diff --git a/libnetwork/config/config.go b/libnetwork/config/config.go
index 95053323b0..0348b91df8 100644
--- a/libnetwork/config/config.go
+++ b/libnetwork/config/config.go
@@ -9,7 +9,6 @@ import (
 	"github.com/docker/docker/libnetwork/datastore"
 	"github.com/docker/docker/libnetwork/ipamutils"
 	"github.com/docker/docker/libnetwork/netlabel"
-	"github.com/docker/docker/libnetwork/osl"
 	"github.com/docker/docker/pkg/plugingetter"
 )
 
@@ -20,7 +19,15 @@ const (
 
 // Config encapsulates configurations of various Libnetwork components
 type Config struct {
-	DataDir                string
+	DataDir string
+	// ExecRoot is the base-path for libnetwork external key listeners
+	// (created in "<ExecRoot>/libnetwork/<Controller-Short-ID>.sock"),
+	// and is passed as "-exec-root: argument for "libnetwork-setkey".
+	//
+	// It is only used on Linux, but referenced in some "unix" files
+	// (linux and freebsd).
+	//
+	// FIXME(thaJeztah): ExecRoot is only used for Controller.startExternalKeyListener(), but "libnetwork-setkey" is only implemented on Linux.
 	ExecRoot               string
 	DefaultNetwork         string
 	DefaultDriver          string
@@ -109,12 +116,13 @@ func OptionDataDir(dataDir string) Option {
 	}
 }
 
-// OptionExecRoot function returns an option setter for exec root folder
+// OptionExecRoot function returns an option setter for exec root folder.
+//
+// On Linux, it sets both the controller's ExecRoot and osl.basePath, whereas
+// on FreeBSD, it only sets the controller's ExecRoot. It is a no-op on other
+// platforms.
 func OptionExecRoot(execRoot string) Option {
-	return func(c *Config) {
-		c.ExecRoot = execRoot
-		osl.SetBasePath(execRoot)
-	}
+	return optionExecRoot(execRoot)
 }
 
 // OptionPluginGetter returns a plugingetter for remote drivers.
diff --git a/libnetwork/config/config_freebsd.go b/libnetwork/config/config_freebsd.go
new file mode 100644
index 0000000000..b1a5da5f74
--- /dev/null
+++ b/libnetwork/config/config_freebsd.go
@@ -0,0 +1,8 @@
+package config
+
+// FIXME(thaJeztah): ExecRoot is only used for Controller.startExternalKeyListener(), but "libnetwork-setkey" is only implemented on Linux.
+func optionExecRoot(execRoot string) Option {
+	return func(c *Config) {
+		c.ExecRoot = execRoot
+	}
+}
diff --git a/libnetwork/config/config_linux.go b/libnetwork/config/config_linux.go
new file mode 100644
index 0000000000..0ecc6645ee
--- /dev/null
+++ b/libnetwork/config/config_linux.go
@@ -0,0 +1,11 @@
+package config
+
+import "github.com/docker/docker/libnetwork/osl"
+
+// optionExecRoot on Linux sets both the controller's ExecRoot and osl.basePath.
+func optionExecRoot(execRoot string) Option {
+	return func(c *Config) {
+		c.ExecRoot = execRoot
+		osl.SetBasePath(execRoot)
+	}
+}
diff --git a/libnetwork/config/config_unsupported.go b/libnetwork/config/config_unsupported.go
new file mode 100644
index 0000000000..0fc3e3fc1e
--- /dev/null
+++ b/libnetwork/config/config_unsupported.go
@@ -0,0 +1,8 @@
+//go:build !linux && !freebsd
+
+package config
+
+// optionExecRoot is a no-op on non-unix platforms.
+func optionExecRoot(execRoot string) Option {
+	return func(*Config) {}
+}
diff --git a/libnetwork/libnetwork_linux_test.go b/libnetwork/libnetwork_linux_test.go
index c57a9e4a92..072164bb7d 100644
--- a/libnetwork/libnetwork_linux_test.go
+++ b/libnetwork/libnetwork_linux_test.go
@@ -1714,7 +1714,7 @@ func externalKeyTest(t *testing.T, reexec bool) {
 	if reexec {
 		err := reexecSetKey("this-must-fail", containerID, controller.ID())
 		if err == nil {
-			t.Fatalf("SetExternalKey must fail if the corresponding namespace is not created")
+			t.Fatalf("libnetwork-setkey must fail if the corresponding namespace is not created")
 		}
 	} else {
 		// Setting an non-existing key (namespace) must fail
@@ -1737,7 +1737,7 @@ func externalKeyTest(t *testing.T, reexec bool) {
 	if reexec {
 		err := reexecSetKey("ValidKey", containerID, controller.ID())
 		if err != nil {
-			t.Fatalf("SetExternalKey failed with %v", err)
+			t.Fatalf("libnetwork-setkey failed with %v", err)
 		}
 	} else {
 		if err := sbox.SetKey("ValidKey"); err != nil {
diff --git a/libnetwork/osl/namespace_linux.go b/libnetwork/osl/namespace_linux.go
index f6edb1e85e..b7cdef50e5 100644
--- a/libnetwork/osl/namespace_linux.go
+++ b/libnetwork/osl/namespace_linux.go
@@ -43,16 +43,16 @@ var (
 	gpmWg            sync.WaitGroup
 	gpmCleanupPeriod = 60 * time.Second
 	gpmChan          = make(chan chan struct{})
-	prefix           = defaultPrefix
+	netnsBasePath    = filepath.Join(defaultPrefix, "netns")
 )
 
 // SetBasePath sets the base url prefix for the ns path
 func SetBasePath(path string) {
-	prefix = path
+	netnsBasePath = filepath.Join(path, "netns")
 }
 
 func basePath() string {
-	return filepath.Join(prefix, "netns")
+	return netnsBasePath
 }
 
 func createBasePath() {
diff --git a/libnetwork/osl/namespace_unsupported.go b/libnetwork/osl/namespace_unsupported.go
index 3e93d837f0..639b94d5ba 100644
--- a/libnetwork/osl/namespace_unsupported.go
+++ b/libnetwork/osl/namespace_unsupported.go
@@ -11,7 +11,3 @@ func GC() {
 func GetSandboxForExternalKey(path string, key string) (Sandbox, error) {
 	return nil, nil
 }
-
-// SetBasePath sets the base url prefix for the ns path
-func SetBasePath(path string) {
-}
diff --git a/libnetwork/osl/namespace_windows.go b/libnetwork/osl/namespace_windows.go
index 1ee8269928..7694563c6e 100644
--- a/libnetwork/osl/namespace_windows.go
+++ b/libnetwork/osl/namespace_windows.go
@@ -18,9 +18,4 @@ func GetSandboxForExternalKey(path string, key string) (Sandbox, error) {
 
 // GC triggers garbage collection of namespace path right away
 // and waits for it.
-func GC() {
-}
-
-// SetBasePath sets the base url prefix for the ns path
-func SetBasePath(path string) {
-}
+func GC() {}
diff --git a/libnetwork/osl/sandbox_freebsd.go b/libnetwork/osl/sandbox_freebsd.go
index 7c985ac53a..979f6d7c23 100644
--- a/libnetwork/osl/sandbox_freebsd.go
+++ b/libnetwork/osl/sandbox_freebsd.go
@@ -26,7 +26,3 @@ func GetSandboxForExternalKey(path string, key string) (Sandbox, error) {
 // and waits for it.
 func GC() {
 }
-
-// SetBasePath sets the base url prefix for the ns path
-func SetBasePath(path string) {
-}
diff --git a/libnetwork/sandbox_externalkey_unix.go b/libnetwork/sandbox_externalkey_unix.go
index ad40b27194..99aec0926f 100644
--- a/libnetwork/sandbox_externalkey_unix.go
+++ b/libnetwork/sandbox_externalkey_unix.go
@@ -65,11 +65,11 @@ func setKey() error {
 		return err
 	}
 
-	return SetExternalKey(shortCtlrID, containerID, fmt.Sprintf("/proc/%d/ns/net", state.Pid), *execRoot)
+	return setExternalKey(shortCtlrID, containerID, fmt.Sprintf("/proc/%d/ns/net", state.Pid), *execRoot)
 }
 
-// SetExternalKey provides a convenient way to set an External key to a sandbox
-func SetExternalKey(shortCtlrID string, containerID string, key string, execRoot string) error {
+// setExternalKey provides a convenient way to set an External key to a sandbox
+func setExternalKey(shortCtlrID string, containerID string, key string, execRoot string) error {
 	uds := filepath.Join(execRoot, execSubdir, shortCtlrID+".sock")
 	c, err := net.Dial("unix", uds)
 	if err != nil {