt-cache show ${PKG} | grep Version)"
+  if [[ ${PKG} == trafficserver ]]; then
+    docker container exec tmp_proxies /opt/trafficserver/bin/traffic_server --version
+  else
+    echo "* ${PKG} $(docker container exec tmp_proxies /usr/bin/apt-cache show ${PKG} | grep Version)"
+  fi
 
   if [[ -z "${TEST_ID}" ]]; then
     npm run --silent cli --base=http://localhost:${PROXY_PORT} > "results/${PROXY}.json"