From 24aa5e41531c5720decdadd6ee355d394bb1b22e Mon Sep 17 00:00:00 2001
From: Abel Feng <fshb1988@gmail.com>
Date: Thu, 6 Mar 2025 11:17:00 +0800
Subject: [PATCH 001/225] add sync syscall before get container diff when
 commit

Signed-off-by: Abel Feng <fshb1988@gmail.com>
---
 pkg/imgutil/commit/commit.go       |  3 +++
 pkg/imgutil/commit/commit_other.go | 23 +++++++++++++++++++++++
 pkg/imgutil/commit/commit_unix.go  | 25 +++++++++++++++++++++++++
 3 files changed, 51 insertions(+)
 create mode 100644 pkg/imgutil/commit/commit_other.go
 create mode 100644 pkg/imgutil/commit/commit_unix.go

diff --git a/pkg/imgutil/commit/commit.go b/pkg/imgutil/commit/commit.go
index d660d86e88b..782a5cd6edb 100644
--- a/pkg/imgutil/commit/commit.go
+++ b/pkg/imgutil/commit/commit.go
@@ -173,6 +173,9 @@ func Commit(ctx context.Context, client *containerd.Client, container containerd
 	}
 	defer done(ctx)
 
+	// Sync filesystem to make sure that all the data writes in container could be persisted to disk.
+	Sync()
+
 	diffLayerDesc, diffID, err := createDiff(ctx, id, sn, client.ContentStore(), differ)
 	if err != nil {
 		return emptyDigest, fmt.Errorf("failed to export layer: %w", err)
diff --git a/pkg/imgutil/commit/commit_other.go b/pkg/imgutil/commit/commit_other.go
new file mode 100644
index 00000000000..2a7b18cf56d
--- /dev/null
+++ b/pkg/imgutil/commit/commit_other.go
@@ -0,0 +1,23 @@
+//go:build !unix
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package commit
+
+func Sync() {
+
+}
diff --git a/pkg/imgutil/commit/commit_unix.go b/pkg/imgutil/commit/commit_unix.go
new file mode 100644
index 00000000000..38e602d886f
--- /dev/null
+++ b/pkg/imgutil/commit/commit_unix.go
@@ -0,0 +1,25 @@
+//go:build unix
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package commit
+
+import "syscall"
+
+func Sync() {
+	syscall.Sync()
+}

From 7bd097b33c27dde64f4e6d18f8579f3e0882592f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 14 Mar 2025 22:46:55 +0000
Subject: [PATCH 002/225] build(deps): bump docker/login-action from 3.3.0 to
 3.4.0

Bumps [docker/login-action](https://github.com/docker/login-action) from 3.3.0 to 3.4.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/9780b0c442fbb1117ed29e0efdff1e18412f7567...74a5d142397b4f367a81961eba4e8cd7edddf772)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/ghcr-image-build-and-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ghcr-image-build-and-publish.yml b/.github/workflows/ghcr-image-build-and-publish.yml
index dbfa167ffe3..4a908c0565e 100644
--- a/.github/workflows/ghcr-image-build-and-publish.yml
+++ b/.github/workflows/ghcr-image-build-and-publish.yml
@@ -43,7 +43,7 @@ jobs:
       # https://github.com/docker/login-action
       - name: Log into registry ${{ env.REGISTRY }}
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  # v3.3.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  # v3.4.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

From dd9e8ce77d20ab27b56767a3c2c6db964d57a23d Mon Sep 17 00:00:00 2001
From: Swagat Bora <sbora@amazon.com>
Date: Fri, 28 Feb 2025 06:41:07 +0000
Subject: [PATCH 003/225] Add support for remaining blkio settings

Also adds HostConfig inspect tests and skip unsupported docker tests

Signed-off-by: Swagat Bora <sbora@amazon.com>
---
 cmd/nerdctl/container/container_create.go     |  29 +-
 .../container/container_inspect_linux_test.go |  62 +++-
 cmd/nerdctl/container/container_run.go        |  10 +-
 .../container_run_cgroup_linux_test.go        | 191 ++++++++++
 docs/command-reference.md                     |   7 +-
 pkg/api/types/container_types.go              |  17 +-
 pkg/cmd/container/create.go                   |  15 +-
 pkg/cmd/container/run_blkio_linux.go          | 346 ++++++++++++++++++
 pkg/cmd/container/run_cgroup_linux.go         |  21 +-
 pkg/infoutil/infoutil.go                      |  38 +-
 pkg/inspecttypes/dockercompat/dockercompat.go | 114 +++++-
 .../dockercompat/dockercompat_test.go         |  15 +-
 pkg/testutil/nerdtest/requirements.go         |  22 ++
 13 files changed, 827 insertions(+), 60 deletions(-)
 create mode 100644 pkg/cmd/container/run_blkio_linux.go

diff --git a/cmd/nerdctl/container/container_create.go b/cmd/nerdctl/container/container_create.go
index 1ef0f958f9c..934551aa84a 100644
--- a/cmd/nerdctl/container/container_create.go
+++ b/cmd/nerdctl/container/container_create.go
@@ -199,19 +199,42 @@ func createOptions(cmd *cobra.Command) (types.ContainerCreateOptions, error) {
 	if err != nil {
 		return opt, err
 	}
+	opt.Cgroupns, err = cmd.Flags().GetString("cgroupns")
+	if err != nil {
+		return opt, err
+	}
+	opt.CgroupParent, err = cmd.Flags().GetString("cgroup-parent")
+	if err != nil {
+		return opt, err
+	}
+	opt.Device, err = cmd.Flags().GetStringSlice("device")
+	if err != nil {
+		return opt, err
+	}
+	// #endregion
+
+	// #region for blkio flags
 	opt.BlkioWeight, err = cmd.Flags().GetUint16("blkio-weight")
 	if err != nil {
 		return opt, err
 	}
-	opt.Cgroupns, err = cmd.Flags().GetString("cgroupns")
+	opt.BlkioWeightDevice, err = cmd.Flags().GetStringArray("blkio-weight-device")
 	if err != nil {
 		return opt, err
 	}
-	opt.CgroupParent, err = cmd.Flags().GetString("cgroup-parent")
+	opt.BlkioDeviceReadBps, err = cmd.Flags().GetStringArray("device-read-bps")
 	if err != nil {
 		return opt, err
 	}
-	opt.Device, err = cmd.Flags().GetStringSlice("device")
+	opt.BlkioDeviceWriteBps, err = cmd.Flags().GetStringArray("device-write-bps")
+	if err != nil {
+		return opt, err
+	}
+	opt.BlkioDeviceReadIOps, err = cmd.Flags().GetStringArray("device-read-iops")
+	if err != nil {
+		return opt, err
+	}
+	opt.BlkioDeviceWriteIOps, err = cmd.Flags().GetStringArray("device-write-iops")
 	if err != nil {
 		return opt, err
 	}
diff --git a/cmd/nerdctl/container/container_inspect_linux_test.go b/cmd/nerdctl/container/container_inspect_linux_test.go
index 2c7bc7b8197..610c17e45f2 100644
--- a/cmd/nerdctl/container/container_inspect_linux_test.go
+++ b/cmd/nerdctl/container/container_inspect_linux_test.go
@@ -19,6 +19,7 @@ package container
 import (
 	"fmt"
 	"os"
+	"os/exec"
 	"slices"
 	"strings"
 	"testing"
@@ -246,7 +247,6 @@ func TestContainerInspectHostConfig(t *testing.T) {
 	base.Cmd("run", "-d", "--name", testContainer,
 		"--cpuset-cpus", "0-1",
 		"--cpuset-mems", "0",
-		"--blkio-weight", "500",
 		"--cpu-shares", "1024",
 		"--cpu-quota", "100000",
 		"--group-add", "1000",
@@ -266,7 +266,6 @@ func TestContainerInspectHostConfig(t *testing.T) {
 
 	assert.Equal(t, "0-1", inspect.HostConfig.CPUSetCPUs)
 	assert.Equal(t, "0", inspect.HostConfig.CPUSetMems)
-	assert.Equal(t, uint16(500), inspect.HostConfig.BlkioWeight)
 	assert.Equal(t, uint64(1024), inspect.HostConfig.CPUShares)
 	assert.Equal(t, int64(100000), inspect.HostConfig.CPUQuota)
 	assert.Assert(t, slices.Contains(inspect.HostConfig.GroupAdd, "1000"), "Expected '1000' to be in GroupAdd")
@@ -311,6 +310,11 @@ func TestContainerInspectHostConfigDefaults(t *testing.T) {
 	assert.Equal(t, "", inspect.HostConfig.CPUSetCPUs)
 	assert.Equal(t, "", inspect.HostConfig.CPUSetMems)
 	assert.Equal(t, uint16(0), inspect.HostConfig.BlkioWeight)
+	assert.Equal(t, 0, len(inspect.HostConfig.BlkioWeightDevice))
+	assert.Equal(t, 0, len(inspect.HostConfig.BlkioDeviceReadBps))
+	assert.Equal(t, 0, len(inspect.HostConfig.BlkioDeviceReadIOps))
+	assert.Equal(t, 0, len(inspect.HostConfig.BlkioDeviceWriteBps))
+	assert.Equal(t, 0, len(inspect.HostConfig.BlkioDeviceWriteIOps))
 	assert.Equal(t, uint64(0), inspect.HostConfig.CPUShares)
 	assert.Equal(t, int64(0), inspect.HostConfig.CPUQuota)
 	assert.Equal(t, hc.GroupAddSize, len(inspect.HostConfig.GroupAdd))
@@ -456,6 +460,60 @@ func TestContainerInspectDevices(t *testing.T) {
 	assert.DeepEqual(t, expectedDevices, inspect.HostConfig.Devices)
 }
 
+func TestContainerInspectBlkioSettings(t *testing.T) {
+	testutil.DockerIncompatible(t)
+	testContainer := testutil.Identifier(t)
+	// Some of the blkio settings are not supported in cgroup v1.
+	// So skip this test if running on cgroup v1
+	if infoutil.CgroupsVersion() == "1" {
+		t.Skip("test skipped for rootless containers or if running with cgroup v1")
+	}
+
+	if rootlessutil.IsRootless() {
+		t.Skip("test requires root privilege to create a dummy device")
+	}
+
+	devPath := "/dev/dummy-zero"
+	// a dummy zero device: mknod /dev/dummy-zero c 1 5
+	helperCmd := exec.Command("mknod", []string{devPath, "c", "1", "5"}...)
+	if out, err := helperCmd.CombinedOutput(); err != nil {
+		err = fmt.Errorf("cannot create %q: %q: %w", devPath, string(out), err)
+		t.Fatal(err)
+	}
+
+	// ensure the file will be removed in case of failed in the test
+	defer func() {
+		if err := exec.Command("rm", "-f", devPath).Run(); err != nil {
+			t.Logf("failed to remove device %s: %v", devPath, err)
+		}
+	}()
+
+	base := testutil.NewBase(t)
+	defer base.Cmd("rm", "-f", testContainer).AssertOK()
+
+	base.Cmd("run", "-d", "--name", testContainer,
+		"--blkio-weight", "500",
+		"--blkio-weight-device", "/dev/dummy-zero:500",
+		"--device-read-bps", "/dev/dummy-zero:1048576",
+		"--device-read-iops", "/dev/dummy-zero:1000",
+		"--device-write-bps", "/dev/dummy-zero:2097152",
+		"--device-write-iops", "/dev/dummy-zero:2000",
+		testutil.AlpineImage, "sleep", "infinity").AssertOK()
+
+	inspect := base.InspectContainer(testContainer)
+	assert.Equal(t, uint16(500), inspect.HostConfig.BlkioWeight)
+	assert.Equal(t, 1, len(inspect.HostConfig.BlkioWeightDevice))
+	assert.Equal(t, uint16(500), *inspect.HostConfig.BlkioWeightDevice[0].Weight)
+	assert.Equal(t, 1, len(inspect.HostConfig.BlkioDeviceReadBps))
+	assert.Equal(t, uint64(1048576), inspect.HostConfig.BlkioDeviceReadBps[0].Rate)
+	assert.Equal(t, 1, len(inspect.HostConfig.BlkioDeviceWriteBps))
+	assert.Equal(t, uint64(2097152), inspect.HostConfig.BlkioDeviceWriteBps[0].Rate)
+	assert.Equal(t, 1, len(inspect.HostConfig.BlkioDeviceReadIOps))
+	assert.Equal(t, uint64(1000), inspect.HostConfig.BlkioDeviceReadIOps[0].Rate)
+	assert.Equal(t, 1, len(inspect.HostConfig.BlkioDeviceWriteIOps))
+	assert.Equal(t, uint64(2000), inspect.HostConfig.BlkioDeviceWriteIOps[0].Rate)
+}
+
 type hostConfigValues struct {
 	Driver       string
 	ShmSize      int64
diff --git a/cmd/nerdctl/container/container_run.go b/cmd/nerdctl/container/container_run.go
index e45a1617c5a..d42d61e1d2f 100644
--- a/cmd/nerdctl/container/container_run.go
+++ b/cmd/nerdctl/container/container_run.go
@@ -155,7 +155,6 @@ func setCreateFlags(cmd *cobra.Command) {
 	})
 	cmd.Flags().Int64("pids-limit", -1, "Tune container pids limit (set -1 for unlimited)")
 	cmd.Flags().StringSlice("cgroup-conf", nil, "Configure cgroup v2 (key=value)")
-	cmd.Flags().Uint16("blkio-weight", 0, "Block IO (relative weight), between 10 and 1000, or 0 to disable (default 0)")
 	cmd.Flags().String("cgroupns", defaults.CgroupnsMode(), `Cgroup namespace to use, the default depends on the cgroup version ("host"|"private")`)
 	cmd.Flags().String("cgroup-parent", "", "Optional parent cgroup for the container")
 	cmd.RegisterFlagCompletionFunc("cgroupns", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
@@ -173,6 +172,15 @@ func setCreateFlags(cmd *cobra.Command) {
 	cmd.Flags().String("rdt-class", "", "Name of the RDT class (or CLOS) to associate the container with")
 	// #endregion
 
+	// #region blkio flags
+	cmd.Flags().Uint16("blkio-weight", 0, "Block IO (relative weight), between 10 and 1000, or 0 to disable (default 0)")
+	cmd.Flags().StringArray("blkio-weight-device", []string{}, "Block IO weight (relative device weight) (default [])")
+	cmd.Flags().StringArray("device-read-bps", []string{}, "Limit read rate (bytes per second) from a device (default [])")
+	cmd.Flags().StringArray("device-read-iops", []string{}, "Limit read rate (IO per second) from a device (default [])")
+	cmd.Flags().StringArray("device-write-bps", []string{}, "Limit write rate (bytes per second) to a device (default [])")
+	cmd.Flags().StringArray("device-write-iops", []string{}, "Limit write rate (IO per second) to a device (default [])")
+	// #endregion
+
 	// user flags
 	cmd.Flags().StringP("user", "u", "", "Username or UID (format: <name|uid>[:<group|gid>])")
 	cmd.Flags().String("umask", "", "Set the umask inside the container. Defaults to 0022")
diff --git a/cmd/nerdctl/container/container_run_cgroup_linux_test.go b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
index edf42711730..2e1fce340df 100644
--- a/cmd/nerdctl/container/container_run_cgroup_linux_test.go
+++ b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
@@ -21,8 +21,10 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"testing"
 
 	"gotest.tools/v3/assert"
@@ -477,3 +479,192 @@ func TestRunBlkioWeightCgroupV2(t *testing.T) {
 	base.Cmd("update", containerName, "--blkio-weight", "400").AssertOK()
 	base.Cmd("exec", containerName, "cat", "io.bfq.weight").AssertOutExactly("default 400\n")
 }
+
+func TestRunBlkioSettingCgroupV2(t *testing.T) {
+	testCase := nerdtest.Setup()
+	testCase.Require = nerdtest.Rootful
+
+	// Create dummy device path
+	dummyDev := "/dev/dummy-zero"
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		// Create dummy device
+		helperCmd := exec.Command("mknod", dummyDev, "c", "1", "5")
+		if out, err := helperCmd.CombinedOutput(); err != nil {
+			t.Fatalf("cannot create %q: %q: %v", dummyDev, string(out), err)
+		}
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		// Clean up the dummy device
+		if err := exec.Command("rm", "-f", dummyDev).Run(); err != nil {
+			t.Logf("failed to remove device %s: %v", dummyDev, err)
+		}
+	}
+
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "blkio-weight",
+			Require:     nerdtest.CGroupV2,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("run", "-d", "--name", data.Identifier(),
+					"--blkio-weight", "150",
+					testutil.AlpineImage, "sleep", "infinity")
+			},
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rm", "-f", data.Identifier())
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					ExitCode: 0,
+					Output: expect.All(
+						func(stdout string, info string, t *testing.T) {
+							assert.Assert(t, strings.Contains(helpers.Capture("inspect", "--format", "{{.HostConfig.BlkioWeight}}", data.Identifier()), "150"))
+						},
+					),
+				}
+			},
+		},
+		{
+			Description: "blkio-weight-device",
+			Require:     nerdtest.CGroupV2,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("run", "-d", "--name", data.Identifier(),
+					"--blkio-weight-device", dummyDev+":100",
+					testutil.AlpineImage, "sleep", "infinity")
+			},
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rm", "-f", data.Identifier())
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					ExitCode: 0,
+					Output: expect.All(
+						func(stdout string, info string, t *testing.T) {
+							inspectOut := helpers.Capture("inspect", "--format", "{{range .HostConfig.BlkioWeightDevice}}{{.Weight}}{{end}}", data.Identifier())
+							assert.Assert(t, strings.Contains(inspectOut, "100"))
+						},
+					),
+				}
+			},
+		},
+		{
+			Description: "device-read-bps",
+			Require: require.All(
+				nerdtest.CGroupV2,
+				// Docker cli (v26.1.3) available in github runners has a bug where some of the blkio options
+				// do not work https://github.com/docker/cli/issues/5321. The fix has been merged to the latest releases
+				// but not currently available in the v26 release.
+				require.Not(nerdtest.Docker),
+			),
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("run", "-d", "--name", data.Identifier(),
+					"--device-read-bps", dummyDev+":1048576",
+					testutil.AlpineImage, "sleep", "infinity")
+			},
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rm", "-f", data.Identifier())
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					ExitCode: 0,
+					Output: expect.All(
+						func(stdout string, info string, t *testing.T) {
+							inspectOut := helpers.Capture("inspect", "--format", "{{range .HostConfig.BlkioDeviceReadBps}}{{.Rate}}{{end}}", data.Identifier())
+							assert.Assert(t, strings.Contains(inspectOut, "1048576"))
+						},
+					),
+				}
+			},
+		},
+		{
+			Description: "device-write-bps",
+			Require: require.All(
+				nerdtest.CGroupV2,
+				// Docker cli (v26.1.3) available in github runners has a bug where some of the blkio options
+				// do not work https://github.com/docker/cli/issues/5321. The fix has been merged to the latest releases
+				// but not currently available in the v26 release.
+				require.Not(nerdtest.Docker),
+			),
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("run", "-d", "--name", data.Identifier(),
+					"--device-write-bps", dummyDev+":2097152",
+					testutil.AlpineImage, "sleep", "infinity")
+			},
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rm", "-f", data.Identifier())
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					ExitCode: 0,
+					Output: expect.All(
+						func(stdout string, info string, t *testing.T) {
+							inspectOut := helpers.Capture("inspect", "--format", "{{range .HostConfig.BlkioDeviceWriteBps}}{{.Rate}}{{end}}", data.Identifier())
+							assert.Assert(t, strings.Contains(inspectOut, "2097152"))
+						},
+					),
+				}
+			},
+		},
+		{
+			Description: "device-read-iops",
+			Require: require.All(
+				nerdtest.CGroupV2,
+				// Docker cli (v26.1.3) available in github runners has a bug where some of the blkio options
+				// do not work https://github.com/docker/cli/issues/5321. The fix has been merged to the latest releases
+				// but not currently available in the v26 release.
+				require.Not(nerdtest.Docker),
+			),
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("run", "-d", "--name", data.Identifier(),
+					"--device-read-iops", dummyDev+":1000",
+					testutil.AlpineImage, "sleep", "infinity")
+			},
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rm", "-f", data.Identifier())
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					ExitCode: 0,
+					Output: expect.All(
+						func(stdout string, info string, t *testing.T) {
+							inspectOut := helpers.Capture("inspect", "--format", "{{range .HostConfig.BlkioDeviceReadIOps}}{{.Rate}}{{end}}", data.Identifier())
+							assert.Assert(t, strings.Contains(inspectOut, "1000"))
+						},
+					),
+				}
+			},
+		},
+		{
+			Description: "device-write-iops",
+			Require: require.All(
+				nerdtest.CGroupV2,
+				// Docker cli (v26.1.3) available in github runners has a bug where some of the blkio options
+				// do not work https://github.com/docker/cli/issues/5321. The fix has been merged to the latest releases
+				// but not currently available in the v26 release.
+				require.Not(nerdtest.Docker),
+			),
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("run", "-d", "--name", data.Identifier(),
+					"--device-write-iops", dummyDev+":2000",
+					testutil.AlpineImage, "sleep", "infinity")
+			},
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rm", "-f", data.Identifier())
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					ExitCode: 0,
+					Output: expect.All(
+						func(stdout string, info string, t *testing.T) {
+							inspectOut := helpers.Capture("inspect", "--format", "{{range .HostConfig.BlkioDeviceWriteIOps}}{{.Rate}}{{end}}", data.Identifier())
+							assert.Assert(t, strings.Contains(inspectOut, "2000"))
+						},
+					),
+				}
+			},
+		},
+	}
+
+	testCase.Run(t)
+}
diff --git a/docs/command-reference.md b/docs/command-reference.md
index 41fcd969fd6..a4d2f7af7be 100644
--- a/docs/command-reference.md
+++ b/docs/command-reference.md
@@ -213,6 +213,11 @@ Resource flags:
 - :whale: `--pids-limit`: Tune container pids limit
 - :nerd_face: `--cgroup-conf`: Configure cgroup v2 (key=value)
 - :whale: `--blkio-weight`: Block IO (relative weight), between 10 and 1000, or 0 to disable (default 0)
+- :whale: `--blkio-weight-device`: Block IO weight (relative device weight)
+- :whale: `--device-read-bps`: Limit read rate (bytes per second) from a device
+- :whale: `--device-read-iops`: Limit read rate (IO per second) from a device
+- :whale: `--device-write-bps`: Limit write rate (bytes per second) to a device
+- :whale: `--device-write-iops`: Limit write rate (IO per second) to a device
 - :whale: `--cgroupns=(host|private)`: Cgroup namespace to use
   - Default: "private" on cgroup v2 hosts, "host" on cgroup v1 hosts
 - :whale: `--cgroup-parent`: Optional parent cgroup for the container
@@ -414,7 +419,7 @@ IPFS flags:
 - :nerd_face: `--ipfs-address`: Multiaddr of IPFS API (default uses `$IPFS_PATH` env variable if defined or local directory `~/.ipfs`)
 
 Unimplemented `docker run` flags:
-    `--blkio-weight-device`, `--cpu-rt-*`, `--device-*`,
+    `--cpu-rt-*`, `--device-cgroup-rule`,
     `--disable-content-trust`, `--expose`, `--health-*`, `--isolation`, `--no-healthcheck`,
     `--link*`, `--publish-all`, `--storage-opt`,
     `--userns`, `--volume-driver`
diff --git a/pkg/api/types/container_types.go b/pkg/api/types/container_types.go
index 3d0ae773ce1..5325915631d 100644
--- a/pkg/api/types/container_types.go
+++ b/pkg/api/types/container_types.go
@@ -140,8 +140,6 @@ type ContainerCreateOptions struct {
 	PidsLimit int64
 	// CgroupConf specifies to configure cgroup v2 (key=value)
 	CgroupConf []string
-	// BlkioWeight specifies the block IO (relative weight), between 10 and 1000, or 0 to disable (default 0)
-	BlkioWeight uint16
 	// Cgroupns specifies the cgroup namespace to use
 	Cgroupns string
 	// CgroupParent specifies the optional parent cgroup for the container
@@ -150,6 +148,21 @@ type ContainerCreateOptions struct {
 	Device []string
 	// #endregion
 
+	// #region for blkio related flags
+	// BlkioWeight specifies the block IO (relative weight), between 10 and 1000, or 0 to disable (default 0)
+	BlkioWeight uint16
+	// BlkioWeightDevice specifies the Block IO weight (relative device weight)
+	BlkioWeightDevice []string
+	// BlkioDeviceReadBps specifies the Block IO read rate limit(bytes per second) of a device
+	BlkioDeviceReadBps []string
+	// BlkioDeviceWriteBps specifies the Block IO write rate limit(bytes per second) of a device
+	BlkioDeviceWriteBps []string
+	// BlkioDeviceReadIOps specifies the Block IO read rate limit(IO per second) of a device
+	BlkioDeviceReadIOps []string
+	// BlkioDeviceWriteIOps specifies the Block IO read rate limit(IO per second) of a device
+	BlkioDeviceWriteIOps []string
+	// #endregion
+
 	// #region for intel RDT flags
 	// RDTClass specifies the Intel Resource Director Technology (RDT) class
 	RDTClass string
diff --git a/pkg/cmd/container/create.go b/pkg/cmd/container/create.go
index 1dfe123bd0a..7127e364302 100644
--- a/pkg/cmd/container/create.go
+++ b/pkg/cmd/container/create.go
@@ -331,8 +331,6 @@ func Create(ctx context.Context, client *containerd.Client, args []string, netMa
 
 	internalLabels.rm = containerutil.EncodeContainerRmOptLabel(options.Rm)
 
-	internalLabels.blkioWeight = options.BlkioWeight
-
 	// TODO: abolish internal labels and only use annotations
 	ilOpt, err := withInternalLabels(internalLabels)
 	if err != nil {
@@ -624,11 +622,10 @@ func withStop(stopSignal string, stopTimeout int, ensuredImage *imgutil.EnsuredI
 
 type internalLabels struct {
 	// labels from cmd options
-	namespace   string
-	platform    string
-	extraHosts  []string
-	pidFile     string
-	blkioWeight uint16
+	namespace  string
+	platform   string
+	extraHosts []string
+	pidFile    string
 	// labels from cmd options or automatically set
 	name       string
 	hostname   string
@@ -754,10 +751,6 @@ func withInternalLabels(internalLabels internalLabels) (containerd.NewContainerO
 		m[labels.ContainerAutoRemove] = internalLabels.rm
 	}
 
-	if internalLabels.blkioWeight > 0 {
-		hostConfigLabel.BlkioWeight = internalLabels.blkioWeight
-	}
-
 	if internalLabels.cidFile != "" {
 		hostConfigLabel.CidFile = internalLabels.cidFile
 	}
diff --git a/pkg/cmd/container/run_blkio_linux.go b/pkg/cmd/container/run_blkio_linux.go
new file mode 100644
index 00000000000..1b3f03929c3
--- /dev/null
+++ b/pkg/cmd/container/run_blkio_linux.go
@@ -0,0 +1,346 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package container
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/docker/go-units"
+	"github.com/opencontainers/runtime-spec/specs-go"
+	"golang.org/x/sys/unix"
+
+	"github.com/containerd/containerd/v2/core/containers"
+	"github.com/containerd/containerd/v2/pkg/oci"
+	"github.com/containerd/log"
+
+	"github.com/containerd/nerdctl/v2/pkg/api/types"
+	"github.com/containerd/nerdctl/v2/pkg/infoutil"
+)
+
+// WeightDevice is a structure that holds device:weight pair
+type WeightDevice struct {
+	Path   string
+	Weight uint16
+}
+
+func (w *WeightDevice) String() string {
+	return fmt.Sprintf("%s:%d", w.Path, w.Weight)
+}
+
+// ThrottleDevice is a structure that holds device:rate_per_second pair
+type ThrottleDevice struct {
+	Path string
+	Rate uint64
+}
+
+func (t *ThrottleDevice) String() string {
+	return fmt.Sprintf("%s:%d", t.Path, t.Rate)
+}
+
+func toOCIWeightDevices(weightDevices []*WeightDevice) ([]specs.LinuxWeightDevice, error) {
+	var stat unix.Stat_t
+	blkioWeightDevices := make([]specs.LinuxWeightDevice, 0, len(weightDevices))
+
+	for _, weightDevice := range weightDevices {
+		if err := unix.Stat(weightDevice.Path, &stat); err != nil {
+			return nil, fmt.Errorf("failed to stat %s: %w", weightDevice.Path, err)
+		}
+		weight := weightDevice.Weight
+		d := specs.LinuxWeightDevice{Weight: &weight}
+		// The type is 32bit on mips.
+		d.Major = int64(unix.Major(uint64(stat.Rdev))) //nolint: unconvert
+		d.Minor = int64(unix.Minor(uint64(stat.Rdev))) //nolint: unconvert
+		blkioWeightDevices = append(blkioWeightDevices, d)
+	}
+
+	return blkioWeightDevices, nil
+}
+
+func toOCIThrottleDevices(devs []*ThrottleDevice) ([]specs.LinuxThrottleDevice, error) {
+	var stat unix.Stat_t
+	throttleDevices := make([]specs.LinuxThrottleDevice, 0, len(devs))
+
+	for _, d := range devs {
+		if err := unix.Stat(d.Path, &stat); err != nil {
+			return nil, fmt.Errorf("failed to stat %s: %w", d.Path, err)
+		}
+		d := specs.LinuxThrottleDevice{Rate: d.Rate}
+		// the type is 32bit on mips
+		d.Major = int64(unix.Major(uint64(stat.Rdev))) //nolint: unconvert
+		d.Minor = int64(unix.Minor(uint64(stat.Rdev))) //nolint: unconvert
+		throttleDevices = append(throttleDevices, d)
+	}
+
+	return throttleDevices, nil
+}
+
+func withBlkioWeight(blkioWeight uint16) oci.SpecOpts {
+	return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {
+		if s.Linux.Resources.BlockIO == nil {
+			s.Linux.Resources.BlockIO = &specs.LinuxBlockIO{}
+		}
+		s.Linux.Resources.BlockIO.Weight = &blkioWeight
+		return nil
+	}
+}
+
+func withBlkioWeightDevice(weightDevices []specs.LinuxWeightDevice) oci.SpecOpts {
+	return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {
+		if s.Linux.Resources.BlockIO == nil {
+			s.Linux.Resources.BlockIO = &specs.LinuxBlockIO{}
+		}
+		s.Linux.Resources.BlockIO.WeightDevice = weightDevices
+		return nil
+	}
+}
+
+func withBlkioReadBpsDevice(devices []specs.LinuxThrottleDevice) oci.SpecOpts {
+	return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {
+		if s.Linux.Resources.BlockIO == nil {
+			s.Linux.Resources.BlockIO = &specs.LinuxBlockIO{}
+		}
+		s.Linux.Resources.BlockIO.ThrottleReadBpsDevice = devices
+		return nil
+	}
+}
+
+func withBlkioWriteBpsDevice(devices []specs.LinuxThrottleDevice) oci.SpecOpts {
+	return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {
+		if s.Linux.Resources.BlockIO == nil {
+			s.Linux.Resources.BlockIO = &specs.LinuxBlockIO{}
+		}
+		s.Linux.Resources.BlockIO.ThrottleWriteBpsDevice = devices
+		return nil
+	}
+}
+
+func withBlkioReadIOPSDevice(devices []specs.LinuxThrottleDevice) oci.SpecOpts {
+	return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {
+		if s.Linux.Resources.BlockIO == nil {
+			s.Linux.Resources.BlockIO = &specs.LinuxBlockIO{}
+		}
+		s.Linux.Resources.BlockIO.ThrottleReadIOPSDevice = devices
+		return nil
+	}
+}
+
+func withBlkioWriteIOPSDevice(devices []specs.LinuxThrottleDevice) oci.SpecOpts {
+	return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {
+		if s.Linux.Resources.BlockIO == nil {
+			s.Linux.Resources.BlockIO = &specs.LinuxBlockIO{}
+		}
+		s.Linux.Resources.BlockIO.ThrottleWriteIOPSDevice = devices
+		return nil
+	}
+}
+
+func BlkioOCIOpts(options types.ContainerCreateOptions) ([]oci.SpecOpts, error) {
+	var opts []oci.SpecOpts
+
+	// Handle BlkioWeight
+	if options.BlkioWeight != 0 {
+		if !infoutil.BlockIOWeight(options.GOptions.CgroupManager) {
+			// blkio weight is not available on cgroup v1 since kernel 5.0.
+			// On cgroup v2, blkio weight is implemented using io.weight
+			log.L.Warn("kernel support for cgroup blkio weight missing, weight discarded")
+		} else {
+			if options.BlkioWeight < 10 || options.BlkioWeight > 1000 {
+				return nil, errors.New("range of blkio weight is from 10 to 1000")
+			}
+			opts = append(opts, withBlkioWeight(options.BlkioWeight))
+		}
+	}
+
+	// Handle BlkioWeightDevice
+	if len(options.BlkioWeightDevice) > 0 {
+		if !infoutil.BlockIOWeightDevice(options.GOptions.CgroupManager) {
+			// blkio weight device is not available on cgroup v1 since kernel 5.0.
+			// On cgroup v2, blkio weight is implemented using io.weight
+			log.L.Warn("kernel support for cgroup blkio weight device missing, weight device discarded")
+		} else {
+			weightDevices, err := validateWeightDevices(options.BlkioWeightDevice)
+			if err != nil {
+				return nil, fmt.Errorf("invalid weight device: %w", err)
+			}
+			linuxWeightDevices, err := toOCIWeightDevices(weightDevices)
+			if err != nil {
+				return nil, err
+			}
+			opts = append(opts, withBlkioWeightDevice(linuxWeightDevices))
+		}
+	}
+
+	// Handle BlockIOReadBpsDevice
+	if len(options.BlkioDeviceReadBps) > 0 {
+		if !infoutil.BlockIOReadBpsDevice(options.GOptions.CgroupManager) {
+			log.L.Warn("kernel support for cgroup blkio read bps device missing, read bps device discarded")
+		} else {
+			readBpsDevices, err := validateThrottleBpsDevices(options.BlkioDeviceReadBps)
+			if err != nil {
+				return nil, fmt.Errorf("invalid read bps device: %w", err)
+			}
+			throttleDevices, err := toOCIThrottleDevices(readBpsDevices)
+			if err != nil {
+				return nil, err
+			}
+			opts = append(opts, withBlkioReadBpsDevice(throttleDevices))
+		}
+	}
+
+	// Handle BlockIOWriteBpsDevice
+	if len(options.BlkioDeviceWriteBps) > 0 {
+		if !infoutil.BlockIOWriteBpsDevice(options.GOptions.CgroupManager) {
+			log.L.Warn("kernel support for cgroup blkio write bps device missing, write bps device discarded")
+		} else {
+			writeBpsDevices, err := validateThrottleBpsDevices(options.BlkioDeviceWriteBps)
+			if err != nil {
+				return nil, fmt.Errorf("invalid write bps device: %w", err)
+			}
+			throttleDevices, err := toOCIThrottleDevices(writeBpsDevices)
+			if err != nil {
+				return nil, err
+			}
+			opts = append(opts, withBlkioWriteBpsDevice(throttleDevices))
+		}
+	}
+
+	// Handle BlockIOReadIopsDevice
+	if len(options.BlkioDeviceReadIOps) > 0 {
+		if !infoutil.BlockIOReadIOpsDevice(options.GOptions.CgroupManager) {
+			log.L.Warn("kernel support for cgroup blkio read iops device missing, read iops device discarded")
+		} else {
+			readIopsDevices, err := validateThrottleIOpsDevices(options.BlkioDeviceReadIOps)
+			if err != nil {
+				return nil, fmt.Errorf("invalid read iops device: %w", err)
+			}
+			throttleDevices, err := toOCIThrottleDevices(readIopsDevices)
+			if err != nil {
+				return nil, err
+			}
+			opts = append(opts, withBlkioReadIOPSDevice(throttleDevices))
+		}
+	}
+
+	// Handle BlockIOWriteIopsDevice
+	if len(options.BlkioDeviceWriteIOps) > 0 {
+		if !infoutil.BlockIOWriteIOpsDevice(options.GOptions.CgroupManager) {
+			log.L.Warn("kernel support for cgroup blkio write iops device missing, write iops device discarded")
+		} else {
+			writeIopsDevices, err := validateThrottleIOpsDevices(options.BlkioDeviceWriteIOps)
+			if err != nil {
+				return nil, fmt.Errorf("invalid write iops device: %w", err)
+			}
+			throttleDevices, err := toOCIThrottleDevices(writeIopsDevices)
+			if err != nil {
+				return nil, err
+			}
+			opts = append(opts, withBlkioWriteIOPSDevice(throttleDevices))
+		}
+	}
+
+	return opts, nil
+}
+
+// validateWeightDevices validates an array of device-weight strings
+//
+// from https://github.com/docker/cli/blob/master/opts/weightdevice.go#L15
+func validateWeightDevices(vals []string) ([]*WeightDevice, error) {
+	weightDevices := make([]*WeightDevice, 0, len(vals))
+	for _, val := range vals {
+		k, v, ok := strings.Cut(val, ":")
+		if !ok || k == "" {
+			return nil, fmt.Errorf("bad format: %s", val)
+		}
+		if !strings.HasPrefix(k, "/dev/") {
+			return nil, fmt.Errorf("bad format for device path: %s", val)
+		}
+		weight, err := strconv.ParseUint(v, 10, 16)
+		if err != nil {
+			return nil, fmt.Errorf("invalid weight for device: %s", val)
+		}
+		if weight > 0 && (weight < 10 || weight > 1000) {
+			return nil, fmt.Errorf("invalid weight for device: %s", val)
+		}
+
+		weightDevices = append(weightDevices, &WeightDevice{
+			Path:   k,
+			Weight: uint16(weight),
+		})
+	}
+	return weightDevices, nil
+}
+
+// validateThrottleBpsDevices validates an array of device-rate strings for bytes per second
+//
+// from https://github.com/docker/cli/blob/master/opts/throttledevice.go#L16
+func validateThrottleBpsDevices(vals []string) ([]*ThrottleDevice, error) {
+	throttleDevices := make([]*ThrottleDevice, 0, len(vals))
+	for _, val := range vals {
+		k, v, ok := strings.Cut(val, ":")
+		if !ok || k == "" {
+			return nil, fmt.Errorf("bad format: %s", val)
+		}
+
+		if !strings.HasPrefix(k, "/dev/") {
+			return nil, fmt.Errorf("bad format for device path: %s", val)
+		}
+		rate, err := units.RAMInBytes(v)
+		if err != nil {
+			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", val)
+		}
+		if rate < 0 {
+			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", val)
+		}
+
+		throttleDevices = append(throttleDevices, &ThrottleDevice{
+			Path: k,
+			Rate: uint64(rate),
+		})
+	}
+	return throttleDevices, nil
+}
+
+// validateThrottleIOpsDevices validates an array of device-rate strings for IO operations per second
+//
+// from https://github.com/docker/cli/blob/master/opts/throttledevice.go#L40
+func validateThrottleIOpsDevices(vals []string) ([]*ThrottleDevice, error) {
+	throttleDevices := make([]*ThrottleDevice, 0, len(vals))
+	for _, val := range vals {
+		k, v, ok := strings.Cut(val, ":")
+		if !ok || k == "" {
+			return nil, fmt.Errorf("bad format: %s", val)
+		}
+
+		if !strings.HasPrefix(k, "/dev/") {
+			return nil, fmt.Errorf("bad format for device path: %s", val)
+		}
+		rate, err := strconv.ParseUint(v, 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>. Number must be a positive integer", val)
+		}
+
+		throttleDevices = append(throttleDevices, &ThrottleDevice{
+			Path: k,
+			Rate: rate,
+		})
+	}
+	return throttleDevices, nil
+}
diff --git a/pkg/cmd/container/run_cgroup_linux.go b/pkg/cmd/container/run_cgroup_linux.go
index a4d6fb7a266..5216ecc9c57 100644
--- a/pkg/cmd/container/run_cgroup_linux.go
+++ b/pkg/cmd/container/run_cgroup_linux.go
@@ -180,14 +180,11 @@ func generateCgroupOpts(id string, options types.ContainerCreateOptions, interna
 	}
 	opts = append(opts, withUnified(unifieds))
 
-	if options.BlkioWeight != 0 && !infoutil.BlockIOWeight(options.GOptions.CgroupManager) {
-		log.L.Warn("kernel support for cgroup blkio weight missing, weight discarded")
-		options.BlkioWeight = 0
-	}
-	if options.BlkioWeight > 0 && options.BlkioWeight < 10 || options.BlkioWeight > 1000 {
-		return nil, errors.New("range of blkio weight is from 10 to 1000")
+	blkioOpts, err := BlkioOCIOpts(options)
+	if err != nil {
+		return nil, err
 	}
-	opts = append(opts, withBlkioWeight(options.BlkioWeight))
+	opts = append(opts, blkioOpts...)
 
 	switch options.Cgroupns {
 	case "private":
@@ -314,16 +311,6 @@ func withUnified(unified map[string]string) oci.SpecOpts {
 	}
 }
 
-func withBlkioWeight(blkioWeight uint16) oci.SpecOpts {
-	return func(_ context.Context, _ oci.Client, _ *containers.Container, s *oci.Spec) error {
-		if blkioWeight == 0 {
-			return nil
-		}
-		s.Linux.Resources.BlockIO = &specs.LinuxBlockIO{Weight: &blkioWeight}
-		return nil
-	}
-}
-
 func withCustomMemoryResources(memoryOptions customMemoryOptions) oci.SpecOpts {
 	return func(_ context.Context, _ oci.Client, _ *containers.Container, s *oci.Spec) error {
 		if s.Linux != nil {
diff --git a/pkg/infoutil/infoutil.go b/pkg/infoutil/infoutil.go
index 2886c9fe049..965ae4a0c90 100644
--- a/pkg/infoutil/infoutil.go
+++ b/pkg/infoutil/infoutil.go
@@ -26,6 +26,7 @@ import (
 	"time"
 
 	"github.com/Masterminds/semver/v3"
+	"github.com/docker/docker/pkg/sysinfo"
 
 	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/containerd/v2/core/introspection"
@@ -244,13 +245,42 @@ func parseRuncVersion(runcVersionStdout []byte) (*dockercompat.ComponentVersion,
 	}, nil
 }
 
-// BlockIOWeight return whether Block IO weight is supported or not
-func BlockIOWeight(cgroupManager string) bool {
+// getMobySysInfo returns the moby system info for the given cgroup manager
+func getMobySysInfo(cgroupManager string) *sysinfo.SysInfo {
 	var info dockercompat.Info
 	info.CgroupVersion = CgroupsVersion()
 	info.CgroupDriver = cgroupManager
-	mobySysInfo := mobySysInfo(&info)
+	return mobySysInfo(&info)
+}
+
+// BlockIOWeight returns whether Block IO weight is supported or not
+func BlockIOWeight(cgroupManager string) bool {
 	// blkio weight is not available on cgroup v1 since kernel 5.0.
 	// On cgroup v2, blkio weight is implemented using io.weight
-	return mobySysInfo.BlkioWeight
+	return getMobySysInfo(cgroupManager).BlkioWeight
+}
+
+// BlockIOWeightDevice returns whether Block IO weight device is supported or not
+func BlockIOWeightDevice(cgroupManager string) bool {
+	return getMobySysInfo(cgroupManager).BlkioWeightDevice
+}
+
+// BlockIOReadBpsDevice returns whether Block IO read limit in bytes per second is supported or not
+func BlockIOReadBpsDevice(cgroupManager string) bool {
+	return getMobySysInfo(cgroupManager).BlkioReadBpsDevice
+}
+
+// BlockIOWriteBpsDevice returns whether Block IO write limit in bytes per second is supported or not
+func BlockIOWriteBpsDevice(cgroupManager string) bool {
+	return getMobySysInfo(cgroupManager).BlkioWriteBpsDevice
+}
+
+// BlockIOReadIOpsDevice returns whether Block IO read limit in IO per second is supported or not
+func BlockIOReadIOpsDevice(cgroupManager string) bool {
+	return getMobySysInfo(cgroupManager).BlkioReadIOpsDevice
+}
+
+// BlockIOWriteIOpsDevice returns whether Block IO write limit in IO per second is supported or not
+func BlockIOWriteIOpsDevice(cgroupManager string) bool {
+	return getMobySysInfo(cgroupManager).BlkioWriteIOpsDevice
 }
diff --git a/pkg/inspecttypes/dockercompat/dockercompat.go b/pkg/inspecttypes/dockercompat/dockercompat.go
index 027726f14d8..b0831352d54 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat.go
@@ -167,19 +167,18 @@ type HostConfig struct {
 	Tmpfs   map[string]string `json:"Tmpfs,omitempty"` // List of tmpfs (mounts) used for the container
 	UTSMode string            // UTS namespace to use for the container
 	// UsernsMode      UsernsMode        // The user namespace to use for the container
-	ShmSize int64             // Size of /dev/shm in bytes. The size must be greater than 0.
-	Sysctls map[string]string // List of Namespaced sysctls used for the container
-	Runtime string            // Runtime to use with this container
-
-	BlkioWeight    uint16          // Block IO weight (relative weight vs. other containers)
-	CPUSetMems     string          `json:"CpusetMems"` // CpusetMems 0-2, 0,1
-	CPUSetCPUs     string          `json:"CpusetCpus"` // CpusetCpus 0-2, 0,1
-	CPUQuota       int64           `json:"CpuQuota"`   // CPU CFS (Completely Fair Scheduler) quota
-	CPUShares      uint64          `json:"CpuShares"`  // CPU shares (relative weight vs. other containers)
-	Memory         int64           // Memory limit (in bytes)
-	MemorySwap     int64           // Total memory usage (memory + swap); set `-1` to enable unlimited swap
-	OomKillDisable bool            // specifies whether to disable OOM Killer
-	Devices        []DeviceMapping // List of devices to map inside the container
+	ShmSize        int64             // Size of /dev/shm in bytes. The size must be greater than 0.
+	Sysctls        map[string]string // List of Namespaced sysctls used for the container
+	Runtime        string            // Runtime to use with this container
+	CPUSetMems     string            `json:"CpusetMems"` // CpusetMems 0-2, 0,1
+	CPUSetCPUs     string            `json:"CpusetCpus"` // CpusetCpus 0-2, 0,1
+	CPUQuota       int64             `json:"CpuQuota"`   // CPU CFS (Completely Fair Scheduler) quota
+	CPUShares      uint64            `json:"CpuShares"`  // CPU shares (relative weight vs. other containers)
+	Memory         int64             // Memory limit (in bytes)
+	MemorySwap     int64             // Total memory usage (memory + swap); set `-1` to enable unlimited swap
+	OomKillDisable bool              // specifies whether to disable OOM Killer
+	Devices        []DeviceMapping   // List of devices to map inside the container
+	LinuxBlkioSettings
 }
 
 // From https://github.com/moby/moby/blob/v20.10.1/api/types/types.go#L416-L427
@@ -303,6 +302,15 @@ type NetworkEndpointSettings struct {
 	// TODO DriverOpts          map[string]string
 }
 
+type LinuxBlkioSettings struct {
+	BlkioWeight          uint16 // Block IO weight (relative weight vs. other containers)
+	BlkioWeightDevice    []*specs.LinuxWeightDevice
+	BlkioDeviceReadBps   []*specs.LinuxThrottleDevice
+	BlkioDeviceWriteBps  []*specs.LinuxThrottleDevice
+	BlkioDeviceReadIOps  []*specs.LinuxThrottleDevice
+	BlkioDeviceWriteIOps []*specs.LinuxThrottleDevice
+}
+
 // ContainerFromNative instantiates a Docker-compatible Container from containerd-native Container.
 func ContainerFromNative(n *native.Container) (*Container, error) {
 	var hostname string
@@ -540,6 +548,11 @@ func ContainerFromNative(n *native.Container) (*Container, error) {
 		pidMode = n.Labels[labels.PIDContainer]
 	}
 	c.HostConfig.PidMode = pidMode
+
+	if err := getBlkioSettingsFromSpec(n.Spec.(*specs.Spec), c.HostConfig); err != nil {
+		return nil, fmt.Errorf("failed to get blkio settings: %w", err)
+	}
+
 	return c, nil
 }
 
@@ -925,3 +938,78 @@ func ParseMountProperties(option []string) (rw bool, propagation string) {
 	}
 	return
 }
+
+func getDefaultLinuxBlkioSettings() LinuxBlkioSettings {
+	return LinuxBlkioSettings{
+		BlkioWeight:          0,
+		BlkioWeightDevice:    make([]*specs.LinuxWeightDevice, 0),
+		BlkioDeviceReadBps:   make([]*specs.LinuxThrottleDevice, 0),
+		BlkioDeviceWriteBps:  make([]*specs.LinuxThrottleDevice, 0),
+		BlkioDeviceReadIOps:  make([]*specs.LinuxThrottleDevice, 0),
+		BlkioDeviceWriteIOps: make([]*specs.LinuxThrottleDevice, 0),
+	}
+}
+
+func getBlkioSettingsFromSpec(spec *specs.Spec, hostConfig *HostConfig) error {
+	if spec == nil {
+		return fmt.Errorf("spec cannot be nil")
+	}
+	if hostConfig == nil {
+		return fmt.Errorf("hostConfig cannot be nil")
+	}
+
+	// Initialize empty arrays by default
+	hostConfig.LinuxBlkioSettings = getDefaultLinuxBlkioSettings()
+
+	if spec.Linux == nil || spec.Linux.Resources == nil || spec.Linux.Resources.BlockIO == nil {
+		return nil
+	}
+
+	blockIO := spec.Linux.Resources.BlockIO
+
+	// Set block IO weight
+	if blockIO.Weight != nil {
+		hostConfig.BlkioWeight = *blockIO.Weight
+	}
+
+	// Set weight devices
+	if len(blockIO.WeightDevice) > 0 {
+		hostConfig.BlkioWeightDevice = make([]*specs.LinuxWeightDevice, len(blockIO.WeightDevice))
+		for i, dev := range blockIO.WeightDevice {
+			hostConfig.BlkioWeightDevice[i] = &dev
+		}
+	}
+
+	// Set throttle devices for read BPS
+	if len(blockIO.ThrottleReadBpsDevice) > 0 {
+		hostConfig.BlkioDeviceReadBps = make([]*specs.LinuxThrottleDevice, len(blockIO.ThrottleReadBpsDevice))
+		for i, dev := range blockIO.ThrottleReadBpsDevice {
+			hostConfig.BlkioDeviceReadBps[i] = &dev
+		}
+	}
+
+	// Set throttle devices for write BPS
+	if len(blockIO.ThrottleWriteBpsDevice) > 0 {
+		hostConfig.BlkioDeviceWriteBps = make([]*specs.LinuxThrottleDevice, len(blockIO.ThrottleWriteBpsDevice))
+		for i, dev := range blockIO.ThrottleWriteBpsDevice {
+			hostConfig.BlkioDeviceWriteBps[i] = &dev
+		}
+	}
+
+	// Set throttle devices for read IOPs
+	if len(blockIO.ThrottleReadIOPSDevice) > 0 {
+		hostConfig.BlkioDeviceReadIOps = make([]*specs.LinuxThrottleDevice, len(blockIO.ThrottleReadIOPSDevice))
+		for i, dev := range blockIO.ThrottleReadIOPSDevice {
+			hostConfig.BlkioDeviceReadIOps[i] = &dev
+		}
+	}
+
+	// Set throttle devices for write IOPs
+	if len(blockIO.ThrottleWriteIOPSDevice) > 0 {
+		hostConfig.BlkioDeviceWriteIOps = make([]*specs.LinuxThrottleDevice, len(blockIO.ThrottleWriteIOPSDevice))
+		for i, dev := range blockIO.ThrottleWriteIOPSDevice {
+			hostConfig.BlkioDeviceWriteIOps[i] = &dev
+		}
+	}
+	return nil
+}
diff --git a/pkg/inspecttypes/dockercompat/dockercompat_test.go b/pkg/inspecttypes/dockercompat/dockercompat_test.go
index 27beead6c59..ddb621b9f39 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat_test.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat_test.go
@@ -82,8 +82,9 @@ func TestContainerFromNative(t *testing.T) {
 						Driver: "json-file",
 						Opts:   map[string]string{},
 					},
-					UTSMode: "host",
-					Tmpfs:   map[string]string{},
+					UTSMode:            "host",
+					Tmpfs:              map[string]string{},
+					LinuxBlkioSettings: getDefaultLinuxBlkioSettings(),
 				},
 				Mounts: []MountPoint{
 					{
@@ -174,8 +175,9 @@ func TestContainerFromNative(t *testing.T) {
 						Driver: "json-file",
 						Opts:   map[string]string{},
 					},
-					UTSMode: "host",
-					Tmpfs:   map[string]string{},
+					UTSMode:            "host",
+					Tmpfs:              map[string]string{},
+					LinuxBlkioSettings: getDefaultLinuxBlkioSettings(),
 				},
 				Mounts: []MountPoint{
 					{
@@ -264,8 +266,9 @@ func TestContainerFromNative(t *testing.T) {
 						Driver: "json-file",
 						Opts:   map[string]string{},
 					},
-					UTSMode: "host",
-					Tmpfs:   map[string]string{},
+					UTSMode:            "host",
+					Tmpfs:              map[string]string{},
+					LinuxBlkioSettings: getDefaultLinuxBlkioSettings(),
 				},
 				Mounts: []MountPoint{
 					{
diff --git a/pkg/testutil/nerdtest/requirements.go b/pkg/testutil/nerdtest/requirements.go
index 88acba1802d..3566b273f0d 100644
--- a/pkg/testutil/nerdtest/requirements.go
+++ b/pkg/testutil/nerdtest/requirements.go
@@ -190,6 +190,28 @@ var CgroupsAccessible = require.All(
 	},
 )
 
+// CGroupV2 requires that cgroup is enabled and cgroup version is 2
+var CGroupV2 = &test.Requirement{
+	Check: func(data test.Data, helpers test.Helpers) (ret bool, mess string) {
+		ret = true
+		mess = "cgroup is enabled"
+		stdout := helpers.Capture("info", "--format", "{{ json . }}")
+		var dinf dockercompat.Info
+		err := json.Unmarshal([]byte(stdout), &dinf)
+		assert.NilError(helpers.T(), err, "failed to parse docker info")
+		switch dinf.CgroupDriver {
+		case "none", "":
+			ret = false
+			mess = "cgroup is none"
+		}
+		if dinf.CgroupVersion != "2" {
+			ret = false
+			mess = "cgroup version is not 2"
+		}
+		return ret, mess
+	},
+}
+
 // Soci requires that the soci snapshotter is enabled
 var Soci = &test.Requirement{
 	Check: func(data test.Data, helpers test.Helpers) (ret bool, mess string) {

From 59c439e54bb60947c2708d939e7762111af5875e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 17 Mar 2025 18:09:27 +0000
Subject: [PATCH 004/225] build(deps): bump github.com/containerd/containerd/v2

Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.0.3 to 2.0.4.
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](https://github.com/containerd/containerd/compare/v2.0.3...v2.0.4)

---
updated-dependencies:
- dependency-name: github.com/containerd/containerd/v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index c749f2f4e15..58d605cd9f4 100644
--- a/go.mod
+++ b/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/containerd/cgroups/v3 v3.0.5
 	github.com/containerd/console v1.0.4
 	github.com/containerd/containerd/api v1.8.0
-	github.com/containerd/containerd/v2 v2.0.3
+	github.com/containerd/containerd/v2 v2.0.4
 	github.com/containerd/continuity v0.4.5
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/fifo v1.1.0
diff --git a/go.sum b/go.sum
index ac9d2cd325c..67ff418e902 100644
--- a/go.sum
+++ b/go.sum
@@ -31,8 +31,8 @@ github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn
 github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
 github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0=
 github.com/containerd/containerd/api v1.8.0/go.mod h1:dFv4lt6S20wTu/hMcP4350RL87qPWLVa/OHOwmmdnYc=
-github.com/containerd/containerd/v2 v2.0.3 h1:zBKgwgZsuu+LPCMzCLgA4sC4MiZzZ59ZT31XkmiISQM=
-github.com/containerd/containerd/v2 v2.0.3/go.mod h1:5j9QUUaV/cy9ZeAx4S+8n9ffpf+iYnEj4jiExgcbuLY=
+github.com/containerd/containerd/v2 v2.0.4 h1:+r7yJMwhTfMm3CDyiBjMBQO8a9CTBxL2Bg/JtqtIwB8=
+github.com/containerd/containerd/v2 v2.0.4/go.mod h1:5j9QUUaV/cy9ZeAx4S+8n9ffpf+iYnEj4jiExgcbuLY=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=

From 9aecbf3b00fe7575cd8e91883934381ae0738ffb Mon Sep 17 00:00:00 2001
From: Arjun Raja Yogidas <arjunry@amazon.com>
Date: Mon, 17 Mar 2025 01:47:01 +0000
Subject: [PATCH 005/225] fix: Return empty network settings for non started
 containers

Signed-off-by: Arjun Raja Yogidas <arjunry@amazon.com>
---
 pkg/inspecttypes/dockercompat/dockercompat.go | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkg/inspecttypes/dockercompat/dockercompat.go b/pkg/inspecttypes/dockercompat/dockercompat.go
index 027726f14d8..27ae6dc44b6 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat.go
@@ -458,6 +458,14 @@ func ContainerFromNative(n *native.Container) (*Container, error) {
 		}
 		c.NetworkSettings = nSettings
 		c.HostConfig.PortBindings = *nSettings.Ports
+	} else {
+		// n.process is not set if the container is not started, making the networkSetting null
+		// we should send an empty object even in this case inorder for it to be compatible with docker inspect response
+		nSettings, err := networkSettingsFromNative(nil, n.Spec.(*specs.Spec))
+		if err != nil {
+			return nil, err
+		}
+		c.NetworkSettings = nSettings
 	}
 
 	cpuSetting, err := cpuSettingsFromNative(n.Spec.(*specs.Spec))

From 0b97695007550ef726305100675b36e25412f20f Mon Sep 17 00:00:00 2001
From: ningmingxiao <ning.mingxiao@zte.com.cn>
Date: Mon, 17 Mar 2025 17:09:47 +0800
Subject: [PATCH 006/225] fix:nerdctl ps show nothing when timeout

Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>
---
 cmd/nerdctl/compose/compose_ps.go  | 5 -----
 pkg/containerutil/containerutil.go | 4 ----
 pkg/formatter/formatter.go         | 4 ----
 3 files changed, 13 deletions(-)

diff --git a/cmd/nerdctl/compose/compose_ps.go b/cmd/nerdctl/compose/compose_ps.go
index c3ea4fd2578..badee1755b9 100644
--- a/cmd/nerdctl/compose/compose_ps.go
+++ b/cmd/nerdctl/compose/compose_ps.go
@@ -21,7 +21,6 @@ import (
 	"fmt"
 	"strings"
 	"text/tabwriter"
-	"time"
 
 	"github.com/spf13/cobra"
 	"golang.org/x/sync/errgroup"
@@ -345,10 +344,6 @@ func formatPublishers(labelMap map[string]string) []PortPublisher {
 
 // statusForFilter returns the status value to be matched with the 'status' filter
 func statusForFilter(ctx context.Context, c containerd.Container) string {
-	// Just in case, there is something wrong in server.
-	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
-	defer cancel()
-
 	task, err := c.Task(ctx, nil)
 	if err != nil {
 		// NOTE: NotFound doesn't mean that container hasn't started.
diff --git a/pkg/containerutil/containerutil.go b/pkg/containerutil/containerutil.go
index c929a1716c4..1e4fe2a34e3 100644
--- a/pkg/containerutil/containerutil.go
+++ b/pkg/containerutil/containerutil.go
@@ -86,10 +86,6 @@ func PrintHostPort(ctx context.Context, writer io.Writer, container containerd.C
 
 // ContainerStatus returns the container's status from its task.
 func ContainerStatus(ctx context.Context, c containerd.Container) (containerd.Status, error) {
-	// Just in case, there is something wrong in server.
-	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
-	defer cancel()
-
 	task, err := c.Task(ctx, nil)
 	if err != nil {
 		return containerd.Status{}, err
diff --git a/pkg/formatter/formatter.go b/pkg/formatter/formatter.go
index 1c6acdcfced..3801e1ab208 100644
--- a/pkg/formatter/formatter.go
+++ b/pkg/formatter/formatter.go
@@ -39,11 +39,7 @@ import (
 )
 
 func ContainerStatus(ctx context.Context, c containerd.Container) string {
-	// Just in case, there is something wrong in server.
-	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
-	defer cancel()
 	titleCaser := cases.Title(language.English)
-
 	task, err := c.Task(ctx, nil)
 	if err != nil {
 		// NOTE: NotFound doesn't mean that container hasn't started.

From 48d42673b0174662e1f747ec31919f9dad387d10 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 19 Mar 2025 13:02:37 +0000
Subject: [PATCH 007/225] build(deps): bump github.com/containerd/imgcrypt/v2
 from 2.0.0 to 2.0.1

Bumps [github.com/containerd/imgcrypt/v2](https://github.com/containerd/imgcrypt) from 2.0.0 to 2.0.1.
- [Release notes](https://github.com/containerd/imgcrypt/releases)
- [Changelog](https://github.com/containerd/imgcrypt/blob/main/CHANGES)
- [Commits](https://github.com/containerd/imgcrypt/compare/v2.0.0...v2.0.1)

---
updated-dependencies:
- dependency-name: github.com/containerd/imgcrypt/v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 58d605cd9f4..1c8e9f78290 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/fifo v1.1.0
 	github.com/containerd/go-cni v1.1.12
-	github.com/containerd/imgcrypt/v2 v2.0.0
+	github.com/containerd/imgcrypt/v2 v2.0.1
 	github.com/containerd/log v0.1.0
 	github.com/containerd/nerdctl/mod/tigron v0.0.0
 	github.com/containerd/nydus-snapshotter v0.15.0
diff --git a/go.sum b/go.sum
index 67ff418e902..b91e80b42d0 100644
--- a/go.sum
+++ b/go.sum
@@ -45,8 +45,8 @@ github.com/containerd/go-cni v1.1.12 h1:wm/5VD/i255hjM4uIZjBRiEQ7y98W9ACy/mHeLi4
 github.com/containerd/go-cni v1.1.12/go.mod h1:+jaqRBdtW5faJxj2Qwg1Of7GsV66xcvnCx4mSJtUlxU=
 github.com/containerd/go-runc v1.1.0 h1:OX4f+/i2y5sUT7LhmcJH7GYrjjhHa1QI4e8yO0gGleA=
 github.com/containerd/go-runc v1.1.0/go.mod h1:xJv2hFF7GvHtTJd9JqTS2UVxMkULUYw4JN5XAUZqH5U=
-github.com/containerd/imgcrypt/v2 v2.0.0 h1:vd2ByN6cXeearzXCQljH1eYe77FgFO5/B9+dK14mng0=
-github.com/containerd/imgcrypt/v2 v2.0.0/go.mod h1:S4kOVvPZRerVueZULagcwkJK7sKc/wQI/ixcmyj26uY=
+github.com/containerd/imgcrypt/v2 v2.0.1 h1:gQcmeCKA97fAl0wlpq0itSY/PagFBsn4/mlKUy6kOio=
+github.com/containerd/imgcrypt/v2 v2.0.1/go.mod h1:/qIJL8nxzdzMA2n5iYyyuIY36KfoVQWmgTWdfVtyebM=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/containerd/nydus-snapshotter v0.15.0 h1:RqZRs1GPeM6T3wmuxJV9u+2Rg4YETVMwTmiDeX+iWC8=

From 65f44c693430166a59947a57993e88531e05c67c Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Tue, 18 Mar 2025 17:29:33 +0900
Subject: [PATCH 008/225] update containerd (2.0.4), etc.; verify the git tags
 with the commit hashes

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 .github/workflows/test-canary.yml             |  2 +-
 .github/workflows/test.yml                    | 30 +++----
 Dockerfile                                    | 87 +++++++++++--------
 .../containerd-fuse-overlayfs-v2.1.1          |  6 --
 .../containerd-fuse-overlayfs-v2.1.2          |  6 ++
 Dockerfile.d/SHA256SUMS.d/slirp4netns-v1.3.1  |  6 --
 Dockerfile.d/SHA256SUMS.d/slirp4netns-v1.3.2  |  7 ++
 hack/git-checkout-tag-with-hash.sh            | 46 ++++++++++
 8 files changed, 124 insertions(+), 66 deletions(-)
 delete mode 100644 Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.1
 create mode 100644 Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.2
 delete mode 100644 Dockerfile.d/SHA256SUMS.d/slirp4netns-v1.3.1
 create mode 100644 Dockerfile.d/SHA256SUMS.d/slirp4netns-v1.3.2
 create mode 100755 hack/git-checkout-tag-with-hash.sh

diff --git a/.github/workflows/test-canary.yml b/.github/workflows/test-canary.yml
index 45d25c2372e..0a890600afa 100644
--- a/.github/workflows/test-canary.yml
+++ b/.github/workflows/test-canary.yml
@@ -81,7 +81,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           repository: containerd/containerd
-          ref: "v1.7.25"
+          ref: "v1.7.27"
           path: containerd
           fetch-depth: 1
       - name: "Set up CNI"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a50b3c8a75c..0ce8c02b607 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -26,13 +26,13 @@ jobs:
       matrix:
         include:
           - runner: ubuntu-24.04
-            containerd: v1.6.36
+            containerd: v1.6.38
             arch: amd64
           - runner: ubuntu-24.04
-            containerd: v2.0.3
+            containerd: v2.0.4
             arch: amd64
           - runner: ubuntu-24.04-arm
-            containerd: v2.0.3
+            containerd: v2.0.4
             arch: arm64
     env:
       CONTAINERD_VERSION: "${{ matrix.containerd }}"
@@ -82,7 +82,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           repository: containerd/containerd
-          ref: v1.7.25
+          ref: v1.7.27
           path: containerd
           fetch-depth: 1
       - if: ${{ matrix.goos=='windows' }}
@@ -102,15 +102,15 @@ jobs:
       matrix:
         include:
           - ubuntu: 22.04
-            containerd: v1.6.36
+            containerd: v1.6.38
             runner: "ubuntu-22.04"
             arch: amd64
           - ubuntu: 24.04
-            containerd: v2.0.3
+            containerd: v2.0.4
             runner: "ubuntu-24.04"
             arch: amd64
           - ubuntu: 24.04
-            containerd: v2.0.3
+            containerd: v2.0.4
             runner: "ubuntu-24.04-arm"
             arch: arm64
     env:
@@ -160,7 +160,7 @@ jobs:
       matrix:
         include:
           - ubuntu: 24.04
-            containerd: v2.0.3
+            containerd: v2.0.4
             arch: amd64
     env:
       CONTAINERD_VERSION: "${{ matrix.containerd }}"
@@ -221,25 +221,25 @@ jobs:
       matrix:
         include:
           - ubuntu: 22.04
-            containerd: v1.6.36
+            containerd: v1.6.38
             rootlesskit: v1.1.1  # Deprecated
             target: rootless
             runner: "ubuntu-22.04"
             arch: amd64
           - ubuntu: 24.04
-            containerd: v2.0.3
+            containerd: v2.0.4
             rootlesskit: v2.3.4
             target: rootless
             arch: amd64
             runner: "ubuntu-24.04"
           - ubuntu: 24.04
-            containerd: v2.0.3
+            containerd: v2.0.4
             rootlesskit: v2.3.4
             target: rootless
             arch: arm64
             runner: "ubuntu-24.04-arm"
           - ubuntu: 24.04
-            containerd: v2.0.3
+            containerd: v2.0.4
             rootlesskit: v2.3.4
             target: rootless-port-slirp4netns
             arch: amd64
@@ -373,7 +373,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           repository: containerd/containerd
-          ref: v1.7.25
+          ref: v1.7.27
           path: containerd
           fetch-depth: 1
       - name: "Set up CNI"
@@ -381,7 +381,7 @@ jobs:
         run: GOPATH=$(go env GOPATH) script/setup/install-cni-windows
       - name: "Set up containerd"
         env:
-          ctrdVersion: 1.7.25
+          ctrdVersion: 1.7.27
         run: powershell hack/configure-windows-ci.ps1
       - name: "Run integration tests"
         run: ./hack/test-integration.sh -test.only-flaky=false
@@ -437,7 +437,7 @@ jobs:
     env:
       MODE: ${{ matrix.mode }}
       # FIXME: this is only necessary to access the build cache. To remove with build cleanup.
-      CONTAINERD_VERSION: v2.0.3
+      CONTAINERD_VERSION: v2.0.4
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
diff --git a/Dockerfile b/Dockerfile
index 0d441c18acd..8750018a18e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,42 +15,42 @@
 # -----------------------------------------------------------------------------
 # Usage: `docker run -it --privileged <IMAGE>`. Make sure to add `-t` and `--privileged`.
 
-# TODO: verify commit hash
-
 # Basic deps
-ARG CONTAINERD_VERSION=v2.0.3
-ARG RUNC_VERSION=v1.2.5
-ARG CNI_PLUGINS_VERSION=v1.6.2
+# @BINARY: the binary checksums are verified via Dockerfile.d/SHA256SUMS.d/<COMPONENT>-<VERSION>
+ARG CONTAINERD_VERSION=v2.0.4@1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20
+ARG RUNC_VERSION=v1.2.6@e89a29929c775025419ab0d218a43588b4c12b9a
+ARG CNI_PLUGINS_VERSION=v1.6.2@BINARY
 
 # Extra deps: Build
-ARG BUILDKIT_VERSION=v0.20.1
+ARG BUILDKIT_VERSION=v0.20.1@BINARY
 # Extra deps: Lazy-pulling
-ARG STARGZ_SNAPSHOTTER_VERSION=v0.16.3
+ARG STARGZ_SNAPSHOTTER_VERSION=v0.16.3@BINARY
 # Extra deps: Encryption
-ARG IMGCRYPT_VERSION=v2.0.0
+ARG IMGCRYPT_VERSION=v2.0.1@c377ec98ff79ec9205eabf555ebd2ea784738c6c
 # Extra deps: Rootless
-ARG ROOTLESSKIT_VERSION=v2.3.4
-ARG SLIRP4NETNS_VERSION=v1.3.1
+ARG ROOTLESSKIT_VERSION=v2.3.4@BINARY
+ARG SLIRP4NETNS_VERSION=v1.3.2@BINARY
 # Extra deps: bypass4netns
-ARG BYPASS4NETNS_VERSION=v0.4.2
+ARG BYPASS4NETNS_VERSION=v0.4.2@aa04bd3dcc48c6dae6d7327ba219bda8fe2a4634
 # Extra deps: FUSE-OverlayFS
-ARG FUSE_OVERLAYFS_VERSION=v1.14
-ARG CONTAINERD_FUSE_OVERLAYFS_VERSION=v2.1.1
+ARG FUSE_OVERLAYFS_VERSION=v1.14@BINARY
+ARG CONTAINERD_FUSE_OVERLAYFS_VERSION=v2.1.2@BINARY
 # Extra deps: Init
-ARG TINI_VERSION=v0.19.0
+ARG TINI_VERSION=v0.19.0@BINARY
 # Extra deps: Debug
-ARG BUILDG_VERSION=v0.4.1
+ARG BUILDG_VERSION=v0.4.1@BINARY
 
 # Test deps
+# Currently, the Docker Official Images and the test deps are not pinned by the hash
 ARG GO_VERSION=1.24
 ARG UBUNTU_VERSION=24.04
 ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.1
 ARG GOTESTSUM_VERSION=v1.12.0
 ARG NYDUS_VERSION=v2.3.0
 ARG SOCI_SNAPSHOTTER_VERSION=0.8.0
-ARG KUBO_VERSION=v0.32.1
+ARG KUBO_VERSION=v0.33.2
 
-FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.6.1 AS xx
+FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.6.1@sha256:923441d7c25f1e2eb5789f82d987693c47b8ed987c4ab3b075d6ed2b5d6779a3 AS xx
 
 
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-bookworm AS build-base-debian
@@ -70,13 +70,14 @@ RUN xx-apt-get update -qq && xx-apt-get install -qq --no-install-recommends \
   libseccomp-dev \
   pkg-config
 RUN git config --global advice.detachedHead false
+ADD hack/git-checkout-tag-with-hash.sh /usr/local/bin/
 
 FROM build-base-debian AS build-containerd
 ARG TARGETARCH
 ARG CONTAINERD_VERSION
 RUN git clone https://github.com/containerd/containerd.git /go/src/github.com/containerd/containerd
 WORKDIR /go/src/github.com/containerd/containerd
-RUN git checkout ${CONTAINERD_VERSION} && \
+RUN git-checkout-tag-with-hash.sh ${CONTAINERD_VERSION} && \
   mkdir -p /out /out/$TARGETARCH && \
   cp -a containerd.service /out
 RUN GO=xx-go make STATIC=1 && \
@@ -87,7 +88,7 @@ ARG RUNC_VERSION
 ARG TARGETARCH
 RUN git clone https://github.com/opencontainers/runc.git /go/src/github.com/opencontainers/runc
 WORKDIR /go/src/github.com/opencontainers/runc
-RUN git checkout ${RUNC_VERSION} && \
+RUN git-checkout-tag-with-hash.sh ${RUNC_VERSION} && \
   mkdir -p /out
 ENV CGO_ENABLED=1
 RUN GO=xx-go CC=$(xx-info)-gcc STRIP=$(xx-info)-strip make static && \
@@ -98,7 +99,7 @@ ARG BYPASS4NETNS_VERSION
 ARG TARGETARCH
 RUN git clone https://github.com/rootless-containers/bypass4netns.git /go/src/github.com/rootless-containers/bypass4netns
 WORKDIR /go/src/github.com/rootless-containers/bypass4netns
-RUN git checkout ${BYPASS4NETNS_VERSION} && \
+RUN git-checkout-tag-with-hash.sh ${BYPASS4NETNS_VERSION} && \
   mkdir -p /out/${TARGETARCH}
 ENV CGO_ENABLED=1
 RUN GO=xx-go make static && \
@@ -109,7 +110,7 @@ ARG KUBO_VERSION
 ARG TARGETARCH
 RUN git clone https://github.com/ipfs/kubo.git /go/src/github.com/ipfs/kubo
 WORKDIR /go/src/github.com/ipfs/kubo
-RUN git checkout ${KUBO_VERSION} && \
+RUN git-checkout-tag-with-hash.sh ${KUBO_VERSION} && \
   mkdir -p /out/${TARGETARCH}
 ENV CGO_ENABLED=0
 RUN xx-go --wrap && \
@@ -119,6 +120,7 @@ RUN xx-go --wrap && \
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS build-base
 RUN apk add --no-cache make git curl
 RUN git config --global advice.detachedHead false
+ADD hack/git-checkout-tag-with-hash.sh /usr/local/bin/
 
 FROM build-base AS build-minimal
 RUN BINDIR=/out/bin make binaries install
@@ -134,12 +136,13 @@ RUN mkdir -p /out/share/doc/nerdctl-full && touch /out/share/doc/nerdctl-full/RE
 ARG CONTAINERD_VERSION
 COPY --from=build-containerd /out/${TARGETARCH:-amd64}/* /out/bin/
 COPY --from=build-containerd /out/containerd.service /out/lib/systemd/system/containerd.service
-RUN echo "- containerd: ${CONTAINERD_VERSION}" >> /out/share/doc/nerdctl-full/README.md
+RUN echo "- containerd: ${CONTAINERD_VERSION/@*}" >> /out/share/doc/nerdctl-full/README.md
 ARG RUNC_VERSION
 COPY --from=build-runc /out/runc.${TARGETARCH:-amd64} /out/bin/runc
-RUN echo "- runc: ${RUNC_VERSION}" >> /out/share/doc/nerdctl-full/README.md
+RUN echo "- runc: ${RUNC_VERSION/@*}" >> /out/share/doc/nerdctl-full/README.md
 ARG CNI_PLUGINS_VERSION
-RUN fname="cni-plugins-${TARGETOS:-linux}-${TARGETARCH:-amd64}-${CNI_PLUGINS_VERSION}.tgz" && \
+RUN CNI_PLUGINS_VERSION=${CNI_PLUGINS_VERSION/@BINARY}; \
+  fname="cni-plugins-${TARGETOS:-linux}-${TARGETARCH:-amd64}-${CNI_PLUGINS_VERSION}.tgz" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/containernetworking/plugins/releases/download/${CNI_PLUGINS_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/cni-plugins-${CNI_PLUGINS_VERSION}" | sha256sum -c && \
   mkdir -p /out/libexec/cni && \
@@ -147,7 +150,8 @@ RUN fname="cni-plugins-${TARGETOS:-linux}-${TARGETARCH:-amd64}-${CNI_PLUGINS_VER
   rm -f "${fname}" && \
   echo "- CNI plugins: ${CNI_PLUGINS_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG BUILDKIT_VERSION
-RUN fname="buildkit-${BUILDKIT_VERSION}.${TARGETOS:-linux}-${TARGETARCH:-amd64}.tar.gz" && \
+RUN BUILDKIT_VERSION=${BUILDKIT_VERSION/@BINARY}; \
+  fname="buildkit-${BUILDKIT_VERSION}.${TARGETOS:-linux}-${TARGETARCH:-amd64}.tar.gz" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/moby/buildkit/releases/download/${BUILDKIT_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/buildkit-${BUILDKIT_VERSION}" | sha256sum -c && \
   tar xzf "${fname}" -C /out && \
@@ -161,7 +165,8 @@ RUN cd /out/lib/systemd/system && \
   echo "" >> buildkit.service && \
   echo "# This file was converted from containerd.service, with \`sed -E '${sedcomm}'\`" >> buildkit.service
 ARG STARGZ_SNAPSHOTTER_VERSION
-RUN fname="stargz-snapshotter-${STARGZ_SNAPSHOTTER_VERSION}-${TARGETOS:-linux}-${TARGETARCH:-amd64}.tar.gz" && \
+RUN STARGZ_SNAPSHOTTER_VERSION=${STARGZ_SNAPSHOTTER_VERSION/@BINARY}; \
+  fname="stargz-snapshotter-${STARGZ_SNAPSHOTTER_VERSION}-${TARGETOS:-linux}-${TARGETARCH:-amd64}.tar.gz" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/containerd/stargz-snapshotter/releases/download/${STARGZ_SNAPSHOTTER_VERSION}/${fname}" && \
   curl -o "stargz-snapshotter.service" -fsSL --proto '=https' --tlsv1.2 "https://raw.githubusercontent.com/containerd/stargz-snapshotter/${STARGZ_SNAPSHOTTER_VERSION}/script/config/etc/systemd/system/stargz-snapshotter.service" && \
   grep "${fname}" "/SHA256SUMS.d/stargz-snapshotter-${STARGZ_SNAPSHOTTER_VERSION}" | sha256sum -c - && \
@@ -173,11 +178,12 @@ RUN fname="stargz-snapshotter-${STARGZ_SNAPSHOTTER_VERSION}-${TARGETOS:-linux}-$
 ARG IMGCRYPT_VERSION
 RUN git clone https://github.com/containerd/imgcrypt.git /go/src/github.com/containerd/imgcrypt && \
   cd /go/src/github.com/containerd/imgcrypt && \
-  git checkout "${IMGCRYPT_VERSION}" && \
+  git-checkout-tag-with-hash.sh "${IMGCRYPT_VERSION}" && \
   CGO_ENABLED=0 make && DESTDIR=/out make install && \
-  echo "- imgcrypt: ${IMGCRYPT_VERSION}" >> /out/share/doc/nerdctl-full/README.md
+  echo "- imgcrypt: ${IMGCRYPT_VERSION/@*}" >> /out/share/doc/nerdctl-full/README.md
 ARG SLIRP4NETNS_VERSION
-RUN fname="slirp4netns-$(cat /target_uname_m)" && \
+RUN SLIRP4NETNS_VERSION=${SLIRP4NETNS_VERSION/@BINARY}; \
+  fname="slirp4netns-$(cat /target_uname_m)" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/rootless-containers/slirp4netns/releases/download/${SLIRP4NETNS_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/slirp4netns-${SLIRP4NETNS_VERSION}" | sha256sum -c && \
   mv "${fname}" /out/bin/slirp4netns && \
@@ -185,36 +191,41 @@ RUN fname="slirp4netns-$(cat /target_uname_m)" && \
   echo "- slirp4netns: ${SLIRP4NETNS_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG BYPASS4NETNS_VERSION
 COPY --from=build-bypass4netns /out/${TARGETARCH:-amd64}/* /out/bin/
-RUN echo "- bypass4netns: ${BYPASS4NETNS_VERSION}" >> /out/share/doc/nerdctl-full/README.md
+RUN echo "- bypass4netns: ${BYPASS4NETNS_VERSION/@*}" >> /out/share/doc/nerdctl-full/README.md
 ARG FUSE_OVERLAYFS_VERSION
-RUN fname="fuse-overlayfs-$(cat /target_uname_m)" && \
+RUN FUSE_OVERLAYFS_VERSION=${FUSE_OVERLAYFS_VERSION/@BINARY}; \
+  fname="fuse-overlayfs-$(cat /target_uname_m)" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/containers/fuse-overlayfs/releases/download/${FUSE_OVERLAYFS_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/fuse-overlayfs-${FUSE_OVERLAYFS_VERSION}" | sha256sum -c && \
   mv "${fname}" /out/bin/fuse-overlayfs && \
   chmod +x /out/bin/fuse-overlayfs && \
   echo "- fuse-overlayfs: ${FUSE_OVERLAYFS_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG CONTAINERD_FUSE_OVERLAYFS_VERSION
-RUN fname="containerd-fuse-overlayfs-${CONTAINERD_FUSE_OVERLAYFS_VERSION/v}-${TARGETOS:-linux}-${TARGETARCH:-amd64}.tar.gz" && \
+RUN CONTAINERD_FUSE_OVERLAYFS_VERSION=${CONTAINERD_FUSE_OVERLAYFS_VERSION/@BINARY}; \
+  fname="containerd-fuse-overlayfs-${CONTAINERD_FUSE_OVERLAYFS_VERSION/v}-${TARGETOS:-linux}-${TARGETARCH:-amd64}.tar.gz" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/containerd/fuse-overlayfs-snapshotter/releases/download/${CONTAINERD_FUSE_OVERLAYFS_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/containerd-fuse-overlayfs-${CONTAINERD_FUSE_OVERLAYFS_VERSION}" | sha256sum -c && \
   tar xzf "${fname}" -C /out/bin && \
   rm -f "${fname}" && \
   echo "- containerd-fuse-overlayfs: ${CONTAINERD_FUSE_OVERLAYFS_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG TINI_VERSION
-RUN fname="tini-static-${TARGETARCH:-amd64}" && \
+RUN TINI_VERSION=${TINI_VERSION/@BINARY}; \
+  fname="tini-static-${TARGETARCH:-amd64}" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/krallin/tini/releases/download/${TINI_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/tini-${TINI_VERSION}" | sha256sum -c && \
   cp -a "${fname}" /out/bin/tini && chmod +x /out/bin/tini && \
   echo "- Tini: ${TINI_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG BUILDG_VERSION
-RUN fname="buildg-${BUILDG_VERSION}-${TARGETOS:-linux}-${TARGETARCH:-amd64}.tar.gz" && \
+RUN BUILDG_VERSION=${BUILDG_VERSION/@BINARY}; \
+  fname="buildg-${BUILDG_VERSION}-${TARGETOS:-linux}-${TARGETARCH:-amd64}.tar.gz" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/ktock/buildg/releases/download/${BUILDG_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/buildg-${BUILDG_VERSION}" | sha256sum -c && \
   tar xzf "${fname}" -C /out/bin && \
   rm -f "${fname}" && \
   echo "- buildg: ${BUILDG_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG ROOTLESSKIT_VERSION
-RUN fname="rootlesskit-$(cat /target_uname_m).tar.gz" && \
+RUN ROOTLESSKIT_VERSION=${ROOTLESSKIT_VERSION/@BINARY}; \
+  fname="rootlesskit-$(cat /target_uname_m).tar.gz" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/rootless-containers/rootlesskit/releases/download/${ROOTLESSKIT_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/rootlesskit-${ROOTLESSKIT_VERSION}" | sha256sum -c && \
   tar xzf "${fname}" -C /out/bin && \
@@ -223,10 +234,10 @@ RUN fname="rootlesskit-$(cat /target_uname_m).tar.gz" && \
 
 RUN echo "" >> /out/share/doc/nerdctl-full/README.md && \
   echo "## License" >> /out/share/doc/nerdctl-full/README.md && \
-  echo "- bin/slirp4netns:    [GNU GENERAL PUBLIC LICENSE, Version 2](https://github.com/rootless-containers/slirp4netns/blob/${SLIRP4NETNS_VERSION}/COPYING)" >> /out/share/doc/nerdctl-full/README.md && \
-  echo "- bin/fuse-overlayfs: [GNU GENERAL PUBLIC LICENSE, Version 2](https://github.com/containers/fuse-overlayfs/blob/${FUSE_OVERLAYFS_VERSION}/COPYING)" >> /out/share/doc/nerdctl-full/README.md && \
+  echo "- bin/slirp4netns:    [GNU GENERAL PUBLIC LICENSE, Version 2](https://github.com/rootless-containers/slirp4netns/blob/${SLIRP4NETNS_VERSION/@*}/COPYING)" >> /out/share/doc/nerdctl-full/README.md && \
+  echo "- bin/fuse-overlayfs: [GNU GENERAL PUBLIC LICENSE, Version 2](https://github.com/containers/fuse-overlayfs/blob/${FUSE_OVERLAYFS_VERSION/@*}/COPYING)" >> /out/share/doc/nerdctl-full/README.md && \
   echo "- bin/{runc,bypass4netns,bypass4netnsd}: Apache License 2.0, statically linked with libseccomp ([LGPL 2.1](https://github.com/seccomp/libseccomp/blob/main/LICENSE), source code available at https://github.com/seccomp/libseccomp/)" >> /out/share/doc/nerdctl-full/README.md && \
-  echo "- bin/tini: [MIT License](https://github.com/krallin/tini/blob/${TINI_VERSION}/LICENSE)" >> /out/share/doc/nerdctl-full/README.md && \
+  echo "- bin/tini: [MIT License](https://github.com/krallin/tini/blob/${TINI_VERSION/@*}/LICENSE)" >> /out/share/doc/nerdctl-full/README.md && \
   echo "- Other files: [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0)" >> /out/share/doc/nerdctl-full/README.md
 
 FROM build-dependencies AS build-full
diff --git a/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.1 b/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.1
deleted file mode 100644
index 6596447644d..00000000000
--- a/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.1
+++ /dev/null
@@ -1,6 +0,0 @@
-2061a4064d163544f69e36fe56d008ab90f791906d5a96bddf87d3151fdde836  containerd-fuse-overlayfs-2.1.1-linux-amd64.tar.gz
-99d08b0f41ede108f36efb9b5d8e0613be69336785cf97a73074487b52d9e71e  containerd-fuse-overlayfs-2.1.1-linux-arm-v7.tar.gz
-2219bf91d943480ce7021d6fce956379050757a500d36540b4372d45616c74eb  containerd-fuse-overlayfs-2.1.1-linux-arm64.tar.gz
-a2515f00553334b23470d52b088e49c3aa69aa9d66163dc14f188684bc8c774d  containerd-fuse-overlayfs-2.1.1-linux-ppc64le.tar.gz
-ae0fc07af2d34fb4c599364f82570ec43fed07f1892e493726f5414ecf8c8908  containerd-fuse-overlayfs-2.1.1-linux-riscv64.tar.gz
-1200244a100b2433cc98a7ec8a0138073e9ad1c5e11ed503f5d2b3063dd40197  containerd-fuse-overlayfs-2.1.1-linux-s390x.tar.gz
diff --git a/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.2 b/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.2
new file mode 100644
index 00000000000..260fe0dedad
--- /dev/null
+++ b/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.2
@@ -0,0 +1,6 @@
+b484d76468b7e91e215c7bdab99eb6322e3c396707cd72c3571d8bc6a62f4fb5  containerd-fuse-overlayfs-2.1.2-linux-amd64.tar.gz
+35648602f4eea1a84095ac19ca63752e3a9faa2e1a3b9ba95c6e555aee932820  containerd-fuse-overlayfs-2.1.2-linux-arm-v7.tar.gz
+0d9a75ef98e4538f039fea3da621560fd2b85a6bc34735f189121decf7d2266b  containerd-fuse-overlayfs-2.1.2-linux-arm64.tar.gz
+02a4f9c90b2fbabd4326a19f7659638b36910c4633fe1772f44da6239c4e95fa  containerd-fuse-overlayfs-2.1.2-linux-ppc64le.tar.gz
+febd653d766cc724383045509b6958d8f1bdfc4d4b8d5027099d7760c6374dca  containerd-fuse-overlayfs-2.1.2-linux-riscv64.tar.gz
+44a6c830d3371d522033ac47a2f90b6be12311d72a8b290a70d73771aa062e6c  containerd-fuse-overlayfs-2.1.2-linux-s390x.tar.gz
diff --git a/Dockerfile.d/SHA256SUMS.d/slirp4netns-v1.3.1 b/Dockerfile.d/SHA256SUMS.d/slirp4netns-v1.3.1
deleted file mode 100644
index 4d0d9ea9444..00000000000
--- a/Dockerfile.d/SHA256SUMS.d/slirp4netns-v1.3.1
+++ /dev/null
@@ -1,6 +0,0 @@
-2dd9aac6c2e3203e53cb7b6e4b9fc7123e4e4a9716c8bb1d95951853059a6af5  slirp4netns-aarch64
-ed618c0f2c74014bb736e9e427e18c8791ad9d68311872a41b06fac0d7cb9ef2  slirp4netns-armv7l
-a10f70209cee0dd0532fea0e8b6bfde5d16dec5206fd4b3387d861721456de66  slirp4netns-ppc64le
-38209015c2f3f4619d9fc46610852887910f33c7a0b96f7d2aa835a7bbc73f31  slirp4netns-riscv64
-9f42718455b1f9cf4b6f0efee314b78e860b8c36dbbb6290f09c8fbedda9ff8a  slirp4netns-s390x
-4bc5d6c311f9fa7ae00ce54aefe10c2afaf0800fe9e99f32616a964ed804a9e1  slirp4netns-x86_64
diff --git a/Dockerfile.d/SHA256SUMS.d/slirp4netns-v1.3.2 b/Dockerfile.d/SHA256SUMS.d/slirp4netns-v1.3.2
new file mode 100644
index 00000000000..db7c5ae07df
--- /dev/null
+++ b/Dockerfile.d/SHA256SUMS.d/slirp4netns-v1.3.2
@@ -0,0 +1,7 @@
+b4162d27bbbd3683ca8ee57b51a1b270c0054b3a15fcc1830a5d7c10b77ad045  SOURCE_DATE_EPOCH
+c55117faa5e18345a3ee1515267f056822ff0c1897999ae5422b0114ee48df85  slirp4netns-aarch64
+f55a6c9e3ec8280e9c3cec083f07dc124e2846ce8139a9281c35013e968d7e95  slirp4netns-armv7l
+7b388a9cacbd89821f7f7a6457470fcae8f51aa846162521589feb4634ec7586  slirp4netns-ppc64le
+041f9fe507510de1fbb802933a6add093ff19f941185965295c81f2ba4fc9cec  slirp4netns-riscv64
+aa39cf14414ae53dbff6b79dfdfa55b5ff8ac5250e2261804863cd365b33a818  slirp4netns-s390x
+4d55a3658ae259e3e74bb75cf058eb05d6e39ad6bbe170ca8e94c2462bea0eb1  slirp4netns-x86_64
diff --git a/hack/git-checkout-tag-with-hash.sh b/hack/git-checkout-tag-with-hash.sh
new file mode 100755
index 00000000000..aecbd5421d9
--- /dev/null
+++ b/hack/git-checkout-tag-with-hash.sh
@@ -0,0 +1,46 @@
+#!/bin/sh
+
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+# This script is intended to be usable in other projects too.
+# * Must not have project-specific logics
+# * Must be compatible with bash, dash, and busybox
+
+set -eu
+if [ "$#" -ne 1 ]; then
+	echo "$0: checkout TAG with HASH, and validate it"
+	echo "Usage: $0 TAG[@HASH]"
+	exit 0
+fi
+
+: "${GIT:=git}"
+TAG="$(echo "$1" | cut -d@ -f1)"
+HASH=""
+case "$1" in
+*@*)
+	HASH="$(echo "$1" | cut -d@ -f2)"
+	;;
+esac
+
+"$GIT" checkout "$TAG"
+HEAD="$("$GIT" rev-parse HEAD)"
+if [ -z "$HASH" ]; then
+	echo >&2 "WARNING: ${TAG}: commit hash was not specified (got ${HEAD})"
+else
+	if [ "$HEAD" != "$HASH" ]; then
+		echo >&2 "ERROR: ${TAG}: expected ${HASH}, got ${HEAD}"
+		exit 1
+	fi
+fi

From 8aff7f7e4822da590211f8344d52e1e2f17f1cb2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 19 Mar 2025 22:15:59 +0000
Subject: [PATCH 009/225] build(deps): bump the docker group with 2 updates

Bumps the docker group with 2 updates: [github.com/docker/cli](https://github.com/docker/cli) and [github.com/docker/docker](https://github.com/docker/docker).


Updates `github.com/docker/cli` from 28.0.1+incompatible to 28.0.2+incompatible
- [Commits](https://github.com/docker/cli/compare/v28.0.1...v28.0.2)

Updates `github.com/docker/docker` from 28.0.1+incompatible to 28.0.2+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/compare/v28.0.1...v28.0.2)

---
updated-dependencies:
- dependency-name: github.com/docker/cli
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker
- dependency-name: github.com/docker/docker
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 4 ++--
 go.sum | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/go.mod b/go.mod
index 1c8e9f78290..d9e0f56e8ce 100644
--- a/go.mod
+++ b/go.mod
@@ -31,8 +31,8 @@ require (
 	github.com/coreos/go-systemd/v22 v22.5.0
 	github.com/cyphar/filepath-securejoin v0.4.1
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v28.0.1+incompatible
-	github.com/docker/docker v28.0.1+incompatible
+	github.com/docker/cli v28.0.2+incompatible
+	github.com/docker/docker v28.0.2+incompatible
 	github.com/docker/go-connections v0.5.0
 	github.com/docker/go-units v0.5.0
 	github.com/fahedouch/go-logrotate v0.2.1
diff --git a/go.sum b/go.sum
index b91e80b42d0..8900fcf085d 100644
--- a/go.sum
+++ b/go.sum
@@ -88,10 +88,10 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/docker/cli v28.0.1+incompatible h1:g0h5NQNda3/CxIsaZfH4Tyf6vpxFth7PYl3hgCPOKzs=
-github.com/docker/cli v28.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/docker v28.0.1+incompatible h1:FCHjSRdXhNRFjlHMTv4jUNlIBbTeRjrWfeFuJp7jpo0=
-github.com/docker/docker v28.0.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/cli v28.0.2+incompatible h1:cRPZ77FK3/IXTAIQQj1vmhlxiLS5m+MIUDwS6f57lrE=
+github.com/docker/cli v28.0.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/docker v28.0.2+incompatible h1:9BILleFwug5FSSqWBgVevgL3ewDJfWWWyZVqlDMttE8=
+github.com/docker/docker v28.0.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=

From 3bb5bedde132fc64ea1154872f2aa64066cbd82a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 19 Mar 2025 22:20:38 +0000
Subject: [PATCH 010/225] build(deps): bump actions/cache from 4.2.2 to 4.2.3

Bumps [actions/cache](https://github.com/actions/cache) from 4.2.2 to 4.2.3.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/d4323d4df104b026a6aa633fdb11d772146be0bf...5a3ec84eff668545956fd18022155c47e93e2684)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a50b3c8a75c..5a39d263bca 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -396,7 +396,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 1
-      - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf  # v4.2.2
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
         with:
           path: /root/.vagrant.d
           key: vagrant-${{ matrix.box }}
@@ -444,7 +444,7 @@ jobs:
           fetch-depth: 1
       - uses: lima-vm/lima-actions/setup@be564a1408f84557d067b099a475652288074b2e  # v1.0.0
         id: lima-actions-setup
-      - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf  # v4.2.2
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
         with:
           path: ~/.cache/lima
           key: lima-${{ steps.lima-actions-setup.outputs.version }}

From 4ae63816731e29672fb848474d014c4679bc1399 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 19 Mar 2025 22:20:42 +0000
Subject: [PATCH 011/225] build(deps): bump actions/setup-go from 5.3.0 to
 5.4.0

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.3.0 to 5.4.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/f111f3307d8850f501ac008e886eec1fd1932a34...0aaccfd150d50ccaeb58ebd88d36e91967a5f35b)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/lint.yml        | 4 ++--
 .github/workflows/project.yml     | 2 +-
 .github/workflows/release.yml     | 2 +-
 .github/workflows/test-canary.yml | 2 +-
 .github/workflows/test.yml        | 8 ++++----
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 80c63109381..41b9b0ceb2e 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -46,7 +46,7 @@ jobs:
             . ./hack/build-integration-canary.sh
             canary::golang::latest
           fi
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
@@ -64,7 +64,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 1
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index 7a7fce563f0..e0a205c78bb 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -20,7 +20,7 @@ jobs:
         with:
           path: src/github.com/containerd/nerdctl
           fetch-depth: 100
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
           cache-dependency-path: src/github.com/containerd/nerdctl
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 72940cf30f5..a54ef605b42 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,7 +15,7 @@ jobs:
     timeout-minutes: 40
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-    - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
+    - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
       with:
         go-version: 1.24.x
     - name: "Compile binaries"
diff --git a/.github/workflows/test-canary.yml b/.github/workflows/test-canary.yml
index 45d25c2372e..845de25f283 100644
--- a/.github/workflows/test-canary.yml
+++ b/.github/workflows/test-canary.yml
@@ -70,7 +70,7 @@ jobs:
 
           . ./hack/build-integration-canary.sh
           canary::golang::latest
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a50b3c8a75c..e176dc5bfd0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -74,7 +74,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 1
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
@@ -312,7 +312,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 1
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ matrix.go-version }}
           check-latest: true
@@ -327,7 +327,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 1
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
@@ -363,7 +363,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 1
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true

From dc79e90541ed85d988e9481db561a00f8b960afc Mon Sep 17 00:00:00 2001
From: Shubharanshu Mahapatra <shubhum@amazon.com>
Date: Thu, 13 Mar 2025 17:29:08 -0700
Subject: [PATCH 012/225] add env to inspect

Signed-off-by: Shubharanshu Mahapatra <shubhum@amazon.com>
---
 pkg/inspecttypes/dockercompat/dockercompat.go      | 5 +++++
 pkg/inspecttypes/dockercompat/dockercompat_test.go | 7 ++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkg/inspecttypes/dockercompat/dockercompat.go b/pkg/inspecttypes/dockercompat/dockercompat.go
index 568bf6fcb40..7c6113e64bf 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat.go
@@ -561,6 +561,11 @@ func ContainerFromNative(n *native.Container) (*Container, error) {
 		return nil, fmt.Errorf("failed to get blkio settings: %w", err)
 	}
 
+	if n.Spec != nil {
+		if spec, ok := n.Spec.(*specs.Spec); ok && spec.Process != nil {
+			c.Config.Env = spec.Process.Env
+		}
+	}
 	return c, nil
 }
 
diff --git a/pkg/inspecttypes/dockercompat/dockercompat_test.go b/pkg/inspecttypes/dockercompat/dockercompat_test.go
index ddb621b9f39..b8ff88a4791 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat_test.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat_test.go
@@ -57,7 +57,11 @@ func TestContainerFromNative(t *testing.T) {
 						"nerdctl/hostname":  "host1",
 					},
 				},
-				Spec: &specs.Spec{},
+				Spec: &specs.Spec{
+					Process: &specs.Process{
+						Env: []string{"/some/path"},
+					},
+				},
 				Process: &native.Process{
 					Pid: 10000,
 					Status: containerd.Status{
@@ -103,6 +107,7 @@ func TestContainerFromNative(t *testing.T) {
 						"nerdctl/hostname":  "host1",
 					},
 					Hostname: "host1",
+					Env:      []string{"/some/path"},
 				},
 				NetworkSettings: &NetworkSettings{
 					Ports:    &nat.PortMap{},

From bbf2ab73b541107217d6190d957f90d534fdcc1f Mon Sep 17 00:00:00 2001
From: Shubharanshu Mahapatra <shubhum@amazon.com>
Date: Fri, 14 Mar 2025 10:53:13 -0700
Subject: [PATCH 013/225] add user to inspect

Signed-off-by: Shubharanshu Mahapatra <shubhum@amazon.com>
---
 .../container/container_inspect_linux_test.go | 34 +++++++++++++++++++
 pkg/cmd/container/create.go                   | 16 +++++++++
 pkg/inspecttypes/dockercompat/dockercompat.go |  5 +++
 .../dockercompat/dockercompat_test.go         |  3 ++
 pkg/labels/labels.go                          |  3 ++
 5 files changed, 61 insertions(+)

diff --git a/cmd/nerdctl/container/container_inspect_linux_test.go b/cmd/nerdctl/container/container_inspect_linux_test.go
index 610c17e45f2..3617f37e273 100644
--- a/cmd/nerdctl/container/container_inspect_linux_test.go
+++ b/cmd/nerdctl/container/container_inspect_linux_test.go
@@ -20,6 +20,7 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"slices"
 	"strings"
 	"testing"
@@ -27,11 +28,14 @@ import (
 	"github.com/docker/go-connections/nat"
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 	"github.com/containerd/nerdctl/v2/pkg/infoutil"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/labels"
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestContainerInspectContainsPortConfig(t *testing.T) {
@@ -514,6 +518,36 @@ func TestContainerInspectBlkioSettings(t *testing.T) {
 	assert.Equal(t, uint64(2000), inspect.HostConfig.BlkioDeviceWriteIOps[0].Rate)
 }
 
+func TestContainerInspectUser(t *testing.T) {
+	nerdtest.Setup()
+	testCase := &test.Case{
+		Description: "Container inspect contains User",
+		Require:     nerdtest.Build,
+		Setup: func(data test.Data, helpers test.Helpers) {
+			dockerfile := fmt.Sprintf(`
+FROM %s
+RUN groupadd -r test && useradd -r -g test test
+USER test
+`, testutil.UbuntuImage)
+
+			err := os.WriteFile(filepath.Join(data.TempDir(), "Dockerfile"), []byte(dockerfile), 0o600)
+			assert.NilError(helpers.T(), err)
+
+			helpers.Ensure("build", "-t", data.Identifier(), data.TempDir())
+			helpers.Ensure("create", "--name", data.Identifier(), "--user", "test", data.Identifier())
+		},
+		Cleanup: func(data test.Data, helpers test.Helpers) {
+			helpers.Anyhow("rm", "-f", data.Identifier())
+		},
+		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+			return helpers.Command("inspect", "--format", "{{.Config.User}}", data.Identifier())
+		},
+		Expected: test.Expects(0, nil, expect.Equals("test\n")),
+	}
+
+	testCase.Run(t)
+}
+
 type hostConfigValues struct {
 	Driver       string
 	ShmSize      int64
diff --git a/pkg/cmd/container/create.go b/pkg/cmd/container/create.go
index 7127e364302..61e7686aebd 100644
--- a/pkg/cmd/container/create.go
+++ b/pkg/cmd/container/create.go
@@ -179,6 +179,15 @@ func Create(ctx context.Context, client *containerd.Client, args []string, netMa
 		}
 	}
 
+	if ensuredImage != nil && ensuredImage.ImageConfig.User != "" {
+		internalLabels.user = ensuredImage.ImageConfig.User
+	}
+
+	// Override it if User is passed
+	if options.User != "" {
+		internalLabels.user = options.User
+	}
+
 	rootfsOpts, rootfsCOpts, err := generateRootfsOpts(args, id, ensuredImage, options)
 	if err != nil {
 		return nil, generateRemoveStateDirFunc(ctx, id, internalLabels), err
@@ -271,6 +280,7 @@ func Create(ctx context.Context, client *containerd.Client, args []string, netMa
 	if err != nil {
 		return nil, generateRemoveOrphanedDirsFunc(ctx, id, dataStore, internalLabels), err
 	}
+
 	opts = append(opts, uOpts...)
 	gOpts, err := generateGroupsOpts(options.GroupAdd)
 	internalLabels.groupAdd = options.GroupAdd
@@ -662,6 +672,8 @@ type internalLabels struct {
 
 	// label for device mapping set by the --device flag
 	deviceMapping []dockercompat.DeviceMapping
+
+	user string
 }
 
 // WithInternalLabels sets the internal labels for a container.
@@ -783,6 +795,10 @@ func withInternalLabels(internalLabels internalLabels) (containerd.NewContainerO
 	}
 	m[labels.DNSSetting] = string(dnsSettingsJSON)
 
+	if internalLabels.user != "" {
+		m[labels.User] = internalLabels.user
+	}
+
 	return containerd.WithAdditionalContainerLabels(m), nil
 }
 
diff --git a/pkg/inspecttypes/dockercompat/dockercompat.go b/pkg/inspecttypes/dockercompat/dockercompat.go
index 7c6113e64bf..4605de3d1e7 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat.go
@@ -566,6 +566,11 @@ func ContainerFromNative(n *native.Container) (*Container, error) {
 			c.Config.Env = spec.Process.Env
 		}
 	}
+
+	if n.Labels[labels.User] != "" {
+		c.Config.User = n.Labels[labels.User]
+	}
+
 	return c, nil
 }
 
diff --git a/pkg/inspecttypes/dockercompat/dockercompat_test.go b/pkg/inspecttypes/dockercompat/dockercompat_test.go
index b8ff88a4791..4966ce89604 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat_test.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat_test.go
@@ -55,6 +55,7 @@ func TestContainerFromNative(t *testing.T) {
 						"nerdctl/mounts":    "[{\"Type\":\"bind\",\"Source\":\"/mnt/foo\",\"Destination\":\"/mnt/foo\",\"Mode\":\"rshared,rw\",\"RW\":true,\"Propagation\":\"rshared\"}]",
 						"nerdctl/state-dir": tempStateDir,
 						"nerdctl/hostname":  "host1",
+						"nerdctl/user":      "test-user",
 					},
 				},
 				Spec: &specs.Spec{
@@ -105,9 +106,11 @@ func TestContainerFromNative(t *testing.T) {
 						"nerdctl/mounts":    "[{\"Type\":\"bind\",\"Source\":\"/mnt/foo\",\"Destination\":\"/mnt/foo\",\"Mode\":\"rshared,rw\",\"RW\":true,\"Propagation\":\"rshared\"}]",
 						"nerdctl/state-dir": tempStateDir,
 						"nerdctl/hostname":  "host1",
+						"nerdctl/user":      "test-user",
 					},
 					Hostname: "host1",
 					Env:      []string{"/some/path"},
+					User:     "test-user",
 				},
 				NetworkSettings: &NetworkSettings{
 					Ports:    &nat.PortMap{},
diff --git a/pkg/labels/labels.go b/pkg/labels/labels.go
index 0376497ad9e..9356ad03a68 100644
--- a/pkg/labels/labels.go
+++ b/pkg/labels/labels.go
@@ -115,4 +115,7 @@ const (
 
 	// DNSSettings sets the dockercompat DNS config values
 	DNSSetting = Prefix + "dns"
+
+	// User is the username of the container
+	User = Prefix + "user"
 )

From c66f8ebf66c73eef37a4fbf95a85d1c278519beb Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 20 Mar 2025 11:06:24 -0700
Subject: [PATCH 014/225] Dockerfile git clones to be quiet and shallow

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 Dockerfile | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 8750018a18e..4a31d8eef41 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -75,7 +75,7 @@ ADD hack/git-checkout-tag-with-hash.sh /usr/local/bin/
 FROM build-base-debian AS build-containerd
 ARG TARGETARCH
 ARG CONTAINERD_VERSION
-RUN git clone https://github.com/containerd/containerd.git /go/src/github.com/containerd/containerd
+RUN git clone --quiet --depth 1 --branch "${CONTAINERD_VERSION%@*}" https://github.com/containerd/containerd.git /go/src/github.com/containerd/containerd
 WORKDIR /go/src/github.com/containerd/containerd
 RUN git-checkout-tag-with-hash.sh ${CONTAINERD_VERSION} && \
   mkdir -p /out /out/$TARGETARCH && \
@@ -86,7 +86,7 @@ RUN GO=xx-go make STATIC=1 && \
 FROM build-base-debian AS build-runc
 ARG RUNC_VERSION
 ARG TARGETARCH
-RUN git clone https://github.com/opencontainers/runc.git /go/src/github.com/opencontainers/runc
+RUN git clone --quiet --depth 1 --branch "${RUNC_VERSION%@*}" https://github.com/opencontainers/runc.git /go/src/github.com/opencontainers/runc
 WORKDIR /go/src/github.com/opencontainers/runc
 RUN git-checkout-tag-with-hash.sh ${RUNC_VERSION} && \
   mkdir -p /out
@@ -97,7 +97,7 @@ RUN GO=xx-go CC=$(xx-info)-gcc STRIP=$(xx-info)-strip make static && \
 FROM build-base-debian AS build-bypass4netns
 ARG BYPASS4NETNS_VERSION
 ARG TARGETARCH
-RUN git clone https://github.com/rootless-containers/bypass4netns.git /go/src/github.com/rootless-containers/bypass4netns
+RUN git clone --quiet --depth 1 --branch "${BYPASS4NETNS_VERSION%@*}" https://github.com/rootless-containers/bypass4netns.git /go/src/github.com/rootless-containers/bypass4netns
 WORKDIR /go/src/github.com/rootless-containers/bypass4netns
 RUN git-checkout-tag-with-hash.sh ${BYPASS4NETNS_VERSION} && \
   mkdir -p /out/${TARGETARCH}
@@ -108,7 +108,7 @@ RUN GO=xx-go make static && \
 FROM build-base-debian AS build-kubo
 ARG KUBO_VERSION
 ARG TARGETARCH
-RUN git clone https://github.com/ipfs/kubo.git /go/src/github.com/ipfs/kubo
+RUN git clone --quiet --depth 1 --branch "${KUBO_VERSION%@*}" https://github.com/ipfs/kubo.git /go/src/github.com/ipfs/kubo
 WORKDIR /go/src/github.com/ipfs/kubo
 RUN git-checkout-tag-with-hash.sh ${KUBO_VERSION} && \
   mkdir -p /out/${TARGETARCH}
@@ -176,7 +176,7 @@ RUN STARGZ_SNAPSHOTTER_VERSION=${STARGZ_SNAPSHOTTER_VERSION/@BINARY}; \
   mv stargz-snapshotter.service /out/lib/systemd/system/stargz-snapshotter.service && \
   echo "- Stargz Snapshotter: ${STARGZ_SNAPSHOTTER_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG IMGCRYPT_VERSION
-RUN git clone https://github.com/containerd/imgcrypt.git /go/src/github.com/containerd/imgcrypt && \
+RUN git clone --quiet --depth 1 --branch "${IMGCRYPT_VERSION%@*}" https://github.com/containerd/imgcrypt.git /go/src/github.com/containerd/imgcrypt && \
   cd /go/src/github.com/containerd/imgcrypt && \
   git-checkout-tag-with-hash.sh "${IMGCRYPT_VERSION}" && \
   CGO_ENABLED=0 make && DESTDIR=/out make install && \

From 233285b25e851c0338f12f478724a23d9c2258bf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 26 Mar 2025 22:34:22 +0000
Subject: [PATCH 015/225] build(deps): bump the docker group with 2 updates

Bumps the docker group with 2 updates: [github.com/docker/cli](https://github.com/docker/cli) and [github.com/docker/docker](https://github.com/docker/docker).


Updates `github.com/docker/cli` from 28.0.2+incompatible to 28.0.4+incompatible
- [Commits](https://github.com/docker/cli/compare/v28.0.2...v28.0.4)

Updates `github.com/docker/docker` from 28.0.2+incompatible to 28.0.4+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/compare/v28.0.2...v28.0.4)

---
updated-dependencies:
- dependency-name: github.com/docker/cli
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker
- dependency-name: github.com/docker/docker
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 4 ++--
 go.sum | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/go.mod b/go.mod
index d9e0f56e8ce..d33d9966ae8 100644
--- a/go.mod
+++ b/go.mod
@@ -31,8 +31,8 @@ require (
 	github.com/coreos/go-systemd/v22 v22.5.0
 	github.com/cyphar/filepath-securejoin v0.4.1
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v28.0.2+incompatible
-	github.com/docker/docker v28.0.2+incompatible
+	github.com/docker/cli v28.0.4+incompatible
+	github.com/docker/docker v28.0.4+incompatible
 	github.com/docker/go-connections v0.5.0
 	github.com/docker/go-units v0.5.0
 	github.com/fahedouch/go-logrotate v0.2.1
diff --git a/go.sum b/go.sum
index 8900fcf085d..eb86a38a137 100644
--- a/go.sum
+++ b/go.sum
@@ -88,10 +88,10 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/docker/cli v28.0.2+incompatible h1:cRPZ77FK3/IXTAIQQj1vmhlxiLS5m+MIUDwS6f57lrE=
-github.com/docker/cli v28.0.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/docker v28.0.2+incompatible h1:9BILleFwug5FSSqWBgVevgL3ewDJfWWWyZVqlDMttE8=
-github.com/docker/docker v28.0.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/cli v28.0.4+incompatible h1:pBJSJeNd9QeIWPjRcV91RVJihd/TXB77q1ef64XEu4A=
+github.com/docker/cli v28.0.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/docker v28.0.4+incompatible h1:JNNkBctYKurkw6FrHfKqY0nKIDf5nrbxjVBtS+cdcok=
+github.com/docker/docker v28.0.4+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=

From a257f62e2ba1d68a44b142a7cd346375c4e5b7dc Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 26 Mar 2025 22:34:31 +0000
Subject: [PATCH 016/225] build(deps): bump
 github.com/containerd/nydus-snapshotter

Bumps [github.com/containerd/nydus-snapshotter](https://github.com/containerd/nydus-snapshotter) from 0.15.0 to 0.15.1.
- [Release notes](https://github.com/containerd/nydus-snapshotter/releases)
- [Commits](https://github.com/containerd/nydus-snapshotter/compare/v0.15.0...v0.15.1)

---
updated-dependencies:
- dependency-name: github.com/containerd/nydus-snapshotter
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index d9e0f56e8ce..bde8fe6955e 100644
--- a/go.mod
+++ b/go.mod
@@ -19,7 +19,7 @@ require (
 	github.com/containerd/imgcrypt/v2 v2.0.1
 	github.com/containerd/log v0.1.0
 	github.com/containerd/nerdctl/mod/tigron v0.0.0
-	github.com/containerd/nydus-snapshotter v0.15.0
+	github.com/containerd/nydus-snapshotter v0.15.1
 	github.com/containerd/platforms v1.0.0-rc.1
 	github.com/containerd/stargz-snapshotter v0.16.3
 	github.com/containerd/stargz-snapshotter/estargz v0.16.3
diff --git a/go.sum b/go.sum
index 8900fcf085d..f6888a8723a 100644
--- a/go.sum
+++ b/go.sum
@@ -49,8 +49,8 @@ github.com/containerd/imgcrypt/v2 v2.0.1 h1:gQcmeCKA97fAl0wlpq0itSY/PagFBsn4/mlK
 github.com/containerd/imgcrypt/v2 v2.0.1/go.mod h1:/qIJL8nxzdzMA2n5iYyyuIY36KfoVQWmgTWdfVtyebM=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/containerd/nydus-snapshotter v0.15.0 h1:RqZRs1GPeM6T3wmuxJV9u+2Rg4YETVMwTmiDeX+iWC8=
-github.com/containerd/nydus-snapshotter v0.15.0/go.mod h1:biq0ijpeZe0I5yZFSJyHzFSjjRZQ7P7y/OuHyd7hYOw=
+github.com/containerd/nydus-snapshotter v0.15.1 h1:huPj2d8J1BEx6mjm6h72BCo1kY5lTrfatnnujzpu6BA=
+github.com/containerd/nydus-snapshotter v0.15.1/go.mod h1:FfwH2KBkNYoisK/e+KsmNr7xTU53DmnavQHMFOcXwfM=
 github.com/containerd/platforms v1.0.0-rc.1 h1:83KIq4yy1erSRgOVHNk1HYdPvzdJ5CnsWaRoJX4C41E=
 github.com/containerd/platforms v1.0.0-rc.1/go.mod h1:J71L7B+aiM5SdIEqmd9wp6THLVRzJGXfNuWCZCllLA4=
 github.com/containerd/plugin v1.0.0 h1:c8Kf1TNl6+e2TtMHZt+39yAPDbouRH9WAToRjex483Y=

From 2db910590a84737ccac5a2bb1f2a163a2586a551 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 26 Mar 2025 22:34:31 -0700
Subject: [PATCH 017/225] Makefile cleanup and update

- update to golangci v2
- remove dependency on go-imports-reviser (in favor of golangci provided gci)
- remove useless tasks
- remove hack make-license

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/.golangci.yml              | 99 +++++++++++++++------------
 mod/tigron/Makefile                   | 59 +++++++---------
 mod/tigron/hack/make-lint-licenses.sh | 30 --------
 3 files changed, 80 insertions(+), 108 deletions(-)
 delete mode 100755 mod/tigron/hack/make-lint-licenses.sh

diff --git a/mod/tigron/.golangci.yml b/mod/tigron/.golangci.yml
index 66e0b8d2ade..db36a3802b6 100644
--- a/mod/tigron/.golangci.yml
+++ b/mod/tigron/.golangci.yml
@@ -1,54 +1,65 @@
----
-output:
-  sort-results: true
-
-issues:
-  max-issues-per-linter: 0
-  max-same-issues: 0
+version: "2"
 
 run:
-  concurrency: 0
-  timeout: 5m
   issues-exit-code: 2
-  tests: true
   modules-download-mode: readonly
   allow-parallel-runners: true
   allow-serial-runners: true
 
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+
 linters:
-  disable-all: false
-  enable-all: true
+  default: all
   disable:
-    # Opting-out
-    - nonamedreturns  # named returns are occasionally useful
-    - exhaustruct  # does not serve much of a purpose
-    - funlen  # not interested
-    - cyclop  # not interested much
-    - godox  # having these are useful
-    # Duplicating
-    - gci  # we use go-imports instead
-    # Deprecated
-    - tenv
-    # TODO: Temporarily out until we wrap up all of them
-#    - wrapcheck
-
-linters-settings:
-  staticcheck:
-    checks:
-      - "all"
+    - cyclop
+    - exhaustruct
+    - funlen
+    - godox
+    - nonamedreturns
+  settings:
+    depguard:
+      rules:
+        main:
+          files:
+            - $all
+          allow:
+            - $gostd
+            - github.com/containerd/nerdctl/mod/tigron
+            - github.com/creack/pty
+            - github.com/rs/zerolog
+            - github.com/rs/zerolog/log
+            - go.uber.org/goleak
+            - golang.org/x/sync/errgroup
+            - golang.org/x/term
+            - gotest.tools
+    staticcheck:
+      checks:
+        - all
+  exclusions:
+    generated: disable
 
-  depguard:
-    rules:
-      main:
-        files:
-          - "$all"
-        allow:
-          - $gostd
-          - "github.com/containerd/nerdctl/mod/tigron"
-          # WATCHOUT! https://github.com/OpenPeeDeeP/depguard/issues/108
-          # Currently, depguard will fail detecting any dependency starting with a standard package name as third-party.
-          # Thus, the following three are allowed provisionally, though currently not "necessary".
-          - "golang.org/x/sync"
-          - "golang.org/x/term"
-          - "gotest.tools"
-          - "github.com/creack/pty"
+formatters:
+  settings:
+    gci:
+      sections:
+        - standard
+        - default
+        - prefix(github.com/containerd)
+        - localmodule
+      no-inline-comments: true
+      no-prefix-comments: true
+      custom-order: true
+    gofumpt:
+      extra-rules: true
+    golines:
+      max-len: 100
+      tab-len: 4
+      shorten-comments: true
+  enable:
+    - gci
+    - gofumpt
+    - golines
+  exclusions:
+    generated: disable
diff --git a/mod/tigron/Makefile b/mod/tigron/Makefile
index 681dbc3f920..388b97065c0 100644
--- a/mod/tigron/Makefile
+++ b/mod/tigron/Makefile
@@ -57,16 +57,16 @@ endef
 ##########################
 # High-level tasks definitions
 ##########################
-lint: lint-go-all lint-imports lint-yaml lint-shell lint-commits lint-headers lint-mod lint-licenses-all
+lint: lint-go-all lint-yaml lint-shell lint-commits lint-headers lint-mod lint-licenses-all
 test: test-unit test-unit-race test-unit-bench
 unit: test-unit test-unit-race test-unit-bench
-fix: fix-mod fix-imports fix-go-all
+fix: fix-mod fix-go-all
 
 ##########################
 # Linting tasks
 ##########################
 lint-go:
-	$(call title, $@)
+	$(call title, $@: $(GOOS))
 	@cd $(MAKEFILE_DIR) \
 		&& golangci-lint run $(VERBOSE_FLAG_LONG) ./...
 	$(call footer, $@)
@@ -80,12 +80,6 @@ lint-go-all:
 		&& GOOS=windows make lint-go
 	$(call footer, $@)
 
-lint-imports:
-	$(call title, $@)
-	@cd $(MAKEFILE_DIR) \
-		&& goimports-reviser -recursive -list-diff -set-exit-status -output stdout -company-prefixes "$(ORG_PREFIXES)"  ./...
-	$(call footer, $@)
-
 lint-yaml:
 	$(call title, $@)
 	@cd $(MAKEFILE_DIR) \
@@ -115,10 +109,15 @@ lint-mod:
 		&& go mod tidy --diff
 	$(call footer, $@)
 
+# FIXME: go-licenses cannot find LICENSE from root of repo when submodule is imported:
+# https://github.com/google/go-licenses/issues/186
+# This is impacting gotest.tools
 lint-licenses:
-	$(call title, $@)
+	$(call title, $@: $(GOOS))
 	@cd $(MAKEFILE_DIR) \
-		&& ./hack/make-lint-licenses.sh
+		&& go-licenses check --include_tests --allowed_licenses=Apache-2.0,BSD-2-Clause,BSD-3-Clause,MIT,MPL-2.0 \
+		  --ignore gotest.tools \
+		  ./...
 	$(call footer, $@)
 
 lint-licenses-all:
@@ -134,7 +133,7 @@ lint-licenses-all:
 # Automated fixing tasks
 ##########################
 fix-go:
-	$(call title, $@)
+	$(call title, $@: $(GOOS))
 	@cd $(MAKEFILE_DIR) \
 		&& golangci-lint run --fix
 	$(call footer, $@)
@@ -148,12 +147,6 @@ fix-go-all:
 		&& GOOS=windows make fix-go
 	$(call footer, $@)
 
-fix-imports:
-	$(call title, $@)
-	@cd $(MAKEFILE_DIR) \
-		&& goimports-reviser -company-prefixes $(ORG_PREFIXES) ./...
-	$(call footer, $@)
-
 fix-mod:
 	$(call title, $@)
 	@cd $(MAKEFILE_DIR) \
@@ -171,18 +164,16 @@ up:
 ##########################
 install-dev-tools:
 	$(call title, $@)
-	# golangci: v1.64.5
-	# git-validation: main from 2023/11
-	# ltag: v0.2.5
-	# go-licenses: v2.0.0-alpha.1
-	# goimports-reviser: v3.9.0
+	# golangci: v2.0.2 (2024-03-26)
+	# git-validation: main (2025-02-25)
+	# ltag: main (2025-03-04)
+	# go-licenses: v2.0.0-alpha.1 (2024-06-27)
 	@cd $(MAKEFILE_DIR) \
-		&& go install github.com/golangci/golangci-lint/cmd/golangci-lint@0a603e49e5e9870f5f9f2035bcbe42cd9620a9d5 \
-		&& go install github.com/vbatts/git-validation@679e5cad8c50f1605ab3d8a0a947aaf72fb24c07 \
-		&& go install github.com/kunalkushwaha/ltag@b0cfa33e4cc9383095dc584d3990b62c95096de0 \
-		&& go install github.com/google/go-licenses/v2@d01822334fba5896920a060f762ea7ecdbd086e8 \
-		&& go install github.com/incu6us/goimports-reviser/v3@698f92d226d50a01731ca8551993ebc1bb7fc788
-	@echo "Remember to add GOROOT/bin to your path"
+		&& go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@2b224c2cf4c9f261c22a16af7f8ca6408467f338 \
+		&& go install github.com/vbatts/git-validation@7b60e35b055dd2eab5844202ffffad51d9c93922 \
+		&& go install github.com/containerd/ltag@66e6a514664ee2d11a470735519fa22b1a9eaabd \
+		&& go install github.com/google/go-licenses/v2@d01822334fba5896920a060f762ea7ecdbd086e8
+	@echo "Remember to add \$$HOME/go/bin to your path"
 	$(call footer, $@)
 
 ##########################
@@ -190,7 +181,7 @@ install-dev-tools:
 ##########################
 test-unit:
 	$(call title, $@)
-	@go test $(VERBOSE_FLAG) $(MAKEFILE_DIR)/...
+	@EXPERIMENTAL_HIGHK_FD=true go test $(VERBOSE_FLAG) $(MAKEFILE_DIR)/...
 	$(call footer, $@)
 
 test-unit-bench:
@@ -200,7 +191,7 @@ test-unit-bench:
 
 test-unit-race:
 	$(call title, $@)
-	@go test $(VERBOSE_FLAG) $(MAKEFILE_DIR)/... -race
+	@EXPERIMENTAL_HIGHK_FD=true go test $(VERBOSE_FLAG) $(MAKEFILE_DIR)/... -race
 	$(call footer, $@)
 
 .PHONY: \
@@ -210,6 +201,6 @@ test-unit-race:
 	up \
 	unit \
 	install-dev-tools \
-	lint-commits lint-go lint-go-all lint-headers lint-imports lint-licenses lint-licenses-all lint-mod lint-shell lint-yaml \
-	fix-go fix-go-all fix-imports fix-mod \
-	test-unit test-unit-race test-unit-bench
+	lint-commits lint-go lint-go-all lint-headers lint-licenses lint-licenses-all lint-mod lint-shell lint-yaml \
+	fix-go fix-go-all fix-mod \
+	test-unit test-unit-race test-unit-bench
\ No newline at end of file
diff --git a/mod/tigron/hack/make-lint-licenses.sh b/mod/tigron/hack/make-lint-licenses.sh
deleted file mode 100755
index 23bdca517ac..00000000000
--- a/mod/tigron/hack/make-lint-licenses.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/usr/bin/env bash
-
-#   Copyright The containerd Authors.
-
-#   Licensed under the Apache License, Version 2.0 (the "License");
-#   you may not use this file except in compliance with the License.
-#   You may obtain a copy of the License at
-
-#       http://www.apache.org/licenses/LICENSE-2.0
-
-#   Unless required by applicable law or agreed to in writing, software
-#   distributed under the License is distributed on an "AS IS" BASIS,
-#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#   See the License for the specific language governing permissions and
-#   limitations under the License.
-
-# shellcheck disable=SC2034,SC2015
-set -o errexit -o errtrace -o functrace -o nounset -o pipefail
-
-# FIXME: go-licenses cannot find LICENSE from root of repo when submodule is imported:
-# https://github.com/google/go-licenses/issues/186
-# This is impacting gotest.tools
-# go-licenses is also really broken right now wrt to stdlib: https://github.com/google/go-licenses/issues/244
-# workaround taken from the awesome folks at Pulumi: https://github.com/pulumi/license-check-action/pull/3
-go-licenses check --include_tests --allowed_licenses=Apache-2.0,BSD-2-Clause,BSD-3-Clause,MIT,MPL-2.0 \
-	  --ignore gotest.tools \
-	  --ignore "$(go list std | awk 'NR > 1 { printf(",") } { printf("%s",$0) } END { print "" }')" \
-	  ./...
-
-printf "WARNING: you need to manually verify licenses for:\n- gotest.tools\n"

From a92e93c144f7c83402d80cba99a69190b86daa6e Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 26 Mar 2025 22:53:59 -0700
Subject: [PATCH 018/225] Cosmetic fixes

- satisfy updated golangci-lint
- simplify code
- simplify func signatures
- enhance documentation a bit

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/.golangci.yml            |  8 ++--
 mod/tigron/Makefile                 |  4 +-
 mod/tigron/expect/comparators.go    | 13 ++++---
 mod/tigron/expect/consts.go         | 11 ++++--
 mod/tigron/expect/doc.go            | 19 +++++++++
 mod/tigron/require/doc.go           | 19 +++++++++
 mod/tigron/require/requirement.go   | 37 ++++++++----------
 mod/tigron/test/case.go             | 23 +++++++----
 mod/tigron/test/command.go          | 20 +++++++---
 mod/tigron/test/config.go           |  2 +-
 mod/tigron/test/data.go             |  6 +--
 mod/tigron/test/doc.go              | 18 +++++++++
 mod/tigron/test/funct.go            |  5 ++-
 mod/tigron/test/helpers.go          |  2 +-
 mod/tigron/test/interfaces.go       | 60 +++++++++++++++--------------
 mod/tigron/test/internal/consts.go  |  4 ++
 mod/tigron/test/internal/pty/pty.go | 13 ++++---
 mod/tigron/test/test.go             |  2 +
 mod/tigron/test/types.go            | 24 +++++++-----
 mod/tigron/utils/doc.go             | 19 +++++++++
 20 files changed, 209 insertions(+), 100 deletions(-)
 create mode 100644 mod/tigron/expect/doc.go
 create mode 100644 mod/tigron/require/doc.go
 create mode 100644 mod/tigron/test/doc.go
 create mode 100644 mod/tigron/utils/doc.go

diff --git a/mod/tigron/.golangci.yml b/mod/tigron/.golangci.yml
index db36a3802b6..aa2f7f1a51a 100644
--- a/mod/tigron/.golangci.yml
+++ b/mod/tigron/.golangci.yml
@@ -25,15 +25,13 @@ linters:
           files:
             - $all
           allow:
+
             - $gostd
             - github.com/containerd/nerdctl/mod/tigron
             - github.com/creack/pty
-            - github.com/rs/zerolog
-            - github.com/rs/zerolog/log
-            - go.uber.org/goleak
-            - golang.org/x/sync/errgroup
+            - golang.org/x/sync
             - golang.org/x/term
-            - gotest.tools
+            - gotest.tools/v3
     staticcheck:
       checks:
         - all
diff --git a/mod/tigron/Makefile b/mod/tigron/Makefile
index 388b97065c0..b534581b75b 100644
--- a/mod/tigron/Makefile
+++ b/mod/tigron/Makefile
@@ -181,7 +181,7 @@ install-dev-tools:
 ##########################
 test-unit:
 	$(call title, $@)
-	@EXPERIMENTAL_HIGHK_FD=true go test $(VERBOSE_FLAG) $(MAKEFILE_DIR)/...
+	@go test $(VERBOSE_FLAG) $(MAKEFILE_DIR)/...
 	$(call footer, $@)
 
 test-unit-bench:
@@ -191,7 +191,7 @@ test-unit-bench:
 
 test-unit-race:
 	$(call title, $@)
-	@EXPERIMENTAL_HIGHK_FD=true go test $(VERBOSE_FLAG) $(MAKEFILE_DIR)/... -race
+	@CGO_ENABLED=1 go test $(VERBOSE_FLAG) $(MAKEFILE_DIR)/... -race
 	$(call footer, $@)
 
 .PHONY: \
diff --git a/mod/tigron/expect/comparators.go b/mod/tigron/expect/comparators.go
index dde002db544..9ccaadef470 100644
--- a/mod/tigron/expect/comparators.go
+++ b/mod/tigron/expect/comparators.go
@@ -30,7 +30,7 @@ import (
 // All can be used as a parameter for expected.Output to group a set of comparators.
 func All(comparators ...test.Comparator) test.Comparator {
 	//nolint:thelper
-	return func(stdout string, info string, t *testing.T) {
+	return func(stdout, info string, t *testing.T) {
 		t.Helper()
 
 		for _, comparator := range comparators {
@@ -43,17 +43,18 @@ func All(comparators ...test.Comparator) test.Comparator {
 // is found contained in the output.
 func Contains(compare string) test.Comparator {
 	//nolint:thelper
-	return func(stdout string, info string, t *testing.T) {
+	return func(stdout, info string, t *testing.T) {
 		t.Helper()
 		assert.Check(t, strings.Contains(stdout, compare),
 			fmt.Sprintf("Output does not contain: %q", compare)+info)
 	}
 }
 
-// DoesNotContain is to be used for expected.Output to ensure a comparison string is NOT found in the output.
+// DoesNotContain is to be used for expected.Output to ensure a comparison string is NOT found in
+// the output.
 func DoesNotContain(compare string) test.Comparator {
 	//nolint:thelper
-	return func(stdout string, info string, t *testing.T) {
+	return func(stdout, info string, t *testing.T) {
 		t.Helper()
 		assert.Check(t, !strings.Contains(stdout, compare),
 			fmt.Sprintf("Output does contain: %q", compare)+info)
@@ -63,7 +64,7 @@ func DoesNotContain(compare string) test.Comparator {
 // Equals is to be used for expected.Output to ensure it is exactly the output.
 func Equals(compare string) test.Comparator {
 	//nolint:thelper
-	return func(stdout string, info string, t *testing.T) {
+	return func(stdout, info string, t *testing.T) {
 		t.Helper()
 		assert.Equal(t, compare, stdout, info)
 	}
@@ -73,7 +74,7 @@ func Equals(compare string) test.Comparator {
 // Provisional - expected use, but have not seen it so far.
 func Match(reg *regexp.Regexp) test.Comparator {
 	//nolint:thelper
-	return func(stdout string, info string, t *testing.T) {
+	return func(stdout, info string, t *testing.T) {
 		t.Helper()
 		assert.Check(t, reg.MatchString(stdout), "Output does not match: "+reg.String(), info)
 	}
diff --git a/mod/tigron/expect/consts.go b/mod/tigron/expect/consts.go
index 670e12b4f52..2abab2235b2 100644
--- a/mod/tigron/expect/consts.go
+++ b/mod/tigron/expect/consts.go
@@ -17,8 +17,13 @@
 package expect
 
 const (
-	ExitCodeSuccess     = 0
+	// ExitCodeSuccess will ensure that the command effectively ran returned with exit code zero.
+	ExitCodeSuccess = 0
+	// ExitCodeGenericFail will verify that the command ran and exited with a non-zero error code.
+	// This does NOT include timeouts, cancellation, or signals.
 	ExitCodeGenericFail = -1
-	ExitCodeNoCheck     = -2
-	ExitCodeTimeout     = -3
+	// ExitCodeNoCheck does not enforce any check at all on the function.
+	ExitCodeNoCheck = -2
+	// ExitCodeTimeout verifies that the command was cancelled on timeout.
+	ExitCodeTimeout = -3
 )
diff --git a/mod/tigron/expect/doc.go b/mod/tigron/expect/doc.go
new file mode 100644
index 00000000000..962a92cef64
--- /dev/null
+++ b/mod/tigron/expect/doc.go
@@ -0,0 +1,19 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package expect provides a set of simple concrete test.Comparator implementations to use by tests
+// on stdout, along with exit code expectations.
+package expect
diff --git a/mod/tigron/require/doc.go b/mod/tigron/require/doc.go
new file mode 100644
index 00000000000..f816c257566
--- /dev/null
+++ b/mod/tigron/require/doc.go
@@ -0,0 +1,19 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package require provides a set of concrete test.Requirements to express the need for a specific
+// architecture, OS, or binary, along with Not() and All() which allow Requirements composition.
+package require
diff --git a/mod/tigron/require/requirement.go b/mod/tigron/require/requirement.go
index 4f110a5bf3f..76c0b95f62d 100644
--- a/mod/tigron/require/requirement.go
+++ b/mod/tigron/require/requirement.go
@@ -24,6 +24,7 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/test"
 )
 
+// Binary requires a certain binary to be present in the PATH.
 func Binary(name string) *test.Requirement {
 	return &test.Requirement{
 		Check: func(_ test.Data, _ test.Helpers) (bool, string) {
@@ -39,45 +40,40 @@ func Binary(name string) *test.Requirement {
 	}
 }
 
+// OS requires a specific operating system (matched against runtime.GOOS).
 func OS(os string) *test.Requirement {
 	return &test.Requirement{
 		Check: func(_ test.Data, _ test.Helpers) (bool, string) {
-			mess := fmt.Sprintf("current operating system is %q", runtime.GOOS)
-			ret := true
-			if runtime.GOOS != os {
-				ret = false
-			}
-
-			return ret, mess
+			return runtime.GOOS == os, fmt.Sprintf("current operating system is %q", runtime.GOOS)
 		},
 	}
 }
 
+// Arch requires a specific CPU architecture (matched against runtime.GOARCH).
 func Arch(arch string) *test.Requirement {
 	return &test.Requirement{
 		Check: func(_ test.Data, _ test.Helpers) (bool, string) {
-			mess := fmt.Sprintf("current architecture is %q", runtime.GOARCH)
-			ret := true
-			if runtime.GOARCH != arch {
-				ret = false
-			}
-
-			return ret, mess
+			return runtime.GOARCH == arch, fmt.Sprintf("current architecture is %q", runtime.GOARCH)
 		},
 	}
 }
 
 //nolint:gochecknoglobals
 var (
-	Amd64   = Arch("amd64")
-	Arm64   = Arch("arm64")
+	// Amd64 requires an intel x86_64 CPU.
+	Amd64 = Arch("amd64")
+	// Arm64 requires an ARM CPU.
+	Arm64 = Arch("arm64")
+	// Windows requires the OS to be Windows.
 	Windows = OS("windows")
-	Linux   = OS("linux")
-	Darwin  = OS("darwin")
+	// Linux requires the OS to be Linux.
+	Linux = OS("linux")
+	// Darwin requires the OS to be macOS.
+	Darwin = OS("darwin")
 )
 
-// NOTE: Not will always ignore any setup and cleanup inside the wrapped requirement.
-
+// Not will negate another requirement
+// Note that it will always *ignore* any setup and cleanup inside the wrapped requirement.
 func Not(requirement *test.Requirement) *test.Requirement {
 	return &test.Requirement{
 		Check: func(data test.Data, helpers test.Helpers) (bool, string) {
@@ -88,6 +84,7 @@ func Not(requirement *test.Requirement) *test.Requirement {
 	}
 }
 
+// All combines several other requirements together.
 func All(requirements ...*test.Requirement) *test.Requirement {
 	return &test.Requirement{
 		Check: func(data test.Data, helpers test.Helpers) (bool, string) {
diff --git a/mod/tigron/test/case.go b/mod/tigron/test/case.go
index 99f8101cc56..5b7ac14b532 100644
--- a/mod/tigron/test/case.go
+++ b/mod/tigron/test/case.go
@@ -23,20 +23,23 @@ import (
 	"gotest.tools/v3/assert"
 )
 
-// Case describes an entire test-case, including data, setup and cleanup routines, command and expectations.
+// Case describes an entire test-case, including data, setup and cleanup routines, command and
+// expectations.
 type Case struct {
-	// Description contains a human-readable short desc, used as a seed for the identifier and as a title for the test
+	// Description contains a human-readable short desc, used as a seed for the identifier and as a
+	// title for the test.
 	Description string
-	// NoParallel disables parallel execution if set to true
+	// NoParallel disables parallel execution if set to true.
 	// This obviously implies that all tests run in parallel, by default. This is a design choice.
 	NoParallel bool
-	// Env contains a map of environment variables to use as a base for all commands run in Setup, Command and Cleanup
-	// Note that the environment is inherited by subtests
+	// Env contains a map of environment variables to use as a base for all commands run in Setup,
+	// Command and Cleanup.
+	// Note that the environment is inherited by subtests.
 	Env map[string]string
-	// Data contains test specific data, accessible to all operations, also inherited by subtests
+	// Data contains test specific data, accessible to all operations, also inherited by subtests.
 	Data Data
 	// Config contains specific information meaningful to the binary being tested.
-	// It is also inherited by subtests
+	// It is also inherited by subtests.
 	Config Config
 
 	// Requirement
@@ -73,7 +76,11 @@ func (test *Case) Run(t *testing.T) {
 
 		// Attach testing.T
 		test.t = subT
-		assert.Assert(test.t, test.Description != "" || test.parent == nil, "A test description cannot be empty")
+		assert.Assert(
+			test.t,
+			test.Description != "" || test.parent == nil,
+			"A test description cannot be empty",
+		)
 		assert.Assert(test.t, test.Command == nil || test.Expected != nil,
 			"Expectations for a test command cannot be nil. You may want to use Setup instead.")
 
diff --git a/mod/tigron/test/command.go b/mod/tigron/test/command.go
index cca0771237c..8c5daba389f 100644
--- a/mod/tigron/test/command.go
+++ b/mod/tigron/test/command.go
@@ -14,6 +14,7 @@
    limitations under the License.
 */
 
+//nolint:revive
 package test
 
 import (
@@ -34,7 +35,8 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/test/internal/pty"
 )
 
-// CustomizableCommand is an interface meant for people who want to heavily customize the base command
+// CustomizableCommand is an interface meant for people who want to heavily customize the base
+// command
 // of their test case.
 type CustomizableCommand interface {
 	TestableCommand
@@ -52,8 +54,9 @@ type CustomizableCommand interface {
 	// WithConfig allows passing custom config properties from the test to the base command
 	withConfig(config Config)
 	withT(t *testing.T)
-	// Clear does a clone, but will clear binary and arguments, but retain the env, or any other custom properties
-	// Gotcha: if GenericCommand is embedded with a custom Run and an overridden clear to return the embedding type
+	// Clear does a clone, but will clear binary and arguments, but retain the env, or any other
+	// custom properties Gotcha: if GenericCommand is embedded with a custom Run and an overridden
+	// clear to return the embedding type
 	// the result will be the embedding command, no longer the GenericCommand
 	clear() TestableCommand
 
@@ -127,12 +130,13 @@ func (gc *GenericCommand) Run(expect *Expected) {
 		env    []string
 		tty    *os.File
 		psty   *os.File
+		stdout string
 	)
 
 	output := &bytes.Buffer{}
-	stdout := ""
 	copyGroup := &errgroup.Group{}
 
+	//nolint:nestif
 	if !gc.async {
 		iCmdCmd := gc.boot()
 
@@ -158,6 +162,7 @@ func (gc *GenericCommand) Run(expect *Expected) {
 					gc.t.Log("start command failed")
 					gc.t.Log(gc.result.ExitCode)
 					gc.t.Log(gc.result.Error)
+
 					return gc.result.Error
 				}
 
@@ -166,6 +171,7 @@ func (gc *GenericCommand) Run(expect *Expected) {
 					if err != nil {
 						gc.t.Log("writing to the pty failed")
 						gc.t.Log(err)
+
 						return err
 					}
 				}
@@ -205,7 +211,8 @@ func (gc *GenericCommand) Run(expect *Expected) {
 		// ExitCode goes first
 		switch expect.ExitCode {
 		case internal.ExitCodeNoCheck:
-			// ExitCodeNoCheck means we do not care at all about exit code. It can be a failure, a success, or a timeout.
+			// ExitCodeNoCheck means we do not care at all about exit code. It can be a failure, a
+			// success, or a timeout.
 		case internal.ExitCodeGenericFail:
 			// ExitCodeGenericFail means we expect an error (excluding timeout).
 			assert.Assert(gc.t, result.ExitCode != 0,
@@ -367,7 +374,8 @@ func (gc *GenericCommand) boot() icmd.Cmd {
 		}
 	}
 
-	// Ensure the subprocess gets executed in a temporary directory unless explicitly instructed otherwise
+	// Ensure the subprocess gets executed in a temporary directory unless explicitly instructed
+	// otherwise
 	iCmdCmd.Dir = gc.workingDir
 
 	if gc.stdin != nil {
diff --git a/mod/tigron/test/config.go b/mod/tigron/test/config.go
index 88001fec439..366b3651fbc 100644
--- a/mod/tigron/test/config.go
+++ b/mod/tigron/test/config.go
@@ -29,7 +29,7 @@ func WithConfig(key ConfigKey, value ConfigValue) Config {
 // Contains the implementation of the Config interface
 
 //nolint:ireturn
-func configureConfig(cfg Config, parent Config) Config {
+func configureConfig(cfg, parent Config) Config {
 	if cfg == nil {
 		cfg = &config{
 			config: make(map[ConfigKey]ConfigValue),
diff --git a/mod/tigron/test/data.go b/mod/tigron/test/data.go
index 28e020b8d77..59bb8218384 100644
--- a/mod/tigron/test/data.go
+++ b/mod/tigron/test/data.go
@@ -31,7 +31,7 @@ const (
 // WithData returns a data object with a certain key value set.
 //
 //nolint:ireturn
-func WithData(key string, value string) Data {
+func WithData(key, value string) Data {
 	dat := &data{}
 	dat.Set(key, value)
 
@@ -41,7 +41,7 @@ func WithData(key string, value string) Data {
 // Contains the implementation of the Data interface
 
 //nolint:ireturn
-func configureData(t *testing.T, seedData Data, parent Data) Data {
+func configureData(t *testing.T, seedData, parent Data) Data {
 	t.Helper()
 
 	if seedData == nil {
@@ -78,7 +78,7 @@ func (dt *data) Get(key string) string {
 }
 
 //nolint:ireturn
-func (dt *data) Set(key string, value string) Data {
+func (dt *data) Set(key, value string) Data {
 	if dt.labels == nil {
 		dt.labels = map[string]string{}
 	}
diff --git a/mod/tigron/test/doc.go b/mod/tigron/test/doc.go
new file mode 100644
index 00000000000..939a39371e6
--- /dev/null
+++ b/mod/tigron/test/doc.go
@@ -0,0 +1,18 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package test is the main entrypoint for Tigron.
+package test
diff --git a/mod/tigron/test/funct.go b/mod/tigron/test/funct.go
index cc6f80c04cd..446c003aba5 100644
--- a/mod/tigron/test/funct.go
+++ b/mod/tigron/test/funct.go
@@ -21,11 +21,12 @@ import "testing"
 // An Evaluator is a function that decides whether a test should run or not.
 type Evaluator func(data Data, helpers Helpers) (bool, string)
 
-// A Butler is the function signature meant to be attached to a Setup or Cleanup routine for a Case or Requirement.
+// A Butler is the function signature meant to be attached to a Setup or Cleanup routine for a Case
+// or Requirement.
 type Butler func(data Data, helpers Helpers)
 
 // A Comparator is the function signature to implement for the Output property of an Expected.
-type Comparator func(stdout string, info string, t *testing.T)
+type Comparator func(stdout, info string, t *testing.T)
 
 // A Manager is the function signature meant to produce expectations for a command.
 type Manager func(data Data, helpers Helpers) *Expected
diff --git a/mod/tigron/test/helpers.go b/mod/tigron/test/helpers.go
index 3cdfdc2ebea..80725bd613d 100644
--- a/mod/tigron/test/helpers.go
+++ b/mod/tigron/test/helpers.go
@@ -57,7 +57,7 @@ func (help *helpersInternal) Capture(args ...string) string {
 
 	help.Command(args...).Run(&Expected{
 		//nolint:thelper
-		Output: func(stdout string, _ string, _ *testing.T) {
+		Output: func(stdout, _ string, _ *testing.T) {
 			ret = stdout
 		},
 	})
diff --git a/mod/tigron/test/interfaces.go b/mod/tigron/test/interfaces.go
index 70f11007911..14838039bf3 100644
--- a/mod/tigron/test/interfaces.go
+++ b/mod/tigron/test/interfaces.go
@@ -24,15 +24,17 @@ import (
 )
 
 // Data is meant to hold information about a test:
-// - first, any random key value data that the test implementer wants to carry / modify - this is test data
-// - second, some commonly useful immutable test properties (a way to generate unique identifiers for that test,
+// - first, any random key value data that the test implementer wants to carry / modify - this is
+// test data - second, some commonly useful immutable test properties (a way to generate unique
+// identifiers for that test,
 // temporary directory, etc.)
-// Note that Data is inherited, from parent test to subtest (except for Identifier and TempDir of course).
+// Note that Data is inherited, from parent test to subtest (except for Identifier and TempDir of
+// course).
 type Data interface {
 	// Get returns the value of a certain key for custom data
 	Get(key string) string
 	// Set will save `value` for `key`
-	Set(key string, value string) Data
+	Set(key, value string) Data
 
 	// Identifier returns the test identifier that can be used to name resources
 	Identifier(suffix ...string) string
@@ -43,56 +45,57 @@ type Data interface {
 // Helpers provides a set of helpers to run commands with simple expectations,
 // available at all stages of a test (Setup, Cleanup, etc...)
 type Helpers interface {
-	// Ensure runs a command and verifies it is succeeding
+	// Ensure runs a command and verifies it is succeeding.
 	Ensure(args ...string)
-	// Anyhow runs a command and ignores its result
+	// Anyhow runs a command and ignores its result.
 	Anyhow(args ...string)
-	// Fail runs a command and verifies it failed
+	// Fail runs a command and verifies it failed.
 	Fail(args ...string)
-	// Capture runs a command, verifies it succeeded, and returns stdout
+	// Capture runs a command, verifies it succeeded, and returns stdout.
 	Capture(args ...string) string
-	// Err runs a command, and returns stderr regardless of its outcome
-	// This is mostly useful for debugging
+	// Err runs a command, and returns stderr regardless of its outcome.
+	// This is mostly useful for debugging.
 	Err(args ...string) string
 
-	// Command will return a populated command from the default internal command, with the provided arguments,
-	// ready to be Run or further configured
+	// Command will return a populated command from the default internal command, with the provided
+	// arguments, ready to be Run or further configured.
 	Command(args ...string) TestableCommand
-	// Custom will return a bare command, without configuration nor defaults (still has the Env)
+	// Custom will return a bare command, without configuration nor defaults (still has the Env).
 	Custom(binary string, args ...string) TestableCommand
 
-	// Read return the config value associated with a key
+	// Read return the config value associated with a key.
 	Read(key ConfigKey) ConfigValue
-	// Write saves a value in the config
+	// Write saves a value in the config.
 	Write(key ConfigKey, value ConfigValue)
 
-	// T returns the current testing object
+	// T returns the current testing object.
 	T() *testing.T
 }
 
-// The TestableCommand interface represents a low-level command to execute, typically to be compared with an Expected
-// A TestableCommand can be used as a Case Command obviously, but also as part of a Setup or Cleanup routine,
-// and as the basis of any type of helper.
+// The TestableCommand interface represents a low-level command to execute, typically to be compared
+// with an Expected. A TestableCommand can be used as a Case Command obviously, but also as part of
+// a Setup or Cleanup routine, and as the basis of any type of helper.
 // For more powerful use-cases outside of test cases, see below CustomizableCommand.
 type TestableCommand interface { //nolint:interfacebloat
-	// WithBinary specifies what binary to execute
+	// WithBinary specifies what binary to execute.
 	WithBinary(binary string)
-	// WithArgs specifies the args to pass to the binary. Note that WithArgs can be used multiple times and is additive.
+	// WithArgs specifies the args to pass to the binary. Note that WithArgs can be used multiple
+	// times and is additive.
 	WithArgs(args ...string)
-	// WithWrapper allows wrapping a command with another command (for example: `time`)
+	// WithWrapper allows wrapping a command with another command (for example: `time`).
 	WithWrapper(binary string, args ...string)
 	WithPseudoTTY(writers ...func(*os.File) error)
-	// WithStdin allows passing a reader to be used for stdin for the command
+	// WithStdin allows passing a reader to be used for stdin for the command.
 	WithStdin(r io.Reader)
-	// WithCwd allows specifying the working directory for the command
+	// WithCwd allows specifying the working directory for the command.
 	WithCwd(path string)
-	// Clone returns a copy of the command
+	// Clone returns a copy of the command.
 	Clone() TestableCommand
 
 	// Run does execute the command, and compare the output with the provided expectation.
 	// Passing nil for `Expected` will just run the command regardless of outcome.
-	// An empty `&Expected{}` is (of course) equivalent to &Expected{Exit: 0}, meaning the command is
-	// verified to be successful
+	// An empty `&Expected{}` is (of course) equivalent to &Expected{Exit: 0}, meaning the command
+	// is verified to be successful
 	Run(expect *Expected)
 	// Background allows starting a command in the background
 	Background(timeout time.Duration)
@@ -102,7 +105,8 @@ type TestableCommand interface { //nolint:interfacebloat
 	Stderr() string
 }
 
-// Config is meant to hold information relevant to the binary (eg: flags defining certain behaviors, etc.)
+// Config is meant to hold information relevant to the binary (eg: flags defining certain behaviors,
+// etc.)
 type Config interface {
 	Write(key ConfigKey, value ConfigValue) Config
 	Read(key ConfigKey) ConfigValue
diff --git a/mod/tigron/test/internal/consts.go b/mod/tigron/test/internal/consts.go
index dd058dcf7bf..2fcb2680c87 100644
--- a/mod/tigron/test/internal/consts.go
+++ b/mod/tigron/test/internal/consts.go
@@ -14,6 +14,10 @@
    limitations under the License.
 */
 
+// Package internal provides an assert library, pty, a command wrapper, and a leak detection library
+// for internal use in Tigron.
+// The objective for these is not to become generic use-cases libraries, but instead to deliver what
+// Tigron needs in the simplest possible form.
 package internal
 
 // This is duplicated form `expect` to avoid circular imports.
diff --git a/mod/tigron/test/internal/pty/pty.go b/mod/tigron/test/internal/pty/pty.go
index 9aa32f3e047..cd564a2731b 100644
--- a/mod/tigron/test/internal/pty/pty.go
+++ b/mod/tigron/test/internal/pty/pty.go
@@ -14,10 +14,10 @@
    limitations under the License.
 */
 
-// Package pty.
-// Note that creack is MIT licensed, making it better to depend on it rather than using derived code here.
-// Underlying creack implementation is OK though they have more (unnecessary to us) features and do not follow the
-// same coding standards.
+// Package pty provides a simple to manipulate pty Open method.
+// Note that creack is MIT licensed, making it better to depend on it rather than using derived code
+// here. Underlying implementation is OK though they have more (unnecessary to us) features and do
+// not follow the same coding standards.
 package pty
 
 import (
@@ -28,10 +28,13 @@ import (
 )
 
 var (
-	ErrFailure             = errors.New("pty failure")
+	// ErrFailure is wrapping system pty creation failure returned by Open().
+	ErrFailure = errors.New("pty failure")
+	// ErrUnsupportedPlatform is returned by Open() on unsupported platforms.
 	ErrUnsupportedPlatform = errors.New("pty not supported on this platform")
 )
 
+// Open will allocate and return a new pty.
 func Open() (*os.File, *os.File, error) {
 	pty, tty, err := creack.Open()
 	if err != nil {
diff --git a/mod/tigron/test/test.go b/mod/tigron/test/test.go
index 00cf7b708fc..274a783b8b7 100644
--- a/mod/tigron/test/test.go
+++ b/mod/tigron/test/test.go
@@ -20,6 +20,7 @@ import (
 	"testing"
 )
 
+// Testable TODO.
 type Testable interface {
 	CustomCommand(testCase *Case, t *testing.T) CustomizableCommand
 	AmbientRequirements(testCase *Case, t *testing.T)
@@ -30,6 +31,7 @@ type Testable interface {
 //nolint:gochecknoglobals
 var registeredTestable Testable
 
+// Customize TODO.
 func Customize(testable Testable) {
 	registeredTestable = testable
 }
diff --git a/mod/tigron/test/types.go b/mod/tigron/test/types.go
index 7544d808814..0b8130bc2ef 100644
--- a/mod/tigron/test/types.go
+++ b/mod/tigron/test/types.go
@@ -17,29 +17,33 @@
 package test
 
 type (
-	ConfigKey   string
+	// ConfigKey FIXME consider getting rid of this?
+	ConfigKey string
+	// ConfigValue FIXME consider getting rid of this?
 	ConfigValue string
 )
 
-// A Requirement offers a way to verify random conditions to decide if a test should be skipped or run.
+// A Requirement offers a way to verify random conditions to decide if a test should be skipped or
+// run.
 // It can also (optionally) provide custom Setup and Cleanup routines.
 type Requirement struct {
-	// Check is expected to verify if the requirement is fulfilled, and return a boolean and an explanatory message
+	// Check is expected to verify if the requirement is fulfilled, and return a boolean and an
+	// explanatory message.
 	Check Evaluator
-	// Setup, if provided, will be run before any test-specific Setup routine, in the order that requirements
-	// have been declared
+	// Setup, if provided, will be run before any test-specific Setup routine, in the order that
+	// requirements have been declared.
 	Setup Butler
-	// Cleanup, if provided, will be run after any test-specific Cleanup routine, in the reverse order that
-	// requirements have been declared
+	// Cleanup, if provided, will be run after any test-specific Cleanup routine, in the reverse
+	// order that requirements have been declared.
 	Cleanup Butler
 }
 
 // Expected expresses the expected output of a command.
 type Expected struct {
-	// ExitCode
+	// ExitCode.
 	ExitCode int
-	// Errors contains any error that (once serialized) should be seen in stderr
+	// Errors contains any error that (once serialized) should be seen in stderr.
 	Errors []error
-	// Output function to match against stdout
+	// Output function to match against stdout.
 	Output Comparator
 }
diff --git a/mod/tigron/utils/doc.go b/mod/tigron/utils/doc.go
new file mode 100644
index 00000000000..929fd70562c
--- /dev/null
+++ b/mod/tigron/utils/doc.go
@@ -0,0 +1,19 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package utils provides generic helpers that are regularly useful for a range of test authors.
+// TODO: question the usefulness of this and whether this should even be part of tigron.
+package utils

From 7cc425756452276bb217bbf87cab65fba148a88f Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 26 Mar 2025 23:08:38 -0700
Subject: [PATCH 019/225] Add assertive lib

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/internal/assertive/assertive.go    | 169 ++++++++++++++++++
 .../internal/assertive/assertive_test.go      |  48 +++++
 mod/tigron/internal/assertive/doc.go          |  22 +++
 3 files changed, 239 insertions(+)
 create mode 100644 mod/tigron/internal/assertive/assertive.go
 create mode 100644 mod/tigron/internal/assertive/assertive_test.go
 create mode 100644 mod/tigron/internal/assertive/doc.go

diff --git a/mod/tigron/internal/assertive/assertive.go b/mod/tigron/internal/assertive/assertive.go
new file mode 100644
index 00000000000..4f0f4d6536a
--- /dev/null
+++ b/mod/tigron/internal/assertive/assertive.go
@@ -0,0 +1,169 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package assertive
+
+import (
+	"errors"
+	"strings"
+	"time"
+)
+
+type testingT interface {
+	Helper()
+	FailNow()
+	Fail()
+	Log(args ...interface{})
+}
+
+// ErrorIsNil immediately fails a test if err is not nil.
+func ErrorIsNil(t testingT, err error, msg ...string) {
+	t.Helper()
+
+	if err != nil {
+		t.Log("expecting nil error, but got:", err)
+		failNow(t, msg...)
+	}
+}
+
+// ErrorIs immediately fails a test if err is not the comparison error.
+func ErrorIs(t testingT, err, compErr error, msg ...string) {
+	t.Helper()
+
+	if !errors.Is(err, compErr) {
+		t.Log("expected error to be:", compErr, "- instead it is:", err)
+		failNow(t, msg...)
+	}
+}
+
+// IsEqual immediately fails a test if the two interfaces are not equal.
+func IsEqual(t testingT, actual, expected interface{}, msg ...string) {
+	t.Helper()
+
+	if !isEqual(t, actual, expected) {
+		t.Log("expected:", actual, " - to be equal to:", expected)
+		failNow(t, msg...)
+	}
+}
+
+// IsNotEqual immediately fails a test if the two interfaces are equal.
+func IsNotEqual(t testingT, actual, expected interface{}, msg ...string) {
+	t.Helper()
+
+	if isEqual(t, actual, expected) {
+		t.Log("expected:", actual, " - to be equal to:", expected)
+		failNow(t, msg...)
+	}
+}
+
+// StringContains immediately fails a test if the actual string does not contain the other string.
+func StringContains(t testingT, actual, contains string, msg ...string) {
+	t.Helper()
+
+	if !strings.Contains(actual, contains) {
+		t.Log("expected:", actual, " - to contain:", contains)
+		failNow(t, msg...)
+	}
+}
+
+// StringDoesNotContain immediately fails a test if the actual string contains the other string.
+func StringDoesNotContain(t testingT, actual, contains string, msg ...string) {
+	t.Helper()
+
+	if strings.Contains(actual, contains) {
+		t.Log("expected:", actual, " - to NOT contain:", contains)
+		failNow(t, msg...)
+	}
+}
+
+// StringHasSuffix immediately fails a test if the string does not end with suffix.
+func StringHasSuffix(t testingT, actual, suffix string, msg ...string) {
+	t.Helper()
+
+	if !strings.HasSuffix(actual, suffix) {
+		t.Log("expected:", actual, " - to end with:", suffix)
+		failNow(t, msg...)
+	}
+}
+
+// StringHasPrefix immediately fails a test if the string does not start with prefix.
+func StringHasPrefix(t testingT, actual, prefix string, msg ...string) {
+	t.Helper()
+
+	if !strings.HasPrefix(actual, prefix) {
+		t.Log("expected:", actual, " - to start with:", prefix)
+		failNow(t, msg...)
+	}
+}
+
+// DurationIsLessThan immediately fails a test if the duration is more than the reference.
+func DurationIsLessThan(t testingT, actual, expected time.Duration, msg ...string) {
+	t.Helper()
+
+	if actual >= expected {
+		t.Log("expected:", actual, " - to be less than:", expected)
+		failNow(t, msg...)
+	}
+}
+
+// True immediately fails a test if the boolean is not true...
+func True(t testingT, comp bool, msg ...string) bool {
+	t.Helper()
+
+	if !comp {
+		failNow(t, msg...)
+	}
+
+	return comp
+}
+
+// Check marks a test as failed if the boolean is not true (safe in go routines)
+//
+//nolint:varnamelen
+func Check(t testingT, comp bool, msg ...string) bool {
+	t.Helper()
+
+	if !comp {
+		for _, m := range msg {
+			t.Log(m)
+		}
+
+		t.Fail()
+	}
+
+	return comp
+}
+
+//nolint:varnamelen
+func failNow(t testingT, msg ...string) {
+	t.Helper()
+
+	if len(msg) > 0 {
+		for _, m := range msg {
+			t.Log(m)
+		}
+	}
+
+	t.FailNow()
+}
+
+func isEqual(t testingT, actual, expected interface{}) bool {
+	t.Helper()
+
+	// FIXME: this is risky and limited. Right now this is fine internally, but do better if this
+	// becomes public.
+	return actual == expected
+}
diff --git a/mod/tigron/internal/assertive/assertive_test.go b/mod/tigron/internal/assertive/assertive_test.go
new file mode 100644
index 00000000000..6d236c0718b
--- /dev/null
+++ b/mod/tigron/internal/assertive/assertive_test.go
@@ -0,0 +1,48 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package assertive_test
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
+)
+
+func TestY(t *testing.T) {
+	t.Parallel()
+
+	var err error
+
+	assertive.ErrorIsNil(t, err)
+
+	//nolint:err113
+	someErr := errors.New("test error")
+
+	err = fmt.Errorf("wrap: %w", someErr)
+	assertive.ErrorIs(t, err, someErr)
+
+	foo := "foo"
+	assertive.IsEqual(t, foo, "foo")
+
+	bar := 10
+	assertive.IsEqual(t, bar, 10)
+
+	baz := true
+	assertive.IsEqual(t, baz, true)
+}
diff --git a/mod/tigron/internal/assertive/doc.go b/mod/tigron/internal/assertive/doc.go
new file mode 100644
index 00000000000..606a3dd7d81
--- /dev/null
+++ b/mod/tigron/internal/assertive/doc.go
@@ -0,0 +1,22 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package assertive is an experimental, zero-dependencies assert library.
+// Right now, it is not public and meant to be used only inside tigron.
+// Consumers of tigron are free to use whatever assert library they want.
+// In the future, this may become public for peeps who want `assert` to be
+// bundled in.
+package assertive

From 4ad52bc09686f8962e45c86448b7ca2c9cb62550 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 26 Mar 2025 23:20:23 -0700
Subject: [PATCH 020/225] Migrate away from assert to internal assertive

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/expect/comparators.go | 22 +++++++++++++++-------
 mod/tigron/test/case.go          |  8 ++++----
 mod/tigron/test/command.go       | 10 +++++-----
 3 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/mod/tigron/expect/comparators.go b/mod/tigron/expect/comparators.go
index 9ccaadef470..d6c6c8731f5 100644
--- a/mod/tigron/expect/comparators.go
+++ b/mod/tigron/expect/comparators.go
@@ -22,8 +22,7 @@ import (
 	"strings"
 	"testing"
 
-	"gotest.tools/v3/assert"
-
+	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 )
 
@@ -45,7 +44,7 @@ func Contains(compare string) test.Comparator {
 	//nolint:thelper
 	return func(stdout, info string, t *testing.T) {
 		t.Helper()
-		assert.Check(t, strings.Contains(stdout, compare),
+		assertive.Check(t, strings.Contains(stdout, compare),
 			fmt.Sprintf("Output does not contain: %q", compare)+info)
 	}
 }
@@ -56,8 +55,8 @@ func DoesNotContain(compare string) test.Comparator {
 	//nolint:thelper
 	return func(stdout, info string, t *testing.T) {
 		t.Helper()
-		assert.Check(t, !strings.Contains(stdout, compare),
-			fmt.Sprintf("Output does contain: %q", compare)+info)
+		assertive.Check(t, !strings.Contains(stdout, compare),
+			fmt.Sprintf("Output should not contain: %q", compare)+info)
 	}
 }
 
@@ -66,7 +65,11 @@ func Equals(compare string) test.Comparator {
 	//nolint:thelper
 	return func(stdout, info string, t *testing.T) {
 		t.Helper()
-		assert.Equal(t, compare, stdout, info)
+		assertive.Check(
+			t,
+			compare == stdout,
+			fmt.Sprintf("Output is not equal to: %q", compare)+info,
+		)
 	}
 }
 
@@ -76,6 +79,11 @@ func Match(reg *regexp.Regexp) test.Comparator {
 	//nolint:thelper
 	return func(stdout, info string, t *testing.T) {
 		t.Helper()
-		assert.Check(t, reg.MatchString(stdout), "Output does not match: "+reg.String(), info)
+		assertive.Check(
+			t,
+			reg.MatchString(stdout),
+			fmt.Sprintf("Output does not match: %q", reg.String()),
+			info,
+		)
 	}
 }
diff --git a/mod/tigron/test/case.go b/mod/tigron/test/case.go
index 5b7ac14b532..e72e13a7c6b 100644
--- a/mod/tigron/test/case.go
+++ b/mod/tigron/test/case.go
@@ -20,7 +20,7 @@ import (
 	"slices"
 	"testing"
 
-	"gotest.tools/v3/assert"
+	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
 )
 
 // Case describes an entire test-case, including data, setup and cleanup routines, command and
@@ -72,16 +72,16 @@ func (test *Case) Run(t *testing.T) {
 	testRun := func(subT *testing.T) {
 		subT.Helper()
 
-		assert.Assert(subT, test.t == nil, "You cannot run a test multiple times")
+		assertive.True(subT, test.t == nil, "You cannot run a test multiple times")
 
 		// Attach testing.T
 		test.t = subT
-		assert.Assert(
+		assertive.True(
 			test.t,
 			test.Description != "" || test.parent == nil,
 			"A test description cannot be empty",
 		)
-		assert.Assert(test.t, test.Command == nil || test.Expected != nil,
+		assertive.True(test.t, test.Command == nil || test.Expected != nil,
 			"Expectations for a test command cannot be nil. You may want to use Setup instead.")
 
 		// Ensure we have env
diff --git a/mod/tigron/test/command.go b/mod/tigron/test/command.go
index 8c5daba389f..05c7a2d798e 100644
--- a/mod/tigron/test/command.go
+++ b/mod/tigron/test/command.go
@@ -28,9 +28,9 @@ import (
 
 	"golang.org/x/sync/errgroup"
 	"golang.org/x/term"
-	"gotest.tools/v3/assert"
 	"gotest.tools/v3/icmd"
 
+	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
 	"github.com/containerd/nerdctl/mod/tigron/test/internal"
 	"github.com/containerd/nerdctl/mod/tigron/test/internal/pty"
 )
@@ -215,19 +215,19 @@ func (gc *GenericCommand) Run(expect *Expected) {
 			// success, or a timeout.
 		case internal.ExitCodeGenericFail:
 			// ExitCodeGenericFail means we expect an error (excluding timeout).
-			assert.Assert(gc.t, result.ExitCode != 0,
+			assertive.True(gc.t, result.ExitCode != 0,
 				"Expected exit code to be different than 0\n"+debug)
 		case internal.ExitCodeTimeout:
-			assert.Assert(gc.t, expect.ExitCode == internal.ExitCodeTimeout,
+			assertive.True(gc.t, expect.ExitCode == internal.ExitCodeTimeout,
 				"Command unexpectedly timed-out\n"+debug)
 		default:
-			assert.Assert(gc.t, expect.ExitCode == result.ExitCode,
+			assertive.True(gc.t, expect.ExitCode == result.ExitCode,
 				fmt.Sprintf("Expected exit code: %d\n", expect.ExitCode)+debug)
 		}
 
 		// Range through the expected errors and confirm they are seen on stderr
 		for _, expectErr := range expect.Errors {
-			assert.Assert(gc.t, strings.Contains(gc.rawStdErr, expectErr.Error()),
+			assertive.True(gc.t, strings.Contains(gc.rawStdErr, expectErr.Error()),
 				fmt.Sprintf("Expected error: %q to be found in stderr\n", expectErr.Error())+debug)
 		}
 

From c9c90d9c9fd287188bf93a28d6ed0e765579472e Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 27 Mar 2025 00:01:31 -0700
Subject: [PATCH 021/225] Adding internal leak detection lib

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 go.sum                                  |   4 +-
 mod/tigron/.golangci.yml                |   2 +-
 mod/tigron/Makefile                     |   4 +-
 mod/tigron/go.mod                       |   1 +
 mod/tigron/go.sum                       |  10 ++
 mod/tigron/internal/highk/doc.go        |  25 +++++
 mod/tigron/internal/highk/fileleak.go   | 116 ++++++++++++++++++++++++
 mod/tigron/internal/highk/goroutines.go |  28 ++++++
 8 files changed, 185 insertions(+), 5 deletions(-)
 create mode 100644 mod/tigron/internal/highk/doc.go
 create mode 100644 mod/tigron/internal/highk/fileleak.go
 create mode 100644 mod/tigron/internal/highk/goroutines.go

diff --git a/go.sum b/go.sum
index 5af41bd6df0..a01dec6beb5 100644
--- a/go.sum
+++ b/go.sum
@@ -325,8 +325,8 @@ go.opentelemetry.io/otel/sdk/metric v1.31.0 h1:i9hxxLJF/9kkvfHppyLL55aW7iIJz4Jjx
 go.opentelemetry.io/otel/sdk/metric v1.31.0/go.mod h1:CRInTMVvNhUKgSAMbKyTMxqOBC0zgyxzW55lZzX43Y8=
 go.opentelemetry.io/otel/trace v1.31.0 h1:ffjsj1aRouKewfr85U2aGagJ46+MvodynlQ1HYdmJys=
 go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06FJAsO1tJg480A=
-go.uber.org/goleak v1.1.12 h1:gZAh5/EyT/HQwlpkCy6wTpqfH9H8Lz8zbm3dZh+OyzA=
-go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
 go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
diff --git a/mod/tigron/.golangci.yml b/mod/tigron/.golangci.yml
index aa2f7f1a51a..2395687bac8 100644
--- a/mod/tigron/.golangci.yml
+++ b/mod/tigron/.golangci.yml
@@ -25,13 +25,13 @@ linters:
           files:
             - $all
           allow:
-
             - $gostd
             - github.com/containerd/nerdctl/mod/tigron
             - github.com/creack/pty
             - golang.org/x/sync
             - golang.org/x/term
             - gotest.tools/v3
+            - go.uber.org/goleak
     staticcheck:
       checks:
         - all
diff --git a/mod/tigron/Makefile b/mod/tigron/Makefile
index b534581b75b..ba2bbf0d754 100644
--- a/mod/tigron/Makefile
+++ b/mod/tigron/Makefile
@@ -181,7 +181,7 @@ install-dev-tools:
 ##########################
 test-unit:
 	$(call title, $@)
-	@go test $(VERBOSE_FLAG) $(MAKEFILE_DIR)/...
+	@HIGHK_EXPERIMENTAL_FD=true go test $(VERBOSE_FLAG) $(MAKEFILE_DIR)/...
 	$(call footer, $@)
 
 test-unit-bench:
@@ -191,7 +191,7 @@ test-unit-bench:
 
 test-unit-race:
 	$(call title, $@)
-	@CGO_ENABLED=1 go test $(VERBOSE_FLAG) $(MAKEFILE_DIR)/... -race
+	@HIGHK_EXPERIMENTAL_FD=true CGO_ENABLED=1 go test $(VERBOSE_FLAG) $(MAKEFILE_DIR)/... -race
 	$(call footer, $@)
 
 .PHONY: \
diff --git a/mod/tigron/go.mod b/mod/tigron/go.mod
index e03295efb48..8e81eb56a19 100644
--- a/mod/tigron/go.mod
+++ b/mod/tigron/go.mod
@@ -4,6 +4,7 @@ go 1.23
 
 require (
 	github.com/creack/pty v1.1.24
+	go.uber.org/goleak v1.3.0
 	golang.org/x/sync v0.11.0
 	golang.org/x/term v0.29.0
 	gotest.tools/v3 v3.5.2
diff --git a/mod/tigron/go.sum b/mod/tigron/go.sum
index e8489e88ada..a38084b4f4c 100644
--- a/mod/tigron/go.sum
+++ b/mod/tigron/go.sum
@@ -1,12 +1,22 @@
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
 github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
 golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
 golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
 golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
diff --git a/mod/tigron/internal/highk/doc.go b/mod/tigron/internal/highk/doc.go
new file mode 100644
index 00000000000..1383569de95
--- /dev/null
+++ b/mod/tigron/internal/highk/doc.go
@@ -0,0 +1,25 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package highk (for "high-κ dielectric") is a highly experimental leak detection library
+// (for file descriptors and go routines).
+// It is purely internal for now and used only as part of the tests for tigron.
+// TODO:
+// - get rid of lsof and implement in go
+// - investigate feasibility of adding automatic leak detection for any test using tigron
+// - investigate feasibility of adding leak detection for tested binaries
+// - review usefulness of uber goroutines leak library
+package highk
diff --git a/mod/tigron/internal/highk/fileleak.go b/mod/tigron/internal/highk/fileleak.go
new file mode 100644
index 00000000000..d6bc6e1bac6
--- /dev/null
+++ b/mod/tigron/internal/highk/fileleak.go
@@ -0,0 +1,116 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package highk
+
+import (
+	"io"
+	"os"
+	"os/exec"
+	"slices"
+	"strconv"
+	"strings"
+	"syscall"
+)
+
+// FIXME: it seems that lsof (or go test) is interefering and showing false positive KQUEUE / inodes
+//
+//nolint:gochecknoglobals
+var whitelist = map[string]bool{
+	"5u  KQUEUE":   true,
+	"10u  a_inode": true,
+}
+
+// SnapshotOpenFiles will capture the list of currently open-files for the process.
+//
+//nolint:wrapcheck
+func SnapshotOpenFiles(file *os.File) ([]byte, error) {
+	// Using a buffer would add a pipe to the list of files
+	// Reimplement this stuff in go ASAP and toss lsof instead of passing around fd
+	_, _ = file.Seek(0, 0)
+	_ = file.Truncate(0)
+
+	exe, err := exec.LookPath("lsof")
+	if err != nil {
+		return nil, err
+	}
+
+	//nolint:gosec
+	cmd := exec.Command(exe, "-nP", "-p", strconv.Itoa(syscall.Getpid()))
+	cmd.Stdout = file
+
+	_ = cmd.Run()
+
+	_, _ = file.Seek(0, 0)
+
+	return io.ReadAll(file)
+}
+
+// Diff will return a slice of strings showing the diff between two strings.
+func Diff(one, two string) []string {
+	aone := strings.Split(one, "\n")
+	atwo := strings.Split(two, "\n")
+
+	slices.Sort(aone)
+	slices.Sort(atwo)
+
+	loss := make(map[string]bool, len(aone))
+	gain := map[string]bool{}
+
+	for _, v := range aone {
+		loss[v] = true
+	}
+
+	for _, v := range atwo {
+		if _, ok := loss[v]; ok {
+			delete(loss, v)
+		} else {
+			gain[v] = true
+		}
+	}
+
+	diff := []string{}
+
+	for key := range loss {
+		legit := true
+
+		for wl := range whitelist {
+			if strings.Contains(key, wl) {
+				legit = false
+			}
+		}
+
+		if legit {
+			diff = append(diff, "- "+key)
+		}
+	}
+
+	for key := range gain {
+		legit := true
+
+		for wl := range whitelist {
+			if strings.Contains(key, wl) {
+				legit = false
+			}
+		}
+
+		if legit {
+			diff = append(diff, "+ "+key)
+		}
+	}
+
+	return diff
+}
diff --git a/mod/tigron/internal/highk/goroutines.go b/mod/tigron/internal/highk/goroutines.go
new file mode 100644
index 00000000000..121facf8816
--- /dev/null
+++ b/mod/tigron/internal/highk/goroutines.go
@@ -0,0 +1,28 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package highk
+
+import (
+	"go.uber.org/goleak"
+)
+
+// FindGoRoutines retrieves leaked go routines, which are returned as an error.
+//
+//nolint:wrapcheck
+func FindGoRoutines() error {
+	return goleak.Find()
+}

From 2df29b7cf15379b504ec9892bf117c038a7a0405 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 26 Mar 2025 18:49:04 -0700
Subject: [PATCH 022/225] Adding tigron tests

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/require/requirement_test.go | 126 +++++++++++++++++++++++++
 mod/tigron/test/config_test.go         |  54 +++++++++++
 mod/tigron/test/data_test.go           |  81 ++++++++++++++++
 mod/tigron/test/interfaces.go          |   3 +-
 4 files changed, 262 insertions(+), 2 deletions(-)
 create mode 100644 mod/tigron/require/requirement_test.go
 create mode 100644 mod/tigron/test/config_test.go
 create mode 100644 mod/tigron/test/data_test.go

diff --git a/mod/tigron/require/requirement_test.go b/mod/tigron/require/requirement_test.go
new file mode 100644
index 00000000000..aa4e0fec0f2
--- /dev/null
+++ b/mod/tigron/require/requirement_test.go
@@ -0,0 +1,126 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package require_test
+
+import (
+	"runtime"
+	"testing"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+)
+
+const (
+	darwin  = "darwin"
+	windows = "windows"
+	linux   = "linux"
+)
+
+func TestRequire(t *testing.T) {
+	t.Parallel()
+
+	var pass bool
+
+	switch runtime.GOOS {
+	case "windows":
+		pass, _ = require.Windows.Check(nil, nil)
+	case "linux":
+		pass, _ = require.Linux.Check(nil, nil)
+	case "darwin":
+		pass, _ = require.Darwin.Check(nil, nil)
+	default:
+		pass, _ = require.OS(runtime.GOOS).Check(nil, nil)
+	}
+
+	assertive.IsEqual(t, pass, true)
+
+	switch runtime.GOARCH {
+	case "amd64":
+		pass, _ = require.Amd64.Check(nil, nil)
+	case "arm64":
+		pass, _ = require.Arm64.Check(nil, nil)
+	default:
+		pass, _ = require.Arch(runtime.GOARCH).Check(nil, nil)
+	}
+
+	assertive.IsEqual(t, pass, true)
+}
+
+func TestNot(t *testing.T) {
+	t.Parallel()
+
+	var pass bool
+
+	switch runtime.GOOS {
+	case windows:
+		pass, _ = require.Not(require.Linux).Check(nil, nil)
+	case linux:
+		pass, _ = require.Not(require.Windows).Check(nil, nil)
+	case darwin:
+		pass, _ = require.Not(require.Windows).Check(nil, nil)
+	default:
+		pass, _ = require.Not(require.Linux).Check(nil, nil)
+	}
+
+	assertive.IsEqual(t, pass, true)
+}
+
+func TestAllSuccess(t *testing.T) {
+	t.Parallel()
+
+	var pass bool
+
+	switch runtime.GOOS {
+	case windows:
+		pass, _ = require.All(require.Not(require.Linux), require.Not(require.Darwin)).
+			Check(nil, nil)
+	case linux:
+		pass, _ = require.All(require.Not(require.Windows), require.Not(require.Darwin)).
+			Check(nil, nil)
+	case darwin:
+		pass, _ = require.All(require.Not(require.Windows), require.Not(require.Linux)).
+			Check(nil, nil)
+	default:
+		pass, _ = require.All(require.Not(require.Windows), require.Not(require.Linux),
+			require.Not(require.Darwin)).Check(nil, nil)
+	}
+
+	assertive.IsEqual(t, pass, true)
+}
+
+func TestAllOneFail(t *testing.T) {
+	t.Parallel()
+
+	var pass bool
+
+	switch runtime.GOOS {
+	case "windows":
+		pass, _ = require.All(require.Not(require.Linux), require.Not(require.Darwin)).
+			Check(nil, nil)
+	case "linux":
+		pass, _ = require.All(require.Not(require.Windows), require.Not(require.Darwin)).
+			Check(nil, nil)
+	case "darwin":
+		pass, _ = require.All(require.Not(require.Windows), require.Not(require.Linux)).
+			Check(nil, nil)
+	default:
+		pass, _ = require.All(require.Not(require.OS(runtime.GOOS)), require.Not(require.Linux),
+			require.Not(require.Darwin)).Check(nil, nil)
+	}
+
+	assertive.IsEqual(t, pass, true)
+}
diff --git a/mod/tigron/test/config_test.go b/mod/tigron/test/config_test.go
new file mode 100644
index 00000000000..6112aee0d09
--- /dev/null
+++ b/mod/tigron/test/config_test.go
@@ -0,0 +1,54 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+//nolint:testpackage
+package test
+
+import (
+	"testing"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
+)
+
+func TestConfig(t *testing.T) {
+	t.Parallel()
+
+	// Create
+	cfg := WithConfig("test", "something")
+
+	assertive.IsEqual(t, string(cfg.Read("test")), "something")
+
+	// Write
+	cfg.Write("test-write", "else")
+
+	// Overwrite
+	cfg.Write("test", "one")
+
+	assertive.IsEqual(t, string(cfg.Read("test")), "one")
+	assertive.IsEqual(t, string(cfg.Read("test-write")), "else")
+
+	assertive.IsEqual(t, string(cfg.Read("doesnotexist")), "")
+
+	// Test adoption
+	cfg2 := WithConfig("test", "two")
+	cfg2.Write("adopt", "two")
+
+	//nolint:forcetypeassert
+	cfg.(*config).adopt(cfg2)
+
+	assertive.IsEqual(t, string(cfg.Read("test")), "one")
+	assertive.IsEqual(t, string(cfg.Read("adopt")), "two")
+}
diff --git a/mod/tigron/test/data_test.go b/mod/tigron/test/data_test.go
new file mode 100644
index 00000000000..3c9ea730206
--- /dev/null
+++ b/mod/tigron/test/data_test.go
@@ -0,0 +1,81 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+//nolint:testpackage
+package test
+
+import (
+	"testing"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
+)
+
+func TestDataBasic(t *testing.T) {
+	t.Parallel()
+
+	dataObj := WithData("test", "create")
+
+	assertive.IsEqual(t, dataObj.Get("test"), "create")
+	assertive.IsEqual(t, dataObj.Get("doesnotexist"), "")
+
+	dataObj.Set("test", "set")
+	assertive.IsEqual(t, dataObj.Get("test"), "set")
+}
+
+func TestDataTempDir(t *testing.T) {
+	t.Parallel()
+
+	dataObj := configureData(t, nil, nil)
+
+	one := dataObj.TempDir()
+	two := dataObj.TempDir()
+
+	assertive.IsEqual(t, one, two)
+	assertive.IsNotEqual(t, one, "")
+}
+
+func TestDataIdentifier(t *testing.T) {
+	t.Parallel()
+
+	dataObj := configureData(t, nil, nil)
+
+	one := dataObj.Identifier()
+	two := dataObj.Identifier()
+
+	assertive.IsEqual(t, one, two)
+	assertive.StringHasPrefix(t, one, "testdataidentifier")
+
+	three := dataObj.Identifier("Some Add ∞ Funky∞Prefix")
+	assertive.StringHasPrefix(t, three, "testdataidentifier-some-add-funky-prefix")
+}
+
+func TestDataIdentifierThatIsReallyReallyReallyReallyReallyReallyReallyReallyReallyReallyReallyLong(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	dataObj := configureData(t, nil, nil)
+
+	one := dataObj.Identifier()
+	two := dataObj.Identifier()
+
+	assertive.IsEqual(t, one, two)
+	assertive.StringHasPrefix(t, one, "testdataidentifier")
+	assertive.IsEqual(t, len(one), identifierMaxLength)
+
+	three := dataObj.Identifier("Add something")
+	assertive.IsNotEqual(t, three, one)
+}
diff --git a/mod/tigron/test/interfaces.go b/mod/tigron/test/interfaces.go
index 14838039bf3..ef7533e85a0 100644
--- a/mod/tigron/test/interfaces.go
+++ b/mod/tigron/test/interfaces.go
@@ -26,8 +26,7 @@ import (
 // Data is meant to hold information about a test:
 // - first, any random key value data that the test implementer wants to carry / modify - this is
 // test data - second, some commonly useful immutable test properties (a way to generate unique
-// identifiers for that test,
-// temporary directory, etc.)
+// identifiers for that test, temporary directory, etc.)
 // Note that Data is inherited, from parent test to subtest (except for Identifier and TempDir of
 // course).
 type Data interface {

From 6b83b6b12992f8e4c2b266619015547e07e71b64 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 27 Mar 2025 22:33:33 +0000
Subject: [PATCH 023/225] build(deps): bump golang.org/x/net in the golang-x
 group

Bumps the golang-x group with 1 update: [golang.org/x/net](https://github.com/golang/net).

Updates `golang.org/x/net` from 0.37.0 to 0.38.0
- [Commits](https://github.com/golang/net/compare/v0.37.0...v0.38.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 61af0752a00..72e200b56f2 100644
--- a/go.mod
+++ b/go.mod
@@ -61,7 +61,7 @@ require (
 	github.com/yuchanns/srslog v1.1.0
 	go.uber.org/mock v0.5.0
 	golang.org/x/crypto v0.36.0
-	golang.org/x/net v0.37.0
+	golang.org/x/net v0.38.0
 	golang.org/x/sync v0.12.0
 	golang.org/x/sys v0.31.0
 	golang.org/x/term v0.30.0
diff --git a/go.sum b/go.sum
index a01dec6beb5..fc70c36777e 100644
--- a/go.sum
+++ b/go.sum
@@ -368,8 +368,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
-golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
+golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

From 994190af9a4f1e495f882cee7817fbecfa712e4a Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 27 Mar 2025 15:23:02 -0700
Subject: [PATCH 024/225] Update golangci to v2

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/lint.yml                    |   3 -
 .golangci.yml                                 | 370 +++++++++++-------
 Makefile                                      |  39 +-
 .../container/container_inspect_linux_test.go |   1 +
 pkg/cmd/container/run_mount.go                |   2 +-
 pkg/logging/logging.go                        |   3 +-
 6 files changed, 234 insertions(+), 184 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 41b9b0ceb2e..dd45b10830e 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -75,6 +75,3 @@ jobs:
         run: make lint-yaml
       - name: shell
         run: make lint-shell
-      - name: go imports ordering
-        run: |
-          make lint-imports
diff --git a/.golangci.yml b/.golangci.yml
index d93e5bbdbbb..bf186a332d2 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,167 +1,233 @@
----
+version: "2"
+
 run:
-  concurrency: 6
-  timeout: 5m
+  modules-download-mode: readonly
+
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+
 linters:
-  disable-all: true
+  default: none
   enable:
     - depguard
-    - gofmt
-    - goimports
     - govet
     - ineffassign
     - misspell
     - nakedret
     - prealloc
-    - typecheck
-    # - asciicheck
-    # - bodyclose
-    # - dogsled
-    # - dupl
-    # - errcheck
-    # - errorlint
-    # - exhaustive
-    # - exhaustivestruct
-    # - exportloopref
-    # - funlen
-    # - gci
-    # - gochecknoglobals
-    # - gochecknoinits
-    # - gocognit
-    # - goconst
-    # - gocritic
-    # - gocyclo
-    # - godot
-    # - godox
-    # - goerr113
-    # - gofumpt
-    # - goheader
-    # - golint
-    # - gomnd
-    # - gomodguard
-    # - goprintffuncname
-    # - gosec (gas)
-    - gosimple  # (megacheck)
-    # - interfacer
-    # - lll
-    # - maligned
-    # - nestif
-    # - nlreturn
-    # - noctx
-    # - nolintlint
     - revive
-    # - rowserrcheck
-    # - scopelint
-    # - sqlclosecheck
     - staticcheck
-    - stylecheck
-    # - testpackage
-    # - tparallel
     - unconvert
-    # - unparam
     - unused
-    # - whitespace
-    # - wrapcheck
-    # - wsl
-linters-settings:
-  gocritic:
-    enabled-checks:
-      # Diagnostic
-      - appendAssign
-      - argOrder
-      - badCond
-      - caseOrder
-      - codegenComment
-      - commentedOutCode
-      - deprecatedComment
-      - dupArg
-      - dupBranchBody
-      - dupCase
-      - dupSubExpr
-      - exitAfterDefer
-      - flagDeref
-      - flagName
-      - nilValReturn
-      - offBy1
-      - sloppyReassign
-      - weakCond
-      - octalLiteral
-
-      # Performance
-      - appendCombine
-      - equalFold
-      - hugeParam
-      - indexAlloc
-      - rangeExprCopy
-      - rangeValCopy
+  settings:
+    staticcheck:
+      checks:
+        # Below is the default set
+        - "all"
+        - "-ST1000"
+        - "-ST1003"
+        - "-ST1016"
+        - "-ST1020"
+        - "-ST1021"
+        - "-ST1022"
+        # FIXME: this below this point is disabled for now, but we should investigate
+        - "-QF1008"  # Omit embedded fields from selector expression https://staticcheck.dev/docs/checks#QF1008
+        - "-QF1003"  # Convert if/else-if chain to tagged switch https://staticcheck.dev/docs/checks#QF1003
+        - "-QF1009"  # Use time.Time.Equal instead of == operator https://staticcheck.dev/docs/checks#QF1009
+        - "-QF1001"  # Apply De Morgan’s law https://staticcheck.dev/docs/checks#QF1001
+        - "-QF1012"  # Use fmt.Fprintf(x, ...) instead of x.Write(fmt.Sprintf(...)) https://staticcheck.dev/docs/checks#QF1012
+        - "-ST1005"  # Expand call to math.Pow https://staticcheck.dev/docs/checks#QF1005
+        - "-QF1004"  # Use strings.ReplaceAll instead of strings.Replace with n == -1 https://staticcheck.dev/docs/checks#QF1004
+    revive:
+      enable-all-rules: true
+      rules:
+        # See https://revive.run/r
+        # Below are unsorted, and we might want to review them to decide which one we want to enable
+        - name: exported
+          disabled: true
+        - name: add-constant
+          disabled: true
+        - name: cognitive-complexity
+          disabled: true
+        - name: package-comments
+          disabled: true
+        - name: cyclomatic
+          disabled: true
+        - name: deep-exit
+          disabled: true
+        - name: function-length
+          disabled: true
+        - name: flag-parameter
+          disabled: true
+        - name: max-public-structs
+          disabled: true
+        - name: max-control-nesting
+          disabled: true
+        - name: confusing-results
+          disabled: true
+        - name: nested-structs
+          disabled: true
+        - name: import-alias-naming
+          disabled: true
+        - name: filename-format
+          disabled: true
+        - name: use-any
+          disabled: true
+        # FIXME: we should enable these below
+        - name: struct-tag
+          disabled: true
+        - name: redundant-import-alias
+          disabled: true
+        - name: empty-lines
+          disabled: true
+        - name: unhandled-error
+          disabled: true
+        - name: confusing-naming
+          disabled: true
+        - name: unused-parameter
+          disabled: true
+        - name: unused-receiver
+          disabled: true
+        - name: import-shadowing
+          disabled: true
+        - name: use-errors-new
+          disabled: true
+        - name: argument-limit
+          disabled: true
+        - name: time-equal
+          disabled: true
+        - name: defer
+          disabled: true
+        - name: early-return
+          disabled: true
+        - name: comment-spacings
+          disabled: true
+        - name: function-result-limit
+          disabled: true
+        - name: unexported-naming
+          disabled: true
+        - name: unnecessary-stmt
+          disabled: true
+        - name: if-return
+          disabled: true
+        - name: unchecked-type-assertion
+          disabled: true
+        - name: bare-return
+          disabled: true
+        # Below have been reviewed and disabled
+        - name: line-length-limit
+          # Better dealt with by formatter golines
+          disabled: true
 
-      # Style
-      - assignOp
-      - boolExprSimplify
-      - captLocal
-      - commentFormatting
-      - commentedOutImport
-      - defaultCaseOrder
-      - docStub
-      - elseif
-      - emptyFallthrough
-      - emptyStringTest
-      - hexLiteral
-      - ifElseChain
-      - methodExprCall
-      - regexpMust
-      - singleCaseSwitch
-      - sloppyLen
-      - stringXbytes
-      - switchTrue
-      - typeAssertChain
-      - typeSwitchVar
-      - underef
-      - unlabelStmt
-      - unlambda
-      - unslice
-      - valSwap
-      - wrapperFunc
-      - yodaStyleExpr
+    depguard:
+      rules:
+        no-patent:
+          # do not link in golang-lru anywhere (problematic patent)
+          deny:
+            - pkg: github.com/hashicorp/golang-lru/arc/v2
+              desc: patented (https://github.com/hashicorp/golang-lru/blob/arc/v2.0.7/arc/arc.go#L18)
+        pkg:
+          # pkg files must not depend on cobra nor anything in cmd
+          files:
+            - '**/pkg/**/*.go'
+          deny:
+            - pkg: github.com/spf13/cobra
+              desc: pkg must not depend on cobra
+            - pkg: github.com/spf13/pflag
+              desc: pkg must not depend on pflag
+            - pkg: github.com/spf13/viper
+              desc: pkg must not depend on viper
+            - pkg: github.com/containerd/nerdctl/v2/cmd
+              desc: pkg must not depend on any cmd files
+    gocritic:
+      enabled-checks:
+        - appendAssign
+        - argOrder
+        - badCond
+        - caseOrder
+        - codegenComment
+        - commentedOutCode
+        - deprecatedComment
+        - dupArg
+        - dupBranchBody
+        - dupCase
+        - dupSubExpr
+        - exitAfterDefer
+        - flagDeref
+        - flagName
+        - nilValReturn
+        - offBy1
+        - sloppyReassign
+        - weakCond
+        - octalLiteral
+        - appendCombine
+        - equalFold
+        - hugeParam
+        - indexAlloc
+        - rangeExprCopy
+        - rangeValCopy
+        - assignOp
+        - boolExprSimplify
+        - captLocal
+        - commentFormatting
+        - commentedOutImport
+        - defaultCaseOrder
+        - docStub
+        - elseif
+        - emptyFallthrough
+        - emptyStringTest
+        - hexLiteral
+        - ifElseChain
+        - methodExprCall
+        - regexpMust
+        - singleCaseSwitch
+        - sloppyLen
+        - stringXbytes
+        - switchTrue
+        - typeAssertChain
+        - typeSwitchVar
+        - underef
+        - unlabelStmt
+        - unlambda
+        - unslice
+        - valSwap
+        - wrapperFunc
+        - yodaStyleExpr
+        - builtinShadow
+        - importShadow
+        - initClause
+        - nestingReduce
+        - paramTypeCombine
+        - ptrToRefParam
+        - typeUnparen
+        - unnamedResult
+        - unnecessaryBlock
+  exclusions:
+    generated: disable
 
-      # Opinionated
-      - builtinShadow
-      - importShadow
-      - initClause
-      - nestingReduce
-      - paramTypeCombine
-      - ptrToRefParam
-      - typeUnparen
-      - unnamedResult
-      - unnecessaryBlock
-
-  depguard:
-    rules:
-      # pkg files must not depend on cobra nor anything in cmd
-      pkg:
-        files:
-          - "**/pkg/**/*.go"
-        deny:
-          - pkg: "github.com/spf13/cobra"
-            desc: "pkg must not depend on cobra"
-          - pkg: "github.com/spf13/pflag"
-            desc: "pkg must not depend on pflag"
-          - pkg: "github.com/spf13/viper"
-            desc: "pkg must not depend on viper"
-          - pkg: "github.com/containerd/nerdctl/v2/cmd"
-            desc: "pkg must not depend on any cmd files"
-      no-patent:
-        deny:
-          - pkg: "github.com/hashicorp/golang-lru/arc/v2"
-            desc: "patented (https://github.com/hashicorp/golang-lru/blob/arc/v2.0.7/arc/arc.go#L18)"
-
-issues:
-  max-issues-per-linter: 0
-  max-same-issues: 0
-  exclude-rules:
-    - linters:
-        - revive
-      text: "unused-parameter"
-
-output:
-  sort-results: true
+formatters:
+  settings:
+    gci:
+      sections:
+        - standard
+        - default
+        - prefix(github.com/containerd)
+        - localmodule
+      no-inline-comments: true
+      no-prefix-comments: true
+      custom-order: true
+    gofumpt:
+      extra-rules: true
+    golines:
+      max-len: 100
+      tab-len: 4
+      shorten-comments: true
+  enable:
+    - gci
+    - gofmt
+    # We might consider enabling the following:
+    #    - gofumpt
+    #    - golines
+  exclusions:
+    generated: disable
diff --git a/Makefile b/Makefile
index 331a5022173..843d460b3a4 100644
--- a/Makefile
+++ b/Makefile
@@ -22,7 +22,6 @@
 # Configuration
 ##########################
 PACKAGE := "github.com/containerd/nerdctl/v2"
-ORG_PREFIXES := "github.com/containerd"
 
 DOCKER ?= docker
 GO ?= go
@@ -80,9 +79,9 @@ endef
 ##########################
 all: binaries
 
-lint: lint-go-all lint-imports lint-yaml lint-shell lint-commits lint-mod lint-licenses-all
+lint: lint-go-all lint-yaml lint-shell lint-commits lint-mod lint-licenses-all
 
-fix: fix-mod fix-imports fix-go-all
+fix: fix-mod fix-go-all
 
 # TODO: fix race task and add it
 test: test-unit # test-unit-race test-unit-bench
@@ -139,12 +138,6 @@ lint-go-all:
 		&& GOOS=freebsd make lint-go
 	$(call footer, $@)
 
-lint-imports:
-	$(call title, $@)
-	@cd $(MAKEFILE_DIR) \
-		&& goimports-reviser -recursive -list-diff -set-exit-status -output stdout -company-prefixes "$(ORG_PREFIXES)"  ./...
-	$(call footer, $@)
-
 lint-yaml:
 	$(call title, $@)
 	cd $(MAKEFILE_DIR) \
@@ -206,12 +199,6 @@ fix-go-all:
 		&& GOOS=windows make fix-go
 	$(call footer, $@)
 
-fix-imports:
-	$(call title, $@)
-	@cd $(MAKEFILE_DIR) \
-		&& goimports-reviser -company-prefixes $(ORG_PREFIXES) ./...
-	$(call footer, $@)
-
 fix-mod:
 	$(call title, $@)
 	@cd $(MAKEFILE_DIR) \
@@ -223,19 +210,17 @@ fix-mod:
 ##########################
 install-dev-tools:
 	$(call title, $@)
-	# golangci: v1.64.5
-	# git-validation: main from 2023/11
-	# ltag: v0.2.5
-	# go-licenses: v2.0.0-alpha.1
-	# goimports-reviser: v3.8.2
+	# golangci: v2.0.2 (2024-03-26)
+	# git-validation: main (2025-02-25)
+	# ltag: main (2025-03-04)
+	# go-licenses: v2.0.0-alpha.1 (2024-06-27)
 	@cd $(MAKEFILE_DIR) \
-		&& go install github.com/golangci/golangci-lint/cmd/golangci-lint@0a603e49e5e9870f5f9f2035bcbe42cd9620a9d5 \
-		&& go install github.com/vbatts/git-validation@679e5cad8c50f1605ab3d8a0a947aaf72fb24c07 \
-		&& go install github.com/kunalkushwaha/ltag@b0cfa33e4cc9383095dc584d3990b62c95096de0 \
+		&& go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@2b224c2cf4c9f261c22a16af7f8ca6408467f338 \
+		&& go install github.com/vbatts/git-validation@7b60e35b055dd2eab5844202ffffad51d9c93922 \
+		&& go install github.com/containerd/ltag@66e6a514664ee2d11a470735519fa22b1a9eaabd \
 		&& go install github.com/google/go-licenses/v2@d01822334fba5896920a060f762ea7ecdbd086e8 \
-		&& go install github.com/incu6us/goimports-reviser/v3@f034195cc8a7ffc7cc70d60aa3a25500874eaf04 \
 		&& go install gotest.tools/gotestsum@ac6dad9c7d87b969004f7749d1942938526c9716
-	@echo "Remember to add GOROOT/bin to your path"
+	@echo "Remember to add \$$HOME/go/bin to your path"
 	$(call footer, $@)
 
 ##########################
@@ -312,8 +297,8 @@ artifacts: clean
 	binaries \
 	install \
 	clean \
-	lint-go lint-go-all lint-imports lint-yaml lint-shell lint-commits lint-mod lint-licenses lint-licenses-all \
-	fix-go fix-go-all fix-imports fix-mod \
+	lint-go lint-go-all lint-yaml lint-shell lint-commits lint-mod lint-licenses lint-licenses-all \
+	fix-go fix-go-all fix-mod \
 	install-dev-tools \
 	test-unit test-unit-race test-unit-bench \
 	artifacts
diff --git a/cmd/nerdctl/container/container_inspect_linux_test.go b/cmd/nerdctl/container/container_inspect_linux_test.go
index 3617f37e273..c03a0a472ea 100644
--- a/cmd/nerdctl/container/container_inspect_linux_test.go
+++ b/cmd/nerdctl/container/container_inspect_linux_test.go
@@ -30,6 +30,7 @@ import (
 
 	"github.com/containerd/nerdctl/mod/tigron/expect"
 	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/infoutil"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/labels"
diff --git a/pkg/cmd/container/run_mount.go b/pkg/cmd/container/run_mount.go
index eb9be3aefb2..92900a21d59 100644
--- a/pkg/cmd/container/run_mount.go
+++ b/pkg/cmd/container/run_mount.go
@@ -126,7 +126,7 @@ func parseMountFlags(volStore volumestore.VolumeStore, options types.ContainerCr
 // Other mounts such as procfs mount are not handled here.
 func generateMountOpts(ctx context.Context, client *containerd.Client, ensuredImage *imgutil.EnsuredImage,
 	volStore volumestore.VolumeStore, options types.ContainerCreateOptions) ([]oci.SpecOpts, []string, []*mountutil.Processed, error) {
-	//nolint:golint,prealloc
+	//nolint:prealloc
 	var (
 		opts        []oci.SpecOpts
 		anonVolumes []string
diff --git a/pkg/logging/logging.go b/pkg/logging/logging.go
index 4966ad21254..9ebe907355e 100644
--- a/pkg/logging/logging.go
+++ b/pkg/logging/logging.go
@@ -30,13 +30,14 @@ import (
 	"sync"
 	"time"
 
-	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/fsnotify/fsnotify"
 	"github.com/muesli/cancelreader"
 
+	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/containerd/v2/core/runtime/v2/logging"
 	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
+
 	"github.com/containerd/nerdctl/v2/pkg/lockutil"
 )
 

From 303faac4bc824bba742ab6e1980ae1c58a22ee4d Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 27 Mar 2025 11:22:32 -0700
Subject: [PATCH 025/225] Enabling tigron lint and test on the CI

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/lint.yml   |  4 +-
 .github/workflows/tigron.yml | 90 ++++++++++++++++++++++++++++++++++++
 2 files changed, 92 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/tigron.yml

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 41b9b0ceb2e..9cdc031c6b9 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,7 +14,7 @@ env:
 jobs:
   go:
     timeout-minutes: 5
-    name: "go | ${{ matrix.goos }} | ${{ matrix.canary }}"
+    name: "${{ matrix.goos }} | ${{ matrix.canary }}"
     runs-on: "${{ matrix.os }}"
     defaults:
       run:
@@ -42,7 +42,7 @@ jobs:
       - name: Set GO env
         run: |
           # If canary is specified, get the latest available golang pre-release instead of the major version
-          if [ "$canary" != "" ]; then
+          if [ "${{ matrix.canary }}" != "" ]; then
             . ./hack/build-integration-canary.sh
             canary::golang::latest
           fi
diff --git a/.github/workflows/tigron.yml b/.github/workflows/tigron.yml
new file mode 100644
index 00000000000..e238c659fe9
--- /dev/null
+++ b/.github/workflows/tigron.yml
@@ -0,0 +1,90 @@
+name: tigron
+
+on:
+  push:
+    branches:
+      - main
+      - 'release/**'
+  pull_request:
+    paths: 'mod/tigron/**'
+
+env:
+  GO_VERSION: 1.24.x
+  GOTOOLCHAIN: local
+
+jobs:
+  lint:
+    timeout-minutes: 10
+    name: "${{ matrix.goos }} ${{ matrix.os }} | go ${{ matrix.canary }}"
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-24.04
+          - os: macos-15
+          - os: windows-2022
+          - os: ubuntu-24.04
+            goos: freebsd
+          - os: ubuntu-24.04
+            canary: go-canary
+    steps:
+      - name: "Checkout project"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          fetch-depth: 100
+      - name: "Set GO env"
+        run: |
+          # If canary is specified, get the latest available golang pre-release instead of the major version
+          if [ "${{ matrix.canary }}" != "" ]; then
+            . ./hack/build-integration-canary.sh
+            canary::golang::latest
+          fi
+      - name: "Install go"
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          check-latest: true
+      - name: "Install tools"
+        run: |
+          cd mod/tigron
+          echo "::group:: make install-dev-tools"
+          make install-dev-tools
+          if [ "$RUNNER_OS" == macOS ]; then
+            brew install yamllint shellcheck
+          fi
+          echo "::endgroup::"
+      - name: "lint"
+        env:
+          NO_COLOR: true
+        run: |
+          if [ "$RUNNER_OS" != "Linux" ] || [ "${{ matrix.goos }}" != "" ]; then
+            echo "It is not necessary to run the linter on this platform (${{ env.RUNNER_OS }} ${{ matrix.goos }})"
+            exit
+          fi
+
+          echo "::group:: lint"
+          cd mod/tigron
+          export LINT_COMMIT_RANGE="$(jq -r '.after + "..HEAD"' ${GITHUB_EVENT_PATH})"
+          make lint
+          echo "::endgroup::"
+      - name: "test-unit"
+        run: |
+          echo "::group:: unit test"
+          cd mod/tigron
+          make test-unit
+          echo "::endgroup::"
+      - name: "test-unit-race"
+        run: |
+          echo "::group:: race test"
+          cd mod/tigron
+          make test-unit-race
+          echo "::endgroup::"
+      - name: "test-unit-bench"
+        run: |
+          echo "::group:: bench"
+          cd mod/tigron
+          make test-unit-bench
+          echo "::endgroup::"

From a1dc0e28daae98d40760b63f54efc9857abdbeb6 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 28 Mar 2025 15:46:35 -0700
Subject: [PATCH 026/225] Avoid console SetRaw

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/container/container_run.go | 3 ++-
 pkg/cmd/container/attach.go            | 5 ++++-
 pkg/cmd/container/exec.go              | 3 ++-
 pkg/containerutil/containerutil.go     | 3 ++-
 pkg/logging/logging.go                 | 3 ++-
 5 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/cmd/nerdctl/container/container_run.go b/cmd/nerdctl/container/container_run.go
index d42d61e1d2f..12b2ac9ad82 100644
--- a/cmd/nerdctl/container/container_run.go
+++ b/cmd/nerdctl/container/container_run.go
@@ -23,6 +23,7 @@ import (
 	"strings"
 
 	"github.com/spf13/cobra"
+	"golang.org/x/term"
 
 	"github.com/containerd/console"
 	"github.com/containerd/log"
@@ -407,7 +408,7 @@ func runAction(cmd *cobra.Command, args []string) error {
 			return err
 		}
 		defer con.Reset()
-		if err := con.SetRaw(); err != nil {
+		if _, err := term.MakeRaw(int(con.Fd())); err != nil {
 			return err
 		}
 	}
diff --git a/pkg/cmd/container/attach.go b/pkg/cmd/container/attach.go
index 177a9fd03db..31a1523e9e9 100644
--- a/pkg/cmd/container/attach.go
+++ b/pkg/cmd/container/attach.go
@@ -21,6 +21,8 @@ import (
 	"errors"
 	"fmt"
 
+	"golang.org/x/term"
+
 	"github.com/containerd/console"
 	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/containerd/v2/pkg/cio"
@@ -93,7 +95,8 @@ func Attach(ctx context.Context, client *containerd.Client, req string, options
 			return err
 		}
 		defer con.Reset()
-		if err := con.SetRaw(); err != nil {
+
+		if _, err := term.MakeRaw(int(con.Fd())); err != nil {
 			return fmt.Errorf("failed to set the console to raw mode: %w", err)
 		}
 		closer := func() {
diff --git a/pkg/cmd/container/exec.go b/pkg/cmd/container/exec.go
index c00c776998b..0c087e63782 100644
--- a/pkg/cmd/container/exec.go
+++ b/pkg/cmd/container/exec.go
@@ -23,6 +23,7 @@ import (
 	"os"
 
 	"github.com/opencontainers/runtime-spec/specs-go"
+	"golang.org/x/term"
 
 	"github.com/containerd/console"
 	containerd "github.com/containerd/containerd/v2/client"
@@ -111,7 +112,7 @@ func execActionWithContainer(ctx context.Context, client *containerd.Client, con
 			return err
 		}
 		defer con.Reset()
-		if err := con.SetRaw(); err != nil {
+		if _, err := term.MakeRaw(int(con.Fd())); err != nil {
 			return err
 		}
 	}
diff --git a/pkg/containerutil/containerutil.go b/pkg/containerutil/containerutil.go
index 1e4fe2a34e3..ee71d5853fa 100644
--- a/pkg/containerutil/containerutil.go
+++ b/pkg/containerutil/containerutil.go
@@ -33,6 +33,7 @@ import (
 	dockeropts "github.com/docker/docker/opts"
 	"github.com/moby/sys/signal"
 	"github.com/opencontainers/runtime-spec/specs-go"
+	"golang.org/x/term"
 
 	"github.com/containerd/console"
 	containerd "github.com/containerd/containerd/v2/client"
@@ -248,7 +249,7 @@ func Start(ctx context.Context, container containerd.Container, flagA bool, clie
 			return err
 		}
 		defer con.Reset()
-		if err := con.SetRaw(); err != nil {
+		if _, err := term.MakeRaw(int(con.Fd())); err != nil {
 			return err
 		}
 	}
diff --git a/pkg/logging/logging.go b/pkg/logging/logging.go
index 4966ad21254..9ebe907355e 100644
--- a/pkg/logging/logging.go
+++ b/pkg/logging/logging.go
@@ -30,13 +30,14 @@ import (
 	"sync"
 	"time"
 
-	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/fsnotify/fsnotify"
 	"github.com/muesli/cancelreader"
 
+	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/containerd/v2/core/runtime/v2/logging"
 	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
+
 	"github.com/containerd/nerdctl/v2/pkg/lockutil"
 )
 

From 46af33e18a906244c452903969e9a8bb3f3d1030 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 29 Mar 2025 07:31:35 -0700
Subject: [PATCH 027/225] Update wincni

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/test-canary.yml |  11 +---
 .github/workflows/test.yml        |  19 +-----
 hack/provisioning/windows/cni.sh  | 103 ++++++++++++++++++++++++++++++
 3 files changed, 106 insertions(+), 27 deletions(-)
 create mode 100755 hack/provisioning/windows/cni.sh

diff --git a/.github/workflows/test-canary.yml b/.github/workflows/test-canary.yml
index 83f95a533b6..ffd14400c26 100644
--- a/.github/workflows/test-canary.yml
+++ b/.github/workflows/test-canary.yml
@@ -76,17 +76,8 @@ jobs:
           check-latest: true
       - run: go install ./cmd/nerdctl
       - run: make install-dev-tools
-      # This here is solely to get the cni install script, which has not been modified in 3+ years.
-      # There is little to no reason to update this to latest containerd
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          repository: containerd/containerd
-          ref: "v1.7.27"
-          path: containerd
-          fetch-depth: 1
       - name: "Set up CNI"
-        working-directory: containerd
-        run: GOPATH=$(go env GOPATH) script/setup/install-cni-windows
+        run: GOPATH=$(go env GOPATH) ./hack/provisioning/windows/cni.sh
       # Windows setup script can only use released versions
       - name: "Set up containerd"
         env:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1c766c92936..5fc6502cf62 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -78,17 +78,9 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
-      - if: ${{ matrix.goos=='windows' }}
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          repository: containerd/containerd
-          ref: v1.7.27
-          path: containerd
-          fetch-depth: 1
       - if: ${{ matrix.goos=='windows' }}
         name: "Set up CNI"
-        working-directory: containerd
-        run: GOPATH=$(go env GOPATH) script/setup/install-cni-windows
+        run: GOPATH=$(go env GOPATH) ./hack/provisioning/windows/cni.sh
       - name: "Run unit tests"
         run: make test-unit
 
@@ -370,15 +362,8 @@ jobs:
       - run: |
           go install ./cmd/nerdctl
           make install-dev-tools
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          repository: containerd/containerd
-          ref: v1.7.27
-          path: containerd
-          fetch-depth: 1
       - name: "Set up CNI"
-        working-directory: containerd
-        run: GOPATH=$(go env GOPATH) script/setup/install-cni-windows
+        run: GOPATH=$(go env GOPATH) ./hack/provisioning/windows/cni.sh
       - name: "Set up containerd"
         env:
           ctrdVersion: 1.7.27
diff --git a/hack/provisioning/windows/cni.sh b/hack/provisioning/windows/cni.sh
new file mode 100755
index 00000000000..42e7549a724
--- /dev/null
+++ b/hack/provisioning/windows/cni.sh
@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+# adapted from: https://raw.githubusercontent.com/containerd/containerd/refs/tags/v2.0.3/script/setup/install-cni-windows
+
+#shellcheck disable=SC2154
+set -o errexit -o errtrace -o functrace -o nounset -o pipefail
+
+# FIXME: make this configurable
+WINCNI_VERSION=v0.3.1
+
+git config --global advice.detachedHead false
+
+DESTDIR="${DESTDIR:-"C:\\Program Files\\containerd\\cni"}"
+WINCNI_BIN_DIR="${DESTDIR}/bin"
+WINCNI_PKG=github.com/Microsoft/windows-container-networking
+
+git clone --depth 1 --branch "${WINCNI_VERSION}" "https://${WINCNI_PKG}.git" "${GOPATH}/src/${WINCNI_PKG}"
+cd "${GOPATH}/src/${WINCNI_PKG}"
+make all
+install -D -m 755 "out/nat.exe" "${WINCNI_BIN_DIR}/nat.exe"
+install -D -m 755 "out/sdnbridge.exe" "${WINCNI_BIN_DIR}/sdnbridge.exe"
+install -D -m 755 "out/sdnoverlay.exe" "${WINCNI_BIN_DIR}/sdnoverlay.exe"
+
+CNI_CONFIG_DIR="${DESTDIR}/conf"
+mkdir -p "${CNI_CONFIG_DIR}"
+
+# split_ip splits ip into a 4-element array.
+split_ip() {
+  local -r varname="$1"
+  local -r ip="$2"
+  for i in {0..3}; do
+    eval "$varname"["$i"]="$( echo "$ip" | cut -d '.' -f $((i + 1)) )"
+  done
+}
+
+# subnet gets subnet for a gateway, e.g. 192.168.100.0/24.
+calculate_subnet() {
+  local -r gateway="$1"
+  local -r prefix_len="$2"
+  split_ip gateway_array "$gateway"
+  local len=$prefix_len
+  for i in {0..3}; do
+    if (( len >= 8 )); then
+      mask=255
+    elif (( len > 0 )); then
+      mask=$(( 256 - 2 ** ( 8 - len ) ))
+    else
+      mask=0
+    fi
+    (( len -= 8 ))
+    result_array[i]=$(( gateway_array[i] & mask ))
+  done
+  result="$(printf ".%s" "${result_array[@]}")"
+  result="${result:1}"
+  echo "$result/$((32 - prefix_len))"
+}
+
+# nat already exists on the Windows VM, the subnet and gateway
+# we specify should match that.
+: "${GATEWAY:=$(powershell -c "(Get-NetIPAddress -InterfaceAlias 'vEthernet (nat)' -AddressFamily IPv4).IPAddress")}"
+: "${PREFIX_LEN:=$(powershell -c "(Get-NetIPAddress -InterfaceAlias 'vEthernet (nat)' -AddressFamily IPv4).PrefixLength")}"
+
+subnet="$(calculate_subnet "$GATEWAY" "$PREFIX_LEN")"
+
+# The "name" field in the config is used as the underlying
+# network type right now (see
+# https://github.com/microsoft/windows-container-networking/pull/45),
+# so it must match a network type in:
+# https://docs.microsoft.com/en-us/windows-server/networking/technologies/hcn/hcn-json-document-schemas
+bash -c 'cat >"'"${CNI_CONFIG_DIR}"'"/0-containerd-nat.conf <<EOF
+{
+    "cniVersion": "1.0.0",
+    "name": "nat",
+    "type": "nat",
+    "master": "Ethernet",
+    "ipam": {
+        "subnet": "'"$subnet"'",
+        "routes": [
+            {
+                "GW": "'"$GATEWAY"'"
+            }
+        ]
+    },
+    "capabilities": {
+        "portMappings": true,
+        "dns": true
+    }
+}
+EOF'
\ No newline at end of file

From 6f658816aab503a3e06ea4325c5e732e2a572109 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 28 Mar 2025 09:54:25 -0700
Subject: [PATCH 028/225] golangci yml configuration cleanup

- re-activate gocritic, disabling rules we do not pass
- disable prealloc (considered harmful)
- activate golines formatter
- comment and re-orgnize linters section

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .golangci.yml | 113 ++++++++++++++++++++++++++------------------------
 1 file changed, 59 insertions(+), 54 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index bf186a332d2..616b1ce2a9c 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -10,16 +10,36 @@ issues:
 linters:
   default: none
   enable:
-    - depguard
+    # 1. This is the default enabled set of golanci
+
+    # We should consider enabling errcheck
+    # - errcheck
     - govet
     - ineffassign
-    - misspell
-    - nakedret
-    - prealloc
-    - revive
     - staticcheck
-    - unconvert
     - unused
+
+    # 2. These are not part of the default set
+
+    # Important to prevent import of certain packages
+    - depguard
+    # Removes unnecessary conversions
+    - unconvert
+    # Flag common typos
+    - misspell
+    # A meta-linter seen as a good replacement for golint
+    - revive
+    # Gocritic
+    - gocritic
+
+    # 3. We used to use these, but have now removed them
+
+    # Use of prealloc is generally premature optimization and performance profiling should be done instead
+    # https://golangci-lint.run/usage/linters/#prealloc
+    # - prealloc
+    # Provided by revive in a better way
+    # - nakedret
+
   settings:
     staticcheck:
       checks:
@@ -119,7 +139,6 @@ linters:
         - name: line-length-limit
           # Better dealt with by formatter golines
           disabled: true
-
     depguard:
       rules:
         no-patent:
@@ -141,67 +160,53 @@ linters:
             - pkg: github.com/containerd/nerdctl/v2/cmd
               desc: pkg must not depend on any cmd files
     gocritic:
-      enabled-checks:
+      disabled-checks:
+        # Below are normally enabled by default, but we do not pass
         - appendAssign
-        - argOrder
-        - badCond
-        - caseOrder
-        - codegenComment
-        - commentedOutCode
-        - deprecatedComment
-        - dupArg
-        - dupBranchBody
-        - dupCase
-        - dupSubExpr
-        - exitAfterDefer
-        - flagDeref
-        - flagName
+        - ifElseChain
+        - unslice
+        - badCall
+        - assignOp
+        - commentFormatting
+        - captLocal
+        - singleCaseSwitch
+        - wrapperFunc
+        - elseif
+        - regexpMust
+      enabled-checks:
+        # Below used to be enabled, but we do not pass anymore
+        # - paramTypeCombine
+        # - octalLiteral
+        # - unnamedResult
+        # - equalFold
+        # - sloppyReassign
+        # - emptyStringTest
+        # - hugeParam
+        # - appendCombine
+        # - stringXbytes
+        # - ptrToRefParam
+        # - commentedOutCode
+        # - rangeValCopy
+        # - methodExprCall
+        # - yodaStyleExpr
+        # - typeUnparen
+
+        # We enabled these and we pass
         - nilValReturn
-        - offBy1
-        - sloppyReassign
         - weakCond
-        - octalLiteral
-        - appendCombine
-        - equalFold
-        - hugeParam
         - indexAlloc
         - rangeExprCopy
-        - rangeValCopy
-        - assignOp
         - boolExprSimplify
-        - captLocal
-        - commentFormatting
         - commentedOutImport
-        - defaultCaseOrder
         - docStub
-        - elseif
         - emptyFallthrough
-        - emptyStringTest
         - hexLiteral
-        - ifElseChain
-        - methodExprCall
-        - regexpMust
-        - singleCaseSwitch
-        - sloppyLen
-        - stringXbytes
-        - switchTrue
         - typeAssertChain
-        - typeSwitchVar
-        - underef
         - unlabelStmt
-        - unlambda
-        - unslice
-        - valSwap
-        - wrapperFunc
-        - yodaStyleExpr
         - builtinShadow
         - importShadow
         - initClause
         - nestingReduce
-        - paramTypeCombine
-        - ptrToRefParam
-        - typeUnparen
-        - unnamedResult
         - unnecessaryBlock
   exclusions:
     generated: disable
@@ -220,7 +225,7 @@ formatters:
     gofumpt:
       extra-rules: true
     golines:
-      max-len: 100
+      max-len: 500
       tab-len: 4
       shorten-comments: true
   enable:
@@ -228,6 +233,6 @@ formatters:
     - gofmt
     # We might consider enabling the following:
     #    - gofumpt
-    #    - golines
+    - golines
   exclusions:
     generated: disable

From 1b3b183af8db3b3f4689ce00002895ad2e19a3a8 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 28 Mar 2025 09:56:45 -0700
Subject: [PATCH 029/225] Lint: revive redundant-import-alias

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .golangci.yml                | 2 --
 pkg/api/types/image_types.go | 2 +-
 pkg/imgutil/commit/commit.go | 2 +-
 3 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index 616b1ce2a9c..395afd32adf 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -97,8 +97,6 @@ linters:
         # FIXME: we should enable these below
         - name: struct-tag
           disabled: true
-        - name: redundant-import-alias
-          disabled: true
         - name: empty-lines
           disabled: true
         - name: unhandled-error
diff --git a/pkg/api/types/image_types.go b/pkg/api/types/image_types.go
index 0a723ca2cd2..d48e6318026 100644
--- a/pkg/api/types/image_types.go
+++ b/pkg/api/types/image_types.go
@@ -19,7 +19,7 @@ package types
 import (
 	"io"
 
-	v1 "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 // ImageListOptions specifies options for `nerdctl image list`.
diff --git a/pkg/imgutil/commit/commit.go b/pkg/imgutil/commit/commit.go
index 782a5cd6edb..fd5886bfb7f 100644
--- a/pkg/imgutil/commit/commit.go
+++ b/pkg/imgutil/commit/commit.go
@@ -48,7 +48,7 @@ import (
 	"github.com/containerd/nerdctl/v2/pkg/clientutil"
 	"github.com/containerd/nerdctl/v2/pkg/cmd/image"
 	"github.com/containerd/nerdctl/v2/pkg/containerutil"
-	imgutil "github.com/containerd/nerdctl/v2/pkg/imgutil"
+	"github.com/containerd/nerdctl/v2/pkg/imgutil"
 	"github.com/containerd/nerdctl/v2/pkg/labels"
 )
 

From 39d5ef2860a6ca078ce3172a5dd8166312778904 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 28 Mar 2025 09:58:49 -0700
Subject: [PATCH 030/225] Lint: revive struct-tag

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .golangci.yml           | 2 --
 pkg/cmd/network/list.go | 2 +-
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index 395afd32adf..0581083297a 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -95,8 +95,6 @@ linters:
         - name: use-any
           disabled: true
         # FIXME: we should enable these below
-        - name: struct-tag
-          disabled: true
         - name: empty-lines
           disabled: true
         - name: unhandled-error
diff --git a/pkg/cmd/network/list.go b/pkg/cmd/network/list.go
index b2075356d8c..731c51b1b99 100644
--- a/pkg/cmd/network/list.go
+++ b/pkg/cmd/network/list.go
@@ -35,7 +35,7 @@ type networkPrintable struct {
 	Name   string
 	Labels string
 	// TODO: "CreatedAt", "Driver", "IPv6", "Internal", "Scope"
-	file string `json:"-"`
+	file string
 }
 
 func List(ctx context.Context, options types.NetworkListOptions) error {

From 4e3f637a1b016c55cccfc47cf41a2e48fea64089 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 28 Mar 2025 10:06:39 -0700
Subject: [PATCH 031/225] Lint: revive time-equal

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .golangci.yml               | 2 --
 pkg/netutil/netutil_test.go | 4 ++--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index 0581083297a..a824b76a0d9 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -111,8 +111,6 @@ linters:
           disabled: true
         - name: argument-limit
           disabled: true
-        - name: time-equal
-          disabled: true
         - name: defer
           disabled: true
         - name: early-return
diff --git a/pkg/netutil/netutil_test.go b/pkg/netutil/netutil_test.go
index a17f4cb6197..399a33ee436 100644
--- a/pkg/netutil/netutil_test.go
+++ b/pkg/netutil/netutil_test.go
@@ -198,7 +198,7 @@ func testDefaultNetworkCreation(t *testing.T) {
 	assert.NilError(t, err)
 	assert.Assert(t, len(files) == 2) // files[0] is the entry for '.'
 	assert.Assert(t, filepath.Join(cniConfTestDir, files[1].Name()) == defaultNetConf.File)
-	assert.Assert(t, firstConfigModTime == files[1].ModTime())
+	assert.Assert(t, firstConfigModTime.Equal(files[1].ModTime()))
 }
 
 // Tests whether nerdctl properly creates the default network
@@ -297,7 +297,7 @@ func testDefaultNetworkCreationWithBridgeIP(t *testing.T) {
 	assert.NilError(t, err)
 	assert.Assert(t, len(files) == 2) // files[0] is the entry for '.'
 	assert.Assert(t, filepath.Join(cniConfTestDir, files[1].Name()) == defaultNetConf.File)
-	assert.Assert(t, firstConfigModTime == files[1].ModTime())
+	assert.Assert(t, firstConfigModTime.Equal(files[1].ModTime()))
 }
 
 // Tests whether nerdctl skips the creation of the default network if a

From ebc89dc071ec4adbc4d7a020ca8754c3787ca8e0 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 28 Mar 2025 10:21:14 -0700
Subject: [PATCH 032/225] Lint: revive unexported-naming

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .golangci.yml                                 | 2 --
 pkg/cmd/container/run_windows.go              | 8 ++++----
 pkg/inspecttypes/dockercompat/dockercompat.go | 8 ++++----
 3 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index a824b76a0d9..86cee86fcf7 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -119,8 +119,6 @@ linters:
           disabled: true
         - name: function-result-limit
           disabled: true
-        - name: unexported-naming
-          disabled: true
         - name: unnecessary-stmt
           disabled: true
         - name: if-return
diff --git a/pkg/cmd/container/run_windows.go b/pkg/cmd/container/run_windows.go
index 6b38e7e9f3f..6bc5b42e699 100644
--- a/pkg/cmd/container/run_windows.go
+++ b/pkg/cmd/container/run_windows.go
@@ -69,17 +69,17 @@ func setPlatformOptions(
 			if err != nil {
 				return nil, fmt.Errorf("failed to parse memory bytes %q: %w", options.Memory, err)
 			}
-			UVMMemmory := map[string]string{
+			uvmMemmory := map[string]string{
 				uvmMemorySizeInMB: fmt.Sprintf("%v", mem64),
 			}
-			opts = append(opts, oci.WithAnnotations(UVMMemmory))
+			opts = append(opts, oci.WithAnnotations(uvmMemmory))
 		}
 
 		if options.CPUs > 0.0 {
-			UVMCPU := map[string]string{
+			uvmCPU := map[string]string{
 				uvmCPUCount: fmt.Sprintf("%v", options.CPUs),
 			}
-			opts = append(opts, oci.WithAnnotations(UVMCPU))
+			opts = append(opts, oci.WithAnnotations(uvmCPU))
 		}
 		opts = append(opts, oci.WithWindowsHyperV)
 	case "host":
diff --git a/pkg/inspecttypes/dockercompat/dockercompat.go b/pkg/inspecttypes/dockercompat/dockercompat.go
index 4605de3d1e7..e5b797e786d 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat.go
@@ -820,10 +820,10 @@ func getMemorySettingsFromNative(sp *specs.Spec) (*MemorySetting, error) {
 	return res, nil
 }
 
-func getDNSFromNative(Labels map[string]string) (*DNSSettings, error) {
+func getDNSFromNative(lbls map[string]string) (*DNSSettings, error) {
 	res := &DNSSettings{}
 
-	if dnsSettingJSON, ok := Labels[labels.DNSSetting]; ok {
+	if dnsSettingJSON, ok := lbls[labels.DNSSetting]; ok {
 		if err := json.Unmarshal([]byte(dnsSettingJSON), &res); err != nil {
 			return nil, fmt.Errorf("failed to parse DNS settings: %v", err)
 		}
@@ -832,10 +832,10 @@ func getDNSFromNative(Labels map[string]string) (*DNSSettings, error) {
 	return res, nil
 }
 
-func getHostConfigLabelFromNative(Labels map[string]string) (*HostConfigLabel, error) {
+func getHostConfigLabelFromNative(lbls map[string]string) (*HostConfigLabel, error) {
 	res := &HostConfigLabel{}
 
-	if hostConfigLabelJSON, ok := Labels[labels.HostConfigLabel]; ok {
+	if hostConfigLabelJSON, ok := lbls[labels.HostConfigLabel]; ok {
 		if err := json.Unmarshal([]byte(hostConfigLabelJSON), &res); err != nil {
 			return nil, fmt.Errorf("failed to parse DNS servers: %v", err)
 		}

From bc989da4548e151012f1c4d5399cf475c077d225 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 28 Mar 2025 10:29:25 -0700
Subject: [PATCH 033/225] Lint: revive if-return

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .golangci.yml                                  |  2 --
 pkg/containerutil/container_network_manager.go | 11 ++---------
 2 files changed, 2 insertions(+), 11 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index 86cee86fcf7..bada400d3f3 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -121,8 +121,6 @@ linters:
           disabled: true
         - name: unnecessary-stmt
           disabled: true
-        - name: if-return
-          disabled: true
         - name: unchecked-type-assertion
           disabled: true
         - name: bare-return
diff --git a/pkg/containerutil/container_network_manager.go b/pkg/containerutil/container_network_manager.go
index c16ee9dfb9a..9f082f9ce12 100644
--- a/pkg/containerutil/container_network_manager.go
+++ b/pkg/containerutil/container_network_manager.go
@@ -240,11 +240,7 @@ func (m *noneNetworkManager) SetupNetworking(ctx context.Context, containerID st
 	}
 
 	// Save the meta information
-	if err = hs.Acquire(hsMeta); err != nil {
-		return err
-	}
-
-	return nil
+	return hs.Acquire(hsMeta)
 }
 
 // CleanupNetworking Performs any required cleanup actions for the given container.
@@ -269,10 +265,7 @@ func (m *noneNetworkManager) CleanupNetworking(ctx context.Context, container co
 	}
 
 	// Release
-	if err = hs.Release(container.ID()); err != nil {
-		return err
-	}
-	return nil
+	return hs.Release(container.ID())
 }
 
 // InternalNetworkingOptionLabels Returns the set of NetworkingOptions which should be set as labels on the container.

From 702a97740ddb866c414abdff393cfa39e1bcc577 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 28 Mar 2025 10:38:26 -0700
Subject: [PATCH 034/225] Lint: revive filename-format

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .golangci.yml                                                   | 2 --
 .../infoutilmock/{info.util.mock.go => infoutil_mock.go}        | 0
 2 files changed, 2 deletions(-)
 rename pkg/infoutil/infoutilmock/{info.util.mock.go => infoutil_mock.go} (100%)

diff --git a/.golangci.yml b/.golangci.yml
index bada400d3f3..781920f4ac7 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -90,8 +90,6 @@ linters:
           disabled: true
         - name: import-alias-naming
           disabled: true
-        - name: filename-format
-          disabled: true
         - name: use-any
           disabled: true
         # FIXME: we should enable these below
diff --git a/pkg/infoutil/infoutilmock/info.util.mock.go b/pkg/infoutil/infoutilmock/infoutil_mock.go
similarity index 100%
rename from pkg/infoutil/infoutilmock/info.util.mock.go
rename to pkg/infoutil/infoutilmock/infoutil_mock.go

From 77b0edc861019996fa6f23bfafc9cc64732dfd95 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 28 Mar 2025 10:42:08 -0700
Subject: [PATCH 035/225] Lint: revive import-alias-naming

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .golangci.yml                             | 2 --
 cmd/nerdctl/container/container_update.go | 4 ++--
 cmd/nerdctl/inspect/inspect.go            | 8 ++++----
 3 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index 781920f4ac7..e7d02f19cc2 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -88,8 +88,6 @@ linters:
           disabled: true
         - name: nested-structs
           disabled: true
-        - name: import-alias-naming
-          disabled: true
         - name: use-any
           disabled: true
         # FIXME: we should enable these below
diff --git a/cmd/nerdctl/container/container_update.go b/cmd/nerdctl/container/container_update.go
index fb728655d29..28ac0f6d078 100644
--- a/cmd/nerdctl/container/container_update.go
+++ b/cmd/nerdctl/container/container_update.go
@@ -38,7 +38,7 @@ import (
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
 	"github.com/containerd/nerdctl/v2/pkg/clientutil"
-	nerdctlContainer "github.com/containerd/nerdctl/v2/pkg/cmd/container"
+	nerdctlcontainer "github.com/containerd/nerdctl/v2/pkg/cmd/container"
 	"github.com/containerd/nerdctl/v2/pkg/formatter"
 	"github.com/containerd/nerdctl/v2/pkg/idutil/containerwalker"
 	"github.com/containerd/nerdctl/v2/pkg/infoutil"
@@ -358,7 +358,7 @@ func updateContainer(ctx context.Context, client *containerd.Client, id string,
 		return err
 	}
 	if cmd.Flags().Changed("restart") && restart != "" {
-		if err := nerdctlContainer.UpdateContainerRestartPolicyLabel(ctx, client, container, restart); err != nil {
+		if err := nerdctlcontainer.UpdateContainerRestartPolicyLabel(ctx, client, container, restart); err != nil {
 			return err
 		}
 	}
diff --git a/cmd/nerdctl/inspect/inspect.go b/cmd/nerdctl/inspect/inspect.go
index 53d02858d5a..8c62f54e4d1 100644
--- a/cmd/nerdctl/inspect/inspect.go
+++ b/cmd/nerdctl/inspect/inspect.go
@@ -23,9 +23,9 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/completion"
-	containerCmd "github.com/containerd/nerdctl/v2/cmd/nerdctl/container"
+	containercmd "github.com/containerd/nerdctl/v2/cmd/nerdctl/container"
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
-	imageCmd "github.com/containerd/nerdctl/v2/cmd/nerdctl/image"
+	imagecmd "github.com/containerd/nerdctl/v2/cmd/nerdctl/image"
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
 	"github.com/containerd/nerdctl/v2/pkg/clientutil"
 	"github.com/containerd/nerdctl/v2/pkg/cmd/container"
@@ -117,13 +117,13 @@ func inspectAction(cmd *cobra.Command, args []string) error {
 	var containerInspectOptions types.ContainerInspectOptions
 	if inspectImage {
 		platform := ""
-		imageInspectOptions, err = imageCmd.InspectOptions(cmd, &platform)
+		imageInspectOptions, err = imagecmd.InspectOptions(cmd, &platform)
 		if err != nil {
 			return err
 		}
 	}
 	if inspectContainer {
-		containerInspectOptions, err = containerCmd.InspectOptions(cmd)
+		containerInspectOptions, err = containercmd.InspectOptions(cmd)
 		if err != nil {
 			return err
 		}

From 8893fe4121164aa1c412006cf17b703e2af9b6ad Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 28 Mar 2025 11:26:49 -0700
Subject: [PATCH 036/225] Lint: revive: review and organization off all rules

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .golangci.yml | 109 +++++++++++++++++++++++++++++++++-----------------
 1 file changed, 72 insertions(+), 37 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index e7d02f19cc2..5cfdd2df7ac 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -63,68 +63,103 @@ linters:
       enable-all-rules: true
       rules:
         # See https://revive.run/r
-        # Below are unsorted, and we might want to review them to decide which one we want to enable
-        - name: exported
+
+        ##### P0: we should do it ASAP.
+        - name: max-control-nesting
+          # 10 occurences (at default 5). Deep nesting hurts readibility.
+          arguments: [7]
+        - name: deep-exit
+          # 11 occurrences. Do not exit in random places.
           disabled: true
-        - name: add-constant
+        - name: unchecked-type-assertion
+          # 14 occurrences. This is generally risky and encourages bad coding for newcomers.
           disabled: true
-        - name: cognitive-complexity
+        - name: bare-return
+          # 31 occurrences. Bare returns are just evil, very unfriendly, and make reading and editing much harder.
           disabled: true
-        - name: package-comments
+        - name: import-shadowing
+          # 44 occurrences. Shadowing makes things prone to errors / confusing to read.
           disabled: true
-        - name: cyclomatic
+        - name: use-errors-new
+          # 84 occurrences. Improves error testing.
           disabled: true
-        - name: deep-exit
+
+        ##### P1: consider making a dent on these, but not critical.
+        - name: argument-limit
+          # 4 occurrences (at default 8). Long windy arguments list for functions are hard to read. Use structs instead.
+          arguments: [12]
+        - name: unnecessary-stmt
+          # 5 occurrences. Increase readability.
           disabled: true
-        - name: function-length
+        - name: defer
+          # 7 occurrences. Confusing to read for newbies.
           disabled: true
-        - name: flag-parameter
+        - name: confusing-naming
+          # 10 occurrences. Hurts readability.
           disabled: true
-        - name: max-public-structs
+        - name: early-return
+          # 10 occurrences. Would improve readability.
           disabled: true
-        - name: max-control-nesting
+        - name: function-result-limit
+          # 12 occurrences (at default 3). A function returning many results is probably too big.
+          arguments: [7]
+        - name: function-length
+          # 155 occurrences (at default 0, 75). Really long functions should really be broken up in most cases.
+          arguments: [0, 400]
+        - name: cyclomatic
+          # 204 occurrences (at default 10)
+          arguments: [100]
+        - name: unhandled-error
+          # 222 occurrences. Could indicate failure to handle broken conditions.
           disabled: true
+        - name: cognitive-complexity
+          arguments: [197]
+          # 441 occurrences (at default 7). We should try to lower it (involves significant refactoring).
+
+        ##### P2: nice to have.
+        - name: max-public-structs
+          # 7 occurrences (at default 5). Might indicate overcrowding of public API.
+          arguments: [21]
         - name: confusing-results
+          # 13 occurrences. Have named returns when the type stutters.
+          # Makes it a bit easier to figure out function behavior just looking at signature.
           disabled: true
-        - name: nested-structs
+        - name: comment-spacings
+          # 50 occurrences. Makes code look less wonky / ease readability.
           disabled: true
         - name: use-any
+          # 30 occurrences. `any` instead of `interface{}`. Cosmetic.
           disabled: true
-        # FIXME: we should enable these below
         - name: empty-lines
+          # 85 occurrences. Makes code look less wonky / ease readability.
           disabled: true
-        - name: unhandled-error
-          disabled: true
-        - name: confusing-naming
-          disabled: true
-        - name: unused-parameter
-          disabled: true
-        - name: unused-receiver
-          disabled: true
-        - name: import-shadowing
-          disabled: true
-        - name: use-errors-new
-          disabled: true
-        - name: argument-limit
-          disabled: true
-        - name: defer
+        - name: package-comments
+          # 100 occurrences. Better for documentation...
           disabled: true
-        - name: early-return
+        - name: exported
+          # 577 occurrences. Forces documentation of any exported symbol.
           disabled: true
-        - name: comment-spacings
+
+        ###### Permanently disabled. Below have been reviewed and vetted to be unnecessary.
+        - name: line-length-limit
+          # Formatter `golines` takes care of this.
           disabled: true
-        - name: function-result-limit
+        - name: nested-structs
+          # 5 occurrences. Trivial. This is not that hard to read.
           disabled: true
-        - name: unnecessary-stmt
+        - name: flag-parameter
+          # 52 occurrences. Not sure if this is valuable.
           disabled: true
-        - name: unchecked-type-assertion
+        - name: unused-parameter
+          # 505 occurrences. A lot of work for a marginal improvement.
           disabled: true
-        - name: bare-return
+        - name: unused-receiver
+          # 31 occurrences. Ibid.
           disabled: true
-        # Below have been reviewed and disabled
-        - name: line-length-limit
-          # Better dealt with by formatter golines
+        - name: add-constant
+          # 2605 occurrences. Kind of useful in itself, but unacceptable amount of effort to fix
           disabled: true
+
     depguard:
       rules:
         no-patent:

From a46718f702fab7dc890064c517b33914632b2571 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 28 Mar 2025 11:28:40 -0700
Subject: [PATCH 037/225] Lint: staticcheck fix QF1004

Note that QF1009 has been fixed by previous commits working on revive.

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .golangci.yml                   | 2 --
 pkg/dnsutil/hostsstore/hosts.go | 2 +-
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index 5cfdd2df7ac..cf30bd287ce 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -54,11 +54,9 @@ linters:
         # FIXME: this below this point is disabled for now, but we should investigate
         - "-QF1008"  # Omit embedded fields from selector expression https://staticcheck.dev/docs/checks#QF1008
         - "-QF1003"  # Convert if/else-if chain to tagged switch https://staticcheck.dev/docs/checks#QF1003
-        - "-QF1009"  # Use time.Time.Equal instead of == operator https://staticcheck.dev/docs/checks#QF1009
         - "-QF1001"  # Apply De Morgan’s law https://staticcheck.dev/docs/checks#QF1001
         - "-QF1012"  # Use fmt.Fprintf(x, ...) instead of x.Write(fmt.Sprintf(...)) https://staticcheck.dev/docs/checks#QF1012
         - "-ST1005"  # Expand call to math.Pow https://staticcheck.dev/docs/checks#QF1005
-        - "-QF1004"  # Use strings.ReplaceAll instead of strings.Replace with n == -1 https://staticcheck.dev/docs/checks#QF1004
     revive:
       enable-all-rules: true
       rules:
diff --git a/pkg/dnsutil/hostsstore/hosts.go b/pkg/dnsutil/hostsstore/hosts.go
index 1b25b02d765..1378ed39686 100644
--- a/pkg/dnsutil/hostsstore/hosts.go
+++ b/pkg/dnsutil/hostsstore/hosts.go
@@ -52,7 +52,7 @@ func parseHostsButSkipMarkedRegion(w io.Writer, r io.Reader) error {
 LINE:
 	for scanner.Scan() {
 		line := scanner.Text()
-		line = strings.Replace(strings.Trim(line, " \t"), "\t", " ", -1)
+		line = strings.ReplaceAll(strings.Trim(line, " \t"), "\t", " ")
 		sawMarkerEnd := false
 		if strings.HasPrefix(line, "#") {
 			com := strings.TrimSpace(line[1:])

From 1298c20fb6d58e4b8481ce9ddd621ec23aa029fd Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 28 Mar 2025 11:32:00 -0700
Subject: [PATCH 038/225] Lint: staticcheck fix ST1005

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .golangci.yml            | 1 -
 pkg/imgutil/filtering.go | 6 ++----
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index cf30bd287ce..f1c64f6b5e9 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -56,7 +56,6 @@ linters:
         - "-QF1003"  # Convert if/else-if chain to tagged switch https://staticcheck.dev/docs/checks#QF1003
         - "-QF1001"  # Apply De Morgan’s law https://staticcheck.dev/docs/checks#QF1001
         - "-QF1012"  # Use fmt.Fprintf(x, ...) instead of x.Write(fmt.Sprintf(...)) https://staticcheck.dev/docs/checks#QF1012
-        - "-ST1005"  # Expand call to math.Pow https://staticcheck.dev/docs/checks#QF1005
     revive:
       enable-all-rules: true
       rules:
diff --git a/pkg/imgutil/filtering.go b/pkg/imgutil/filtering.go
index 26525d86cb2..30764f163c6 100644
--- a/pkg/imgutil/filtering.go
+++ b/pkg/imgutil/filtering.go
@@ -158,8 +158,7 @@ func FilterByCreatedAt(ctx context.Context, client *containerd.Client, before []
 				return []images.Image{}, err
 			}
 			if len(beforeImages) == 0 {
-				//nolint:stylecheck
-				return []images.Image{}, fmt.Errorf("No such image: %s", fetchImageNames(before))
+				return []images.Image{}, fmt.Errorf("no such image: %s", fetchImageNames(before))
 			}
 			maxTime = beforeImages[0].CreatedAt
 			for _, image := range beforeImages {
@@ -175,8 +174,7 @@ func FilterByCreatedAt(ctx context.Context, client *containerd.Client, before []
 				return []images.Image{}, err
 			}
 			if len(sinceImages) == 0 {
-				//nolint:stylecheck
-				return []images.Image{}, fmt.Errorf("No such image: %s", fetchImageNames(since))
+				return []images.Image{}, fmt.Errorf("no such image: %s", fetchImageNames(since))
 			}
 			minTime = sinceImages[0].CreatedAt
 			for _, image := range sinceImages {

From 46c6af6e11d31884f95c3b54827af5a7cf1494db Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 28 Mar 2025 11:40:28 -0700
Subject: [PATCH 039/225] Lint: staticcheck review remaining checks

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .golangci.yml | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index f1c64f6b5e9..65b0fb1fa51 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -51,11 +51,23 @@ linters:
         - "-ST1020"
         - "-ST1021"
         - "-ST1022"
-        # FIXME: this below this point is disabled for now, but we should investigate
-        - "-QF1008"  # Omit embedded fields from selector expression https://staticcheck.dev/docs/checks#QF1008
-        - "-QF1003"  # Convert if/else-if chain to tagged switch https://staticcheck.dev/docs/checks#QF1003
-        - "-QF1001"  # Apply De Morgan’s law https://staticcheck.dev/docs/checks#QF1001
-        - "-QF1012"  # Use fmt.Fprintf(x, ...) instead of x.Write(fmt.Sprintf(...)) https://staticcheck.dev/docs/checks#QF1012
+
+        ##### TODO: fix and enable these
+        # 4 occurrences.
+        # Use fmt.Fprintf(x, ...) instead of x.Write(fmt.Sprintf(...)) https://staticcheck.dev/docs/checks#QF1012
+        - "-QF1012"
+        # 6 occurrences.
+        # Apply De Morgan’s law https://staticcheck.dev/docs/checks#QF1001
+        - "-QF1001"
+        # 10 occurrences.
+        # Convert if/else-if chain to tagged switch https://staticcheck.dev/docs/checks#QF1003
+        - "-QF1003"
+
+        ##### These have been vetted to be disabled.
+        # 55 occurrences. Omit embedded fields from selector expression https://staticcheck.dev/docs/checks#QF1008
+        # Usefulness is questionable.
+        - "-QF1008"
+
     revive:
       enable-all-rules: true
       rules:

From aab2d506a06a76d710c578b76083c788b3f35516 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sun, 30 Mar 2025 11:45:12 -0700
Subject: [PATCH 040/225] Adjust drifting test for another year

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/image/image_history_test.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cmd/nerdctl/image/image_history_test.go b/cmd/nerdctl/image/image_history_test.go
index f4f0d2c0505..16667641600 100644
--- a/cmd/nerdctl/image/image_history_test.go
+++ b/cmd/nerdctl/image/image_history_test.go
@@ -95,7 +95,7 @@ func TestImageHistory(t *testing.T) {
 					assert.Equal(t, len(history), 2, info)
 					assert.Equal(t, history[0].Size, "0B", info)
 					// FIXME: how is this going to age?
-					assert.Equal(t, history[0].CreatedSince, "3 years ago", info)
+					assert.Equal(t, history[0].CreatedSince, "4 years ago", info)
 					assert.Equal(t, history[0].Snapshot, "<missing>", info)
 					assert.Equal(t, history[0].Comment, "", info)
 
@@ -109,7 +109,7 @@ func TestImageHistory(t *testing.T) {
 					assert.Equal(t, history[1].CreatedBy, "/bin/sh -c #(nop) ADD file:3b16ffee2b26d8af5…", info)
 
 					assert.Equal(t, history[1].Size, "5.947MB", info)
-					assert.Equal(t, history[1].CreatedSince, "3 years ago", info)
+					assert.Equal(t, history[1].CreatedSince, "4 years ago", info)
 					assert.Equal(t, history[1].Snapshot, "sha256:56bf55b8eed1f0b4794a30386e4d1d3da949c…", info)
 					assert.Equal(t, history[1].Comment, "", info)
 				}),

From 710dfceea1296b53b3ecf37ef772549b3412b112 Mon Sep 17 00:00:00 2001
From: Arjun Raja Yogidas <arjunry@amazon.com>
Date: Mon, 31 Mar 2025 17:12:56 +0000
Subject: [PATCH 041/225] fix: Pass ps_args as option to container top

Signed-off-by: Arjun Raja Yogidas <arjunry@amazon.com>
---
 cmd/nerdctl/container/container_top.go | 12 +++++++++++-
 pkg/api/types/container_types.go       |  3 +++
 pkg/cmd/container/top.go               |  3 +--
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/cmd/nerdctl/container/container_top.go b/cmd/nerdctl/container/container_top.go
index d6ec4702260..6c802ce841a 100644
--- a/cmd/nerdctl/container/container_top.go
+++ b/cmd/nerdctl/container/container_top.go
@@ -19,6 +19,7 @@ package container
 import (
 	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/spf13/cobra"
 
@@ -66,9 +67,18 @@ func topAction(cmd *cobra.Command, args []string) error {
 		return err
 	}
 	defer cancel()
-	return container.Top(ctx, client, args, types.ContainerTopOptions{
+
+	containerID := args[0]
+	var psArgs string
+	if len(args) > 1 {
+		// Join all remaining arguments as ps args
+		psArgs = strings.Join(args[1:], " ")
+	}
+
+	return container.Top(ctx, client, []string{containerID}, types.ContainerTopOptions{
 		Stdout:   cmd.OutOrStdout(),
 		GOptions: globalOptions,
+		PsArgs:   psArgs,
 	})
 
 }
diff --git a/pkg/api/types/container_types.go b/pkg/api/types/container_types.go
index 5325915631d..6505f4aaca4 100644
--- a/pkg/api/types/container_types.go
+++ b/pkg/api/types/container_types.go
@@ -343,6 +343,9 @@ type ContainerTopOptions struct {
 	Stdout io.Writer
 	// GOptions is the global options
 	GOptions GlobalCommandOptions
+
+	// Arguments to pass through to the ps command
+	PsArgs string
 }
 
 // ContainerInspectOptions specifies options for `nerdctl container inspect`
diff --git a/pkg/cmd/container/top.go b/pkg/cmd/container/top.go
index 35addf54887..474958715ed 100644
--- a/pkg/cmd/container/top.go
+++ b/pkg/cmd/container/top.go
@@ -28,7 +28,6 @@ package container
 import (
 	"context"
 	"fmt"
-	"strings"
 
 	containerd "github.com/containerd/containerd/v2/client"
 
@@ -60,7 +59,7 @@ func Top(ctx context.Context, client *containerd.Client, containers []string, op
 			if found.MatchCount > 1 {
 				return fmt.Errorf("multiple IDs found with provided prefix: %s", found.Req)
 			}
-			return containerTop(ctx, opt.Stdout, client, found.Container.ID(), strings.Join(containers[1:], " "))
+			return containerTop(ctx, opt.Stdout, client, found.Container.ID(), opt.PsArgs)
 		},
 	}
 

From 26fb66fe73b682f0fdd23a37161f6317f191154d Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Mon, 31 Mar 2025 18:36:31 -0700
Subject: [PATCH 042/225] Mute noisy test pull logs

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/container/container_run_stargz_linux_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmd/nerdctl/container/container_run_stargz_linux_test.go b/cmd/nerdctl/container/container_run_stargz_linux_test.go
index 3132b28f9b9..3298a492130 100644
--- a/cmd/nerdctl/container/container_run_stargz_linux_test.go
+++ b/cmd/nerdctl/container/container_run_stargz_linux_test.go
@@ -35,7 +35,7 @@ func TestRunStargz(t *testing.T) {
 		require.Not(nerdtest.Docker),
 	)
 
-	testCase.Command = test.Command("--snapshotter=stargz", "run", "--rm", testutil.FedoraESGZImage, "ls", "/.stargz-snapshotter")
+	testCase.Command = test.Command("--snapshotter=stargz", "run", "--quiet", "--rm", testutil.FedoraESGZImage, "ls", "/.stargz-snapshotter")
 
 	testCase.Expected = test.Expects(0, nil, nil)
 

From 751c1eb5a10b6a2d35f94a9196ee54e6c9a69034 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Mon, 31 Mar 2025 09:34:04 -0700
Subject: [PATCH 043/225] Fix content digest not found

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 pkg/cmd/builder/build.go         |  2 +-
 pkg/cmd/image/convert.go         |  4 +--
 pkg/cmd/image/crypt.go           |  3 +-
 pkg/cmd/image/push.go            | 10 ++++--
 pkg/cmd/image/remove.go          |  4 +++
 pkg/cmd/image/tag.go             |  3 +-
 pkg/imgutil/converter/convert.go | 55 ++++++++++++++++++++++++++++++++
 7 files changed, 74 insertions(+), 7 deletions(-)
 create mode 100644 pkg/imgutil/converter/convert.go

diff --git a/pkg/cmd/builder/build.go b/pkg/cmd/builder/build.go
index 4fb69ccd1fb..c25287bb441 100644
--- a/pkg/cmd/builder/build.go
+++ b/pkg/cmd/builder/build.go
@@ -127,7 +127,7 @@ func Build(ctx context.Context, client *containerd.Client, options types.Builder
 			if _, err := imageService.Create(ctx, image); err != nil {
 				// if already exists; skip.
 				if errors.Is(err, errdefs.ErrAlreadyExists) {
-					if err = imageService.Delete(ctx, targetRef); err != nil {
+					if err = imageService.Delete(ctx, targetRef, images.SynchronousDelete()); err != nil {
 						return err
 					}
 					if _, err = imageService.Create(ctx, image); err != nil {
diff --git a/pkg/cmd/image/convert.go b/pkg/cmd/image/convert.go
index 47fe2103355..460bf3c4091 100644
--- a/pkg/cmd/image/convert.go
+++ b/pkg/cmd/image/convert.go
@@ -190,7 +190,7 @@ func Convert(ctx context.Context, client *containerd.Client, srcRawRef, targetRa
 	}
 
 	// converter.Convert() gains the lease by itself
-	newImg, err := converter.Convert(ctx, client, targetRef, srcRef, convertOpts...)
+	newImg, err := converterutil.Convert(ctx, client, targetRef, srcRef, convertOpts...)
 	if err != nil {
 		return err
 	}
@@ -208,7 +208,7 @@ func Convert(ctx context.Context, client *containerd.Client, srcRawRef, targetRa
 			return err
 		}
 		is := client.ImageService()
-		_ = is.Delete(ctx, newI.Name)
+		_ = is.Delete(ctx, newI.Name, images.SynchronousDelete())
 		finimg, err := is.Create(ctx, *newI)
 		if err != nil {
 			return err
diff --git a/pkg/cmd/image/crypt.go b/pkg/cmd/image/crypt.go
index 981d39dfd51..47d62915243 100644
--- a/pkg/cmd/image/crypt.go
+++ b/pkg/cmd/image/crypt.go
@@ -30,6 +30,7 @@ import (
 	"github.com/containerd/imgcrypt/v2/images/encryption/parsehelpers"
 
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
+	nerdconverter "github.com/containerd/nerdctl/v2/pkg/imgutil/converter"
 	"github.com/containerd/nerdctl/v2/pkg/platformutil"
 	"github.com/containerd/nerdctl/v2/pkg/referenceutil"
 )
@@ -93,7 +94,7 @@ func Crypt(ctx context.Context, client *containerd.Client, srcRawRef, targetRawR
 	convertOpts = append(convertOpts, converter.WithIndexConvertFunc(convertFunc))
 
 	// converter.Convert() gains the lease by itself
-	newImg, err := converter.Convert(ctx, client, targetRef, srcRef, convertOpts...)
+	newImg, err := nerdconverter.Convert(ctx, client, targetRef, srcRef, convertOpts...)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/cmd/image/push.go b/pkg/cmd/image/push.go
index ac5602b6cce..0c463e76f02 100644
--- a/pkg/cmd/image/push.go
+++ b/pkg/cmd/image/push.go
@@ -43,6 +43,7 @@ import (
 
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
 	"github.com/containerd/nerdctl/v2/pkg/errutil"
+	nerdconverter "github.com/containerd/nerdctl/v2/pkg/imgutil/converter"
 	"github.com/containerd/nerdctl/v2/pkg/imgutil/dockerconfigresolver"
 	"github.com/containerd/nerdctl/v2/pkg/imgutil/push"
 	"github.com/containerd/nerdctl/v2/pkg/ipfs"
@@ -119,7 +120,12 @@ func Push(ctx context.Context, client *containerd.Client, rawRef string, options
 		pushRef = ref + "-tmp-reduced-platform"
 		// Push fails with "400 Bad Request" when the manifest is multi-platform but we do not locally have multi-platform blobs.
 		// So we create a tmp reduced-platform image to avoid the error.
-		platImg, err := converter.Convert(ctx, client, pushRef, ref, converter.WithPlatform(platMC))
+		// Ensure all the layers are here: https://github.com/containerd/nerdctl/issues/3425
+		err = EnsureAllContent(ctx, client, ref, platMC, options.GOptions)
+		if err != nil {
+			return err
+		}
+		platImg, err := nerdconverter.Convert(ctx, client, pushRef, ref, converter.WithPlatform(platMC))
 		if err != nil {
 			if len(options.Platforms) == 0 {
 				return fmt.Errorf("failed to create a tmp single-platform image %q: %w", pushRef, err)
@@ -132,7 +138,7 @@ func Push(ctx context.Context, client *containerd.Client, rawRef string, options
 
 	if options.Estargz {
 		pushRef = ref + "-tmp-esgz"
-		esgzImg, err := converter.Convert(ctx, client, pushRef, ref, converter.WithPlatform(platMC), converter.WithLayerConvertFunc(eStargzConvertFunc()))
+		esgzImg, err := nerdconverter.Convert(ctx, client, pushRef, ref, converter.WithPlatform(platMC), converter.WithLayerConvertFunc(eStargzConvertFunc()))
 		if err != nil {
 			return fmt.Errorf("failed to convert to eStargz: %v", err)
 		}
diff --git a/pkg/cmd/image/remove.go b/pkg/cmd/image/remove.go
index 6b9f78fd757..6baa1970d2e 100644
--- a/pkg/cmd/image/remove.go
+++ b/pkg/cmd/image/remove.go
@@ -79,6 +79,8 @@ func Remove(ctx context.Context, client *containerd.Client, args []string, optio
 
 			if cid, ok := runningImages[found.Image.Name]; ok {
 				if options.Force {
+					// FIXME: this is suspicious, but passing the opt seem to break some tests
+					// if err = is.Delete(ctx, found.Image.Name, delOpts...); err != nil {
 					if err = is.Delete(ctx, found.Image.Name); err != nil {
 						return err
 					}
@@ -126,6 +128,8 @@ func Remove(ctx context.Context, client *containerd.Client, args []string, optio
 
 			if cid, ok := runningImages[found.Image.Name]; ok {
 				if options.Force {
+					// FIXME: this is suspicious, but passing the opt seem to break some tests
+					// if err = is.Delete(ctx, found.Image.Name, delOpts...); err != nil {
 					if err = is.Delete(ctx, found.Image.Name); err != nil {
 						return false, err
 					}
diff --git a/pkg/cmd/image/tag.go b/pkg/cmd/image/tag.go
index dc975c9f8d0..60ab191d4f7 100644
--- a/pkg/cmd/image/tag.go
+++ b/pkg/cmd/image/tag.go
@@ -21,6 +21,7 @@ import (
 	"fmt"
 
 	containerd "github.com/containerd/containerd/v2/client"
+	"github.com/containerd/containerd/v2/core/images"
 	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
 
@@ -81,7 +82,7 @@ func Tag(ctx context.Context, client *containerd.Client, options types.ImageTagO
 	img.Name = parsedReference.String()
 	if _, err = imageService.Create(ctx, img); err != nil {
 		if errdefs.IsAlreadyExists(err) {
-			if err = imageService.Delete(ctx, img.Name); err != nil {
+			if err = imageService.Delete(ctx, img.Name, images.SynchronousDelete()); err != nil {
 				return err
 			}
 			if _, err = imageService.Create(ctx, img); err != nil {
diff --git a/pkg/imgutil/converter/convert.go b/pkg/imgutil/converter/convert.go
new file mode 100644
index 00000000000..5cb822e79c7
--- /dev/null
+++ b/pkg/imgutil/converter/convert.go
@@ -0,0 +1,55 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package converter
+
+import (
+	"context"
+
+	"github.com/containerd/containerd/v2/core/images"
+	"github.com/containerd/containerd/v2/core/images/converter"
+)
+
+// Something seems wrong in converter.Convert.
+// When dstRef != srcRef, convert will first forcefully delete dstRef,
+// *asynchronously*, then create the image.
+// This seems to cause a race conditions, and the deletion may kick in after the creation.
+// This here is to workaround the bug, by manually creating the image first,
+// then converting it in place (which avoid the problematic code-path).
+// See containerd upstream discussion https://github.com/containerd/containerd/pull/11628 and
+// nerdctl issues:
+// https://github.com/containerd/nerdctl/issues/3509#issuecomment-2398236766
+// https://github.com/containerd/nerdctl/issues/3513
+// Note this should be remove if/when containerd merges in a fix.
+
+func Convert(ctx context.Context, client converter.Client, dstRef, srcRef string, opts ...converter.Opt) (*images.Image, error) {
+	imageService := client.ImageService()
+
+	img, err := imageService.Get(ctx, srcRef)
+	if err != nil {
+		return nil, err
+	}
+
+	img.Name = dstRef
+
+	_ = imageService.Delete(ctx, img.Name, images.SynchronousDelete())
+
+	if _, err = imageService.Create(ctx, img); err != nil {
+		return nil, err
+	}
+
+	return converter.Convert(ctx, client, dstRef, dstRef, opts...)
+}

From 423fc1fc0a359cdc382551fa8c3d976c8dbf935d Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 29 Mar 2025 10:27:32 -0700
Subject: [PATCH 044/225] CI: quiet run output

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 Vagrantfile.freebsd | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Vagrantfile.freebsd b/Vagrantfile.freebsd
index f3a2e4a4d4a..96fffc4c51e 100644
--- a/Vagrantfile.freebsd
+++ b/Vagrantfile.freebsd
@@ -59,7 +59,7 @@ Vagrant.configure("2") do |config|
         set -eux -o pipefail
         daemon -o containerd.out containerd
         sleep 3
-        /root/go/bin/nerdctl run --rm --net=none dougrabson/freebsd-minimal:13 echo "Nerdctl is up and running."
+        /root/go/bin/nerdctl run --rm --quiet --net=none dougrabson/freebsd-minimal:13 echo "Nerdctl is up and running."
     SHELL
   end
 

From 0896078df423ff6accbcc2933eee4a8e2fb3fde1 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 29 Mar 2025 10:20:19 -0700
Subject: [PATCH 045/225] Add new command implementation

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/internal/com/command.go            | 443 +++++++++++++
 mod/tigron/internal/com/command_other.go      |  39 ++
 mod/tigron/internal/com/command_test.go       | 624 ++++++++++++++++++
 mod/tigron/internal/com/command_windows.go    |  25 +
 mod/tigron/internal/com/doc.go                |  25 +
 .../internal/com/package_benchmark_test.go    |  48 ++
 .../internal/com/package_example_test.go      | 262 ++++++++
 mod/tigron/internal/com/package_test.go       |  69 ++
 mod/tigron/internal/com/pipes.go              | 270 ++++++++
 mod/tigron/internal/logger/doc.go             |  21 +
 mod/tigron/internal/logger/logger.go          |  66 ++
 11 files changed, 1892 insertions(+)
 create mode 100644 mod/tigron/internal/com/command.go
 create mode 100644 mod/tigron/internal/com/command_other.go
 create mode 100644 mod/tigron/internal/com/command_test.go
 create mode 100644 mod/tigron/internal/com/command_windows.go
 create mode 100644 mod/tigron/internal/com/doc.go
 create mode 100644 mod/tigron/internal/com/package_benchmark_test.go
 create mode 100644 mod/tigron/internal/com/package_example_test.go
 create mode 100644 mod/tigron/internal/com/package_test.go
 create mode 100644 mod/tigron/internal/com/pipes.go
 create mode 100644 mod/tigron/internal/logger/doc.go
 create mode 100644 mod/tigron/internal/logger/logger.go

diff --git a/mod/tigron/internal/com/command.go b/mod/tigron/internal/com/command.go
new file mode 100644
index 00000000000..e71869d5ade
--- /dev/null
+++ b/mod/tigron/internal/com/command.go
@@ -0,0 +1,443 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package com
+
+import (
+	"context"
+	"errors"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/logger"
+)
+
+const (
+	defaultTimeout = 10 * time.Second
+	delayAfterWait = 100 * time.Millisecond
+)
+
+var (
+	// ErrTimeout is returned by Wait() in case a command fail to complete within allocated time.
+	ErrTimeout = errors.New("command timed out")
+	// ErrFailedStarting is returned by Run() and Wait() in case a command fails to start (eg:
+	// binary missing).
+	ErrFailedStarting = errors.New("command failed starting")
+	// ErrSignaled is returned by Wait() if a signal was sent to the command while running.
+	ErrSignaled = errors.New("command execution signaled")
+	// ErrExecutionFailed is returned by Wait() when a command executes but returns a non-zero error
+	// code.
+	ErrExecutionFailed = errors.New("command returned a non-zero exit code")
+	// ErrFailedSendingSignal may happen if sending a signal to an already terminated process.
+	ErrFailedSendingSignal = errors.New("failed sending signal")
+
+	// ErrExecAlreadyStarted is a system error normally indicating a bogus double call to Run().
+	ErrExecAlreadyStarted = errors.New("command has already been started (double `Run`)")
+	// ErrExecNotStarted is a system error normally indicating that Wait() has been called without
+	// first calling Run().
+	ErrExecNotStarted = errors.New("command has not been started (call `Run` first)")
+	// ErrExecAlreadyFinished is a system error indicating a double call to Wait().
+	ErrExecAlreadyFinished = errors.New("command is already finished")
+
+	errExecutionCancelled = errors.New("command execution cancelled")
+)
+
+type contextKey string
+
+// LoggerKey defines the key to attach a logger to on the context.
+const LoggerKey = contextKey("logger")
+
+// Result carries the resulting output of a command once it has finished.
+type Result struct {
+	Environ  []string
+	Stdout   string
+	Stderr   string
+	ExitCode int
+	Signal   os.Signal
+}
+
+type execution struct {
+	//nolint:containedctx
+	context context.Context
+	cancel  context.CancelFunc
+	command *exec.Cmd
+	pipes   *stdPipes
+	log     logger.Logger
+	err     error
+}
+
+// Command is a thin wrapper on-top of golang exec.Command.
+type Command struct {
+	Binary      string
+	PrependArgs []string
+	Args        []string
+	WrapBinary  string
+	WrapArgs    []string
+	Timeout     time.Duration
+
+	WorkingDir string
+	Env        map[string]string
+	// FIXME: EnvBlackList might change for a better mechanism (regexp and/or whitelist + blacklist)
+	EnvBlackList []string
+
+	writers []func() io.Reader
+
+	ptyStdout bool
+	ptyStderr bool
+	ptyStdin  bool
+
+	exec   *execution
+	mutex  sync.Mutex
+	result *Result
+}
+
+// Clone does just duplicate a command, resetting its execution.
+func (gc *Command) Clone() *Command {
+	com := &Command{
+		Binary:      gc.Binary,
+		PrependArgs: append([]string(nil), gc.PrependArgs...),
+		Args:        append([]string(nil), gc.Args...),
+		WrapBinary:  gc.WrapBinary,
+		WrapArgs:    append([]string(nil), gc.WrapArgs...),
+		Timeout:     gc.Timeout,
+
+		WorkingDir:   gc.WorkingDir,
+		Env:          map[string]string{},
+		EnvBlackList: append([]string(nil), gc.EnvBlackList...),
+
+		writers: append([]func() io.Reader(nil), gc.writers...),
+
+		ptyStdout: gc.ptyStdout,
+		ptyStderr: gc.ptyStderr,
+		ptyStdin:  gc.ptyStdin,
+	}
+
+	for k, v := range gc.Env {
+		com.Env[k] = v
+	}
+
+	return com
+}
+
+// WithPTY requests that the command be executed with a pty for std streams. Parameters allow
+// showing which streams
+// are to be tied to the pty.
+// This command has no effect if Run has already been called.
+func (gc *Command) WithPTY(stdin, stdout, stderr bool) {
+	gc.ptyStdout = stdout
+	gc.ptyStderr = stderr
+	gc.ptyStdin = stdin
+}
+
+// WithFeeder ensures that the provider function will be executed and its output fed to the command
+// stdin. WithFeeder, like Feed, can be used multiple times, and writes will be performed
+// sequentially, in order.
+// This command has no effect if Run has already been called.
+func (gc *Command) WithFeeder(writers ...func() io.Reader) {
+	gc.writers = append(gc.writers, writers...)
+}
+
+// Feed ensures that the provider reader will be copied on the command stdin.
+// Feed, like WithFeeder, can be used multiple times, and writes will be performed in sequentially,
+// in order.
+// This command has no effect if Run has already been called.
+func (gc *Command) Feed(reader io.Reader) {
+	gc.writers = append(gc.writers, func() io.Reader {
+		return reader
+	})
+}
+
+// Run starts the command in the background.
+// It may error out immediately if the command fails to start (ErrFailedStarting).
+func (gc *Command) Run(parentCtx context.Context) error {
+	// Lock
+	gc.mutex.Lock()
+	defer gc.mutex.Unlock()
+
+	// Protect against dumb calls
+	if gc.result != nil {
+		return ErrExecAlreadyFinished
+	} else if gc.exec != nil {
+		return ErrExecAlreadyStarted
+	}
+
+	var (
+		ctx       context.Context
+		ctxCancel context.CancelFunc
+		pipes     *stdPipes
+		cmd       *exec.Cmd
+		err       error
+	)
+
+	// Get a timing-out context
+	timeout := gc.Timeout
+	if timeout == 0 {
+		timeout = defaultTimeout
+	}
+
+	ctx, ctxCancel = context.WithTimeout(parentCtx, timeout)
+
+	// Create a contextual command, set the logger
+	cmd = gc.buildCommand(ctx)
+
+	// Get a debug-logger from the context
+	var (
+		log logger.Logger
+		ok  bool
+	)
+
+	if log, ok = parentCtx.Value(LoggerKey).(logger.Logger); !ok {
+		log = nil
+	}
+
+	conLog := logger.NewLogger(log).Set("command", cmd.String())
+	// FIXME: this is manual silencing of pipe logs (very noisy)
+	// It should be possible to enable this with some debug flag.
+	// Note that one probably never want this on unless they are actually debugging pipes issues...
+	emLog := logger.NewLogger(nil).Set("command", cmd.String())
+
+	gc.exec = &execution{
+		context: ctx,
+		cancel:  ctxCancel,
+		command: cmd,
+		log:     conLog,
+	}
+
+	// Prepare pipes
+	pipes, err = newStdPipes(ctx, emLog, gc.ptyStdout, gc.ptyStderr, gc.ptyStdin, gc.writers)
+	if err != nil {
+		ctxCancel()
+
+		gc.exec.err = errors.Join(ErrFailedStarting, err)
+
+		// No wrapping here - we do not even have pipes, and the command has not been started.
+
+		return gc.exec.err
+	}
+
+	// Attach pipes
+	gc.exec.pipes = pipes
+	cmd.Stdout = pipes.stdout.writer
+	cmd.Stderr = pipes.stderr.writer
+	cmd.Stdin = pipes.stdin.reader
+
+	// Start it
+	if err = cmd.Start(); err != nil {
+		// On failure, can the context, wrap whatever we have and return
+		gc.exec.log.Log("start failed", err)
+
+		gc.exec.err = errors.Join(ErrFailedStarting, err)
+
+		_ = gc.wrap()
+
+		defer ctxCancel()
+
+		return gc.exec.err
+	}
+
+	select {
+	case <-ctx.Done():
+		// There is no good reason for this to happen, so, log it
+		err = gc.wrap()
+
+		gc.exec.log.Log("stdout", gc.result.Stdout)
+		gc.exec.log.Log("stderr", gc.result.Stderr)
+		gc.exec.log.Log("exitcode", gc.result.ExitCode)
+		gc.exec.log.Log("err", err)
+		gc.exec.log.Log("ctxerr", ctx.Err())
+
+		return err
+	default:
+	}
+
+	return nil
+}
+
+// Wait should be called after Run(), and will return the outcome of the command execution.
+func (gc *Command) Wait() (*Result, error) {
+	gc.mutex.Lock()
+	defer gc.mutex.Unlock()
+
+	switch {
+	case gc.exec == nil:
+		return nil, ErrExecNotStarted
+	case gc.exec.err != nil:
+		return gc.result, gc.exec.err
+	case gc.result != nil:
+		return gc.result, ErrExecAlreadyFinished
+	}
+
+	// Cancel the context in any case now
+	defer gc.exec.cancel()
+
+	// Wait for the command
+	_ = gc.exec.command.Wait()
+
+	// Capture timeout and cancellation
+	select {
+	case <-gc.exec.context.Done():
+	default:
+	}
+
+	// Wrap the results and return
+	err := gc.wrap()
+
+	return gc.result, err
+}
+
+// Signal sends a signal to the command. It should be called after Run() but before Wait().
+func (gc *Command) Signal(sig os.Signal) error {
+	gc.mutex.Lock()
+	defer gc.mutex.Unlock()
+
+	if gc.exec == nil {
+		return ErrExecNotStarted
+	}
+
+	err := gc.exec.command.Process.Signal(sig)
+	if err != nil {
+		err = errors.Join(ErrFailedSendingSignal, err)
+	}
+
+	return err
+}
+
+func (gc *Command) wrap() error {
+	pipes := gc.exec.pipes
+	cmd := gc.exec.command
+	ctx := gc.exec.context
+
+	// Close and drain the pipes
+	pipes.closeCallee()
+	_ = pipes.ioGroup.Wait()
+	pipes.closeCaller()
+
+	// Get the status, exitCode, signal, error
+	var (
+		status   syscall.WaitStatus
+		signal   os.Signal
+		exitCode int
+		err      error
+	)
+
+	// XXXgolang: this is troubling. cmd.ProcessState.ExitCode() is always fine, even if
+	// cmd.ProcessState is nil.
+	exitCode = cmd.ProcessState.ExitCode()
+
+	if cmd.ProcessState != nil {
+		var ok bool
+		if status, ok = cmd.ProcessState.Sys().(syscall.WaitStatus); !ok {
+			panic("failed casting process state sys")
+		}
+
+		if status.Signaled() {
+			signal = status.Signal()
+			err = ErrSignaled
+		} else if exitCode != 0 {
+			err = ErrExecutionFailed
+		}
+	}
+
+	// Catch-up on the context
+	switch ctx.Err() {
+	case context.DeadlineExceeded:
+		err = ErrTimeout
+	case context.Canceled:
+		err = errExecutionCancelled
+	default:
+	}
+
+	// Stuff everything in Result and return err
+	gc.result = &Result{
+		ExitCode: exitCode,
+		Stdout:   pipes.fromStdout,
+		Stderr:   pipes.fromStderr,
+		Environ:  cmd.Environ(),
+		Signal:   signal,
+	}
+
+	if gc.exec.err == nil {
+		gc.exec.err = err
+	}
+
+	return gc.exec.err
+}
+
+func (gc *Command) buildCommand(ctx context.Context) *exec.Cmd {
+	// Build arguments and binary
+	args := gc.Args
+	if gc.PrependArgs != nil {
+		args = append(gc.PrependArgs, args...)
+	}
+
+	binary := gc.Binary
+
+	if gc.WrapBinary != "" {
+		args = append([]string{gc.Binary}, args...)
+		args = append(gc.WrapArgs, args...)
+		binary = gc.WrapBinary
+	}
+
+	//nolint:gosec
+	cmd := exec.CommandContext(ctx, binary, args...)
+
+	// Add dir
+	cmd.Dir = gc.WorkingDir
+
+	// Set wait delay after waits returns
+	cmd.WaitDelay = delayAfterWait
+
+	// Build env
+	cmd.Env = []string{}
+	// TODO: replace with regexps? and/or whitelist?
+	for _, envValue := range os.Environ() {
+		add := true
+
+		for _, b := range gc.EnvBlackList {
+			if b == "*" || strings.HasPrefix(envValue, b+"=") {
+				add = false
+
+				break
+			}
+		}
+
+		if add {
+			cmd.Env = append(cmd.Env, envValue)
+		}
+	}
+
+	// Attach any explicit env we have
+	for k, v := range gc.Env {
+		cmd.Env = append(cmd.Env, k+"="+v)
+	}
+
+	// Attach platform ProcAttr and get optional custom cancellation routine
+	if cancellation := addAttr(cmd); cancellation != nil {
+		cmd.Cancel = func() error {
+			gc.exec.log.Log("command cancelled")
+
+			// Call the platform dependent cancellation routine
+			return cancellation()
+		}
+	}
+
+	return cmd
+}
diff --git a/mod/tigron/internal/com/command_other.go b/mod/tigron/internal/com/command_other.go
new file mode 100644
index 00000000000..7bddc09c9ff
--- /dev/null
+++ b/mod/tigron/internal/com/command_other.go
@@ -0,0 +1,39 @@
+//go:build !windows
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package com
+
+import (
+	"os/exec"
+	"syscall"
+)
+
+func addAttr(cmd *exec.Cmd) func() error {
+	// Default shutdown will leave child processes behind in certain circumstances
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		Setsid: true,
+		// FIXME: understand why we would want that
+		// Setctty: true,
+	}
+
+	return func() error {
+		_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+
+		return nil
+	}
+}
diff --git a/mod/tigron/internal/com/command_test.go b/mod/tigron/internal/com/command_test.go
new file mode 100644
index 00000000000..04034f037b8
--- /dev/null
+++ b/mod/tigron/internal/com/command_test.go
@@ -0,0 +1,624 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package com_test
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"runtime"
+	"strconv"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
+	"github.com/containerd/nerdctl/mod/tigron/internal/com"
+)
+
+const windows = "windows"
+
+// Testing faulty code (double run, etc.)
+
+func TestFaultyDoubleRunWait(t *testing.T) {
+	// Double run returns an error on the second run, but Wait will still work properly
+	t.Parallel()
+
+	command := &com.Command{
+		Binary:  "printf",
+		Args:    []string{"one"},
+		Timeout: time.Second,
+	}
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	err = command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIs(t, err, com.ErrExecAlreadyStarted)
+
+	res, err := command.Wait()
+
+	assertive.ErrorIsNil(t, err)
+	assertive.IsEqual(t, expect.ExitCodeSuccess, res.ExitCode)
+	assertive.IsEqual(t, "one", res.Stdout)
+	assertive.IsEqual(t, "", res.Stderr)
+}
+
+func TestFaultyRunDoubleWait(t *testing.T) {
+	// Double wait returns an error on the second wait, but also returns the existing result
+	t.Parallel()
+
+	command := &com.Command{
+		Binary:  "printf",
+		Args:    []string{"one"},
+		Timeout: time.Second,
+	}
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err := command.Wait()
+
+	assertive.ErrorIsNil(t, err)
+	assertive.IsEqual(t, expect.ExitCodeSuccess, res.ExitCode)
+	assertive.IsEqual(t, "one", res.Stdout)
+	assertive.IsEqual(t, "", res.Stderr)
+
+	res, err = command.Wait()
+
+	assertive.ErrorIs(t, err, com.ErrExecAlreadyFinished)
+	assertive.IsEqual(t, expect.ExitCodeSuccess, res.ExitCode)
+	assertive.IsEqual(t, "one", res.Stdout)
+	assertive.IsEqual(t, "", res.Stderr)
+}
+
+func TestFailRun(t *testing.T) {
+	t.Parallel()
+
+	command := &com.Command{
+		Binary: "does-not-exist",
+	}
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIs(t, err, com.ErrFailedStarting)
+
+	err = command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIs(t, err, com.ErrExecAlreadyFinished)
+
+	res, err := command.Wait()
+
+	assertive.ErrorIs(t, err, com.ErrFailedStarting)
+	assertive.IsEqual(t, -1, res.ExitCode)
+	assertive.IsEqual(t, "", res.Stdout)
+	assertive.IsEqual(t, "", res.Stderr)
+
+	res, err = command.Wait()
+
+	assertive.ErrorIs(t, err, com.ErrFailedStarting)
+	assertive.IsEqual(t, -1, res.ExitCode)
+	assertive.IsEqual(t, "", res.Stdout)
+	assertive.IsEqual(t, "", res.Stderr)
+}
+
+func TestBasicRunWait(t *testing.T) {
+	t.Parallel()
+
+	command := &com.Command{
+		Binary: "printf",
+		Args:   []string{"one"},
+	}
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err := command.Wait()
+
+	assertive.ErrorIsNil(t, err)
+	assertive.IsEqual(t, 0, res.ExitCode)
+	assertive.IsEqual(t, "one", res.Stdout)
+	assertive.IsEqual(t, "", res.Stderr)
+}
+
+func TestBasicFail(t *testing.T) {
+	t.Parallel()
+
+	command := &com.Command{
+		Binary: "bash",
+		Args:   []string{"-c", "--", "does-not-exist"},
+	}
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err := command.Wait()
+
+	assertive.ErrorIs(t, err, com.ErrExecutionFailed)
+	assertive.IsEqual(t, 127, res.ExitCode)
+	assertive.IsEqual(t, "", res.Stdout)
+	assertive.StringHasSuffix(t, res.Stderr, "does-not-exist: command not found\n")
+}
+
+func TestWorkingDir(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	command := &com.Command{
+		Binary:     "pwd",
+		WorkingDir: dir,
+	}
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err := command.Wait()
+
+	assertive.ErrorIsNil(t, err)
+	assertive.IsEqual(t, 0, res.ExitCode)
+
+	// Note:
+	// - darwin will link to /private/DIR, so, check with HasSuffix
+	// - windows+ming will go to C:\Users\RUNNER~1\AppData\Local\Temp\, so, ignore Windows
+	if runtime.GOOS == windows {
+		t.Skip("skipping last check on windows, see note")
+	}
+
+	assertive.StringHasSuffix(t, res.Stdout, dir+"\n")
+}
+
+func TestEnvBlacklist(t *testing.T) {
+	t.Setenv("FOO", "BAR")
+	t.Setenv("FOOBAR", "BARBAR")
+
+	command := &com.Command{
+		Binary: "env",
+	}
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err := command.Wait()
+
+	assertive.ErrorIsNil(t, err)
+	assertive.IsEqual(t, 0, res.ExitCode)
+	assertive.StringContains(t, res.Stdout, "FOO=BAR")
+	assertive.StringContains(t, res.Stdout, "FOOBAR=BARBAR")
+
+	command = &com.Command{
+		Binary:       "env",
+		EnvBlackList: []string{"FOO"},
+	}
+
+	err = command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err = command.Wait()
+
+	assertive.ErrorIsNil(t, err)
+	assertive.IsEqual(t, res.ExitCode, 0)
+	assertive.StringDoesNotContain(t, res.Stdout, "FOO=BAR")
+	assertive.StringContains(t, res.Stdout, "FOOBAR=BARBAR")
+
+	// On windows, with mingw, SYSTEMROOT,TERM and HOME (possibly others) will be forcefully added
+	// to the environment regardless, so, we can't test "*" blacklist
+	if runtime.GOOS == windows {
+		t.Skip(
+			"Windows/mingw will always repopulate the environment with extra variables we cannot bypass",
+		)
+	}
+
+	command = &com.Command{
+		Binary:       "env",
+		EnvBlackList: []string{"*"},
+	}
+
+	err = command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err = command.Wait()
+
+	assertive.ErrorIsNil(t, err)
+	assertive.IsEqual(t, res.ExitCode, 0)
+	assertive.IsEqual(t, res.Stdout, "")
+}
+
+func TestEnvAdd(t *testing.T) {
+	t.Setenv("FOO", "BAR")
+	t.Setenv("BLED", "BLED")
+	t.Setenv("BAZ", "OLD")
+
+	command := &com.Command{
+		Binary: "env",
+		Env: map[string]string{
+			"FOO":  "REPLACE",
+			"BAR":  "NEW",
+			"BLED": "EXPLICIT",
+		},
+		EnvBlackList: []string{"BLED"},
+	}
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err := command.Wait()
+
+	assertive.ErrorIsNil(t, err)
+	assertive.IsEqual(t, res.ExitCode, 0)
+	assertive.StringContains(t, res.Stdout, "FOO=REPLACE")
+	assertive.StringContains(t, res.Stdout, "BAR=NEW")
+	assertive.StringContains(t, res.Stdout, "BAZ=OLD")
+	assertive.StringContains(t, res.Stdout, "BLED=EXPLICIT")
+}
+
+func TestStdoutStderr(t *testing.T) {
+	t.Parallel()
+
+	command := &com.Command{
+		Binary: "bash",
+		Args:   []string{"-c", "--", "printf onstdout; >&2 printf onstderr;"},
+	}
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err := command.Wait()
+
+	assertive.ErrorIsNil(t, err)
+	assertive.IsEqual(t, res.ExitCode, 0)
+	assertive.IsEqual(t, res.Stdout, "onstdout")
+	assertive.IsEqual(t, res.Stderr, "onstderr")
+}
+
+func TestTimeoutPlain(t *testing.T) {
+	t.Parallel()
+
+	start := time.Now()
+	command := &com.Command{
+		Binary: "bash",
+		// XXX unclear if windows is really able to terminate sleep 5, so, split it up to give it a
+		// chance...
+		Args:    []string{"-c", "--", "printf one; sleep 1; sleep 1; sleep 1; sleep 1; printf two"},
+		Timeout: 1 * time.Second,
+	}
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err := command.Wait()
+
+	end := time.Now()
+
+	assertive.ErrorIs(t, err, com.ErrTimeout)
+	assertive.IsEqual(t, res.ExitCode, -1)
+	assertive.IsEqual(t, res.Stdout, "one")
+	assertive.IsEqual(t, res.Stderr, "")
+	assertive.DurationIsLessThan(t, end.Sub(start), 2*time.Second)
+}
+
+func TestTimeoutDelayed(t *testing.T) {
+	t.Parallel()
+
+	start := time.Now()
+	command := &com.Command{
+		Binary: "bash",
+		// XXX unclear if windows is really able to terminate sleep 5, so, split it up to give it a
+		// chance...
+		Args:    []string{"-c", "--", "printf one; sleep 1; sleep 1; sleep 1; sleep 1; printf two"},
+		Timeout: 1 * time.Second,
+	}
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	time.Sleep(1 * time.Second)
+
+	res, err := command.Wait()
+
+	end := time.Now()
+
+	assertive.ErrorIs(t, err, com.ErrTimeout)
+	assertive.IsEqual(t, res.ExitCode, -1)
+	assertive.IsEqual(t, res.Stdout, "one")
+	assertive.IsEqual(t, res.Stderr, "")
+	assertive.DurationIsLessThan(t, end.Sub(start), 2*time.Second)
+}
+
+func TestPTYStdout(t *testing.T) {
+	t.Parallel()
+
+	if runtime.GOOS == windows {
+		t.Skip("PTY are not supported on Windows")
+	}
+
+	command := &com.Command{
+		Binary: "bash",
+		Args: []string{
+			"-c",
+			"--",
+			"[ -t 1 ] || { echo not a pty; exit 41; }; printf onstdout; >&2 printf onstderr;",
+		},
+		Timeout: 1 * time.Second,
+	}
+
+	command.WithPTY(false, true, false)
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err := command.Wait()
+
+	assertive.ErrorIsNil(t, err)
+	assertive.IsEqual(t, res.ExitCode, 0)
+	assertive.IsEqual(t, res.Stdout, "onstdout")
+	assertive.IsEqual(t, res.Stderr, "onstderr")
+}
+
+func TestPTYStderr(t *testing.T) {
+	t.Parallel()
+
+	if runtime.GOOS == windows {
+		t.Skip("PTY are not supported on Windows")
+	}
+
+	command := &com.Command{
+		Binary: "bash",
+		Args: []string{
+			"-c",
+			"--",
+			"[ -t 2 ] || { echo not a pty; exit 41; }; printf onstdout; >&2 printf onstderr;",
+		},
+		Timeout: 1 * time.Second,
+	}
+
+	command.WithPTY(false, false, true)
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err := command.Wait()
+
+	assertive.ErrorIsNil(t, err)
+	assertive.IsEqual(t, res.ExitCode, 0)
+	assertive.IsEqual(t, res.Stdout, "onstdout")
+	assertive.IsEqual(t, res.Stderr, "onstderr")
+}
+
+func TestPTYBoth(t *testing.T) {
+	t.Parallel()
+
+	if runtime.GOOS == windows {
+		t.Skip("PTY are not supported on Windows")
+	}
+
+	command := &com.Command{
+		Binary: "bash",
+		Args: []string{
+			"-c", "--", "[ -t 1 ] && [ -t 2 ] || { echo not a pty; exit 41; }; printf onstdout; >&2 printf onstderr;",
+		},
+		Timeout: 1 * time.Second,
+	}
+
+	command.WithPTY(true, true, true)
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err := command.Wait()
+
+	assertive.ErrorIsNil(t, err)
+	assertive.IsEqual(t, res.ExitCode, 0)
+	assertive.IsEqual(t, res.Stdout, "onstdoutonstderr")
+	assertive.IsEqual(t, res.Stderr, "")
+}
+
+func TestWriteStdin(t *testing.T) {
+	t.Parallel()
+
+	command := &com.Command{
+		Binary: "bash",
+		Args: []string{
+			"-c", "--",
+			"read line1; read line2; read line3; printf 'from stdin%s%s%s' \"$line1\" \"$line2\" \"$line3\";",
+		},
+		Timeout: 1 * time.Second,
+	}
+
+	command.WithFeeder(func() io.Reader {
+		time.Sleep(100 * time.Millisecond)
+
+		return strings.NewReader("hello first\n")
+	})
+
+	command.Feed(strings.NewReader("hello world\n"))
+	command.Feed(strings.NewReader("hello again\n"))
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err := command.Wait()
+
+	assertive.ErrorIsNil(t, err)
+	assertive.IsEqual(t, 0, res.ExitCode)
+	assertive.IsEqual(t, "from stdinhello firsthello worldhello again", res.Stdout)
+}
+
+func TestWritePTYStdin(t *testing.T) {
+	t.Parallel()
+
+	if runtime.GOOS == windows {
+		t.Skip("PTY are not supported on Windows")
+	}
+
+	command := &com.Command{
+		Binary:  "bash",
+		Args:    []string{"-c", "--", "[ -t 0 ] || { echo not a pty; exit 41; }; cat /dev/stdin"},
+		Timeout: 1 * time.Second,
+	}
+
+	command.WithPTY(true, false, false)
+
+	command.WithFeeder(func() io.Reader {
+		time.Sleep(100 * time.Millisecond)
+
+		return strings.NewReader("hello first")
+	})
+
+	command.Feed(strings.NewReader("hello world"))
+	command.Feed(strings.NewReader("hello again"))
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err := command.Wait()
+
+	assertive.ErrorIs(t, err, com.ErrTimeout)
+	assertive.IsEqual(t, -1, res.ExitCode)
+	assertive.IsEqual(t, "hello firsthello worldhello again", res.Stdout)
+}
+
+func TestSignalOnCompleted(t *testing.T) {
+	t.Parallel()
+
+	var usig os.Signal = syscall.SIGTERM
+
+	command := &com.Command{
+		Binary:  "true",
+		Timeout: 3 * time.Second,
+	}
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	_, err = command.Wait()
+
+	assertive.ErrorIsNil(t, err)
+
+	err = command.Signal(usig)
+
+	assertive.ErrorIs(t, err, com.ErrFailedSendingSignal)
+}
+
+// FIXME: this is not working as expected, and proc.Signal returns nil error while it should not.
+// func TestSignalTooLate(t *testing.T) {
+//	t.Parallel()
+//
+//	var usig os.Signal
+//	usig = syscall.SIGTERM
+//
+//	command := &com.Command{
+//		Binary:  "true",
+//		Timeout: 3 * time.Second,
+//	}
+//
+//  err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+//
+//	assertive.ErrorIsNil(t, err)
+//
+//	time.Sleep(1 * time.Second)
+//
+//	err = command.Signal(usig)
+//
+//	assertive.ErrorIs(t, err, com.ErrFailedSendingSignal)
+// }
+
+func TestSignalNormal(t *testing.T) {
+	t.Parallel()
+
+	var usig os.Signal = syscall.SIGTERM
+
+	sig, ok := usig.(syscall.Signal)
+	if !ok {
+		panic("sig cast failed")
+	}
+
+	command := &com.Command{
+		Binary: "bash",
+		Args: []string{
+			"-c", "--",
+			fmt.Sprintf(
+				"printf entry; sig_msg () { printf \"caught\"; exit 42; }; trap sig_msg %s; "+
+					"printf set; while true; do sleep 0.1; done",
+				strconv.Itoa(int(sig)),
+			),
+		},
+		Timeout: 3 * time.Second,
+	}
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	// A bit arbitrary - just want to wait for stdout to go through before sending the signal
+	time.Sleep(100 * time.Millisecond)
+
+	_ = command.Signal(usig)
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err := command.Wait()
+
+	assertive.ErrorIs(t, err, com.ErrExecutionFailed)
+	assertive.IsEqual(t, res.Stdout, "entrysetcaught")
+	assertive.IsEqual(t, res.Stderr, "")
+	assertive.IsEqual(t, res.ExitCode, 42)
+	assertive.True(t, res.Signal == nil)
+
+	command = &com.Command{
+		Binary:  "sleep",
+		Args:    []string{"10"},
+		Timeout: 3 * time.Second,
+	}
+
+	err = command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err)
+
+	err = command.Signal(usig)
+
+	assertive.ErrorIsNil(t, err)
+
+	res, err = command.Wait()
+
+	assertive.ErrorIs(t, err, com.ErrSignaled)
+	assertive.IsEqual(t, res.Stdout, "")
+	assertive.IsEqual(t, res.Stderr, "")
+	assertive.IsEqual(t, res.Signal, usig)
+	assertive.IsEqual(t, res.ExitCode, -1)
+}
diff --git a/mod/tigron/internal/com/command_windows.go b/mod/tigron/internal/com/command_windows.go
new file mode 100644
index 00000000000..32a66084a00
--- /dev/null
+++ b/mod/tigron/internal/com/command_windows.go
@@ -0,0 +1,25 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package com
+
+import (
+	"os/exec"
+)
+
+func addAttr(_ *exec.Cmd) func() error {
+	return nil
+}
diff --git a/mod/tigron/internal/com/doc.go b/mod/tigron/internal/com/doc.go
new file mode 100644
index 00000000000..f7b6764de37
--- /dev/null
+++ b/mod/tigron/internal/com/doc.go
@@ -0,0 +1,25 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package com is a lightweight wrapper around golang command execution.
+// It provides a simplified API to create commands with baked-in:
+// - timeout
+// - pty
+// - environment filtering
+// - stdin manipulation
+// - proper termination of the process group
+// - wrapping commands and prepended args
+package com
diff --git a/mod/tigron/internal/com/package_benchmark_test.go b/mod/tigron/internal/com/package_benchmark_test.go
new file mode 100644
index 00000000000..de3fdad8c42
--- /dev/null
+++ b/mod/tigron/internal/com/package_benchmark_test.go
@@ -0,0 +1,48 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package com_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/com"
+)
+
+// FIXME: this requires go 1.24 - uncomment when go 1.23 is out of support
+// func BenchmarkCommand(b *testing.B) {
+//	for b.Loop() {
+//		cmd := com.Command{
+//			Binary: "true",
+//		}
+//
+//		_ = cmd.Run()
+//		_, _ = cmd.Wait()
+//	}
+// }
+
+func BenchmarkCommandParallel(b *testing.B) {
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			cmd := &com.Command{
+				Binary: "true",
+			}
+			_ = cmd.Run(context.Background())
+			_, _ = cmd.Wait()
+		}
+	})
+}
diff --git a/mod/tigron/internal/com/package_example_test.go b/mod/tigron/internal/com/package_example_test.go
new file mode 100644
index 00000000000..38df0249fef
--- /dev/null
+++ b/mod/tigron/internal/com/package_example_test.go
@@ -0,0 +1,262 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package com_test
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/com"
+)
+
+func ExampleCommand() {
+	cmd := com.Command{
+		Binary: "printf",
+		Args:   []string{"hello world"},
+	}
+
+	err := cmd.Run(context.Background())
+	if err != nil {
+		fmt.Println("Run err:", err)
+
+		return
+	}
+
+	exec, err := cmd.Wait()
+	if err != nil {
+		fmt.Println("Wait err:", err)
+
+		return
+	}
+
+	fmt.Println("Exit code:", exec.ExitCode)
+	fmt.Println("Stdout:")
+	fmt.Println(exec.Stdout)
+	fmt.Println("Stderr:")
+	fmt.Println(exec.Stderr)
+
+	// Output:
+	// Exit code: 0
+	// Stdout:
+	// hello world
+	// Stderr:
+	//
+}
+
+func ExampleCommand_Signal() {
+	cmd := com.Command{
+		Binary:  "sleep",
+		Args:    []string{"3600"},
+		Timeout: time.Second,
+	}
+
+	err := cmd.Run(context.Background())
+	if err != nil {
+		fmt.Println("Run err:", err)
+
+		return
+	}
+
+	err = cmd.Signal(os.Interrupt)
+	if err != nil {
+		fmt.Println("Signal err:", err)
+
+		return
+	}
+
+	exec, err := cmd.Wait()
+	fmt.Println("Wait err:", err)
+	fmt.Println("Exit code:", exec.ExitCode)
+	fmt.Println("Stdout:")
+	fmt.Println(exec.Stdout)
+	fmt.Println("Stderr:")
+	fmt.Println(exec.Stderr)
+	fmt.Println("Signal:", exec.Signal)
+
+	// Output:
+	// Wait err: command execution signaled
+	// Exit code: -1
+	// Stdout:
+	//
+	// Stderr:
+	//
+	// Signal: interrupt
+}
+
+func ExampleCommand_WithPTY() {
+	cmd := &com.Command{
+		Binary: "bash",
+		Args: []string{
+			"-c",
+			"--",
+			"[ -t 1 ] || { echo not a pty; exit 41; }; printf onstdout; >&2 printf onstderr;",
+		},
+		Timeout: 1 * time.Second,
+	}
+
+	// The PTY can be set to any of stdin, stdout, stderr
+	// Note that PTY are supported only on Linux, Darwin and FreeBSD
+	cmd.WithPTY(false, true, false)
+
+	err := cmd.Run(context.Background())
+	if err != nil {
+		fmt.Println("Run err:", err)
+
+		return
+	}
+
+	exec, err := cmd.Wait()
+	if err != nil {
+		fmt.Println("Wait err:", err)
+
+		return
+	}
+
+	fmt.Println("Exit code:", exec.ExitCode)
+	fmt.Println("Stdout:")
+	fmt.Println(exec.Stdout)
+	fmt.Println("Stderr:")
+	fmt.Println(exec.Stderr)
+
+	// Output:
+	// Exit code: 0
+	// Stdout:
+	// onstdout
+	// Stderr:
+	// onstderr
+}
+
+func ExampleCommand_Feed() {
+	cmd := &com.Command{
+		Binary: "bash",
+		Args: []string{
+			"-c", "--",
+			"read line1; read line2; printf 'from stdin%s%s%s' \"$line1\" \"$line2\";",
+		},
+	}
+
+	// Use WithFeeder if you do want to perform additional tasks before feeding to stdin
+	cmd.WithFeeder(func() io.Reader {
+		time.Sleep(100 * time.Millisecond)
+
+		return strings.NewReader("hello world\n")
+	})
+
+	// Or use the simpler Feed if you just want to pass along content to stdin
+	// Note that successive calls to WithFeeder / Feed will be written to stdin in order.
+	cmd.Feed(strings.NewReader("hello again\n"))
+
+	err := cmd.Run(context.Background())
+	if err != nil {
+		fmt.Println("Run err:", err)
+
+		return
+	}
+
+	exec, err := cmd.Wait()
+	if err != nil {
+		fmt.Println("Wait err:", err)
+
+		return
+	}
+
+	fmt.Println("Exit code:", exec.ExitCode)
+	fmt.Println("Stdout:")
+	fmt.Println(exec.Stdout)
+	fmt.Println("Stderr:")
+	fmt.Println(exec.Stderr)
+
+	// Output:
+	// Exit code: 0
+	// Stdout:
+	// from stdinhello worldhello again
+	// Stderr:
+	//
+}
+
+func ExampleErrTimeout() {
+	cmd := &com.Command{
+		Binary:  "sleep",
+		Args:    []string{"3600"},
+		Timeout: time.Second,
+	}
+
+	err := cmd.Run(context.Background())
+	if err != nil {
+		fmt.Println("Run err:", err)
+
+		return
+	}
+
+	exec, err := cmd.Wait()
+	fmt.Println("Wait err:", err)
+	fmt.Println("Exit code:", exec.ExitCode)
+	fmt.Println("Stdout:")
+	fmt.Println(exec.Stdout)
+	fmt.Println("Stderr:")
+	fmt.Println(exec.Stderr)
+
+	// Output:
+	// Wait err: command timed out
+	// Exit code: -1
+	// Stdout:
+	//
+	// Stderr:
+	//
+}
+
+func ExampleErrFailedStarting() {
+	cmd := &com.Command{
+		Binary: "non-existent",
+	}
+
+	err := cmd.Run(context.Background())
+
+	fmt.Println("Run err:")
+	fmt.Println(err)
+
+	// Output:
+	// Run err:
+	// command failed starting
+	// exec: "non-existent": executable file not found in $PATH
+}
+
+func ExampleErrExecutionFailed() {
+	cmd := &com.Command{
+		Binary: "bash",
+		Args:   []string{"-c", "--", "does-not-exist"},
+	}
+
+	err := cmd.Run(context.Background())
+	if err != nil {
+		fmt.Println("Run err:", err)
+
+		return
+	}
+
+	exec, err := cmd.Wait()
+	fmt.Println("Wait err:", err)
+	fmt.Println("Exit code:", exec.ExitCode)
+
+	// Output:
+	// Wait err: command returned a non-zero exit code
+	// Exit code: 127
+}
diff --git a/mod/tigron/internal/com/package_test.go b/mod/tigron/internal/com/package_test.go
new file mode 100644
index 00000000000..1b6c1c5d526
--- /dev/null
+++ b/mod/tigron/internal/com/package_test.go
@@ -0,0 +1,69 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package com_test
+
+import (
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/highk"
+)
+
+func TestMain(m *testing.M) {
+	// Prep exit code
+	exitCode := 0
+	defer func() { os.Exit(exitCode) }()
+
+	var (
+		snapFile      *os.File
+		before, after []byte
+	)
+
+	if os.Getenv("HIGHK_EXPERIMENTAL_FD") != "" {
+		snapFile, _ = os.CreateTemp("", "fileleaks")
+		before, _ = highk.SnapshotOpenFiles(snapFile)
+	}
+
+	exitCode = m.Run()
+
+	if exitCode != 0 {
+		return
+	}
+
+	if os.Getenv("HIGHK_EXPERIMENTAL_FD") != "" {
+		after, _ = highk.SnapshotOpenFiles(snapFile)
+		diff := highk.Diff(string(before), string(after))
+
+		if len(diff) != 0 {
+			_, _ = fmt.Fprintln(os.Stderr, "Leaking file descriptors")
+
+			for _, file := range diff {
+				_, _ = fmt.Fprintln(os.Stderr, file)
+			}
+
+			exitCode = 1
+		}
+	}
+
+	if err := highk.FindGoRoutines(); err != nil {
+		_, _ = fmt.Fprintln(os.Stderr, "Leaking go routines")
+		_, _ = fmt.Fprintln(os.Stderr, err.Error())
+
+		exitCode = 1
+	}
+}
diff --git a/mod/tigron/internal/com/pipes.go b/mod/tigron/internal/com/pipes.go
new file mode 100644
index 00000000000..fc8f9e32baf
--- /dev/null
+++ b/mod/tigron/internal/com/pipes.go
@@ -0,0 +1,270 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package com
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"os"
+
+	"golang.org/x/sync/errgroup"
+	"golang.org/x/term"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/logger"
+	"github.com/containerd/nerdctl/mod/tigron/internal/pty"
+)
+
+var (
+	// ErrFailedCreating could be returned by newStdPipes() on pty creation failure.
+	ErrFailedCreating = errors.New("failed acquiring pipe")
+	// ErrFailedReading could be returned by the ioGroup in case the go routines fails to read out
+	// of a pipe.
+	ErrFailedReading = errors.New("failed reading")
+	// ErrFailedWriting could be returned by the ioGroup in case the go routines fails to write on a
+	// pipe.
+	ErrFailedWriting = errors.New("failed writing")
+)
+
+type pipe struct {
+	reader io.ReadCloser
+	writer io.WriteCloser
+}
+
+type stdPipes struct {
+	ioGroup    *errgroup.Group
+	stdin      *pipe
+	stdout     *pipe
+	stderr     *pipe
+	fromStdout string
+	fromStderr string
+	log        logger.Logger
+}
+
+func (pipes *stdPipes) closeCallee() {
+	// Failure to close will happen:
+	// 1. on a "normal" context timeout:
+	// - command is cancelled first (which forcibly closes the callee pipes)
+	// - then context deadline is hit
+	// - then closeCallee is called here
+	// 2. if we have a pty attached on both stdout and stderr
+	pipes.log.Helper()
+	pipes.log.Log("<- closing callee pipes")
+
+	if pipes.stdin.reader != nil {
+		if closeErr := pipes.stdin.reader.Close(); closeErr != nil {
+			pipes.log.Log(" x failed closing callee stdin", closeErr)
+		}
+	}
+
+	if pipes.stdout.writer != nil {
+		if closeErr := pipes.stdout.writer.Close(); closeErr != nil {
+			pipes.log.Log(" x failed closing callee stdout", closeErr)
+		}
+	}
+
+	if pipes.stderr.writer != nil {
+		if closeErr := pipes.stderr.writer.Close(); closeErr != nil {
+			pipes.log.Log(" x failed closing callee stderr", closeErr)
+		}
+	}
+}
+
+func (pipes *stdPipes) closeCaller() {
+	pipes.log.Helper()
+	pipes.log.Log("<- closing caller pipes")
+
+	if pipes.stdin.writer != nil {
+		if closeErr := pipes.stdin.writer.Close(); closeErr != nil {
+			pipes.log.Log(" x failed closing caller stdin", closeErr)
+		}
+	}
+
+	if pipes.stdout.reader != nil {
+		if closeErr := pipes.stdout.reader.Close(); closeErr != nil {
+			pipes.log.Log(" x failed closing caller stdout", closeErr)
+		}
+	}
+
+	if pipes.stderr.reader != nil {
+		if closeErr := pipes.stderr.reader.Close(); closeErr != nil {
+			pipes.log.Log(" x failed closing caller stderr", closeErr)
+		}
+	}
+}
+
+//nolint:gocognit
+func newStdPipes(
+	ctx context.Context,
+	log *logger.ConcreteLogger,
+	ptyStdout, ptyStderr, ptyStdin bool,
+	writers []func() io.Reader,
+) (pipes *stdPipes, err error) {
+	// Close everything cleanly in case we errored
+	defer func() {
+		if err != nil {
+			pipes.closeCallee()
+			pipes.closeCaller()
+		}
+	}()
+
+	log = log.Set(">", "pipes")
+	pipes = &stdPipes{
+		stdin:  &pipe{},
+		stdout: &pipe{},
+		stderr: &pipe{},
+		log:    log,
+	}
+
+	var (
+		mty *os.File
+		tty *os.File
+	)
+
+	// If we want a pty, configure it now
+	if ptyStdout || ptyStderr || ptyStdin {
+		pipes.log.Log("<- opening pty")
+
+		mty, tty, err = pty.Open()
+		if err != nil {
+			pipes.log.Log(" x failed opening pty", err)
+
+			return nil, errors.Join(ErrFailedCreating, err)
+		}
+
+		if _, err = term.MakeRaw(int(tty.Fd())); err != nil {
+			pipes.log.Log(" x failed making pty raw", err)
+
+			return nil, errors.Join(ErrFailedCreating, err)
+		}
+	}
+
+	if ptyStdin {
+		pipes.log.Log("<- assigning pty to stdin")
+
+		pipes.stdin.writer = mty
+		pipes.stdin.reader = tty
+	} else if len(writers) > 0 {
+		pipes.log.Log(" * assigning a pipe to stdin as we have writers")
+
+		// Only create a pipe for stdin if we intend on writing to stdin.
+		// Otherwise, processes awaiting end of stream will just hang there.
+		pipes.stdin.reader, pipes.stdin.writer, err = os.Pipe()
+		if err != nil {
+			pipes.log.Log(" x failed creating pipe for stdin", err)
+
+			return nil, errors.Join(ErrFailedCreating, err)
+		}
+	}
+
+	if ptyStdout {
+		pipes.log.Log("<- assigning pty to stdout")
+
+		pipes.stdout.writer = tty
+		pipes.stdout.reader = mty
+	} else {
+		pipes.stdout.reader, pipes.stdout.writer, err = os.Pipe()
+		if err != nil {
+			pipes.log.Log(" x failed creating pipe for stdout", err)
+
+			return nil, errors.Join(ErrFailedCreating, err)
+		}
+	}
+
+	if ptyStderr {
+		pipes.log.Log("<- assigning pty to stderr")
+
+		pipes.stderr.writer = tty
+		pipes.stderr.reader = mty
+	} else {
+		pipes.stderr.reader, pipes.stderr.writer, err = os.Pipe()
+		if err != nil {
+			pipes.log.Log(" x failed creating pipe for stderr", err)
+
+			return nil, errors.Join(ErrFailedCreating, err)
+		}
+	}
+
+	// Prepare ioGroup
+	pipes.ioGroup, _ = errgroup.WithContext(ctx)
+
+	// Writers to stdin
+	pipes.ioGroup.Go(func() error {
+		pipes.log.Log("-> about to write to stdin")
+
+		for _, writer := range writers {
+			if _, copyErr := io.Copy(pipes.stdin.writer, writer()); copyErr != nil {
+				pipes.log.Log(" x failed writing to stdin", copyErr)
+
+				return errors.Join(ErrFailedWriting, copyErr)
+			}
+		}
+
+		pipes.log.Log("<- done writing to stdin")
+
+		if !ptyStdin && pipes.stdin.writer != nil {
+			if closeErr := pipes.stdin.writer.Close(); closeErr != nil {
+				pipes.log.Log(" x failed closing caller stdin", closeErr)
+			}
+		}
+
+		return nil
+	})
+
+	// Read stdout...
+	pipes.ioGroup.Go(func() error {
+		pipes.log.Log("-> about to read stdout")
+
+		buf := &bytes.Buffer{}
+		_, copyErr := io.Copy(buf, pipes.stdout.reader)
+		pipes.fromStdout = buf.String()
+
+		if copyErr != nil {
+			pipes.log.Log(" x failed reading from stdout", copyErr)
+
+			copyErr = errors.Join(ErrFailedReading, copyErr)
+		}
+
+		pipes.log.Log("<- done reading stdout")
+
+		return copyErr
+	})
+
+	// ... and stderr (if not the same - eg: pty)
+	if pipes.stderr.reader != pipes.stdout.reader {
+		pipes.ioGroup.Go(func() error {
+			pipes.log.Log("-> about to read stderr")
+
+			buf := &bytes.Buffer{}
+			_, copyErr := io.Copy(buf, pipes.stderr.reader)
+			pipes.fromStderr = buf.String()
+
+			if copyErr != nil {
+				pipes.log.Log(" x failed reading from stderr", copyErr)
+
+				copyErr = errors.Join(ErrFailedReading, copyErr)
+			}
+
+			pipes.log.Log("<- done reading stderr")
+
+			return copyErr
+		})
+	}
+
+	return pipes, nil
+}
diff --git a/mod/tigron/internal/logger/doc.go b/mod/tigron/internal/logger/doc.go
new file mode 100644
index 00000000000..29cbb608fd6
--- /dev/null
+++ b/mod/tigron/internal/logger/doc.go
@@ -0,0 +1,21 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package logger is a very simple stub allowing developers to hook whatever logger they want to
+// debug internal behavior of the com package.
+// The passed logger just has to implement the Log(args...interface{}) method.
+// Typically, that would be testing.T.
+package logger
diff --git a/mod/tigron/internal/logger/logger.go b/mod/tigron/internal/logger/logger.go
new file mode 100644
index 00000000000..7fa26e5b718
--- /dev/null
+++ b/mod/tigron/internal/logger/logger.go
@@ -0,0 +1,66 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package logger
+
+import (
+	"time"
+)
+
+// Logger describes a passed logger, useful only for debugging.
+type Logger interface {
+	Log(args ...interface{})
+	Helper()
+}
+
+// ConcreteLogger is a simple struct allowing to set additional metadata for a Logger.
+type ConcreteLogger struct {
+	meta       []interface{}
+	wrappedLog Logger
+}
+
+// Set allows attaching metadata to the logger display.
+func (cl *ConcreteLogger) Set(key, value string) *ConcreteLogger {
+	return &ConcreteLogger{
+		meta:       append(cl.meta, "["+key+"="+value+"]"),
+		wrappedLog: cl.wrappedLog,
+	}
+}
+
+// Log prints a message using the Log method of the embedded Logger.
+func (cl *ConcreteLogger) Log(args ...interface{}) {
+	if cl.wrappedLog != nil {
+		cl.wrappedLog.Helper()
+		cl.wrappedLog.Log(
+			append(
+				append([]interface{}{"[" + time.Now().Format(time.RFC3339) + "]"}, cl.meta...),
+				args...)...)
+	}
+}
+
+// Helper is called so that traces from t.Log are not linking to the logger methods themselves.
+func (cl *ConcreteLogger) Helper() {
+	if cl.wrappedLog != nil {
+		cl.wrappedLog.Helper()
+	}
+}
+
+// NewLogger returns a new concrete logger from a struct satisfying the Logger interface.
+func NewLogger(logger Logger) *ConcreteLogger {
+	return &ConcreteLogger{
+		wrappedLog: logger,
+	}
+}

From 37d4d289c3a92980b159270921249c9011a53313 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 29 Mar 2025 10:21:13 -0700
Subject: [PATCH 046/225] Enhance comparators debugging info

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/expect/comparators.go         | 12 +++++++++---
 mod/tigron/expect/{consts.go => exit.go} |  9 ++++++---
 2 files changed, 15 insertions(+), 6 deletions(-)
 rename mod/tigron/expect/{consts.go => exit.go} (83%)

diff --git a/mod/tigron/expect/comparators.go b/mod/tigron/expect/comparators.go
index d6c6c8731f5..17edc209588 100644
--- a/mod/tigron/expect/comparators.go
+++ b/mod/tigron/expect/comparators.go
@@ -17,6 +17,7 @@
 package expect
 
 import (
+	"encoding/hex"
 	"fmt"
 	"regexp"
 	"strings"
@@ -45,7 +46,8 @@ func Contains(compare string) test.Comparator {
 	return func(stdout, info string, t *testing.T) {
 		t.Helper()
 		assertive.Check(t, strings.Contains(stdout, compare),
-			fmt.Sprintf("Output does not contain: %q", compare)+info)
+			fmt.Sprintf("Output does not contain: %q", compare),
+			info)
 	}
 }
 
@@ -56,7 +58,7 @@ func DoesNotContain(compare string) test.Comparator {
 	return func(stdout, info string, t *testing.T) {
 		t.Helper()
 		assertive.Check(t, !strings.Contains(stdout, compare),
-			fmt.Sprintf("Output should not contain: %q", compare)+info)
+			fmt.Sprintf("Output should not contain: %q", compare), info)
 	}
 }
 
@@ -65,10 +67,14 @@ func Equals(compare string) test.Comparator {
 	//nolint:thelper
 	return func(stdout, info string, t *testing.T) {
 		t.Helper()
+
+		hexdump := hex.Dump([]byte(stdout))
 		assertive.Check(
 			t,
 			compare == stdout,
-			fmt.Sprintf("Output is not equal to: %q", compare)+info,
+			fmt.Sprintf("Output is not equal to: %q", compare),
+			"\n"+hexdump,
+			info,
 		)
 	}
 }
diff --git a/mod/tigron/expect/consts.go b/mod/tigron/expect/exit.go
similarity index 83%
rename from mod/tigron/expect/consts.go
rename to mod/tigron/expect/exit.go
index 2abab2235b2..4ebdf0df594 100644
--- a/mod/tigron/expect/consts.go
+++ b/mod/tigron/expect/exit.go
@@ -21,9 +21,12 @@ const (
 	ExitCodeSuccess = 0
 	// ExitCodeGenericFail will verify that the command ran and exited with a non-zero error code.
 	// This does NOT include timeouts, cancellation, or signals.
-	ExitCodeGenericFail = -1
+	ExitCodeGenericFail = -10
 	// ExitCodeNoCheck does not enforce any check at all on the function.
-	ExitCodeNoCheck = -2
+	ExitCodeNoCheck = -11
 	// ExitCodeTimeout verifies that the command was cancelled on timeout.
-	ExitCodeTimeout = -3
+	ExitCodeTimeout = -12
+	// ExitCodeSignaled verifies that the command has been terminated by a signal.
+	ExitCodeSignaled = -13
+	// ExitCodeCancelled = -14.
 )

From cb8668df8920d209556c896beacbebde19b3745a Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 29 Mar 2025 10:25:05 -0700
Subject: [PATCH 047/225] Adapt tooling to the new command implementation

- use internal/com instead of icmd
- move pty from test/internal to internal
- update go mod, sum, and depguard

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/.golangci.yml                      |   1 -
 mod/tigron/go.mod                             |  12 +-
 mod/tigron/go.sum                             |  16 +-
 .../internal/consts.go => internal/exit.go}   |  13 +-
 mod/tigron/{test => }/internal/pty/pty.go     |   0
 mod/tigron/test/case.go                       |   2 +-
 mod/tigron/test/command.go                    | 381 +++++++-----------
 mod/tigron/test/helpers.go                    |   6 +-
 mod/tigron/test/interfaces.go                 |  21 +-
 9 files changed, 191 insertions(+), 261 deletions(-)
 rename mod/tigron/{test/internal/consts.go => internal/exit.go} (77%)
 rename mod/tigron/{test => }/internal/pty/pty.go (100%)

diff --git a/mod/tigron/.golangci.yml b/mod/tigron/.golangci.yml
index 2395687bac8..4e312afa579 100644
--- a/mod/tigron/.golangci.yml
+++ b/mod/tigron/.golangci.yml
@@ -30,7 +30,6 @@ linters:
             - github.com/creack/pty
             - golang.org/x/sync
             - golang.org/x/term
-            - gotest.tools/v3
             - go.uber.org/goleak
     staticcheck:
       checks:
diff --git a/mod/tigron/go.mod b/mod/tigron/go.mod
index 8e81eb56a19..6979d174148 100644
--- a/mod/tigron/go.mod
+++ b/mod/tigron/go.mod
@@ -1,16 +1,12 @@
 module github.com/containerd/nerdctl/mod/tigron
 
-go 1.23
+go 1.23.0
 
 require (
 	github.com/creack/pty v1.1.24
 	go.uber.org/goleak v1.3.0
-	golang.org/x/sync v0.11.0
-	golang.org/x/term v0.29.0
-	gotest.tools/v3 v3.5.2
+	golang.org/x/sync v0.12.0
+	golang.org/x/term v0.30.0
 )
 
-require (
-	github.com/google/go-cmp v0.6.0 // indirect
-	golang.org/x/sys v0.30.0 // indirect
-)
+require golang.org/x/sys v0.31.0 // indirect
diff --git a/mod/tigron/go.sum b/mod/tigron/go.sum
index a38084b4f4c..b6ba6f6badb 100644
--- a/mod/tigron/go.sum
+++ b/mod/tigron/go.sum
@@ -2,21 +2,17 @@ github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
 github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
-golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
-golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
-golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
+golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
+golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
+golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
-gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
diff --git a/mod/tigron/test/internal/consts.go b/mod/tigron/internal/exit.go
similarity index 77%
rename from mod/tigron/test/internal/consts.go
rename to mod/tigron/internal/exit.go
index 2fcb2680c87..3fddd602491 100644
--- a/mod/tigron/test/internal/consts.go
+++ b/mod/tigron/internal/exit.go
@@ -17,13 +17,16 @@
 // Package internal provides an assert library, pty, a command wrapper, and a leak detection library
 // for internal use in Tigron.
 // The objective for these is not to become generic use-cases libraries, but instead to deliver what
-// Tigron needs in the simplest possible form.
+// Tigron needs
+// in the simplest possible form.
 package internal
 
-// This is duplicated form `expect` to avoid circular imports.
+// This is duplicated from `expect` to avoid circular imports.
 const (
 	ExitCodeSuccess     = 0
-	ExitCodeGenericFail = -1
-	ExitCodeNoCheck     = -2
-	ExitCodeTimeout     = -3
+	ExitCodeGenericFail = -10
+	ExitCodeNoCheck     = -11
+	ExitCodeTimeout     = -12
+	ExitCodeSignaled    = -13
+	// ExitCodeCancelled = -14.
 )
diff --git a/mod/tigron/test/internal/pty/pty.go b/mod/tigron/internal/pty/pty.go
similarity index 100%
rename from mod/tigron/test/internal/pty/pty.go
rename to mod/tigron/internal/pty/pty.go
diff --git a/mod/tigron/test/case.go b/mod/tigron/test/case.go
index e72e13a7c6b..3ec3574a4d7 100644
--- a/mod/tigron/test/case.go
+++ b/mod/tigron/test/case.go
@@ -111,7 +111,7 @@ func (test *Case) Run(t *testing.T) {
 
 		var custCom CustomizableCommand
 		if registeredTestable == nil {
-			custCom = &GenericCommand{}
+			custCom = NewGenericCommand()
 		} else {
 			custCom = registeredTestable.CustomCommand(test, test.t)
 		}
diff --git a/mod/tigron/test/command.go b/mod/tigron/test/command.go
index 05c7a2d798e..a8ed09e4524 100644
--- a/mod/tigron/test/command.go
+++ b/mod/tigron/test/command.go
@@ -18,7 +18,7 @@
 package test
 
 import (
-	"bytes"
+	"context"
 	"fmt"
 	"io"
 	"os"
@@ -26,18 +26,19 @@ import (
 	"testing"
 	"time"
 
-	"golang.org/x/sync/errgroup"
-	"golang.org/x/term"
-	"gotest.tools/v3/icmd"
-
+	"github.com/containerd/nerdctl/mod/tigron/internal"
 	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
-	"github.com/containerd/nerdctl/mod/tigron/test/internal"
-	"github.com/containerd/nerdctl/mod/tigron/test/internal/pty"
+	"github.com/containerd/nerdctl/mod/tigron/internal/com"
 )
 
+const defaultExecutionTimeout = 3 * time.Minute
+
 // CustomizableCommand is an interface meant for people who want to heavily customize the base
-// command
-// of their test case.
+// command of their test case.
+// FIXME: now that most of the logic got moved to the internal command, consider simplifying this /
+// removing some of the extra layers from here
+//
+//nolint:interfacebloat
 type CustomizableCommand interface {
 	TestableCommand
 
@@ -45,6 +46,8 @@ type CustomizableCommand interface {
 	// WithBlacklist allows to filter out unwanted variables from the embedding environment -
 	// default it pass any that is defined by WithEnv
 	WithBlacklist(env []string)
+	// T returns the current testing object
+	T() *testing.T
 
 	// withEnv *copies* the passed map to the environment of the command to be executed
 	// Note that this will override any variable defined in the embedding environment
@@ -54,10 +57,10 @@ type CustomizableCommand interface {
 	// WithConfig allows passing custom config properties from the test to the base command
 	withConfig(config Config)
 	withT(t *testing.T)
-	// Clear does a clone, but will clear binary and arguments, but retain the env, or any other
-	// custom properties Gotcha: if GenericCommand is embedded with a custom Run and an overridden
-	// clear to return the embedding type
-	// the result will be the embedding command, no longer the GenericCommand
+	// Clear does a clone, but will clear binary and arguments while retaining the env, or any other
+	// custom properties Gotcha: if genericCommand is embedded with a custom Run and an overridden
+	// clear to return the embedding type the result will be the embedding command, no longer the
+	// genericCommand
 	clear() TestableCommand
 
 	// Will manipulate specific configuration option on the command
@@ -68,6 +71,19 @@ type CustomizableCommand interface {
 	read(key ConfigKey) ConfigValue
 }
 
+//nolint:ireturn
+func NewGenericCommand() CustomizableCommand {
+	genericCom := &GenericCommand{
+		Env: map[string]string{},
+		cmd: &com.Command{},
+	}
+
+	genericCom.cmd.Env = genericCom.Env
+	genericCom.cmd.Timeout = defaultExecutionTimeout
+
+	return genericCom
+}
+
 // GenericCommand is a concrete Command implementation.
 type GenericCommand struct {
 	Config  Config
@@ -76,164 +92,155 @@ type GenericCommand struct {
 
 	t *testing.T
 
-	helperBinary string
-	helperArgs   []string
-	prependArgs  []string
-	mainBinary   string
-	mainArgs     []string
-
-	envBlackList []string
-	stdin        io.Reader
-	async        bool
-	pty          bool
-	ptyWriters   []func(*os.File) error
-	timeout      time.Duration
-	workingDir   string
-
-	result    *icmd.Result
+	cmd   *com.Command
+	async bool
+
 	rawStdErr string
 }
 
 func (gc *GenericCommand) WithBinary(binary string) {
-	gc.mainBinary = binary
+	gc.cmd.Binary = binary
 }
 
 func (gc *GenericCommand) WithArgs(args ...string) {
-	gc.mainArgs = append(gc.mainArgs, args...)
+	gc.cmd.Args = append(gc.cmd.Args, args...)
 }
 
 func (gc *GenericCommand) WithWrapper(binary string, args ...string) {
-	gc.helperBinary = binary
-	gc.helperArgs = args
+	gc.cmd.WrapBinary = binary
+	gc.cmd.WrapArgs = args
 }
 
-func (gc *GenericCommand) WithPseudoTTY(writers ...func(*os.File) error) {
-	gc.pty = true
-	gc.ptyWriters = writers
+func (gc *GenericCommand) WithPseudoTTY() {
+	gc.cmd.WithPTY(true, true, false)
 }
 
-func (gc *GenericCommand) WithStdin(r io.Reader) {
-	gc.stdin = r
+func (gc *GenericCommand) Feed(r io.Reader) {
+	gc.cmd.Feed(r)
+}
+
+func (gc *GenericCommand) WithFeeder(fun func() io.Reader) {
+	gc.cmd.WithFeeder(fun)
 }
 
 func (gc *GenericCommand) WithCwd(path string) {
-	gc.workingDir = path
+	gc.cmd.WorkingDir = path
 }
 
-func (gc *GenericCommand) Run(expect *Expected) {
-	if gc.t != nil {
-		gc.t.Helper()
-	}
+func (gc *GenericCommand) WithBlacklist(env []string) {
+	gc.cmd.EnvBlackList = env
+}
+
+func (gc *GenericCommand) WithTimeout(timeout time.Duration) {
+	gc.cmd.Timeout = timeout
+}
 
-	var (
-		result *icmd.Result
-		env    []string
-		tty    *os.File
-		psty   *os.File
-		stdout string
-	)
+func (gc *GenericCommand) PrependArgs(args ...string) {
+	gc.cmd.PrependArgs = args
+}
 
-	output := &bytes.Buffer{}
-	copyGroup := &errgroup.Group{}
+func (gc *GenericCommand) Background() {
+	gc.async = true
 
-	//nolint:nestif
-	if !gc.async {
-		iCmdCmd := gc.boot()
-
-		if gc.pty {
-			psty, tty, _ = pty.Open()
-			_, _ = term.MakeRaw(int(tty.Fd()))
-
-			iCmdCmd.Stdin = tty
-			iCmdCmd.Stdout = tty
-
-			// Copy from the master
-			copyGroup.Go(func() error {
-				_, _ = io.Copy(output, psty)
-
-				return nil
-			})
-
-			// Cautiously start the command
-			startGroup := &errgroup.Group{}
-			startGroup.Go(func() error {
-				gc.result = icmd.StartCmd(iCmdCmd)
-				if gc.result.Error != nil {
-					gc.t.Log("start command failed")
-					gc.t.Log(gc.result.ExitCode)
-					gc.t.Log(gc.result.Error)
-
-					return gc.result.Error
-				}
-
-				for _, writer := range gc.ptyWriters {
-					err := writer(psty)
-					if err != nil {
-						gc.t.Log("writing to the pty failed")
-						gc.t.Log(err)
-
-						return err
-					}
-				}
-
-				return nil
-			})
-
-			// Let the error through for WaitOnCmd to handle
-			_ = startGroup.Wait()
-		} else {
-			// Run it
-			gc.result = icmd.StartCmd(iCmdCmd)
-		}
-	}
+	_ = gc.cmd.Run(context.WithValue(context.Background(), com.LoggerKey, gc.t))
+}
 
-	result = icmd.WaitOnCmd(gc.timeout, gc.result)
-	env = gc.result.Cmd.Env
+func (gc *GenericCommand) Signal(sig os.Signal) error {
+	//nolint:wrapcheck
+	return gc.cmd.Signal(sig)
+}
 
-	if gc.pty {
-		_ = tty.Close()
-		_ = psty.Close()
-		_ = copyGroup.Wait()
+func (gc *GenericCommand) Run(expect *Expected) {
+	if gc.t != nil {
+		gc.t.Helper()
 	}
 
-	stdout = result.Stdout()
-	if stdout == "" {
-		stdout = output.String()
+	if !gc.async {
+		_ = gc.cmd.Run(context.WithValue(context.Background(), com.LoggerKey, gc.t))
 	}
 
-	gc.rawStdErr = result.Stderr()
+	result, err := gc.cmd.Wait()
+	if result != nil {
+		gc.rawStdErr = result.Stderr
+	}
 
 	// Check our expectations, if any
 	if expect != nil {
-		// Build the debug string - additionally attach the env (which iCmd does not do)
-		debug := result.String() + "Env:\n" + strings.Join(env, "\n")
+		// Build the debug string
+		separator := "================================="
+		debugCommand := gc.cmd.Binary + " " + strings.Join(gc.cmd.Args, " ")
+		debugTimeout := gc.cmd.Timeout
+		debugWD := gc.cmd.WorkingDir
+
+		// FIXME: this is ugly af. Do better.
+		debug := fmt.Sprintf(
+			"\n%s\n| Command:\t%s\n| Working Dir:\t%s\n| Timeout:\t%s\n%s\n"+
+				"%s\n%s\n| Stderr:\n%s\n%s\n%s\n| Stdout:\n%s\n%s\n%s\n| Exit Code: %d\n| Signaled: %v\n| Err: %v\n%s",
+			separator,
+			debugCommand,
+			debugWD,
+			debugTimeout,
+			separator,
+			"\t"+strings.Join(result.Environ, "\n\t"),
+			separator,
+			separator,
+			result.Stderr,
+			separator,
+			separator,
+			result.Stdout,
+			separator,
+			result.ExitCode,
+			result.Signal,
+			err,
+			separator,
+		)
 
 		// ExitCode goes first
 		switch expect.ExitCode {
 		case internal.ExitCodeNoCheck:
-			// ExitCodeNoCheck means we do not care at all about exit code. It can be a failure, a
-			// success, or a timeout.
+			// ExitCodeNoCheck means we do not care at all about what happened. Fire and forget...
 		case internal.ExitCodeGenericFail:
-			// ExitCodeGenericFail means we expect an error (excluding timeout).
-			assertive.True(gc.t, result.ExitCode != 0,
-				"Expected exit code to be different than 0\n"+debug)
+			// ExitCodeGenericFail means we expect an error (excluding timeout, cancellation,
+			// signalling).
+			assertive.ErrorIs(
+				gc.t,
+				err,
+				com.ErrExecutionFailed,
+				"Command should have failed",
+				debug,
+			)
 		case internal.ExitCodeTimeout:
-			assertive.True(gc.t, expect.ExitCode == internal.ExitCodeTimeout,
-				"Command unexpectedly timed-out\n"+debug)
+			assertive.ErrorIs(
+				gc.t,
+				err,
+				com.ErrTimeout,
+				"Command should have timed out",
+				debug,
+			)
+		case internal.ExitCodeSignaled:
+			assertive.ErrorIs(
+				gc.t,
+				err,
+				com.ErrSignaled,
+				"Command should have been signaled",
+				debug,
+			)
+		case internal.ExitCodeSuccess:
+			assertive.ErrorIsNil(gc.t, err, "Command should have succeeded", debug)
 		default:
-			assertive.True(gc.t, expect.ExitCode == result.ExitCode,
-				fmt.Sprintf("Expected exit code: %d\n", expect.ExitCode)+debug)
+			assertive.IsEqual(gc.t, expect.ExitCode, result.ExitCode,
+				fmt.Sprintf("Expected exit code: %d\n", expect.ExitCode), debug)
 		}
 
 		// Range through the expected errors and confirm they are seen on stderr
 		for _, expectErr := range expect.Errors {
-			assertive.True(gc.t, strings.Contains(gc.rawStdErr, expectErr.Error()),
-				fmt.Sprintf("Expected error: %q to be found in stderr\n", expectErr.Error())+debug)
+			assertive.StringContains(gc.t, result.Stderr, expectErr.Error(),
+				fmt.Sprintf("Expected error: %q to be found in stderr\n", expectErr.Error()), debug)
 		}
 
 		// Finally, check the output if we are asked to
 		if expect.Output != nil {
-			expect.Output(stdout, debug, gc.t)
+			expect.Output(result.Stdout, debug, gc.t)
 		}
 	}
 }
@@ -242,27 +249,9 @@ func (gc *GenericCommand) Stderr() string {
 	return gc.rawStdErr
 }
 
-func (gc *GenericCommand) Background(timeout time.Duration) {
-	// Run it
-	gc.async = true
-
-	i := gc.boot()
-
-	gc.timeout = timeout
-	gc.result = icmd.StartCmd(i)
-}
-
-func (gc *GenericCommand) Signal(sig os.Signal) error {
-	return gc.result.Cmd.Process.Signal(sig) //nolint:wrapcheck
-}
-
 func (gc *GenericCommand) withEnv(env map[string]string) {
-	if gc.Env == nil {
-		gc.Env = map[string]string{}
-	}
-
 	for k, v := range env {
-		gc.Env[k] = v
+		gc.cmd.Env[k] = v
 	}
 }
 
@@ -270,33 +259,28 @@ func (gc *GenericCommand) withTempDir(path string) {
 	gc.TempDir = path
 }
 
-func (gc *GenericCommand) WithBlacklist(env []string) {
-	gc.envBlackList = env
-}
-
 func (gc *GenericCommand) withConfig(config Config) {
 	gc.Config = config
 }
 
-func (gc *GenericCommand) PrependArgs(args ...string) {
-	gc.prependArgs = append(gc.prependArgs, args...)
-}
-
 //nolint:ireturn
 func (gc *GenericCommand) Clone() TestableCommand {
 	// Copy the command and return a new one - with almost everything from the parent command
-	com := *gc
-	com.result = nil
-	com.stdin = nil
-	com.timeout = 0
-	com.rawStdErr = ""
+	clone := *gc
+	clone.rawStdErr = ""
+	clone.async = false
+
 	// Clone Env
-	com.Env = make(map[string]string, len(gc.Env))
+	clone.Env = make(map[string]string, len(gc.Env))
 	for k, v := range gc.Env {
-		com.Env[k] = v
+		clone.Env[k] = v
 	}
 
-	return &com
+	// Clone the underlying command
+	clone.cmd = gc.cmd.Clone()
+	clone.cmd.Env = clone.Env
+
+	return &clone
 }
 
 func (gc *GenericCommand) T() *testing.T {
@@ -305,21 +289,23 @@ func (gc *GenericCommand) T() *testing.T {
 
 //nolint:ireturn
 func (gc *GenericCommand) clear() TestableCommand {
-	com := *gc
-	com.mainBinary = ""
-	com.helperBinary = ""
-	com.mainArgs = []string{}
-	com.prependArgs = []string{}
-	com.helperArgs = []string{}
+	comcopy := *gc
+	// Reset internal command
+	comcopy.cmd = &com.Command{}
+	comcopy.rawStdErr = ""
+	comcopy.async = false
 	// Clone Env
-	com.Env = make(map[string]string, len(gc.Env))
+	comcopy.Env = make(map[string]string, len(gc.Env))
 	// Reset configuration
-	com.Config = &config{}
+	comcopy.Config = &config{}
+	// Copy the env
 	for k, v := range gc.Env {
-		com.Env[k] = v
+		comcopy.Env[k] = v
 	}
 
-	return &com
+	comcopy.cmd.Env = comcopy.Env
+
+	return &comcopy
 }
 
 func (gc *GenericCommand) withT(t *testing.T) {
@@ -334,58 +320,3 @@ func (gc *GenericCommand) read(key ConfigKey) ConfigValue {
 func (gc *GenericCommand) write(key ConfigKey, value ConfigValue) {
 	gc.Config.Write(key, value)
 }
-
-func (gc *GenericCommand) boot() icmd.Cmd {
-	// This is a helper function, not to appear in the debugging output
-	if gc.t != nil {
-		gc.t.Helper()
-	}
-
-	binary := gc.mainBinary
-	//nolint:gocritic
-	args := append(gc.prependArgs, gc.mainArgs...)
-
-	if gc.helperBinary != "" {
-		args = append([]string{binary}, args...)
-		args = append(gc.helperArgs, args...)
-		binary = gc.helperBinary
-	}
-
-	// Create the command and set the env
-	// TODO: do we really need iCmd?
-	gc.t.Log(binary, strings.Join(args, " "))
-
-	iCmdCmd := icmd.Command(binary, args...)
-	iCmdCmd.Env = []string{}
-
-	for _, envValue := range os.Environ() {
-		add := true
-
-		for _, b := range gc.envBlackList {
-			if strings.HasPrefix(envValue, b+"=") {
-				add = false
-
-				break
-			}
-		}
-
-		if add {
-			iCmdCmd.Env = append(iCmdCmd.Env, envValue)
-		}
-	}
-
-	// Ensure the subprocess gets executed in a temporary directory unless explicitly instructed
-	// otherwise
-	iCmdCmd.Dir = gc.workingDir
-
-	if gc.stdin != nil {
-		iCmdCmd.Stdin = gc.stdin
-	}
-
-	// Attach any extra env we have
-	for k, v := range gc.Env {
-		iCmdCmd.Env = append(iCmdCmd.Env, fmt.Sprintf("%s=%s", k, v))
-	}
-
-	return iCmdCmd
-}
diff --git a/mod/tigron/test/helpers.go b/mod/tigron/test/helpers.go
index 80725bd613d..3cc6cae6317 100644
--- a/mod/tigron/test/helpers.go
+++ b/mod/tigron/test/helpers.go
@@ -19,7 +19,7 @@ package test
 import (
 	"testing"
 
-	"github.com/containerd/nerdctl/mod/tigron/test/internal"
+	"github.com/containerd/nerdctl/mod/tigron/internal"
 )
 
 // This is the implementation of Helpers
@@ -75,7 +75,7 @@ func (help *helpersInternal) Err(args ...string) string {
 
 // Command will return a clone of your base command without running it.
 //
-//nolint:ireturn
+//nolint:ireturn,nolintlint
 func (help *helpersInternal) Command(args ...string) TestableCommand {
 	cc := help.cmdInternal.Clone()
 	cc.WithArgs(args...)
@@ -86,7 +86,7 @@ func (help *helpersInternal) Command(args ...string) TestableCommand {
 // Custom will return a command for the requested binary and args, with the environment of your test
 // (eg: Env, Cwd, etc.)
 //
-//nolint:ireturn
+//nolint:ireturn,nolintlint
 func (help *helpersInternal) Custom(binary string, args ...string) TestableCommand {
 	cc := help.cmdInternal.clear()
 	cc.WithBinary(binary)
diff --git a/mod/tigron/test/interfaces.go b/mod/tigron/test/interfaces.go
index ef7533e85a0..8f8727a8298 100644
--- a/mod/tigron/test/interfaces.go
+++ b/mod/tigron/test/interfaces.go
@@ -83,24 +83,29 @@ type TestableCommand interface { //nolint:interfacebloat
 	WithArgs(args ...string)
 	// WithWrapper allows wrapping a command with another command (for example: `time`).
 	WithWrapper(binary string, args ...string)
-	WithPseudoTTY(writers ...func(*os.File) error)
-	// WithStdin allows passing a reader to be used for stdin for the command.
-	WithStdin(r io.Reader)
+	// WithPseudoTTY will allocate a new pty and set the command stdin and stdout to it.
+	WithPseudoTTY()
 	// WithCwd allows specifying the working directory for the command.
 	WithCwd(path string)
+	// WithTimeout defines the execution timeout for a command.
+	WithTimeout(timeout time.Duration)
+	// WithFeeder allows passing a reader to be fed to the command stdin.
+	WithFeeder(fun func() io.Reader)
+	// Feed allows passing a reader to be fed to the command stdin.
+	Feed(r io.Reader)
 	// Clone returns a copy of the command.
 	Clone() TestableCommand
 
 	// Run does execute the command, and compare the output with the provided expectation.
 	// Passing nil for `Expected` will just run the command regardless of outcome.
 	// An empty `&Expected{}` is (of course) equivalent to &Expected{Exit: 0}, meaning the command
-	// is verified to be successful
+	// is verified to be successful.
 	Run(expect *Expected)
-	// Background allows starting a command in the background
-	Background(timeout time.Duration)
-	// Signal sends a signal to a backgrounded command
+	// Background allows starting a command in the background.
+	Background()
+	// Signal sends a signal to a backgrounded command.
 	Signal(sig os.Signal) error
-	// Stderr allows retrieving the raw stderr output of the command once it has been run
+	// Stderr allows retrieving the raw stderr output of the command once it has been run.
 	Stderr() string
 }
 

From 761330e60aa1c2f1b1133ed3cfcda43e49848015 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 29 Mar 2025 10:26:36 -0700
Subject: [PATCH 048/225] Enable leak detection for tests under test

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/internal/highk/fileleak.go |  4 +-
 mod/tigron/test/package_test.go       | 69 +++++++++++++++++++++++++++
 2 files changed, 71 insertions(+), 2 deletions(-)
 create mode 100644 mod/tigron/test/package_test.go

diff --git a/mod/tigron/internal/highk/fileleak.go b/mod/tigron/internal/highk/fileleak.go
index d6bc6e1bac6..af8da5fcfd3 100644
--- a/mod/tigron/internal/highk/fileleak.go
+++ b/mod/tigron/internal/highk/fileleak.go
@@ -30,8 +30,8 @@ import (
 //
 //nolint:gochecknoglobals
 var whitelist = map[string]bool{
-	"5u  KQUEUE":   true,
-	"10u  a_inode": true,
+	"KQUEUE":  true,
+	"a_inode": true,
 }
 
 // SnapshotOpenFiles will capture the list of currently open-files for the process.
diff --git a/mod/tigron/test/package_test.go b/mod/tigron/test/package_test.go
new file mode 100644
index 00000000000..5e10a796398
--- /dev/null
+++ b/mod/tigron/test/package_test.go
@@ -0,0 +1,69 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package test_test
+
+import (
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/highk"
+)
+
+func TestMain(m *testing.M) {
+	// Prep exit code
+	exitCode := 0
+	defer func() { os.Exit(exitCode) }()
+
+	var (
+		snapFile      *os.File
+		before, after []byte
+	)
+
+	if os.Getenv("HIGHK_EXPERIMENTAL_FD") != "" {
+		snapFile, _ = os.CreateTemp("", "fileleaks")
+		before, _ = highk.SnapshotOpenFiles(snapFile)
+	}
+
+	exitCode = m.Run()
+
+	if exitCode != 0 {
+		return
+	}
+
+	if os.Getenv("HIGHK_EXPERIMENTAL_FD") != "" {
+		after, _ = highk.SnapshotOpenFiles(snapFile)
+		diff := highk.Diff(string(before), string(after))
+
+		if len(diff) != 0 {
+			_, _ = fmt.Fprintln(os.Stderr, "Leaking file descriptors")
+
+			for _, file := range diff {
+				_, _ = fmt.Fprintln(os.Stderr, file)
+			}
+
+			exitCode = 1
+		}
+	}
+
+	if err := highk.FindGoRoutines(); err != nil {
+		_, _ = fmt.Fprintln(os.Stderr, "Leaking go routines")
+		_, _ = fmt.Fprintln(os.Stderr, os.Stderr, err.Error())
+
+		exitCode = 1
+	}
+}

From d9cd8f5eb274913e1f3227b3e2f7e13e57f49f4f Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 29 Mar 2025 10:28:18 -0700
Subject: [PATCH 049/225] Adapt nerdtest to updated tigron

- Background() signature change
- command creation change

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 pkg/testutil/nerdtest/command.go         | 10 ++++++----
 pkg/testutil/nerdtest/utilities_linux.go |  7 +++++--
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/pkg/testutil/nerdtest/command.go b/pkg/testutil/nerdtest/command.go
index 2675d07a78c..b979963d662 100644
--- a/pkg/testutil/nerdtest/command.go
+++ b/pkg/testutil/nerdtest/command.go
@@ -21,7 +21,6 @@ import (
 	"os/exec"
 	"path/filepath"
 	"testing"
-	"time"
 
 	"gotest.tools/v3/assert"
 
@@ -78,7 +77,10 @@ func newNerdCommand(conf test.Config, t *testing.T) *nerdCommand {
 	}
 
 	// Create the base command, with the right binary, t
-	ret := &nerdCommand{}
+	ret := &nerdCommand{
+		GenericCommand: *(test.NewGenericCommand().(*test.GenericCommand)),
+	}
+
 	ret.WithBinary(binary)
 	// Not interested in these - and insulate us from parent environment side effects
 	ret.WithBlacklist([]string{
@@ -113,9 +115,9 @@ func (nc *nerdCommand) Run(expect *test.Expected) {
 	nc.GenericCommand.Run(expect)
 }
 
-func (nc *nerdCommand) Background(timeout time.Duration) {
+func (nc *nerdCommand) Background() {
 	nc.prep()
-	nc.GenericCommand.Background(timeout)
+	nc.GenericCommand.Background()
 }
 
 // Run does override the generic command run, as we are testing both docker and nerdctl
diff --git a/pkg/testutil/nerdtest/utilities_linux.go b/pkg/testutil/nerdtest/utilities_linux.go
index 2a12bfd1aec..75c199acd25 100644
--- a/pkg/testutil/nerdtest/utilities_linux.go
+++ b/pkg/testutil/nerdtest/utilities_linux.go
@@ -47,7 +47,8 @@ func RunSigProxyContainer(signal os.Signal, exitOnSignal bool, args []string, da
 	trap sig_msg ` + sig + `
 	printf "` + ready + `\n"
 	while true; do
-		sleep 0.1
+		printf "waiting...\n"
+		sleep 0.5
 	done
 `
 
@@ -55,7 +56,9 @@ func RunSigProxyContainer(signal os.Signal, exitOnSignal bool, args []string, da
 	args = append([]string{"run"}, args...)
 
 	cmd := helpers.Command(args...)
-	cmd.Background(10 * time.Second)
+	// NOTE: because of a test like TestStopWithStopSignal, we need to wait enough for nerdctl to terminate the container
+	cmd.WithTimeout(20 * time.Second)
+	cmd.Background()
 	EnsureContainerStarted(helpers, data.Identifier())
 
 	for {

From e77c56163caa423c25a79b02f8c5545efffa9149 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 29 Mar 2025 10:32:15 -0700
Subject: [PATCH 050/225] Update tests to adopt tooling changes

- Background
- Feed, WithFeeder, WithPseudoTTY
- use exit code consts where appropriate
- some --quiet

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/builder/builder_build_test.go     |  4 +-
 cmd/nerdctl/builder/builder_builder_test.go   |  2 +-
 .../container/container_attach_linux_test.go  | 52 ++++++++-----------
 .../container/container_run_linux_test.go     | 19 +++----
 .../container/container_start_linux_test.go   | 15 +++---
 cmd/nerdctl/image/image_list_test.go          |  4 +-
 cmd/nerdctl/image/image_load_test.go          |  2 +-
 cmd/nerdctl/ipfs/ipfs_compose_linux_test.go   |  9 ++--
 cmd/nerdctl/ipfs/ipfs_registry_linux_test.go  |  7 +--
 cmd/nerdctl/issues/main_linux_test.go         |  4 +-
 cmd/nerdctl/main_test_test.go                 |  2 +-
 .../system/system_events_linux_test.go        |  4 +-
 cmd/nerdctl/volume/volume_create_test.go      |  2 +-
 13 files changed, 61 insertions(+), 65 deletions(-)

diff --git a/cmd/nerdctl/builder/builder_build_test.go b/cmd/nerdctl/builder/builder_build_test.go
index be8bc051a67..e4999a927ee 100644
--- a/cmd/nerdctl/builder/builder_build_test.go
+++ b/cmd/nerdctl/builder/builder_build_test.go
@@ -102,7 +102,7 @@ CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(-1, nil, nil),
+				Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 			},
 		},
 	}
@@ -234,7 +234,7 @@ func TestBuildFromStdin(t *testing.T) {
 			dockerfile := fmt.Sprintf(`FROM %s
 CMD ["echo", "nerdctl-build-test-stdin"]`, testutil.CommonImage)
 			cmd := helpers.Command("build", "-t", data.Identifier(), "-f", "-", ".")
-			cmd.WithStdin(strings.NewReader(dockerfile))
+			cmd.Feed(strings.NewReader(dockerfile))
 			return cmd
 		},
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
diff --git a/cmd/nerdctl/builder/builder_builder_test.go b/cmd/nerdctl/builder/builder_builder_test.go
index 57c1a864ee3..a049e566380 100644
--- a/cmd/nerdctl/builder/builder_builder_test.go
+++ b/cmd/nerdctl/builder/builder_builder_test.go
@@ -83,7 +83,7 @@ CMD ["echo", "nerdctl-builder-debug-test-string"]`, testutil.CommonImage)
 					err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 					assert.NilError(helpers.T(), err)
 					cmd := helpers.Command("builder", "debug", buildCtx)
-					cmd.WithStdin(bytes.NewReader([]byte("c\n")))
+					cmd.Feed(bytes.NewReader([]byte("c\n")))
 					return cmd
 				},
 				Expected: test.Expects(0, nil, nil),
diff --git a/cmd/nerdctl/container/container_attach_linux_test.go b/cmd/nerdctl/container/container_attach_linux_test.go
index d2f5a7b7b0d..083fd4a194e 100644
--- a/cmd/nerdctl/container/container_attach_linux_test.go
+++ b/cmd/nerdctl/container/container_attach_linux_test.go
@@ -17,8 +17,9 @@
 package container
 
 import (
+	"bytes"
 	"errors"
-	"os"
+	"io"
 	"strings"
 	"testing"
 	"time"
@@ -56,11 +57,9 @@ func TestAttach(t *testing.T) {
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		cmd := helpers.Command("run", "--rm", "-it", "--name", data.Identifier(), testutil.CommonImage)
-		cmd.WithPseudoTTY(func(f *os.File) error {
-			// ctrl+p and ctrl+q (see https://en.wikipedia.org/wiki/C0_and_C1_control_codes)
-			_, err := f.Write([]byte{16, 17})
-			return err
-		})
+		cmd.WithPseudoTTY()
+		// ctrl+p and ctrl+q (see https://en.wikipedia.org/wiki/C0_and_C1_control_codes)
+		cmd.Feed(bytes.NewReader([]byte{16, 17}))
 
 		cmd.Run(&test.Expected{
 			ExitCode: 0,
@@ -74,15 +73,15 @@ func TestAttach(t *testing.T) {
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
 		// Run interactively and detach
 		cmd := helpers.Command("attach", data.Identifier())
-		cmd.WithPseudoTTY(func(f *os.File) error {
-			_, _ = f.WriteString("echo mark${NON}mark\n")
+
+		cmd.WithPseudoTTY()
+		cmd.Feed(strings.NewReader("echo mark${NON}mark\n"))
+		cmd.WithFeeder(func() io.Reader {
 			// Interestingly, and unlike with run, on attach, docker (like nerdctl) ALSO needs a pause so that the
 			// container can read stdin before we detach
 			time.Sleep(time.Second)
 			// ctrl+p and ctrl+q (see https://en.wikipedia.org/wiki/C0_and_C1_control_codes)
-			_, err := f.Write([]byte{16, 17})
-
-			return err
+			return bytes.NewReader([]byte{16, 17})
 		})
 
 		return cmd
@@ -120,10 +119,8 @@ func TestAttachDetachKeys(t *testing.T) {
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		cmd := helpers.Command("run", "--rm", "-it", "--detach-keys=ctrl-q", "--name", data.Identifier(), testutil.CommonImage)
-		cmd.WithPseudoTTY(func(f *os.File) error {
-			_, err := f.Write([]byte{17})
-			return err
-		})
+		cmd.WithPseudoTTY()
+		cmd.Feed(bytes.NewReader([]byte{17}))
 
 		cmd.Run(&test.Expected{
 			ExitCode: 0,
@@ -137,15 +134,14 @@ func TestAttachDetachKeys(t *testing.T) {
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
 		// Run interactively and detach
 		cmd := helpers.Command("attach", "--detach-keys=ctrl-a,ctrl-b", data.Identifier())
-		cmd.WithPseudoTTY(func(f *os.File) error {
-			_, _ = f.WriteString("echo mark${NON}mark\n")
+		cmd.WithPseudoTTY()
+		cmd.Feed(strings.NewReader("echo mark${NON}mark\n"))
+		cmd.WithFeeder(func() io.Reader {
 			// Interestingly, and unlike with run, on attach, docker (like nerdctl) ALSO needs a pause so that the
 			// container can read stdin before we detach
 			time.Sleep(time.Second)
-			// ctrl+a and ctrl+b (see https://en.wikipedia.org/wiki/C0_and_C1_control_codes)
-			_, err := f.Write([]byte{1, 2})
-
-			return err
+			// ctrl+p and ctrl+q (see https://en.wikipedia.org/wiki/C0_and_C1_control_codes)
+			return bytes.NewReader([]byte{1, 2})
 		})
 
 		return cmd
@@ -179,11 +175,9 @@ func TestAttachForAutoRemovedContainer(t *testing.T) {
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		cmd := helpers.Command("run", "--rm", "-it", "--detach-keys=ctrl-a,ctrl-b", "--name", data.Identifier(), testutil.CommonImage)
-		cmd.WithPseudoTTY(func(f *os.File) error {
-			// ctrl+a and ctrl+b (see https://en.wikipedia.org/wiki/C0_and_C1_control_codes)
-			_, err := f.Write([]byte{1, 2})
-			return err
-		})
+		cmd.WithPseudoTTY()
+		// ctrl+a and ctrl+b (see https://en.wikipedia.org/wiki/C0_and_C1_control_codes)
+		cmd.Feed(bytes.NewReader([]byte{1, 2}))
 
 		cmd.Run(&test.Expected{
 			ExitCode: 0,
@@ -197,10 +191,8 @@ func TestAttachForAutoRemovedContainer(t *testing.T) {
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
 		// Run interactively and detach
 		cmd := helpers.Command("attach", data.Identifier())
-		cmd.WithPseudoTTY(func(f *os.File) error {
-			_, err := f.WriteString("echo mark${NON}mark\nexit 42\n")
-			return err
-		})
+		cmd.WithPseudoTTY()
+		cmd.Feed(strings.NewReader("echo mark${NON}mark\nexit 42\n"))
 
 		return cmd
 	}
diff --git a/cmd/nerdctl/container/container_run_linux_test.go b/cmd/nerdctl/container/container_run_linux_test.go
index efffd92196f..378464bfcbd 100644
--- a/cmd/nerdctl/container/container_run_linux_test.go
+++ b/cmd/nerdctl/container/container_run_linux_test.go
@@ -379,6 +379,7 @@ func TestRunSigProxy(t *testing.T) {
 			},
 
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				// FIXME: os.Interrupt will likely not work on Windows
 				cmd := nerdtest.RunSigProxyContainer(os.Interrupt, true, nil, data, helpers)
 				err := cmd.Signal(os.Interrupt)
 				assert.NilError(helpers.T(), err)
@@ -417,7 +418,7 @@ func TestRunSigProxy(t *testing.T) {
 				return cmd
 			},
 
-			Expected: test.Expects(127, nil, expect.DoesNotContain(nerdtest.SignalCaught)),
+			Expected: test.Expects(expect.ExitCodeSignaled, nil, expect.DoesNotContain(nerdtest.SignalCaught)),
 		},
 	}
 
@@ -503,8 +504,9 @@ func TestRunWithDetachKeys(t *testing.T) {
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
 		// Run interactively and detach
 		cmd := helpers.Command("run", "-it", "--detach-keys=ctrl-a,ctrl-b", "--name", data.Identifier(), testutil.CommonImage)
-		cmd.WithPseudoTTY(func(f *os.File) error {
-			_, _ = f.WriteString("echo mark${NON}mark\n")
+		cmd.WithPseudoTTY()
+		cmd.Feed(strings.NewReader("echo mark${NON}mark\n"))
+		cmd.WithFeeder(func() io.Reader {
 			// Because of the way we proxy stdin, we have to wait here, otherwise we detach before
 			// the rest of the input ever reaches the container
 			// Note that this only concerns nerdctl, as docker seems to behave ok LOCALLY.
@@ -514,8 +516,7 @@ func TestRunWithDetachKeys(t *testing.T) {
 			nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			// }
 			// ctrl+a and ctrl+b (see https://en.wikipedia.org/wiki/C0_and_C1_control_codes)
-			_, err := f.Write([]byte{1, 2})
-			return err
+			return bytes.NewReader([]byte{1, 2})
 		})
 
 		return cmd
@@ -571,8 +572,9 @@ func TestIssue3568(t *testing.T) {
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
 		// Run interactively and detach
 		cmd := helpers.Command("run", "--rm", "-it", "--detach-keys=ctrl-a,ctrl-b", "--name", data.Identifier(), testutil.CommonImage)
-		cmd.WithPseudoTTY(func(f *os.File) error {
-			_, _ = f.WriteString("echo mark${NON}mark\n")
+		cmd.WithPseudoTTY()
+		cmd.Feed(strings.NewReader("echo mark${NON}mark\n"))
+		cmd.WithFeeder(func() io.Reader {
 			// Because of the way we proxy stdin, we have to wait here, otherwise we detach before
 			// the rest of the input ever reaches the container
 			// Note that this only concerns nerdctl, as docker seems to behave ok LOCALLY.
@@ -582,8 +584,7 @@ func TestIssue3568(t *testing.T) {
 			nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			// }
 			// ctrl+a and ctrl+b (see https://en.wikipedia.org/wiki/C0_and_C1_control_codes)
-			_, err := f.Write([]byte{1, 2})
-			return err
+			return bytes.NewReader([]byte{1, 2})
 		})
 
 		return cmd
diff --git a/cmd/nerdctl/container/container_start_linux_test.go b/cmd/nerdctl/container/container_start_linux_test.go
index afd7d1d788b..4f56cc9d679 100644
--- a/cmd/nerdctl/container/container_start_linux_test.go
+++ b/cmd/nerdctl/container/container_start_linux_test.go
@@ -17,8 +17,9 @@
 package container
 
 import (
+	"bytes"
 	"errors"
-	"os"
+	"io"
 	"strings"
 	"testing"
 
@@ -40,10 +41,8 @@ func TestStartDetachKeys(t *testing.T) {
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		cmd := helpers.Command("run", "-it", "--name", data.Identifier(), testutil.CommonImage)
-		cmd.WithPseudoTTY(func(f *os.File) error {
-			_, err := f.WriteString("exit\n")
-			return err
-		})
+		cmd.WithPseudoTTY()
+		cmd.Feed(strings.NewReader("exit\n"))
 		cmd.Run(&test.Expected{
 			ExitCode: 0,
 		})
@@ -60,10 +59,10 @@ func TestStartDetachKeys(t *testing.T) {
 			flags += "i"
 		}
 		cmd := helpers.Command("start", flags, "--detach-keys=ctrl-a,ctrl-b", data.Identifier())
-		cmd.WithPseudoTTY(func(f *os.File) error {
+		cmd.WithPseudoTTY()
+		cmd.WithFeeder(func() io.Reader {
 			// ctrl+a and ctrl+b (see https://en.wikipedia.org/wiki/C0_and_C1_control_codes)
-			_, err := f.Write([]byte{1, 2})
-			return err
+			return bytes.NewReader([]byte{1, 2})
 		})
 
 		return cmd
diff --git a/cmd/nerdctl/image/image_list_test.go b/cmd/nerdctl/image/image_list_test.go
index 38b0b034fed..8956d2d9f77 100644
--- a/cmd/nerdctl/image/image_list_test.go
+++ b/cmd/nerdctl/image/image_list_test.go
@@ -270,13 +270,13 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Description: "since=non-exists-image",
 				Require:     nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3511"),
 				Command:     test.Command("images", "--filter", "since=non-exists-image"),
-				Expected:    test.Expects(-1, []error{errors.New("No such image: ")}, nil),
+				Expected:    test.Expects(expect.ExitCodeGenericFail, []error{errors.New("No such image: ")}, nil),
 			},
 			{
 				Description: "before=non-exists-image",
 				Require:     nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3511"),
 				Command:     test.Command("images", "--filter", "before=non-exists-image"),
-				Expected:    test.Expects(-1, []error{errors.New("No such image: ")}, nil),
+				Expected:    test.Expects(expect.ExitCodeGenericFail, []error{errors.New("No such image: ")}, nil),
 			},
 		},
 	}
diff --git a/cmd/nerdctl/image/image_load_test.go b/cmd/nerdctl/image/image_load_test.go
index 3533c183e84..fc1fa549da4 100644
--- a/cmd/nerdctl/image/image_load_test.go
+++ b/cmd/nerdctl/image/image_load_test.go
@@ -53,7 +53,7 @@ func TestLoadStdinFromPipe(t *testing.T) {
 			cmd := helpers.Command("load")
 			reader, err := os.Open(filepath.Join(data.TempDir(), "common.tar"))
 			assert.NilError(t, err, "failed to open common.tar")
-			cmd.WithStdin(reader)
+			cmd.Feed(reader)
 			return cmd
 		},
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
diff --git a/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go b/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go
index aa36f35b08e..2387555c0a3 100644
--- a/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go
+++ b/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go
@@ -19,6 +19,7 @@ package ipfs
 import (
 	"fmt"
 	"io"
+	"os"
 	"strconv"
 	"strings"
 	"testing"
@@ -211,8 +212,9 @@ func TestIPFSCompBuild(t *testing.T) {
 		// Start a local ipfs backed registry
 		// FIXME: this is bad and likely to collide with other tests
 		ipfsServer = helpers.Command("ipfs", "registry", "serve", "--listen-registry", listenAddr)
-		// Once foregrounded, do not wait for it more than a second
-		ipfsServer.Background(1 * time.Second)
+		// This should not take longer than that
+		ipfsServer.WithTimeout(30 * time.Second)
+		ipfsServer.Background()
 		// Apparently necessary to let it start...
 		time.Sleep(time.Second)
 
@@ -237,9 +239,8 @@ COPY index.html /usr/share/nginx/html/index.html
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
 		if ipfsServer != nil {
-			// Close the server once done
 			helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
-			ipfsServer.Run(nil)
+			ipfsServer.Signal(os.Kill)
 		}
 		if comp != nil {
 			helpers.Anyhow("compose", "-f", comp.YAMLFullPath(), "down", "-v")
diff --git a/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go b/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go
index 20865efc834..dcb0f7429ed 100644
--- a/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go
+++ b/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go
@@ -70,8 +70,9 @@ func TestIPFSNerdctlRegistry(t *testing.T) {
 
 		// Start a local ipfs backed registry
 		ipfsServer = helpers.Command("ipfs", "registry", "serve", "--listen-registry", listenAddr)
-		// Once foregrounded, do not wait for it more than a second
-		ipfsServer.Background(1 * time.Second)
+		// This should not take longer than that
+		ipfsServer.WithTimeout(30 * time.Second)
+		ipfsServer.Background()
 		// Apparently necessary to let it start...
 		time.Sleep(time.Second)
 	}
@@ -79,7 +80,7 @@ func TestIPFSNerdctlRegistry(t *testing.T) {
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
 		if ipfsServer != nil {
 			// Close the server once done
-			ipfsServer.Run(nil)
+			ipfsServer.Signal(os.Kill)
 		}
 	}
 
diff --git a/cmd/nerdctl/issues/main_linux_test.go b/cmd/nerdctl/issues/main_linux_test.go
index 4703897a7e2..12f1b9384d6 100644
--- a/cmd/nerdctl/issues/main_linux_test.go
+++ b/cmd/nerdctl/issues/main_linux_test.go
@@ -39,7 +39,7 @@ func TestIssue108(t *testing.T) {
 		{
 			Description: "-it --net=host",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				cmd := helpers.Command("run", "-it", "--rm", "--net=host", testutil.CommonImage, "echo", "this was always working")
+				cmd := helpers.Command("run", "--quiet", "-it", "--rm", "--net=host", testutil.CommonImage, "echo", "this was always working")
 				cmd.WithPseudoTTY()
 				return cmd
 			},
@@ -48,7 +48,7 @@ func TestIssue108(t *testing.T) {
 		{
 			Description: "--net=host -it",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				cmd := helpers.Command("run", "--rm", "--net=host", "-it", testutil.CommonImage, "echo", "this was not working due to issue #108")
+				cmd := helpers.Command("run", "--quiet", "--rm", "--net=host", "-it", testutil.CommonImage, "echo", "this was not working due to issue #108")
 				cmd.WithPseudoTTY()
 				return cmd
 			},
diff --git a/cmd/nerdctl/main_test_test.go b/cmd/nerdctl/main_test_test.go
index 36c6a96e3a9..ae9acc0f7f6 100644
--- a/cmd/nerdctl/main_test_test.go
+++ b/cmd/nerdctl/main_test_test.go
@@ -61,7 +61,7 @@ func TestTest(t *testing.T) {
 		{
 			Description: "failure with multiple error testing",
 			Command:     test.Command("-fail"),
-			Expected:    test.Expects(-1, []error{errors.New("unknown"), errors.New("shorthand")}, nil),
+			Expected:    test.Expects(expect.ExitCodeGenericFail, []error{errors.New("unknown"), errors.New("shorthand")}, nil),
 		},
 		{
 			Description: "success with exact output testing",
diff --git a/cmd/nerdctl/system/system_events_linux_test.go b/cmd/nerdctl/system/system_events_linux_test.go
index 20f1f8e3f06..bcf01bd0f19 100644
--- a/cmd/nerdctl/system/system_events_linux_test.go
+++ b/cmd/nerdctl/system/system_events_linux_test.go
@@ -30,7 +30,9 @@ import (
 
 func testEventFilterExecutor(data test.Data, helpers test.Helpers) test.TestableCommand {
 	cmd := helpers.Command("events", "--filter", data.Get("filter"), "--format", "json")
-	cmd.Background(1 * time.Second)
+	// 3 seconds is too short on slow rig (EL8)
+	cmd.WithTimeout(10 * time.Second)
+	cmd.Background()
 	helpers.Ensure("run", "--rm", testutil.CommonImage)
 	return cmd
 }
diff --git a/cmd/nerdctl/volume/volume_create_test.go b/cmd/nerdctl/volume/volume_create_test.go
index 8e761c6e015..8eedd781751 100644
--- a/cmd/nerdctl/volume/volume_create_test.go
+++ b/cmd/nerdctl/volume/volume_create_test.go
@@ -85,7 +85,7 @@ func TestVolumeCreate(t *testing.T) {
 				helpers.Anyhow("volume", "rm", "-f", data.Identifier())
 			},
 			// NOTE: docker returns 125 on this
-			Expected: test.Expects(-1, []error{errdefs.ErrInvalidArgument}, nil),
+			Expected: test.Expects(expect.ExitCodeGenericFail, []error{errdefs.ErrInvalidArgument}, nil),
 		},
 		{
 			Description: "creating already existing volume should succeed",

From 625445f3f99f3347990790cea2cb83e5d62c8a95 Mon Sep 17 00:00:00 2001
From: zzzzzzzzzy9 <zhang.yu58@zte.com.cn>
Date: Wed, 2 Apr 2025 16:14:25 +0800
Subject: [PATCH 051/225] test for run -td

Signed-off-by: zzzzzzzzzy9 <zhang.yu58@zte.com.cn>
---
 cmd/nerdctl/container/container_run_linux_test.go | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/cmd/nerdctl/container/container_run_linux_test.go b/cmd/nerdctl/container/container_run_linux_test.go
index efffd92196f..2a18cc72eb5 100644
--- a/cmd/nerdctl/container/container_run_linux_test.go
+++ b/cmd/nerdctl/container/container_run_linux_test.go
@@ -364,6 +364,18 @@ func TestRunTTY(t *testing.T) {
 			},
 			Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 		},
+		{
+			Description: "stty with -td",
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Ensure("rm", "-f", data.Identifier())
+			},
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				cmd := helpers.Command("run", "-td", data.Identifier(), "stty")
+				cmd.WithPseudoTTY()
+				return cmd
+			},
+			Expected: test.Expects(0, nil, nil),
+		},
 	}
 }
 

From 8b06f2ac54855adbf7e58ad888f2b62daa2745d9 Mon Sep 17 00:00:00 2001
From: Kay Yan <kay.yan@daocloud.io>
Date: Thu, 3 Apr 2025 12:14:45 +0000
Subject: [PATCH 052/225] Fix env_file in compose work with profile

Signed-off-by: Kay Yan <kay.yan@daocloud.io>
---
 cmd/nerdctl/compose/compose_up_linux_test.go | 15 ++++++++++++++-
 pkg/composer/composer.go                     | 14 +-------------
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/cmd/nerdctl/compose/compose_up_linux_test.go b/cmd/nerdctl/compose/compose_up_linux_test.go
index 6da3162b4b9..3d7597adf88 100644
--- a/cmd/nerdctl/compose/compose_up_linux_test.go
+++ b/cmd/nerdctl/compose/compose_up_linux_test.go
@@ -19,6 +19,7 @@ package compose
 import (
 	"fmt"
 	"io"
+	"os"
 	"strings"
 	"testing"
 	"time"
@@ -499,6 +500,12 @@ func TestComposeUpProfile(t *testing.T) {
 	serviceRegular := testutil.Identifier(t) + "-regular"
 	serviceProfiled := testutil.Identifier(t) + "-profiled"
 
+	// write the env.common file to tmpdir
+	tmpDir := t.TempDir()
+	envFilePath := fmt.Sprintf("%s/env.common", tmpDir)
+	err := os.WriteFile(envFilePath, []byte("TEST_ENV_INJECTION=WORKS\n"), 0644)
+	assert.NilError(t, err)
+
 	dockerComposeYAML := fmt.Sprintf(`
 services:
   %s:
@@ -508,7 +515,9 @@ services:
     image: %[3]s
     profiles:
       - test-profile
-`, serviceRegular, serviceProfiled, testutil.NginxAlpineImage)
+    env_file:
+      - %[4]s
+`, serviceRegular, serviceProfiled, testutil.NginxAlpineImage, envFilePath)
 
 	// * Test with profile
 	//   Should run both the services:
@@ -521,6 +530,10 @@ services:
 	psCmd := base.Cmd("ps", "-a", "--format={{.Names}}")
 	psCmd.AssertOutContains(serviceRegular)
 	psCmd.AssertOutContains(serviceProfiled)
+
+	execCmd := base.ComposeCmd("-f", comp1.YAMLFullPath(), "exec", serviceProfiled, "env")
+	execCmd.AssertOutContains("TEST_ENV_INJECTION=WORKS")
+
 	base.ComposeCmd("-f", comp1.YAMLFullPath(), "--profile", "test-profile", "down", "-v").AssertOK()
 
 	// * Test without profile
diff --git a/pkg/composer/composer.go b/pkg/composer/composer.go
index d159fbbbfaf..539971d1f7e 100644
--- a/pkg/composer/composer.go
+++ b/pkg/composer/composer.go
@@ -84,6 +84,7 @@ func New(o Options, client *containerd.Client) (*Composer, error) {
 		composecli.WithEnvFiles(),
 		composecli.WithDotEnv,
 		composecli.WithName(o.Project),
+		composecli.WithProfiles(o.Profiles),
 	)
 
 	projectOptions, err := composecli.NewProjectOptions(o.ConfigPaths, optionsFn...)
@@ -95,19 +96,6 @@ func New(o Options, client *containerd.Client) (*Composer, error) {
 		return nil, err
 	}
 
-	if len(o.Services) > 0 {
-		s, err := project.GetServices(o.Services...)
-		if err != nil {
-			return nil, err
-		}
-		o.Profiles = append(o.Profiles, s.GetProfiles()...)
-	}
-
-	project, err = project.WithProfiles(o.Profiles)
-	if err != nil {
-		return nil, err
-	}
-
 	if o.DebugPrintFull {
 		projectJSON, _ := json.MarshalIndent(project, "", "    ")
 		log.L.Debug("printing project JSON")

From 8318437f07b104c0638aefb02c59eef64719ef11 Mon Sep 17 00:00:00 2001
From: "y.li" <prestonkelsie434@gmail.com>
Date: Fri, 4 Apr 2025 21:26:50 +0800
Subject: [PATCH 053/225] fix hardcode in TestImageHistory

Signed-off-by: y.li <prestonkelsie434@gmail.com>
---
 cmd/nerdctl/image/image_history_test.go | 13 ++---
 pkg/formatter/formatter_test.go         | 71 +++++++++++++++++++++++++
 2 files changed, 78 insertions(+), 6 deletions(-)
 create mode 100644 pkg/formatter/formatter_test.go

diff --git a/cmd/nerdctl/image/image_history_test.go b/cmd/nerdctl/image/image_history_test.go
index 16667641600..699a7cf6fe1 100644
--- a/cmd/nerdctl/image/image_history_test.go
+++ b/cmd/nerdctl/image/image_history_test.go
@@ -29,6 +29,7 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
+	"github.com/containerd/nerdctl/v2/pkg/formatter"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
@@ -93,11 +94,6 @@ func TestImageHistory(t *testing.T) {
 					history, err := decode(stdout)
 					assert.NilError(t, err, info)
 					assert.Equal(t, len(history), 2, info)
-					assert.Equal(t, history[0].Size, "0B", info)
-					// FIXME: how is this going to age?
-					assert.Equal(t, history[0].CreatedSince, "4 years ago", info)
-					assert.Equal(t, history[0].Snapshot, "<missing>", info)
-					assert.Equal(t, history[0].Comment, "", info)
 
 					localTimeL1, _ := time.Parse(time.RFC3339, "2021-03-31T10:21:23-07:00")
 					localTimeL2, _ := time.Parse(time.RFC3339, "2021-03-31T10:21:21-07:00")
@@ -108,8 +104,13 @@ func TestImageHistory(t *testing.T) {
 					assert.Equal(t, compTime2.UTC().String(), localTimeL2.UTC().String(), info)
 					assert.Equal(t, history[1].CreatedBy, "/bin/sh -c #(nop) ADD file:3b16ffee2b26d8af5…", info)
 
+					assert.Equal(t, history[0].Size, "0B", info)
+					assert.Equal(t, history[0].CreatedSince, formatter.TimeSinceInHuman(compTime1), info)
+					assert.Equal(t, history[0].Snapshot, "<missing>", info)
+					assert.Equal(t, history[0].Comment, "", info)
+
 					assert.Equal(t, history[1].Size, "5.947MB", info)
-					assert.Equal(t, history[1].CreatedSince, "4 years ago", info)
+					assert.Equal(t, history[1].CreatedSince, formatter.TimeSinceInHuman(compTime2), info)
 					assert.Equal(t, history[1].Snapshot, "sha256:56bf55b8eed1f0b4794a30386e4d1d3da949c…", info)
 					assert.Equal(t, history[1].Comment, "", info)
 				}),
diff --git a/pkg/formatter/formatter_test.go b/pkg/formatter/formatter_test.go
new file mode 100644
index 00000000000..3d3890ba25b
--- /dev/null
+++ b/pkg/formatter/formatter_test.go
@@ -0,0 +1,71 @@
+package formatter
+
+import (
+	"testing"
+	"time"
+
+	"gotest.tools/v3/assert"
+)
+
+func TestTimeSinceInHuman(t *testing.T) {
+	now := time.Now()
+
+	tests := []struct {
+		name     string
+		input    time.Time
+		expected string
+	}{
+		{
+			name:     "1 second ago",
+			input:    now.Add(-1 * time.Second),
+			expected: "1 second ago",
+		},
+		{
+			name:     "59 seconds ago",
+			input:    now.Add(-59 * time.Second),
+			expected: "59 seconds ago",
+		},
+		{
+			name:     "1 minute ago",
+			input:    now.Add(-1 * time.Minute),
+			expected: "About a minute ago",
+		},
+		{
+			name:     "1 hour ago",
+			input:    now.Add(-1 * time.Hour),
+			expected: "About an hour ago",
+		},
+		{
+			name:     "1 day ago",
+			input:    now.Add(-24 * time.Hour),
+			expected: "24 hours ago",
+		},
+		{
+			name:     "4 days ago",
+			input:    now.Add(-4 * 24 * time.Hour),
+			expected: "4 days ago",
+		},
+		{
+			name:     "1 year ago",
+			input:    now.Add(-365 * 24 * time.Hour),
+			expected: "12 months ago",
+		},
+		{
+			name:     "4 years ago",
+			input:    now.Add(-4 * 365 * 24 * time.Hour),
+			expected: "4 years ago",
+		},
+		{
+			name:     "zero duration",
+			input:    now,
+			expected: "Less than a second ago",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := TimeSinceInHuman(tt.input)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}

From 4efae1649b5b858265a35126c9d23d3e64cc525a Mon Sep 17 00:00:00 2001
From: "y.li" <prestonkelsie434@gmail.com>
Date: Fri, 4 Apr 2025 22:42:47 +0800
Subject: [PATCH 054/225] ltag

Signed-off-by: y.li <prestonkelsie434@gmail.com>
---
 pkg/formatter/formatter_test.go | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/pkg/formatter/formatter_test.go b/pkg/formatter/formatter_test.go
index 3d3890ba25b..296cecf5041 100644
--- a/pkg/formatter/formatter_test.go
+++ b/pkg/formatter/formatter_test.go
@@ -1,3 +1,19 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
 package formatter
 
 import (

From d1b827a9820c8c9f72687936f18d90e4037a33ee Mon Sep 17 00:00:00 2001
From: "y.li" <prestonkelsie434@gmail.com>
Date: Sat, 5 Apr 2025 00:00:33 +0800
Subject: [PATCH 055/225] add parallel

Signed-off-by: y.li <prestonkelsie434@gmail.com>
---
 pkg/formatter/formatter_test.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkg/formatter/formatter_test.go b/pkg/formatter/formatter_test.go
index 296cecf5041..6e039039e11 100644
--- a/pkg/formatter/formatter_test.go
+++ b/pkg/formatter/formatter_test.go
@@ -25,6 +25,7 @@ import (
 
 func TestTimeSinceInHuman(t *testing.T) {
 	now := time.Now()
+	t.Parallel()
 
 	tests := []struct {
 		name     string
@@ -80,6 +81,7 @@ func TestTimeSinceInHuman(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
 			result := TimeSinceInHuman(tt.input)
 			assert.Equal(t, tt.expected, result)
 		})

From 4f1d307de3af426d986069cb706f48c589b19d13 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 4 Apr 2025 11:49:06 -0700
Subject: [PATCH 056/225] Fix logging regression.

Trim prefix part of containerd socket address.

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 pkg/logging/logging.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/logging/logging.go b/pkg/logging/logging.go
index 9ebe907355e..1f1475acd2a 100644
--- a/pkg/logging/logging.go
+++ b/pkg/logging/logging.go
@@ -164,7 +164,7 @@ func WaitForLogger(dataStore, ns, id string) error {
 }
 
 func getContainerWait(ctx context.Context, address string, config *logging.Config) (<-chan containerd.ExitStatus, error) {
-	client, err := containerd.New(address, containerd.WithDefaultNamespace(config.Namespace))
+	client, err := containerd.New(strings.TrimPrefix(address, "unix://"), containerd.WithDefaultNamespace(config.Namespace))
 	if err != nil {
 		return nil, err
 	}

From b9043ff9a05c50b04e10582a1924504ad97cb214 Mon Sep 17 00:00:00 2001
From: fahed dorgaa <fahed.dorgaa@gmail.com>
Date: Fri, 4 Apr 2025 23:54:01 +0200
Subject: [PATCH 057/225] update go-logrotate to v0.3.0

Signed-off-by: fahed dorgaa <fahed.dorgaa@gmail.com>
---
 go.mod | 2 +-
 go.sum | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/go.mod b/go.mod
index 72e200b56f2..8c28e25bed5 100644
--- a/go.mod
+++ b/go.mod
@@ -35,7 +35,7 @@ require (
 	github.com/docker/docker v28.0.4+incompatible
 	github.com/docker/go-connections v0.5.0
 	github.com/docker/go-units v0.5.0
-	github.com/fahedouch/go-logrotate v0.2.1
+	github.com/fahedouch/go-logrotate v0.3.0
 	github.com/fatih/color v1.18.0
 	github.com/fluent/fluent-logger-golang v1.9.0
 	github.com/fsnotify/fsnotify v1.8.0
diff --git a/go.sum b/go.sum
index fc70c36777e..1accc976bd6 100644
--- a/go.sum
+++ b/go.sum
@@ -6,8 +6,8 @@ github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20231105174938-2b5cbb29f3e2/go.mod
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
-github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
+github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/Masterminds/semver/v3 v3.3.1 h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7rj+4nv4=
 github.com/Masterminds/semver/v3 v3.3.1/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
@@ -102,8 +102,8 @@ github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymF
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/fahedouch/go-logrotate v0.2.1 h1:Q0Hk9Kp/Y4iwy9uR9e/60fEoxGhvfk8MG7WwtL9aarM=
-github.com/fahedouch/go-logrotate v0.2.1/go.mod h1:Mmyex1f9fGXBNnhS9uHsbnO9BGvADF4VGqVnqAJalgc=
+github.com/fahedouch/go-logrotate v0.3.0 h1:XP+dHIDgWZ1ckz43mG6gl5ASer3PZDVr755SVMyzaUQ=
+github.com/fahedouch/go-logrotate v0.3.0/go.mod h1:X49m0bvPLkk71MHNCQ1yEfVEw8W/u+qvHa/hOnhCYf4=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=

From e40aae9332f6d3c2c6ce7f7c7ae569567550a96f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 4 Apr 2025 23:00:32 +0000
Subject: [PATCH 058/225] build(deps): bump github.com/fsnotify/fsnotify from
 1.8.0 to 1.9.0

Bumps [github.com/fsnotify/fsnotify](https://github.com/fsnotify/fsnotify) from 1.8.0 to 1.9.0.
- [Release notes](https://github.com/fsnotify/fsnotify/releases)
- [Changelog](https://github.com/fsnotify/fsnotify/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fsnotify/fsnotify/compare/v1.8.0...v1.9.0)

---
updated-dependencies:
- dependency-name: github.com/fsnotify/fsnotify
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 72e200b56f2..66d366051b5 100644
--- a/go.mod
+++ b/go.mod
@@ -38,7 +38,7 @@ require (
 	github.com/fahedouch/go-logrotate v0.2.1
 	github.com/fatih/color v1.18.0
 	github.com/fluent/fluent-logger-golang v1.9.0
-	github.com/fsnotify/fsnotify v1.8.0
+	github.com/fsnotify/fsnotify v1.9.0
 	github.com/go-viper/mapstructure/v2 v2.2.1
 	github.com/ipfs/go-cid v0.5.0
 	github.com/klauspost/compress v1.18.0
diff --git a/go.sum b/go.sum
index fc70c36777e..48c84466f2d 100644
--- a/go.sum
+++ b/go.sum
@@ -110,8 +110,8 @@ github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fluent/fluent-logger-golang v1.9.0 h1:zUdY44CHX2oIUc7VTNZc+4m+ORuO/mldQDA7czhWXEg=
 github.com/fluent/fluent-logger-golang v1.9.0/go.mod h1:2/HCT/jTy78yGyeNGQLGQsjF3zzzAuy6Xlk6FCMV5eU=
-github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
-github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
 github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=

From 1540091d0744fe62fecb60002804cc81cf525652 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 7 Apr 2025 23:04:54 +0000
Subject: [PATCH 059/225] build(deps): bump the golang-x group with 6 updates

Bumps the golang-x group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.36.0` | `0.37.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.38.0` | `0.39.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.12.0` | `0.13.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.31.0` | `0.32.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.30.0` | `0.31.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.23.0` | `0.24.0` |


Updates `golang.org/x/crypto` from 0.36.0 to 0.37.0
- [Commits](https://github.com/golang/crypto/compare/v0.36.0...v0.37.0)

Updates `golang.org/x/net` from 0.38.0 to 0.39.0
- [Commits](https://github.com/golang/net/compare/v0.38.0...v0.39.0)

Updates `golang.org/x/sync` from 0.12.0 to 0.13.0
- [Commits](https://github.com/golang/sync/compare/v0.12.0...v0.13.0)

Updates `golang.org/x/sys` from 0.31.0 to 0.32.0
- [Commits](https://github.com/golang/sys/compare/v0.31.0...v0.32.0)

Updates `golang.org/x/term` from 0.30.0 to 0.31.0
- [Commits](https://github.com/golang/term/compare/v0.30.0...v0.31.0)

Updates `golang.org/x/text` from 0.23.0 to 0.24.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](https://github.com/golang/text/compare/v0.23.0...v0.24.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
- dependency-name: golang.org/x/net
  dependency-version: 0.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
- dependency-name: golang.org/x/sync
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
- dependency-name: golang.org/x/sys
  dependency-version: 0.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
- dependency-name: golang.org/x/term
  dependency-version: 0.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
- dependency-name: golang.org/x/text
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 12 ++++++------
 go.sum | 24 ++++++++++++------------
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/go.mod b/go.mod
index 977188f51d4..abfabef9cb6 100644
--- a/go.mod
+++ b/go.mod
@@ -60,12 +60,12 @@ require (
 	github.com/vishvananda/netns v0.0.5
 	github.com/yuchanns/srslog v1.1.0
 	go.uber.org/mock v0.5.0
-	golang.org/x/crypto v0.36.0
-	golang.org/x/net v0.38.0
-	golang.org/x/sync v0.12.0
-	golang.org/x/sys v0.31.0
-	golang.org/x/term v0.30.0
-	golang.org/x/text v0.23.0
+	golang.org/x/crypto v0.37.0
+	golang.org/x/net v0.39.0
+	golang.org/x/sync v0.13.0
+	golang.org/x/sys v0.32.0
+	golang.org/x/term v0.31.0
+	golang.org/x/text v0.24.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
 )
diff --git a/go.sum b/go.sum
index 6b0355f08a3..c947e88d9a0 100644
--- a/go.sum
+++ b/go.sum
@@ -337,8 +337,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.30.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
+golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f h1:XdNn9LlyWAhLVp6P/i8QYBW+hlyhrhei9uErw2B5GJo=
 golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f/go.mod h1:D5SMRVC3C2/4+F/DB1wZsLRnSNimn2Sp/NPsCrsv8ak=
@@ -368,8 +368,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
+golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -382,8 +382,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
-golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
+golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -406,8 +406,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
+golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -417,8 +417,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
-golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
+golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
+golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
@@ -428,8 +428,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
+golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=

From 390af3e05ebbd302e7b6ccb1fce58943a3f047eb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 7 Apr 2025 23:14:22 +0000
Subject: [PATCH 060/225] build(deps): bump github.com/pelletier/go-toml/v2
 from 2.2.3 to 2.2.4

Bumps [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml) from 2.2.3 to 2.2.4.
- [Release notes](https://github.com/pelletier/go-toml/releases)
- [Changelog](https://github.com/pelletier/go-toml/blob/v2/.goreleaser.yaml)
- [Commits](https://github.com/pelletier/go-toml/compare/v2.2.3...v2.2.4)

---
updated-dependencies:
- dependency-name: github.com/pelletier/go-toml/v2
  dependency-version: 2.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 977188f51d4..333cc3a0d90 100644
--- a/go.mod
+++ b/go.mod
@@ -51,7 +51,7 @@ require (
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/opencontainers/runtime-spec v1.2.1
-	github.com/pelletier/go-toml/v2 v2.2.3
+	github.com/pelletier/go-toml/v2 v2.2.4
 	github.com/rootless-containers/bypass4netns v0.4.2
 	github.com/rootless-containers/rootlesskit/v2 v2.3.4
 	github.com/spf13/cobra v1.9.1
diff --git a/go.sum b/go.sum
index 6b0355f08a3..5c96aad6302 100644
--- a/go.sum
+++ b/go.sum
@@ -242,8 +242,8 @@ github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU
 github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.11.1 h1:nHFvthhM0qY8/m+vfhJylliSshm8G1jJ2jDMcgULaH8=
 github.com/opencontainers/selinux v1.11.1/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec=
-github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
-github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7 h1:Dx7Ovyv/SFnMFw3fD4oEoeorXc6saIiQ23LrGLth0Gw=
 github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
 github.com/philhofer/fwd v1.1.3-0.20240612014219-fbbf4953d986 h1:jYi87L8j62qkXzaYHAQAhEapgukhenIMZRBKTNRLHJ4=

From a30633be126eeaa2fb5e8d0831b205c50b9c7948 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 8 Apr 2025 07:32:06 +0000
Subject: [PATCH 061/225] build(deps): bump go.uber.org/mock from 0.5.0 to
 0.5.1

Bumps [go.uber.org/mock](https://github.com/uber/mock) from 0.5.0 to 0.5.1.
- [Release notes](https://github.com/uber/mock/releases)
- [Changelog](https://github.com/uber-go/mock/blob/main/CHANGELOG.md)
- [Commits](https://github.com/uber/mock/compare/v0.5.0...v0.5.1)

---
updated-dependencies:
- dependency-name: go.uber.org/mock
  dependency-version: 0.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index abfabef9cb6..8b346440697 100644
--- a/go.mod
+++ b/go.mod
@@ -59,7 +59,7 @@ require (
 	github.com/vishvananda/netlink v1.3.0
 	github.com/vishvananda/netns v0.0.5
 	github.com/yuchanns/srslog v1.1.0
-	go.uber.org/mock v0.5.0
+	go.uber.org/mock v0.5.1
 	golang.org/x/crypto v0.37.0
 	golang.org/x/net v0.39.0
 	golang.org/x/sync v0.13.0
diff --git a/go.sum b/go.sum
index c947e88d9a0..ff02114b58e 100644
--- a/go.sum
+++ b/go.sum
@@ -327,8 +327,8 @@ go.opentelemetry.io/otel/trace v1.31.0 h1:ffjsj1aRouKewfr85U2aGagJ46+MvodynlQ1HY
 go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06FJAsO1tJg480A=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
-go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
+go.uber.org/mock v0.5.1 h1:ASgazW/qBmR+A32MYFDB6E2POoTgOwT509VP0CT/fjs=
+go.uber.org/mock v0.5.1/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=

From 2ec878c3934ddb5cdab24c338fdef37cb22474ed Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 8 Apr 2025 08:32:01 +0000
Subject: [PATCH 062/225] build(deps): bump
 github.com/compose-spec/compose-go/v2

Bumps [github.com/compose-spec/compose-go/v2](https://github.com/compose-spec/compose-go) from 2.4.9 to 2.5.0.
- [Release notes](https://github.com/compose-spec/compose-go/releases)
- [Commits](https://github.com/compose-spec/compose-go/compare/v2.4.9...v2.5.0)

---
updated-dependencies:
- dependency-name: github.com/compose-spec/compose-go/v2
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index a1b0c180c3d..b170c204199 100644
--- a/go.mod
+++ b/go.mod
@@ -6,7 +6,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.3.1
 	github.com/Microsoft/go-winio v0.6.2
 	github.com/Microsoft/hcsshim v0.12.9
-	github.com/compose-spec/compose-go/v2 v2.4.9
+	github.com/compose-spec/compose-go/v2 v2.5.0
 	github.com/containerd/accelerated-container-image v1.3.0
 	github.com/containerd/cgroups/v3 v3.0.5
 	github.com/containerd/console v1.0.4
diff --git a/go.sum b/go.sum
index ecee6dfba41..2521e262c56 100644
--- a/go.sum
+++ b/go.sum
@@ -21,8 +21,8 @@ github.com/cilium/ebpf v0.16.0 h1:+BiEnHL6Z7lXnlGUsXQPPAE7+kenAd4ES8MQ5min0Ok=
 github.com/cilium/ebpf v0.16.0/go.mod h1:L7u2Blt2jMM/vLAVgjxluxtBKlz3/GWjB0dMOEngfwE=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/compose-spec/compose-go/v2 v2.4.9 h1:2K4TDw+1ba2idiR6empXHKRXvWYpnvAKoNQy93/sSOs=
-github.com/compose-spec/compose-go/v2 v2.4.9/go.mod h1:6k5l/0TxCg0/2uLEhRVEsoBWBprS2uvZi32J7xub3lo=
+github.com/compose-spec/compose-go/v2 v2.5.0 h1:Y1hYWfYaBsAAHwggXME1LjoZENq7bP0tj9gqQxYwKR8=
+github.com/compose-spec/compose-go/v2 v2.5.0/go.mod h1:vPlkN0i+0LjLf9rv52lodNMUTJF5YHVfHVGLLIP67NA=
 github.com/containerd/accelerated-container-image v1.3.0 h1:sFbTgSuMboeKHa9f7MY11hWF1XxVWjFoiTsXYtOtvdU=
 github.com/containerd/accelerated-container-image v1.3.0/go.mod h1:EvKVWor6ZQNUyYp0MZm5hw4k21ropuz7EegM+m/Jb/Q=
 github.com/containerd/cgroups/v3 v3.0.5 h1:44na7Ud+VwyE7LIoJ8JTNQOa549a8543BmzaJHo6Bzo=

From e6283c06a098f7173157af49a5318a5477892188 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Thu, 10 Apr 2025 01:29:59 +0900
Subject: [PATCH 063/225] CI: FreeBSD: fix "No packages available to install
 matching ..."

Fix issue 4094

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 Vagrantfile.freebsd | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Vagrantfile.freebsd b/Vagrantfile.freebsd
index 96fffc4c51e..ee6545ab1c5 100644
--- a/Vagrantfile.freebsd
+++ b/Vagrantfile.freebsd
@@ -36,6 +36,10 @@ Vagrant.configure("2") do |config|
     sh.inline = <<~SHELL
         #!/usr/bin/env bash
         set -eux -o pipefail
+        freebsd-version -kru
+        # switching to "release_2" ensures compatibility with the current Vagrant box
+        # https://github.com/moby/buildkit/pull/5893
+        sed -i '' 's/latest/release_2/' /usr/local/etc/pkg/repos/FreeBSD.conf
         # `pkg install go` still installs Go 1.20 (March 2024)
         pkg install -y go122 containerd runj
         ln -s go122 /usr/local/bin/go

From 33f1d2805d9ce769197bdaaeb3d51197101deff1 Mon Sep 17 00:00:00 2001
From: Swagat Bora <sbora@amazon.com>
Date: Thu, 3 Apr 2025 19:11:16 +0000
Subject: [PATCH 064/225] feat: add cpu-rt-period and cpu-rt-runtime options in
 nerdctl create/run

Signed-off-by: Swagat Bora <sbora@amazon.com>
---
 cmd/nerdctl/container/container_create.go     |  8 ++
 cmd/nerdctl/container/container_run.go        |  2 +
 .../container_run_cgroup_linux_test.go        | 36 +++++++
 docs/command-reference.md                     |  8 +-
 pkg/api/types/container_types.go              |  4 +
 pkg/cmd/container/run_cgroup_linux.go         | 13 +++
 pkg/infoutil/infoutil.go                      |  5 +
 pkg/inspecttypes/dockercompat/dockercompat.go | 72 ++++++++------
 .../dockercompat/dockercompat_test.go         | 94 +++++++++++++++++++
 pkg/inspecttypes/dockercompat/info.go         |  1 +
 10 files changed, 212 insertions(+), 31 deletions(-)

diff --git a/cmd/nerdctl/container/container_create.go b/cmd/nerdctl/container/container_create.go
index 934551aa84a..67db1a4f94a 100644
--- a/cmd/nerdctl/container/container_create.go
+++ b/cmd/nerdctl/container/container_create.go
@@ -159,6 +159,14 @@ func createOptions(cmd *cobra.Command) (types.ContainerCreateOptions, error) {
 	if err != nil {
 		return opt, err
 	}
+	opt.CPURealtimePeriod, err = cmd.Flags().GetUint64("cpu-rt-period")
+	if err != nil {
+		return opt, err
+	}
+	opt.CPURealtimeRuntime, err = cmd.Flags().GetUint64("cpu-rt-runtime")
+	if err != nil {
+		return opt, err
+	}
 	opt.Memory, err = cmd.Flags().GetString("memory")
 	if err != nil {
 		return opt, err
diff --git a/cmd/nerdctl/container/container_run.go b/cmd/nerdctl/container/container_run.go
index 12b2ac9ad82..84bc42f05e6 100644
--- a/cmd/nerdctl/container/container_run.go
+++ b/cmd/nerdctl/container/container_run.go
@@ -166,6 +166,8 @@ func setCreateFlags(cmd *cobra.Command) {
 	cmd.Flags().Uint64("cpu-shares", 0, "CPU shares (relative weight)")
 	cmd.Flags().Int64("cpu-quota", -1, "Limit CPU CFS (Completely Fair Scheduler) quota")
 	cmd.Flags().Uint64("cpu-period", 0, "Limit CPU CFS (Completely Fair Scheduler) period")
+	cmd.Flags().Uint64("cpu-rt-period", 0, "Limit CPU real-time period in microseconds")
+	cmd.Flags().Uint64("cpu-rt-runtime", 0, "Limit CPU real-time runtime in microseconds")
 	// device is defined as StringSlice, not StringArray, to allow specifying "--device=DEV1,DEV2" (compatible with Podman)
 	cmd.Flags().StringSlice("device", nil, "Add a host device to the container")
 	// ulimit is defined as StringSlice, not StringArray, to allow specifying "--ulimit=ULIMIT1,ULIMIT2" (compatible with Podman)
diff --git a/cmd/nerdctl/container/container_run_cgroup_linux_test.go b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
index 2e1fce340df..7c308a1bcaa 100644
--- a/cmd/nerdctl/container/container_run_cgroup_linux_test.go
+++ b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
@@ -668,3 +668,39 @@ func TestRunBlkioSettingCgroupV2(t *testing.T) {
 
 	testCase.Run(t)
 }
+
+func TestRunCPURealTimeSettingCgroupV1(t *testing.T) {
+	nerdtest.Setup()
+
+	testCase := &test.Case{
+		Description: "cpu-rt-runtime-and-period",
+		Require: require.All(
+			require.Not(nerdtest.CGroupV2),
+			nerdtest.Rootful,
+		),
+		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+			return helpers.Command("create", "--name", data.Identifier(),
+				"--cpu-rt-runtime", "950000",
+				"--cpu-rt-period", "1000000",
+				testutil.AlpineImage, "sleep", "infinity")
+		},
+		Cleanup: func(data test.Data, helpers test.Helpers) {
+			helpers.Anyhow("rm", "-f", data.Identifier())
+		},
+		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+			return &test.Expected{
+				ExitCode: 0,
+				Output: expect.All(
+					func(stdout string, info string, t *testing.T) {
+						rtRuntime := helpers.Capture("inspect", "--format", "{{.HostConfig.CPURealtimeRuntime}}", data.Identifier())
+						rtPeriod := helpers.Capture("inspect", "--format", "{{.HostConfig.CPURealtimePeriod}}", data.Identifier())
+						assert.Assert(t, strings.Contains(rtRuntime, "950000"))
+						assert.Assert(t, strings.Contains(rtPeriod, "1000000"))
+					},
+				),
+			}
+		},
+	}
+
+	testCase.Run(t)
+}
diff --git a/docs/command-reference.md b/docs/command-reference.md
index a4d2f7af7be..dc9cdc786fc 100644
--- a/docs/command-reference.md
+++ b/docs/command-reference.md
@@ -203,6 +203,8 @@ Resource flags:
 - :whale: `--cpu-shares`: CPU shares (relative weight)
 - :whale: `--cpuset-cpus`: CPUs in which to allow execution (0-3, 0,1)
 - :whale: `--cpuset-mems`: Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on NUMA systems
+- :whale: `--cpu-rt-period`: Limit CPU real-time period in microseconds. Only supported with cgroup v1.
+- :whale: `--cpu-rt-runtime`: Limit CPU real-time runtime in microseconds. Only supported with cgroup v1.
 - :whale: `--memory`: Memory limit
 - :whale: `--memory-reservation`: Memory soft limit
 - :whale: `--memory-swap`: Swap limit equal to memory plus swap: '-1' to enable unlimited swap
@@ -419,10 +421,8 @@ IPFS flags:
 - :nerd_face: `--ipfs-address`: Multiaddr of IPFS API (default uses `$IPFS_PATH` env variable if defined or local directory `~/.ipfs`)
 
 Unimplemented `docker run` flags:
-    `--cpu-rt-*`, `--device-cgroup-rule`,
-    `--disable-content-trust`, `--expose`, `--health-*`, `--isolation`, `--no-healthcheck`,
-    `--link*`, `--publish-all`, `--storage-opt`,
-    `--userns`, `--volume-driver`
+    `--device-cgroup-rule`, `--disable-content-trust`, `--expose`, `--health-*`, `--isolation`, `--no-healthcheck`,
+    `--link*`, `--publish-all`, `--storage-opt`, `--userns`, `--volume-driver`
 
 ### :whale: :blue_square: nerdctl exec
 
diff --git a/pkg/api/types/container_types.go b/pkg/api/types/container_types.go
index 5325915631d..28e66b8187e 100644
--- a/pkg/api/types/container_types.go
+++ b/pkg/api/types/container_types.go
@@ -114,6 +114,10 @@ type ContainerCreateOptions struct {
 	CPUSetCPUs string
 	// CPUSetMems specifies the memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on NUMA systems.
 	CPUSetMems string
+	// Limit CPU real-time period in microseconds
+	CPURealtimePeriod uint64
+	// Limit CPU real-time runtime in microseconds
+	CPURealtimeRuntime uint64
 	// Memory specifies the memory limit
 	Memory string
 	// MemoryReservationChanged specifies whether the memory soft limit has been changed
diff --git a/pkg/cmd/container/run_cgroup_linux.go b/pkg/cmd/container/run_cgroup_linux.go
index 5216ecc9c57..75eb5f6405b 100644
--- a/pkg/cmd/container/run_cgroup_linux.go
+++ b/pkg/cmd/container/run_cgroup_linux.go
@@ -102,6 +102,19 @@ func generateCgroupOpts(id string, options types.ContainerCreateOptions, interna
 		opts = append(opts, oci.WithCPUsMems(options.CPUSetMems))
 	}
 
+	if options.CPURealtimePeriod != 0 || options.CPURealtimeRuntime != 0 {
+		if !infoutil.CPURealtime(options.GOptions.CgroupManager) {
+			// CPU realtime scheduling is not supported in cgroup V2
+			return nil, errors.New("kernel does not support CPU real-time scheduler")
+		}
+
+		if options.CPURealtimePeriod != 0 && options.CPURealtimeRuntime != 0 &&
+			options.CPURealtimeRuntime > options.CPURealtimePeriod {
+			return nil, errors.New("cpu real-time runtime cannot be higher than cpu real-time period")
+		}
+	}
+	opts = append(opts, oci.WithCPURT(int64(options.CPURealtimeRuntime), options.CPURealtimePeriod))
+
 	var mem64 int64
 	if options.Memory != "" {
 		mem64, err = units.RAMInBytes(options.Memory)
diff --git a/pkg/infoutil/infoutil.go b/pkg/infoutil/infoutil.go
index 965ae4a0c90..ce6bf9085b1 100644
--- a/pkg/infoutil/infoutil.go
+++ b/pkg/infoutil/infoutil.go
@@ -284,3 +284,8 @@ func BlockIOReadIOpsDevice(cgroupManager string) bool {
 func BlockIOWriteIOpsDevice(cgroupManager string) bool {
 	return getMobySysInfo(cgroupManager).BlkioWriteIOpsDevice
 }
+
+// CPURealtime returns whether CPU realtime period is supported or not
+func CPURealtime(cgroupManager string) bool {
+	return getMobySysInfo(cgroupManager).CPURealtime
+}
diff --git a/pkg/inspecttypes/dockercompat/dockercompat.go b/pkg/inspecttypes/dockercompat/dockercompat.go
index e5b797e786d..fb1abf9adf2 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat.go
@@ -167,17 +167,20 @@ type HostConfig struct {
 	Tmpfs   map[string]string `json:"Tmpfs,omitempty"` // List of tmpfs (mounts) used for the container
 	UTSMode string            // UTS namespace to use for the container
 	// UsernsMode      UsernsMode        // The user namespace to use for the container
-	ShmSize        int64             // Size of /dev/shm in bytes. The size must be greater than 0.
-	Sysctls        map[string]string // List of Namespaced sysctls used for the container
-	Runtime        string            // Runtime to use with this container
-	CPUSetMems     string            `json:"CpusetMems"` // CpusetMems 0-2, 0,1
-	CPUSetCPUs     string            `json:"CpusetCpus"` // CpusetCpus 0-2, 0,1
-	CPUQuota       int64             `json:"CpuQuota"`   // CPU CFS (Completely Fair Scheduler) quota
-	CPUShares      uint64            `json:"CpuShares"`  // CPU shares (relative weight vs. other containers)
-	Memory         int64             // Memory limit (in bytes)
-	MemorySwap     int64             // Total memory usage (memory + swap); set `-1` to enable unlimited swap
-	OomKillDisable bool              // specifies whether to disable OOM Killer
-	Devices        []DeviceMapping   // List of devices to map inside the container
+	ShmSize            int64             // Size of /dev/shm in bytes. The size must be greater than 0.
+	Sysctls            map[string]string // List of Namespaced sysctls used for the container
+	Runtime            string            // Runtime to use with this container
+	CPUSetMems         string            `json:"CpusetMems"`         // CpusetMems 0-2, 0,1
+	CPUSetCPUs         string            `json:"CpusetCpus"`         // CpusetCpus 0-2, 0,1
+	CPUQuota           int64             `json:"CpuQuota"`           // CPU CFS (Completely Fair Scheduler) quota
+	CPUShares          uint64            `json:"CpuShares"`          // CPU shares (relative weight vs. other containers)
+	CPUPeriod          uint64            `json:"CpuPeriod"`          // Limits the CPU CFS (Completely Fair Scheduler) period
+	CPURealtimePeriod  uint64            `json:"CpuRealtimePeriod"`  // Limits the CPU real-time period in microseconds
+	CPURealtimeRuntime int64             `json:"CpuRealtimeRuntime"` // Limits the CPU real-time runtime in microseconds
+	Memory             int64             // Memory limit (in bytes)
+	MemorySwap         int64             // Total memory usage (memory + swap); set `-1` to enable unlimited swap
+	OomKillDisable     bool              // specifies whether to disable OOM Killer
+	Devices            []DeviceMapping   // List of devices to map inside the container
 	LinuxBlkioSettings
 }
 
@@ -264,11 +267,14 @@ type DeviceMapping struct {
 	CgroupPermissions string
 }
 
-type cpuSettings struct {
-	cpuSetCpus string
-	cpuSetMems string
-	cpuShares  uint64
-	cpuQuota   int64
+type CPUSettings struct {
+	CPUSetCpus         string
+	CPUSetMems         string
+	CPUShares          uint64
+	CPUQuota           int64
+	CPUPeriod          uint64
+	CPURealtimePeriod  uint64
+	CPURealtimeRuntime int64
 }
 
 // DefaultNetworkSettings is from https://github.com/moby/moby/blob/v20.10.1/api/types/types.go#L405-L414
@@ -478,12 +484,15 @@ func ContainerFromNative(n *native.Container) (*Container, error) {
 
 	cpuSetting, err := cpuSettingsFromNative(n.Spec.(*specs.Spec))
 	if err != nil {
-		return nil, fmt.Errorf("failed to Decode cpuSettings: %v", err)
+		return nil, fmt.Errorf("failed to Decode cpuSetting: %v", err)
 	}
-	c.HostConfig.CPUSetCPUs = cpuSetting.cpuSetCpus
-	c.HostConfig.CPUSetMems = cpuSetting.cpuSetMems
-	c.HostConfig.CPUQuota = cpuSetting.cpuQuota
-	c.HostConfig.CPUShares = cpuSetting.cpuShares
+	c.HostConfig.CPUSetCPUs = cpuSetting.CPUSetCpus
+	c.HostConfig.CPUSetMems = cpuSetting.CPUSetMems
+	c.HostConfig.CPUQuota = cpuSetting.CPUQuota
+	c.HostConfig.CPUShares = cpuSetting.CPUShares
+	c.HostConfig.CPUPeriod = cpuSetting.CPUPeriod
+	c.HostConfig.CPURealtimePeriod = cpuSetting.CPURealtimePeriod
+	c.HostConfig.CPURealtimeRuntime = cpuSetting.CPURealtimeRuntime
 
 	cgroupNamespace, err := getCgroupnsFromNative(n.Spec.(*specs.Spec))
 	if err != nil {
@@ -728,23 +737,32 @@ func networkSettingsFromNative(n *native.NetNS, sp *specs.Spec) (*NetworkSetting
 	return res, nil
 }
 
-func cpuSettingsFromNative(sp *specs.Spec) (*cpuSettings, error) {
-	res := &cpuSettings{}
+func cpuSettingsFromNative(sp *specs.Spec) (*CPUSettings, error) {
+	res := &CPUSettings{}
 	if sp.Linux != nil && sp.Linux.Resources != nil && sp.Linux.Resources.CPU != nil {
 		if sp.Linux.Resources.CPU.Cpus != "" {
-			res.cpuSetCpus = sp.Linux.Resources.CPU.Cpus
+			res.CPUSetCpus = sp.Linux.Resources.CPU.Cpus
 		}
 
 		if sp.Linux.Resources.CPU.Mems != "" {
-			res.cpuSetMems = sp.Linux.Resources.CPU.Mems
+			res.CPUSetMems = sp.Linux.Resources.CPU.Mems
 		}
 
 		if sp.Linux.Resources.CPU.Shares != nil && *sp.Linux.Resources.CPU.Shares > 0 {
-			res.cpuShares = *sp.Linux.Resources.CPU.Shares
+			res.CPUShares = *sp.Linux.Resources.CPU.Shares
 		}
 
 		if sp.Linux.Resources.CPU.Quota != nil && *sp.Linux.Resources.CPU.Quota > 0 {
-			res.cpuQuota = *sp.Linux.Resources.CPU.Quota
+			res.CPUQuota = *sp.Linux.Resources.CPU.Quota
+		}
+		if sp.Linux.Resources.CPU.Period != nil && *sp.Linux.Resources.CPU.Period > 0 {
+			res.CPUPeriod = *sp.Linux.Resources.CPU.Period
+		}
+		if sp.Linux.Resources.CPU.RealtimePeriod != nil && *sp.Linux.Resources.CPU.RealtimePeriod > 0 {
+			res.CPURealtimePeriod = *sp.Linux.Resources.CPU.RealtimePeriod
+		}
+		if sp.Linux.Resources.CPU.RealtimeRuntime != nil && *sp.Linux.Resources.CPU.RealtimeRuntime > 0 {
+			res.CPURealtimeRuntime = *sp.Linux.Resources.CPU.RealtimeRuntime
 		}
 	}
 
diff --git a/pkg/inspecttypes/dockercompat/dockercompat_test.go b/pkg/inspecttypes/dockercompat/dockercompat_test.go
index 4966ce89604..a31286bff36 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat_test.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat_test.go
@@ -417,3 +417,97 @@ func TestNetworkSettingsFromNative(t *testing.T) {
 		})
 	}
 }
+
+func TestCpuSettingsFromNative(t *testing.T) {
+	// Helper function to create uint64 pointer
+	uint64Ptr := func(i uint64) *uint64 {
+		return &i
+	}
+
+	int64Ptr := func(i int64) *int64 {
+		return &i
+	}
+
+	testcases := []struct {
+		name     string
+		spec     *specs.Spec
+		expected *CPUSettings
+	}{
+		{
+			name:     "Test with empty spec",
+			spec:     &specs.Spec{},
+			expected: &CPUSettings{},
+		},
+		{
+			name: "Full CPU Settings",
+			spec: &specs.Spec{
+				Linux: &specs.Linux{
+					Resources: &specs.LinuxResources{
+						CPU: &specs.LinuxCPU{
+							Cpus:            "0-3",
+							Mems:            "0-1",
+							Shares:          uint64Ptr(1024),
+							Quota:           int64Ptr(100000),
+							Period:          uint64Ptr(100000),
+							RealtimePeriod:  uint64Ptr(1000000),
+							RealtimeRuntime: int64Ptr(950000),
+						},
+					},
+				},
+			},
+			expected: &CPUSettings{
+				CPUSetCpus:         "0-3",
+				CPUSetMems:         "0-1",
+				CPUShares:          1024,
+				CPUQuota:           100000,
+				CPUPeriod:          100000,
+				CPURealtimePeriod:  1000000,
+				CPURealtimeRuntime: 950000,
+			},
+		},
+		{
+			name: "Partial CPU Settings",
+			spec: &specs.Spec{
+				Linux: &specs.Linux{
+					Resources: &specs.LinuxResources{
+						CPU: &specs.LinuxCPU{
+							Cpus:   "0,1",
+							Shares: uint64Ptr(512),
+						},
+					},
+				},
+			},
+			expected: &CPUSettings{
+				CPUSetCpus: "0,1",
+				CPUShares:  512,
+			},
+		},
+		{
+			name: "Zero Values Should Be Ignored",
+			spec: &specs.Spec{
+				Linux: &specs.Linux{
+					Resources: &specs.LinuxResources{
+						CPU: &specs.LinuxCPU{
+							Shares:          uint64Ptr(0),
+							Quota:           int64Ptr(0),
+							Period:          uint64Ptr(0),
+							RealtimePeriod:  uint64Ptr(0),
+							RealtimeRuntime: int64Ptr(0),
+						},
+					},
+				},
+			},
+			expected: &CPUSettings{},
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			result, err := cpuSettingsFromNative(tc.spec)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			assert.DeepEqual(t, result, tc.expected)
+		})
+	}
+}
diff --git a/pkg/inspecttypes/dockercompat/info.go b/pkg/inspecttypes/dockercompat/info.go
index c1f137650f0..4cfa3974f22 100644
--- a/pkg/inspecttypes/dockercompat/info.go
+++ b/pkg/inspecttypes/dockercompat/info.go
@@ -37,6 +37,7 @@ type Info struct {
 	CPUCfsQuota       bool `json:"CpuCfsQuota"`
 	CPUShares         bool
 	CPUSet            bool
+	CPURealtime       bool
 	PidsLimit         bool
 	IPv4Forwarding    bool
 	BridgeNfIptables  bool

From a1665689160036a219254b719bb52475e1456533 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 10 Apr 2025 22:04:14 +0000
Subject: [PATCH 065/225] build(deps): bump
 github.com/compose-spec/compose-go/v2

Bumps [github.com/compose-spec/compose-go/v2](https://github.com/compose-spec/compose-go) from 2.5.0 to 2.6.0.
- [Release notes](https://github.com/compose-spec/compose-go/releases)
- [Commits](https://github.com/compose-spec/compose-go/compare/v2.5.0...v2.6.0)

---
updated-dependencies:
- dependency-name: github.com/compose-spec/compose-go/v2
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index b170c204199..2d374b2e381 100644
--- a/go.mod
+++ b/go.mod
@@ -6,7 +6,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.3.1
 	github.com/Microsoft/go-winio v0.6.2
 	github.com/Microsoft/hcsshim v0.12.9
-	github.com/compose-spec/compose-go/v2 v2.5.0
+	github.com/compose-spec/compose-go/v2 v2.6.0
 	github.com/containerd/accelerated-container-image v1.3.0
 	github.com/containerd/cgroups/v3 v3.0.5
 	github.com/containerd/console v1.0.4
diff --git a/go.sum b/go.sum
index 2521e262c56..a29d712875a 100644
--- a/go.sum
+++ b/go.sum
@@ -21,8 +21,8 @@ github.com/cilium/ebpf v0.16.0 h1:+BiEnHL6Z7lXnlGUsXQPPAE7+kenAd4ES8MQ5min0Ok=
 github.com/cilium/ebpf v0.16.0/go.mod h1:L7u2Blt2jMM/vLAVgjxluxtBKlz3/GWjB0dMOEngfwE=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/compose-spec/compose-go/v2 v2.5.0 h1:Y1hYWfYaBsAAHwggXME1LjoZENq7bP0tj9gqQxYwKR8=
-github.com/compose-spec/compose-go/v2 v2.5.0/go.mod h1:vPlkN0i+0LjLf9rv52lodNMUTJF5YHVfHVGLLIP67NA=
+github.com/compose-spec/compose-go/v2 v2.6.0 h1:/+oBD2ixSENOeN/TlJqWZmUak0xM8A7J08w/z661Wd4=
+github.com/compose-spec/compose-go/v2 v2.6.0/go.mod h1:vPlkN0i+0LjLf9rv52lodNMUTJF5YHVfHVGLLIP67NA=
 github.com/containerd/accelerated-container-image v1.3.0 h1:sFbTgSuMboeKHa9f7MY11hWF1XxVWjFoiTsXYtOtvdU=
 github.com/containerd/accelerated-container-image v1.3.0/go.mod h1:EvKVWor6ZQNUyYp0MZm5hw4k21ropuz7EegM+m/Jb/Q=
 github.com/containerd/cgroups/v3 v3.0.5 h1:44na7Ud+VwyE7LIoJ8JTNQOa549a8543BmzaJHo6Bzo=

From 2def90d0be3b98456240eed3df494ae8a080ddf1 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 3 Apr 2025 10:57:08 -0700
Subject: [PATCH 066/225] Update golangci

This commit relaxes line length from 100 to 120, and disables a bunch of linters we do not want.

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/.golangci.yml | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/mod/tigron/.golangci.yml b/mod/tigron/.golangci.yml
index 4e312afa579..1c17cd11206 100644
--- a/mod/tigron/.golangci.yml
+++ b/mod/tigron/.golangci.yml
@@ -13,11 +13,23 @@ issues:
 linters:
   default: all
   disable:
-    - cyclop
-    - exhaustruct
-    - funlen
-    - godox
-    - nonamedreturns
+    # These are the linters that we know we do not want
+    - cyclop          # provided by revive
+    - exhaustruct     # does not serve much of a purpose
+    - funlen          # provided by revive
+    - gocognit        # provided by revive
+    - goconst         # provided by revive
+    - godox           # not helpful unless we could downgrade it to warning / info
+    - ginkgolinter    # no ginkgo
+    - gomodguard      # we use depguard instead
+    - ireturn         # too annoying with not enough value
+    - lll             # provided by golines
+    - nonamedreturns  # named returns are occasionally useful
+    - prealloc        # premature optimization
+    - promlinter      # no prometheus
+    - sloglint        # no slog
+    - testifylint     # no testify
+    - zerologlint     # no zerolog
   settings:
     depguard:
       rules:
@@ -51,7 +63,7 @@ formatters:
     gofumpt:
       extra-rules: true
     golines:
-      max-len: 100
+      max-len: 120
       tab-len: 4
       shorten-comments: true
   enable:

From 0bf31d0a67901d677486c666b254e9c499814934 Mon Sep 17 00:00:00 2001
From: Jayesh Kale <jayesh6297@gmail.com>
Date: Thu, 10 Apr 2025 23:53:04 +0530
Subject: [PATCH 067/225] (fix) stopping container when setup using setuid bit

when nerdctl setup to run `setuid bit`,
nerdctl failed to execute `container stop` command.
the fix is to add the checks for uid and euid.
for more information refer this issue https://github.com/containerd/nerdctl/issues/4098

fix ci freebsd and windows build

removed irrelevant changes and added addtional information for change

removed runtime linux check for os build file

Signed-off-by: Jayesh Kale <jayesh6297@gmail.com>
---
 cmd/nerdctl/main.go         |  5 ++++-
 cmd/nerdctl/main_freebsd.go |  5 +++++
 cmd/nerdctl/main_linux.go   | 16 ++++++++++++++++
 cmd/nerdctl/main_windows.go |  5 +++++
 4 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/cmd/nerdctl/main.go b/cmd/nerdctl/main.go
index 8bdcad92381..1efadbe99d3 100644
--- a/cmd/nerdctl/main.go
+++ b/cmd/nerdctl/main.go
@@ -190,7 +190,6 @@ func initRootCmdFlags(rootCmd *cobra.Command, tomlPath string) (*pflag.FlagSet,
 }
 
 func newApp() (*cobra.Command, error) {
-
 	tomlPath := ncdefaults.NerdctlTOML()
 	if v, ok := os.LookupEnv("NERDCTL_TOML"); ok {
 		tomlPath = v
@@ -217,6 +216,10 @@ Config file ($NERDCTL_TOML): %s
 		return nil, err
 	}
 
+	if err := resetSavedSETUID(); err != nil {
+		return nil, err
+	}
+
 	rootCmd.PersistentPreRunE = func(cmd *cobra.Command, args []string) error {
 		globalOptions, err := helpers.ProcessRootCmdFlags(cmd)
 		if err != nil {
diff --git a/cmd/nerdctl/main_freebsd.go b/cmd/nerdctl/main_freebsd.go
index 391d34cfeed..089974e1760 100644
--- a/cmd/nerdctl/main_freebsd.go
+++ b/cmd/nerdctl/main_freebsd.go
@@ -27,3 +27,8 @@ func appNeedsRootlessParentMain(cmd *cobra.Command, args []string) bool {
 func addApparmorCommand(rootCmd *cobra.Command) {
 	// NOP
 }
+
+func resetSavedSETUID() error {
+	// NOP
+	return nil
+}
diff --git a/cmd/nerdctl/main_linux.go b/cmd/nerdctl/main_linux.go
index 0bf52d3ca23..5aba7c2f480 100644
--- a/cmd/nerdctl/main_linux.go
+++ b/cmd/nerdctl/main_linux.go
@@ -18,6 +18,7 @@ package main
 
 import (
 	"github.com/spf13/cobra"
+	"golang.org/x/sys/unix"
 
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/apparmor"
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
@@ -66,3 +67,18 @@ func appNeedsRootlessParentMain(cmd *cobra.Command, args []string) bool {
 func addApparmorCommand(rootCmd *cobra.Command) {
 	rootCmd.AddCommand(apparmor.Command())
 }
+
+// resetSavedSETUID drops the saved UID of a setuid-root process to the original real UID.
+// This ensures the process cannot regain root privileges later.
+// It only performs the operation if the process is currently running with effective UID 0 (root)
+// and was started by a non-root user (i.e., real UID != effective UID).
+// For more info see issue https://github.com/containerd/nerdctl/issues/4098
+func resetSavedSETUID() error {
+	var err error
+	uid := unix.Getuid()
+	euid := unix.Geteuid()
+	if uid != euid && euid == 0 {
+		err = unix.Setresuid(0, 0, uid)
+	}
+	return err
+}
diff --git a/cmd/nerdctl/main_windows.go b/cmd/nerdctl/main_windows.go
index 391d34cfeed..089974e1760 100644
--- a/cmd/nerdctl/main_windows.go
+++ b/cmd/nerdctl/main_windows.go
@@ -27,3 +27,8 @@ func appNeedsRootlessParentMain(cmd *cobra.Command, args []string) bool {
 func addApparmorCommand(rootCmd *cobra.Command) {
 	// NOP
 }
+
+func resetSavedSETUID() error {
+	// NOP
+	return nil
+}

From e3a4c70239abb1ed7141f7c1e5255f5a0dcda277 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 3 Apr 2025 10:29:49 -0700
Subject: [PATCH 068/225] Adding mimicry (internal mock mechanism)

Mimicry is a lightweight, zero dependency mock mechanism created to ease testing of Tigron.
Since Tigron heavily relies on *testing.T, it is currently hard to test.
Moving away to a tig.T interface instead of *testing.T will unlock the ability to mock.
Mimicry does provide:
- recording of all function calls, with arguments and complete stack trace (see Report())
- optional custom handling of function calls (see Register())
- QOL: fancyfied OCS8 links allow opening files from traces in terminal

UX is largely in flux right now and experimental, but the objective is to:
- do not require code generation
- do not abuse reflection
- keep the amount of boilerplate to the absolute minimum for the mock consumer
- ... and as small as possible for the mock creator
- keep zero dependencies

This commit also introduce the tig.T interface to be used everywhere inside Tigron in the future,
along with a complete mock for it.

Mimicry is not meant to be used directly for now, though, if there is interest, a future
version might graduate out of `internal`.

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/internal/formatter/doc.go       |  18 +++
 mod/tigron/internal/formatter/formatter.go |  95 +++++++++++++
 mod/tigron/internal/formatter/osc8.go      |  31 +++++
 mod/tigron/internal/mimicry/doc.go         |  21 +++
 mod/tigron/internal/mimicry/doc.md         | 118 +++++++++++++++++
 mod/tigron/internal/mimicry/mimicry.go     | 147 +++++++++++++++++++++
 mod/tigron/internal/mimicry/print.go       |  59 +++++++++
 mod/tigron/internal/mimicry/stack.go       | 130 ++++++++++++++++++
 mod/tigron/internal/mocks/doc.go           |  18 +++
 mod/tigron/internal/mocks/t.go             |  95 +++++++++++++
 mod/tigron/tig/doc.go                      |  20 +++
 mod/tigron/tig/t.go                        |  40 ++++++
 12 files changed, 792 insertions(+)
 create mode 100644 mod/tigron/internal/formatter/doc.go
 create mode 100644 mod/tigron/internal/formatter/formatter.go
 create mode 100644 mod/tigron/internal/formatter/osc8.go
 create mode 100644 mod/tigron/internal/mimicry/doc.go
 create mode 100644 mod/tigron/internal/mimicry/doc.md
 create mode 100644 mod/tigron/internal/mimicry/mimicry.go
 create mode 100644 mod/tigron/internal/mimicry/print.go
 create mode 100644 mod/tigron/internal/mimicry/stack.go
 create mode 100644 mod/tigron/internal/mocks/doc.go
 create mode 100644 mod/tigron/internal/mocks/t.go
 create mode 100644 mod/tigron/tig/doc.go
 create mode 100644 mod/tigron/tig/t.go

diff --git a/mod/tigron/internal/formatter/doc.go b/mod/tigron/internal/formatter/doc.go
new file mode 100644
index 00000000000..e03daea02b6
--- /dev/null
+++ b/mod/tigron/internal/formatter/doc.go
@@ -0,0 +1,18 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package formatter provides simple formatting helpers for internal consumption.
+package formatter
diff --git a/mod/tigron/internal/formatter/formatter.go b/mod/tigron/internal/formatter/formatter.go
new file mode 100644
index 00000000000..765a3be575f
--- /dev/null
+++ b/mod/tigron/internal/formatter/formatter.go
@@ -0,0 +1,95 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package formatter
+
+import (
+	"fmt"
+	"strings"
+	"unicode/utf8"
+)
+
+const (
+	maxLineLength = 110
+	maxLines      = 100
+	kMaxLength    = 7
+)
+
+func chunk(s string, length int) []string {
+	var chunks []string
+
+	lines := strings.Split(s, "\n")
+
+	for x := 0; x < maxLines && x < len(lines); x++ {
+		line := lines[x]
+		if utf8.RuneCountInString(line) < length {
+			chunks = append(chunks, line)
+
+			continue
+		}
+
+		for index := 0; index < utf8.RuneCountInString(line); index += length {
+			end := index + length
+			if end > utf8.RuneCountInString(line) {
+				end = utf8.RuneCountInString(line)
+			}
+
+			chunks = append(chunks, string([]rune(line)[index:end]))
+		}
+	}
+
+	if len(chunks) == maxLines {
+		chunks = append(chunks, "...")
+	}
+
+	return chunks
+}
+
+// Table formats a `n x 2` dataset into a series of rows.
+// FIXME: the problem with full-width emoji is that they are going to eff-up the maths and display
+// here...
+// Maybe the csv writer could be cheat-used to get the right widths.
+//
+//nolint:mnd // Too annoying
+func Table(data [][]any) string {
+	var output string
+
+	for _, row := range data {
+		key := fmt.Sprintf("%v", row[0])
+		value := strings.ReplaceAll(fmt.Sprintf("%v", row[1]), "\t", "  ")
+
+		output += fmt.Sprintf("+%s+\n", strings.Repeat("-", maxLineLength-2))
+
+		if utf8.RuneCountInString(key) > kMaxLength {
+			key = string([]rune(key)[:kMaxLength-3]) + "..."
+		}
+
+		for _, line := range chunk(value, maxLineLength-kMaxLength-7) {
+			output += fmt.Sprintf(
+				"| %-*s | %-*s |\n",
+				kMaxLength,
+				key,
+				maxLineLength-kMaxLength-7,
+				line,
+			)
+			key = ""
+		}
+	}
+
+	output += fmt.Sprintf("+%s+", strings.Repeat("-", maxLineLength-2))
+
+	return output
+}
diff --git a/mod/tigron/internal/formatter/osc8.go b/mod/tigron/internal/formatter/osc8.go
new file mode 100644
index 00000000000..4a4874a3a9d
--- /dev/null
+++ b/mod/tigron/internal/formatter/osc8.go
@@ -0,0 +1,31 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package formatter
+
+import "fmt"
+
+// OSC8 hyperlinks implementation.
+type OSC8 struct {
+	Location string `json:"location"`
+	Line     int    `json:"line"`
+	Text     string `json:"text"`
+}
+
+func (o *OSC8) String() string {
+	// FIXME: not sure if any desktop software does support line numbers anchors?
+	return fmt.Sprintf("\x1b]8;;%s#%d:1\x07%s\x1b]8;;\x07"+"\u001b[0m", o.Location, o.Line, o.Text)
+}
diff --git a/mod/tigron/internal/mimicry/doc.go b/mod/tigron/internal/mimicry/doc.go
new file mode 100644
index 00000000000..289acf8e59e
--- /dev/null
+++ b/mod/tigron/internal/mimicry/doc.go
@@ -0,0 +1,21 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package mimicry provides a very rough and rudimentary mimicry library to help with internal tigron testing.
+// It does not require generation, does not abuse reflect (too much), and keeps the amount of boilerplate baloney to a
+// minimum.
+// This is NOT a generic mock library. Use something else if you need one.
+package mimicry
diff --git a/mod/tigron/internal/mimicry/doc.md b/mod/tigron/internal/mimicry/doc.md
new file mode 100644
index 00000000000..4e37122350a
--- /dev/null
+++ b/mod/tigron/internal/mimicry/doc.md
@@ -0,0 +1,118 @@
+# [INTERNAL] [EXPERIMENTAL] Mimicry
+
+## Creating a Mock
+
+```golang
+package mymock
+
+import "github.com/containerd/nerdctl/mod/tigron/internal/mimicry"
+
+// Let's assume we want to mock the following, likely defined somewhere else
+// type InterfaceToBeMocked interface {
+//    SomeMethod(one string, two int) error
+// }
+
+// Compile time ensure the mock does fulfill the interface
+var _ InterfaceToBeMocked = &MyMock{}
+
+type MyMock struct {
+    // Embed mimicry core
+	mimicry.Core
+}
+
+// First, describe function parameters and return values.
+type (
+    MyMockSomeMethodIn struct {
+        one string
+        two int
+    }
+
+    MyMockSomeMethodOut = error
+)
+
+// Satisfy the interface + wire-in the handler mechanism
+
+func (m *MyMock) SomeMethod(one string, two int) error {
+	// Call mimicry method Retrieve that will record the call, and return a custom handler if one is defined
+    if handler := m.Retrieve(); handler != nil {
+		// Call the optional handler if there is one.
+        return handler.(mimicry.Function[MyMockSomeMethodIn, MyMockSomeMethodOut])(MyMockSomeMethodIn{
+            one: one,
+            two: two,
+        })
+    }
+
+    return nil
+}
+```
+
+
+## Using a Mock
+
+For consumers, the simplest way to use the mock is to inspect calls after the fact:
+
+```golang
+package mymock
+
+import "testing"
+
+// This is the code you want to test, that does depend on the interface we are mocking.
+// func functionYouWantToTest(o InterfaceToBeMocked, i int) {
+//    o.SomeMethod("lala", i)
+// }
+
+func TestOne(t *testing.T) {
+	// Create the mock from above
+    mocky := &MyMock{}
+
+	// Call the function you want to test
+    functionYouWantToTest(mocky, 42)
+    functionYouWantToTest(mocky, 123)
+
+    // Now you can inspect the calls log for that function.
+    report := mocky.Report(InterfaceToBeMocked.SomeMethod)
+    t.Log("Number of times it was called:", len(report))
+    t.Log("Inspecting the last call:")
+    t.Log(mimicry.PrintCall(report[len(report)-1]))
+}
+```
+
+## Using handlers
+
+Implementing handlers allows active interception of the calls for more elaborate scenarios.
+
+```golang
+package main_test
+
+import "testing"
+
+// The method you want to test against the mock
+// func functionYouWantToTest(o InterfaceToBeMocked, i int) {
+//    o.SomeMethod("lala", i)
+// }
+
+func TestTwo(t *testing.T) {
+	// Create the base mock
+    mocky := &MyMock{}
+
+	// Declare a custom handler for the method `SomeMethod`
+    mocky.Register(InterfaceToBeMocked.SomeMethod, func(in MyMockSomeMethodIn) MyMockSomeMethodOut {
+        t.Log("Got parameters", in)
+
+        // We want to fail on that
+        if in.two == 42 {
+            // Print out the callstack
+            report := mocky.Report(InterfaceToBeMocked.SomeMethod)
+            t.Log(mimicry.PrintCall(report[len(report)-1]))
+            t.Error("We do not want to ever receive 42. Inspect trace above.")
+        }else{
+            t.Log("all fine - we did not see 42")
+        }
+
+        return nil
+    })
+
+    functionYouWantToTest(mocky, 123)
+    functionYouWantToTest(mocky, 42)
+}
+```
diff --git a/mod/tigron/internal/mimicry/mimicry.go b/mod/tigron/internal/mimicry/mimicry.go
new file mode 100644
index 00000000000..60deb6c1a34
--- /dev/null
+++ b/mod/tigron/internal/mimicry/mimicry.go
@@ -0,0 +1,147 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package mimicry
+
+import (
+	"reflect"
+	"runtime"
+	"strings"
+	"time"
+)
+
+const callStackMaxDepth = 5
+
+var _ Mocked = &Core{}
+
+// Mocked is the interface representing a fully-mocking struct (both for Designer and Consumer).
+type Mocked interface {
+	Consumer
+	Designer
+}
+
+// Function is a generics for any mockable function.
+type Function[IN any, OUT any] = func(IN) OUT
+
+// Consumer is the mock interface exposed to mock users.
+// It defines a handful of methods to register a custom handler, get and reset calls reports.
+type Consumer interface {
+	Register(fun, handler any)
+	Report(fun any) []*Call
+	Reset()
+}
+
+// Designer is the mock interface that mock creators can use to write function boilerplate.
+type Designer interface {
+	Retrieve(args ...any) any
+}
+
+// Core is a concrete implementation that any mock struct can embed to satisfy Mocked.
+// FIXME: this is not safe to use concurrently.
+type Core struct {
+	mockedFunctions map[string]any
+	callsList       map[string][]*Call
+}
+
+// Reset does reset the callStack records for all functions.
+func (mi *Core) Reset() {
+	mi.callsList = make(map[string][]*Call)
+}
+
+// Report returns all Calls made to the referenced function.
+func (mi *Core) Report(fun any) []*Call {
+	fid := getFunID(fun)
+
+	if mi.callsList == nil {
+		mi.callsList = make(map[string][]*Call)
+	}
+
+	ret, ok := mi.callsList[fid]
+	if !ok {
+		ret = []*Call{}
+	}
+
+	return ret
+}
+
+// Retrieve returns a registered custom handler for that function if there is one.
+func (mi *Core) Retrieve(args ...any) any {
+	// Get the frames.
+	pc := make([]uintptr, callStackMaxDepth)
+	//nolint:mnd // Whatever mnd...
+	n := runtime.Callers(2, pc)
+	callersFrames := runtime.CallersFrames(pc[:n])
+	// This is the frame associate with the mock currently calling retrieve, so, extract the short
+	// name of it.
+	frame, _ := callersFrames.Next()
+	nm := strings.Split(frame.Function, ".")
+	fid := nm[len(nm)-1]
+
+	// Initialize callsList if need be
+	if mi.callsList == nil {
+		mi.callsList = make(map[string][]*Call)
+	}
+
+	// Now, get the remaining frames until we hit the go library or the call stack depth limit.
+	frames := []*Frame{}
+
+	for range callStackMaxDepth {
+		frame, _ = callersFrames.Next()
+		if isStd(frame.Function) {
+			break
+		}
+
+		frames = append(frames, &Frame{
+			File:     frame.File,
+			Function: frame.Function,
+			Line:     frame.Line,
+		})
+	}
+
+	// Stuff into the call list.
+	mi.callsList[fid] = append(mi.callsList[fid], &Call{
+		Time:   time.Now(),
+		Args:   args,
+		Frames: frames,
+	})
+
+	// See if we have a registered handler and return it if so.
+	if ret, ok := mi.mockedFunctions[fid]; ok {
+		return ret
+	}
+
+	return nil
+}
+
+// Register does declare an explicit handler for that function.
+func (mi *Core) Register(fun, handler any) {
+	if mi.mockedFunctions == nil {
+		mi.mockedFunctions = make(map[string]any)
+	}
+
+	mi.mockedFunctions[getFunID(fun)] = handler
+}
+
+func getFunID(fun any) string {
+	// The point of keeping only the func name is to avoid type mismatch dependent on what interface
+	// is used by the
+	// consumer.
+	origin := runtime.FuncForPC(reflect.ValueOf(fun).Pointer()).Name()
+	seg := strings.Split(origin, ".")
+	origin = seg[len(seg)-1]
+
+	return origin
+}
diff --git a/mod/tigron/internal/mimicry/print.go b/mod/tigron/internal/mimicry/print.go
new file mode 100644
index 00000000000..96c333c63da
--- /dev/null
+++ b/mod/tigron/internal/mimicry/print.go
@@ -0,0 +1,59 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package mimicry
+
+import (
+	"strings"
+	"time"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/formatter"
+)
+
+const (
+	maxLineLength       = 110
+	sourceLineAround    = 2
+	breakpointDecorator = "🔴"
+	frameDecorator      = "⬆️"
+)
+
+// PrintCall does fancy format a Call.
+func PrintCall(call *Call) string {
+	sectionSeparator := strings.Repeat("_", maxLineLength)
+
+	debug := [][]any{
+		{"Arguments", call.Args},
+		{"Time", call.Time.Format(time.RFC3339)},
+	}
+
+	output := []string{
+		formatter.Table(debug),
+		sectionSeparator,
+	}
+
+	marker := breakpointDecorator
+	for _, v := range call.Frames {
+		output = append(output,
+			v.String(),
+			sectionSeparator,
+			v.Excerpt(sourceLineAround, marker),
+			sectionSeparator,
+		)
+		marker = frameDecorator
+	}
+
+	return "\n" + strings.Join(output, "\n")
+}
diff --git a/mod/tigron/internal/mimicry/stack.go b/mod/tigron/internal/mimicry/stack.go
new file mode 100644
index 00000000000..d712a5a71ed
--- /dev/null
+++ b/mod/tigron/internal/mimicry/stack.go
@@ -0,0 +1,130 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package mimicry
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/formatter"
+)
+
+const (
+	hyperlinkDecorator = "🔗"
+	intoDecorator      = "↪"
+)
+
+// Call is used to store information about a call to a function of the mocked struct, including
+// arguments, time, and
+// frames.
+type Call struct {
+	Time   time.Time
+	Args   []any
+	Frames []*Frame
+}
+
+// A Frame stores information about a call code-path: file, line number and function name.
+type Frame struct {
+	File     string
+	Function string
+	Line     int
+}
+
+// String returns an OSC8 hyperlink pointing to the source along with package and function
+// information.
+// FIXME: we are mixing formatting concerns here.
+// FIXME: this is gibberish to read.
+func (f *Frame) String() string {
+	cwd, _ := os.Getwd()
+
+	rel, err := filepath.Rel(cwd, f.File)
+	if err != nil {
+		rel = f.File
+	}
+
+	spl := strings.Split(f.Function, ".")
+	fun := spl[len(spl)-1]
+	mod := strings.Join(spl[:len(spl)-1], ".")
+
+	return hyperlinkDecorator + " " + (&formatter.OSC8{
+		Location: "file://" + f.File,
+		Line:     f.Line,
+		Text:     fmt.Sprintf("%s:%d", rel, f.Line),
+	}).String() +
+		fmt.Sprintf(
+			"\n%6s package %q\n",
+			intoDecorator,
+			mod,
+		) +
+		fmt.Sprintf(
+			"%8s func %s",
+			" "+intoDecorator,
+			fun,
+		)
+}
+
+// Excerpt will return the source code content associated with the frame + a few lines around.
+func (f *Frame) Excerpt(add int, marker string) string {
+	source, err := os.Open(f.File)
+	if err != nil {
+		return ""
+	}
+
+	defer func() {
+		_ = source.Close()
+	}()
+
+	index := 1
+	scanner := bufio.NewScanner(source)
+
+	for ; scanner.Err() == nil && index < f.Line-add; index++ {
+		if !scanner.Scan() {
+			break
+		}
+
+		_ = scanner.Text()
+	}
+
+	capt := []string{}
+
+	for ; scanner.Err() == nil && index <= f.Line+add; index++ {
+		if !scanner.Scan() {
+			break
+		}
+
+		line := scanner.Text()
+		if index == f.Line {
+			line = fmt.Sprintf("%6d %s %s", index, marker, line)
+		} else {
+			// FIXME: see other similar note. Rune counting is not display-width, so...
+			line = fmt.Sprintf("%6d %*s %s", index, utf8.RuneCountInString(marker), "", line)
+		}
+
+		capt = append(capt, line)
+	}
+
+	return strings.Join(capt, "\n")
+}
+
+func isStd(in string) bool {
+	return !strings.Contains(in, "/")
+}
diff --git a/mod/tigron/internal/mocks/doc.go b/mod/tigron/internal/mocks/doc.go
new file mode 100644
index 00000000000..abc96ad625d
--- /dev/null
+++ b/mod/tigron/internal/mocks/doc.go
@@ -0,0 +1,18 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package mocks provides a collection of tigron internal mocks to ease testing.
+package mocks
diff --git a/mod/tigron/internal/mocks/t.go b/mod/tigron/internal/mocks/t.go
new file mode 100644
index 00000000000..7665fd4fe3b
--- /dev/null
+++ b/mod/tigron/internal/mocks/t.go
@@ -0,0 +1,95 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+//nolint:forcetypeassert
+//revive:disable:exported,max-public-structs,package-comments
+package mocks
+
+// FIXME: type asserts...
+
+import (
+	"github.com/containerd/nerdctl/mod/tigron/internal/mimicry"
+	"github.com/containerd/nerdctl/mod/tigron/tig"
+)
+
+type T interface {
+	tig.T
+	mimicry.Consumer
+}
+
+type (
+	THelperIn  struct{}
+	THelperOut struct{}
+
+	TFailIn  struct{}
+	TFailOut struct{}
+
+	TFailNowIn  struct{}
+	TFailNowOut struct{}
+
+	TLogIn  []any
+	TLogOut struct{}
+
+	TNameIn  struct{}
+	TNameOut = string
+
+	TTempDirIn  struct{}
+	TTempDirOut = string
+)
+
+type MockT struct {
+	mimicry.Core
+}
+
+func (m *MockT) Helper() {
+	if handler := m.Retrieve(); handler != nil {
+		handler.(mimicry.Function[THelperIn, THelperOut])(THelperIn{})
+	}
+}
+
+func (m *MockT) FailNow() {
+	if handler := m.Retrieve(); handler != nil {
+		handler.(mimicry.Function[TFailNowIn, TFailNowOut])(TFailNowIn{})
+	}
+}
+
+func (m *MockT) Fail() {
+	if handler := m.Retrieve(); handler != nil {
+		handler.(mimicry.Function[TFailIn, TFailOut])(TFailIn{})
+	}
+}
+
+func (m *MockT) Log(args ...any) {
+	if handler := m.Retrieve(args...); handler != nil {
+		handler.(mimicry.Function[TLogIn, TLogOut])(args)
+	}
+}
+
+func (m *MockT) Name() string {
+	if handler := m.Retrieve(); handler != nil {
+		return handler.(mimicry.Function[TNameIn, TNameOut])(TNameIn{})
+	}
+
+	return ""
+}
+
+func (m *MockT) TempDir() string {
+	if handler := m.Retrieve(); handler != nil {
+		return handler.(mimicry.Function[TTempDirIn, TTempDirOut])(TTempDirIn{})
+	}
+
+	return ""
+}
diff --git a/mod/tigron/tig/doc.go b/mod/tigron/tig/doc.go
new file mode 100644
index 00000000000..6349b286a57
--- /dev/null
+++ b/mod/tigron/tig/doc.go
@@ -0,0 +1,20 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package tig defines interfaces for third-party packages that tigron needs to interact with.
+// The main upside of expressing our expectations instead of depending directly on concrete implementations is
+// evidently the ability to mock easily, which in turn makes testing much easier.
+package tig
diff --git a/mod/tigron/tig/t.go b/mod/tigron/tig/t.go
new file mode 100644
index 00000000000..f6256b72404
--- /dev/null
+++ b/mod/tigron/tig/t.go
@@ -0,0 +1,40 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package tig
+
+// T is what Tigron needs from a testing implementation (*testing.T obviously satisfies it).
+//
+// Expert note: using the testing.TB interface instead is tempting, but not possible, as the go authors made it
+// impossible to implement (by declaring a private method on it):
+// https://cs.opensource.google/go/go/+/refs/tags/go1.24.2:src/testing/testing.go;l=913-939
+// Generally speaking, interfaces in go should be defined by the consumer, not the producer.
+// Depending on producers' interfaces make them much harder to change for the producer, harder (or impossible) to mock,
+// and decreases modularity.
+// On the other hand, consumer defined interfaces allows to remove direct dependencies on implementation and encourages
+// depending on abstraction instead, and reduces the interface size of what has to be mocked to just what is actually
+// needed.
+// This is a fundamental difference compared to traditional compiled languages that forces code to declare which
+// interfaces it implements, while go interfaces are more a form of duck-typing.
+// See https://www.airs.com/blog/archives/277 for more.
+type T interface {
+	Helper()
+	FailNow()
+	Fail()
+	Log(args ...any)
+	Name() string
+	TempDir() string
+}

From 33836f6d871e8baa7e3cc1d56da022d90d4c1037 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 3 Apr 2025 10:33:35 -0700
Subject: [PATCH 069/225] Assertive enhancements

This brings a set of enhancements to assertive:
- function name simplifications
- generics-ifying of some functions that can be used on comparables
- additional methods (Match, DoesNotMatch)
- debugging output is made clear, along with OCS8 link and excerpt of the test file
- all methods can now elect to Fail later instead of FailNow
- Check method is removed (^ because of above)
- all methods can now elect to silence output on success

Other Tigron files are updated to adopt these changes:
- method names update
- comparators move away from Check and now fully leverages assertive

This also adds a large number of tests for assertive, leveraging mimicry.

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/expect/comparators.go              |  42 +--
 mod/tigron/internal/assertive/assertive.go    | 312 ++++++++++++------
 .../internal/assertive/assertive_test.go      | 190 ++++++++++-
 mod/tigron/internal/com/command_test.go       |  24 +-
 mod/tigron/test/command.go                    |   2 +-
 mod/tigron/test/data_test.go                  |   6 +-
 6 files changed, 417 insertions(+), 159 deletions(-)

diff --git a/mod/tigron/expect/comparators.go b/mod/tigron/expect/comparators.go
index 17edc209588..36b09de5e45 100644
--- a/mod/tigron/expect/comparators.go
+++ b/mod/tigron/expect/comparators.go
@@ -14,13 +14,12 @@
    limitations under the License.
 */
 
+//revive:disable:package-comments // annoying false positive behavior
+//nolint:thelper // FIXME: remove when we move to tig.T
 package expect
 
 import (
-	"encoding/hex"
-	"fmt"
 	"regexp"
-	"strings"
 	"testing"
 
 	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
@@ -29,7 +28,6 @@ import (
 
 // All can be used as a parameter for expected.Output to group a set of comparators.
 func All(comparators ...test.Comparator) test.Comparator {
-	//nolint:thelper
 	return func(stdout, info string, t *testing.T) {
 		t.Helper()
 
@@ -39,57 +37,35 @@ func All(comparators ...test.Comparator) test.Comparator {
 	}
 }
 
-// Contains can be used as a parameter for expected.Output and ensures a comparison string
-// is found contained in the output.
+// Contains can be used as a parameter for expected.Output and ensures a comparison string is found contained in the
+// output.
 func Contains(compare string) test.Comparator {
-	//nolint:thelper
 	return func(stdout, info string, t *testing.T) {
 		t.Helper()
-		assertive.Check(t, strings.Contains(stdout, compare),
-			fmt.Sprintf("Output does not contain: %q", compare),
-			info)
+		assertive.Contains(assertive.WithFailLater(t), stdout, compare, info)
 	}
 }
 
-// DoesNotContain is to be used for expected.Output to ensure a comparison string is NOT found in
-// the output.
+// DoesNotContain is to be used for expected.Output to ensure a comparison string is NOT found in the output.
 func DoesNotContain(compare string) test.Comparator {
-	//nolint:thelper
 	return func(stdout, info string, t *testing.T) {
 		t.Helper()
-		assertive.Check(t, !strings.Contains(stdout, compare),
-			fmt.Sprintf("Output should not contain: %q", compare), info)
+		assertive.DoesNotContain(assertive.WithFailLater(t), stdout, compare, info)
 	}
 }
 
 // Equals is to be used for expected.Output to ensure it is exactly the output.
 func Equals(compare string) test.Comparator {
-	//nolint:thelper
 	return func(stdout, info string, t *testing.T) {
 		t.Helper()
-
-		hexdump := hex.Dump([]byte(stdout))
-		assertive.Check(
-			t,
-			compare == stdout,
-			fmt.Sprintf("Output is not equal to: %q", compare),
-			"\n"+hexdump,
-			info,
-		)
+		assertive.IsEqual(assertive.WithFailLater(t), stdout, compare, info)
 	}
 }
 
 // Match is to be used for expected.Output to ensure we match a regexp.
-// Provisional - expected use, but have not seen it so far.
 func Match(reg *regexp.Regexp) test.Comparator {
-	//nolint:thelper
 	return func(stdout, info string, t *testing.T) {
 		t.Helper()
-		assertive.Check(
-			t,
-			reg.MatchString(stdout),
-			fmt.Sprintf("Output does not match: %q", reg.String()),
-			info,
-		)
+		assertive.Match(assertive.WithFailLater(t), stdout, reg, info)
 	}
 }
diff --git a/mod/tigron/internal/assertive/assertive.go b/mod/tigron/internal/assertive/assertive.go
index 4f0f4d6536a..735c58c52f9 100644
--- a/mod/tigron/internal/assertive/assertive.go
+++ b/mod/tigron/internal/assertive/assertive.go
@@ -14,156 +14,274 @@
    limitations under the License.
 */
 
+//revive:disable:add-constant,package-comments
 package assertive
 
 import (
+	"bufio"
 	"errors"
+	"fmt"
+	"os"
+	"regexp"
+	"runtime"
 	"strings"
 	"time"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/formatter"
+	"github.com/containerd/nerdctl/mod/tigron/tig"
+)
+
+// TODO: once debugging output will be cleaned-up, reintroduce hexdump.
+
+const (
+	expectedSuccessDecorator = "✅️ does verify:\t\t"
+	expectedFailDecorator    = "❌ does not verify:\t"
+	receivedDecorator        = "👀 testing:\t\t"
+	hyperlinkDecorator       = "🔗"
 )
 
-type testingT interface {
-	Helper()
-	FailNow()
-	Fail()
-	Log(args ...interface{})
+// ErrorIsNil fails a test if err is not nil.
+func ErrorIsNil(testing tig.T, err error, msg ...string) {
+	testing.Helper()
+
+	evaluate(testing, errors.Is(err, nil), err, "is `<nil>`", msg...)
 }
 
-// ErrorIsNil immediately fails a test if err is not nil.
-func ErrorIsNil(t testingT, err error, msg ...string) {
-	t.Helper()
+// ErrorIs fails a test if err is not the comparison error.
+func ErrorIs(testing tig.T, err, expected error, msg ...string) {
+	testing.Helper()
 
-	if err != nil {
-		t.Log("expecting nil error, but got:", err)
-		failNow(t, msg...)
-	}
+	evaluate(testing, errors.Is(err, expected), err, fmt.Sprintf("is `%v`", expected), msg...)
 }
 
-// ErrorIs immediately fails a test if err is not the comparison error.
-func ErrorIs(t testingT, err, compErr error, msg ...string) {
-	t.Helper()
+// IsEqual fails a test if the two interfaces are not equal.
+func IsEqual[T comparable](testing tig.T, actual, expected T, msg ...string) {
+	testing.Helper()
 
-	if !errors.Is(err, compErr) {
-		t.Log("expected error to be:", compErr, "- instead it is:", err)
-		failNow(t, msg...)
-	}
+	evaluate(testing, actual == expected, actual, fmt.Sprintf("= `%v`", expected), msg...)
 }
 
-// IsEqual immediately fails a test if the two interfaces are not equal.
-func IsEqual(t testingT, actual, expected interface{}, msg ...string) {
-	t.Helper()
+// IsNotEqual fails a test if the two interfaces are equal.
+func IsNotEqual[T comparable](testing tig.T, actual, expected T, msg ...string) {
+	testing.Helper()
 
-	if !isEqual(t, actual, expected) {
-		t.Log("expected:", actual, " - to be equal to:", expected)
-		failNow(t, msg...)
-	}
+	evaluate(testing, actual != expected, actual, fmt.Sprintf("!= `%v`", expected), msg...)
 }
 
-// IsNotEqual immediately fails a test if the two interfaces are equal.
-func IsNotEqual(t testingT, actual, expected interface{}, msg ...string) {
-	t.Helper()
+// Contains fails a test if the actual string does not contain the other string.
+func Contains(testing tig.T, actual, contains string, msg ...string) {
+	testing.Helper()
 
-	if isEqual(t, actual, expected) {
-		t.Log("expected:", actual, " - to be equal to:", expected)
-		failNow(t, msg...)
-	}
+	evaluate(
+		testing,
+		strings.Contains(actual, contains),
+		actual,
+		fmt.Sprintf("~= `%v`", contains),
+		msg...)
 }
 
-// StringContains immediately fails a test if the actual string does not contain the other string.
-func StringContains(t testingT, actual, contains string, msg ...string) {
-	t.Helper()
+// DoesNotContain fails a test if the actual string contains the other string.
+func DoesNotContain(testing tig.T, actual, contains string, msg ...string) {
+	testing.Helper()
 
-	if !strings.Contains(actual, contains) {
-		t.Log("expected:", actual, " - to contain:", contains)
-		failNow(t, msg...)
-	}
+	evaluate(
+		testing,
+		!strings.Contains(actual, contains),
+		actual,
+		fmt.Sprintf("! ~= `%v`", contains),
+		msg...)
 }
 
-// StringDoesNotContain immediately fails a test if the actual string contains the other string.
-func StringDoesNotContain(t testingT, actual, contains string, msg ...string) {
-	t.Helper()
+// HasSuffix fails a test if the string does not end with suffix.
+func HasSuffix(testing tig.T, actual, suffix string, msg ...string) {
+	testing.Helper()
 
-	if strings.Contains(actual, contains) {
-		t.Log("expected:", actual, " - to NOT contain:", contains)
-		failNow(t, msg...)
-	}
+	evaluate(
+		testing,
+		strings.HasSuffix(actual, suffix),
+		actual,
+		fmt.Sprintf("`%v` $", suffix),
+		msg...)
 }
 
-// StringHasSuffix immediately fails a test if the string does not end with suffix.
-func StringHasSuffix(t testingT, actual, suffix string, msg ...string) {
-	t.Helper()
+// HasPrefix fails a test if the string does not start with prefix.
+func HasPrefix(testing tig.T, actual, prefix string, msg ...string) {
+	testing.Helper()
 
-	if !strings.HasSuffix(actual, suffix) {
-		t.Log("expected:", actual, " - to end with:", suffix)
-		failNow(t, msg...)
-	}
+	evaluate(
+		testing,
+		strings.HasPrefix(actual, prefix),
+		actual,
+		fmt.Sprintf("^ `%v`", prefix),
+		msg...)
 }
 
-// StringHasPrefix immediately fails a test if the string does not start with prefix.
-func StringHasPrefix(t testingT, actual, prefix string, msg ...string) {
-	t.Helper()
+// Match fails a test if the string does not match the regexp.
+func Match(testing tig.T, actual string, reg *regexp.Regexp, msg ...string) {
+	testing.Helper()
 
-	if !strings.HasPrefix(actual, prefix) {
-		t.Log("expected:", actual, " - to start with:", prefix)
-		failNow(t, msg...)
-	}
+	evaluate(testing, reg.MatchString(actual), actual, fmt.Sprintf("`%v`", reg), msg...)
 }
 
-// DurationIsLessThan immediately fails a test if the duration is more than the reference.
-func DurationIsLessThan(t testingT, actual, expected time.Duration, msg ...string) {
-	t.Helper()
+// DoesNotMatch fails a test if the string does match the regexp.
+func DoesNotMatch(testing tig.T, actual string, reg *regexp.Regexp, msg ...string) {
+	testing.Helper()
 
-	if actual >= expected {
-		t.Log("expected:", actual, " - to be less than:", expected)
-		failNow(t, msg...)
-	}
+	evaluate(testing, !reg.MatchString(actual), actual, fmt.Sprintf("`%v`", reg), msg...)
 }
 
-// True immediately fails a test if the boolean is not true...
-func True(t testingT, comp bool, msg ...string) bool {
-	t.Helper()
+// IsLessThan fails a test if the actual is more or equal than the reference.
+func IsLessThan[T ~int | ~float64 | time.Duration](
+	testing tig.T,
+	actual, expected T,
+	msg ...string,
+) {
+	testing.Helper()
 
-	if !comp {
-		failNow(t, msg...)
-	}
+	evaluate(testing, actual < expected, actual, fmt.Sprintf("< `%v`", expected), msg...)
+}
+
+// IsMoreThan fails a test if the actual is less or equal than the reference.
+func IsMoreThan[T ~int | ~float64 | time.Duration](
+	testing tig.T,
+	actual, expected T,
+	msg ...string,
+) {
+	testing.Helper()
+
+	evaluate(testing, actual > expected, actual, fmt.Sprintf("< `%v`", expected), msg...)
+}
+
+// True fails a test if the boolean is not true...
+func True(testing tig.T, comp bool, msg ...string) bool {
+	testing.Helper()
+
+	evaluate(testing, comp, comp, true, msg...)
 
 	return comp
 }
 
-// Check marks a test as failed if the boolean is not true (safe in go routines)
-//
-//nolint:varnamelen
-func Check(t testingT, comp bool, msg ...string) bool {
-	t.Helper()
+// WithFailLater will allow an assertion to not fail the test immediately.
+// Failing later is necessary when asserting inside go routines, and also if you want many
+// successive asserts to all
+// evaluate instead of stopping at the first failing one.
+func WithFailLater(t tig.T) tig.T {
+	return &failLater{
+		t,
+	}
+}
 
-	if !comp {
-		for _, m := range msg {
-			t.Log(m)
+// WithSilentSuccess (used to wrap a *testing.T struct) will not log debugging assertive information
+// when the result is
+// a success.
+// In some cases, this is convenient to avoid crowding the display with successful checks info.
+func WithSilentSuccess(t tig.T) tig.T {
+	return &silentSuccess{
+		t,
+	}
+}
+
+type failLater struct {
+	tig.T
+}
+type silentSuccess struct {
+	tig.T
+}
+
+func evaluate(testing tig.T, isSuccess bool, actual, expected any, msg ...string) {
+	testing.Helper()
+
+	decorate(testing, isSuccess, actual, expected, msg...)
+
+	if !isSuccess {
+		if _, ok := testing.(*failLater); ok {
+			testing.Fail()
+		} else {
+			testing.FailNow()
 		}
+	}
+}
+
+func decorate(testing tig.T, isSuccess bool, actual, expected any, msg ...string) {
+	testing.Helper()
 
-		t.Fail()
+	header := "\t"
+
+	hyperlink := getTopFrameFile()
+	if hyperlink != "" {
+		msg = append([]string{hyperlink + "\n"}, msg...)
 	}
 
-	return comp
+	msg = append(msg, fmt.Sprintf("\t%s`%v`", receivedDecorator, actual))
+
+	if isSuccess {
+		msg = append(msg,
+			fmt.Sprintf("\t%s%v", expectedSuccessDecorator, expected),
+		)
+	} else {
+		msg = append(msg,
+			fmt.Sprintf("\t%s%v", expectedFailDecorator, expected),
+		)
+	}
+
+	if _, ok := testing.(*silentSuccess); !isSuccess || !ok {
+		testing.Log(header + strings.Join(msg, "\n") + "\n")
+	}
 }
 
-//nolint:varnamelen
-func failNow(t testingT, msg ...string) {
-	t.Helper()
+func getTopFrameFile() string {
+	// Get the frames.
+	//nolint:mnd // Whatever mnd...
+	pc := make([]uintptr, 20)
+	//nolint:mnd // Whatever mnd...
+	n := runtime.Callers(2, pc)
+	callersFrames := runtime.CallersFrames(pc[:n])
+
+	var file string
 
-	if len(msg) > 0 {
-		for _, m := range msg {
-			t.Log(m)
+	var lineNumber int
+
+	var frame runtime.Frame
+	for range 20 {
+		frame, _ = callersFrames.Next()
+		if !strings.Contains(frame.Function, "/") {
+			break
 		}
+
+		file = frame.File
+		lineNumber = frame.Line
 	}
 
-	t.FailNow()
-}
+	if file == "" {
+		return ""
+	}
+
+	//nolint:gosec // file is coming from runtime frames so, fine
+	source, err := os.Open(file)
+	if err != nil {
+		return ""
+	}
 
-func isEqual(t testingT, actual, expected interface{}) bool {
-	t.Helper()
+	defer func() {
+		_ = source.Close()
+	}()
+
+	index := 1
+	scanner := bufio.NewScanner(source)
+
+	var line string
+
+	for ; scanner.Err() == nil && index <= lineNumber; index++ {
+		if !scanner.Scan() {
+			break
+		}
+
+		line = strings.Trim(scanner.Text(), "\t ")
+	}
 
-	// FIXME: this is risky and limited. Right now this is fine internally, but do better if this
-	// becomes public.
-	return actual == expected
+	return hyperlinkDecorator + " " + (&formatter.OSC8{
+		Text:     line,
+		Location: "file://" + file,
+		Line:     frame.Line,
+	}).String()
 }
diff --git a/mod/tigron/internal/assertive/assertive_test.go b/mod/tigron/internal/assertive/assertive_test.go
index 6d236c0718b..ccb987e3ab3 100644
--- a/mod/tigron/internal/assertive/assertive_test.go
+++ b/mod/tigron/internal/assertive/assertive_test.go
@@ -14,35 +14,199 @@
    limitations under the License.
 */
 
+//revive:disable:add-constant
 package assertive_test
 
 import (
 	"errors"
 	"fmt"
+	"regexp"
 	"testing"
+	"time"
 
 	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
+	"github.com/containerd/nerdctl/mod/tigron/internal/mimicry"
+	"github.com/containerd/nerdctl/mod/tigron/internal/mocks"
+	"github.com/containerd/nerdctl/mod/tigron/tig"
 )
 
-func TestY(t *testing.T) {
+func TestAssertivePass(t *testing.T) {
 	t.Parallel()
 
-	var err error
+	var nilErr error
+	//nolint:err113 // Fine, this is a test
+	notNilErr := errors.New("some error")
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, nilErr, "a nil error should pass ErrorIsNil")
+	assertive.ErrorIs(t, nilErr, nil, "a nil error should pass ErrorIs(err, nil)")
+	assertive.ErrorIs(
+		t,
+		fmt.Errorf("neh %w", notNilErr),
+		notNilErr,
+		"an error wrapping another should match with ErrorIs",
+	)
 
-	//nolint:err113
-	someErr := errors.New("test error")
+	assertive.IsEqual(t, "foo", "foo", "= should work as expected (on string)")
+	assertive.IsNotEqual(t, "foo", "else", "!= should work as expected (on string)")
 
-	err = fmt.Errorf("wrap: %w", someErr)
-	assertive.ErrorIs(t, err, someErr)
+	assertive.IsEqual(t, true, true, "= should work as expected (on bool)")
+	assertive.IsNotEqual(t, true, false, "!= should work as expected (on bool)")
 
-	foo := "foo"
-	assertive.IsEqual(t, foo, "foo")
+	assertive.IsEqual(t, 1, 1, "= should work as expected (on int)")
+	assertive.IsNotEqual(t, 1, 0, "!= should work as expected (on int)")
 
-	bar := 10
-	assertive.IsEqual(t, bar, 10)
+	assertive.IsEqual(t, -1.0, -1, "= should work as expected (on float)")
+	assertive.IsNotEqual(t, -1.0, 0, "!= should work as expected (on float)")
 
-	baz := true
-	assertive.IsEqual(t, baz, true)
+	type foo struct {
+		name string
+	}
+
+	assertive.IsEqual(t, foo{}, foo{}, "= should work as expected (on struct)")
+	assertive.IsEqual(
+		t,
+		foo{name: "foo"},
+		foo{name: "foo"},
+		"= should work as expected (on struct)",
+	)
+	assertive.IsNotEqual(
+		t,
+		foo{name: "bar"},
+		foo{name: "foo"},
+		"!= should work as expected (on struct)",
+	)
+
+	assertive.Contains(t, "foo", "o", "⊂ should work")
+	assertive.DoesNotContain(t, "foo", "a", "¬⊂ should work")
+	assertive.HasPrefix(t, "foo", "f", "prefix should work")
+	assertive.HasSuffix(t, "foo", "o", "suffix should work")
+	assertive.Match(t, "foo", regexp.MustCompile("^[fo]{3,}$"), "match should work")
+	assertive.DoesNotMatch(t, "foo", regexp.MustCompile("^[abc]{3,}$"), "match should work")
+
+	assertive.True(t, true, "is true should work as expected")
+
+	assertive.IsLessThan(t, time.Minute, time.Hour, "< should work (duration)")
+	assertive.IsMoreThan(t, time.Minute, time.Second, "< should work (duration)")
+	assertive.IsLessThan(t, 1, 2, "< should work (int)")
+	assertive.IsMoreThan(t, 2, 1, "> should work (int)")
+	assertive.IsLessThan(t, -1.2, 2, "< should work (float)")
+	assertive.IsMoreThan(t, 2, -1.2, "> should work (float)")
+}
+
+func TestAssertiveFailBehavior(t *testing.T) {
+	t.Parallel()
+
+	mockT := &mocks.MockT{}
+
+	var nilErr error
+	//nolint:err113 // Fine, this is a test
+	notNilErr := errors.New("some error")
+
+	assertive.ErrorIsNil(mockT, notNilErr, "a nil error should pass ErrorIsNil")
+	assertive.ErrorIs(mockT, notNilErr, nil, "a nil error should pass ErrorIs(err, nil)")
+	assertive.ErrorIs(
+		mockT,
+		fmt.Errorf("neh %w", nilErr),
+		nilErr,
+		"an error wrapping another should match with ErrorIs",
+	)
+
+	assertive.IsEqual(mockT, "foo", "else", "= should work as expected (on string)")
+	assertive.IsNotEqual(mockT, "foo", "foo", "!= should work as expected (on string)")
+
+	assertive.IsEqual(mockT, true, false, "= should work as expected (on bool)")
+	assertive.IsNotEqual(mockT, true, true, "!= should work as expected (on bool)")
+
+	assertive.IsEqual(mockT, 1, 0, "= should work as expected (on int)")
+	assertive.IsNotEqual(mockT, 1, 1, "!= should work as expected (on int)")
+
+	assertive.IsEqual(mockT, -1.0, 0, "= should work as expected (on float)")
+	assertive.IsNotEqual(mockT, -1.0, -1, "!= should work as expected (on float)")
+
+	type foo struct {
+		name string
+	}
+
+	assertive.IsEqual(mockT, foo{}, foo{name: "foo"}, "= should work as expected (on struct)")
+	assertive.IsEqual(
+		mockT,
+		foo{name: "bar"},
+		foo{name: "foo"},
+		"= should work as expected (on struct)",
+	)
+	assertive.IsNotEqual(
+		mockT,
+		foo{name: ""},
+		foo{name: ""},
+		"!= should work as expected (on struct)",
+	)
+
+	assertive.Contains(mockT, "foo", "a", "⊂ should work")
+	assertive.DoesNotContain(mockT, "foo", "o", "¬⊂ should work")
+	assertive.HasPrefix(mockT, "foo", "o", "prefix should work")
+	assertive.HasSuffix(mockT, "foo", "f", "suffix should work")
+	assertive.Match(mockT, "foo", regexp.MustCompile("^[abc]{3,}$"), "match should work")
+	assertive.DoesNotMatch(mockT, "foo", regexp.MustCompile("^[fo]{3,}$"), "match should work")
+
+	assertive.True(mockT, false, "is true should work as expected")
+
+	assertive.IsLessThan(mockT, time.Hour, time.Minute, "< should work (duration)")
+	assertive.IsMoreThan(mockT, time.Second, time.Minute, "< should work (duration)")
+	assertive.IsLessThan(mockT, 2, 1, "< should work (int)")
+	assertive.IsMoreThan(mockT, 1, 2, "> should work (int)")
+	assertive.IsLessThan(mockT, 2, -1.2, "< should work (float)")
+	assertive.IsMoreThan(mockT, -1.2, 2, "> should work (float)")
+
+	if len(mockT.Report(tig.T.FailNow)) != 27 {
+		t.Error("we should have called FailNow as many times as we have asserts here")
+	}
+
+	if len(mockT.Report(tig.T.Fail)) != 0 {
+		t.Error("we should NOT have called Fail")
+	}
+}
+
+func TestAssertiveFailLater(t *testing.T) {
+	t.Parallel()
+
+	mockT := &mocks.MockT{}
+
+	assertive.True(assertive.WithFailLater(mockT), false, "is true should work as expected")
+
+	if len(mockT.Report(tig.T.FailNow)) != 0 {
+		t.Log(mimicry.PrintCall(mockT.Report(tig.T.FailNow)[0]))
+		t.Error("we should NOT have called FailNow")
+	}
+
+	if len(mockT.Report(tig.T.Fail)) != 1 {
+		t.Error("we should have called Fail")
+	}
+}
+
+func TestAssertiveSilentSuccess(t *testing.T) {
+	t.Parallel()
+
+	mockT := &mocks.MockT{}
+
+	assertive.True(mockT, true, "is true should work as expected")
+	assertive.True(mockT, false, "is true should work as expected")
+
+	if len(mockT.Report(tig.T.Log)) != 2 {
+		t.Error("we should have called Log on both success and failure")
+	}
+
+	mockT.Reset()
+
+	assertive.True(assertive.WithSilentSuccess(mockT), true, "is true should work as expected")
+
+	if len(mockT.Report(tig.T.Log)) != 0 {
+		t.Log(mimicry.PrintCall(mockT.Report(tig.T.Log)[0]))
+		t.Error("we should NOT have called Log on success")
+	}
+
+	assertive.True(assertive.WithSilentSuccess(mockT), false, "is true should work as expected")
+
+	if len(mockT.Report(tig.T.Log)) != 1 {
+		t.Error("we should still have called Log on failure")
+	}
 }
diff --git a/mod/tigron/internal/com/command_test.go b/mod/tigron/internal/com/command_test.go
index 04034f037b8..2f62f1ef246 100644
--- a/mod/tigron/internal/com/command_test.go
+++ b/mod/tigron/internal/com/command_test.go
@@ -159,7 +159,7 @@ func TestBasicFail(t *testing.T) {
 	assertive.ErrorIs(t, err, com.ErrExecutionFailed)
 	assertive.IsEqual(t, 127, res.ExitCode)
 	assertive.IsEqual(t, "", res.Stdout)
-	assertive.StringHasSuffix(t, res.Stderr, "does-not-exist: command not found\n")
+	assertive.HasSuffix(t, res.Stderr, "does-not-exist: command not found\n")
 }
 
 func TestWorkingDir(t *testing.T) {
@@ -187,7 +187,7 @@ func TestWorkingDir(t *testing.T) {
 		t.Skip("skipping last check on windows, see note")
 	}
 
-	assertive.StringHasSuffix(t, res.Stdout, dir+"\n")
+	assertive.HasSuffix(t, res.Stdout, dir+"\n")
 }
 
 func TestEnvBlacklist(t *testing.T) {
@@ -206,8 +206,8 @@ func TestEnvBlacklist(t *testing.T) {
 
 	assertive.ErrorIsNil(t, err)
 	assertive.IsEqual(t, 0, res.ExitCode)
-	assertive.StringContains(t, res.Stdout, "FOO=BAR")
-	assertive.StringContains(t, res.Stdout, "FOOBAR=BARBAR")
+	assertive.Contains(t, res.Stdout, "FOO=BAR")
+	assertive.Contains(t, res.Stdout, "FOOBAR=BARBAR")
 
 	command = &com.Command{
 		Binary:       "env",
@@ -222,8 +222,8 @@ func TestEnvBlacklist(t *testing.T) {
 
 	assertive.ErrorIsNil(t, err)
 	assertive.IsEqual(t, res.ExitCode, 0)
-	assertive.StringDoesNotContain(t, res.Stdout, "FOO=BAR")
-	assertive.StringContains(t, res.Stdout, "FOOBAR=BARBAR")
+	assertive.DoesNotContain(t, res.Stdout, "FOO=BAR")
+	assertive.Contains(t, res.Stdout, "FOOBAR=BARBAR")
 
 	// On windows, with mingw, SYSTEMROOT,TERM and HOME (possibly others) will be forcefully added
 	// to the environment regardless, so, we can't test "*" blacklist
@@ -272,10 +272,10 @@ func TestEnvAdd(t *testing.T) {
 
 	assertive.ErrorIsNil(t, err)
 	assertive.IsEqual(t, res.ExitCode, 0)
-	assertive.StringContains(t, res.Stdout, "FOO=REPLACE")
-	assertive.StringContains(t, res.Stdout, "BAR=NEW")
-	assertive.StringContains(t, res.Stdout, "BAZ=OLD")
-	assertive.StringContains(t, res.Stdout, "BLED=EXPLICIT")
+	assertive.Contains(t, res.Stdout, "FOO=REPLACE")
+	assertive.Contains(t, res.Stdout, "BAR=NEW")
+	assertive.Contains(t, res.Stdout, "BAZ=OLD")
+	assertive.Contains(t, res.Stdout, "BLED=EXPLICIT")
 }
 
 func TestStdoutStderr(t *testing.T) {
@@ -322,7 +322,7 @@ func TestTimeoutPlain(t *testing.T) {
 	assertive.IsEqual(t, res.ExitCode, -1)
 	assertive.IsEqual(t, res.Stdout, "one")
 	assertive.IsEqual(t, res.Stderr, "")
-	assertive.DurationIsLessThan(t, end.Sub(start), 2*time.Second)
+	assertive.IsLessThan(t, end.Sub(start), 2*time.Second)
 }
 
 func TestTimeoutDelayed(t *testing.T) {
@@ -351,7 +351,7 @@ func TestTimeoutDelayed(t *testing.T) {
 	assertive.IsEqual(t, res.ExitCode, -1)
 	assertive.IsEqual(t, res.Stdout, "one")
 	assertive.IsEqual(t, res.Stderr, "")
-	assertive.DurationIsLessThan(t, end.Sub(start), 2*time.Second)
+	assertive.IsLessThan(t, end.Sub(start), 2*time.Second)
 }
 
 func TestPTYStdout(t *testing.T) {
diff --git a/mod/tigron/test/command.go b/mod/tigron/test/command.go
index a8ed09e4524..ef41610338a 100644
--- a/mod/tigron/test/command.go
+++ b/mod/tigron/test/command.go
@@ -234,7 +234,7 @@ func (gc *GenericCommand) Run(expect *Expected) {
 
 		// Range through the expected errors and confirm they are seen on stderr
 		for _, expectErr := range expect.Errors {
-			assertive.StringContains(gc.t, result.Stderr, expectErr.Error(),
+			assertive.Contains(gc.t, result.Stderr, expectErr.Error(),
 				fmt.Sprintf("Expected error: %q to be found in stderr\n", expectErr.Error()), debug)
 		}
 
diff --git a/mod/tigron/test/data_test.go b/mod/tigron/test/data_test.go
index 3c9ea730206..9e39ed677ca 100644
--- a/mod/tigron/test/data_test.go
+++ b/mod/tigron/test/data_test.go
@@ -56,10 +56,10 @@ func TestDataIdentifier(t *testing.T) {
 	two := dataObj.Identifier()
 
 	assertive.IsEqual(t, one, two)
-	assertive.StringHasPrefix(t, one, "testdataidentifier")
+	assertive.HasPrefix(t, one, "testdataidentifier")
 
 	three := dataObj.Identifier("Some Add ∞ Funky∞Prefix")
-	assertive.StringHasPrefix(t, three, "testdataidentifier-some-add-funky-prefix")
+	assertive.HasPrefix(t, three, "testdataidentifier-some-add-funky-prefix")
 }
 
 func TestDataIdentifierThatIsReallyReallyReallyReallyReallyReallyReallyReallyReallyReallyReallyLong(
@@ -73,7 +73,7 @@ func TestDataIdentifierThatIsReallyReallyReallyReallyReallyReallyReallyReallyRea
 	two := dataObj.Identifier()
 
 	assertive.IsEqual(t, one, two)
-	assertive.StringHasPrefix(t, one, "testdataidentifier")
+	assertive.HasPrefix(t, one, "testdataidentifier")
 	assertive.IsEqual(t, len(one), identifierMaxLength)
 
 	three := dataObj.Identifier("Add something")

From e6dbb2165a74cd20b0745f575d09359170612b27 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 12 Apr 2025 09:24:05 +0000
Subject: [PATCH 070/225] build(deps): bump crazy-max/ghaction-github-runtime
 from 3.0.0 to 3.1.0

Bumps [crazy-max/ghaction-github-runtime](https://github.com/crazy-max/ghaction-github-runtime) from 3.0.0 to 3.1.0.
- [Release notes](https://github.com/crazy-max/ghaction-github-runtime/releases)
- [Commits](https://github.com/crazy-max/ghaction-github-runtime/compare/b3a9207c0e1ef41f4cf215303c976869d0c2c1c4...3cb05d89e1f492524af3d41a1c98c83bc3025124)

---
updated-dependencies:
- dependency-name: crazy-max/ghaction-github-runtime
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/test.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5fc6502cf62..c1113c57b2d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -42,7 +42,7 @@ jobs:
         with:
           fetch-depth: 1
       - name: "Expose GitHub Runtime variables for gha"
-        uses: crazy-max/ghaction-github-runtime@b3a9207c0e1ef41f4cf215303c976869d0c2c1c4  # v3.0.0
+        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
       - name: "Build dependencies for the integration test environment image"
         run: |
           docker buildx create --name with-gha --use
@@ -114,7 +114,7 @@ jobs:
         with:
           fetch-depth: 1
       - name: "Expose GitHub Runtime variables for gha"
-        uses: crazy-max/ghaction-github-runtime@b3a9207c0e1ef41f4cf215303c976869d0c2c1c4  # v3.0.0
+        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
       - name: "Prepare integration test environment"
         run: |
           docker buildx create --name with-gha --use
@@ -167,7 +167,7 @@ jobs:
           sudo sysctl -w net.ipv6.conf.all.forwarding=1
           sudo sysctl -w net.ipv4.ip_forward=1
       - name: "Expose GitHub Runtime variables for gha"
-        uses: crazy-max/ghaction-github-runtime@b3a9207c0e1ef41f4cf215303c976869d0c2c1c4  # v3.0.0
+        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
       - name: Enable IPv6 for Docker, and configure docker to use containerd for gha
         run: |
           sudo mkdir -p /etc/docker
@@ -271,7 +271,7 @@ jobs:
           docker run --privileged --rm tonistiigi/binfmt --install linux/arm64
           docker run --privileged --rm tonistiigi/binfmt --install linux/arm/v7
       - name: "Expose GitHub Runtime variables for gha"
-        uses: crazy-max/ghaction-github-runtime@b3a9207c0e1ef41f4cf215303c976869d0c2c1c4  # v3.0.0
+        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
       - name: "Prepare (network driver=slirp4netns, port driver=builtin)"
         run: |
           docker buildx create --name with-gha --use
@@ -466,7 +466,7 @@ jobs:
           docker info
           docker version
       - name: "Expose GitHub Runtime variables for gha"
-        uses: crazy-max/ghaction-github-runtime@b3a9207c0e1ef41f4cf215303c976869d0c2c1c4  # v3.0.0
+        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
       - name: "Prepare integration tests"
         run: |
           set -eux

From cece0a9e06c183af27db7a52d52db2958da8aa7a Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sun, 13 Apr 2025 10:47:45 -0700
Subject: [PATCH 071/225] Add environment WhiteList support for Command +
 prefix matching

Prior, only BlackList-ing of environment variables was supported, and solely for exact variable names match, or "*" for all.

This changeset introduces:
- WhiteList-ing
- prefix matching for env var names (eg: "THING_*" can now be used to white/black list any env variable which name starts with THING_)

Note that whitelisting takes precedence over blacklisting if both are used.

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/internal/com/command.go      |  48 +++-
 mod/tigron/internal/com/command_test.go | 352 ++++++++++++++++--------
 2 files changed, 270 insertions(+), 130 deletions(-)

diff --git a/mod/tigron/internal/com/command.go b/mod/tigron/internal/com/command.go
index e71869d5ade..855f91cca13 100644
--- a/mod/tigron/internal/com/command.go
+++ b/mod/tigron/internal/com/command.go
@@ -93,10 +93,10 @@ type Command struct {
 	WrapArgs    []string
 	Timeout     time.Duration
 
-	WorkingDir string
-	Env        map[string]string
-	// FIXME: EnvBlackList might change for a better mechanism (regexp and/or whitelist + blacklist)
+	WorkingDir   string
+	Env          map[string]string
 	EnvBlackList []string
+	EnvWhiteList []string
 
 	writers []func() io.Reader
 
@@ -122,6 +122,7 @@ func (gc *Command) Clone() *Command {
 		WorkingDir:   gc.WorkingDir,
 		Env:          map[string]string{},
 		EnvBlackList: append([]string(nil), gc.EnvBlackList...),
+		EnvWhiteList: append([]string(nil), gc.EnvWhiteList...),
 
 		writers: append([]func() io.Reader(nil), gc.writers...),
 
@@ -399,26 +400,55 @@ func (gc *Command) buildCommand(ctx context.Context) *exec.Cmd {
 	//nolint:gosec
 	cmd := exec.CommandContext(ctx, binary, args...)
 
-	// Add dir
+	// Add dir.
 	cmd.Dir = gc.WorkingDir
 
-	// Set wait delay after waits returns
+	// Set wait delay after waits returns.
 	cmd.WaitDelay = delayAfterWait
 
-	// Build env
+	// Build env.
 	cmd.Env = []string{}
-	// TODO: replace with regexps? and/or whitelist?
+
+	const (
+		star  = "*"
+		equal = "="
+	)
+
 	for _, envValue := range os.Environ() {
 		add := true
 
-		for _, b := range gc.EnvBlackList {
-			if b == "*" || strings.HasPrefix(envValue, b+"=") {
+		for _, needle := range gc.EnvBlackList {
+			if strings.HasSuffix(needle, star) {
+				needle = strings.TrimSuffix(needle, star)
+			} else if needle != star && !strings.Contains(needle, equal) {
+				needle += equal
+			}
+
+			if needle == star || strings.HasPrefix(envValue, needle) {
 				add = false
 
 				break
 			}
 		}
 
+		if len(gc.EnvWhiteList) > 0 {
+			add = false
+
+			for _, needle := range gc.EnvWhiteList {
+				if strings.HasSuffix(needle, star) {
+					needle = strings.TrimSuffix(needle, star)
+				} else if needle != star && !strings.Contains(needle, equal) {
+					needle += equal
+				}
+
+				if needle == star || strings.HasPrefix(envValue, needle) {
+					add = true
+
+					break
+				}
+			}
+		}
+
 		if add {
 			cmd.Env = append(cmd.Env, envValue)
 		}
diff --git a/mod/tigron/internal/com/command_test.go b/mod/tigron/internal/com/command_test.go
index 2f62f1ef246..7652a772675 100644
--- a/mod/tigron/internal/com/command_test.go
+++ b/mod/tigron/internal/com/command_test.go
@@ -14,6 +14,7 @@
    limitations under the License.
 */
 
+//revive:disable:add-constant
 package com_test
 
 import (
@@ -49,18 +50,18 @@ func TestFaultyDoubleRunWait(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	err = command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIs(t, err, com.ErrExecAlreadyStarted)
+	assertive.ErrorIs(t, err, com.ErrExecAlreadyStarted, "Err")
 
 	res, err := command.Wait()
 
-	assertive.ErrorIsNil(t, err)
-	assertive.IsEqual(t, expect.ExitCodeSuccess, res.ExitCode)
-	assertive.IsEqual(t, "one", res.Stdout)
-	assertive.IsEqual(t, "", res.Stderr)
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, expect.ExitCodeSuccess, res.ExitCode, "ExitCode")
+	assertive.IsEqual(t, "one", res.Stdout, "Stdout")
+	assertive.IsEqual(t, "", res.Stderr, "Stderr")
 }
 
 func TestFaultyRunDoubleWait(t *testing.T) {
@@ -75,21 +76,21 @@ func TestFaultyRunDoubleWait(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err := command.Wait()
 
-	assertive.ErrorIsNil(t, err)
-	assertive.IsEqual(t, expect.ExitCodeSuccess, res.ExitCode)
-	assertive.IsEqual(t, "one", res.Stdout)
-	assertive.IsEqual(t, "", res.Stderr)
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, expect.ExitCodeSuccess, res.ExitCode, "ExitCode")
+	assertive.IsEqual(t, "one", res.Stdout, "Stdout")
+	assertive.IsEqual(t, "", res.Stderr, "Stderr")
 
 	res, err = command.Wait()
 
-	assertive.ErrorIs(t, err, com.ErrExecAlreadyFinished)
-	assertive.IsEqual(t, expect.ExitCodeSuccess, res.ExitCode)
-	assertive.IsEqual(t, "one", res.Stdout)
-	assertive.IsEqual(t, "", res.Stderr)
+	assertive.ErrorIs(t, err, com.ErrExecAlreadyFinished, "Err")
+	assertive.IsEqual(t, expect.ExitCodeSuccess, res.ExitCode, "ExitCode")
+	assertive.IsEqual(t, "one", res.Stdout, "Stdout")
+	assertive.IsEqual(t, "", res.Stderr, "Stderr")
 }
 
 func TestFailRun(t *testing.T) {
@@ -101,25 +102,25 @@ func TestFailRun(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIs(t, err, com.ErrFailedStarting)
+	assertive.ErrorIs(t, err, com.ErrFailedStarting, "Err")
 
 	err = command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIs(t, err, com.ErrExecAlreadyFinished)
+	assertive.ErrorIs(t, err, com.ErrExecAlreadyFinished, "Err")
 
 	res, err := command.Wait()
 
-	assertive.ErrorIs(t, err, com.ErrFailedStarting)
-	assertive.IsEqual(t, -1, res.ExitCode)
-	assertive.IsEqual(t, "", res.Stdout)
-	assertive.IsEqual(t, "", res.Stderr)
+	assertive.ErrorIs(t, err, com.ErrFailedStarting, "Err")
+	assertive.IsEqual(t, -1, res.ExitCode, "ExitCode")
+	assertive.IsEqual(t, "", res.Stdout, "Stdout")
+	assertive.IsEqual(t, "", res.Stderr, "Stderr")
 
 	res, err = command.Wait()
 
-	assertive.ErrorIs(t, err, com.ErrFailedStarting)
-	assertive.IsEqual(t, -1, res.ExitCode)
-	assertive.IsEqual(t, "", res.Stdout)
-	assertive.IsEqual(t, "", res.Stderr)
+	assertive.ErrorIs(t, err, com.ErrFailedStarting, "Err")
+	assertive.IsEqual(t, -1, res.ExitCode, "ExitCode")
+	assertive.IsEqual(t, "", res.Stdout, "Stdout")
+	assertive.IsEqual(t, "", res.Stderr, "Stderr")
 }
 
 func TestBasicRunWait(t *testing.T) {
@@ -132,14 +133,14 @@ func TestBasicRunWait(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err := command.Wait()
 
-	assertive.ErrorIsNil(t, err)
-	assertive.IsEqual(t, 0, res.ExitCode)
-	assertive.IsEqual(t, "one", res.Stdout)
-	assertive.IsEqual(t, "", res.Stderr)
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, 0, res.ExitCode, "ExitCode")
+	assertive.IsEqual(t, "one", res.Stdout, "Stdout")
+	assertive.IsEqual(t, "", res.Stderr, "Stderr")
 }
 
 func TestBasicFail(t *testing.T) {
@@ -152,14 +153,14 @@ func TestBasicFail(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err := command.Wait()
 
-	assertive.ErrorIs(t, err, com.ErrExecutionFailed)
-	assertive.IsEqual(t, 127, res.ExitCode)
-	assertive.IsEqual(t, "", res.Stdout)
-	assertive.HasSuffix(t, res.Stderr, "does-not-exist: command not found\n")
+	assertive.ErrorIs(t, err, com.ErrExecutionFailed, "Err")
+	assertive.IsEqual(t, 127, res.ExitCode, "ExitCode")
+	assertive.IsEqual(t, "", res.Stdout, "Stdout")
+	assertive.HasSuffix(t, res.Stderr, "does-not-exist: command not found\n", "Stderr")
 }
 
 func TestWorkingDir(t *testing.T) {
@@ -173,12 +174,12 @@ func TestWorkingDir(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err := command.Wait()
 
-	assertive.ErrorIsNil(t, err)
-	assertive.IsEqual(t, 0, res.ExitCode)
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, 0, res.ExitCode, "ExitCode")
 
 	// Note:
 	// - darwin will link to /private/DIR, so, check with HasSuffix
@@ -187,43 +188,72 @@ func TestWorkingDir(t *testing.T) {
 		t.Skip("skipping last check on windows, see note")
 	}
 
-	assertive.HasSuffix(t, res.Stdout, dir+"\n")
+	assertive.HasSuffix(t, res.Stdout, dir+"\n", "Stdout")
 }
 
 func TestEnvBlacklist(t *testing.T) {
 	t.Setenv("FOO", "BAR")
 	t.Setenv("FOOBAR", "BARBAR")
 
+	// First, test that environment gets through to the command
 	command := &com.Command{
 		Binary: "env",
+		// Note: LS_COLORS is just too loud
+		EnvBlackList: []string{
+			"LS_COLORS",
+		},
 	}
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err := command.Wait()
 
-	assertive.ErrorIsNil(t, err)
-	assertive.IsEqual(t, 0, res.ExitCode)
-	assertive.Contains(t, res.Stdout, "FOO=BAR")
-	assertive.Contains(t, res.Stdout, "FOOBAR=BARBAR")
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, 0, res.ExitCode, "ExitCode")
+	assertive.Contains(t, res.Stdout, "FOO=BAR", "Stdout")
+	assertive.Contains(t, res.Stdout, "FOOBAR=BARBAR", "Stdout")
 
+	// Now test that we can blacklist a single variable with fully qualified name (FOO)
 	command = &com.Command{
-		Binary:       "env",
-		EnvBlackList: []string{"FOO"},
+		Binary: "env",
+		EnvBlackList: []string{
+			"LS_COLORS",
+			"FOO",
+		},
+	}
+
+	err = command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err, "Err")
+
+	res, err = command.Wait()
+
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, res.ExitCode, 0, "ExitCode")
+	assertive.DoesNotContain(t, res.Stdout, "FOO=", "Stdout")
+	assertive.Contains(t, res.Stdout, "FOOBAR=BARBAR", "Stdout")
+
+	// Now test that we can blacklist multiple variables with FOO*
+	command = &com.Command{
+		Binary: "env",
+		EnvBlackList: []string{
+			"LS_COLORS",
+			"FOO*",
+		},
 	}
 
 	err = command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err = command.Wait()
 
-	assertive.ErrorIsNil(t, err)
-	assertive.IsEqual(t, res.ExitCode, 0)
-	assertive.DoesNotContain(t, res.Stdout, "FOO=BAR")
-	assertive.Contains(t, res.Stdout, "FOOBAR=BARBAR")
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, res.ExitCode, 0, "ExitCode")
+	assertive.DoesNotContain(t, res.Stdout, "FOO=", "Stdout")
+	assertive.DoesNotContain(t, res.Stdout, "FOOBAR=", "Stdout")
 
 	// On windows, with mingw, SYSTEMROOT,TERM and HOME (possibly others) will be forcefully added
 	// to the environment regardless, so, we can't test "*" blacklist
@@ -233,20 +263,93 @@ func TestEnvBlacklist(t *testing.T) {
 		)
 	}
 
+	// Now, test that we can blacklist everything
 	command = &com.Command{
 		Binary:       "env",
 		EnvBlackList: []string{"*"},
 	}
 
 	err = command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+	assertive.ErrorIsNil(t, err, "Err")
+
+	res, err = command.Wait()
+
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, res.ExitCode, 0, "ExitCode")
+	assertive.IsEqual(t, res.Stdout, "", "Stdout")
+}
+
+func TestEnvWhiteList(t *testing.T) {
+	t.Setenv("FOO", "BAR")
+	t.Setenv("FOOBAR", "BARBAR")
+
+	// Test that whitelist does let through only FOO
+	command := &com.Command{
+		Binary: "env",
+		EnvWhiteList: []string{
+			"FOO",
+		},
+	}
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
+
+	res, err := command.Wait()
+
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, 0, res.ExitCode, "ExitCode")
+	assertive.Contains(t, res.Stdout, "FOO=BAR", "Stdout")
+	assertive.DoesNotContain(t, res.Stdout, "FOOBAR=", "Stdout")
+	assertive.DoesNotContain(t, res.Stdout, "LS_COLORS=", "Stdout")
+
+	// Test that whitelist does let through FOO and FOOBAR with FOO*
+	command = &com.Command{
+		Binary: "env",
+		EnvWhiteList: []string{
+			"FOO*",
+		},
+	}
+
+	err = command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err = command.Wait()
 
-	assertive.ErrorIsNil(t, err)
-	assertive.IsEqual(t, res.ExitCode, 0)
-	assertive.IsEqual(t, res.Stdout, "")
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, 0, res.ExitCode, "ExitCode")
+	assertive.Contains(t, res.Stdout, "FOO=BAR", "Stdout")
+	assertive.Contains(t, res.Stdout, "FOOBAR=BARBAR", "Stdout")
+	assertive.DoesNotContain(t, res.Stdout, "LS_COLORS=", "Stdout")
+}
+
+func TestEnvBlacklistWhiteList(t *testing.T) {
+	t.Setenv("FOO", "BAR")
+	t.Setenv("FOOBAR", "BARBAR")
+
+	// Test that if both are specified, only whitelist is taken into account
+	command := &com.Command{
+		Binary: "env",
+		EnvBlackList: []string{
+			"*",
+			"FOO*",
+		},
+		EnvWhiteList: []string{
+			"*",
+		},
+	}
+
+	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
+
+	assertive.ErrorIsNil(t, err, "Err")
+
+	res, err := command.Wait()
+
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, 0, res.ExitCode, "ExitCode")
+	assertive.Contains(t, res.Stdout, "FOO=BAR", "Stdout")
+	assertive.Contains(t, res.Stdout, "FOOBAR=BARBAR", "Stdout")
 }
 
 func TestEnvAdd(t *testing.T) {
@@ -261,21 +364,28 @@ func TestEnvAdd(t *testing.T) {
 			"BAR":  "NEW",
 			"BLED": "EXPLICIT",
 		},
-		EnvBlackList: []string{"BLED"},
+		EnvBlackList: []string{
+			"LS_COLORS",
+			"BLED",
+		},
 	}
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err := command.Wait()
 
-	assertive.ErrorIsNil(t, err)
-	assertive.IsEqual(t, res.ExitCode, 0)
-	assertive.Contains(t, res.Stdout, "FOO=REPLACE")
-	assertive.Contains(t, res.Stdout, "BAR=NEW")
-	assertive.Contains(t, res.Stdout, "BAZ=OLD")
-	assertive.Contains(t, res.Stdout, "BLED=EXPLICIT")
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, res.ExitCode, 0, "ExitCode")
+	// Confirm explicit Env: declaration overrides os.Environ
+	assertive.Contains(t, res.Stdout, "FOO=REPLACE", "Stdout")
+	// Confirm explicit Env: declaration does add a new variable
+	assertive.Contains(t, res.Stdout, "BAR=NEW", "Stdout")
+	// Confirm explicit Env: declaration for unrelated variable does not reset os.Environ
+	assertive.Contains(t, res.Stdout, "BAZ=OLD", "Stdout")
+	// Confirm that blacklist only operates on os.Environ and not on any explicitly added Env: declaration
+	assertive.Contains(t, res.Stdout, "BLED=EXPLICIT", "Stdout")
 }
 
 func TestStdoutStderr(t *testing.T) {
@@ -288,14 +398,14 @@ func TestStdoutStderr(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err := command.Wait()
 
-	assertive.ErrorIsNil(t, err)
-	assertive.IsEqual(t, res.ExitCode, 0)
-	assertive.IsEqual(t, res.Stdout, "onstdout")
-	assertive.IsEqual(t, res.Stderr, "onstderr")
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, res.ExitCode, 0, "ExitCode")
+	assertive.IsEqual(t, res.Stdout, "onstdout", "Stdout", "Stdout")
+	assertive.IsEqual(t, res.Stderr, "onstderr", "Stderr", "Stderr")
 }
 
 func TestTimeoutPlain(t *testing.T) {
@@ -312,17 +422,17 @@ func TestTimeoutPlain(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err := command.Wait()
 
 	end := time.Now()
 
-	assertive.ErrorIs(t, err, com.ErrTimeout)
-	assertive.IsEqual(t, res.ExitCode, -1)
-	assertive.IsEqual(t, res.Stdout, "one")
-	assertive.IsEqual(t, res.Stderr, "")
-	assertive.IsLessThan(t, end.Sub(start), 2*time.Second)
+	assertive.ErrorIs(t, err, com.ErrTimeout, "Err")
+	assertive.IsEqual(t, res.ExitCode, -1, "ExitCode")
+	assertive.IsEqual(t, res.Stdout, "one", "Stdout")
+	assertive.IsEqual(t, res.Stderr, "", "Stderr")
+	assertive.IsLessThan(t, end.Sub(start), 2*time.Second, "Total execution time")
 }
 
 func TestTimeoutDelayed(t *testing.T) {
@@ -339,7 +449,7 @@ func TestTimeoutDelayed(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	time.Sleep(1 * time.Second)
 
@@ -347,11 +457,11 @@ func TestTimeoutDelayed(t *testing.T) {
 
 	end := time.Now()
 
-	assertive.ErrorIs(t, err, com.ErrTimeout)
-	assertive.IsEqual(t, res.ExitCode, -1)
-	assertive.IsEqual(t, res.Stdout, "one")
-	assertive.IsEqual(t, res.Stderr, "")
-	assertive.IsLessThan(t, end.Sub(start), 2*time.Second)
+	assertive.ErrorIs(t, err, com.ErrTimeout, "Err")
+	assertive.IsEqual(t, res.ExitCode, -1, "ExitCode")
+	assertive.IsEqual(t, res.Stdout, "one", "Stdout")
+	assertive.IsEqual(t, res.Stderr, "", "Stderr")
+	assertive.IsLessThan(t, end.Sub(start), 2*time.Second, "Total execution time")
 }
 
 func TestPTYStdout(t *testing.T) {
@@ -375,14 +485,14 @@ func TestPTYStdout(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err := command.Wait()
 
-	assertive.ErrorIsNil(t, err)
-	assertive.IsEqual(t, res.ExitCode, 0)
-	assertive.IsEqual(t, res.Stdout, "onstdout")
-	assertive.IsEqual(t, res.Stderr, "onstderr")
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, res.ExitCode, 0, "ExitCode")
+	assertive.IsEqual(t, res.Stdout, "onstdout", "Stdout")
+	assertive.IsEqual(t, res.Stderr, "onstderr", "Stderr")
 }
 
 func TestPTYStderr(t *testing.T) {
@@ -406,14 +516,14 @@ func TestPTYStderr(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err := command.Wait()
 
-	assertive.ErrorIsNil(t, err)
-	assertive.IsEqual(t, res.ExitCode, 0)
-	assertive.IsEqual(t, res.Stdout, "onstdout")
-	assertive.IsEqual(t, res.Stderr, "onstderr")
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, res.ExitCode, 0, "ExitCode")
+	assertive.IsEqual(t, res.Stdout, "onstdout", "Stdout")
+	assertive.IsEqual(t, res.Stderr, "onstderr", "Stderr")
 }
 
 func TestPTYBoth(t *testing.T) {
@@ -435,14 +545,14 @@ func TestPTYBoth(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err := command.Wait()
 
-	assertive.ErrorIsNil(t, err)
-	assertive.IsEqual(t, res.ExitCode, 0)
-	assertive.IsEqual(t, res.Stdout, "onstdoutonstderr")
-	assertive.IsEqual(t, res.Stderr, "")
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, res.ExitCode, 0, "ExitCode")
+	assertive.IsEqual(t, res.Stdout, "onstdoutonstderr", "Stdout")
+	assertive.IsEqual(t, res.Stderr, "", "Stderr")
 }
 
 func TestWriteStdin(t *testing.T) {
@@ -468,13 +578,13 @@ func TestWriteStdin(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err := command.Wait()
 
-	assertive.ErrorIsNil(t, err)
-	assertive.IsEqual(t, 0, res.ExitCode)
-	assertive.IsEqual(t, "from stdinhello firsthello worldhello again", res.Stdout)
+	assertive.ErrorIsNil(t, err, "Err")
+	assertive.IsEqual(t, 0, res.ExitCode, "ExitCode")
+	assertive.IsEqual(t, "from stdinhello firsthello worldhello again", res.Stdout, "Stdout")
 }
 
 func TestWritePTYStdin(t *testing.T) {
@@ -503,13 +613,13 @@ func TestWritePTYStdin(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err := command.Wait()
 
-	assertive.ErrorIs(t, err, com.ErrTimeout)
-	assertive.IsEqual(t, -1, res.ExitCode)
-	assertive.IsEqual(t, "hello firsthello worldhello again", res.Stdout)
+	assertive.ErrorIs(t, err, com.ErrTimeout, "Err")
+	assertive.IsEqual(t, -1, res.ExitCode, "ExitCode")
+	assertive.IsEqual(t, "hello firsthello worldhello again", res.Stdout, "Stdout")
 }
 
 func TestSignalOnCompleted(t *testing.T) {
@@ -524,15 +634,15 @@ func TestSignalOnCompleted(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	_, err = command.Wait()
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	err = command.Signal(usig)
 
-	assertive.ErrorIs(t, err, com.ErrFailedSendingSignal)
+	assertive.ErrorIs(t, err, com.ErrFailedSendingSignal, "Err")
 }
 
 // FIXME: this is not working as expected, and proc.Signal returns nil error while it should not.
@@ -549,7 +659,7 @@ func TestSignalOnCompleted(t *testing.T) {
 //
 //  err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 //
-//	assertive.ErrorIsNil(t, err)
+//	assertive.ErrorIsNil(t, err, "Err")
 //
 //	time.Sleep(1 * time.Second)
 //
@@ -583,22 +693,22 @@ func TestSignalNormal(t *testing.T) {
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	// A bit arbitrary - just want to wait for stdout to go through before sending the signal
 	time.Sleep(100 * time.Millisecond)
 
 	_ = command.Signal(usig)
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err := command.Wait()
 
-	assertive.ErrorIs(t, err, com.ErrExecutionFailed)
-	assertive.IsEqual(t, res.Stdout, "entrysetcaught")
-	assertive.IsEqual(t, res.Stderr, "")
-	assertive.IsEqual(t, res.ExitCode, 42)
-	assertive.True(t, res.Signal == nil)
+	assertive.ErrorIs(t, err, com.ErrExecutionFailed, "Err")
+	assertive.IsEqual(t, res.Stdout, "entrysetcaught", "Stdout")
+	assertive.IsEqual(t, res.Stderr, "", "Stderr")
+	assertive.IsEqual(t, res.ExitCode, 42, "ExitCode")
+	assertive.True(t, res.Signal == nil, "Signal")
 
 	command = &com.Command{
 		Binary:  "sleep",
@@ -608,17 +718,17 @@ func TestSignalNormal(t *testing.T) {
 
 	err = command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	err = command.Signal(usig)
 
-	assertive.ErrorIsNil(t, err)
+	assertive.ErrorIsNil(t, err, "Err")
 
 	res, err = command.Wait()
 
-	assertive.ErrorIs(t, err, com.ErrSignaled)
-	assertive.IsEqual(t, res.Stdout, "")
-	assertive.IsEqual(t, res.Stderr, "")
-	assertive.IsEqual(t, res.Signal, usig)
-	assertive.IsEqual(t, res.ExitCode, -1)
+	assertive.ErrorIs(t, err, com.ErrSignaled, "Err")
+	assertive.IsEqual(t, res.Stdout, "", "Stdout")
+	assertive.IsEqual(t, res.Stderr, "", "Stderr")
+	assertive.IsEqual(t, res.Signal, usig, "Signal")
+	assertive.IsEqual(t, res.ExitCode, -1, "ExitCode")
 }

From 734f7a18d38c44034f5f031981ec5f0889c0efc8 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sun, 13 Apr 2025 10:51:24 -0700
Subject: [PATCH 072/225] Cosmetic cleanup and linting

This is mostly a cosmetic changeset:
- refined golangcilint, explicitly calling which linters we really care about, along with settings for revive
- comments on reasons for some of //nolint
- comments line breaks
- additional FIXME information
- assert type check fixes
- const-ification
- overall making linter happy(-ier)

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/.golangci.yml                      | 88 +++++++++++++++----
 mod/tigron/expect/comparators_test.go         |  3 +
 mod/tigron/internal/com/command.go            | 35 +++-----
 mod/tigron/internal/com/command_other.go      |  4 +-
 .../internal/com/package_example_test.go      |  1 +
 mod/tigron/internal/com/package_test.go       |  8 +-
 mod/tigron/internal/com/pipes.go              |  7 +-
 mod/tigron/internal/doc.go                    | 21 +++++
 mod/tigron/internal/exit.go                   |  5 --
 mod/tigron/internal/formatter/osc8.go         |  1 +
 mod/tigron/internal/highk/doc.go              |  4 +-
 mod/tigron/internal/highk/fileleak.go         | 12 +--
 mod/tigron/internal/highk/goroutines.go       |  2 +-
 mod/tigron/internal/logger/doc.go             |  8 +-
 mod/tigron/internal/logger/logger.go          |  8 +-
 mod/tigron/internal/mimicry/mimicry.go        |  3 +-
 mod/tigron/internal/pty/pty.go                |  4 +-
 mod/tigron/require/requirement_test.go        |  8 +-
 mod/tigron/test/command.go                    |  2 +-
 mod/tigron/test/config.go                     |  7 +-
 mod/tigron/test/config_test.go                | 10 ++-
 mod/tigron/test/data.go                       | 32 ++++---
 mod/tigron/test/data_test.go                  |  1 +
 mod/tigron/test/funct.go                      |  1 +
 mod/tigron/test/helpers.go                    |  4 -
 mod/tigron/test/interfaces.go                 |  2 +-
 mod/tigron/test/package_test.go               |  8 +-
 mod/tigron/test/types.go                      |  3 +-
 28 files changed, 176 insertions(+), 116 deletions(-)
 create mode 100644 mod/tigron/internal/doc.go

diff --git a/mod/tigron/.golangci.yml b/mod/tigron/.golangci.yml
index 1c17cd11206..22d2a86dd71 100644
--- a/mod/tigron/.golangci.yml
+++ b/mod/tigron/.golangci.yml
@@ -12,25 +12,81 @@ issues:
 
 linters:
   default: all
+  enable:
+    # These are the default set of golangci (errcheck is disabled, see below)
+    - govet             # Vet examines Go source code and reports suspicious constructs. It is roughly the same as 'go vet' and uses its passes.
+    - ineffassign       # Detects when assignments to existing variables are not used.
+    - staticcheck       # It's the set of rules from staticcheck.
+    - unused            # Checks Go code for unused constants, variables, functions and types.
+    # These are the linters we knowingly want enabled in addition to the default set
+    - containedctx      # avoid embedding context into structs
+    - depguard          # Allows to explicitly allow or disallow third party modules
+    - err113            # encourage static errors
+    - gochecknoglobals  # globals should be avoided as much as possible
+    - godot             # forces dot at the end of comments
+    - gosec             # various security checks
+    - interfacebloat    # limit complexity in public APIs
+    - paralleltest      # enforces tests using parallel
+    - revive            # meta linter (see settings below)
+    - testpackage       # test packages should be separate from the package they test (eg: name them package_test)
+    - testableexamples  # makes sure that examples are testable (have an expected output)
+    - thelper           # enforces use of t.Helper()
+    - varnamelen        # encourage readable descriptive names for variables instead of x, y, z
   disable:
     # These are the linters that we know we do not want
-    - cyclop          # provided by revive
-    - exhaustruct     # does not serve much of a purpose
-    - funlen          # provided by revive
-    - gocognit        # provided by revive
-    - goconst         # provided by revive
-    - godox           # not helpful unless we could downgrade it to warning / info
-    - ginkgolinter    # no ginkgo
-    - gomodguard      # we use depguard instead
-    - ireturn         # too annoying with not enough value
-    - lll             # provided by golines
-    - nonamedreturns  # named returns are occasionally useful
-    - prealloc        # premature optimization
-    - promlinter      # no prometheus
-    - sloglint        # no slog
-    - testifylint     # no testify
-    - zerologlint     # no zerolog
+    - cyclop            # provided by revive
+    - exhaustruct       # does not serve much of a purpose
+    - errcheck          # provided by revive
+    - forcetypeassert   # provided by revive
+    - funlen            # provided by revive
+    - gocognit          # provided by revive
+    - goconst           # provided by revive
+    - godox             # not helpful unless we could downgrade it to warning / info
+    - ginkgolinter      # no ginkgo
+    - gomodguard        # we use depguard instead
+    - ireturn           # too annoying with not enough value
+    - lll               # provided by golines
+    - nestif            # already provided ten different ways with revive cognitive complexity, etc
+    - nonamedreturns    # named returns are occasionally useful
+    - prealloc          # premature optimization
+    - promlinter        # no prometheus
+    - sloglint          # no slog
+    - testifylint       # no testify
+    - zerologlint       # no zerolog
   settings:
+    interfacebloat:
+      # Default is 10
+      max: 13
+    revive:
+      enable-all-rules: true
+      rules:
+        - name: cognitive-complexity
+          # Default is 7
+          arguments: [60]
+        - name: function-length
+          # Default is 50, 75
+          arguments: [80, 180]
+        - name: cyclomatic
+          # Default is 10
+          arguments: [30]
+        - name: add-constant
+          arguments:
+            - allowInts: "0,1,2"
+              allowStrs: '""'
+        - name: flag-parameter
+          # Not sure why this is valuable.
+          disabled: true
+        - name: line-length-limit
+          # Formatter `golines` takes care of this.
+          disabled: true
+        - name: unhandled-error
+          arguments:
+            - "fmt.Print"
+            - "fmt.Println"
+            - "fmt.Printf"
+            - "fmt.Fprint"
+            - "fmt.Fprintln"
+            - "fmt.Fprintf"
     depguard:
       rules:
         main:
diff --git a/mod/tigron/expect/comparators_test.go b/mod/tigron/expect/comparators_test.go
index 211ca7ad03e..c6710f6073b 100644
--- a/mod/tigron/expect/comparators_test.go
+++ b/mod/tigron/expect/comparators_test.go
@@ -14,8 +14,11 @@
    limitations under the License.
 */
 
+//revive:disable:add-constant
 package expect_test
 
+// TODO: add a lot more tests including failure conditions with mimicry
+
 import (
 	"regexp"
 	"testing"
diff --git a/mod/tigron/internal/com/command.go b/mod/tigron/internal/com/command.go
index 855f91cca13..cc8959a7e13 100644
--- a/mod/tigron/internal/com/command.go
+++ b/mod/tigron/internal/com/command.go
@@ -43,16 +43,14 @@ var (
 	ErrFailedStarting = errors.New("command failed starting")
 	// ErrSignaled is returned by Wait() if a signal was sent to the command while running.
 	ErrSignaled = errors.New("command execution signaled")
-	// ErrExecutionFailed is returned by Wait() when a command executes but returns a non-zero error
-	// code.
+	// ErrExecutionFailed is returned by Wait() when a command executes but returns a non-zero error code.
 	ErrExecutionFailed = errors.New("command returned a non-zero exit code")
 	// ErrFailedSendingSignal may happen if sending a signal to an already terminated process.
 	ErrFailedSendingSignal = errors.New("failed sending signal")
 
 	// ErrExecAlreadyStarted is a system error normally indicating a bogus double call to Run().
 	ErrExecAlreadyStarted = errors.New("command has already been started (double `Run`)")
-	// ErrExecNotStarted is a system error normally indicating that Wait() has been called without
-	// first calling Run().
+	// ErrExecNotStarted is a system error normally indicating that Wait() has been called without first calling Run().
 	ErrExecNotStarted = errors.New("command has not been started (call `Run` first)")
 	// ErrExecAlreadyFinished is a system error indicating a double call to Wait().
 	ErrExecAlreadyFinished = errors.New("command is already finished")
@@ -75,7 +73,7 @@ type Result struct {
 }
 
 type execution struct {
-	//nolint:containedctx
+	//nolint:containedctx // Is there a way around this?
 	context context.Context
 	cancel  context.CancelFunc
 	command *exec.Cmd
@@ -138,9 +136,8 @@ func (gc *Command) Clone() *Command {
 	return com
 }
 
-// WithPTY requests that the command be executed with a pty for std streams. Parameters allow
-// showing which streams
-// are to be tied to the pty.
+// WithPTY requests that the command be executed with a pty for std streams.
+// Parameters allow showing which streams are to be tied to the pty.
 // This command has no effect if Run has already been called.
 func (gc *Command) WithPTY(stdin, stdout, stderr bool) {
 	gc.ptyStdout = stdout
@@ -148,17 +145,15 @@ func (gc *Command) WithPTY(stdin, stdout, stderr bool) {
 	gc.ptyStdin = stdin
 }
 
-// WithFeeder ensures that the provider function will be executed and its output fed to the command
-// stdin. WithFeeder, like Feed, can be used multiple times, and writes will be performed
-// sequentially, in order.
+// WithFeeder ensures that the provider function will be executed and its output fed to the command stdin.
+// WithFeeder, like Feed, can be used multiple times, and writes will be performed sequentially, in order.
 // This command has no effect if Run has already been called.
 func (gc *Command) WithFeeder(writers ...func() io.Reader) {
 	gc.writers = append(gc.writers, writers...)
 }
 
 // Feed ensures that the provider reader will be copied on the command stdin.
-// Feed, like WithFeeder, can be used multiple times, and writes will be performed in sequentially,
-// in order.
+// Feed, like WithFeeder, can be used multiple times, and writes will be performed in sequentially, in order.
 // This command has no effect if Run has already been called.
 func (gc *Command) Feed(reader io.Reader) {
 	gc.writers = append(gc.writers, func() io.Reader {
@@ -198,7 +193,6 @@ func (gc *Command) Run(parentCtx context.Context) error {
 
 	// Create a contextual command, set the logger
 	cmd = gc.buildCommand(ctx)
-
 	// Get a debug-logger from the context
 	var (
 		log logger.Logger
@@ -339,8 +333,7 @@ func (gc *Command) wrap() error {
 		err      error
 	)
 
-	// XXXgolang: this is troubling. cmd.ProcessState.ExitCode() is always fine, even if
-	// cmd.ProcessState is nil.
+	// XXXgolang: this is troubling. cmd.ProcessState.ExitCode() is always fine, even if cmd.ProcessState is nil.
 	exitCode = cmd.ProcessState.ExitCode()
 
 	if cmd.ProcessState != nil {
@@ -357,7 +350,7 @@ func (gc *Command) wrap() error {
 		}
 	}
 
-	// Catch-up on the context
+	// Catch-up on the context.
 	switch ctx.Err() {
 	case context.DeadlineExceeded:
 		err = ErrTimeout
@@ -366,7 +359,7 @@ func (gc *Command) wrap() error {
 	default:
 	}
 
-	// Stuff everything in Result and return err
+	// Stuff everything in Result and return err.
 	gc.result = &Result{
 		ExitCode: exitCode,
 		Stdout:   pipes.fromStdout,
@@ -383,7 +376,7 @@ func (gc *Command) wrap() error {
 }
 
 func (gc *Command) buildCommand(ctx context.Context) *exec.Cmd {
-	// Build arguments and binary
+	// Build arguments and binary.
 	args := gc.Args
 	if gc.PrependArgs != nil {
 		args = append(gc.PrependArgs, args...)
@@ -459,12 +452,12 @@ func (gc *Command) buildCommand(ctx context.Context) *exec.Cmd {
 		cmd.Env = append(cmd.Env, k+"="+v)
 	}
 
-	// Attach platform ProcAttr and get optional custom cancellation routine
+	// Attach platform ProcAttr and get optional custom cancellation routine.
 	if cancellation := addAttr(cmd); cancellation != nil {
 		cmd.Cancel = func() error {
 			gc.exec.log.Log("command cancelled")
 
-			// Call the platform dependent cancellation routine
+			// Call the platform dependent cancellation routine.
 			return cancellation()
 		}
 	}
diff --git a/mod/tigron/internal/com/command_other.go b/mod/tigron/internal/com/command_other.go
index 7bddc09c9ff..a510753b019 100644
--- a/mod/tigron/internal/com/command_other.go
+++ b/mod/tigron/internal/com/command_other.go
@@ -24,10 +24,10 @@ import (
 )
 
 func addAttr(cmd *exec.Cmd) func() error {
-	// Default shutdown will leave child processes behind in certain circumstances
+	// Default shutdown will leave child processes behind in certain circumstances.
 	cmd.SysProcAttr = &syscall.SysProcAttr{
 		Setsid: true,
-		// FIXME: understand why we would want that
+		// FIXME: understand why we would want that.
 		// Setctty: true,
 	}
 
diff --git a/mod/tigron/internal/com/package_example_test.go b/mod/tigron/internal/com/package_example_test.go
index 38df0249fef..4090a81b9e8 100644
--- a/mod/tigron/internal/com/package_example_test.go
+++ b/mod/tigron/internal/com/package_example_test.go
@@ -14,6 +14,7 @@
    limitations under the License.
 */
 
+//revive:disable:add-constant
 package com_test
 
 import (
diff --git a/mod/tigron/internal/com/package_test.go b/mod/tigron/internal/com/package_test.go
index 1b6c1c5d526..eaadadc4c8a 100644
--- a/mod/tigron/internal/com/package_test.go
+++ b/mod/tigron/internal/com/package_test.go
@@ -50,10 +50,10 @@ func TestMain(m *testing.M) {
 		diff := highk.Diff(string(before), string(after))
 
 		if len(diff) != 0 {
-			_, _ = fmt.Fprintln(os.Stderr, "Leaking file descriptors")
+			fmt.Fprintln(os.Stderr, "Leaking file descriptors")
 
 			for _, file := range diff {
-				_, _ = fmt.Fprintln(os.Stderr, file)
+				fmt.Fprintln(os.Stderr, file)
 			}
 
 			exitCode = 1
@@ -61,8 +61,8 @@ func TestMain(m *testing.M) {
 	}
 
 	if err := highk.FindGoRoutines(); err != nil {
-		_, _ = fmt.Fprintln(os.Stderr, "Leaking go routines")
-		_, _ = fmt.Fprintln(os.Stderr, err.Error())
+		fmt.Fprintln(os.Stderr, "Leaking go routines")
+		fmt.Fprintln(os.Stderr, err.Error())
 
 		exitCode = 1
 	}
diff --git a/mod/tigron/internal/com/pipes.go b/mod/tigron/internal/com/pipes.go
index fc8f9e32baf..adda3d2ed0e 100644
--- a/mod/tigron/internal/com/pipes.go
+++ b/mod/tigron/internal/com/pipes.go
@@ -33,11 +33,9 @@ import (
 var (
 	// ErrFailedCreating could be returned by newStdPipes() on pty creation failure.
 	ErrFailedCreating = errors.New("failed acquiring pipe")
-	// ErrFailedReading could be returned by the ioGroup in case the go routines fails to read out
-	// of a pipe.
+	// ErrFailedReading could be returned by the ioGroup in case the go routines fails to read out of a pipe.
 	ErrFailedReading = errors.New("failed reading")
-	// ErrFailedWriting could be returned by the ioGroup in case the go routines fails to write on a
-	// pipe.
+	// ErrFailedWriting could be returned by the ioGroup in case the go routines fails to write on a pipe.
 	ErrFailedWriting = errors.New("failed writing")
 )
 
@@ -108,7 +106,6 @@ func (pipes *stdPipes) closeCaller() {
 	}
 }
 
-//nolint:gocognit
 func newStdPipes(
 	ctx context.Context,
 	log *logger.ConcreteLogger,
diff --git a/mod/tigron/internal/doc.go b/mod/tigron/internal/doc.go
new file mode 100644
index 00000000000..861260a5b73
--- /dev/null
+++ b/mod/tigron/internal/doc.go
@@ -0,0 +1,21 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package internal provides an assert library, pty, a command wrapper, and a leak detection library
+// for internal use in Tigron. The objective for these is not to become generic use-cases libraries,
+// but instead to deliver what Tigron
+// needs in the simplest possible form.
+package internal
diff --git a/mod/tigron/internal/exit.go b/mod/tigron/internal/exit.go
index 3fddd602491..7a124a01730 100644
--- a/mod/tigron/internal/exit.go
+++ b/mod/tigron/internal/exit.go
@@ -14,11 +14,6 @@
    limitations under the License.
 */
 
-// Package internal provides an assert library, pty, a command wrapper, and a leak detection library
-// for internal use in Tigron.
-// The objective for these is not to become generic use-cases libraries, but instead to deliver what
-// Tigron needs
-// in the simplest possible form.
 package internal
 
 // This is duplicated from `expect` to avoid circular imports.
diff --git a/mod/tigron/internal/formatter/osc8.go b/mod/tigron/internal/formatter/osc8.go
index 4a4874a3a9d..6917dad4c68 100644
--- a/mod/tigron/internal/formatter/osc8.go
+++ b/mod/tigron/internal/formatter/osc8.go
@@ -27,5 +27,6 @@ type OSC8 struct {
 
 func (o *OSC8) String() string {
 	// FIXME: not sure if any desktop software does support line numbers anchors?
+	// FIXME: test that the terminal is able to display these and fallback to printing the information if not.
 	return fmt.Sprintf("\x1b]8;;%s#%d:1\x07%s\x1b]8;;\x07"+"\u001b[0m", o.Location, o.Line, o.Text)
 }
diff --git a/mod/tigron/internal/highk/doc.go b/mod/tigron/internal/highk/doc.go
index 1383569de95..46c419008b1 100644
--- a/mod/tigron/internal/highk/doc.go
+++ b/mod/tigron/internal/highk/doc.go
@@ -14,8 +14,8 @@
    limitations under the License.
 */
 
-// Package highk (for "high-κ dielectric") is a highly experimental leak detection library
-// (for file descriptors and go routines).
+// Package highk (for "high-κ dielectric") is a highly experimental leak detection library (for file descriptors and go
+// routines).
 // It is purely internal for now and used only as part of the tests for tigron.
 // TODO:
 // - get rid of lsof and implement in go
diff --git a/mod/tigron/internal/highk/fileleak.go b/mod/tigron/internal/highk/fileleak.go
index af8da5fcfd3..7c3d167a38f 100644
--- a/mod/tigron/internal/highk/fileleak.go
+++ b/mod/tigron/internal/highk/fileleak.go
@@ -26,9 +26,9 @@ import (
 	"syscall"
 )
 
-// FIXME: it seems that lsof (or go test) is interefering and showing false positive KQUEUE / inodes
+// FIXME: it seems that lsof (or go test) is interfering and showing false positive KQUEUE / inodes
 //
-//nolint:gochecknoglobals
+//nolint:gochecknoglobals // FIXME rewrite all of this anyhow
 var whitelist = map[string]bool{
 	"KQUEUE":  true,
 	"a_inode": true,
@@ -36,10 +36,10 @@ var whitelist = map[string]bool{
 
 // SnapshotOpenFiles will capture the list of currently open-files for the process.
 //
-//nolint:wrapcheck
+//nolint:wrapcheck // FIXME: work in progress
 func SnapshotOpenFiles(file *os.File) ([]byte, error) {
-	// Using a buffer would add a pipe to the list of files
-	// Reimplement this stuff in go ASAP and toss lsof instead of passing around fd
+	// Using a buffer would add a pipe to the list of files.
+	// Reimplement this stuff in go ASAP and toss lsof instead of passing around fd.
 	_, _ = file.Seek(0, 0)
 	_ = file.Truncate(0)
 
@@ -48,7 +48,7 @@ func SnapshotOpenFiles(file *os.File) ([]byte, error) {
 		return nil, err
 	}
 
-	//nolint:gosec
+	//nolint:gosec // G204 is fine here
 	cmd := exec.Command(exe, "-nP", "-p", strconv.Itoa(syscall.Getpid()))
 	cmd.Stdout = file
 
diff --git a/mod/tigron/internal/highk/goroutines.go b/mod/tigron/internal/highk/goroutines.go
index 121facf8816..30c80e4bb1a 100644
--- a/mod/tigron/internal/highk/goroutines.go
+++ b/mod/tigron/internal/highk/goroutines.go
@@ -22,7 +22,7 @@ import (
 
 // FindGoRoutines retrieves leaked go routines, which are returned as an error.
 //
-//nolint:wrapcheck
+//nolint:wrapcheck // FIXME: work in progress
 func FindGoRoutines() error {
 	return goleak.Find()
 }
diff --git a/mod/tigron/internal/logger/doc.go b/mod/tigron/internal/logger/doc.go
index 29cbb608fd6..8731bcaf6ce 100644
--- a/mod/tigron/internal/logger/doc.go
+++ b/mod/tigron/internal/logger/doc.go
@@ -14,8 +14,8 @@
    limitations under the License.
 */
 
-// Package logger is a very simple stub allowing developers to hook whatever logger they want to
-// debug internal behavior of the com package.
-// The passed logger just has to implement the Log(args...interface{}) method.
-// Typically, that would be testing.T.
+// Package logger is a very simple stub allowing developers to hook whatever logger they want to debug internal behavior
+// of the com package.
+// The passed logger just has to implement the Log(args...any) method.
+// Typically, that would be a *testing.T.
 package logger
diff --git a/mod/tigron/internal/logger/logger.go b/mod/tigron/internal/logger/logger.go
index 7fa26e5b718..a9be51a296c 100644
--- a/mod/tigron/internal/logger/logger.go
+++ b/mod/tigron/internal/logger/logger.go
@@ -22,13 +22,13 @@ import (
 
 // Logger describes a passed logger, useful only for debugging.
 type Logger interface {
-	Log(args ...interface{})
+	Log(args ...any)
 	Helper()
 }
 
 // ConcreteLogger is a simple struct allowing to set additional metadata for a Logger.
 type ConcreteLogger struct {
-	meta       []interface{}
+	meta       []any
 	wrappedLog Logger
 }
 
@@ -41,12 +41,12 @@ func (cl *ConcreteLogger) Set(key, value string) *ConcreteLogger {
 }
 
 // Log prints a message using the Log method of the embedded Logger.
-func (cl *ConcreteLogger) Log(args ...interface{}) {
+func (cl *ConcreteLogger) Log(args ...any) {
 	if cl.wrappedLog != nil {
 		cl.wrappedLog.Helper()
 		cl.wrappedLog.Log(
 			append(
-				append([]interface{}{"[" + time.Now().Format(time.RFC3339) + "]"}, cl.meta...),
+				append([]any{"[" + time.Now().Format(time.RFC3339) + "]"}, cl.meta...),
 				args...)...)
 	}
 }
diff --git a/mod/tigron/internal/mimicry/mimicry.go b/mod/tigron/internal/mimicry/mimicry.go
index 60deb6c1a34..d9afa081dac 100644
--- a/mod/tigron/internal/mimicry/mimicry.go
+++ b/mod/tigron/internal/mimicry/mimicry.go
@@ -137,8 +137,7 @@ func (mi *Core) Register(fun, handler any) {
 
 func getFunID(fun any) string {
 	// The point of keeping only the func name is to avoid type mismatch dependent on what interface
-	// is used by the
-	// consumer.
+	// is used by the consumer.
 	origin := runtime.FuncForPC(reflect.ValueOf(fun).Pointer()).Name()
 	seg := strings.Split(origin, ".")
 	origin = seg[len(seg)-1]
diff --git a/mod/tigron/internal/pty/pty.go b/mod/tigron/internal/pty/pty.go
index cd564a2731b..a7facf80105 100644
--- a/mod/tigron/internal/pty/pty.go
+++ b/mod/tigron/internal/pty/pty.go
@@ -35,8 +35,8 @@ var (
 )
 
 // Open will allocate and return a new pty.
-func Open() (*os.File, *os.File, error) {
-	pty, tty, err := creack.Open()
+func Open() (pty, tty *os.File, err error) {
+	pty, tty, err = creack.Open()
 	if err != nil {
 		if errors.Is(err, creack.ErrUnsupported) {
 			err = errors.Join(ErrUnsupportedPlatform, err)
diff --git a/mod/tigron/require/requirement_test.go b/mod/tigron/require/requirement_test.go
index aa4e0fec0f2..040e77e7e08 100644
--- a/mod/tigron/require/requirement_test.go
+++ b/mod/tigron/require/requirement_test.go
@@ -57,7 +57,7 @@ func TestRequire(t *testing.T) {
 		pass, _ = require.Arch(runtime.GOARCH).Check(nil, nil)
 	}
 
-	assertive.IsEqual(t, pass, true)
+	assertive.IsEqual(t, pass, true, "Require works as expected")
 }
 
 func TestNot(t *testing.T) {
@@ -76,7 +76,7 @@ func TestNot(t *testing.T) {
 		pass, _ = require.Not(require.Linux).Check(nil, nil)
 	}
 
-	assertive.IsEqual(t, pass, true)
+	assertive.IsEqual(t, pass, true, "require.Not works as expected")
 }
 
 func TestAllSuccess(t *testing.T) {
@@ -99,7 +99,7 @@ func TestAllSuccess(t *testing.T) {
 			require.Not(require.Darwin)).Check(nil, nil)
 	}
 
-	assertive.IsEqual(t, pass, true)
+	assertive.IsEqual(t, pass, true, "require.All works as expected")
 }
 
 func TestAllOneFail(t *testing.T) {
@@ -122,5 +122,5 @@ func TestAllOneFail(t *testing.T) {
 			require.Not(require.Darwin)).Check(nil, nil)
 	}
 
-	assertive.IsEqual(t, pass, true)
+	assertive.IsEqual(t, pass, true, "mixing require.All and require.Not works as expected")
 }
diff --git a/mod/tigron/test/command.go b/mod/tigron/test/command.go
index ef41610338a..67289079867 100644
--- a/mod/tigron/test/command.go
+++ b/mod/tigron/test/command.go
@@ -38,7 +38,7 @@ const defaultExecutionTimeout = 3 * time.Minute
 // FIXME: now that most of the logic got moved to the internal command, consider simplifying this /
 // removing some of the extra layers from here
 //
-//nolint:interfacebloat
+
 type CustomizableCommand interface {
 	TestableCommand
 
diff --git a/mod/tigron/test/config.go b/mod/tigron/test/config.go
index 366b3651fbc..e9f37ddef61 100644
--- a/mod/tigron/test/config.go
+++ b/mod/tigron/test/config.go
@@ -17,8 +17,6 @@
 package test
 
 // WithConfig returns a config object with a certain config property set.
-//
-//nolint:ireturn
 func WithConfig(key ConfigKey, value ConfigValue) Config {
 	cfg := &config{}
 	cfg.Write(key, value)
@@ -26,9 +24,7 @@ func WithConfig(key ConfigKey, value ConfigValue) Config {
 	return cfg
 }
 
-// Contains the implementation of the Config interface
-
-//nolint:ireturn
+// Contains the implementation of the Config interface.
 func configureConfig(cfg, parent Config) Config {
 	if cfg == nil {
 		cfg = &config{
@@ -49,7 +45,6 @@ type config struct {
 	config map[ConfigKey]ConfigValue
 }
 
-//nolint:ireturn
 func (cfg *config) Write(key ConfigKey, value ConfigValue) Config {
 	if cfg.config == nil {
 		cfg.config = make(map[ConfigKey]ConfigValue)
diff --git a/mod/tigron/test/config_test.go b/mod/tigron/test/config_test.go
index 6112aee0d09..6f8e85912cd 100644
--- a/mod/tigron/test/config_test.go
+++ b/mod/tigron/test/config_test.go
@@ -14,7 +14,8 @@
    limitations under the License.
 */
 
-//nolint:testpackage
+//revive:disable:add-constant
+//nolint:testpackage // We need to test some internals here
 package test
 
 import (
@@ -46,8 +47,11 @@ func TestConfig(t *testing.T) {
 	cfg2 := WithConfig("test", "two")
 	cfg2.Write("adopt", "two")
 
-	//nolint:forcetypeassert
-	cfg.(*config).adopt(cfg2)
+	cnf, ok := cfg.(*config)
+
+	assertive.True(t, ok)
+
+	cnf.adopt(cfg2)
 
 	assertive.IsEqual(t, string(cfg.Read("test")), "one")
 	assertive.IsEqual(t, string(cfg.Read("adopt")), "two")
diff --git a/mod/tigron/test/data.go b/mod/tigron/test/data.go
index 59bb8218384..8907b9ca199 100644
--- a/mod/tigron/test/data.go
+++ b/mod/tigron/test/data.go
@@ -25,12 +25,12 @@ import (
 )
 
 const (
-	identifierMaxLength = 76
+	identifierMaxLength       = 76
+	identifierSeparator       = "-"
+	identifierSignatureLength = 8
 )
 
 // WithData returns a data object with a certain key value set.
-//
-//nolint:ireturn
 func WithData(key, value string) Data {
 	dat := &data{}
 	dat.Set(key, value)
@@ -38,9 +38,7 @@ func WithData(key, value string) Data {
 	return dat
 }
 
-// Contains the implementation of the Data interface
-
-//nolint:ireturn
+// Contains the implementation of the Data interface.
 func configureData(t *testing.T, seedData, parent Data) Data {
 	t.Helper()
 
@@ -77,7 +75,6 @@ func (dt *data) Get(key string) string {
 	return dt.labels[key]
 }
 
-//nolint:ireturn
 func (dt *data) Set(key, value string) Data {
 	if dt.labels == nil {
 		dt.labels = map[string]string{}
@@ -98,11 +95,12 @@ func (dt *data) TempDir() string {
 
 func (dt *data) adopt(parent Data) {
 	// Note: implementation dependent
-	//nolint:forcetypeassert
-	for k, v := range parent.(*data).labels {
-		// Only copy keys that are not set already
-		if _, ok := dt.labels[k]; !ok {
-			dt.Set(k, v)
+	if castData, ok := parent.(*data); ok {
+		for k, v := range castData.labels {
+			// Only copy keys that are not set already
+			if _, ok := dt.labels[k]; !ok {
+				dt.Set(k, v)
+			}
 		}
 	}
 }
@@ -110,11 +108,11 @@ func (dt *data) adopt(parent Data) {
 func defaultIdentifierHashing(names ...string) string {
 	// Notes: identifier MAY be used for namespaces, image names, etc.
 	// So, the rules are stringent on what it can contain.
-	replaceWith := []byte("-")
+	replaceWith := []byte(identifierSeparator)
 	name := strings.ToLower(strings.Join(names, string(replaceWith)))
 	// Ensure we have a unique identifier despite characters replacements
 	// (well, as unique as the names collection being passed)
-	signature := fmt.Sprintf("%x", sha256.Sum256([]byte(name)))[0:8]
+	signature := fmt.Sprintf("%x", sha256.Sum256([]byte(name)))[0:identifierSignatureLength]
 	// Make sure we do not use any unsafe characters
 	safeName := regexp.MustCompile(`[^a-z0-9-]+`)
 	// And we avoid repeats of the separator
@@ -126,11 +124,11 @@ func defaultIdentifierHashing(names ...string) string {
 
 	// Ensure we will never go above 76 characters in length (with signature)
 	if len(name) > (identifierMaxLength - len(signature)) {
-		name = name[0:67]
+		name = name[0 : identifierMaxLength-identifierSignatureLength-len(identifierSeparator)]
 	}
 
-	if name[len(name)-1:] != "-" {
-		signature = "-" + signature
+	if name[len(name)-1:] != identifierSeparator {
+		signature = identifierSeparator + signature
 	}
 
 	return name + signature
diff --git a/mod/tigron/test/data_test.go b/mod/tigron/test/data_test.go
index 9e39ed677ca..dff839d6026 100644
--- a/mod/tigron/test/data_test.go
+++ b/mod/tigron/test/data_test.go
@@ -15,6 +15,7 @@
 */
 
 //nolint:testpackage
+//revive:disable:add-constant
 package test
 
 import (
diff --git a/mod/tigron/test/funct.go b/mod/tigron/test/funct.go
index 446c003aba5..8614b9cbefb 100644
--- a/mod/tigron/test/funct.go
+++ b/mod/tigron/test/funct.go
@@ -26,6 +26,7 @@ type Evaluator func(data Data, helpers Helpers) (bool, string)
 type Butler func(data Data, helpers Helpers)
 
 // A Comparator is the function signature to implement for the Output property of an Expected.
+// TODO: when we will break API, remove the info parameter.
 type Comparator func(stdout, info string, t *testing.T)
 
 // A Manager is the function signature meant to produce expectations for a command.
diff --git a/mod/tigron/test/helpers.go b/mod/tigron/test/helpers.go
index 3cc6cae6317..681226047fa 100644
--- a/mod/tigron/test/helpers.go
+++ b/mod/tigron/test/helpers.go
@@ -74,8 +74,6 @@ func (help *helpersInternal) Err(args ...string) string {
 }
 
 // Command will return a clone of your base command without running it.
-//
-//nolint:ireturn,nolintlint
 func (help *helpersInternal) Command(args ...string) TestableCommand {
 	cc := help.cmdInternal.Clone()
 	cc.WithArgs(args...)
@@ -85,8 +83,6 @@ func (help *helpersInternal) Command(args ...string) TestableCommand {
 
 // Custom will return a command for the requested binary and args, with the environment of your test
 // (eg: Env, Cwd, etc.)
-//
-//nolint:ireturn,nolintlint
 func (help *helpersInternal) Custom(binary string, args ...string) TestableCommand {
 	cc := help.cmdInternal.clear()
 	cc.WithBinary(binary)
diff --git a/mod/tigron/test/interfaces.go b/mod/tigron/test/interfaces.go
index 8f8727a8298..07f348999c5 100644
--- a/mod/tigron/test/interfaces.go
+++ b/mod/tigron/test/interfaces.go
@@ -75,7 +75,7 @@ type Helpers interface {
 // with an Expected. A TestableCommand can be used as a Case Command obviously, but also as part of
 // a Setup or Cleanup routine, and as the basis of any type of helper.
 // For more powerful use-cases outside of test cases, see below CustomizableCommand.
-type TestableCommand interface { //nolint:interfacebloat
+type TestableCommand interface {
 	// WithBinary specifies what binary to execute.
 	WithBinary(binary string)
 	// WithArgs specifies the args to pass to the binary. Note that WithArgs can be used multiple
diff --git a/mod/tigron/test/package_test.go b/mod/tigron/test/package_test.go
index 5e10a796398..d637f02e53d 100644
--- a/mod/tigron/test/package_test.go
+++ b/mod/tigron/test/package_test.go
@@ -50,10 +50,10 @@ func TestMain(m *testing.M) {
 		diff := highk.Diff(string(before), string(after))
 
 		if len(diff) != 0 {
-			_, _ = fmt.Fprintln(os.Stderr, "Leaking file descriptors")
+			fmt.Fprintln(os.Stderr, "Leaking file descriptors")
 
 			for _, file := range diff {
-				_, _ = fmt.Fprintln(os.Stderr, file)
+				fmt.Fprintln(os.Stderr, file)
 			}
 
 			exitCode = 1
@@ -61,8 +61,8 @@ func TestMain(m *testing.M) {
 	}
 
 	if err := highk.FindGoRoutines(); err != nil {
-		_, _ = fmt.Fprintln(os.Stderr, "Leaking go routines")
-		_, _ = fmt.Fprintln(os.Stderr, os.Stderr, err.Error())
+		fmt.Fprintln(os.Stderr, "Leaking go routines")
+		fmt.Fprintln(os.Stderr, os.Stderr, err.Error())
 
 		exitCode = 1
 	}
diff --git a/mod/tigron/test/types.go b/mod/tigron/test/types.go
index 0b8130bc2ef..af74be37ef9 100644
--- a/mod/tigron/test/types.go
+++ b/mod/tigron/test/types.go
@@ -23,8 +23,7 @@ type (
 	ConfigValue string
 )
 
-// A Requirement offers a way to verify random conditions to decide if a test should be skipped or
-// run.
+// A Requirement offers a way to verify random conditions to decide if a test should be skipped or run.
 // It can also (optionally) provide custom Setup and Cleanup routines.
 type Requirement struct {
 	// Check is expected to verify if the requirement is fulfilled, and return a boolean and an

From 609fe3b5a2923b0ac5274fbd154d752942ae88be Mon Sep 17 00:00:00 2001
From: Yuhang Wei <weiyuhang2011@gmail.com>
Date: Mon, 14 Apr 2025 20:54:12 +0800
Subject: [PATCH 073/225] fix: inspect should return one array rather than a
 stream of array

Signed-off-by: Yuhang Wei <weiyuhang2011@gmail.com>
---
 cmd/nerdctl/container/container_inspect.go | 18 ++++++++++++++++--
 cmd/nerdctl/image/image_inspect.go         | 16 +++++++++++++++-
 cmd/nerdctl/inspect/inspect.go             | 22 +++++++++++++++++++---
 pkg/cmd/container/inspect.go               | 12 ++++--------
 pkg/cmd/image/inspect.go                   | 14 +++-----------
 5 files changed, 57 insertions(+), 25 deletions(-)

diff --git a/cmd/nerdctl/container/container_inspect.go b/cmd/nerdctl/container/container_inspect.go
index 8f1b6b807cf..78560b63c0e 100644
--- a/cmd/nerdctl/container/container_inspect.go
+++ b/cmd/nerdctl/container/container_inspect.go
@@ -21,15 +21,18 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/containerd/log"
+
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/completion"
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
 	"github.com/containerd/nerdctl/v2/pkg/clientutil"
 	"github.com/containerd/nerdctl/v2/pkg/cmd/container"
+	"github.com/containerd/nerdctl/v2/pkg/formatter"
 )
 
 func inspectCommand() *cobra.Command {
-	var cmd = &cobra.Command{
+	cmd := &cobra.Command{
 		Use:               "inspect [flags] CONTAINER [CONTAINER, ...]",
 		Short:             "Display detailed information on one or more containers.",
 		Long:              "Hint: set `--mode=native` for showing the full output",
@@ -100,7 +103,18 @@ func inspectAction(cmd *cobra.Command, args []string) error {
 	}
 	defer cancel()
 
-	return container.Inspect(ctx, client, args, opt)
+	entries, err := container.Inspect(ctx, client, args, opt)
+	if err != nil {
+		return err
+	}
+
+	// Display
+	if len(entries) > 0 {
+		if formatErr := formatter.FormatSlice(opt.Format, opt.Stdout, entries); formatErr != nil {
+			log.G(ctx).Error(formatErr)
+		}
+	}
+	return err
 }
 
 func containerInspectShellComplete(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
diff --git a/cmd/nerdctl/image/image_inspect.go b/cmd/nerdctl/image/image_inspect.go
index 833b770f9b0..5dd7238a151 100644
--- a/cmd/nerdctl/image/image_inspect.go
+++ b/cmd/nerdctl/image/image_inspect.go
@@ -21,11 +21,14 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/containerd/log"
+
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/completion"
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
 	"github.com/containerd/nerdctl/v2/pkg/clientutil"
 	"github.com/containerd/nerdctl/v2/pkg/cmd/image"
+	"github.com/containerd/nerdctl/v2/pkg/formatter"
 )
 
 func inspectCommand() *cobra.Command {
@@ -102,7 +105,18 @@ func imageInspectAction(cmd *cobra.Command, args []string) error {
 	}
 	defer cancel()
 
-	return image.Inspect(ctx, client, args, options)
+	entries, err := image.Inspect(ctx, client, args, options)
+	if err != nil {
+		return err
+	}
+
+	// Display
+	if len(entries) > 0 {
+		if formatErr := formatter.FormatSlice(options.Format, options.Stdout, entries); formatErr != nil {
+			log.G(ctx).Error(formatErr)
+		}
+	}
+	return err
 }
 
 func imageInspectShellComplete(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
diff --git a/cmd/nerdctl/inspect/inspect.go b/cmd/nerdctl/inspect/inspect.go
index 8c62f54e4d1..0473f1bddc3 100644
--- a/cmd/nerdctl/inspect/inspect.go
+++ b/cmd/nerdctl/inspect/inspect.go
@@ -22,6 +22,8 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/containerd/log"
+
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/completion"
 	containercmd "github.com/containerd/nerdctl/v2/cmd/nerdctl/container"
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
@@ -30,12 +32,13 @@ import (
 	"github.com/containerd/nerdctl/v2/pkg/clientutil"
 	"github.com/containerd/nerdctl/v2/pkg/cmd/container"
 	"github.com/containerd/nerdctl/v2/pkg/cmd/image"
+	"github.com/containerd/nerdctl/v2/pkg/formatter"
 	"github.com/containerd/nerdctl/v2/pkg/idutil/containerwalker"
 	"github.com/containerd/nerdctl/v2/pkg/idutil/imagewalker"
 )
 
 func Command() *cobra.Command {
-	var cmd = &cobra.Command{
+	cmd := &cobra.Command{
 		Use:               "inspect",
 		Short:             "Return low-level information on objects.",
 		Args:              cobra.MinimumNArgs(1),
@@ -79,6 +82,10 @@ func inspectAction(cmd *cobra.Command, args []string) error {
 	}
 	namespace := globalOptions.Namespace
 	address := globalOptions.Address
+	format, err := cmd.Flags().GetString("format")
+	if err != nil {
+		return err
+	}
 	inspectType, err := cmd.Flags().GetString("type")
 	if err != nil {
 		return err
@@ -130,6 +137,7 @@ func inspectAction(cmd *cobra.Command, args []string) error {
 	}
 
 	var errs []error
+	var entries []interface{}
 	for _, req := range args {
 		var ni int
 		var nc int
@@ -150,12 +158,16 @@ func inspectAction(cmd *cobra.Command, args []string) error {
 		if ni == 0 && nc == 0 {
 			errs = append(errs, fmt.Errorf("no such object %s", req))
 		} else if ni > 0 {
-			if err := image.Inspect(ctx, client, []string{req}, imageInspectOptions); err != nil {
+			if imageEntries, err := image.Inspect(ctx, client, []string{req}, imageInspectOptions); err != nil {
 				errs = append(errs, err)
+			} else {
+				entries = append(entries, imageEntries...)
 			}
 		} else if nc > 0 {
-			if err := container.Inspect(ctx, client, []string{req}, containerInspectOptions); err != nil {
+			if containerEntries, err := container.Inspect(ctx, client, []string{req}, containerInspectOptions); err != nil {
 				errs = append(errs, err)
+			} else {
+				entries = append(entries, containerEntries...)
 			}
 		}
 	}
@@ -164,6 +176,10 @@ func inspectAction(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("%d errors: %v", len(errs), errs)
 	}
 
+	if formatErr := formatter.FormatSlice(format, cmd.OutOrStdout(), entries); formatErr != nil {
+		log.G(ctx).Error(formatErr)
+	}
+
 	return nil
 }
 
diff --git a/pkg/cmd/container/inspect.go b/pkg/cmd/container/inspect.go
index 72db92d4248..63c359ae51a 100644
--- a/pkg/cmd/container/inspect.go
+++ b/pkg/cmd/container/inspect.go
@@ -23,19 +23,17 @@ import (
 
 	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/containerd/v2/core/snapshots"
-	"github.com/containerd/log"
 
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
 	"github.com/containerd/nerdctl/v2/pkg/containerdutil"
 	"github.com/containerd/nerdctl/v2/pkg/containerinspector"
-	"github.com/containerd/nerdctl/v2/pkg/formatter"
 	"github.com/containerd/nerdctl/v2/pkg/idutil/containerwalker"
 	"github.com/containerd/nerdctl/v2/pkg/imgutil"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 )
 
 // Inspect prints detailed information for each container in `containers`.
-func Inspect(ctx context.Context, client *containerd.Client, containers []string, options types.ContainerInspectOptions) error {
+func Inspect(ctx context.Context, client *containerd.Client, containers []string, options types.ContainerInspectOptions) ([]any, error) {
 	f := &containerInspector{
 		mode:        options.Mode,
 		size:        options.Size,
@@ -48,13 +46,11 @@ func Inspect(ctx context.Context, client *containerd.Client, containers []string
 	}
 
 	err := walker.WalkAll(ctx, containers, true)
-	if len(f.entries) > 0 {
-		if formatErr := formatter.FormatSlice(options.Format, options.Stdout, f.entries); formatErr != nil {
-			log.L.Error(formatErr)
-		}
+	if err != nil {
+		return []any{}, err
 	}
 
-	return err
+	return f.entries, nil
 }
 
 type containerInspector struct {
diff --git a/pkg/cmd/image/inspect.go b/pkg/cmd/image/inspect.go
index 35d3211f737..3d549a4bcff 100644
--- a/pkg/cmd/image/inspect.go
+++ b/pkg/cmd/image/inspect.go
@@ -30,7 +30,6 @@ import (
 
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
 	"github.com/containerd/nerdctl/v2/pkg/containerdutil"
-	"github.com/containerd/nerdctl/v2/pkg/formatter"
 	"github.com/containerd/nerdctl/v2/pkg/imageinspector"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/referenceutil"
@@ -87,7 +86,7 @@ func inspectIdentifier(ctx context.Context, client *containerd.Client, identifie
 }
 
 // Inspect prints detailed information of each image in `images`.
-func Inspect(ctx context.Context, client *containerd.Client, identifiers []string, options types.ImageInspectOptions) error {
+func Inspect(ctx context.Context, client *containerd.Client, identifiers []string, options types.ImageInspectOptions) ([]any, error) {
 	// Set a timeout
 	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
@@ -189,16 +188,9 @@ func Inspect(ctx context.Context, client *containerd.Client, identifiers []strin
 		}
 	}
 
-	// Display
-	if len(entries) > 0 {
-		if formatErr := formatter.FormatSlice(options.Format, options.Stdout, entries); formatErr != nil {
-			log.G(ctx).Error(formatErr)
-		}
-	}
-
 	if len(errs) > 0 {
-		return fmt.Errorf("%d errors:\n%w", len(errs), errors.Join(errs...))
+		return []any{}, fmt.Errorf("%d errors:\n%w", len(errs), errors.Join(errs...))
 	}
 
-	return nil
+	return entries, nil
 }

From a46b5678e18e8fc77044f16b8838732ca58c4578 Mon Sep 17 00:00:00 2001
From: Yuhang Wei <weiyuhang2011@gmail.com>
Date: Mon, 14 Apr 2025 20:54:43 +0800
Subject: [PATCH 074/225] test(inspect): validate combined container and image
 inspect output

`nerdctl inspect <container> <image>` should return a single JSON array
containing both the container and image inspect results. This unit test
parses the output and compares it with the results of separate `inspect`
commands to ensure correctness.

Signed-off-by: Yuhang Wei <weiyuhang2011@gmail.com>
---
 cmd/nerdctl/inspect/inspect_test.go | 49 +++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/cmd/nerdctl/inspect/inspect_test.go b/cmd/nerdctl/inspect/inspect_test.go
index 18b6d6ffee5..954b0e73eac 100644
--- a/cmd/nerdctl/inspect/inspect_test.go
+++ b/cmd/nerdctl/inspect/inspect_test.go
@@ -17,11 +17,60 @@
 package inspect
 
 import (
+	"encoding/json"
 	"testing"
 
+	"gotest.tools/v3/assert"
+
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
+	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestMain(m *testing.M) {
 	testutil.M(m)
 }
+
+func TestInspectSimpleCase(t *testing.T) {
+	nerdtest.Setup()
+	testCase := &test.Case{
+		Description: "inspect container and image return one single json array",
+		Setup: func(data test.Data, helpers test.Helpers) {
+			identifier := data.Identifier()
+			helpers.Ensure("run", "-d", "--quiet", "--name", identifier, testutil.CommonImage, "sleep", nerdtest.Infinity)
+		},
+		Cleanup: func(data test.Data, helpers test.Helpers) {
+			identifier := data.Identifier()
+			helpers.Anyhow("rm", "-f", identifier)
+		},
+		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+			return helpers.Command("inspect", testutil.CommonImage, data.Identifier())
+		},
+		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+			return &test.Expected{
+				Output: func(stdout string, info string, t *testing.T) {
+					var inspectResult []json.RawMessage
+					err := json.Unmarshal([]byte(stdout), &inspectResult)
+					assert.NilError(t, err, "Unable to unmarshal output\n"+info)
+					assert.Equal(t, len(inspectResult), 2, "Unexpectedly got multiple results\n"+info)
+
+					var dci dockercompat.Image
+					err = json.Unmarshal(inspectResult[0], &dci)
+					assert.NilError(t, err, "Unable to unmarshal output\n"+info)
+					inspecti := nerdtest.InspectImage(helpers, testutil.CommonImage)
+					assert.Equal(t, dci.ID, inspecti.ID, info)
+
+					var dcc dockercompat.Container
+					err = json.Unmarshal(inspectResult[1], &dcc)
+					assert.NilError(t, err, "Unable to unmarshal output\n"+info)
+					inspectc := nerdtest.InspectContainer(helpers, data.Identifier())
+					assert.Assert(t, dcc.ID == inspectc.ID, info)
+				},
+			}
+		},
+	}
+
+	testCase.Run(t)
+}

From 88a564095496af7c7a2c573d7cc80100eda7b5f9 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Mon, 14 Apr 2025 08:50:44 -0700
Subject: [PATCH 075/225] Fix canary version matching

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 hack/build-integration-canary.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hack/build-integration-canary.sh b/hack/build-integration-canary.sh
index 0396ada100e..ff53db891a0 100755
--- a/hack/build-integration-canary.sh
+++ b/hack/build-integration-canary.sh
@@ -276,9 +276,10 @@ canary::build::integration(){
     fi
 
     while read -r line; do
-      # Extract value after "=" from a possible dockerfile `ARG XXX_VERSION`
+      # Extract value after "=" from a possible dockerfile `ARG XXX_VERSION`, stripping out @ suffixes
       old_version=$(echo "$line" | grep "ARG ${shortsafename}_VERSION=") || true
       old_version="${old_version##*=}"
+      old_version="${old_version%%@*}"
       [ "$old_version" != "" ] || continue
       # If the Dockerfile version does NOT start with a v, adapt to that
       [ "${old_version:0:1}" == "v" ] || higher_readable="${higher_readable:1}"

From b5e5dabab69076fe0e1f6d57949d2263282feaa1 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 3 Apr 2025 13:54:13 -0700
Subject: [PATCH 076/225] Add expect.JSON comparator

This changeset adds expect.JSON[T any], which will allow easier testing of json output and hopefully
remove a lot of boilerplate unmarshalling / assert in tests.

It also adds an extensive doc.md document about comparators (plan is trim down the main documentation
to a small set of simple examples, then link to these "advanced" docs for further reading), which
will allow for easier documentation maintenance and more approachable reading.

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/expect/comparators.go      |  17 ++
 mod/tigron/expect/comparators_test.go |  31 +++-
 mod/tigron/expect/doc.md              | 221 ++++++++++++++++++++++++++
 3 files changed, 264 insertions(+), 5 deletions(-)
 create mode 100644 mod/tigron/expect/doc.md

diff --git a/mod/tigron/expect/comparators.go b/mod/tigron/expect/comparators.go
index 36b09de5e45..d7f944f32a8 100644
--- a/mod/tigron/expect/comparators.go
+++ b/mod/tigron/expect/comparators.go
@@ -19,11 +19,13 @@
 package expect
 
 import (
+	"encoding/json"
 	"regexp"
 	"testing"
 
 	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
 	"github.com/containerd/nerdctl/mod/tigron/test"
+	"github.com/containerd/nerdctl/mod/tigron/tig"
 )
 
 // All can be used as a parameter for expected.Output to group a set of comparators.
@@ -69,3 +71,18 @@ func Match(reg *regexp.Regexp) test.Comparator {
 		assertive.Match(assertive.WithFailLater(t), stdout, reg, info)
 	}
 }
+
+// JSON allows to verify that the output can be marshalled into T, and optionally can be further verified by a provided
+// method.
+func JSON[T any](obj T, verifier func(T, string, tig.T)) test.Comparator {
+	return func(stdout, info string, t *testing.T) {
+		t.Helper()
+
+		err := json.Unmarshal([]byte(stdout), &obj)
+		assertive.ErrorIsNil(assertive.WithFailLater(t), err, "failed to unmarshal JSON from stdout")
+
+		if verifier != nil && err == nil {
+			verifier(obj, info, t)
+		}
+	}
+}
diff --git a/mod/tigron/expect/comparators_test.go b/mod/tigron/expect/comparators_test.go
index c6710f6073b..f216d3ecb51 100644
--- a/mod/tigron/expect/comparators_test.go
+++ b/mod/tigron/expect/comparators_test.go
@@ -20,24 +20,45 @@ package expect_test
 // TODO: add a lot more tests including failure conditions with mimicry
 
 import (
+	"encoding/json"
 	"regexp"
 	"testing"
 
 	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
+	"github.com/containerd/nerdctl/mod/tigron/tig"
 )
 
 func TestExpect(t *testing.T) {
 	t.Parallel()
 
-	expect.Contains("b")("a b c", "info", t)
-	expect.DoesNotContain("d")("a b c", "info", t)
-	expect.Equals("a b c")("a b c", "info", t)
-	expect.Match(regexp.MustCompile("[a-z ]+"))("a b c", "info", t)
+	expect.Contains("b")("a b c", "contains works", t)
+	expect.DoesNotContain("d")("a b c", "does not contain works", t)
+	expect.Equals("a b c")("a b c", "equals work", t)
+	expect.Match(regexp.MustCompile("[a-z ]+"))("a b c", "match works", t)
 
 	expect.All(
 		expect.Contains("b"),
 		expect.DoesNotContain("d"),
 		expect.Equals("a b c"),
 		expect.Match(regexp.MustCompile("[a-z ]+")),
-	)("a b c", "info", t)
+	)("a b c", "all", t)
+
+	type foo struct {
+		Foo map[string]string `json:"foo"`
+	}
+
+	data, err := json.Marshal(&foo{
+		Foo: map[string]string{
+			"foo": "bar",
+		},
+	})
+
+	assertive.ErrorIsNil(t, err)
+
+	expect.JSON(&foo{}, nil)(string(data), "json, no verifier", t)
+
+	expect.JSON(&foo{}, func(obj *foo, info string, t tig.T) {
+		assertive.IsEqual(t, obj.Foo["foo"], "bar", info)
+	})(string(data), "json, with verifier", t)
 }
diff --git a/mod/tigron/expect/doc.md b/mod/tigron/expect/doc.md
new file mode 100644
index 00000000000..48b8d4be6e9
--- /dev/null
+++ b/mod/tigron/expect/doc.md
@@ -0,0 +1,221 @@
+# Expectations
+
+Attaching expectations to a test case is how the developer can express conditions on exit code, stdout, or stderr,
+to be verified for the test to pass.
+
+The simplest way to do that is to use the helper `test.Expects(exitCode int, errors []error, outputCompare test.Comparator)`.
+
+```go
+package main
+
+import (
+    "testing"
+
+    "github.com/containerd/nerdctl/mod/tigron/test"
+)
+
+func TestMyThing(t *testing.T) {
+    // Declare your test
+    myTest := &test.Case{}
+
+    // Attach a command to run
+    myTest.Command = test.Custom("ls")
+
+    // Set your expectations
+    myTest.Expected = test.Expects(expect.ExitCodeSuccess, nil, nil)
+
+    // Run it
+    myTest.Run(t)
+}
+```
+
+### Exit status expectations
+
+The first parameter, `exitCode` should be set to one of the provided `expect.ExitCodeXXX` constants:
+- `expect.ExitCodeSuccess`: validates that the command ran and exited successfully
+- `expect.ExitCodeTimeout`: validates that the command did time out
+- `expect.ExitCodeSignaled`: validates that the command received a signal
+- `expect.ExitCodeGenericFail`: validates that the command failed (failed to start, or returned a non-zero exit code)
+- `expect.ExitCodeNoCheck`: does not enforce any verification at all on the command
+
+... you may also pass explicit exit codes directly (> 0) if you want to precisely match them.
+
+### Stderr expectations with []error
+
+To validate that stderr contain specific information, you can pass a slice of `error` as `test.Expects`
+second parameter.
+
+The command output on stderr is then verified to contain all stringified errors.
+
+### Stdout expectations with Comparators
+
+The last parameter of `test.Expects` accepts a `test.Comparator`, which allows testing the content of the command
+output on `stdout`.
+
+The following ready-made `test.Comparator` generators are provided:
+- `expect.Contains(string)`: verifies that stdout contains the string parameter
+- `expect.DoesNotContain(string)`: negation of above
+- `expect.Equals(string)`: strict equality
+- `expect.Match(*regexp.Regexp)`: regexp matching
+- `expect.All(comparators ...Comparator)`: allows to bundle together a bunch of other comparators
+- `expect.JSON[T any](obj T, verifier func(T, string, tig.T))`: allows to verify the output is valid JSON and optionally
+pass `verifier(T, string, tig.T)` extra validation
+
+### A complete example
+
+```go
+package main
+
+import (
+    "testing"
+    "errors"
+
+    "github.com/containerd/nerdctl/mod/tigron/tig"
+    "github.com/containerd/nerdctl/mod/tigron/test"
+    "github.com/containerd/nerdctl/mod/tigron/expect"
+)
+
+type Thing struct {
+    Name string
+}
+
+func TestMyThing(t *testing.T) {
+    // Declare your test
+    myTest := &test.Case{}
+
+    // Attach a command to run
+    myTest.Command = test.Custom("bash", "-c", "--", ">&2 echo thing; echo '{\"Name\": \"out\"}'; exit 42;")
+
+    // Set your expectations
+    myTest.Expected = test.Expects(
+        expect.ExitCodeGenericFail,
+        []error{errors.New("thing")},
+        expect.All(
+            expect.Contains("out"),
+            expect.DoesNotContain("something"),
+            expect.JSON(&Thing{}, func(obj *Thing, info string, t tig.T) {
+                assert.Equal(t, obj.Name, "something", info)
+            }),
+        ),
+    )
+
+    // Run it
+    myTest.Run(t)
+}
+```
+
+### Custom stdout comparators
+
+If you need to implement more advanced verifications on stdout that the ready-made comparators can't do,
+you can implement your own custom `test.Comparator`.
+
+For example:
+
+```go
+package whatever
+
+import (
+    "testing"
+
+    "gotest.tools/v3/assert"
+
+    "github.com/containerd/nerdctl/mod/tigron/tig"
+    "github.com/containerd/nerdctl/mod/tigron/test"
+)
+
+func TestMyThing(t *testing.T) {
+    // Declare your test
+    myTest := &test.Case{}
+
+    // Attach a command to run
+    myTest.Command = test.Custom("ls")
+
+    // Set your expectations
+    myTest.Expected = test.Expects(0, nil, func(stdout, info string, t tig.T){
+        t.Helper()
+        // Bla bla, do whatever advanced stuff and some asserts
+    })
+
+    // Run it
+    myTest.Run(t)
+}
+
+// You can of course generalize your comparator into a generator if it is going to be useful repeatedly
+
+func MyComparatorGenerator(param1, param2 any) test.Comparator {
+    return func(stdout, info string, t tig.T) {
+        t.Helper()
+        // Do your thing...
+        // ...
+    }
+}
+
+```
+
+You can now pass along `MyComparator(comparisonString)` as the third parameter of `test.Expects`, or compose it with
+other comparators using `expect.All(MyComparator(comparisonString), OtherComparator(somethingElse))`
+
+Note that you have access to an opaque `info` string, that provides a brief formatted header message that assert
+will use in case of failure to provide context on the error.
+You may of course ignore it and write your own message.
+
+### Advanced expectations
+
+You may want to have expectations that contain a certain piece of data that is being used in the command or at
+other stages of your test (like `Setup` for example).
+
+To achieve that, you should write your own `test.Manager` instead of using the helper `test.Expects`.
+
+A manager is a simple function which only role is to return a `test.Expected` struct.
+The `test.Manager` signature makes available `test.Data` and `test.Helpers` to you.
+
+Here is an example, where we are using `data.Get("sometestdata")`.
+
+```go
+package main
+
+import (
+    "errors"
+    "testing"
+
+    "gotest.tools/v3/assert"
+
+    "github.com/containerd/nerdctl/mod/tigron/test"
+)
+
+func TestMyThing(t *testing.T) {
+    // Declare your test
+    myTest := &test.Case{}
+
+    myTest.Setup = func(data test.Data, helpers test.Helpers){
+        // Do things...
+        // ...
+        // Save this for later
+        data.Set("something", "lalala")
+    }
+
+    // Attach a command to run
+    myTest.Command = test.Custom("somecommand")
+
+    // Set your fully custom expectations
+    myTest.Expected = func(data test.Data, helpers test.Helpers) *test.Expected {
+        // With a custom Manager you have access to both the test.Data and test.Helpers to perform more
+        // refined verifications.
+        return &test.Expected{
+            ExitCode: 1,
+            Errors: []error{
+                errors.New("foobla"),
+            },
+            Output: func(stdout, info string, t tig.T) {
+                t.Helper()
+
+                // Retrieve the data that was set during the Setup phase.
+                assert.Assert(t, stdout == data.Get("sometestdata"), info)
+            },
+        }
+    }
+
+    // Run it
+    myTest.Run(t)
+}
+```

From 36c304f2b7fe905c3d9a0caa9ce9d2a002941bf9 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 3 Apr 2025 14:05:16 -0700
Subject: [PATCH 077/225] Migrate Volume test to use expect.JSON

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/volume/volume_inspect_test.go | 42 ++++++-----------------
 1 file changed, 11 insertions(+), 31 deletions(-)

diff --git a/cmd/nerdctl/volume/volume_inspect_test.go b/cmd/nerdctl/volume/volume_inspect_test.go
index 7e627a119b5..86d070065e4 100644
--- a/cmd/nerdctl/volume/volume_inspect_test.go
+++ b/cmd/nerdctl/volume/volume_inspect_test.go
@@ -18,7 +18,6 @@ package volume
 
 import (
 	"crypto/rand"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
@@ -31,6 +30,7 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/expect"
 	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
+	"github.com/containerd/nerdctl/mod/tigron/tig"
 
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/native"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
@@ -99,15 +99,11 @@ func TestVolumeInspect(t *testing.T) {
 				return &test.Expected{
 					Output: expect.All(
 						expect.Contains(data.Get("vol1")),
-						func(stdout string, info string, t *testing.T) {
-							var dc []native.Volume
-							if err := json.Unmarshal([]byte(stdout), &dc); err != nil {
-								t.Fatal(err)
-							}
+						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							assert.Assert(t, len(dc) == 1, fmt.Sprintf("one result, not %d", len(dc))+info)
 							assert.Assert(t, dc[0].Name == data.Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Get("vol1"), dc[0].Name)+info)
 							assert.Assert(t, dc[0].Labels == nil, fmt.Sprintf("expected labels to be nil and were %v", dc[0].Labels)+info)
-						},
+						}),
 					),
 				}
 			},
@@ -121,16 +117,12 @@ func TestVolumeInspect(t *testing.T) {
 				return &test.Expected{
 					Output: expect.All(
 						expect.Contains(data.Get("vol2")),
-						func(stdout string, info string, t *testing.T) {
-							var dc []native.Volume
-							if err := json.Unmarshal([]byte(stdout), &dc); err != nil {
-								t.Fatal(err)
-							}
+						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							labels := *dc[0].Labels
 							assert.Assert(t, len(labels) == 2, fmt.Sprintf("two results, not %d", len(labels)))
 							assert.Assert(t, labels["foo"] == "fooval", fmt.Sprintf("label foo should be fooval, not %s", labels["foo"]))
 							assert.Assert(t, labels["bar"] == "barval", fmt.Sprintf("label bar should be barval, not %s", labels["bar"]))
-						},
+						}),
 					),
 				}
 			},
@@ -145,13 +137,9 @@ func TestVolumeInspect(t *testing.T) {
 				return &test.Expected{
 					Output: expect.All(
 						expect.Contains(data.Get("vol1")),
-						func(stdout string, info string, t *testing.T) {
-							var dc []native.Volume
-							if err := json.Unmarshal([]byte(stdout), &dc); err != nil {
-								t.Fatal(err)
-							}
+						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							assert.Assert(t, dc[0].Size == size, fmt.Sprintf("expected size to be %d (was %d)", size, dc[0].Size))
-						},
+						}),
 					),
 				}
 			},
@@ -166,15 +154,11 @@ func TestVolumeInspect(t *testing.T) {
 					Output: expect.All(
 						expect.Contains(data.Get("vol1")),
 						expect.Contains(data.Get("vol2")),
-						func(stdout string, info string, t *testing.T) {
-							var dc []native.Volume
-							if err := json.Unmarshal([]byte(stdout), &dc); err != nil {
-								t.Fatal(err)
-							}
+						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							assert.Assert(t, len(dc) == 2, fmt.Sprintf("two results, not %d", len(dc)))
 							assert.Assert(t, dc[0].Name == data.Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Get("vol1"), dc[0].Name))
 							assert.Assert(t, dc[1].Name == data.Get("vol2"), fmt.Sprintf("expected name to be %q (was %q)", data.Get("vol2"), dc[1].Name))
-						},
+						}),
 					),
 				}
 			},
@@ -190,14 +174,10 @@ func TestVolumeInspect(t *testing.T) {
 					Errors:   []error{errdefs.ErrNotFound, errdefs.ErrInvalidArgument},
 					Output: expect.All(
 						expect.Contains(data.Get("vol1")),
-						func(stdout string, info string, t *testing.T) {
-							var dc []native.Volume
-							if err := json.Unmarshal([]byte(stdout), &dc); err != nil {
-								t.Fatal(err)
-							}
+						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							assert.Assert(t, len(dc) == 1, fmt.Sprintf("one result, not %d", len(dc)))
 							assert.Assert(t, dc[0].Name == data.Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Get("vol1"), dc[0].Name))
-						},
+						}),
 					),
 				}
 			},

From 9255358df8977836469819cdb227739c6fb96a52 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 3 Apr 2025 15:58:15 -0700
Subject: [PATCH 078/225] Adjust command test

In some cases, exec is just really slow.
Adjusting tests so that we start counting after the command actually started.

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/internal/com/command_test.go | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/mod/tigron/internal/com/command_test.go b/mod/tigron/internal/com/command_test.go
index 7652a772675..9c5d0b7e8a0 100644
--- a/mod/tigron/internal/com/command_test.go
+++ b/mod/tigron/internal/com/command_test.go
@@ -411,7 +411,6 @@ func TestStdoutStderr(t *testing.T) {
 func TestTimeoutPlain(t *testing.T) {
 	t.Parallel()
 
-	start := time.Now()
 	command := &com.Command{
 		Binary: "bash",
 		// XXX unclear if windows is really able to terminate sleep 5, so, split it up to give it a
@@ -421,11 +420,10 @@ func TestTimeoutPlain(t *testing.T) {
 	}
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
-
 	assertive.ErrorIsNil(t, err, "Err")
 
+	start := time.Now()
 	res, err := command.Wait()
-
 	end := time.Now()
 
 	assertive.ErrorIs(t, err, com.ErrTimeout, "Err")
@@ -438,7 +436,6 @@ func TestTimeoutPlain(t *testing.T) {
 func TestTimeoutDelayed(t *testing.T) {
 	t.Parallel()
 
-	start := time.Now()
 	command := &com.Command{
 		Binary: "bash",
 		// XXX unclear if windows is really able to terminate sleep 5, so, split it up to give it a
@@ -448,20 +445,20 @@ func TestTimeoutDelayed(t *testing.T) {
 	}
 
 	err := command.Run(context.WithValue(context.Background(), com.LoggerKey, t))
-
 	assertive.ErrorIsNil(t, err, "Err")
 
-	time.Sleep(1 * time.Second)
+	start := time.Now()
 
-	res, err := command.Wait()
+	time.Sleep(2 * time.Second)
 
+	res, err := command.Wait()
 	end := time.Now()
 
 	assertive.ErrorIs(t, err, com.ErrTimeout, "Err")
 	assertive.IsEqual(t, res.ExitCode, -1, "ExitCode")
 	assertive.IsEqual(t, res.Stdout, "one", "Stdout")
 	assertive.IsEqual(t, res.Stderr, "", "Stderr")
-	assertive.IsLessThan(t, end.Sub(start), 2*time.Second, "Total execution time")
+	assertive.IsLessThan(t, end.Sub(start), 3*time.Second, "Total execution time")
 }
 
 func TestPTYStdout(t *testing.T) {

From 23b84209380fdc9de2c7b9bfd0691f4b0fcf9003 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sun, 13 Apr 2025 11:39:10 -0700
Subject: [PATCH 079/225] Mark t.Helper() to avoid reporting wrong source info
 on failure

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/test/helpers.go         | 5 +++++
 pkg/testutil/nerdtest/command.go   | 1 +
 pkg/testutil/nerdtest/utilities.go | 5 +++++
 3 files changed, 11 insertions(+)

diff --git a/mod/tigron/test/helpers.go b/mod/tigron/test/helpers.go
index 681226047fa..c148be6e5ac 100644
--- a/mod/tigron/test/helpers.go
+++ b/mod/tigron/test/helpers.go
@@ -32,6 +32,7 @@ type helpersInternal struct {
 
 // Ensure will run a command and make sure it is successful.
 func (help *helpersInternal) Ensure(args ...string) {
+	help.t.Helper()
 	help.Command(args...).Run(&Expected{
 		ExitCode: internal.ExitCodeSuccess,
 	})
@@ -39,6 +40,7 @@ func (help *helpersInternal) Ensure(args ...string) {
 
 // Anyhow will run a command regardless of outcome (may or may not fail).
 func (help *helpersInternal) Anyhow(args ...string) {
+	help.t.Helper()
 	help.Command(args...).Run(&Expected{
 		ExitCode: internal.ExitCodeNoCheck,
 	})
@@ -46,6 +48,7 @@ func (help *helpersInternal) Anyhow(args ...string) {
 
 // Fail will run a command and make sure it does fail.
 func (help *helpersInternal) Fail(args ...string) {
+	help.t.Helper()
 	help.Command(args...).Run(&Expected{
 		ExitCode: internal.ExitCodeGenericFail,
 	})
@@ -55,6 +58,7 @@ func (help *helpersInternal) Fail(args ...string) {
 func (help *helpersInternal) Capture(args ...string) string {
 	var ret string
 
+	help.t.Helper()
 	help.Command(args...).Run(&Expected{
 		//nolint:thelper
 		Output: func(stdout, _ string, _ *testing.T) {
@@ -67,6 +71,7 @@ func (help *helpersInternal) Capture(args ...string) string {
 
 // Err will run a command with no expectation and return Stderr.
 func (help *helpersInternal) Err(args ...string) string {
+	help.t.Helper()
 	cmd := help.Command(args...)
 	cmd.Run(nil)
 
diff --git a/pkg/testutil/nerdtest/command.go b/pkg/testutil/nerdtest/command.go
index b979963d662..dbeed949e7c 100644
--- a/pkg/testutil/nerdtest/command.go
+++ b/pkg/testutil/nerdtest/command.go
@@ -105,6 +105,7 @@ type nerdCommand struct {
 }
 
 func (nc *nerdCommand) Run(expect *test.Expected) {
+	nc.T().Helper()
 	nc.prep()
 	if getTarget() == targetDocker {
 		// We are not in the business of testing docker *error* output, so, spay expectation here
diff --git a/pkg/testutil/nerdtest/utilities.go b/pkg/testutil/nerdtest/utilities.go
index 59311e5fe19..56cae946170 100644
--- a/pkg/testutil/nerdtest/utilities.go
+++ b/pkg/testutil/nerdtest/utilities.go
@@ -45,6 +45,7 @@ func IsDocker() bool {
 
 // InspectContainer is a helper that can be used inside custom commands or Setup
 func InspectContainer(helpers test.Helpers, name string) dockercompat.Container {
+	helpers.T().Helper()
 	var dc []dockercompat.Container
 	cmd := helpers.Command("container", "inspect", name)
 	cmd.Run(&test.Expected{
@@ -58,6 +59,7 @@ func InspectContainer(helpers test.Helpers, name string) dockercompat.Container
 }
 
 func InspectVolume(helpers test.Helpers, name string) native.Volume {
+	helpers.T().Helper()
 	var dc []native.Volume
 	cmd := helpers.Command("volume", "inspect", name)
 	cmd.Run(&test.Expected{
@@ -71,6 +73,7 @@ func InspectVolume(helpers test.Helpers, name string) native.Volume {
 }
 
 func InspectNetwork(helpers test.Helpers, name string) dockercompat.Network {
+	helpers.T().Helper()
 	var dc []dockercompat.Network
 	cmd := helpers.Command("network", "inspect", name)
 	cmd.Run(&test.Expected{
@@ -84,6 +87,7 @@ func InspectNetwork(helpers test.Helpers, name string) dockercompat.Network {
 }
 
 func InspectImage(helpers test.Helpers, name string) dockercompat.Image {
+	helpers.T().Helper()
 	var dc []dockercompat.Image
 	cmd := helpers.Command("image", "inspect", name)
 	cmd.Run(&test.Expected{
@@ -102,6 +106,7 @@ const (
 )
 
 func EnsureContainerStarted(helpers test.Helpers, con string) {
+	helpers.T().Helper()
 	started := false
 	for i := 0; i < maxRetry && !started; i++ {
 		helpers.Command("container", "inspect", con).

From 384bf14a52f55aa208faa19bb091f0d98a2bcf2c Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sun, 13 Apr 2025 11:49:58 -0700
Subject: [PATCH 080/225] Deprecate info in comparators

The extra info parameter makes it so that all command debugging information is printed-out for every assert.
Since command debugging information will now be logged separately, this is now un-necessary.
A later PR will change the API and remove the parameter entirely from test.Comparator.

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/expect/comparators.go | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/mod/tigron/expect/comparators.go b/mod/tigron/expect/comparators.go
index d7f944f32a8..7bf87803f41 100644
--- a/mod/tigron/expect/comparators.go
+++ b/mod/tigron/expect/comparators.go
@@ -30,11 +30,11 @@ import (
 
 // All can be used as a parameter for expected.Output to group a set of comparators.
 func All(comparators ...test.Comparator) test.Comparator {
-	return func(stdout, info string, t *testing.T) {
+	return func(stdout, _ string, t *testing.T) {
 		t.Helper()
 
 		for _, comparator := range comparators {
-			comparator(stdout, info, t)
+			comparator(stdout, "", t)
 		}
 	}
 }
@@ -42,47 +42,47 @@ func All(comparators ...test.Comparator) test.Comparator {
 // Contains can be used as a parameter for expected.Output and ensures a comparison string is found contained in the
 // output.
 func Contains(compare string) test.Comparator {
-	return func(stdout, info string, t *testing.T) {
+	return func(stdout, _ string, t *testing.T) {
 		t.Helper()
-		assertive.Contains(assertive.WithFailLater(t), stdout, compare, info)
+		assertive.Contains(assertive.WithFailLater(t), stdout, compare, "Inspecting output (contains)")
 	}
 }
 
 // DoesNotContain is to be used for expected.Output to ensure a comparison string is NOT found in the output.
 func DoesNotContain(compare string) test.Comparator {
-	return func(stdout, info string, t *testing.T) {
+	return func(stdout, _ string, t *testing.T) {
 		t.Helper()
-		assertive.DoesNotContain(assertive.WithFailLater(t), stdout, compare, info)
+		assertive.DoesNotContain(assertive.WithFailLater(t), stdout, compare, "Inspecting output (does not contain)")
 	}
 }
 
 // Equals is to be used for expected.Output to ensure it is exactly the output.
 func Equals(compare string) test.Comparator {
-	return func(stdout, info string, t *testing.T) {
+	return func(stdout, _ string, t *testing.T) {
 		t.Helper()
-		assertive.IsEqual(assertive.WithFailLater(t), stdout, compare, info)
+		assertive.IsEqual(assertive.WithFailLater(t), stdout, compare, "Inspecting output (equals)")
 	}
 }
 
 // Match is to be used for expected.Output to ensure we match a regexp.
 func Match(reg *regexp.Regexp) test.Comparator {
-	return func(stdout, info string, t *testing.T) {
+	return func(stdout, _ string, t *testing.T) {
 		t.Helper()
-		assertive.Match(assertive.WithFailLater(t), stdout, reg, info)
+		assertive.Match(assertive.WithFailLater(t), stdout, reg, "Inspecting output (match)")
 	}
 }
 
 // JSON allows to verify that the output can be marshalled into T, and optionally can be further verified by a provided
 // method.
 func JSON[T any](obj T, verifier func(T, string, tig.T)) test.Comparator {
-	return func(stdout, info string, t *testing.T) {
+	return func(stdout, _ string, t *testing.T) {
 		t.Helper()
 
 		err := json.Unmarshal([]byte(stdout), &obj)
-		assertive.ErrorIsNil(assertive.WithFailLater(t), err, "failed to unmarshal JSON from stdout")
+		assertive.ErrorIsNil(assertive.WithSilentSuccess(t), err, "Unmarshalling JSON from stdout must succeed")
 
 		if verifier != nil && err == nil {
-			verifier(obj, info, t)
+			verifier(obj, "Inspecting output (JSON)", t)
 		}
 	}
 }

From e2a004858afdc1278a50ea360ff04cc0b82d7dfe Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sun, 13 Apr 2025 12:14:03 -0700
Subject: [PATCH 081/225] Cleaner debug information for assertive

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/internal/assertive/assertive.go | 87 ++++++++++++++--------
 1 file changed, 57 insertions(+), 30 deletions(-)

diff --git a/mod/tigron/internal/assertive/assertive.go b/mod/tigron/internal/assertive/assertive.go
index 735c58c52f9..bc9b2df4563 100644
--- a/mod/tigron/internal/assertive/assertive.go
+++ b/mod/tigron/internal/assertive/assertive.go
@@ -31,12 +31,12 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/tig"
 )
 
-// TODO: once debugging output will be cleaned-up, reintroduce hexdump.
-
 const (
+	markLineLength           = 20
 	expectedSuccessDecorator = "✅️ does verify:\t\t"
-	expectedFailDecorator    = "❌ does not verify:\t"
+	expectedFailDecorator    = "❌ FAILED!\t\t"
 	receivedDecorator        = "👀 testing:\t\t"
+	annotationDecorator      = "🖊️"
 	hyperlinkDecorator       = "🔗"
 )
 
@@ -163,8 +163,8 @@ func True(testing tig.T, comp bool, msg ...string) bool {
 
 // WithFailLater will allow an assertion to not fail the test immediately.
 // Failing later is necessary when asserting inside go routines, and also if you want many
-// successive asserts to all
-// evaluate instead of stopping at the first failing one.
+// successive asserts to all evaluate instead of stopping at the first failing one.
+// FIXME: it should be possible to have both WithFailLater and WithSilentSuccess at the same time.
 func WithFailLater(t tig.T) tig.T {
 	return &failLater{
 		t,
@@ -205,49 +205,76 @@ func evaluate(testing tig.T, isSuccess bool, actual, expected any, msg ...string
 func decorate(testing tig.T, isSuccess bool, actual, expected any, msg ...string) {
 	testing.Helper()
 
-	header := "\t"
+	if _, ok := testing.(*silentSuccess); !isSuccess || !ok {
+		head := strings.Repeat("<", markLineLength)
+		footer := strings.Repeat(">", markLineLength)
+		header := "\t"
 
-	hyperlink := getTopFrameFile()
-	if hyperlink != "" {
-		msg = append([]string{hyperlink + "\n"}, msg...)
-	}
+		custom := fmt.Sprintf("\t%s %s", annotationDecorator, strings.Join(msg, "\n"))
 
-	msg = append(msg, fmt.Sprintf("\t%s`%v`", receivedDecorator, actual))
+		msg = append([]string{"", head}, custom)
 
-	if isSuccess {
-		msg = append(msg,
-			fmt.Sprintf("\t%s%v", expectedSuccessDecorator, expected),
-		)
-	} else {
-		msg = append(msg,
-			fmt.Sprintf("\t%s%v", expectedFailDecorator, expected),
-		)
-	}
+		msg = append([]string{getTopFrameFile()}, msg...)
 
-	if _, ok := testing.(*silentSuccess); !isSuccess || !ok {
-		testing.Log(header + strings.Join(msg, "\n") + "\n")
+		msg = append(msg, fmt.Sprintf("\t%s`%v`", receivedDecorator, actual))
+
+		if isSuccess {
+			msg = append(msg,
+				fmt.Sprintf("\t%s%v", expectedSuccessDecorator, expected),
+			)
+		} else {
+			msg = append(msg,
+				fmt.Sprintf("\t%s%v", expectedFailDecorator, expected),
+			)
+		}
+
+		testing.Log(header + strings.Join(msg, "\n") + "\n" + footer + "\n")
 	}
 }
 
+// XXX FIXME #expert
+// Because of how golang testing works, the upper frame is the one from where t.Run is being called,
+// as (presumably) the passed function is starting with its own stack in a go routine.
+// In the case of subtests, t.Run being called from inside Tigron will make it so that the top frame
+// is case.go around line 233 (where we call Command.Run(), which is the one calling assertive).
+// To possibly address this:
+// plan a. just drop entirely OSC8 links and source extracts and trash all of this
+// plan b. get the top frame from the root test, and pass it to subtests on a custom property, the somehow into here
+// plan c. figure out a hack to call t.Run from the test file without ruining the Tigron UX
+// Dereference t.Run? Return a closure to be called from the top? w/o disabling inlining in the right place?
+// Short term, blacklisting /tigron (and /nerdtest) will at least prevent the wrong links from appearing in the output.
 func getTopFrameFile() string {
-	// Get the frames.
+	// Get the frames. Skip the first two frames - current one and caller.
 	//nolint:mnd // Whatever mnd...
-	pc := make([]uintptr, 20)
+	pc := make([]uintptr, 40)
 	//nolint:mnd // Whatever mnd...
 	n := runtime.Callers(2, pc)
 	callersFrames := runtime.CallersFrames(pc[:n])
 
-	var file string
+	var (
+		file       string
+		lineNumber int
+		frame      runtime.Frame
+	)
 
-	var lineNumber int
+	more := true
+	for more {
+		frame, more = callersFrames.Next()
 
-	var frame runtime.Frame
-	for range 20 {
-		frame, _ = callersFrames.Next()
+		// Once we are in the go main stack, bail out
 		if !strings.Contains(frame.Function, "/") {
 			break
 		}
 
+		// XXX see note above
+		if strings.Contains(frame.File, "/tigron") {
+			continue
+		}
+
+		if strings.Contains(frame.File, "/nerdtest") {
+			continue
+		}
+
 		file = frame.File
 		lineNumber = frame.Line
 	}
@@ -282,6 +309,6 @@ func getTopFrameFile() string {
 	return hyperlinkDecorator + " " + (&formatter.OSC8{
 		Text:     line,
 		Location: "file://" + file,
-		Line:     frame.Line,
+		Line:     lineNumber,
 	}).String()
 }

From 488e1e78243a289ad346cc6f52da4bc82db00484 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Mon, 14 Apr 2025 10:33:08 -0700
Subject: [PATCH 082/225] Enhanced test debug information

Finishing prior effort to make test run easier to debug, this introduces a number of changes to the output:
- high-contrast emojis to make it easier to spot relevant sections
- 2 columns table formatting for commands informations
- better spacing
- lifecycle sections (cleanup, setup, run)
- clearly called out assertive output

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/.golangci.yml                   |   9 +-
 mod/tigron/go.mod                          |   3 +-
 mod/tigron/go.sum                          |   6 +-
 mod/tigron/internal/formatter/formatter.go | 116 ++++++++++-------
 mod/tigron/internal/mimicry/print.go       |   2 +-
 mod/tigron/test/case.go                    | 121 ++++++++++++------
 mod/tigron/test/command.go                 | 137 +++++++++++++--------
 7 files changed, 252 insertions(+), 142 deletions(-)

diff --git a/mod/tigron/.golangci.yml b/mod/tigron/.golangci.yml
index 22d2a86dd71..ab1817e4d1a 100644
--- a/mod/tigron/.golangci.yml
+++ b/mod/tigron/.golangci.yml
@@ -37,6 +37,7 @@ linters:
     - cyclop            # provided by revive
     - exhaustruct       # does not serve much of a purpose
     - errcheck          # provided by revive
+    - errchkjson        # forces handling of json err (eg: prevents _), which is too much
     - forcetypeassert   # provided by revive
     - funlen            # provided by revive
     - gocognit          # provided by revive
@@ -65,7 +66,7 @@ linters:
           arguments: [60]
         - name: function-length
           # Default is 50, 75
-          arguments: [80, 180]
+          arguments: [80, 200]
         - name: cyclomatic
           # Default is 10
           arguments: [30]
@@ -93,11 +94,17 @@ linters:
           files:
             - $all
           allow:
+            # Allowing go standard library and tigron itself
             - $gostd
             - github.com/containerd/nerdctl/mod/tigron
+            # We use creack as our base for pty
             - github.com/creack/pty
+            # Used for display width computation in internal/formatter
+            - golang.org/x/text/width
+            # errgroups and term (make raw) are used by internal/pipes
             - golang.org/x/sync
             - golang.org/x/term
+            # EXPERIMENTAL: for go routines leakage detection
             - go.uber.org/goleak
     staticcheck:
       checks:
diff --git a/mod/tigron/go.mod b/mod/tigron/go.mod
index 6979d174148..7d355696bef 100644
--- a/mod/tigron/go.mod
+++ b/mod/tigron/go.mod
@@ -5,8 +5,9 @@ go 1.23.0
 require (
 	github.com/creack/pty v1.1.24
 	go.uber.org/goleak v1.3.0
-	golang.org/x/sync v0.12.0
+	golang.org/x/sync v0.13.0
 	golang.org/x/term v0.30.0
+	golang.org/x/text v0.24.0
 )
 
 require golang.org/x/sys v0.31.0 // indirect
diff --git a/mod/tigron/go.sum b/mod/tigron/go.sum
index b6ba6f6badb..fdf139e7e15 100644
--- a/mod/tigron/go.sum
+++ b/mod/tigron/go.sum
@@ -8,11 +8,13 @@ github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PK
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
-golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
+golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
 golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
 golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
+golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
+golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/mod/tigron/internal/formatter/formatter.go b/mod/tigron/internal/formatter/formatter.go
index 765a3be575f..43ce9fe56c4 100644
--- a/mod/tigron/internal/formatter/formatter.go
+++ b/mod/tigron/internal/formatter/formatter.go
@@ -19,77 +19,99 @@ package formatter
 import (
 	"fmt"
 	"strings"
-	"unicode/utf8"
+
+	"golang.org/x/text/width"
 )
 
 const (
 	maxLineLength = 110
 	maxLines      = 100
 	kMaxLength    = 7
+	spacer        = " "
 )
 
-func chunk(s string, length int) []string {
-	var chunks []string
-
-	lines := strings.Split(s, "\n")
-
-	for x := 0; x < maxLines && x < len(lines); x++ {
-		line := lines[x]
-		if utf8.RuneCountInString(line) < length {
-			chunks = append(chunks, line)
-
-			continue
-		}
-
-		for index := 0; index < utf8.RuneCountInString(line); index += length {
-			end := index + length
-			if end > utf8.RuneCountInString(line) {
-				end = utf8.RuneCountInString(line)
-			}
-
-			chunks = append(chunks, string([]rune(line)[index:end]))
-		}
-	}
-
-	if len(chunks) == maxLines {
-		chunks = append(chunks, "...")
-	}
-
-	return chunks
-}
-
-// Table formats a `n x 2` dataset into a series of rows.
-// FIXME: the problem with full-width emoji is that they are going to eff-up the maths and display
-// here...
-// Maybe the csv writer could be cheat-used to get the right widths.
+// Table formats a `n x 2` dataset into a series of n rows by 2 columns.
 //
 //nolint:mnd // Too annoying
-func Table(data [][]any) string {
+func Table(data [][]any, mark string) string {
 	var output string
 
 	for _, row := range data {
 		key := fmt.Sprintf("%v", row[0])
 		value := strings.ReplaceAll(fmt.Sprintf("%v", row[1]), "\t", "  ")
 
-		output += fmt.Sprintf("+%s+\n", strings.Repeat("-", maxLineLength-2))
-
-		if utf8.RuneCountInString(key) > kMaxLength {
-			key = string([]rune(key)[:kMaxLength-3]) + "..."
-		}
+		output += fmt.Sprintf("+%s+\n", strings.Repeat(mark, maxLineLength-2))
 
-		for _, line := range chunk(value, maxLineLength-kMaxLength-7) {
+		for _, line := range chunk(value, maxLineLength-kMaxLength-7, maxLines) {
 			output += fmt.Sprintf(
-				"| %-*s | %-*s |\n",
-				kMaxLength,
-				key,
-				maxLineLength-kMaxLength-7,
+				"| %s | %s |\n",
+				// Keys longer than one line of kMaxLength will be striped to one line
+				chunk(key, kMaxLength, 1)[0],
 				line,
 			)
 			key = ""
 		}
 	}
 
-	output += fmt.Sprintf("+%s+", strings.Repeat("-", maxLineLength-2))
+	output += fmt.Sprintf("+%s+", strings.Repeat(mark, maxLineLength-2))
 
 	return output
 }
+
+// chunk does take a string and split it in lines of maxLength size, accounting for characters display width.
+func chunk(s string, maxLength, maxLines int) []string {
+	chunks := []string{}
+
+	runes := []rune(s)
+
+	size := 0
+	start := 0
+
+	for index := range runes {
+		var segment string
+
+		switch width.LookupRune(runes[index]).Kind() {
+		case width.EastAsianWide, width.EastAsianFullwidth:
+			size += 2
+		case width.EastAsianAmbiguous, width.Neutral, width.EastAsianHalfwidth, width.EastAsianNarrow:
+			size++
+		default:
+			size++
+		}
+
+		switch {
+		case runes[index] == '\n':
+			// Met a line-break. Pad to size (removing the line break)
+			segment = string(runes[start:index])
+			segment += strings.Repeat(spacer, maxLength-size+1)
+			start = index + 1
+			size = 0
+		case size == maxLength:
+			// Line is full. Add the segment.
+			segment = string(runes[start : index+1])
+			start = index + 1
+			size = 0
+		case size > maxLength:
+			// Last char was double width. Push it back to next line, and pad with a single space.
+			segment = string(runes[start:index]) + spacer
+			start = index
+			size = 2
+		case index == len(runes)-1:
+			// End of string. Pad it to size.
+			segment = string(runes[start : index+1])
+			segment += strings.Repeat(spacer, maxLength-size)
+		default:
+			continue
+		}
+
+		chunks = append(chunks, segment)
+	}
+
+	if len(chunks) > maxLines {
+		chunks = append(chunks[0:maxLines], "...")
+	} else if len(chunks) == 0 {
+		chunks = []string{strings.Repeat(spacer, maxLength)}
+	}
+
+	return chunks
+}
diff --git a/mod/tigron/internal/mimicry/print.go b/mod/tigron/internal/mimicry/print.go
index 96c333c63da..2f1c357ca4e 100644
--- a/mod/tigron/internal/mimicry/print.go
+++ b/mod/tigron/internal/mimicry/print.go
@@ -40,7 +40,7 @@ func PrintCall(call *Call) string {
 	}
 
 	output := []string{
-		formatter.Table(debug),
+		formatter.Table(debug, "-"),
 		sectionSeparator,
 	}
 
diff --git a/mod/tigron/test/case.go b/mod/tigron/test/case.go
index 3ec3574a4d7..6a703e964a0 100644
--- a/mod/tigron/test/case.go
+++ b/mod/tigron/test/case.go
@@ -17,10 +17,13 @@
 package test
 
 import (
+	"encoding/json"
+	"fmt"
 	"slices"
 	"testing"
 
 	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
+	"github.com/containerd/nerdctl/mod/tigron/internal/formatter"
 )
 
 // Case describes an entire test-case, including data, setup and cleanup routines, command and
@@ -62,9 +65,15 @@ type Case struct {
 	parent  *Case
 }
 
+const (
+	startDecorator  = "🚀"
+	cleanDecorator  = "🧽"
+	setupDecorator  = "🏗"
+	subinDecorator  = "⤵️"
+	suboutDecorator = "↩️"
+)
+
 // Run prepares and executes the test, and any possible subtests.
-//
-//nolint:gocognit
 func (test *Case) Run(t *testing.T) {
 	t.Helper()
 	// Run the test
@@ -72,17 +81,17 @@ func (test *Case) Run(t *testing.T) {
 	testRun := func(subT *testing.T) {
 		subT.Helper()
 
-		assertive.True(subT, test.t == nil, "You cannot run a test multiple times")
+		silentT := assertive.WithSilentSuccess(subT)
+
+		assertive.True(silentT, test.t == nil, "You cannot run a test multiple times")
+		assertive.True(silentT, test.Description != "" || test.parent == nil,
+			"A subtest description cannot be empty")
+		assertive.True(silentT, test.Command == nil || test.Expected != nil,
+			"Expectations for a test command cannot be nil. You may want to use `Setup` instead"+
+				"of `Command`.")
 
 		// Attach testing.T
 		test.t = subT
-		assertive.True(
-			test.t,
-			test.Description != "" || test.parent == nil,
-			"A test description cannot be empty",
-		)
-		assertive.True(test.t, test.Command == nil || test.Expected != nil,
-			"Expectations for a test command cannot be nil. You may want to use Setup instead.")
 
 		// Ensure we have env
 		if test.Env == nil {
@@ -168,49 +177,83 @@ func (test *Case) Run(t *testing.T) {
 		}
 
 		// Execute cleanups now
-		test.t.Log("")
-		test.t.Log("======================== Pre-test cleanup ========================")
-
-		for _, cleanup := range cleanups {
-			cleanup(test.Data, test.helpers)
-		}
-
-		// Register the cleanups, in reverse
-		test.t.Cleanup(func() {
-			test.t.Log("")
-			test.t.Log("======================== Post-test cleanup ========================")
-
-			slices.Reverse(cleanups)
+		if len(cleanups) > 0 {
+			test.t.Log(
+				"\n\n" + formatter.Table(
+					[][]any{{cleanDecorator, fmt.Sprintf("%q: initial cleanup", test.t.Name())}},
+					"=",
+				) + "\n",
+			)
 
 			for _, cleanup := range cleanups {
 				cleanup(test.Data, test.helpers)
 			}
-		})
 
-		// Run the setups
-		test.t.Log("")
-		test.t.Log("======================== Test setup ========================")
+			// Register the cleanups, in reverse
+			test.t.Cleanup(func() {
+				test.t.Helper()
+				test.t.Log(
+					"\n\n" + formatter.Table(
+						[][]any{{cleanDecorator, fmt.Sprintf("%q: post-cleanup", test.t.Name())}},
+						"=",
+					) + "\n",
+				)
+
+				slices.Reverse(cleanups)
 
-		for _, setup := range setups {
-			setup(test.Data, test.helpers)
+				for _, cleanup := range cleanups {
+					cleanup(test.Data, test.helpers)
+				}
+			})
+		}
+
+		// Run the setups
+		if len(setups) > 0 {
+			test.t.Log(
+				"\n\n" + formatter.Table(
+					[][]any{{setupDecorator, fmt.Sprintf("%q: setup", test.t.Name())}},
+					"=",
+				) + "\n",
+			)
+
+			for _, setup := range setups {
+				setup(test.Data, test.helpers)
+			}
 		}
 
 		// Run the command if any, with expectations
 		// Note: if we have a command, we already know we DO have Expected
-		test.t.Log("")
-		test.t.Log("======================== Test Run ========================")
-
 		if test.Command != nil {
-			test.Command(test.Data, test.helpers).Run(test.Expected(test.Data, test.helpers))
+			cmd := test.Command(test.Data, test.helpers)
+
+			debugConfig, _ := json.MarshalIndent(test.Config.(*config).config, "", "  ")
+			debugData, _ := json.MarshalIndent(test.Data.(*data).labels, "", "  ")
+
+			test.t.Log(
+				"\n\n" + formatter.Table(
+					[][]any{
+						{startDecorator, fmt.Sprintf("%q: starting test!", test.t.Name())},
+						{"cwd", test.Data.TempDir()},
+						{"config", string(debugConfig)},
+						{"data", string(debugData)},
+					},
+					"=",
+				) + "\n",
+			)
+
+			cmd.Run(test.Expected(test.Data, test.helpers))
 		}
 
-		// Now go for the subtests
-		test.t.Log("")
-		test.t.Log("======================== Processing subtests ========================")
+		if len(test.SubTests) > 0 {
+			// Now go for the subtests
+			test.t.Logf("\n%s️ %q: into subtests prep", subinDecorator, test.t.Name())
+
+			for _, subTest := range test.SubTests {
+				subTest.parent = test
+				subTest.Run(test.t)
+			}
 
-		for _, subTest := range test.SubTests {
-			subTest.parent = test
-			subTest.Run(test.t)
+			test.t.Logf("\n%s️ %q: done with subtests prep", suboutDecorator, test.t.Name())
 		}
 	}
 
diff --git a/mod/tigron/test/command.go b/mod/tigron/test/command.go
index 67289079867..0c1970d8d81 100644
--- a/mod/tigron/test/command.go
+++ b/mod/tigron/test/command.go
@@ -14,14 +14,14 @@
    limitations under the License.
 */
 
-//nolint:revive
+//revive:disable:exported,package-comments,add-constant // TODO.
 package test
 
 import (
 	"context"
-	"fmt"
 	"io"
 	"os"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -29,9 +29,17 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/internal"
 	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
 	"github.com/containerd/nerdctl/mod/tigron/internal/com"
+	"github.com/containerd/nerdctl/mod/tigron/internal/formatter"
 )
 
-const defaultExecutionTimeout = 3 * time.Minute
+const (
+	defaultExecutionTimeout = 3 * time.Minute
+	commandDecorator        = "⚙️"
+	errorDecorator          = "🚫"
+	exitDecorator           = "⚠️"
+	stdoutDecorator         = "🟢"
+	stderrDecorator         = "🟠"
+)
 
 // CustomizableCommand is an interface meant for people who want to heavily customize the base
 // command of their test case.
@@ -71,7 +79,6 @@ type CustomizableCommand interface {
 	read(key ConfigKey) ConfigValue
 }
 
-//nolint:ireturn
 func NewGenericCommand() CustomizableCommand {
 	genericCom := &GenericCommand{
 		Env: map[string]string{},
@@ -151,49 +158,56 @@ func (gc *GenericCommand) Signal(sig os.Signal) error {
 }
 
 func (gc *GenericCommand) Run(expect *Expected) {
-	if gc.t != nil {
-		gc.t.Helper()
-	}
+	gc.t.Helper()
+
+	var debug [][]any
 
 	if !gc.async {
 		_ = gc.cmd.Run(context.WithValue(context.Background(), com.LoggerKey, gc.t))
 	}
 
+	debug = append(debug,
+		[]any{"➡️", commandDecorator + " " + gc.cmd.Binary + " " + strings.Join(gc.cmd.Args, " ")},
+	)
+
+	// Wait for the command and if Err is not nil, append it to the debug information
 	result, err := gc.cmd.Wait()
+	if err != nil {
+		debug = append(debug, []any{"", errorDecorator + " " + err.Error()})
+	}
+
+	// If we were requested to perform expectation matching, add non-empty debugging information
 	if result != nil {
 		gc.rawStdErr = result.Stderr
+
+		if result.ExitCode != 0 {
+			debug = append(debug, []any{"", exitDecorator + " " + strconv.Itoa(result.ExitCode)})
+		}
+
+		if result.Stdout != "" {
+			debug = append(debug, []any{"", stdoutDecorator + " " + result.Stdout})
+		}
+
+		if result.Stderr != "" {
+			debug = append(debug, []any{"", stderrDecorator + " " + result.Stderr})
+		}
+
+		if result.Signal != nil {
+			debug = append(debug, []any{"Signal", result.Signal.String()})
+		}
+
+		debug = append(debug,
+			[]any{"Limit", gc.cmd.Timeout},
+			[]any{"Environ", strings.Join(result.Environ, "\n")},
+		)
 	}
 
-	// Check our expectations, if any
+	// Print the command info
+	gc.t.Log("\n\n" + formatter.Table(debug, "-") + "\n")
+
+	// Now, check our expectations, if any
 	if expect != nil {
-		// Build the debug string
-		separator := "================================="
-		debugCommand := gc.cmd.Binary + " " + strings.Join(gc.cmd.Args, " ")
-		debugTimeout := gc.cmd.Timeout
-		debugWD := gc.cmd.WorkingDir
-
-		// FIXME: this is ugly af. Do better.
-		debug := fmt.Sprintf(
-			"\n%s\n| Command:\t%s\n| Working Dir:\t%s\n| Timeout:\t%s\n%s\n"+
-				"%s\n%s\n| Stderr:\n%s\n%s\n%s\n| Stdout:\n%s\n%s\n%s\n| Exit Code: %d\n| Signaled: %v\n| Err: %v\n%s",
-			separator,
-			debugCommand,
-			debugWD,
-			debugTimeout,
-			separator,
-			"\t"+strings.Join(result.Environ, "\n\t"),
-			separator,
-			separator,
-			result.Stderr,
-			separator,
-			separator,
-			result.Stdout,
-			separator,
-			result.ExitCode,
-			result.Signal,
-			err,
-			separator,
-		)
+		assertT := assertive.WithSilentSuccess(gc.t)
 
 		// ExitCode goes first
 		switch expect.ExitCode {
@@ -203,44 +217,67 @@ func (gc *GenericCommand) Run(expect *Expected) {
 			// ExitCodeGenericFail means we expect an error (excluding timeout, cancellation,
 			// signalling).
 			assertive.ErrorIs(
-				gc.t,
+				assertT,
 				err,
 				com.ErrExecutionFailed,
-				"Command should have failed",
-				debug,
+				"Command should fail",
 			)
 		case internal.ExitCodeTimeout:
 			assertive.ErrorIs(
 				gc.t,
 				err,
 				com.ErrTimeout,
-				"Command should have timed out",
-				debug,
+				"Command should time-out",
 			)
 		case internal.ExitCodeSignaled:
 			assertive.ErrorIs(
 				gc.t,
 				err,
 				com.ErrSignaled,
-				"Command should have been signaled",
-				debug,
+				"Command should get signaled",
 			)
 		case internal.ExitCodeSuccess:
-			assertive.ErrorIsNil(gc.t, err, "Command should have succeeded", debug)
+			assertive.ErrorIsNil(
+				assertT,
+				err,
+				"Command should succeed",
+			)
 		default:
-			assertive.IsEqual(gc.t, expect.ExitCode, result.ExitCode,
-				fmt.Sprintf("Expected exit code: %d\n", expect.ExitCode), debug)
+			exc := -1
+			if result != nil {
+				exc = result.ExitCode
+			}
+
+			assertive.IsEqual(
+				assertT,
+				expect.ExitCode,
+				exc,
+				"Exit code should match expectation",
+			)
 		}
 
+		// Switch to fail later mode so that we get ALL subsequent asserts failures from there on.
+		// Also does allow using assert(ive) in go routines.
+		assertT = assertive.WithFailLater(gc.t)
+
 		// Range through the expected errors and confirm they are seen on stderr
 		for _, expectErr := range expect.Errors {
-			assertive.Contains(gc.t, result.Stderr, expectErr.Error(),
-				fmt.Sprintf("Expected error: %q to be found in stderr\n", expectErr.Error()), debug)
+			assertive.Contains(
+				assertT,
+				gc.rawStdErr,
+				expectErr.Error(),
+				"Stderr should contain expected error",
+			)
 		}
 
 		// Finally, check the output if we are asked to
+		// FIXME: we cannot pass on assertT further for now until we move to tig.T
 		if expect.Output != nil {
-			expect.Output(result.Stdout, debug, gc.t)
+			expect.Output(
+				result.Stdout,
+				"",
+				gc.t,
+			)
 		}
 	}
 }
@@ -263,7 +300,6 @@ func (gc *GenericCommand) withConfig(config Config) {
 	gc.Config = config
 }
 
-//nolint:ireturn
 func (gc *GenericCommand) Clone() TestableCommand {
 	// Copy the command and return a new one - with almost everything from the parent command
 	clone := *gc
@@ -287,7 +323,6 @@ func (gc *GenericCommand) T() *testing.T {
 	return gc.t
 }
 
-//nolint:ireturn
 func (gc *GenericCommand) clear() TestableCommand {
 	comcopy := *gc
 	// Reset internal command

From 000a4b5e1c9ef03d97cef131d4dfa94ad79551f0 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Mon, 14 Apr 2025 15:54:16 -0700
Subject: [PATCH 083/225] mod/tigron/require documentation

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/require/doc.md | 63 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 mod/tigron/require/doc.md

diff --git a/mod/tigron/require/doc.md b/mod/tigron/require/doc.md
new file mode 100644
index 00000000000..5db53f9a633
--- /dev/null
+++ b/mod/tigron/require/doc.md
@@ -0,0 +1,63 @@
+# Requirements
+
+Any `test.Case` has a `Require` property that allow enforcing specific, per-test requirements.
+
+A `Requirement` is expected to make you `Skip` tests when the environment does not match
+expectations.
+
+A number of ready-made requirements are provided:
+
+```go
+require.Windows // a test runs only on Windows
+require.Linux // a test runs only on Linux
+test.Darwin // a test runs only on Darwin
+test.OS(name string) // a test runs only on the OS `name`
+require.Binary(name string) // a test requires the binary `name` to be in the PATH
+require.Not(req Requirement) // a test runs only if the opposite of the requirement `req` is fulfilled
+require.All(req ...Requirement) // a test runs only if all requirements are fulfilled
+```
+
+## Custom requirements
+
+A requirement is a simple struct (`test.Requirement`), that must provide a `Check` function.
+
+`Check` function signature is `func(data Data, helpers Helpers) (bool, string)`, that is expected
+to return `true` if the environment is fine to run that test, or `false` if not.
+The second parameter should return a meaningful message explaining what the requirement is.
+
+For example: `found kernel version > 5.0`.
+
+Given requirements can be negated with `require.Not(req)`, your message should describe the state of the environment
+and not whether the conditions are met (or not met).
+
+A `test.Requirement` can optionally provide custom `Setup` and `Cleanup` routines, in case you need to perform
+specific operations before the test run (and cleanup something after).
+
+`Setup/Cleanup` will only run if the requirement `Check` returns true.
+
+Here is for example how the `require.Binary` method is implemented:
+
+```go
+package thing
+
+func Binary(name string) *test.Requirement {
+    return &test.Requirement{
+        Check: func(_ test.Data, _ test.Helpers) (bool, string) {
+            mess := fmt.Sprintf("executable %q has been found in PATH", name)
+            ret := true
+            if _, err := exec.LookPath(name); err != nil {
+                ret = false
+                mess = fmt.Sprintf("executable %q doesn't exist in PATH", name)
+            }
+
+            return ret, mess
+        },
+    }
+}
+```
+
+## Gotcha
+
+Obviously, `test.Not(otherreq)` will NOT perform any `Setup/Cleanup` provided by `otherreq`.
+
+Ambient requirements are currently undocumented.

From a7d46bcfdf94310020294b407ce7b80384746a32 Mon Sep 17 00:00:00 2001
From: Tushar Gupta <codingid6@gmail.com>
Date: Sat, 29 Mar 2025 02:05:07 +0530
Subject: [PATCH 084/225] feat: Add "Containers" propery in the "nerdctl
 network inspect" command.

Signed-off-by: Tushar Gupta <codingid6@gmail.com>
---
 cmd/nerdctl/network/network_inspect.go        | 14 ++++++-
 cmd/nerdctl/network/network_inspect_test.go   | 37 +++++++++++++++++++
 pkg/cmd/network/inspect.go                    | 28 +++++++++++++-
 pkg/inspecttypes/dockercompat/dockercompat.go | 28 ++++++++++++--
 pkg/inspecttypes/native/network.go            |  3 +-
 5 files changed, 102 insertions(+), 8 deletions(-)

diff --git a/cmd/nerdctl/network/network_inspect.go b/cmd/nerdctl/network/network_inspect.go
index adc1a96507d..c61fe893eca 100644
--- a/cmd/nerdctl/network/network_inspect.go
+++ b/cmd/nerdctl/network/network_inspect.go
@@ -22,6 +22,7 @@ import (
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/completion"
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
+	"github.com/containerd/nerdctl/v2/pkg/clientutil"
 	"github.com/containerd/nerdctl/v2/pkg/cmd/network"
 )
 
@@ -59,13 +60,22 @@ func inspectAction(cmd *cobra.Command, args []string) error {
 	if err != nil {
 		return err
 	}
-	return network.Inspect(cmd.Context(), types.NetworkInspectOptions{
+
+	options := types.NetworkInspectOptions{
 		GOptions: globalOptions,
 		Mode:     mode,
 		Format:   format,
 		Networks: args,
 		Stdout:   cmd.OutOrStdout(),
-	})
+	}
+
+	client, ctx, cancel, err := clientutil.NewClient(cmd.Context(), options.GOptions.Namespace, options.GOptions.Address)
+	if err != nil {
+		return err
+	}
+	defer cancel()
+
+	return network.Inspect(ctx, client, options)
 }
 
 func networkInspectShellComplete(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
diff --git a/cmd/nerdctl/network/network_inspect_test.go b/cmd/nerdctl/network/network_inspect_test.go
index cb89f25f2d4..0694d1f0a9b 100644
--- a/cmd/nerdctl/network/network_inspect_test.go
+++ b/cmd/nerdctl/network/network_inspect_test.go
@@ -29,6 +29,7 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
+	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
@@ -278,6 +279,42 @@ func TestNetworkInspect(t *testing.T) {
 				}
 			},
 		},
+		{
+			Description: "Verify that only active containers appear in the network inspect output",
+			Setup: func(data test.Data, helpers test.Helpers) {
+				helpers.Ensure("network", "create", data.Identifier("nginx-network-1"))
+				helpers.Ensure("network", "create", data.Identifier("nginx-network-2"))
+				helpers.Ensure("create", "--name", data.Identifier("nginx-container-1"), "--network", data.Identifier("nginx-network-1"), testutil.NginxAlpineImage)
+				helpers.Ensure("create", "--name", data.Identifier("nginx-container-2"), "--network", data.Identifier("nginx-network-1"), testutil.NginxAlpineImage)
+				helpers.Ensure("create", "--name", data.Identifier("nginx-container-on-diff-network"), "--network", data.Identifier("nginx-network-2"), testutil.NginxAlpineImage)
+				helpers.Ensure("start", data.Identifier("nginx-container-1"), data.Identifier("nginx-container-on-diff-network"))
+				data.Set("nginx-container-1-id", strings.Trim(helpers.Capture("inspect", data.Identifier("nginx-container-1"), "--format", "{{.Id}}"), "\n"))
+			},
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rm", "-f", data.Identifier("nginx-container-1"))
+				helpers.Anyhow("rm", "-f", data.Identifier("nginx-container-2"))
+				helpers.Anyhow("rm", "-f", data.Identifier("nginx-container-on-diff-network"))
+				helpers.Anyhow("network", "remove", data.Identifier("nginx-network-1"))
+				helpers.Anyhow("network", "remove", data.Identifier("nginx-network-2"))
+			},
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("network", "inspect", data.Identifier("nginx-network-1"))
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					Output: func(stdout string, info string, t *testing.T) {
+						var dc []dockercompat.Network
+						err := json.Unmarshal([]byte(stdout), &dc)
+						assert.NilError(t, err, "Unable to unmarshal output\n"+info)
+						assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
+						assert.Equal(t, dc[0].Name, data.Identifier("nginx-network-1"))
+						// Assert only the "running" containers on the same network are returned.
+						assert.Equal(t, 1, len(dc[0].Containers), "Expected a single container as per configuration, but got multiple.")
+						assert.Equal(t, data.Identifier("nginx-container-1"), dc[0].Containers[data.Get("nginx-container-1-id")].Name)
+					},
+				}
+			},
+		},
 	}
 
 	testCase.Run(t)
diff --git a/pkg/cmd/network/inspect.go b/pkg/cmd/network/inspect.go
index 5fae28028f3..0a9090b95aa 100644
--- a/pkg/cmd/network/inspect.go
+++ b/pkg/cmd/network/inspect.go
@@ -22,16 +22,19 @@ import (
 	"errors"
 	"fmt"
 
+	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/log"
 
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
+	"github.com/containerd/nerdctl/v2/pkg/containerinspector"
 	"github.com/containerd/nerdctl/v2/pkg/formatter"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/native"
+	"github.com/containerd/nerdctl/v2/pkg/labels"
 	"github.com/containerd/nerdctl/v2/pkg/netutil"
 )
 
-func Inspect(ctx context.Context, options types.NetworkInspectOptions) error {
+func Inspect(ctx context.Context, client *containerd.Client, options types.NetworkInspectOptions) error {
 	if options.Mode != "native" && options.Mode != "dockercompat" {
 		return fmt.Errorf("unknown mode %q", options.Mode)
 	}
@@ -53,12 +56,35 @@ func Inspect(ctx context.Context, options types.NetworkInspectOptions) error {
 			errs = append(errs, fmt.Errorf("no network found matching: %s", req))
 			continue
 		}
+
 		network := netList[0]
+		var filters = []string{fmt.Sprintf("labels.%q==%q", labels.Networks, []string{network.Name})}
+
+		filteredContainers, err := client.Containers(ctx, filters...)
+
+		if err != nil {
+			return err
+		}
+
+		var containers []*native.Container
+
+		for _, container := range filteredContainers {
+			nativeContainer, err := containerinspector.Inspect(ctx, container)
+			if err != nil {
+				continue
+			}
+			if nativeContainer.Process == nil || nativeContainer.Process.Status.Status != containerd.Running {
+				continue
+			}
+			containers = append(containers, nativeContainer)
+		}
+
 		r := &native.Network{
 			CNI:           json.RawMessage(network.Bytes),
 			NerdctlID:     network.NerdctlID,
 			NerdctlLabels: network.NerdctlLabels,
 			File:          network.File,
+			Containers:    containers,
 		}
 		switch options.Mode {
 		case "native":
diff --git a/pkg/inspecttypes/dockercompat/dockercompat.go b/pkg/inspecttypes/dockercompat/dockercompat.go
index e5b797e786d..f04b4d7401a 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat.go
@@ -884,13 +884,22 @@ type IPAM struct {
 // Network mimics a `docker network inspect` object.
 // From https://github.com/moby/moby/blob/v20.10.7/api/types/types.go#L430-L448
 type Network struct {
-	Name   string            `json:"Name"`
-	ID     string            `json:"Id,omitempty"` // optional in nerdctl
-	IPAM   IPAM              `json:"IPAM,omitempty"`
-	Labels map[string]string `json:"Labels"`
+	Name       string                      `json:"Name"`
+	ID         string                      `json:"Id,omitempty"` // optional in nerdctl
+	IPAM       IPAM                        `json:"IPAM,omitempty"`
+	Labels     map[string]string           `json:"Labels"`
+	Containers map[string]EndpointResource `json:"Containers"` // Containers contains endpoints belonging to the network
 	// Scope, Driver, etc. are omitted
 }
 
+type EndpointResource struct {
+	Name string `json:"Name"`
+	// EndpointID  string `json:"EndpointID"`
+	// MacAddress  string `json:"MacAddress"`
+	// IPv4Address string `json:"IPv4Address"`
+	// IPv6Address string `json:"IPv6Address"`
+}
+
 type structuredCNI struct {
 	Name    string `json:"name"`
 	Plugins []struct {
@@ -930,6 +939,17 @@ func NetworkFromNative(n *native.Network) (*Network, error) {
 		res.Labels = *n.NerdctlLabels
 	}
 
+	res.Containers = make(map[string]EndpointResource)
+	for _, container := range n.Containers {
+		res.Containers[container.ID] = EndpointResource{
+			Name: container.Labels[labels.Name],
+			// EndpointID:  container.EndpointID,
+			// MacAddress:  container.MacAddress,
+			// IPv4Address: container.IPv4Address,
+			// IPv6Address: container.IPv6Address,
+		}
+	}
+
 	return &res, nil
 }
 
diff --git a/pkg/inspecttypes/native/network.go b/pkg/inspecttypes/native/network.go
index 18d5e96bb1e..f0e84d5974a 100644
--- a/pkg/inspecttypes/native/network.go
+++ b/pkg/inspecttypes/native/network.go
@@ -18,10 +18,11 @@ package native
 
 import "encoding/json"
 
-// Network corresponds to pkg/netutil.NetworkConfigList
+// Network corresponds to pkg/netutil.NetworkConfig
 type Network struct {
 	CNI           json.RawMessage    `json:"CNI,omitempty"`
 	NerdctlID     *string            `json:"NerdctlID"`
 	NerdctlLabels *map[string]string `json:"NerdctlLabels,omitempty"`
 	File          string             `json:"File,omitempty"`
+	Containers    []*Container       `json:"Containers"`
 }

From 086cef0e8e6ffceb9f05e5be72793cbac51bab1c Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Tue, 15 Apr 2025 15:14:08 -0700
Subject: [PATCH 085/225] Fix image removal

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 pkg/cmd/image/remove.go | 36 ++++++++++++++++++++++--------------
 1 file changed, 22 insertions(+), 14 deletions(-)

diff --git a/pkg/cmd/image/remove.go b/pkg/cmd/image/remove.go
index 6baa1970d2e..44aafa5fab4 100644
--- a/pkg/cmd/image/remove.go
+++ b/pkg/cmd/image/remove.go
@@ -79,18 +79,22 @@ func Remove(ctx context.Context, client *containerd.Client, args []string, optio
 
 			if cid, ok := runningImages[found.Image.Name]; ok {
 				if options.Force {
-					// FIXME: this is suspicious, but passing the opt seem to break some tests
-					// if err = is.Delete(ctx, found.Image.Name, delOpts...); err != nil {
-					if err = is.Delete(ctx, found.Image.Name); err != nil {
+					// This is a running image, so, we need to keep a ref on it so that containerd does not GC the layers
+					// First create the new image with an empty name
+					originalName := found.Image.Name
+					found.Image.Name = ":"
+					if _, err = is.Create(ctx, found.Image); err != nil {
 						return err
 					}
-					fmt.Fprintf(options.Stdout, "Untagged: %s\n", found.Image.Name)
-					fmt.Fprintf(options.Stdout, "Untagged: %s\n", found.Image.Target.Digest.String())
 
-					found.Image.Name = ":"
-					if _, err = is.Create(ctx, found.Image); err != nil {
+					// Now, delete the original
+					if err = is.Delete(ctx, originalName, delOpts...); err != nil {
 						return err
 					}
+
+					fmt.Fprintf(options.Stdout, "Untagged: %s\n", originalName)
+					fmt.Fprintf(options.Stdout, "Untagged: %s@%s\n", originalName, found.Image.Target.Digest.String())
+
 					return nil
 				}
 				return fmt.Errorf("conflict: unable to delete %s (cannot be forced) - image is being used by running container %s", found.Req, cid)
@@ -128,18 +132,22 @@ func Remove(ctx context.Context, client *containerd.Client, args []string, optio
 
 			if cid, ok := runningImages[found.Image.Name]; ok {
 				if options.Force {
-					// FIXME: this is suspicious, but passing the opt seem to break some tests
-					// if err = is.Delete(ctx, found.Image.Name, delOpts...); err != nil {
-					if err = is.Delete(ctx, found.Image.Name); err != nil {
+					// This is a running image, so, we need to keep a ref on it so that containerd does not GC the layers
+					// First create the new image with an empty name
+					originalName := found.Image.Name
+					found.Image.Name = ":"
+					if _, err = is.Create(ctx, found.Image); err != nil {
 						return false, err
 					}
-					fmt.Fprintf(options.Stdout, "Untagged: %s\n", found.Image.Name)
-					fmt.Fprintf(options.Stdout, "Untagged: %s\n", found.Image.Target.Digest.String())
 
-					found.Image.Name = ":"
-					if _, err = is.Create(ctx, found.Image); err != nil {
+					// Now, delete the original
+					if err = is.Delete(ctx, originalName, delOpts...); err != nil {
 						return false, err
 					}
+
+					fmt.Fprintf(options.Stdout, "Untagged: %s\n", originalName)
+					fmt.Fprintf(options.Stdout, "Untagged: %s@%s\n", originalName, found.Image.Target.Digest.String())
+
 					return false, nil
 				}
 				return false, fmt.Errorf("conflict: unable to delete %s (cannot be forced) - image is being used by running container %s", found.Req, cid)

From 330ddf4a68f8a9e8a9e42a04d2f48d93b0f4b619 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Tue, 15 Apr 2025 14:21:59 -0700
Subject: [PATCH 086/225] Cosmetic fixes for testing debug logs

- fix timeout showing 0s instead of default when no explicit timeout is provided
- add actual execution time
- fix long logs (stdout, stderr) that were showing only the beginning to also show the end
- fix formatting issue for "..."
- marginally better output for command contextual information

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/internal/com/command.go         | 17 ++++++++++-------
 mod/tigron/internal/formatter/formatter.go |  5 ++++-
 mod/tigron/test/case.go                    |  2 +-
 mod/tigron/test/command.go                 | 16 +++++++++++++---
 4 files changed, 28 insertions(+), 12 deletions(-)

diff --git a/mod/tigron/internal/com/command.go b/mod/tigron/internal/com/command.go
index cc8959a7e13..c8cd6c3d21b 100644
--- a/mod/tigron/internal/com/command.go
+++ b/mod/tigron/internal/com/command.go
@@ -70,6 +70,7 @@ type Result struct {
 	Stderr   string
 	ExitCode int
 	Signal   os.Signal
+	Duration time.Duration
 }
 
 type execution struct {
@@ -102,9 +103,10 @@ type Command struct {
 	ptyStderr bool
 	ptyStdin  bool
 
-	exec   *execution
-	mutex  sync.Mutex
-	result *Result
+	exec      *execution
+	mutex     sync.Mutex
+	result    *Result
+	startTime time.Time
 }
 
 // Clone does just duplicate a command, resetting its execution.
@@ -184,12 +186,12 @@ func (gc *Command) Run(parentCtx context.Context) error {
 	)
 
 	// Get a timing-out context
-	timeout := gc.Timeout
-	if timeout == 0 {
-		timeout = defaultTimeout
+	if gc.Timeout == 0 {
+		gc.Timeout = defaultTimeout
 	}
 
-	ctx, ctxCancel = context.WithTimeout(parentCtx, timeout)
+	ctx, ctxCancel = context.WithTimeout(parentCtx, gc.Timeout)
+	gc.startTime = time.Now()
 
 	// Create a contextual command, set the logger
 	cmd = gc.buildCommand(ctx)
@@ -366,6 +368,7 @@ func (gc *Command) wrap() error {
 		Stderr:   pipes.fromStderr,
 		Environ:  cmd.Environ(),
 		Signal:   signal,
+		Duration: time.Since(gc.startTime),
 	}
 
 	if gc.exec.err == nil {
diff --git a/mod/tigron/internal/formatter/formatter.go b/mod/tigron/internal/formatter/formatter.go
index 43ce9fe56c4..f0900acbc3f 100644
--- a/mod/tigron/internal/formatter/formatter.go
+++ b/mod/tigron/internal/formatter/formatter.go
@@ -108,7 +108,10 @@ func chunk(s string, maxLength, maxLines int) []string {
 	}
 
 	if len(chunks) > maxLines {
-		chunks = append(chunks[0:maxLines], "...")
+		abbreviator := "..."
+		chunks = append(
+			append(chunks[0:maxLines/2], abbreviator+strings.Repeat(spacer, maxLength-len(abbreviator))),
+			chunks[len(chunks)-maxLines/2:]...)
 	} else if len(chunks) == 0 {
 		chunks = []string{strings.Repeat(spacer, maxLength)}
 	}
diff --git a/mod/tigron/test/case.go b/mod/tigron/test/case.go
index 6a703e964a0..5de72442cc4 100644
--- a/mod/tigron/test/case.go
+++ b/mod/tigron/test/case.go
@@ -233,7 +233,7 @@ func (test *Case) Run(t *testing.T) {
 				"\n\n" + formatter.Table(
 					[][]any{
 						{startDecorator, fmt.Sprintf("%q: starting test!", test.t.Name())},
-						{"cwd", test.Data.TempDir()},
+						{"temp", test.Data.TempDir()},
 						{"config", string(debugConfig)},
 						{"data", string(debugData)},
 					},
diff --git a/mod/tigron/test/command.go b/mod/tigron/test/command.go
index 0c1970d8d81..9f932bfde67 100644
--- a/mod/tigron/test/command.go
+++ b/mod/tigron/test/command.go
@@ -39,6 +39,10 @@ const (
 	exitDecorator           = "⚠️"
 	stdoutDecorator         = "🟢"
 	stderrDecorator         = "🟠"
+	timeoutDecorator        = "⏰"
+	cwdDecorator            = "📁"
+	envDecorator            = "🌱"
+	sigDecorator            = "⚡"
 )
 
 // CustomizableCommand is an interface meant for people who want to heavily customize the base
@@ -193,12 +197,18 @@ func (gc *GenericCommand) Run(expect *Expected) {
 		}
 
 		if result.Signal != nil {
-			debug = append(debug, []any{"Signal", result.Signal.String()})
+			debug = append(debug, []any{"", sigDecorator + " " + result.Signal.String()})
+		}
+
+		duration := result.Duration.String()
+		if result.Duration < time.Second {
+			duration = "<1s"
 		}
 
 		debug = append(debug,
-			[]any{"Limit", gc.cmd.Timeout},
-			[]any{"Environ", strings.Join(result.Environ, "\n")},
+			[]any{envDecorator, strings.Join(result.Environ, "\n")},
+			[]any{timeoutDecorator, duration + " (limit: " + gc.cmd.Timeout.String() + ")"},
+			[]any{cwdDecorator, gc.cmd.WorkingDir},
 		)
 	}
 

From d439da9f06f3cf2b5f83b5bd23980530992f8918 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Tue, 15 Apr 2025 21:32:57 -0700
Subject: [PATCH 087/225] Implement env whitelist to reduce debug noise

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/test/command.go       |  4 ++++
 pkg/testutil/nerdtest/command.go | 19 ++++++++-----------
 2 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/mod/tigron/test/command.go b/mod/tigron/test/command.go
index 9f932bfde67..ecc32e95784 100644
--- a/mod/tigron/test/command.go
+++ b/mod/tigron/test/command.go
@@ -142,6 +142,10 @@ func (gc *GenericCommand) WithBlacklist(env []string) {
 	gc.cmd.EnvBlackList = env
 }
 
+func (gc *GenericCommand) WithWhitelist(env []string) {
+	gc.cmd.EnvWhiteList = env
+}
+
 func (gc *GenericCommand) WithTimeout(timeout time.Duration) {
 	gc.cmd.Timeout = timeout
 }
diff --git a/pkg/testutil/nerdtest/command.go b/pkg/testutil/nerdtest/command.go
index dbeed949e7c..cf8b7207bd2 100644
--- a/pkg/testutil/nerdtest/command.go
+++ b/pkg/testutil/nerdtest/command.go
@@ -82,17 +82,14 @@ func newNerdCommand(conf test.Config, t *testing.T) *nerdCommand {
 	}
 
 	ret.WithBinary(binary)
-	// Not interested in these - and insulate us from parent environment side effects
-	ret.WithBlacklist([]string{
-		"LS_COLORS",
-		"DOCKER_CONFIG",
-		"CONTAINERD_SNAPSHOTTER",
-		"NERDCTL_TOML",
-		"CONTAINERD_ADDRESS",
-		"CNI_PATH",
-		"NETCONFPATH",
-		"NERDCTL_EXPERIMENTAL",
-		"NERDCTL_HOST_GATEWAY_IP",
+	ret.WithWhitelist([]string{
+		"PATH",
+		"HOME",
+		"XDG_*",
+		// Windows needs ProgramData, AppData, etc
+		"Program*",
+		"PROGRAM*",
+		"APPDATA",
 	})
 	return ret
 }

From 1b44f934b7b54bb9fef7418f13ee28243ba3b7fe Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 16 Apr 2025 10:50:19 -0700
Subject: [PATCH 088/225] Fix internal command flaky test (window)

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/internal/com/command_test.go | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/mod/tigron/internal/com/command_test.go b/mod/tigron/internal/com/command_test.go
index 9c5d0b7e8a0..ebbb5075b86 100644
--- a/mod/tigron/internal/com/command_test.go
+++ b/mod/tigron/internal/com/command_test.go
@@ -427,7 +427,10 @@ func TestTimeoutPlain(t *testing.T) {
 	end := time.Now()
 
 	assertive.ErrorIs(t, err, com.ErrTimeout, "Err")
-	assertive.IsEqual(t, res.ExitCode, -1, "ExitCode")
+	// FIXME? It seems like on windows exitcode is randomly 1 on timeout
+	// This is not a problem, as with a time-out we do not care about exit code, but is raising questions
+	// about golang underlying implementation / command cancellation mechanism.
+	// assertive.IsEqual(t, res.ExitCode, -1, "ExitCode")
 	assertive.IsEqual(t, res.Stdout, "one", "Stdout")
 	assertive.IsEqual(t, res.Stderr, "", "Stderr")
 	assertive.IsLessThan(t, end.Sub(start), 2*time.Second, "Total execution time")
@@ -455,7 +458,10 @@ func TestTimeoutDelayed(t *testing.T) {
 	end := time.Now()
 
 	assertive.ErrorIs(t, err, com.ErrTimeout, "Err")
-	assertive.IsEqual(t, res.ExitCode, -1, "ExitCode")
+	// FIXME? It seems like on windows exitcode is randomly 1 on timeout
+	// This is not a problem, as with a time-out we do not care about exit code, but is raising questions
+	// about golang underlying implementation / command cancellation mechanism.
+	// assertive.IsEqual(t, res.ExitCode, -1, "ExitCode")
 	assertive.IsEqual(t, res.Stdout, "one", "Stdout")
 	assertive.IsEqual(t, res.Stderr, "", "Stderr")
 	assertive.IsLessThan(t, end.Sub(start), 3*time.Second, "Total execution time")

From d88b9df1826b1ca6fb6faaeb422538429d4ec6ca Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 16 Apr 2025 19:02:15 -0700
Subject: [PATCH 089/225] Allow per-command environment override

While test allow declaration of custom environment variables, they must be set during the test
declaration, apply to all commands, and cannot be altered during lifecycle operations (eg: Setup).
This provides the ability to set variables for specific, individual commands.

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/.golangci.yml      | 2 +-
 mod/tigron/test/command.go    | 4 ++++
 mod/tigron/test/interfaces.go | 2 ++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/mod/tigron/.golangci.yml b/mod/tigron/.golangci.yml
index ab1817e4d1a..e5ce1567ab6 100644
--- a/mod/tigron/.golangci.yml
+++ b/mod/tigron/.golangci.yml
@@ -57,7 +57,7 @@ linters:
   settings:
     interfacebloat:
       # Default is 10
-      max: 13
+      max: 20
     revive:
       enable-all-rules: true
       rules:
diff --git a/mod/tigron/test/command.go b/mod/tigron/test/command.go
index 0c1970d8d81..39d7f606e74 100644
--- a/mod/tigron/test/command.go
+++ b/mod/tigron/test/command.go
@@ -126,6 +126,10 @@ func (gc *GenericCommand) Feed(r io.Reader) {
 	gc.cmd.Feed(r)
 }
 
+func (gc *GenericCommand) Setenv(key, value string) {
+	gc.cmd.Env[key] = value
+}
+
 func (gc *GenericCommand) WithFeeder(fun func() io.Reader) {
 	gc.cmd.WithFeeder(fun)
 }
diff --git a/mod/tigron/test/interfaces.go b/mod/tigron/test/interfaces.go
index 07f348999c5..a4d250d87fa 100644
--- a/mod/tigron/test/interfaces.go
+++ b/mod/tigron/test/interfaces.go
@@ -89,6 +89,8 @@ type TestableCommand interface {
 	WithCwd(path string)
 	// WithTimeout defines the execution timeout for a command.
 	WithTimeout(timeout time.Duration)
+	// Setenv allows to override a specific env variable directly for a specific command instead of test-wide
+	Setenv(key, value string)
 	// WithFeeder allows passing a reader to be fed to the command stdin.
 	WithFeeder(fun func() io.Reader)
 	// Feed allows passing a reader to be fed to the command stdin.

From 3f21c04aa97a6d48b56e004aa09a010fa0f85bab Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 16 Apr 2025 13:37:16 -0700
Subject: [PATCH 090/225] test.Data to support temp resources manipulation

Many tests require temporary resources (Dockerfiles, compose.yml, etc), and routinely
redo the same thing over and over (create separate temp dir, write file, remove temp dir).
At best this adds a lot of inconsistent boilerplate / helper functions to the test - at worst,
the resources are not properly cleaned-up, or not well isolated from other tests.

This PR does introduce a set of helpers to fasttrack temp files manipulation, and rejiggle the
Data interface to more clearly separate labels (shared with subtests) and temporary resources.

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 docs/testing/tools.md         |  20 ++--
 mod/tigron/.golangci.yml      |   7 +-
 mod/tigron/expect/doc.md      |   6 +-
 mod/tigron/test/case.go       |  29 +++--
 mod/tigron/test/command.go    |   1 +
 mod/tigron/test/consts.go     |  26 +++++
 mod/tigron/test/data.go       | 196 ++++++++++++++++++++++++++--------
 mod/tigron/test/data_test.go  |  35 +++---
 mod/tigron/test/funct.go      |   5 +-
 mod/tigron/test/interfaces.go |  48 ++++++---
 10 files changed, 281 insertions(+), 92 deletions(-)
 create mode 100644 mod/tigron/test/consts.go

diff --git a/docs/testing/tools.md b/docs/testing/tools.md
index 70230ae663b..9b4f0d9d1ad 100644
--- a/docs/testing/tools.md
+++ b/docs/testing/tools.md
@@ -109,7 +109,7 @@ that this name is then visible in the list of containers.
 
 To achieve that, you should write your own `Manager`, leveraging test `Data`.
 
-Here is an example, where we are using `data.Get("sometestdata")`.
+Here is an example, where we are using `data.Labels().Get("sometestdata")`.
 
 ```go
 package main
@@ -133,7 +133,7 @@ func TestMyThing(t *testing.T) {
 
 	// Declare your test
 	myTest := &test.Case{
-		Data:        test.WithData("sometestdata", "blah"),
+		Data:        test.WithLabels(map[string]string{"sometestdata": "blah"}),
 		Command:     test.Command("info"),
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
@@ -143,7 +143,7 @@ func TestMyThing(t *testing.T) {
 					errdefs.ErrNotFound,
 				},
 				Output: func(stdout string, info string, t *testing.T) {
-					assert.Assert(t, stdout == data.Get("sometestdata"), info)
+					assert.Assert(t, stdout == data.Labels().Get("sometestdata"), info)
 				},
 			}
 		},
@@ -157,7 +157,7 @@ func TestMyThing(t *testing.T) {
 
 `Data` is provided to allow storing mutable key-value information that pertain to the test.
 
-While it can be provided through `test.WithData(key string, value string)`,
+While it can be provided through `test.WithLabels(map[string]string{key: value})`,
 inside the testcase definition, it can also be dynamically manipulated inside `Setup`, or `Command`.
 
 Note that `Data` additionally exposes the following functions:
@@ -244,9 +244,9 @@ func TestMyThing(t *testing.T) {
 
 	// Declare your test
 	myTest := &test.Case{
-		Data:        test.WithData("sometestdata", "blah"),
+		Data:        test.WithLabels(map[string]string{"sometestdata": "blah"}),
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("run", "--name", data.Get("sometestdata"))
+			return helpers.Command("run", "--name", data.Labels().Get("sometestdata"))
 		},
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
@@ -256,7 +256,7 @@ func TestMyThing(t *testing.T) {
 					errdefs.ErrNotFound,
 				},
 				Output: func(stdout string, info string, t *testing.T) {
-					assert.Assert(t, stdout == data.Get("sometestdata"), info)
+					assert.Assert(t, stdout == data.Labels().Get("sometestdata"), info)
 				},
 			}
 		},
@@ -325,7 +325,7 @@ func TestMyThing(t *testing.T) {
 
 	// Declare your test
 	myTest := &test.Case{
-		Data:        test.WithData("sometestdata", "blah"),
+		Data:        test.WithLabels(map[string]string{"sometestdata": "blah"}),
 		Setup: func(data *test.Data, helpers test.Helpers){
 			helpers.Ensure("volume", "create", "foo")
 			helpers.Ensure("volume", "create", "bar")
@@ -335,7 +335,7 @@ func TestMyThing(t *testing.T) {
 			helpers.Anyhow("volume", "rm", "bar")
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("run", "--name", data.Identifier()+data.Get("sometestdata"))
+			return helpers.Command("run", "--name", data.Identifier()+data.Labels().Get("sometestdata"))
 		},
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
@@ -345,7 +345,7 @@ func TestMyThing(t *testing.T) {
 					errdefs.ErrNotFound,
 				},
 				Output: func(stdout string, info string, t *testing.T) {
-					assert.Assert(t, stdout == data.Get("sometestdata"), info)
+					assert.Assert(t, stdout == data.Labels().Get("sometestdata"), info)
 				},
 			}
 		},
diff --git a/mod/tigron/.golangci.yml b/mod/tigron/.golangci.yml
index ab1817e4d1a..2e9b9894ae6 100644
--- a/mod/tigron/.golangci.yml
+++ b/mod/tigron/.golangci.yml
@@ -61,12 +61,15 @@ linters:
     revive:
       enable-all-rules: true
       rules:
+        - name: max-public-structs
+          # Default is 5
+          arguments: 7
         - name: cognitive-complexity
           # Default is 7
-          arguments: [60]
+          arguments: [100]
         - name: function-length
           # Default is 50, 75
-          arguments: [80, 200]
+          arguments: [80, 220]
         - name: cyclomatic
           # Default is 10
           arguments: [30]
diff --git a/mod/tigron/expect/doc.md b/mod/tigron/expect/doc.md
index 48b8d4be6e9..7b2e9828df6 100644
--- a/mod/tigron/expect/doc.md
+++ b/mod/tigron/expect/doc.md
@@ -169,7 +169,7 @@ To achieve that, you should write your own `test.Manager` instead of using the h
 A manager is a simple function which only role is to return a `test.Expected` struct.
 The `test.Manager` signature makes available `test.Data` and `test.Helpers` to you.
 
-Here is an example, where we are using `data.Get("sometestdata")`.
+Here is an example, where we are using `data.Labels().Get("sometestdata")`.
 
 ```go
 package main
@@ -191,7 +191,7 @@ func TestMyThing(t *testing.T) {
         // Do things...
         // ...
         // Save this for later
-        data.Set("something", "lalala")
+        data.Labels().Set("something", "lalala")
     }
 
     // Attach a command to run
@@ -210,7 +210,7 @@ func TestMyThing(t *testing.T) {
                 t.Helper()
 
                 // Retrieve the data that was set during the Setup phase.
-                assert.Assert(t, stdout == data.Get("sometestdata"), info)
+                assert.Assert(t, stdout == data.Labels().Get("sometestdata"), info)
             },
         }
     }
diff --git a/mod/tigron/test/case.go b/mod/tigron/test/case.go
index 5de72442cc4..67846dfbb0f 100644
--- a/mod/tigron/test/case.go
+++ b/mod/tigron/test/case.go
@@ -19,7 +19,9 @@ package test
 import (
 	"encoding/json"
 	"fmt"
+	"os"
 	"slices"
+	"strings"
 	"testing"
 
 	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
@@ -71,6 +73,7 @@ const (
 	setupDecorator  = "🏗"
 	subinDecorator  = "⤵️"
 	suboutDecorator = "↩️"
+	tempDecorator   = "⏳"
 )
 
 // Run prepares and executes the test, and any possible subtests.
@@ -115,7 +118,7 @@ func (test *Case) Run(t *testing.T) {
 		}
 
 		// Inherit and attach Data and Config
-		test.Data = configureData(test.t, test.Data, parentData)
+		test.Data = newData(test.t, test.Data, parentData)
 		test.Config = configureConfig(test.Config, parentConfig)
 
 		var custCom CustomizableCommand
@@ -125,9 +128,13 @@ func (test *Case) Run(t *testing.T) {
 			custCom = registeredTestable.CustomCommand(test, test.t)
 		}
 
-		custCom.WithCwd(test.Data.TempDir())
+		// Separate cwd from the temp directory
+		custCom.WithCwd(test.t.TempDir())
 		custCom.withT(test.t)
-		custCom.withTempDir(test.Data.TempDir())
+		// Set the command tempdir to another temp location.
+		// This is required for the current extension mechanism to allow creation of command dependent configuration
+		// assets. Note that this is a different location than both CWD and Data.Temp().Path().
+		custCom.withTempDir(test.t.TempDir())
 		custCom.withEnv(test.Env)
 		custCom.withConfig(test.Config)
 
@@ -229,18 +236,28 @@ func (test *Case) Run(t *testing.T) {
 			debugConfig, _ := json.MarshalIndent(test.Config.(*config).config, "", "  ")
 			debugData, _ := json.MarshalIndent(test.Data.(*data).labels, "", "  ")
 
+			// Show the files in the temp directory BEFORE the command is executed
+			tempFiles := []string{}
+
+			if files, err := os.ReadDir(test.Data.Temp().Path()); err == nil {
+				for _, file := range files {
+					tempFiles = append(tempFiles, file.Name())
+				}
+			}
+
 			test.t.Log(
 				"\n\n" + formatter.Table(
 					[][]any{
 						{startDecorator, fmt.Sprintf("%q: starting test!", test.t.Name())},
-						{"temp", test.Data.TempDir()},
+						{tempDecorator, test.Data.Temp().Dir()},
+						{"", strings.Join(tempFiles, "\n")},
 						{"config", string(debugConfig)},
-						{"data", string(debugData)},
+						{"labels", string(debugData)},
 					},
 					"=",
 				) + "\n",
 			)
-
+			// FIXME: so, the expected function will run BEFORE the command
 			cmd.Run(test.Expected(test.Data, test.helpers))
 		}
 
diff --git a/mod/tigron/test/command.go b/mod/tigron/test/command.go
index ecc32e95784..899f0474574 100644
--- a/mod/tigron/test/command.go
+++ b/mod/tigron/test/command.go
@@ -65,6 +65,7 @@ type CustomizableCommand interface {
 	// Note that this will override any variable defined in the embedding environment
 	withEnv(env map[string]string)
 	// withTempDir specifies a temporary directory to use
+	// FIXME: this is only required because of the current command extension mechanism
 	withTempDir(path string)
 	// WithConfig allows passing custom config properties from the test to the base command
 	withConfig(config Config)
diff --git a/mod/tigron/test/consts.go b/mod/tigron/test/consts.go
new file mode 100644
index 00000000000..a54b54a9e55
--- /dev/null
+++ b/mod/tigron/test/consts.go
@@ -0,0 +1,26 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package test
+
+const (
+	// FilePermissionsDefault specifies the default creation mode for temporary files.
+	// Note that umask will affect these.
+	FilePermissionsDefault = 0o644
+	// DirPermissionsDefault specifies the default creation mode for temporary directories.
+	// Note that umask will affect these.
+	DirPermissionsDefault = 0o755
+)
diff --git a/mod/tigron/test/data.go b/mod/tigron/test/data.go
index 8907b9ca199..d5583d60b2d 100644
--- a/mod/tigron/test/data.go
+++ b/mod/tigron/test/data.go
@@ -19,9 +19,13 @@ package test
 import (
 	"crypto/sha256"
 	"fmt"
+	"os"
+	"path/filepath"
 	"regexp"
 	"strings"
-	"testing"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
+	"github.com/containerd/nerdctl/mod/tigron/tig"
 )
 
 const (
@@ -30,79 +34,181 @@ const (
 	identifierSignatureLength = 8
 )
 
-// WithData returns a data object with a certain key value set.
-func WithData(key, value string) Data {
-	dat := &data{}
-	dat.Set(key, value)
+// WithLabels returns a Data object with specific key value labels set.
+func WithLabels(in map[string]string) Data {
+	dat := &data{
+		labels: &labels{
+			inMap: in,
+		},
+		temp: &temp{},
+	}
 
 	return dat
 }
 
-// Contains the implementation of the Data interface.
-func configureData(t *testing.T, seedData, parent Data) Data {
-	t.Helper()
+type labels struct {
+	inMap map[string]string
+}
 
-	if seedData == nil {
-		seedData = &data{}
-	}
+func (lb *labels) Get(key string) string {
+	return lb.inMap[key]
+}
 
-	//nolint:forcetypeassert
-	dat := &data{
-		// Note: implementation dependent
-		labels:  seedData.(*data).labels,
-		tempDir: t.TempDir(),
-		testID: func(suffix ...string) string {
-			suffix = append([]string{t.Name()}, suffix...)
+func (lb *labels) Set(key, value string) {
+	lb.inMap[key] = value
+}
 
-			return defaultIdentifierHashing(suffix...)
-		},
-	}
+type temp struct {
+	tempDir string
+	t       tig.T
+}
 
-	if parent != nil {
-		dat.adopt(parent)
-	}
+func (tp *temp) Load(key ...string) string {
+	tp.t.Helper()
 
-	return dat
+	pth := filepath.Join(append([]string{tp.tempDir}, key...)...)
+
+	//nolint:gosec // Fine in the context of testing
+	content, err := os.ReadFile(pth)
+
+	assertive.ErrorIsNil(
+		assertive.WithSilentSuccess(tp.t),
+		err,
+		fmt.Sprintf("Loading file %q must succeed", pth),
+	)
+
+	return string(content)
 }
 
-type data struct {
-	labels  map[string]string
-	testID  func(suffix ...string) string
-	tempDir string
+func (tp *temp) Exists(key ...string) {
+	tp.t.Helper()
+
+	pth := filepath.Join(append([]string{tp.tempDir}, key...)...)
+
+	_, err := os.Stat(pth)
+
+	assertive.ErrorIsNil(
+		assertive.WithSilentSuccess(tp.t),
+		err,
+		fmt.Sprintf("File %q must exist", pth),
+	)
 }
 
-func (dt *data) Get(key string) string {
-	return dt.labels[key]
+func (tp *temp) Save(value string, key ...string) string {
+	tp.t.Helper()
+
+	tp.Dir(key[:len(key)-1]...)
+
+	pth := filepath.Join(append([]string{tp.tempDir}, key...)...)
+
+	err := os.WriteFile(
+		pth,
+		[]byte(value),
+		FilePermissionsDefault,
+	)
+
+	assertive.ErrorIsNil(
+		assertive.WithSilentSuccess(tp.t),
+		err,
+		fmt.Sprintf("Saving file %q must succeed", filepath.Join(key...)),
+	)
+
+	return pth
 }
 
-func (dt *data) Set(key, value string) Data {
-	if dt.labels == nil {
-		dt.labels = map[string]string{}
-	}
+func (tp *temp) Dir(key ...string) string {
+	tp.t.Helper()
+
+	pth := filepath.Join(append([]string{tp.tempDir}, key...)...)
+	err := os.MkdirAll(pth, DirPermissionsDefault)
+
+	assertive.ErrorIsNil(
+		assertive.WithSilentSuccess(tp.t),
+		err,
+		fmt.Sprintf("Creating directory %q must succeed", pth),
+	)
+
+	return pth
+}
+
+func (tp *temp) Path(key ...string) string {
+	tp.t.Helper()
 
-	dt.labels[key] = value
+	return filepath.Join(append([]string{tp.tempDir}, key...)...)
+}
 
-	return dt
+type data struct {
+	temp   DataTemp
+	labels DataLabels
+	testID func(suffix ...string) string
 }
 
 func (dt *data) Identifier(suffix ...string) string {
 	return dt.testID(suffix...)
 }
 
-func (dt *data) TempDir() string {
-	return dt.tempDir
+func (dt *data) Labels() DataLabels {
+	return dt.labels
 }
 
-func (dt *data) adopt(parent Data) {
-	// Note: implementation dependent
-	if castData, ok := parent.(*data); ok {
-		for k, v := range castData.labels {
+func (dt *data) Temp() DataTemp {
+	return dt.temp
+}
+
+// Contains the implementation of the Data interface
+//
+//nolint:varnamelen
+func newData(t tig.T, seed, parent Data) Data {
+	t.Helper()
+
+	t = assertive.WithSilentSuccess(t)
+
+	seedMap := map[string]string{}
+
+	if seed != nil {
+		if inLab, ok := seed.Labels().(*labels); ok {
+			seedMap = inLab.inMap
+		}
+	}
+
+	if parent != nil {
+		for k, v := range parent.Labels().(*labels).inMap {
 			// Only copy keys that are not set already
-			if _, ok := dt.labels[k]; !ok {
-				dt.Set(k, v)
+			if _, ok := seedMap[k]; !ok {
+				seedMap[k] = v
 			}
 		}
 	}
+
+	// NOTE: certain systems will use the path dirname to decide how they name resources.
+	// t.TempDir() will always return /tmp/TestTempDir2153252249/001, meaning these systems will all
+	// use the identical 001 part. This is true for compose specifically.
+	// Appending the base test identifier here would guarantee better unicity.
+	// Note though that Windows will barf if >256 characters, so, hashing...
+	// Small caveat: identically named tests in different modules WILL still end-up with the same last segment.
+	tempDir := filepath.Join(
+		t.TempDir(),
+		fmt.Sprintf("%x", sha256.Sum256([]byte(t.Name())))[0:identifierSignatureLength],
+	)
+
+	assertive.ErrorIsNil(t, os.MkdirAll(tempDir, DirPermissionsDefault))
+
+	dat := &data{
+		labels: &labels{
+			inMap: seedMap,
+		},
+		temp: &temp{
+			tempDir: tempDir,
+			t:       t,
+		},
+		testID: func(suffix ...string) string {
+			suffix = append([]string{t.Name()}, suffix...)
+
+			return defaultIdentifierHashing(suffix...)
+		},
+	}
+
+	return dat
 }
 
 func defaultIdentifierHashing(names ...string) string {
diff --git a/mod/tigron/test/data_test.go b/mod/tigron/test/data_test.go
index dff839d6026..37e0c1c010b 100644
--- a/mod/tigron/test/data_test.go
+++ b/mod/tigron/test/data_test.go
@@ -24,34 +24,45 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
 )
 
-func TestDataBasic(t *testing.T) {
+func TestLabels(t *testing.T) {
 	t.Parallel()
 
-	dataObj := WithData("test", "create")
+	dataLabels := WithLabels(map[string]string{"test": "create"}).Labels()
 
-	assertive.IsEqual(t, dataObj.Get("test"), "create")
-	assertive.IsEqual(t, dataObj.Get("doesnotexist"), "")
+	assertive.IsEqual(t, dataLabels.Get("test"), "create")
+	assertive.IsEqual(t, dataLabels.Get("doesnotexist"), "")
 
-	dataObj.Set("test", "set")
-	assertive.IsEqual(t, dataObj.Get("test"), "set")
+	dataLabels.Set("test", "set")
+	assertive.IsEqual(t, dataLabels.Get("test"), "set")
+
+	dataLabels.Set("test", "reset")
+	assertive.IsEqual(t, dataLabels.Get("test"), "reset")
 }
 
-func TestDataTempDir(t *testing.T) {
+func TestTemp(t *testing.T) {
 	t.Parallel()
 
-	dataObj := configureData(t, nil, nil)
+	dataObj := newData(t, nil, nil)
 
-	one := dataObj.TempDir()
-	two := dataObj.TempDir()
+	one := dataObj.Temp().Path()
+	two := dataObj.Temp().Path()
 
 	assertive.IsEqual(t, one, two)
 	assertive.IsNotEqual(t, one, "")
+
+	t.Run("verify that subtest has an independent TempDir", func(t *testing.T) {
+		t.Parallel()
+
+		dataObj = newData(t, nil, nil)
+		three := dataObj.Temp().Path()
+		assertive.IsNotEqual(t, one, three)
+	})
 }
 
 func TestDataIdentifier(t *testing.T) {
 	t.Parallel()
 
-	dataObj := configureData(t, nil, nil)
+	dataObj := newData(t, nil, nil)
 
 	one := dataObj.Identifier()
 	two := dataObj.Identifier()
@@ -68,7 +79,7 @@ func TestDataIdentifierThatIsReallyReallyReallyReallyReallyReallyReallyReallyRea
 ) {
 	t.Parallel()
 
-	dataObj := configureData(t, nil, nil)
+	dataObj := newData(t, nil, nil)
 
 	one := dataObj.Identifier()
 	two := dataObj.Identifier()
diff --git a/mod/tigron/test/funct.go b/mod/tigron/test/funct.go
index 8614b9cbefb..45b4abbd9d9 100644
--- a/mod/tigron/test/funct.go
+++ b/mod/tigron/test/funct.go
@@ -25,8 +25,11 @@ type Evaluator func(data Data, helpers Helpers) (bool, string)
 // or Requirement.
 type Butler func(data Data, helpers Helpers)
 
+// TODO: when we will break API:
+// - remove the info parameter
+// - move to tig.T
+
 // A Comparator is the function signature to implement for the Output property of an Expected.
-// TODO: when we will break API, remove the info parameter.
 type Comparator func(stdout, info string, t *testing.T)
 
 // A Manager is the function signature meant to produce expectations for a command.
diff --git a/mod/tigron/test/interfaces.go b/mod/tigron/test/interfaces.go
index 07f348999c5..09b0abf84fa 100644
--- a/mod/tigron/test/interfaces.go
+++ b/mod/tigron/test/interfaces.go
@@ -23,22 +23,44 @@ import (
 	"time"
 )
 
-// Data is meant to hold information about a test:
-// - first, any random key value data that the test implementer wants to carry / modify - this is
-// test data - second, some commonly useful immutable test properties (a way to generate unique
-// identifiers for that test, temporary directory, etc.)
-// Note that Data is inherited, from parent test to subtest (except for Identifier and TempDir of
-// course).
-type Data interface {
-	// Get returns the value of a certain key for custom data
+// DataLabels holds key-value test information set by the test authors.
+// Note that retrieving a non-existent label will return the empty string.
+type DataLabels interface {
+	// Get returns the value of the requested label.
 	Get(key string) string
-	// Set will save `value` for `key`
-	Set(key, value string) Data
+	// Set will save the label `key` with `value`.
+	Set(key, value string)
+}
 
-	// Identifier returns the test identifier that can be used to name resources
+// DataTemp allows test authors to easily manipulate test fixtures / temporary files.
+type DataTemp interface {
+	// Load will retrieve the content stored in the file
+	// Asserts on failure.
+	Load(key ...string) string
+	// Save will store the content in the file, ensuring parent dir exists, and return the path.
+	// Asserts on failure.
+	Save(data string, key ...string) string
+	// Path will return the absolute path for the asset, whether it exists or not.
+	Path(key ...string) string
+	// Exists asserts that the object exist.
+	Exists(key ...string)
+	// Dir ensures the directory under temp is created, and returns the path.
+	// Asserts on failure.
+	Dir(key ...string) string
+}
+
+// Data is meant to hold information about a test:
+// - first, key-value data that the test implementer wants to carry around - this is Labels()
+// - second, some commonly useful immutable test properties (eg: a way to generate unique
+// identifiers for that test)
+// - third, ability to manipulate test files inside managed temporary directories
+// Note that Data Labels are inherited from parent test to subtest.
+// This is not true for Identifier and Temp().Dir(), which are bound to the test itself, though temporary files
+// can be accessed by subtests if their location is passed around (in Labels).
+type Data interface {
+	Temp() DataTemp
+	Labels() DataLabels
 	Identifier(suffix ...string) string
-	// TempDir returns the test temporary directory
-	TempDir() string
 }
 
 // Helpers provides a set of helpers to run commands with simple expectations,

From 0d492a27bc29eb8b1e7bc51be4ee9a0a854dcaca Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 16 Apr 2025 14:09:44 -0700
Subject: [PATCH 091/225] Update tests to use modified tigron

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .../builder/builder_build_oci_layout_test.go  |  51 +-
 cmd/nerdctl/builder/builder_build_test.go     | 518 +++++++++---------
 cmd/nerdctl/builder/builder_builder_test.go   |  49 +-
 cmd/nerdctl/completion/completion_test.go     |  14 +-
 .../container/container_commit_linux_test.go  |   4 +-
 .../container/container_create_linux_test.go  |  28 +-
 .../container/container_create_test.go        |  14 +-
 .../container/container_exec_linux_test.go    |  10 +-
 .../container/container_inspect_linux_test.go |   4 +-
 .../container/container_restart_linux_test.go |   4 +-
 .../container_run_cgroup_linux_test.go        |  18 +-
 .../container_run_network_linux_test.go       |  42 +-
 cmd/nerdctl/container/container_stats_test.go |  10 +-
 cmd/nerdctl/container/container_top_test.go   |   6 +-
 cmd/nerdctl/image/image_convert_linux_test.go |  10 +-
 cmd/nerdctl/image/image_encrypt_linux_test.go |  12 +-
 cmd/nerdctl/image/image_history_test.go       |   2 +-
 cmd/nerdctl/image/image_list_test.go          |  36 +-
 cmd/nerdctl/image/image_load_test.go          |   8 +-
 cmd/nerdctl/image/image_prune_test.go         |  18 +-
 cmd/nerdctl/image/image_pull_linux_test.go    |  34 +-
 cmd/nerdctl/image/image_push_linux_test.go    |  68 +--
 cmd/nerdctl/image/image_remove_test.go        |  14 +-
 cmd/nerdctl/image/image_save_test.go          |  36 +-
 cmd/nerdctl/ipfs/ipfs_compose_linux_test.go   |  30 +-
 cmd/nerdctl/ipfs/ipfs_kubo_linux_test.go      |  26 +-
 cmd/nerdctl/ipfs/ipfs_registry_linux_test.go  |  30 +-
 cmd/nerdctl/ipfs/ipfs_simple_linux_test.go    |  84 +--
 cmd/nerdctl/main_test_test.go                 |  18 +-
 .../network/network_create_linux_test.go      |  12 +-
 cmd/nerdctl/network/network_inspect_test.go   |  20 +-
 .../network/network_list_linux_test.go        |  20 +-
 .../network/network_remove_linux_test.go      |  28 +-
 .../system/system_events_linux_test.go        |  42 +-
 cmd/nerdctl/system/system_prune_linux_test.go |   6 +-
 cmd/nerdctl/volume/volume_inspect_test.go     |  34 +-
 cmd/nerdctl/volume/volume_list_test.go        |  78 +--
 cmd/nerdctl/volume/volume_namespace_test.go   |  24 +-
 cmd/nerdctl/volume/volume_prune_linux_test.go |  48 +-
 .../volume/volume_remove_linux_test.go        |   6 +-
 pkg/testutil/nerdtest/ca/ca.go                |   3 +-
 pkg/testutil/nerdtest/command.go              |   4 +-
 pkg/testutil/nerdtest/registry/cesanta.go     |  13 +-
 pkg/testutil/nerdtest/registry/common.go      |   6 +-
 pkg/testutil/nerdtest/registry/docker.go      |   2 +-
 pkg/testutil/nerdtest/requirements.go         |   4 +-
 pkg/testutil/nerdtest/utilities.go            |  53 +-
 47 files changed, 790 insertions(+), 811 deletions(-)

diff --git a/cmd/nerdctl/builder/builder_build_oci_layout_test.go b/cmd/nerdctl/builder/builder_build_oci_layout_test.go
index 93cc4152284..758675e85a1 100644
--- a/cmd/nerdctl/builder/builder_build_oci_layout_test.go
+++ b/cmd/nerdctl/builder/builder_build_oci_layout_test.go
@@ -18,13 +18,13 @@ package builder
 
 import (
 	"fmt"
-	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
 	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
@@ -44,17 +44,17 @@ func TestBuildContextWithOCILayout(t *testing.T) {
 		),
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			if nerdtest.IsDocker() {
-				helpers.Anyhow("buildx", "stop", data.Identifier("-container"))
-				helpers.Anyhow("buildx", "rm", "--force", data.Identifier("-container"))
+				helpers.Anyhow("buildx", "stop", data.Identifier("container"))
+				helpers.Anyhow("buildx", "rm", "--force", data.Identifier("container"))
 			}
-			helpers.Anyhow("rmi", "-f", data.Identifier("-parent"))
-			helpers.Anyhow("rmi", "-f", data.Identifier("-child"))
+			helpers.Anyhow("rmi", "-f", data.Identifier("parent"))
+			helpers.Anyhow("rmi", "-f", data.Identifier("child"))
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
 			// Default docker driver does not support OCI exporter.
 			// Reference: https://docs.docker.com/build/exporters/oci-docker/
 			if nerdtest.IsDocker() {
-				name := data.Identifier("-container")
+				name := data.Identifier("container")
 				helpers.Ensure("buildx", "create", "--name", name, "--driver=docker-container")
 				dockerBuilderArgs = []string{"buildx", "--builder", name}
 			}
@@ -63,25 +63,21 @@ func TestBuildContextWithOCILayout(t *testing.T) {
 LABEL layer=oci-layout-parent
 CMD ["echo", "test-nerdctl-build-context-oci-layout-parent"]`, testutil.CommonImage)
 
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
+			data.Temp().Save(dockerfile, "Dockerfile")
+			dest := data.Temp().Dir("parent")
+			tarPath := data.Temp().Path("parent.tar")
 
-			tarPath := filepath.Join(buildCtx, "parent.tar")
-			dest := filepath.Join(buildCtx, "parent")
-			assert.NilError(helpers.T(), os.MkdirAll(dest, 0o700))
-			helpers.Ensure("build", buildCtx, "--tag", data.Identifier("-parent"))
-			helpers.Ensure("image", "save", "--output", tarPath, data.Identifier("-parent"))
-			helpers.Custom("tar", "Cxf", dest, tarPath).Run(&test.Expected{})
+			helpers.Ensure("build", data.Temp().Path(), "--tag", data.Identifier("parent"))
+			helpers.Ensure("image", "save", "--output", tarPath, data.Identifier("parent"))
+			helpers.Custom("tar", "Cxf", dest, tarPath).Run(&test.Expected{
+				ExitCode: expect.ExitCodeSuccess,
+			})
 		},
 
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			dockerfile := `FROM parent
 CMD ["echo", "test-nerdctl-build-context-oci-layout"]`
-
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
+			data.Temp().Save(dockerfile, "Dockerfile")
 
 			var cmd test.TestableCommand
 			if nerdtest.IsDocker() {
@@ -89,7 +85,13 @@ CMD ["echo", "test-nerdctl-build-context-oci-layout"]`
 			} else {
 				cmd = helpers.Command()
 			}
-			cmd.WithArgs("build", buildCtx, fmt.Sprintf("--build-context=parent=oci-layout://%s", filepath.Join(buildCtx, "parent")), "--tag", data.Identifier("-child"))
+			cmd.WithArgs(
+				"build",
+				data.Temp().Path(),
+				fmt.Sprintf("--build-context=parent=oci-layout://%s", filepath.Join(data.Temp().Path(), "parent")),
+				"--tag",
+				data.Identifier("child"),
+			)
 			if nerdtest.IsDocker() {
 				// Need to load the container image from the builder to be able to run it.
 				cmd.WithArgs("--load")
@@ -99,7 +101,14 @@ CMD ["echo", "test-nerdctl-build-context-oci-layout"]`
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
 				Output: func(stdout string, info string, t *testing.T) {
-					assert.Assert(t, strings.Contains(helpers.Capture("run", "--rm", data.Identifier("-child")), "test-nerdctl-build-context-oci-layout"), info)
+					assert.Assert(
+						t,
+						strings.Contains(
+							helpers.Capture("run", "--rm", data.Identifier("child")),
+							"test-nerdctl-build-context-oci-layout",
+						),
+						info,
+					)
 				},
 			}
 		},
diff --git a/cmd/nerdctl/builder/builder_build_test.go b/cmd/nerdctl/builder/builder_build_test.go
index e4999a927ee..3260be3e4ba 100644
--- a/cmd/nerdctl/builder/builder_build_test.go
+++ b/cmd/nerdctl/builder/builder_build_test.go
@@ -19,8 +19,6 @@ package builder
 import (
 	"errors"
 	"fmt"
-	"os"
-	"path/filepath"
 	"runtime"
 	"strings"
 	"testing"
@@ -39,23 +37,20 @@ import (
 func TestBuildBasics(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
-			err := os.WriteFile(filepath.Join(data.TempDir(), "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", data.TempDir())
-		},
-		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rmi", "-f", data.Identifier())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Labels().Set("buildCtx", data.Temp().Path())
 		},
 		SubTests: []*test.Case{
 			{
 				Description: "Successfully build with 'tag first', 'buildctx second'",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", "-t", data.Identifier(), data.Get("buildCtx"))
+					helpers.Ensure("build", "-t", data.Identifier(), data.Labels().Get("buildCtx"))
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -63,12 +58,12 @@ CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 			{
 				Description: "Successfully build with 'buildctx first', 'tag second'",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "-t", data.Identifier())
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -76,12 +71,18 @@ CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 			{
 				Description: "Successfully build with output docker, main tag still works",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "-t", data.Identifier(), "--output=type=docker,name="+data.Identifier("ignored"))
+					helpers.Ensure(
+						"build",
+						data.Labels().Get("buildCtx"),
+						"-t",
+						data.Identifier(),
+						"--output=type=docker,name="+data.Identifier("ignored"),
+					)
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -89,18 +90,24 @@ CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 			{
 				Description: "Successfully build with output docker, name cannot be used",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "-t", data.Identifier(), "--output=type=docker,name="+data.Identifier("ignored"))
+					helpers.Ensure(
+						"build",
+						data.Labels().Get("buildCtx"),
+						"-t",
+						data.Identifier(),
+						"--output=type=docker,name="+data.Identifier("ignored"),
+					)
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier("ignored"))
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					helpers.Anyhow("rmi", "-f", data.Identifier())
+					helpers.Anyhow("rmi", "-f", data.Identifier("ignored"))
 				},
 				Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 			},
@@ -122,32 +129,39 @@ func TestCanBuildOnOtherPlatform(t *testing.T) {
 			can, err := platformutil.CanExecProbably("linux/" + candidateArch)
 			assert.NilError(helpers.T(), err)
 
-			data.Set("OS", "linux")
-			data.Set("Architecture", candidateArch)
+			data.Labels().Set("OS", "linux")
+			data.Labels().Set("Architecture", candidateArch)
 			return can, "Current environment does not support emulation"
 		},
 	}
 
+	dockerfile := fmt.Sprintf(`FROM %s
+RUN echo hello > /hello
+CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: require.All(
 			nerdtest.Build,
 			requireEmulation,
 		),
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-RUN echo hello > /hello
-CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
-			err := os.WriteFile(filepath.Join(data.TempDir(), "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", data.TempDir())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Labels().Set("buildCtx", data.Temp().Path())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("build", data.Get("buildCtx"), "--platform", fmt.Sprintf("%s/%s", data.Get("OS"), data.Get("Architecture")), "-t", data.Identifier())
+			return helpers.Command(
+				"build",
+				data.Labels().Get("buildCtx"),
+				"--platform",
+				fmt.Sprintf("%s/%s", data.Labels().Get("OS"), data.Labels().Get("Architecture")),
+				"-t",
+				data.Identifier(),
+			)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
-		Expected: test.Expects(0, nil, nil),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 	}
 
 	testCase.Run(t)
@@ -168,21 +182,19 @@ func TestBuildBaseImage(t *testing.T) {
 			dockerfile := fmt.Sprintf(`FROM %s
 RUN echo hello > /hello
 CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
-			err := os.WriteFile(filepath.Join(data.TempDir(), "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", "-t", data.Identifier("first"), data.TempDir())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			helpers.Ensure("build", "-t", data.Identifier("first"), data.Temp().Path())
 
 			dockerfileSecond := fmt.Sprintf(`FROM %s
 RUN echo hello2 > /hello2
 CMD ["cat", "/hello2"]`, data.Identifier("first"))
-			err = os.WriteFile(filepath.Join(data.TempDir(), "Dockerfile"), []byte(dockerfileSecond), 0644)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", "-t", data.Identifier("second"), data.TempDir())
+			data.Temp().Save(dockerfileSecond, "Dockerfile")
+			helpers.Ensure("build", "-t", data.Identifier("second"), data.Temp().Path())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			return helpers.Command("run", "--rm", data.Identifier("second"))
 		},
-		Expected: test.Expects(0, nil, expect.Equals("hello2\n")),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("hello2\n")),
 	}
 
 	testCase.Run(t)
@@ -209,14 +221,13 @@ func TestBuildFromContainerd(t *testing.T) {
 			dockerfile := fmt.Sprintf(`FROM %s
 RUN echo hello2 > /hello2
 CMD ["cat", "/hello2"]`, data.Identifier("first"))
-			err := os.WriteFile(filepath.Join(data.TempDir(), "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", "-t", data.Identifier("second"), data.TempDir())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			helpers.Ensure("build", "-t", data.Identifier("second"), data.Temp().Path())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			return helpers.Command("run", "--rm", data.Identifier("second"))
 		},
-		Expected: test.Expects(0, nil, expect.Equals("hello2\n")),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("hello2\n")),
 	}
 
 	testCase.Run(t)
@@ -225,14 +236,15 @@ CMD ["cat", "/hello2"]`, data.Identifier("first"))
 func TestBuildFromStdin(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-stdin"]`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-stdin"]`, testutil.CommonImage)
 			cmd := helpers.Command("build", "-t", data.Identifier(), "-f", "-", ".")
 			cmd.Feed(strings.NewReader(dockerfile))
 			return cmd
@@ -250,21 +262,15 @@ CMD ["echo", "nerdctl-build-test-stdin"]`, testutil.CommonImage)
 func TestBuildWithDockerfile(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-dockerfile"]
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
-		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rmi", "-f", data.Identifier())
-		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-dockerfile"]
-	`, testutil.CommonImage)
-			buildCtx := filepath.Join(data.TempDir(), "test")
-			err := os.MkdirAll(buildCtx, 0755)
-			assert.NilError(helpers.T(), err)
-			err = os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Temp().Save(dockerfile, "test", "Dockerfile")
+			data.Labels().Set("buildCtx", data.Temp().Path("test"))
 		},
 		SubTests: []*test.Case{
 			{
@@ -274,10 +280,10 @@ CMD ["echo", "nerdctl-build-test-dockerfile"]
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					cmd := helpers.Command("build", "-t", data.Identifier(), "-f", "Dockerfile", "..")
-					cmd.WithCwd(data.Get("buildCtx"))
+					cmd.WithCwd(data.Labels().Get("buildCtx"))
 					return cmd
 				},
-				Expected: test.Expects(0, nil, nil),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 			},
 			{
 				Description: "Dockerfile .",
@@ -286,16 +292,16 @@ CMD ["echo", "nerdctl-build-test-dockerfile"]
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					cmd := helpers.Command("build", "-t", data.Identifier(), "-f", "Dockerfile", ".")
-					cmd.WithCwd(data.Get("buildCtx"))
+					cmd.WithCwd(data.Labels().Get("buildCtx"))
 					return cmd
 				},
-				Expected: test.Expects(0, nil, nil),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 			},
 			{
 				Description: "../Dockerfile .",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					cmd := helpers.Command("build", "-t", data.Identifier(), "-f", "../Dockerfile", ".")
-					cmd.WithCwd(data.Get("buildCtx"))
+					cmd.WithCwd(data.Labels().Get("buildCtx"))
 					return cmd
 				},
 				Expected: test.Expects(1, nil, nil),
@@ -312,53 +318,41 @@ func TestBuildLocal(t *testing.T) {
 	const testFileName = "nerdctl-build-test"
 	const testContent = "nerdctl"
 
+	dockerfile := fmt.Sprintf(`FROM scratch
+COPY %s /`, testFileName)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM scratch
-COPY %s /`, testFileName)
-
-			err := os.WriteFile(filepath.Join(data.TempDir(), "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-
-			err = os.WriteFile(filepath.Join(data.TempDir(), testFileName), []byte(testContent), 0644)
-			assert.NilError(helpers.T(), err)
-
-			data.Set("buildCtx", data.TempDir())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Temp().Save(testContent, testFileName)
+			data.Labels().Set("buildCtx", data.Temp().Path())
 		},
 		SubTests: []*test.Case{
 			{
-				Description: "destination 1",
+				// GOTCHA: avoid comma and = in the test name, or buildctl will misparse the destination direction
+				Description: "-o type local destination DIR: verify the file copied from context is in the output directory",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("build", "-o", fmt.Sprintf("type=local,dest=%s", data.TempDir()), data.Get("buildCtx"))
+					return helpers.Command("build", "-o", fmt.Sprintf("type=local,dest=%s", data.Temp().Path()), data.Labels().Get("buildCtx"))
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: func(stdout string, info string, t *testing.T) {
-							testFilePath := filepath.Join(data.TempDir(), testFileName)
-							_, err := os.Stat(testFilePath)
-							assert.NilError(helpers.T(), err, info)
-							dt, err := os.ReadFile(testFilePath)
-							assert.NilError(helpers.T(), err, info)
-							assert.Equal(helpers.T(), string(dt), testContent, info)
+						Output: func(stdout, info string, t *testing.T) {
+							// Expecting testFileName to exist inside the output target directory
+							assert.Equal(t, data.Temp().Load(testFileName), testContent, "file content is identical")
 						},
 					}
 				},
 			},
 			{
-				Description: "destination 2",
+				Description: "-o DIR: verify the file copied from context is in the output directory",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("build", "-o", data.TempDir(), data.Get("buildCtx"))
+					return helpers.Command("build", "-o", data.Temp().Path(), data.Labels().Get("buildCtx"))
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: func(stdout string, info string, t *testing.T) {
-							testFilePath := filepath.Join(data.TempDir(), testFileName)
-							_, err := os.Stat(testFilePath)
-							assert.NilError(helpers.T(), err, info)
-							dt, err := os.ReadFile(testFilePath)
-							assert.NilError(helpers.T(), err, info)
-							assert.Equal(helpers.T(), string(dt), testContent, info)
+						Output: func(stdout, info string, t *testing.T) {
+							assert.Equal(t, data.Temp().Load(testFileName), testContent, "file content is identical")
 						},
 					}
 				},
@@ -372,27 +366,26 @@ COPY %s /`, testFileName)
 func TestBuildWithBuildArg(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+ARG TEST_STRING=1
+ENV TEST_STRING=$TEST_STRING
+CMD echo $TEST_STRING
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-ARG TEST_STRING=1
-ENV TEST_STRING=$TEST_STRING
-CMD echo $TEST_STRING
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Labels().Set("buildCtx", data.Temp().Path())
 		},
 		SubTests: []*test.Case{
 			{
 				Description: "No args",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "-t", data.Identifier())
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -400,12 +393,12 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("1\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("1\n")),
 			},
 			{
 				Description: "ArgValueOverridesDefault",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "--build-arg", "TEST_STRING=2", "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "--build-arg", "TEST_STRING=2", "-t", data.Identifier())
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -413,12 +406,12 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("2\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("2\n")),
 			},
 			{
 				Description: "EmptyArgValueOverridesDefault",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "--build-arg", "TEST_STRING=", "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "--build-arg", "TEST_STRING=", "-t", data.Identifier())
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -426,12 +419,12 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("\n")),
 			},
 			{
 				Description: "UnsetArgKeyPreservesDefault",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "--build-arg", "TEST_STRING", "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "--build-arg", "TEST_STRING", "-t", data.Identifier())
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -439,7 +432,7 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("1\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("1\n")),
 			},
 			{
 				Description: "EnvValueOverridesDefault",
@@ -447,7 +440,7 @@ CMD echo $TEST_STRING
 					"TEST_STRING": "3",
 				},
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "--build-arg", "TEST_STRING", "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "--build-arg", "TEST_STRING", "-t", data.Identifier())
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -455,7 +448,7 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("3\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("3\n")),
 			},
 			{
 				Description: "EmptyEnvValueOverridesDefault",
@@ -463,7 +456,7 @@ CMD echo $TEST_STRING
 					"TEST_STRING": "",
 				},
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "--build-arg", "TEST_STRING", "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "--build-arg", "TEST_STRING", "-t", data.Identifier())
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -471,7 +464,7 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("\n")),
 			},
 		},
 	}
@@ -482,27 +475,24 @@ CMD echo $TEST_STRING
 func TestBuildWithIIDFile(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-string"]
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-string"]
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", buildCtx, "--iidfile", filepath.Join(data.TempDir(), "id.txt"), "-t", data.Identifier())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			helpers.Ensure("build", data.Temp().Path(), "--iidfile", data.Temp().Path("id.txt"), "-t", data.Identifier())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			imageID, err := os.ReadFile(filepath.Join(data.TempDir(), "id.txt"))
-			assert.NilError(helpers.T(), err)
-			return helpers.Command("run", "--rm", string(imageID))
+			return helpers.Command("run", "--rm", data.Temp().Load("id.txt"))
 		},
 
-		Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 	}
 
 	testCase.Run(t)
@@ -511,25 +501,24 @@ CMD ["echo", "nerdctl-build-test-string"]
 func TestBuildWithLabels(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+LABEL name=nerdctl-build-test-label
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-LABEL name=nerdctl-build-test-label
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", buildCtx, "--label", "label=test", "-t", data.Identifier())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			helpers.Ensure("build", data.Temp().Path(), "--label", "label=test", "-t", data.Identifier())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			return helpers.Command("inspect", data.Identifier(), "--format", "{{json .Config.Labels }}")
 		},
 
-		Expected: test.Expects(0, nil, expect.Equals("{\"label\":\"test\",\"name\":\"nerdctl-build-test-label\"}\n")),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("{\"label\":\"test\",\"name\":\"nerdctl-build-test-label\"}\n")),
 	}
 
 	testCase.Run(t)
@@ -538,49 +527,54 @@ LABEL name=nerdctl-build-test-label
 func TestBuildMultipleTags(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-string"]
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
-		Data: test.WithData("i1", "image").
-			Set("i2", "image2").
-			Set("i3", "image3:hello"),
 		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rmi", "-f", data.Get("i1"))
-			helpers.Anyhow("rmi", "-f", data.Get("i2"))
-			helpers.Anyhow("rmi", "-f", data.Get("i3"))
+			helpers.Anyhow("rmi", "-f", data.Labels().Get("i1"))
+			helpers.Anyhow("rmi", "-f", data.Labels().Get("i2"))
+			helpers.Anyhow("rmi", "-f", data.Labels().Get("i3"))
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-string"]
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", buildCtx, "-t", data.Get("i1"), "-t", data.Get("i2"), "-t", data.Get("i3"))
+			data.Labels().Set("i1", data.Identifier("image"))
+			data.Labels().Set("i2", data.Identifier("image2"))
+			data.Labels().Set("i3", data.Identifier("image3")+":hello")
+			data.Temp().Save(dockerfile, "Dockerfile")
+			helpers.Ensure(
+				"build",
+				data.Temp().Path(),
+				"-t", data.Labels().Get("i1"),
+				"-t", data.Labels().Get("i2"),
+				"-t", data.Labels().Get("i3"),
+			)
 		},
 		SubTests: []*test.Case{
 			{
 				Description: "i1",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("run", "--rm", data.Get("i1"))
+					return helpers.Command("run", "--rm", data.Labels().Get("i1"))
 				},
 
-				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 			{
 				Description: "i2",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("run", "--rm", data.Get("i2"))
+					return helpers.Command("run", "--rm", data.Labels().Get("i2"))
 				},
 
-				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 			{
 				Description: "i3",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("run", "--rm", data.Get("i3"))
+					return helpers.Command("run", "--rm", data.Labels().Get("i3"))
 				},
 
-				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 		},
 	}
@@ -591,6 +585,10 @@ CMD ["echo", "nerdctl-build-test-string"]
 func TestBuildWithContainerfile(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-string"]
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: require.All(
 			nerdtest.Build,
@@ -600,18 +598,13 @@ func TestBuildWithContainerfile(t *testing.T) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-string"]
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Containerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", buildCtx, "-t", data.Identifier())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			helpers.Ensure("build", data.Temp().Path(), "-t", data.Identifier())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			return helpers.Command("run", "--rm", data.Identifier())
 		},
-		Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 	}
 
 	testCase.Run(t)
@@ -629,20 +622,19 @@ func TestBuildWithDockerFileAndContainerfile(t *testing.T) {
 			dockerfile := fmt.Sprintf(`FROM %s
 CMD ["echo", "dockerfile"]
 	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
+			data.Temp().Save(dockerfile, "Dockerfile")
+
 			dockerfile = fmt.Sprintf(`FROM %s
 CMD ["echo", "containerfile"]
 	`, testutil.CommonImage)
-			err = os.WriteFile(filepath.Join(buildCtx, "Containerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", buildCtx, "-t", data.Identifier())
+			data.Temp().Save(dockerfile, "Containerfile")
+
+			helpers.Ensure("build", data.Temp().Path(), "-t", data.Identifier())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			return helpers.Command("run", "--rm", data.Identifier())
 		},
-		Expected: test.Expects(0, nil, expect.Equals("dockerfile\n")),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("dockerfile\n")),
 	}
 
 	testCase.Run(t)
@@ -651,6 +643,10 @@ CMD ["echo", "containerfile"]
 func TestBuildNoTag(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-string"]
+	`, testutil.CommonImage)
+
 	// FIXME: this test should be rewritten and instead get the image id from the build, then query the image explicitly - instead of pruning / noparallel
 	testCase := &test.Case{
 		NoParallel: true,
@@ -659,16 +655,13 @@ func TestBuildNoTag(t *testing.T) {
 			helpers.Ensure("image", "prune", "--force", "--all")
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-string"]
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", buildCtx)
+			data.Temp().Save(dockerfile, "Dockerfile")
+
+			// XXX FIXME
+			helpers.Capture("build", data.Temp().Path())
 		},
 		Command:  test.Command("images"),
-		Expected: test.Expects(0, nil, expect.Contains("<none>")),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("<none>")),
 	}
 
 	testCase.Run(t)
@@ -677,23 +670,27 @@ CMD ["echo", "nerdctl-build-test-string"]
 func TestBuildContextDockerImageAlias(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := `FROM myorg/myapp
+CMD ["echo", "nerdctl-build-myorg/myapp"]`
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := `FROM myorg/myapp
-CMD ["echo", "nerdctl-build-myorg/myapp"]`
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Temp().Save(dockerfile, "Dockerfile")
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("build", "-t", data.Identifier(), data.Get("buildCtx"), fmt.Sprintf("--build-context=myorg/myapp=docker-image://%s", testutil.CommonImage))
-		},
-		Expected: test.Expects(0, nil, nil),
+			return helpers.Command(
+				"build",
+				"-t",
+				data.Identifier(),
+				data.Temp().Path(),
+				fmt.Sprintf("--build-context=myorg/myapp=docker-image://%s", testutil.CommonImage),
+			)
+		},
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 	}
 
 	testCase.Run(t)
@@ -704,6 +701,9 @@ func TestBuildContextWithCopyFromDir(t *testing.T) {
 
 	content := "hello_from_dir_2"
 	filename := "hello.txt"
+	dockerfile := fmt.Sprintf(`FROM %s
+COPY --from=dir2 /%s /hello_from_dir2.txt
+RUN ["cat", "/hello_from_dir2.txt"]`, testutil.CommonImage, filename)
 
 	testCase := &test.Case{
 		Require: require.All(
@@ -714,23 +714,19 @@ func TestBuildContextWithCopyFromDir(t *testing.T) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dir2 := helpers.T().TempDir()
-			filePath := filepath.Join(dir2, filename)
-			err := os.WriteFile(filePath, []byte(content), 0o600)
-			assert.NilError(helpers.T(), err)
-			dockerfile := fmt.Sprintf(`FROM %s
-COPY --from=dir2 /%s /hello_from_dir2.txt
-RUN ["cat", "/hello_from_dir2.txt"]`, testutil.CommonImage, filename)
-			buildCtx := data.TempDir()
-			err = os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
-			data.Set("dir2", dir2)
+			data.Temp().Save(dockerfile, "context", "Dockerfile")
+			data.Temp().Save(content, "other-directory", filename)
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("build", "-t", data.Identifier(), data.Get("buildCtx"), fmt.Sprintf("--build-context=dir2=%s", data.Get("dir2")))
-		},
-		Expected: test.Expects(0, nil, nil),
+			return helpers.Command(
+				"build",
+				"-t",
+				data.Identifier(),
+				data.Temp().Path("context"),
+				fmt.Sprintf("--build-context=dir2=%s", data.Temp().Path("other-directory")),
+			)
+		},
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 	}
 
 	testCase.Run(t)
@@ -741,24 +737,20 @@ RUN ["cat", "/hello_from_dir2.txt"]`, testutil.CommonImage, filename)
 func TestBuildSourceDateEpoch(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+ARG SOURCE_DATE_EPOCH
+RUN echo $SOURCE_DATE_EPOCH >/source-date-epoch
+CMD ["cat", "/source-date-epoch"]
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: require.All(
 			nerdtest.Build,
 			require.Not(nerdtest.Docker),
 		),
-		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rmi", "-f", data.Identifier())
-		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-ARG SOURCE_DATE_EPOCH
-RUN echo $SOURCE_DATE_EPOCH >/source-date-epoch
-CMD ["cat", "/source-date-epoch"]
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Labels().Set("buildCtx", data.Temp().Path())
 		},
 		SubTests: []*test.Case{
 			{
@@ -767,7 +759,7 @@ CMD ["cat", "/source-date-epoch"]
 					"SOURCE_DATE_EPOCH": "1111111111",
 				},
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "-t", data.Identifier())
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
@@ -775,7 +767,7 @@ CMD ["cat", "/source-date-epoch"]
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("1111111111\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("1111111111\n")),
 			},
 			{
 				Description: "2222222222",
@@ -783,7 +775,7 @@ CMD ["cat", "/source-date-epoch"]
 					"SOURCE_DATE_EPOCH": "1111111111",
 				},
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "--build-arg", "SOURCE_DATE_EPOCH=2222222222", "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "--build-arg", "SOURCE_DATE_EPOCH=2222222222", "-t", data.Identifier())
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
@@ -791,7 +783,7 @@ CMD ["cat", "/source-date-epoch"]
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("2222222222\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("2222222222\n")),
 			},
 		},
 	}
@@ -802,29 +794,25 @@ CMD ["cat", "/source-date-epoch"]
 func TestBuildNetwork(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+RUN apk add --no-cache curl
+RUN curl -I http://google.com
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: require.All(
 			nerdtest.Build,
 			require.Not(nerdtest.Docker),
 		),
-		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rmi", "-f", data.Identifier())
-		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-RUN apk add --no-cache curl
-RUN curl -I http://google.com
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Labels().Set("buildCtx", data.Temp().Path())
 		},
 		SubTests: []*test.Case{
 			{
 				Description: "none",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("build", data.Get("buildCtx"), "-t", data.Identifier(), "--no-cache", "--network", "none")
+					return helpers.Command("build", data.Labels().Get("buildCtx"), "-t", data.Identifier(), "--no-cache", "--network", "none")
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
@@ -834,22 +822,22 @@ RUN curl -I http://google.com
 			{
 				Description: "empty",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("build", data.Get("buildCtx"), "-t", data.Identifier(), "--no-cache", "--network", "")
+					return helpers.Command("build", data.Labels().Get("buildCtx"), "-t", data.Identifier(), "--no-cache", "--network", "")
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, nil),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 			},
 			{
 				Description: "default",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("build", data.Get("buildCtx"), "-t", data.Identifier(), "--no-cache", "--network", "default")
+					return helpers.Command("build", data.Labels().Get("buildCtx"), "-t", data.Identifier(), "--no-cache", "--network", "default")
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, nil),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 			},
 		},
 	}
@@ -863,6 +851,8 @@ func TestBuildAttestation(t *testing.T) {
 	const testSBOMFileName = "sbom.spdx.json"
 	const testProvenanceFileName = "provenance.json"
 
+	dockerfile := fmt.Sprintf(`FROM %s`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: require.All(
 			nerdtest.Build,
@@ -872,38 +862,34 @@ func TestBuildAttestation(t *testing.T) {
 			if nerdtest.IsDocker() {
 				helpers.Anyhow("buildx", "rm", data.Identifier("builder"))
 			}
-			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
 			if nerdtest.IsDocker() {
 				helpers.Anyhow("buildx", "create", "--name", data.Identifier("builder"), "--bootstrap", "--use")
 			}
 
-			dockerfile := fmt.Sprintf(`FROM %s`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Labels().Set("buildCtx", data.Temp().Path())
 		},
 		SubTests: []*test.Case{
 			{
 				Description: "SBOM",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					outputSBOMDir := helpers.T().TempDir()
-					data.Set("outputSBOMFile", filepath.Join(outputSBOMDir, testSBOMFileName))
-
 					cmd := helpers.Command("build")
 					if nerdtest.IsDocker() {
 						cmd.WithArgs("--builder", data.Identifier("builder"))
 					}
-					cmd.WithArgs("--sbom=true", "-o", fmt.Sprintf("type=local,dest=%s", outputSBOMDir), data.Get("buildCtx"))
+					cmd.WithArgs(
+						"--sbom=true",
+						"-o", fmt.Sprintf("type=local,dest=%s", data.Temp().Path("dir-for-bom")),
+						data.Labels().Get("buildCtx"),
+					)
 					return cmd
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: func(stdout string, info string, t *testing.T) {
-							_, err := os.Stat(data.Get("outputSBOMFile"))
-							assert.NilError(t, err, info)
+						Output: func(stdout, info string, t *testing.T) {
+							data.Temp().Exists("dir-for-bom", testSBOMFileName)
 						},
 					}
 				},
@@ -911,21 +897,21 @@ func TestBuildAttestation(t *testing.T) {
 			{
 				Description: "Provenance",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					outputProvenanceDir := data.TempDir()
-					data.Set("outputProvenanceFile", filepath.Join(outputProvenanceDir, testProvenanceFileName))
-
 					cmd := helpers.Command("build")
 					if nerdtest.IsDocker() {
 						cmd.WithArgs("--builder", data.Identifier("builder"))
 					}
-					cmd.WithArgs("--provenance=mode=min", "-o", fmt.Sprintf("type=local,dest=%s", outputProvenanceDir), data.Get("buildCtx"))
+					cmd.WithArgs(
+						"--provenance=mode=min",
+						"-o", fmt.Sprintf("type=local,dest=%s", data.Temp().Path("dir-for-prov")),
+						data.Labels().Get("buildCtx"),
+					)
 					return cmd
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: func(stdout string, info string, t *testing.T) {
-							_, err := os.Stat(data.Get("outputProvenanceFile"))
-							assert.NilError(t, err, info)
+						Output: func(stdout, info string, t *testing.T) {
+							data.Temp().Exists("dir-for-prov", testProvenanceFileName)
 						},
 					}
 				},
@@ -933,24 +919,23 @@ func TestBuildAttestation(t *testing.T) {
 			{
 				Description: "Attestation",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					outputAttestationDir := data.TempDir()
-					data.Set("outputSBOMFile", filepath.Join(outputAttestationDir, testSBOMFileName))
-					data.Set("outputProvenanceFile", filepath.Join(outputAttestationDir, testProvenanceFileName))
-
 					cmd := helpers.Command("build")
 					if nerdtest.IsDocker() {
 						cmd.WithArgs("--builder", data.Identifier("builder"))
 					}
-					cmd.WithArgs("--attest=type=provenance,mode=min", "--attest=type=sbom", "-o", fmt.Sprintf("type=local,dest=%s", outputAttestationDir), data.Get("buildCtx"))
+					cmd.WithArgs(
+						"--attest=type=provenance,mode=min",
+						"--attest=type=sbom",
+						"-o", fmt.Sprintf("type=local,dest=%s", data.Temp().Path("dir-for-attest")),
+						data.Labels().Get("buildCtx"),
+					)
 					return cmd
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: func(stdout string, info string, t *testing.T) {
-							_, err := os.Stat(data.Get("outputSBOMFile"))
-							assert.NilError(t, err, info)
-							_, err = os.Stat(data.Get("outputProvenanceFile"))
-							assert.NilError(t, err, info)
+						Output: func(stdout, info string, t *testing.T) {
+							data.Temp().Exists("dir-for-attest", testSBOMFileName)
+							data.Temp().Exists("dir-for-attest", testProvenanceFileName)
 						},
 					}
 				},
@@ -964,6 +949,11 @@ func TestBuildAttestation(t *testing.T) {
 func TestBuildAddHost(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+RUN ping -c 5 alpha
+RUN ping -c 5 beta
+`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: require.All(
 			nerdtest.Build,
@@ -972,19 +962,17 @@ func TestBuildAddHost(t *testing.T) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-RUN ping -c 5 alpha
-RUN ping -c 5 beta
-`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Temp().Save(dockerfile, "Dockerfile")
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("build", data.Get("buildCtx"), "-t", data.Identifier(), "--add-host", "alpha:127.0.0.1", "--add-host", "beta:127.0.0.1")
-		},
-		Expected: test.Expects(0, nil, nil),
+			return helpers.Command(
+				"build", data.Temp().Path(),
+				"-t", data.Identifier(),
+				"--add-host", "alpha:127.0.0.1",
+				"--add-host", "beta:127.0.0.1",
+			)
+		},
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 	}
 
 	testCase.Run(t)
diff --git a/cmd/nerdctl/builder/builder_builder_test.go b/cmd/nerdctl/builder/builder_builder_test.go
index a049e566380..fdbfa1990ac 100644
--- a/cmd/nerdctl/builder/builder_builder_test.go
+++ b/cmd/nerdctl/builder/builder_builder_test.go
@@ -17,15 +17,11 @@
 package builder
 
 import (
-	"bytes"
 	"errors"
 	"fmt"
-	"os"
-	"path/filepath"
+	"strings"
 	"testing"
 
-	"gotest.tools/v3/assert"
-
 	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
@@ -49,10 +45,8 @@ func TestBuilder(t *testing.T) {
 				Setup: func(data test.Data, helpers test.Helpers) {
 					dockerfile := fmt.Sprintf(`FROM %s
 CMD ["echo", "nerdctl-test-builder-prune"]`, testutil.CommonImage)
-					buildCtx := data.TempDir()
-					err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-					assert.NilError(helpers.T(), err)
-					helpers.Ensure("build", buildCtx)
+					data.Temp().Save(dockerfile, "Dockerfile")
+					helpers.Ensure("build", data.Temp().Path())
 				},
 				Command:  test.Command("builder", "prune", "--force"),
 				Expected: test.Expects(0, nil, nil),
@@ -63,10 +57,8 @@ CMD ["echo", "nerdctl-test-builder-prune"]`, testutil.CommonImage)
 				Setup: func(data test.Data, helpers test.Helpers) {
 					dockerfile := fmt.Sprintf(`FROM %s
 CMD ["echo", "nerdctl-test-builder-prune"]`, testutil.CommonImage)
-					buildCtx := data.TempDir()
-					err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-					assert.NilError(helpers.T(), err)
-					helpers.Ensure("build", buildCtx)
+					data.Temp().Save(dockerfile, "Dockerfile")
+					helpers.Ensure("build", data.Temp().Path())
 				},
 				Command:  test.Command("builder", "prune", "--force", "--all"),
 				Expected: test.Expects(0, nil, nil),
@@ -79,11 +71,9 @@ CMD ["echo", "nerdctl-test-builder-prune"]`, testutil.CommonImage)
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					dockerfile := fmt.Sprintf(`FROM %s
 CMD ["echo", "nerdctl-builder-debug-test-string"]`, testutil.CommonImage)
-					buildCtx := data.TempDir()
-					err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-					assert.NilError(helpers.T(), err)
-					cmd := helpers.Command("builder", "debug", buildCtx)
-					cmd.Feed(bytes.NewReader([]byte("c\n")))
+					data.Temp().Save(dockerfile, "Dockerfile")
+					cmd := helpers.Command("builder", "debug", data.Temp().Path())
+					cmd.Feed(strings.NewReader("c\n"))
 					return cmd
 				},
 				Expected: test.Expects(0, nil, nil),
@@ -103,13 +93,10 @@ CMD ["echo", "nerdctl-builder-debug-test-string"]`, testutil.CommonImage)
 					helpers.Ensure("tag", oldImage, newImage)
 
 					dockerfile := fmt.Sprintf(`FROM %s`, newImage)
-					buildCtx := data.TempDir()
-					err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-					assert.NilError(helpers.T(), err)
-
-					data.Set("buildCtx", buildCtx)
-					data.Set("oldImageSha", oldImageSha)
-					data.Set("newImageSha", newImageSha)
+					data.Temp().Save(dockerfile, "Dockerfile")
+					data.Labels().Set("oldImageSha", oldImageSha)
+					data.Labels().Set("newImageSha", newImageSha)
+					data.Labels().Set("base", data.Temp().Dir())
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", testutil.AlpineImage)
@@ -119,11 +106,11 @@ CMD ["echo", "nerdctl-builder-debug-test-string"]`, testutil.CommonImage)
 						Description: "pull false",
 						NoParallel:  true,
 						Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-							return helpers.Command("build", data.Get("buildCtx"), "--pull=false")
+							return helpers.Command("build", data.Labels().Get("base"), "--pull=false")
 						},
 						Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 							return &test.Expected{
-								Errors: []error{errors.New(data.Get("oldImageSha"))},
+								Errors: []error{errors.New(data.Labels().Get("oldImageSha"))},
 							}
 						},
 					},
@@ -131,11 +118,11 @@ CMD ["echo", "nerdctl-builder-debug-test-string"]`, testutil.CommonImage)
 						Description: "pull true",
 						NoParallel:  true,
 						Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-							return helpers.Command("build", data.Get("buildCtx"), "--pull=true")
+							return helpers.Command("build", data.Labels().Get("base"), "--pull=true")
 						},
 						Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 							return &test.Expected{
-								Errors: []error{errors.New(data.Get("newImageSha"))},
+								Errors: []error{errors.New(data.Labels().Get("newImageSha"))},
 							}
 						},
 					},
@@ -143,11 +130,11 @@ CMD ["echo", "nerdctl-builder-debug-test-string"]`, testutil.CommonImage)
 						Description: "no pull",
 						NoParallel:  true,
 						Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-							return helpers.Command("build", data.Get("buildCtx"))
+							return helpers.Command("build", data.Labels().Get("base"))
 						},
 						Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 							return &test.Expected{
-								Errors: []error{errors.New(data.Get("newImageSha"))},
+								Errors: []error{errors.New(data.Labels().Get("newImageSha"))},
 							}
 						},
 					},
diff --git a/cmd/nerdctl/completion/completion_test.go b/cmd/nerdctl/completion/completion_test.go
index 23bdf833c52..bde281ab497 100644
--- a/cmd/nerdctl/completion/completion_test.go
+++ b/cmd/nerdctl/completion/completion_test.go
@@ -41,7 +41,7 @@ func TestCompletion(t *testing.T) {
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 			helpers.Ensure("network", "create", identifier)
 			helpers.Ensure("volume", "create", identifier)
-			data.Set("identifier", identifier)
+			data.Labels().Set("identifier", identifier)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			identifier := data.Identifier()
@@ -93,7 +93,7 @@ func TestCompletion(t *testing.T) {
 					return &test.Expected{
 						Output: expect.All(
 							expect.Contains("host\n"),
-							expect.Contains(data.Get("identifier")+"\n"),
+							expect.Contains(data.Labels().Get("identifier")+"\n"),
 						),
 					}
 				},
@@ -105,7 +105,7 @@ func TestCompletion(t *testing.T) {
 					return &test.Expected{
 						Output: expect.All(
 							expect.Contains("host\n"),
-							expect.Contains(data.Get("identifier")+"\n"),
+							expect.Contains(data.Labels().Get("identifier")+"\n"),
 						),
 					}
 				},
@@ -117,7 +117,7 @@ func TestCompletion(t *testing.T) {
 					return &test.Expected{
 						Output: expect.All(
 							expect.Contains("host\n"),
-							expect.Contains(data.Get("identifier")+"\n"),
+							expect.Contains(data.Labels().Get("identifier")+"\n"),
 						),
 					}
 				},
@@ -134,7 +134,7 @@ func TestCompletion(t *testing.T) {
 					return &test.Expected{
 						Output: expect.All(
 							expect.DoesNotContain("host\n"),
-							expect.Contains(data.Get("identifier")+"\n"),
+							expect.Contains(data.Labels().Get("identifier")+"\n"),
 						),
 					}
 				},
@@ -153,7 +153,7 @@ func TestCompletion(t *testing.T) {
 				Command:     test.Command("__complete", "volume", "inspect", ""),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.Contains(data.Get("identifier") + "\n"),
+						Output: expect.Contains(data.Labels().Get("identifier") + "\n"),
 					}
 				},
 			},
@@ -162,7 +162,7 @@ func TestCompletion(t *testing.T) {
 				Command:     test.Command("__complete", "volume", "rm", ""),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.Contains(data.Get("identifier") + "\n"),
+						Output: expect.Contains(data.Labels().Get("identifier") + "\n"),
 					}
 				},
 			},
diff --git a/cmd/nerdctl/container/container_commit_linux_test.go b/cmd/nerdctl/container/container_commit_linux_test.go
index 8da0ee01b4f..e1a167c0633 100644
--- a/cmd/nerdctl/container/container_commit_linux_test.go
+++ b/cmd/nerdctl/container/container_commit_linux_test.go
@@ -45,7 +45,7 @@ func TestKubeCommitSave(t *testing.T) {
 				containerID = strings.TrimPrefix(stdout, "containerd://")
 			},
 		})
-		data.Set("containerID", containerID)
+		data.Labels().Set("containerID", containerID)
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -53,7 +53,7 @@ func TestKubeCommitSave(t *testing.T) {
 	}
 
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
-		helpers.Ensure("commit", data.Get("containerID"), "testcommitsave")
+		helpers.Ensure("commit", data.Labels().Get("containerID"), "testcommitsave")
 		return helpers.Command("save", "testcommitsave")
 	}
 
diff --git a/cmd/nerdctl/container/container_create_linux_test.go b/cmd/nerdctl/container/container_create_linux_test.go
index 0a20ddac9c2..3ea83d8ac96 100644
--- a/cmd/nerdctl/container/container_create_linux_test.go
+++ b/cmd/nerdctl/container/container_create_linux_test.go
@@ -199,7 +199,7 @@ func TestIssue2993(t *testing.T) {
 		{
 			Description: "Issue #2993 - nerdctl no longer leaks containers and etchosts directories and files when container creation fails.",
 			Setup: func(data test.Data, helpers test.Helpers) {
-				dataRoot := data.TempDir()
+				dataRoot := data.Temp().Path()
 
 				helpers.Ensure("run", "--data-root", dataRoot, "--name", data.Identifier(), "-d", testutil.AlpineImage, "sleep", nerdtest.Infinity)
 
@@ -218,25 +218,25 @@ func TestIssue2993(t *testing.T) {
 				assert.NilError(t, err)
 				assert.Equal(t, len(etchostsDirs), 1)
 
-				data.Set(containersPathKey, containersPath)
-				data.Set(etchostsPathKey, etchostsPath)
+				data.Labels().Set(containersPathKey, containersPath)
+				data.Labels().Set(etchostsPathKey, etchostsPath)
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				helpers.Anyhow("rm", "--data-root", data.TempDir(), "-f", data.Identifier())
+				helpers.Anyhow("rm", "--data-root", data.Temp().Path(), "-f", data.Identifier())
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--data-root", data.TempDir(), "--name", data.Identifier(), "-d", testutil.AlpineImage, "sleep", nerdtest.Infinity)
+				return helpers.Command("run", "--data-root", data.Temp().Path(), "--name", data.Identifier(), "-d", testutil.AlpineImage, "sleep", nerdtest.Infinity)
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: 1,
 					Errors:   []error{errors.New("is already used by ID")},
 					Output: func(stdout string, info string, t *testing.T) {
-						containersDirs, err := os.ReadDir(data.Get(containersPathKey))
+						containersDirs, err := os.ReadDir(data.Labels().Get(containersPathKey))
 						assert.NilError(t, err)
 						assert.Equal(t, len(containersDirs), 1)
 
-						etchostsDirs, err := os.ReadDir(data.Get(etchostsPathKey))
+						etchostsDirs, err := os.ReadDir(data.Labels().Get(etchostsPathKey))
 						assert.NilError(t, err)
 						assert.Equal(t, len(etchostsDirs), 1)
 					},
@@ -246,7 +246,7 @@ func TestIssue2993(t *testing.T) {
 		{
 			Description: "Issue #2993 - nerdctl no longer leaks containers and etchosts directories and files when containers are removed.",
 			Setup: func(data test.Data, helpers test.Helpers) {
-				dataRoot := data.TempDir()
+				dataRoot := data.Temp().Path()
 
 				helpers.Ensure("run", "--data-root", dataRoot, "--name", data.Identifier(), "-d", testutil.AlpineImage, "sleep", nerdtest.Infinity)
 
@@ -265,25 +265,25 @@ func TestIssue2993(t *testing.T) {
 				assert.NilError(t, err)
 				assert.Equal(t, len(etchostsDirs), 1)
 
-				data.Set(containersPathKey, containersPath)
-				data.Set(etchostsPathKey, etchostsPath)
+				data.Labels().Set(containersPathKey, containersPath)
+				data.Labels().Set(etchostsPathKey, etchostsPath)
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				helpers.Anyhow("--data-root", data.TempDir(), "rm", "-f", data.Identifier())
+				helpers.Anyhow("--data-root", data.Temp().Path(), "rm", "-f", data.Identifier())
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("--data-root", data.TempDir(), "rm", "-f", data.Identifier())
+				return helpers.Command("--data-root", data.Temp().Path(), "rm", "-f", data.Identifier())
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: 0,
 					Errors:   []error{},
 					Output: func(stdout string, info string, t *testing.T) {
-						containersDirs, err := os.ReadDir(data.Get(containersPathKey))
+						containersDirs, err := os.ReadDir(data.Labels().Get(containersPathKey))
 						assert.NilError(t, err)
 						assert.Equal(t, len(containersDirs), 0)
 
-						etchostsDirs, err := os.ReadDir(data.Get(etchostsPathKey))
+						etchostsDirs, err := os.ReadDir(data.Labels().Get(etchostsPathKey))
 						assert.NilError(t, err)
 						assert.Equal(t, len(etchostsDirs), 0)
 					},
diff --git a/cmd/nerdctl/container/container_create_test.go b/cmd/nerdctl/container/container_create_test.go
index 8b507d37fc6..f10536eecce 100644
--- a/cmd/nerdctl/container/container_create_test.go
+++ b/cmd/nerdctl/container/container_create_test.go
@@ -35,7 +35,7 @@ func TestCreate(t *testing.T) {
 	testCase := nerdtest.Setup()
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		helpers.Ensure("create", "--name", data.Identifier("container"), testutil.CommonImage, "echo", "foo")
-		data.Set("cID", data.Identifier("container"))
+		data.Labels().Set("cID", data.Identifier("container"))
 	}
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
 		helpers.Anyhow("rm", "-f", data.Identifier("container"))
@@ -55,7 +55,7 @@ func TestCreate(t *testing.T) {
 			Description: "start",
 			NoParallel:  true,
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("start", data.Get("cID"))
+				return helpers.Command("start", data.Labels().Get("cID"))
 			},
 			Expected: test.Expects(0, nil, nil),
 		},
@@ -63,7 +63,7 @@ func TestCreate(t *testing.T) {
 			Description: "logs",
 			NoParallel:  true,
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("logs", data.Get("cID"))
+				return helpers.Command("logs", data.Labels().Get("cID"))
 			},
 			Expected: test.Expects(0, nil, expect.Contains("foo")),
 		},
@@ -79,7 +79,7 @@ func TestCreateHyperVContainer(t *testing.T) {
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		helpers.Ensure("create", "--isolation", "hyperv", "--name", data.Identifier("container"), testutil.CommonImage, "echo", "foo")
-		data.Set("cID", data.Identifier("container"))
+		data.Labels().Set("cID", data.Identifier("container"))
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -98,10 +98,10 @@ func TestCreateHyperVContainer(t *testing.T) {
 			Description: "start",
 			NoParallel:  true,
 			Setup: func(data test.Data, helpers test.Helpers) {
-				helpers.Ensure("start", data.Get("cID"))
+				helpers.Ensure("start", data.Labels().Get("cID"))
 				ran := false
 				for i := 0; i < 10 && !ran; i++ {
-					helpers.Command("container", "inspect", data.Get("cID")).
+					helpers.Command("container", "inspect", data.Labels().Get("cID")).
 						Run(&test.Expected{
 							ExitCode: expect.ExitCodeNoCheck,
 							Output: func(stdout string, info string, t *testing.T) {
@@ -119,7 +119,7 @@ func TestCreateHyperVContainer(t *testing.T) {
 				assert.Assert(t, ran, "container did not ran after 10 seconds")
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("logs", data.Get("cID"))
+				return helpers.Command("logs", data.Labels().Get("cID"))
 			},
 			Expected: test.Expects(0, nil, expect.Contains("foo")),
 		},
diff --git a/cmd/nerdctl/container/container_exec_linux_test.go b/cmd/nerdctl/container/container_exec_linux_test.go
index c5624085643..5ff812d9429 100644
--- a/cmd/nerdctl/container/container_exec_linux_test.go
+++ b/cmd/nerdctl/container/container_exec_linux_test.go
@@ -65,14 +65,14 @@ func TestExecTTY(t *testing.T) {
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage, "sleep", nerdtest.Infinity)
-		data.Set("container_name", data.Identifier())
+		data.Labels().Set("container_name", data.Identifier())
 	}
 
 	testCase.SubTests = []*test.Case{
 		{
 			Description: "stty with -it",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				cmd := helpers.Command("exec", "-it", data.Get("container_name"), "stty")
+				cmd := helpers.Command("exec", "-it", data.Labels().Get("container_name"), "stty")
 				cmd.WithPseudoTTY()
 				return cmd
 			},
@@ -81,7 +81,7 @@ func TestExecTTY(t *testing.T) {
 		{
 			Description: "stty with -t",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				cmd := helpers.Command("exec", "-t", data.Get("container_name"), "stty")
+				cmd := helpers.Command("exec", "-t", data.Labels().Get("container_name"), "stty")
 				cmd.WithPseudoTTY()
 				return cmd
 			},
@@ -90,7 +90,7 @@ func TestExecTTY(t *testing.T) {
 		{
 			Description: "stty with -i",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				cmd := helpers.Command("exec", "-i", data.Get("container_name"), "stty")
+				cmd := helpers.Command("exec", "-i", data.Labels().Get("container_name"), "stty")
 				cmd.WithPseudoTTY()
 				return cmd
 			},
@@ -99,7 +99,7 @@ func TestExecTTY(t *testing.T) {
 		{
 			Description: "stty without params",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				cmd := helpers.Command("exec", data.Get("container_name"), "stty")
+				cmd := helpers.Command("exec", data.Labels().Get("container_name"), "stty")
 				cmd.WithPseudoTTY()
 				return cmd
 			},
diff --git a/cmd/nerdctl/container/container_inspect_linux_test.go b/cmd/nerdctl/container/container_inspect_linux_test.go
index c03a0a472ea..b070359fa00 100644
--- a/cmd/nerdctl/container/container_inspect_linux_test.go
+++ b/cmd/nerdctl/container/container_inspect_linux_test.go
@@ -531,10 +531,10 @@ RUN groupadd -r test && useradd -r -g test test
 USER test
 `, testutil.UbuntuImage)
 
-			err := os.WriteFile(filepath.Join(data.TempDir(), "Dockerfile"), []byte(dockerfile), 0o600)
+			err := os.WriteFile(filepath.Join(data.Temp().Path(), "Dockerfile"), []byte(dockerfile), 0o600)
 			assert.NilError(helpers.T(), err)
 
-			helpers.Ensure("build", "-t", data.Identifier(), data.TempDir())
+			helpers.Ensure("build", "-t", data.Identifier(), data.Temp().Path())
 			helpers.Ensure("create", "--name", data.Identifier(), "--user", "test", data.Identifier())
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
diff --git a/cmd/nerdctl/container/container_restart_linux_test.go b/cmd/nerdctl/container/container_restart_linux_test.go
index 95b404099cd..55996bcbcd4 100644
--- a/cmd/nerdctl/container/container_restart_linux_test.go
+++ b/cmd/nerdctl/container/container_restart_linux_test.go
@@ -136,7 +136,7 @@ func TestRestartWithSignal(t *testing.T) {
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
 		cmd := nerdtest.RunSigProxyContainer(nerdtest.SigUsr1, false, nil, data, helpers)
 		// Capture the current pid
-		data.Set("oldpid", strconv.Itoa(nerdtest.InspectContainer(helpers, data.Identifier()).State.Pid))
+		data.Labels().Set("oldpid", strconv.Itoa(nerdtest.InspectContainer(helpers, data.Identifier()).State.Pid))
 		// Send the signal
 		helpers.Ensure("restart", "--signal", "SIGUSR1", data.Identifier())
 		return cmd
@@ -154,7 +154,7 @@ func TestRestartWithSignal(t *testing.T) {
 					nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 					// Check the new pid is different
 					newpid := strconv.Itoa(nerdtest.InspectContainer(helpers, data.Identifier()).State.Pid)
-					assert.Assert(helpers.T(), newpid != data.Get("oldpid"), info)
+					assert.Assert(helpers.T(), newpid != data.Labels().Get("oldpid"), info)
 				},
 			),
 		}
diff --git a/cmd/nerdctl/container/container_run_cgroup_linux_test.go b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
index 2e1fce340df..564e1a74d3f 100644
--- a/cmd/nerdctl/container/container_run_cgroup_linux_test.go
+++ b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
@@ -242,7 +242,7 @@ func TestRunDevice(t *testing.T) {
 			t.Logf("lo[%d] = %+v", i, lo[i])
 			loContent := fmt.Sprintf("lo%d-content", i)
 			assert.NilError(t, os.WriteFile(lo[i].Device, []byte(loContent), 0o700))
-			data.Set("loContent"+strconv.Itoa(i), loContent)
+			data.Labels().Set("loContent"+strconv.Itoa(i), loContent)
 		}
 
 		// lo0 is readable but not writable.
@@ -254,7 +254,7 @@ func TestRunDevice(t *testing.T) {
 			"--device", lo[0].Device+":r",
 			"--device", lo[1].Device,
 			testutil.AlpineImage, "sleep", nerdtest.Infinity)
-		data.Set("id", data.Identifier())
+		data.Labels().Set("id", data.Identifier())
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -270,25 +270,25 @@ func TestRunDevice(t *testing.T) {
 		{
 			Description: "can read lo0",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("exec", data.Get("id"), "cat", lo[0].Device)
+				return helpers.Command("exec", data.Labels().Get("id"), "cat", lo[0].Device)
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: expect.Contains(data.Get("locontent0")),
+					Output: expect.Contains(data.Labels().Get("locontent0")),
 				}
 			},
 		},
 		{
 			Description: "cannot write lo0",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("exec", data.Get("id"), "sh", "-ec", "echo -n \"overwritten-lo1-content\">"+lo[0].Device)
+				return helpers.Command("exec", data.Labels().Get("id"), "sh", "-ec", "echo -n \"overwritten-lo1-content\">"+lo[0].Device)
 			},
 			Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 		},
 		{
 			Description: "cannot read lo2",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("exec", data.Get("id"), "cat", lo[2].Device)
+				return helpers.Command("exec", data.Labels().Get("id"), "cat", lo[2].Device)
 			},
 			Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 		},
@@ -296,11 +296,11 @@ func TestRunDevice(t *testing.T) {
 			Description: "can read lo1",
 			NoParallel:  true,
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("exec", data.Get("id"), "cat", lo[1].Device)
+				return helpers.Command("exec", data.Labels().Get("id"), "cat", lo[1].Device)
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: expect.Contains(data.Get("locontent1")),
+					Output: expect.Contains(data.Labels().Get("locontent1")),
 				}
 			},
 		},
@@ -308,7 +308,7 @@ func TestRunDevice(t *testing.T) {
 			Description: "can write lo1 and read back updated value",
 			NoParallel:  true,
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("exec", data.Get("id"), "sh", "-ec", "echo -n \"overwritten-lo1-content\">"+lo[1].Device)
+				return helpers.Command("exec", data.Labels().Get("id"), "sh", "-ec", "echo -n \"overwritten-lo1-content\">"+lo[1].Device)
 			},
 			Expected: test.Expects(expect.ExitCodeSuccess, nil, func(stdout string, info string, t *testing.T) {
 				lo1Read, err := os.ReadFile(lo[1].Device)
diff --git a/cmd/nerdctl/container/container_run_network_linux_test.go b/cmd/nerdctl/container/container_run_network_linux_test.go
index e275669fa38..853e14e8ab5 100644
--- a/cmd/nerdctl/container/container_run_network_linux_test.go
+++ b/cmd/nerdctl/container/container_run_network_linux_test.go
@@ -363,10 +363,10 @@ func TestRunWithInvalidPortThenCleanUp(t *testing.T) {
 		{
 			Description: "Run a container with invalid ports, and then clean up.",
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				helpers.Anyhow("rm", "--data-root", data.TempDir(), "-f", data.Identifier())
+				helpers.Anyhow("rm", "--data-root", data.Temp().Path(), "-f", data.Identifier())
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--data-root", data.TempDir(), "--rm", "--name", data.Identifier(), "-p", "22200-22299:22200-22299", testutil.CommonImage)
+				return helpers.Command("run", "--data-root", data.Temp().Path(), "--rm", "--name", data.Identifier(), "-p", "22200-22299:22200-22299", testutil.CommonImage)
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -382,7 +382,7 @@ func TestRunWithInvalidPortThenCleanUp(t *testing.T) {
 							return h
 						}
 
-						dataRoot := data.TempDir()
+						dataRoot := data.Temp().Path()
 						h := getAddrHash(defaults.DefaultAddress)
 						dataStore := filepath.Join(dataRoot, h)
 						namespace := string(helpers.Read(nerdtest.Namespace))
@@ -519,8 +519,8 @@ func TestSharedNetworkSetup(t *testing.T) {
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
-			data.Set("containerName1", data.Identifier("-container1"))
-			containerName1 := data.Get("containerName1")
+			data.Labels().Set("containerName1", data.Identifier("-container1"))
+			containerName1 := data.Labels().Get("containerName1")
 			helpers.Ensure("run", "-d", "--name", containerName1,
 				testutil.NginxAlpineImage)
 		},
@@ -538,7 +538,7 @@ func TestSharedNetworkSetup(t *testing.T) {
 					containerName2 := data.Identifier()
 					cmd := helpers.Command()
 					cmd.WithArgs("run", "-d", "--name", containerName2,
-						"--network=container:"+data.Get("containerName1"),
+						"--network=container:"+data.Labels().Get("containerName1"),
 						testutil.NginxAlpineImage)
 					return cmd
 				},
@@ -547,7 +547,7 @@ func TestSharedNetworkSetup(t *testing.T) {
 						Output: func(stdout string, info string, t *testing.T) {
 							containerName2 := data.Identifier()
 							assert.Assert(t, strings.Contains(helpers.Capture("exec", containerName2, "wget", "-qO-", "http://127.0.0.1:80"), testutil.NginxAlpineIndexHTMLSnippet), info)
-							helpers.Ensure("restart", data.Get("containerName1"))
+							helpers.Ensure("restart", data.Labels().Get("containerName1"))
 							helpers.Ensure("stop", "--time=1", containerName2)
 							helpers.Ensure("start", containerName2)
 							assert.Assert(t, strings.Contains(helpers.Capture("exec", containerName2, "wget", "-qO-", "http://127.0.0.1:80"), testutil.NginxAlpineIndexHTMLSnippet), info)
@@ -564,7 +564,7 @@ func TestSharedNetworkSetup(t *testing.T) {
 					containerName2 := data.Identifier()
 					cmd := helpers.Command()
 					cmd.WithArgs("run", "-d", "--name", containerName2, "--uts", "host",
-						"--network=container:"+data.Get("containerName1"),
+						"--network=container:"+data.Labels().Get("containerName1"),
 						testutil.AlpineImage)
 					return cmd
 				},
@@ -583,7 +583,7 @@ func TestSharedNetworkSetup(t *testing.T) {
 					containerName2 := data.Identifier()
 					cmd := helpers.Command()
 					cmd.WithArgs("run", "-d", "--name", containerName2, "--dns", "0.1.2.3",
-						"--network=container:"+data.Get("containerName1"),
+						"--network=container:"+data.Labels().Get("containerName1"),
 						testutil.AlpineImage)
 					return cmd
 				},
@@ -608,7 +608,7 @@ func TestSharedNetworkSetup(t *testing.T) {
 					containerName2 := data.Identifier()
 					cmd := helpers.Command()
 					cmd.WithArgs("run", "--name", containerName2, "--dns-option", "attempts:5",
-						"--network=container:"+data.Get("containerName1"),
+						"--network=container:"+data.Labels().Get("containerName1"),
 						testutil.AlpineImage, "cat", "/etc/resolv.conf")
 					return cmd
 				},
@@ -631,7 +631,7 @@ func TestSharedNetworkSetup(t *testing.T) {
 					containerName2 := data.Identifier()
 					cmd := helpers.Command()
 					cmd.WithArgs("run", "-d", "--name", containerName2, "--publish", "80:8080",
-						"--network=container:"+data.Get("containerName1"),
+						"--network=container:"+data.Labels().Get("containerName1"),
 						testutil.AlpineImage)
 					return cmd
 				},
@@ -656,7 +656,7 @@ func TestSharedNetworkSetup(t *testing.T) {
 					containerName2 := data.Identifier()
 					cmd := helpers.Command()
 					cmd.WithArgs("run", "-d", "--name", containerName2, "--hostname", "test",
-						"--network=container:"+data.Get("containerName1"),
+						"--network=container:"+data.Labels().Get("containerName1"),
 						testutil.AlpineImage)
 					return cmd
 				},
@@ -682,19 +682,19 @@ func TestSharedNetworkWithNone(t *testing.T) {
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
-			data.Set("containerName1", data.Identifier("-container1"))
-			containerName1 := data.Get("containerName1")
+			data.Labels().Set("containerName1", data.Identifier("-container1"))
+			containerName1 := data.Labels().Get("containerName1")
 			helpers.Ensure("run", "-d", "--name", containerName1, "--network", "none",
 				testutil.NginxAlpineImage)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rm", "-f", data.Get("containerName1"))
+			helpers.Anyhow("rm", "-f", data.Labels().Get("containerName1"))
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			containerName2 := data.Identifier()
 			cmd := helpers.Command()
 			cmd.WithArgs("run", "-d", "--name", containerName2,
-				"--network=container:"+data.Get("containerName1"),
+				"--network=container:"+data.Labels().Get("containerName1"),
 				testutil.NginxAlpineImage)
 			return cmd
 		},
@@ -927,7 +927,7 @@ func TestNoneNetworkHostName(t *testing.T) {
 		Setup: func(data test.Data, helpers test.Helpers) {
 			output := helpers.Capture("run", "-d", "--name", data.Identifier(), "--network", "none", testutil.NginxAlpineImage)
 			assert.Assert(helpers.T(), len(output) > 12, output)
-			data.Set("hostname", output[:12])
+			data.Labels().Set("hostname", output[:12])
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rm", "-f", data.Identifier())
@@ -937,7 +937,7 @@ func TestNoneNetworkHostName(t *testing.T) {
 		},
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
-				Output: expect.Equals(data.Get("hostname") + "\n"),
+				Output: expect.Equals(data.Labels().Get("hostname") + "\n"),
 			}
 		},
 	}
@@ -949,7 +949,7 @@ func TestHostNetworkHostName(t *testing.T) {
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
-			data.Set("containerName1", data.Identifier())
+			data.Labels().Set("containerName1", data.Identifier())
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rm", "-f", data.Identifier())
@@ -974,7 +974,7 @@ func TestNoneNetworkDnsConfigs(t *testing.T) {
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
-			data.Set("containerName1", data.Identifier())
+			data.Labels().Set("containerName1", data.Identifier())
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rm", "-f", data.Identifier())
@@ -1003,7 +1003,7 @@ func TestHostNetworkDnsConfigs(t *testing.T) {
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
-			data.Set("containerName1", data.Identifier())
+			data.Labels().Set("containerName1", data.Identifier())
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rm", "-f", data.Identifier())
diff --git a/cmd/nerdctl/container/container_stats_test.go b/cmd/nerdctl/container/container_stats_test.go
index 0648d502d94..59132d156a1 100644
--- a/cmd/nerdctl/container/container_stats_test.go
+++ b/cmd/nerdctl/container/container_stats_test.go
@@ -53,7 +53,7 @@ func TestStats(t *testing.T) {
 		helpers.Ensure("run", "-d", "--name", data.Identifier("container"), testutil.CommonImage, "sleep", nerdtest.Infinity)
 		helpers.Ensure("run", "-d", "--name", data.Identifier("memlimited"), "--memory", "1g", testutil.CommonImage, "sleep", nerdtest.Infinity)
 		helpers.Ensure("run", "--name", data.Identifier("exited"), testutil.CommonImage, "echo", "'exited'")
-		data.Set("id", data.Identifier("container"))
+		data.Labels().Set("id", data.Identifier("container"))
 	}
 
 	testCase.SubTests = []*test.Case{
@@ -62,7 +62,7 @@ func TestStats(t *testing.T) {
 			Command:     test.Command("stats", "--no-stream", "--no-trunc"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: expect.Contains(data.Get("id")),
+					Output: expect.Contains(data.Labels().Get("id")),
 				}
 			},
 		},
@@ -71,21 +71,21 @@ func TestStats(t *testing.T) {
 			Command:     test.Command("container", "stats", "--no-stream", "--no-trunc"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: expect.Contains(data.Get("id")),
+					Output: expect.Contains(data.Labels().Get("id")),
 				}
 			},
 		},
 		{
 			Description: "stats ID",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("stats", "--no-stream", data.Get("id"))
+				return helpers.Command("stats", "--no-stream", data.Labels().Get("id"))
 			},
 			Expected: test.Expects(0, nil, nil),
 		},
 		{
 			Description: "container stats ID",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("container", "stats", "--no-stream", data.Get("id"))
+				return helpers.Command("container", "stats", "--no-stream", data.Labels().Get("id"))
 			},
 			Expected: test.Expects(0, nil, nil),
 		},
diff --git a/cmd/nerdctl/container/container_top_test.go b/cmd/nerdctl/container/container_top_test.go
index 6f18721b14e..e63d71f4150 100644
--- a/cmd/nerdctl/container/container_top_test.go
+++ b/cmd/nerdctl/container/container_top_test.go
@@ -38,7 +38,7 @@ func TestTop(t *testing.T) {
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		// FIXME: busybox 1.36 on windows still appears to not support sleep inf. Unclear why.
 		helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage, "sleep", nerdtest.Infinity)
-		data.Set("cID", data.Identifier())
+		data.Labels().Set("cID", data.Identifier())
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -51,7 +51,7 @@ func TestTop(t *testing.T) {
 			// Docker does not support top -o
 			Require: require.Not(nerdtest.Docker),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("top", data.Get("cID"), "-o", "pid,user,cmd")
+				return helpers.Command("top", data.Labels().Get("cID"), "-o", "pid,user,cmd")
 			},
 
 			Expected: test.Expects(0, nil, nil),
@@ -59,7 +59,7 @@ func TestTop(t *testing.T) {
 		{
 			Description: "simple",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("top", data.Get("cID"))
+				return helpers.Command("top", data.Labels().Get("cID"))
 			},
 
 			Expected: test.Expects(0, nil, nil),
diff --git a/cmd/nerdctl/image/image_convert_linux_test.go b/cmd/nerdctl/image/image_convert_linux_test.go
index 3d2615741bc..b26358ec8b9 100644
--- a/cmd/nerdctl/image/image_convert_linux_test.go
+++ b/cmd/nerdctl/image/image_convert_linux_test.go
@@ -115,16 +115,16 @@ func TestImageConvertNydusVerify(t *testing.T) {
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 			base := testutil.NewBase(t)
 			registry = testregistry.NewWithNoAuth(base, 0, false)
-			data.Set(remoteImageKey, fmt.Sprintf("%s:%d/nydusd-image:test", "localhost", registry.Port))
+			data.Labels().Set(remoteImageKey, fmt.Sprintf("%s:%d/nydusd-image:test", "localhost", registry.Port))
 			helpers.Ensure("image", "convert", "--nydus", "--oci", testutil.CommonImage, data.Identifier("converted-image"))
-			helpers.Ensure("tag", data.Identifier("converted-image"), data.Get(remoteImageKey))
-			helpers.Ensure("push", data.Get(remoteImageKey))
+			helpers.Ensure("tag", data.Identifier("converted-image"), data.Labels().Get(remoteImageKey))
+			helpers.Ensure("push", data.Labels().Get(remoteImageKey))
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier("converted-image"))
 			if registry != nil {
 				registry.Cleanup(nil)
-				helpers.Anyhow("rmi", "-f", data.Get(remoteImageKey))
+				helpers.Anyhow("rmi", "-f", data.Labels().Get(remoteImageKey))
 			}
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
@@ -133,7 +133,7 @@ func TestImageConvertNydusVerify(t *testing.T) {
 				"--source",
 				testutil.CommonImage,
 				"--target",
-				data.Get(remoteImageKey),
+				data.Labels().Get(remoteImageKey),
 				"--source-insecure",
 				"--target-insecure",
 			)
diff --git a/cmd/nerdctl/image/image_encrypt_linux_test.go b/cmd/nerdctl/image/image_encrypt_linux_test.go
index ac883133f63..f8d34dc03cb 100644
--- a/cmd/nerdctl/image/image_encrypt_linux_test.go
+++ b/cmd/nerdctl/image/image_encrypt_linux_test.go
@@ -51,7 +51,7 @@ func TestImageEncryptJWE(t *testing.T) {
 			if registry != nil {
 				registry.Cleanup(nil)
 				keyPair.Cleanup()
-				helpers.Anyhow("rmi", "-f", data.Get(remoteImageKey))
+				helpers.Anyhow("rmi", "-f", data.Labels().Get(remoteImageKey))
 			}
 			helpers.Anyhow("rmi", "-f", data.Identifier("decrypted"))
 		},
@@ -69,13 +69,13 @@ func TestImageEncryptJWE(t *testing.T) {
 			helpers.Ensure("push", encryptImageRef)
 			helpers.Anyhow("rmi", "-f", encryptImageRef)
 			helpers.Anyhow("rmi", "-f", testutil.CommonImage)
-			data.Set(remoteImageKey, encryptImageRef)
+			data.Labels().Set(remoteImageKey, encryptImageRef)
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			helpers.Fail("pull", data.Get(remoteImageKey))
-			helpers.Ensure("pull", "--quiet", "--unpack=false", data.Get(remoteImageKey))
-			helpers.Fail("image", "decrypt", "--key="+keyPair.Pub, data.Get(remoteImageKey), data.Identifier("decrypted")) // decryption needs prv key, not pub key
-			return helpers.Command("image", "decrypt", "--key="+keyPair.Prv, data.Get(remoteImageKey), data.Identifier("decrypted"))
+			helpers.Fail("pull", data.Labels().Get(remoteImageKey))
+			helpers.Ensure("pull", "--quiet", "--unpack=false", data.Labels().Get(remoteImageKey))
+			helpers.Fail("image", "decrypt", "--key="+keyPair.Pub, data.Labels().Get(remoteImageKey), data.Identifier("decrypted")) // decryption needs prv key, not pub key
+			return helpers.Command("image", "decrypt", "--key="+keyPair.Prv, data.Labels().Get(remoteImageKey), data.Identifier("decrypted"))
 		},
 		Expected: test.Expects(0, nil, nil),
 	}
diff --git a/cmd/nerdctl/image/image_history_test.go b/cmd/nerdctl/image/image_history_test.go
index 699a7cf6fe1..1281c00fa47 100644
--- a/cmd/nerdctl/image/image_history_test.go
+++ b/cmd/nerdctl/image/image_history_test.go
@@ -83,7 +83,7 @@ func TestImageHistory(t *testing.T) {
 			// XXX: despite efforts to isolate this test, it keeps on having side effects linked to
 			// https://github.com/containerd/nerdctl/issues/3512
 			// Isolating it into a completely different root is the last ditched attempt at avoiding the issue
-			helpers.Write(nerdtest.DataRoot, test.ConfigValue(data.TempDir()))
+			helpers.Write(nerdtest.DataRoot, test.ConfigValue(data.Temp().Path()))
 			helpers.Ensure("pull", "--quiet", "--platform", "linux/arm64", testutil.CommonImage)
 		},
 		SubTests: []*test.Case{
diff --git a/cmd/nerdctl/image/image_list_test.go b/cmd/nerdctl/image/image_list_test.go
index 8956d2d9f77..a1db81ee440 100644
--- a/cmd/nerdctl/image/image_list_test.go
+++ b/cmd/nerdctl/image/image_list_test.go
@@ -148,10 +148,10 @@ LABEL foo=bar
 LABEL version=0.1
 RUN echo "actually creating a layer so that docker sets the createdAt time"
 `, testutil.CommonImage)
-			buildCtx := data.TempDir()
+			buildCtx := data.Temp().Path()
 			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Labels().Set("buildCtx", buildCtx)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", "taggedimage:one-fragment-one")
@@ -159,8 +159,8 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			data.Set("builtImageID", data.Identifier())
-			return helpers.Command("build", "-t", data.Identifier(), data.Get("buildCtx"))
+			data.Labels().Set("builtImageID", data.Identifier())
+			return helpers.Command("build", "-t", data.Identifier(), data.Labels().Get("buildCtx"))
 		},
 		Expected: test.Expects(0, nil, nil),
 		SubTests: []*test.Case{
@@ -169,7 +169,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", "label=foo=bar"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.Contains(data.Get("builtImageID")),
+						Output: expect.Contains(data.Labels().Get("builtImageID")),
 					}
 				},
 			},
@@ -178,7 +178,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", "label=foo=bar1"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.DoesNotContain(data.Get("builtImageID")),
+						Output: expect.DoesNotContain(data.Labels().Get("builtImageID")),
 					}
 				},
 			},
@@ -187,7 +187,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", "label=foo=bar", "--filter", "label=version=0.1"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.Contains(data.Get("builtImageID")),
+						Output: expect.Contains(data.Labels().Get("builtImageID")),
 					}
 				},
 			},
@@ -196,7 +196,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", "label=foo=bar", "--filter", "label=version=0.2"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.DoesNotContain(data.Get("builtImageID")),
+						Output: expect.DoesNotContain(data.Labels().Get("builtImageID")),
 					}
 				},
 			},
@@ -205,18 +205,18 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", "label=version"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.Contains(data.Get("builtImageID")),
+						Output: expect.Contains(data.Labels().Get("builtImageID")),
 					}
 				},
 			},
 			{
 				Description: "reference=ID*",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("images", "--filter", fmt.Sprintf("reference=%s*", data.Get("builtImageID")))
+					return helpers.Command("images", "--filter", fmt.Sprintf("reference=%s*", data.Labels().Get("builtImageID")))
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.Contains(data.Get("builtImageID")),
+						Output: expect.Contains(data.Labels().Get("builtImageID")),
 					}
 				},
 			},
@@ -231,13 +231,13 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 			{
 				Description: "before=ID:latest",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("images", "--filter", fmt.Sprintf("before=%s:latest", data.Get("builtImageID")))
+					return helpers.Command("images", "--filter", fmt.Sprintf("before=%s:latest", data.Labels().Get("builtImageID")))
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
 						Output: expect.All(
 							expect.Contains(testutil.ImageRepo(testutil.CommonImage)),
-							expect.DoesNotContain(data.Get("builtImageID")),
+							expect.DoesNotContain(data.Labels().Get("builtImageID")),
 						),
 					}
 				},
@@ -248,7 +248,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
 						Output: expect.All(
-							expect.Contains(data.Get("builtImageID")),
+							expect.Contains(data.Labels().Get("builtImageID")),
 							expect.DoesNotContain(testutil.ImageRepo(testutil.CommonImage)),
 						),
 					}
@@ -260,7 +260,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
 						Output: expect.All(
-							expect.DoesNotContain(data.Get("builtImageID")),
+							expect.DoesNotContain(data.Labels().Get("builtImageID")),
 							expect.DoesNotContain(testutil.ImageRepo(testutil.CommonImage)),
 						),
 					}
@@ -296,17 +296,17 @@ func TestImagesFilterDangling(t *testing.T) {
 			dockerfile := fmt.Sprintf(`FROM %s
 CMD ["echo", "nerdctl-build-notag-string"]
 	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
+			buildCtx := data.Temp().Path()
 			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Labels().Set("buildCtx", buildCtx)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("container", "prune", "-f")
 			helpers.Anyhow("image", "prune", "--all", "-f")
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("build", data.Get("buildCtx"))
+			return helpers.Command("build", data.Labels().Get("buildCtx"))
 		},
 		Expected: test.Expects(0, nil, nil),
 		SubTests: []*test.Case{
diff --git a/cmd/nerdctl/image/image_load_test.go b/cmd/nerdctl/image/image_load_test.go
index fc1fa549da4..6598ab93db5 100644
--- a/cmd/nerdctl/image/image_load_test.go
+++ b/cmd/nerdctl/image/image_load_test.go
@@ -43,7 +43,7 @@ func TestLoadStdinFromPipe(t *testing.T) {
 			identifier := data.Identifier()
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 			helpers.Ensure("tag", testutil.CommonImage, identifier)
-			helpers.Ensure("save", identifier, "-o", filepath.Join(data.TempDir(), "common.tar"))
+			helpers.Ensure("save", identifier, "-o", filepath.Join(data.Temp().Path(), "common.tar"))
 			helpers.Ensure("rmi", "-f", identifier)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
@@ -51,7 +51,7 @@ func TestLoadStdinFromPipe(t *testing.T) {
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			cmd := helpers.Command("load")
-			reader, err := os.Open(filepath.Join(data.TempDir(), "common.tar"))
+			reader, err := os.Open(filepath.Join(data.Temp().Path(), "common.tar"))
 			assert.NilError(t, err, "failed to open common.tar")
 			cmd.Feed(reader)
 			return cmd
@@ -94,14 +94,14 @@ func TestLoadQuiet(t *testing.T) {
 			identifier := data.Identifier()
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 			helpers.Ensure("tag", testutil.CommonImage, identifier)
-			helpers.Ensure("save", identifier, "-o", filepath.Join(data.TempDir(), "common.tar"))
+			helpers.Ensure("save", identifier, "-o", filepath.Join(data.Temp().Path(), "common.tar"))
 			helpers.Ensure("rmi", "-f", identifier)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("load", "--quiet", "--input", filepath.Join(data.TempDir(), "common.tar"))
+			return helpers.Command("load", "--quiet", "--input", filepath.Join(data.Temp().Path(), "common.tar"))
 		},
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
diff --git a/cmd/nerdctl/image/image_prune_test.go b/cmd/nerdctl/image/image_prune_test.go
index 1c8b402e332..402ea7bb94a 100644
--- a/cmd/nerdctl/image/image_prune_test.go
+++ b/cmd/nerdctl/image/image_prune_test.go
@@ -71,7 +71,7 @@ func TestImagePrune(t *testing.T) {
 				CMD ["echo", "nerdctl-test-image-prune"]
 					`, testutil.CommonImage)
 
-				buildCtx := data.TempDir()
+				buildCtx := data.Temp().Path()
 				err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 				assert.NilError(helpers.T(), err)
 				helpers.Ensure("build", buildCtx)
@@ -119,7 +119,7 @@ func TestImagePrune(t *testing.T) {
 				CMD ["echo", "nerdctl-test-image-prune"]
 					`, testutil.CommonImage)
 
-				buildCtx := data.TempDir()
+				buildCtx := data.Temp().Path()
 				err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 				assert.NilError(helpers.T(), err)
 				helpers.Ensure("build", buildCtx)
@@ -163,7 +163,7 @@ func TestImagePrune(t *testing.T) {
 CMD ["echo", "nerdctl-test-image-prune-filter-label"]
 LABEL foo=bar
 LABEL version=0.1`, testutil.CommonImage)
-				buildCtx := data.TempDir()
+				buildCtx := data.Temp().Path()
 				err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 				assert.NilError(helpers.T(), err)
 				helpers.Ensure("build", "-t", data.Identifier(), buildCtx)
@@ -203,22 +203,22 @@ LABEL version=0.1`, testutil.CommonImage)
 				dockerfile := fmt.Sprintf(`FROM %s
 RUN echo "Anything, so that we create actual content for docker to set the current time for CreatedAt"
 CMD ["echo", "nerdctl-test-image-prune-until"]`, testutil.CommonImage)
-				buildCtx := data.TempDir()
+				buildCtx := data.Temp().Path()
 				err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 				assert.NilError(helpers.T(), err)
 				helpers.Ensure("build", "-t", data.Identifier(), buildCtx)
 				imgList := helpers.Capture("images")
 				assert.Assert(t, strings.Contains(imgList, data.Identifier()), "Missing "+data.Identifier())
-				data.Set("imageID", data.Identifier())
+				data.Labels().Set("imageID", data.Identifier())
 			},
 			Command: test.Command("image", "prune", "--force", "--all", "--filter", "until=12h"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.DoesNotContain(data.Get("imageID")),
+						expect.DoesNotContain(data.Labels().Get("imageID")),
 						func(stdout string, info string, t *testing.T) {
 							imgList := helpers.Capture("images")
-							assert.Assert(t, strings.Contains(imgList, data.Get("imageID")), info)
+							assert.Assert(t, strings.Contains(imgList, data.Labels().Get("imageID")), info)
 						},
 					),
 				}
@@ -234,10 +234,10 @@ CMD ["echo", "nerdctl-test-image-prune-until"]`, testutil.CommonImage)
 					Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 						return &test.Expected{
 							Output: expect.All(
-								expect.Contains(data.Get("imageID")),
+								expect.Contains(data.Labels().Get("imageID")),
 								func(stdout string, info string, t *testing.T) {
 									imgList := helpers.Capture("images")
-									assert.Assert(t, !strings.Contains(imgList, data.Get("imageID")), imgList, info)
+									assert.Assert(t, !strings.Contains(imgList, data.Labels().Get("imageID")), imgList, info)
 								},
 							),
 						}
diff --git a/cmd/nerdctl/image/image_pull_linux_test.go b/cmd/nerdctl/image/image_pull_linux_test.go
index 9939bc72529..6156b82a3e2 100644
--- a/cmd/nerdctl/image/image_pull_linux_test.go
+++ b/cmd/nerdctl/image/image_pull_linux_test.go
@@ -61,7 +61,7 @@ func TestImagePullWithCosign(t *testing.T) {
 CMD ["echo", "nerdctl-build-test-string"]
 	`, testutil.CommonImage)
 
-			buildCtx := data.TempDir()
+			buildCtx := data.Temp().Path()
 			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 			assert.NilError(helpers.T(), err)
 			helpers.Ensure("build", "-t", testImageRef+":one", buildCtx)
@@ -69,7 +69,7 @@ CMD ["echo", "nerdctl-build-test-string"]
 			helpers.Ensure("push", "--sign=cosign", "--cosign-key="+keyPair.PrivateKey, testImageRef+":one")
 			helpers.Ensure("push", "--sign=cosign", "--cosign-key="+keyPair.PrivateKey, testImageRef+":two")
 			helpers.Ensure("rmi", "-f", testImageRef)
-			data.Set("imageref", testImageRef)
+			data.Labels().Set("imageref", testImageRef)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			if keyPair != nil {
@@ -86,7 +86,7 @@ CMD ["echo", "nerdctl-build-test-string"]
 			{
 				Description: "Pull with the correct key",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("pull", "--quiet", "--verify=cosign", "--cosign-key="+keyPair.PublicKey, data.Get("imageref")+":one")
+					return helpers.Command("pull", "--quiet", "--verify=cosign", "--cosign-key="+keyPair.PublicKey, data.Labels().Get("imageref")+":one")
 				},
 				Expected: test.Expects(0, nil, nil),
 			},
@@ -97,7 +97,7 @@ CMD ["echo", "nerdctl-build-test-string"]
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					newKeyPair := testhelpers.NewCosignKeyPair(t, "cosign-key-pair-test", "2")
-					return helpers.Command("pull", "--quiet", "--verify=cosign", "--cosign-key="+newKeyPair.PublicKey, data.Get("imageref")+":two")
+					return helpers.Command("pull", "--quiet", "--verify=cosign", "--cosign-key="+newKeyPair.PublicKey, data.Labels().Get("imageref")+":two")
 				},
 				Expected: test.Expects(12, nil, nil),
 			},
@@ -127,7 +127,7 @@ func TestImagePullPlainHttpWithDefaultPort(t *testing.T) {
 CMD ["echo", "nerdctl-build-test-string"]
 	`, testutil.CommonImage)
 
-			buildCtx := data.TempDir()
+			buildCtx := data.Temp().Path()
 			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 			assert.NilError(helpers.T(), err)
 			helpers.Ensure("build", "-t", testImageRef, buildCtx)
@@ -169,13 +169,15 @@ func TestImagePullSoci(t *testing.T) {
 			{
 				Description: "Run without specifying SOCI index",
 				NoParallel:  true,
-				Data: test.WithData("remoteSnapshotsExpectedCount", "11").
-					Set("sociIndexDigest", ""),
+				Data: test.WithLabels(map[string]string{
+					"remoteSnapshotsExpectedCount": "11",
+					"sociIndexDigest":              "",
+				}),
 				Setup: func(data test.Data, helpers test.Helpers) {
 					cmd := helpers.Custom("mount")
 					cmd.Run(&test.Expected{
 						Output: func(stdout string, info string, t *testing.T) {
-							data.Set("remoteSnapshotsInitialCount", strconv.Itoa(strings.Count(stdout, "fuse.rawBridge")))
+							data.Labels().Set("remoteSnapshotsInitialCount", strconv.Itoa(strings.Count(stdout, "fuse.rawBridge")))
 						},
 					})
 					helpers.Ensure("--snapshotter=soci", "pull", testutil.FfmpegSociImage)
@@ -189,10 +191,10 @@ func TestImagePullSoci(t *testing.T) {
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
 						Output: func(stdout string, info string, t *testing.T) {
-							remoteSnapshotsInitialCount, _ := strconv.Atoi(data.Get("remoteSnapshotsInitialCount"))
+							remoteSnapshotsInitialCount, _ := strconv.Atoi(data.Labels().Get("remoteSnapshotsInitialCount"))
 							remoteSnapshotsActualCount := strings.Count(stdout, "fuse.rawBridge")
 							assert.Equal(t,
-								data.Get("remoteSnapshotsExpectedCount"),
+								data.Labels().Get("remoteSnapshotsExpectedCount"),
 								strconv.Itoa(remoteSnapshotsActualCount-remoteSnapshotsInitialCount),
 								info)
 						},
@@ -202,13 +204,15 @@ func TestImagePullSoci(t *testing.T) {
 			{
 				Description: "Run with bad SOCI index",
 				NoParallel:  true,
-				Data: test.WithData("remoteSnapshotsExpectedCount", "11").
-					Set("sociIndexDigest", "sha256:thisisabadindex0000000000000000000000000000000000000000000000000"),
+				Data: test.WithLabels(map[string]string{
+					"remoteSnapshotsExpectedCount": "11",
+					"sociIndexDigest":              "sha256:thisisabadindex0000000000000000000000000000000000000000000000000",
+				}),
 				Setup: func(data test.Data, helpers test.Helpers) {
 					cmd := helpers.Custom("mount")
 					cmd.Run(&test.Expected{
 						Output: func(stdout string, info string, t *testing.T) {
-							data.Set("remoteSnapshotsInitialCount", strconv.Itoa(strings.Count(stdout, "fuse.rawBridge")))
+							data.Labels().Set("remoteSnapshotsInitialCount", strconv.Itoa(strings.Count(stdout, "fuse.rawBridge")))
 						},
 					})
 					helpers.Ensure("--snapshotter=soci", "pull", testutil.FfmpegSociImage)
@@ -222,10 +226,10 @@ func TestImagePullSoci(t *testing.T) {
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
 						Output: func(stdout string, info string, t *testing.T) {
-							remoteSnapshotsInitialCount, _ := strconv.Atoi(data.Get("remoteSnapshotsInitialCount"))
+							remoteSnapshotsInitialCount, _ := strconv.Atoi(data.Labels().Get("remoteSnapshotsInitialCount"))
 							remoteSnapshotsActualCount := strings.Count(stdout, "fuse.rawBridge")
 							assert.Equal(t,
-								data.Get("remoteSnapshotsExpectedCount"),
+								data.Labels().Get("remoteSnapshotsExpectedCount"),
 								strconv.Itoa(remoteSnapshotsActualCount-remoteSnapshotsInitialCount),
 								info)
 						},
diff --git a/cmd/nerdctl/image/image_push_linux_test.go b/cmd/nerdctl/image/image_push_linux_test.go
index 66d26512a8a..bf10f371a23 100644
--- a/cmd/nerdctl/image/image_push_linux_test.go
+++ b/cmd/nerdctl/image/image_push_linux_test.go
@@ -67,16 +67,16 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						registryNoAuthHTTPRandom.IP.String(), registryNoAuthHTTPRandom.Port, data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.CommonImage, testImageRef)
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", data.Get("testImageRef"))
+					return helpers.Command("push", data.Labels().Get("testImageRef"))
 				},
 				Expected: test.Expects(1, []error{errors.New("server gave HTTP response to HTTPS client")}, nil),
 			},
@@ -87,16 +87,16 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						registryNoAuthHTTPRandom.IP.String(), registryNoAuthHTTPRandom.Port, data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.CommonImage, testImageRef)
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", "--insecure-registry", data.Get("testImageRef"))
+					return helpers.Command("push", "--insecure-registry", data.Labels().Get("testImageRef"))
 				},
 				Expected: test.Expects(0, nil, nil),
 			},
@@ -106,11 +106,11 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						"127.0.0.1", registryNoAuthHTTPRandom.Port, data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.CommonImage, testImageRef)
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", data.Get("testImageRef"))
+					return helpers.Command("push", data.Labels().Get("testImageRef"))
 				},
 				Expected: test.Expects(0, nil, nil),
 			},
@@ -121,16 +121,16 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s/%s:%s",
 						registryNoAuthHTTPDefault.IP.String(), data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.CommonImage, testImageRef)
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", "--insecure-registry", data.Get("testImageRef"))
+					return helpers.Command("push", "--insecure-registry", data.Labels().Get("testImageRef"))
 				},
 				Expected: test.Expects(0, nil, nil),
 			},
@@ -141,19 +141,19 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						registryTokenAuthHTTPSRandom.IP.String(), registryTokenAuthHTTPSRandom.Port, data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.CommonImage, testImageRef)
 					helpers.Ensure("--insecure-registry", "login", "-u", "admin", "-p", "badmin",
 						fmt.Sprintf("%s:%d", registryTokenAuthHTTPSRandom.IP.String(), registryTokenAuthHTTPSRandom.Port))
 
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", "--insecure-registry", data.Get("testImageRef"))
+					return helpers.Command("push", "--insecure-registry", data.Labels().Get("testImageRef"))
 				},
 				Expected: test.Expects(0, nil, nil),
 			},
@@ -164,19 +164,19 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						registryTokenAuthHTTPSRandom.IP.String(), registryTokenAuthHTTPSRandom.Port, data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.CommonImage, testImageRef)
 					helpers.Ensure("--hosts-dir", registryTokenAuthHTTPSRandom.HostsDir, "login", "-u", "admin", "-p", "badmin",
 						fmt.Sprintf("%s:%d", registryTokenAuthHTTPSRandom.IP.String(), registryTokenAuthHTTPSRandom.Port))
 
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", "--hosts-dir", registryTokenAuthHTTPSRandom.HostsDir, data.Get("testImageRef"))
+					return helpers.Command("push", "--hosts-dir", registryTokenAuthHTTPSRandom.HostsDir, data.Labels().Get("testImageRef"))
 				},
 				Expected: test.Expects(0, nil, nil),
 			},
@@ -187,16 +187,16 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.NonDistBlobImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						registryNoAuthHTTPRandom.IP.String(), registryNoAuthHTTPRandom.Port, data.Identifier(), strings.Split(testutil.NonDistBlobImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.NonDistBlobImage, testImageRef)
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", "--insecure-registry", data.Get("testImageRef"))
+					return helpers.Command("push", "--insecure-registry", data.Labels().Get("testImageRef"))
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
@@ -219,16 +219,16 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.NonDistBlobImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						registryNoAuthHTTPRandom.IP.String(), registryNoAuthHTTPRandom.Port, data.Identifier(), strings.Split(testutil.NonDistBlobImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.NonDistBlobImage, testImageRef)
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", "--insecure-registry", "--allow-nondistributable-artifacts", data.Get("testImageRef"))
+					return helpers.Command("push", "--insecure-registry", "--allow-nondistributable-artifacts", data.Labels().Get("testImageRef"))
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
@@ -254,16 +254,16 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.UbuntuImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						registryNoAuthHTTPRandom.IP.String(), registryNoAuthHTTPRandom.Port, data.Identifier(), strings.Split(testutil.UbuntuImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.UbuntuImage, testImageRef)
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", "--snapshotter=soci", "--insecure-registry", "--soci-span-size=2097152", "--soci-min-layer-size=20971520", data.Get("testImageRef"))
+					return helpers.Command("push", "--snapshotter=soci", "--insecure-registry", "--soci-span-size=2097152", "--soci-min-layer-size=20971520", data.Labels().Get("testImageRef"))
 				},
 				Expected: test.Expects(0, nil, nil),
 			},
diff --git a/cmd/nerdctl/image/image_remove_test.go b/cmd/nerdctl/image/image_remove_test.go
index e91f05c69af..db5fa47f722 100644
--- a/cmd/nerdctl/image/image_remove_test.go
+++ b/cmd/nerdctl/image/image_remove_test.go
@@ -129,11 +129,11 @@ func TestRemove(t *testing.T) {
 				repoName, _ := imgutil.ParseRepoTag(testutil.CommonImage)
 				imgShortID := strings.TrimPrefix(img.RepoDigests[0], repoName+"@sha256:")[0:8]
 
-				data.Set(imgShortIDKey, imgShortID)
+				data.Labels().Set(imgShortIDKey, imgShortID)
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
-				helpers.Anyhow("rmi", "-f", data.Get(imgShortIDKey))
+				helpers.Anyhow("rmi", "-f", data.Labels().Get(imgShortIDKey))
 			},
 			Command: test.Command("rmi", "-f", testutil.CommonImage),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
@@ -238,11 +238,11 @@ func TestRemove(t *testing.T) {
 				repoName, _ := imgutil.ParseRepoTag(testutil.CommonImage)
 				imgShortID := strings.TrimPrefix(img.RepoDigests[0], repoName+"@sha256:")[0:8]
 
-				data.Set(imgShortIDKey, imgShortID)
+				data.Labels().Set(imgShortIDKey, imgShortID)
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
-				helpers.Anyhow("rmi", "-f", data.Get(imgShortIDKey))
+				helpers.Anyhow("rmi", "-f", data.Labels().Get(imgShortIDKey))
 			},
 			Command: test.Command("rmi", "-f", testutil.CommonImage),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
@@ -330,17 +330,17 @@ func TestIssue3016(t *testing.T) {
 
 				helpers.Ensure("tag", testutil.CommonImage, tagID)
 
-				data.Set(tagIDKey, tagID)
+				data.Labels().Set(tagIDKey, tagID)
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("rmi", data.Get(tagIDKey))
+				return helpers.Command("rmi", data.Labels().Get(tagIDKey))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: 0,
 					Errors:   []error{},
 					Output: func(stdout string, info string, t *testing.T) {
-						helpers.Command("images", data.Get(tagIDKey)).Run(&test.Expected{
+						helpers.Command("images", data.Labels().Get(tagIDKey)).Run(&test.Expected{
 							ExitCode: 0,
 							Output: func(stdout string, info string, t *testing.T) {
 								assert.Equal(t, len(strings.Split(stdout, "\n")), 2)
diff --git a/cmd/nerdctl/image/image_save_test.go b/cmd/nerdctl/image/image_save_test.go
index 7e61ef6e28f..4f3bf58de6a 100644
--- a/cmd/nerdctl/image/image_save_test.go
+++ b/cmd/nerdctl/image/image_save_test.go
@@ -44,13 +44,13 @@ func TestSaveContent(t *testing.T) {
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("save", "-o", filepath.Join(data.TempDir(), "out.tar"), testutil.CommonImage)
+			return helpers.Command("save", "-o", filepath.Join(data.Temp().Path(), "out.tar"), testutil.CommonImage)
 		},
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
 				Output: func(stdout string, info string, t *testing.T) {
-					rootfsPath := filepath.Join(data.TempDir(), "rootfs")
-					err := testhelpers.ExtractDockerArchive(filepath.Join(data.TempDir(), "out.tar"), rootfsPath)
+					rootfsPath := filepath.Join(data.Temp().Path(), "rootfs")
+					err := testhelpers.ExtractDockerArchive(filepath.Join(data.Temp().Path(), "out.tar"), rootfsPath)
 					assert.NilError(t, err)
 					etcOSReleasePath := filepath.Join(rootfsPath, "/etc/os-release")
 					etcOSReleaseBytes, err := os.ReadFile(etcOSReleasePath)
@@ -83,8 +83,8 @@ func TestSave(t *testing.T) {
 			Description: "Single image, by id",
 			NoParallel:  true,
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get("id") != "" {
-					helpers.Anyhow("rmi", "-f", data.Get("id"))
+				if data.Labels().Get("id") != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get("id"))
 				}
 			},
 			Setup: func(data test.Data, helpers test.Helpers) {
@@ -97,14 +97,14 @@ func TestSave(t *testing.T) {
 				} else {
 					id = strings.Split(img.RepoDigests[0], ":")[1]
 				}
-				tarPath := filepath.Join(data.TempDir(), "out.tar")
+				tarPath := filepath.Join(data.Temp().Path(), "out.tar")
 				helpers.Ensure("save", "-o", tarPath, id)
 				helpers.Ensure("rmi", "-f", testutil.CommonImage)
 				helpers.Ensure("load", "-i", tarPath)
-				data.Set("id", id)
+				data.Labels().Set("id", id)
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get("id"), "sh", "-euxc", "echo foo")
+				return helpers.Command("run", "--rm", data.Labels().Get("id"), "sh", "-euxc", "echo foo")
 			},
 			Expected: test.Expects(0, nil, expect.Equals("foo\n")),
 		},
@@ -112,8 +112,8 @@ func TestSave(t *testing.T) {
 			Description: "Image with different names, by id",
 			NoParallel:  true,
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get("id") != "" {
-					helpers.Anyhow("rmi", "-f", data.Get("id"))
+				if data.Labels().Get("id") != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get("id"))
 				}
 			},
 			Setup: func(data test.Data, helpers test.Helpers) {
@@ -126,14 +126,14 @@ func TestSave(t *testing.T) {
 					id = strings.Split(img.RepoDigests[0], ":")[1]
 				}
 				helpers.Ensure("tag", testutil.CommonImage, data.Identifier())
-				tarPath := filepath.Join(data.TempDir(), "out.tar")
+				tarPath := filepath.Join(data.Temp().Path(), "out.tar")
 				helpers.Ensure("save", "-o", tarPath, id)
 				helpers.Ensure("rmi", "-f", testutil.CommonImage)
 				helpers.Ensure("load", "-i", tarPath)
-				data.Set("id", id)
+				data.Labels().Set("id", id)
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get("id"), "sh", "-euxc", "echo foo")
+				return helpers.Command("run", "--rm", data.Labels().Get("id"), "sh", "-euxc", "echo foo")
 			},
 			Expected: test.Expects(0, nil, expect.Equals("foo\n")),
 		},
@@ -161,8 +161,8 @@ func TestSaveMultipleImagesWithSameIDAndLoad(t *testing.T) {
 			Description: "Issue #3568 - Save multiple container images with the same image ID but different image names",
 			NoParallel:  true,
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get("id") != "" {
-					helpers.Anyhow("rmi", "-f", data.Get("id"))
+				if data.Labels().Get("id") != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get("id"))
 				}
 			},
 			Setup: func(data test.Data, helpers test.Helpers) {
@@ -175,11 +175,11 @@ func TestSaveMultipleImagesWithSameIDAndLoad(t *testing.T) {
 					id = strings.Split(img.RepoDigests[0], ":")[1]
 				}
 				helpers.Ensure("tag", testutil.CommonImage, data.Identifier())
-				tarPath := filepath.Join(data.TempDir(), "out.tar")
+				tarPath := filepath.Join(data.Temp().Path(), "out.tar")
 				helpers.Ensure("save", "-o", tarPath, testutil.CommonImage, data.Identifier())
 				helpers.Ensure("rmi", "-f", id)
 				helpers.Ensure("load", "-i", tarPath)
-				data.Set("id", id)
+				data.Labels().Set("id", id)
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("images", "--no-trunc")
@@ -189,7 +189,7 @@ func TestSaveMultipleImagesWithSameIDAndLoad(t *testing.T) {
 					ExitCode: 0,
 					Errors:   []error{},
 					Output: func(stdout string, info string, t *testing.T) {
-						assert.Equal(t, strings.Count(stdout, data.Get("id")), 2)
+						assert.Equal(t, strings.Count(stdout, data.Labels().Get("id")), 2)
 					},
 				}
 			},
diff --git a/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go b/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go
index 2387555c0a3..9a7b09805b5 100644
--- a/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go
+++ b/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go
@@ -58,7 +58,7 @@ func TestIPFSCompNoBuild(t *testing.T) {
 		// Start Kubo
 		ipfsRegistry = registry.NewKuboRegistry(data, helpers, t, nil, 0, nil)
 		ipfsRegistry.Setup(data, helpers)
-		data.Set(ipfsAddrKey, fmt.Sprintf("/ip4/%s/tcp/%d", ipfsRegistry.IP, ipfsRegistry.Port))
+		data.Labels().Set(ipfsAddrKey, fmt.Sprintf("/ip4/%s/tcp/%d", ipfsRegistry.IP, ipfsRegistry.Port))
 
 		// Ensure we have the images
 		helpers.Ensure("pull", "--quiet", testutil.WordpressImage)
@@ -114,15 +114,15 @@ func subtestTestIPFSCompNoB(t *testing.T, stargz bool, byAddr bool) *test.Case {
 			ipfsCIDWP = pushToIPFS(helpers, testutil.WordpressImage, "--estargz")
 			ipfsCIDMD = pushToIPFS(helpers, testutil.MariaDBImage, "--estargz")
 		} else if byAddr {
-			ipfsCIDWP = pushToIPFS(helpers, testutil.WordpressImage, "--ipfs-address="+data.Get(ipfsAddrKey))
-			ipfsCIDMD = pushToIPFS(helpers, testutil.MariaDBImage, "--ipfs-address="+data.Get(ipfsAddrKey))
-			data.Set(composeExtraKey, "--ipfs-address="+data.Get(ipfsAddrKey))
+			ipfsCIDWP = pushToIPFS(helpers, testutil.WordpressImage, "--ipfs-address="+data.Labels().Get(ipfsAddrKey))
+			ipfsCIDMD = pushToIPFS(helpers, testutil.MariaDBImage, "--ipfs-address="+data.Labels().Get(ipfsAddrKey))
+			data.Labels().Set(composeExtraKey, "--ipfs-address="+data.Labels().Get(ipfsAddrKey))
 		} else {
 			ipfsCIDWP = pushToIPFS(helpers, testutil.WordpressImage)
 			ipfsCIDMD = pushToIPFS(helpers, testutil.MariaDBImage)
 		}
-		data.Set(wordpressImageCIDKey, ipfsCIDWP)
-		data.Set(mariaImageCIDKey, ipfsCIDMD)
+		data.Labels().Set(wordpressImageCIDKey, ipfsCIDWP)
+		data.Labels().Set(mariaImageCIDKey, ipfsCIDMD)
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -131,9 +131,9 @@ func subtestTestIPFSCompNoB(t *testing.T, stargz bool, byAddr bool) *test.Case {
 		// they have the same cid - except for the estargz version obviously)
 		// Deliberately electing to not remove them here so that we can parallelize and cut down the running time
 		/*
-			if data.Get(mariaImageCIDKey) != "" {
-				helpers.Anyhow("rmi", "-f", data.Get(mariaImageCIDKey))
-				helpers.Anyhow("rmi", "-f", data.Get(wordpressImageCIDKey))
+			if data.Labels().Get(mariaImageCIDKey) != "" {
+				helpers.Anyhow("rmi", "-f", data.Labels().Get(mariaImageCIDKey))
+				helpers.Anyhow("rmi", "-f", data.Labels().Get(wordpressImageCIDKey))
 			}
 		*/
 	}
@@ -141,7 +141,7 @@ func subtestTestIPFSCompNoB(t *testing.T, stargz bool, byAddr bool) *test.Case {
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
 		safePort, err := portlock.Acquire(0)
 		assert.NilError(helpers.T(), err)
-		data.Set("wordpressPort", strconv.Itoa(safePort))
+		data.Labels().Set("wordpressPort", strconv.Itoa(safePort))
 		composeUP(data, helpers, fmt.Sprintf(`
 version: '3.1'
 
@@ -175,7 +175,7 @@ services:
 volumes:
   wordpress:
   db:
-`, data.Get(wordpressImageCIDKey), safePort, data.Get(mariaImageCIDKey)), data.Get(composeExtraKey))
+`, data.Labels().Get(wordpressImageCIDKey), safePort, data.Labels().Get(mariaImageCIDKey)), data.Labels().Get(composeExtraKey))
 		// FIXME: need to break down composeUP into testable commands instead
 		// Right now, this is just a dummy placeholder
 		return helpers.Command("info")
@@ -219,7 +219,7 @@ func TestIPFSCompBuild(t *testing.T) {
 		time.Sleep(time.Second)
 
 		// Save nginx to ipfs
-		data.Set(mainImageCIDKey, pushToIPFS(helpers, testutil.NginxAlpineImage))
+		data.Labels().Set(mainImageCIDKey, pushToIPFS(helpers, testutil.NginxAlpineImage))
 
 		const dockerComposeYAML = `
 services:
@@ -230,7 +230,7 @@ services:
 `
 		dockerfile := fmt.Sprintf(`FROM %s/ipfs/%s
 COPY index.html /usr/share/nginx/html/index.html
-`, listenAddr, data.Get(mainImageCIDKey))
+`, listenAddr, data.Labels().Get(mainImageCIDKey))
 
 		comp = testutil.NewComposeDir(t, dockerComposeYAML)
 		comp.WriteFile("Dockerfile", dockerfile)
@@ -239,7 +239,7 @@ COPY index.html /usr/share/nginx/html/index.html
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
 		if ipfsServer != nil {
-			helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
+			helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
 			ipfsServer.Signal(os.Kill)
 		}
 		if comp != nil {
@@ -290,7 +290,7 @@ func composeUP(data test.Data, helpers test.Helpers, dockerComposeYAML string, o
 
 	checkWordpress := func() error {
 		// FIXME: see other notes on using the same port repeatedly
-		resp, err := nettestutil.HTTPGet("http://127.0.0.1:"+data.Get("wordpressPort"), 5, false)
+		resp, err := nettestutil.HTTPGet("http://127.0.0.1:"+data.Labels().Get("wordpressPort"), 5, false)
 		if err != nil {
 			return err
 		}
diff --git a/cmd/nerdctl/ipfs/ipfs_kubo_linux_test.go b/cmd/nerdctl/ipfs/ipfs_kubo_linux_test.go
index 48068b076c8..de1dc16d239 100644
--- a/cmd/nerdctl/ipfs/ipfs_kubo_linux_test.go
+++ b/cmd/nerdctl/ipfs/ipfs_kubo_linux_test.go
@@ -51,7 +51,7 @@ func TestIPFSAddrWithKubo(t *testing.T) {
 		ipfsRegistry = registry.NewKuboRegistry(data, helpers, t, nil, 0, nil)
 		ipfsRegistry.Setup(data, helpers)
 		ipfsAddr := fmt.Sprintf("/ip4/%s/tcp/%d", ipfsRegistry.IP, ipfsRegistry.Port)
-		data.Set(ipfsAddrKey, ipfsAddr)
+		data.Labels().Set(ipfsAddrKey, ipfsAddr)
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -65,17 +65,17 @@ func TestIPFSAddrWithKubo(t *testing.T) {
 			Description: "with default snapshotter",
 			NoParallel:  true,
 			Setup: func(data test.Data, helpers test.Helpers) {
-				ipfsCID := pushToIPFS(helpers, testutil.CommonImage, fmt.Sprintf("--ipfs-address=%s", data.Get(ipfsAddrKey)))
-				helpers.Ensure("pull", "--quiet", "--ipfs-address", data.Get(ipfsAddrKey), "ipfs://"+ipfsCID)
-				data.Set(mainImageCIDKey, ipfsCID)
+				ipfsCID := pushToIPFS(helpers, testutil.CommonImage, fmt.Sprintf("--ipfs-address=%s", data.Labels().Get(ipfsAddrKey)))
+				helpers.Ensure("pull", "--quiet", "--ipfs-address", data.Labels().Get(ipfsAddrKey), "ipfs://"+ipfsCID)
+				data.Labels().Set(mainImageCIDKey, ipfsCID)
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get(mainImageCIDKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
+				if data.Labels().Get(mainImageCIDKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
 				}
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(mainImageCIDKey), "echo", "hello")
+				return helpers.Command("run", "--rm", data.Labels().Get(mainImageCIDKey), "echo", "hello")
 			},
 			Expected: test.Expects(0, nil, expect.Equals("hello\n")),
 		},
@@ -88,17 +88,17 @@ func TestIPFSAddrWithKubo(t *testing.T) {
 				nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3475"),
 			),
 			Setup: func(data test.Data, helpers test.Helpers) {
-				ipfsCID := pushToIPFS(helpers, testutil.CommonImage, fmt.Sprintf("--ipfs-address=%s", data.Get(ipfsAddrKey)), "--estargz")
-				helpers.Ensure("pull", "--quiet", "--ipfs-address", data.Get(ipfsAddrKey), "ipfs://"+ipfsCID)
-				data.Set(mainImageCIDKey, ipfsCID)
+				ipfsCID := pushToIPFS(helpers, testutil.CommonImage, fmt.Sprintf("--ipfs-address=%s", data.Labels().Get(ipfsAddrKey)), "--estargz")
+				helpers.Ensure("pull", "--quiet", "--ipfs-address", data.Labels().Get(ipfsAddrKey), "ipfs://"+ipfsCID)
+				data.Labels().Set(mainImageCIDKey, ipfsCID)
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get(mainImageCIDKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
+				if data.Labels().Get(mainImageCIDKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
 				}
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(mainImageCIDKey), "ls", "/.stargz-snapshotter")
+				return helpers.Command("run", "--rm", data.Labels().Get(mainImageCIDKey), "ls", "/.stargz-snapshotter")
 			},
 			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("sha256:.*[.]json[\n]"))),
 		},
diff --git a/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go b/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go
index dcb0f7429ed..5c044bf36af 100644
--- a/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go
+++ b/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go
@@ -89,16 +89,16 @@ func TestIPFSNerdctlRegistry(t *testing.T) {
 			Description: "with default snapshotter",
 			NoParallel:  true,
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(ipfsImageURLKey, listenAddr+"/ipfs/"+pushToIPFS(helpers, testutil.CommonImage))
-				helpers.Ensure("pull", "--quiet", data.Get(ipfsImageURLKey))
+				data.Labels().Set(ipfsImageURLKey, listenAddr+"/ipfs/"+pushToIPFS(helpers, testutil.CommonImage))
+				helpers.Ensure("pull", "--quiet", data.Labels().Get(ipfsImageURLKey))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get(ipfsImageURLKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(ipfsImageURLKey))
+				if data.Labels().Get(ipfsImageURLKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(ipfsImageURLKey))
 				}
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(ipfsImageURLKey), "echo", "hello")
+				return helpers.Command("run", "--rm", data.Labels().Get(ipfsImageURLKey), "echo", "hello")
 			},
 			Expected: test.Expects(0, nil, expect.Equals("hello\n")),
 		},
@@ -107,16 +107,16 @@ func TestIPFSNerdctlRegistry(t *testing.T) {
 			NoParallel:  true,
 			Require:     nerdtest.Stargz,
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(ipfsImageURLKey, listenAddr+"/ipfs/"+pushToIPFS(helpers, testutil.CommonImage, "--estargz"))
-				helpers.Ensure("pull", "--quiet", data.Get(ipfsImageURLKey))
+				data.Labels().Set(ipfsImageURLKey, listenAddr+"/ipfs/"+pushToIPFS(helpers, testutil.CommonImage, "--estargz"))
+				helpers.Ensure("pull", "--quiet", data.Labels().Get(ipfsImageURLKey))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get(ipfsImageURLKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(ipfsImageURLKey))
+				if data.Labels().Get(ipfsImageURLKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(ipfsImageURLKey))
 				}
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(ipfsImageURLKey), "ls", "/.stargz-snapshotter")
+				return helpers.Command("run", "--rm", data.Labels().Get(ipfsImageURLKey), "ls", "/.stargz-snapshotter")
 			},
 			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("sha256:.*[.]json[\n]"))),
 		},
@@ -126,18 +126,18 @@ func TestIPFSNerdctlRegistry(t *testing.T) {
 			Require:     nerdtest.Build,
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rmi", "-f", data.Identifier("built-image"))
-				if data.Get(ipfsImageURLKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(ipfsImageURLKey))
+				if data.Labels().Get(ipfsImageURLKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(ipfsImageURLKey))
 				}
 			},
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(ipfsImageURLKey, listenAddr+"/ipfs/"+pushToIPFS(helpers, testutil.CommonImage))
+				data.Labels().Set(ipfsImageURLKey, listenAddr+"/ipfs/"+pushToIPFS(helpers, testutil.CommonImage))
 
 				dockerfile := fmt.Sprintf(`FROM %s
 CMD ["echo", "nerdctl-build-test-string"]
-	`, data.Get(ipfsImageURLKey))
+	`, data.Labels().Get(ipfsImageURLKey))
 
-				buildCtx := data.TempDir()
+				buildCtx := data.Temp().Path()
 				err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 				assert.NilError(helpers.T(), err)
 
diff --git a/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go b/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go
index dda1771cadd..eb1262cc696 100644
--- a/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go
+++ b/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go
@@ -53,16 +53,16 @@ func TestIPFSSimple(t *testing.T) {
 			Description: "with default snapshotter",
 			NoParallel:  true,
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage))
-				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Get(mainImageCIDKey))
+				data.Labels().Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage))
+				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Labels().Get(mainImageCIDKey))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get(mainImageCIDKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
+				if data.Labels().Get(mainImageCIDKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
 				}
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(mainImageCIDKey), "echo", "hello")
+				return helpers.Command("run", "--rm", data.Labels().Get(mainImageCIDKey), "echo", "hello")
 			},
 			Expected: test.Expects(0, nil, expect.Equals("hello\n")),
 		},
@@ -74,16 +74,16 @@ func TestIPFSSimple(t *testing.T) {
 				nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3475"),
 			),
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage, "--estargz"))
-				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Get(mainImageCIDKey))
+				data.Labels().Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage, "--estargz"))
+				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Labels().Get(mainImageCIDKey))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get(mainImageCIDKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
+				if data.Labels().Get(mainImageCIDKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
 				}
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(mainImageCIDKey), "ls", "/.stargz-snapshotter")
+				return helpers.Command("run", "--rm", data.Labels().Get(mainImageCIDKey), "ls", "/.stargz-snapshotter")
 			},
 			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("sha256:.*[.]json[\n]"))),
 		},
@@ -91,32 +91,32 @@ func TestIPFSSimple(t *testing.T) {
 			Description: "with commit and push",
 			NoParallel:  true,
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage))
-				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Get(mainImageCIDKey))
+				data.Labels().Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage))
+				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Labels().Get(mainImageCIDKey))
 
 				// Run a container that does modify something, then commit and push it
-				helpers.Ensure("run", "--name", data.Identifier("commit-container"), data.Get(mainImageCIDKey), "sh", "-c", "--", "echo hello > /hello")
+				helpers.Ensure("run", "--name", data.Identifier("commit-container"), data.Labels().Get(mainImageCIDKey), "sh", "-c", "--", "echo hello > /hello")
 				helpers.Ensure("commit", data.Identifier("commit-container"), data.Identifier("commit-image"))
-				data.Set(transformedImageCIDKey, pushToIPFS(helpers, data.Identifier("commit-image")))
+				data.Labels().Set(transformedImageCIDKey, pushToIPFS(helpers, data.Identifier("commit-image")))
 
 				// Clean-up
 				helpers.Ensure("rm", data.Identifier("commit-container"))
 				helpers.Ensure("rmi", data.Identifier("commit-image"))
 
 				// Pull back the committed image
-				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Get(transformedImageCIDKey))
+				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Labels().Get(transformedImageCIDKey))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier("commit-container"))
 				helpers.Anyhow("rmi", "-f", data.Identifier("commit-image"))
-				if data.Get(mainImageCIDKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
-					helpers.Anyhow("rmi", "-f", data.Get(transformedImageCIDKey))
+				if data.Labels().Get(mainImageCIDKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(transformedImageCIDKey))
 				}
 			},
 
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(transformedImageCIDKey), "cat", "/hello")
+				return helpers.Command("run", "--rm", data.Labels().Get(transformedImageCIDKey), "cat", "/hello")
 			},
 
 			Expected: test.Expects(0, nil, expect.Equals("hello\n")),
@@ -129,32 +129,32 @@ func TestIPFSSimple(t *testing.T) {
 				nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3475"),
 			),
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage, "--estargz"))
-				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Get(mainImageCIDKey))
+				data.Labels().Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage, "--estargz"))
+				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Labels().Get(mainImageCIDKey))
 
 				// Run a container that does modify something, then commit and push it
-				helpers.Ensure("run", "--name", data.Identifier("commit-container"), data.Get(mainImageCIDKey), "sh", "-c", "--", "echo hello > /hello")
+				helpers.Ensure("run", "--name", data.Identifier("commit-container"), data.Labels().Get(mainImageCIDKey), "sh", "-c", "--", "echo hello > /hello")
 				helpers.Ensure("commit", data.Identifier("commit-container"), data.Identifier("commit-image"))
-				data.Set(transformedImageCIDKey, pushToIPFS(helpers, data.Identifier("commit-image")))
+				data.Labels().Set(transformedImageCIDKey, pushToIPFS(helpers, data.Identifier("commit-image")))
 
 				// Clean-up
 				helpers.Ensure("rm", data.Identifier("commit-container"))
 				helpers.Ensure("rmi", data.Identifier("commit-image"))
 
 				// Pull back the image
-				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Get(transformedImageCIDKey))
+				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Labels().Get(transformedImageCIDKey))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier("commit-container"))
 				helpers.Anyhow("rmi", "-f", data.Identifier("commit-image"))
-				if data.Get(mainImageCIDKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
-					helpers.Anyhow("rmi", "-f", data.Get(transformedImageCIDKey))
+				if data.Labels().Get(mainImageCIDKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(transformedImageCIDKey))
 				}
 			},
 
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(transformedImageCIDKey), "sh", "-c", "--", "cat /hello && ls /.stargz-snapshotter")
+				return helpers.Command("run", "--rm", data.Labels().Get(transformedImageCIDKey), "sh", "-c", "--", "cat /hello && ls /.stargz-snapshotter")
 			},
 
 			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("hello[\n]sha256:.*[.]json[\n]"))),
@@ -164,18 +164,18 @@ func TestIPFSSimple(t *testing.T) {
 			NoParallel:  true,
 			Require:     require.Binary("openssl"),
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage))
-				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Get(mainImageCIDKey))
+				data.Labels().Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage))
+				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Labels().Get(mainImageCIDKey))
 
 				// Prep a key pair
 				keyPair := testhelpers.NewJWEKeyPair(t)
 				// FIXME: this will only cleanup when the group is done, not right, but it works
 				t.Cleanup(keyPair.Cleanup)
-				data.Set("pub", keyPair.Pub)
-				data.Set("prv", keyPair.Prv)
+				data.Labels().Set("pub", keyPair.Pub)
+				data.Labels().Set("prv", keyPair.Prv)
 
 				// Encrypt the image, and verify it is encrypted
-				helpers.Ensure("image", "encrypt", "--recipient=jwe:"+keyPair.Pub, data.Get(mainImageCIDKey), data.Identifier("encrypted"))
+				helpers.Ensure("image", "encrypt", "--recipient=jwe:"+keyPair.Pub, data.Labels().Get(mainImageCIDKey), data.Identifier("encrypted"))
 				cmd := helpers.Command("image", "inspect", "--mode=native", "--format={{len .Index.Manifests}}", data.Identifier("encrypted"))
 				cmd.Run(&test.Expected{
 					Output: expect.Equals("1\n"),
@@ -186,19 +186,19 @@ func TestIPFSSimple(t *testing.T) {
 				})
 
 				// Push the encrypted image and save the CID
-				data.Set(transformedImageCIDKey, pushToIPFS(helpers, data.Identifier("encrypted")))
+				data.Labels().Set(transformedImageCIDKey, pushToIPFS(helpers, data.Identifier("encrypted")))
 
 				// Remove both images locally
-				helpers.Ensure("rmi", "-f", data.Get(mainImageCIDKey))
-				helpers.Ensure("rmi", "-f", data.Get(transformedImageCIDKey))
+				helpers.Ensure("rmi", "-f", data.Labels().Get(mainImageCIDKey))
+				helpers.Ensure("rmi", "-f", data.Labels().Get(transformedImageCIDKey))
 
 				// Pull back without unpacking
-				helpers.Ensure("pull", "--quiet", "--unpack=false", "ipfs://"+data.Get(transformedImageCIDKey))
+				helpers.Ensure("pull", "--quiet", "--unpack=false", "ipfs://"+data.Labels().Get(transformedImageCIDKey))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get(mainImageCIDKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
-					helpers.Anyhow("rmi", "-f", data.Get(transformedImageCIDKey))
+				if data.Labels().Get(mainImageCIDKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(transformedImageCIDKey))
 				}
 			},
 			SubTests: []*test.Case{
@@ -208,7 +208,7 @@ func TestIPFSSimple(t *testing.T) {
 						helpers.Anyhow("rm", "-f", data.Identifier("decrypted"))
 					},
 					Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-						return helpers.Command("image", "decrypt", "--key="+data.Get("pub"), data.Get(transformedImageCIDKey), data.Identifier("decrypted"))
+						return helpers.Command("image", "decrypt", "--key="+data.Labels().Get("pub"), data.Labels().Get(transformedImageCIDKey), data.Identifier("decrypted"))
 					},
 					Expected: test.Expects(1, nil, nil),
 				},
@@ -218,7 +218,7 @@ func TestIPFSSimple(t *testing.T) {
 						helpers.Anyhow("rm", "-f", data.Identifier("decrypted"))
 					},
 					Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-						return helpers.Command("image", "decrypt", "--key="+data.Get("prv"), data.Get(transformedImageCIDKey), data.Identifier("decrypted"))
+						return helpers.Command("image", "decrypt", "--key="+data.Labels().Get("prv"), data.Labels().Get(transformedImageCIDKey), data.Identifier("decrypted"))
 					},
 					Expected: test.Expects(0, nil, nil),
 				},
diff --git a/cmd/nerdctl/main_test_test.go b/cmd/nerdctl/main_test_test.go
index ae9acc0f7f6..4a06ea3667f 100644
--- a/cmd/nerdctl/main_test_test.go
+++ b/cmd/nerdctl/main_test_test.go
@@ -72,29 +72,29 @@ func TestTest(t *testing.T) {
 		},
 		{
 			Description: "data propagation",
-			Data:        test.WithData("status", "uninitialized"),
+			Data:        test.WithLabels(map[string]string{"status": "uninitialized"}),
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set("status", data.Get("status")+"-setup")
+				data.Labels().Set("status", data.Labels().Get("status")+"-setup")
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				cmd := helpers.Custom("printf", data.Get("status"))
-				data.Set("status", data.Get("status")+"-command")
+				cmd := helpers.Custom("printf", data.Labels().Get("status"))
+				data.Labels().Set("status", data.Labels().Get("status")+"-command")
 				return cmd
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get("status") == "uninitialized" {
+				if data.Labels().Get("status") == "uninitialized" {
 					return
 				}
-				if data.Get("status") != "uninitialized-setup-command" {
-					log.Fatalf("unexpected status label %q", data.Get("status"))
+				if data.Labels().Get("status") != "uninitialized-setup-command" {
+					log.Fatalf("unexpected status label %q", data.Labels().Get("status"))
 				}
-				data.Set("status", data.Get("status")+"-cleanup")
+				data.Labels().Set("status", data.Labels().Get("status")+"-cleanup")
 			},
 			SubTests: []*test.Case{
 				{
 					Description: "Subtest data propagation",
 					Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-						return helpers.Custom("printf", data.Get("status"))
+						return helpers.Custom("printf", data.Labels().Get("status"))
 					},
 					Expected: test.Expects(0, nil, expect.Equals("uninitialized-setup-command")),
 				},
diff --git a/cmd/nerdctl/network/network_create_linux_test.go b/cmd/nerdctl/network/network_create_linux_test.go
index 418f07fde74..5dd82655390 100644
--- a/cmd/nerdctl/network/network_create_linux_test.go
+++ b/cmd/nerdctl/network/network_create_linux_test.go
@@ -42,7 +42,7 @@ func TestNetworkCreate(t *testing.T) {
 				helpers.Ensure("network", "create", identifier)
 				netw := nerdtest.InspectNetwork(helpers, identifier)
 				assert.Equal(t, len(netw.IPAM.Config), 1)
-				data.Set("subnet", netw.IPAM.Config[0].Subnet)
+				data.Labels().Set("subnet", netw.IPAM.Config[0].Subnet)
 
 				helpers.Ensure("network", "create", data.Identifier("1"))
 			},
@@ -51,7 +51,7 @@ func TestNetworkCreate(t *testing.T) {
 				helpers.Anyhow("network", "rm", data.Identifier("1"))
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				data.Set("container2", helpers.Capture("run", "--rm", "--net", data.Identifier("1"), testutil.CommonImage, "ip", "route"))
+				data.Labels().Set("container2", helpers.Capture("run", "--rm", "--net", data.Identifier("1"), testutil.CommonImage, "ip", "route"))
 				return helpers.Command("run", "--rm", "--net", data.Identifier(), testutil.CommonImage, "ip", "route")
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
@@ -59,8 +59,8 @@ func TestNetworkCreate(t *testing.T) {
 					ExitCode: 0,
 					Errors:   nil,
 					Output: func(stdout string, info string, t *testing.T) {
-						assert.Assert(t, strings.Contains(stdout, data.Get("subnet")), info)
-						assert.Assert(t, !strings.Contains(data.Get("container2"), data.Get("subnet")), info)
+						assert.Assert(t, strings.Contains(stdout, data.Labels().Get("subnet")), info)
+						assert.Assert(t, !strings.Contains(data.Labels().Get("container2"), data.Labels().Get("subnet")), info)
 					},
 				}
 			},
@@ -83,7 +83,7 @@ func TestNetworkCreate(t *testing.T) {
 			Require:     nerdtest.OnlyIPv6,
 			Setup: func(data test.Data, helpers test.Helpers) {
 				subnetStr := "2001:db8:8::/64"
-				data.Set("subnetStr", subnetStr)
+				data.Labels().Set("subnetStr", subnetStr)
 				_, _, err := net.ParseCIDR(subnetStr)
 				assert.Assert(t, err == nil)
 
@@ -99,7 +99,7 @@ func TestNetworkCreate(t *testing.T) {
 				return &test.Expected{
 					ExitCode: 0,
 					Output: func(stdout string, info string, t *testing.T) {
-						_, subnet, _ := net.ParseCIDR(data.Get("subnetStr"))
+						_, subnet, _ := net.ParseCIDR(data.Labels().Get("subnetStr"))
 						ip := ipv6helper.FindIPv6(stdout)
 						assert.Assert(t, subnet.Contains(ip), info)
 					},
diff --git a/cmd/nerdctl/network/network_inspect_test.go b/cmd/nerdctl/network/network_inspect_test.go
index cb89f25f2d4..d7ce389bb91 100644
--- a/cmd/nerdctl/network/network_inspect_test.go
+++ b/cmd/nerdctl/network/network_inspect_test.go
@@ -43,7 +43,7 @@ func TestNetworkInspect(t *testing.T) {
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		helpers.Ensure("network", "create", data.Identifier("basenet"))
-		data.Set("basenet", data.Identifier("basenet"))
+		data.Labels().Set("basenet", data.Identifier("basenet"))
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -132,7 +132,7 @@ func TestNetworkInspect(t *testing.T) {
 			Description: "match exact id",
 			// See notes below
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				id := strings.TrimSpace(helpers.Capture("network", "inspect", data.Get("basenet"), "--format", "{{ .Id }}"))
+				id := strings.TrimSpace(helpers.Capture("network", "inspect", data.Labels().Get("basenet"), "--format", "{{ .Id }}"))
 				return helpers.Command("network", "inspect", id)
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
@@ -142,7 +142,7 @@ func TestNetworkInspect(t *testing.T) {
 						err := json.Unmarshal([]byte(stdout), &dc)
 						assert.NilError(t, err, "Unable to unmarshal output\n"+info)
 						assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
-						assert.Equal(t, dc[0].Name, data.Get("basenet"))
+						assert.Equal(t, dc[0].Name, data.Labels().Get("basenet"))
 					},
 				}
 			},
@@ -153,7 +153,7 @@ func TestNetworkInspect(t *testing.T) {
 			// This is bizarre, as it is working in the match exact id test - and there does not seem to be a particular reason for that
 			Require: require.Not(require.Windows),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				id := strings.TrimSpace(helpers.Capture("network", "inspect", data.Get("basenet"), "--format", "{{ .Id }}"))
+				id := strings.TrimSpace(helpers.Capture("network", "inspect", data.Labels().Get("basenet"), "--format", "{{ .Id }}"))
 				return helpers.Command("network", "inspect", id[0:25])
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
@@ -163,7 +163,7 @@ func TestNetworkInspect(t *testing.T) {
 						err := json.Unmarshal([]byte(stdout), &dc)
 						assert.NilError(t, err, "Unable to unmarshal output\n"+info)
 						assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
-						assert.Equal(t, dc[0].Name, data.Get("basenet"))
+						assert.Equal(t, dc[0].Name, data.Labels().Get("basenet"))
 					},
 				}
 			},
@@ -174,15 +174,15 @@ func TestNetworkInspect(t *testing.T) {
 			// This is bizarre, as it is working in the match exact id test - and there does not seem to be a particular reason for that
 			Require: require.Not(require.Windows),
 			Setup: func(data test.Data, helpers test.Helpers) {
-				id := strings.TrimSpace(helpers.Capture("network", "inspect", data.Get("basenet"), "--format", "{{ .Id }}"))
+				id := strings.TrimSpace(helpers.Capture("network", "inspect", data.Labels().Get("basenet"), "--format", "{{ .Id }}"))
 				helpers.Ensure("network", "create", id[0:12])
-				data.Set("netname", id[0:12])
+				data.Labels().Set("netname", id[0:12])
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				helpers.Anyhow("network", "remove", data.Get("netname"))
+				helpers.Anyhow("network", "remove", data.Labels().Get("netname"))
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("network", "inspect", data.Get("netname"))
+				return helpers.Command("network", "inspect", data.Labels().Get("netname"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -191,7 +191,7 @@ func TestNetworkInspect(t *testing.T) {
 						err := json.Unmarshal([]byte(stdout), &dc)
 						assert.NilError(t, err, "Unable to unmarshal output\n"+info)
 						assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
-						assert.Equal(t, dc[0].Name, data.Get("netname"))
+						assert.Equal(t, dc[0].Name, data.Labels().Get("netname"))
 					},
 				}
 			},
diff --git a/cmd/nerdctl/network/network_list_linux_test.go b/cmd/nerdctl/network/network_list_linux_test.go
index 96f35dedf2e..3bf6f9e912f 100644
--- a/cmd/nerdctl/network/network_list_linux_test.go
+++ b/cmd/nerdctl/network/network_list_linux_test.go
@@ -31,12 +31,12 @@ func TestNetworkLsFilter(t *testing.T) {
 	testCase := nerdtest.Setup()
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
-		data.Set("identifier", data.Identifier())
-		data.Set("label", "mylabel=label-1")
-		data.Set("net1", data.Identifier("1"))
-		data.Set("net2", data.Identifier("2"))
-		data.Set("netID1", helpers.Capture("network", "create", "--label="+data.Get("label"), data.Get("net1")))
-		data.Set("netID2", helpers.Capture("network", "create", data.Get("net2")))
+		data.Labels().Set("identifier", data.Identifier())
+		data.Labels().Set("label", "mylabel=label-1")
+		data.Labels().Set("net1", data.Identifier("1"))
+		data.Labels().Set("net2", data.Identifier("2"))
+		data.Labels().Set("netID1", helpers.Capture("network", "create", "--label="+data.Labels().Get("label"), data.Labels().Get("net1")))
+		data.Labels().Set("netID2", helpers.Capture("network", "create", data.Labels().Get("net2")))
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -48,7 +48,7 @@ func TestNetworkLsFilter(t *testing.T) {
 		{
 			Description: "filter label",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("network", "ls", "--quiet", "--filter", "label="+data.Get("label"))
+				return helpers.Command("network", "ls", "--quiet", "--filter", "label="+data.Labels().Get("label"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -56,7 +56,7 @@ func TestNetworkLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 1, info)
 						netNames := map[string]struct{}{
-							data.Get("netID1")[:12]: {},
+							data.Labels().Get("netID1")[:12]: {},
 						}
 
 						for _, name := range lines {
@@ -70,7 +70,7 @@ func TestNetworkLsFilter(t *testing.T) {
 		{
 			Description: "filter name",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("network", "ls", "--quiet", "--filter", "name="+data.Get("net2"))
+				return helpers.Command("network", "ls", "--quiet", "--filter", "name="+data.Labels().Get("net2"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -78,7 +78,7 @@ func TestNetworkLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 1, info)
 						netNames := map[string]struct{}{
-							data.Get("netID2")[:12]: {},
+							data.Labels().Get("netID2")[:12]: {},
 						}
 
 						for _, name := range lines {
diff --git a/cmd/nerdctl/network/network_remove_linux_test.go b/cmd/nerdctl/network/network_remove_linux_test.go
index 48906cbad08..7a86ec37962 100644
--- a/cmd/nerdctl/network/network_remove_linux_test.go
+++ b/cmd/nerdctl/network/network_remove_linux_test.go
@@ -40,11 +40,11 @@ func TestNetworkRemove(t *testing.T) {
 			Setup: func(data test.Data, helpers test.Helpers) {
 				identifier := data.Identifier()
 				helpers.Ensure("network", "create", identifier)
-				data.Set("netID", nerdtest.InspectNetwork(helpers, identifier).ID)
+				data.Labels().Set("netID", nerdtest.InspectNetwork(helpers, identifier).ID)
 				helpers.Ensure("run", "--rm", "--net", identifier, "--name", identifier, testutil.CommonImage)
 				// Verity the network is here
-				_, err := netlink.LinkByName("br-" + data.Get("netID")[:12])
-				assert.NilError(t, err, "failed to find network br-"+data.Get("netID")[:12], "%v")
+				_, err := netlink.LinkByName("br-" + data.Labels().Get("netID")[:12])
+				assert.NilError(t, err, "failed to find network br-"+data.Labels().Get("netID")[:12], "%v")
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("network", "rm", data.Identifier())
@@ -56,7 +56,7 @@ func TestNetworkRemove(t *testing.T) {
 				return &test.Expected{
 					ExitCode: 0,
 					Output: func(stdout string, info string, t *testing.T) {
-						_, err := netlink.LinkByName("br-" + data.Get("netID")[:12])
+						_, err := netlink.LinkByName("br-" + data.Labels().Get("netID")[:12])
 						assert.Error(t, err, "Link not found", info)
 					},
 				}
@@ -81,14 +81,14 @@ func TestNetworkRemove(t *testing.T) {
 			Description: "Network remove by id",
 			Setup: func(data test.Data, helpers test.Helpers) {
 				helpers.Ensure("network", "create", data.Identifier())
-				data.Set("netID", nerdtest.InspectNetwork(helpers, data.Identifier()).ID)
+				data.Labels().Set("netID", nerdtest.InspectNetwork(helpers, data.Identifier()).ID)
 				helpers.Ensure("run", "--rm", "--net", data.Identifier(), "--name", data.Identifier(), testutil.CommonImage)
 				// Verity the network is here
-				_, err := netlink.LinkByName("br-" + data.Get("netID")[:12])
-				assert.NilError(t, err, "failed to find network br-"+data.Get("netID")[:12], "%v")
+				_, err := netlink.LinkByName("br-" + data.Labels().Get("netID")[:12])
+				assert.NilError(t, err, "failed to find network br-"+data.Labels().Get("netID")[:12], "%v")
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("network", "rm", data.Get("netID"))
+				return helpers.Command("network", "rm", data.Labels().Get("netID"))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("network", "rm", data.Identifier())
@@ -97,7 +97,7 @@ func TestNetworkRemove(t *testing.T) {
 				return &test.Expected{
 					ExitCode: 0,
 					Output: func(stdout string, info string, t *testing.T) {
-						_, err := netlink.LinkByName("br-" + data.Get("netID")[:12])
+						_, err := netlink.LinkByName("br-" + data.Labels().Get("netID")[:12])
 						assert.Error(t, err, "Link not found", info)
 					},
 				}
@@ -107,14 +107,14 @@ func TestNetworkRemove(t *testing.T) {
 			Description: "Network remove by short id",
 			Setup: func(data test.Data, helpers test.Helpers) {
 				helpers.Ensure("network", "create", data.Identifier())
-				data.Set("netID", nerdtest.InspectNetwork(helpers, data.Identifier()).ID)
+				data.Labels().Set("netID", nerdtest.InspectNetwork(helpers, data.Identifier()).ID)
 				helpers.Ensure("run", "--rm", "--net", data.Identifier(), "--name", data.Identifier(), testutil.CommonImage)
 				// Verity the network is here
-				_, err := netlink.LinkByName("br-" + data.Get("netID")[:12])
-				assert.NilError(t, err, "failed to find network br-"+data.Get("netID")[:12], "%v")
+				_, err := netlink.LinkByName("br-" + data.Labels().Get("netID")[:12])
+				assert.NilError(t, err, "failed to find network br-"+data.Labels().Get("netID")[:12], "%v")
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("network", "rm", data.Get("netID")[:12])
+				return helpers.Command("network", "rm", data.Labels().Get("netID")[:12])
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("network", "rm", data.Identifier())
@@ -123,7 +123,7 @@ func TestNetworkRemove(t *testing.T) {
 				return &test.Expected{
 					ExitCode: 0,
 					Output: func(stdout string, info string, t *testing.T) {
-						_, err := netlink.LinkByName("br-" + data.Get("netID")[:12])
+						_, err := netlink.LinkByName("br-" + data.Labels().Get("netID")[:12])
 						assert.Error(t, err, "Link not found", info)
 					},
 				}
diff --git a/cmd/nerdctl/system/system_events_linux_test.go b/cmd/nerdctl/system/system_events_linux_test.go
index bcf01bd0f19..37310bf9a7c 100644
--- a/cmd/nerdctl/system/system_events_linux_test.go
+++ b/cmd/nerdctl/system/system_events_linux_test.go
@@ -29,7 +29,7 @@ import (
 )
 
 func testEventFilterExecutor(data test.Data, helpers test.Helpers) test.TestableCommand {
-	cmd := helpers.Command("events", "--filter", data.Get("filter"), "--format", "json")
+	cmd := helpers.Command("events", "--filter", data.Labels().Get("filter"), "--format", "json")
 	// 3 seconds is too short on slow rig (EL8)
 	cmd.WithTimeout(10 * time.Second)
 	cmd.Background()
@@ -48,11 +48,13 @@ func TestEventFilters(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: expect.ExitCodeTimeout,
-					Output:   expect.Contains(data.Get("output")),
+					Output:   expect.Contains(data.Labels().Get("output")),
 				}
 			},
-			Data: test.WithData("filter", "event=START").
-				Set("output", "\"Status\":\"start\""),
+			Data: test.WithLabels(map[string]string{
+				"filter": "event=START",
+				"output": "\"Status\":\"start\"",
+			}),
 		},
 		{
 			Description: "StartEventFilter",
@@ -60,11 +62,13 @@ func TestEventFilters(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: expect.ExitCodeTimeout,
-					Output:   expect.Contains(data.Get("output")),
+					Output:   expect.Contains(data.Labels().Get("output")),
 				}
 			},
-			Data: test.WithData("filter", "event=start").
-				Set("output", "tatus\":\"start\""),
+			Data: test.WithLabels(map[string]string{
+				"filter": "event=start",
+				"output": "tatus\":\"start\"",
+			}),
 		},
 		{
 			Description: "UnsupportedEventFilter",
@@ -73,11 +77,13 @@ func TestEventFilters(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: expect.ExitCodeTimeout,
-					Output:   expect.Contains(data.Get("output")),
+					Output:   expect.Contains(data.Labels().Get("output")),
 				}
 			},
-			Data: test.WithData("filter", "event=unknown").
-				Set("output", "\"Status\":\"unknown\""),
+			Data: test.WithLabels(map[string]string{
+				"filter": "event=unknown",
+				"output": "\"Status\":\"unknown\"",
+			}),
 		},
 		{
 			Description: "StatusFilter",
@@ -85,11 +91,13 @@ func TestEventFilters(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: expect.ExitCodeTimeout,
-					Output:   expect.Contains(data.Get("output")),
+					Output:   expect.Contains(data.Labels().Get("output")),
 				}
 			},
-			Data: test.WithData("filter", "status=start").
-				Set("output", "tatus\":\"start\""),
+			Data: test.WithLabels(map[string]string{
+				"filter": "status=start",
+				"output": "tatus\":\"start\"",
+			}),
 		},
 		{
 			Description: "UnsupportedStatusFilter",
@@ -98,11 +106,13 @@ func TestEventFilters(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: expect.ExitCodeTimeout,
-					Output:   expect.Contains(data.Get("output")),
+					Output:   expect.Contains(data.Labels().Get("output")),
 				}
 			},
-			Data: test.WithData("filter", "status=unknown").
-				Set("output", "\"Status\":\"unknown\""),
+			Data: test.WithLabels(map[string]string{
+				"filter": "status=unknown",
+				"output": "\"Status\":\"unknown\"",
+			}),
 		},
 	}
 
diff --git a/cmd/nerdctl/system/system_prune_linux_test.go b/cmd/nerdctl/system/system_prune_linux_test.go
index 45a0b896d01..70a4a9df651 100644
--- a/cmd/nerdctl/system/system_prune_linux_test.go
+++ b/cmd/nerdctl/system/system_prune_linux_test.go
@@ -48,12 +48,12 @@ func TestSystemPrune(t *testing.T) {
 				helpers.Ensure("run", "-v", fmt.Sprintf("%s:/volume", data.Identifier()),
 					"--net", data.Identifier(), "--name", data.Identifier(), testutil.CommonImage)
 
-				data.Set("anonIdentifier", anonIdentifier)
+				data.Labels().Set("anonIdentifier", anonIdentifier)
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("network", "rm", data.Identifier())
 				helpers.Anyhow("volume", "rm", data.Identifier())
-				helpers.Anyhow("volume", "rm", data.Get("anonIdentifier"))
+				helpers.Anyhow("volume", "rm", data.Labels().Get("anonIdentifier"))
 				helpers.Anyhow("rm", "-f", data.Identifier())
 			},
 			Command: test.Command("system", "prune", "-f", "--volumes", "--all"),
@@ -66,7 +66,7 @@ func TestSystemPrune(t *testing.T) {
 						images := helpers.Capture("images")
 						containers := helpers.Capture("ps", "-a")
 						assert.Assert(t, strings.Contains(volumes, data.Identifier()), volumes)
-						assert.Assert(t, !strings.Contains(volumes, data.Get("anonIdentifier")), volumes)
+						assert.Assert(t, !strings.Contains(volumes, data.Labels().Get("anonIdentifier")), volumes)
 						assert.Assert(t, !strings.Contains(containers, data.Identifier()), containers)
 						assert.Assert(t, !strings.Contains(networks, data.Identifier()), networks)
 						assert.Assert(t, !strings.Contains(images, testutil.CommonImage), images)
diff --git a/cmd/nerdctl/volume/volume_inspect_test.go b/cmd/nerdctl/volume/volume_inspect_test.go
index 86d070065e4..af2e7938884 100644
--- a/cmd/nerdctl/volume/volume_inspect_test.go
+++ b/cmd/nerdctl/volume/volume_inspect_test.go
@@ -65,8 +65,8 @@ func TestVolumeInspect(t *testing.T) {
 		vol := nerdtest.InspectVolume(helpers, data.Identifier("first"))
 		err := createFileWithSize(vol.Mountpoint, size)
 		assert.NilError(t, err, "File creation failed")
-		data.Set("vol1", data.Identifier("first"))
-		data.Set("vol2", data.Identifier("second"))
+		data.Labels().Set("vol1", data.Identifier("first"))
+		data.Labels().Set("vol2", data.Identifier("second"))
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -93,15 +93,15 @@ func TestVolumeInspect(t *testing.T) {
 		{
 			Description: "success",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "inspect", data.Get("vol1"))
+				return helpers.Command("volume", "inspect", data.Labels().Get("vol1"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.Contains(data.Get("vol1")),
+						expect.Contains(data.Labels().Get("vol1")),
 						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							assert.Assert(t, len(dc) == 1, fmt.Sprintf("one result, not %d", len(dc))+info)
-							assert.Assert(t, dc[0].Name == data.Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Get("vol1"), dc[0].Name)+info)
+							assert.Assert(t, dc[0].Name == data.Labels().Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Labels().Get("vol1"), dc[0].Name)+info)
 							assert.Assert(t, dc[0].Labels == nil, fmt.Sprintf("expected labels to be nil and were %v", dc[0].Labels)+info)
 						}),
 					),
@@ -111,12 +111,12 @@ func TestVolumeInspect(t *testing.T) {
 		{
 			Description: "inspect labels",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "inspect", data.Get("vol2"))
+				return helpers.Command("volume", "inspect", data.Labels().Get("vol2"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.Contains(data.Get("vol2")),
+						expect.Contains(data.Labels().Get("vol2")),
 						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							labels := *dc[0].Labels
 							assert.Assert(t, len(labels) == 2, fmt.Sprintf("two results, not %d", len(labels)))
@@ -131,12 +131,12 @@ func TestVolumeInspect(t *testing.T) {
 			Description: "inspect size",
 			Require:     require.Not(nerdtest.Docker),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "inspect", "--size", data.Get("vol1"))
+				return helpers.Command("volume", "inspect", "--size", data.Labels().Get("vol1"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.Contains(data.Get("vol1")),
+						expect.Contains(data.Labels().Get("vol1")),
 						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							assert.Assert(t, dc[0].Size == size, fmt.Sprintf("expected size to be %d (was %d)", size, dc[0].Size))
 						}),
@@ -147,17 +147,17 @@ func TestVolumeInspect(t *testing.T) {
 		{
 			Description: "multi success",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "inspect", data.Get("vol1"), data.Get("vol2"))
+				return helpers.Command("volume", "inspect", data.Labels().Get("vol1"), data.Labels().Get("vol2"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.Contains(data.Get("vol1")),
-						expect.Contains(data.Get("vol2")),
+						expect.Contains(data.Labels().Get("vol1")),
+						expect.Contains(data.Labels().Get("vol2")),
 						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							assert.Assert(t, len(dc) == 2, fmt.Sprintf("two results, not %d", len(dc)))
-							assert.Assert(t, dc[0].Name == data.Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Get("vol1"), dc[0].Name))
-							assert.Assert(t, dc[1].Name == data.Get("vol2"), fmt.Sprintf("expected name to be %q (was %q)", data.Get("vol2"), dc[1].Name))
+							assert.Assert(t, dc[0].Name == data.Labels().Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Labels().Get("vol1"), dc[0].Name))
+							assert.Assert(t, dc[1].Name == data.Labels().Get("vol2"), fmt.Sprintf("expected name to be %q (was %q)", data.Labels().Get("vol2"), dc[1].Name))
 						}),
 					),
 				}
@@ -166,17 +166,17 @@ func TestVolumeInspect(t *testing.T) {
 		{
 			Description: "part success multi",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "inspect", "invalid∞", "nonexistent", data.Get("vol1"))
+				return helpers.Command("volume", "inspect", "invalid∞", "nonexistent", data.Labels().Get("vol1"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: 1,
 					Errors:   []error{errdefs.ErrNotFound, errdefs.ErrInvalidArgument},
 					Output: expect.All(
-						expect.Contains(data.Get("vol1")),
+						expect.Contains(data.Labels().Get("vol1")),
 						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							assert.Assert(t, len(dc) == 1, fmt.Sprintf("one result, not %d", len(dc)))
-							assert.Assert(t, dc[0].Name == data.Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Get("vol1"), dc[0].Name))
+							assert.Assert(t, dc[0].Name == data.Labels().Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Labels().Get("vol1"), dc[0].Name))
 						}),
 					),
 				}
diff --git a/cmd/nerdctl/volume/volume_list_test.go b/cmd/nerdctl/volume/volume_list_test.go
index 0610925df32..d666595abc6 100644
--- a/cmd/nerdctl/volume/volume_list_test.go
+++ b/cmd/nerdctl/volume/volume_list_test.go
@@ -122,22 +122,22 @@ func TestVolumeLsFilter(t *testing.T) {
 		err = createFileWithSize(nerdtest.InspectVolume(helpers, vol4).Mountpoint, 1024000)
 		assert.NilError(t, err, "File creation failed")
 
-		data.Set("vol1", vol1)
-		data.Set("vol2", vol2)
-		data.Set("vol3", vol3)
-		data.Set("vol4", vol4)
-		data.Set("mainlabel", "mylabel")
-		data.Set("label1", label1)
-		data.Set("label2", label2)
-		data.Set("label3", label3)
-		data.Set("label4", label4)
+		data.Labels().Set("vol1", vol1)
+		data.Labels().Set("vol2", vol2)
+		data.Labels().Set("vol3", vol3)
+		data.Labels().Set("vol4", vol4)
+		data.Labels().Set("mainlabel", "mylabel")
+		data.Labels().Set("label1", label1)
+		data.Labels().Set("label2", label2)
+		data.Labels().Set("label3", label3)
+		data.Labels().Set("label4", label4)
 
 	}
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
-		helpers.Anyhow("volume", "rm", "-f", data.Get("vol1"))
-		helpers.Anyhow("volume", "rm", "-f", data.Get("vol2"))
-		helpers.Anyhow("volume", "rm", "-f", data.Get("vol3"))
-		helpers.Anyhow("volume", "rm", "-f", data.Get("vol4"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("vol1"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("vol2"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("vol3"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("vol4"))
 	}
 	testCase.SubTests = []*test.Case{
 		{
@@ -149,10 +149,10 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 4, "expected at least 4 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol1"): {},
-							data.Get("vol2"): {},
-							data.Get("vol3"): {},
-							data.Get("vol4"): {},
+							data.Labels().Get("vol1"): {},
+							data.Labels().Get("vol2"): {},
+							data.Labels().Get("vol3"): {},
+							data.Labels().Get("vol4"): {},
 						}
 						var numMatches = 0
 						for _, name := range lines {
@@ -170,7 +170,7 @@ func TestVolumeLsFilter(t *testing.T) {
 		{
 			Description: "Retrieving label=mainlabel",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Get("mainlabel"))
+				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Labels().Get("mainlabel"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -178,9 +178,9 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 3, "expected at least 3 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol1"): {},
-							data.Get("vol2"): {},
-							data.Get("vol3"): {},
+							data.Labels().Get("vol1"): {},
+							data.Labels().Get("vol2"): {},
+							data.Labels().Get("vol3"): {},
 						}
 						for _, name := range lines {
 							_, ok := volNames[name]
@@ -193,7 +193,7 @@ func TestVolumeLsFilter(t *testing.T) {
 		{
 			Description: "Retrieving label=mainlabel=label2",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Get("label2"))
+				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Labels().Get("label2"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -201,7 +201,7 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 1, "expected at least 1 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol2"): {},
+							data.Labels().Get("vol2"): {},
 						}
 						for _, name := range lines {
 							_, ok := volNames[name]
@@ -214,7 +214,7 @@ func TestVolumeLsFilter(t *testing.T) {
 		{
 			Description: "Retrieving label=mainlabel=",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Get("mainlabel")+"=")
+				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Labels().Get("mainlabel")+"=")
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -227,7 +227,7 @@ func TestVolumeLsFilter(t *testing.T) {
 		{
 			Description: "Retrieving label=mainlabel=label1 and label=mainlabel=label2",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Get("label1"), "--filter", "label="+data.Get("label2"))
+				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Labels().Get("label1"), "--filter", "label="+data.Labels().Get("label2"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -240,7 +240,7 @@ func TestVolumeLsFilter(t *testing.T) {
 		{
 			Description: "Retrieving label=mainlabel and label=grouplabel=label4",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Get("mainlabel"), "--filter", "label="+data.Get("label4"))
+				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Labels().Get("mainlabel"), "--filter", "label="+data.Labels().Get("label4"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -248,8 +248,8 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 2, "expected at least 2 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol1"): {},
-							data.Get("vol2"): {},
+							data.Labels().Get("vol1"): {},
+							data.Labels().Get("vol2"): {},
 						}
 						for _, name := range lines {
 							_, ok := volNames[name]
@@ -262,7 +262,7 @@ func TestVolumeLsFilter(t *testing.T) {
 		{
 			Description: "Retrieving name=volume1",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "ls", "--quiet", "--filter", "name="+data.Get("vol1"))
+				return helpers.Command("volume", "ls", "--quiet", "--filter", "name="+data.Labels().Get("vol1"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -270,7 +270,7 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 1, "expected at least 1 line"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol1"): {},
+							data.Labels().Get("vol1"): {},
 						}
 						for _, name := range lines {
 							_, ok := volNames[name]
@@ -285,7 +285,7 @@ func TestVolumeLsFilter(t *testing.T) {
 			// Nerdctl filter behavior is broken
 			Require: nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3452"),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "ls", "--quiet", "--filter", "name="+data.Get("vol1"), "--filter", "name="+data.Get("vol2"))
+				return helpers.Command("volume", "ls", "--quiet", "--filter", "name="+data.Labels().Get("vol1"), "--filter", "name="+data.Labels().Get("vol2"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -293,8 +293,8 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 2, "expected at least 2 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol1"): {},
-							data.Get("vol2"): {},
+							data.Labels().Get("vol1"): {},
+							data.Labels().Get("vol2"): {},
 						}
 						for _, name := range lines {
 							_, ok := volNames[name]
@@ -316,8 +316,8 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 3, "expected at least 3 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol2"): {},
-							data.Get("vol4"): {},
+							data.Labels().Get("vol2"): {},
+							data.Labels().Get("vol4"): {},
 						}
 						var tab = tabutil.NewReader("VOLUME NAME\tDIRECTORY\tSIZE")
 						var err = tab.ParseHeader(lines[0])
@@ -347,8 +347,8 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 3, "expected at least 3 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol2"): {},
-							data.Get("vol4"): {},
+							data.Labels().Get("vol2"): {},
+							data.Labels().Get("vol4"): {},
 						}
 						var tab = tabutil.NewReader("VOLUME NAME\tDIRECTORY\tSIZE")
 						var err = tab.ParseHeader(lines[0])
@@ -378,8 +378,8 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 3, "expected at least 3 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol1"): {},
-							data.Get("vol3"): {},
+							data.Labels().Get("vol1"): {},
+							data.Labels().Get("vol3"): {},
 						}
 						var tab = tabutil.NewReader("VOLUME NAME\tDIRECTORY\tSIZE")
 						var err = tab.ParseHeader(lines[0])
diff --git a/cmd/nerdctl/volume/volume_namespace_test.go b/cmd/nerdctl/volume/volume_namespace_test.go
index a4b351d9286..341d2d37204 100644
--- a/cmd/nerdctl/volume/volume_namespace_test.go
+++ b/cmd/nerdctl/volume/volume_namespace_test.go
@@ -35,14 +35,14 @@ func TestVolumeNamespace(t *testing.T) {
 
 	// Create a volume in a different namespace
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
-		data.Set("root_namespace", data.Identifier())
-		data.Set("root_volume", data.Identifier())
+		data.Labels().Set("root_namespace", data.Identifier())
+		data.Labels().Set("root_volume", data.Identifier())
 		helpers.Ensure("--namespace", data.Identifier(), "volume", "create", data.Identifier())
 	}
 
 	// Cleanup once done
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
-		if data.Get("root_namespace") != "" {
+		if data.Labels().Get("root_namespace") != "" {
 			helpers.Anyhow("--namespace", data.Identifier(), "volume", "remove", data.Identifier())
 			helpers.Anyhow("namespace", "remove", data.Identifier())
 		}
@@ -52,7 +52,7 @@ func TestVolumeNamespace(t *testing.T) {
 		{
 			Description: "inspect another namespace volume should fail",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "inspect", data.Get("root_volume"))
+				return helpers.Command("volume", "inspect", data.Labels().Get("root_volume"))
 			},
 			Expected: test.Expects(1, []error{
 				errdefs.ErrNotFound,
@@ -61,7 +61,7 @@ func TestVolumeNamespace(t *testing.T) {
 		{
 			Description: "removing another namespace volume should fail",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "remove", data.Get("root_volume"))
+				return helpers.Command("volume", "remove", data.Labels().Get("root_volume"))
 			},
 			Expected: test.Expects(1, []error{
 				errdefs.ErrNotFound,
@@ -75,9 +75,9 @@ func TestVolumeNamespace(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.DoesNotContain(data.Get("root_volume")),
+						expect.DoesNotContain(data.Labels().Get("root_volume")),
 						func(stdout string, info string, t *testing.T) {
-							helpers.Ensure("--namespace", data.Get("root_namespace"), "volume", "inspect", data.Get("root_volume"))
+							helpers.Ensure("--namespace", data.Labels().Get("root_namespace"), "volume", "inspect", data.Labels().Get("root_volume"))
 						},
 					),
 				}
@@ -87,17 +87,17 @@ func TestVolumeNamespace(t *testing.T) {
 			Description: "create with the same name should work, then delete it",
 			NoParallel:  true,
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "create", data.Get("root_volume"))
+				return helpers.Command("volume", "create", data.Labels().Get("root_volume"))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				helpers.Anyhow("volume", "rm", data.Get("root_volume"))
+				helpers.Anyhow("volume", "rm", data.Labels().Get("root_volume"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: func(stdout string, info string, t *testing.T) {
-						helpers.Ensure("volume", "inspect", data.Get("root_volume"))
-						helpers.Ensure("volume", "rm", data.Get("root_volume"))
-						helpers.Ensure("--namespace", data.Get("root_namespace"), "volume", "inspect", data.Get("root_volume"))
+						helpers.Ensure("volume", "inspect", data.Labels().Get("root_volume"))
+						helpers.Ensure("volume", "rm", data.Labels().Get("root_volume"))
+						helpers.Ensure("--namespace", data.Labels().Get("root_namespace"), "volume", "inspect", data.Labels().Get("root_volume"))
 					},
 				}
 			},
diff --git a/cmd/nerdctl/volume/volume_prune_linux_test.go b/cmd/nerdctl/volume/volume_prune_linux_test.go
index 10b4e6b85f6..16f69bca559 100644
--- a/cmd/nerdctl/volume/volume_prune_linux_test.go
+++ b/cmd/nerdctl/volume/volume_prune_linux_test.go
@@ -41,18 +41,18 @@ func TestVolumePrune(t *testing.T) {
 			"-v", namedBusy+":/namedbusyvolume",
 			"-v", anonIDBusy+":/anonbusyvolume", testutil.CommonImage)
 
-		data.Set("anonIDBusy", anonIDBusy)
-		data.Set("anonIDDangling", anonIDDangling)
-		data.Set("namedBusy", namedBusy)
-		data.Set("namedDangling", namedDangling)
+		data.Labels().Set("anonIDBusy", anonIDBusy)
+		data.Labels().Set("anonIDDangling", anonIDDangling)
+		data.Labels().Set("namedBusy", namedBusy)
+		data.Labels().Set("namedDangling", namedDangling)
 	}
 
 	var cleanup = func(data test.Data, helpers test.Helpers) {
 		helpers.Anyhow("rm", "-f", data.Identifier())
-		helpers.Anyhow("volume", "rm", "-f", data.Get("anonIDBusy"))
-		helpers.Anyhow("volume", "rm", "-f", data.Get("anonIDDangling"))
-		helpers.Anyhow("volume", "rm", "-f", data.Get("namedBusy"))
-		helpers.Anyhow("volume", "rm", "-f", data.Get("namedDangling"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("anonIDBusy"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("anonIDDangling"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("namedBusy"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("namedDangling"))
 	}
 
 	testCase := nerdtest.Setup()
@@ -69,15 +69,15 @@ func TestVolumePrune(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.DoesNotContain(data.Get("anonIDBusy")),
-						expect.Contains(data.Get("anonIDDangling")),
-						expect.DoesNotContain(data.Get("namedBusy")),
-						expect.DoesNotContain(data.Get("namedDangling")),
+						expect.DoesNotContain(data.Labels().Get("anonIDBusy")),
+						expect.Contains(data.Labels().Get("anonIDDangling")),
+						expect.DoesNotContain(data.Labels().Get("namedBusy")),
+						expect.DoesNotContain(data.Labels().Get("namedDangling")),
 						func(stdout string, info string, t *testing.T) {
-							helpers.Ensure("volume", "inspect", data.Get("anonIDBusy"))
-							helpers.Fail("volume", "inspect", data.Get("anonIDDangling"))
-							helpers.Ensure("volume", "inspect", data.Get("namedBusy"))
-							helpers.Ensure("volume", "inspect", data.Get("namedDangling"))
+							helpers.Ensure("volume", "inspect", data.Labels().Get("anonIDBusy"))
+							helpers.Fail("volume", "inspect", data.Labels().Get("anonIDDangling"))
+							helpers.Ensure("volume", "inspect", data.Labels().Get("namedBusy"))
+							helpers.Ensure("volume", "inspect", data.Labels().Get("namedDangling"))
 						},
 					),
 				}
@@ -92,15 +92,15 @@ func TestVolumePrune(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.DoesNotContain(data.Get("anonIDBusy")),
-						expect.Contains(data.Get("anonIDDangling")),
-						expect.DoesNotContain(data.Get("namedBusy")),
-						expect.Contains(data.Get("namedDangling")),
+						expect.DoesNotContain(data.Labels().Get("anonIDBusy")),
+						expect.Contains(data.Labels().Get("anonIDDangling")),
+						expect.DoesNotContain(data.Labels().Get("namedBusy")),
+						expect.Contains(data.Labels().Get("namedDangling")),
 						func(stdout string, info string, t *testing.T) {
-							helpers.Ensure("volume", "inspect", data.Get("anonIDBusy"))
-							helpers.Fail("volume", "inspect", data.Get("anonIDDangling"))
-							helpers.Ensure("volume", "inspect", data.Get("namedBusy"))
-							helpers.Fail("volume", "inspect", data.Get("namedDangling"))
+							helpers.Ensure("volume", "inspect", data.Labels().Get("anonIDBusy"))
+							helpers.Fail("volume", "inspect", data.Labels().Get("anonIDDangling"))
+							helpers.Ensure("volume", "inspect", data.Labels().Get("namedBusy"))
+							helpers.Fail("volume", "inspect", data.Labels().Get("namedDangling"))
 						},
 					),
 				}
diff --git a/cmd/nerdctl/volume/volume_remove_linux_test.go b/cmd/nerdctl/volume/volume_remove_linux_test.go
index 01680bd30ec..1fb98e77846 100644
--- a/cmd/nerdctl/volume/volume_remove_linux_test.go
+++ b/cmd/nerdctl/volume/volume_remove_linux_test.go
@@ -89,17 +89,17 @@ func TestVolumeRemove(t *testing.T) {
 					}
 				}
 				assert.Assert(t, anonName != "", "Failed to find anonymous volume id", inspect)
-				data.Set("anonName", anonName)
+				data.Labels().Set("anonName", anonName)
 			},
 
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
-				helpers.Anyhow("volume", "rm", "-f", data.Get("anonName"))
+				helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("anonName"))
 			},
 
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				// Try to remove that anon volume
-				return helpers.Command("volume", "rm", data.Get("anonName"))
+				return helpers.Command("volume", "rm", data.Labels().Get("anonName"))
 			},
 
 			Expected: test.Expects(1, []error{errdefs.ErrFailedPrecondition}, nil),
diff --git a/pkg/testutil/nerdtest/ca/ca.go b/pkg/testutil/nerdtest/ca/ca.go
index 08615f7058b..49d69f81b4f 100644
--- a/pkg/testutil/nerdtest/ca/ca.go
+++ b/pkg/testutil/nerdtest/ca/ca.go
@@ -69,8 +69,7 @@ func New(data test.Data, t *testing.T) *CA {
 		BasicConstraintsValid: true,
 	}
 
-	dir, err := os.MkdirTemp(data.TempDir(), "ca")
-	assert.NilError(t, err)
+	dir := data.Temp().Dir("ca")
 	keyPath := filepath.Join(dir, "ca.key")
 	certPath := filepath.Join(dir, "ca.cert")
 	writePair(t, keyPath, certPath, cert, cert, key, key)
diff --git a/pkg/testutil/nerdtest/command.go b/pkg/testutil/nerdtest/command.go
index cf8b7207bd2..d3ca847119a 100644
--- a/pkg/testutil/nerdtest/command.go
+++ b/pkg/testutil/nerdtest/command.go
@@ -130,7 +130,7 @@ func (nc *nerdCommand) prep() {
 	if customDCConfig := nc.GenericCommand.Config.Read(DockerConfig); customDCConfig != "" {
 		if !nc.hasWrittenDockerConfig {
 			dest := filepath.Join(nc.Env["DOCKER_CONFIG"], "config.json")
-			err := os.WriteFile(dest, []byte(customDCConfig), 0400)
+			err := os.WriteFile(dest, []byte(customDCConfig), test.FilePermissionsDefault)
 			assert.NilError(nc.T(), err, "failed to write custom docker config json file for test")
 			nc.hasWrittenDockerConfig = true
 		}
@@ -174,7 +174,7 @@ func (nc *nerdCommand) prep() {
 		if nc.Config.Read(NerdctlToml) != "" {
 			if !nc.hasWrittenToml {
 				dest := nc.Env["NERDCTL_TOML"]
-				err := os.WriteFile(dest, []byte(nc.Config.Read(NerdctlToml)), 0400)
+				err := os.WriteFile(dest, []byte(nc.Config.Read(NerdctlToml)), test.FilePermissionsDefault)
 				assert.NilError(nc.T(), err, "failed to write NerdctlToml")
 				nc.hasWrittenToml = true
 			}
diff --git a/pkg/testutil/nerdtest/registry/cesanta.go b/pkg/testutil/nerdtest/registry/cesanta.go
index 58bc361f212..111286e3c6b 100644
--- a/pkg/testutil/nerdtest/registry/cesanta.go
+++ b/pkg/testutil/nerdtest/registry/cesanta.go
@@ -128,10 +128,6 @@ func NewCesantaAuthServer(data test.Data, helpers test.Helpers, ca *ca.CA, port
 	assert.NilError(helpers.T(), err, fmt.Errorf("failed bcrypt encrypting password: %w", err))
 	// Prepare configuration file for authentication server
 	// Details: https://github.com/cesanta/docker_auth/blob/1.7.1/examples/simple.yml
-	configFile, err := os.CreateTemp(data.TempDir(), "authconfig")
-	assert.NilError(helpers.T(), err, fmt.Errorf("failed creating temporary directory for config file: %w", err))
-	configFileName := configFile.Name()
-
 	cc := &CesantaConfig{
 		Server: CesantaConfigServer{
 			Addr: ":5100",
@@ -165,6 +161,7 @@ func NewCesantaAuthServer(data test.Data, helpers test.Helpers, ca *ca.CA, port
 		cc.Token.Key = "/auth/domain.key"
 	}
 
+	configFileName := data.Temp().Path("authconfig")
 	err = cc.Save(configFileName)
 	assert.NilError(helpers.T(), err, fmt.Errorf("failed writing configuration: %w", err))
 
@@ -181,20 +178,12 @@ func NewCesantaAuthServer(data test.Data, helpers test.Helpers, ca *ca.CA, port
 		helpers.Ensure("rm", "-f", containerName)
 		errPortRelease := portlock.Release(port)
 		errCertClose := cert.Close()
-		errConfigClose := configFile.Close()
-		errConfigRemove := os.Remove(configFileName)
 		if errPortRelease != nil {
 			helpers.T().Error(errPortRelease.Error())
 		}
 		if errCertClose != nil {
 			helpers.T().Error(errCertClose.Error())
 		}
-		if errConfigClose != nil {
-			helpers.T().Error(errConfigClose.Error())
-		}
-		if errConfigRemove != nil {
-			helpers.T().Error(errConfigRemove.Error())
-		}
 	}
 
 	setup := func(data test.Data, helpers test.Helpers) {
diff --git a/pkg/testutil/nerdtest/registry/common.go b/pkg/testutil/nerdtest/registry/common.go
index d662d00f7c0..53877c0809d 100644
--- a/pkg/testutil/nerdtest/registry/common.go
+++ b/pkg/testutil/nerdtest/registry/common.go
@@ -19,8 +19,6 @@ package registry
 import (
 	"fmt"
 	"net"
-	"os"
-	"path/filepath"
 
 	"golang.org/x/crypto/bcrypt"
 
@@ -71,9 +69,7 @@ func (ba *BasicAuth) Params(data test.Data) []string {
 	if ba.HtFile == "" && ba.Username != "" && ba.Password != "" {
 		pass := ba.Password
 		encryptedPass, _ := bcrypt.GenerateFromPassword([]byte(pass), bcrypt.DefaultCost)
-		tmpDir, _ := os.MkdirTemp(data.TempDir(), "htpasswd")
-		ba.HtFile = filepath.Join(tmpDir, "htpasswd")
-		_ = os.WriteFile(ba.HtFile, []byte(fmt.Sprintf(`%s:%s`, ba.Username, string(encryptedPass[:]))), 0600)
+		ba.HtFile = data.Temp().Save(fmt.Sprintf(`%s:%s`, ba.Username, string(encryptedPass[:])), "htpasswd")
 	}
 	ret := []string{
 		"--env", "REGISTRY_AUTH=htpasswd",
diff --git a/pkg/testutil/nerdtest/registry/docker.go b/pkg/testutil/nerdtest/registry/docker.go
index 30ee7626b53..82cde7f21d6 100644
--- a/pkg/testutil/nerdtest/registry/docker.go
+++ b/pkg/testutil/nerdtest/registry/docker.go
@@ -96,7 +96,7 @@ func NewDockerRegistry(data test.Data, helpers test.Helpers, currentCA *ca.CA, p
 	// FIXME: in the future, we will want to further manipulate hosts toml file from the test
 	// This should then return the struct, instead of saving it on its own
 	hostsDir, err := func() (string, error) {
-		hDir, err := os.MkdirTemp(data.TempDir(), "certs.d")
+		hDir := data.Temp().Dir("certs.d")
 		assert.NilError(helpers.T(), err, fmt.Errorf("failed creating directory certs.d: %w", err))
 
 		if currentCA != nil {
diff --git a/pkg/testutil/nerdtest/requirements.go b/pkg/testutil/nerdtest/requirements.go
index 3566b273f0d..90291a28aef 100644
--- a/pkg/testutil/nerdtest/requirements.go
+++ b/pkg/testutil/nerdtest/requirements.go
@@ -342,7 +342,7 @@ var Private = &test.Requirement{
 		// We need this to happen NOW and not in setup, as otherwise cleanup with operate on the default namespace
 		namespace := data.Identifier("private")
 		helpers.Write(Namespace, test.ConfigValue(namespace))
-		data.Set("_deletenamespace", namespace)
+		data.Labels().Set("_deletenamespace", namespace)
 		// FIXME: is this necessary? Should NoParallel be subsumed into config?
 		helpers.Write(modePrivate, enabled)
 		return true, "private mode creates a dedicated namespace for nerdctl, and disable parallelism for docker"
@@ -356,7 +356,7 @@ var Private = &test.Requirement{
 				helpers.Ensure(append([]string{"rm", "-f"}, strings.Split(containerList, "\n")...)...)
 			}
 			helpers.Ensure("system", "prune", "-f", "--all", "--volumes")
-			helpers.Anyhow("namespace", "remove", data.Get("_deletenamespace"))
+			helpers.Anyhow("namespace", "remove", data.Labels().Get("_deletenamespace"))
 		}
 	},
 }
diff --git a/pkg/testutil/nerdtest/utilities.go b/pkg/testutil/nerdtest/utilities.go
index 56cae946170..71b2d662f5c 100644
--- a/pkg/testutil/nerdtest/utilities.go
+++ b/pkg/testutil/nerdtest/utilities.go
@@ -25,6 +25,7 @@ import (
 
 	"github.com/containerd/nerdctl/mod/tigron/expect"
 	"github.com/containerd/nerdctl/mod/tigron/test"
+	"github.com/containerd/nerdctl/mod/tigron/tig"
 
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/native"
@@ -46,58 +47,54 @@ func IsDocker() bool {
 // InspectContainer is a helper that can be used inside custom commands or Setup
 func InspectContainer(helpers test.Helpers, name string) dockercompat.Container {
 	helpers.T().Helper()
-	var dc []dockercompat.Container
+	var res dockercompat.Container
 	cmd := helpers.Command("container", "inspect", name)
 	cmd.Run(&test.Expected{
-		Output: func(stdout string, info string, t *testing.T) {
-			err := json.Unmarshal([]byte(stdout), &dc)
-			assert.NilError(t, err, "Unable to unmarshal output\n"+info)
-			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
-		},
+		Output: expect.JSON([]dockercompat.Container{}, func(dc []dockercompat.Container, _ string, t tig.T) {
+			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results")
+			res = dc[0]
+		}),
 	})
-	return dc[0]
+	return res
 }
 
 func InspectVolume(helpers test.Helpers, name string) native.Volume {
 	helpers.T().Helper()
-	var dc []native.Volume
+	var res native.Volume
 	cmd := helpers.Command("volume", "inspect", name)
 	cmd.Run(&test.Expected{
-		Output: func(stdout string, info string, t *testing.T) {
-			err := json.Unmarshal([]byte(stdout), &dc)
-			assert.NilError(t, err, "Unable to unmarshal output\n"+info)
-			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
-		},
+		Output: expect.JSON([]native.Volume{}, func(dc []native.Volume, _ string, t tig.T) {
+			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results")
+			res = dc[0]
+		}),
 	})
-	return dc[0]
+	return res
 }
 
 func InspectNetwork(helpers test.Helpers, name string) dockercompat.Network {
 	helpers.T().Helper()
-	var dc []dockercompat.Network
+	var res dockercompat.Network
 	cmd := helpers.Command("network", "inspect", name)
 	cmd.Run(&test.Expected{
-		Output: func(stdout string, info string, t *testing.T) {
-			err := json.Unmarshal([]byte(stdout), &dc)
-			assert.NilError(t, err, "Unable to unmarshal output\n"+info)
-			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
-		},
+		Output: expect.JSON([]dockercompat.Network{}, func(dc []dockercompat.Network, _ string, t tig.T) {
+			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results")
+			res = dc[0]
+		}),
 	})
-	return dc[0]
+	return res
 }
 
 func InspectImage(helpers test.Helpers, name string) dockercompat.Image {
 	helpers.T().Helper()
-	var dc []dockercompat.Image
+	var res dockercompat.Image
 	cmd := helpers.Command("image", "inspect", name)
 	cmd.Run(&test.Expected{
-		Output: func(stdout string, info string, t *testing.T) {
-			err := json.Unmarshal([]byte(stdout), &dc)
-			assert.NilError(t, err, "Unable to unmarshal output\n"+info)
-			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
-		},
+		Output: expect.JSON([]dockercompat.Image{}, func(dc []dockercompat.Image, _ string, t tig.T) {
+			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results")
+			res = dc[0]
+		}),
 	})
-	return dc[0]
+	return res
 }
 
 const (

From 7cab413cfe0e914dd31a951a04491ecbd3dfeec6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 17 Apr 2025 22:13:23 +0000
Subject: [PATCH 092/225] build(deps): bump the docker group with 2 updates

Bumps the docker group with 2 updates: [github.com/docker/cli](https://github.com/docker/cli) and [github.com/docker/docker](https://github.com/docker/docker).


Updates `github.com/docker/cli` from 28.0.4+incompatible to 28.1.0+incompatible
- [Commits](https://github.com/docker/cli/compare/v28.0.4...v28.1.0)

Updates `github.com/docker/docker` from 28.0.4+incompatible to 28.1.0+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/compare/v28.0.4...v28.1.0)

---
updated-dependencies:
- dependency-name: github.com/docker/cli
  dependency-version: 28.1.0+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker
- dependency-name: github.com/docker/docker
  dependency-version: 28.1.0+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 4 ++--
 go.sum | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/go.mod b/go.mod
index 2d374b2e381..b0c7923cf63 100644
--- a/go.mod
+++ b/go.mod
@@ -31,8 +31,8 @@ require (
 	github.com/coreos/go-systemd/v22 v22.5.0
 	github.com/cyphar/filepath-securejoin v0.4.1
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v28.0.4+incompatible
-	github.com/docker/docker v28.0.4+incompatible
+	github.com/docker/cli v28.1.0+incompatible
+	github.com/docker/docker v28.1.0+incompatible
 	github.com/docker/go-connections v0.5.0
 	github.com/docker/go-units v0.5.0
 	github.com/fahedouch/go-logrotate v0.3.0
diff --git a/go.sum b/go.sum
index a29d712875a..a19fd2185b0 100644
--- a/go.sum
+++ b/go.sum
@@ -88,10 +88,10 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/docker/cli v28.0.4+incompatible h1:pBJSJeNd9QeIWPjRcV91RVJihd/TXB77q1ef64XEu4A=
-github.com/docker/cli v28.0.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/docker v28.0.4+incompatible h1:JNNkBctYKurkw6FrHfKqY0nKIDf5nrbxjVBtS+cdcok=
-github.com/docker/docker v28.0.4+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/cli v28.1.0+incompatible h1:WiJhUBbuIH/BsJtth+C1hPwra4P0nsKJiWy9ie5My5s=
+github.com/docker/cli v28.1.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/docker v28.1.0+incompatible h1:4iqpcWQCt3Txcz7iWIb1U3SZ/n9ffo4U+ryY5/3eOp0=
+github.com/docker/docker v28.1.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=

From f74502d3c58c2f9235c8aaf162c0b15b6f471d30 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 17 Apr 2025 22:13:38 +0000
Subject: [PATCH 093/225] build(deps): bump github.com/containerd/containerd/v2

Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.0.4 to 2.0.5.
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](https://github.com/containerd/containerd/compare/v2.0.4...v2.0.5)

---
updated-dependencies:
- dependency-name: github.com/containerd/containerd/v2
  dependency-version: 2.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 2d374b2e381..7c6ebc00266 100644
--- a/go.mod
+++ b/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/containerd/cgroups/v3 v3.0.5
 	github.com/containerd/console v1.0.4
 	github.com/containerd/containerd/api v1.8.0
-	github.com/containerd/containerd/v2 v2.0.4
+	github.com/containerd/containerd/v2 v2.0.5
 	github.com/containerd/continuity v0.4.5
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/fifo v1.1.0
diff --git a/go.sum b/go.sum
index a29d712875a..1e0f65134b2 100644
--- a/go.sum
+++ b/go.sum
@@ -31,8 +31,8 @@ github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn
 github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
 github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0=
 github.com/containerd/containerd/api v1.8.0/go.mod h1:dFv4lt6S20wTu/hMcP4350RL87qPWLVa/OHOwmmdnYc=
-github.com/containerd/containerd/v2 v2.0.4 h1:+r7yJMwhTfMm3CDyiBjMBQO8a9CTBxL2Bg/JtqtIwB8=
-github.com/containerd/containerd/v2 v2.0.4/go.mod h1:5j9QUUaV/cy9ZeAx4S+8n9ffpf+iYnEj4jiExgcbuLY=
+github.com/containerd/containerd/v2 v2.0.5 h1:2vg/TjUXnaohAxiHnthQg8K06L9I4gdYEMcOLiMc8BQ=
+github.com/containerd/containerd/v2 v2.0.5/go.mod h1:Qqo0UN43i2fX1FLkrSTCg6zcHNfjN7gEnx3NPRZI+N0=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=

From a7a0ae78595b5a4736848bfae06fe9bb2b14651c Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 17 Apr 2025 15:30:51 -0700
Subject: [PATCH 094/225] Update containerd to v2.0.5

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/test.yml | 18 +++++++++---------
 Dockerfile                 |  2 +-
 go.mod                     |  2 +-
 go.sum                     |  4 ++--
 4 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c1113c57b2d..857c3eaee23 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -29,10 +29,10 @@ jobs:
             containerd: v1.6.38
             arch: amd64
           - runner: ubuntu-24.04
-            containerd: v2.0.4
+            containerd: v2.0.5
             arch: amd64
           - runner: ubuntu-24.04-arm
-            containerd: v2.0.4
+            containerd: v2.0.5
             arch: arm64
     env:
       CONTAINERD_VERSION: "${{ matrix.containerd }}"
@@ -98,11 +98,11 @@ jobs:
             runner: "ubuntu-22.04"
             arch: amd64
           - ubuntu: 24.04
-            containerd: v2.0.4
+            containerd: v2.0.5
             runner: "ubuntu-24.04"
             arch: amd64
           - ubuntu: 24.04
-            containerd: v2.0.4
+            containerd: v2.0.5
             runner: "ubuntu-24.04-arm"
             arch: arm64
     env:
@@ -152,7 +152,7 @@ jobs:
       matrix:
         include:
           - ubuntu: 24.04
-            containerd: v2.0.4
+            containerd: v2.0.5
             arch: amd64
     env:
       CONTAINERD_VERSION: "${{ matrix.containerd }}"
@@ -219,19 +219,19 @@ jobs:
             runner: "ubuntu-22.04"
             arch: amd64
           - ubuntu: 24.04
-            containerd: v2.0.4
+            containerd: v2.0.5
             rootlesskit: v2.3.4
             target: rootless
             arch: amd64
             runner: "ubuntu-24.04"
           - ubuntu: 24.04
-            containerd: v2.0.4
+            containerd: v2.0.5
             rootlesskit: v2.3.4
             target: rootless
             arch: arm64
             runner: "ubuntu-24.04-arm"
           - ubuntu: 24.04
-            containerd: v2.0.4
+            containerd: v2.0.5
             rootlesskit: v2.3.4
             target: rootless-port-slirp4netns
             arch: amd64
@@ -422,7 +422,7 @@ jobs:
     env:
       MODE: ${{ matrix.mode }}
       # FIXME: this is only necessary to access the build cache. To remove with build cleanup.
-      CONTAINERD_VERSION: v2.0.4
+      CONTAINERD_VERSION: v2.0.5
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
diff --git a/Dockerfile b/Dockerfile
index 4a31d8eef41..4512babcd09 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,7 +17,7 @@
 
 # Basic deps
 # @BINARY: the binary checksums are verified via Dockerfile.d/SHA256SUMS.d/<COMPONENT>-<VERSION>
-ARG CONTAINERD_VERSION=v2.0.4@1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20
+ARG CONTAINERD_VERSION=v2.0.5@fb4c30d4ede3531652d86197bf3fc9515e5276d9
 ARG RUNC_VERSION=v1.2.6@e89a29929c775025419ab0d218a43588b4c12b9a
 ARG CNI_PLUGINS_VERSION=v1.6.2@BINARY
 
diff --git a/go.mod b/go.mod
index 2d374b2e381..7c6ebc00266 100644
--- a/go.mod
+++ b/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/containerd/cgroups/v3 v3.0.5
 	github.com/containerd/console v1.0.4
 	github.com/containerd/containerd/api v1.8.0
-	github.com/containerd/containerd/v2 v2.0.4
+	github.com/containerd/containerd/v2 v2.0.5
 	github.com/containerd/continuity v0.4.5
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/fifo v1.1.0
diff --git a/go.sum b/go.sum
index a29d712875a..1e0f65134b2 100644
--- a/go.sum
+++ b/go.sum
@@ -31,8 +31,8 @@ github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn
 github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
 github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0=
 github.com/containerd/containerd/api v1.8.0/go.mod h1:dFv4lt6S20wTu/hMcP4350RL87qPWLVa/OHOwmmdnYc=
-github.com/containerd/containerd/v2 v2.0.4 h1:+r7yJMwhTfMm3CDyiBjMBQO8a9CTBxL2Bg/JtqtIwB8=
-github.com/containerd/containerd/v2 v2.0.4/go.mod h1:5j9QUUaV/cy9ZeAx4S+8n9ffpf+iYnEj4jiExgcbuLY=
+github.com/containerd/containerd/v2 v2.0.5 h1:2vg/TjUXnaohAxiHnthQg8K06L9I4gdYEMcOLiMc8BQ=
+github.com/containerd/containerd/v2 v2.0.5/go.mod h1:Qqo0UN43i2fX1FLkrSTCg6zcHNfjN7gEnx3NPRZI+N0=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=

From aa03626e89007b1298e6bb2164b2935a07f38cb2 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 17 Apr 2025 18:10:55 -0700
Subject: [PATCH 095/225] Fix EL8 tests execution

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/test.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c1113c57b2d..edf55ed4115 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -489,20 +489,20 @@ jobs:
         # This might be due to the old kernel shipped with Alma (4.18), or something else between centos/docker.
         run: |
           set -eux
-          [ "$MODE" = "rootless" ] && {
+          if [ "$MODE" = "rootless" ]; then
             echo "rootless"
             docker run -t -v /dev:/dev --rm --privileged test-integration /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=false
-          } || {
+          else
             echo "rootful"
             docker run -t -v /dev:/dev --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=false
-          }
+          fi
       - name: "Run integration tests (flaky)"
         run: |
           set -eux
-          [ "$MODE" = "rootless" ] && {
+          if [ "$MODE" = "rootless" ]; then
             echo "rootless"
             docker run -t -v /dev:/dev --rm --privileged test-integration /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=true
-          } || {
+          else
             echo "rootful"
             docker run -t -v /dev:/dev --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=true
-          }
+          fi

From fcc15334a8fc2663e28e3dadbe26af2c30daf255 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 17 Apr 2025 13:53:42 -0700
Subject: [PATCH 096/225] Fix image delete in convert

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 pkg/cmd/image/convert.go | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkg/cmd/image/convert.go b/pkg/cmd/image/convert.go
index 460bf3c4091..b7963ea2702 100644
--- a/pkg/cmd/image/convert.go
+++ b/pkg/cmd/image/convert.go
@@ -208,8 +208,7 @@ func Convert(ctx context.Context, client *containerd.Client, srcRawRef, targetRa
 			return err
 		}
 		is := client.ImageService()
-		_ = is.Delete(ctx, newI.Name, images.SynchronousDelete())
-		finimg, err := is.Create(ctx, *newI)
+		finimg, err := is.Update(ctx, *newI)
 		if err != nil {
 			return err
 		}

From 7d6a6a79ff21c82027237f8bdacfc6b71a163853 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 16 Apr 2025 09:40:34 -0700
Subject: [PATCH 097/225] Bump Dockerfile dependencies

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 4512babcd09..0f69003ac81 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -45,9 +45,9 @@ ARG BUILDG_VERSION=v0.4.1@BINARY
 ARG GO_VERSION=1.24
 ARG UBUNTU_VERSION=24.04
 ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.1
-ARG GOTESTSUM_VERSION=v1.12.0
+ARG GOTESTSUM_VERSION=v1.12.1
 ARG NYDUS_VERSION=v2.3.0
-ARG SOCI_SNAPSHOTTER_VERSION=0.8.0
+ARG SOCI_SNAPSHOTTER_VERSION=0.9.0
 ARG KUBO_VERSION=v0.33.2
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.6.1@sha256:923441d7c25f1e2eb5789f82d987693c47b8ed987c4ab3b075d6ed2b5d6779a3 AS xx

From 1bd12e8f67e4582bc76085d16317a08fb042dd4f Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Tue, 15 Apr 2025 22:20:04 -0700
Subject: [PATCH 098/225] Bump cni go dependency

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 go.mod                           |  2 +-
 go.sum                           |  4 ++--
 hack/configure-windows-ci.ps1    |  2 +-
 hack/provisioning/windows/cni.sh | 26 +++++++++++++++-----------
 pkg/netutil/netutil.go           | 19 +++----------------
 5 files changed, 22 insertions(+), 31 deletions(-)

diff --git a/go.mod b/go.mod
index ec2b281ed03..b8e3d32df45 100644
--- a/go.mod
+++ b/go.mod
@@ -25,7 +25,7 @@ require (
 	github.com/containerd/stargz-snapshotter/estargz v0.16.3
 	github.com/containerd/stargz-snapshotter/ipfs v0.16.3
 	github.com/containerd/typeurl/v2 v2.2.3
-	github.com/containernetworking/cni v1.2.3
+	github.com/containernetworking/cni v1.3.0
 	github.com/containernetworking/plugins v1.6.2
 	github.com/coreos/go-iptables v0.8.0
 	github.com/coreos/go-systemd/v22 v22.5.0
diff --git a/go.sum b/go.sum
index cda53f54463..633a8b3ec0c 100644
--- a/go.sum
+++ b/go.sum
@@ -65,8 +65,8 @@ github.com/containerd/ttrpc v1.2.7 h1:qIrroQvuOL9HQ1X6KHe2ohc7p+HP/0VE6XPU7elJRq
 github.com/containerd/ttrpc v1.2.7/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
 github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
 github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
-github.com/containernetworking/cni v1.2.3 h1:hhOcjNVUQTnzdRJ6alC5XF+wd9mfGIUaj8FuJbEslXM=
-github.com/containernetworking/cni v1.2.3/go.mod h1:DuLgF+aPd3DzcTQTtp/Nvl1Kim23oFKdm2okJzBQA5M=
+github.com/containernetworking/cni v1.3.0 h1:v6EpN8RznAZj9765HhXQrtXgX+ECGebEYEmnuFjskwo=
+github.com/containernetworking/cni v1.3.0/go.mod h1:Bs8glZjjFfGPHMw6hQu82RUgEPNGEaBb9KS5KtNMnJ4=
 github.com/containernetworking/plugins v1.6.2 h1:pqP8Mq923TLyef5g97XfJ/xpDeVek4yF8A4mzy9Tc4U=
 github.com/containernetworking/plugins v1.6.2/go.mod h1:SP5UG3jDO9LtmfbBJdP+nl3A1atOtbj2MBOYsnaxy64=
 github.com/containers/ocicrypt v1.2.1 h1:0qIOTT9DoYwcKmxSt8QJt+VzMY18onl9jUXsxpVhSmM=
diff --git a/hack/configure-windows-ci.ps1 b/hack/configure-windows-ci.ps1
index 1c97a487182..c3505c269b4 100644
--- a/hack/configure-windows-ci.ps1
+++ b/hack/configure-windows-ci.ps1
@@ -18,7 +18,7 @@ echo "configuration complete! Printing configuration..."
 echo "Service:"
 get-service containerd
 echo "cni configuration"
-cat "$Env:ProgramFiles\containerd\cni\conf\0-containerd-nat.conf"
+cat "$Env:ProgramFiles\containerd\cni\conf\0-containerd-nat.conflist"
 ls "$Env:ProgramFiles\containerd\cni\bin"
 echo "containerd install"
 ls "$Env:ProgramFiles\containerd\"
diff --git a/hack/provisioning/windows/cni.sh b/hack/provisioning/windows/cni.sh
index 42e7549a724..8f6aae4323f 100755
--- a/hack/provisioning/windows/cni.sh
+++ b/hack/provisioning/windows/cni.sh
@@ -81,23 +81,27 @@ subnet="$(calculate_subnet "$GATEWAY" "$PREFIX_LEN")"
 # https://github.com/microsoft/windows-container-networking/pull/45),
 # so it must match a network type in:
 # https://docs.microsoft.com/en-us/windows-server/networking/technologies/hcn/hcn-json-document-schemas
-bash -c 'cat >"'"${CNI_CONFIG_DIR}"'"/0-containerd-nat.conf <<EOF
+bash -c 'cat >"'"${CNI_CONFIG_DIR}"'"/0-containerd-nat.conflist <<EOF
 {
-    "cniVersion": "1.0.0",
-    "name": "nat",
-    "type": "nat",
-    "master": "Ethernet",
-    "ipam": {
+  "cniVersion": "1.0.0",
+  "name": "nat",
+  "plugins": [
+    {
+      "type": "nat",
+      "master": "Ethernet",
+      "ipam": {
         "subnet": "'"$subnet"'",
         "routes": [
-            {
-                "GW": "'"$GATEWAY"'"
-            }
+          {
+            "GW": "'"$GATEWAY"'"
+          }
         ]
-    },
-    "capabilities": {
+      },
+      "capabilities": {
         "portMappings": true,
         "dns": true
+      }
     }
+  ]
 }
 EOF'
\ No newline at end of file
diff --git a/pkg/netutil/netutil.go b/pkg/netutil/netutil.go
index d4db0a0b1b9..f6e62fb2147 100644
--- a/pkg/netutil/netutil.go
+++ b/pkg/netutil/netutil.go
@@ -28,7 +28,6 @@ import (
 	"path/filepath"
 	"sort"
 	"strconv"
-	"strings"
 
 	"github.com/containernetworking/cni/libcni"
 
@@ -533,21 +532,9 @@ func cniLoad(fileNames []string) (configList []*NetworkConfig, err error) {
 		}
 
 		var netConfigList *libcni.NetworkConfigList
-		if strings.HasSuffix(fileName, ".conflist") {
-			netConfigList, err = libcni.ConfListFromBytes(bytes)
-			if err != nil {
-				return nil, wrapCNIError(fileName, err)
-			}
-		} else {
-			var netConfig *libcni.NetworkConfig
-			netConfig, err = libcni.ConfFromBytes(bytes)
-			if err != nil {
-				return nil, wrapCNIError(fileName, err)
-			}
-			netConfigList, err = libcni.ConfListFromConf(netConfig)
-			if err != nil {
-				return nil, wrapCNIError(fileName, err)
-			}
+		netConfigList, err = libcni.NetworkConfFromBytes(bytes)
+		if err != nil {
+			return nil, wrapCNIError(fileName, err)
 		}
 		id, nerdctlLabels := nerdctlIDLabels(netConfigList.Bytes)
 		configList = append(configList, &NetworkConfig{

From 24c8654e4f2be1e5c9e00656f5c533627a7158ae Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 18 Apr 2025 12:27:51 -0700
Subject: [PATCH 099/225] Fixing cross-merge failure

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .golangci.yml                               | 2 +-
 cmd/nerdctl/network/network_inspect_test.go | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index 65b0fb1fa51..d0e92d9ab31 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -128,7 +128,7 @@ linters:
         ##### P2: nice to have.
         - name: max-public-structs
           # 7 occurrences (at default 5). Might indicate overcrowding of public API.
-          arguments: [21]
+          arguments: [25]
         - name: confusing-results
           # 13 occurrences. Have named returns when the type stutters.
           # Makes it a bit easier to figure out function behavior just looking at signature.
diff --git a/cmd/nerdctl/network/network_inspect_test.go b/cmd/nerdctl/network/network_inspect_test.go
index f00021e1b25..11fc36f9a1b 100644
--- a/cmd/nerdctl/network/network_inspect_test.go
+++ b/cmd/nerdctl/network/network_inspect_test.go
@@ -288,7 +288,7 @@ func TestNetworkInspect(t *testing.T) {
 				helpers.Ensure("create", "--name", data.Identifier("nginx-container-2"), "--network", data.Identifier("nginx-network-1"), testutil.NginxAlpineImage)
 				helpers.Ensure("create", "--name", data.Identifier("nginx-container-on-diff-network"), "--network", data.Identifier("nginx-network-2"), testutil.NginxAlpineImage)
 				helpers.Ensure("start", data.Identifier("nginx-container-1"), data.Identifier("nginx-container-on-diff-network"))
-				data.Set("nginx-container-1-id", strings.Trim(helpers.Capture("inspect", data.Identifier("nginx-container-1"), "--format", "{{.Id}}"), "\n"))
+				data.Labels().Set("nginx-container-1-id", strings.Trim(helpers.Capture("inspect", data.Identifier("nginx-container-1"), "--format", "{{.Id}}"), "\n"))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier("nginx-container-1"))
@@ -310,7 +310,7 @@ func TestNetworkInspect(t *testing.T) {
 						assert.Equal(t, dc[0].Name, data.Identifier("nginx-network-1"))
 						// Assert only the "running" containers on the same network are returned.
 						assert.Equal(t, 1, len(dc[0].Containers), "Expected a single container as per configuration, but got multiple.")
-						assert.Equal(t, data.Identifier("nginx-container-1"), dc[0].Containers[data.Get("nginx-container-1-id")].Name)
+						assert.Equal(t, data.Identifier("nginx-container-1"), dc[0].Containers[data.Labels().Get("nginx-container-1-id")].Name)
 					},
 				}
 			},

From ff8b599ae6bf66eb5f38a256f256da18fdb3caec Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 17 Apr 2025 14:26:11 -0700
Subject: [PATCH 100/225] Modernize tests in container and compose

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .../compose/compose_build_linux_test.go       | 124 +++--
 cmd/nerdctl/compose/compose_config_test.go    | 276 ++++++++---
 cmd/nerdctl/compose/compose_cp_linux_test.go  |  85 ++--
 .../compose/compose_create_linux_test.go      | 124 ++++-
 .../compose/compose_exec_linux_test.go        | 460 ++++++++++--------
 cmd/nerdctl/compose/compose_run_linux_test.go | 122 ++---
 cmd/nerdctl/container/container_logs_test.go  |  30 +-
 .../container_run_network_linux_test.go       |  24 +-
 .../container_run_soci_linux_test.go          |  83 ++--
 cmd/nerdctl/container/container_run_test.go   | 377 ++++++++------
 .../container_run_verify_linux_test.go        |  78 ++-
 cmd/nerdctl/helpers/testing_linux.go          |  59 ---
 cmd/nerdctl/image/image_encrypt_linux_test.go |  14 +-
 cmd/nerdctl/image/image_pull_linux_test.go    | 107 ++--
 cmd/nerdctl/ipfs/ipfs_simple_linux_test.go    |  11 +-
 .../network/network_create_linux_test.go      |   6 +-
 pkg/testutil/nerdtest/utilities.go            |  59 +++
 pkg/testutil/testutil.go                      |  77 +--
 pkg/testutil/testutil_freebsd.go              |   7 -
 pkg/testutil/testutil_linux.go                |   9 -
 pkg/testutil/testutil_windows.go              |   6 +-
 21 files changed, 1267 insertions(+), 871 deletions(-)

diff --git a/cmd/nerdctl/compose/compose_build_linux_test.go b/cmd/nerdctl/compose/compose_build_linux_test.go
index 80cc04d4c35..6ea0663240a 100644
--- a/cmd/nerdctl/compose/compose_build_linux_test.go
+++ b/cmd/nerdctl/compose/compose_build_linux_test.go
@@ -17,17 +17,31 @@
 package compose
 
 import (
+	"errors"
 	"fmt"
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestComposeBuild(t *testing.T) {
-	const imageSvc0 = "composebuild_svc0"
-	const imageSvc1 = "composebuild_svc1"
+	dockerfile := "FROM " + testutil.AlpineImage
+
+	testCase := nerdtest.Setup()
+
+	testCase.Require = nerdtest.Build
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		// Make sure we shard the image name to something unique to the test to avoid conflicts with other tests
+		imageSvc0 := data.Identifier("svc0")
+		imageSvc1 := data.Identifier("svc1")
 
-	dockerComposeYAML := fmt.Sprintf(`
+		// We are not going to run them, so, ports conflicts should not matter here
+		dockerComposeYAML := fmt.Sprintf(`
 services:
   svc0:
     build: .
@@ -43,31 +57,81 @@ services:
     - 8081:80
 `, imageSvc0, imageSvc1)
 
-	dockerfile := fmt.Sprintf(`FROM %s`, testutil.AlpineImage)
-
-	testutil.RequiresBuild(t)
-	testutil.RegisterBuildCacheCleanup(t)
-	base := testutil.NewBase(t)
-
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	comp.WriteFile("Dockerfile", dockerfile)
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
-
-	defer base.Cmd("rmi", imageSvc0).Run()
-	defer base.Cmd("rmi", imageSvc1).Run()
-
-	// 1. build only 1 service without triggering the dependency service build
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "build", "svc0").AssertOK()
-	base.Cmd("images").AssertOutContains(imageSvc0)
-	base.Cmd("images").AssertOutNotContains(imageSvc1)
-	// 2. build multiple services
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "build", "svc0", "svc1").AssertOK()
-	base.Cmd("images").AssertOutContains(imageSvc0)
-	base.Cmd("images").AssertOutContains(imageSvc1)
-	// 3. build all if no args are given
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "build").AssertOK()
-	// 4. fail if some services args not exist in compose.yml
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "build", "svc0", "svc100").AssertFail()
+		data.Temp().Save(dockerComposeYAML, "compose.yaml")
+		data.Temp().Save(dockerfile, "Dockerfile")
+
+		data.Labels().Set("composeYaml", data.Temp().Path("compose.yaml"))
+		data.Labels().Set("imageSvc0", imageSvc0)
+		data.Labels().Set("imageSvc1", imageSvc1)
+	}
+
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "build svc0",
+			NoParallel:  true,
+			Setup: func(data test.Data, helpers test.Helpers) {
+				helpers.Ensure("compose", "-f", data.Labels().Get("composeYaml"), "build", "svc0")
+			},
+
+			Command: test.Command("images"),
+
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					Output: expect.All(
+						expect.Contains(data.Labels().Get("imageSvc0")),
+						expect.DoesNotContain(data.Labels().Get("imageSvc1")),
+					),
+				}
+			},
+		},
+		{
+			Description: "build svc0 and svc1",
+			NoParallel:  true,
+			Setup: func(data test.Data, helpers test.Helpers) {
+				helpers.Ensure("compose", "-f", data.Labels().Get("composeYaml"), "build", "svc0", "svc1")
+			},
+
+			Command: test.Command("images"),
+
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					Output: expect.All(
+						expect.Contains(data.Labels().Get("imageSvc0")),
+						expect.Contains(data.Labels().Get("imageSvc1")),
+					),
+				}
+			},
+		},
+		{
+			Description: "build no arg",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("composeYaml"), "build")
+			},
+
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
+		},
+		{
+			Description: "build bogus",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command(
+					"compose",
+					"-f",
+					data.Labels().Get("composeYaml"),
+					"build",
+					"svc0",
+					"svc100",
+				)
+			},
+
+			Expected: test.Expects(1, []error{errors.New("no such service: svc100")}, nil),
+		},
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		if data.Labels().Get("imageSvc0") != "" {
+			helpers.Anyhow("rmi", data.Labels().Get("imageSvc0"), data.Labels().Get("imageSvc1"))
+		}
+	}
+
+	testCase.Run(t)
 }
diff --git a/cmd/nerdctl/compose/compose_config_test.go b/cmd/nerdctl/compose/compose_config_test.go
index 18dd728da5a..5df0c9eeebb 100644
--- a/cmd/nerdctl/compose/compose_config_test.go
+++ b/cmd/nerdctl/compose/compose_config_test.go
@@ -18,141 +18,275 @@ package compose
 
 import (
 	"fmt"
-	"os"
-	"path/filepath"
 	"testing"
 
 	"gotest.tools/v3/assert"
 
-	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestComposeConfig(t *testing.T) {
-	base := testutil.NewBase(t)
-
-	var dockerComposeYAML = `
+	const dockerComposeYAML = `
 services:
   hello:
     image: alpine:3.13
 `
+	testCase := nerdtest.Setup()
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "config").AssertOutContains("hello:")
-}
-
-func TestComposeConfigWithPrintService(t *testing.T) {
-	base := testutil.NewBase(t)
-
-	var dockerComposeYAML = `
-services:
-  hello1:
-    image: alpine:3.13
-`
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		data.Temp().Save(dockerComposeYAML, "compose.yaml")
+		data.Labels().Set("composeYaml", data.Temp().Path("compose.yaml"))
+	}
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "config contains service name",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("composeYaml"), "config")
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("hello:")),
+		},
+		{
+			Description: "config --services is exactly service name",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command(
+					"compose",
+					"-f",
+					data.Labels().Get("composeYaml"),
+					"config",
+					"--services",
+				)
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("hello\n")),
+		},
+		{
+			Description: "config --hash=* contains service name",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("composeYaml"), "config", "--hash=*")
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("hello")),
+		},
+	}
 
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "config", "--services").AssertOutExactly("hello1\n")
+	testCase.Run(t)
 }
 
 func TestComposeConfigWithPrintServiceHash(t *testing.T) {
-	base := testutil.NewBase(t)
-
-	var dockerComposeYAML = `
+	const dockerComposeYAML = `
 services:
-  hello1:
+  hello:
     image: alpine:%s
 `
+	testCase := nerdtest.Setup()
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		data.Temp().Save(fmt.Sprintf(dockerComposeYAML, "3.13"), "compose.yaml")
+
+		hash := helpers.Capture(
+			"compose",
+			"-f",
+			data.Temp().Path("compose.yaml"),
+			"config",
+			"--hash=hello",
+		)
 
-	comp := testutil.NewComposeDir(t, fmt.Sprintf(dockerComposeYAML, "3.13"))
-	defer comp.CleanUp()
+		data.Labels().Set("hash", hash)
 
-	// `--hash=*` is broken in Docker Compose v2.23.0: https://github.com/docker/compose/issues/11145
-	if base.Target == testutil.Nerdctl {
-		base.ComposeCmd("-f", comp.YAMLFullPath(), "config", "--hash=*").AssertOutContains("hello1")
+		data.Temp().Save(fmt.Sprintf(dockerComposeYAML, "3.14"), "compose.yaml")
 	}
 
-	hash := base.ComposeCmd("-f", comp.YAMLFullPath(), "config", "--hash=hello1").Out()
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		return helpers.Command(
+			"compose",
+			"-f",
+			data.Temp().Path("compose.yaml"),
+			"config",
+			"--hash=hello",
+		)
+	}
 
-	newComp := testutil.NewComposeDir(t, fmt.Sprintf(dockerComposeYAML, "3.14"))
-	defer newComp.CleanUp()
+	testCase.Expected = func(data test.Data, helpers test.Helpers) *test.Expected {
+		return &test.Expected{
+			ExitCode: 0,
+			Output: func(stdout, info string, t *testing.T) {
+				assert.Assert(t, data.Labels().Get("hash") != stdout, "hash should be different")
+			},
+		}
+	}
 
-	newHash := base.ComposeCmd("-f", newComp.YAMLFullPath(), "config", "--hash=hello1").Out()
-	assert.Assert(t, hash != newHash)
+	testCase.Run(t)
 }
 
 func TestComposeConfigWithMultipleFile(t *testing.T) {
-	base := testutil.NewBase(t)
-
-	var dockerComposeYAML = `
+	const dockerComposeBase = `
 services:
   hello1:
     image: alpine:3.13
 `
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-
-	comp.WriteFile("docker-compose.test.yml", `
+	const dockerComposeTest = `
 services:
   hello2:
     image: alpine:3.14
-`)
-	comp.WriteFile("docker-compose.override.yml", `
+`
+
+	const dockerComposeOverride = `
 services:
   hello1:
     image: alpine:3.14
-`)
+`
+
+	testCase := nerdtest.Setup()
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		data.Temp().Save(dockerComposeBase, "compose.yaml")
+		data.Temp().Save(dockerComposeTest, "docker-compose.test.yml")
+		data.Temp().Save(dockerComposeOverride, "docker-compose.override.yml")
+
+		data.Labels().Set("composeDir", data.Temp().Path())
+		data.Labels().Set("composeYaml", data.Temp().Path("compose.yaml"))
+		data.Labels().Set("composeYamlTest", data.Temp().Path("docker-compose.test.yml"))
+	}
+
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "config override",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command(
+					"compose",
+					"-f", data.Labels().Get("composeYaml"),
+					"-f", data.Labels().Get("composeYamlTest"),
+					"config",
+				)
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.All(
+				expect.Contains("alpine:3.13"),
+				expect.Contains("alpine:3.14"),
+				expect.Contains("hello1"),
+				expect.Contains("hello2"),
+			)),
+		},
+		{
+			Description: "project dir",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command(
+					"compose",
+					"--project-directory", data.Labels().Get("composeDir"), "config",
+				)
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("alpine:3.14")),
+		},
+		{
+			Description: "project dir services",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command(
+					"compose",
+					"--project-directory", data.Labels().Get("composeDir"), "config", "--services",
+				)
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("hello1\n")),
+		},
+	}
 
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "-f", filepath.Join(comp.Dir(), "docker-compose.test.yml"), "config").AssertOutContains("alpine:3.14")
-	base.ComposeCmd("--project-directory", comp.Dir(), "config", "--services").AssertOutExactly("hello1\n")
-	base.ComposeCmd("--project-directory", comp.Dir(), "config").AssertOutContains("alpine:3.14")
+	testCase.Run(t)
 }
 
 func TestComposeConfigWithComposeFileEnv(t *testing.T) {
-	base := testutil.NewBase(t)
-
-	var dockerComposeYAML = `
+	const dockerComposeBase = `
 services:
   hello1:
     image: alpine:3.13
 `
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-
-	comp.WriteFile("docker-compose.test.yml", `
+	const dockerComposeTest = `
 services:
   hello2:
     image: alpine:3.14
-`)
+`
+
+	testCase := nerdtest.Setup()
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		data.Temp().Save(dockerComposeBase, "compose.yaml")
+		data.Temp().Save(dockerComposeTest, "docker-compose.test.yml")
 
-	base.Env = append(base.Env, "COMPOSE_FILE="+comp.YAMLFullPath()+","+filepath.Join(comp.Dir(), "docker-compose.test.yml"), "COMPOSE_PATH_SEPARATOR=,")
+		data.Labels().Set("composeDir", data.Temp().Path())
+		data.Labels().Set("composeYaml", data.Temp().Path("compose.yaml"))
+		data.Labels().Set("composeYamlTest", data.Temp().Path("docker-compose.test.yml"))
+	}
+
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "env config",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				cmd := helpers.Command(
+					"compose",
+					"config",
+				)
+				cmd.Setenv("COMPOSE_FILE", data.Labels().Get("composeYaml")+","+data.Labels().Get("composeYamlTest"))
+				cmd.Setenv("COMPOSE_PATH_SEPARATOR", ",")
+				return cmd
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.All(
+				expect.Contains("alpine:3.13"),
+				expect.Contains("alpine:3.14"),
+				expect.Contains("hello1"),
+				expect.Contains("hello2"),
+			)),
+		},
+		{
+			Description: "env with project dir",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				cmd := helpers.Command(
+					"compose",
+					"--project-directory", data.Labels().Get("composeDir"),
+					"config",
+				)
+				cmd.Setenv("COMPOSE_FILE", data.Labels().Get("composeYaml")+","+data.Labels().Get("composeYamlTest"))
+				cmd.Setenv("COMPOSE_PATH_SEPARATOR", ",")
+				return cmd
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.All(
+				expect.Contains("alpine:3.13"),
+				expect.Contains("alpine:3.14"),
+				expect.Contains("hello1"),
+				expect.Contains("hello2"),
+			)),
+		},
+	}
 
-	base.ComposeCmd("config").AssertOutContains("alpine:3.14")
-	base.ComposeCmd("--project-directory", comp.Dir(), "config", "--services").AssertOutContainsAll("hello1\n", "hello2\n")
-	base.ComposeCmd("--project-directory", comp.Dir(), "config").AssertOutContains("alpine:3.14")
+	testCase.Run(t)
 }
 
 func TestComposeConfigWithEnvFile(t *testing.T) {
-	base := testutil.NewBase(t)
-
 	const dockerComposeYAML = `
 services:
   hello:
     image: ${image}
 `
-
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-
-	envFile := filepath.Join(comp.Dir(), "env")
 	const envFileContent = `
 image: hello-world
 `
-	assert.NilError(t, os.WriteFile(envFile, []byte(envFileContent), 0644))
 
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "--env-file", envFile, "config").AssertOutContains("image: hello-world")
+	testCase := nerdtest.Setup()
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		data.Temp().Save(dockerComposeYAML, "compose.yaml")
+		data.Temp().Save(envFileContent, "env")
+	}
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		return helpers.Command("compose",
+			"-f", data.Temp().Path("compose.yaml"),
+			"--env-file", data.Temp().Path("env"),
+			"config",
+		)
+	}
+
+	testCase.Expected = test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("image: hello-world"))
+
+	testCase.Run(t)
 }
diff --git a/cmd/nerdctl/compose/compose_cp_linux_test.go b/cmd/nerdctl/compose/compose_cp_linux_test.go
index 605210d8946..7d5dea8502c 100644
--- a/cmd/nerdctl/compose/compose_cp_linux_test.go
+++ b/cmd/nerdctl/compose/compose_cp_linux_test.go
@@ -18,18 +18,18 @@ package compose
 
 import (
 	"fmt"
-	"os"
-	"path/filepath"
 	"testing"
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestComposeCopy(t *testing.T) {
-	base := testutil.NewBase(t)
-
 	var dockerComposeYAML = fmt.Sprintf(`
 version: '3.1'
 
@@ -39,31 +39,54 @@ services:
     command: "sleep infinity"
 `, testutil.CommonImage)
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
-
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "up", "-d").AssertOK()
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").AssertOK()
-
-	// gernetate test file
-	srcDir := t.TempDir()
-	srcFile := filepath.Join(srcDir, "test-file")
-	srcFileContent := []byte("test-file-content")
-	err := os.WriteFile(srcFile, srcFileContent, 0o644)
-	assert.NilError(t, err)
-
-	// test copy to service
-	destPath := "/dest-no-exist-no-slash"
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "cp", srcFile, "svc0:"+destPath).AssertOK()
-
-	// test copy from service
-	destFile := filepath.Join(srcDir, "test-file2")
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "cp", "svc0:"+destPath, destFile).AssertOK()
-
-	destFileContent, err := os.ReadFile(destFile)
-	assert.NilError(t, err)
-	assert.DeepEqual(t, srcFileContent, destFileContent)
-
+	const testFileContent = "test-file-content"
+
+	testCase := nerdtest.Setup()
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		compYamlPath := data.Temp().Save(dockerComposeYAML, "compose.yaml")
+		helpers.Ensure("compose", "-f", compYamlPath, "up", "-d")
+
+		srcFilePath := data.Temp().Save(testFileContent, "test-file")
+
+		data.Labels().Set("composeYaml", compYamlPath)
+		data.Labels().Set("srcFile", srcFilePath)
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("compose", "-f", data.Temp().Path("compose.yaml"), "down", "-v")
+	}
+
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "test copy to service /dest-no-exist-no-slash",
+			// These are expected to run in sequence
+			NoParallel: true,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose",
+					"-f", data.Labels().Get("composeYaml"),
+					"cp", data.Labels().Get("srcFile"), "svc0:/dest-no-exist-no-slash")
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
+		},
+		{
+			Description: "test copy from service test-file2",
+			NoParallel:  true,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose",
+					"-f", data.Labels().Get("composeYaml"),
+					"cp", "svc0:/dest-no-exist-no-slash", data.Temp().Path("test-file2"))
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					Output: func(stdout, info string, t *testing.T) {
+						copied := data.Temp().Load("test-file2")
+						assert.Equal(t, copied, testFileContent)
+					},
+				}
+			},
+		},
+	}
+
+	testCase.Run(t)
 }
diff --git a/cmd/nerdctl/compose/compose_create_linux_test.go b/cmd/nerdctl/compose/compose_create_linux_test.go
index 43f2dc40067..c1a94dfd2c6 100644
--- a/cmd/nerdctl/compose/compose_create_linux_test.go
+++ b/cmd/nerdctl/compose/compose_create_linux_test.go
@@ -18,13 +18,19 @@ package compose
 
 import (
 	"fmt"
+	"strings"
 	"testing"
 
+	"gotest.tools/v3/assert"
+
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestComposeCreate(t *testing.T) {
-	base := testutil.NewBase(t)
 	var dockerComposeYAML = fmt.Sprintf(`
 version: '3.1'
 
@@ -33,22 +39,53 @@ services:
     image: %s
 `, testutil.AlpineImage)
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
-
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").AssertOK()
-
-	// 1.1 `compose create` should create service container (in `created` status)
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "create").AssertOK()
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "ps", "svc0", "-a").AssertOutContainsAny("Created", "created")
-	// 1.2 created container can be started by `compose start`
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "start").AssertOK()
+	testCase := nerdtest.Setup()
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		compYamlPath := data.Temp().Save(dockerComposeYAML, "compose.yaml")
+		data.Labels().Set("composeYaml", compYamlPath)
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("compose", "-f", data.Temp().Path("compose.yaml"), "down", "-v")
+	}
+
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "`compose create` should work",
+			// These are sequential
+			NoParallel: true,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("composeYaml"), "create")
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
+		},
+		{
+			Description: "`compose create` should have created service container (in `created` status)",
+			NoParallel:  true,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("composeYaml"), "ps", "svc0", "-a")
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, func(stdout, info string, t *testing.T) {
+				assert.Assert(t,
+					strings.Contains(stdout, "created") || strings.Contains(stdout, "Created"),
+					"stdout should contain `created`")
+			}),
+		},
+		{
+			Description: "`created container can be started by `compose start`",
+			NoParallel:  true,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("composeYaml"), "start")
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
+		},
+	}
+
+	testCase.Run(t)
 }
 
 func TestComposeCreateDependency(t *testing.T) {
-	base := testutil.NewBase(t)
 	var dockerComposeYAML = fmt.Sprintf(`
 version: '3.1'
 
@@ -61,17 +98,54 @@ services:
     image: %s
 `, testutil.CommonImage, testutil.CommonImage)
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
-
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").AssertOK()
-
-	// `compose create` should create containers for both services and their dependencies
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "create", "svc0").AssertOK()
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "ps", "svc0", "-a").AssertOutContainsAny("Created", "created")
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "ps", "svc1", "-a").AssertOutContainsAny("Created", "created")
+	testCase := nerdtest.Setup()
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		compYamlPath := data.Temp().Save(dockerComposeYAML, "compose.yaml")
+		data.Labels().Set("composeYaml", compYamlPath)
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("compose", "-f", data.Temp().Path("compose.yaml"), "down", "-v")
+	}
+
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "`compose create` should work",
+			// These are sequential
+			NoParallel: true,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("composeYaml"), "create")
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
+		},
+		{
+			Description: "`compose create` should have created svc0 (in `created` status)",
+			NoParallel:  true,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("composeYaml"), "ps", "svc0", "-a")
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, func(stdout, info string, t *testing.T) {
+				assert.Assert(t,
+					strings.Contains(stdout, "created") || strings.Contains(stdout, "Created"),
+					"stdout should contain `created`")
+			}),
+		},
+		{
+			Description: "`compose create` should have created svc1 (in `created` status)",
+			NoParallel:  true,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("composeYaml"), "ps", "svc1", "-a")
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, func(stdout, info string, t *testing.T) {
+				assert.Assert(t,
+					strings.Contains(stdout, "created") || strings.Contains(stdout, "Created"),
+					"stdout should contain `created`")
+			}),
+		},
+	}
+
+	testCase.Run(t)
 }
 
 func TestComposeCreatePull(t *testing.T) {
diff --git a/cmd/nerdctl/compose/compose_exec_linux_test.go b/cmd/nerdctl/compose/compose_exec_linux_test.go
index 0546ebed6f5..be437cb94d0 100644
--- a/cmd/nerdctl/compose/compose_exec_linux_test.go
+++ b/cmd/nerdctl/compose/compose_exec_linux_test.go
@@ -17,20 +17,23 @@
 package compose
 
 import (
-	"errors"
 	"fmt"
 	"net"
+	"path/filepath"
 	"strings"
 	"testing"
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestComposeExec(t *testing.T) {
-	base := testutil.NewBase(t)
-	var dockerComposeYAML = fmt.Sprintf(`
+	dockerComposeYAML := fmt.Sprintf(`
 version: '3.1'
 
 services:
@@ -42,107 +45,108 @@ services:
     command: "sleep infinity"
 `, testutil.CommonImage, testutil.CommonImage)
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
-
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "up", "-d", "svc0").AssertOK()
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").AssertOK()
-
-	// test basic functionality and `--workdir` flag
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "exec", "-i=false", "--no-TTY", "svc0", "echo", "success").AssertOutExactly("success\n")
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "exec", "-i=false", "--no-TTY", "--workdir", "/tmp", "svc0", "pwd").AssertOutExactly("/tmp\n")
-	// cannot `exec` on non-running service
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "exec", "svc1", "echo", "success").AssertFail()
-}
-
-func TestComposeExecWithEnv(t *testing.T) {
-	base := testutil.NewBase(t)
-	var dockerComposeYAML = fmt.Sprintf(`
-version: '3.1'
-
-services:
-  svc0:
-    image: %s
-    command: "sleep infinity"
-`, testutil.CommonImage)
-
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
-
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "up", "-d").AssertOK()
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").AssertOK()
-
-	// FYI: https://github.com/containerd/nerdctl/blob/e4b2b6da56555dc29ed66d0fd8e7094ff2bc002d/cmd/nerdctl/run_test.go#L177
-	base.Env = append(base.Env, "CORGE=corge-value-in-host", "GARPLY=garply-value-in-host")
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "exec", "-i=false", "--no-TTY",
-		"--env", "FOO=foo1,foo2",
-		"--env", "BAR=bar1 bar2",
-		"--env", "BAZ=",
-		"--env", "QUX", // not exported in OS
-		"--env", "QUUX=quux1",
-		"--env", "QUUX=quux2",
-		"--env", "CORGE", // OS exported
-		"--env", "GRAULT=grault_key=grault_value", // value contains `=` char
-		"--env", "GARPLY=", // OS exported
-		"--env", "WALDO=", // not exported in OS
-
-		"svc0", "env").AssertOutWithFunc(func(stdout string) error {
-		if !strings.Contains(stdout, "\nFOO=foo1,foo2\n") {
-			return errors.New("got bad FOO")
-		}
-		if !strings.Contains(stdout, "\nBAR=bar1 bar2\n") {
-			return errors.New("got bad BAR")
-		}
-		if !strings.Contains(stdout, "\nBAZ=\n") {
-			return errors.New("got bad BAZ")
-		}
-		if strings.Contains(stdout, "QUX") {
-			return errors.New("got bad QUX (should not be set)")
-		}
-		if !strings.Contains(stdout, "\nQUUX=quux2\n") {
-			return errors.New("got bad QUUX")
-		}
-		if !strings.Contains(stdout, "\nCORGE=corge-value-in-host\n") {
-			return errors.New("got bad CORGE")
-		}
-		if !strings.Contains(stdout, "\nGRAULT=grault_key=grault_value\n") {
-			return errors.New("got bad GRAULT")
-		}
-		if !strings.Contains(stdout, "\nGARPLY=\n") {
-			return errors.New("got bad GARPLY")
-		}
-		if !strings.Contains(stdout, "\nWALDO=\n") {
-			return errors.New("got bad WALDO")
-		}
-
-		return nil
-	})
-}
+	testCase := nerdtest.Setup()
 
-func TestComposeExecWithUser(t *testing.T) {
-	base := testutil.NewBase(t)
-	var dockerComposeYAML = fmt.Sprintf(`
-version: '3.1'
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		yamlPath := data.Temp().Save(dockerComposeYAML, "compose.yaml")
+		data.Labels().Set("YAMLPath", yamlPath)
+		helpers.Ensure("compose", "-f", yamlPath, "up", "-d", "svc0")
+	}
 
-services:
-  svc0:
-    image: %s
-    command: "sleep infinity"
-`, testutil.CommonImage)
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("compose", "-f", data.Temp().Path("compose.yaml"), "down", "-v")
+	}
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "exec no tty",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command(
+					"compose",
+					"-f",
+					data.Labels().Get("YAMLPath"),
+					"exec",
+					"-i=false",
+					"--no-TTY",
+					"svc0",
+					"echo",
+					"success",
+				)
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("success\n")),
+		},
+		{
+			Description: "exec no tty with workdir",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command(
+					"compose",
+					"-f",
+					data.Labels().Get("YAMLPath"),
+					"exec",
+					"-i=false",
+					"--no-TTY",
+					"--workdir",
+					"/tmp",
+					"svc0",
+					"pwd",
+				)
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("/tmp\n")),
+		},
+		{
+			Description: "cannot exec on non-running service",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("YAMLPath"), "exec", "svc1", "echo", "success")
+			},
+			Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
+		},
+		{
+			Description: "with env",
+			Env: map[string]string{
+				"CORGE":  "corge-value-in-host",
+				"GARPLY": "garply-value-in-host",
+			},
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command(
+					"compose",
+					"-f",
+					data.Labels().Get("YAMLPath"),
+					"exec",
+					"-i=false",
+					"--no-TTY",
+					"--env", "FOO=foo1,foo2",
+					"--env", "BAR=bar1 bar2",
+					"--env", "BAZ=",
+					"--env", "QUX", // not exported in OS
+					"--env", "QUUX=quux1",
+					"--env", "QUUX=quux2",
+					"--env", "CORGE", // OS exported
+					"--env", "GRAULT=grault_key=grault_value", // value contains `=` char
+					"--env", "GARPLY=", // OS exported
+					"--env", "WALDO=", // not exported in OS
+					"svc0",
+					"env")
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.All(
+				expect.Contains("\nFOO=foo1,foo2\n"),
+				expect.Contains("\nBAR=bar1 bar2\n"),
+				expect.Contains("\nBAZ=\n"),
+				expect.DoesNotContain("QUX"),
+				expect.Contains("\nQUUX=quux2\n"),
+				expect.Contains("\nCORGE=corge-value-in-host\n"),
+				expect.Contains("\nGRAULT=grault_key=grault_value\n"),
+				expect.Contains("\nGARPLY=\n"),
+				expect.Contains("\nWALDO=\n"),
+			)),
+		},
+	}
 
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "up", "-d").AssertOK()
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").AssertOK()
+	userSubTest := &test.Case{
+		Description: "with user",
+		SubTests:    []*test.Case{},
+	}
 
-	testCases := map[string]string{
+	userCasesMap := map[string]string{
 		"":             "uid=0(root) gid=0(root)",
 		"1000":         "uid=1000 gid=0(root)",
 		"1000:users":   "uid=1000 gid=100(users)",
@@ -151,21 +155,29 @@ services:
 		"nobody:users": "uid=65534(nobody) gid=100(users)",
 	}
 
-	for userStr, expected := range testCases {
-		args := []string{"-f", comp.YAMLFullPath(), "exec", "-i=false", "--no-TTY"}
-		if userStr != "" {
-			args = append(args, "--user", userStr)
-		}
-		args = append(args, "svc0", "id")
-		base.ComposeCmd(args...).AssertOutContains(expected)
+	for k, v := range userCasesMap {
+		userSubTest.SubTests = append(userSubTest.SubTests, &test.Case{
+			Description: k + " " + v,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				args := []string{"compose", "-f", data.Labels().Get("YAMLPath"), "exec", "-i=false", "--no-TTY"}
+				if k != "" {
+					args = append(args, "--user", k)
+				}
+				args = append(args, "svc0", "id")
+				return helpers.Command(args...)
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains(v)),
+		})
 	}
+
+	testCase.SubTests = append(testCase.SubTests, userSubTest)
+
+	testCase.Run(t)
 }
 
 func TestComposeExecTTY(t *testing.T) {
-	// `-i` in `compose run & exec` is only supported in compose v2.
-	base := testutil.NewBase(t)
-
-	var dockerComposeYAML = fmt.Sprintf(`
+	const expectedOutput = "speed 38400 baud"
+	dockerComposeYAML := fmt.Sprintf(`
 version: '3.1'
 
 services:
@@ -175,29 +187,85 @@ services:
     image: %s
 `, testutil.CommonImage, testutil.CommonImage)
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
-
-	testContainer := testutil.Identifier(t)
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "run", "-d", "-i=false", "--name", testContainer, "svc0", "sleep", "1h").AssertOK()
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").AssertOK()
-	base.EnsureContainerStarted(testContainer)
-
-	const sttyPartialOutput = "speed 38400 baud"
-	// unbuffer(1) emulates tty, which is required by `nerdctl run -t`.
-	// unbuffer(1) can be installed with `apt-get install expect`.
-	unbuffer := []string{"unbuffer"}
-	base.ComposeCmdWithHelper(unbuffer, "-f", comp.YAMLFullPath(), "exec", "svc0", "stty").AssertOutContains(sttyPartialOutput)             // `-it`
-	base.ComposeCmdWithHelper(unbuffer, "-f", comp.YAMLFullPath(), "exec", "-i=false", "svc0", "stty").AssertOutContains(sttyPartialOutput) // `-t`
-	base.ComposeCmdWithHelper(unbuffer, "-f", comp.YAMLFullPath(), "exec", "--no-TTY", "svc0", "stty").AssertFail()                         // `-i`
-	base.ComposeCmdWithHelper(unbuffer, "-f", comp.YAMLFullPath(), "exec", "-i=false", "--no-TTY", "svc0", "stty").AssertFail()
+	testCase := nerdtest.Setup()
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		yamlPath := data.Temp().Save(dockerComposeYAML, "compose.yaml")
+		data.Labels().Set("YAMLPath", yamlPath)
+		helpers.Ensure(
+			"compose",
+			"-f",
+			yamlPath,
+			"run",
+			"-d",
+			"-i=false",
+			"--name",
+			data.Identifier(),
+			"svc0",
+			"sleep",
+			"1h",
+		)
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		// FIXME?
+		// similar, other test does *also* remove the container
+		helpers.Anyhow("compose", "-f", data.Labels().Get("YAMLPath"), "down", "-v")
+	}
+
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "stty exec",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				cmd := helpers.Command("compose", "-f", data.Labels().Get("YAMLPath"), "exec", "svc0", "stty")
+				cmd.WithPseudoTTY()
+				return cmd
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains(expectedOutput)),
+		},
+		{
+			Description: "-i=false stty exec",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				cmd := helpers.Command("compose", "-f", data.Labels().Get("YAMLPath"), "exec", "-i=false", "svc0", "stty")
+				cmd.WithPseudoTTY()
+				return cmd
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains(expectedOutput)),
+		},
+		{
+			Description: "--no-TTY stty exec",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				cmd := helpers.Command("compose", "-f", data.Labels().Get("YAMLPath"), "exec", "--no-TTY", "svc0", "stty")
+				cmd.WithPseudoTTY()
+				return cmd
+			},
+			Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
+		},
+		{
+			Description: "-i=false --no-TTY stty exec",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				cmd := helpers.Command(
+					"compose",
+					"-f",
+					data.Labels().Get("YAMLPath"),
+					"exec",
+					"-i=false",
+					"--no-TTY",
+					"svc0",
+					"stty",
+				)
+				cmd.WithPseudoTTY()
+				return cmd
+			},
+			Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
+		},
+	}
+
+	testCase.Run(t)
 }
 
 func TestComposeExecWithIndex(t *testing.T) {
-	base := testutil.NewBase(t)
-	var dockerComposeYAML = fmt.Sprintf(`
+	dockerComposeYAML := fmt.Sprintf(`
 version: '3.1'
 
 services:
@@ -208,39 +276,52 @@ services:
       replicas: 3
 `, testutil.CommonImage)
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	t.Cleanup(func() {
-		comp.CleanUp()
-	})
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
-
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "up", "-d", "svc0").AssertOK()
-	t.Cleanup(func() {
-		base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").AssertOK()
-	})
-
-	// try 5 times to ensure that results are stable
-	for i := 0; i < 5; i++ {
-		for _, j := range []string{"1", "2", "3"} {
-			name := fmt.Sprintf("%s-svc0-%s", projectName, j)
-			host := fmt.Sprintf("%s.%s_default", name, projectName)
-			var (
-				expectIP string
-				realIP   string
-			)
-			//  docker and nerdctl have different DNS resolution behaviors.
-			// it uses the ID in the /etc/hosts file, so we need to fetch the ID first.
-			if testutil.GetTarget() == testutil.Docker {
-				base.Cmd("ps", "--filter", fmt.Sprintf("name=%s", name), "--format", "{{.ID}}").AssertOutWithFunc(func(stdout string) error {
-					host = strings.TrimSpace(stdout)
-					return nil
-				})
-			}
-			cmds := []string{"-f", comp.YAMLFullPath(), "exec", "-i=false", "--no-TTY", "--index", j, "svc0"}
-			base.ComposeCmd(append(cmds, "cat", "/etc/hosts")...).
-				AssertOutWithFunc(func(stdout string) error {
-					lines := strings.Split(stdout, "\n")
+	testCase := nerdtest.Setup()
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		yamlPath := data.Temp().Save(dockerComposeYAML, "compose.yaml")
+		data.Labels().Set("YAMLPath", yamlPath)
+		data.Labels().Set("projectName", strings.ToLower(filepath.Base(data.Temp().Dir())))
+
+		helpers.Ensure("compose", "-f", yamlPath, "up", "-d", "svc0")
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("compose", "-f", data.Temp().Path("compose.yaml"), "down", "-v")
+	}
+
+	for _, index := range []string{"1", "2", "3"} {
+		testCase.SubTests = append(testCase.SubTests, &test.Case{
+			Description: index,
+			Setup: func(data test.Data, helpers test.Helpers) {
+				// try 5 times to ensure that results are stable
+				for range 5 {
+					cmds := []string{
+						"compose",
+						"-f",
+						data.Labels().Get("YAMLPath"),
+						"exec",
+						"-i=false",
+						"--no-TTY",
+						"--index",
+						index,
+						"svc0",
+					}
+
+					hsts := helpers.Capture(append(cmds, "cat", "/etc/hosts")...)
+					ips := helpers.Capture(append(cmds, "ip", "addr", "show", "dev", "eth0")...)
+
+					var (
+						expectIP string
+						realIP   string
+					)
+					name := fmt.Sprintf("%s-svc0-%s", data.Labels().Get("projectName"), index)
+					host := fmt.Sprintf("%s.%s_default", name, data.Labels().Get("projectName"))
+					if nerdtest.IsDocker() {
+						host = strings.TrimSpace(helpers.Capture("ps", "--filter", "name="+name, "--format", "{{.ID}}"))
+					}
+
+					lines := strings.Split(hsts, "\n")
 					for _, line := range lines {
 						if !strings.Contains(line, host) {
 							continue
@@ -250,37 +331,32 @@ services:
 							continue
 						}
 						expectIP = fields[0]
-						return nil
 					}
-					return errors.New("fail to get the expected ip address")
-				})
-			base.ComposeCmd(append(cmds, "ip", "addr", "show", "dev", "eth0")...).
-				AssertOutWithFunc(func(stdout string) error {
-					ip := findIP(stdout)
-					if ip == nil {
-						return errors.New("fail to get the real ip address")
+
+					var ip string
+					lines = strings.Split(ips, "\n")
+					for _, line := range lines {
+						if !strings.Contains(line, "inet ") {
+							continue
+						}
+						fields := strings.Fields(line)
+						if len(fields) <= 1 {
+							continue
+						}
+						ip = strings.Split(fields[1], "/")[0]
+						break
 					}
-					realIP = ip.String()
-					return nil
-				})
-			assert.Equal(t, realIP, expectIP)
-		}
-	}
-}
 
-func findIP(output string) net.IP {
-	var ip string
-	lines := strings.Split(output, "\n")
-	for _, line := range lines {
-		if !strings.Contains(line, "inet ") {
-			continue
-		}
-		fields := strings.Fields(line)
-		if len(fields) <= 1 {
-			continue
-		}
-		ip = strings.Split(fields[1], "/")[0]
-		break
+					pip := net.ParseIP(ip)
+
+					assert.Assert(helpers.T(), pip != nil, "fail to get the real ip address")
+					realIP = pip.String()
+
+					assert.Equal(helpers.T(), realIP, expectIP)
+				}
+			},
+		})
 	}
-	return net.ParseIP(ip)
+
+	testCase.Run(t)
 }
diff --git a/cmd/nerdctl/compose/compose_run_linux_test.go b/cmd/nerdctl/compose/compose_run_linux_test.go
index 65b36e7ffb6..bd606299bfe 100644
--- a/cmd/nerdctl/compose/compose_run_linux_test.go
+++ b/cmd/nerdctl/compose/compose_run_linux_test.go
@@ -26,48 +26,18 @@ import (
 	"gotest.tools/v3/assert"
 
 	"github.com/containerd/log"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nettestutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/testregistry"
 )
 
 func TestComposeRun(t *testing.T) {
-	base := testutil.NewBase(t)
-	// specify the name of container in order to remove
-	// TODO: when `compose rm` is implemented, replace it.
-	containerName := testutil.Identifier(t)
-
-	dockerComposeYAML := fmt.Sprintf(`
-version: '3.1'
-services:
-  alpine:
-    image: %s
-    entrypoint:
-      - stty
-`, testutil.AlpineImage)
-
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").Run()
-
-	defer base.Cmd("rm", "-f", "-v", containerName).Run()
-	const sttyPartialOutput = "speed 38400 baud"
-	// unbuffer(1) emulates tty, which is required by `nerdctl run -t`.
-	// unbuffer(1) can be installed with `apt-get install expect`.
-	unbuffer := []string{"unbuffer"}
-	base.ComposeCmdWithHelper(unbuffer, "-f", comp.YAMLFullPath(),
-		"run", "--name", containerName, "alpine").AssertOutContains(sttyPartialOutput)
-}
-
-func TestComposeRunWithRM(t *testing.T) {
-	base := testutil.NewBase(t)
-	// specify the name of container in order to remove
-	// TODO: when `compose rm` is implemented, replace it.
-	containerName := testutil.Identifier(t)
+	const expectedOutput = "speed 38400 baud"
 
 	dockerComposeYAML := fmt.Sprintf(`
 version: '3.1'
@@ -78,29 +48,69 @@ services:
       - stty
 `, testutil.AlpineImage)
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").Run()
-
-	defer base.Cmd("rm", "-f", "-v", containerName).Run()
-	const sttyPartialOutput = "speed 38400 baud"
-	// unbuffer(1) emulates tty, which is required by `nerdctl run -t`.
-	// unbuffer(1) can be installed with `apt-get install expect`.
-	unbuffer := []string{"unbuffer"}
-	base.ComposeCmdWithHelper(unbuffer, "-f", comp.YAMLFullPath(),
-		"run", "--name", containerName, "--rm", "alpine").AssertOutContains(sttyPartialOutput)
-
-	psCmd := base.Cmd("ps", "-a", "--format=\"{{.Names}}\"")
-	result := psCmd.Run()
-	stdoutContent := result.Stdout() + result.Stderr()
-	assert.Assert(psCmd.Base.T, result.ExitCode == 0, stdoutContent)
-	if strings.Contains(stdoutContent, containerName) {
-		log.L.Errorf("test failed, the container %s is not removed", stdoutContent)
-		t.Fail()
-		return
+	testCase := nerdtest.Setup()
+
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "pty run",
+			Setup: func(data test.Data, helpers test.Helpers) {
+				data.Temp().Save(dockerComposeYAML, "compose.yaml")
+			},
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				cmd := helpers.Command(
+					"compose",
+					"-f",
+					data.Temp().Path("compose.yaml"),
+					"run",
+					"--name",
+					data.Identifier(),
+					"alpine",
+				)
+				cmd.WithPseudoTTY()
+				return cmd
+			},
+			Expected: test.Expects(0, nil, expect.Contains(expectedOutput)),
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rm", "-f", "-v", data.Identifier())
+				helpers.Anyhow("compose", "-f", data.Temp().Path("compose.yaml"), "down", "-v")
+			},
+		},
+		{
+			Description: "pty run with --rm",
+			Setup: func(data test.Data, helpers test.Helpers) {
+				data.Temp().Save(dockerComposeYAML, "compose.yaml")
+			},
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				cmd := helpers.Command(
+					"compose",
+					"-f",
+					data.Temp().Path("compose.yaml"),
+					"run",
+					"--name",
+					data.Identifier(),
+					"--rm",
+					"alpine",
+				)
+				cmd.WithPseudoTTY()
+				return cmd
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				// Ensure the container has been removed
+				capt := helpers.Capture("ps", "-a", "--format=\"{{.Names}}\"")
+				assert.Assert(t, !strings.Contains(capt, data.Identifier()), capt)
+
+				return &test.Expected{
+					Output: expect.Contains(expectedOutput),
+				}
+			},
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rm", "-f", "-v", data.Identifier())
+				helpers.Anyhow("compose", "-f", data.Temp().Path("compose.yaml"), "down", "-v")
+			},
+		},
 	}
+
+	testCase.Run(t)
 }
 
 func TestComposeRunWithServicePorts(t *testing.T) {
diff --git a/cmd/nerdctl/container/container_logs_test.go b/cmd/nerdctl/container/container_logs_test.go
index 94c561fafb4..05b6ea67190 100644
--- a/cmd/nerdctl/container/container_logs_test.go
+++ b/cmd/nerdctl/container/container_logs_test.go
@@ -17,6 +17,7 @@
 package container
 
 import (
+	"errors"
 	"fmt"
 	"os/exec"
 	"runtime"
@@ -76,16 +77,29 @@ bar`
 // Tests whether `nerdctl logs` properly separates stdout/stderr output
 // streams for containers using the jsonfile logging driver:
 func TestLogsOutStreamsSeparated(t *testing.T) {
-	t.Parallel()
-	base := testutil.NewBase(t)
-	containerName := testutil.Identifier(t)
+	testCase := nerdtest.Setup()
 
-	defer base.Cmd("rm", containerName).Run()
-	base.Cmd("run", "-d", "--name", containerName, testutil.CommonImage,
-		"sh", "-euc", "echo stdout1; echo stderr1 >&2; echo stdout2; echo stderr2 >&2").AssertOK()
-	time.Sleep(3 * time.Second)
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage,
+			"sh", "-euc", "echo stdout1; echo stderr1 >&2; echo stdout2; echo stderr2 >&2")
+	}
 
-	base.Cmd("logs", containerName).AssertOutStreamsExactly("stdout1\nstdout2\n", "stderr1\nstderr2\n")
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rm", "-f", data.Identifier())
+	}
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		// Arbitrary, but we need to wait until the logs show up
+		time.Sleep(3 * time.Second)
+		return helpers.Command("logs", data.Identifier())
+	}
+
+	testCase.Expected = test.Expects(expect.ExitCodeSuccess, []error{
+		//revive:disable:error-strings
+		errors.New("stderr1\nstderr2\n"),
+	}, expect.Equals("stdout1\nstdout2\n"))
+
+	testCase.Run(t)
 }
 
 func TestLogsWithInheritedFlags(t *testing.T) {
diff --git a/cmd/nerdctl/container/container_run_network_linux_test.go b/cmd/nerdctl/container/container_run_network_linux_test.go
index 853e14e8ab5..46b9057e11a 100644
--- a/cmd/nerdctl/container/container_run_network_linux_test.go
+++ b/cmd/nerdctl/container/container_run_network_linux_test.go
@@ -41,7 +41,6 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
-	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
@@ -682,27 +681,18 @@ func TestSharedNetworkWithNone(t *testing.T) {
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
-			data.Labels().Set("containerName1", data.Identifier("-container1"))
-			containerName1 := data.Labels().Get("containerName1")
-			helpers.Ensure("run", "-d", "--name", containerName1, "--network", "none",
+			helpers.Ensure("run", "-d", "--name", data.Identifier("container1"), "--network", "none",
 				testutil.NginxAlpineImage)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rm", "-f", data.Labels().Get("containerName1"))
+			helpers.Anyhow("rm", "-f", data.Identifier("container1"))
+			helpers.Anyhow("rm", "-f", data.Identifier("container2"))
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			containerName2 := data.Identifier()
-			cmd := helpers.Command()
-			cmd.WithArgs("run", "-d", "--name", containerName2,
-				"--network=container:"+data.Labels().Get("containerName1"),
-				testutil.NginxAlpineImage)
-			return cmd
-		},
-		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
-			return &test.Expected{
-				ExitCode: 0,
-			}
+			return helpers.Command("run", "-d", "--name", data.Identifier("container2"),
+				"--network=container:"+data.Identifier("container1"), testutil.NginxAlpineImage)
 		},
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 	}
 	testCase.Run(t)
 }
@@ -905,7 +895,7 @@ func TestRunContainerWithStaticIP6(t *testing.T) {
 				return
 			}
 			cmd.AssertOutWithFunc(func(stdout string) error {
-				ip := helpers.FindIPv6(stdout)
+				ip := nerdtest.FindIPv6(stdout)
 				if !subnet.Contains(ip) {
 					return fmt.Errorf("expected subnet %s include ip %s", subnet, ip)
 				}
diff --git a/cmd/nerdctl/container/container_run_soci_linux_test.go b/cmd/nerdctl/container/container_run_soci_linux_test.go
index 57cf0599525..670a15dc7de 100644
--- a/cmd/nerdctl/container/container_run_soci_linux_test.go
+++ b/cmd/nerdctl/container/container_run_soci_linux_test.go
@@ -17,60 +17,63 @@
 package container
 
 import (
-	"os/exec"
+	"strconv"
 	"strings"
 	"testing"
 
-	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
+	"gotest.tools/v3/assert"
+
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestRunSoci(t *testing.T) {
-	testutil.DockerIncompatible(t)
-	tests := []struct {
-		name                         string
-		image                        string
-		remoteSnapshotsExpectedCount int
-	}{
-		{
-			name:                         "Run with SOCI",
-			image:                        testutil.FfmpegSociImage,
-			remoteSnapshotsExpectedCount: 11,
-		},
-	}
+	testCase := nerdtest.Setup()
 
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			base := testutil.NewBase(t)
-			helpers.RequiresSoci(base)
+	testCase.Require = require.All(
+		require.Not(nerdtest.Docker),
+		nerdtest.Soci,
+	)
 
-			//counting initial snapshot mounts
-			initialMounts, err := exec.Command("mount").Output()
-			if err != nil {
-				t.Fatal(err)
-			}
+	// Tests relying on the output of "mount" cannot be run in parallel obviously
+	testCase.NoParallel = true
 
-			remoteSnapshotsInitialCount := strings.Count(string(initialMounts), "fuse.rawBridge")
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		helpers.Custom("mount").Run(&test.Expected{
+			ExitCode: 0,
+			Output: func(stdout, info string, t *testing.T) {
+				data.Labels().Set("beforeCount", strconv.Itoa(strings.Count(stdout, "fuse.rawBridge")))
+			},
+		})
+	}
 
-			runOutput := base.Cmd("--snapshotter=soci", "run", "--rm", testutil.FfmpegSociImage).Out()
-			base.T.Logf("run output: %s", runOutput)
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rmi", "-f", testutil.FfmpegSociImage)
+	}
 
-			actualMounts, err := exec.Command("mount").Output()
-			if err != nil {
-				t.Fatal(err)
-			}
-			remoteSnapshotsActualCount := strings.Count(string(actualMounts), "fuse.rawBridge")
-			base.T.Logf("number of actual mounts: %v", remoteSnapshotsActualCount)
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		return helpers.Command("--snapshotter=soci", "run", "--rm", testutil.FfmpegSociImage)
+	}
 
-			rmiOutput := base.Cmd("rmi", testutil.FfmpegSociImage).Out()
-			base.T.Logf("rmi output: %s", rmiOutput)
+	testCase.Expected = func(data test.Data, helpers test.Helpers) *test.Expected {
+		return &test.Expected{
+			Output: func(stdout, info string, t *testing.T) {
+				var afterCount int
+				beforeCount, _ := strconv.Atoi(data.Labels().Get("beforeCount"))
 
-			base.T.Logf("number of expected mounts: %v", tt.remoteSnapshotsExpectedCount)
+				helpers.Custom("mount").Run(&test.Expected{
+					Output: func(stdout, info string, t *testing.T) {
+						afterCount = strings.Count(stdout, "fuse.rawBridge")
+					},
+				})
 
-			if tt.remoteSnapshotsExpectedCount != (remoteSnapshotsActualCount - remoteSnapshotsInitialCount) {
-				t.Fatalf("incorrect number of remote snapshots; expected=%d, actual=%d",
-					tt.remoteSnapshotsExpectedCount, remoteSnapshotsActualCount-remoteSnapshotsInitialCount)
-			}
-		})
+				assert.Equal(t, 11, afterCount-beforeCount, "expected the number of fuse.rawBridge")
+			},
+		}
 	}
+
+	testCase.Run(t)
 }
diff --git a/cmd/nerdctl/container/container_run_test.go b/cmd/nerdctl/container/container_run_test.go
index 97eac527b8d..eb0d22c9674 100644
--- a/cmd/nerdctl/container/container_run_test.go
+++ b/cmd/nerdctl/container/container_run_test.go
@@ -34,215 +34,274 @@ import (
 	"gotest.tools/v3/icmd"
 	"gotest.tools/v3/poll"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestRunEntrypointWithBuild(t *testing.T) {
-	t.Parallel()
-	testutil.RequiresBuild(t)
-	testutil.RegisterBuildCacheCleanup(t)
-	base := testutil.NewBase(t)
-	imageName := testutil.Identifier(t)
-	defer base.Cmd("rmi", imageName).Run()
+	nerdtest.Setup()
 
 	dockerfile := fmt.Sprintf(`FROM %s
 ENTRYPOINT ["echo", "foo"]
 CMD ["echo", "bar"]
 	`, testutil.CommonImage)
 
-	buildCtx := helpers.CreateBuildContext(t, dockerfile)
+	testCase := &test.Case{
+		Require: nerdtest.Build,
+		Setup: func(data test.Data, helpers test.Helpers) {
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Labels().Set("image", data.Identifier())
+			helpers.Ensure("build", "-t", data.Labels().Get("image"), data.Temp().Path())
+		},
+		SubTests: []*test.Case{
+			{
+				Description: "Run image",
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--rm", data.Labels().Get("image"))
+				},
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("foo echo bar\n")),
+			},
+			{
+				Description: "Run image empty entrypoint",
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--rm", "--entrypoint", "", data.Labels().Get("image"))
+				},
+				Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
+			},
+			{
+				Description: "Run image time entrypoint",
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--rm", "--entrypoint", "time", data.Labels().Get("image"))
+				},
+				Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
+			},
+			{
+				Description: "Run image empty entrypoint custom command",
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--rm", "--entrypoint", "", data.Labels().Get("image"), "echo", "blah")
+				},
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.All(
+					expect.Contains("blah"),
+					expect.DoesNotContain("foo"),
+					expect.DoesNotContain("bar"),
+				)),
+			},
+			{
+				Description: "Run image time entrypoint custom command",
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--rm", "--entrypoint", "time", data.Labels().Get("image"), "echo", "blah")
+				},
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.All(
+					expect.Contains("blah"),
+					expect.DoesNotContain("foo"),
+					expect.DoesNotContain("bar"),
+				)),
+			},
+		},
+	}
 
-	base.Cmd("build", "-t", imageName, buildCtx).AssertOK()
-	base.Cmd("run", "--rm", imageName).AssertOutExactly("foo echo bar\n")
-	base.Cmd("run", "--rm", "--entrypoint", "", imageName).AssertFail()
-	base.Cmd("run", "--rm", "--entrypoint", "", imageName, "echo", "blah").AssertOutWithFunc(func(stdout string) error {
-		if !strings.Contains(stdout, "blah") {
-			return errors.New("echo blah was not executed?")
-		}
-		if strings.Contains(stdout, "bar") {
-			return errors.New("echo bar should not be executed")
-		}
-		if strings.Contains(stdout, "foo") {
-			return errors.New("echo foo should not be executed")
-		}
-		return nil
-	})
-	base.Cmd("run", "--rm", "--entrypoint", "time", imageName).AssertFail()
-	base.Cmd("run", "--rm", "--entrypoint", "time", imageName, "echo", "blah").AssertOutWithFunc(func(stdout string) error {
-		if !strings.Contains(stdout, "blah") {
-			return errors.New("echo blah was not executed?")
-		}
-		if strings.Contains(stdout, "bar") {
-			return errors.New("echo bar should not be executed")
-		}
-		if strings.Contains(stdout, "foo") {
-			return errors.New("echo foo should not be executed")
-		}
-		return nil
-	})
+	testCase.Run(t)
 }
 
 func TestRunWorkdir(t *testing.T) {
-	t.Parallel()
-	base := testutil.NewBase(t)
+	testCase := nerdtest.Setup()
+
 	dir := "/foo"
 	if runtime.GOOS == "windows" {
 		dir = "c:" + dir
 	}
-	cmd := base.Cmd("run", "--rm", "--workdir="+dir, testutil.CommonImage, "pwd")
-	cmd.AssertOutContains("/foo")
+
+	testCase.Command = test.Command("run", "--rm", "--workdir="+dir, testutil.CommonImage, "pwd")
+
+	testCase.Expected = test.Expects(expect.ExitCodeSuccess, nil, expect.Contains(dir))
+
+	testCase.Run(t)
 }
 
 func TestRunWithDoubleDash(t *testing.T) {
-	t.Parallel()
-	testutil.DockerIncompatible(t)
-	base := testutil.NewBase(t)
-	base.Cmd("run", "--rm", testutil.CommonImage, "--", "sh", "-euxc", "exit 0").AssertOK()
+	testCase := nerdtest.Setup()
+
+	testCase.Require = require.Not(nerdtest.Docker)
+
+	testCase.Command = test.Command("run", "--rm", testutil.CommonImage, "--", "sh", "-euxc", "exit 0")
+
+	testCase.Expected = test.Expects(expect.ExitCodeSuccess, nil, nil)
+
+	testCase.Run(t)
 }
 
 func TestRunExitCode(t *testing.T) {
-	t.Parallel()
-	base := testutil.NewBase(t)
-	tID := testutil.Identifier(t)
-	testContainer0 := tID + "-0"
-	testContainer123 := tID + "-123"
-	defer base.Cmd("rm", "-f", testContainer0, testContainer123).Run()
-
-	base.Cmd("run", "--name", testContainer0, testutil.CommonImage, "sh", "-euxc", "exit 0").AssertOK()
-	base.Cmd("run", "--name", testContainer123, testutil.CommonImage, "sh", "-euxc", "exit 123").AssertExitCode(123)
-	base.Cmd("ps", "-a").AssertOutWithFunc(func(stdout string) error {
-		if !strings.Contains(stdout, "Exited (0)") {
-			return fmt.Errorf("no entry for %q", testContainer0)
-		}
-		if !strings.Contains(stdout, "Exited (123)") {
-			return fmt.Errorf("no entry for %q", testContainer123)
-		}
-		return nil
-	})
+	testCase := nerdtest.Setup()
 
-	inspect0 := base.InspectContainer(testContainer0)
-	assert.Equal(base.T, "exited", inspect0.State.Status)
-	assert.Equal(base.T, 0, inspect0.State.ExitCode)
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rm", "-f", data.Identifier("exit0"))
+		helpers.Anyhow("rm", "-f", data.Identifier("exit123"))
+	}
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		helpers.Ensure("run", "--name", data.Identifier("exit0"), testutil.CommonImage, "sh", "-euxc", "exit 0")
+		helpers.Command("run", "--name", data.Identifier("exit123"), testutil.CommonImage, "sh", "-euxc", "exit 123").
+			Run(&test.Expected{ExitCode: 123})
+	}
+
+	testCase.Command = test.Command("ps", "-a")
+
+	testCase.Expected = func(data test.Data, helpers test.Helpers) *test.Expected {
+		return &test.Expected{
+			ExitCode: expect.ExitCodeSuccess,
+			Errors:   nil,
+			Output: expect.All(
+				expect.Match(regexp.MustCompile("Exited [(]123[)][A-Za-z0-9 ]+"+data.Identifier("exit123"))),
+				expect.Match(regexp.MustCompile("Exited [(]0[)][A-Za-z0-9 ]+"+data.Identifier("exit0"))),
+				func(stdout, info string, t *testing.T) {
+					assert.Equal(t, nerdtest.InspectContainer(helpers, data.Identifier("exit0")).State.Status, "exited")
+					assert.Equal(t, nerdtest.InspectContainer(helpers, data.Identifier("exit123")).State.Status, "exited")
+				},
+			),
+		}
+	}
 
-	inspect123 := base.InspectContainer(testContainer123)
-	assert.Equal(base.T, "exited", inspect123.State.Status)
-	assert.Equal(base.T, 123, inspect123.State.ExitCode)
+	testCase.Run(t)
 }
 
 func TestRunCIDFile(t *testing.T) {
-	t.Parallel()
-	base := testutil.NewBase(t)
-	fileName := filepath.Join(t.TempDir(), "cid.file")
+	testCase := nerdtest.Setup()
 
-	base.Cmd("run", "--rm", "--cidfile", fileName, testutil.CommonImage).AssertOK()
-	defer os.Remove(fileName)
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		helpers.Ensure("run", "--rm", "--cidfile", data.Temp().Path("cid-file"), testutil.CommonImage)
+		data.Temp().Exists("cid-file")
+	}
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		return helpers.Command("run", "--rm", "--cidfile", data.Temp().Path("cid-file"), testutil.CommonImage)
+	}
 
-	_, err := os.Stat(fileName)
-	assert.NilError(base.T, err)
+	// Docker will return 125 while nerdctl returns 1, so, generic fail instead of specific exit code
+	testCase.Expected = test.Expects(expect.ExitCodeGenericFail, []error{errors.New("container ID file found")}, nil)
 
-	base.Cmd("run", "--rm", "--cidfile", fileName, testutil.CommonImage).AssertFail()
+	testCase.Run(t)
 }
 
 func TestRunEnvFile(t *testing.T) {
-	t.Parallel()
-	base := testutil.NewBase(t)
-	base.Env = append(base.Env, "HOST_ENV=ENV-IN-HOST")
-
-	tID := testutil.Identifier(t)
-	file1, err := os.CreateTemp("", tID)
-	assert.NilError(base.T, err)
-	path1 := file1.Name()
-	defer file1.Close()
-	defer os.Remove(path1)
-	err = os.WriteFile(path1, []byte("# this is a comment line\nTESTKEY1=TESTVAL1"), 0666)
-	assert.NilError(base.T, err)
-
-	file2, err := os.CreateTemp("", tID)
-	assert.NilError(base.T, err)
-	path2 := file2.Name()
-	defer file2.Close()
-	defer os.Remove(path2)
-	err = os.WriteFile(path2, []byte("# this is a comment line\nTESTKEY2=TESTVAL2\nHOST_ENV"), 0666)
-	assert.NilError(base.T, err)
-
-	base.Cmd("run", "--rm", "--env-file", path1, "--env-file", path2, testutil.CommonImage, "sh", "-c", "echo -n $TESTKEY1").AssertOutExactly("TESTVAL1")
-	base.Cmd("run", "--rm", "--env-file", path1, "--env-file", path2, testutil.CommonImage, "sh", "-c", "echo -n $TESTKEY2").AssertOutExactly("TESTVAL2")
-	base.Cmd("run", "--rm", "--env-file", path1, "--env-file", path2, testutil.CommonImage, "sh", "-c", "echo -n $HOST_ENV").AssertOutExactly("ENV-IN-HOST")
+	testCase := nerdtest.Setup()
+
+	testCase.Env = map[string]string{
+		"HOST_ENV": "ENV-IN-HOST",
+	}
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		data.Temp().Save("# this is a comment line\nTESTKEY1=TESTVAL1", "env1-file")
+		data.Temp().Save("# this is a comment line\nTESTKEY2=TESTVAL2\nHOST_ENV", "env2-file")
+	}
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		return helpers.Command(
+			"run", "--rm",
+			"--env-file", data.Temp().Path("env1-file"),
+			"--env-file", data.Temp().Path("env2-file"),
+			testutil.CommonImage, "env")
+	}
+
+	testCase.Expected = test.Expects(expect.ExitCodeSuccess, nil, expect.All(
+		expect.Contains("TESTKEY1=TESTVAL1"),
+		expect.Contains("TESTKEY2=TESTVAL2"),
+		expect.Contains("HOST_ENV=ENV-IN-HOST"),
+	))
+
+	testCase.Run(t)
 }
 
 func TestRunEnv(t *testing.T) {
-	t.Parallel()
-	base := testutil.NewBase(t)
-	base.Env = append(base.Env, "CORGE=corge-value-in-host", "GARPLY=garply-value-in-host")
-	base.Cmd("run", "--rm",
-		"--env", "FOO=foo1,foo2",
-		"--env", "BAR=bar1 bar2",
-		"--env", "BAZ=",
-		"--env", "QUX", // not exported in OS
-		"--env", "QUUX=quux1",
-		"--env", "QUUX=quux2",
-		"--env", "CORGE", // OS exported
-		"--env", "GRAULT=grault_key=grault_value", // value contains `=` char
-		"--env", "GARPLY=", // OS exported
-		"--env", "WALDO=", // not exported in OS
-
-		testutil.CommonImage, "env").AssertOutWithFunc(func(stdout string) error {
-		if !strings.Contains(stdout, "\nFOO=foo1,foo2\n") {
-			return errors.New("got bad FOO")
-		}
-		if !strings.Contains(stdout, "\nBAR=bar1 bar2\n") {
-			return errors.New("got bad BAR")
-		}
-		if !strings.Contains(stdout, "\nBAZ=\n") && runtime.GOOS != "windows" {
-			return errors.New("got bad BAZ")
-		}
-		if strings.Contains(stdout, "QUX") {
-			return errors.New("got bad QUX (should not be set)")
-		}
-		if !strings.Contains(stdout, "\nQUUX=quux2\n") {
-			return errors.New("got bad QUUX")
-		}
-		if !strings.Contains(stdout, "\nCORGE=corge-value-in-host\n") {
-			return errors.New("got bad CORGE")
-		}
-		if !strings.Contains(stdout, "\nGRAULT=grault_key=grault_value\n") {
-			return errors.New("got bad GRAULT")
-		}
-		if !strings.Contains(stdout, "\nGARPLY=\n") && runtime.GOOS != "windows" {
-			return errors.New("got bad GARPLY")
-		}
-		if !strings.Contains(stdout, "\nWALDO=\n") && runtime.GOOS != "windows" {
-			return errors.New("got bad WALDO")
-		}
+	testCase := nerdtest.Setup()
 
-		return nil
-	})
+	testCase.Env = map[string]string{
+		"CORGE":  "corge-value-in-host",
+		"GARPLY": "garply-value-in-host",
+	}
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		return helpers.Command("run", "--rm",
+			"--env", "FOO=foo1,foo2",
+			"--env", "BAR=bar1 bar2",
+			"--env", "BAZ=",
+			"--env", "QUX", // not exported in OS
+			"--env", "QUUX=quux1",
+			"--env", "QUUX=quux2",
+			"--env", "CORGE", // OS exported
+			"--env", "GRAULT=grault_key=grault_value", // value contains `=` char
+			"--env", "GARPLY=", // OS exported
+			"--env", "WALDO=", // not exported in OS
+			testutil.CommonImage, "env")
+	}
+
+	validate := []test.Comparator{
+		expect.Contains("\nFOO=foo1,foo2\n"),
+		expect.Contains("\nBAR=bar1 bar2\n"),
+		expect.DoesNotContain("QUX"),
+		expect.Contains("\nQUUX=quux2\n"),
+		expect.Contains("\nCORGE=corge-value-in-host\n"),
+		expect.Contains("\nGRAULT=grault_key=grault_value\n"),
+	}
+
+	if runtime.GOOS != "windows" {
+		validate = append(
+			validate,
+			expect.Contains("\nBAZ=\n"),
+			expect.Contains("\nGARPLY=\n"),
+			expect.Contains("\nWALDO=\n"),
+		)
+	}
+
+	testCase.Expected = test.Expects(expect.ExitCodeSuccess, nil, expect.All(validate...))
+
+	testCase.Run(t)
 }
-func TestRunHostnameEnv(t *testing.T) {
-	t.Parallel()
-	base := testutil.NewBase(t)
 
-	base.Cmd("run", "-i", "--rm", testutil.CommonImage).
-		CmdOption(testutil.WithStdin(strings.NewReader(`[[ "HOSTNAME=$(hostname)" == "$(env | grep HOSTNAME)" ]]`))).
-		AssertOK()
+func TestRunHostnameEnv(t *testing.T) {
+	testCase := nerdtest.Setup()
 
-	if runtime.GOOS == "windows" {
-		t.Skip("run --hostname not implemented on Windows yet")
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "default hostname",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				cmd := helpers.Command("run", "--rm", "--quiet", testutil.CommonImage)
+				// Note: on Windows, just straight passing the command will not work (some cmd escaping weirdness?)
+				cmd.Feed(strings.NewReader(`[[ "HOSTNAME=$(hostname)" == "$(env | grep HOSTNAME)" ]]`))
+				return cmd
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
+		},
+		{
+			Description: "with --hostname",
+			// Windows does not support --hostname
+			Require:  require.Not(require.Windows),
+			Command:  test.Command("run", "--rm", "--quiet", "--hostname", "foobar", testutil.CommonImage, "env"),
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("HOSTNAME=foobar")),
+		},
 	}
-	base.Cmd("run", "--rm", "--hostname", "foobar", testutil.CommonImage, "env").AssertOutContains("HOSTNAME=foobar")
+
+	testCase.Run(t)
 }
 
 func TestRunStdin(t *testing.T) {
-	t.Parallel()
-	base := testutil.NewBase(t)
+	testCase := nerdtest.Setup()
 
 	const testStr = "test-run-stdin"
-	opts := []func(*testutil.Cmd){
-		testutil.WithStdin(strings.NewReader(testStr)),
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		cmd := helpers.Command("run", "--rm", "-i", testutil.CommonImage, "cat")
+		cmd.Feed(strings.NewReader(testStr))
+		return cmd
 	}
-	base.Cmd("run", "--rm", "-i", testutil.CommonImage, "cat").CmdOption(opts...).AssertOutExactly(testStr)
+
+	testCase.Expected = test.Expects(expect.ExitCodeSuccess, nil, expect.Equals(testStr))
+
+	testCase.Run(t)
 }
 
 func TestRunWithJsonFileLogDriver(t *testing.T) {
@@ -493,7 +552,7 @@ COPY --from=builder /go/src/logger/logger /
 }
 
 // history: There was a bug that the --add-host items disappear when the another container created.
-// This case ensures that it's doesn't happen.
+// This test ensures that it doesn't happen.
 // (https://github.com/containerd/nerdctl/issues/2560)
 func TestRunAddHostRemainsWhenAnotherContainerCreated(t *testing.T) {
 	if runtime.GOOS == "windows" {
diff --git a/cmd/nerdctl/container/container_run_verify_linux_test.go b/cmd/nerdctl/container/container_run_verify_linux_test.go
index 7d12342cbb3..e5d56373089 100644
--- a/cmd/nerdctl/container/container_run_verify_linux_test.go
+++ b/cmd/nerdctl/container/container_run_verify_linux_test.go
@@ -20,38 +20,66 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/testregistry"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/registry"
 )
 
 func TestRunVerifyCosign(t *testing.T) {
-	testutil.RequireExecutable(t, "cosign")
-	testutil.DockerIncompatible(t)
-	testutil.RequiresBuild(t)
-	testutil.RegisterBuildCacheCleanup(t)
-	t.Parallel()
-
-	base := testutil.NewBase(t)
-	base.Env = append(base.Env, "COSIGN_PASSWORD=1")
-
-	keyPair := helpers.NewCosignKeyPair(t, "cosign-key-pair", "1")
-	reg := testregistry.NewWithNoAuth(base, 0, false)
-	t.Cleanup(func() {
-		keyPair.Cleanup()
-		reg.Cleanup(nil)
-	})
-
-	tID := testutil.Identifier(t)
-	testImageRef := fmt.Sprintf("127.0.0.1:%d/%s", reg.Port, tID)
 	dockerfile := fmt.Sprintf(`FROM %s
 CMD ["echo", "nerdctl-build-test-string"]
 	`, testutil.CommonImage)
 
-	buildCtx := helpers.CreateBuildContext(t, dockerfile)
+	testCase := nerdtest.Setup()
+
+	var reg *registry.Server
+
+	testCase.Require = require.All(
+		require.Binary("cosign"),
+		require.Not(nerdtest.Docker),
+		nerdtest.Build,
+		nerdtest.Registry,
+	)
+
+	testCase.Env["COSIGN_PASSWORD"] = "1"
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		data.Temp().Save(dockerfile, "Dockerfile")
+		pri, pub := nerdtest.GenerateCosignKeyPair(data, helpers, "1")
+		reg = nerdtest.RegistryWithNoAuth(data, helpers, 0, false)
+		reg.Setup(data, helpers)
+
+		testImageRef := fmt.Sprintf("127.0.0.1:%d/%s", reg.Port, data.Identifier("push-cosign-image"))
+		helpers.Ensure("build", "-t", testImageRef, data.Temp().Path())
+		helpers.Ensure("push", testImageRef, "--sign=cosign", "--cosign-key="+pri)
+
+		data.Labels().Set("public_key", pub)
+		data.Labels().Set("image_ref", testImageRef)
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		if reg != nil {
+			reg.Cleanup(data, helpers)
+		}
+	}
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		helpers.Fail(
+			"run", "--rm", "--verify=cosign",
+			"--cosign-key=dummy",
+			data.Labels().Get("image_ref"))
+
+		return helpers.Command(
+			"run", "--rm", "--verify=cosign",
+			"--cosign-key="+data.Labels().Get("public_key"),
+			data.Labels().Get("image_ref"))
+	}
+
+	testCase.Expected = test.Expects(expect.ExitCodeSuccess, nil, nil)
 
-	base.Cmd("build", "-t", testImageRef, buildCtx).AssertOK()
-	base.Cmd("push", testImageRef, "--sign=cosign", "--cosign-key="+keyPair.PrivateKey).AssertOK()
-	base.Cmd("run", "--rm", "--verify=cosign", "--cosign-key="+keyPair.PublicKey, testImageRef).AssertOK()
-	base.Cmd("run", "--rm", "--verify=cosign", "--cosign-key=dummy", testImageRef).AssertFail()
+	testCase.Run(t)
 }
diff --git a/cmd/nerdctl/helpers/testing_linux.go b/cmd/nerdctl/helpers/testing_linux.go
index dd5901177de..bf63686f0c8 100644
--- a/cmd/nerdctl/helpers/testing_linux.go
+++ b/cmd/nerdctl/helpers/testing_linux.go
@@ -19,7 +19,6 @@ package helpers
 import (
 	"fmt"
 	"io"
-	"net"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -33,64 +32,6 @@ import (
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nettestutil"
 )
 
-func FindIPv6(output string) net.IP {
-	var ipv6 string
-	lines := strings.Split(output, "\n")
-	for _, line := range lines {
-		if strings.Contains(line, "inet6") {
-			fields := strings.Fields(line)
-			if len(fields) > 1 {
-				ipv6 = strings.Split(fields[1], "/")[0]
-				break
-			}
-		}
-	}
-	return net.ParseIP(ipv6)
-}
-
-type JweKeyPair struct {
-	Prv     string
-	Pub     string
-	Cleanup func()
-}
-
-func NewJWEKeyPair(t testing.TB) *JweKeyPair {
-	testutil.RequireExecutable(t, "openssl")
-	td, err := os.MkdirTemp(t.TempDir(), "jwe-key-pair")
-	assert.NilError(t, err)
-	prv := filepath.Join(td, "mykey.pem")
-	pub := filepath.Join(td, "mypubkey.pem")
-	cmds := [][]string{
-		// Exec openssl commands to ensure that nerdctl is compatible with the output of openssl commands.
-		// Do NOT refactor this function to use "crypto/rsa" stdlib.
-		{"openssl", "genrsa", "-out", prv},
-		{"openssl", "rsa", "-in", prv, "-pubout", "-out", pub},
-	}
-	for _, f := range cmds {
-		cmd := exec.Command(f[0], f[1:]...)
-		if out, err := cmd.CombinedOutput(); err != nil {
-			t.Fatalf("failed to run %v: %v (%q)", cmd.Args, err, string(out))
-		}
-	}
-	return &JweKeyPair{
-		Prv: prv,
-		Pub: pub,
-		Cleanup: func() {
-			_ = os.RemoveAll(td)
-		},
-	}
-}
-
-func RequiresSoci(base *testutil.Base) {
-	info := base.Info()
-	for _, p := range info.Plugins.Storage {
-		if p == "soci" {
-			return
-		}
-	}
-	base.T.Skip("test requires soci")
-}
-
 type CosignKeyPair struct {
 	PublicKey  string
 	PrivateKey string
diff --git a/cmd/nerdctl/image/image_encrypt_linux_test.go b/cmd/nerdctl/image/image_encrypt_linux_test.go
index f8d34dc03cb..40cb742a10c 100644
--- a/cmd/nerdctl/image/image_encrypt_linux_test.go
+++ b/cmd/nerdctl/image/image_encrypt_linux_test.go
@@ -26,7 +26,6 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
-	testhelpers "github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/testregistry"
@@ -36,7 +35,6 @@ func TestImageEncryptJWE(t *testing.T) {
 	nerdtest.Setup()
 
 	var registry *testregistry.RegistryServer
-	var keyPair *testhelpers.JweKeyPair
 
 	const remoteImageKey = "remoteImageKey"
 
@@ -50,18 +48,20 @@ func TestImageEncryptJWE(t *testing.T) {
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			if registry != nil {
 				registry.Cleanup(nil)
-				keyPair.Cleanup()
 				helpers.Anyhow("rmi", "-f", data.Labels().Get(remoteImageKey))
 			}
 			helpers.Anyhow("rmi", "-f", data.Identifier("decrypted"))
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
+			pri, pub := nerdtest.GenerateJWEKeyPair(data, helpers)
+			data.Labels().Set("private", pri)
+			data.Labels().Set("public", pub)
+
 			base := testutil.NewBase(t)
 			registry = testregistry.NewWithNoAuth(base, 0, false)
-			keyPair = testhelpers.NewJWEKeyPair(t)
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 			encryptImageRef := fmt.Sprintf("127.0.0.1:%d/%s:encrypted", registry.Port, data.Identifier())
-			helpers.Ensure("image", "encrypt", "--recipient=jwe:"+keyPair.Pub, testutil.CommonImage, encryptImageRef)
+			helpers.Ensure("image", "encrypt", "--recipient=jwe:"+pub, testutil.CommonImage, encryptImageRef)
 			inspector := helpers.Capture("image", "inspect", "--mode=native", "--format={{len .Index.Manifests}}", encryptImageRef)
 			assert.Equal(t, inspector, "1\n")
 			inspector = helpers.Capture("image", "inspect", "--mode=native", "--format={{json .Manifest.Layers}}", encryptImageRef)
@@ -74,8 +74,8 @@ func TestImageEncryptJWE(t *testing.T) {
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			helpers.Fail("pull", data.Labels().Get(remoteImageKey))
 			helpers.Ensure("pull", "--quiet", "--unpack=false", data.Labels().Get(remoteImageKey))
-			helpers.Fail("image", "decrypt", "--key="+keyPair.Pub, data.Labels().Get(remoteImageKey), data.Identifier("decrypted")) // decryption needs prv key, not pub key
-			return helpers.Command("image", "decrypt", "--key="+keyPair.Prv, data.Labels().Get(remoteImageKey), data.Identifier("decrypted"))
+			helpers.Fail("image", "decrypt", "--key="+data.Labels().Get("public"), data.Labels().Get(remoteImageKey), data.Identifier("decrypted")) // decryption needs prv key, not pub key
+			return helpers.Command("image", "decrypt", "--key="+data.Labels().Get("private"), data.Labels().Get(remoteImageKey), data.Identifier("decrypted"))
 		},
 		Expected: test.Expects(0, nil, nil),
 	}
diff --git a/cmd/nerdctl/image/image_pull_linux_test.go b/cmd/nerdctl/image/image_pull_linux_test.go
index 6156b82a3e2..6dd12b34aba 100644
--- a/cmd/nerdctl/image/image_pull_linux_test.go
+++ b/cmd/nerdctl/image/image_pull_linux_test.go
@@ -18,8 +18,6 @@ package image
 
 import (
 	"fmt"
-	"os"
-	"path/filepath"
 	"strconv"
 	"strings"
 	"testing"
@@ -30,17 +28,19 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
-	testhelpers "github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/testregistry"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/registry"
 )
 
 func TestImagePullWithCosign(t *testing.T) {
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-string"]
+	`, testutil.CommonImage)
+
 	nerdtest.Setup()
 
-	var registry *testregistry.RegistryServer
-	var keyPair *testhelpers.CosignKeyPair
+	var reg *registry.Server
 
 	testCase := &test.Case{
 		Require: require.All(
@@ -48,45 +48,47 @@ func TestImagePullWithCosign(t *testing.T) {
 			nerdtest.Build,
 			require.Binary("cosign"),
 			require.Not(nerdtest.Docker),
+			nerdtest.Registry,
 		),
+
 		Env: map[string]string{
 			"COSIGN_PASSWORD": "1",
 		},
-		Setup: func(data test.Data, helpers test.Helpers) {
-			keyPair = testhelpers.NewCosignKeyPair(t, "cosign-key-pair", "1")
-			base := testutil.NewBase(t)
-			registry = testregistry.NewWithNoAuth(base, 0, false)
-			testImageRef := fmt.Sprintf("%s:%d/%s", "127.0.0.1", registry.Port, data.Identifier())
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-string"]
-	`, testutil.CommonImage)
 
+		Setup: func(data test.Data, helpers test.Helpers) {
+			data.Temp().Save(dockerfile, "Dockerfile")
+			pri, pub := nerdtest.GenerateCosignKeyPair(data, helpers, "1")
+			reg = nerdtest.RegistryWithNoAuth(data, helpers, 0, false)
+			reg.Setup(data, helpers)
+			testImageRef := fmt.Sprintf("%s:%d/%s", "127.0.0.1", reg.Port, data.Identifier())
 			buildCtx := data.Temp().Path()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
+
 			helpers.Ensure("build", "-t", testImageRef+":one", buildCtx)
 			helpers.Ensure("build", "-t", testImageRef+":two", buildCtx)
-			helpers.Ensure("push", "--sign=cosign", "--cosign-key="+keyPair.PrivateKey, testImageRef+":one")
-			helpers.Ensure("push", "--sign=cosign", "--cosign-key="+keyPair.PrivateKey, testImageRef+":two")
-			helpers.Ensure("rmi", "-f", testImageRef)
-			data.Labels().Set("imageref", testImageRef)
+			helpers.Ensure("push", "--sign=cosign", "--cosign-key="+pri, testImageRef+":one")
+			helpers.Ensure("push", "--sign=cosign", "--cosign-key="+pri, testImageRef+":two")
+
+			data.Labels().Set("public_key", pub)
+			data.Labels().Set("image_ref", testImageRef)
 		},
+
 		Cleanup: func(data test.Data, helpers test.Helpers) {
-			if keyPair != nil {
-				keyPair.Cleanup()
-			}
-			if registry != nil {
-				registry.Cleanup(nil)
-				testImageRef := fmt.Sprintf("%s:%d/%s", "127.0.0.1", registry.Port, data.Identifier())
+			if reg != nil {
+				reg.Cleanup(data, helpers)
+				testImageRef := data.Labels().Get("image_ref")
 				helpers.Anyhow("rmi", "-f", testImageRef+":one")
 				helpers.Anyhow("rmi", "-f", testImageRef+":two")
 			}
 		},
+
 		SubTests: []*test.Case{
 			{
 				Description: "Pull with the correct key",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("pull", "--quiet", "--verify=cosign", "--cosign-key="+keyPair.PublicKey, data.Labels().Get("imageref")+":one")
+					return helpers.Command(
+						"pull", "--quiet", "--verify=cosign",
+						"--cosign-key="+data.Labels().Get("public_key"),
+						data.Labels().Get("image_ref")+":one")
 				},
 				Expected: test.Expects(0, nil, nil),
 			},
@@ -96,8 +98,8 @@ CMD ["echo", "nerdctl-build-test-string"]
 					"COSIGN_PASSWORD": "2",
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					newKeyPair := testhelpers.NewCosignKeyPair(t, "cosign-key-pair-test", "2")
-					return helpers.Command("pull", "--quiet", "--verify=cosign", "--cosign-key="+newKeyPair.PublicKey, data.Labels().Get("imageref")+":two")
+					_, pub := nerdtest.GenerateCosignKeyPair(data, helpers, "2")
+					return helpers.Command("pull", "--quiet", "--verify=cosign", "--cosign-key="+pub, data.Labels().Get("image_ref")+":two")
 				},
 				Expected: test.Expects(12, nil, nil),
 			},
@@ -110,42 +112,44 @@ CMD ["echo", "nerdctl-build-test-string"]
 func TestImagePullPlainHttpWithDefaultPort(t *testing.T) {
 	nerdtest.Setup()
 
-	var registry *testregistry.RegistryServer
+	var reg *registry.Server
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-string"]
+	`, testutil.CommonImage)
 
 	testCase := &test.Case{
 		Require: require.All(
 			require.Linux,
 			require.Not(nerdtest.Docker),
 			nerdtest.Build,
+			nerdtest.Registry,
 		),
+
 		Setup: func(data test.Data, helpers test.Helpers) {
-			base := testutil.NewBase(t)
-			registry = testregistry.NewWithNoAuth(base, 80, false)
+			data.Temp().Save(dockerfile, "Dockerfile")
+			reg = nerdtest.RegistryWithNoAuth(data, helpers, 80, false)
+			reg.Setup(data, helpers)
 			testImageRef := fmt.Sprintf("%s/%s:%s",
-				registry.IP.String(), data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-string"]
-	`, testutil.CommonImage)
-
+				reg.IP.String(), data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
 			buildCtx := data.Temp().Path()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
+
 			helpers.Ensure("build", "-t", testImageRef, buildCtx)
 			helpers.Ensure("--insecure-registry", "push", testImageRef)
 			helpers.Ensure("rmi", "-f", testImageRef)
+
+			data.Labels().Set("image_ref", testImageRef)
 		},
+
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			testImageRef := fmt.Sprintf("%s/%s:%s",
-				registry.IP.String(), data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
-			return helpers.Command("--insecure-registry", "pull", testImageRef)
+			return helpers.Command("--insecure-registry", "pull", data.Labels().Get("image_ref"))
 		},
+
 		Expected: test.Expects(0, nil, nil),
+
 		Cleanup: func(data test.Data, helpers test.Helpers) {
-			if registry != nil {
-				registry.Cleanup(nil)
-				testImageRef := fmt.Sprintf("%s/%s:%s",
-					registry.IP.String(), data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
-				helpers.Anyhow("rmi", "-f", testImageRef)
+			if reg != nil {
+				reg.Cleanup(data, helpers)
+				helpers.Anyhow("rmi", "-f", data.Labels().Get("image_ref"))
 			}
 		},
 	}
@@ -165,6 +169,8 @@ func TestImagePullSoci(t *testing.T) {
 
 		// NOTE: these tests cannot be run in parallel, as they depend on the output of host `mount`
 		// They also feel prone to raciness...
+		NoParallel: true,
+
 		SubTests: []*test.Case{
 			{
 				Description: "Run without specifying SOCI index",
@@ -190,13 +196,14 @@ func TestImagePullSoci(t *testing.T) {
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: func(stdout string, info string, t *testing.T) {
+						Output: func(stdout string, _ string, t *testing.T) {
 							remoteSnapshotsInitialCount, _ := strconv.Atoi(data.Labels().Get("remoteSnapshotsInitialCount"))
 							remoteSnapshotsActualCount := strings.Count(stdout, "fuse.rawBridge")
 							assert.Equal(t,
 								data.Labels().Get("remoteSnapshotsExpectedCount"),
 								strconv.Itoa(remoteSnapshotsActualCount-remoteSnapshotsInitialCount),
-								info)
+								"expected remote snapshot count to match",
+							)
 						},
 					}
 				},
@@ -231,7 +238,7 @@ func TestImagePullSoci(t *testing.T) {
 							assert.Equal(t,
 								data.Labels().Get("remoteSnapshotsExpectedCount"),
 								strconv.Itoa(remoteSnapshotsActualCount-remoteSnapshotsInitialCount),
-								info)
+								"expected remote snapshot count to match")
 						},
 					}
 				},
diff --git a/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go b/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go
index eb1262cc696..9edd24f5af1 100644
--- a/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go
+++ b/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go
@@ -24,7 +24,6 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
-	testhelpers "github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
@@ -168,14 +167,12 @@ func TestIPFSSimple(t *testing.T) {
 				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Labels().Get(mainImageCIDKey))
 
 				// Prep a key pair
-				keyPair := testhelpers.NewJWEKeyPair(t)
-				// FIXME: this will only cleanup when the group is done, not right, but it works
-				t.Cleanup(keyPair.Cleanup)
-				data.Labels().Set("pub", keyPair.Pub)
-				data.Labels().Set("prv", keyPair.Prv)
+				pri, pub := nerdtest.GenerateJWEKeyPair(data, helpers)
+				data.Labels().Set("prv", pri)
+				data.Labels().Set("pub", pub)
 
 				// Encrypt the image, and verify it is encrypted
-				helpers.Ensure("image", "encrypt", "--recipient=jwe:"+keyPair.Pub, data.Labels().Get(mainImageCIDKey), data.Identifier("encrypted"))
+				helpers.Ensure("image", "encrypt", "--recipient=jwe:"+pub, data.Labels().Get(mainImageCIDKey), data.Identifier("encrypted"))
 				cmd := helpers.Command("image", "inspect", "--mode=native", "--format={{len .Index.Manifests}}", data.Identifier("encrypted"))
 				cmd.Run(&test.Expected{
 					Output: expect.Equals("1\n"),
diff --git a/cmd/nerdctl/network/network_create_linux_test.go b/cmd/nerdctl/network/network_create_linux_test.go
index 5dd82655390..01ed943467f 100644
--- a/cmd/nerdctl/network/network_create_linux_test.go
+++ b/cmd/nerdctl/network/network_create_linux_test.go
@@ -17,6 +17,7 @@
 package network
 
 import (
+	"fmt"
 	"net"
 	"strings"
 	"testing"
@@ -26,7 +27,6 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/expect"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
-	ipv6helper "github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
@@ -100,8 +100,8 @@ func TestNetworkCreate(t *testing.T) {
 					ExitCode: 0,
 					Output: func(stdout string, info string, t *testing.T) {
 						_, subnet, _ := net.ParseCIDR(data.Labels().Get("subnetStr"))
-						ip := ipv6helper.FindIPv6(stdout)
-						assert.Assert(t, subnet.Contains(ip), info)
+						ip := nerdtest.FindIPv6(stdout)
+						assert.Assert(t, subnet.Contains(ip), fmt.Sprintf("subnet %s contains ip %s", subnet, ip))
 					},
 				}
 			},
diff --git a/pkg/testutil/nerdtest/utilities.go b/pkg/testutil/nerdtest/utilities.go
index 71b2d662f5c..a5c15eede0c 100644
--- a/pkg/testutil/nerdtest/utilities.go
+++ b/pkg/testutil/nerdtest/utilities.go
@@ -18,12 +18,15 @@ package nerdtest
 
 import (
 	"encoding/json"
+	"net"
+	"strings"
 	"testing"
 	"time"
 
 	"gotest.tools/v3/assert"
 
 	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 	"github.com/containerd/nerdctl/mod/tigron/tig"
 
@@ -132,3 +135,59 @@ func EnsureContainerStarted(helpers test.Helpers, con string) {
 		helpers.T().Fatalf("container %s still not running after %d retries", con, maxRetry)
 	}
 }
+
+func GenerateJWEKeyPair(data test.Data, helpers test.Helpers) (string, string) {
+	helpers.T().Helper()
+
+	path := "jwe-key-pair"
+	data.Temp().Dir(path)
+
+	pass, message := require.Binary("openssl").Check(data, helpers)
+	if !pass {
+		helpers.T().Skip(message)
+	}
+
+	pri := data.Temp().Path(path, "mykey.pem")
+	pub := data.Temp().Path(path, "mypubkey.pem")
+
+	// Exec openssl commands to ensure that nerdctl is compatible with the output of openssl commands.
+	// Do NOT refactor this function to use "crypto/rsa" stdlib.
+	helpers.Custom("openssl", "genrsa", "-out", pri).Run(&test.Expected{})
+	helpers.Custom("openssl", "rsa", "-in", pri, "-pubout", "-out", pub).Run(&test.Expected{})
+
+	return pri, pub
+}
+
+func GenerateCosignKeyPair(data test.Data, helpers test.Helpers, password string) (pri string, pub string) {
+	helpers.T().Helper()
+
+	path := "cosign-key-pair"
+	data.Temp().Dir(path)
+
+	pass, message := require.Binary("cosign").Check(data, helpers)
+	if !pass {
+		helpers.T().Skip(message)
+	}
+
+	cmd := helpers.Custom("cosign", "generate-key-pair")
+	cmd.WithCwd(data.Temp().Path(path))
+	cmd.Setenv("COSIGN_PASSWORD", password)
+	cmd.Run(&test.Expected{})
+
+	return data.Temp().Path(path, "cosign.key"), data.Temp().Path(path, "cosign.pub")
+}
+
+func FindIPv6(output string) net.IP {
+	var ipv6 string
+	lines := strings.Split(output, "\n")
+	for _, line := range lines {
+		if strings.Contains(line, "inet6") {
+			fields := strings.Fields(line)
+			if len(fields) > 1 {
+				ipv6 = strings.Split(fields[1], "/")[0]
+				break
+			}
+		}
+	}
+	return net.ParseIP(ipv6)
+}
diff --git a/pkg/testutil/testutil.go b/pkg/testutil/testutil.go
index 525225fb996..f12c704e8bb 100644
--- a/pkg/testutil/testutil.go
+++ b/pkg/testutil/testutil.go
@@ -413,14 +413,6 @@ func (c *Cmd) AssertOutContains(s string) {
 	c.Assert(expected)
 }
 
-func (c *Cmd) AssertErrContains(s string) {
-	c.Base.T.Helper()
-	expected := icmd.Expected{
-		Err: s,
-	}
-	c.Assert(expected)
-}
-
 func (c *Cmd) AssertCombinedOutContains(s string) {
 	c.Base.T.Helper()
 	res := c.runIfNecessary()
@@ -465,16 +457,6 @@ func (c *Cmd) AssertOutNotContains(s string) {
 	})
 }
 
-func (c *Cmd) AssertErrNotContains(s string) {
-	c.Base.T.Helper()
-	c.AssertOutWithFunc(func(stderr string) error {
-		if strings.Contains(stderr, s) {
-			return fmt.Errorf("expected stdout to not contain %q", s)
-		}
-		return nil
-	})
-}
-
 func (c *Cmd) AssertOutExactly(s string) {
 	c.Base.T.Helper()
 	fn := func(stdout string) error {
@@ -486,24 +468,6 @@ func (c *Cmd) AssertOutExactly(s string) {
 	c.AssertOutWithFunc(fn)
 }
 
-func (c *Cmd) AssertOutStreamsExactly(stdout, stderr string) {
-	c.Base.T.Helper()
-	fn := func(sout, serr string) error {
-		msg := ""
-		if sout != stdout {
-			msg += fmt.Sprintf("stdout mismatch, expected %q, got %q\n", stdout, sout)
-		}
-		if serr != stderr {
-			msg += fmt.Sprintf("stderr mismatch, expected %q, got %q\n", stderr, serr)
-		}
-		if msg != "" {
-			return errors.New(msg)
-		}
-		return nil
-	}
-	c.AssertOutStreamsWithFunc(fn)
-}
-
 func (c *Cmd) AssertOutWithFunc(fn func(stdout string) error) {
 	c.Base.T.Helper()
 	res := c.runIfNecessary()
@@ -511,13 +475,6 @@ func (c *Cmd) AssertOutWithFunc(fn func(stdout string) error) {
 	assert.NilError(c.Base.T, fn(res.Stdout()), res.Combined())
 }
 
-func (c *Cmd) AssertOutStreamsWithFunc(fn func(stdout, stderr string) error) {
-	c.Base.T.Helper()
-	res := c.runIfNecessary()
-	assert.Equal(c.Base.T, 0, res.ExitCode, res)
-	assert.NilError(c.Base.T, fn(res.Stdout(), res.Stderr()), res.Combined())
-}
-
 func (c *Cmd) Out() string {
 	c.Base.T.Helper()
 	res := c.runIfNecessary()
@@ -525,13 +482,6 @@ func (c *Cmd) Out() string {
 	return res.Stdout()
 }
 
-func (c *Cmd) OutLines() []string {
-	c.Base.T.Helper()
-	out := c.Out()
-	// FIXME: improve memory efficiency
-	return strings.Split(out, "\n")
-}
-
 type Target = string
 
 const (
@@ -544,7 +494,6 @@ var (
 	flagTestKillDaemon bool
 	flagTestIPv6       bool
 	flagTestKube       bool
-	flagVerbose        bool
 	flagTestFlaky      bool
 )
 
@@ -558,9 +507,6 @@ func M(m *testing.M) {
 	flag.BoolVar(&flagTestIPv6, "test.only-ipv6", false, "enable tests on IPv6")
 	flag.BoolVar(&flagTestKube, "test.only-kubernetes", false, "enable tests on Kubernetes")
 	flag.BoolVar(&flagTestFlaky, "test.only-flaky", false, "enable testing of flaky tests only (if false, flaky tests are ignored)")
-	if flag.Lookup("test.v") != nil {
-		flagVerbose = true
-	}
 	flag.Parse()
 
 	os.Exit(func() int {
@@ -638,8 +584,6 @@ func IsDocker() bool {
 	return GetTarget() == Docker
 }
 
-func GetVerbose() bool { return flagVerbose }
-
 func DockerIncompatible(t testing.TB) {
 	if IsDocker() {
 		t.Skip("test is incompatible with Docker")
@@ -667,22 +611,6 @@ func RequireExecPlatform(t testing.TB, ss ...string) {
 	}
 }
 
-func RequireDaemonVersion(b *Base, constraint string) {
-	b.T.Helper()
-	c, err := semver.NewConstraint(constraint)
-	if err != nil {
-		b.T.Fatal(err)
-	}
-	info := b.Info()
-	sv, err := semver.NewVersion(info.ServerVersion)
-	if err != nil {
-		b.T.Skip(err)
-	}
-	if !c.Check(sv) {
-		b.T.Skipf("version %v does not satisfy constraints %v", sv, c)
-	}
-}
-
 func RequireKernelVersion(t testing.TB, constraint string) {
 	t.Helper()
 	c, err := semver.NewConstraint(constraint)
@@ -839,3 +767,8 @@ func RegisterBuildCacheCleanup(t *testing.T) {
 		NewBase(t).Cmd("builder", "prune", "--all", "--force").Run()
 	})
 }
+
+func mirrorOf(s string) string {
+	// plain mirror, NOT stargz-converted images
+	return fmt.Sprintf("ghcr.io/stargz-containers/%s-org", s)
+}
diff --git a/pkg/testutil/testutil_freebsd.go b/pkg/testutil/testutil_freebsd.go
index 63a79f07a02..9761008585f 100644
--- a/pkg/testutil/testutil_freebsd.go
+++ b/pkg/testutil/testutil_freebsd.go
@@ -16,8 +16,6 @@
 
 package testutil
 
-import "fmt"
-
 const (
 	CommonImage = "docker.io/knast/freebsd:13-STABLE"
 
@@ -35,8 +33,3 @@ var (
 	NginxAlpineImage = mirrorOf("nginx:1.19-alpine")
 	GolangImage      = mirrorOf("golang:1.18")
 )
-
-func mirrorOf(s string) string {
-	// plain mirror, NOT stargz-converted images
-	return fmt.Sprintf("ghcr.io/stargz-containers/%s-org", s)
-}
diff --git a/pkg/testutil/testutil_linux.go b/pkg/testutil/testutil_linux.go
index 1224bf121ee..f7ab0688d42 100644
--- a/pkg/testutil/testutil_linux.go
+++ b/pkg/testutil/testutil_linux.go
@@ -16,15 +16,6 @@
 
 package testutil
 
-import (
-	"fmt"
-)
-
-func mirrorOf(s string) string {
-	// plain mirror, NOT stargz-converted images
-	return fmt.Sprintf("ghcr.io/stargz-containers/%s-org", s)
-}
-
 var (
 	BusyboxImage                = "ghcr.io/containerd/busybox:1.36"
 	AlpineImage                 = mirrorOf("alpine:3.13")
diff --git a/pkg/testutil/testutil_windows.go b/pkg/testutil/testutil_windows.go
index 868e5df1cd8..d1b830da6bf 100644
--- a/pkg/testutil/testutil_windows.go
+++ b/pkg/testutil/testutil_windows.go
@@ -43,9 +43,6 @@ const (
 	NginxAlpineImage            = "registry.k8s.io/e2e-test-images/nginx:1.14-2"
 	NginxAlpineIndexHTMLSnippet = "<title>Welcome to nginx!</title>"
 
-	GolangImage = "fixme-test-using-this-image-is-disabled-on-windows"
-	AlpineImage = "fixme-test-using-this-image-is-disabled-on-windows"
-
 	// This error string is expected when attempting to connect to a TCP socket
 	// for a service which actively refuses the connection.
 	// (e.g. attempting to connect using http to an https endpoint).
@@ -56,6 +53,9 @@ const (
 )
 
 var (
+	GolangImage = mirrorOf("fixme-test-using-this-image-is-disabled-on-windows")
+	AlpineImage = mirrorOf("fixme-test-using-this-image-is-disabled-on-windows")
+
 	hypervContainer     bool
 	hypervSupported     bool
 	hypervSupportedOnce sync.Once

From 5cf3f804215fdde52e1c477e5007420d645f2503 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 18 Apr 2025 15:04:34 -0700
Subject: [PATCH 101/225] Increase test timeout for EL8

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 pkg/testutil/nerdtest/utilities_linux.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkg/testutil/nerdtest/utilities_linux.go b/pkg/testutil/nerdtest/utilities_linux.go
index 75c199acd25..bc652564f83 100644
--- a/pkg/testutil/nerdtest/utilities_linux.go
+++ b/pkg/testutil/nerdtest/utilities_linux.go
@@ -57,7 +57,9 @@ func RunSigProxyContainer(signal os.Signal, exitOnSignal bool, args []string, da
 
 	cmd := helpers.Command(args...)
 	// NOTE: because of a test like TestStopWithStopSignal, we need to wait enough for nerdctl to terminate the container
-	cmd.WithTimeout(20 * time.Second)
+	// It looks like EL8 could be particularly slow (https://github.com/containerd/nerdctl/issues/4068)
+	// Note that in normal circumstances, 10 seconds is plenty enough.
+	cmd.WithTimeout(40 * time.Second)
 	cmd.Background()
 	EnsureContainerStarted(helpers, data.Identifier())
 

From 4a55331e121b5776dbe7fc36331ce8aad33b63d1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 18 Apr 2025 22:53:13 +0000
Subject: [PATCH 102/225] build(deps): bump the docker group with 2 updates

Bumps the docker group with 2 updates: [github.com/docker/cli](https://github.com/docker/cli) and [github.com/docker/docker](https://github.com/docker/docker).


Updates `github.com/docker/cli` from 28.1.0+incompatible to 28.1.1+incompatible
- [Commits](https://github.com/docker/cli/compare/v28.1.0...v28.1.1)

Updates `github.com/docker/docker` from 28.1.0+incompatible to 28.1.1+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/compare/v28.1.0...v28.1.1)

---
updated-dependencies:
- dependency-name: github.com/docker/cli
  dependency-version: 28.1.1+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker
- dependency-name: github.com/docker/docker
  dependency-version: 28.1.1+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 4 ++--
 go.sum | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/go.mod b/go.mod
index b8e3d32df45..16ddec105f8 100644
--- a/go.mod
+++ b/go.mod
@@ -31,8 +31,8 @@ require (
 	github.com/coreos/go-systemd/v22 v22.5.0
 	github.com/cyphar/filepath-securejoin v0.4.1
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v28.1.0+incompatible
-	github.com/docker/docker v28.1.0+incompatible
+	github.com/docker/cli v28.1.1+incompatible
+	github.com/docker/docker v28.1.1+incompatible
 	github.com/docker/go-connections v0.5.0
 	github.com/docker/go-units v0.5.0
 	github.com/fahedouch/go-logrotate v0.3.0
diff --git a/go.sum b/go.sum
index 633a8b3ec0c..c8f40b1208a 100644
--- a/go.sum
+++ b/go.sum
@@ -88,10 +88,10 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/docker/cli v28.1.0+incompatible h1:WiJhUBbuIH/BsJtth+C1hPwra4P0nsKJiWy9ie5My5s=
-github.com/docker/cli v28.1.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/docker v28.1.0+incompatible h1:4iqpcWQCt3Txcz7iWIb1U3SZ/n9ffo4U+ryY5/3eOp0=
-github.com/docker/docker v28.1.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/cli v28.1.1+incompatible h1:eyUemzeI45DY7eDPuwUcmDyDj1pM98oD5MdSpiItp8k=
+github.com/docker/cli v28.1.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/docker v28.1.1+incompatible h1:49M11BFLsVO1gxY9UX9p/zwkE/rswggs8AdFmXQw51I=
+github.com/docker/docker v28.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=

From b2855f7b950a25795ba2e22b9b0ab2c7ffb5364c Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 18 Apr 2025 22:23:18 -0700
Subject: [PATCH 103/225] Mark kube target as flaky

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/test-kube.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-kube.yml b/.github/workflows/test-kube.yml
index 580a9a2181a..57871c3abee 100644
--- a/.github/workflows/test-kube.yml
+++ b/.github/workflows/test-kube.yml
@@ -1,5 +1,5 @@
 # This pipeline purpose is solely meant to run a subset of our test suites against a kubernetes cluster
-name: kubernetes
+name: "[flaky, see #3988] kubernetes"
 
 on:
   push:

From 7bf2f0149534f41adb2f9ef7355c40874c736133 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 19 Apr 2025 09:59:31 -0700
Subject: [PATCH 104/225] Bump kind version 0.27

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 hack/build-integration-kubernetes.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hack/build-integration-kubernetes.sh b/hack/build-integration-kubernetes.sh
index be7f7344f00..d2aa564a551 100755
--- a/hack/build-integration-kubernetes.sh
+++ b/hack/build-integration-kubernetes.sh
@@ -22,8 +22,8 @@ readonly root
 . "$root/scripts/lib.sh"
 
 GO_VERSION=1.24
-KIND_VERSION=v0.24.0
-CNI_PLUGINS_VERSION=v1.5.1
+KIND_VERSION=v0.27.0
+CNI_PLUGINS_VERSION=v1.6.2
 
 [ "$(uname -m)" == "aarch64" ] && GOARCH=arm64 || GOARCH=amd64
 

From cda31f15e6b3d597aad55f08817012c0fd83d568 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 19 Apr 2025 12:53:50 -0700
Subject: [PATCH 105/225] Extend CI timeout as windows fail

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/tigron.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/tigron.yml b/.github/workflows/tigron.yml
index e238c659fe9..dd0cc615167 100644
--- a/.github/workflows/tigron.yml
+++ b/.github/workflows/tigron.yml
@@ -14,7 +14,7 @@ env:
 
 jobs:
   lint:
-    timeout-minutes: 10
+    timeout-minutes: 15
     name: "${{ matrix.goos }} ${{ matrix.os }} | go ${{ matrix.canary }}"
     runs-on: ${{ matrix.os }}
     defaults:

From 594342ae6c1435af6476b1452c3d0392b4a3d115 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sun, 20 Apr 2025 13:22:04 -0700
Subject: [PATCH 106/225] Rewrite TestRunBindMountBind

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .../container_run_mount_linux_test.go         | 145 +++++++++++-------
 1 file changed, 91 insertions(+), 54 deletions(-)

diff --git a/cmd/nerdctl/container/container_run_mount_linux_test.go b/cmd/nerdctl/container/container_run_mount_linux_test.go
index f02d47d5198..c941d8d39fb 100644
--- a/cmd/nerdctl/container/container_run_mount_linux_test.go
+++ b/cmd/nerdctl/container/container_run_mount_linux_test.go
@@ -27,6 +27,8 @@ import (
 	"gotest.tools/v3/assert"
 
 	"github.com/containerd/containerd/v2/core/mount"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
@@ -304,68 +306,103 @@ func TestRunBindMountTmpfs(t *testing.T) {
 	base.Cmd("run", "--rm", "--mount", "type=tmpfs,target=/tmp,tmpfs-size=64m", testutil.AlpineImage, "grep", "/tmp", "/proc/mounts").AssertOutWithFunc(f([]string{"rw", "nosuid", "nodev", "size=65536k"}))
 }
 
-func TestRunBindMountBind(t *testing.T) {
-	t.Parallel()
-	base := testutil.NewBase(t)
-	tID := testutil.Identifier(t)
-	rwDir, err := os.MkdirTemp(t.TempDir(), "rw")
-	if err != nil {
-		t.Fatal(err)
-	}
-	roDir, err := os.MkdirTemp(t.TempDir(), "ro")
-	if err != nil {
-		t.Fatal(err)
-	}
+func mountExistsWithOpt(mountPoint, mountOpt string) test.Comparator {
+	return func(stdout, info string, t *testing.T) {
+		lines := strings.Split(strings.TrimSpace(stdout), "\n")
+		mountOutput := []string{}
+		for _, line := range lines {
+			if strings.Contains(line, mountPoint) {
+				mountOutput = strings.Split(line, " ")
+				break
+			}
+		}
 
-	containerName := tID
-	defer base.Cmd("rm", "-f", containerName).AssertOK()
-	base.Cmd("run",
-		"-d",
-		"--name", containerName,
-		"--mount", fmt.Sprintf("type=bind,src=%s,target=/mnt1", rwDir),
-		"--mount", fmt.Sprintf("type=bind,src=%s,target=/mnt2,ro", roDir),
-		testutil.AlpineImage,
-		"top",
-	).AssertOK()
-	base.Cmd("exec", containerName, "sh", "-exc", "echo -n str1 > /mnt1/file1").AssertOK()
-	base.Cmd("exec", containerName, "sh", "-exc", "echo -n str2 > /mnt2/file2").AssertFail()
+		assert.Assert(t, len(mountOutput) > 0, "we should have found the mount point in /proc/mounts")
+		assert.Assert(t, len(mountOutput) >= 4, "invalid format for mount line")
 
-	base.Cmd("run",
-		"--rm",
-		"--mount", fmt.Sprintf("type=bind,src=%s,target=/mnt1", rwDir),
-		testutil.AlpineImage,
-		"cat", "/mnt1/file1",
-	).AssertOutExactly("str1")
+		options := strings.Split(mountOutput[3], ",")
 
-	// check `bind-propagation`
-	f := func(allow string) func(stdout string) error {
-		return func(stdout string) error {
-			lines := strings.Split(strings.TrimSpace(stdout), "\n")
-			if len(lines) != 1 {
-				return fmt.Errorf("expected 1 lines, got %q", stdout)
-			}
-			fields := strings.Split(lines[0], " ")
-			if len(fields) < 4 {
-				return fmt.Errorf("invalid /proc/mounts format %q", stdout)
+		found := false
+		for _, opt := range options {
+			if mountOpt == opt {
+				found = true
+				break
 			}
+		}
+
+		assert.Assert(t, found, "mount option %s not found", mountOpt)
+	}
+}
 
-			options := strings.Split(fields[3], ",")
+func TestRunBindMountBind(t *testing.T) {
+	testCase := nerdtest.Setup()
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		// Run a container with bind mount directories, one rw, the other ro
+		rwDir := data.Temp().Dir("rw")
+		roDir := data.Temp().Dir("ro")
+
+		helpers.Ensure(
+			"run",
+			"-d",
+			"--name", data.Identifier("container"),
+			"--mount", fmt.Sprintf("type=bind,src=%s,target=/mntrw", rwDir),
+			"--mount", fmt.Sprintf("type=bind,src=%s,target=/mntro,ro", roDir),
+			testutil.AlpineImage,
+			"top",
+		)
+
+		// Save host rwDir location and container id for subtests
+		data.Labels().Set("container", data.Identifier("container"))
+		data.Labels().Set("rwDir", rwDir)
+	}
 
-			found := false
-			for _, s := range options {
-				if allow == s {
-					found = true
-					break
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "ensure we cannot write to ro mount",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("exec", data.Labels().Get("container"), "sh", "-exc", "echo -n failure > /mntro/file")
+			},
+			Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
+		},
+		{
+			Description: "ensure we can write to rw, and read it back from another container mounting the same target",
+			Setup: func(data test.Data, helpers test.Helpers) {
+				helpers.Ensure("exec", data.Labels().Get("container"), "sh", "-exc", "echo -n success > /mntrw/file")
+			},
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command(
+					"run",
+					"--rm",
+					"--mount", fmt.Sprintf("type=bind,src=%s,target=/mntrw", data.Labels().Get("rwDir")),
+					testutil.AlpineImage,
+					"cat", "/mntrw/file",
+				)
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("success")),
+		},
+		{
+			Description: "Check that mntrw is seen in /proc/mounts",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("exec", data.Labels().Get("container"), "cat", "/proc/mounts")
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					Output: expect.All(
+						// Ensure we have mntrw in the mount list
+						mountExistsWithOpt("/mntrw", "rw"),
+						mountExistsWithOpt("/mntro", "ro"),
+					),
 				}
-			}
-			if !found {
-				return fmt.Errorf("expected stdout to contain %q, got %+v", allow, options)
-			}
-			return nil
-		}
+			},
+		},
 	}
-	base.Cmd("exec", containerName, "grep", "/mnt1", "/proc/mounts").AssertOutWithFunc(f("rw"))
-	base.Cmd("exec", containerName, "grep", "/mnt2", "/proc/mounts").AssertOutWithFunc(f("ro"))
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rm", "-f", data.Identifier("container"))
+	}
+
+	testCase.Run(t)
 }
 
 func TestRunMountBindMode(t *testing.T) {

From 3878b011a731b9e0292c64cd7b14f438d9993ac6 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 18 Apr 2025 11:31:22 -0700
Subject: [PATCH 107/225] Allow multiple needles in Contains and DoesNotContain

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/expect/comparators.go      | 14 ++++++++++++--
 mod/tigron/expect/comparators_test.go |  3 +++
 mod/tigron/expect/doc.md              |  4 ++--
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/mod/tigron/expect/comparators.go b/mod/tigron/expect/comparators.go
index 7bf87803f41..84f5fe13bd2 100644
--- a/mod/tigron/expect/comparators.go
+++ b/mod/tigron/expect/comparators.go
@@ -41,18 +41,28 @@ func All(comparators ...test.Comparator) test.Comparator {
 
 // Contains can be used as a parameter for expected.Output and ensures a comparison string is found contained in the
 // output.
-func Contains(compare string) test.Comparator {
+func Contains(compare string, more ...string) test.Comparator {
 	return func(stdout, _ string, t *testing.T) {
 		t.Helper()
+
 		assertive.Contains(assertive.WithFailLater(t), stdout, compare, "Inspecting output (contains)")
+
+		for _, m := range more {
+			assertive.Contains(assertive.WithFailLater(t), stdout, m, "Inspecting output (contains)")
+		}
 	}
 }
 
 // DoesNotContain is to be used for expected.Output to ensure a comparison string is NOT found in the output.
-func DoesNotContain(compare string) test.Comparator {
+func DoesNotContain(compare string, more ...string) test.Comparator {
 	return func(stdout, _ string, t *testing.T) {
 		t.Helper()
+
 		assertive.DoesNotContain(assertive.WithFailLater(t), stdout, compare, "Inspecting output (does not contain)")
+
+		for _, m := range more {
+			assertive.DoesNotContain(assertive.WithFailLater(t), stdout, m, "Inspecting output (does not contain)")
+		}
 	}
 }
 
diff --git a/mod/tigron/expect/comparators_test.go b/mod/tigron/expect/comparators_test.go
index f216d3ecb51..d0d76c3b701 100644
--- a/mod/tigron/expect/comparators_test.go
+++ b/mod/tigron/expect/comparators_test.go
@@ -30,6 +30,7 @@ import (
 )
 
 func TestExpect(t *testing.T) {
+	// TODO: write more tests once we can mock t in Comparator signature
 	t.Parallel()
 
 	expect.Contains("b")("a b c", "contains works", t)
@@ -39,7 +40,9 @@ func TestExpect(t *testing.T) {
 
 	expect.All(
 		expect.Contains("b"),
+		expect.Contains("b", "c"),
 		expect.DoesNotContain("d"),
+		expect.DoesNotContain("d", "e"),
 		expect.Equals("a b c"),
 		expect.Match(regexp.MustCompile("[a-z ]+")),
 	)("a b c", "all", t)
diff --git a/mod/tigron/expect/doc.md b/mod/tigron/expect/doc.md
index 7b2e9828df6..566f92d8c55 100644
--- a/mod/tigron/expect/doc.md
+++ b/mod/tigron/expect/doc.md
@@ -53,8 +53,8 @@ The last parameter of `test.Expects` accepts a `test.Comparator`, which allows t
 output on `stdout`.
 
 The following ready-made `test.Comparator` generators are provided:
-- `expect.Contains(string)`: verifies that stdout contains the string parameter
-- `expect.DoesNotContain(string)`: negation of above
+- `expect.Contains(string, ...string)`: verifies that stdout does contain the provided parameters
+- `expect.DoesNotContain(string, ...string)`: verifies that stdout does not contain any of the passed parameters
 - `expect.Equals(string)`: strict equality
 - `expect.Match(*regexp.Regexp)`: regexp matching
 - `expect.All(comparators ...Comparator)`: allows to bundle together a bunch of other comparators

From 4e961136d5b3158dea3ae972003e45644a8a72f5 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 18 Apr 2025 11:31:49 -0700
Subject: [PATCH 108/225] Streamline tests to leverage Contain/DoesNotContain
 multi parameters

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/completion/completion_test.go     | 15 ++------
 .../compose/compose_build_linux_test.go       |  5 +--
 cmd/nerdctl/compose/compose_config_test.go    | 33 ++++++++---------
 .../compose/compose_exec_linux_test.go        | 17 ++++-----
 cmd/nerdctl/container/container_diff_test.go  | 15 ++++----
 cmd/nerdctl/container/container_logs_test.go  | 12 +++----
 cmd/nerdctl/container/container_run_test.go   | 36 ++++++++++---------
 cmd/nerdctl/image/image_list_test.go          | 15 ++++----
 cmd/nerdctl/image/image_remove_test.go        |  7 ++--
 cmd/nerdctl/volume/volume_inspect_test.go     |  3 +-
 cmd/nerdctl/volume/volume_prune_linux_test.go | 14 ++++----
 11 files changed, 78 insertions(+), 94 deletions(-)

diff --git a/cmd/nerdctl/completion/completion_test.go b/cmd/nerdctl/completion/completion_test.go
index bde281ab497..89266ceda4a 100644
--- a/cmd/nerdctl/completion/completion_test.go
+++ b/cmd/nerdctl/completion/completion_test.go
@@ -91,10 +91,7 @@ func TestCompletion(t *testing.T) {
 				Command:     test.Command("__complete", "run", "--net", ""),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.All(
-							expect.Contains("host\n"),
-							expect.Contains(data.Labels().Get("identifier")+"\n"),
-						),
+						Output: expect.Contains("host\n", data.Labels().Get("identifier")+"\n"),
 					}
 				},
 			},
@@ -103,10 +100,7 @@ func TestCompletion(t *testing.T) {
 				Command:     test.Command("__complete", "run", "-it", "--net", ""),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.All(
-							expect.Contains("host\n"),
-							expect.Contains(data.Labels().Get("identifier")+"\n"),
-						),
+						Output: expect.Contains("host\n", data.Labels().Get("identifier")+"\n"),
 					}
 				},
 			},
@@ -115,10 +109,7 @@ func TestCompletion(t *testing.T) {
 				Command:     test.Command("__complete", "run", "-it", "--rm", "--net", ""),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.All(
-							expect.Contains("host\n"),
-							expect.Contains(data.Labels().Get("identifier")+"\n"),
-						),
+						Output: expect.Contains("host\n", data.Labels().Get("identifier")+"\n"),
 					}
 				},
 			},
diff --git a/cmd/nerdctl/compose/compose_build_linux_test.go b/cmd/nerdctl/compose/compose_build_linux_test.go
index 6ea0663240a..2c967a331e2 100644
--- a/cmd/nerdctl/compose/compose_build_linux_test.go
+++ b/cmd/nerdctl/compose/compose_build_linux_test.go
@@ -95,10 +95,7 @@ services:
 
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: expect.All(
-						expect.Contains(data.Labels().Get("imageSvc0")),
-						expect.Contains(data.Labels().Get("imageSvc1")),
-					),
+					Output: expect.Contains(data.Labels().Get("imageSvc0"), data.Labels().Get("imageSvc1")),
 				}
 			},
 		},
diff --git a/cmd/nerdctl/compose/compose_config_test.go b/cmd/nerdctl/compose/compose_config_test.go
index 5df0c9eeebb..e9f16c6a92d 100644
--- a/cmd/nerdctl/compose/compose_config_test.go
+++ b/cmd/nerdctl/compose/compose_config_test.go
@@ -162,12 +162,11 @@ services:
 					"config",
 				)
 			},
-			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.All(
-				expect.Contains("alpine:3.13"),
-				expect.Contains("alpine:3.14"),
-				expect.Contains("hello1"),
-				expect.Contains("hello2"),
-			)),
+			Expected: test.Expects(
+				expect.ExitCodeSuccess,
+				nil,
+				expect.Contains("alpine:3.13", "alpine:3.14", "hello1", "hello2"),
+			),
 		},
 		{
 			Description: "project dir",
@@ -230,12 +229,11 @@ services:
 				cmd.Setenv("COMPOSE_PATH_SEPARATOR", ",")
 				return cmd
 			},
-			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.All(
-				expect.Contains("alpine:3.13"),
-				expect.Contains("alpine:3.14"),
-				expect.Contains("hello1"),
-				expect.Contains("hello2"),
-			)),
+			Expected: test.Expects(
+				expect.ExitCodeSuccess,
+				nil,
+				expect.Contains("alpine:3.13", "alpine:3.14", "hello1", "hello2"),
+			),
 		},
 		{
 			Description: "env with project dir",
@@ -249,12 +247,11 @@ services:
 				cmd.Setenv("COMPOSE_PATH_SEPARATOR", ",")
 				return cmd
 			},
-			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.All(
-				expect.Contains("alpine:3.13"),
-				expect.Contains("alpine:3.14"),
-				expect.Contains("hello1"),
-				expect.Contains("hello2"),
-			)),
+			Expected: test.Expects(
+				expect.ExitCodeSuccess,
+				nil,
+				expect.Contains("alpine:3.13", "alpine:3.14", "hello1", "hello2"),
+			),
 		},
 	}
 
diff --git a/cmd/nerdctl/compose/compose_exec_linux_test.go b/cmd/nerdctl/compose/compose_exec_linux_test.go
index be437cb94d0..0f86c447de4 100644
--- a/cmd/nerdctl/compose/compose_exec_linux_test.go
+++ b/cmd/nerdctl/compose/compose_exec_linux_test.go
@@ -128,15 +128,16 @@ services:
 					"env")
 			},
 			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.All(
-				expect.Contains("\nFOO=foo1,foo2\n"),
-				expect.Contains("\nBAR=bar1 bar2\n"),
-				expect.Contains("\nBAZ=\n"),
+				expect.Contains(
+					"\nFOO=foo1,foo2\n",
+					"\nBAR=bar1 bar2\n",
+					"\nBAZ=\n",
+					"\nQUUX=quux2\n",
+					"\nCORGE=corge-value-in-host\n",
+					"\nGRAULT=grault_key=grault_value\n",
+					"\nGARPLY=\n",
+					"\nWALDO=\n"),
 				expect.DoesNotContain("QUX"),
-				expect.Contains("\nQUUX=quux2\n"),
-				expect.Contains("\nCORGE=corge-value-in-host\n"),
-				expect.Contains("\nGRAULT=grault_key=grault_value\n"),
-				expect.Contains("\nGARPLY=\n"),
-				expect.Contains("\nWALDO=\n"),
 			)),
 		},
 	}
diff --git a/cmd/nerdctl/container/container_diff_test.go b/cmd/nerdctl/container/container_diff_test.go
index 07e0cb4fd45..dc09244a3a0 100644
--- a/cmd/nerdctl/container/container_diff_test.go
+++ b/cmd/nerdctl/container/container_diff_test.go
@@ -51,12 +51,15 @@ func TestDiff(t *testing.T) {
 		return helpers.Command("diff", data.Identifier())
 	}
 
-	testCase.Expected = test.Expects(0, nil, expect.All(
-		expect.Contains("A /a"),
-		expect.Contains("C /bin"),
-		expect.Contains("A /bin/b"),
-		expect.Contains("D /bin/base64"),
-	))
+	testCase.Expected = test.Expects(
+		0,
+		nil,
+		expect.Contains(
+			"A /a",
+			"C /bin",
+			"A /bin/b",
+			"D /bin/base64"),
+	)
 
 	testCase.Run(t)
 }
diff --git a/cmd/nerdctl/container/container_logs_test.go b/cmd/nerdctl/container/container_logs_test.go
index 05b6ea67190..76fe2f96fd6 100644
--- a/cmd/nerdctl/container/container_logs_test.go
+++ b/cmd/nerdctl/container/container_logs_test.go
@@ -247,8 +247,7 @@ func TestLogsWithForegroundContainers(t *testing.T) {
 				return helpers.Command("logs", data.Identifier())
 			},
 			Expected: test.Expects(0, nil, expect.All(
-				expect.Contains("foo"),
-				expect.Contains("bar"),
+				expect.Contains("foo", "bar"),
 				expect.DoesNotContain("baz"),
 			)),
 		},
@@ -264,8 +263,7 @@ func TestLogsWithForegroundContainers(t *testing.T) {
 				return helpers.Command("logs", data.Identifier())
 			},
 			Expected: test.Expects(0, nil, expect.All(
-				expect.Contains("foo"),
-				expect.Contains("bar"),
+				expect.Contains("foo", "bar"),
 				expect.DoesNotContain("baz"),
 			)),
 		},
@@ -283,8 +281,7 @@ func TestLogsWithForegroundContainers(t *testing.T) {
 				return helpers.Command("logs", data.Identifier())
 			},
 			Expected: test.Expects(0, nil, expect.All(
-				expect.Contains("foo"),
-				expect.Contains("bar"),
+				expect.Contains("foo", "bar"),
 				expect.DoesNotContain("baz"),
 			)),
 		},
@@ -302,8 +299,7 @@ func TestLogsWithForegroundContainers(t *testing.T) {
 				return helpers.Command("logs", data.Identifier())
 			},
 			Expected: test.Expects(0, nil, expect.All(
-				expect.Contains("foo"),
-				expect.Contains("bar"),
+				expect.Contains("foo", "bar"),
 				expect.DoesNotContain("baz"),
 			)),
 		},
diff --git a/cmd/nerdctl/container/container_run_test.go b/cmd/nerdctl/container/container_run_test.go
index eb0d22c9674..82b7cbd7f53 100644
--- a/cmd/nerdctl/container/container_run_test.go
+++ b/cmd/nerdctl/container/container_run_test.go
@@ -87,8 +87,7 @@ CMD ["echo", "bar"]
 				},
 				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.All(
 					expect.Contains("blah"),
-					expect.DoesNotContain("foo"),
-					expect.DoesNotContain("bar"),
+					expect.DoesNotContain("foo", "bar"),
 				)),
 			},
 			{
@@ -98,8 +97,7 @@ CMD ["echo", "bar"]
 				},
 				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.All(
 					expect.Contains("blah"),
-					expect.DoesNotContain("foo"),
-					expect.DoesNotContain("bar"),
+					expect.DoesNotContain("foo", "bar"),
 				)),
 			},
 		},
@@ -207,11 +205,11 @@ func TestRunEnvFile(t *testing.T) {
 			testutil.CommonImage, "env")
 	}
 
-	testCase.Expected = test.Expects(expect.ExitCodeSuccess, nil, expect.All(
-		expect.Contains("TESTKEY1=TESTVAL1"),
-		expect.Contains("TESTKEY2=TESTVAL2"),
-		expect.Contains("HOST_ENV=ENV-IN-HOST"),
-	))
+	testCase.Expected = test.Expects(
+		expect.ExitCodeSuccess,
+		nil,
+		expect.Contains("TESTKEY1=TESTVAL1", "TESTKEY2=TESTVAL2", "HOST_ENV=ENV-IN-HOST"),
+	)
 
 	testCase.Run(t)
 }
@@ -240,20 +238,24 @@ func TestRunEnv(t *testing.T) {
 	}
 
 	validate := []test.Comparator{
-		expect.Contains("\nFOO=foo1,foo2\n"),
-		expect.Contains("\nBAR=bar1 bar2\n"),
+		expect.Contains(
+			"\nFOO=foo1,foo2\n",
+			"\nBAR=bar1 bar2\n",
+			"\nQUUX=quux2\n",
+			"\nCORGE=corge-value-in-host\n",
+			"\nGRAULT=grault_key=grault_value\n",
+		),
 		expect.DoesNotContain("QUX"),
-		expect.Contains("\nQUUX=quux2\n"),
-		expect.Contains("\nCORGE=corge-value-in-host\n"),
-		expect.Contains("\nGRAULT=grault_key=grault_value\n"),
 	}
 
 	if runtime.GOOS != "windows" {
 		validate = append(
 			validate,
-			expect.Contains("\nBAZ=\n"),
-			expect.Contains("\nGARPLY=\n"),
-			expect.Contains("\nWALDO=\n"),
+			expect.Contains(
+				"\nBAZ=\n",
+				"\nGARPLY=\n",
+				"\nWALDO=\n",
+			),
 		)
 	}
 
diff --git a/cmd/nerdctl/image/image_list_test.go b/cmd/nerdctl/image/image_list_test.go
index a1db81ee440..6eba01c84c5 100644
--- a/cmd/nerdctl/image/image_list_test.go
+++ b/cmd/nerdctl/image/image_list_test.go
@@ -223,10 +223,11 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 			{
 				Description: "reference=tagged*:*fragment*",
 				Command:     test.Command("images", "--filter", "reference=tagged*:*fragment*"),
-				Expected: test.Expects(0, nil, expect.All(
-					expect.Contains("one-"),
-					expect.Contains("two-"),
-				)),
+				Expected: test.Expects(
+					0,
+					nil,
+					expect.Contains("one-", "two-"),
+				),
 			},
 			{
 				Description: "before=ID:latest",
@@ -259,9 +260,9 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", fmt.Sprintf("since=%s", testutil.CommonImage), testutil.CommonImage),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.All(
-							expect.DoesNotContain(data.Labels().Get("builtImageID")),
-							expect.DoesNotContain(testutil.ImageRepo(testutil.CommonImage)),
+						Output: expect.DoesNotContain(
+							data.Labels().Get("builtImageID"),
+							testutil.ImageRepo(testutil.CommonImage),
 						),
 					}
 				},
diff --git a/cmd/nerdctl/image/image_remove_test.go b/cmd/nerdctl/image/image_remove_test.go
index db5fa47f722..11f2f050636 100644
--- a/cmd/nerdctl/image/image_remove_test.go
+++ b/cmd/nerdctl/image/image_remove_test.go
@@ -186,11 +186,8 @@ func TestRemove(t *testing.T) {
 				return &test.Expected{
 					Output: func(stdout string, info string, t *testing.T) {
 						helpers.Command("images").Run(&test.Expected{
-							Output: expect.All(
-								expect.DoesNotContain(repoName),
-								// a created container with removed image doesn't impact other `rmi` command
-								expect.DoesNotContain(nginxRepoName),
-							),
+							// a created container with removed image doesn't impact other `rmi` command
+							Output: expect.DoesNotContain(repoName, nginxRepoName),
 						})
 					},
 				}
diff --git a/cmd/nerdctl/volume/volume_inspect_test.go b/cmd/nerdctl/volume/volume_inspect_test.go
index af2e7938884..b42b3d41558 100644
--- a/cmd/nerdctl/volume/volume_inspect_test.go
+++ b/cmd/nerdctl/volume/volume_inspect_test.go
@@ -152,8 +152,7 @@ func TestVolumeInspect(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.Contains(data.Labels().Get("vol1")),
-						expect.Contains(data.Labels().Get("vol2")),
+						expect.Contains(data.Labels().Get("vol1"), data.Labels().Get("vol2")),
 						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							assert.Assert(t, len(dc) == 2, fmt.Sprintf("two results, not %d", len(dc)))
 							assert.Assert(t, dc[0].Name == data.Labels().Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Labels().Get("vol1"), dc[0].Name))
diff --git a/cmd/nerdctl/volume/volume_prune_linux_test.go b/cmd/nerdctl/volume/volume_prune_linux_test.go
index 16f69bca559..6565f578733 100644
--- a/cmd/nerdctl/volume/volume_prune_linux_test.go
+++ b/cmd/nerdctl/volume/volume_prune_linux_test.go
@@ -69,10 +69,12 @@ func TestVolumePrune(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.DoesNotContain(data.Labels().Get("anonIDBusy")),
 						expect.Contains(data.Labels().Get("anonIDDangling")),
-						expect.DoesNotContain(data.Labels().Get("namedBusy")),
-						expect.DoesNotContain(data.Labels().Get("namedDangling")),
+						expect.DoesNotContain(
+							data.Labels().Get("anonIDBusy"),
+							data.Labels().Get("namedBusy"),
+							data.Labels().Get("namedDangling"),
+						),
 						func(stdout string, info string, t *testing.T) {
 							helpers.Ensure("volume", "inspect", data.Labels().Get("anonIDBusy"))
 							helpers.Fail("volume", "inspect", data.Labels().Get("anonIDDangling"))
@@ -92,10 +94,8 @@ func TestVolumePrune(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.DoesNotContain(data.Labels().Get("anonIDBusy")),
-						expect.Contains(data.Labels().Get("anonIDDangling")),
-						expect.DoesNotContain(data.Labels().Get("namedBusy")),
-						expect.Contains(data.Labels().Get("namedDangling")),
+						expect.DoesNotContain(data.Labels().Get("anonIDBusy"), data.Labels().Get("namedBusy")),
+						expect.Contains(data.Labels().Get("anonIDDangling"), data.Labels().Get("namedDangling")),
 						func(stdout string, info string, t *testing.T) {
 							helpers.Ensure("volume", "inspect", data.Labels().Get("anonIDBusy"))
 							helpers.Fail("volume", "inspect", data.Labels().Get("anonIDDangling"))

From 2b6294dc3c22f42e9e29af49290820627c455cb5 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 19 Apr 2025 10:32:23 -0700
Subject: [PATCH 109/225] Add DataTemp.SaveToWriter

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/test/data.go       | 38 ++++++++++++++++++++++++++++++++++-
 mod/tigron/test/interfaces.go |  3 +++
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/mod/tigron/test/data.go b/mod/tigron/test/data.go
index d5583d60b2d..9400b88ec03 100644
--- a/mod/tigron/test/data.go
+++ b/mod/tigron/test/data.go
@@ -19,6 +19,7 @@ package test
 import (
 	"crypto/sha256"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -110,7 +111,42 @@ func (tp *temp) Save(value string, key ...string) string {
 	assertive.ErrorIsNil(
 		assertive.WithSilentSuccess(tp.t),
 		err,
-		fmt.Sprintf("Saving file %q must succeed", filepath.Join(key...)),
+		fmt.Sprintf("Saving file %q must succeed", pth),
+	)
+
+	return pth
+}
+
+func (tp *temp) SaveToWriter(writer func(file io.Writer) error, key ...string) string {
+	tp.t.Helper()
+
+	tp.Dir(key[:len(key)-1]...)
+
+	pth := filepath.Join(append([]string{tp.tempDir}, key...)...)
+	silentT := assertive.WithSilentSuccess(tp.t)
+
+	//nolint:gosec // it is fine
+	file, err := os.OpenFile(pth, os.O_CREATE, FilePermissionsDefault)
+	assertive.ErrorIsNil(
+		silentT,
+		err,
+		fmt.Sprintf("Opening file %q must succeed", pth),
+	)
+
+	defer func() {
+		err = file.Close()
+		assertive.ErrorIsNil(
+			silentT,
+			err,
+			fmt.Sprintf("Closing file %q must succeed", pth),
+		)
+	}()
+
+	err = writer(file)
+	assertive.ErrorIsNil(
+		silentT,
+		err,
+		fmt.Sprintf("Filewriter failed while attempting to write to %q", pth),
 	)
 
 	return pth
diff --git a/mod/tigron/test/interfaces.go b/mod/tigron/test/interfaces.go
index afa52013f31..12df876747a 100644
--- a/mod/tigron/test/interfaces.go
+++ b/mod/tigron/test/interfaces.go
@@ -40,6 +40,9 @@ type DataTemp interface {
 	// Save will store the content in the file, ensuring parent dir exists, and return the path.
 	// Asserts on failure.
 	Save(data string, key ...string) string
+	// SaveToWriter allows to write to the file as a writer.
+	// This is particularly useful for encoding functions like pem.Encode.
+	SaveToWriter(writer func(file io.Writer) error, key ...string) string
 	// Path will return the absolute path for the asset, whether it exists or not.
 	Path(key ...string) string
 	// Exists asserts that the object exist.

From 660c9a8aa24a94af1e73259a4b857ada09078bd0 Mon Sep 17 00:00:00 2001
From: Marat Radchenko <marat@slonopotamus.org>
Date: Sun, 15 Dec 2024 17:13:47 +0300
Subject: [PATCH 110/225] darwin build

Closes #732

Signed-off-by: Marat Radchenko <marat@slonopotamus.org>
---
 .github/workflows/lint.yml                    |  2 +
 .github/workflows/test.yml                    |  2 +
 ..._freebsd.go => completion_unix_nolinux.go} |  2 +
 ..._cp_freebsd.go => container_cp_nolinux.go} |  2 +
 cmd/nerdctl/container/container_cp_windows.go | 23 ------
 ...un_windows.go => container_run_nolinux.go} |  2 +
 .../{main_freebsd.go => main_nolinux.go}      |  2 +
 pkg/buildkitutil/buildkitutil_test.go         |  2 +
 ...reebsd.go => buildkitutil_unix_nolinux.go} |  2 +
 .../{exec_freebsd.go => exec_nolinux.go}      |  2 +
 pkg/cmd/container/exec_windows.go             | 26 -------
 .../{run_freebsd.go => run_unix_nolinux.go}   |  2 +
 .../{stats_freebsd.go => stats_nolinux.go}    |  2 +
 pkg/cmd/container/stats_windows.go            | 26 -------
 ...espace_freebsd.go => namespace_nolinux.go} |  2 +
 pkg/cmd/namespace/namespace_windows.go        | 26 -------
 ....go => containerinspector_unix_nolinux.go} |  2 +
 pkg/defaults/defaults_darwin.go               | 26 ++++++-
 pkg/defaults/defaults_freebsd.go              |  2 +-
 .../infoutil/infoutil_darwin.go               | 22 +++---
 pkg/mountutil/mountutil_darwin.go             | 72 +++++++++++++++++++
 ...{ocihook_freebsd.go => ocihook_nolinux.go} |  2 +
 pkg/ocihook/ocihook_windows.go                | 21 ------
 .../nerdtest/platform/platform_darwin.go      | 19 ++---
 pkg/testutil/testutil_darwin.go               | 35 +++++++++
 25 files changed, 183 insertions(+), 143 deletions(-)
 rename cmd/nerdctl/completion/{completion_freebsd.go => completion_unix_nolinux.go} (96%)
 rename cmd/nerdctl/container/{container_cp_freebsd.go => container_cp_nolinux.go} (97%)
 delete mode 100644 cmd/nerdctl/container/container_cp_windows.go
 rename cmd/nerdctl/container/{container_run_windows.go => container_run_nolinux.go} (97%)
 rename cmd/nerdctl/{main_freebsd.go => main_nolinux.go} (97%)
 rename pkg/buildkitutil/{buildkitutil_freebsd.go => buildkitutil_unix_nolinux.go} (96%)
 rename pkg/cmd/container/{exec_freebsd.go => exec_nolinux.go} (97%)
 delete mode 100644 pkg/cmd/container/exec_windows.go
 rename pkg/cmd/container/{run_freebsd.go => run_unix_nolinux.go} (97%)
 rename pkg/cmd/container/{stats_freebsd.go => stats_nolinux.go} (98%)
 delete mode 100644 pkg/cmd/container/stats_windows.go
 rename pkg/cmd/namespace/{namespace_freebsd.go => namespace_nolinux.go} (97%)
 delete mode 100644 pkg/cmd/namespace/namespace_windows.go
 rename pkg/containerinspector/{containerinspector_freebsd.go => containerinspector_unix_nolinux.go} (96%)
 rename cmd/nerdctl/main_windows.go => pkg/infoutil/infoutil_darwin.go (62%)
 create mode 100644 pkg/mountutil/mountutil_darwin.go
 rename pkg/ocihook/{ocihook_freebsd.go => ocihook_nolinux.go} (97%)
 delete mode 100644 pkg/ocihook/ocihook_windows.go
 rename cmd/nerdctl/container/container_run_freebsd.go => pkg/testutil/nerdtest/platform/platform_darwin.go (59%)
 create mode 100644 pkg/testutil/testutil_darwin.go

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 4a4f0bed7f8..b79138a70d9 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -27,6 +27,8 @@ jobs:
             goos: linux
           - os: ubuntu-24.04
             goos: freebsd
+          - os: ubuntu-24.04
+            goos: darwin
           # FIXME: this is currently failing in a non-sensical way, so, running on linux instead...
           # - os: windows-2022
           - os: ubuntu-24.04
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3477b6fd148..0938a736408 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -70,6 +70,8 @@ jobs:
             goos: windows
           - os: ubuntu-24.04
             goos: linux
+          - os: macos-15
+            goos: darwin
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
diff --git a/cmd/nerdctl/completion/completion_freebsd.go b/cmd/nerdctl/completion/completion_unix_nolinux.go
similarity index 96%
rename from cmd/nerdctl/completion/completion_freebsd.go
rename to cmd/nerdctl/completion/completion_unix_nolinux.go
index 465671cfc24..5a80c80573c 100644
--- a/cmd/nerdctl/completion/completion_freebsd.go
+++ b/cmd/nerdctl/completion/completion_unix_nolinux.go
@@ -1,3 +1,5 @@
+//go:build unix && !linux
+
 /*
    Copyright The containerd Authors.
 
diff --git a/cmd/nerdctl/container/container_cp_freebsd.go b/cmd/nerdctl/container/container_cp_nolinux.go
similarity index 97%
rename from cmd/nerdctl/container/container_cp_freebsd.go
rename to cmd/nerdctl/container/container_cp_nolinux.go
index 4e7d2cfd518..95a9accec0a 100644
--- a/cmd/nerdctl/container/container_cp_freebsd.go
+++ b/cmd/nerdctl/container/container_cp_nolinux.go
@@ -1,3 +1,5 @@
+//go:build !linux
+
 /*
    Copyright The containerd Authors.
 
diff --git a/cmd/nerdctl/container/container_cp_windows.go b/cmd/nerdctl/container/container_cp_windows.go
deleted file mode 100644
index 4e7d2cfd518..00000000000
--- a/cmd/nerdctl/container/container_cp_windows.go
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package container
-
-import "github.com/spf13/cobra"
-
-func AddCpCommand(rootCmd *cobra.Command) {
-	// NOP
-}
diff --git a/cmd/nerdctl/container/container_run_windows.go b/cmd/nerdctl/container/container_run_nolinux.go
similarity index 97%
rename from cmd/nerdctl/container/container_run_windows.go
rename to cmd/nerdctl/container/container_run_nolinux.go
index 5ef9a6d94fb..334461c583e 100644
--- a/cmd/nerdctl/container/container_run_windows.go
+++ b/cmd/nerdctl/container/container_run_nolinux.go
@@ -1,3 +1,5 @@
+//go:build !linux
+
 /*
    Copyright The containerd Authors.
 
diff --git a/cmd/nerdctl/main_freebsd.go b/cmd/nerdctl/main_nolinux.go
similarity index 97%
rename from cmd/nerdctl/main_freebsd.go
rename to cmd/nerdctl/main_nolinux.go
index 089974e1760..fb0f1230943 100644
--- a/cmd/nerdctl/main_freebsd.go
+++ b/cmd/nerdctl/main_nolinux.go
@@ -1,3 +1,5 @@
+//go:build !linux
+
 /*
    Copyright The containerd Authors.
 
diff --git a/pkg/buildkitutil/buildkitutil_test.go b/pkg/buildkitutil/buildkitutil_test.go
index 09250c0439a..a123bc5f3cd 100644
--- a/pkg/buildkitutil/buildkitutil_test.go
+++ b/pkg/buildkitutil/buildkitutil_test.go
@@ -35,6 +35,8 @@ func TestBuildKitFile(t *testing.T) {
 	var tmp = t.TempDir()
 	var wd, err = os.Getwd()
 	assert.NilError(t, err)
+	tmp, err = filepath.EvalSymlinks(tmp)
+	assert.NilError(t, err)
 	err = os.Chdir(tmp)
 	assert.NilError(t, err)
 	defer os.Chdir(wd)
diff --git a/pkg/buildkitutil/buildkitutil_freebsd.go b/pkg/buildkitutil/buildkitutil_unix_nolinux.go
similarity index 96%
rename from pkg/buildkitutil/buildkitutil_freebsd.go
rename to pkg/buildkitutil/buildkitutil_unix_nolinux.go
index a0b02e3c7dc..238f8677198 100644
--- a/pkg/buildkitutil/buildkitutil_freebsd.go
+++ b/pkg/buildkitutil/buildkitutil_unix_nolinux.go
@@ -1,3 +1,5 @@
+//go:build unix && !linux
+
 /*
    Copyright The containerd Authors.
 
diff --git a/pkg/cmd/container/exec_freebsd.go b/pkg/cmd/container/exec_nolinux.go
similarity index 97%
rename from pkg/cmd/container/exec_freebsd.go
rename to pkg/cmd/container/exec_nolinux.go
index 57ebca59e4a..99865ab4ea8 100644
--- a/pkg/cmd/container/exec_freebsd.go
+++ b/pkg/cmd/container/exec_nolinux.go
@@ -1,3 +1,5 @@
+//go:build !linux
+
 /*
    Copyright The containerd Authors.
 
diff --git a/pkg/cmd/container/exec_windows.go b/pkg/cmd/container/exec_windows.go
deleted file mode 100644
index 0e8eb6bc563..00000000000
--- a/pkg/cmd/container/exec_windows.go
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package container
-
-import (
-	"github.com/opencontainers/runtime-spec/specs-go"
-)
-
-func setExecCapabilities(pspec *specs.Process) error {
-	//no op windows
-	return nil
-}
diff --git a/pkg/cmd/container/run_freebsd.go b/pkg/cmd/container/run_unix_nolinux.go
similarity index 97%
rename from pkg/cmd/container/run_freebsd.go
rename to pkg/cmd/container/run_unix_nolinux.go
index ddf743121e7..fde2629b27d 100644
--- a/pkg/cmd/container/run_freebsd.go
+++ b/pkg/cmd/container/run_unix_nolinux.go
@@ -1,3 +1,5 @@
+//go:build unix && !linux
+
 /*
    Copyright The containerd Authors.
 
diff --git a/pkg/cmd/container/stats_freebsd.go b/pkg/cmd/container/stats_nolinux.go
similarity index 98%
rename from pkg/cmd/container/stats_freebsd.go
rename to pkg/cmd/container/stats_nolinux.go
index ef2c98fdfad..fbef460eaab 100644
--- a/pkg/cmd/container/stats_freebsd.go
+++ b/pkg/cmd/container/stats_nolinux.go
@@ -1,3 +1,5 @@
+//go:build !linux
+
 /*
    Copyright The containerd Authors.
 
diff --git a/pkg/cmd/container/stats_windows.go b/pkg/cmd/container/stats_windows.go
deleted file mode 100644
index ef2c98fdfad..00000000000
--- a/pkg/cmd/container/stats_windows.go
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package container
-
-import (
-	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/native"
-	"github.com/containerd/nerdctl/v2/pkg/statsutil"
-)
-
-func setContainerStatsAndRenderStatsEntry(previousStats *statsutil.ContainerStats, firstSet bool, anydata interface{}, pid int, interfaces []native.NetInterface) (statsutil.StatsEntry, error) {
-	return statsutil.StatsEntry{}, nil
-}
diff --git a/pkg/cmd/namespace/namespace_freebsd.go b/pkg/cmd/namespace/namespace_nolinux.go
similarity index 97%
rename from pkg/cmd/namespace/namespace_freebsd.go
rename to pkg/cmd/namespace/namespace_nolinux.go
index a3a45d59168..eb133db4beb 100644
--- a/pkg/cmd/namespace/namespace_freebsd.go
+++ b/pkg/cmd/namespace/namespace_nolinux.go
@@ -1,3 +1,5 @@
+//go:build !linux
+
 /*
    Copyright The containerd Authors.
 
diff --git a/pkg/cmd/namespace/namespace_windows.go b/pkg/cmd/namespace/namespace_windows.go
deleted file mode 100644
index a3a45d59168..00000000000
--- a/pkg/cmd/namespace/namespace_windows.go
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package namespace
-
-import (
-	"github.com/containerd/containerd/v2/pkg/namespaces"
-)
-
-func namespaceDeleteOpts(cgroup bool) ([]namespaces.DeleteOpts, error) {
-	var delOpts []namespaces.DeleteOpts
-	return delOpts, nil
-}
diff --git a/pkg/containerinspector/containerinspector_freebsd.go b/pkg/containerinspector/containerinspector_unix_nolinux.go
similarity index 96%
rename from pkg/containerinspector/containerinspector_freebsd.go
rename to pkg/containerinspector/containerinspector_unix_nolinux.go
index e5a2dbc42fb..2902651bc61 100644
--- a/pkg/containerinspector/containerinspector_freebsd.go
+++ b/pkg/containerinspector/containerinspector_unix_nolinux.go
@@ -1,3 +1,5 @@
+//go:build unix && !linux
+
 /*
    Copyright The containerd Authors.
 
diff --git a/pkg/defaults/defaults_darwin.go b/pkg/defaults/defaults_darwin.go
index 38db7823db1..88aef1073e4 100644
--- a/pkg/defaults/defaults_darwin.go
+++ b/pkg/defaults/defaults_darwin.go
@@ -20,22 +20,42 @@
 
 package defaults
 
+import gocni "github.com/containerd/go-cni"
+
+const (
+	AppArmorProfileName = ""
+	SeccompProfileName  = ""
+	Runtime             = ""
+)
+
 func CNIPath() string {
-	return ""
+	return gocni.DefaultCNIDir
+}
+
+func CNIRuntimeDir() (string, error) {
+	return "/var/run/cni", nil
 }
 
 func CNINetConfPath() string {
-	return ""
+	return gocni.DefaultNetDir
 }
 
 func DataRoot() string {
-	return ""
+	return "/var/lib/nerdctl"
 }
 
 func CgroupManager() string {
 	return ""
 }
 
+func CgroupnsMode() string {
+	return ""
+}
+
+func NerdctlTOML() string {
+	return "/etc/nerdctl/nerdctl.toml"
+}
+
 func HostsDirs() []string {
 	return []string{}
 }
diff --git a/pkg/defaults/defaults_freebsd.go b/pkg/defaults/defaults_freebsd.go
index 90cdda10a9a..cf768925f1c 100644
--- a/pkg/defaults/defaults_freebsd.go
+++ b/pkg/defaults/defaults_freebsd.go
@@ -40,7 +40,7 @@ func CNINetConfPath() string {
 }
 
 func CNIRuntimeDir() (string, error) {
-	return "/run/cni", nil
+	return "/var/run/cni", nil
 }
 
 func CgroupManager() string {
diff --git a/cmd/nerdctl/main_windows.go b/pkg/infoutil/infoutil_darwin.go
similarity index 62%
rename from cmd/nerdctl/main_windows.go
rename to pkg/infoutil/infoutil_darwin.go
index 089974e1760..3b87f89df2f 100644
--- a/cmd/nerdctl/main_windows.go
+++ b/pkg/infoutil/infoutil_darwin.go
@@ -14,21 +14,25 @@
    limitations under the License.
 */
 
-package main
+package infoutil
 
 import (
-	"github.com/spf13/cobra"
+	"github.com/docker/docker/pkg/sysinfo"
+
+	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 )
 
-func appNeedsRootlessParentMain(cmd *cobra.Command, args []string) bool {
-	return false
+const UnameO = "Darwin"
+
+func CgroupsVersion() string {
+	return ""
 }
 
-func addApparmorCommand(rootCmd *cobra.Command) {
-	// NOP
+func fulfillPlatformInfo(info *dockercompat.Info) {
+	// unimplemented
 }
 
-func resetSavedSETUID() error {
-	// NOP
-	return nil
+func mobySysInfo(info *dockercompat.Info) *sysinfo.SysInfo {
+	var sysinfo sysinfo.SysInfo
+	return &sysinfo
 }
diff --git a/pkg/mountutil/mountutil_darwin.go b/pkg/mountutil/mountutil_darwin.go
new file mode 100644
index 00000000000..c86d9a3cdec
--- /dev/null
+++ b/pkg/mountutil/mountutil_darwin.go
@@ -0,0 +1,72 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package mountutil
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/containerd/containerd/v2/pkg/oci"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/log"
+
+	"github.com/containerd/nerdctl/v2/pkg/mountutil/volumestore"
+)
+
+const (
+	DefaultMountType = ""
+
+	DefaultPropagationMode = ""
+)
+
+func UnprivilegedMountFlags(path string) ([]string, error) {
+	m := []string{}
+	return m, nil
+}
+
+// parseVolumeOptions parses specified optsRaw with using information of
+// the volume type and the src directory when necessary.
+func parseVolumeOptions(vType, src, optsRaw string) ([]string, []oci.SpecOpts, error) {
+	var writeModeRawOpts []string
+	for _, opt := range strings.Split(optsRaw, ",") {
+		switch opt {
+		case "rw":
+			writeModeRawOpts = append(writeModeRawOpts, opt)
+		case "ro":
+			writeModeRawOpts = append(writeModeRawOpts, opt)
+		case "":
+			// NOP
+		default:
+			log.L.Warnf("unsupported volume option %q", opt)
+		}
+	}
+	var opts []string
+	if len(writeModeRawOpts) > 1 {
+		return nil, nil, fmt.Errorf("duplicated read/write volume option: %+v", writeModeRawOpts)
+	} else if len(writeModeRawOpts) > 0 && writeModeRawOpts[0] == "ro" {
+		opts = append(opts, "ro")
+	} // No need to return option when "rw"
+	return opts, nil, nil
+}
+
+func ProcessFlagTmpfs(s string) (*Processed, error) {
+	return nil, errdefs.ErrNotImplemented
+}
+
+func ProcessFlagMount(s string, volStore volumestore.VolumeStore) (*Processed, error) {
+	return nil, errdefs.ErrNotImplemented
+}
diff --git a/pkg/ocihook/ocihook_freebsd.go b/pkg/ocihook/ocihook_nolinux.go
similarity index 97%
rename from pkg/ocihook/ocihook_freebsd.go
rename to pkg/ocihook/ocihook_nolinux.go
index 03323a67215..85f465f392f 100644
--- a/pkg/ocihook/ocihook_freebsd.go
+++ b/pkg/ocihook/ocihook_nolinux.go
@@ -1,3 +1,5 @@
+//go:build !linux
+
 /*
    Copyright The containerd Authors.
 
diff --git a/pkg/ocihook/ocihook_windows.go b/pkg/ocihook/ocihook_windows.go
deleted file mode 100644
index 03323a67215..00000000000
--- a/pkg/ocihook/ocihook_windows.go
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package ocihook
-
-func loadAppArmor() {
-	//noop
-}
diff --git a/cmd/nerdctl/container/container_run_freebsd.go b/pkg/testutil/nerdtest/platform/platform_darwin.go
similarity index 59%
rename from cmd/nerdctl/container/container_run_freebsd.go
rename to pkg/testutil/nerdtest/platform/platform_darwin.go
index 5ef9a6d94fb..0fa050fe63f 100644
--- a/cmd/nerdctl/container/container_run_freebsd.go
+++ b/pkg/testutil/nerdtest/platform/platform_darwin.go
@@ -14,13 +14,16 @@
    limitations under the License.
 */
 
-package container
+package platform
 
-import (
-	"github.com/spf13/cobra"
-)
-
-func capShellComplete(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-	candidates := []string{}
-	return candidates, cobra.ShellCompDirectiveNoFileComp
+func DataHome() (string, error) {
+	panic("not supported")
 }
+
+var (
+	// The following are here solely for darwin to compile / lint. They are not used, as the corresponding tests are running only on linux.
+	RegistryImageStable = "registry:2"
+	RegistryImageNext   = "ghcr.io/distribution/distribution:"
+	KuboImage           = "ipfs/kubo:v0.16.0"
+	DockerAuthImage     = "cesanta/docker_auth:1.7"
+)
diff --git a/pkg/testutil/testutil_darwin.go b/pkg/testutil/testutil_darwin.go
new file mode 100644
index 00000000000..07990bfef57
--- /dev/null
+++ b/pkg/testutil/testutil_darwin.go
@@ -0,0 +1,35 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package testutil
+
+const (
+	CommonImage = ""
+
+	// This error string is expected when attempting to connect to a TCP socket
+	// for a service which actively refuses the connection.
+	// (e.g. attempting to connect using http to an https endpoint).
+	// It should be "connection refused" as per the TCP RFC.
+	// https://www.rfc-editor.org/rfc/rfc793
+	ExpectedConnectionRefusedError = "connection refused"
+)
+
+var (
+	BusyboxImage     = "ghcr.io/containerd/busybox:1.36"
+	AlpineImage      = mirrorOf("alpine:3.13")
+	NginxAlpineImage = mirrorOf("nginx:1.19-alpine")
+	GolangImage      = mirrorOf("golang:1.18")
+)

From 16d755c4eb75a535087cae8e591aff40186a5a37 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 19 Apr 2025 10:35:17 -0700
Subject: [PATCH 111/225] Add x509 test helper

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/utils/testca/ca.go | 170 ++++++++++++++++++++++++++++++++++
 1 file changed, 170 insertions(+)
 create mode 100644 mod/tigron/utils/testca/ca.go

diff --git a/mod/tigron/utils/testca/ca.go b/mod/tigron/utils/testca/ca.go
new file mode 100644
index 00000000000..662be0c810c
--- /dev/null
+++ b/mod/tigron/utils/testca/ca.go
@@ -0,0 +1,170 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package testca provides helpers to create a self-signed CA certificate, and the ability to generate
+// signed certificates from it.
+// PLEASE NOTE THIS IS NOT A PRODUCTION SAFE NOR VERIFIED WAY TO MANAGE CERTIFICATES FOR SERVERS.
+package testca
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"io"
+	"math/big"
+	"net"
+	"time"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+	"github.com/containerd/nerdctl/mod/tigron/tig"
+)
+
+const (
+	keyLength    = 4096
+	caRoot       = "ca"
+	certsRoot    = "certs"
+	organization = "tigron volatile testing organization"
+	lifetime     = 24 * time.Hour
+	serialSize   = 60
+)
+
+// NewX509 creates a new, self-signed, signing certificate under data.Temp()/ca
+// From that Cert as a CA, you can then generate signed certificates.
+// Note that the common name of the cert will be set to the test name.
+func NewX509(data test.Data, helpers test.Helpers) *Cert {
+	template := &x509.Certificate{
+		Subject: pkix.Name{
+			Organization: []string{organization},
+			CommonName:   helpers.T().Name(),
+		},
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().Add(lifetime),
+		IsCA:                  true,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		BasicConstraintsValid: true,
+	}
+
+	return (&Cert{}).GenerateCustomX509(data, helpers, caRoot, template)
+}
+
+// Cert allows the consumer to retrieve the cert and key path, to be used by other processes, like servers for example.
+type Cert struct {
+	KeyPath  string
+	CertPath string
+	key      *rsa.PrivateKey
+	cert     *x509.Certificate
+}
+
+// GenerateServerX509 produces a certificate usable by a server.
+// additional can be used to provide additional ips to be added to the certificate.
+func (ca *Cert) GenerateServerX509(data test.Data, helpers test.Helpers, host string, additional ...string) *Cert {
+	template := &x509.Certificate{
+		Subject: pkix.Name{
+			Organization: []string{organization},
+			CommonName:   host,
+		},
+		NotBefore:   time.Now(),
+		NotAfter:    time.Now().Add(lifetime),
+		KeyUsage:    x509.KeyUsageCRLSign,
+		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		DNSNames:    additional,
+	}
+
+	additional = append([]string{host}, additional...)
+	for _, h := range additional {
+		if ip := net.ParseIP(h); ip != nil {
+			template.IPAddresses = append(template.IPAddresses, ip)
+		}
+	}
+
+	return ca.GenerateCustomX509(data, helpers, certsRoot, template)
+}
+
+// GenerateCustomX509 signs a random x509 certificate template.
+// Note that if SerialNumber is specified, it must be safe to use on the filesystem as this will be used in the name
+// of the certificate file.
+func (ca *Cert) GenerateCustomX509(
+	data test.Data,
+	helpers test.Helpers,
+	underDirectory string,
+	template *x509.Certificate,
+) *Cert {
+	silentT := assertive.WithSilentSuccess(helpers.T())
+	key, certPath, keyPath := createCert(silentT, data, underDirectory, template, ca.cert, ca.key)
+
+	return &Cert{
+		CertPath: certPath,
+		KeyPath:  keyPath,
+		key:      key,
+		cert:     template,
+	}
+}
+
+func createCert(
+	testing tig.T,
+	data test.Data,
+	dir string,
+	template, caCert *x509.Certificate,
+	caKey *rsa.PrivateKey,
+) (key *rsa.PrivateKey, certPath, keyPath string) {
+	if caCert == nil {
+		caCert = template
+	}
+
+	if caKey == nil {
+		caKey = key
+	}
+
+	key, err := rsa.GenerateKey(rand.Reader, keyLength)
+	assertive.ErrorIsNil(testing, err, "key generation should succeed")
+
+	signedCert, err := x509.CreateCertificate(rand.Reader, template, caCert, &key.PublicKey, caKey)
+	assertive.ErrorIsNil(testing, err, "certificate creation should succeed")
+
+	serial := template.SerialNumber
+	if serial == nil {
+		serial = serialNumber()
+	}
+
+	data.Temp().Dir(dir)
+	certPath = data.Temp().Path(dir, serial.String()+".cert")
+	keyPath = data.Temp().Path(dir, serial.String()+".key")
+
+	data.Temp().SaveToWriter(func(writer io.Writer) error {
+		return pem.Encode(writer, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)})
+	}, keyPath)
+
+	data.Temp().SaveToWriter(func(writer io.Writer) error {
+		return pem.Encode(writer, &pem.Block{Type: "CERTIFICATE", Bytes: signedCert})
+	}, keyPath)
+
+	return key, certPath, keyPath
+}
+
+func serialNumber() *big.Int {
+	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), serialSize)
+
+	serial, err := rand.Int(rand.Reader, serialNumberLimit)
+	if err != nil {
+		panic(err)
+	}
+
+	return serial
+}

From 15bb28ec1871ff7e98a4e6d7d755fc04a5edf7b1 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 19 Apr 2025 10:42:29 -0700
Subject: [PATCH 112/225] Cleanup ca/ca.go and use new helper

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 pkg/containerdutil/image_store.go         |  20 +++
 pkg/testutil/nerdtest/ca/ca.go            | 161 ----------------------
 pkg/testutil/nerdtest/registry/cesanta.go |  10 +-
 pkg/testutil/nerdtest/registry/docker.go  |  12 +-
 pkg/testutil/nerdtest/registry/kubo.go    |   4 +-
 pkg/testutil/nerdtest/third-party.go      |  12 +-
 6 files changed, 35 insertions(+), 184 deletions(-)
 create mode 100644 pkg/containerdutil/image_store.go
 delete mode 100644 pkg/testutil/nerdtest/ca/ca.go

diff --git a/pkg/containerdutil/image_store.go b/pkg/containerdutil/image_store.go
new file mode 100644
index 00000000000..571f42c69c2
--- /dev/null
+++ b/pkg/containerdutil/image_store.go
@@ -0,0 +1,20 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package containerdutil
+
+type ImageStore struct {
+}
diff --git a/pkg/testutil/nerdtest/ca/ca.go b/pkg/testutil/nerdtest/ca/ca.go
deleted file mode 100644
index 49d69f81b4f..00000000000
--- a/pkg/testutil/nerdtest/ca/ca.go
+++ /dev/null
@@ -1,161 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package ca
-
-import (
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/pem"
-	"fmt"
-	"math/big"
-	"net"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"gotest.tools/v3/assert"
-
-	"github.com/containerd/nerdctl/mod/tigron/test"
-)
-
-type CA struct {
-	KeyPath  string
-	CertPath string
-
-	t      *testing.T
-	key    *rsa.PrivateKey
-	cert   *x509.Certificate
-	closeF func() error
-}
-
-func (ca *CA) Close() error {
-	return ca.closeF()
-}
-
-const keyLength = 4096
-
-func New(data test.Data, t *testing.T) *CA {
-	key, err := rsa.GenerateKey(rand.Reader, keyLength)
-	assert.NilError(t, err)
-
-	cert := &x509.Certificate{
-		SerialNumber: serialNumber(t),
-		Subject: pkix.Name{
-			Organization: []string{"nerdctl test organization"},
-			CommonName:   fmt.Sprintf("nerdctl CA (%s)", t.Name()),
-		},
-		NotBefore:             time.Now(),
-		NotAfter:              time.Now().Add(24 * time.Hour),
-		IsCA:                  true,
-		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
-		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		BasicConstraintsValid: true,
-	}
-
-	dir := data.Temp().Dir("ca")
-	keyPath := filepath.Join(dir, "ca.key")
-	certPath := filepath.Join(dir, "ca.cert")
-	writePair(t, keyPath, certPath, cert, cert, key, key)
-
-	return &CA{
-		KeyPath:  keyPath,
-		CertPath: certPath,
-		t:        t,
-		key:      key,
-		cert:     cert,
-		closeF: func() error {
-			return os.RemoveAll(dir)
-		},
-	}
-}
-
-type Cert struct {
-	KeyPath  string
-	CertPath string
-	closeF   func() error
-}
-
-func (c *Cert) Close() error {
-	return c.closeF()
-}
-
-func (ca *CA) NewCert(host string, additional ...string) *Cert {
-	t := ca.t
-
-	key, err := rsa.GenerateKey(rand.Reader, keyLength)
-	assert.NilError(t, err)
-
-	additional = append([]string{host}, additional...)
-
-	cert := &x509.Certificate{
-		SerialNumber: serialNumber(t),
-		Subject: pkix.Name{
-			Organization: []string{"nerdctl test organization"},
-			CommonName:   fmt.Sprintf("nerdctl %s (%s)", host, t.Name()),
-		},
-		NotBefore:   time.Now(),
-		NotAfter:    time.Now().Add(24 * time.Hour),
-		KeyUsage:    x509.KeyUsageCRLSign,
-		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		DNSNames:    additional,
-	}
-	for _, h := range additional {
-		if ip := net.ParseIP(h); ip != nil {
-			cert.IPAddresses = append(cert.IPAddresses, ip)
-		}
-	}
-
-	dir, err := os.MkdirTemp(t.TempDir(), "cert")
-	assert.NilError(t, err)
-	certPath := filepath.Join(dir, "a.cert")
-	keyPath := filepath.Join(dir, "a.key")
-	writePair(t, keyPath, certPath, cert, ca.cert, key, ca.key)
-
-	return &Cert{
-		CertPath: certPath,
-		KeyPath:  keyPath,
-		closeF: func() error {
-			return os.RemoveAll(dir)
-		},
-	}
-}
-
-func writePair(t *testing.T, keyPath, certPath string, cert, caCert *x509.Certificate, key, caKey *rsa.PrivateKey) {
-	keyF, err := os.Create(keyPath)
-	assert.NilError(t, err)
-	defer keyF.Close()
-	assert.NilError(t, pem.Encode(keyF, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)}))
-	assert.NilError(t, keyF.Close())
-
-	certB, err := x509.CreateCertificate(rand.Reader, cert, caCert, &key.PublicKey, caKey)
-	assert.NilError(t, err)
-	certF, err := os.Create(certPath)
-	assert.NilError(t, err)
-	defer certF.Close()
-	assert.NilError(t, pem.Encode(certF, &pem.Block{Type: "CERTIFICATE", Bytes: certB}))
-	assert.NilError(t, certF.Close())
-}
-
-func serialNumber(t *testing.T) *big.Int {
-	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 60)
-	sn, err := rand.Int(rand.Reader, serialNumberLimit)
-	assert.NilError(t, err)
-	return sn
-}
diff --git a/pkg/testutil/nerdtest/registry/cesanta.go b/pkg/testutil/nerdtest/registry/cesanta.go
index 111286e3c6b..1a83f73dfcb 100644
--- a/pkg/testutil/nerdtest/registry/cesanta.go
+++ b/pkg/testutil/nerdtest/registry/cesanta.go
@@ -31,9 +31,9 @@ import (
 
 	"github.com/containerd/nerdctl/mod/tigron/expect"
 	"github.com/containerd/nerdctl/mod/tigron/test"
+	"github.com/containerd/nerdctl/mod/tigron/utils/testca"
 
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/ca"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/platform"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nettestutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/portlock"
@@ -119,7 +119,7 @@ func ensureContainerStarted(helpers test.Helpers, con string) {
 	}
 }
 
-func NewCesantaAuthServer(data test.Data, helpers test.Helpers, ca *ca.CA, port int, user, pass string, tls bool) *TokenAuthServer {
+func NewCesantaAuthServer(data test.Data, helpers test.Helpers, ca *testca.Cert, port int, user, pass string, tls bool) *TokenAuthServer {
 	// listen on 0.0.0.0 to enable 127.0.0.1
 	listenIP := net.ParseIP("0.0.0.0")
 	hostIP, err := nettestutil.NonLoopbackIPv4()
@@ -165,7 +165,7 @@ func NewCesantaAuthServer(data test.Data, helpers test.Helpers, ca *ca.CA, port
 	err = cc.Save(configFileName)
 	assert.NilError(helpers.T(), err, fmt.Errorf("failed writing configuration: %w", err))
 
-	cert := ca.NewCert(hostIP.String())
+	cert := ca.GenerateServerX509(data, helpers, hostIP.String())
 	// FIXME: this will fail in many circumstances. Review strategy on how to acquire a free port.
 	// We probably have better code for that already somewhere.
 	port, err = portlock.Acquire(port)
@@ -177,13 +177,9 @@ func NewCesantaAuthServer(data test.Data, helpers test.Helpers, ca *ca.CA, port
 	cleanup := func(data test.Data, helpers test.Helpers) {
 		helpers.Ensure("rm", "-f", containerName)
 		errPortRelease := portlock.Release(port)
-		errCertClose := cert.Close()
 		if errPortRelease != nil {
 			helpers.T().Error(errPortRelease.Error())
 		}
-		if errCertClose != nil {
-			helpers.T().Error(errCertClose.Error())
-		}
 	}
 
 	setup := func(data test.Data, helpers test.Helpers) {
diff --git a/pkg/testutil/nerdtest/registry/docker.go b/pkg/testutil/nerdtest/registry/docker.go
index 82cde7f21d6..6e90cdfcfc9 100644
--- a/pkg/testutil/nerdtest/registry/docker.go
+++ b/pkg/testutil/nerdtest/registry/docker.go
@@ -25,15 +25,15 @@ import (
 	"gotest.tools/v3/assert"
 
 	"github.com/containerd/nerdctl/mod/tigron/test"
+	"github.com/containerd/nerdctl/mod/tigron/utils/testca"
 
-	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/ca"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/hoststoml"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/platform"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nettestutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/portlock"
 )
 
-func NewDockerRegistry(data test.Data, helpers test.Helpers, currentCA *ca.CA, port int, auth Auth) *Server {
+func NewDockerRegistry(data test.Data, helpers test.Helpers, currentCA *testca.Cert, port int, auth Auth) *Server {
 	// listen on 0.0.0.0 to enable 127.0.0.1
 	listenIP := net.ParseIP("0.0.0.0")
 	hostIP, err := nettestutil.NonLoopbackIPv4()
@@ -56,10 +56,10 @@ func NewDockerRegistry(data test.Data, helpers test.Helpers, currentCA *ca.CA, p
 		"--name", containerName,
 	}
 	scheme := "http"
-	var cert *ca.Cert
+	var cert *testca.Cert
 	if currentCA != nil {
 		scheme = "https"
-		cert = currentCA.NewCert(hostIP.String(), "127.0.0.1", "localhost", "::1")
+		cert = currentCA.GenerateServerX509(data, helpers, hostIP.String(), "127.0.0.1", "localhost", "::1")
 		args = append(args,
 			"--env", "REGISTRY_HTTP_TLS_CERTIFICATE=/registry/domain.crt",
 			"--env", "REGISTRY_HTTP_TLS_KEY=/registry/domain.key",
@@ -86,10 +86,6 @@ func NewDockerRegistry(data test.Data, helpers test.Helpers, currentCA *ca.CA, p
 		helpers.Anyhow("rm", "-f", containerName)
 		errPortRelease := portlock.Release(port)
 
-		if cert != nil {
-			assert.NilError(helpers.T(), cert.Close(), fmt.Errorf("failed cleaning certificates: %w", err))
-		}
-
 		assert.NilError(helpers.T(), errPortRelease, fmt.Errorf("failed releasing port: %w", err))
 	}
 
diff --git a/pkg/testutil/nerdtest/registry/kubo.go b/pkg/testutil/nerdtest/registry/kubo.go
index 1a9a3ca2db8..40c0f67f798 100644
--- a/pkg/testutil/nerdtest/registry/kubo.go
+++ b/pkg/testutil/nerdtest/registry/kubo.go
@@ -25,14 +25,14 @@ import (
 	"gotest.tools/v3/assert"
 
 	"github.com/containerd/nerdctl/mod/tigron/test"
+	"github.com/containerd/nerdctl/mod/tigron/utils/testca"
 
-	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/ca"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/platform"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nettestutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/portlock"
 )
 
-func NewKuboRegistry(data test.Data, helpers test.Helpers, t *testing.T, currentCA *ca.CA, port int, auth Auth) *Server {
+func NewKuboRegistry(data test.Data, helpers test.Helpers, t *testing.T, currentCA *testca.Cert, port int, auth Auth) *Server {
 	// listen on 0.0.0.0 to enable 127.0.0.1
 	listenIP := net.ParseIP("0.0.0.0")
 	hostIP, err := nettestutil.NonLoopbackIPv4()
diff --git a/pkg/testutil/nerdtest/third-party.go b/pkg/testutil/nerdtest/third-party.go
index 0a0906599e9..f845a61f84e 100644
--- a/pkg/testutil/nerdtest/third-party.go
+++ b/pkg/testutil/nerdtest/third-party.go
@@ -22,8 +22,8 @@ import (
 	"gotest.tools/v3/assert"
 
 	"github.com/containerd/nerdctl/mod/tigron/test"
+	"github.com/containerd/nerdctl/mod/tigron/utils/testca"
 
-	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/ca"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/registry"
 )
 
@@ -45,16 +45,16 @@ func KubeCtlCommand(helpers test.Helpers, args ...string) test.TestableCommand {
 }
 
 func RegistryWithTokenAuth(data test.Data, helpers test.Helpers, user, pass string, port int, tls bool) (*registry.Server, *registry.TokenAuthServer) {
-	rca := ca.New(data, helpers.T())
+	rca := testca.NewX509(data, helpers)
 	as := registry.NewCesantaAuthServer(data, helpers, rca, 0, user, pass, tls)
 	re := registry.NewDockerRegistry(data, helpers, rca, port, as.Auth)
 	return re, as
 }
 
 func RegistryWithNoAuth(data test.Data, helpers test.Helpers, port int, tls bool) *registry.Server {
-	var rca *ca.CA
+	var rca *testca.Cert
 	if tls {
-		rca = ca.New(data, helpers.T())
+		rca = testca.NewX509(data, helpers)
 	}
 	return registry.NewDockerRegistry(data, helpers, rca, port, &registry.NoAuth{})
 }
@@ -64,9 +64,9 @@ func RegistryWithBasicAuth(data test.Data, helpers test.Helpers, user, pass stri
 		Username: user,
 		Password: pass,
 	}
-	var rca *ca.CA
+	var rca *testca.Cert
 	if tls {
-		rca = ca.New(data, helpers.T())
+		rca = testca.NewX509(data, helpers)
 	}
 	return registry.NewDockerRegistry(data, helpers, rca, port, auth)
 }

From 95fc28434216721e2d63a643a419492958e4c88a Mon Sep 17 00:00:00 2001
From: Shubharanshu Mahapatra <shubhum@amazon.com>
Date: Wed, 16 Apr 2025 09:55:18 -0700
Subject: [PATCH 113/225] fix: BUILDKIT_HOST env parsing

Signed-off-by: Shubharanshu Mahapatra <shubhum@amazon.com>
---
 cmd/nerdctl/builder/builder.go              |  3 +-
 cmd/nerdctl/builder/builder_build.go        | 12 ++-
 cmd/nerdctl/builder/builder_build_test.go   | 86 +++++++++++++++++++++
 cmd/nerdctl/builder/builder_builder_test.go | 67 ++++++++++++++++
 4 files changed, 164 insertions(+), 4 deletions(-)

diff --git a/cmd/nerdctl/builder/builder.go b/cmd/nerdctl/builder/builder.go
index 46ae2cfc66d..2688be88928 100644
--- a/cmd/nerdctl/builder/builder.go
+++ b/cmd/nerdctl/builder/builder.go
@@ -58,8 +58,7 @@ func pruneCommand() *cobra.Command {
 		SilenceErrors: true,
 	}
 
-	helpers.AddStringFlag(cmd, "buildkit-host", nil, "", "BUILDKIT_HOST", "BuildKit address")
-
+	cmd.Flags().String("buildkit-host", "", "BuildKit address")
 	cmd.Flags().BoolP("all", "a", false, "Remove all unused build cache, not just dangling ones")
 	cmd.Flags().BoolP("force", "f", false, "Do not prompt for confirmation")
 	return cmd
diff --git a/cmd/nerdctl/builder/builder_build.go b/cmd/nerdctl/builder/builder_build.go
index 52a9f108620..582147589dc 100644
--- a/cmd/nerdctl/builder/builder_build.go
+++ b/cmd/nerdctl/builder/builder_build.go
@@ -44,7 +44,7 @@ If Dockerfile is not present and -f is not specified, it will look for Container
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	helpers.AddStringFlag(cmd, "buildkit-host", nil, "", "BUILDKIT_HOST", "BuildKit address")
+	cmd.Flags().String("buildkit-host", "", "BuildKit address")
 	cmd.Flags().StringArray("add-host", nil, "Add a custom host-to-IP mapping (format: \"host:ip\")")
 	cmd.Flags().StringArrayP("tag", "t", nil, "Name and optionally a tag in the 'name:tag' format")
 	cmd.Flags().StringP("file", "f", "", "Name of the Dockerfile")
@@ -242,7 +242,7 @@ func processBuildCommandFlag(cmd *cobra.Command, args []string) (types.BuilderBu
 }
 
 func GetBuildkitHost(cmd *cobra.Command, namespace string) (string, error) {
-	if cmd.Flags().Changed("buildkit-host") || os.Getenv("BUILDKIT_HOST") != "" {
+	if cmd.Flags().Changed("buildkit-host") {
 		// If address is explicitly specified, use it.
 		buildkitHost, err := cmd.Flags().GetString("buildkit-host")
 		if err != nil {
@@ -253,6 +253,14 @@ func GetBuildkitHost(cmd *cobra.Command, namespace string) (string, error) {
 		}
 		return buildkitHost, nil
 	}
+
+	if buildkitHost := os.Getenv("BUILDKIT_HOST"); buildkitHost != "" {
+		if err := buildkitutil.PingBKDaemon(buildkitHost); err != nil {
+			return "", err
+		}
+		return buildkitHost, nil
+
+	}
 	return buildkitutil.GetBuildkitHost(namespace)
 }
 
diff --git a/cmd/nerdctl/builder/builder_build_test.go b/cmd/nerdctl/builder/builder_build_test.go
index 3260be3e4ba..09ff4bfc8b4 100644
--- a/cmd/nerdctl/builder/builder_build_test.go
+++ b/cmd/nerdctl/builder/builder_build_test.go
@@ -19,6 +19,7 @@ package builder
 import (
 	"errors"
 	"fmt"
+	"path/filepath"
 	"runtime"
 	"strings"
 	"testing"
@@ -29,6 +30,7 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
+	"github.com/containerd/nerdctl/v2/pkg/buildkitutil"
 	"github.com/containerd/nerdctl/v2/pkg/platformutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
@@ -977,3 +979,87 @@ RUN ping -c 5 beta
 
 	testCase.Run(t)
 }
+
+func TestBuildWithBuildkitConfig(t *testing.T) {
+	nerdtest.Setup()
+
+	testCase := &test.Case{
+		Require: require.All(
+			nerdtest.Build,
+			require.Not(nerdtest.Docker),
+		),
+		Setup: func(data test.Data, helpers test.Helpers) {
+			dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Labels().Set("buildCtx", data.Temp().Path())
+
+		},
+		SubTests: []*test.Case{
+			{
+				Description: "build with buildkit-host",
+				Setup: func(data test.Data, helpers test.Helpers) {
+					// Get BuildkitAddr
+					buildkitAddr, err := buildkitutil.GetBuildkitHost(testutil.Namespace)
+					assert.NilError(helpers.T(), err)
+					buildkitAddr = strings.TrimPrefix(buildkitAddr, "unix://")
+
+					// Symlink the buildkit Socket for testing
+					symlinkedBuildkitAddr := filepath.Join(data.Temp().Path(), "buildkit.sock")
+
+					// Do a negative test to check the setup
+					helpers.Fail("build", "-t", data.Identifier(), "--buildkit-host", fmt.Sprintf("unix://%s", symlinkedBuildkitAddr), data.Labels().Get("buildCtx"))
+
+					// Test build with the symlinked socket
+					cmd := helpers.Custom("ln", "-s", buildkitAddr, symlinkedBuildkitAddr)
+					cmd.Run(&test.Expected{
+						ExitCode: 0,
+					})
+					helpers.Ensure("build", "-t", data.Identifier(), "--buildkit-host", fmt.Sprintf("unix://%s", symlinkedBuildkitAddr), data.Labels().Get("buildCtx"))
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--rm", data.Identifier())
+				},
+				Cleanup: func(data test.Data, helpers test.Helpers) {
+					helpers.Anyhow("rmi", "-f", data.Identifier())
+				},
+				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+			},
+			{
+				Description: "build with env specified",
+				Setup: func(data test.Data, helpers test.Helpers) {
+					// Get BuildkitAddr
+					buildkitAddr, err := buildkitutil.GetBuildkitHost(testutil.Namespace)
+					assert.NilError(helpers.T(), err)
+					buildkitAddr = strings.TrimPrefix(buildkitAddr, "unix://")
+
+					// Symlink the buildkit Socket for testing
+					symlinkedBuildkitAddr := filepath.Join(data.Temp().Path(), "buildkit-env.sock")
+
+					// Do a negative test to ensure setting up the env variable is effective
+					cmd := helpers.Command("build", "-t", data.Identifier(), data.Labels().Get("buildCtx"))
+					cmd.Setenv("BUILDKIT_HOST", fmt.Sprintf("unix://%s", symlinkedBuildkitAddr))
+					cmd.Run(&test.Expected{ExitCode: expect.ExitCodeGenericFail})
+
+					// Symlink the buildkit socket for testing
+					cmd = helpers.Custom("ln", "-s", buildkitAddr, symlinkedBuildkitAddr)
+					cmd.Run(&test.Expected{
+						ExitCode: 0,
+					})
+
+					cmd = helpers.Command("build", "-t", data.Identifier(), data.Labels().Get("buildCtx"))
+					cmd.Setenv("BUILDKIT_HOST", fmt.Sprintf("unix://%s", symlinkedBuildkitAddr))
+					cmd.Run(&test.Expected{ExitCode: expect.ExitCodeSuccess})
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--rm", data.Identifier())
+				},
+				Cleanup: func(data test.Data, helpers test.Helpers) {
+					helpers.Anyhow("rmi", "-f", data.Identifier())
+				},
+				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+			},
+		},
+	}
+	testCase.Run(t)
+}
diff --git a/cmd/nerdctl/builder/builder_builder_test.go b/cmd/nerdctl/builder/builder_builder_test.go
index fdbfa1990ac..da912cc0af9 100644
--- a/cmd/nerdctl/builder/builder_builder_test.go
+++ b/cmd/nerdctl/builder/builder_builder_test.go
@@ -19,12 +19,17 @@ package builder
 import (
 	"errors"
 	"fmt"
+	"path/filepath"
 	"strings"
 	"testing"
 
+	"gotest.tools/v3/assert"
+
+	"github.com/containerd/nerdctl/mod/tigron/expect"
 	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
+	"github.com/containerd/nerdctl/v2/pkg/buildkitutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
@@ -63,6 +68,68 @@ CMD ["echo", "nerdctl-test-builder-prune"]`, testutil.CommonImage)
 				Command:  test.Command("builder", "prune", "--force", "--all"),
 				Expected: test.Expects(0, nil, nil),
 			},
+			{
+				Description: "builder with buildkit-host",
+				NoParallel:  true,
+				Require:     require.Not(nerdtest.Docker),
+				Setup: func(data test.Data, helpers test.Helpers) {
+					// Get BuildkitAddr
+					buildkitAddr, err := buildkitutil.GetBuildkitHost(testutil.Namespace)
+					assert.NilError(helpers.T(), err)
+					buildkitAddr = strings.TrimPrefix(buildkitAddr, "unix://")
+
+					// Symlink the buildkit Socket for testing
+					symlinkedBuildkitAddr := filepath.Join(data.Temp().Path(), "buildkit.sock")
+					data.Labels().Set("symlinkedBuildkitAddr", symlinkedBuildkitAddr)
+
+					// Do a negative test to check the setup
+					helpers.Fail("builder", "prune", "--force", "--buildkit-host", fmt.Sprintf("unix://%s", symlinkedBuildkitAddr))
+
+					// Test build with the symlinked socket
+					cmd := helpers.Custom("ln", "-s", buildkitAddr, symlinkedBuildkitAddr)
+					cmd.Run(&test.Expected{
+						ExitCode: 0,
+					})
+
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("builder", "prune", "--force", "--buildkit-host", fmt.Sprintf("unix://%s", data.Labels().Get("symlinkedBuildkitAddr")))
+				},
+				Expected: test.Expects(0, nil, nil),
+			},
+			{
+				Description: "builder with env",
+				NoParallel:  true,
+				Require:     require.Not(nerdtest.Docker),
+				Setup: func(data test.Data, helpers test.Helpers) {
+					// Get BuildkitAddr
+					buildkitAddr, err := buildkitutil.GetBuildkitHost(testutil.Namespace)
+					assert.NilError(helpers.T(), err)
+					buildkitAddr = strings.TrimPrefix(buildkitAddr, "unix://")
+
+					// Symlink the buildkit Socket for testing
+					symlinkedBuildkitAddr := filepath.Join(data.Temp().Path(), "buildkit-env.sock")
+					data.Labels().Set("symlinkedBuildkitAddr", symlinkedBuildkitAddr)
+
+					// Do a negative test to ensure setting up the env variable is effective
+					cmd := helpers.Command("builder", "prune", "--force")
+					cmd.Setenv("BUILDKIT_HOST", fmt.Sprintf("unix://%s", symlinkedBuildkitAddr))
+					cmd.Run(&test.Expected{ExitCode: expect.ExitCodeGenericFail})
+
+					// Symlink the buildkit socket for testing
+					cmd = helpers.Custom("ln", "-s", buildkitAddr, symlinkedBuildkitAddr)
+					cmd.Run(&test.Expected{
+						ExitCode: 0,
+					})
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					symlinkedBuildkitAddr := data.Labels().Get("symlinkedBuildkitAddr")
+					cmd := helpers.Command("builder", "prune", "--force")
+					cmd.Setenv("BUILDKIT_HOST", fmt.Sprintf("unix://%s", symlinkedBuildkitAddr))
+					return cmd
+				},
+				Expected: test.Expects(0, nil, nil),
+			},
 			{
 				Description: "Debug",
 				// `nerdctl builder debug` is currently incompatible with `docker buildx debug`.

From b5d5f2f8cb8ae5232aa9c11fa6147169ab1132b1 Mon Sep 17 00:00:00 2001
From: Manu Gupta <manugupt1@gmail.com>
Date: Tue, 22 Apr 2025 08:07:05 -0700
Subject: [PATCH 114/225] Add provenance from github actions

Signed-off-by: Manu Gupta <manugupt1@gmail.com>
---
 .github/workflows/release.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a54ef605b42..b56e0e8d407 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,12 @@ jobs:
   release:
     runs-on: ubuntu-24.04
     timeout-minutes: 40
+    # The maximum access is "read" for PRs from public forked repos
+    # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
+    permissions:
+      contents: write  # for releases
+      id-token: write  # for provenances
+      attestations: write  # for provenances
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
@@ -39,6 +45,11 @@ jobs:
         - - -
         Release manager: [ADD YOUR NAME HERE] (@[ADD YOUR GITHUB ID HERE])
         EOF
+    - name: "Generate artifact attestation"
+      uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2  # v2.2.3
+      if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+      with:
+        subject-path: _output/*
     - name: "Create release"
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 66b6507cde51436ac159370f336c70e30415f4a2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 22 Apr 2025 23:00:18 +0000
Subject: [PATCH 115/225] build(deps): bump
 github.com/compose-spec/compose-go/v2

Bumps [github.com/compose-spec/compose-go/v2](https://github.com/compose-spec/compose-go) from 2.6.0 to 2.6.1.
- [Release notes](https://github.com/compose-spec/compose-go/releases)
- [Commits](https://github.com/compose-spec/compose-go/compare/v2.6.0...v2.6.1)

---
updated-dependencies:
- dependency-name: github.com/compose-spec/compose-go/v2
  dependency-version: 2.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 16ddec105f8..1c9bb9cfb7d 100644
--- a/go.mod
+++ b/go.mod
@@ -6,7 +6,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.3.1
 	github.com/Microsoft/go-winio v0.6.2
 	github.com/Microsoft/hcsshim v0.12.9
-	github.com/compose-spec/compose-go/v2 v2.6.0
+	github.com/compose-spec/compose-go/v2 v2.6.1
 	github.com/containerd/accelerated-container-image v1.3.0
 	github.com/containerd/cgroups/v3 v3.0.5
 	github.com/containerd/console v1.0.4
diff --git a/go.sum b/go.sum
index c8f40b1208a..0e9b9ee537b 100644
--- a/go.sum
+++ b/go.sum
@@ -21,8 +21,8 @@ github.com/cilium/ebpf v0.16.0 h1:+BiEnHL6Z7lXnlGUsXQPPAE7+kenAd4ES8MQ5min0Ok=
 github.com/cilium/ebpf v0.16.0/go.mod h1:L7u2Blt2jMM/vLAVgjxluxtBKlz3/GWjB0dMOEngfwE=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/compose-spec/compose-go/v2 v2.6.0 h1:/+oBD2ixSENOeN/TlJqWZmUak0xM8A7J08w/z661Wd4=
-github.com/compose-spec/compose-go/v2 v2.6.0/go.mod h1:vPlkN0i+0LjLf9rv52lodNMUTJF5YHVfHVGLLIP67NA=
+github.com/compose-spec/compose-go/v2 v2.6.1 h1:276YiQKRcGGtgkxiymzWHJ2CTv5joQA+7DTNrUA+rys=
+github.com/compose-spec/compose-go/v2 v2.6.1/go.mod h1:vPlkN0i+0LjLf9rv52lodNMUTJF5YHVfHVGLLIP67NA=
 github.com/containerd/accelerated-container-image v1.3.0 h1:sFbTgSuMboeKHa9f7MY11hWF1XxVWjFoiTsXYtOtvdU=
 github.com/containerd/accelerated-container-image v1.3.0/go.mod h1:EvKVWor6ZQNUyYp0MZm5hw4k21ropuz7EegM+m/Jb/Q=
 github.com/containerd/cgroups/v3 v3.0.5 h1:44na7Ud+VwyE7LIoJ8JTNQOa549a8543BmzaJHo6Bzo=

From 4372159017c5fd6016aa9a4dbfe44ee6f413d674 Mon Sep 17 00:00:00 2001
From: fahed dorgaa <fahed.dorgaa@gmail.com>
Date: Wed, 23 Apr 2025 10:41:18 +0200
Subject: [PATCH 116/225] fix: disable strict dependency enforcement for
 vagrant-libvirt plugin installation

Signed-off-by: fahed dorgaa <fahed.dorgaa@gmail.com>
---
 .github/workflows/test.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0938a736408..1e87734d697 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -401,7 +401,8 @@ jobs:
           sudo systemctl enable --now libvirtd
           sudo apt-get build-dep -qq ruby-libvirt
           sudo apt-get install -qq --no-install-recommends libxslt-dev libxml2-dev libvirt-dev ruby-bundler ruby-dev zlib1g-dev
-          sudo vagrant plugin install vagrant-libvirt
+          # Disable strict dependency enforcement to bypass gem version conflicts during the installation of the vagrant-libvirt plugin.
+          sudo env VAGRANT_DISABLE_STRICT_DEPENDENCY_ENFORCEMENT=1 vagrant plugin install vagrant-libvirt
       - name: Boot VM
         run: |
           ln -sf Vagrantfile.freebsd Vagrantfile

From c70adabf230e0c2d6c16b47864bbaec7184d95e1 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 23 Apr 2025 12:53:06 -0700
Subject: [PATCH 117/225] Shorten max lines in logs to 50 and add message

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/internal/formatter/formatter.go | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/mod/tigron/internal/formatter/formatter.go b/mod/tigron/internal/formatter/formatter.go
index f0900acbc3f..b2eb9a8868f 100644
--- a/mod/tigron/internal/formatter/formatter.go
+++ b/mod/tigron/internal/formatter/formatter.go
@@ -25,7 +25,7 @@ import (
 
 const (
 	maxLineLength = 110
-	maxLines      = 100
+	maxLines      = 50
 	kMaxLength    = 7
 	spacer        = " "
 )
@@ -107,11 +107,20 @@ func chunk(s string, maxLength, maxLines int) []string {
 		chunks = append(chunks, segment)
 	}
 
+	// If really long, preserve the starting first quarter, the trailing three quarters, and inform.
 	if len(chunks) > maxLines {
-		abbreviator := "..."
+		abbreviator := fmt.Sprintf("... %d lines are being ignored...", len(chunks)-maxLines)
 		chunks = append(
-			append(chunks[0:maxLines/2], abbreviator+strings.Repeat(spacer, maxLength-len(abbreviator))),
-			chunks[len(chunks)-maxLines/2:]...)
+			append(chunks[0:maxLines/4], abbreviator+strings.Repeat(spacer, maxLength-len(abbreviator))),
+			chunks[len(chunks)-maxLines*3/4:]...,
+		)
+		chunks = append(
+			[]string{
+				fmt.Sprintf("Actual content is %d lines long and has been abbreviated to %d\n", len(chunks), maxLines),
+				strings.Repeat(spacer, maxLength),
+			},
+			chunks...,
+		)
 	} else if len(chunks) == 0 {
 		chunks = []string{strings.Repeat(spacer, maxLength)}
 	}

From 93594d6ae9a14c2b573033c87de2cb6885be8a6d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 24 Apr 2025 22:29:51 +0000
Subject: [PATCH 118/225] build(deps): bump docker/build-push-action from
 6.15.0 to 6.16.0

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.15.0 to 6.16.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/471d1dc4e07e5cdedd4c2171150001c434f0b7a4...14487ce63c7a62a4a324b0bfb37086795e31c6c1)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 6.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/ghcr-image-build-and-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ghcr-image-build-and-publish.yml b/.github/workflows/ghcr-image-build-and-publish.yml
index 4a908c0565e..47084653b93 100644
--- a/.github/workflows/ghcr-image-build-and-publish.yml
+++ b/.github/workflows/ghcr-image-build-and-publish.yml
@@ -60,7 +60,7 @@ jobs:
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
-        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4  # v6.15.0
+        uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1  # v6.16.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64

From 70fa10d205b8f8f7f805735688e6b3382ac022b1 Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Fri, 25 Apr 2025 21:35:50 +0900
Subject: [PATCH 119/225] Bump up buildg to v0.5.2

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
---
 Dockerfile                              | 2 +-
 Dockerfile.d/SHA256SUMS.d/buildg-v0.4.1 | 2 --
 Dockerfile.d/SHA256SUMS.d/buildg-v0.5.2 | 2 ++
 3 files changed, 3 insertions(+), 3 deletions(-)
 delete mode 100644 Dockerfile.d/SHA256SUMS.d/buildg-v0.4.1
 create mode 100644 Dockerfile.d/SHA256SUMS.d/buildg-v0.5.2

diff --git a/Dockerfile b/Dockerfile
index 0f69003ac81..16b1dd7557f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -38,7 +38,7 @@ ARG CONTAINERD_FUSE_OVERLAYFS_VERSION=v2.1.2@BINARY
 # Extra deps: Init
 ARG TINI_VERSION=v0.19.0@BINARY
 # Extra deps: Debug
-ARG BUILDG_VERSION=v0.4.1@BINARY
+ARG BUILDG_VERSION=v0.5.2@BINARY
 
 # Test deps
 # Currently, the Docker Official Images and the test deps are not pinned by the hash
diff --git a/Dockerfile.d/SHA256SUMS.d/buildg-v0.4.1 b/Dockerfile.d/SHA256SUMS.d/buildg-v0.4.1
deleted file mode 100644
index e01ee1dbdc5..00000000000
--- a/Dockerfile.d/SHA256SUMS.d/buildg-v0.4.1
+++ /dev/null
@@ -1,2 +0,0 @@
-87d047c4742b904e9f0f48427aec5cd157dc96ea97cd89e3ff5b1db171c6eb5e  buildg-v0.4.1-linux-amd64.tar.gz
-44ab3251cef95f0e79e94f54113be962dacf197ad8d5c5b455aa4a6b8d566111  buildg-v0.4.1-linux-arm64.tar.gz
diff --git a/Dockerfile.d/SHA256SUMS.d/buildg-v0.5.2 b/Dockerfile.d/SHA256SUMS.d/buildg-v0.5.2
new file mode 100644
index 00000000000..bff0ce012f6
--- /dev/null
+++ b/Dockerfile.d/SHA256SUMS.d/buildg-v0.5.2
@@ -0,0 +1,2 @@
+70371949ac56d118e55306091640e63537069a538a97c151eb7475c07cb5a8a4  buildg-v0.5.2-linux-amd64.tar.gz
+9c44a5f8ecc3035998a07e1c564338205700cf5287c723e8ccba1da2815168cc  buildg-v0.5.2-linux-arm64.tar.gz
\ No newline at end of file

From 0e6f3f221494e51ee12aff24d2c415d78aa0f694 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 25 Apr 2025 22:27:32 +0000
Subject: [PATCH 120/225] build(deps): bump
 github.com/containernetworking/plugins

Bumps [github.com/containernetworking/plugins](https://github.com/containernetworking/plugins) from 1.6.2 to 1.7.1.
- [Release notes](https://github.com/containernetworking/plugins/releases)
- [Commits](https://github.com/containernetworking/plugins/compare/v1.6.2...v1.7.1)

---
updated-dependencies:
- dependency-name: github.com/containernetworking/plugins
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 10 +++++-----
 go.sum | 37 ++++++++++++++++++++-----------------
 2 files changed, 25 insertions(+), 22 deletions(-)

diff --git a/go.mod b/go.mod
index 1c9bb9cfb7d..3362fa0d988 100644
--- a/go.mod
+++ b/go.mod
@@ -26,7 +26,7 @@ require (
 	github.com/containerd/stargz-snapshotter/ipfs v0.16.3
 	github.com/containerd/typeurl/v2 v2.2.3
 	github.com/containernetworking/cni v1.3.0
-	github.com/containernetworking/plugins v1.6.2
+	github.com/containernetworking/plugins v1.7.1
 	github.com/coreos/go-iptables v0.8.0
 	github.com/coreos/go-systemd/v22 v22.5.0
 	github.com/cyphar/filepath-securejoin v0.4.1
@@ -56,7 +56,7 @@ require (
 	github.com/rootless-containers/rootlesskit/v2 v2.3.4
 	github.com/spf13/cobra v1.9.1
 	github.com/spf13/pflag v1.0.6
-	github.com/vishvananda/netlink v1.3.0
+	github.com/vishvananda/netlink v1.3.1-0.20250303224720-0e7078ed04c8
 	github.com/vishvananda/netns v0.0.5
 	github.com/yuchanns/srslog v1.1.0
 	go.uber.org/mock v0.5.1
@@ -92,7 +92,7 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.8 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
@@ -113,7 +113,7 @@ require (
 	github.com/multiformats/go-multibase v0.2.0 // indirect
 	github.com/multiformats/go-multihash v0.2.3 // indirect
 	github.com/multiformats/go-varint v0.0.7 // indirect
-	github.com/opencontainers/selinux v1.11.1 // indirect
+	github.com/opencontainers/selinux v1.12.0 // indirect
 	github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7 // indirect
 	github.com/philhofer/fwd v1.1.3-0.20240612014219-fbbf4953d986 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
@@ -136,7 +136,7 @@ require (
 	golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 // indirect
 	google.golang.org/grpc v1.69.4 // indirect
-	google.golang.org/protobuf v1.36.2 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
 	lukechampine.com/blake3 v1.3.0 // indirect
 )
 
diff --git a/go.sum b/go.sum
index 0e9b9ee537b..cde4c08c296 100644
--- a/go.sum
+++ b/go.sum
@@ -67,8 +67,8 @@ github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++
 github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
 github.com/containernetworking/cni v1.3.0 h1:v6EpN8RznAZj9765HhXQrtXgX+ECGebEYEmnuFjskwo=
 github.com/containernetworking/cni v1.3.0/go.mod h1:Bs8glZjjFfGPHMw6hQu82RUgEPNGEaBb9KS5KtNMnJ4=
-github.com/containernetworking/plugins v1.6.2 h1:pqP8Mq923TLyef5g97XfJ/xpDeVek4yF8A4mzy9Tc4U=
-github.com/containernetworking/plugins v1.6.2/go.mod h1:SP5UG3jDO9LtmfbBJdP+nl3A1atOtbj2MBOYsnaxy64=
+github.com/containernetworking/plugins v1.7.1 h1:CNAR0jviDj6FS5Vg85NTgKWLDzZPfi/lj+VJfhMDTIs=
+github.com/containernetworking/plugins v1.7.1/go.mod h1:xuMdjuio+a1oVQsHKjr/mgzuZ24leAsqUYRnzGoXHy0=
 github.com/containers/ocicrypt v1.2.1 h1:0qIOTT9DoYwcKmxSt8QJt+VzMY18onl9jUXsxpVhSmM=
 github.com/containers/ocicrypt v1.2.1/go.mod h1:aD0AAqfMp0MtwqWgHM1bUwe1anx0VazI108CRrSKINQ=
 github.com/coreos/go-iptables v0.8.0 h1:MPc2P89IhuVpLI7ETL/2tx3XZ61VeICZjYqDEgNsPRc=
@@ -152,10 +152,11 @@ github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -230,18 +231,18 @@ github.com/multiformats/go-multihash v0.2.3 h1:7Lyc8XfX/IY2jWb/gI7JP+o7JEq9hOa7B
 github.com/multiformats/go-multihash v0.2.3/go.mod h1:dXgKXCXjBzdscBLk9JkjINiEsCKRVch90MdaGiKsvSM=
 github.com/multiformats/go-varint v0.0.7 h1:sWSGR+f/eu5ABZA2ZpYKBILXTTs9JWpdEM/nEGOHFS8=
 github.com/multiformats/go-varint v0.0.7/go.mod h1:r8PUYw/fD/SjBCiKOoDlGF6QawOELpZAu9eioSos/OU=
-github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
-github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
-github.com/onsi/gomega v1.36.0 h1:Pb12RlruUtj4XUuPUqeEWc6j5DkVVVA49Uf6YLfC95Y=
-github.com/onsi/gomega v1.36.0/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
+github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus=
+github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=
+github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y=
+github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
 github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/selinux v1.11.1 h1:nHFvthhM0qY8/m+vfhJylliSshm8G1jJ2jDMcgULaH8=
-github.com/opencontainers/selinux v1.11.1/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec=
+github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8=
+github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7 h1:Dx7Ovyv/SFnMFw3fD4oEoeorXc6saIiQ23LrGLth0Gw=
@@ -292,8 +293,8 @@ github.com/tinylib/msgp v1.2.0 h1:0uKB/662twsVBpYUPbokj4sTSKhWFKB7LopO2kWK8lY=
 github.com/tinylib/msgp v1.2.0/go.mod h1:2vIGs3lcUo8izAATNobrCHevYZC/LMsJtw4JPiYPHro=
 github.com/vbatts/tar-split v0.11.6 h1:4SjTW5+PU11n6fZenf2IPoV8/tz3AaYHMWjf23envGs=
 github.com/vbatts/tar-split v0.11.6/go.mod h1:dqKNtesIOr2j2Qv3W/cHjnvk9I8+G7oAkFDFN6TCBEI=
-github.com/vishvananda/netlink v1.3.0 h1:X7l42GfcV4S6E4vHTsw48qbrV+9PVojNfIhZcwQdrZk=
-github.com/vishvananda/netlink v1.3.0/go.mod h1:i6NetklAujEcC6fK0JPjT8qSwWyO0HLn4UKG+hGqeJs=
+github.com/vishvananda/netlink v1.3.1-0.20250303224720-0e7078ed04c8 h1:Y4egeTrP7sccowz2GWTJVtHlwkZippgBTpUmMteFUWQ=
+github.com/vishvananda/netlink v1.3.1-0.20250303224720-0e7078ed04c8/go.mod h1:i6NetklAujEcC6fK0JPjT8qSwWyO0HLn4UKG+hGqeJs=
 github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
@@ -325,6 +326,8 @@ go.opentelemetry.io/otel/sdk/metric v1.31.0 h1:i9hxxLJF/9kkvfHppyLL55aW7iIJz4Jjx
 go.opentelemetry.io/otel/sdk/metric v1.31.0/go.mod h1:CRInTMVvNhUKgSAMbKyTMxqOBC0zgyxzW55lZzX43Y8=
 go.opentelemetry.io/otel/trace v1.31.0 h1:ffjsj1aRouKewfr85U2aGagJ46+MvodynlQ1HYdmJys=
 go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06FJAsO1tJg480A=
+go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
+go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.5.1 h1:ASgazW/qBmR+A32MYFDB6E2POoTgOwT509VP0CT/fjs=
@@ -442,8 +445,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.27.0 h1:qEKojBykQkQ4EynWy4S8Weg69NumxKdn40Fce3uc/8o=
-golang.org/x/tools v0.27.0/go.mod h1:sUi0ZgbwW9ZPAq26Ekut+weQPR5eIM6GQLQ1Yjm1H0Q=
+golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
+golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -471,8 +474,8 @@ google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.36.2 h1:R8FeyR1/eLmkutZOM5CWghmo5itiG9z0ktFlTVLuTmU=
-google.golang.org/protobuf v1.36.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=

From 2760aa92b1f6f270480a36bba48fbd54517d8478 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 25 Apr 2025 15:56:55 -0700
Subject: [PATCH 121/225] Enhance error information for failing logURI

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 pkg/cioutil/container_io.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cioutil/container_io.go b/pkg/cioutil/container_io.go
index 944a392b7a7..c69bfda4888 100644
--- a/pkg/cioutil/container_io.go
+++ b/pkg/cioutil/container_io.go
@@ -176,7 +176,7 @@ func NewContainerIO(namespace string, logURI string, tty bool, stdin io.Reader,
 			cmd.ExtraFiles = append(cmd.ExtraFiles, stdoutr, stderrr, w)
 
 			if err := cmd.Start(); err != nil {
-				return nil, fmt.Errorf("failed to start binary process with cmdArgs %v: %w", cmd.Args, err)
+				return nil, fmt.Errorf("failed to start binary process with cmdArgs %v (logURI: %s): %w", cmd.Args, logURI, err)
 			}
 
 			closers = append(closers, func() error { return cmd.Process.Kill() })

From b21a1c4acd927605a2438c9028984c5b47b5b148 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 24 Apr 2025 17:01:56 -0700
Subject: [PATCH 122/225] ./hack cleanup

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/lint.yml                    |  4 +-
 .github/workflows/test-canary.yml             |  6 +-
 .github/workflows/test-kube.yml               |  2 +-
 .github/workflows/test.yml                    |  2 +-
 .github/workflows/tigron.yml                  |  5 +-
 hack/build-integration-canary.sh              | 24 ------
 hack/provisioning/README.md                   | 15 ++++
 .../kube/kind.sh}                             | 32 ++++----
 hack/{ => provisioning/kube}/kind.yaml        |  0
 hack/provisioning/linux/cni.sh                | 51 +++++++++++++
 hack/provisioning/linux/containerd.sh         | 76 +++++++++++++++++++
 hack/provisioning/version/fetch.sh            | 62 +++++++++++++++
 hack/provisioning/windows/cni.sh              |  7 +-
 .../windows/containerd.ps1}                   |  2 -
 hack/scripts/lib.sh                           | 38 +++++++---
 15 files changed, 258 insertions(+), 68 deletions(-)
 create mode 100644 hack/provisioning/README.md
 rename hack/{build-integration-kubernetes.sh => provisioning/kube/kind.sh} (81%)
 rename hack/{ => provisioning/kube}/kind.yaml (100%)
 create mode 100755 hack/provisioning/linux/cni.sh
 create mode 100755 hack/provisioning/linux/containerd.sh
 create mode 100755 hack/provisioning/version/fetch.sh
 rename hack/{configure-windows-ci.ps1 => provisioning/windows/containerd.ps1} (89%)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index b79138a70d9..3bda482409d 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -45,8 +45,8 @@ jobs:
         run: |
           # If canary is specified, get the latest available golang pre-release instead of the major version
           if [ "${{ matrix.canary }}" != "" ]; then
-            . ./hack/build-integration-canary.sh
-            canary::golang::latest
+            . ./hack/provisioning/version/fetch.sh
+            printf "GO_VERSION=%s\n" "$(go::canary::for::go-setup)" >> "$GITHUB_ENV"
           fi
       - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
diff --git a/.github/workflows/test-canary.yml b/.github/workflows/test-canary.yml
index ffd14400c26..39b32d21783 100644
--- a/.github/workflows/test-canary.yml
+++ b/.github/workflows/test-canary.yml
@@ -68,8 +68,8 @@ jobs:
           ctd_v="$("${args[@]}" https://api.github.com/repos/containerd/containerd/tags | jq -rc .[0].name)"
           echo "CONTAINERD_VERSION=${ctd_v:1}" >> "$GITHUB_ENV"
 
-          . ./hack/build-integration-canary.sh
-          canary::golang::latest
+          . ./hack/provisioning/version/fetch.sh
+          printf "GO_VERSION=%s\n" "$(go::canary::for::go-setup)" >> "$GITHUB_ENV"
       - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
@@ -82,7 +82,7 @@ jobs:
       - name: "Set up containerd"
         env:
           ctrdVersion: ${{ env.CONTAINERD_VERSION }}
-        run: powershell hack/configure-windows-ci.ps1
+        run: powershell hack/provisioning/windows/containerd.ps1
       - name: "Run integration tests"
         run: ./hack/test-integration.sh -test.only-flaky=false
       - name: "Run integration tests (flaky)"
diff --git a/.github/workflows/test-kube.yml b/.github/workflows/test-kube.yml
index 57871c3abee..7fd8d880f89 100644
--- a/.github/workflows/test-kube.yml
+++ b/.github/workflows/test-kube.yml
@@ -23,5 +23,5 @@ jobs:
       - name: "Run Kubernetes integration tests"
         # See https://github.com/containerd/nerdctl/blob/main/docs/testing/README.md#about-parallelization
         run: |
-          ./hack/build-integration-kubernetes.sh
+          ./hack/provisioning/kube/kind.sh
           sudo ./_output/nerdctl exec nerdctl-test-control-plane bash -c -- 'export TMPDIR="$HOME"/tmp; mkdir -p "$TMPDIR"; cd /nerdctl-source; /usr/local/go/bin/go test -p 1 ./cmd/nerdctl/... -test.only-kubernetes'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1e87734d697..53bc9a45bf8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -369,7 +369,7 @@ jobs:
       - name: "Set up containerd"
         env:
           ctrdVersion: 1.7.27
-        run: powershell hack/configure-windows-ci.ps1
+        run: powershell hack/provisioning/windows/containerd.ps1
       - name: "Run integration tests"
         run: ./hack/test-integration.sh -test.only-flaky=false
       - name: "Run integration tests (flaky)"
diff --git a/.github/workflows/tigron.yml b/.github/workflows/tigron.yml
index dd0cc615167..5915adae0ad 100644
--- a/.github/workflows/tigron.yml
+++ b/.github/workflows/tigron.yml
@@ -37,10 +37,9 @@ jobs:
           fetch-depth: 100
       - name: "Set GO env"
         run: |
-          # If canary is specified, get the latest available golang pre-release instead of the major version
           if [ "${{ matrix.canary }}" != "" ]; then
-            . ./hack/build-integration-canary.sh
-            canary::golang::latest
+            . ./hack/provisioning/version/fetch.sh
+            printf "GO_VERSION=%s\n" "$(go::canary::for::go-setup)" >> "$GITHUB_ENV"
           fi
       - name: "Install go"
         uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
diff --git a/hack/build-integration-canary.sh b/hack/build-integration-canary.sh
index ff53db891a0..ae205c90bed 100755
--- a/hack/build-integration-canary.sh
+++ b/hack/build-integration-canary.sh
@@ -323,27 +323,3 @@ canary::golang::hublatest(){
 
   printf "%s" "$available_version"
 }
-
-canary::golang::latest(){
-  # Enable extended globbing features to use advanced pattern matching
-  shopt -s extglob
-
-  # Get latest golang version and split it in components
-  norm=()
-  while read -r line; do
-    line_trimmed="${line//+([[:space:]])/}"
-    norm+=("$line_trimmed")
-  done < \
-    <(sed -E 's/^go([0-9]+)[.]([0-9]+)([.]([0-9]+))?(([a-z]+)([0-9]+))?/\1.\2\n\4\n\6\n\7/i' \
-      <(curl -fsSL "https://go.dev/dl/?mode=json&include=all" | jq -rc .[0].version) \
-    )
-
-  # Serialize version, making sure we have a patch version, and separate possible rcX into .rc-X
-  [ "${norm[1]}" != "" ] || norm[1]="0"
-  norm[1]=".${norm[1]}"
-  [ "${norm[2]}" == "" ] || norm[2]="-${norm[2]}"
-  [ "${norm[3]}" == "" ] || norm[3]=".${norm[3]}"
-  # Save it
-  IFS=
-  echo "GO_VERSION=${norm[*]}" >> "$GITHUB_ENV"
-}
diff --git a/hack/provisioning/README.md b/hack/provisioning/README.md
new file mode 100644
index 00000000000..314ffc9fed4
--- /dev/null
+++ b/hack/provisioning/README.md
@@ -0,0 +1,15 @@
+# Dependencies provisioning for integration testing
+
+This folder provides a set of scripts useful (for the CI) to configure hosts for
+the purpose of testing.
+
+While this is agnostic and would (probably) work outside the context of GitHub Actions,
+this is not the right way for people to install a functioning stack.
+Use provided installation scripts instead (see user documentation).
+
+## Contents
+
+- `/version` allows retrieving latest (or experimental) versions of certain products (golang, containerd, etc)
+- `/linux` allows updating in-place containerd, cni (future: buildkit)
+- `/windows` allows install WinCNI, containerd
+- `/kube` allows spinning-up a Kind cluster
\ No newline at end of file
diff --git a/hack/build-integration-kubernetes.sh b/hack/provisioning/kube/kind.sh
similarity index 81%
rename from hack/build-integration-kubernetes.sh
rename to hack/provisioning/kube/kind.sh
index d2aa564a551..1260758dfa0 100755
--- a/hack/build-integration-kubernetes.sh
+++ b/hack/provisioning/kube/kind.sh
@@ -14,16 +14,19 @@
 #   See the License for the specific language governing permissions and
 #   limitations under the License.
 
-# shellcheck disable=SC2034,SC2015
 set -o errexit -o errtrace -o functrace -o nounset -o pipefail
 root="$(cd "$(dirname "${BASH_SOURCE[0]:-$PWD}")" 2>/dev/null 1>&2 && pwd)"
 readonly root
 # shellcheck source=/dev/null
-. "$root/scripts/lib.sh"
+. "$root/../../scripts/lib.sh"
 
 GO_VERSION=1.24
 KIND_VERSION=v0.27.0
-CNI_PLUGINS_VERSION=v1.6.2
+CNI_PLUGINS_VERSION=v1.7.1
+# shellcheck disable=SC2034
+CNI_PLUGINS_SHA_AMD64=1a28a0506bfe5bcdc981caf1a49eeab7e72da8321f1119b7be85f22621013098
+# shellcheck disable=SC2034
+CNI_PLUGINS_SHA_ARM64=119fcb508d1ac2149e49a550752f9cd64d023a1d70e189b59c476e4d2bf7c497
 
 [ "$(uname -m)" == "aarch64" ] && GOARCH=arm64 || GOARCH=amd64
 
@@ -55,19 +58,6 @@ install::kubectl(){
   host::install "$temp"/kubectl
 }
 
-install::cni(){
-  local version="$1"
-  local temp
-  temp="$(fs::mktemp "install")"
-
-  http::get "$temp"/cni.tgz "https://github.com/containernetworking/plugins/releases/download/$version/cni-plugins-${GOOS:-linux}-${GOARCH:-amd64}-$version.tgz"
-  sudo mkdir -p /opt/cni/bin
-  sudo tar xzf "$temp"/cni.tgz -C /opt/cni/bin
-  mkdir -p ~/opt/cni/bin
-  tar xzf "$temp"/cni.tgz -C ~/opt/cni/bin
-  rm "$temp"/cni.tgz
-}
-
 exec::kind(){
   local args=()
   [ ! "$_rootful" ] || args=(sudo env PATH="$PATH" KIND_EXPERIMENTAL_PROVIDER="$KIND_EXPERIMENTAL_PROVIDER")
@@ -92,16 +82,20 @@ main(){
   configure::rootful "${ROOTFUL:-}"
 
   log::info "Installing host dependencies if necessary"
+  host::require make go
   host::require kind 2>/dev/null || install::kind "$KIND_VERSION"
   host::require kubectl 2>/dev/null || install::kubectl
 
   # Build nerdctl to use for kind
-  make binaries
+  make -f "$root/../../../Makefile" binaries
   PATH=$(pwd)/_output:"$PATH"
   export PATH
 
   # Add CNI plugins
-  install::cni "$CNI_PLUGINS_VERSION"
+  local sha
+  sha="CNI_PLUGINS_SHA_$(tr "[:lower:]" "[:upper:]" <<<"$GOARCH")"
+  # shellcheck source=/dev/null
+  "$root"/../linux/cni.sh "$CNI_PLUGINS_VERSION" "$GOARCH" "${!sha}"
 
   # Hack to get go into kind control plane
   exec::nerdctl rm -f go-kind 2>/dev/null || true
@@ -113,7 +107,7 @@ main(){
   log::info "Creating new cluster"
   export KIND_EXPERIMENTAL_PROVIDER=nerdctl
   exec::kind delete cluster --name nerdctl-test 2>/dev/null || true
-  exec::kind create cluster --name nerdctl-test --config=./hack/kind.yaml
+  exec::kind create cluster --name nerdctl-test --config="$root"/kind.yaml
 }
 
 main "$@"
diff --git a/hack/kind.yaml b/hack/provisioning/kube/kind.yaml
similarity index 100%
rename from hack/kind.yaml
rename to hack/provisioning/kube/kind.yaml
diff --git a/hack/provisioning/linux/cni.sh b/hack/provisioning/linux/cni.sh
new file mode 100755
index 00000000000..aaee9ad7fe0
--- /dev/null
+++ b/hack/provisioning/linux/cni.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+set -o errexit -o errtrace -o functrace -o nounset -o pipefail
+root="$(cd "$(dirname "${BASH_SOURCE[0]:-$PWD}")" 2>/dev/null 1>&2 && pwd)"
+readonly root
+# shellcheck source=/dev/null
+. "$root/../../scripts/lib.sh"
+
+provision::cni::uninstall(){
+  [ "$(id -u)" == 0 ] || {
+    log::error "You need to be root"
+    return 1
+  }
+
+  rm -Rf /opt/cni/bin
+}
+
+# provision::containerd::cni will retrieve a specific version of cni plugins and extract it in place on the host
+provision::cni(){
+  local version="$1"
+  local arch="$2"
+  local bin_sha="$3"
+
+  cd "$(fs::mktemp "cni-install")"
+
+  http::get::secure \
+    cni.tgz \
+    https://github.com/containernetworking/plugins/releases/download/"$version"/cni-plugins-linux-"$arch"-"$version".tgz \
+    "$bin_sha"
+
+  sudo mkdir -p /opt/cni/bin
+  sudo tar -C /opt/cni/bin -xzf cni.tgz
+
+  cd - >/dev/null
+}
+
+provision::cni "$1" "$2" "$3"
\ No newline at end of file
diff --git a/hack/provisioning/linux/containerd.sh b/hack/provisioning/linux/containerd.sh
new file mode 100755
index 00000000000..f49ef9c9cc0
--- /dev/null
+++ b/hack/provisioning/linux/containerd.sh
@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+set -o errexit -o errtrace -o functrace -o nounset -o pipefail
+root="$(cd "$(dirname "${BASH_SOURCE[0]:-$PWD}")" 2>/dev/null 1>&2 && pwd)"
+readonly root
+# shellcheck source=/dev/null
+. "$root/../../scripts/lib.sh"
+
+# provision::containerd::uninstall will ensure deb containerd are purged
+provision::containerd::uninstall(){
+  [ "$(id -u)" == 0 ] || {
+    log::error "You need to be root"
+    return 1
+  }
+
+  # Purge deb package
+  apt-get -q purge containerd* 2>/dev/null || true
+  # Remove conf
+  rm -f /etc/containerd/containerd.toml
+  # Remove manually installed containerd if leftover
+  systemctl stop containerd 2>/dev/null
+  rm -f /lib/systemd/system/containerd.service
+  systemctl daemon-reload 2>/dev/null || true
+  ! command -v containerd || rm -f "$(which containerd)"
+}
+
+# provision::containerd::rootful will retrieve a specific version of containerd and install it on the host.
+provision::containerd::rootful(){
+  local version="$1"
+  local arch="$2"
+  local bin_sha="$3"
+  local service_sha="$4"
+
+  # Be tolerant with passed versions - with or without leading "v"
+  [ "${version:0:1}" != "v" ] || version="${version:1}"
+
+  cd "$(fs::mktemp "containerd-install")"
+
+  # Get the binary and install it
+  http::get::secure \
+    containerd.tar.gz \
+    https://github.com/containerd/containerd/releases/download/v"$version"/containerd-"$version"-linux-"$arch".tar.gz \
+    "$bin_sha"
+
+  sudo tar::expand /usr/local containerd.tar.gz
+
+  # Get the systemd unit
+  http::get::secure \
+    containerd.service \
+    https://raw.githubusercontent.com/containerd/containerd/refs/tags/v"$version"/containerd.service \
+    "$service_sha"
+
+  sudo cp containerd.service /lib/systemd/system/containerd.service
+
+  # Start it
+  sudo systemctl daemon-reload
+  sudo systemctl start containerd
+
+  cd - >/dev/null || true
+}
+
+provision::containerd::rootful "$1" "$2" "$3" "$4"
\ No newline at end of file
diff --git a/hack/provisioning/version/fetch.sh b/hack/provisioning/version/fetch.sh
new file mode 100755
index 00000000000..3145d2670be
--- /dev/null
+++ b/hack/provisioning/version/fetch.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+set -o errexit -o errtrace -o functrace -o nounset -o pipefail
+
+# go::canary::for::go-setup retrieves the latest unstable golang version and format it for use by
+# https://github.com/actions/setup-go
+# Note that if the latest unstable is an old RC for the current stable, we print the empty string.
+go::canary::for::go-setup(){
+  local all_versions
+  local stable_major_minor
+  local canary_major_minor
+  local canary_full_version
+
+  # Get all golang versions
+  all_versions="$(curl -fsSL --proto '=https' --tlsv1.2 "https://go.dev/dl/?mode=json&include=all")"
+
+  # Get the latest stable release major.minor for comparison
+  read -r stable_major_minor < \
+    <(sed -E 's/^go([0-9]+[.][0-9]+).*/\1/i' \
+      <(jq -rc 'map(select(.stable==true)).[0].version' <<<"$all_versions") \
+    )
+
+  # Get the latest unstable release major.minor, and full version (formatted for use by go-setup)
+  read -r canary_major_minor canary_full_version < \
+    <(sed -E 's/^go([0-9]+)[.]([0-9]+)(([a-z]+)([0-9]+))?/\1.\2 \1.\2.0-\4.\5/i' \
+      <(jq -rc 'map(select(.stable==false)).[0].version' <<<"$all_versions") \
+    )
+
+  # If the latest RC is for the same major.minor as the latest stable one, then there is no canary, return empty string
+  [ "$canary_major_minor" != "$stable_major_minor" ] || return 0
+
+  # Otherwise, print the full version
+  printf "%s" "$canary_full_version"
+}
+
+# github::project::latest retrieves the latest tag from a github project
+github::project::latest(){
+  local project="$1"
+  local args
+
+  # Get latest
+  args=(curl -fsSL --proto '=https' --tlsv1.2 -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28")
+  [ "${GITHUB_TOKEN:-}" == "" ] && {
+    >&2 printf "GITHUB_TOKEN is not set - you might face rate limitations with the Github API\n"
+  } || args+=(-H "Authorization: Bearer $GITHUB_TOKEN")
+
+  "${args[@]}" https://api.github.com/repos/"$project"/tags | jq -rc .[0].name
+}
\ No newline at end of file
diff --git a/hack/provisioning/windows/cni.sh b/hack/provisioning/windows/cni.sh
index 8f6aae4323f..2c1b90ce40b 100755
--- a/hack/provisioning/windows/cni.sh
+++ b/hack/provisioning/windows/cni.sh
@@ -16,11 +16,9 @@
 
 # adapted from: https://raw.githubusercontent.com/containerd/containerd/refs/tags/v2.0.3/script/setup/install-cni-windows
 
-#shellcheck disable=SC2154
 set -o errexit -o errtrace -o functrace -o nounset -o pipefail
 
-# FIXME: make this configurable
-WINCNI_VERSION=v0.3.1
+WINCNI_VERSION="${WINCNI_VERSION:-v0.3.1}"
 
 git config --global advice.detachedHead false
 
@@ -28,7 +26,7 @@ DESTDIR="${DESTDIR:-"C:\\Program Files\\containerd\\cni"}"
 WINCNI_BIN_DIR="${DESTDIR}/bin"
 WINCNI_PKG=github.com/Microsoft/windows-container-networking
 
-git clone --depth 1 --branch "${WINCNI_VERSION}" "https://${WINCNI_PKG}.git" "${GOPATH}/src/${WINCNI_PKG}"
+git clone --quiet --depth 1 --branch "${WINCNI_VERSION}" "https://${WINCNI_PKG}.git" "${GOPATH}/src/${WINCNI_PKG}"
 cd "${GOPATH}/src/${WINCNI_PKG}"
 make all
 install -D -m 755 "out/nat.exe" "${WINCNI_BIN_DIR}/nat.exe"
@@ -62,6 +60,7 @@ calculate_subnet() {
       mask=0
     fi
     (( len -= 8 ))
+    #shellcheck disable=SC2154
     result_array[i]=$(( gateway_array[i] & mask ))
   done
   result="$(printf ".%s" "${result_array[@]}")"
diff --git a/hack/configure-windows-ci.ps1 b/hack/provisioning/windows/containerd.ps1
similarity index 89%
rename from hack/configure-windows-ci.ps1
rename to hack/provisioning/windows/containerd.ps1
index c3505c269b4..56f4219008c 100644
--- a/hack/configure-windows-ci.ps1
+++ b/hack/provisioning/windows/containerd.ps1
@@ -1,5 +1,3 @@
-# To install CNI, see https://github.com/containerd/containerd/blob/release/1.7/script/setup/install-cni-windows
-
 $ErrorActionPreference = "Stop"
 
 #install containerd
diff --git a/hack/scripts/lib.sh b/hack/scripts/lib.sh
index c29b056ea70..8eb93ca527a 100755
--- a/hack/scripts/lib.sh
+++ b/hack/scripts/lib.sh
@@ -83,11 +83,18 @@ log::error(){
 
 # Helpers
 host::require(){
-  local binary="$1"
+  local binary
+
+  miss=
+  for binary in "$@"; do
+    log::debug "Checking presence of $binary"
+    command -v "$binary" >/dev/null || {
+      miss+="$binary"
+    }
+  done
 
-  log::debug "Checking presence of $binary"
-  command -v "$binary" >/dev/null || {
-    log::error "You need $binary for this script to work, and it cannot be found in your path"
+  [ "$miss" == "" ] || {
+    log::error "For this script to work, you need: $miss (could not find them in your path)"
     return 1
   }
 }
@@ -160,6 +167,23 @@ http::get(){
   _http::get "$url" "$output" "2" "1" "" "" "$@"
 }
 
+http::get::secure(){
+  local output="$1"
+  local url="$2"
+  local sha="$3"
+  shift
+  shift
+  shift
+
+  _http::get "$url" "$output" "2" "1" "" "" "$@"
+  shasum -a 256 -c <<<"$sha  $output" || {
+    ret=$?
+    log::error "Expected sha: $sha"
+    log::error "Actual sha: $(shasum -a 256 "$output")"
+    return $ret
+  }
+}
+
 http::healthcheck(){
   local url="$1"
   local retry="${2:-5}"
@@ -182,8 +206,6 @@ http::checksum(){
   local temp
   temp="$(fs::mktemp "http-checksum")"
 
-  host::require shasum
-
   for url in "${urls[@]}"; do
     http::get "$temp/${url##*/}" "$url"
   done
@@ -232,6 +254,4 @@ github::releases::latest(){
 }
 
 log::init
-host::require jq
-host::require tar
-host::require curl
+host::require jq tar curl shasum

From 7e41456136fcb625a8add52cb721464f07811d00 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 25 Apr 2025 15:23:25 -0700
Subject: [PATCH 123/225] Move netutil flock to subdirectory

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 pkg/lockutil/lockutil_unix.go |  2 ++
 pkg/netutil/netutil.go        |  9 +++++----
 pkg/netutil/netutil_test.go   | 12 ++++++------
 pkg/ocihook/ocihook.go        |  2 +-
 4 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/pkg/lockutil/lockutil_unix.go b/pkg/lockutil/lockutil_unix.go
index de99ca9a4e1..c4655c58b6c 100644
--- a/pkg/lockutil/lockutil_unix.go
+++ b/pkg/lockutil/lockutil_unix.go
@@ -28,6 +28,7 @@ import (
 )
 
 func WithDirLock(dir string, fn func() error) error {
+	_ = os.MkdirAll(dir, 0700)
 	dirFile, err := os.Open(dir)
 	if err != nil {
 		return err
@@ -55,6 +56,7 @@ func flock(f *os.File, flags int) error {
 }
 
 func Lock(dir string) (*os.File, error) {
+	_ = os.MkdirAll(dir, 0700)
 	dirFile, err := os.Open(dir)
 	if err != nil {
 		return nil, err
diff --git a/pkg/netutil/netutil.go b/pkg/netutil/netutil.go
index f6e62fb2147..e97a9125c58 100644
--- a/pkg/netutil/netutil.go
+++ b/pkg/netutil/netutil.go
@@ -56,7 +56,8 @@ func (e *CNIEnv) ListNetworksMatch(reqs []string, allowPseudoNetwork bool) (list
 	var err error
 
 	var networkConfigs []*NetworkConfig
-	err = lockutil.WithDirLock(e.NetconfPath, func() error {
+	// NOTE: we cannot lock NetconfPath directly, as Cilium (maybe others) are also locking it.
+	err = lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), func() error {
 		networkConfigs, err = e.networkConfigList()
 		return err
 	})
@@ -220,7 +221,7 @@ func (e *CNIEnv) NetworkList() ([]*NetworkConfig, error) {
 		netConfigList, err = e.networkConfigList()
 		return err
 	}
-	err = lockutil.WithDirLock(e.NetconfPath, fn)
+	err = lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), fn)
 
 	return netConfigList, err
 }
@@ -336,7 +337,7 @@ func (e *CNIEnv) CreateNetwork(opts types.NetworkCreateOptions) (*NetworkConfig,
 		}
 		return e.writeNetworkConfig(netConf)
 	}
-	err := lockutil.WithDirLock(e.NetconfPath, fn)
+	err := lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), fn)
 	if err != nil {
 		return nil, err
 	}
@@ -350,7 +351,7 @@ func (e *CNIEnv) RemoveNetwork(net *NetworkConfig) error {
 		}
 		return net.clean()
 	}
-	return lockutil.WithDirLock(e.NetconfPath, fn)
+	return lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), fn)
 }
 
 // GetDefaultNetworkConfig checks whether the default network exists
diff --git a/pkg/netutil/netutil_test.go b/pkg/netutil/netutil_test.go
index 399a33ee436..6b53ffd46b4 100644
--- a/pkg/netutil/netutil_test.go
+++ b/pkg/netutil/netutil_test.go
@@ -196,9 +196,9 @@ func testDefaultNetworkCreation(t *testing.T) {
 	}
 	err = filepath.Walk(cniConfTestDir, walkF)
 	assert.NilError(t, err)
-	assert.Assert(t, len(files) == 2) // files[0] is the entry for '.'
-	assert.Assert(t, filepath.Join(cniConfTestDir, files[1].Name()) == defaultNetConf.File)
-	assert.Assert(t, firstConfigModTime.Equal(files[1].ModTime()))
+	assert.Equal(t, len(files), 3) // files[0] is the entry for '.', files[1] is the lock
+	assert.Assert(t, filepath.Join(cniConfTestDir, files[2].Name()) == defaultNetConf.File)
+	assert.Assert(t, firstConfigModTime.Equal(files[2].ModTime()))
 }
 
 // Tests whether nerdctl properly creates the default network
@@ -295,9 +295,9 @@ func testDefaultNetworkCreationWithBridgeIP(t *testing.T) {
 	}
 	err = filepath.Walk(cniConfTestDir, walkF)
 	assert.NilError(t, err)
-	assert.Assert(t, len(files) == 2) // files[0] is the entry for '.'
-	assert.Assert(t, filepath.Join(cniConfTestDir, files[1].Name()) == defaultNetConf.File)
-	assert.Assert(t, firstConfigModTime.Equal(files[1].ModTime()))
+	assert.Equal(t, len(files), 3) // files[0] is the entry for '.', files[1] is the lock
+	assert.Assert(t, filepath.Join(cniConfTestDir, files[2].Name()) == defaultNetConf.File)
+	assert.Assert(t, firstConfigModTime.Equal(files[2].ModTime()))
 }
 
 // Tests whether nerdctl skips the creation of the default network if a
diff --git a/pkg/ocihook/ocihook.go b/pkg/ocihook/ocihook.go
index 1673004cec1..2807b23e9d8 100644
--- a/pkg/ocihook/ocihook.go
+++ b/pkg/ocihook/ocihook.go
@@ -107,7 +107,7 @@ func Run(stdin io.Reader, stderr io.Writer, event, dataStore, cniPath, cniNetcon
 	if err != nil {
 		return err
 	}
-	lock, err := lockutil.Lock(cniNetconfPath)
+	lock, err := lockutil.Lock(filepath.Join(cniNetconfPath, ".nerdctl.lock"))
 	if err != nil {
 		return err
 	}

From 5aaad8098e4f1f5075dc827ebe590d12885d1317 Mon Sep 17 00:00:00 2001
From: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Date: Fri, 25 Apr 2025 21:36:54 +0900
Subject: [PATCH 124/225] Add --buildg-startup-timeout flag

This also extends buildg's default timeout value to 1m

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
---
 cmd/nerdctl/builder/builder.go | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/cmd/nerdctl/builder/builder.go b/cmd/nerdctl/builder/builder.go
index 2688be88928..6154090affd 100644
--- a/cmd/nerdctl/builder/builder.go
+++ b/cmd/nerdctl/builder/builder.go
@@ -21,6 +21,7 @@ import (
 	"os"
 	"os/exec"
 	"strings"
+	"time"
 
 	"github.com/docker/go-units"
 	"github.com/spf13/cobra"
@@ -146,6 +147,7 @@ func debugCommand() *cobra.Command {
 	cmd.Flags().String("image", "", "Image to use for debugging stage")
 	cmd.Flags().StringArray("ssh", nil, "Allow forwarding SSH agent to the build. Format: default|<id>[=<socket>|<key>[,<key>]]")
 	cmd.Flags().StringArray("secret", nil, "Expose secret value to the build. Format: id=secretname,src=filepath")
+	helpers.AddDurationFlag(cmd, "buildg-startup-timeout", nil, 1*time.Minute, "", "Timeout for starting up buildg")
 	return cmd
 }
 
@@ -167,6 +169,12 @@ func debugAction(cmd *cobra.Command, args []string) error {
 		buildgArgs = append([]string{"--debug"}, buildgArgs...)
 	}
 
+	startupTimeout, err := cmd.Flags().GetDuration("buildg-startup-timeout")
+	if err != nil {
+		return err
+	}
+	buildgArgs = append(buildgArgs, "--startup-timeout="+startupTimeout.String())
+
 	if file, err := cmd.Flags().GetString("file"); err != nil {
 		return err
 	} else if file != "" {

From d8ef3665f6c842f57026ac30568dddf001285e2e Mon Sep 17 00:00:00 2001
From: Ruihua Wen <spiffyeight77@gmail.com>
Date: Sun, 16 Mar 2025 15:58:41 +0900
Subject: [PATCH 125/225] feat: add --details flag to logs command

Signed-off-by: Ruihua Wen <spiffyeight77@gmail.com>
---
 cmd/nerdctl/container/container_logs.go      |  6 ++
 cmd/nerdctl/container/container_logs_test.go | 28 +++++++
 docs/command-reference.md                    |  7 +-
 pkg/api/types/container_types.go             |  2 +
 pkg/cmd/container/logs.go                    | 87 ++++++++++++++++++++
 pkg/logging/detail_writer.go                 | 42 ++++++++++
 pkg/logging/journald_logger.go               |  2 +
 pkg/logging/json_logger.go                   |  2 +
 pkg/logging/log_viewer.go                    | 14 ++++
 pkg/logging/logging.go                       |  2 +
 10 files changed, 190 insertions(+), 2 deletions(-)
 create mode 100644 pkg/logging/detail_writer.go

diff --git a/cmd/nerdctl/container/container_logs.go b/cmd/nerdctl/container/container_logs.go
index 4c8a3095bb9..0543e97e0eb 100644
--- a/cmd/nerdctl/container/container_logs.go
+++ b/cmd/nerdctl/container/container_logs.go
@@ -53,6 +53,7 @@ The following containers are supported:
 	cmd.Flags().StringP("tail", "n", "all", "Number of lines to show from the end of the logs")
 	cmd.Flags().String("since", "", "Show logs since timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)")
 	cmd.Flags().String("until", "", "Show logs before a timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)")
+	cmd.Flags().Bool("details", false, "Show extra details provided to logs")
 	return cmd
 }
 
@@ -88,6 +89,10 @@ func logsOptions(cmd *cobra.Command) (types.ContainerLogsOptions, error) {
 	if err != nil {
 		return types.ContainerLogsOptions{}, err
 	}
+	details, err := cmd.Flags().GetBool("details")
+	if err != nil {
+		return types.ContainerLogsOptions{}, err
+	}
 	return types.ContainerLogsOptions{
 		Stdout:     cmd.OutOrStdout(),
 		Stderr:     cmd.OutOrStderr(),
@@ -97,6 +102,7 @@ func logsOptions(cmd *cobra.Command) (types.ContainerLogsOptions, error) {
 		Tail:       tail,
 		Since:      since,
 		Until:      until,
+		Details:    details,
 	}, nil
 }
 
diff --git a/cmd/nerdctl/container/container_logs_test.go b/cmd/nerdctl/container/container_logs_test.go
index 76fe2f96fd6..033c4127be3 100644
--- a/cmd/nerdctl/container/container_logs_test.go
+++ b/cmd/nerdctl/container/container_logs_test.go
@@ -355,3 +355,31 @@ func TestNoneLoggerHasNoLogURI(t *testing.T) {
 	testCase.Expected = test.Expects(1, nil, nil)
 	testCase.Run(t)
 }
+
+func TestLogsWithDetails(t *testing.T) {
+	testCase := nerdtest.Setup()
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		helpers.Ensure("run", "-d", "--log-driver", "json-file",
+			"--log-opt", "max-size=10m",
+			"--log-opt", "max-file=3",
+			"--log-opt", "env=ENV",
+			"--env", "ENV=foo",
+			"--log-opt", "labels=LABEL",
+			"--label", "LABEL=bar",
+			"--name", data.Identifier(), testutil.CommonImage,
+			"sh", "-ec", "echo baz")
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rm", "-f", data.Identifier())
+	}
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		return helpers.Command("logs", "--details", data.Identifier())
+	}
+
+	testCase.Expected = test.Expects(0, nil, expect.Contains("ENV=foo", "LABEL=bar", "baz"))
+
+	testCase.Run(t)
+}
diff --git a/docs/command-reference.md b/docs/command-reference.md
index dc9cdc786fc..3f516ff3677 100644
--- a/docs/command-reference.md
+++ b/docs/command-reference.md
@@ -328,8 +328,12 @@ Logging flags:
       - :nerd_face: `--log-opt=log-path=<LOG-PATH>`: The log path where the logs are written. The path will be created if it does not exist. If the log file exists, the old file will be renamed to `<LOG-PATH>.1`.
         - Default: `<data-root>/<containerd-socket-hash>/<namespace>/<container-id>/<container-id>-json.log`
         - Example: `/var/lib/nerdctl/1935db59/containers/default/<container-id>/<container-id>-json.log`
+      - :whale: `--log-opt labels=production_status,geo`: A comma-separated list of logging-related labels this daemon accepts.
+      - :whale: `--log-opt env=os,customer`: A comma-separated list of logging-related environment variables this daemon accepts.
   - :whale: `--log-driver=journald`: Writes log messages to `journald`. The `journald` daemon must be running on the host machine.
     - :whale: `--log-opt=tag=<TEMPLATE>`: Specify template to set `SYSLOG_IDENTIFIER` value in journald logs.
+    - :whale: `--log-opt labels=production_status,geo`: A comma-separated list of logging-related labels this daemon accepts.
+    - :whale: `--log-opt env=os,customer`: A comma-separated list of logging-related environment variables this daemon accepts.
   - :whale: `--log-driver=fluentd`: Writes log messages to `fluentd`. The `fluentd` daemon must be running on the host machine.
     - The `fluentd` logging driver supports the following logging options:
       - :whale: `--log-opt=fluentd-address=<ADDRESS>`: The address of the `fluentd` daemon, tcp(default) and unix sockets are supported..
@@ -542,14 +546,13 @@ Usage: `nerdctl logs [OPTIONS] CONTAINER`
 
 Flags:
 
+- :whale: `--details`: Show extra details provided to logs
 - :whale: `-f, --follow`: Follow log output
 - :whale: `--since`: Show logs since timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)
 - :whale: `--until`: Show logs before a timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)
 - :whale: `-t, --timestamps`: Show timestamps
 - :whale: `-n, --tail`: Number of lines to show from the end of the logs (default "all")
 
-Unimplemented `docker logs` flags: `--details`
-
 ### :whale: nerdctl port
 
 List port mappings or a specific mapping for the container.
diff --git a/pkg/api/types/container_types.go b/pkg/api/types/container_types.go
index a1b2d272c17..aabe8dbc23c 100644
--- a/pkg/api/types/container_types.go
+++ b/pkg/api/types/container_types.go
@@ -404,6 +404,8 @@ type ContainerLogsOptions struct {
 	Since string
 	// Show logs before a timestamp (e.g., 2013-01-02T13:23:37Z) or relative (e.g., 42m for 42 minutes).
 	Until string
+	// Details specifies whether to show extra details provided to logs
+	Details bool
 }
 
 // ContainerWaitOptions specifies options for `nerdctl (container) wait`.
diff --git a/pkg/cmd/container/logs.go b/pkg/cmd/container/logs.go
index 9bf30018758..c2ede0f0b35 100644
--- a/pkg/cmd/container/logs.go
+++ b/pkg/cmd/container/logs.go
@@ -18,9 +18,12 @@ package container
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"os"
 	"os/signal"
+	"sort"
+	"strings"
 	"syscall"
 
 	containerd "github.com/containerd/containerd/v2/client"
@@ -102,6 +105,46 @@ func Logs(ctx context.Context, client *containerd.Client, container string, opti
 				}
 			}
 
+			var detailPrefix string
+			if options.Details {
+				if logConfigJSON, ok := l["nerdctl/log-config"]; ok {
+					type logConfig struct {
+						Opts map[string]string `json:"opts"`
+					}
+
+					e, err := getContainerEnvs(ctx, found.Container)
+					if err != nil {
+						return err
+					}
+
+					var logCfg logConfig
+					var optPairs []string
+
+					if err := json.Unmarshal([]byte(logConfigJSON), &logCfg); err == nil {
+						envOpts, labelOpts := getLogOpts(logCfg.Opts)
+
+						for _, v := range envOpts {
+							if env, ok := e[v]; ok {
+								optPairs = append(optPairs, fmt.Sprintf("%s=%s", v, env))
+							}
+						}
+
+						for _, v := range labelOpts {
+							if label, ok := l[v]; ok {
+								optPairs = append(optPairs, fmt.Sprintf("%s=%s", v, label))
+							}
+						}
+
+						if len(optPairs) > 0 {
+							sort.Strings(optPairs)
+							detailPrefix = strings.Join(optPairs, ",")
+						}
+					} else {
+						log.L.Warn("failed to parse `--details` option, detailed information might not be displayed")
+					}
+				}
+			}
+
 			logViewOpts := logging.LogViewOptions{
 				ContainerID:       found.Container.ID(),
 				Namespace:         l[labels.Namespace],
@@ -112,6 +155,8 @@ func Logs(ctx context.Context, client *containerd.Client, container string, opti
 				Tail:              options.Tail,
 				Since:             options.Since,
 				Until:             options.Until,
+				Details:           options.Details,
+				DetailPrefix:      &detailPrefix,
 			}
 			logViewer, err := logging.InitContainerLogViewer(l, logViewOpts, stopChannel, options.GOptions.Experimental)
 			if err != nil {
@@ -146,3 +191,45 @@ func getLogPath(ctx context.Context, container containerd.Container) (string, er
 
 	return meta.LogPath, nil
 }
+
+func getContainerEnvs(ctx context.Context, container containerd.Container) (map[string]string, error) {
+	envMap := make(map[string]string)
+
+	spec, err := container.Spec(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	if spec.Process == nil {
+		return envMap, nil
+	}
+
+	for _, env := range spec.Process.Env {
+		parts := strings.SplitN(env, "=", 2)
+		if len(parts) == 2 {
+			envMap[parts[0]] = parts[1]
+		}
+	}
+
+	return envMap, nil
+}
+
+func getLogOpts(logOpts map[string]string) ([]string, []string) {
+	var envOpts []string
+	var labelOpts []string
+
+	for k, v := range logOpts {
+		lowerKey := strings.ToLower(k)
+		if lowerKey == "env" {
+			envNames := strings.Split(v, ",")
+			envOpts = append(envOpts, envNames...)
+		}
+
+		if lowerKey == "labels" {
+			labelNames := strings.Split(v, ",")
+			labelOpts = append(labelOpts, labelNames...)
+		}
+	}
+
+	return envOpts, labelOpts
+}
diff --git a/pkg/logging/detail_writer.go b/pkg/logging/detail_writer.go
new file mode 100644
index 00000000000..ef5972a9a3c
--- /dev/null
+++ b/pkg/logging/detail_writer.go
@@ -0,0 +1,42 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package logging
+
+import "io"
+
+type DetailWriter struct {
+	w      io.Writer
+	prefix string
+}
+
+func NewDetailWriter(w io.Writer, prefix string) io.Writer {
+	return &DetailWriter{
+		w:      w,
+		prefix: prefix,
+	}
+}
+
+func (dw *DetailWriter) Write(p []byte) (n int, err error) {
+	if len(p) > 0 {
+		if _, err = dw.w.Write([]byte(dw.prefix)); err != nil {
+			return 0, err
+		}
+
+		return dw.w.Write(p)
+	}
+	return 0, nil
+}
diff --git a/pkg/logging/journald_logger.go b/pkg/logging/journald_logger.go
index a82d138d714..ce2f3afe59e 100644
--- a/pkg/logging/journald_logger.go
+++ b/pkg/logging/journald_logger.go
@@ -43,6 +43,8 @@ import (
 
 var JournalDriverLogOpts = []string{
 	Tag,
+	Env,
+	Labels,
 }
 
 func JournalLogOptsValidate(logOptMap map[string]string) error {
diff --git a/pkg/logging/json_logger.go b/pkg/logging/json_logger.go
index a5297e755ce..d715d0158ee 100644
--- a/pkg/logging/json_logger.go
+++ b/pkg/logging/json_logger.go
@@ -42,6 +42,8 @@ var JSONDriverLogOpts = []string{
 	LogPath,
 	MaxSize,
 	MaxFile,
+	Env,
+	Labels,
 }
 
 type JSONLogger struct {
diff --git a/pkg/logging/log_viewer.go b/pkg/logging/log_viewer.go
index e8eec8bd8cc..c5b41d9a719 100644
--- a/pkg/logging/log_viewer.go
+++ b/pkg/logging/log_viewer.go
@@ -82,6 +82,12 @@ type LogViewOptions struct {
 	// Start/end timestampts to filter logs by.
 	Since string
 	Until string
+
+	// Details enables showing extra details(env and label) in logs.
+	Details bool
+
+	// DetailPrefix is the prefix added when Details is enabled.
+	DetailPrefix *string
 }
 
 func (lvo *LogViewOptions) Validate() error {
@@ -150,6 +156,14 @@ func InitContainerLogViewer(containerLabels map[string]string, lvopts LogViewOpt
 
 // Prints all logs for this LogViewer's containers to the provided io.Writers.
 func (lv *ContainerLogViewer) PrintLogsTo(stdout, stderr io.Writer) error {
+	if lv.logViewingOptions.Details {
+		if lv.logViewingOptions.DetailPrefix != nil {
+			prefix := *lv.logViewingOptions.DetailPrefix + " "
+			stdout = NewDetailWriter(stdout, prefix)
+			stderr = NewDetailWriter(stderr, prefix)
+		}
+
+	}
 	viewerFunc, err := getLogViewer(lv.loggingConfig.Driver)
 	if err != nil {
 		return err
diff --git a/pkg/logging/logging.go b/pkg/logging/logging.go
index 1f1475acd2a..eab10cbd726 100644
--- a/pkg/logging/logging.go
+++ b/pkg/logging/logging.go
@@ -48,6 +48,8 @@ const (
 	MaxSize    = "max-size"
 	MaxFile    = "max-file"
 	Tag        = "tag"
+	Env        = "env"
+	Labels     = "labels"
 )
 
 type Driver interface {

From bcdb5eb487035c17df8641001c982139ebee921c Mon Sep 17 00:00:00 2001
From: fahed dorgaa <fahed.dorgaa@gmail.com>
Date: Sun, 27 Apr 2025 21:00:10 +0200
Subject: [PATCH 126/225] fix stats for exited container and introduce some
 refacto

Signed-off-by: fahed dorgaa <fahed.dorgaa@gmail.com>
---
 pkg/cmd/container/stats.go | 35 ++++++++++++++++-------------------
 pkg/statsutil/stats.go     |  9 +++++++--
 2 files changed, 23 insertions(+), 21 deletions(-)

diff --git a/pkg/cmd/container/stats.go b/pkg/cmd/container/stats.go
index b21c08fce61..7b840c1010d 100644
--- a/pkg/cmd/container/stats.go
+++ b/pkg/cmd/container/stats.go
@@ -93,7 +93,7 @@ func Stats(ctx context.Context, client *containerd.Client, containerIDs []string
 	closeChan := make(chan error)
 
 	var err error
-	var w = options.Stdout
+	w := options.Stdout
 	var tmpl *template.Template
 	switch options.Format {
 	case "", "table":
@@ -128,7 +128,6 @@ func Stats(ctx context.Context, client *containerd.Client, containerIDs []string
 				return
 			}
 		}
-
 	}
 
 	// getContainerList get all existing containers (only used when calling `nerdctl stats` without arguments).
@@ -145,7 +144,9 @@ func Stats(ctx context.Context, client *containerd.Client, containerIDs []string
 					continue
 				}
 			}
-			s := statsutil.NewStats(c.ID())
+			// if an error occurs when getting labels, the ID alone is sufficient for the stats screen.
+			clabels, _ := c.Labels(ctx)
+			s := statsutil.NewStats(c.ID(), containerutil.GetContainerName(clabels))
 			if cStats.add(s) {
 				waitFirst.Add(1)
 				go collect(ctx, options.GOptions, s, waitFirst, c.ID(), !options.NoStream)
@@ -176,7 +177,11 @@ func Stats(ctx context.Context, client *containerd.Client, containerIDs []string
 					return
 				}
 			}
-			s := statsutil.NewStats(datacc.ID)
+			// Load the container to get its ID for retrieving the container name from Labels.
+			// if an error occurs, the ID alone is sufficient for the stats screen.
+			container, _ := client.LoadContainer(ctx, datacc.ID)
+			clabels, _ := container.Labels(ctx)
+			s := statsutil.NewStats(datacc.ID, containerutil.GetContainerName(clabels))
 			if cStats.add(s) {
 				waitFirst.Add(1)
 				go collect(ctx, options.GOptions, s, waitFirst, datacc.ID, !options.NoStream)
@@ -219,7 +224,9 @@ func Stats(ctx context.Context, client *containerd.Client, containerIDs []string
 		walker := &containerwalker.ContainerWalker{
 			Client: client,
 			OnFound: func(ctx context.Context, found containerwalker.Found) error {
-				s := statsutil.NewStats(found.Container.ID())
+				// if an error occurs when getting labels, the ID alone is sufficient for the stats screen.
+				clabels, _ := found.Container.Labels(ctx)
+				s := statsutil.NewStats(found.Container.ID(), containerutil.GetContainerName(clabels))
 				if cStats.add(s) {
 					waitFirst.Add(1)
 					go collect(ctx, options.GOptions, s, waitFirst, found.Container.ID(), !options.NoStream)
@@ -249,7 +256,7 @@ func Stats(ctx context.Context, client *containerd.Client, containerIDs []string
 
 	// firstTick is for creating distant CPU readings.
 	// firstTick stats are not displayed.
-	var firstTick = true
+	firstTick := true
 	for range ticker.C {
 		cleanScreen()
 		ccstats := []statsutil.StatsEntry{}
@@ -353,25 +360,17 @@ func collect(ctx context.Context, globalOptions types.GlobalCommandOptions, s *s
 		s.SetError(err)
 		return
 	}
-
 	go func() {
 		previousStats := new(statsutil.ContainerStats)
 		firstSet := true
 		for {
-			//task is in the for loop to avoid nil task just after Container creation
+			// task is in the for loop to avoid nil task just after Container creation
 			task, err := container.Task(ctx, nil)
 			if err != nil {
 				u <- err
 				continue
 			}
 
-			//labels is in the for loop to avoid nil labels just after Container creation
-			clabels, err := container.Labels(ctx)
-			if err != nil {
-				u <- err
-				continue
-			}
-
 			metric, err := task.Metrics(ctx)
 			if err != nil {
 				u <- err
@@ -395,8 +394,6 @@ func collect(ctx context.Context, globalOptions types.GlobalCommandOptions, s *s
 				u <- err
 				continue
 			}
-			statsEntry.Name = containerutil.GetContainerName(clabels)
-			statsEntry.ID = container.ID()
 
 			if firstSet {
 				firstSet = false
@@ -404,7 +401,7 @@ func collect(ctx context.Context, globalOptions types.GlobalCommandOptions, s *s
 				s.SetStatistics(statsEntry)
 			}
 			u <- nil
-			//sleep to create distant CPU readings
+			// sleep to create distant CPU readings
 			time.Sleep(500 * time.Millisecond)
 		}
 	}()
@@ -421,7 +418,7 @@ func collect(ctx context.Context, globalOptions types.GlobalCommandOptions, s *s
 			}
 		case err := <-u:
 			if err != nil {
-				if !errdefs.IsNotFound(err) {
+				if !errdefs.IsNotFound(err) && !strings.Contains(err.Error(), "no such file or directory") {
 					s.SetError(err)
 					continue
 				}
diff --git a/pkg/statsutil/stats.go b/pkg/statsutil/stats.go
index d732e1d837d..c5bf3c0f68d 100644
--- a/pkg/statsutil/stats.go
+++ b/pkg/statsutil/stats.go
@@ -69,15 +69,20 @@ type ContainerStats struct {
 }
 
 // NewStats is from https://github.com/docker/cli/blob/3fb4fb83dfb5db0c0753a8316f21aea54dab32c5/cli/command/container/formatter_stats.go#L113-L116
-func NewStats(containerID string) *Stats {
-	return &Stats{StatsEntry: StatsEntry{ID: containerID}}
+func NewStats(containerID string, containerName string) *Stats {
+	return &Stats{StatsEntry: StatsEntry{ID: containerID, Name: containerName}}
 }
 
 // SetStatistics is from https://github.com/docker/cli/blob/3fb4fb83dfb5db0c0753a8316f21aea54dab32c5/cli/command/container/formatter_stats.go#L87-L93
 func (cs *Stats) SetStatistics(s StatsEntry) {
 	cs.mutex.Lock()
 	defer cs.mutex.Unlock()
+	// The statsEntry ID and Name fields are already populated within the cs.StatsEntry
+	cStatsName := cs.StatsEntry.Name
+	cStatsID := cs.StatsEntry.ID
 	cs.StatsEntry = s
+	cs.StatsEntry.Name = cStatsName
+	cs.StatsEntry.ID = cStatsID
 }
 
 // GetStatistics is from https://github.com/docker/cli/blob/3fb4fb83dfb5db0c0753a8316f21aea54dab32c5/cli/command/container/formatter_stats.go#L95-L100

From d668068b238b356a085605fac8c73c5632c37c49 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Mon, 28 Apr 2025 14:28:55 -0700
Subject: [PATCH 127/225] Fix tigron CI bustage

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/tigron.yml | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/tigron.yml b/.github/workflows/tigron.yml
index 5915adae0ad..9f4befc5087 100644
--- a/.github/workflows/tigron.yml
+++ b/.github/workflows/tigron.yml
@@ -35,18 +35,21 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 100
-      - name: "Set GO env"
+      - if: ${{ matrix.canary }}
+        name: "Init (canary): retrieve GO_VERSION"
         run: |
-          if [ "${{ matrix.canary }}" != "" ]; then
-            . ./hack/provisioning/version/fetch.sh
-            printf "GO_VERSION=%s\n" "$(go::canary::for::go-setup)" >> "$GITHUB_ENV"
-          fi
-      - name: "Install go"
+          latest_go="$(. ./hack/provisioning/version/fetch.sh; go::canary::for::go-setup)"
+          printf "GO_VERSION=%s\n" "$latest_go" >> "$GITHUB_ENV"
+          [ "$latest_go" != "" ] || \
+            echo "::warning title=No canary go::There is currently no canary go version to test. Steps will not run."
+      - if: ${{ env.GO_VERSION != '' }}
+        name: "Install go"
         uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
-      - name: "Install tools"
+      - if: ${{ env.GO_VERSION != '' }}
+        name: "Install tools"
         run: |
           cd mod/tigron
           echo "::group:: make install-dev-tools"
@@ -55,7 +58,8 @@ jobs:
             brew install yamllint shellcheck
           fi
           echo "::endgroup::"
-      - name: "lint"
+      - if: ${{ env.GO_VERSION != '' }}
+        name: "lint"
         env:
           NO_COLOR: true
         run: |
@@ -69,19 +73,22 @@ jobs:
           export LINT_COMMIT_RANGE="$(jq -r '.after + "..HEAD"' ${GITHUB_EVENT_PATH})"
           make lint
           echo "::endgroup::"
-      - name: "test-unit"
+      - if: ${{ env.GO_VERSION != '' }}
+        name: "test-unit"
         run: |
           echo "::group:: unit test"
           cd mod/tigron
           make test-unit
           echo "::endgroup::"
-      - name: "test-unit-race"
+      - if: ${{ env.GO_VERSION != '' }}
+        name: "test-unit-race"
         run: |
           echo "::group:: race test"
           cd mod/tigron
           make test-unit-race
           echo "::endgroup::"
-      - name: "test-unit-bench"
+      - if: ${{ env.GO_VERSION != '' }}
+        name: "test-unit-bench"
         run: |
           echo "::group:: bench"
           cd mod/tigron

From bf7312da458ddd6bf0e56531d1700ecb6c4c5d52 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Mon, 28 Apr 2025 14:29:32 -0700
Subject: [PATCH 128/225] Fix wrong number of lines reported

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/internal/formatter/formatter.go | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/mod/tigron/internal/formatter/formatter.go b/mod/tigron/internal/formatter/formatter.go
index b2eb9a8868f..a239273bda3 100644
--- a/mod/tigron/internal/formatter/formatter.go
+++ b/mod/tigron/internal/formatter/formatter.go
@@ -108,20 +108,21 @@ func chunk(s string, maxLength, maxLines int) []string {
 	}
 
 	// If really long, preserve the starting first quarter, the trailing three quarters, and inform.
-	if len(chunks) > maxLines {
-		abbreviator := fmt.Sprintf("... %d lines are being ignored...", len(chunks)-maxLines)
+	actualLength := len(chunks)
+	if actualLength > maxLines {
+		abbreviator := fmt.Sprintf("... %d lines are being ignored...", actualLength-maxLines)
 		chunks = append(
 			append(chunks[0:maxLines/4], abbreviator+strings.Repeat(spacer, maxLength-len(abbreviator))),
-			chunks[len(chunks)-maxLines*3/4:]...,
+			chunks[actualLength-maxLines*3/4:]...,
 		)
 		chunks = append(
 			[]string{
-				fmt.Sprintf("Actual content is %d lines long and has been abbreviated to %d\n", len(chunks), maxLines),
+				fmt.Sprintf("Actual content is %d lines long and has been abbreviated to %d\n", actualLength, maxLines),
 				strings.Repeat(spacer, maxLength),
 			},
 			chunks...,
 		)
-	} else if len(chunks) == 0 {
+	} else if actualLength == 0 {
 		chunks = []string{strings.Repeat(spacer, maxLength)}
 	}
 

From d711af0045e5fc8157a00643c3a0395790e0c5cf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Apr 2025 23:37:53 +0000
Subject: [PATCH 129/225] build(deps): bump go.uber.org/mock from 0.5.1 to
 0.5.2

Bumps [go.uber.org/mock](https://github.com/uber/mock) from 0.5.1 to 0.5.2.
- [Release notes](https://github.com/uber/mock/releases)
- [Changelog](https://github.com/uber-go/mock/blob/main/CHANGELOG.md)
- [Commits](https://github.com/uber/mock/compare/v0.5.1...v0.5.2)

---
updated-dependencies:
- dependency-name: go.uber.org/mock
  dependency-version: 0.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 3362fa0d988..61ccab501d8 100644
--- a/go.mod
+++ b/go.mod
@@ -59,7 +59,7 @@ require (
 	github.com/vishvananda/netlink v1.3.1-0.20250303224720-0e7078ed04c8
 	github.com/vishvananda/netns v0.0.5
 	github.com/yuchanns/srslog v1.1.0
-	go.uber.org/mock v0.5.1
+	go.uber.org/mock v0.5.2
 	golang.org/x/crypto v0.37.0
 	golang.org/x/net v0.39.0
 	golang.org/x/sync v0.13.0
diff --git a/go.sum b/go.sum
index cde4c08c296..19f9d5499d4 100644
--- a/go.sum
+++ b/go.sum
@@ -330,8 +330,8 @@ go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.uber.org/mock v0.5.1 h1:ASgazW/qBmR+A32MYFDB6E2POoTgOwT509VP0CT/fjs=
-go.uber.org/mock v0.5.1/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
+go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
+go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=

From 85486757a99666446ed05cec79b9f4cb44489c6b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Apr 2025 23:46:17 +0000
Subject: [PATCH 130/225] build(deps): bump actions/attest-build-provenance
 from 2.2.3 to 2.3.0

Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 2.2.3 to 2.3.0.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-build-provenance/compare/c074443f1aee8d4aeeae555aebba3282517141b2...db473fddc028af60658334401dc6fa3ffd8669fd)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b56e0e8d407..3cceb99a752 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,7 +46,7 @@ jobs:
         Release manager: [ADD YOUR NAME HERE] (@[ADD YOUR GITHUB ID HERE])
         EOF
     - name: "Generate artifact attestation"
-      uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2  # v2.2.3
+      uses: actions/attest-build-provenance@db473fddc028af60658334401dc6fa3ffd8669fd  # v2.3.0
       if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
       with:
         subject-path: _output/*

From 3f2854af1e9c53fa34908f9fca492c812dd9106d Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 24 Apr 2025 17:34:17 -0700
Subject: [PATCH 131/225] Cleanup CI:setup-go

- remove useless .x suffixes
- consistently enforce check latest
- consitent step title

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/lint.yml        |  8 +++++---
 .github/workflows/project.yml     |  4 +++-
 .github/workflows/release.yml     |  6 ++++--
 .github/workflows/test-canary.yml |  3 ++-
 .github/workflows/test.yml        | 18 +++++++++++-------
 .github/workflows/tigron.yml      |  2 +-
 6 files changed, 26 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 3bda482409d..2bec11227ae 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -8,7 +8,7 @@ on:
   pull_request:
 
 env:
-  GO_VERSION: 1.24.x
+  GO_VERSION: "1.24"
   GOTOOLCHAIN: local
 
 jobs:
@@ -48,7 +48,8 @@ jobs:
             . ./hack/provisioning/version/fetch.sh
             printf "GO_VERSION=%s\n" "$(go::canary::for::go-setup)" >> "$GITHUB_ENV"
           fi
-      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+      - name: "Install go"
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
@@ -66,7 +67,8 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 1
-      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+      - name: "Install go"
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index e0a205c78bb..39385123536 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -20,9 +20,11 @@ jobs:
         with:
           path: src/github.com/containerd/nerdctl
           fetch-depth: 100
-      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+      - name: "Install go"
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
+          check-latest: true
           cache-dependency-path: src/github.com/containerd/nerdctl
       - uses: containerd/project-checks@d7751f3c375b8fe4a84c02a068184ee4c1f59bc4  # v1.2.2
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3cceb99a752..72587a7227d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,9 +21,11 @@ jobs:
       attestations: write  # for provenances
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-    - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+    - name: "Install go"
+      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
       with:
-        go-version: 1.24.x
+        go-version: "1.24"
+        check-latest: true
     - name: "Compile binaries"
       run: make artifacts
     - name: "SHA256SUMS"
diff --git a/.github/workflows/test-canary.yml b/.github/workflows/test-canary.yml
index 39b32d21783..514ad8822a2 100644
--- a/.github/workflows/test-canary.yml
+++ b/.github/workflows/test-canary.yml
@@ -70,7 +70,8 @@ jobs:
 
           . ./hack/provisioning/version/fetch.sh
           printf "GO_VERSION=%s\n" "$(go::canary::for::go-setup)" >> "$GITHUB_ENV"
-      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+      - name: "Install go"
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 53bc9a45bf8..5d8f51df409 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -10,7 +10,7 @@ on:
       - '**.md'
 
 env:
-  GO_VERSION: 1.24.x
+  GO_VERSION: "1.24"
   GOTOOLCHAIN: local
   SHORT_TIMEOUT: 5
   LONG_TIMEOUT: 60
@@ -76,7 +76,8 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 1
-      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+      - name: "Install go"
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
@@ -301,17 +302,18 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go-version: ["1.23.x", "1.24.x"]
+        go-version: ["1.23", "1.24"]
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 1
-      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+      - name: "Install go"
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ matrix.go-version }}
           check-latest: true
       - name: "build"
-        run: GO_VERSION="$(echo ${{ matrix.go-version }} | sed -e s/.x//)" make binaries
+        run: make binaries
 
   test-integration-docker-compatibility:
     timeout-minutes: 40
@@ -321,7 +323,8 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 1
-      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+      - name: "Install go"
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
@@ -357,7 +360,8 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 1
-      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+      - name: "Install go"
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
diff --git a/.github/workflows/tigron.yml b/.github/workflows/tigron.yml
index 5915adae0ad..dc2277d64bc 100644
--- a/.github/workflows/tigron.yml
+++ b/.github/workflows/tigron.yml
@@ -9,7 +9,7 @@ on:
     paths: 'mod/tigron/**'
 
 env:
-  GO_VERSION: 1.24.x
+  GO_VERSION: "1.24"
   GOTOOLCHAIN: local
 
 jobs:

From 2ba6eaba7bede0c6840b0174bd283d85bfa0e830 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 24 Apr 2025 17:40:37 -0700
Subject: [PATCH 132/225] Remove broken variable

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5d8f51df409..9c8d3ba1c7c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -390,7 +390,7 @@ jobs:
       - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
         with:
           path: /root/.vagrant.d
-          key: vagrant-${{ matrix.box }}
+          key: vagrant
       - name: Set up vagrant
         run: |
           # from https://github.com/containerd/containerd/blob/v2.0.2/.github/workflows/ci.yml#L583-L596

From 9dcda7baafae1932f2fb0b68ced82a0ef698f877 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 24 Apr 2025 17:41:00 -0700
Subject: [PATCH 133/225] Fix cache scope in EL8

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/test.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9c8d3ba1c7c..0f4bfa72deb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -428,8 +428,6 @@ jobs:
     runs-on: ubuntu-24.04
     env:
       MODE: ${{ matrix.mode }}
-      # FIXME: this is only necessary to access the build cache. To remove with build cleanup.
-      CONTAINERD_VERSION: v2.0.5
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
@@ -486,7 +484,7 @@ jobs:
           docker buildx create --name with-gha --use
           docker buildx build \
             --output=type=docker \
-            --cache-from type=gha,scope=amd64-${CONTAINERD_VERSION} \
+            --cache-from type=gha,scope=test-integration-dependencies-amd64 \
             -t test-integration --target "${TARGET}" \
             .
 

From 687aac55deeea9008756c39117bf7b4958a8bbc1 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 30 Apr 2025 09:34:31 -0700
Subject: [PATCH 134/225] Refactor unit test workflow

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/job-test-unit.yml           | 82 +++++++++++++++++++
 .github/workflows/test-canary.yml             |  2 -
 .../workflows/{test.yml => workflow-test.yml} | 51 +++++-------
 3 files changed, 103 insertions(+), 32 deletions(-)
 create mode 100644 .github/workflows/job-test-unit.yml
 rename .github/workflows/{test.yml => workflow-test.yml} (95%)

diff --git a/.github/workflows/job-test-unit.yml b/.github/workflows/job-test-unit.yml
new file mode 100644
index 00000000000..19a3ab758f4
--- /dev/null
+++ b/.github/workflows/job-test-unit.yml
@@ -0,0 +1,82 @@
+# Note: freebsd tests are not ran here (see integration instead)
+name: test-unit
+
+on:
+  workflow_call:
+    inputs:
+      timeout:
+        required: true
+        type: number
+      go-version:
+        required: true
+        type: string
+      runner:
+        required: true
+        type: string
+      canary:
+        required: false
+        default: false
+        type: boolean
+      windows-cni-version:
+        required: true
+        type: string
+      linux-cni-version:
+        required: true
+        type: string
+      linux-cni-sha:
+        required: true
+        type: string
+
+env:
+  GOTOOLCHAIN: local
+  # Windows fails without this
+  CGO_ENABLED: 0
+
+jobs:
+  test-unit:
+    name: ${{ format('{0}{1}', inputs.runner, inputs.canary && ' (go canary)' || '') }}
+    timeout-minutes: ${{ inputs.timeout }}
+    runs-on: "${{ inputs.runner }}"
+    defaults:
+      run:
+        shell: bash
+
+    env:
+      GO_VERSION: ${{ inputs.go-version }}
+
+    steps:
+      - name: "Init: checkout"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          fetch-depth: 1
+
+      # If canary is requested, check for the latest unstable release
+      - if: ${{ inputs.canary }}
+        name: "Init (canary): retrieve GO_VERSION"
+        run: |
+          latest_go="$(. ./hack/provisioning/version/fetch.sh; go::canary::for::go-setup)"
+          printf "GO_VERSION=%s\n" "$latest_go" >> "$GITHUB_ENV"
+          [ "$latest_go" != "" ] || \
+            echo "::warning title=No canary go::There is currently no canary go version to test. Following steps will not run."
+
+      - if: ${{ env.GO_VERSION != '' }}
+        name: "Init: install go"
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          check-latest: true
+
+      # Install CNI
+      - if: ${{ env.GO_VERSION != '' }}
+        name: "Init: set up CNI"
+        run: |
+          if [ "$RUNNER_OS" == "Windows" ]; then
+            GOPATH=$(go env GOPATH) WINCNI_VERSION=${{ inputs.windows-cni-version }} ./hack/provisioning/windows/cni.sh
+          elif [ "$RUNNER_OS" == "Linux" ]; then
+            ./hack/provisioning/linux/cni.sh "${{ inputs.linux-cni-version }}" "amd64" "${{ inputs.linux-cni-sha }}"
+          fi
+
+      - if: ${{ env.GO_VERSION != '' }}
+        name: "Run"
+        run: |
+          make test-unit
diff --git a/.github/workflows/test-canary.yml b/.github/workflows/test-canary.yml
index 514ad8822a2..6236573fa15 100644
--- a/.github/workflows/test-canary.yml
+++ b/.github/workflows/test-canary.yml
@@ -41,8 +41,6 @@ jobs:
           docker run --privileged --rm tonistiigi/binfmt --install linux/amd64
           docker run --privileged --rm tonistiigi/binfmt --install linux/arm64
           docker run --privileged --rm tonistiigi/binfmt --install linux/arm/v7
-      - name: "Run unit tests"
-        run: go test -v ./pkg/...
       - name: "Run integration tests"
         run: docker run -t --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=false
       - name: "Run integration tests (flaky)"
diff --git a/.github/workflows/test.yml b/.github/workflows/workflow-test.yml
similarity index 95%
rename from .github/workflows/test.yml
rename to .github/workflows/workflow-test.yml
index 0f4bfa72deb..fb867433295 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/workflow-test.yml
@@ -52,40 +52,31 @@ jobs:
             --target build-dependencies --build-arg CONTAINERD_VERSION=${CONTAINERD_VERSION} .
 
   test-unit:
-    # FIXME:
-    # Supposed to work: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/evaluate-expressions-in-workflows-and-actions#example-returning-a-json-data-type
-    # Apparently does not
-    # timeout-minutes: ${{ fromJSON(env.SHORT_TIMEOUT) }}
-    timeout-minutes: 10
-    name: unit | ${{ matrix.goos }}
-    runs-on: "${{ matrix.os }}"
-    defaults:
-      run:
-        shell: bash
+    name: "unit${{ inputs.hack }}"
+    uses: ./.github/workflows/job-test-unit.yml
     strategy:
       fail-fast: false
       matrix:
+        # Run on all supported platforms but freebsd
+        # Additionally run on canary for linux
         include:
-          - os: windows-2022
-            goos: windows
-          - os: ubuntu-24.04
-            goos: linux
-          - os: macos-15
-            goos: darwin
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          fetch-depth: 1
-      - name: "Install go"
-        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          check-latest: true
-      - if: ${{ matrix.goos=='windows' }}
-        name: "Set up CNI"
-        run: GOPATH=$(go env GOPATH) ./hack/provisioning/windows/cni.sh
-      - name: "Run unit tests"
-        run: make test-unit
+          - runner: "ubuntu-24.04"
+            canary: false
+          - runner: "macos-15"
+            canary: false
+          - runner: "windows-2025"
+            canary: false
+          - runner: "ubuntu-24.04"
+            canary: true
+    with:
+      runner: ${{ matrix.runner }}
+      canary: ${{ matrix.canary }}
+      # Windows routinely go over 5 minutes
+      timeout: 10
+      go-version: 1.24
+      windows-cni-version: v0.3.1
+      linux-cni-version: v1.7.1
+      linux-cni-sha: 1a28a0506bfe5bcdc981caf1a49eeab7e72da8321f1119b7be85f22621013098
 
   test-integration:
     needs: build-dependencies

From 20b67ddf9ceaa9d1c8481c5317abc026b4bba46d Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 30 Apr 2025 09:35:03 -0700
Subject: [PATCH 135/225] Enable rootful unit testing on linux

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/job-test-unit.yml                    |  6 ++++++
 .../dockerconfigresolver/credentialsstore_test.go      | 10 +++++-----
 pkg/netutil/netutil_test.go                            |  6 +++---
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/job-test-unit.yml b/.github/workflows/job-test-unit.yml
index 19a3ab758f4..6e2397f59a8 100644
--- a/.github/workflows/job-test-unit.yml
+++ b/.github/workflows/job-test-unit.yml
@@ -80,3 +80,9 @@ jobs:
         name: "Run"
         run: |
           make test-unit
+
+      # On linux, also run with root
+      - if: ${{ env.GO_VERSION != '' && env.RUNNER_OS == 'Linux' }}
+        name: "Run: with root"
+        run: |
+          sudo make test-unit
diff --git a/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go b/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go
index 003fe1aa211..61b99d87d8d 100644
--- a/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go
+++ b/pkg/imgutil/dockerconfigresolver/credentialsstore_test.go
@@ -25,6 +25,8 @@ import (
 	"testing"
 
 	"gotest.tools/v3/assert"
+
+	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 )
 
 func createTempDir(t *testing.T, mode os.FileMode) string {
@@ -40,12 +42,10 @@ func createTempDir(t *testing.T, mode os.FileMode) string {
 }
 
 func TestBrokenCredentialsStore(t *testing.T) {
-	if runtime.GOOS == "freebsd" {
-		// It is unclear why these tests are failing on FreeBSD, and if it is a problem with Vagrant or differences
-		// with FreeBSD
-		// Anyhow, this test is about extreme cases & conditions (filesystem errors wrt credentials loading).
-		t.Skip("skipping broken credential store tests for freebsd")
+	if !rootlessutil.IsRootless() {
+		t.Skip("test is for rootless")
 	}
+
 	if runtime.GOOS == "windows" {
 		// Same as above
 		t.Skip("test is not compatible with windows")
diff --git a/pkg/netutil/netutil_test.go b/pkg/netutil/netutil_test.go
index 6b53ffd46b4..c3dadc74360 100644
--- a/pkg/netutil/netutil_test.go
+++ b/pkg/netutil/netutil_test.go
@@ -34,7 +34,7 @@ import (
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 )
 
-const testBridgeIP = "10.1.100.1/24" // nolint:unused
+const testBridgeIP = "10.42.100.1/24" // nolint:unused
 
 const preExistingNetworkConfigTemplate = `
 {
@@ -278,8 +278,8 @@ func testDefaultNetworkCreationWithBridgeIP(t *testing.T) {
 	// Assert on bridge plugin configuration
 	assert.Equal(t, "bridge", bridgeConfig.Type)
 	// Assert on IPAM configuration
-	assert.Equal(t, "10.1.100.1", bridgeConfig.IPAM.Ranges[0][0].Gateway)
-	assert.Equal(t, "10.1.100.0/24", bridgeConfig.IPAM.Ranges[0][0].Subnet)
+	assert.Equal(t, "10.42.100.1", bridgeConfig.IPAM.Ranges[0][0].Gateway)
+	assert.Equal(t, "10.42.100.0/24", bridgeConfig.IPAM.Ranges[0][0].Subnet)
 	assert.Equal(t, "0.0.0.0/0", bridgeConfig.IPAM.Routes[0].Dst)
 	assert.Equal(t, "host-local", bridgeConfig.IPAM.Type)
 

From 3a3bebf57f87833620f2ba4fbc4248a7104e6e95 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 30 Apr 2025 11:41:24 -0700
Subject: [PATCH 136/225] Harmonize variable names

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/tigron.yml | 21 ++++++++-------------
 1 file changed, 8 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/tigron.yml b/.github/workflows/tigron.yml
index cbc8fde9823..81ddbac1e75 100644
--- a/.github/workflows/tigron.yml
+++ b/.github/workflows/tigron.yml
@@ -15,20 +15,20 @@ env:
 jobs:
   lint:
     timeout-minutes: 15
-    name: "${{ matrix.goos }} ${{ matrix.os }} | go ${{ matrix.canary }}"
-    runs-on: ${{ matrix.os }}
+    name: "${{ matrix.goos }} ${{ matrix.runner }} | go ${{ matrix.canary }}"
+    runs-on: ${{ matrix.runner }}
     defaults:
       run:
         shell: bash
     strategy:
       matrix:
         include:
-          - os: ubuntu-24.04
-          - os: macos-15
-          - os: windows-2022
-          - os: ubuntu-24.04
+          - runner: ubuntu-24.04
+          - runner: macos-15
+          - runner: windows-2022
+          - runner: ubuntu-24.04
             goos: freebsd
-          - os: ubuntu-24.04
+          - runner: ubuntu-24.04
             canary: go-canary
     steps:
       - name: "Checkout project"
@@ -58,16 +58,11 @@ jobs:
             brew install yamllint shellcheck
           fi
           echo "::endgroup::"
-      - if: ${{ env.GO_VERSION != '' }}
+      - if: ${{ env.GO_VERSION != '' && env.RUNNER_OS == 'Linux' && matrix.goos == '' }}
         name: "lint"
         env:
           NO_COLOR: true
         run: |
-          if [ "$RUNNER_OS" != "Linux" ] || [ "${{ matrix.goos }}" != "" ]; then
-            echo "It is not necessary to run the linter on this platform (${{ env.RUNNER_OS }} ${{ matrix.goos }})"
-            exit
-          fi
-
           echo "::group:: lint"
           cd mod/tigron
           export LINT_COMMIT_RANGE="$(jq -r '.after + "..HEAD"' ${GITHUB_EVENT_PATH})"

From c364ee350ca5a7c4332e03e40d44650557b06eaa Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 30 Apr 2025 11:43:07 -0700
Subject: [PATCH 137/225] Refactor lint workflows

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/job-build.yml               | 69 ++++++++++++++++
 .github/workflows/job-lint-go.yml             | 76 +++++++++++++++++
 .github/workflows/job-lint-other.yml          | 38 +++++++++
 .../{project.yml => job-lint-project.yml}     | 45 +++++++----
 .github/workflows/job-test-unit.yml           |  2 +-
 .github/workflows/lint.yml                    | 81 -------------------
 .github/workflows/workflow-lint.yml           | 80 ++++++++++++++++++
 .github/workflows/workflow-test.yml           | 25 +-----
 Makefile                                      |  3 +-
 9 files changed, 298 insertions(+), 121 deletions(-)
 create mode 100644 .github/workflows/job-build.yml
 create mode 100644 .github/workflows/job-lint-go.yml
 create mode 100644 .github/workflows/job-lint-other.yml
 rename .github/workflows/{project.yml => job-lint-project.yml} (53%)
 delete mode 100644 .github/workflows/lint.yml
 create mode 100644 .github/workflows/workflow-lint.yml

diff --git a/.github/workflows/job-build.yml b/.github/workflows/job-build.yml
new file mode 100644
index 00000000000..edaa1df20b7
--- /dev/null
+++ b/.github/workflows/job-build.yml
@@ -0,0 +1,69 @@
+# This job just builds nerdctl for the golang versions we support (as a smoke test)
+name: job-build
+
+on:
+  workflow_call:
+    inputs:
+      timeout:
+        required: true
+        type: number
+      go-version:
+        required: true
+        type: string
+      runner:
+        required: true
+        type: string
+      canary:
+        required: false
+        default: false
+        type: boolean
+
+env:
+  GOTOOLCHAIN: local
+
+jobs:
+  build-all-targets:
+    name: ${{ format('go {0}', inputs.canary && 'canary' || inputs.go-version ) }}
+    timeout-minutes: ${{ inputs.timeout }}
+    runs-on: "${{ inputs.runner }}"
+    defaults:
+      run:
+        shell: bash
+
+    env:
+      GO_VERSION: ${{ inputs.go-version }}
+
+    steps:
+      - name: "Init: checkout"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          fetch-depth: 1
+
+      - if: ${{ inputs.canary }}
+        name: "Init (canary): retrieve GO_VERSION"
+        run: |
+          latest_go="$(. ./hack/provisioning/version/fetch.sh; go::canary::for::go-setup)"
+          printf "GO_VERSION=%s\n" "$latest_go" >> "$GITHUB_ENV"
+          [ "$latest_go" != "" ] || \
+            echo "::warning title=No canary go::There is currently no canary go version to test. Steps will not run."
+
+      - if: ${{ env.GO_VERSION != '' }}
+        name: "Init: install go"
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          check-latest: true
+
+      - if: ${{ env.GO_VERSION != '' }}
+        name: "Run: make binaries"
+        run: |
+          # We officially support these
+          GOOS=linux make binaries
+          GOOS=windows make binaries
+          GOOS=freebsd make binaries
+          GOOS=darwin make binaries
+          GOARCH=arm GOARM=6 make binaries
+          # These architectures are not released, but we still verify that we can at least compile
+          GOARCH=ppc64le make binaries
+          GOARCH=riscv64 make binaries
+          GOARCH=s390x make binaries
diff --git a/.github/workflows/job-lint-go.yml b/.github/workflows/job-lint-go.yml
new file mode 100644
index 00000000000..6102d6cc69a
--- /dev/null
+++ b/.github/workflows/job-lint-go.yml
@@ -0,0 +1,76 @@
+# This job runs golangci-lint
+# Note that technically, `make lint-go-all` would run the linter for all targets, and could be called once, on a single instance.
+# The point of running it on a matrix instead, each GOOS separately, is to verify that the tooling itself is working on the target OS.
+name: job-lint-go
+
+on:
+  workflow_call:
+    inputs:
+      timeout:
+        required: true
+        type: number
+      go-version:
+        required: true
+        type: string
+      runner:
+        required: true
+        type: string
+      canary:
+        required: false
+        default: false
+        type: boolean
+      goos:
+        required: true
+        type: string
+
+env:
+  GOTOOLCHAIN: local
+
+jobs:
+  lint-go:
+    name: ${{ format('{0}{1}', inputs.goos, inputs.canary && ' (go canary)' || '') }}
+    timeout-minutes: ${{ inputs.timeout }}
+    runs-on: "${{ inputs.runner }}"
+    defaults:
+      run:
+        shell: bash
+    env:
+      GO_VERSION: ${{ inputs.go-version }}
+
+    steps:
+      - name: "Init: checkout"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          fetch-depth: 1
+
+      - if: ${{ inputs.canary }}
+        name: "Init (canary): retrieve GO_VERSION"
+        run: |
+          latest_go="$(. ./hack/provisioning/version/fetch.sh; go::canary::for::go-setup)"
+          printf "GO_VERSION=%s\n" "$latest_go" >> "$GITHUB_ENV"
+          [ "$latest_go" != "" ] || \
+            echo "::warning title=No canary go::There is currently no canary go version to test. Steps will not run."
+
+      - if: ${{ env.GO_VERSION != '' }}
+        name: "Init: install go"
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          check-latest: true
+
+      - if: ${{ env.GO_VERSION != '' }}
+        name: "Init: install dev-tools"
+        run: |
+          echo "::group:: make install-dev-tools"
+          make install-dev-tools
+          echo "::endgroup::"
+
+      - if: ${{ env.GO_VERSION != '' }}
+        name: "Run"
+        run: |
+          # On canary, lint for all supported targets
+          if [ "${{ inputs.canary }}" == "true" ]; then
+            NO_COLOR=true make lint-go-all
+          else
+            NO_COLOR=true GOOS="${{ inputs.goos }}" make lint-go
+          fi
diff --git a/.github/workflows/job-lint-other.yml b/.github/workflows/job-lint-other.yml
new file mode 100644
index 00000000000..2f012789877
--- /dev/null
+++ b/.github/workflows/job-lint-other.yml
@@ -0,0 +1,38 @@
+# This job runs any subsidiary linter not part of golangci (shell, yaml, etc)
+name: job-lint-other
+
+on:
+  workflow_call:
+    inputs:
+      timeout:
+        required: true
+        type: number
+      runner:
+        required: true
+        type: string
+
+env:
+  GOTOOLCHAIN: local
+
+jobs:
+  lint-other:
+    name: "yaml | shell"
+    timeout-minutes: ${{ inputs.timeout }}
+    runs-on: ${{ inputs.runner }}
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - name: "Init: checkout"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          fetch-depth: 1
+
+      - name: "Run: yaml"
+        run: |
+          make lint-yaml
+
+      - name: "Run: shell"
+        run: |
+          make lint-shell
diff --git a/.github/workflows/project.yml b/.github/workflows/job-lint-project.yml
similarity index 53%
rename from .github/workflows/project.yml
rename to .github/workflows/job-lint-project.yml
index 39385123536..fcadf7a8ba0 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/job-lint-project.yml
@@ -1,32 +1,49 @@
-name: project
+# This job runs containerd shared project-checks, that verifies licenses, headers, and commits.
+# To run locally, you may just use `make lint` instead, that does the same thing
+# (albeit `make lint` uses more modern versions).
+name: job-lint-project
 
 on:
-  push:
-    branches:
-      - main
-      - 'release/**'
-  pull_request:
+  workflow_call:
+    inputs:
+      timeout:
+        required: true
+        type: number
+      go-version:
+        required: true
+        type: string
+      runner:
+        required: true
+        type: string
 
 env:
   GOTOOLCHAIN: local
 
 jobs:
   project:
-    name: checks
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
+    name: "commits, licenses..."
+    timeout-minutes: ${{ inputs.timeout }}
+    runs-on: ${{ inputs.runner }}
+    defaults:
+      run:
+        shell: bash
+
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+      - name: "Init: checkout"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
-          path: src/github.com/containerd/nerdctl
           fetch-depth: 100
-      - name: "Install go"
+          path: src/github.com/containerd/nerdctl
+
+      - name: "Init: install go"
         uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
         with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version: ${{ inputs.go-version }}
           check-latest: true
           cache-dependency-path: src/github.com/containerd/nerdctl
-      - uses: containerd/project-checks@d7751f3c375b8fe4a84c02a068184ee4c1f59bc4  # v1.2.2
+
+      - name: "Run"
+        uses: containerd/project-checks@d7751f3c375b8fe4a84c02a068184ee4c1f59bc4  # v1.2.2
         with:
           working-directory: src/github.com/containerd/nerdctl
           repo-access-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/job-test-unit.yml b/.github/workflows/job-test-unit.yml
index 6e2397f59a8..67e5d97447c 100644
--- a/.github/workflows/job-test-unit.yml
+++ b/.github/workflows/job-test-unit.yml
@@ -1,5 +1,5 @@
 # Note: freebsd tests are not ran here (see integration instead)
-name: test-unit
+name: job-test-unit
 
 on:
   workflow_call:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
deleted file mode 100644
index 2bec11227ae..00000000000
--- a/.github/workflows/lint.yml
+++ /dev/null
@@ -1,81 +0,0 @@
-name: lint
-
-on:
-  push:
-    branches:
-      - main
-      - 'release/**'
-  pull_request:
-
-env:
-  GO_VERSION: "1.24"
-  GOTOOLCHAIN: local
-
-jobs:
-  go:
-    timeout-minutes: 5
-    name: "${{ matrix.goos }} | ${{ matrix.canary }}"
-    runs-on: "${{ matrix.os }}"
-    defaults:
-      run:
-        shell: bash
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-24.04
-            goos: linux
-          - os: ubuntu-24.04
-            goos: freebsd
-          - os: ubuntu-24.04
-            goos: darwin
-          # FIXME: this is currently failing in a non-sensical way, so, running on linux instead...
-          # - os: windows-2022
-          - os: ubuntu-24.04
-            goos: windows
-          - os: ubuntu-24.04
-            goos: linux
-            # This allows the canary script to select any upcoming golang alpha/beta/RC
-            canary: go-canary
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          fetch-depth: 1
-      - name: Set GO env
-        run: |
-          # If canary is specified, get the latest available golang pre-release instead of the major version
-          if [ "${{ matrix.canary }}" != "" ]; then
-            . ./hack/provisioning/version/fetch.sh
-            printf "GO_VERSION=%s\n" "$(go::canary::for::go-setup)" >> "$GITHUB_ENV"
-          fi
-      - name: "Install go"
-        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          check-latest: true
-      - name: install required linters and dev-tools
-        run: |
-          make install-dev-tools
-      - name: golangci-lint
-        run: |
-          NO_COLOR=true GOOS="${{ matrix.goos }}" make lint-go
-  other:
-    timeout-minutes: 5
-    name: yaml | shell | imports order
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          fetch-depth: 1
-      - name: "Install go"
-        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          check-latest: true
-      - name: install required linters and dev-tools
-        run: |
-          make install-dev-tools
-      - name: yaml
-        run: make lint-yaml
-      - name: shell
-        run: make lint-shell
diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml
new file mode 100644
index 00000000000..5462b8e5d86
--- /dev/null
+++ b/.github/workflows/workflow-lint.yml
@@ -0,0 +1,80 @@
+name: lint
+
+on:
+  push:
+    branches:
+      - main
+      - 'release/**'
+  pull_request:
+
+jobs:
+  # Runs golangci to ensure that:
+  # 1. the tooling is working on the target platform
+  # 2. the linter is happy
+  # 3. for canary (if there is a canary go version), does lint for all supported goos
+  lint-go:
+    name: "go${{ inputs.hack }}"
+    uses: ./.github/workflows/job-lint-go.yml
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            goos: linux
+          - runner: ubuntu-24.04
+            goos: freebsd
+          - runner: macos-15
+            goos: darwin
+          # FIXME: this is currently failing in a nonsensical way, so, running on linux instead...
+          # - runner: windows-2022
+          - runner: ubuntu-24.04
+            goos: windows
+          # Additionally lint for canary
+          - runner: ubuntu-24.04
+            goos: linux
+            canary: true
+    with:
+      timeout: 5
+      go-version: "1.24"
+      runner: ubuntu-24.04
+      # Note: in GitHub yaml world, if `matrix.canary` is undefined, and is passed to `inputs.canary`, the job
+      # will not run. However, if you test it, it will coerce to `false`, hence:
+      canary: ${{ matrix.canary && true || false }}
+      goos: ${{ matrix.goos }}
+
+  # Run common project checks (commits, licenses, etc)
+  lint-project-checks:
+    name: "project checks"
+    uses: ./.github/workflows/job-lint-project.yml
+    with:
+      timeout: 5
+      go-version: "1.24"
+      runner: ubuntu-24.04
+
+  # Lint for shell and yaml files
+  lint-other:
+    name: "other"
+    uses: ./.github/workflows/job-lint-other.yml
+    with:
+      timeout: 5
+      runner: ubuntu-24.04
+
+  # Verify we can actually build on all supported platforms, and a bunch of architectures
+  build-for-go:
+    name: "build for${{ inputs.hack }}"
+    uses: ./.github/workflows/job-build.yml
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Build for both old and stable go
+          - go-version: "1.23"
+          - go-version: "1.24"
+          # Additionally build for canary
+          - go-version: "1.24"
+            canary: true
+    with:
+      timeout: 5
+      go-version: ${{ matrix.go-version }}
+      runner: ubuntu-24.04
+      canary: ${{ matrix.canary && true || false }}
diff --git a/.github/workflows/workflow-test.yml b/.github/workflows/workflow-test.yml
index fb867433295..f7c65649a00 100644
--- a/.github/workflows/workflow-test.yml
+++ b/.github/workflows/workflow-test.yml
@@ -61,16 +61,13 @@ jobs:
         # Additionally run on canary for linux
         include:
           - runner: "ubuntu-24.04"
-            canary: false
           - runner: "macos-15"
-            canary: false
           - runner: "windows-2025"
-            canary: false
           - runner: "ubuntu-24.04"
             canary: true
     with:
       runner: ${{ matrix.runner }}
-      canary: ${{ matrix.canary }}
+      canary: ${{ matrix.canary && true || false }}
       # Windows routinely go over 5 minutes
       timeout: 10
       go-version: 1.24
@@ -286,26 +283,6 @@ jobs:
       - name: "Test (network driver=slirp4netns, port driver=builtin) (flaky)"
         run: docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} ${TEST_TARGET} /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=true
 
-  build:
-    timeout-minutes: 5
-    name: "build | ${{ matrix.go-version }}"
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        go-version: ["1.23", "1.24"]
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          fetch-depth: 1
-      - name: "Install go"
-        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
-        with:
-          go-version: ${{ matrix.go-version }}
-          check-latest: true
-      - name: "build"
-        run: make binaries
-
   test-integration-docker-compatibility:
     timeout-minutes: 40
     name: docker
diff --git a/Makefile b/Makefile
index 843d460b3a4..d7dce5f0fd3 100644
--- a/Makefile
+++ b/Makefile
@@ -26,6 +26,7 @@ PACKAGE := "github.com/containerd/nerdctl/v2"
 DOCKER ?= docker
 GO ?= go
 GOOS ?= $(shell $(GO) env GOOS)
+GOARCH ?= $(shell $(GO) env GOARCH)
 ifeq ($(GOOS),windows)
 	BIN_EXT := .exe
 endif
@@ -102,7 +103,7 @@ help:
 binaries: $(CURDIR)/_output/$(BINARY)$(BIN_EXT)
 
 $(CURDIR)/_output/$(BINARY)$(BIN_EXT):
-	$(call title, $@)
+	$(call title, $@: $(GOOS)/$(GOARCH))
 	$(GO_BUILD) $(GO_BUILD_FLAGS) $(VERBOSE_FLAG) -o $(CURDIR)/_output/$(BINARY)$(BIN_EXT) ./cmd/nerdctl
 	$(call footer, $@)
 

From 2d664979212d47ee03280d51f6dabf7ab0641bc7 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Thu, 1 May 2025 10:55:32 +0900
Subject: [PATCH 138/225] update runc (1.3.0)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 16b1dd7557f..554ed7aab4a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,7 +18,7 @@
 # Basic deps
 # @BINARY: the binary checksums are verified via Dockerfile.d/SHA256SUMS.d/<COMPONENT>-<VERSION>
 ARG CONTAINERD_VERSION=v2.0.5@fb4c30d4ede3531652d86197bf3fc9515e5276d9
-ARG RUNC_VERSION=v1.2.6@e89a29929c775025419ab0d218a43588b4c12b9a
+ARG RUNC_VERSION=v1.3.0@4ca628d1d4c974f92d24daccb901aa078aad748e
 ARG CNI_PLUGINS_VERSION=v1.6.2@BINARY
 
 # Extra deps: Build

From ea9519967fd947a373662a049db24d2a49ac5745 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Thu, 1 May 2025 10:57:15 +0900
Subject: [PATCH 139/225] update CNI plugins (1.7.1)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 Dockerfile                                   | 2 +-
 Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.6.2 | 2 --
 Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.7.1 | 2 ++
 3 files changed, 3 insertions(+), 3 deletions(-)
 delete mode 100644 Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.6.2
 create mode 100644 Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.7.1

diff --git a/Dockerfile b/Dockerfile
index 554ed7aab4a..b4b1e6cb09f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,7 +19,7 @@
 # @BINARY: the binary checksums are verified via Dockerfile.d/SHA256SUMS.d/<COMPONENT>-<VERSION>
 ARG CONTAINERD_VERSION=v2.0.5@fb4c30d4ede3531652d86197bf3fc9515e5276d9
 ARG RUNC_VERSION=v1.3.0@4ca628d1d4c974f92d24daccb901aa078aad748e
-ARG CNI_PLUGINS_VERSION=v1.6.2@BINARY
+ARG CNI_PLUGINS_VERSION=v1.7.1@BINARY
 
 # Extra deps: Build
 ARG BUILDKIT_VERSION=v0.20.1@BINARY
diff --git a/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.6.2 b/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.6.2
deleted file mode 100644
index 109168fb84f..00000000000
--- a/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.6.2
+++ /dev/null
@@ -1,2 +0,0 @@
-b8e811578fb66023f90d2e238d80cec3bdfca4b44049af74c374d4fae0f9c090  cni-plugins-linux-amd64-v1.6.2.tgz
-01e0e22acc7f7004e4588c1fe1871cc86d7ab562cd858e1761c4641d89ebfaa4  cni-plugins-linux-arm64-v1.6.2.tgz
diff --git a/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.7.1 b/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.7.1
new file mode 100644
index 00000000000..c9f57e39739
--- /dev/null
+++ b/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.7.1
@@ -0,0 +1,2 @@
+1a28a0506bfe5bcdc981caf1a49eeab7e72da8321f1119b7be85f22621013098  cni-plugins-linux-amd64-v1.7.1.tgz
+119fcb508d1ac2149e49a550752f9cd64d023a1d70e189b59c476e4d2bf7c497  cni-plugins-linux-arm64-v1.7.1.tgz

From ba6d7a3f69ce9b40e78bdcc827358ad9b48dc26a Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Thu, 1 May 2025 10:59:42 +0900
Subject: [PATCH 140/225] update BuildKit (0.21.1)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 Dockerfile                                 | 2 +-
 Dockerfile.d/SHA256SUMS.d/buildkit-v0.20.1 | 2 --
 Dockerfile.d/SHA256SUMS.d/buildkit-v0.21.1 | 2 ++
 3 files changed, 3 insertions(+), 3 deletions(-)
 delete mode 100644 Dockerfile.d/SHA256SUMS.d/buildkit-v0.20.1
 create mode 100644 Dockerfile.d/SHA256SUMS.d/buildkit-v0.21.1

diff --git a/Dockerfile b/Dockerfile
index b4b1e6cb09f..114e59e96c7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,7 +22,7 @@ ARG RUNC_VERSION=v1.3.0@4ca628d1d4c974f92d24daccb901aa078aad748e
 ARG CNI_PLUGINS_VERSION=v1.7.1@BINARY
 
 # Extra deps: Build
-ARG BUILDKIT_VERSION=v0.20.1@BINARY
+ARG BUILDKIT_VERSION=v0.21.1@BINARY
 # Extra deps: Lazy-pulling
 ARG STARGZ_SNAPSHOTTER_VERSION=v0.16.3@BINARY
 # Extra deps: Encryption
diff --git a/Dockerfile.d/SHA256SUMS.d/buildkit-v0.20.1 b/Dockerfile.d/SHA256SUMS.d/buildkit-v0.20.1
deleted file mode 100644
index d745717f958..00000000000
--- a/Dockerfile.d/SHA256SUMS.d/buildkit-v0.20.1
+++ /dev/null
@@ -1,2 +0,0 @@
-a52768180e2fc1e5ce5ba7c039dcb38ee22ec25e230d34bc4fb3c60159f71be0  buildkit-v0.20.1.linux-amd64.tar.gz
-0023f4304cd8e470a6a21f4272bbf10a4d02b51252f17ef22cc272d642c9cf23  buildkit-v0.20.1.linux-arm64.tar.gz
diff --git a/Dockerfile.d/SHA256SUMS.d/buildkit-v0.21.1 b/Dockerfile.d/SHA256SUMS.d/buildkit-v0.21.1
new file mode 100644
index 00000000000..853b7c35172
--- /dev/null
+++ b/Dockerfile.d/SHA256SUMS.d/buildkit-v0.21.1
@@ -0,0 +1,2 @@
+e0d83a631a48f13232fcee71cbd913e6b11dbde0a45985fa1b99af27ab97086e  buildkit-v0.21.1.linux-amd64.tar.gz
+7652a05f2961c386ea6e65c4701daa0e5a899a20c77596cd5f0eca02851dc1f6  buildkit-v0.21.1.linux-arm64.tar.gz

From 5374d79c1a3be43d3ff7267c4b7ce214335b4d6a Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Thu, 1 May 2025 11:03:10 +0900
Subject: [PATCH 141/225] update Nydus (2.3.1)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 114e59e96c7..8d6475dda35 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -46,7 +46,7 @@ ARG GO_VERSION=1.24
 ARG UBUNTU_VERSION=24.04
 ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.1
 ARG GOTESTSUM_VERSION=v1.12.1
-ARG NYDUS_VERSION=v2.3.0
+ARG NYDUS_VERSION=v2.3.1
 ARG SOCI_SNAPSHOTTER_VERSION=0.9.0
 ARG KUBO_VERSION=v0.33.2
 

From b343bed91d388a038a61df0dd5459f58bcf7b8d3 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Thu, 1 May 2025 11:03:34 +0900
Subject: [PATCH 142/225] update Kubo (0.34.1)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 8d6475dda35..31be02479f0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -48,7 +48,7 @@ ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.1
 ARG GOTESTSUM_VERSION=v1.12.1
 ARG NYDUS_VERSION=v2.3.1
 ARG SOCI_SNAPSHOTTER_VERSION=0.9.0
-ARG KUBO_VERSION=v0.33.2
+ARG KUBO_VERSION=v0.34.1
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.6.1@sha256:923441d7c25f1e2eb5789f82d987693c47b8ed987c4ab3b075d6ed2b5d6779a3 AS xx
 

From 81d830bf0bfff1600fb0f8f785abf5baf838b2ba Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Wed, 23 Apr 2025 00:27:30 +0900
Subject: [PATCH 143/225] go.mod: experimental integration of gomodjail
 (library sandbox)

https://github.com/AkihiroSuda/gomodjail

gomodjail imposes syscall restrictions on a specific set of Go modules (excepts ones that use unsafe pointers, reflections, etc.),
so as to mitigate their potential vulnerabilities and supply chain attack vectors.

Usage:
```
gomodjail run --go-mod=./go.mod -- nerdctl run hello-world
```

or

```
gomodjail pack --go-mod=./go.mod /usr/local/bin/nerdctl
./nerdctl.gomodjail run hello-world
```

Hint: use `git diff --word-diff` for reviewing the changes in this commit

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 .dockerignore                                 |  1 +
 .github/workflows/workflow-test.yml           | 24 ++++++-
 .gitignore                                    |  1 +
 Dockerfile                                    | 11 +++
 Dockerfile.d/test-integration-rootless.sh     |  5 +-
 cmd/nerdctl/builder/builder_builder_test.go   |  3 +-
 .../container/container_restart_linux_test.go |  3 +
 .../container/container_run_linux_test.go     |  2 +
 go.mod                                        | 71 ++++++++++---------
 mod/tigron/test/command.go                    |  4 ++
 mod/tigron/test/interfaces.go                 |  2 +
 pkg/testutil/nerdtest/command.go              | 18 +++--
 pkg/testutil/nerdtest/requirements.go         | 16 +++++
 pkg/testutil/testutil.go                      | 12 +++-
 14 files changed, 127 insertions(+), 46 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index 646cd932d8f..e892fca64ae 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,6 +1,7 @@
 # artifacts
 /nerdctl
 _output
+*.gomodjail
 
 # golangci-lint
 /build
diff --git a/.github/workflows/workflow-test.yml b/.github/workflows/workflow-test.yml
index f7c65649a00..03c7a94247e 100644
--- a/.github/workflows/workflow-test.yml
+++ b/.github/workflows/workflow-test.yml
@@ -197,7 +197,7 @@ jobs:
   test-integration-rootless:
     needs: build-dependencies
     timeout-minutes: 40
-    name: "${{ matrix.target }} | ${{ matrix.containerd }} | ${{ matrix.rootlesskit }} | ${{ matrix.ubuntu }}"
+    name: "${{ matrix.target }} | ${{ matrix.containerd }} | ${{ matrix.rootlesskit }} | ${{ matrix.ubuntu }} || ${{ matrix.nerdctl }}"
     runs-on: "${{ matrix.runner }}"
     strategy:
       fail-fast: false
@@ -209,30 +209,47 @@ jobs:
             target: rootless
             runner: "ubuntu-22.04"
             arch: amd64
+            nerdctl: ""
+            comment: ""
           - ubuntu: 24.04
             containerd: v2.0.5
             rootlesskit: v2.3.4
             target: rootless
             arch: amd64
             runner: "ubuntu-24.04"
+            nerdctl: ""
+            comment: ""
           - ubuntu: 24.04
             containerd: v2.0.5
             rootlesskit: v2.3.4
             target: rootless
             arch: arm64
             runner: "ubuntu-24.04-arm"
+            nerdctl: ""
+            comment: ""
           - ubuntu: 24.04
             containerd: v2.0.5
             rootlesskit: v2.3.4
             target: rootless-port-slirp4netns
             arch: amd64
             runner: "ubuntu-24.04"
+            nerdctl: ""
+            comment: ""
+          - ubuntu: 24.04
+            containerd: v2.0.5
+            rootlesskit: v2.3.4
+            target: rootless
+            arch: amd64
+            runner: "ubuntu-24.04"
+            nerdctl: "nerdctl.gomodjail"
+            comment: "Flaky, not a blocker for merging PRs"
     env:
       CONTAINERD_VERSION: "${{ matrix.containerd }}"
       ARCH: "${{ matrix.arch }}"
       UBUNTU_VERSION: "${{ matrix.ubuntu }}"
       ROOTLESSKIT_VERSION: "${{ matrix.rootlesskit }}"
       TEST_TARGET: "test-integration-${{ matrix.target }}"
+      NERDCTL: "${{ matrix.nerdctl }}"
     steps:
       - name: "Set up AppArmor"
         if: matrix.ubuntu == '24.04'
@@ -279,9 +296,10 @@ jobs:
           fi
           echo "WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622}" >> "$GITHUB_ENV"
       - name: "Test (network driver=slirp4netns, port driver=builtin)"
-        run: docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} ${TEST_TARGET} /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=false
+        run: docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} -e NERDCTL=${NERDCTL} ${TEST_TARGET} /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=false
       - name: "Test (network driver=slirp4netns, port driver=builtin) (flaky)"
-        run: docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} ${TEST_TARGET} /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=true
+        if: matrix.nerdctl != 'nerdctl.gomodjail'
+        run: docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} -e NERDCTL=${NERDCTL} ${TEST_TARGET} /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=true
 
   test-integration-docker-compatibility:
     timeout-minutes: 40
diff --git a/.gitignore b/.gitignore
index 9381e921112..1078655195f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 # artifacts
 /nerdctl
 _output
+*.gomodjail
 
 # golangci-lint
 /build
diff --git a/Dockerfile b/Dockerfile
index 31be02479f0..a7f60057f8e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -39,6 +39,8 @@ ARG CONTAINERD_FUSE_OVERLAYFS_VERSION=v2.1.2@BINARY
 ARG TINI_VERSION=v0.19.0@BINARY
 # Extra deps: Debug
 ARG BUILDG_VERSION=v0.5.2@BINARY
+# Extra deps: gomodjail
+ARG GOMODJAIL_VERSION=v0.1.1@756b1b9636c6de78984cbad1a974d930e2f0e851
 
 # Test deps
 # Currently, the Docker Official Images and the test deps are not pinned by the hash
@@ -231,6 +233,13 @@ RUN ROOTLESSKIT_VERSION=${ROOTLESSKIT_VERSION/@BINARY}; \
   tar xzf "${fname}" -C /out/bin && \
   rm -f "${fname}" /out/bin/rootlesskit-docker-proxy && \
   echo "- RootlessKit: ${ROOTLESSKIT_VERSION}" >> /out/share/doc/nerdctl-full/README.md
+ARG GOMODJAIL_VERSION
+RUN git clone https://github.com/AkihiroSuda/gomodjail.git /go/src/github.com/AkihiroSuda/gomodjail && \
+  cd /go/src/github.com/AkihiroSuda/gomodjail && \
+  git-checkout-tag-with-hash.sh "${GOMODJAIL_VERSION}" && \
+  make STATIC=1 && \
+  cp -a _output/bin/gomodjail /out/bin/ && \
+  echo "- gomodjail: ${GOMODJAIL_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 
 RUN echo "" >> /out/share/doc/nerdctl-full/README.md && \
   echo "## License" >> /out/share/doc/nerdctl-full/README.md && \
@@ -245,6 +254,8 @@ COPY . /go/src/github.com/containerd/nerdctl
 RUN { echo "# nerdctl (full distribution)"; echo "- nerdctl: $(cd /go/src/github.com/containerd/nerdctl && git describe --tags)"; cat /out/share/doc/nerdctl-full/README.md; } > /out/share/doc/nerdctl-full/README.md.new; mv /out/share/doc/nerdctl-full/README.md.new /out/share/doc/nerdctl-full/README.md
 WORKDIR /go/src/github.com/containerd/nerdctl
 RUN BINDIR=/out/bin make binaries install
+RUN /out/bin/gomodjail pack --go-mod=/go/src/github.com/containerd/nerdctl/go.mod /out/bin/nerdctl && \
+  cp -a nerdctl.gomodjail /out/bin/
 COPY README.md /out/share/doc/nerdctl/
 COPY docs /out/share/doc/nerdctl/docs
 RUN (cd /out && find ! -type d | sort | xargs sha256sum > /tmp/SHA256SUMS ) && \
diff --git a/Dockerfile.d/test-integration-rootless.sh b/Dockerfile.d/test-integration-rootless.sh
index 481610eb1bc..9d35d247ccd 100755
--- a/Dockerfile.d/test-integration-rootless.sh
+++ b/Dockerfile.d/test-integration-rootless.sh
@@ -15,6 +15,7 @@
 #   limitations under the License.
 
 set -eux -o pipefail
+: "${NERDCTL:=}"
 if [[ "$(id -u)" = "0" ]]; then
   # Ensure securityfs is mounted for apparmor to work
   if ! mountpoint -q /sys/kernel/security; then
@@ -32,7 +33,7 @@ if [[ "$(id -u)" = "0" ]]; then
 
 	# Switch to the rootless user via SSH
 	systemctl start ssh
-	exec ssh -o StrictHostKeyChecking=no rootless@localhost "$0" "$@"
+	exec ssh -o StrictHostKeyChecking=no rootless@localhost NERDCTL="$NERDCTL" "$0" "$@"
 else
 	containerd-rootless-setuptool.sh install
 	if grep -q "options use-vc" /etc/resolv.conf; then
@@ -63,5 +64,5 @@ EOF
 	# Once ssh-ed, we lost the Dockerfile working dir, so, get back in the nerdctl checkout
 	cd /go/src/github.com/containerd/nerdctl
 	# We also lose the PATH (and SendEnv=PATH would require sshd config changes)
-	exec env PATH="/usr/local/go/bin:$PATH" "$@"
+	exec env PATH="/usr/local/go/bin:$PATH" NERDCTL="$NERDCTL" "$@"
 fi
diff --git a/cmd/nerdctl/builder/builder_builder_test.go b/cmd/nerdctl/builder/builder_builder_test.go
index da912cc0af9..7f1168904ac 100644
--- a/cmd/nerdctl/builder/builder_builder_test.go
+++ b/cmd/nerdctl/builder/builder_builder_test.go
@@ -133,7 +133,8 @@ CMD ["echo", "nerdctl-test-builder-prune"]`, testutil.CommonImage)
 			{
 				Description: "Debug",
 				// `nerdctl builder debug` is currently incompatible with `docker buildx debug`.
-				Require:    require.All(require.Not(nerdtest.Docker)),
+				// FIXME: fails with gomodjail: "timed out to access cache storage. other debug session is running?"
+				Require:    require.All(require.Not(nerdtest.Docker), require.Not(nerdtest.Gomodjail)),
 				NoParallel: true,
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					dockerfile := fmt.Sprintf(`FROM %s
diff --git a/cmd/nerdctl/container/container_restart_linux_test.go b/cmd/nerdctl/container/container_restart_linux_test.go
index 55996bcbcd4..a8d0e525a98 100644
--- a/cmd/nerdctl/container/container_restart_linux_test.go
+++ b/cmd/nerdctl/container/container_restart_linux_test.go
@@ -26,6 +26,7 @@ import (
 	"gotest.tools/v3/assert"
 
 	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
@@ -129,6 +130,8 @@ func TestRestartWithTime(t *testing.T) {
 func TestRestartWithSignal(t *testing.T) {
 	testCase := nerdtest.Setup()
 
+	testCase.Require = require.Not(nerdtest.Gomodjail) // FIXME
+
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
 		helpers.Anyhow("rm", "-f", data.Identifier())
 	}
diff --git a/cmd/nerdctl/container/container_run_linux_test.go b/cmd/nerdctl/container/container_run_linux_test.go
index b40ede8102d..71f2a0c1be6 100644
--- a/cmd/nerdctl/container/container_run_linux_test.go
+++ b/cmd/nerdctl/container/container_run_linux_test.go
@@ -34,6 +34,7 @@ import (
 	"gotest.tools/v3/assert"
 
 	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
@@ -381,6 +382,7 @@ func TestRunTTY(t *testing.T) {
 
 func TestRunSigProxy(t *testing.T) {
 	testCase := nerdtest.Setup()
+	testCase.Require = require.Not(nerdtest.Gomodjail) // FIXME
 
 	testCase.SubTests = []*test.Case{
 		{
diff --git a/go.mod b/go.mod
index 61ccab501d8..d263e36bec5 100644
--- a/go.mod
+++ b/go.mod
@@ -1,3 +1,4 @@
+//gomodjail:confined
 module github.com/containerd/nerdctl/v2
 
 go 1.23.0
@@ -6,65 +7,65 @@ require (
 	github.com/Masterminds/semver/v3 v3.3.1
 	github.com/Microsoft/go-winio v0.6.2
 	github.com/Microsoft/hcsshim v0.12.9
-	github.com/compose-spec/compose-go/v2 v2.6.1
+	github.com/compose-spec/compose-go/v2 v2.6.1 //gomodjail:unconfined
 	github.com/containerd/accelerated-container-image v1.3.0
-	github.com/containerd/cgroups/v3 v3.0.5
-	github.com/containerd/console v1.0.4
+	github.com/containerd/cgroups/v3 v3.0.5 //gomodjail:unconfined
+	github.com/containerd/console v1.0.4 //gomodjail:unconfined
 	github.com/containerd/containerd/api v1.8.0
-	github.com/containerd/containerd/v2 v2.0.5
-	github.com/containerd/continuity v0.4.5
+	github.com/containerd/containerd/v2 v2.0.5 //gomodjail:unconfined
+	github.com/containerd/continuity v0.4.5 //gomodjail:unconfined
 	github.com/containerd/errdefs v1.0.0
-	github.com/containerd/fifo v1.1.0
-	github.com/containerd/go-cni v1.1.12
-	github.com/containerd/imgcrypt/v2 v2.0.1
+	github.com/containerd/fifo v1.1.0 //gomodjail:unconfined
+	github.com/containerd/go-cni v1.1.12 //gomodjail:unconfined
+	github.com/containerd/imgcrypt/v2 v2.0.1 //gomodjail:unconfined
 	github.com/containerd/log v0.1.0
 	github.com/containerd/nerdctl/mod/tigron v0.0.0
-	github.com/containerd/nydus-snapshotter v0.15.1
-	github.com/containerd/platforms v1.0.0-rc.1
-	github.com/containerd/stargz-snapshotter v0.16.3
-	github.com/containerd/stargz-snapshotter/estargz v0.16.3
-	github.com/containerd/stargz-snapshotter/ipfs v0.16.3
+	github.com/containerd/nydus-snapshotter v0.15.1 //gomodjail:unconfined
+	github.com/containerd/platforms v1.0.0-rc.1 //gomodjail:unconfined
+	github.com/containerd/stargz-snapshotter v0.16.3 //gomodjail:unconfined
+	github.com/containerd/stargz-snapshotter/estargz v0.16.3 //gomodjail:unconfined
+	github.com/containerd/stargz-snapshotter/ipfs v0.16.3 //gomodjail:unconfined
 	github.com/containerd/typeurl/v2 v2.2.3
-	github.com/containernetworking/cni v1.3.0
-	github.com/containernetworking/plugins v1.7.1
+	github.com/containernetworking/cni v1.3.0 //gomodjail:unconfined
+	github.com/containernetworking/plugins v1.7.1 //gomodjail:unconfined
 	github.com/coreos/go-iptables v0.8.0
 	github.com/coreos/go-systemd/v22 v22.5.0
-	github.com/cyphar/filepath-securejoin v0.4.1
+	github.com/cyphar/filepath-securejoin v0.4.1 //gomodjail:unconfined
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v28.1.1+incompatible
-	github.com/docker/docker v28.1.1+incompatible
+	github.com/docker/cli v28.1.1+incompatible //gomodjail:unconfined
+	github.com/docker/docker v28.1.1+incompatible //gomodjail:unconfined
 	github.com/docker/go-connections v0.5.0
 	github.com/docker/go-units v0.5.0
-	github.com/fahedouch/go-logrotate v0.3.0
-	github.com/fatih/color v1.18.0
+	github.com/fahedouch/go-logrotate v0.3.0 //gomodjail:unconfined
+	github.com/fatih/color v1.18.0 //gomodjail:unconfined
 	github.com/fluent/fluent-logger-golang v1.9.0
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/go-viper/mapstructure/v2 v2.2.1
 	github.com/ipfs/go-cid v0.5.0
 	github.com/klauspost/compress v1.18.0
-	github.com/mattn/go-isatty v0.0.20
+	github.com/mattn/go-isatty v0.0.20 //gomodjail:unconfined
 	github.com/moby/sys/mount v0.3.4
 	github.com/moby/sys/signal v0.7.1
-	github.com/moby/sys/userns v0.1.0
-	github.com/moby/term v0.5.2
-	github.com/muesli/cancelreader v0.2.2
+	github.com/moby/sys/userns v0.1.0 //gomodjail:unconfined
+	github.com/moby/term v0.5.2 //gomodjail:unconfined
+	github.com/muesli/cancelreader v0.2.2 //gomodjail:unconfined
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/opencontainers/runtime-spec v1.2.1
 	github.com/pelletier/go-toml/v2 v2.2.4
-	github.com/rootless-containers/bypass4netns v0.4.2
-	github.com/rootless-containers/rootlesskit/v2 v2.3.4
-	github.com/spf13/cobra v1.9.1
-	github.com/spf13/pflag v1.0.6
-	github.com/vishvananda/netlink v1.3.1-0.20250303224720-0e7078ed04c8
-	github.com/vishvananda/netns v0.0.5
+	github.com/rootless-containers/bypass4netns v0.4.2 //gomodjail:unconfined
+	github.com/rootless-containers/rootlesskit/v2 v2.3.4 //gomodjail:unconfined
+	github.com/spf13/cobra v1.9.1 //gomodjail:unconfined
+	github.com/spf13/pflag v1.0.6 //gomodjail:unconfined
+	github.com/vishvananda/netlink v1.3.1-0.20250303224720-0e7078ed04c8 //gomodjail:unconfined
+	github.com/vishvananda/netns v0.0.5 //gomodjail:unconfined
 	github.com/yuchanns/srslog v1.1.0
 	go.uber.org/mock v0.5.2
 	golang.org/x/crypto v0.37.0
 	golang.org/x/net v0.39.0
-	golang.org/x/sync v0.13.0
-	golang.org/x/sys v0.32.0
-	golang.org/x/term v0.31.0
+	golang.org/x/sync v0.13.0 //gomodjail:unconfined
+	golang.org/x/sys v0.32.0 //gomodjail:unconfined
+	golang.org/x/term v0.31.0 //gomodjail:unconfined
 	golang.org/x/text v0.24.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
@@ -105,6 +106,7 @@ require (
 	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/symlink v0.3.0 // indirect
+	//gomodjail:unconfined
 	github.com/moby/sys/user v0.3.0 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/multiformats/go-base32 v0.1.0 // indirect
@@ -118,6 +120,7 @@ require (
 	github.com/philhofer/fwd v1.1.3-0.20240612014219-fbbf4953d986 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/sasha-s/go-deadlock v0.3.5 // indirect
+	//gomodjail:unconfined
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/smallstep/pkcs7 v0.1.1 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
@@ -135,7 +138,9 @@ require (
 	go.opentelemetry.io/otel/trace v1.31.0 // indirect
 	golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 // indirect
+	//gomodjail:unconfined
 	google.golang.org/grpc v1.69.4 // indirect
+	//gomodjail:unconfined
 	google.golang.org/protobuf v1.36.5 // indirect
 	lukechampine.com/blake3 v1.3.0 // indirect
 )
diff --git a/mod/tigron/test/command.go b/mod/tigron/test/command.go
index 1516cf8d4dc..272d689d490 100644
--- a/mod/tigron/test/command.go
+++ b/mod/tigron/test/command.go
@@ -110,6 +110,10 @@ type GenericCommand struct {
 	rawStdErr string
 }
 
+func (gc *GenericCommand) Binary() string {
+	return gc.cmd.Binary
+}
+
 func (gc *GenericCommand) WithBinary(binary string) {
 	gc.cmd.Binary = binary
 }
diff --git a/mod/tigron/test/interfaces.go b/mod/tigron/test/interfaces.go
index 12df876747a..f9f9c73431a 100644
--- a/mod/tigron/test/interfaces.go
+++ b/mod/tigron/test/interfaces.go
@@ -101,6 +101,8 @@ type Helpers interface {
 // a Setup or Cleanup routine, and as the basis of any type of helper.
 // For more powerful use-cases outside of test cases, see below CustomizableCommand.
 type TestableCommand interface {
+	// Binary returns what binary to execute.
+	Binary() string
 	// WithBinary specifies what binary to execute.
 	WithBinary(binary string)
 	// WithArgs specifies the args to pass to the binary. Note that WithArgs can be used multiple
diff --git a/pkg/testutil/nerdtest/command.go b/pkg/testutil/nerdtest/command.go
index d3ca847119a..cf96407ee1c 100644
--- a/pkg/testutil/nerdtest/command.go
+++ b/pkg/testutil/nerdtest/command.go
@@ -56,20 +56,28 @@ func newNerdCommand(conf test.Config, t *testing.T) *nerdCommand {
 	trgt := getTarget()
 	switch trgt {
 	case targetNerdctl:
-		binary, err = exec.LookPath(trgt)
+		nerdctl := trgt
+		if env := os.Getenv("NERDCTL"); env != "" {
+			nerdctl = env
+		}
+		binary, err = exec.LookPath(nerdctl)
 		if err != nil {
-			t.Fatalf("unable to find binary %q: %v", trgt, err)
+			t.Fatalf("unable to find binary %q: %v", nerdctl, err)
 		}
 		// Set the default namespace if we do not have something already
 		if conf.Read(Namespace) == "" {
 			conf.Write(Namespace, defaultNamespace)
 		}
 	case targetDocker:
-		binary, err = exec.LookPath(trgt)
+		docker := trgt
+		if env := os.Getenv("DOCKER"); env != "" {
+			docker = env
+		}
+		binary, err = exec.LookPath(docker)
 		if err != nil {
-			t.Fatalf("unable to find binary %q: %v", trgt, err)
+			t.Fatalf("unable to find binary %q: %v", docker, err)
 		}
-		if err = exec.Command("docker", "compose", "version").Run(); err != nil {
+		if err = exec.Command(binary, "compose", "version").Run(); err != nil {
 			t.Fatalf("docker does not support compose: %v", err)
 		}
 	default:
diff --git a/pkg/testutil/nerdtest/requirements.go b/pkg/testutil/nerdtest/requirements.go
index 90291a28aef..37916551e41 100644
--- a/pkg/testutil/nerdtest/requirements.go
+++ b/pkg/testutil/nerdtest/requirements.go
@@ -360,3 +360,19 @@ var Private = &test.Requirement{
 		}
 	},
 }
+
+// Gomodjail returns whether the binary is packed with gomodjail.
+// https://github.com/AkihiroSuda/gomodjail
+var Gomodjail = &test.Requirement{
+	Check: func(_ test.Data, helpers test.Helpers) (ret bool, mess string) {
+		binary := helpers.Command().Binary()
+		// FIXME: do not rely on the filename
+		ret = strings.HasSuffix(binary, ".gomodjail")
+		if ret {
+			mess = "current target is packed with gomodjail"
+		} else {
+			mess = "current target is not packed with gomodjail"
+		}
+		return ret, mess
+	},
+}
diff --git a/pkg/testutil/testutil.go b/pkg/testutil/testutil.go
index f12c704e8bb..5e6ac5abf9b 100644
--- a/pkg/testutil/testutil.go
+++ b/pkg/testutil/testutil.go
@@ -721,13 +721,21 @@ func newBase(t *testing.T, ns string, ipv6Compatible bool, kubernetesCompatible
 	var err error
 	switch base.Target {
 	case Nerdctl:
-		base.Binary, err = exec.LookPath("nerdctl")
+		nerdctl := "nerdctl"
+		if env := os.Getenv("NERDCTL"); env != "" {
+			nerdctl = env
+		}
+		base.Binary, err = exec.LookPath(nerdctl)
 		if err != nil {
 			t.Fatal(err)
 		}
 		base.Args = []string{"--namespace=" + ns}
 	case Docker:
-		base.Binary, err = exec.LookPath("docker")
+		docker := "docker"
+		if env := os.Getenv("DOCKER"); env != "" {
+			docker = env
+		}
+		base.Binary, err = exec.LookPath(docker)
 		if err != nil {
 			t.Fatal(err)
 		}

From 71c646f1478041479d15d29b5b522d342125a726 Mon Sep 17 00:00:00 2001
From: Evan Lezar <elezar@nvidia.com>
Date: Wed, 7 Jun 2023 16:25:22 +0200
Subject: [PATCH 144/225] Add support for CDI devices to device flag

This change adds support for specifying fully-qualified CDI device
names in the --device flag. This allows the Container Device Interface
(CDI) to be used to inject devices into container being run.

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Enable cdi feature for Docker

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Update go mod

Signed-off-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: Jin Dong <djdongjin95@gmail.com>

use containerd cdi.WithCDIDevices

Signed-off-by: Jin Dong <djdongjin95@gmail.com>
---
 .github/workflows/workflow-test.yml           |  5 ++
 cmd/nerdctl/container/container_create.go     | 12 +++-
 .../container/container_run_linux_test.go     | 55 +++++++++++++++++++
 cmd/nerdctl/helpers/flagutil.go               |  6 ++
 cmd/nerdctl/main.go                           |  1 +
 docs/config.md                                |  1 +
 go.mod                                        |  6 ++
 go.sum                                        | 30 ++++++++++
 pkg/api/types/container_types.go              |  2 +
 pkg/cmd/container/create.go                   |  2 +
 pkg/cmd/container/run_cdi.go                  | 46 ++++++++++++++++
 pkg/config/config.go                          |  3 +
 pkg/defaults/defaults_darwin.go               |  4 ++
 pkg/defaults/defaults_freebsd.go              |  4 ++
 pkg/defaults/defaults_linux.go                | 21 +++++++
 pkg/defaults/defaults_windows.go              |  4 ++
 16 files changed, 201 insertions(+), 1 deletion(-)
 create mode 100644 pkg/cmd/container/run_cdi.go

diff --git a/.github/workflows/workflow-test.yml b/.github/workflows/workflow-test.yml
index 03c7a94247e..2a618746cce 100644
--- a/.github/workflows/workflow-test.yml
+++ b/.github/workflows/workflow-test.yml
@@ -328,6 +328,11 @@ jobs:
           # FIXME: remove expect when we are done removing unbuffer from tests
           sudo apt-get install -qq expect
           make install-dev-tools
+      - name: Enable CDI in the Docker daemon.
+        run: |
+          sudo mkdir -p /etc/docker
+          sudo jq '.features.cdi = true' /etc/docker/daemon.json | sudo tee /etc/docker/daemon.json.tmp && sudo mv /etc/docker/daemon.json.tmp /etc/docker/daemon.json
+          sudo systemctl restart docker
       - name: "Ensure that the integration test suite is compatible with Docker"
         run: WITH_SUDO=true ./hack/test-integration.sh -test.target=docker
       - name: "Ensure that the IPv6 integration test suite is compatible with Docker"
diff --git a/cmd/nerdctl/container/container_create.go b/cmd/nerdctl/container/container_create.go
index 67db1a4f94a..81956fe0019 100644
--- a/cmd/nerdctl/container/container_create.go
+++ b/cmd/nerdctl/container/container_create.go
@@ -21,6 +21,7 @@ import (
 	"runtime"
 
 	"github.com/spf13/cobra"
+	cdiparser "tags.cncf.io/container-device-interface/pkg/parser"
 
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
@@ -55,6 +56,7 @@ func CreateCommand() *cobra.Command {
 	return cmd
 }
 
+//revive:disable:function-length
 func createOptions(cmd *cobra.Command) (types.ContainerCreateOptions, error) {
 	var err error
 	opt := types.ContainerCreateOptions{
@@ -215,10 +217,18 @@ func createOptions(cmd *cobra.Command) (types.ContainerCreateOptions, error) {
 	if err != nil {
 		return opt, err
 	}
-	opt.Device, err = cmd.Flags().GetStringSlice("device")
+
+	allDevices, err := cmd.Flags().GetStringSlice("device")
 	if err != nil {
 		return opt, err
 	}
+	for _, device := range allDevices {
+		if cdiparser.IsQualifiedName(device) {
+			opt.CDIDevices = append(opt.CDIDevices, device)
+		} else {
+			opt.Device = append(opt.Device, device)
+		}
+	}
 	// #endregion
 
 	// #region for blkio flags
diff --git a/cmd/nerdctl/container/container_run_linux_test.go b/cmd/nerdctl/container/container_run_linux_test.go
index 71f2a0c1be6..aaa4b124f99 100644
--- a/cmd/nerdctl/container/container_run_linux_test.go
+++ b/cmd/nerdctl/container/container_run_linux_test.go
@@ -661,3 +661,58 @@ func TestPortBindingWithCustomHost(t *testing.T) {
 
 	testCase.Run(t)
 }
+
+func TestRunDeviceCDI(t *testing.T) {
+	t.Parallel()
+	// Although CDI injection is supported by Docker, specifying the --cdi-spec-dirs on the command line is not.
+	testutil.DockerIncompatible(t)
+	cdiSpecDir := filepath.Join(t.TempDir(), "cdi")
+	writeTestCDISpec(t, cdiSpecDir)
+
+	base := testutil.NewBase(t)
+	base.Cmd("--cdi-spec-dirs", cdiSpecDir, "run",
+		"--rm",
+		"--device", "vendor1.com/device=foo",
+		testutil.AlpineImage, "env",
+	).AssertOutContains("FOO=injected")
+}
+
+func TestRunDeviceCDIWithNerdctlConfig(t *testing.T) {
+	t.Parallel()
+	// Although CDI injection is supported by Docker, specifying the --cdi-spec-dirs on the command line is not.
+	testutil.DockerIncompatible(t)
+	cdiSpecDir := filepath.Join(t.TempDir(), "cdi")
+	writeTestCDISpec(t, cdiSpecDir)
+
+	tomlPath := filepath.Join(t.TempDir(), "nerdctl.toml")
+	err := os.WriteFile(tomlPath, []byte(fmt.Sprintf(`
+cdi_spec_dirs = ["%s"]
+`, cdiSpecDir)), 0400)
+	assert.NilError(t, err)
+
+	base := testutil.NewBase(t)
+	base.Env = append(base.Env, "NERDCTL_TOML="+tomlPath)
+	base.Cmd("run",
+		"--rm",
+		"--device", "vendor1.com/device=foo",
+		testutil.AlpineImage, "env",
+	).AssertOutContains("FOO=injected")
+}
+
+func writeTestCDISpec(t *testing.T, cdiSpecDir string) {
+	const testCDIVendor1 = `
+cdiVersion: "0.3.0"
+kind: "vendor1.com/device"
+devices:
+- name: foo
+  containerEdits:
+    env:
+    - FOO=injected
+`
+
+	err := os.MkdirAll(cdiSpecDir, 0700)
+	assert.NilError(t, err)
+	cdiSpecPath := filepath.Join(cdiSpecDir, "vendor1.yaml")
+	err = os.WriteFile(cdiSpecPath, []byte(testCDIVendor1), 0400)
+	assert.NilError(t, err)
+}
diff --git a/cmd/nerdctl/helpers/flagutil.go b/cmd/nerdctl/helpers/flagutil.go
index f1137ac5ebc..4f9261c0cf3 100644
--- a/cmd/nerdctl/helpers/flagutil.go
+++ b/cmd/nerdctl/helpers/flagutil.go
@@ -107,6 +107,11 @@ func ProcessRootCmdFlags(cmd *cobra.Command) (types.GlobalCommandOptions, error)
 	if err != nil {
 		return types.GlobalCommandOptions{}, err
 	}
+	cdiSpecDirs, err := cmd.Flags().GetStringSlice("cdi-spec-dirs")
+	if err != nil {
+		return types.GlobalCommandOptions{}, err
+	}
+
 	return types.GlobalCommandOptions{
 		Debug:            debug,
 		DebugFull:        debugFull,
@@ -123,6 +128,7 @@ func ProcessRootCmdFlags(cmd *cobra.Command) (types.GlobalCommandOptions, error)
 		HostGatewayIP:    hostGatewayIP,
 		BridgeIP:         bridgeIP,
 		KubeHideDupe:     kubeHideDupe,
+		CDISpecDirs:      cdiSpecDirs,
 	}, nil
 }
 
diff --git a/cmd/nerdctl/main.go b/cmd/nerdctl/main.go
index 1efadbe99d3..2b81f65b879 100644
--- a/cmd/nerdctl/main.go
+++ b/cmd/nerdctl/main.go
@@ -186,6 +186,7 @@ func initRootCmdFlags(rootCmd *cobra.Command, tomlPath string) (*pflag.FlagSet,
 	helpers.AddPersistentStringFlag(rootCmd, "host-gateway-ip", nil, nil, nil, aliasToBeInherited, cfg.HostGatewayIP, "NERDCTL_HOST_GATEWAY_IP", "IP address that the special 'host-gateway' string in --add-host resolves to. Defaults to the IP address of the host. It has no effect without setting --add-host")
 	helpers.AddPersistentStringFlag(rootCmd, "bridge-ip", nil, nil, nil, aliasToBeInherited, cfg.BridgeIP, "NERDCTL_BRIDGE_IP", "IP address for the default nerdctl bridge network")
 	rootCmd.PersistentFlags().Bool("kube-hide-dupe", cfg.KubeHideDupe, "Deduplicate images for Kubernetes with namespace k8s.io")
+	rootCmd.PersistentFlags().StringSlice("cdi-spec-dirs", cfg.CDISpecDirs, "The directories to search for CDI spec files. Defaults to /etc/cdi,/var/run/cdi")
 	return aliasToBeInherited, nil
 }
 
diff --git a/docs/config.md b/docs/config.md
index b4c6a20a381..c7bccf72ad5 100644
--- a/docs/config.md
+++ b/docs/config.md
@@ -47,6 +47,7 @@ experimental   = true
 | `host_gateway_ip`   | `--host-gateway-ip`                | `NERDCTL_HOST_GATEWAY_IP` | IP address that the special 'host-gateway' string in --add-host resolves to. Defaults to the IP address of the host. It has no effect without setting --add-host | Since 1.3.0      |
 | `bridge_ip`         | `--bridge-ip`                      | `NERDCTL_BRIDGE_IP`       | IP address for the default nerdctl bridge network, e.g., 10.1.100.1/24                                                                                           | Since 2.0.1      |
 | `kube_hide_dupe`    | `--kube-hide-dupe`                 |                           | Deduplicate images for Kubernetes with namespace k8s.io, no more redundant <none> ones are displayed    | Since 2.0.3      |
+| `cdi_spec_dirs`     | `--cdi-spec-dirs`                   |                          | The folders to use when searching for CDI ([container-device-interface](https://github.com/cncf-tags/container-device-interface)) specifications.    | Since 2.1.0 |
 
 The properties are parsed in the following precedence:
 1. CLI flag
diff --git a/go.mod b/go.mod
index d263e36bec5..572affdd6d4 100644
--- a/go.mod
+++ b/go.mod
@@ -69,6 +69,7 @@ require (
 	golang.org/x/text v0.24.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
+	tags.cncf.io/container-device-interface v1.0.1
 )
 
 require (
@@ -115,6 +116,7 @@ require (
 	github.com/multiformats/go-multibase v0.2.0 // indirect
 	github.com/multiformats/go-multihash v0.2.3 // indirect
 	github.com/multiformats/go-varint v0.0.7 // indirect
+	github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626 // indirect
 	github.com/opencontainers/selinux v1.12.0 // indirect
 	github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7 // indirect
 	github.com/philhofer/fwd v1.1.3-0.20240612014219-fbbf4953d986 // indirect
@@ -125,6 +127,7 @@ require (
 	github.com/smallstep/pkcs7 v0.1.1 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
+	github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
 	github.com/tinylib/msgp v1.2.0 // indirect
 	github.com/vbatts/tar-split v0.11.6 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
@@ -137,12 +140,15 @@ require (
 	go.opentelemetry.io/otel/metric v1.31.0 // indirect
 	go.opentelemetry.io/otel/trace v1.31.0 // indirect
 	golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
+	golang.org/x/mod v0.22.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 // indirect
 	//gomodjail:unconfined
 	google.golang.org/grpc v1.69.4 // indirect
 	//gomodjail:unconfined
 	google.golang.org/protobuf v1.36.5 // indirect
 	lukechampine.com/blake3 v1.3.0 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
+	tags.cncf.io/container-device-interface/specs-go v1.0.0 // indirect
 )
 
 replace github.com/containerd/nerdctl/mod/tigron v0.0.0 => ./mod/tigron
diff --git a/go.sum b/go.sum
index 19f9d5499d4..339839d3fcf 100644
--- a/go.sum
+++ b/go.sum
@@ -14,6 +14,8 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/Microsoft/hcsshim v0.12.9 h1:2zJy5KA+l0loz1HzEGqyNnjd3fyZA31ZBCGKacp6lLg=
 github.com/Microsoft/hcsshim v0.12.9/go.mod h1:fJ0gkFAna6ukt0bLdKB8djt4XIJhF/vEPuoIWYVvZ8Y=
+github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
+github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -152,14 +154,21 @@ github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
 github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/ipfs/go-cid v0.5.0 h1:goEKKhaGm0ul11IHA7I6p1GmKz8kEYniqFopaB5Otwg=
@@ -195,6 +204,7 @@ github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dz
 github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mndrix/tap-go v0.0.0-20171203230836-629fa407e90b/go.mod h1:pzzDgJWZ34fGzaAZGFW22KVZDfyrYW+QABMrWnJBnSs=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
@@ -217,6 +227,7 @@ github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
 github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o=
 github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
+github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
 github.com/multiformats/go-base32 v0.1.0 h1:pVx9xoSPqEIQG8o+UbAe7DNi51oej1NtK+aGkbLYxPE=
@@ -239,8 +250,12 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/opencontainers/runtime-spec v1.0.3-0.20220825212826-86290f6a00fb/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
 github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626 h1:DmNGcqH3WDbV5k8OJ+esPWbqUOX5rMLR2PMvziDMJi0=
+github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626/go.mod h1:BRHJJd0E+cx42OybVYSgUvZmU0B8P9gZuRXlZUP7TKI=
+github.com/opencontainers/selinux v1.9.1/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
 github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8=
 github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
@@ -266,6 +281,7 @@ github.com/rootless-containers/rootlesskit/v2 v2.3.4/go.mod h1:AJNM4jS0jFIF8GvBf
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sasha-s/go-deadlock v0.3.5 h1:tNCOEEDG6tBqrNDOX35j/7hL5FcFViG6awUGROb2NsU=
 github.com/sasha-s/go-deadlock v0.3.5/go.mod h1:bugP6EGbdGYObIlx7pUZtWqlvo8k9H6vCBBsiChJQ5U=
+github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/smallstep/pkcs7 v0.1.1 h1:x+rPdt2W088V9Vkjho4KtoggyktZJlMduZAtRHm68LU=
@@ -282,6 +298,7 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -289,8 +306,11 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
+github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/tinylib/msgp v1.2.0 h1:0uKB/662twsVBpYUPbokj4sTSKhWFKB7LopO2kWK8lY=
 github.com/tinylib/msgp v1.2.0/go.mod h1:2vIGs3lcUo8izAATNobrCHevYZC/LMsJtw4JPiYPHro=
+github.com/urfave/cli v1.19.1/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
 github.com/vbatts/tar-split v0.11.6 h1:4SjTW5+PU11n6fZenf2IPoV8/tz3AaYHMWjf23envGs=
 github.com/vbatts/tar-split v0.11.6/go.mod h1:dqKNtesIOr2j2Qv3W/cHjnvk9I8+G7oAkFDFN6TCBEI=
 github.com/vishvananda/netlink v1.3.1-0.20250303224720-0e7078ed04c8 h1:Y4egeTrP7sccowz2GWTJVtHlwkZippgBTpUmMteFUWQ=
@@ -355,6 +375,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
+golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -390,6 +412,8 @@ golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -489,3 +513,9 @@ honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 lukechampine.com/blake3 v1.3.0 h1:sJ3XhFINmHSrYCgl958hscfIa3bw8x4DqMP3u1YvoYE=
 lukechampine.com/blake3 v1.3.0/go.mod h1:0OFRp7fBtAylGVCO40o87sbupkyIGgbpv1+M1k1LM6k=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+tags.cncf.io/container-device-interface v1.0.1 h1:KqQDr4vIlxwfYh0Ed/uJGVgX+CHAkahrgabg6Q8GYxc=
+tags.cncf.io/container-device-interface v1.0.1/go.mod h1:JojJIOeW3hNbcnOH2q0NrWNha/JuHoDZcmYxAZwb2i0=
+tags.cncf.io/container-device-interface/specs-go v1.0.0 h1:8gLw29hH1ZQP9K1YtAzpvkHCjjyIxHZYzBAvlQ+0vD8=
+tags.cncf.io/container-device-interface/specs-go v1.0.0/go.mod h1:u86hoFWqnh3hWz3esofRFKbI261bUlvUfLKGrDhJkgQ=
diff --git a/pkg/api/types/container_types.go b/pkg/api/types/container_types.go
index aabe8dbc23c..0781b88b83f 100644
--- a/pkg/api/types/container_types.go
+++ b/pkg/api/types/container_types.go
@@ -150,6 +150,8 @@ type ContainerCreateOptions struct {
 	CgroupParent string
 	// Device specifies add a host device to the container
 	Device []string
+	// CDIDevices specifies the CDI devices to add to the container
+	CDIDevices []string
 	// #endregion
 
 	// #region for blkio related flags
diff --git a/pkg/cmd/container/create.go b/pkg/cmd/container/create.go
index 61e7686aebd..2b3b885d2e6 100644
--- a/pkg/cmd/container/create.go
+++ b/pkg/cmd/container/create.go
@@ -124,6 +124,8 @@ func Create(ctx context.Context, client *containerd.Client, args []string, netMa
 	}
 	opts = append(opts, platformOpts...)
 
+	opts = append(opts, withCDIDevices(options.GOptions.CDISpecDirs, options.CDIDevices...))
+
 	if _, err := referenceutil.Parse(args[0]); errors.Is(err, referenceutil.ErrLoadOCIArchiveRequired) {
 		imageRef := args[0]
 
diff --git a/pkg/cmd/container/run_cdi.go b/pkg/cmd/container/run_cdi.go
new file mode 100644
index 00000000000..da49ffb9925
--- /dev/null
+++ b/pkg/cmd/container/run_cdi.go
@@ -0,0 +1,46 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package container
+
+import (
+	"context"
+
+	"tags.cncf.io/container-device-interface/pkg/cdi"
+
+	"github.com/containerd/containerd/v2/core/containers"
+	cdispec "github.com/containerd/containerd/v2/pkg/cdi"
+	"github.com/containerd/containerd/v2/pkg/oci"
+)
+
+// withCDIDevices creates the OCI runtime spec options for injecting CDI devices.
+// Two options are returned: The first ensures that the CDI registry is initialized with
+// refresh disabled, and the second injects the devices into the container.
+func withCDIDevices(cdiSpecDirs []string, devices ...string) oci.SpecOpts {
+	return func(ctx context.Context, client oci.Client, c *containers.Container, s *oci.Spec) error {
+		if len(devices) == 0 {
+			return nil
+		}
+
+		// We configure the CDI registry with the configured spec dirs and disable refresh.
+		cdi.Configure(
+			cdi.WithSpecDirs(cdiSpecDirs...),
+			cdi.WithAutoRefresh(false),
+		)
+
+		return cdispec.WithCDIDevices(devices...)(ctx, client, c, s)
+	}
+}
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 1666ab61a0e..f8a002ff752 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -41,6 +41,8 @@ type Config struct {
 	HostGatewayIP    string   `toml:"host_gateway_ip"`
 	BridgeIP         string   `toml:"bridge_ip, omitempty"`
 	KubeHideDupe     bool     `toml:"kube_hide_dupe"`
+	// CDISpecDirs is a list of directories in which CDI specifications can be found.
+	CDISpecDirs []string `toml:"cdi_spec_dirs,omitempty"`
 }
 
 // New creates a default Config object statically,
@@ -61,5 +63,6 @@ func New() *Config {
 		Experimental:     true,
 		HostGatewayIP:    ncdefaults.HostGatewayIP(),
 		KubeHideDupe:     false,
+		CDISpecDirs:      ncdefaults.CDISpecDirs(),
 	}
 }
diff --git a/pkg/defaults/defaults_darwin.go b/pkg/defaults/defaults_darwin.go
index 88aef1073e4..2779a26ec1b 100644
--- a/pkg/defaults/defaults_darwin.go
+++ b/pkg/defaults/defaults_darwin.go
@@ -63,3 +63,7 @@ func HostsDirs() []string {
 func HostGatewayIP() string {
 	return ""
 }
+
+func CDISpecDirs() []string {
+	return []string{"/etc/cdi", "/var/run/cdi"}
+}
diff --git a/pkg/defaults/defaults_freebsd.go b/pkg/defaults/defaults_freebsd.go
index cf768925f1c..4abd0d4cca4 100644
--- a/pkg/defaults/defaults_freebsd.go
+++ b/pkg/defaults/defaults_freebsd.go
@@ -62,3 +62,7 @@ func HostsDirs() []string {
 func HostGatewayIP() string {
 	return ""
 }
+
+func CDISpecDirs() []string {
+	return []string{"/etc/cdi", "/var/run/cdi"}
+}
diff --git a/pkg/defaults/defaults_linux.go b/pkg/defaults/defaults_linux.go
index a8acdf35bf3..02975aff3b0 100644
--- a/pkg/defaults/defaults_linux.go
+++ b/pkg/defaults/defaults_linux.go
@@ -142,3 +142,24 @@ func HostGatewayIP() string {
 	}
 	return ""
 }
+
+func CDISpecDirs() []string {
+	if !rootlessutil.IsRootless() {
+		return []string{"/etc/cdi", "/var/run/cdi"}
+	}
+	xch, err := rootlessutil.XDGConfigHome()
+	if err != nil {
+		panic(err)
+	}
+	xdr, err := rootlessutil.XDGRuntimeDir()
+	if err != nil {
+		if rootlessutil.IsRootlessChild() {
+			panic(err)
+		}
+		xdr = fmt.Sprintf("/run/user/%d", os.Geteuid())
+	}
+	return []string{
+		filepath.Join(xch, "cdi"),
+		filepath.Join(xdr, "cdi"),
+	}
+}
diff --git a/pkg/defaults/defaults_windows.go b/pkg/defaults/defaults_windows.go
index cbb74c828c7..06a82c0285f 100644
--- a/pkg/defaults/defaults_windows.go
+++ b/pkg/defaults/defaults_windows.go
@@ -77,3 +77,7 @@ func HostsDirs() []string {
 func HostGatewayIP() string {
 	return ""
 }
+
+func CDISpecDirs() []string {
+	return []string{}
+}

From e42002d844d57f3cbe1bd3f861ce16709f24d1e6 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 1 May 2025 17:15:58 -0700
Subject: [PATCH 145/225] Fix tigron prepend args regression

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/test/command.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mod/tigron/test/command.go b/mod/tigron/test/command.go
index 272d689d490..e750842173c 100644
--- a/mod/tigron/test/command.go
+++ b/mod/tigron/test/command.go
@@ -160,7 +160,7 @@ func (gc *GenericCommand) WithTimeout(timeout time.Duration) {
 }
 
 func (gc *GenericCommand) PrependArgs(args ...string) {
-	gc.cmd.PrependArgs = args
+	gc.cmd.PrependArgs = append(gc.cmd.PrependArgs, args...)
 }
 
 func (gc *GenericCommand) Background() {

From 5aa54333aac20e257822c90e736efec27315526c Mon Sep 17 00:00:00 2001
From: Shubharanshu Mahapatra <shubhum@amazon.com>
Date: Thu, 1 May 2025 11:40:52 -0700
Subject: [PATCH 146/225] feat: containerd v2.1 RC migrate.

Signed-off-by: Shubharanshu Mahapatra <shubhum@amazon.com>
---
 Vagrantfile.freebsd        |  2 +-
 go.mod                     | 27 ++++++++-------
 go.sum                     | 67 +++++++++++++++++++-------------------
 pkg/imgutil/fetch/fetch.go |  4 +--
 pkg/imgutil/pull/pull.go   |  4 +--
 5 files changed, 50 insertions(+), 54 deletions(-)

diff --git a/Vagrantfile.freebsd b/Vagrantfile.freebsd
index ee6545ab1c5..a1928268038 100644
--- a/Vagrantfile.freebsd
+++ b/Vagrantfile.freebsd
@@ -63,7 +63,7 @@ Vagrant.configure("2") do |config|
         set -eux -o pipefail
         daemon -o containerd.out containerd
         sleep 3
-        /root/go/bin/nerdctl run --rm --quiet --net=none dougrabson/freebsd-minimal:13 echo "Nerdctl is up and running."
+        CONTAINERD_ADDRESS=/run/containerd/containerd.sock /root/go/bin/nerdctl run --rm --quiet --net=none dougrabson/freebsd-minimal:13 echo "Nerdctl is up and running."
     SHELL
   end
 
diff --git a/go.mod b/go.mod
index 572affdd6d4..06d0a7166fa 100644
--- a/go.mod
+++ b/go.mod
@@ -6,13 +6,13 @@ go 1.23.0
 require (
 	github.com/Masterminds/semver/v3 v3.3.1
 	github.com/Microsoft/go-winio v0.6.2
-	github.com/Microsoft/hcsshim v0.12.9
+	github.com/Microsoft/hcsshim v0.13.0-rc.3
 	github.com/compose-spec/compose-go/v2 v2.6.1 //gomodjail:unconfined
 	github.com/containerd/accelerated-container-image v1.3.0
 	github.com/containerd/cgroups/v3 v3.0.5 //gomodjail:unconfined
 	github.com/containerd/console v1.0.4 //gomodjail:unconfined
-	github.com/containerd/containerd/api v1.8.0
-	github.com/containerd/containerd/v2 v2.0.5 //gomodjail:unconfined
+	github.com/containerd/containerd/api v1.9.0-rc.0
+	github.com/containerd/containerd/v2 v2.1.0-rc.0 //gomodjail:unconfined
 	github.com/containerd/continuity v0.4.5 //gomodjail:unconfined
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/fifo v1.1.0 //gomodjail:unconfined
@@ -73,8 +73,6 @@ require (
 )
 
 require (
-	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
-	github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20231105174938-2b5cbb29f3e2 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 // indirect
 	github.com/cilium/ebpf v0.16.0 // indirect
@@ -108,7 +106,7 @@ require (
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/symlink v0.3.0 // indirect
 	//gomodjail:unconfined
-	github.com/moby/sys/user v0.3.0 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/multiformats/go-base32 v0.1.0 // indirect
 	github.com/multiformats/go-base36 v0.2.0 // indirect
@@ -135,17 +133,18 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0 // indirect
-	go.opentelemetry.io/otel v1.31.0 // indirect
-	go.opentelemetry.io/otel/metric v1.31.0 // indirect
-	go.opentelemetry.io/otel/trace v1.31.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.35.0 // indirect
+	go.opentelemetry.io/otel/metric v1.35.0 // indirect
+	go.opentelemetry.io/otel/trace v1.35.0 // indirect
 	golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
-	golang.org/x/mod v0.22.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 // indirect
+	golang.org/x/mod v0.24.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect
 	//gomodjail:unconfined
-	google.golang.org/grpc v1.69.4 // indirect
+	google.golang.org/grpc v1.72.0 // indirect
 	//gomodjail:unconfined
-	google.golang.org/protobuf v1.36.5 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
 	lukechampine.com/blake3 v1.3.0 // indirect
 	sigs.k8s.io/yaml v1.4.0 // indirect
 	tags.cncf.io/container-device-interface/specs-go v1.0.0 // indirect
diff --git a/go.sum b/go.sum
index 339839d3fcf..ca01e27ae9d 100644
--- a/go.sum
+++ b/go.sum
@@ -1,8 +1,6 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
-github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20231105174938-2b5cbb29f3e2 h1:dIScnXFlF784X79oi7MzVT6GWqr/W1uUt0pB5CsDs9M=
-github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20231105174938-2b5cbb29f3e2/go.mod h1:gCLVsLfv1egrcZu+GoJATN5ts75F2s62ih/457eWzOw=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
@@ -12,8 +10,8 @@ github.com/Masterminds/semver/v3 v3.3.1 h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7r
 github.com/Masterminds/semver/v3 v3.3.1/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/Microsoft/hcsshim v0.12.9 h1:2zJy5KA+l0loz1HzEGqyNnjd3fyZA31ZBCGKacp6lLg=
-github.com/Microsoft/hcsshim v0.12.9/go.mod h1:fJ0gkFAna6ukt0bLdKB8djt4XIJhF/vEPuoIWYVvZ8Y=
+github.com/Microsoft/hcsshim v0.13.0-rc.3 h1:c2Glm+kfftlSccp+rNIJ6mp1UppJYTq7q9SObIu3GZs=
+github.com/Microsoft/hcsshim v0.13.0-rc.3/go.mod h1:rc/I5c+x7rZHik6V5qj31JTATiLKh2BV7CsZpbNlt88=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
@@ -31,10 +29,10 @@ github.com/containerd/cgroups/v3 v3.0.5 h1:44na7Ud+VwyE7LIoJ8JTNQOa549a8543BmzaJ
 github.com/containerd/cgroups/v3 v3.0.5/go.mod h1:SA5DLYnXO8pTGYiAHXz94qvLQTKfVM5GEVisn4jpins=
 github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn4ro=
 github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
-github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0=
-github.com/containerd/containerd/api v1.8.0/go.mod h1:dFv4lt6S20wTu/hMcP4350RL87qPWLVa/OHOwmmdnYc=
-github.com/containerd/containerd/v2 v2.0.5 h1:2vg/TjUXnaohAxiHnthQg8K06L9I4gdYEMcOLiMc8BQ=
-github.com/containerd/containerd/v2 v2.0.5/go.mod h1:Qqo0UN43i2fX1FLkrSTCg6zcHNfjN7gEnx3NPRZI+N0=
+github.com/containerd/containerd/api v1.9.0-rc.0 h1:qs7q8DSuxFKF9oKdYuhRhmdDSck77JEqzf9ExaTL72E=
+github.com/containerd/containerd/api v1.9.0-rc.0/go.mod h1:GhghKFmTR3hNtyznBoQ0EMWr9ju5AqHjcZPsSpTKutI=
+github.com/containerd/containerd/v2 v2.1.0-rc.0 h1:Dy4yAcT139blRUIrzjYVRLKTAtZTCbwjrD0ZRTkHUDM=
+github.com/containerd/containerd/v2 v2.1.0-rc.0/go.mod h1:KzuwQ2djcBrUwvoL9wFgadt5XZYtD6N9dOJAd+P+2Dw=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -219,8 +217,8 @@ github.com/moby/sys/signal v0.7.1 h1:PrQxdvxcGijdo6UXXo/lU/TvHUWyPhj7UOpSo8tuvk0
 github.com/moby/sys/signal v0.7.1/go.mod h1:Se1VGehYokAkrSQwL4tDzHvETwUZlnY7S5XtQ50mQp8=
 github.com/moby/sys/symlink v0.3.0 h1:GZX89mEZ9u53f97npBy4Rc3vJKj7JBDj/PN2I22GrNU=
 github.com/moby/sys/symlink v0.3.0/go.mod h1:3eNdhduHmYPcgsJtZXW1W4XUJdZGBIkttZ8xKqPUJq0=
-github.com/moby/sys/user v0.3.0 h1:9ni5DlcW5an3SvRSx4MouotOygvzaXbaSrc/wGDFWPo=
-github.com/moby/sys/user v0.3.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
@@ -272,8 +270,8 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/rootless-containers/bypass4netns v0.4.2 h1:JUZcpX7VLRfDkLxBPC6fyNalJGv9MjnjECOilZIvKRc=
 github.com/rootless-containers/bypass4netns v0.4.2/go.mod h1:iOY28IeFVqFHnK0qkBCQ3eKzKQgSW5DtlXFQJyJMAQk=
 github.com/rootless-containers/rootlesskit/v2 v2.3.4 h1:EHiqqiq+ntTfdnQtIgDR3etiuqKkRCPr1qpoizJxW/E=
@@ -334,18 +332,20 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0 h1:UP6IpuHFkUgOQL9FFQFrZ+5LiwhhYRbi7VZSIx6Nj5s=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0/go.mod h1:qxuZLtbq5QDtdeSHsS7bcf6EH6uO6jUAgk764zd3rhM=
-go.opentelemetry.io/otel v1.31.0 h1:NsJcKPIW0D0H3NgzPDHmo0WW6SptzPdqg/L1zsIm2hY=
-go.opentelemetry.io/otel v1.31.0/go.mod h1:O0C14Yl9FgkjqcCZAsE053C13OaddMYr/hz6clDkEJE=
-go.opentelemetry.io/otel/metric v1.31.0 h1:FSErL0ATQAmYHUIzSezZibnyVlft1ybhy4ozRPcF2fE=
-go.opentelemetry.io/otel/metric v1.31.0/go.mod h1:C3dEloVbLuYoX41KpmAhOqNriGbA+qqH6PQ5E5mUfnY=
-go.opentelemetry.io/otel/sdk v1.31.0 h1:xLY3abVHYZ5HSfOg3l2E5LUj2Cwva5Y7yGxnSW9H5Gk=
-go.opentelemetry.io/otel/sdk v1.31.0/go.mod h1:TfRbMdhvxIIr/B2N2LQW2S5v9m3gOQ/08KsbbO5BPT0=
-go.opentelemetry.io/otel/sdk/metric v1.31.0 h1:i9hxxLJF/9kkvfHppyLL55aW7iIJz4JjxTeYusH7zMc=
-go.opentelemetry.io/otel/sdk/metric v1.31.0/go.mod h1:CRInTMVvNhUKgSAMbKyTMxqOBC0zgyxzW55lZzX43Y8=
-go.opentelemetry.io/otel/trace v1.31.0 h1:ffjsj1aRouKewfr85U2aGagJ46+MvodynlQ1HYdmJys=
-go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06FJAsO1tJg480A=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
+go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
+go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
+go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
+go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
+go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
+go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
+go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
+go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
+go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
+go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
 go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -375,8 +375,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
-golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -480,15 +480,15 @@ google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 h1:3UsHvIr4Wc2aW4brOaSCmcxh9ksica6fHEr8P1XhkYw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a h1:51aaUVRocpvUOSQKM6Q7VuoaktNIaMCLuhZB6DKksq4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a/go.mod h1:uRxBH1mhmO8PGhU89cMcHaXKZqO+OfakD8QQO0oYwlQ=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.69.4 h1:MF5TftSMkd8GLw/m0KM6V8CMOCY6NZ1NQDPGFgbTt4A=
-google.golang.org/grpc v1.69.4/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
+google.golang.org/grpc v1.72.0 h1:S7UkcVa60b5AAQTaO6ZKamFp1zMZSU0fGDK2WZLbBnM=
+google.golang.org/grpc v1.72.0/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -498,10 +498,11 @@ google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
-google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/pkg/imgutil/fetch/fetch.go b/pkg/imgutil/fetch/fetch.go
index c9ab04f5533..d3f89359c13 100644
--- a/pkg/imgutil/fetch/fetch.go
+++ b/pkg/imgutil/fetch/fetch.go
@@ -40,7 +40,7 @@ type Config struct {
 	// RemoteOpts, e.g. containerd.WithPullUnpack.
 	//
 	// Regardless to RemoteOpts, the following opts are always set:
-	// WithResolver, WithImageHandler, WithSchema1Conversion
+	// WithResolver, WithImageHandler
 	//
 	// RemoteOpts related to unpacking can be set only when len(Platforms) is 1.
 	RemoteOpts []containerd.RemoteOpt
@@ -73,8 +73,6 @@ func Fetch(ctx context.Context, client *containerd.Client, ref string, config *C
 	opts := []containerd.RemoteOpt{
 		containerd.WithResolver(config.Resolver),
 		containerd.WithImageHandler(h),
-		//nolint:staticcheck
-		containerd.WithSchema1Conversion, //lint:ignore SA1019 nerdctl should support schema1 as well.
 		containerd.WithPlatformMatcher(platformMC),
 	}
 	opts = append(opts, config.RemoteOpts...)
diff --git a/pkg/imgutil/pull/pull.go b/pkg/imgutil/pull/pull.go
index e677e9cd732..b6f6e7965b6 100644
--- a/pkg/imgutil/pull/pull.go
+++ b/pkg/imgutil/pull/pull.go
@@ -41,7 +41,7 @@ type Config struct {
 	// RemoteOpts, e.g. containerd.WithPullUnpack.
 	//
 	// Regardless to RemoteOpts, the following opts are always set:
-	// WithResolver, WithImageHandler, WithSchema1Conversion
+	// WithResolver, WithImageHandler
 	//
 	// RemoteOpts related to unpacking can be set only when len(Platforms) is 1.
 	RemoteOpts []containerd.RemoteOpt
@@ -75,8 +75,6 @@ func Pull(ctx context.Context, client *containerd.Client, ref string, config *Co
 	opts := []containerd.RemoteOpt{
 		containerd.WithResolver(config.Resolver),
 		containerd.WithImageHandler(h),
-		//nolint:staticcheck
-		containerd.WithSchema1Conversion, //lint:ignore SA1019 nerdctl should support schema1 as well.
 		containerd.WithPlatformMatcher(platformMC),
 	}
 	opts = append(opts, config.RemoteOpts...)

From 2c91198bae9d6cbb7c49cc9518e74a9d77ba6e78 Mon Sep 17 00:00:00 2001
From: Shubharanshu Mahapatra <shubhum@amazon.com>
Date: Mon, 17 Feb 2025 23:36:08 -0800
Subject: [PATCH 147/225] fix: logs updated on starting of a stopped container

Signed-off-by: Shubharanshu Mahapatra <shubhum@amazon.com>
---
 cmd/nerdctl/compose/compose_start.go          |  2 +-
 cmd/nerdctl/container/container_logs_test.go  | 73 +++++++++++++++++++
 cmd/nerdctl/container/container_start.go      | 15 ++--
 .../container/container_start_linux_test.go   |  8 +-
 pkg/api/types/container_types.go              |  2 +
 pkg/cmd/container/restart.go                  |  2 +-
 pkg/cmd/container/start.go                    |  2 +-
 pkg/containerutil/containerutil.go            |  6 +-
 pkg/errutil/exit_coder.go                     |  5 +-
 pkg/taskutil/taskutil.go                      | 19 +++--
 10 files changed, 109 insertions(+), 25 deletions(-)

diff --git a/cmd/nerdctl/compose/compose_start.go b/cmd/nerdctl/compose/compose_start.go
index 3762753d553..c945f52adb7 100644
--- a/cmd/nerdctl/compose/compose_start.go
+++ b/cmd/nerdctl/compose/compose_start.go
@@ -112,7 +112,7 @@ func startContainers(ctx context.Context, client *containerd.Client, containers
 			}
 
 			// in compose, always disable attach
-			if err := containerutil.Start(ctx, c, false, client, ""); err != nil {
+			if err := containerutil.Start(ctx, c, false, false, client, ""); err != nil {
 				return err
 			}
 			info, err := c.Info(ctx, containerd.WithoutRefreshedMetadata)
diff --git a/cmd/nerdctl/container/container_logs_test.go b/cmd/nerdctl/container/container_logs_test.go
index 033c4127be3..6d8b6c04af0 100644
--- a/cmd/nerdctl/container/container_logs_test.go
+++ b/cmd/nerdctl/container/container_logs_test.go
@@ -19,8 +19,10 @@ package container
 import (
 	"errors"
 	"fmt"
+	"io"
 	"os/exec"
 	"runtime"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -383,3 +385,74 @@ func TestLogsWithDetails(t *testing.T) {
 
 	testCase.Run(t)
 }
+
+func TestLogsWithStartContainer(t *testing.T) {
+	testCase := nerdtest.Setup()
+
+	// For windows we  havent added support for dual logging so not adding the test.
+	testCase.Require = require.Not(require.Windows)
+
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "Test logs are directed correctly for container start of a interactive container",
+			Setup: func(data test.Data, helpers test.Helpers) {
+				cmd := helpers.Command("run", "-it", "--name", data.Identifier(), testutil.CommonImage)
+				cmd.WithPseudoTTY()
+				cmd.WithFeeder(func() io.Reader {
+					return strings.NewReader("echo foo\nexit\n")
+				})
+
+				cmd.Run(&test.Expected{
+					ExitCode: 0,
+				})
+
+			},
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rm", "-f", data.Identifier())
+			},
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				cmd := helpers.Command("start", "-ia", data.Identifier())
+				cmd.WithPseudoTTY()
+				cmd.WithFeeder(func() io.Reader {
+					return strings.NewReader("echo bar\nexit\n")
+				})
+				cmd.Run(&test.Expected{
+					ExitCode: 0,
+				})
+				cmd = helpers.Command("logs", data.Identifier())
+
+				return cmd
+			},
+			Expected: test.Expects(0, nil, expect.Contains("foo", "bar")),
+		},
+		{
+			Description: "Test logs are captured after stopping and starting a non-interactive container and continue capturing new logs",
+			Setup: func(data test.Data, helpers test.Helpers) {
+				helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage, "sh", "-c", "while true; do echo foo; sleep 1; done")
+			},
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rm", "-f", data.Identifier())
+			},
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				helpers.Ensure("stop", data.Identifier())
+				initialLogs := helpers.Capture("logs", data.Identifier())
+				initialFooCount := strings.Count(initialLogs, "foo")
+				data.Labels().Set("initialFooCount", strconv.Itoa(initialFooCount))
+				helpers.Ensure("start", data.Identifier())
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
+				return helpers.Command("logs", data.Identifier())
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					ExitCode: 0,
+					Output: func(stdout string, info string, t *testing.T) {
+						finalLogsCount := strings.Count(stdout, "foo")
+						initialFooCount, _ := strconv.Atoi(data.Labels().Get("initialFooCount"))
+						assert.Assert(t, finalLogsCount > initialFooCount, "Expected 'foo' count to increase after restart", info)
+					},
+				}
+			},
+		},
+	}
+	testCase.Run(t)
+}
diff --git a/cmd/nerdctl/container/container_start.go b/cmd/nerdctl/container/container_start.go
index 42673f46c64..7b770d9b1e6 100644
--- a/cmd/nerdctl/container/container_start.go
+++ b/cmd/nerdctl/container/container_start.go
@@ -43,7 +43,7 @@ func StartCommand() *cobra.Command {
 	cmd.Flags().SetInterspersed(false)
 	cmd.Flags().BoolP("attach", "a", false, "Attach STDOUT/STDERR and forward signals")
 	cmd.Flags().String("detach-keys", consoleutil.DefaultDetachKeys, "Override the default detach keys")
-
+	cmd.Flags().BoolP("interactive", "i", false, "Attach container's STDIN")
 	return cmd
 }
 
@@ -60,11 +60,16 @@ func startOptions(cmd *cobra.Command) (types.ContainerStartOptions, error) {
 	if err != nil {
 		return types.ContainerStartOptions{}, err
 	}
+	interactive, err := cmd.Flags().GetBool("interactive")
+	if err != nil {
+		return types.ContainerStartOptions{}, err
+	}
 	return types.ContainerStartOptions{
-		Stdout:     cmd.OutOrStdout(),
-		GOptions:   globalOptions,
-		Attach:     attach,
-		DetachKeys: detachKeys,
+		Stdout:      cmd.OutOrStdout(),
+		GOptions:    globalOptions,
+		Attach:      attach,
+		DetachKeys:  detachKeys,
+		Interactive: interactive,
 	}, nil
 }
 
diff --git a/cmd/nerdctl/container/container_start_linux_test.go b/cmd/nerdctl/container/container_start_linux_test.go
index 4f56cc9d679..6d9ca8c313b 100644
--- a/cmd/nerdctl/container/container_start_linux_test.go
+++ b/cmd/nerdctl/container/container_start_linux_test.go
@@ -52,13 +52,7 @@ func TestStartDetachKeys(t *testing.T) {
 	}
 
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
-		flags := "-a"
-		// Started container must be interactive - which is apparently the default for nerdctl, which does not support
-		// the -i flag, while docker requires it explicitly
-		if nerdtest.IsDocker() {
-			flags += "i"
-		}
-		cmd := helpers.Command("start", flags, "--detach-keys=ctrl-a,ctrl-b", data.Identifier())
+		cmd := helpers.Command("start", "-ai", "--detach-keys=ctrl-a,ctrl-b", data.Identifier())
 		cmd.WithPseudoTTY()
 		cmd.WithFeeder(func() io.Reader {
 			// ctrl+a and ctrl+b (see https://en.wikipedia.org/wiki/C0_and_C1_control_codes)
diff --git a/pkg/api/types/container_types.go b/pkg/api/types/container_types.go
index 0781b88b83f..691f94b3dc9 100644
--- a/pkg/api/types/container_types.go
+++ b/pkg/api/types/container_types.go
@@ -30,6 +30,8 @@ type ContainerStartOptions struct {
 	Attach bool
 	// The key sequence for detaching a container.
 	DetachKeys string
+	// Attach stdin
+	Interactive bool
 }
 
 // ContainerKillOptions specifies options for `nerdctl (container) kill`.
diff --git a/pkg/cmd/container/restart.go b/pkg/cmd/container/restart.go
index 6b60b082236..3b376ada5a5 100644
--- a/pkg/cmd/container/restart.go
+++ b/pkg/cmd/container/restart.go
@@ -38,7 +38,7 @@ func Restart(ctx context.Context, client *containerd.Client, containers []string
 			if err := containerutil.Stop(ctx, found.Container, options.Timeout, options.Signal); err != nil {
 				return err
 			}
-			if err := containerutil.Start(ctx, found.Container, false, client, ""); err != nil {
+			if err := containerutil.Start(ctx, found.Container, false, false, client, ""); err != nil {
 				return err
 			}
 			_, err := fmt.Fprintln(options.Stdout, found.Req)
diff --git a/pkg/cmd/container/start.go b/pkg/cmd/container/start.go
index 3d9de68cb29..b0820d2aa39 100644
--- a/pkg/cmd/container/start.go
+++ b/pkg/cmd/container/start.go
@@ -40,7 +40,7 @@ func Start(ctx context.Context, client *containerd.Client, reqs []string, option
 			if found.MatchCount > 1 {
 				return fmt.Errorf("multiple IDs found with provided prefix: %s", found.Req)
 			}
-			if err := containerutil.Start(ctx, found.Container, options.Attach, client, options.DetachKeys); err != nil {
+			if err := containerutil.Start(ctx, found.Container, options.Attach, options.Interactive, client, options.DetachKeys); err != nil {
 				return err
 			}
 			if !options.Attach {
diff --git a/pkg/containerutil/containerutil.go b/pkg/containerutil/containerutil.go
index ee71d5853fa..0bebf2310ea 100644
--- a/pkg/containerutil/containerutil.go
+++ b/pkg/containerutil/containerutil.go
@@ -213,7 +213,7 @@ func GenerateSharingPIDOpts(ctx context.Context, targetCon containerd.Container)
 }
 
 // Start starts `container` with `attach` flag. If `attach` is true, it will attach to the container's stdio.
-func Start(ctx context.Context, container containerd.Container, flagA bool, client *containerd.Client, detachKeys string) (err error) {
+func Start(ctx context.Context, container containerd.Container, flagA bool, flagI bool, client *containerd.Client, detachKeys string) (err error) {
 	// defer the storage of start error in the dedicated label
 	defer func() {
 		if err != nil {
@@ -243,7 +243,7 @@ func Start(ctx context.Context, container containerd.Container, flagA bool, clie
 	}
 	flagT := process.Process.Terminal
 	var con console.Console
-	if flagA && flagT {
+	if (flagI || flagA) && flagT {
 		con, err = consoleutil.Current()
 		if err != nil {
 			return err
@@ -284,7 +284,7 @@ func Start(ctx context.Context, container containerd.Container, flagA bool, clie
 		// source: https://github.com/containerd/nerdctl/blob/main/docs/command-reference.md#whale-nerdctl-start
 		attachStreamOpt = []string{"STDOUT", "STDERR"}
 	}
-	task, err := taskutil.NewTask(ctx, client, container, attachStreamOpt, false, flagT, true, con, logURI, detachKeys, namespace, detachC)
+	task, err := taskutil.NewTask(ctx, client, container, attachStreamOpt, flagI, flagT, true, con, logURI, detachKeys, namespace, detachC)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/errutil/exit_coder.go b/pkg/errutil/exit_coder.go
index be0044edbd0..bb3c6ebcc04 100644
--- a/pkg/errutil/exit_coder.go
+++ b/pkg/errutil/exit_coder.go
@@ -16,7 +16,9 @@
 
 package errutil
 
-import "os"
+import (
+	"os"
+)
 
 type ExitCoder interface {
 	error
@@ -46,7 +48,6 @@ func HandleExitCoder(err error) {
 	if err == nil {
 		return
 	}
-
 	if exitErr, ok := err.(ExitCoder); ok {
 		os.Exit(exitErr.ExitCode())
 	}
diff --git a/pkg/taskutil/taskutil.go b/pkg/taskutil/taskutil.go
index ef51fe2c363..6e978aa6a5a 100644
--- a/pkg/taskutil/taskutil.go
+++ b/pkg/taskutil/taskutil.go
@@ -66,15 +66,24 @@ func NewTask(ctx context.Context, client *containerd.Client, container container
 	var ioCreator cio.Creator
 	if len(attachStreamOpt) != 0 {
 		log.G(ctx).Debug("attaching output instead of using the log-uri")
+		// when attaching a TTY we use writee for stdio and binary for log persistence
 		if flagT {
-			in, err := consoleutil.NewDetachableStdin(con, detachKeys, closer)
-			if err != nil {
-				return nil, err
+			var in io.Reader
+			if flagI {
+				// FIXME: check IsTerminal on Windows too
+				if runtime.GOOS != "windows" && !term.IsTerminal(0) {
+					return nil, errors.New("the input device is not a TTY")
+				}
+				var err error
+				in, err = consoleutil.NewDetachableStdin(con, detachKeys, closer)
+				if err != nil {
+					return nil, err
+				}
 			}
-			ioCreator = cio.NewCreator(cio.WithStreams(in, con, nil), cio.WithTerminal)
+			ioCreator = cioutil.NewContainerIO(namespace, logURI, true, in, con, nil)
 		} else {
 			streams := processAttachStreamsOpt(attachStreamOpt)
-			ioCreator = cio.NewCreator(cio.WithStreams(streams.stdIn, streams.stdOut, streams.stdErr))
+			ioCreator = cioutil.NewContainerIO(namespace, logURI, false, streams.stdIn, streams.stdOut, streams.stdErr)
 		}
 
 	} else if flagT && flagD {

From 4dd9ad9b610006c594ba90794ea6a6834d7b51ce Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 1 May 2025 16:11:55 -0700
Subject: [PATCH 148/225] Follow-up to #4012: address tests issues

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/workflow-test.yml           |  12 +-
 Dockerfile.d/test-integration-rootless.sh     |   5 +-
 cmd/nerdctl/builder/builder_builder_test.go   |   3 +-
 cmd/nerdctl/completion/completion_test.go     |  18 ++-
 cmd/nerdctl/compose/compose_up_test.go        |   4 +-
 .../container/container_cp_acid_linux_test.go |   3 +-
 .../container/container_cp_linux_test.go      |   5 +-
 .../container/container_create_linux_test.go  |   4 +-
 .../container/container_inspect_linux_test.go |   8 +-
 .../container/container_kill_linux_test.go    |   3 +-
 .../container/container_list_linux_test.go    |   3 +-
 .../container/container_restart_linux_test.go |   3 +-
 .../container_run_cgroup_linux_test.go        |   4 +-
 .../container/container_run_linux_test.go     |   4 +-
 .../container_run_restart_linux_test.go       |   9 +-
 cmd/nerdctl/container/container_run_test.go   |   4 +-
 .../container/container_stop_linux_test.go    |   2 +-
 cmd/nerdctl/login/login_linux_test.go         |   3 +-
 cmd/nerdctl/network/network_inspect_test.go   |   7 +-
 cmd/nerdctl/system/system_info_test.go        |  11 +-
 docs/testing/README.md                        |   2 +-
 mod/tigron/test/command.go                    |   4 -
 mod/tigron/test/interfaces.go                 |   2 -
 pkg/testutil/nerdtest/command.go              | 134 ++++++++----------
 pkg/testutil/nerdtest/requirements.go         |  15 +-
 pkg/testutil/nerdtest/test.go                 |   2 +-
 pkg/testutil/nerdtest/utilities.go            |   3 +-
 pkg/testutil/testutil.go                      |  68 ++++-----
 28 files changed, 165 insertions(+), 180 deletions(-)

diff --git a/.github/workflows/workflow-test.yml b/.github/workflows/workflow-test.yml
index 2a618746cce..0ca8469aac5 100644
--- a/.github/workflows/workflow-test.yml
+++ b/.github/workflows/workflow-test.yml
@@ -209,32 +209,24 @@ jobs:
             target: rootless
             runner: "ubuntu-22.04"
             arch: amd64
-            nerdctl: ""
-            comment: ""
           - ubuntu: 24.04
             containerd: v2.0.5
             rootlesskit: v2.3.4
             target: rootless
             arch: amd64
             runner: "ubuntu-24.04"
-            nerdctl: ""
-            comment: ""
           - ubuntu: 24.04
             containerd: v2.0.5
             rootlesskit: v2.3.4
             target: rootless
             arch: arm64
             runner: "ubuntu-24.04-arm"
-            nerdctl: ""
-            comment: ""
           - ubuntu: 24.04
             containerd: v2.0.5
             rootlesskit: v2.3.4
             target: rootless-port-slirp4netns
             arch: amd64
             runner: "ubuntu-24.04"
-            nerdctl: ""
-            comment: ""
           - ubuntu: 24.04
             containerd: v2.0.5
             rootlesskit: v2.3.4
@@ -296,10 +288,10 @@ jobs:
           fi
           echo "WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622}" >> "$GITHUB_ENV"
       - name: "Test (network driver=slirp4netns, port driver=builtin)"
-        run: docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} -e NERDCTL=${NERDCTL} ${TEST_TARGET} /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=false
+        run: docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} ${TEST_TARGET} /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=false -test.target=${NERDCTL}
       - name: "Test (network driver=slirp4netns, port driver=builtin) (flaky)"
         if: matrix.nerdctl != 'nerdctl.gomodjail'
-        run: docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} -e NERDCTL=${NERDCTL} ${TEST_TARGET} /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=true
+        run: docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} ${TEST_TARGET} /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=true -test.target=${NERDCTL}
 
   test-integration-docker-compatibility:
     timeout-minutes: 40
diff --git a/Dockerfile.d/test-integration-rootless.sh b/Dockerfile.d/test-integration-rootless.sh
index 9d35d247ccd..481610eb1bc 100755
--- a/Dockerfile.d/test-integration-rootless.sh
+++ b/Dockerfile.d/test-integration-rootless.sh
@@ -15,7 +15,6 @@
 #   limitations under the License.
 
 set -eux -o pipefail
-: "${NERDCTL:=}"
 if [[ "$(id -u)" = "0" ]]; then
   # Ensure securityfs is mounted for apparmor to work
   if ! mountpoint -q /sys/kernel/security; then
@@ -33,7 +32,7 @@ if [[ "$(id -u)" = "0" ]]; then
 
 	# Switch to the rootless user via SSH
 	systemctl start ssh
-	exec ssh -o StrictHostKeyChecking=no rootless@localhost NERDCTL="$NERDCTL" "$0" "$@"
+	exec ssh -o StrictHostKeyChecking=no rootless@localhost "$0" "$@"
 else
 	containerd-rootless-setuptool.sh install
 	if grep -q "options use-vc" /etc/resolv.conf; then
@@ -64,5 +63,5 @@ EOF
 	# Once ssh-ed, we lost the Dockerfile working dir, so, get back in the nerdctl checkout
 	cd /go/src/github.com/containerd/nerdctl
 	# We also lose the PATH (and SendEnv=PATH would require sshd config changes)
-	exec env PATH="/usr/local/go/bin:$PATH" NERDCTL="$NERDCTL" "$@"
+	exec env PATH="/usr/local/go/bin:$PATH" "$@"
 fi
diff --git a/cmd/nerdctl/builder/builder_builder_test.go b/cmd/nerdctl/builder/builder_builder_test.go
index 7f1168904ac..da912cc0af9 100644
--- a/cmd/nerdctl/builder/builder_builder_test.go
+++ b/cmd/nerdctl/builder/builder_builder_test.go
@@ -133,8 +133,7 @@ CMD ["echo", "nerdctl-test-builder-prune"]`, testutil.CommonImage)
 			{
 				Description: "Debug",
 				// `nerdctl builder debug` is currently incompatible with `docker buildx debug`.
-				// FIXME: fails with gomodjail: "timed out to access cache storage. other debug session is running?"
-				Require:    require.All(require.Not(nerdtest.Docker), require.Not(nerdtest.Gomodjail)),
+				Require:    require.All(require.Not(nerdtest.Docker)),
 				NoParallel: true,
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					dockerfile := fmt.Sprintf(`FROM %s
diff --git a/cmd/nerdctl/completion/completion_test.go b/cmd/nerdctl/completion/completion_test.go
index 89266ceda4a..c75e37d490c 100644
--- a/cmd/nerdctl/completion/completion_test.go
+++ b/cmd/nerdctl/completion/completion_test.go
@@ -17,6 +17,7 @@
 package completion
 
 import (
+	"os/exec"
 	"testing"
 
 	"github.com/containerd/nerdctl/mod/tigron/expect"
@@ -34,6 +35,11 @@ func TestMain(m *testing.M) {
 func TestCompletion(t *testing.T) {
 	nerdtest.Setup()
 
+	// Note: some functions need to be tested without the automatic --namespace nerdctl-test argument, so we need
+	// to retrieve the binary name.
+	// Note that we know this works already, so no need to assert err.
+	bin, _ := exec.LookPath(testutil.GetTarget())
+
 	testCase := &test.Case{
 		Require: require.Not(nerdtest.Docker),
 		Setup: func(data test.Data, helpers test.Helpers) {
@@ -158,17 +164,17 @@ func TestCompletion(t *testing.T) {
 				},
 			},
 			{
-				Description: "no namespace --cgroup-manager",
+				Description: "--cgroup-manager",
 				Require:     require.Not(require.Windows),
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Custom("nerdctl", "__complete", "--cgroup-manager", "")
+					return helpers.Command("__complete", "--cgroup-manager", "")
 				},
 				Expected: test.Expects(0, nil, expect.Contains("cgroupfs\n")),
 			},
 			{
-				Description: "no namespace empty",
+				Description: "empty",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Custom("nerdctl", "__complete", "")
+					return helpers.Command("__complete", "")
 				},
 				Expected: test.Expects(0, nil, expect.Contains("run\t")),
 			},
@@ -176,7 +182,7 @@ func TestCompletion(t *testing.T) {
 				Description: "namespace space empty",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					// mind {"--namespace=nerdctl-test"} vs {"--namespace", "nerdctl-test"}
-					return helpers.Custom("nerdctl", "__complete", "--namespace", string(helpers.Read(nerdtest.Namespace)), "")
+					return helpers.Custom(bin, "__complete", "--namespace", string(helpers.Read(nerdtest.Namespace)), "")
 				},
 				Expected: test.Expects(0, nil, expect.Contains("run\t")),
 			},
@@ -199,7 +205,7 @@ func TestCompletion(t *testing.T) {
 				Description: "namespace run -i",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					// mind {"--namespace=nerdctl-test"} vs {"--namespace", "nerdctl-test"}
-					return helpers.Custom("nerdctl", "__complete", "--namespace", string(helpers.Read(nerdtest.Namespace)), "run", "-i", "")
+					return helpers.Custom(bin, "__complete", "--namespace", string(helpers.Read(nerdtest.Namespace)), "run", "-i", "")
 				},
 				Expected: test.Expects(0, nil, expect.Contains(testutil.CommonImage+"\n")),
 			},
diff --git a/cmd/nerdctl/compose/compose_up_test.go b/cmd/nerdctl/compose/compose_up_test.go
index 63bba829fcf..e162ee6806d 100644
--- a/cmd/nerdctl/compose/compose_up_test.go
+++ b/cmd/nerdctl/compose/compose_up_test.go
@@ -27,6 +27,7 @@ import (
 	"gotest.tools/v3/icmd"
 
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 // https://github.com/containerd/nerdctl/issues/1942
@@ -49,7 +50,8 @@ services:
 		ExitCode: 1,
 		Err:      `exec: \"invalid\": executable file not found in $PATH`,
 	}
-	if base.Target == testutil.Docker {
+	// Docker expected err is different
+	if nerdtest.IsDocker() {
 		expected.Err = `unknown or invalid runtime name: invalid`
 	}
 	c.Assert(expected)
diff --git a/cmd/nerdctl/container/container_cp_acid_linux_test.go b/cmd/nerdctl/container/container_cp_acid_linux_test.go
index fc30c4ab314..c5a92ee70bd 100644
--- a/cmd/nerdctl/container/container_cp_acid_linux_test.go
+++ b/cmd/nerdctl/container/container_cp_acid_linux_test.go
@@ -28,6 +28,7 @@ import (
 	"github.com/containerd/nerdctl/v2/pkg/containerutil"
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 // This is a separate set of tests for cp specifically meant to test corner or extreme cases that do not fit in the normal testing rig
@@ -87,7 +88,7 @@ func TestCopyAcid(t *testing.T) {
 		setup()
 
 		expectedErr := containerutil.ErrTargetIsReadOnly.Error()
-		if testutil.GetTarget() == testutil.Docker {
+		if nerdtest.IsDocker() {
 			expectedErr = ""
 		}
 
diff --git a/cmd/nerdctl/container/container_cp_linux_test.go b/cmd/nerdctl/container/container_cp_linux_test.go
index a584b722243..1a268caa60e 100644
--- a/cmd/nerdctl/container/container_cp_linux_test.go
+++ b/cmd/nerdctl/container/container_cp_linux_test.go
@@ -30,6 +30,7 @@ import (
 	"github.com/containerd/nerdctl/v2/pkg/containerutil"
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 // For the test matrix, see https://docs.docker.com/engine/reference/commandline/cp/
@@ -898,7 +899,7 @@ func cpTestHelper(t *testing.T, tg *testgroup) {
 				setup()
 
 				// If Docker, removes the err part of expectation
-				if testutil.GetTarget() == testutil.Docker {
+				if nerdtest.IsDocker() {
 					testCase.expect.Err = ""
 				}
 
@@ -938,7 +939,7 @@ func cpTestHelper(t *testing.T, tg *testgroup) {
 					cmd = base.Cmd("cp", containerStopped+":"+sourceSpec, destinationSpec)
 				}
 
-				if rootlessutil.IsRootless() && testutil.GetTarget() == testutil.Nerdctl {
+				if rootlessutil.IsRootless() && !nerdtest.IsDocker() {
 					cmd.Assert(
 						icmd.Expected{
 							ExitCode: 1,
diff --git a/cmd/nerdctl/container/container_create_linux_test.go b/cmd/nerdctl/container/container_create_linux_test.go
index 3ea83d8ac96..d6a4e91e0f2 100644
--- a/cmd/nerdctl/container/container_create_linux_test.go
+++ b/cmd/nerdctl/container/container_create_linux_test.go
@@ -126,7 +126,7 @@ func TestCreateWithMACAddress(t *testing.T) {
 				assert.Assert(t, strings.Contains(res.Stdout(), expect), fmt.Sprintf("expected output to contain %q: %q", expect, res.Stdout()))
 				assert.Assert(t, res.ExitCode == 0, "Command should have succeeded")
 			} else {
-				if testutil.GetTarget() == testutil.Docker &&
+				if nerdtest.IsDocker() &&
 					(network == networkIPvlan || network == "container:whatever"+tID) {
 					// unlike nerdctl
 					// when using network ipvlan or container in Docker
@@ -137,7 +137,7 @@ func TestCreateWithMACAddress(t *testing.T) {
 				}
 
 				// See https://github.com/containerd/nerdctl/issues/3101
-				if testutil.GetTarget() == testutil.Docker &&
+				if nerdtest.IsDocker() &&
 					(network == networkBridge) {
 					expect = ""
 				}
diff --git a/cmd/nerdctl/container/container_inspect_linux_test.go b/cmd/nerdctl/container/container_inspect_linux_test.go
index b070359fa00..8c99886b32d 100644
--- a/cmd/nerdctl/container/container_inspect_linux_test.go
+++ b/cmd/nerdctl/container/container_inspect_linux_test.go
@@ -198,7 +198,7 @@ func TestContainerInspectState(t *testing.T) {
 	// nerdctl: run error produces a nil Task, so the Status is empty because Status comes from Task.
 	// docker : run error gives => `Status=created` as  in docker there is no a separation between container and Task.
 	errStatus := ""
-	if base.Target == testutil.Docker {
+	if nerdtest.IsDocker() {
 		errStatus = "created"
 	}
 	testCases := []testCase{
@@ -295,7 +295,7 @@ func TestContainerInspectHostConfigDefaults(t *testing.T) {
 
 	// Hostconfig default values differ with Docker.
 	// This is because we directly retrieve the configured values instead of using preset defaults.
-	if testutil.GetTarget() == testutil.Docker {
+	if nerdtest.IsDocker() {
 		hc.Driver = ""
 		hc.GroupAddSize = 0
 		hc.ShmSize = int64(67108864) // Docker default 64M
@@ -399,7 +399,7 @@ func TestContainerInspectHostConfigPID(t *testing.T) {
 
 	var hc hostConfigValues
 
-	if testutil.GetTarget() == testutil.Docker {
+	if nerdtest.IsDocker() {
 		hc.PidMode = "container:" + containerID1
 	} else {
 		hc.PidMode = containerID1
@@ -444,7 +444,7 @@ func TestContainerInspectDevices(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if testutil.GetTarget() == testutil.Docker {
+	if nerdtest.IsDocker() {
 		dir = "/dev/zero"
 	}
 
diff --git a/cmd/nerdctl/container/container_kill_linux_test.go b/cmd/nerdctl/container/container_kill_linux_test.go
index 0e7d3fc3f62..6372d80ee33 100644
--- a/cmd/nerdctl/container/container_kill_linux_test.go
+++ b/cmd/nerdctl/container/container_kill_linux_test.go
@@ -27,6 +27,7 @@ import (
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	iptablesutil "github.com/containerd/nerdctl/v2/pkg/testutil/iptables"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 // TestKillCleanupForwards runs a container that exposes a port and then kill it.
@@ -66,7 +67,7 @@ func TestKillCleanupForwards(t *testing.T) {
 
 	// define iptables chain name depending on the target (docker/nerdctl)
 	var chain string
-	if testutil.GetTarget() == testutil.Docker {
+	if nerdtest.IsDocker() {
 		chain = "DOCKER"
 	} else {
 		redirectChain := "CNI-HOSTPORT-DNAT"
diff --git a/cmd/nerdctl/container/container_list_linux_test.go b/cmd/nerdctl/container/container_list_linux_test.go
index 9e3e1922a03..99f79d140b5 100644
--- a/cmd/nerdctl/container/container_list_linux_test.go
+++ b/cmd/nerdctl/container/container_list_linux_test.go
@@ -30,6 +30,7 @@ import (
 	"github.com/containerd/nerdctl/v2/pkg/strutil"
 	"github.com/containerd/nerdctl/v2/pkg/tabutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 type psTestContainer struct {
@@ -146,7 +147,7 @@ func TestContainerList(t *testing.T) {
 
 		// there is some difference between nerdctl and docker in calculating the size of the container
 		expectedSize := "26.2MB (virtual "
-		if base.Target != testutil.Docker {
+		if !nerdtest.IsDocker() {
 			expectedSize = "25.0 MiB (virtual "
 		}
 
diff --git a/cmd/nerdctl/container/container_restart_linux_test.go b/cmd/nerdctl/container/container_restart_linux_test.go
index a8d0e525a98..f4d82482f1f 100644
--- a/cmd/nerdctl/container/container_restart_linux_test.go
+++ b/cmd/nerdctl/container/container_restart_linux_test.go
@@ -130,7 +130,8 @@ func TestRestartWithTime(t *testing.T) {
 func TestRestartWithSignal(t *testing.T) {
 	testCase := nerdtest.Setup()
 
-	testCase.Require = require.Not(nerdtest.Gomodjail) // FIXME
+	// FIXME: gomodjail signal handling is not working yet: https://github.com/AkihiroSuda/gomodjail/issues/51
+	testCase.Require = require.Not(nerdtest.Gomodjail)
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
 		helpers.Anyhow("rm", "-f", data.Identifier())
diff --git a/cmd/nerdctl/container/container_run_cgroup_linux_test.go b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
index aaef1b02fed..ee6474a8b9b 100644
--- a/cmd/nerdctl/container/container_run_cgroup_linux_test.go
+++ b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
@@ -110,7 +110,7 @@ func TestRunCgroupV2(t *testing.T) {
 	update := []string{"update", "--cpu-quota", "42000", "--cpuset-mems", "0", "--cpu-period", "100000",
 		"--memory", "42m",
 		"--pids-limit", "42", "--cpu-shares", "2000", "--cpuset-cpus", "0-1"}
-	if base.Target == testutil.Docker && info.CgroupVersion == "2" && info.SwapLimit {
+	if nerdtest.IsDocker() && info.CgroupVersion == "2" && info.SwapLimit {
 		// Workaround for Docker with cgroup v2:
 		// > Error response from daemon: Cannot update container 67c13276a13dd6a091cdfdebb355aa4e1ecb15fbf39c2b5c9abee89053e88fce:
 		// > Memory limit should be smaller than already set memoryswap limit, update the memoryswap at the same time
@@ -450,7 +450,7 @@ func TestRunCgroupParent(t *testing.T) {
 	expected := filepath.Join(parent, id)
 	if info.CgroupDriver == "systemd" {
 		expected = filepath.Join(parent, fmt.Sprintf("nerdctl-%s", id))
-		if base.Target == testutil.Docker {
+		if nerdtest.IsDocker() {
 			expected = filepath.Join(parent, fmt.Sprintf("docker-%s", id))
 		}
 	}
diff --git a/cmd/nerdctl/container/container_run_linux_test.go b/cmd/nerdctl/container/container_run_linux_test.go
index aaa4b124f99..736a346ac07 100644
--- a/cmd/nerdctl/container/container_run_linux_test.go
+++ b/cmd/nerdctl/container/container_run_linux_test.go
@@ -382,7 +382,9 @@ func TestRunTTY(t *testing.T) {
 
 func TestRunSigProxy(t *testing.T) {
 	testCase := nerdtest.Setup()
-	testCase.Require = require.Not(nerdtest.Gomodjail) // FIXME
+
+	// FIXME: gomodjail signal handling is not working yet: https://github.com/AkihiroSuda/gomodjail/issues/51
+	testCase.Require = require.Not(nerdtest.Gomodjail)
 
 	testCase.SubTests = []*test.Case{
 		{
diff --git a/cmd/nerdctl/container/container_run_restart_linux_test.go b/cmd/nerdctl/container/container_run_restart_linux_test.go
index c3411c6aaeb..a5ce810bbad 100644
--- a/cmd/nerdctl/container/container_run_restart_linux_test.go
+++ b/cmd/nerdctl/container/container_run_restart_linux_test.go
@@ -28,6 +28,7 @@ import (
 	"gotest.tools/v3/poll"
 
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nettestutil"
 )
 
@@ -92,7 +93,7 @@ func TestRunRestart(t *testing.T) {
 
 func TestRunRestartWithOnFailure(t *testing.T) {
 	base := testutil.NewBase(t)
-	if testutil.GetTarget() == testutil.Nerdctl {
+	if !nerdtest.IsDocker() {
 		testutil.RequireContainerdPlugin(base, "io.containerd.internal.v1", "restart", []string{"on-failure"})
 	}
 	tID := testutil.Identifier(t)
@@ -113,7 +114,7 @@ func TestRunRestartWithOnFailure(t *testing.T) {
 
 func TestRunRestartWithUnlessStopped(t *testing.T) {
 	base := testutil.NewBase(t)
-	if testutil.GetTarget() == testutil.Nerdctl {
+	if !nerdtest.IsDocker() {
 		testutil.RequireContainerdPlugin(base, "io.containerd.internal.v1", "restart", []string{"unless-stopped"})
 	}
 	tID := testutil.Identifier(t)
@@ -137,7 +138,7 @@ func TestRunRestartWithUnlessStopped(t *testing.T) {
 
 func TestUpdateRestartPolicy(t *testing.T) {
 	base := testutil.NewBase(t)
-	if testutil.GetTarget() == testutil.Nerdctl {
+	if !nerdtest.IsDocker() {
 		testutil.RequireContainerdPlugin(base, "io.containerd.internal.v1", "restart", []string{"on-failure"})
 	}
 	tID := testutil.Identifier(t)
@@ -160,7 +161,7 @@ func TestUpdateRestartPolicy(t *testing.T) {
 // and check it can work correctly.
 func TestAddRestartPolicy(t *testing.T) {
 	base := testutil.NewBase(t)
-	if testutil.GetTarget() == testutil.Nerdctl {
+	if !nerdtest.IsDocker() {
 		testutil.RequireContainerdPlugin(base, "io.containerd.internal.v1", "restart", []string{"on-failure"})
 	}
 	tID := testutil.Identifier(t)
diff --git a/cmd/nerdctl/container/container_run_test.go b/cmd/nerdctl/container/container_run_test.go
index 82b7cbd7f53..23b74b97714 100644
--- a/cmd/nerdctl/container/container_run_test.go
+++ b/cmd/nerdctl/container/container_run_test.go
@@ -717,7 +717,7 @@ func TestRunAttachFlag(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			actualOut := tc.testFunc(t, tc.testStr, tc.args)
 			errorMsg := fmt.Sprintf("%s failed;\nExpected: '%s'\nActual: '%s'", tc.name, tc.expectedOut, actualOut)
-			if testutil.GetTarget() == testutil.Docker {
+			if nerdtest.IsDocker() {
 				assert.Equal(t, true, strings.Contains(actualOut, tc.dockerOut), errorMsg)
 			} else {
 				assert.Equal(t, true, strings.Contains(actualOut, tc.expectedOut), errorMsg)
@@ -744,7 +744,7 @@ func TestRunQuiet(t *testing.T) {
 	}
 
 	// Docker and nerdctl image pulls are not 1:1.
-	if testutil.GetTarget() == testutil.Docker {
+	if nerdtest.IsDocker() {
 		sentinel = "Pull complete"
 	} else {
 		sentinel = "resolved"
diff --git a/cmd/nerdctl/container/container_stop_linux_test.go b/cmd/nerdctl/container/container_stop_linux_test.go
index c9ba8874af1..135da90a938 100644
--- a/cmd/nerdctl/container/container_stop_linux_test.go
+++ b/cmd/nerdctl/container/container_stop_linux_test.go
@@ -130,7 +130,7 @@ func TestStopCleanupForwards(t *testing.T) {
 
 	// define iptables chain name depending on the target (docker/nerdctl)
 	var chain string
-	if testutil.GetTarget() == testutil.Docker {
+	if nerdtest.IsDocker() {
 		chain = "DOCKER"
 	} else {
 		redirectChain := "CNI-HOSTPORT-DNAT"
diff --git a/cmd/nerdctl/login/login_linux_test.go b/cmd/nerdctl/login/login_linux_test.go
index 3eab9293db5..55544b33ad8 100644
--- a/cmd/nerdctl/login/login_linux_test.go
+++ b/cmd/nerdctl/login/login_linux_test.go
@@ -33,6 +33,7 @@ import (
 
 	"github.com/containerd/nerdctl/v2/pkg/imgutil/dockerconfigresolver"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/testca"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/testregistry"
 )
@@ -76,7 +77,7 @@ func (ag *Client) Run(base *testutil.Base, host string) *testutil.Cmd {
 		ag.configPath, _ = os.MkdirTemp(base.T.TempDir(), "docker-config")
 	}
 	args := []string{"login"}
-	if base.Target == "nerdctl" {
+	if !nerdtest.IsDocker() {
 		args = append(args, "--debug-full")
 	}
 	args = append(args, ag.args...)
diff --git a/cmd/nerdctl/network/network_inspect_test.go b/cmd/nerdctl/network/network_inspect_test.go
index 11fc36f9a1b..ed4bb00d1e5 100644
--- a/cmd/nerdctl/network/network_inspect_test.go
+++ b/cmd/nerdctl/network/network_inspect_test.go
@@ -19,6 +19,7 @@ package network
 import (
 	"encoding/json"
 	"errors"
+	"os/exec"
 	"strings"
 	"testing"
 
@@ -248,7 +249,11 @@ func TestNetworkInspect(t *testing.T) {
 				return &test.Expected{
 					ExitCode: 0,
 					Output: func(stdout string, info string, t *testing.T) {
-						cmd := helpers.Custom("nerdctl", "--namespace", data.Identifier())
+						// Note: some functions need to be tested without the automatic --namespace nerdctl-test argument, so we need
+						// to retrieve the binary name.
+						// Note that we know this works already, so no need to assert err.
+						bin, _ := exec.LookPath(testutil.GetTarget())
+						cmd := helpers.Custom(bin, "--namespace", data.Identifier())
 
 						com := cmd.Clone()
 						com.WithArgs("network", "inspect", data.Identifier())
diff --git a/cmd/nerdctl/system/system_info_test.go b/cmd/nerdctl/system/system_info_test.go
index 6248a1e0711..8c4bfe10041 100644
--- a/cmd/nerdctl/system/system_info_test.go
+++ b/cmd/nerdctl/system/system_info_test.go
@@ -19,6 +19,7 @@ package system
 import (
 	"encoding/json"
 	"fmt"
+	"os/exec"
 	"testing"
 
 	"gotest.tools/v3/assert"
@@ -29,6 +30,7 @@ import (
 
 	"github.com/containerd/nerdctl/v2/pkg/infoutil"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
+	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
@@ -43,6 +45,11 @@ func testInfoComparator(stdout string, info string, t *testing.T) {
 func TestInfo(t *testing.T) {
 	testCase := nerdtest.Setup()
 
+	// Note: some functions need to be tested without the automatic --namespace nerdctl-test argument, so we need
+	// to retrieve the binary name.
+	// Note that we know this works already, so no need to assert err.
+	bin, _ := exec.LookPath(testutil.GetTarget())
+
 	testCase.SubTests = []*test.Case{
 		{
 			Description: "info",
@@ -58,7 +65,7 @@ func TestInfo(t *testing.T) {
 			Description: "info with namespace",
 			Require:     require.Not(nerdtest.Docker),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Custom("nerdctl", "info")
+				return helpers.Custom(bin, "info")
 			},
 			Expected: test.Expects(0, nil, expect.Contains("Namespace:	default")),
 		},
@@ -69,7 +76,7 @@ func TestInfo(t *testing.T) {
 			},
 			Require: require.Not(nerdtest.Docker),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Custom("nerdctl", "info")
+				return helpers.Custom(bin, "info")
 			},
 			Expected: test.Expects(0, nil, expect.Contains("Namespace:	test")),
 		},
diff --git a/docs/testing/README.md b/docs/testing/README.md
index faca8ab4981..0ab8fcd7647 100644
--- a/docs/testing/README.md
+++ b/docs/testing/README.md
@@ -104,7 +104,7 @@ If you are going to use blanket destructive operations (like `prune`), please:
 and be sure that your namespace is named after the test id
 - remove the namespace in your test `Cleanup`
 - since docker does not support namespaces, be sure to:
-  - only enable `Parallel` if the target is NOT docker: `	if testutil.GetTarget() != testutil.Docker { t.Parallel() }`
+  - only enable `Parallel` if the target is NOT docker: `	if !nerdtest.IsDocker() { t.Parallel() }`
   - double check that what you do in the default namespace is safe
 
 #### Clean-up after (and before) yourself
diff --git a/mod/tigron/test/command.go b/mod/tigron/test/command.go
index 272d689d490..1516cf8d4dc 100644
--- a/mod/tigron/test/command.go
+++ b/mod/tigron/test/command.go
@@ -110,10 +110,6 @@ type GenericCommand struct {
 	rawStdErr string
 }
 
-func (gc *GenericCommand) Binary() string {
-	return gc.cmd.Binary
-}
-
 func (gc *GenericCommand) WithBinary(binary string) {
 	gc.cmd.Binary = binary
 }
diff --git a/mod/tigron/test/interfaces.go b/mod/tigron/test/interfaces.go
index f9f9c73431a..12df876747a 100644
--- a/mod/tigron/test/interfaces.go
+++ b/mod/tigron/test/interfaces.go
@@ -101,8 +101,6 @@ type Helpers interface {
 // a Setup or Cleanup routine, and as the basis of any type of helper.
 // For more powerful use-cases outside of test cases, see below CustomizableCommand.
 type TestableCommand interface {
-	// Binary returns what binary to execute.
-	Binary() string
 	// WithBinary specifies what binary to execute.
 	WithBinary(binary string)
 	// WithArgs specifies the args to pass to the binary. Note that WithArgs can be used multiple
diff --git a/pkg/testutil/nerdtest/command.go b/pkg/testutil/nerdtest/command.go
index cf96407ee1c..cca060500db 100644
--- a/pkg/testutil/nerdtest/command.go
+++ b/pkg/testutil/nerdtest/command.go
@@ -20,6 +20,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"gotest.tools/v3/assert"
@@ -37,51 +38,38 @@ const defaultNamespace = testutil.Namespace
 // Inside the context of a single test, there is no concurrency, as setup, command and cleanup operate in sequence
 // Furthermore, the tempdir is private by definition.
 // Writing files here in a non-safe manner is thus OK.
-type target = string
-
-const (
-	targetNerdctl = target("nerdctl")
-	targetDocker  = target("docker")
-)
 
 func getTarget() string {
 	// Indirecting to testutil for now
 	return testutil.GetTarget()
 }
 
+func isTargetNerdish() bool {
+	return !strings.HasPrefix(filepath.Base(testutil.GetTarget()), "docker")
+}
+
 func newNerdCommand(conf test.Config, t *testing.T) *nerdCommand {
 	// Decide what binary we are running
 	var err error
 	var binary string
 	trgt := getTarget()
-	switch trgt {
-	case targetNerdctl:
-		nerdctl := trgt
-		if env := os.Getenv("NERDCTL"); env != "" {
-			nerdctl = env
-		}
-		binary, err = exec.LookPath(nerdctl)
-		if err != nil {
-			t.Fatalf("unable to find binary %q: %v", nerdctl, err)
-		}
-		// Set the default namespace if we do not have something already
+
+	binary, err = exec.LookPath(trgt)
+	if err != nil {
+		t.Fatalf("unable to find binary %q: %v", binary, err)
+	}
+
+	if isTargetNerdish() {
+		// Any target but docker is considered a nerdctl variant, either gomodjail, or homegrown cli based on the
+		// nerdctl codebase as a library.
+		// Set the default namespace if we do not have one explicitly set already
 		if conf.Read(Namespace) == "" {
 			conf.Write(Namespace, defaultNamespace)
 		}
-	case targetDocker:
-		docker := trgt
-		if env := os.Getenv("DOCKER"); env != "" {
-			docker = env
-		}
-		binary, err = exec.LookPath(docker)
-		if err != nil {
-			t.Fatalf("unable to find binary %q: %v", docker, err)
-		}
+	} else {
 		if err = exec.Command(binary, "compose", "version").Run(); err != nil {
 			t.Fatalf("docker does not support compose: %v", err)
 		}
-	default:
-		t.Fatalf("unknown target %q", getTarget())
 	}
 
 	// Create the base command, with the right binary, t
@@ -112,7 +100,7 @@ type nerdCommand struct {
 func (nc *nerdCommand) Run(expect *test.Expected) {
 	nc.T().Helper()
 	nc.prep()
-	if getTarget() == targetDocker {
+	if !isTargetNerdish() {
 		// We are not in the business of testing docker *error* output, so, spay expectation here
 		if expect != nil {
 			expect.Errors = nil
@@ -144,60 +132,64 @@ func (nc *nerdCommand) prep() {
 		}
 	}
 
-	if getTarget() == targetDocker {
+	// For Docker, honor log level and return
+	if !isTargetNerdish() {
 		// Allow debugging with docker syntax
 		if nc.Config.Read(Debug) != "" {
 			nc.PrependArgs("--log-level=debug")
 		}
-	} else if getTarget() == targetNerdctl {
-		// Set the namespace
-		if nc.Config.Read(Namespace) != "" {
-			nc.PrependArgs("--namespace=" + string(nc.Config.Read(Namespace)))
-		}
+		return
+	}
 
-		if nc.Config.Read(stargz) == enabled {
-			nc.Env["CONTAINERD_SNAPSHOTTER"] = "stargz"
-		}
+	// nerd-ish cli get the following additionally.
 
-		if nc.Config.Read(ipfs) == enabled {
-			var ipfsPath string
-			if rootlessutil.IsRootless() {
-				var err error
-				ipfsPath, err = platform.DataHome()
-				ipfsPath = filepath.Join(ipfsPath, "ipfs")
-				assert.NilError(nc.T(), err)
-			} else {
-				ipfsPath = filepath.Join(os.Getenv("HOME"), ".ipfs")
-			}
-
-			nc.Env["IPFS_PATH"] = ipfsPath
-		}
+	// Set the namespace
+	if nc.Config.Read(Namespace) != "" {
+		nc.PrependArgs("--namespace=" + string(nc.Config.Read(Namespace)))
+	}
 
-		// If no NERDCTL_TOML was explicitly provided, set it to the private dir
-		if nc.Env["NERDCTL_TOML"] == "" {
-			nc.Env["NERDCTL_TOML"] = filepath.Join(nc.GenericCommand.TempDir, "nerdctl.toml")
-		}
+	if nc.Config.Read(stargz) == enabled {
+		nc.Env["CONTAINERD_SNAPSHOTTER"] = "stargz"
+	}
 
-		// If we have custom toml content, write it if it does not exist already
-		if nc.Config.Read(NerdctlToml) != "" {
-			if !nc.hasWrittenToml {
-				dest := nc.Env["NERDCTL_TOML"]
-				err := os.WriteFile(dest, []byte(nc.Config.Read(NerdctlToml)), test.FilePermissionsDefault)
-				assert.NilError(nc.T(), err, "failed to write NerdctlToml")
-				nc.hasWrittenToml = true
-			}
+	if nc.Config.Read(ipfs) == enabled {
+		var ipfsPath string
+		if rootlessutil.IsRootless() {
+			var err error
+			ipfsPath, err = platform.DataHome()
+			ipfsPath = filepath.Join(ipfsPath, "ipfs")
+			assert.NilError(nc.T(), err)
+		} else {
+			ipfsPath = filepath.Join(os.Getenv("HOME"), ".ipfs")
 		}
 
-		if nc.Config.Read(HostsDir) != "" {
-			nc.PrependArgs("--hosts-dir=" + string(nc.Config.Read(HostsDir)))
-		}
-		if nc.Config.Read(DataRoot) != "" {
-			nc.PrependArgs("--data-root=" + string(nc.Config.Read(DataRoot)))
-		}
-		if nc.Config.Read(Debug) != "" {
-			nc.PrependArgs("--debug-full")
+		nc.Env["IPFS_PATH"] = ipfsPath
+	}
+
+	// If no NERDCTL_TOML was explicitly provided, set it to the private dir
+	if nc.Env["NERDCTL_TOML"] == "" {
+		nc.Env["NERDCTL_TOML"] = filepath.Join(nc.GenericCommand.TempDir, "nerdctl.toml")
+	}
+
+	// If we have custom toml content, write it if it does not exist already
+	if nc.Config.Read(NerdctlToml) != "" {
+		if !nc.hasWrittenToml {
+			dest := nc.Env["NERDCTL_TOML"]
+			err := os.WriteFile(dest, []byte(nc.Config.Read(NerdctlToml)), test.FilePermissionsDefault)
+			assert.NilError(nc.T(), err, "failed to write NerdctlToml")
+			nc.hasWrittenToml = true
 		}
 	}
+
+	if nc.Config.Read(HostsDir) != "" {
+		nc.PrependArgs("--hosts-dir=" + string(nc.Config.Read(HostsDir)))
+	}
+	if nc.Config.Read(DataRoot) != "" {
+		nc.PrependArgs("--data-root=" + string(nc.Config.Read(DataRoot)))
+	}
+	if nc.Config.Read(Debug) != "" {
+		nc.PrependArgs("--debug-full")
+	}
 }
 
 func (nc *nerdCommand) Clone() test.TestableCommand {
diff --git a/pkg/testutil/nerdtest/requirements.go b/pkg/testutil/nerdtest/requirements.go
index 37916551e41..b7118e86d06 100644
--- a/pkg/testutil/nerdtest/requirements.go
+++ b/pkg/testutil/nerdtest/requirements.go
@@ -99,7 +99,7 @@ var IsFlaky = func(issueLink string) *test.Requirement {
 // Generally used as require.Not(nerdtest.Docker), which of course it the opposite
 var Docker = &test.Requirement{
 	Check: func(data test.Data, helpers test.Helpers) (ret bool, mess string) {
-		ret = getTarget() == targetDocker
+		ret = !isTargetNerdish()
 		if ret {
 			mess = "current target is docker"
 		} else {
@@ -114,7 +114,7 @@ var Docker = &test.Requirement{
 var NerdctlNeedsFixing = func(issueLink string) *test.Requirement {
 	return &test.Requirement{
 		Check: func(data test.Data, helpers test.Helpers) (ret bool, mess string) {
-			ret = getTarget() == targetDocker
+			ret = !isTargetNerdish()
 			if ret {
 				mess = "current target is docker"
 			} else {
@@ -142,7 +142,7 @@ var BrokenTest = func(message string, req *test.Requirement) *test.Requirement {
 var Rootless = &test.Requirement{
 	Check: func(data test.Data, helpers test.Helpers) (ret bool, mess string) {
 		// Make sure we DO not return "IsRootless true" for docker
-		ret = getTarget() == targetNerdctl && rootlessutil.IsRootless()
+		ret = isTargetNerdish() && rootlessutil.IsRootless()
 		if ret {
 			mess = "environment is root-less"
 		} else {
@@ -177,7 +177,7 @@ var CgroupsAccessible = require.All(
 	CGroup,
 	&test.Requirement{
 		Check: func(data test.Data, helpers test.Helpers) (ret bool, mess string) {
-			isRootLess := getTarget() == targetNerdctl && rootlessutil.IsRootless()
+			isRootLess := isTargetNerdish() && rootlessutil.IsRootless()
 			if isRootLess {
 				stdout := helpers.Capture("info", "--format", "{{ json . }}")
 				var dinf dockercompat.Info
@@ -298,7 +298,7 @@ var Build = &test.Requirement{
 		ret := true
 		mess := "buildkitd is enabled"
 
-		if getTarget() == targetNerdctl {
+		if isTargetNerdish() {
 			bkHostAddr, err := buildkitutil.GetBuildkitHost(defaultNamespace)
 			if err != nil {
 				ret = false
@@ -349,7 +349,7 @@ var Private = &test.Requirement{
 	},
 
 	Cleanup: func(data test.Data, helpers test.Helpers) {
-		if getTarget() == targetNerdctl {
+		if isTargetNerdish() {
 			// FIXME: there are conditions where we still have some stuff in there and this fails...
 			containerList := strings.TrimSpace(helpers.Capture("ps", "-aq"))
 			if containerList != "" {
@@ -365,9 +365,8 @@ var Private = &test.Requirement{
 // https://github.com/AkihiroSuda/gomodjail
 var Gomodjail = &test.Requirement{
 	Check: func(_ test.Data, helpers test.Helpers) (ret bool, mess string) {
-		binary := helpers.Command().Binary()
 		// FIXME: do not rely on the filename
-		ret = strings.HasSuffix(binary, ".gomodjail")
+		ret = strings.HasSuffix(getTarget(), ".gomodjail")
 		if ret {
 			mess = "current target is packed with gomodjail"
 		} else {
diff --git a/pkg/testutil/nerdtest/test.go b/pkg/testutil/nerdtest/test.go
index 9aa623c76d1..94a42c459de 100644
--- a/pkg/testutil/nerdtest/test.go
+++ b/pkg/testutil/nerdtest/test.go
@@ -57,7 +57,7 @@ func (ns *nerdctlSetup) AmbientRequirements(testCase *test.Case, t *testing.T) {
 		t.Skip("runner skips non-flaky tests in the flaky environment")
 	}
 
-	if getTarget() == targetDocker && testCase.Config.Read(modePrivate) == enabled {
+	if !isTargetNerdish() && testCase.Config.Read(modePrivate) == enabled {
 		// For docker, we do disable parallel since there is no namespace where we can isolate
 		testCase.NoParallel = true
 	}
diff --git a/pkg/testutil/nerdtest/utilities.go b/pkg/testutil/nerdtest/utilities.go
index a5c15eede0c..6a52c4afe73 100644
--- a/pkg/testutil/nerdtest/utilities.go
+++ b/pkg/testutil/nerdtest/utilities.go
@@ -19,6 +19,7 @@ package nerdtest
 import (
 	"encoding/json"
 	"net"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -44,7 +45,7 @@ const (
 )
 
 func IsDocker() bool {
-	return testutil.GetTarget() == "docker"
+	return strings.HasPrefix(filepath.Base(testutil.GetTarget()), "docker")
 }
 
 // InspectContainer is a helper that can be used inside custom commands or Setup
diff --git a/pkg/testutil/testutil.go b/pkg/testutil/testutil.go
index 5e6ac5abf9b..e53277bce96 100644
--- a/pkg/testutil/testutil.go
+++ b/pkg/testutil/testutil.go
@@ -51,7 +51,7 @@ import (
 
 type Base struct {
 	T                    testing.TB
-	Target               Target
+	Target               string
 	DaemonIsKillable     bool
 	EnableIPv6           bool
 	IPv6Compatible       bool
@@ -134,15 +134,11 @@ func (b *Base) CmdWithHelper(helper []string, args ...string) *Cmd {
 }
 
 func (b *Base) systemctlTarget() string {
-	switch b.Target {
-	case Nerdctl:
-		return "containerd.service"
-	case Docker:
+	if IsDocker() {
 		return "docker.service"
-	default:
-		b.T.Fatalf("unexpected target %q", b.Target)
-		return ""
 	}
+
+	return "containerd.service"
 }
 
 func (b *Base) systemctlArgs() []string {
@@ -270,7 +266,7 @@ func (b *Base) Info() dockercompat.Info {
 
 func (b *Base) InfoNative() native.Info {
 	b.T.Helper()
-	if GetTarget() != Nerdctl {
+	if IsDocker() {
 		b.T.Skip("InfoNative() should not be called for non-nerdctl target")
 	}
 	cmdResult := b.Cmd("info", "--mode", "native", "--format", "{{ json . }}").Run()
@@ -284,7 +280,7 @@ func (b *Base) InfoNative() native.Info {
 
 func (b *Base) ContainerdAddress() string {
 	b.T.Helper()
-	if GetTarget() != Nerdctl {
+	if IsDocker() {
 		b.T.Skip("ContainerdAddress() should not be called for non-nerdctl target")
 	}
 	if os.Geteuid() == 0 {
@@ -482,15 +478,8 @@ func (c *Cmd) Out() string {
 	return res.Stdout()
 }
 
-type Target = string
-
-const (
-	Nerdctl = Target("nerdctl")
-	Docker  = Target("docker")
-)
-
 var (
-	flagTestTarget     Target
+	flagTestTarget     string
 	flagTestKillDaemon bool
 	flagTestIPv6       bool
 	flagTestKube       bool
@@ -502,13 +491,17 @@ var (
 )
 
 func M(m *testing.M) {
-	flag.StringVar(&flagTestTarget, "test.target", Nerdctl, "target to test")
+	flag.StringVar(&flagTestTarget, "test.target", "nerdctl", "target to test")
 	flag.BoolVar(&flagTestKillDaemon, "test.allow-kill-daemon", false, "enable tests that kill the daemon")
 	flag.BoolVar(&flagTestIPv6, "test.only-ipv6", false, "enable tests on IPv6")
 	flag.BoolVar(&flagTestKube, "test.only-kubernetes", false, "enable tests on Kubernetes")
 	flag.BoolVar(&flagTestFlaky, "test.only-flaky", false, "enable testing of flaky tests only (if false, flaky tests are ignored)")
 	flag.Parse()
 
+	if flagTestTarget == "" {
+		flagTestTarget = "nerdctl"
+	}
+
 	os.Exit(func() int {
 		// If there is a lockfile (no err), or if we error-ed stating it (permission), another test run is currently going.
 		// Note that this could be racy. The .lock file COULD get acquired after this and before we hit the lock section.
@@ -581,7 +574,7 @@ func GetDaemonIsKillable() bool {
 }
 
 func IsDocker() bool {
-	return GetTarget() == Docker
+	return strings.HasPrefix(filepath.Base(GetTarget()), "docker")
 }
 
 func DockerIncompatible(t testing.TB) {
@@ -591,7 +584,7 @@ func DockerIncompatible(t testing.TB) {
 }
 
 func RequiresBuild(t testing.TB) {
-	if GetTarget() == Nerdctl {
+	if !IsDocker() {
 		buildkitHost, err := buildkitutil.GetBuildkitHost(Namespace)
 		if err != nil {
 			t.Skipf("test requires buildkitd: %+v", err)
@@ -719,32 +712,19 @@ func newBase(t *testing.T, ns string, ipv6Compatible bool, kubernetesCompatible
 		t.Skip("legacy tests are considered flaky by default and are skipped unless in the flaky environment")
 	}
 	var err error
-	switch base.Target {
-	case Nerdctl:
-		nerdctl := "nerdctl"
-		if env := os.Getenv("NERDCTL"); env != "" {
-			nerdctl = env
-		}
-		base.Binary, err = exec.LookPath(nerdctl)
-		if err != nil {
-			t.Fatal(err)
+	base.Binary, err = exec.LookPath(base.Target)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if IsDocker() {
+		if err = exec.Command(base.Binary, "compose", "version").Run(); err != nil {
+			t.Fatalf("docker does not support compose: %v", err)
 		}
+	} else {
 		base.Args = []string{"--namespace=" + ns}
-	case Docker:
-		docker := "docker"
-		if env := os.Getenv("DOCKER"); env != "" {
-			docker = env
-		}
-		base.Binary, err = exec.LookPath(docker)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if err := exec.Command("docker", "compose", "version").Run(); err != nil {
-			t.Fatal(err)
-		}
-	default:
-		t.Fatalf("unknown test target %q", base.Target)
 	}
+
 	return base
 }
 

From 37ca1f4954fa99280fb62d425a56d738863ce17c Mon Sep 17 00:00:00 2001
From: fahed dorgaa <fahed.dorgaa@gmail.com>
Date: Fri, 2 May 2025 20:51:52 +0200
Subject: [PATCH 149/225] fix: enhance event monitoring by adding close event
 channel

Signed-off-by: fahed dorgaa <fahed.dorgaa@gmail.com>
---
 pkg/cmd/container/stats.go | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/pkg/cmd/container/stats.go b/pkg/cmd/container/stats.go
index 7b840c1010d..8382fb4b241 100644
--- a/pkg/cmd/container/stats.go
+++ b/pkg/cmd/container/stats.go
@@ -111,7 +111,7 @@ func Stats(ctx context.Context, client *containerd.Client, containerIDs []string
 	waitFirst := &sync.WaitGroup{}
 	cStats := stats{}
 
-	monitorContainerEvents := func(started chan<- struct{}, c chan *events.Envelope) {
+	monitorContainerEvents := func(started chan<- struct{}, c chan *events.Envelope, closeEventChan chan struct{}) {
 		eventsClient := client.EventService()
 		eventsCh, errCh := eventsClient.Subscribe(ctx)
 
@@ -121,6 +121,9 @@ func Stats(ctx context.Context, client *containerd.Client, containerIDs []string
 
 		for {
 			select {
+			case <-closeEventChan:
+				// c is closed, so we can stop monitoring events
+				return
 			case event := <-eventsCh:
 				c <- event
 			case err = <-errCh:
@@ -207,11 +210,16 @@ func Stats(ctx context.Context, client *containerd.Client, containerIDs []string
 		})
 
 		eventChan := make(chan *events.Envelope)
+		closeEventChan := make(chan struct{})
 
 		go eh.Watch(eventChan)
-		go monitorContainerEvents(started, eventChan)
+		go monitorContainerEvents(started, eventChan, closeEventChan)
+
+		defer func() {
+			closeEventChan <- struct{}{}
+			close(eventChan)
+		}()
 
-		defer close(eventChan)
 		<-started
 
 		// Start a goroutine to retrieve the initial list of containers stats.

From a5071dfc5d99ac567ba3f5adc8bd38a1ebb0d5be Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 2 May 2025 14:01:26 -0700
Subject: [PATCH 150/225] Removing net.core.somaxconn from test

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/container/container_inspect_linux_test.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/cmd/nerdctl/container/container_inspect_linux_test.go b/cmd/nerdctl/container/container_inspect_linux_test.go
index b070359fa00..5293ef83f49 100644
--- a/cmd/nerdctl/container/container_inspect_linux_test.go
+++ b/cmd/nerdctl/container/container_inspect_linux_test.go
@@ -263,7 +263,6 @@ func TestContainerInspectHostConfig(t *testing.T) {
 		"--read-only",
 		"--shm-size", "256m",
 		"--uts", "host",
-		"--sysctl", "net.core.somaxconn=1024",
 		"--runtime", "io.containerd.runc.v2",
 		testutil.AlpineImage, "sleep", "infinity").AssertOK()
 

From 3ecc7f87fc4f0e3735f924c8f1a31ec1ac6ee9d0 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 2 May 2025 16:01:12 -0700
Subject: [PATCH 151/225] Disable blkio test for older kernels

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/container/container_inspect_linux_test.go    | 5 +++++
 cmd/nerdctl/container/container_run_cgroup_linux_test.go | 5 +++++
 pkg/testutil/testutil.go                                 | 4 +++-
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/cmd/nerdctl/container/container_inspect_linux_test.go b/cmd/nerdctl/container/container_inspect_linux_test.go
index b070359fa00..9299a1676b0 100644
--- a/cmd/nerdctl/container/container_inspect_linux_test.go
+++ b/cmd/nerdctl/container/container_inspect_linux_test.go
@@ -478,6 +478,11 @@ func TestContainerInspectBlkioSettings(t *testing.T) {
 		t.Skip("test requires root privilege to create a dummy device")
 	}
 
+	// See https://github.com/containerd/nerdctl/issues/4185
+	// It is unclear if this is truly a kernel version problem, a runc issue, or a distro (EL9) issue.
+	// For now, disable the test unless on a recent kernel.
+	testutil.RequireKernelVersion(t, ">= 6.0.0-0")
+
 	devPath := "/dev/dummy-zero"
 	// a dummy zero device: mknod /dev/dummy-zero c 1 5
 	helperCmd := exec.Command("mknod", []string{devPath, "c", "1", "5"}...)
diff --git a/cmd/nerdctl/container/container_run_cgroup_linux_test.go b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
index aaef1b02fed..bbee9af75f6 100644
--- a/cmd/nerdctl/container/container_run_cgroup_linux_test.go
+++ b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
@@ -484,6 +484,11 @@ func TestRunBlkioSettingCgroupV2(t *testing.T) {
 	testCase := nerdtest.Setup()
 	testCase.Require = nerdtest.Rootful
 
+	// See https://github.com/containerd/nerdctl/issues/4185
+	// It is unclear if this is truly a kernel version problem, a runc issue, or a distro (EL9) issue.
+	// For now, disable the test unless on a recent kernel.
+	testutil.RequireKernelVersion(t, ">= 6.0.0-0")
+
 	// Create dummy device path
 	dummyDev := "/dev/dummy-zero"
 
diff --git a/pkg/testutil/testutil.go b/pkg/testutil/testutil.go
index 5e6ac5abf9b..d3a3f72035f 100644
--- a/pkg/testutil/testutil.go
+++ b/pkg/testutil/testutil.go
@@ -617,7 +617,9 @@ func RequireKernelVersion(t testing.TB, constraint string) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	unameR, err := semver.NewVersion(infoutil.UnameR())
+	// EL kernel versions are not semver, so, cleanup first
+	un := strings.Split(infoutil.UnameR(), "-")[0]
+	unameR, err := semver.NewVersion(un)
 	if err != nil {
 		t.Skip(err)
 	}

From f4a9defc22881bcad2a8071897cf38b7d8d51d4b Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 2 May 2025 22:28:56 -0700
Subject: [PATCH 152/225] Refactor github workflows

This focused on cleaning-up integration testing, starting with freeBSD, EL, Docker, Windows.

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/job-test-in-host.yml        | 181 ++++++++++++++
 .github/workflows/job-test-in-lima.yml        | 118 +++++++++
 .github/workflows/job-test-in-vagrant.yml     |  60 +++++
 .github/workflows/job-test-unit.yml           |   2 +-
 .github/workflows/test-canary.yml             |  41 ----
 .github/workflows/test-kube.yml               |  27 ---
 .github/workflows/workflow-flaky.yml          |  56 +++++
 .github/workflows/workflow-test.yml           | 228 +++---------------
 .../{tigron.yml => workflow-tigron.yml}       |   0
 hack/provisioning/kube/kind.sh                |   2 +-
 hack/provisioning/linux/cni.sh                |   6 +-
 hack/provisioning/linux/containerd.sh         |  24 +-
 12 files changed, 468 insertions(+), 277 deletions(-)
 create mode 100644 .github/workflows/job-test-in-host.yml
 create mode 100644 .github/workflows/job-test-in-lima.yml
 create mode 100644 .github/workflows/job-test-in-vagrant.yml
 delete mode 100644 .github/workflows/test-kube.yml
 create mode 100644 .github/workflows/workflow-flaky.yml
 rename .github/workflows/{tigron.yml => workflow-tigron.yml} (100%)

diff --git a/.github/workflows/job-test-in-host.yml b/.github/workflows/job-test-in-host.yml
new file mode 100644
index 00000000000..324fe3e911e
--- /dev/null
+++ b/.github/workflows/job-test-in-host.yml
@@ -0,0 +1,181 @@
+# This currently test docker and nerdctl on windows (w/o canary)
+# Structure is in to allow testing nerdctl on linux as well, though more work is required to make it functional.
+name: job-test-in-host
+
+on:
+  workflow_call:
+    inputs:
+      timeout:
+        required: true
+        type: number
+      runner:
+        required: true
+        type: string
+      canary:
+        required: false
+        default: false
+        type: boolean
+      binary:
+        required: false
+        default: nerdctl
+        type: string
+      go-version:
+        required: true
+        type: string
+      containerd-version:
+        required: true
+        type: string
+      containerd-sha:
+        required: true
+        type: string
+      containerd-service-sha:
+        required: true
+        type: string
+      windows-cni-version:
+        required: true
+        type: string
+      linux-cni-version:
+        required: true
+        type: string
+      linux-cni-sha:
+        required: true
+        type: string
+
+env:
+  GOTOOLCHAIN: local
+
+jobs:
+  test:
+    name: |
+      ${{ inputs.binary != 'nerdctl' && format('{0} < ', inputs.binary) || '' }}
+      ${{ contains(inputs.runner, 'ubuntu') && ' linux' || ' windows' }}
+      ${{ contains(inputs.runner, 'arm') && '(arm)' || '' }}
+      ${{ contains(inputs.runner, '22.04') && '(old ubuntu)' || '' }}
+      ${{ inputs.canary && ' (canary)' || '' }}
+    timeout-minutes: ${{ inputs.timeout }}
+    runs-on: "${{ inputs.runner }}"
+    defaults:
+      run:
+        shell: bash
+
+    env:
+      SHOULD_RUN: "yes"
+      GO_VERSION: ${{ inputs.go-version }}
+      # Both Docker and nerdctl on linux need rootful right now
+      WITH_SUDO: ${{ contains(inputs.runner, 'ubuntu') }}
+      CONTAINERD_VERSION: ${{ inputs.containerd-version }}
+      CONTAINERD_SHA: ${{ inputs.containerd-sha }}
+
+    steps:
+      - name: "Init: checkout"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          fetch-depth: 1
+
+      - if: ${{ inputs.canary }}
+        name: "Init (canary): retrieve latest go and containerd"
+        run: |
+          latest_go="$(. ./hack/provisioning/version/fetch.sh; go::canary::for::go-setup)"
+          latest_containerd="$(. ./hack/provisioning/version/fetch.sh; github::project::latest "containerd/containerd")"
+
+          [ "$latest_go" == "" ] || \
+            printf "GO_VERSION=%s\n" "$latest_go" >> "$GITHUB_ENV"
+          [ "${latest_containerd:1}" == "$CONTAINERD_VERSION" ] || {
+            printf "CONTAINERD_VERSION=%s\n" "${latest_containerd:1}" >> "$GITHUB_ENV"
+            printf "CONTAINERD_SHA=canary is volatile and I accept the risk\n" >> "$GITHUB_ENV"
+          }
+          if [ "$latest_go" == "" ] && [ "${latest_containerd:1}" == "$CONTAINERD_VERSION" ]; then
+            echo "::warning title=No canary::There is currently no canary versions to test. Steps will not run.";
+            printf "SHOULD_RUN=no\n" >> "$GITHUB_ENV"
+          fi
+
+      - if: ${{ env.SHOULD_RUN == 'yes' }}
+        name: "Init: install go"
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          check-latest: true
+
+      # XXX RUNNER_OS and generally env is too unreliable
+      # - if: ${{ env.RUNNER_OS == 'Linux' }}
+      - if: ${{ contains(inputs.runner, 'ubuntu') && env.SHOULD_RUN == 'yes' }}
+        name: "Init (linux): prepare host"
+        run: |
+          if [ "${{ contains(inputs.binary, 'docker') }}" == true ]; then
+            echo "::group:: configure cdi for docker"
+            sudo mkdir -p /etc/docker
+            sudo jq '.features.cdi = true' /etc/docker/daemon.json | sudo tee /etc/docker/daemon.json.tmp && sudo mv /etc/docker/daemon.json.tmp /etc/docker/daemon.json
+            sudo systemctl restart docker
+            echo "::endgroup::"
+          else
+            # FIXME: this is missing runc (see top level workflow note about the state of this)
+            echo "::group:: install dependencies"
+            sudo ./hack/provisioning/linux/containerd.sh uninstall
+            ./hack/provisioning/linux/containerd.sh rootful "$CONTAINERD_VERSION" "amd64" "$CONTAINERD_SHA" "${{ inputs.containerd-service-sha }}"
+            sudo ./hack/provisioning/linux/cni.sh uninstall
+            ./hack/provisioning/linux/cni.sh install "${{ inputs.linux-cni-version }}" "amd64" "${{ inputs.linux-cni-sha }}"
+            echo "::endgroup::"
+
+            echo "::group:: build nerctl"
+            go install ./cmd/nerdctl
+            echo "$HOME/go/bin" >> "$GITHUB_PATH"
+            # Since tests are going to run root, we need nerdctl to be in a PATH that will survive `sudo`
+            sudo cp "$(which nerdctl)" /usr/local/bin
+            echo "::endgroup::"
+          fi
+
+          # Register QEMU (tonistiigi/binfmt)
+          # `--install all` will only install emulation for architectures that cannot be natively executed
+          # Since some arm64 platforms do provide native fallback execution for 32 bits,
+          # armv7 emulation may or may not be installed, causing variance in the result of `uname -m`.
+          # To avoid that, we explicitly list the architectures we do want emulation for.
+          docker run --privileged --rm tonistiigi/binfmt --install linux/amd64
+          docker run --privileged --rm tonistiigi/binfmt --install linux/arm64
+          docker run --privileged --rm tonistiigi/binfmt --install linux/arm/v7
+
+          # FIXME: remove expect when we are done removing unbuffer from tests
+          sudo apt-get install -qq expect
+
+      - if: ${{ contains(inputs.runner, 'windows') && env.SHOULD_RUN == 'yes' }}
+        name: "Init (windows): prepare host"
+        env:
+          ctrdVersion: ${{ env.CONTAINERD_VERSION }}
+        run: |
+          # Install WinCNI
+          echo "::group:: install wincni"
+          GOPATH=$(go env GOPATH) WINCNI_VERSION=${{ inputs.windows-cni-version }} ./hack/provisioning/windows/cni.sh
+          echo "::endgroup::"
+
+          # Install containerd
+          echo "::group:: install containerd"
+          powershell hack/provisioning/windows/containerd.ps1
+          echo "::endgroup::"
+
+          # Install nerdctl
+          echo "::group:: build nerctl"
+          go install ./cmd/nerdctl
+          echo "::endgroup::"
+
+      - if: ${{ env.SHOULD_RUN == 'yes' }}
+        name: "Init: install dev tools"
+        run: |
+          echo "::group:: make install-dev-tools"
+          make install-dev-tools
+          echo "::endgroup::"
+
+      # ipv6 is tested only on linux
+      - if: ${{ contains(inputs.runner, 'ubuntu') && env.SHOULD_RUN == 'yes' }}
+        name: "Run (linux): integration tests (IPv6)"
+        run: |
+          ./hack/test-integration.sh -test.target=${{ inputs.binary }} -test.only-ipv6
+
+      - if: ${{ env.SHOULD_RUN == 'yes' }}
+        name: "Run: integration tests"
+        run: |
+          ./hack/test-integration.sh -test.target=${{ inputs.binary }} -test.only-flaky=false
+
+      # FIXME: this must go
+      - if: ${{ env.SHOULD_RUN == 'yes' }}
+        name: "Run: integration tests (flaky)"
+        run: |
+          ./hack/test-integration.sh -test.target=${{ inputs.binary }} -test.only-flaky=true
diff --git a/.github/workflows/job-test-in-lima.yml b/.github/workflows/job-test-in-lima.yml
new file mode 100644
index 00000000000..22e2f3e9f8b
--- /dev/null
+++ b/.github/workflows/job-test-in-lima.yml
@@ -0,0 +1,118 @@
+# Currently, Lima job test only for EL, though in the future it could be used to also test FreeBSD or other linux-es
+name: job-test-in-lima
+
+on:
+  workflow_call:
+    inputs:
+      timeout:
+        required: true
+        type: number
+      runner:
+        required: true
+        type: string
+      target:
+        required: true
+        type: string
+      guest:
+        required: true
+        type: string
+
+jobs:
+  test:
+    name: "${{ inputs.guest }} ${{ inputs.target }}"
+    timeout-minutes: ${{ inputs.timeout }}
+    runs-on: "${{ inputs.runner }}"
+    env:
+      TARGET: ${{ inputs.target }}
+    steps:
+      - name: "Init: checkout"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          fetch-depth: 1
+
+      - name: "Init: lima"
+        uses: lima-vm/lima-actions/setup@be564a1408f84557d067b099a475652288074b2e  # v1.0.0
+        id: lima-actions-setup
+
+      - name: "Init: Cache"
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
+        with:
+          path: ~/.cache/lima
+          key: lima-${{ steps.lima-actions-setup.outputs.version }}
+
+      - name: "Init: start the guest VM"
+        run: |
+          set -eux
+          # containerd=none is set because the built-in containerd support conflicts with Docker
+          limactl start \
+            --name=default \
+            --cpus=4 \
+            --memory=12 \
+            --containerd=none \
+            --set '.mounts=null | .portForwards=[{"guestSocket":"/var/run/docker.sock","hostSocket":"{{.Dir}}/sock/docker.sock"}]' \
+            template://${{ inputs.guest }}
+
+      # FIXME: the tests should be directly executed in the VM without nesting Docker inside it
+      # https://github.com/containerd/nerdctl/issues/3858
+      - name: "Init: install dockerd in the guest VM"
+        run: |
+          set -eux
+          lima sudo mkdir -p /etc/systemd/system/docker.socket.d
+          cat <<-EOF | lima sudo tee /etc/systemd/system/docker.socket.d/override.conf
+          [Socket]
+          SocketUser=$(whoami)
+          EOF
+          lima sudo dnf config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
+          lima sudo dnf -q -y install docker-ce --nobest
+          lima sudo systemctl enable --now docker
+
+      - name: "Init: configure the host to use dockerd in the guest VM"
+        run: |
+          set -eux
+          sudo systemctl disable --now docker.service docker.socket
+          export DOCKER_HOST="unix://$(limactl ls --format '{{.Dir}}/sock/docker.sock' default)"
+          echo "DOCKER_HOST=${DOCKER_HOST}" >>$GITHUB_ENV
+          docker info
+          docker version
+
+      - name: "Init: expose GitHub Runtime variables for gha"
+        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
+
+      - name: "Init: prepare integration tests"
+        run: |
+          set -eux
+
+          sudo losetup -Dv
+          sudo losetup -lv
+
+          [ "$TARGET" = "rootless" ] && TARGET=test-integration-rootless || TARGET=test-integration
+          docker buildx create --name with-gha --use
+          docker buildx build \
+            --output=type=docker \
+            --cache-from type=gha,scope=test-integration-dependencies-amd64 \
+            -t test-integration --target "${TARGET}" \
+            .
+
+      - name: "Run integration tests"
+        # Presumably, something is broken with the way docker exposes /dev to the container, as it appears to only
+        # randomly work. Mounting /dev does workaround the issue.
+        # This might be due to the old kernel shipped with Alma (4.18), or something else between centos/docker.
+        run: |
+          set -eux
+          if [ "$TARGET" = "rootless" ]; then
+            echo "rootless"
+            docker run -t -v /dev:/dev --rm --privileged test-integration /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=false
+          else
+            echo "rootful"
+            docker run -t -v /dev:/dev --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=false
+          fi
+      - name: "Run: integration tests (flaky)"
+        run: |
+          set -eux
+          if [ "$TARGET" = "rootless" ]; then
+            echo "rootless"
+            docker run -t -v /dev:/dev --rm --privileged test-integration /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=true
+          else
+            echo "rootful"
+            docker run -t -v /dev:/dev --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=true
+          fi
diff --git a/.github/workflows/job-test-in-vagrant.yml b/.github/workflows/job-test-in-vagrant.yml
new file mode 100644
index 00000000000..843606c0987
--- /dev/null
+++ b/.github/workflows/job-test-in-vagrant.yml
@@ -0,0 +1,60 @@
+# Right now, this is testing solely FreeBSD, but could be used to test other targets.
+# Alternatively, this might get replaced entirely by Lima eventually.
+name: job-test-in-vagrant
+
+on:
+  workflow_call:
+    inputs:
+      timeout:
+        required: true
+        type: number
+      runner:
+        required: true
+        type: string
+
+jobs:
+  test:
+    # Will appear as freebsd / 14 in GitHub UI
+    name: "14"
+    timeout-minutes: ${{ inputs.timeout }}
+    runs-on: "${{ inputs.runner }}"
+    steps:
+      - name: "Init: checkout"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          fetch-depth: 1
+
+      - name: "Init: setup cache"
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
+        with:
+          path: /root/.vagrant.d
+          key: vagrant
+
+      - name: "Init: set up vagrant"
+        run: |
+          # from https://github.com/containerd/containerd/blob/v2.0.2/.github/workflows/ci.yml#L583-L596
+          # which is based on https://github.com/opencontainers/runc/blob/v1.1.8/.cirrus.yml#L41-L49
+          # FIXME: https://github.com/containerd/nerdctl/issues/4163
+          curl -fsSL --proto '=https' --tlsv1.2 https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
+          echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
+          sudo sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/ubuntu.sources
+          sudo apt-get update -qq
+          sudo apt-get install -qq libvirt-daemon libvirt-daemon-system vagrant ovmf
+          # https://github.com/vagrant-libvirt/vagrant-libvirt/issues/1725#issuecomment-1454058646
+          sudo cp /usr/share/OVMF/OVMF_VARS_4M.fd /var/lib/libvirt/qemu/nvram/
+          sudo systemctl enable --now libvirtd
+          sudo apt-get build-dep -qq ruby-libvirt
+          sudo apt-get install -qq --no-install-recommends libxslt-dev libxml2-dev libvirt-dev ruby-bundler ruby-dev zlib1g-dev
+          # Disable strict dependency enforcement to bypass gem version conflicts during the installation of the vagrant-libvirt plugin.
+          sudo env VAGRANT_DISABLE_STRICT_DEPENDENCY_ENFORCEMENT=1 vagrant plugin install vagrant-libvirt
+
+      - name: "Init: boot VM"
+        run: |
+          ln -sf Vagrantfile.freebsd Vagrantfile
+          sudo vagrant up --no-tty
+
+      - name: "Run: test-unit"
+        run: sudo vagrant up --provision-with=test-unit
+
+      - name: "Run: test-integration"
+        run: sudo vagrant up --provision-with=test-integration
diff --git a/.github/workflows/job-test-unit.yml b/.github/workflows/job-test-unit.yml
index 67e5d97447c..3027e49beb4 100644
--- a/.github/workflows/job-test-unit.yml
+++ b/.github/workflows/job-test-unit.yml
@@ -73,7 +73,7 @@ jobs:
           if [ "$RUNNER_OS" == "Windows" ]; then
             GOPATH=$(go env GOPATH) WINCNI_VERSION=${{ inputs.windows-cni-version }} ./hack/provisioning/windows/cni.sh
           elif [ "$RUNNER_OS" == "Linux" ]; then
-            ./hack/provisioning/linux/cni.sh "${{ inputs.linux-cni-version }}" "amd64" "${{ inputs.linux-cni-sha }}"
+            ./hack/provisioning/linux/cni.sh install "${{ inputs.linux-cni-version }}" "amd64" "${{ inputs.linux-cni-sha }}"
           fi
 
       - if: ${{ env.GO_VERSION != '' }}
diff --git a/.github/workflows/test-canary.yml b/.github/workflows/test-canary.yml
index 6236573fa15..b23dc91f63f 100644
--- a/.github/workflows/test-canary.yml
+++ b/.github/workflows/test-canary.yml
@@ -45,44 +45,3 @@ jobs:
         run: docker run -t --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=false
       - name: "Run integration tests (flaky)"
         run: docker run -t --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=true
-
-  windows:
-    timeout-minutes: 40
-    runs-on: windows-latest
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          fetch-depth: 1
-      - name: Set GO env
-        run: |
-          # Get latest containerd
-          args=(curl --proto '=https' --tlsv1.2 -fsSL -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28")
-          [ "${GITHUB_TOKEN:-}" == "" ] && {
-            >&2 printf "GITHUB_TOKEN is not set - you might face rate limitations with the Github API\n"
-          } || args+=(-H "Authorization: Bearer $GITHUB_TOKEN")
-          ctd_v="$("${args[@]}" https://api.github.com/repos/containerd/containerd/tags | jq -rc .[0].name)"
-          echo "CONTAINERD_VERSION=${ctd_v:1}" >> "$GITHUB_ENV"
-
-          . ./hack/provisioning/version/fetch.sh
-          printf "GO_VERSION=%s\n" "$(go::canary::for::go-setup)" >> "$GITHUB_ENV"
-      - name: "Install go"
-        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          check-latest: true
-      - run: go install ./cmd/nerdctl
-      - run: make install-dev-tools
-      - name: "Set up CNI"
-        run: GOPATH=$(go env GOPATH) ./hack/provisioning/windows/cni.sh
-      # Windows setup script can only use released versions
-      - name: "Set up containerd"
-        env:
-          ctrdVersion: ${{ env.CONTAINERD_VERSION }}
-        run: powershell hack/provisioning/windows/containerd.ps1
-      - name: "Run integration tests"
-        run: ./hack/test-integration.sh -test.only-flaky=false
-      - name: "Run integration tests (flaky)"
-        run: ./hack/test-integration.sh -test.only-flaky=true
diff --git a/.github/workflows/test-kube.yml b/.github/workflows/test-kube.yml
deleted file mode 100644
index 7fd8d880f89..00000000000
--- a/.github/workflows/test-kube.yml
+++ /dev/null
@@ -1,27 +0,0 @@
-# This pipeline purpose is solely meant to run a subset of our test suites against a kubernetes cluster
-name: "[flaky, see #3988] kubernetes"
-
-on:
-  push:
-    branches:
-      - main
-      - 'release/**'
-  pull_request:
-    paths-ignore:
-      - '**.md'
-
-jobs:
-  linux:
-    runs-on: "ubuntu-24.04"
-    timeout-minutes: 40
-    env:
-      ROOTFUL: true
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          fetch-depth: 1
-      - name: "Run Kubernetes integration tests"
-        # See https://github.com/containerd/nerdctl/blob/main/docs/testing/README.md#about-parallelization
-        run: |
-          ./hack/provisioning/kube/kind.sh
-          sudo ./_output/nerdctl exec nerdctl-test-control-plane bash -c -- 'export TMPDIR="$HOME"/tmp; mkdir -p "$TMPDIR"; cd /nerdctl-source; /usr/local/go/bin/go test -p 1 ./cmd/nerdctl/... -test.only-kubernetes'
diff --git a/.github/workflows/workflow-flaky.yml b/.github/workflows/workflow-flaky.yml
new file mode 100644
index 00000000000..85b5c1dd650
--- /dev/null
+++ b/.github/workflows/workflow-flaky.yml
@@ -0,0 +1,56 @@
+# This workflow puts together all known "flaky" and experimental targets
+name: "[flaky, see #3988]"
+
+on:
+  push:
+    branches:
+      - main
+      - 'release/**'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+
+jobs:
+  test-integration-el:
+    name: "EL${{ inputs.hack }}"
+    uses: ./.github/workflows/job-test-in-lima.yml
+    strategy:
+      fail-fast: false
+      # EL8 is used for testing compatibility with cgroup v1.
+      # Unfortunately, EL8 is hard to debug for M1 users (as Lima+M1+EL8 is not runnable because of page size),
+      # and it currently shows numerous issues.
+      # Thus, EL9 is also added as target (for a limited time?) so that we can figure out which issues are EL8 specific,
+      # and which issues could be reproduced on EL9 as well (which would be easier to debug).
+      matrix:
+        guest: ["almalinux-8", "almalinux-9"]
+        target: ["rootful", "rootless"]
+    with:
+      timeout: 60
+      runner: ubuntu-24.04
+      guest: ${{ matrix.guest }}
+      target: ${{ matrix.target }}
+
+  test-integration-freebsd:
+    name: "FreeBSD"
+    uses: ./.github/workflows/job-test-in-vagrant.yml
+    with:
+      timeout: 15
+      runner: ubuntu-24.04
+
+  kube:
+    name: "kubernetes"
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    env:
+      ROOTFUL: true
+    steps:
+      - name: "Init: checkout"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          fetch-depth: 1
+      - name: "Run"
+        run: |
+          # FIXME: this should be a bit more elegant to use.
+          ./hack/provisioning/kube/kind.sh
+          # See https://github.com/containerd/nerdctl/blob/main/docs/testing/README.md#about-parallelization
+          sudo ./_output/nerdctl exec nerdctl-test-control-plane bash -c -- 'export TMPDIR="$HOME"/tmp; mkdir -p "$TMPDIR"; cd /nerdctl-source; /usr/local/go/bin/go test -p 1 ./cmd/nerdctl/... -test.only-kubernetes'
diff --git a/.github/workflows/workflow-test.yml b/.github/workflows/workflow-test.yml
index 0ca8469aac5..1262c33e6fc 100644
--- a/.github/workflows/workflow-test.yml
+++ b/.github/workflows/workflow-test.yml
@@ -293,204 +293,38 @@ jobs:
         if: matrix.nerdctl != 'nerdctl.gomodjail'
         run: docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} ${TEST_TARGET} /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=true -test.target=${NERDCTL}
 
-  test-integration-docker-compatibility:
-    timeout-minutes: 40
-    name: docker
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          fetch-depth: 1
-      - name: "Install go"
-        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          check-latest: true
-      - name: "Register QEMU (tonistiigi/binfmt)"
-        run: |
-          # `--install all` will only install emulation for architectures that cannot be natively executed
-          # Since some arm64 platforms do provide native fallback execution for 32 bits,
-          # armv7 emulation may or may not be installed, causing variance in the result of `uname -m`.
-          # To avoid that, we explicitly list the architectures we do want emulation for.
-          docker run --privileged --rm tonistiigi/binfmt --install linux/amd64
-          docker run --privileged --rm tonistiigi/binfmt --install linux/arm64
-          docker run --privileged --rm tonistiigi/binfmt --install linux/arm/v7
-      - name: "Prepare integration test environment"
-        run: |
-          # FIXME: remove expect when we are done removing unbuffer from tests
-          sudo apt-get install -qq expect
-          make install-dev-tools
-      - name: Enable CDI in the Docker daemon.
-        run: |
-          sudo mkdir -p /etc/docker
-          sudo jq '.features.cdi = true' /etc/docker/daemon.json | sudo tee /etc/docker/daemon.json.tmp && sudo mv /etc/docker/daemon.json.tmp /etc/docker/daemon.json
-          sudo systemctl restart docker
-      - name: "Ensure that the integration test suite is compatible with Docker"
-        run: WITH_SUDO=true ./hack/test-integration.sh -test.target=docker
-      - name: "Ensure that the IPv6 integration test suite is compatible with Docker"
-        run: WITH_SUDO=true ./hack/test-integration.sh -test.target=docker -test.only-ipv6
-      - name: "Ensure that the integration test suite is compatible with Docker (flaky only)"
-        run: WITH_SUDO=true ./hack/test-integration.sh -test.target=docker -test.only-flaky
-
-  test-integration-windows:
-    timeout-minutes: 40
-    name: windows
-    runs-on: windows-2022
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          fetch-depth: 1
-      - name: "Install go"
-        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          check-latest: true
-      - run: |
-          go install ./cmd/nerdctl
-          make install-dev-tools
-      - name: "Set up CNI"
-        run: GOPATH=$(go env GOPATH) ./hack/provisioning/windows/cni.sh
-      - name: "Set up containerd"
-        env:
-          ctrdVersion: 1.7.27
-        run: powershell hack/provisioning/windows/containerd.ps1
-      - name: "Run integration tests"
-        run: ./hack/test-integration.sh -test.only-flaky=false
-      - name: "Run integration tests (flaky)"
-        run: ./hack/test-integration.sh -test.only-flaky=true
-
-  test-integration-freebsd:
-    timeout-minutes: 40
-    name: FreeBSD
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          fetch-depth: 1
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
-        with:
-          path: /root/.vagrant.d
-          key: vagrant
-      - name: Set up vagrant
-        run: |
-          # from https://github.com/containerd/containerd/blob/v2.0.2/.github/workflows/ci.yml#L583-L596
-          # which is based on https://github.com/opencontainers/runc/blob/v1.1.8/.cirrus.yml#L41-L49
-          curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
-          echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
-          sudo sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/ubuntu.sources
-          sudo apt-get update -qq
-          sudo apt-get install -qq libvirt-daemon libvirt-daemon-system vagrant ovmf
-          # https://github.com/vagrant-libvirt/vagrant-libvirt/issues/1725#issuecomment-1454058646
-          sudo cp /usr/share/OVMF/OVMF_VARS_4M.fd /var/lib/libvirt/qemu/nvram/
-          sudo systemctl enable --now libvirtd
-          sudo apt-get build-dep -qq ruby-libvirt
-          sudo apt-get install -qq --no-install-recommends libxslt-dev libxml2-dev libvirt-dev ruby-bundler ruby-dev zlib1g-dev
-          # Disable strict dependency enforcement to bypass gem version conflicts during the installation of the vagrant-libvirt plugin.
-          sudo env VAGRANT_DISABLE_STRICT_DEPENDENCY_ENFORCEMENT=1 vagrant plugin install vagrant-libvirt
-      - name: Boot VM
-        run: |
-          ln -sf Vagrantfile.freebsd Vagrantfile
-          sudo vagrant up --no-tty
-      - name: test-unit
-        run: sudo vagrant up --provision-with=test-unit
-      - name: test-integration
-        run: sudo vagrant up --provision-with=test-integration
-
-  # EL8 is used for testing compatibility with cgroup v1.
-  # Do not upgrade this to EL9 (cgroup v2).
-  test-integration-el8:
-    timeout-minutes: 60
-    name: "[flaky, see #3988] EL8 (cgroup v1)"
+  test-integration-host:
+    name: "in-host${{ inputs.hack }}"
+    uses: ./.github/workflows/job-test-in-host.yml
     strategy:
       fail-fast: false
       matrix:
-        mode: ["rootful", "rootless"]
-    runs-on: ubuntu-24.04
-    env:
-      MODE: ${{ matrix.mode }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          fetch-depth: 1
-      - uses: lima-vm/lima-actions/setup@be564a1408f84557d067b099a475652288074b2e  # v1.0.0
-        id: lima-actions-setup
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
-        with:
-          path: ~/.cache/lima
-          key: lima-${{ steps.lima-actions-setup.outputs.version }}
-      - name: "Start the guest VM"
-        run: |
-          set -eux
-          # containerd=none is set because the built-in containerd support conflicts with Docker
-          limactl start \
-            --name=default \
-            --cpus=4 \
-            --memory=12 \
-            --containerd=none \
-            --set '.mounts=null | .portForwards=[{"guestSocket":"/var/run/docker.sock","hostSocket":"{{.Dir}}/sock/docker.sock"}]' \
-            template://almalinux-8
-      # FIXME: the tests should be directly executed in the VM without nesting Docker inside it
-      # https://github.com/containerd/nerdctl/issues/3858
-      - name: "Install dockerd in the guest VM"
-        run: |
-          set -eux
-          lima sudo mkdir -p /etc/systemd/system/docker.socket.d
-          cat <<-EOF | lima sudo tee /etc/systemd/system/docker.socket.d/override.conf
-          [Socket]
-          SocketUser=$(whoami)
-          EOF
-          lima sudo dnf config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
-          lima sudo dnf -q -y install docker-ce --nobest
-          lima sudo systemctl enable --now docker
-      - name: "Configure the host to use dockerd in the guest VM"
-        run: |
-          set -eux
-          sudo systemctl disable --now docker.service docker.socket
-          export DOCKER_HOST="unix://$(limactl ls --format '{{.Dir}}/sock/docker.sock' default)"
-          echo "DOCKER_HOST=${DOCKER_HOST}" >>$GITHUB_ENV
-          docker info
-          docker version
-      - name: "Expose GitHub Runtime variables for gha"
-        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
-      - name: "Prepare integration tests"
-        run: |
-          set -eux
-
-          sudo losetup -Dv
-          sudo losetup -lv
-
-          TARGET=test-integration
-          [ "$MODE" = "rootless" ] && TARGET=test-integration-rootless
-          docker buildx create --name with-gha --use
-          docker buildx build \
-            --output=type=docker \
-            --cache-from type=gha,scope=test-integration-dependencies-amd64 \
-            -t test-integration --target "${TARGET}" \
-            .
+        include:
+          # Test on windows w/o canary
+          - runner: windows-2022
+          - runner: windows-2025
+            canary: true
+          # Test docker on linux
+          - runner: ubuntu-24.04
+            binary: docker
 
-      - name: "Run integration tests"
-        # Presumably, something is broken with the way docker exposes /dev to the container, as it appears to only
-        # randomly work. Mounting /dev does workaround the issue.
-        # This might be due to the old kernel shipped with Alma (4.18), or something else between centos/docker.
-        run: |
-          set -eux
-          if [ "$MODE" = "rootless" ]; then
-            echo "rootless"
-            docker run -t -v /dev:/dev --rm --privileged test-integration /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=false
-          else
-            echo "rootful"
-            docker run -t -v /dev:/dev --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=false
-          fi
-      - name: "Run integration tests (flaky)"
-        run: |
-          set -eux
-          if [ "$MODE" = "rootless" ]; then
-            echo "rootless"
-            docker run -t -v /dev:/dev --rm --privileged test-integration /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=true
-          else
-            echo "rootful"
-            docker run -t -v /dev:/dev --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=true
-          fi
+          # FIXME: running nerdctl on the host is work in progress
+          # (we miss runc to be installed on the host - and obviously other deps)
+          # Plan is to pause this for now and first consolidate dependencies management (wrt Dockerfile vs. host-testing CI)
+          # before we can really start testing linux nerdctl on the host.
+          # - runner: ubuntu-24.04
+          # - runner: ubuntu-24.04
+          #  canary: true
+    with:
+      timeout: 45
+      runner: ${{ matrix.runner }}
+      binary: ${{ matrix.binary != '' && matrix.binary || 'nerdctl' }}
+      canary: ${{ matrix.canary && true || false }}
+      go-version: 1.24
+      windows-cni-version: v0.3.1
+      containerd-version: 2.0.5
+      # Note: these as for amd64
+      containerd-sha: 88ab31f3e78e4d2fa12dcb933032122d11d441c83b79a89c6c8076f871e50df8
+      containerd-service-sha: 12a76c13cad132222d2b3d2025e56212d205d37eca77508dbbfcdf6ababbf70a
+      linux-cni-version: v1.7.1
+      linux-cni-sha: 1a28a0506bfe5bcdc981caf1a49eeab7e72da8321f1119b7be85f22621013098
diff --git a/.github/workflows/tigron.yml b/.github/workflows/workflow-tigron.yml
similarity index 100%
rename from .github/workflows/tigron.yml
rename to .github/workflows/workflow-tigron.yml
diff --git a/hack/provisioning/kube/kind.sh b/hack/provisioning/kube/kind.sh
index 1260758dfa0..d62afcaf905 100755
--- a/hack/provisioning/kube/kind.sh
+++ b/hack/provisioning/kube/kind.sh
@@ -95,7 +95,7 @@ main(){
   local sha
   sha="CNI_PLUGINS_SHA_$(tr "[:lower:]" "[:upper:]" <<<"$GOARCH")"
   # shellcheck source=/dev/null
-  "$root"/../linux/cni.sh "$CNI_PLUGINS_VERSION" "$GOARCH" "${!sha}"
+  "$root"/../linux/cni.sh install "$CNI_PLUGINS_VERSION" "$GOARCH" "${!sha}"
 
   # Hack to get go into kind control plane
   exec::nerdctl rm -f go-kind 2>/dev/null || true
diff --git a/hack/provisioning/linux/cni.sh b/hack/provisioning/linux/cni.sh
index aaee9ad7fe0..b2f6e7c7561 100755
--- a/hack/provisioning/linux/cni.sh
+++ b/hack/provisioning/linux/cni.sh
@@ -30,7 +30,7 @@ provision::cni::uninstall(){
 }
 
 # provision::containerd::cni will retrieve a specific version of cni plugins and extract it in place on the host
-provision::cni(){
+provision::cni::install(){
   local version="$1"
   local arch="$2"
   local bin_sha="$3"
@@ -48,4 +48,6 @@ provision::cni(){
   cd - >/dev/null
 }
 
-provision::cni "$1" "$2" "$3"
\ No newline at end of file
+com="$1"
+shift
+provision::cni::"$com" "$@"
diff --git a/hack/provisioning/linux/containerd.sh b/hack/provisioning/linux/containerd.sh
index f49ef9c9cc0..e0c218ded6e 100755
--- a/hack/provisioning/linux/containerd.sh
+++ b/hack/provisioning/linux/containerd.sh
@@ -32,7 +32,7 @@ provision::containerd::uninstall(){
   # Remove conf
   rm -f /etc/containerd/containerd.toml
   # Remove manually installed containerd if leftover
-  systemctl stop containerd 2>/dev/null
+  systemctl stop containerd 2>/dev/null || true
   rm -f /lib/systemd/system/containerd.service
   systemctl daemon-reload 2>/dev/null || true
   ! command -v containerd || rm -f "$(which containerd)"
@@ -51,12 +51,18 @@ provision::containerd::rootful(){
   cd "$(fs::mktemp "containerd-install")"
 
   # Get the binary and install it
-  http::get::secure \
-    containerd.tar.gz \
-    https://github.com/containerd/containerd/releases/download/v"$version"/containerd-"$version"-linux-"$arch".tar.gz \
-    "$bin_sha"
-
-  sudo tar::expand /usr/local containerd.tar.gz
+  if [ "$bin_sha" == "canary is volatile and I accept the risk" ]; then
+    http::get \
+      containerd.tar.gz \
+      https://github.com/containerd/containerd/releases/download/v"$version"/containerd-"$version"-linux-"$arch".tar.gz
+  else
+    http::get::secure \
+      containerd.tar.gz \
+      https://github.com/containerd/containerd/releases/download/v"$version"/containerd-"$version"-linux-"$arch".tar.gz \
+      "$bin_sha"
+  fi
+
+  sudo tar -C /usr/local -xzf containerd.tar.gz
 
   # Get the systemd unit
   http::get::secure \
@@ -73,4 +79,6 @@ provision::containerd::rootful(){
   cd - >/dev/null || true
 }
 
-provision::containerd::rootful "$1" "$2" "$3" "$4"
\ No newline at end of file
+com="$1"
+shift
+provision::containerd::"$com" "$@"

From 654e58650137bcc1708eb86e5f37b4eb2f7b1417 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 3 May 2025 09:10:08 -0700
Subject: [PATCH 153/225] Fix error output for target not found

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 pkg/testutil/nerdtest/command.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/testutil/nerdtest/command.go b/pkg/testutil/nerdtest/command.go
index cca060500db..e886514933f 100644
--- a/pkg/testutil/nerdtest/command.go
+++ b/pkg/testutil/nerdtest/command.go
@@ -56,7 +56,7 @@ func newNerdCommand(conf test.Config, t *testing.T) *nerdCommand {
 
 	binary, err = exec.LookPath(trgt)
 	if err != nil {
-		t.Fatalf("unable to find binary %q: %v", binary, err)
+		t.Fatalf("unable to find binary %q: %v", trgt, err)
 	}
 
 	if isTargetNerdish() {

From 57d1718fffcc17e2c2ccdb17f2f2c305d02f5de9 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 3 May 2025 09:08:10 -0700
Subject: [PATCH 154/225] GHA: rewrite in container integration workflow

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/job-test-dependencies.yml |  54 ++++
 .github/workflows/job-test-in-container.yml | 175 +++++++++++
 .github/workflows/test-canary.yml           |  47 ---
 .github/workflows/workflow-test.yml         | 304 ++++----------------
 4 files changed, 290 insertions(+), 290 deletions(-)
 create mode 100644 .github/workflows/job-test-dependencies.yml
 create mode 100644 .github/workflows/job-test-in-container.yml
 delete mode 100644 .github/workflows/test-canary.yml

diff --git a/.github/workflows/job-test-dependencies.yml b/.github/workflows/job-test-dependencies.yml
new file mode 100644
index 00000000000..c4457bae1c7
--- /dev/null
+++ b/.github/workflows/job-test-dependencies.yml
@@ -0,0 +1,54 @@
+# This job pre-heats the cache for the test image by building all dependencies
+name: job-test-dependencies
+
+on:
+  workflow_call:
+    inputs:
+      timeout:
+        required: true
+        type: number
+      runner:
+        required: true
+        type: string
+      containerd-version:
+        required: false
+        default: ''
+        type: string
+
+env:
+  GOTOOLCHAIN: local
+
+jobs:
+  # This job builds the dependency target of the test docker image for all supported architectures and cache it in GHA
+  build-dependencies:
+    # Note: for whatever reason, you cannot access env.RUNNER_ARCH here
+    name: "${{ contains(inputs.runner, 'arm') && 'arm64' || 'amd64' }}${{ inputs.containerd-version && format(' | {0}', inputs.containerd-version) || ''}}"
+    timeout-minutes: ${{ inputs.timeout }}
+    runs-on: "${{ inputs.runner }}"
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - name: "Init: checkout"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          fetch-depth: 1
+
+      - name: "Init: expose GitHub Runtime variables for gha"
+        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
+
+      - name: "Run: build dependencies for the integration test environment image"
+        run: |
+          # Cache is sharded per-architecture
+          arch=${{ env.RUNNER_ARCH == 'ARM64' && 'arm64' || 'amd64' }}
+          docker buildx create --name with-gha --use
+          # Honor old containerd if requested
+          args=()
+          if [ "${{ inputs.containerd-version }}" != "" ]; then
+            args=(--build-arg CONTAINERD_VERSION=${{ inputs.containerd-version }})
+          fi
+          docker buildx build \
+            --cache-to type=gha,compression=zstd,mode=max,scope=test-integration-dependencies-"$arch" \
+            --cache-from type=gha,scope=test-integration-dependencies-"$arch" \
+            --target build-dependencies "${args[@]}" .
diff --git a/.github/workflows/job-test-in-container.yml b/.github/workflows/job-test-in-container.yml
new file mode 100644
index 00000000000..aebaf031b28
--- /dev/null
+++ b/.github/workflows/job-test-in-container.yml
@@ -0,0 +1,175 @@
+# This job runs integration tests inside a container, for all supported variants (ipv6, canary, etc)
+# Note that it is linux and nerdctl (+/- gomodjail) only.
+name: job-test-in-container
+
+on:
+  workflow_call:
+    inputs:
+      timeout:
+        required: true
+        type: number
+      runner:
+        required: true
+        type: string
+      canary:
+        required: false
+        default: false
+        type: boolean
+      target:
+        required: false
+        default: ''
+        type: string
+      binary:
+        required: false
+        default: nerdctl
+        type: string
+      containerd-version:
+        required: false
+        default: ''
+        type: string
+      rootlesskit-version:
+        required: false
+        default: ''
+        type: string
+      ipv6:
+        required: false
+        default: false
+        type: boolean
+
+env:
+  GOTOOLCHAIN: local
+
+jobs:
+  test:
+    name: |
+      ${{ inputs.binary != 'nerdctl' && format('{0} < ', inputs.binary) || '' }}
+      ${{ inputs.target }}
+      ${{ contains(inputs.runner, 'arm') && '(arm)' || '' }}
+      ${{ contains(inputs.runner, '22.04') && '(old ubuntu)' || '' }}
+      ${{ inputs.ipv6 && ' (ipv6)' || '' }}
+      ${{ inputs.canary && ' (canary)' || '' }}
+      ${{ inputs.containerd-version && format(' (ctd: {0})', inputs.containerd-version) || '' }}
+      ${{ inputs.rootlesskit-version && format(' (rlk: {0})', inputs.rootlesskit-version) || '' }}
+    timeout-minutes: ${{ inputs.timeout }}
+    runs-on: ${{ inputs.runner }}
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - name: "Init: checkout"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          fetch-depth: 1
+
+      - name: "Init: expose GitHub Runtime variables for gha"
+        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
+
+      - name: "Init: register QEMU (tonistiigi/binfmt)"
+        run: |
+          # `--install all` will only install emulation for architectures that cannot be natively executed
+          # Since some arm64 platforms do provide native fallback execution for 32 bits,
+          # armv7 emulation may or may not be installed, causing variance in the result of `uname -m`.
+          # To avoid that, we explicitly list the architectures we do want emulation for.
+          docker run --privileged --rm tonistiigi/binfmt --install linux/amd64
+          docker run --privileged --rm tonistiigi/binfmt --install linux/arm64
+          docker run --privileged --rm tonistiigi/binfmt --install linux/arm/v7
+      - if: ${{ inputs.canary }}
+        name: "Init (canary): prepare updated test image"
+        run: |
+          . ./hack/build-integration-canary.sh
+          canary::build::integration
+      - if: ${{ ! inputs.canary }}
+        name: "Init: prepare test image"
+        run: |
+          buildargs=()
+          # If the runner is old, use old ubuntu inside the container as well
+          [ "${{ contains(inputs.runner, '22.04') }}" != "true" ] || buildargs=(--build-arg UBUNTU_VERSION=22.04)
+          # Honor if we want old containerd
+          [ "${{ inputs.containerd-version }}" == "" ] || buildargs+=(--build-arg CONTAINERD_VERSION=${{ inputs.containerd-version }})
+          # Honor custom targets and if we want old rootlesskit
+          target=test-integration
+          if [ "${{ inputs.target }}" != "rootful" ]; then
+            target+=-${{ inputs.target }}
+            if [ "${{ inputs.rootlesskit-version }}" != "" ]; then
+              buildargs+=(--build-arg ROOTLESSKIT_VERSION=${{ inputs.rootlesskit-version }})
+            fi
+          fi
+          # Cache is sharded per-architecture
+          arch=${{ env.RUNNER_ARCH == 'ARM64' && 'arm64' || 'amd64' }}
+          docker buildx create --name with-gha --use
+          docker buildx build \
+            --output=type=docker \
+            --cache-from type=gha,scope=test-integration-dependencies-"$arch" \
+            -t "$target" --target "$target" \
+            "${buildargs[@]}" \
+            .
+      # Rootful needs to disable snap
+      - if: ${{ inputs.target == 'rootful' }}
+        name: "Init: remove snap loopback devices (conflicts with our loopback devices in TestRunDevice)"
+        run: |
+          sudo systemctl disable --now snapd.service snapd.socket
+          sudo apt-get purge -qq snapd
+          sudo losetup -Dv
+          sudo losetup -lv
+      # Rootless on modern ubuntu wants apparmor
+      - if: ${{ inputs.target != 'rootful' && ! contains(inputs.runner, '22.04') }}
+        name: "Init: prepare apparmor for rootless + ubuntu 24+"
+        run: |
+          cat <<EOT | sudo tee "/etc/apparmor.d/usr.local.bin.rootlesskit"
+          abi <abi/4.0>,
+          include <tunables/global>
+          /usr/local/bin/rootlesskit flags=(unconfined) {
+            userns,
+            # Site-specific additions and overrides. See local/README for details.
+            include if exists <local/usr.local.bin.rootlesskit>
+          }
+          EOT
+          sudo systemctl restart apparmor.service
+      # ipv6 wants... ipv6
+      - if: ${{ inputs.ipv6 }}
+        name: "Init: ipv6"
+        run: |
+          # Enable ipv4 and ipv6 forwarding
+          sudo sysctl -w net.ipv6.conf.all.forwarding=1
+          sudo sysctl -w net.ipv4.ip_forward=1
+          # Enable IPv6 for Docker, and configure docker to use containerd for gha
+          sudo mkdir -p /etc/docker
+          echo '{"ipv6": true, "fixed-cidr-v6": "2001:db8:1::/64", "experimental": true, "ip6tables": true}' | sudo tee /etc/docker/daemon.json
+          sudo systemctl restart docker
+      # Rootless with old rootlesskit wants to disable buildkit
+      - if: ${{ inputs.target != 'rootful' && inputs.rootlesskit-version != '' }}
+        name: "Init: disable buildkit for old rootlesskit"
+        run: |
+          # https://github.com/containerd/nerdctl/issues/622
+          WORKAROUND_ISSUE_622=
+          if echo "${ROOTLESSKIT_VERSION}" | grep -q v1; then
+            WORKAROUND_ISSUE_622=1
+          fi
+          echo "WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622}" >> "$GITHUB_ENV"
+      - name: "Run: integration tests"
+        run: |
+          # IPV6 note: nested IPv6 network inside docker and qemu is complex and needs a bunch of sysctl config.
+          # Therefore, it's hard to debug why the IPv6 tests fail in such an isolation layer.
+          # On the other side, using the host network is easier at configuration.
+          # Besides, each job is running on a different instance, which means using host network here
+          # is safe and has no side effects on others.
+          [ "${{ inputs.target }}" == "rootful" ] \
+            && args=(test-integration ./hack/test-integration.sh) \
+            || args=(test-integration-${{ inputs.target }} /test-integration-rootless.sh ./hack/test-integration.sh)
+          if [ "${{ inputs.ipv6 }}" == true ]; then
+            docker run --network host -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} "${args[@]}" -test.only-flaky=false -test.only-ipv6 -test.target=${{ inputs.binary }}
+          else
+            docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} "${args[@]}" -test.only-flaky=false -test.target=${{ inputs.binary }}
+          fi
+      # FIXME: this NEEDS to go away
+      - name: "Run: integration tests (flaky)"
+        run: |
+          [ "${{ inputs.target }}" == "rootful" ] \
+            && args=(test-integration ./hack/test-integration.sh) \
+            || args=(test-integration-${{ inputs.target }} /test-integration-rootless.sh ./hack/test-integration.sh)
+          if [ "${{ inputs.ipv6 }}" == true ]; then
+            docker run --network host -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} "${args[@]}" -test.only-flaky=true -test.only-ipv6 -test.target=${{ inputs.binary }}
+          else
+            docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} "${args[@]}" -test.only-flaky=true -test.target=${{ inputs.binary }}
+          fi
diff --git a/.github/workflows/test-canary.yml b/.github/workflows/test-canary.yml
deleted file mode 100644
index b23dc91f63f..00000000000
--- a/.github/workflows/test-canary.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-# This pipeline purpose is solely meant to run a subset of our test suites against upcoming or unreleased dependencies versions
-name: "[flaky, see #3988] canary"
-
-on:
-  push:
-    branches:
-      - main
-      - 'release/**'
-  pull_request:
-    paths-ignore:
-      - '**.md'
-
-env:
-  UBUNTU_VERSION: "24.04"
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-jobs:
-  linux:
-    runs-on: "ubuntu-24.04"
-    timeout-minutes: 40
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          fetch-depth: 1
-      - name: "Prepare integration test environment"
-        run: |
-          . ./hack/build-integration-canary.sh
-          canary::build::integration
-      - name: "Remove snap loopback devices (conflicts with our loopback devices in TestRunDevice)"
-        run: |
-          sudo systemctl disable --now snapd.service snapd.socket
-          sudo apt-get purge -qq snapd
-          sudo losetup -Dv
-          sudo losetup -lv
-      - name: "Register QEMU (tonistiigi/binfmt)"
-        run: |
-          # `--install all` will only install emulation for architectures that cannot be natively executed
-          # Since some arm64 platforms do provide native fallback execution for 32 bits,
-          # armv7 emulation may or may not be installed, causing variance in the result of `uname -m`.
-          # To avoid that, we explicitly list the architectures we do want emulation for.
-          docker run --privileged --rm tonistiigi/binfmt --install linux/amd64
-          docker run --privileged --rm tonistiigi/binfmt --install linux/arm64
-          docker run --privileged --rm tonistiigi/binfmt --install linux/arm/v7
-      - name: "Run integration tests"
-        run: docker run -t --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=false
-      - name: "Run integration tests (flaky)"
-        run: docker run -t --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=true
diff --git a/.github/workflows/workflow-test.yml b/.github/workflows/workflow-test.yml
index 1262c33e6fc..dc5bbd358c5 100644
--- a/.github/workflows/workflow-test.yml
+++ b/.github/workflows/workflow-test.yml
@@ -9,49 +9,9 @@ on:
     paths-ignore:
       - '**.md'
 
-env:
-  GO_VERSION: "1.24"
-  GOTOOLCHAIN: local
-  SHORT_TIMEOUT: 5
-  LONG_TIMEOUT: 60
-
 jobs:
-  # This job builds the dependency target of the test docker image for all supported architectures and cache it in GHA
-  build-dependencies:
-    timeout-minutes: 15
-    name: dependencies |  ${{ matrix.containerd }} | ${{ matrix.arch }}
-    runs-on: "${{ matrix.runner }}"
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: ubuntu-24.04
-            containerd: v1.6.38
-            arch: amd64
-          - runner: ubuntu-24.04
-            containerd: v2.0.5
-            arch: amd64
-          - runner: ubuntu-24.04-arm
-            containerd: v2.0.5
-            arch: arm64
-    env:
-      CONTAINERD_VERSION: "${{ matrix.containerd }}"
-      ARCH: "${{ matrix.arch }}"
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          fetch-depth: 1
-      - name: "Expose GitHub Runtime variables for gha"
-        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
-      - name: "Build dependencies for the integration test environment image"
-        run: |
-          docker buildx create --name with-gha --use
-          docker buildx build \
-            --cache-to type=gha,compression=zstd,mode=max,scope=test-integration-dependencies-${ARCH} \
-            --cache-from type=gha,scope=test-integration-dependencies-${ARCH} \
-            --target build-dependencies --build-arg CONTAINERD_VERSION=${CONTAINERD_VERSION} .
-
   test-unit:
+    # Note: inputs.hack is undefined - its purpose is to prevent GitHub Actions from displaying all matrix variants as part of the name.
     name: "unit${{ inputs.hack }}"
     uses: ./.github/workflows/job-test-unit.yml
     strategy:
@@ -75,223 +35,81 @@ jobs:
       linux-cni-version: v1.7.1
       linux-cni-sha: 1a28a0506bfe5bcdc981caf1a49eeab7e72da8321f1119b7be85f22621013098
 
-  test-integration:
-    needs: build-dependencies
-    timeout-minutes: 40
-    name: rootful | ${{ matrix.containerd }} | ${{ matrix.runner }}
-    runs-on: "${{ matrix.runner }}"
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - ubuntu: 22.04
-            containerd: v1.6.38
-            runner: "ubuntu-22.04"
-            arch: amd64
-          - ubuntu: 24.04
-            containerd: v2.0.5
-            runner: "ubuntu-24.04"
-            arch: amd64
-          - ubuntu: 24.04
-            containerd: v2.0.5
-            runner: "ubuntu-24.04-arm"
-            arch: arm64
-    env:
-      CONTAINERD_VERSION: "${{ matrix.containerd }}"
-      ARCH: "${{ matrix.arch }}"
-      UBUNTU_VERSION: "${{ matrix.ubuntu }}"
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          fetch-depth: 1
-      - name: "Expose GitHub Runtime variables for gha"
-        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
-      - name: "Prepare integration test environment"
-        run: |
-          docker buildx create --name with-gha --use
-          docker buildx build \
-            --output=type=docker \
-            --cache-from type=gha,scope=test-integration-dependencies-${ARCH} \
-            -t test-integration --target test-integration --build-arg UBUNTU_VERSION=${UBUNTU_VERSION} --build-arg CONTAINERD_VERSION=${CONTAINERD_VERSION} .
-      - name: "Remove snap loopback devices (conflicts with our loopback devices in TestRunDevice)"
-        run: |
-          sudo systemctl disable --now snapd.service snapd.socket
-          sudo apt-get purge -qq snapd
-          sudo losetup -Dv
-          sudo losetup -lv
-      - name: "Register QEMU (tonistiigi/binfmt)"
-        run: |
-          # `--install all` will only install emulation for architectures that cannot be natively executed
-          # Since some arm64 platforms do provide native fallback execution for 32 bits,
-          # armv7 emulation may or may not be installed, causing variance in the result of `uname -m`.
-          # To avoid that, we explicitly list the architectures we do want emulation for.
-          docker run --privileged --rm tonistiigi/binfmt --install linux/amd64
-          docker run --privileged --rm tonistiigi/binfmt --install linux/arm64
-          docker run --privileged --rm tonistiigi/binfmt --install linux/arm/v7
-      - name: "Run integration tests"
-        run: docker run -t --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=false
-      - name: "Run integration tests (flaky)"
-        run: docker run -t --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=true
-
-  test-integration-ipv6:
-    needs: build-dependencies
-    timeout-minutes: 15
-    name: ipv6 | ${{ matrix.containerd }} | ${{ matrix.ubuntu }}
-    runs-on: "ubuntu-${{ matrix.ubuntu }}"
+  # This job builds the dependency target of the test-image for all supported architectures and cache it in GHA
+  build-dependencies:
+    name: "dependencies${{ inputs.hack }}"
+    uses: ./.github/workflows/job-test-dependencies.yml
     strategy:
       fail-fast: false
       matrix:
         include:
-          - ubuntu: 24.04
-            containerd: v2.0.5
-            arch: amd64
-    env:
-      CONTAINERD_VERSION: "${{ matrix.containerd }}"
-      ARCH: "${{ matrix.arch }}"
-      UBUNTU_VERSION: "${{ matrix.ubuntu }}"
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          fetch-depth: 1
-      - name: Enable ipv4 and ipv6 forwarding
-        run: |
-          sudo sysctl -w net.ipv6.conf.all.forwarding=1
-          sudo sysctl -w net.ipv4.ip_forward=1
-      - name: "Expose GitHub Runtime variables for gha"
-        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
-      - name: Enable IPv6 for Docker, and configure docker to use containerd for gha
-        run: |
-          sudo mkdir -p /etc/docker
-          echo '{"ipv6": true, "fixed-cidr-v6": "2001:db8:1::/64", "experimental": true, "ip6tables": true}' | sudo tee /etc/docker/daemon.json
-          sudo systemctl restart docker
-      - name: "Prepare integration test environment"
-        run: |
-          docker buildx create --name with-gha --use
-          docker buildx build \
-            --output=type=docker \
-            --cache-from type=gha,scope=test-integration-dependencies-${ARCH} \
-            -t test-integration --target test-integration --build-arg UBUNTU_VERSION=${UBUNTU_VERSION} --build-arg CONTAINERD_VERSION=${CONTAINERD_VERSION} .
-      - name: "Remove snap loopback devices (conflicts with our loopback devices in TestRunDevice)"
-        run: |
-          sudo systemctl disable --now snapd.service snapd.socket
-          sudo apt-get purge -qq snapd
-          sudo losetup -Dv
-          sudo losetup -lv
-      - name: "Register QEMU (tonistiigi/binfmt)"
-        run: |
-          # `--install all` will only install emulation for architectures that cannot be natively executed
-          # Since some arm64 platforms do provide native fallback execution for 32 bits,
-          # armv7 emulation may or may not be installed, causing variance in the result of `uname -m`.
-          # To avoid that, we explicitly list the architectures we do want emulation for.
-          docker run --privileged --rm tonistiigi/binfmt --install linux/amd64
-          docker run --privileged --rm tonistiigi/binfmt --install linux/arm64
-          docker run --privileged --rm tonistiigi/binfmt --install linux/arm/v7
-      - name: "Run integration tests"
-        # The nested IPv6 network inside docker and qemu is complex and needs a bunch of sysctl config.
-        # Therefore, it's hard to debug why the IPv6 tests fail in such an isolation layer.
-        # On the other side, using the host network is easier at configuration.
-        # Besides, each job is running on a different instance, which means using host network here
-        # is safe and has no side effects on others.
-        run: docker run --network host -t --rm --privileged test-integration ./hack/test-integration.sh -test.only-ipv6
+          # Build for arm & amd, current containerd
+          - runner: ubuntu-24.04
+          - runner: ubuntu-24.04-arm
+          # Additionally build for old containerd on amd
+          - runner: ubuntu-24.04
+            containerd-version: v1.6.38
+    with:
+      runner: ${{ matrix.runner }}
+      containerd-version: ${{ matrix.containerd-version }}
+      timeout: 20
 
-  test-integration-rootless:
+  test-integration-container:
+    name: "in-container${{ inputs.hack }}"
+    uses: ./.github/workflows/job-test-in-container.yml
     needs: build-dependencies
-    timeout-minutes: 40
-    name: "${{ matrix.target }} | ${{ matrix.containerd }} | ${{ matrix.rootlesskit }} | ${{ matrix.ubuntu }} || ${{ matrix.nerdctl }}"
-    runs-on: "${{ matrix.runner }}"
     strategy:
       fail-fast: false
       matrix:
         include:
-          - ubuntu: 22.04
-            containerd: v1.6.38
-            rootlesskit: v1.1.1  # Deprecated
-            target: rootless
-            runner: "ubuntu-22.04"
-            arch: amd64
-          - ubuntu: 24.04
-            containerd: v2.0.5
-            rootlesskit: v2.3.4
+          ###### Rootless
+          # amd64
+          - runner: ubuntu-24.04
             target: rootless
-            arch: amd64
-            runner: "ubuntu-24.04"
-          - ubuntu: 24.04
-            containerd: v2.0.5
-            rootlesskit: v2.3.4
+          # arm64
+          - runner: ubuntu-24.04-arm
             target: rootless
-            arch: arm64
-            runner: "ubuntu-24.04-arm"
-          - ubuntu: 24.04
-            containerd: v2.0.5
-            rootlesskit: v2.3.4
+          # port-slirp4netns
+          - runner: ubuntu-24.04
             target: rootless-port-slirp4netns
-            arch: amd64
-            runner: "ubuntu-24.04"
-          - ubuntu: 24.04
-            containerd: v2.0.5
-            rootlesskit: v2.3.4
+          # old containerd + old ubuntu + old rootlesskit
+          - runner: ubuntu-22.04
             target: rootless
-            arch: amd64
-            runner: "ubuntu-24.04"
-            nerdctl: "nerdctl.gomodjail"
-            comment: "Flaky, not a blocker for merging PRs"
-    env:
-      CONTAINERD_VERSION: "${{ matrix.containerd }}"
-      ARCH: "${{ matrix.arch }}"
-      UBUNTU_VERSION: "${{ matrix.ubuntu }}"
-      ROOTLESSKIT_VERSION: "${{ matrix.rootlesskit }}"
-      TEST_TARGET: "test-integration-${{ matrix.target }}"
-      NERDCTL: "${{ matrix.nerdctl }}"
-    steps:
-      - name: "Set up AppArmor"
-        if: matrix.ubuntu == '24.04'
-        run: |
-          cat <<EOT | sudo tee "/etc/apparmor.d/usr.local.bin.rootlesskit"
-          abi <abi/4.0>,
-          include <tunables/global>
-
-          /usr/local/bin/rootlesskit flags=(unconfined) {
-            userns,
+            containerd-version: v1.6.38
+            rootlesskit-version: v1.1.1
+          # gomodjail
+          - runner: ubuntu-24.04
+            target: rootless
+            binary: "nerdctl.gomodjail"
+          ###### Rootful
+          # amd64
+          - runner: ubuntu-24.04
+            target: rootful
+          # arm64
+          - runner: ubuntu-24.04-arm
+            target: rootful
+          # old containerd + old ubuntu
+          - runner: ubuntu-22.04
+            target: rootful
+            containerd-version: v1.6.38
+          # ipv6
+          - runner: ubuntu-24.04
+            target: rootful
+            ipv6: true
+          # all canary
+          - runner: ubuntu-24.04
+            target: rootful
+            canary: true
 
-            # Site-specific additions and overrides. See local/README for details.
-            include if exists <local/usr.local.bin.rootlesskit>
-          }
-          EOT
-          sudo systemctl restart apparmor.service
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
-        with:
-          fetch-depth: 1
-      - name: "Register QEMU (tonistiigi/binfmt)"
-        run: |
-          # `--install all` will only install emulation for architectures that cannot be natively executed
-          # Since some arm64 platforms do provide native fallback execution for 32 bits,
-          # armv7 emulation may or may not be installed, causing variance in the result of `uname -m`.
-          # To avoid that, we explicitly list the architectures we do want emulation for.
-          docker run --privileged --rm tonistiigi/binfmt --install linux/amd64
-          docker run --privileged --rm tonistiigi/binfmt --install linux/arm64
-          docker run --privileged --rm tonistiigi/binfmt --install linux/arm/v7
-      - name: "Expose GitHub Runtime variables for gha"
-        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
-      - name: "Prepare (network driver=slirp4netns, port driver=builtin)"
-        run: |
-          docker buildx create --name with-gha --use
-          docker buildx build \
-            --output=type=docker \
-            --cache-from type=gha,scope=test-integration-dependencies-${ARCH} \
-            -t ${TEST_TARGET} --target ${TEST_TARGET} --build-arg UBUNTU_VERSION=${UBUNTU_VERSION} --build-arg CONTAINERD_VERSION=${CONTAINERD_VERSION} --build-arg ROOTLESSKIT_VERSION=${ROOTLESSKIT_VERSION} .
-      - name: "Disable BuildKit for RootlessKit v1 (workaround for issue #622)"
-        run: |
-          # https://github.com/containerd/nerdctl/issues/622
-          WORKAROUND_ISSUE_622=
-          if echo "${ROOTLESSKIT_VERSION}" | grep -q v1; then
-            WORKAROUND_ISSUE_622=1
-          fi
-          echo "WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622}" >> "$GITHUB_ENV"
-      - name: "Test (network driver=slirp4netns, port driver=builtin)"
-        run: docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} ${TEST_TARGET} /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=false -test.target=${NERDCTL}
-      - name: "Test (network driver=slirp4netns, port driver=builtin) (flaky)"
-        if: matrix.nerdctl != 'nerdctl.gomodjail'
-        run: docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} ${TEST_TARGET} /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=true -test.target=${NERDCTL}
+    with:
+      timeout: 45
+      runner: ${{ matrix.runner }}
+      target: ${{ matrix.target }}
+      binary: ${{ matrix.binary && matrix.binary || 'nerdctl' }}
+      containerd-version: ${{ matrix.containerd-version }}
+      rootlesskit-version: ${{ matrix.rootlesskit-version }}
+      ipv6: ${{ matrix.ipv6 && true || false }}
+      canary: ${{ matrix.canary && true || false }}
 
   test-integration-host:
     name: "in-host${{ inputs.hack }}"

From 4c4feeb36000e2d6cee3c889292007b58f96134b Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 2 May 2025 19:23:27 -0700
Subject: [PATCH 155/225] Adding summaries for CI workflows

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/job-build.yml             |  47 ++++++--
 .github/workflows/job-test-in-container.yml |  16 ++-
 .github/workflows/job-test-in-host.yml      |  11 ++
 Dockerfile                                  |   2 +
 hack/github/action-helpers.sh               | 119 ++++++++++++++++++++
 hack/github/gotestsum-reporter.sh           |  44 ++++++++
 hack/test-integration.sh                    |   6 +-
 7 files changed, 228 insertions(+), 17 deletions(-)
 create mode 100755 hack/github/action-helpers.sh
 create mode 100755 hack/github/gotestsum-reporter.sh

diff --git a/.github/workflows/job-build.yml b/.github/workflows/job-build.yml
index edaa1df20b7..2567161442b 100644
--- a/.github/workflows/job-build.yml
+++ b/.github/workflows/job-build.yml
@@ -42,10 +42,11 @@ jobs:
       - if: ${{ inputs.canary }}
         name: "Init (canary): retrieve GO_VERSION"
         run: |
+          . ./hack/github/action-helpers.sh
           latest_go="$(. ./hack/provisioning/version/fetch.sh; go::canary::for::go-setup)"
           printf "GO_VERSION=%s\n" "$latest_go" >> "$GITHUB_ENV"
           [ "$latest_go" != "" ] || \
-            echo "::warning title=No canary go::There is currently no canary go version to test. Steps will not run."
+            github::log::warning "No canary go" "There is currently no canary go version to test. Steps will not run."
 
       - if: ${{ env.GO_VERSION != '' }}
         name: "Init: install go"
@@ -57,13 +58,41 @@ jobs:
       - if: ${{ env.GO_VERSION != '' }}
         name: "Run: make binaries"
         run: |
+          . ./hack/github/action-helpers.sh
+
+          github::md::table::header "OS" "Arch" "Result" "Time" >> $GITHUB_STEP_SUMMARY
+
+          failure=
+
+          build(){
+            local goos="$1"
+            local goarch="${2:-amd64}"
+            local goarm="${3:-}"
+            local result
+
+            github::timer::begin
+
+            GOOS="$goos" GOARCH="$goarch" GOARM="$goarm" make binaries \
+              && result="$decorator_success" \
+              || {
+                failure=true
+                result="$decorator_failure"
+              }
+
+            [ ! "$goarm" ] || goarch="$goarch/v$goarm"
+            github::md::table::line "$goos" "$goarch" "$result" "$(github::timer::format <(github::timer::tick))" >> $GITHUB_STEP_SUMMARY
+          }
+
           # We officially support these
-          GOOS=linux make binaries
-          GOOS=windows make binaries
-          GOOS=freebsd make binaries
-          GOOS=darwin make binaries
-          GOARCH=arm GOARM=6 make binaries
+          build linux
+          build linux arm64
+          build windows
+          build freebsd
+          build darwin
+          build linux arm 6
           # These architectures are not released, but we still verify that we can at least compile
-          GOARCH=ppc64le make binaries
-          GOARCH=riscv64 make binaries
-          GOARCH=s390x make binaries
+          build linux ppc64le
+          build linux riscv64
+          build linux s390x
+
+          [ ! "$failure" ] || exit 1
diff --git a/.github/workflows/job-test-in-container.yml b/.github/workflows/job-test-in-container.yml
index aebaf031b28..354d3bb36cd 100644
--- a/.github/workflows/job-test-in-container.yml
+++ b/.github/workflows/job-test-in-container.yml
@@ -146,9 +146,12 @@ jobs:
           if echo "${ROOTLESSKIT_VERSION}" | grep -q v1; then
             WORKAROUND_ISSUE_622=1
           fi
-          echo "WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622}" >> "$GITHUB_ENV"
+          echo "WORKAROUND_ISSUE_622=$WORKAROUND_ISSUE_622" >> "$GITHUB_ENV"
       - name: "Run: integration tests"
         run: |
+          . ./hack/github/action-helpers.sh
+          github::md::h2 "non-flaky" >> "$GITHUB_STEP_SUMMARY"
+
           # IPV6 note: nested IPv6 network inside docker and qemu is complex and needs a bunch of sysctl config.
           # Therefore, it's hard to debug why the IPv6 tests fail in such an isolation layer.
           # On the other side, using the host network is easier at configuration.
@@ -158,18 +161,21 @@ jobs:
             && args=(test-integration ./hack/test-integration.sh) \
             || args=(test-integration-${{ inputs.target }} /test-integration-rootless.sh ./hack/test-integration.sh)
           if [ "${{ inputs.ipv6 }}" == true ]; then
-            docker run --network host -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} "${args[@]}" -test.only-flaky=false -test.only-ipv6 -test.target=${{ inputs.binary }}
+            docker run --network host -t --rm --privileged -e GITHUB_STEP_SUMMARY="$GITHUB_STEP_SUMMARY" -v "$GITHUB_STEP_SUMMARY":"$GITHUB_STEP_SUMMARY" -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622:-} "${args[@]}" -test.only-flaky=false -test.only-ipv6 -test.target=${{ inputs.binary }}
           else
-            docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} "${args[@]}" -test.only-flaky=false -test.target=${{ inputs.binary }}
+            docker run -t --rm --privileged -e GITHUB_STEP_SUMMARY="$GITHUB_STEP_SUMMARY" -v "$GITHUB_STEP_SUMMARY":"$GITHUB_STEP_SUMMARY" -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622:-} "${args[@]}" -test.only-flaky=false -test.target=${{ inputs.binary }}
           fi
       # FIXME: this NEEDS to go away
       - name: "Run: integration tests (flaky)"
         run: |
+          . ./hack/github/action-helpers.sh
+          github::md::h2 "flaky" >> "$GITHUB_STEP_SUMMARY"
+
           [ "${{ inputs.target }}" == "rootful" ] \
             && args=(test-integration ./hack/test-integration.sh) \
             || args=(test-integration-${{ inputs.target }} /test-integration-rootless.sh ./hack/test-integration.sh)
           if [ "${{ inputs.ipv6 }}" == true ]; then
-            docker run --network host -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} "${args[@]}" -test.only-flaky=true -test.only-ipv6 -test.target=${{ inputs.binary }}
+            docker run --network host -t --rm --privileged -e GITHUB_STEP_SUMMARY="$GITHUB_STEP_SUMMARY" -v "$GITHUB_STEP_SUMMARY":"$GITHUB_STEP_SUMMARY" -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622:-} "${args[@]}" -test.only-flaky=true -test.only-ipv6 -test.target=${{ inputs.binary }}
           else
-            docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} "${args[@]}" -test.only-flaky=true -test.target=${{ inputs.binary }}
+            docker run -t --rm --privileged -e GITHUB_STEP_SUMMARY="$GITHUB_STEP_SUMMARY" -v "$GITHUB_STEP_SUMMARY":"$GITHUB_STEP_SUMMARY" -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622:-} "${args[@]}" -test.only-flaky=true -test.target=${{ inputs.binary }}
           fi
diff --git a/.github/workflows/job-test-in-host.yml b/.github/workflows/job-test-in-host.yml
index 324fe3e911e..6262aa0ac33 100644
--- a/.github/workflows/job-test-in-host.yml
+++ b/.github/workflows/job-test-in-host.yml
@@ -156,6 +156,8 @@ jobs:
           go install ./cmd/nerdctl
           echo "::endgroup::"
 
+          choco install jq
+
       - if: ${{ env.SHOULD_RUN == 'yes' }}
         name: "Init: install dev tools"
         run: |
@@ -167,15 +169,24 @@ jobs:
       - if: ${{ contains(inputs.runner, 'ubuntu') && env.SHOULD_RUN == 'yes' }}
         name: "Run (linux): integration tests (IPv6)"
         run: |
+          . ./hack/github/action-helpers.sh
+          github::md::h2 "ipv6" >> "$GITHUB_STEP_SUMMARY"
+
           ./hack/test-integration.sh -test.target=${{ inputs.binary }} -test.only-ipv6
 
       - if: ${{ env.SHOULD_RUN == 'yes' }}
         name: "Run: integration tests"
         run: |
+          . ./hack/github/action-helpers.sh
+          github::md::h2 "non-flaky" >> "$GITHUB_STEP_SUMMARY"
+
           ./hack/test-integration.sh -test.target=${{ inputs.binary }} -test.only-flaky=false
 
       # FIXME: this must go
       - if: ${{ env.SHOULD_RUN == 'yes' }}
         name: "Run: integration tests (flaky)"
         run: |
+          . ./hack/github/action-helpers.sh
+          github::md::h2 "flaky" >> "$GITHUB_STEP_SUMMARY"
+
           ./hack/test-integration.sh -test.target=${{ inputs.binary }} -test.only-flaky=true
diff --git a/Dockerfile b/Dockerfile
index a7f60057f8e..e4d0fd15551 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -295,8 +295,10 @@ CMD ["bash", "--login", "-i"]
 FROM base AS test-integration
 ARG DEBIAN_FRONTEND=noninteractive
 # `expect` package contains `unbuffer(1)`, which is used for emulating TTY for testing
+# `jq` is required to generate test summaries
 RUN apt-get update -qq && apt-get install -qq --no-install-recommends \
   expect \
+  jq \
   git \
   make
 # We wouldn't need this if Docker Hub could have "golang:${GO_VERSION}-ubuntu"
diff --git a/hack/github/action-helpers.sh b/hack/github/action-helpers.sh
new file mode 100755
index 00000000000..62244ee6fbc
--- /dev/null
+++ b/hack/github/action-helpers.sh
@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+# shellcheck disable=SC2034
+set -o errexit -o errtrace -o functrace -o nounset -o pipefail
+
+readonly decorator_success="✅"
+readonly decorator_failure="❌"
+
+github::md::h1(){
+  printf "# %s\n" "$1"
+}
+
+github::md::h2(){
+  printf "## %s\n" "$1"
+}
+
+github::md::h3(){
+  printf "### %s\n" "$1"
+}
+
+github::md::bq(){
+  local x
+  for x in "$@"; do
+    printf "> %s\n" "$1"
+  done
+}
+
+github::md::table::header(){
+  printf "|"
+  for x in "$@"; do
+    printf " %s |" "$x"
+  done
+  printf "\n"
+  printf "|"
+  for x in "$@"; do
+    printf "%s|" "---"
+  done
+  printf "\n"
+}
+
+github::md::table::line(){
+  printf "|"
+  for x in "$@"; do
+    printf " %s |" "$x"
+  done
+  printf "\n"
+}
+
+github::md::pie(){
+  local title="$1"
+  local label
+  local value
+  shift
+
+  printf '```mermaid\npie\n    title %s\n' "$title"
+  while [ "$#" -gt 0 ]; do
+    label="$1"
+    value="$2"
+    shift
+    shift
+    printf '    "%s" : %s\n' "$label" "$value"
+  done
+  printf '```\n\n'
+
+}
+
+github::log::group(){
+  echo "::group::$*"
+}
+
+github::log::endgroup(){
+  echo "::endgroup::"
+}
+
+github::log::warning(){
+  local title="$1"
+  local msg="$2"
+
+  echo "::warning title=$title::$msg"
+}
+
+_begin=${_begin:-}
+_duration=
+github::timer::begin(){
+  _begin="$(date +%s)"
+}
+
+github::timer::tick(){
+  local tick
+
+  tick="$(date +%s)"
+  printf "%s" "$((tick - _begin))"
+}
+
+github::timer::format() {
+  local t
+  t="$(cat "$1")"
+  local h=$((t/60/60%24))
+  local m=$((t/60%60))
+  local s=$((t%60))
+
+  [[ "$h" == 0 ]] || printf "%d hours " "$h"
+  [[ "$m" == 0 ]] || printf "%d minutes " "$m"
+  printf '%d seconds' "$s"
+}
diff --git a/hack/github/gotestsum-reporter.sh b/hack/github/gotestsum-reporter.sh
new file mode 100755
index 00000000000..872fc25f03d
--- /dev/null
+++ b/hack/github/gotestsum-reporter.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+# shellcheck disable=SC2034,SC2015
+set -o errexit -o errtrace -o functrace -o nounset -o pipefail
+root="$(cd "$(dirname "${BASH_SOURCE[0]:-$PWD}")" 2>/dev/null 1>&2 && pwd)"
+readonly root
+
+# shellcheck source=/dev/null
+. "$root"/action-helpers.sh
+
+GITHUB_STEP_SUMMARY="${GITHUB_STEP_SUMMARY:-/dev/null}"
+
+{
+  github::md::h3 "Total number of tests: $TESTS_TOTAL"
+  github::md::pie "Status" "Skipped" "$TESTS_SKIPPED" "Failed" "$TESTS_FAILED" "Passed" "$(( TESTS_TOTAL - TESTS_FAILED - TESTS_SKIPPED ))"
+
+  # shellcheck disable=SC2207
+  pie=($(jq -rc 'select(has("Test") | not) | select(.Elapsed) | select(.Elapsed > 0) | "\(.Package) \(.Elapsed) "' < "$GOTESTSUM_JSONFILE"))
+  github::md::pie "Time spent per package" "${pie[@]}"
+
+  github::md::h3 "Failing tests"
+  echo '```'
+  jq -rc 'select(.Action == "fail") | select(.Test) | .Test' < "$GOTESTSUM_JSONFILE"
+  echo '```'
+
+  github::md::h3 "Tests taking more than 15 seconds"
+  echo '```'
+  gotestsum tool slowest --threshold 15s --jsonfile "$GOTESTSUM_JSONFILE"
+  echo '```'
+} >> "$GITHUB_STEP_SUMMARY"
diff --git a/hack/test-integration.sh b/hack/test-integration.sh
index 7834216b463..3d1a21365a5 100755
--- a/hack/test-integration.sh
+++ b/hack/test-integration.sh
@@ -32,6 +32,9 @@ readonly needsudo="${WITH_SUDO:-}"
 
 # See https://github.com/containerd/nerdctl/blob/main/docs/testing/README.md#about-parallelization
 args=(--format=testname --jsonfile /tmp/test-integration.log --packages="$root"/../cmd/nerdctl/...)
+# FIXME: not working on windows. Need to change approach: move away from --post-run-command and
+# just process the log file. This might also allow multi-steps/multi-target results aggregation.
+[ "$(uname -s)" != "Linux" ] || args+=(--post-run-command "$root"/github/gotestsum-reporter.sh)
 
 if [ "$#" == 0 ]; then
   "$root"/test-integration.sh -test.only-flaky=false
@@ -51,6 +54,3 @@ if [ "$needsudo" == "true" ] || [ "$needsudo" == "yes" ] || [ "$needsudo" == "1"
 else
   gotestsum "${args[@]}" -- -timeout="$timeout" -p 1 -args -test.allow-kill-daemon "$@"
 fi
-
-echo "These are the tests that took more than 10 seconds:"
-gotestsum tool slowest --threshold 10s --jsonfile /tmp/test-integration.log

From 16e231057e4eb4b76f4d222eaf998d4bd2237168 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sun, 4 May 2025 17:26:31 -0700
Subject: [PATCH 156/225] Bump up timeout for lint-build

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/workflow-lint.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml
index 5462b8e5d86..c6d6f6a4e7a 100644
--- a/.github/workflows/workflow-lint.yml
+++ b/.github/workflows/workflow-lint.yml
@@ -74,7 +74,7 @@ jobs:
           - go-version: "1.24"
             canary: true
     with:
-      timeout: 5
+      timeout: 10
       go-version: ${{ matrix.go-version }}
       runner: ubuntu-24.04
       canary: ${{ matrix.canary && true || false }}

From 742f6f107031bbee26db547308efcae7a23dfa3a Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sun, 4 May 2025 18:56:55 -0700
Subject: [PATCH 157/225] Gomodjail: unconfine fsnotify and cdi

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 go.mod | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/go.mod b/go.mod
index 06d0a7166fa..46ab0623116 100644
--- a/go.mod
+++ b/go.mod
@@ -39,7 +39,7 @@ require (
 	github.com/fahedouch/go-logrotate v0.3.0 //gomodjail:unconfined
 	github.com/fatih/color v1.18.0 //gomodjail:unconfined
 	github.com/fluent/fluent-logger-golang v1.9.0
-	github.com/fsnotify/fsnotify v1.9.0
+	github.com/fsnotify/fsnotify v1.9.0 //gomodjail:unconfined
 	github.com/go-viper/mapstructure/v2 v2.2.1
 	github.com/ipfs/go-cid v0.5.0
 	github.com/klauspost/compress v1.18.0
@@ -69,7 +69,7 @@ require (
 	golang.org/x/text v0.24.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
-	tags.cncf.io/container-device-interface v1.0.1
+	tags.cncf.io/container-device-interface v1.0.1 //gomodjail:unconfined
 )
 
 require (

From bb85aae4a43a0106448287e4b938fa2d896c59a5 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Mon, 5 May 2025 12:33:23 -0700
Subject: [PATCH 158/225] Add darwin to Makefile

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 Makefile | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/Makefile b/Makefile
index d7dce5f0fd3..85af13483b7 100644
--- a/Makefile
+++ b/Makefile
@@ -136,7 +136,8 @@ lint-go-all:
 	@cd $(MAKEFILE_DIR) \
 		&& GOOS=linux make lint-go \
 		&& GOOS=windows make lint-go \
-		&& GOOS=freebsd make lint-go
+		&& GOOS=freebsd make lint-go \
+		&& GOOS=darwin make lint-go
 	$(call footer, $@)
 
 lint-yaml:
@@ -179,8 +180,9 @@ lint-licenses-all:
 	$(call title, $@)
 	@cd $(MAKEFILE_DIR) \
 		&& GOOS=linux make lint-licenses \
+		&& GOOS=windows make lint-licenses \
 		&& GOOS=freebsd make lint-licenses \
-		&& GOOS=windows make lint-licenses
+		&& GOOS=darwin make lint-go
 	$(call footer, $@)
 
 ##########################
@@ -196,8 +198,9 @@ fix-go-all:
 	$(call title, $@)
 	@cd $(MAKEFILE_DIR) \
 		&& GOOS=linux make fix-go \
+		&& GOOS=windows make fix-go \
 		&& GOOS=freebsd make fix-go \
-		&& GOOS=windows make fix-go
+		&& GOOS=darwin make lint-go
 	$(call footer, $@)
 
 fix-mod:

From e64dc6b4942187ecadf93d34037a79b3df3aecf8 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Mon, 5 May 2025 12:38:14 -0700
Subject: [PATCH 159/225] More defensive makefile

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 85af13483b7..3544c484612 100644
--- a/Makefile
+++ b/Makefile
@@ -39,9 +39,9 @@ DOCDIR  ?= $(DATADIR)/doc
 
 BINARY ?= "nerdctl"
 MAKEFILE_DIR := $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST)))))
-VERSION ?= $(shell git -C $(MAKEFILE_DIR) describe --match 'v[0-9]*' --dirty='.m' --always --tags)
+VERSION ?= $(shell git -C $(MAKEFILE_DIR) describe --match 'v[0-9]*' --dirty='.m' --always --tags 2>/dev/null || echo no_git_information)
 VERSION_TRIMMED := $(VERSION:v%=%)
-REVISION ?= $(shell git -C $(MAKEFILE_DIR) rev-parse HEAD)$(shell if ! git -C $(MAKEFILE_DIR) diff --no-ext-diff --quiet --exit-code; then echo .m; fi)
+REVISION ?= $(shell git -C $(MAKEFILE_DIR) rev-parse HEAD 2>/dev/null || echo no_git_information)$(shell if ! git -C $(MAKEFILE_DIR) diff --no-ext-diff --quiet --exit-code 2>/dev/null; then echo .m; fi)
 LINT_COMMIT_RANGE ?= main..HEAD
 GO_BUILD_LDFLAGS ?= -s -w
 GO_BUILD_FLAGS ?=

From c30a057ef13eb9eec5fc00d6ff2f397c9d22c3aa Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 5 May 2025 23:40:23 +0000
Subject: [PATCH 160/225] build(deps): bump the golang-x group with 6 updates

Bumps the golang-x group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.37.0` | `0.38.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.39.0` | `0.40.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.13.0` | `0.14.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.32.0` | `0.33.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.31.0` | `0.32.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.24.0` | `0.25.0` |


Updates `golang.org/x/crypto` from 0.37.0 to 0.38.0
- [Commits](https://github.com/golang/crypto/compare/v0.37.0...v0.38.0)

Updates `golang.org/x/net` from 0.39.0 to 0.40.0
- [Commits](https://github.com/golang/net/compare/v0.39.0...v0.40.0)

Updates `golang.org/x/sync` from 0.13.0 to 0.14.0
- [Commits](https://github.com/golang/sync/compare/v0.13.0...v0.14.0)

Updates `golang.org/x/sys` from 0.32.0 to 0.33.0
- [Commits](https://github.com/golang/sys/compare/v0.32.0...v0.33.0)

Updates `golang.org/x/term` from 0.31.0 to 0.32.0
- [Commits](https://github.com/golang/term/compare/v0.31.0...v0.32.0)

Updates `golang.org/x/text` from 0.24.0 to 0.25.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](https://github.com/golang/text/compare/v0.24.0...v0.25.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
- dependency-name: golang.org/x/net
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
- dependency-name: golang.org/x/sync
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
- dependency-name: golang.org/x/sys
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
- dependency-name: golang.org/x/term
  dependency-version: 0.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
- dependency-name: golang.org/x/text
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 12 ++++++------
 go.sum | 24 ++++++++++++------------
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/go.mod b/go.mod
index 46ab0623116..53d192441cc 100644
--- a/go.mod
+++ b/go.mod
@@ -61,12 +61,12 @@ require (
 	github.com/vishvananda/netns v0.0.5 //gomodjail:unconfined
 	github.com/yuchanns/srslog v1.1.0
 	go.uber.org/mock v0.5.2
-	golang.org/x/crypto v0.37.0
-	golang.org/x/net v0.39.0
-	golang.org/x/sync v0.13.0 //gomodjail:unconfined
-	golang.org/x/sys v0.32.0 //gomodjail:unconfined
-	golang.org/x/term v0.31.0 //gomodjail:unconfined
-	golang.org/x/text v0.24.0
+	golang.org/x/crypto v0.38.0
+	golang.org/x/net v0.40.0
+	golang.org/x/sync v0.14.0 //gomodjail:unconfined
+	golang.org/x/sys v0.33.0 //gomodjail:unconfined
+	golang.org/x/term v0.32.0 //gomodjail:unconfined
+	golang.org/x/text v0.25.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
 	tags.cncf.io/container-device-interface v1.0.1 //gomodjail:unconfined
diff --git a/go.sum b/go.sum
index ca01e27ae9d..000a60e9682 100644
--- a/go.sum
+++ b/go.sum
@@ -360,8 +360,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.30.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
-golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
+golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
+golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f h1:XdNn9LlyWAhLVp6P/i8QYBW+hlyhrhei9uErw2B5GJo=
 golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f/go.mod h1:D5SMRVC3C2/4+F/DB1wZsLRnSNimn2Sp/NPsCrsv8ak=
@@ -393,8 +393,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
-golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
+golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
+golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -407,8 +407,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
-golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
+golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -433,8 +433,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
-golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -444,8 +444,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
-golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
+golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
+golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
@@ -455,8 +455,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
-golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
+golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
+golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=

From 4039cfef3a010bbfab3b2e0f8f989a06b947c6c4 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Tue, 6 May 2025 09:10:35 -0700
Subject: [PATCH 161/225] Workaround gomodjail concurrency issue

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 hack/test-integration.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hack/test-integration.sh b/hack/test-integration.sh
index 3d1a21365a5..8968b139e1d 100755
--- a/hack/test-integration.sh
+++ b/hack/test-integration.sh
@@ -26,6 +26,13 @@ if [[ "$(id -u)" = "0" ]]; then
   fi
 fi
 
+# This is a temporary workaround for https://github.com/AkihiroSuda/gomodjail/issues/50
+# FIXME: remove this once above has been fixed.
+if command -v nerdctl.gomodjail >/dev/null 2>&1; then
+  # We do not care that it fails or succeeds - just need gomodjail to unpack once.
+  nerdctl.gomodjail info >/dev/null 2>&1 || true
+fi
+
 readonly timeout="60m"
 readonly retries="2"
 readonly needsudo="${WITH_SUDO:-}"

From 65f4412ea5058de79856d59d21fbe94b042f6f16 Mon Sep 17 00:00:00 2001
From: Shubharanshu Mahapatra <shubhum@amazon.com>
Date: Mon, 5 May 2025 16:11:04 -0700
Subject: [PATCH 162/225] fix: test nerdctl ps filter created.

Signed-off-by: Shubharanshu Mahapatra <shubhum@amazon.com>
---
 .../container/container_create_test.go        | 18 +++-------
 .../container/container_list_linux_test.go    | 34 +++++++++++++++++++
 .../system/system_events_linux_test.go        |  1 +
 pkg/cmd/container/list_util.go                |  6 ++++
 4 files changed, 46 insertions(+), 13 deletions(-)

diff --git a/cmd/nerdctl/container/container_create_test.go b/cmd/nerdctl/container/container_create_test.go
index f10536eecce..07a14a3136c 100644
--- a/cmd/nerdctl/container/container_create_test.go
+++ b/cmd/nerdctl/container/container_create_test.go
@@ -18,6 +18,7 @@ package container
 
 import (
 	"encoding/json"
+	"fmt"
 	"testing"
 	"time"
 
@@ -41,29 +42,20 @@ func TestCreate(t *testing.T) {
 		helpers.Anyhow("rm", "-f", data.Identifier("container"))
 	}
 
-	testCase.Require = nerdtest.IsFlaky("https://github.com/containerd/nerdctl/issues/3717")
-
 	testCase.SubTests = []*test.Case{
 		{
 			Description: "ps -a",
 			NoParallel:  true,
-			Command:     test.Command("ps", "-a"),
-			// FIXME: this might get a false positive if other tests have created a container
-			Expected: test.Expects(0, nil, expect.Contains("Created")),
-		},
-		{
-			Description: "start",
-			NoParallel:  true,
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("start", data.Labels().Get("cID"))
+				return helpers.Command("ps", "-a", "--filter", "status=created", "--filter", fmt.Sprintf("name=%s", data.Labels().Get("cID")))
 			},
-			Expected: test.Expects(0, nil, nil),
+			Expected: test.Expects(0, nil, expect.Contains("Created")),
 		},
 		{
-			Description: "logs",
+			Description: "start",
 			NoParallel:  true,
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("logs", data.Labels().Get("cID"))
+				return helpers.Command("start", "-a", data.Labels().Get("cID"))
 			},
 			Expected: test.Expects(0, nil, expect.Contains("foo")),
 		},
diff --git a/cmd/nerdctl/container/container_list_linux_test.go b/cmd/nerdctl/container/container_list_linux_test.go
index 99f79d140b5..e7ce1c92e11 100644
--- a/cmd/nerdctl/container/container_list_linux_test.go
+++ b/cmd/nerdctl/container/container_list_linux_test.go
@@ -26,6 +26,8 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/formatter"
 	"github.com/containerd/nerdctl/v2/pkg/strutil"
 	"github.com/containerd/nerdctl/v2/pkg/tabutil"
@@ -628,3 +630,35 @@ func TestContainerListCheckCreatedTime(t *testing.T) {
 		t.Errorf("expected containers in decending order")
 	}
 }
+
+func TestContainerListStatusFilter(t *testing.T) {
+	testCase := nerdtest.Setup()
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		helpers.Ensure("create", "--name", data.Identifier("container"), testutil.CommonImage, "echo", "foo")
+		data.Labels().Set("cID", data.Identifier("container"))
+	}
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rm", "-f", data.Identifier("container"))
+	}
+
+	testCase.SubTests = []*test.Case{
+		// TODO: Refactor other filter tests
+		{
+			Description: "ps filter with status=created",
+			NoParallel:  true,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("ps", "-a", "--filter", "status=created", "--filter", fmt.Sprintf("name=%s", data.Labels().Get("cID")))
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					ExitCode: 0,
+					Output: func(stdout, info string, t *testing.T) {
+						assert.Assert(t, strings.Contains(stdout, data.Labels().Get("cID")), "No container found with status created")
+					},
+				}
+			},
+		},
+	}
+
+	testCase.Run(t)
+}
diff --git a/cmd/nerdctl/system/system_events_linux_test.go b/cmd/nerdctl/system/system_events_linux_test.go
index 37310bf9a7c..431abdafb0b 100644
--- a/cmd/nerdctl/system/system_events_linux_test.go
+++ b/cmd/nerdctl/system/system_events_linux_test.go
@@ -29,6 +29,7 @@ import (
 )
 
 func testEventFilterExecutor(data test.Data, helpers test.Helpers) test.TestableCommand {
+	helpers.Ensure("pull", testutil.CommonImage)
 	cmd := helpers.Command("events", "--filter", data.Labels().Get("filter"), "--format", "json")
 	// 3 seconds is too short on slow rig (EL8)
 	cmd.WithTimeout(10 * time.Second)
diff --git a/pkg/cmd/container/list_util.go b/pkg/cmd/container/list_util.go
index c6e0da8e2eb..da63106efd5 100644
--- a/pkg/cmd/container/list_util.go
+++ b/pkg/cmd/container/list_util.go
@@ -25,6 +25,7 @@ import (
 
 	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/containerd/v2/core/containers"
+	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
 
 	"github.com/containerd/nerdctl/v2/pkg/containerutil"
@@ -106,6 +107,7 @@ func (cl *containerFilterContext) foldExitedFilter(_ context.Context, filter, va
 	if err != nil {
 		return err
 	}
+	log.L.Infof("checking exit status %v %v", filter, value)
 	cl.exitedFilterFuncs = append(cl.exitedFilterFuncs, func(exitStatus int) bool {
 		return exited == exitStatus
 	})
@@ -235,6 +237,10 @@ func (cl *containerFilterContext) matchesTaskFilters(ctx context.Context, contai
 	defer cancel()
 	task, err := container.Task(ctx, nil)
 	if err != nil {
+		if errdefs.IsNotFound(err) {
+			// Check if we want to filter created containers
+			return cl.matchesExitedFilter(containerd.Status{Status: containerd.Created}) && cl.matchesStatusFilter(containerd.Status{Status: containerd.Created})
+		}
 		log.G(ctx).Warn(err)
 		return false
 	}

From 2e81f212706ad70fc40c2ca371ae9ba83b432be3 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sun, 4 May 2025 18:02:04 -0700
Subject: [PATCH 163/225] Integration in-container: simplify job

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/job-test-in-container.yml | 15 +++++----------
 Dockerfile.d/test-integration-rootless.sh   |  2 +-
 2 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/job-test-in-container.yml b/.github/workflows/job-test-in-container.yml
index 354d3bb36cd..ddc8bb7fe44 100644
--- a/.github/workflows/job-test-in-container.yml
+++ b/.github/workflows/job-test-in-container.yml
@@ -56,6 +56,11 @@ jobs:
       run:
         shell: bash
 
+    env:
+      # https://github.com/containerd/nerdctl/issues/622
+      # The only case when rootlesskit-version is force-specified is when we downgrade explicitly to v1
+      WORKAROUND_ISSUE_622: ${{ inputs.rootlesskit-version }}
+
     steps:
       - name: "Init: checkout"
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
@@ -137,16 +142,6 @@ jobs:
           sudo mkdir -p /etc/docker
           echo '{"ipv6": true, "fixed-cidr-v6": "2001:db8:1::/64", "experimental": true, "ip6tables": true}' | sudo tee /etc/docker/daemon.json
           sudo systemctl restart docker
-      # Rootless with old rootlesskit wants to disable buildkit
-      - if: ${{ inputs.target != 'rootful' && inputs.rootlesskit-version != '' }}
-        name: "Init: disable buildkit for old rootlesskit"
-        run: |
-          # https://github.com/containerd/nerdctl/issues/622
-          WORKAROUND_ISSUE_622=
-          if echo "${ROOTLESSKIT_VERSION}" | grep -q v1; then
-            WORKAROUND_ISSUE_622=1
-          fi
-          echo "WORKAROUND_ISSUE_622=$WORKAROUND_ISSUE_622" >> "$GITHUB_ENV"
       - name: "Run: integration tests"
         run: |
           . ./hack/github/action-helpers.sh
diff --git a/Dockerfile.d/test-integration-rootless.sh b/Dockerfile.d/test-integration-rootless.sh
index 481610eb1bc..f6e243f32b5 100755
--- a/Dockerfile.d/test-integration-rootless.sh
+++ b/Dockerfile.d/test-integration-rootless.sh
@@ -26,7 +26,7 @@ if [[ "$(id -u)" = "0" ]]; then
 	fi
 
 	: "${WORKAROUND_ISSUE_622:=}"
-	if [[ "$WORKAROUND_ISSUE_622" = "1" ]]; then
+	if [[ "$WORKAROUND_ISSUE_622" != "" ]]; then
 		touch /workaround-issue-622
 	fi
 

From e65860255e63bbcef9a356f05b1f6da1f7c942ac Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Tue, 6 May 2025 10:49:59 -0700
Subject: [PATCH 164/225] Increase timeout for windows on TestRunRmTime

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/container/container_run_test.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/cmd/nerdctl/container/container_run_test.go b/cmd/nerdctl/container/container_run_test.go
index 23b74b97714..568fe851107 100644
--- a/cmd/nerdctl/container/container_run_test.go
+++ b/cmd/nerdctl/container/container_run_test.go
@@ -600,7 +600,11 @@ func TestRunRmTime(t *testing.T) {
 	base.Cmd("run", "--rm", testutil.CommonImage, "true").AssertOK()
 	t1 := time.Now()
 	took := t1.Sub(t0)
-	const deadline = 3 * time.Second
+	var deadline = 3 * time.Second
+	// FIXME: Investigate? it appears that since the move to containerd 2 on Windows, this is taking longer.
+	if runtime.GOOS == "windows" {
+		deadline = 10 * time.Second
+	}
 	if took > deadline {
 		t.Fatalf("expected to have completed in %v, took %v", deadline, took)
 	}

From db57f37a020bd106f95e6f1f0870ae648a70dc7d Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Tue, 6 May 2025 11:54:52 -0700
Subject: [PATCH 165/225] Rewrite TestLogsWithoutNewlineOrEOF

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/container/container_logs_test.go | 30 +++++++++++++-------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/cmd/nerdctl/container/container_logs_test.go b/cmd/nerdctl/container/container_logs_test.go
index 033c4127be3..abaf94b3a5c 100644
--- a/cmd/nerdctl/container/container_logs_test.go
+++ b/cmd/nerdctl/container/container_logs_test.go
@@ -194,18 +194,26 @@ func TestLogsWithRunningContainer(t *testing.T) {
 }
 
 func TestLogsWithoutNewlineOrEOF(t *testing.T) {
-	if runtime.GOOS != "linux" {
-		t.Skip("FIXME: test does not work on Windows yet because containerd doesn't send an exit event appropriately after task exit on Windows")
+	testCase := nerdtest.Setup()
+	// FIXME: test does not work on Windows yet because containerd doesn't send an exit event appropriately after task exit on Windows")
+	// FIXME: nerdctl behavior does not match docker - test disabled for nerdctl until we fix
+	testCase.Require = require.All(
+		require.Linux,
+		nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/4201"),
+	)
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage, "printf", "'Hello World!\nThere is no newline'")
 	}
-	t.Parallel()
-	base := testutil.NewBase(t)
-	containerName := testutil.Identifier(t)
-	defer base.Cmd("rm", "-f", containerName).Run()
-	expected := []string{"Hello World!", "There is no newline"}
-	base.Cmd("run", "-d", "--name", containerName, testutil.CommonImage,
-		"printf", "'Hello World!\nThere is no newline'").AssertOK()
-	time.Sleep(3 * time.Second)
-	base.Cmd("logs", "-f", containerName).AssertOutContainsAll(expected...)
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rm", "-f", data.Identifier())
+	}
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		// FIXME: arbitrary timeouts are by nature a problem.
+		time.Sleep(5 * time.Second)
+		return helpers.Command("logs", "-f", data.Identifier())
+	}
+	testCase.Expected = test.Expects(0, nil, expect.Equals("'Hello World!\nThere is no newline'"))
+	testCase.Run(t)
 }
 
 func TestLogsAfterRestartingContainer(t *testing.T) {

From 2388dccf6e4b778f1681f6e37549b8eaa9d37376 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Wed, 7 May 2025 12:28:17 +0900
Subject: [PATCH 166/225] go.mod: github.com/syndtr/gocapability:
 gomodjail:unconfined

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 go.mod | 1 +
 1 file changed, 1 insertion(+)

diff --git a/go.mod b/go.mod
index 53d192441cc..1a70db9a359 100644
--- a/go.mod
+++ b/go.mod
@@ -125,6 +125,7 @@ require (
 	github.com/smallstep/pkcs7 v0.1.1 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
+	//gomodjail:unconfined
 	github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
 	github.com/tinylib/msgp v1.2.0 // indirect
 	github.com/vbatts/tar-split v0.11.6 // indirect

From 7ac3125f5ea891993845b8ae6b229faed4146f2b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 7 May 2025 03:38:02 +0000
Subject: [PATCH 167/225] build(deps): bump github.com/containerd/containerd/v2

Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.1.0-rc.0 to 2.1.0-rc.1.
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](https://github.com/containerd/containerd/compare/v2.1.0-rc.0...v2.1.0-rc.1)

---
updated-dependencies:
- dependency-name: github.com/containerd/containerd/v2
  dependency-version: 2.1.0-rc.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 1a70db9a359..0063569975a 100644
--- a/go.mod
+++ b/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/containerd/cgroups/v3 v3.0.5 //gomodjail:unconfined
 	github.com/containerd/console v1.0.4 //gomodjail:unconfined
 	github.com/containerd/containerd/api v1.9.0-rc.0
-	github.com/containerd/containerd/v2 v2.1.0-rc.0 //gomodjail:unconfined
+	github.com/containerd/containerd/v2 v2.1.0-rc.1 //gomodjail:unconfined
 	github.com/containerd/continuity v0.4.5 //gomodjail:unconfined
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/fifo v1.1.0 //gomodjail:unconfined
diff --git a/go.sum b/go.sum
index 000a60e9682..3caf45a3462 100644
--- a/go.sum
+++ b/go.sum
@@ -31,8 +31,8 @@ github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn
 github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
 github.com/containerd/containerd/api v1.9.0-rc.0 h1:qs7q8DSuxFKF9oKdYuhRhmdDSck77JEqzf9ExaTL72E=
 github.com/containerd/containerd/api v1.9.0-rc.0/go.mod h1:GhghKFmTR3hNtyznBoQ0EMWr9ju5AqHjcZPsSpTKutI=
-github.com/containerd/containerd/v2 v2.1.0-rc.0 h1:Dy4yAcT139blRUIrzjYVRLKTAtZTCbwjrD0ZRTkHUDM=
-github.com/containerd/containerd/v2 v2.1.0-rc.0/go.mod h1:KzuwQ2djcBrUwvoL9wFgadt5XZYtD6N9dOJAd+P+2Dw=
+github.com/containerd/containerd/v2 v2.1.0-rc.1 h1:b5sVLu3jkbI32v9oBwuqyKntiAgxtTB2p2HoSi7h0Ds=
+github.com/containerd/containerd/v2 v2.1.0-rc.1/go.mod h1:Hk5Q63X2x6zG6f+UNno9GbTEy1qO9ay8KE4O+T8UFVc=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=

From 38d67f09b4485eb58d2fda545e672caf86e8805f Mon Sep 17 00:00:00 2001
From: Shubharanshu Mahapatra <shubhum@amazon.com>
Date: Thu, 13 Feb 2025 16:18:49 +0530
Subject: [PATCH 168/225] feat: add support for userns

Signed-off-by: Shubharanshu Mahapatra <shubhum@amazon.com>
---
 .github/workflows/job-test-in-container.yml   |   2 +-
 .golangci.yml                                 |   2 +-
 cmd/nerdctl/builder/builder_build.go          |   9 +
 cmd/nerdctl/container/container_create.go     |  24 +
 .../container/container_create_linux_test.go  | 185 +++++++
 cmd/nerdctl/container/container_run.go        |   2 +-
 .../container_run_user_linux_test.go          | 226 ++++++++
 cmd/nerdctl/main.go                           |   1 +
 docs/command-reference.md                     |   5 +-
 docs/config.md                                |   2 +
 go.mod                                        |   3 +-
 pkg/api/types/container_types.go              |   3 +
 pkg/cmd/container/create.go                   |  30 +-
 .../container/create_userns_opts_darwin.go    |  46 ++
 .../container/create_userns_opts_freebsd.go   |  46 ++
 pkg/cmd/container/create_userns_opts_linux.go | 516 ++++++++++++++++++
 .../create_userns_opts_linux_test.go          | 144 +++++
 .../container/create_userns_opts_windows.go   |  46 ++
 pkg/cmd/container/idmap.go                    | 170 ++++++
 pkg/config/config.go                          |   2 +
 pkg/testutil/nerdtest/requirements.go         |  41 ++
 pkg/testutil/testutil.go                      |  16 +-
 22 files changed, 1509 insertions(+), 12 deletions(-)
 create mode 100644 pkg/cmd/container/create_userns_opts_darwin.go
 create mode 100644 pkg/cmd/container/create_userns_opts_freebsd.go
 create mode 100644 pkg/cmd/container/create_userns_opts_linux.go
 create mode 100644 pkg/cmd/container/create_userns_opts_linux_test.go
 create mode 100644 pkg/cmd/container/create_userns_opts_windows.go
 create mode 100644 pkg/cmd/container/idmap.go

diff --git a/.github/workflows/job-test-in-container.yml b/.github/workflows/job-test-in-container.yml
index ddc8bb7fe44..6c1b9bae492 100644
--- a/.github/workflows/job-test-in-container.yml
+++ b/.github/workflows/job-test-in-container.yml
@@ -153,7 +153,7 @@ jobs:
           # Besides, each job is running on a different instance, which means using host network here
           # is safe and has no side effects on others.
           [ "${{ inputs.target }}" == "rootful" ] \
-            && args=(test-integration ./hack/test-integration.sh) \
+            && args=(test-integration ./hack/test-integration.sh -test.allow-modify-users=true) \
             || args=(test-integration-${{ inputs.target }} /test-integration-rootless.sh ./hack/test-integration.sh)
           if [ "${{ inputs.ipv6 }}" == true ]; then
             docker run --network host -t --rm --privileged -e GITHUB_STEP_SUMMARY="$GITHUB_STEP_SUMMARY" -v "$GITHUB_STEP_SUMMARY":"$GITHUB_STEP_SUMMARY" -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622:-} "${args[@]}" -test.only-flaky=false -test.only-ipv6 -test.target=${{ inputs.binary }}
diff --git a/.golangci.yml b/.golangci.yml
index d0e92d9ab31..7fda716e51a 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -114,7 +114,7 @@ linters:
           arguments: [7]
         - name: function-length
           # 155 occurrences (at default 0, 75). Really long functions should really be broken up in most cases.
-          arguments: [0, 400]
+          arguments: [0, 450]
         - name: cyclomatic
           # 204 occurrences (at default 10)
           arguments: [100]
diff --git a/cmd/nerdctl/builder/builder_build.go b/cmd/nerdctl/builder/builder_build.go
index 582147589dc..8b9691fb8a3 100644
--- a/cmd/nerdctl/builder/builder_build.go
+++ b/cmd/nerdctl/builder/builder_build.go
@@ -25,6 +25,8 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/containerd/log"
+
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/completion"
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
@@ -209,6 +211,13 @@ func processBuildCommandFlag(cmd *cobra.Command, args []string) (types.BuilderBu
 		return types.BuilderBuildOptions{}, err
 	}
 
+	usernsRemap, err := cmd.Flags().GetString("userns-remap")
+	if err != nil {
+		return types.BuilderBuildOptions{}, err
+	} else if usernsRemap != "" {
+		log.L.Warn("userns remap is not supported with nerdctl build. dropping the config.")
+	}
+
 	return types.BuilderBuildOptions{
 		GOptions:             globalOptions,
 		BuildKitHost:         buildKitHost,
diff --git a/cmd/nerdctl/container/container_create.go b/cmd/nerdctl/container/container_create.go
index 81956fe0019..e8d7e6a4d33 100644
--- a/cmd/nerdctl/container/container_create.go
+++ b/cmd/nerdctl/container/container_create.go
@@ -464,6 +464,30 @@ func createOptions(cmd *cobra.Command) (types.ContainerCreateOptions, error) {
 	}
 	// #endregion
 
+	// #region for UserNS
+	opt.UserNS, err = cmd.Flags().GetString("userns-remap")
+	if err != nil {
+		return opt, err
+	}
+
+	userns, err := cmd.Flags().GetString("userns")
+	if err != nil {
+		return opt, err
+	}
+
+	if userns == "host" {
+		opt.UserNS = ""
+	} else if userns != "" {
+		return opt, fmt.Errorf("invalid user mode")
+	}
+
+	if opt.Privileged && opt.UserNS != "" {
+		//userns-remap is not supported with privileged flag.
+		// Ref: https://docs.docker.com/engine/security/userns-remap/
+		return opt, fmt.Errorf("privileged flag cannot be used with userns-remap")
+	}
+	// #endregion
+
 	return opt, nil
 }
 
diff --git a/cmd/nerdctl/container/container_create_linux_test.go b/cmd/nerdctl/container/container_create_linux_test.go
index d6a4e91e0f2..66da8a19e86 100644
--- a/cmd/nerdctl/container/container_create_linux_test.go
+++ b/cmd/nerdctl/container/container_create_linux_test.go
@@ -19,15 +19,19 @@ package container
 import (
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
+	"syscall"
 	"testing"
 
 	"github.com/opencontainers/go-digest"
 	"gotest.tools/v3/assert"
 
 	"github.com/containerd/containerd/v2/defaults"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
 	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
@@ -325,3 +329,184 @@ func TestCreateFromOCIArchive(t *testing.T) {
 	base.Cmd("create", "--rm", "--name", containerName, fmt.Sprintf("oci-archive://%s", tarPath)).AssertOK()
 	base.Cmd("start", "--attach", containerName).AssertOutContains("test-nerdctl-create-from-oci-archive")
 }
+
+func TestUsernsMappingCreateCmd(t *testing.T) {
+	nerdtest.Setup()
+
+	testCase := &test.Case{
+		Require: require.All(
+			nerdtest.AllowModifyUserns,
+			nerdtest.RemapIDs,
+			require.Not(nerdtest.Docker)),
+		NoParallel: true,
+		Setup: func(data test.Data, helpers test.Helpers) {
+			data.Labels().Set("validUserns", "nerdctltestuser")
+			data.Labels().Set("expectedHostUID", "123456789")
+			data.Labels().Set("invalidUserns", "invaliduser")
+		},
+		SubTests: []*test.Case{
+			{
+				Description: "Test container create with valid Userns",
+				NoParallel:  true, // Changes system config so running in non parallel mode
+				Setup: func(data test.Data, helpers test.Helpers) {
+					err := appendUsernsConfig(data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID"), helpers)
+					assert.NilError(t, err, "Failed to append Userns config")
+				},
+				Cleanup: func(data test.Data, helpers test.Helpers) {
+					removeUsernsConfig(t, data.Labels().Get("validUserns"), helpers)
+					helpers.Anyhow("rm", "-f", data.Identifier())
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					helpers.Ensure("create", "--tty", "--userns-remap", data.Labels().Get("validUserns"), "--name", data.Identifier(), testutil.NginxAlpineImage)
+					return helpers.Command("start", data.Identifier())
+				},
+				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+					return &test.Expected{
+						ExitCode: 0,
+						Output: func(stdout string, info string, t *testing.T) {
+							actualHostUID, err := getContainerHostUID(helpers, data.Identifier())
+							assert.NilError(t, err, "Failed to get container host UID")
+							assert.Assert(t, actualHostUID == data.Labels().Get("expectedHostUID"), info)
+						},
+					}
+				},
+			},
+			{
+				Description: "Test container create failure with valid Userns and privileged flag",
+				NoParallel:  true, // Changes system config so running in non parallel mode
+				Setup: func(data test.Data, helpers test.Helpers) {
+					err := appendUsernsConfig(data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID"), helpers)
+					assert.NilError(t, err, "Failed to append Userns config")
+				},
+				Cleanup: func(data test.Data, helpers test.Helpers) {
+					removeUsernsConfig(t, data.Labels().Get("validUserns"), helpers)
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("create", "--tty", "--privileged", "--userns-remap", data.Labels().Get("validUserns"), "--name", data.Identifier(), testutil.NginxAlpineImage)
+				},
+				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+					return &test.Expected{
+						ExitCode: 1,
+					}
+				},
+			},
+			{
+				Description: "Test container create with invalid Userns",
+				NoParallel:  true, // Changes system config so running in non parallel mode
+				Cleanup: func(data test.Data, helpers test.Helpers) {
+					helpers.Anyhow("rm", "-f", data.Identifier())
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("create", "--tty", "--userns-remap", data.Labels().Get("invalidUserns"), "--name", data.Identifier(), testutil.NginxAlpineImage)
+				},
+				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+					return &test.Expected{
+						ExitCode: 1,
+					}
+				},
+			},
+		},
+	}
+	testCase.Run(t)
+}
+
+func getContainerHostUID(helpers test.Helpers, containerName string) (string, error) {
+	result := helpers.Capture("inspect", "--format", "{{.State.Pid}}", containerName)
+	pidStr := strings.TrimSpace(result)
+	pid, err := strconv.Atoi(pidStr)
+	if err != nil {
+		return "", fmt.Errorf("invalid PID: %v", err)
+	}
+
+	stat, err := os.Stat(fmt.Sprintf("/proc/%d", pid))
+	if err != nil {
+		return "", fmt.Errorf("failed to stat process: %v", err)
+	}
+
+	uid := int(stat.Sys().(*syscall.Stat_t).Uid)
+	return strconv.Itoa(uid), nil
+}
+
+func appendUsernsConfig(userns string, hostUID string, helpers test.Helpers) error {
+	addUser(userns, hostUID, helpers)
+	entry := fmt.Sprintf("%s:%s:65536\n", userns, hostUID)
+	tempDir := helpers.T().TempDir()
+	files := []string{"subuid", "subgid"}
+	for _, file := range files {
+
+		fileBak := filepath.Join(tempDir, file)
+		defer os.Remove(fileBak)
+		d, err := os.Create(fileBak)
+		if err != nil {
+			return fmt.Errorf("failed to create %s: %w", fileBak, err)
+		}
+
+		s, err := os.Open(filepath.Join("/etc", file))
+		if err != nil {
+			return fmt.Errorf("failed to open %s: %w", file, err)
+		}
+		defer s.Close()
+
+		_, err = io.Copy(d, s)
+		if err != nil {
+			return fmt.Errorf("failed to copy %s to %s: %w", file, fileBak, err)
+		}
+
+		f, err := os.OpenFile(fmt.Sprintf("/etc/%s", file), os.O_APPEND|os.O_WRONLY, 0644)
+		if err != nil {
+			return fmt.Errorf("failed to open %s: %w", file, err)
+		}
+		defer f.Close()
+
+		if _, err := f.WriteString(entry); err != nil {
+			return fmt.Errorf("failed to write to %s: %w", file, err)
+		}
+	}
+	return nil
+}
+
+func addUser(username string, hostID string, helpers test.Helpers) {
+	helpers.Custom("groupadd", "-g", hostID, username).Run(&test.Expected{
+		ExitCode: 0})
+	helpers.Custom("useradd", "-u", hostID, "-g", hostID, "-s", "/bin/false", username).Run(&test.Expected{
+		ExitCode: 0})
+}
+
+func removeUsernsConfig(t *testing.T, userns string, helpers test.Helpers) {
+	delUser(userns, helpers)
+	delGroup(userns, helpers)
+	tempDir := helpers.T().TempDir()
+	files := []string{"subuid", "subgid"}
+	for _, file := range files {
+		fileBak := filepath.Join(tempDir, file)
+		s, err := os.Open(fileBak)
+		if err != nil {
+			t.Logf("failed to open %s, Error: %s", fileBak, err)
+			continue
+		}
+		defer s.Close()
+
+		d, err := os.Open(filepath.Join("/etc/%s", file))
+		if err != nil {
+			t.Logf("failed to open %s, Error: %s", file, err)
+			continue
+
+		}
+		defer d.Close()
+
+		_, err = io.Copy(d, s)
+		if err != nil {
+			t.Logf("failed to restore. Copy %s to %s failed, Error %s", fileBak, file, err)
+			continue
+		}
+
+	}
+}
+
+func delUser(username string, helpers test.Helpers) {
+	helpers.Custom("userdel", username).Run(&test.Expected{ExitCode: expect.ExitCodeNoCheck})
+}
+
+func delGroup(groupname string, helpers test.Helpers) {
+	helpers.Custom("groupdel", groupname).Run(&test.Expected{ExitCode: expect.ExitCodeNoCheck})
+}
diff --git a/cmd/nerdctl/container/container_run.go b/cmd/nerdctl/container/container_run.go
index 84bc42f05e6..be629b7eb2f 100644
--- a/cmd/nerdctl/container/container_run.go
+++ b/cmd/nerdctl/container/container_run.go
@@ -288,7 +288,6 @@ func setCreateFlags(cmd *cobra.Command) {
 	// #endregion
 
 	cmd.Flags().String("ipfs-address", "", "multiaddr of IPFS API (default uses $IPFS_PATH env variable if defined or local directory ~/.ipfs)")
-
 	cmd.Flags().String("isolation", "default", "Specify isolation technology for container. On Linux the only valid value is default. Windows options are host, process and hyperv with process isolation as the default")
 	cmd.RegisterFlagCompletionFunc("isolation", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		if runtime.GOOS == "windows" {
@@ -296,6 +295,7 @@ func setCreateFlags(cmd *cobra.Command) {
 		}
 		return []string{"default"}, cobra.ShellCompDirectiveNoFileComp
 	})
+	cmd.Flags().String("userns", "", "Specify host to disable userns-remap")
 
 }
 
diff --git a/cmd/nerdctl/container/container_run_user_linux_test.go b/cmd/nerdctl/container/container_run_user_linux_test.go
index 968057f1404..61e2d674d77 100644
--- a/cmd/nerdctl/container/container_run_user_linux_test.go
+++ b/cmd/nerdctl/container/container_run_user_linux_test.go
@@ -17,9 +17,16 @@
 package container
 
 import (
+	"fmt"
 	"testing"
 
+	"gotest.tools/v3/assert"
+
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestRunUserGID(t *testing.T) {
@@ -181,3 +188,222 @@ func TestRunAddGroup_CVE_2023_25173(t *testing.T) {
 		base.Cmd(cmd...).AssertOutContains(testCase.expected + "\n")
 	}
 }
+
+func TestUsernsMappingRunCmd(t *testing.T) {
+	nerdtest.Setup()
+	testCase := &test.Case{
+		Require: require.All(
+			nerdtest.AllowModifyUserns,
+			nerdtest.RemapIDs,
+			require.Not(nerdtest.Docker),
+		),
+		Setup: func(data test.Data, helpers test.Helpers) {
+			data.Labels().Set("validUserns", "nerdctltestuser")
+			data.Labels().Set("expectedHostUID", "123456789")
+			data.Labels().Set("validUid", "123456789")
+			data.Labels().Set("net-container", "net-container")
+			data.Labels().Set("invalidUserns", "invaliduser")
+		},
+		SubTests: []*test.Case{
+			{
+				Description: "Test container run with valid Userns format userns username",
+				NoParallel:  true, // Changes system config so running in non parallel mode
+				Setup: func(data test.Data, helpers test.Helpers) {
+					err := appendUsernsConfig(data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID"), helpers)
+					assert.NilError(t, err, "Failed to append Userns config")
+				},
+				Cleanup: func(data test.Data, helpers test.Helpers) {
+					helpers.Anyhow("rm", "-f", data.Identifier())
+					removeUsernsConfig(t, data.Labels().Get("validUserns"), helpers)
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--tty", "-d", "--userns-remap", data.Labels().Get("validUserns"), "--name", data.Identifier(), testutil.CommonImage, "sleep", "inf")
+				},
+				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+					return &test.Expected{
+						ExitCode: 0,
+						Output: func(stdout string, info string, t *testing.T) {
+							actualHostUID, err := getContainerHostUID(helpers, data.Identifier())
+							if err != nil {
+								t.Fatalf("Failed to get container host UID: %v", err)
+							}
+							assert.Assert(t, actualHostUID == data.Labels().Get("expectedHostUID"), info)
+						},
+					}
+				},
+			},
+			{
+				Description: "Test container run with valid Userns  --userns uid",
+				NoParallel:  true, // Changes system config so running in non parallel mode
+				Setup: func(data test.Data, helpers test.Helpers) {
+					err := appendUsernsConfig(data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID"), helpers)
+					assert.NilError(t, err, "Failed to append Userns config")
+				},
+				Cleanup: func(data test.Data, helpers test.Helpers) {
+					helpers.Anyhow("rm", "-f", data.Identifier())
+					removeUsernsConfig(t, data.Labels().Get("validUserns"), helpers)
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--tty", "-d", "--userns-remap", data.Labels().Get("validUid"), "--name", data.Identifier(), testutil.CommonImage, "sleep", "inf")
+				},
+				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+					return &test.Expected{
+						ExitCode: 0,
+						Output: func(stdout string, info string, t *testing.T) {
+							actualHostUID, err := getContainerHostUID(helpers, data.Identifier())
+							if err != nil {
+								t.Fatalf("Failed to get container host UID: %v", err)
+							}
+							assert.Assert(t, actualHostUID == data.Labels().Get("expectedHostUID"), info)
+						},
+					}
+				},
+			},
+			{
+				Description: "Test container run failure with valid Userns and privileged flag",
+				NoParallel:  true, // Changes system config so running in non parallel mode
+				Setup: func(data test.Data, helpers test.Helpers) {
+					err := appendUsernsConfig(data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID"), helpers)
+					assert.NilError(t, err, "Failed to append Userns config")
+				},
+				Cleanup: func(data test.Data, helpers test.Helpers) {
+					removeUsernsConfig(t, data.Labels().Get("validUserns"), helpers)
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--tty", "--privileged", "--userns-remap", data.Labels().Get("validUserns"), "--name", data.Identifier(), testutil.CommonImage, "sleep", "inf")
+				},
+				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+					return &test.Expected{
+						ExitCode: 1,
+					}
+				},
+			},
+			{
+				Description: "Test container run with valid Userns format --userns <username>:<groupname>",
+				NoParallel:  true, // Changes system config so running in non parallel mode
+				Setup: func(data test.Data, helpers test.Helpers) {
+					err := appendUsernsConfig(data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID"), helpers)
+					assert.NilError(t, err, "Failed to append Userns config")
+				},
+				Cleanup: func(data test.Data, helpers test.Helpers) {
+					helpers.Anyhow("rm", "-f", data.Identifier())
+					removeUsernsConfig(t, data.Labels().Get("validUserns"), helpers)
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--tty", "-d", "--userns-remap", fmt.Sprintf("%s:%s", data.Labels().Get("validUserns"), data.Labels().Get("validUserns")), "--name", data.Identifier(), testutil.CommonImage, "sleep", "inf")
+				},
+				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+					return &test.Expected{
+						ExitCode: 0,
+						Output: func(stdout string, info string, t *testing.T) {
+							actualHostUID, err := getContainerHostUID(helpers, data.Identifier())
+							if err != nil {
+								t.Fatalf("Failed to get container host UID: %v", err)
+							}
+							assert.Assert(t, actualHostUID == data.Labels().Get("expectedHostUID"), info)
+						},
+					}
+				},
+			},
+			{
+				Description: "Test container run with valid Userns  --userns uid:gid",
+				NoParallel:  true, // Changes system config so running in non parallel mode
+				Setup: func(data test.Data, helpers test.Helpers) {
+					err := appendUsernsConfig(data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID"), helpers)
+					assert.NilError(t, err, "Failed to append Userns config")
+				},
+				Cleanup: func(data test.Data, helpers test.Helpers) {
+					helpers.Anyhow("rm", "-f", data.Identifier())
+					removeUsernsConfig(t, data.Labels().Get("validUserns"), helpers)
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--tty", "-d", "--userns-remap", fmt.Sprintf("%s:%s", data.Labels().Get("validUid"), data.Labels().Get("validUid")), "--name", data.Identifier(), testutil.CommonImage, "sleep", "inf")
+				},
+				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+					return &test.Expected{
+						ExitCode: 0,
+						Output: func(stdout string, info string, t *testing.T) {
+							actualHostUID, err := getContainerHostUID(helpers, data.Identifier())
+							if err != nil {
+								t.Fatalf("Failed to get container host UID: %v", err)
+							}
+							assert.Assert(t, actualHostUID == data.Labels().Get("expectedHostUID"), info)
+						},
+					}
+				},
+			},
+			{
+				Description: "Test container network share with valid Userns",
+				NoParallel:  true, // Changes system config so running in non parallel mode
+				Setup: func(data test.Data, helpers test.Helpers) {
+					err := appendUsernsConfig(data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID"), helpers)
+					assert.NilError(t, err, "Failed to append Userns config")
+					helpers.Ensure("run", "--tty", "-d", "--userns-remap", data.Labels().Get("validUserns"), "--name", data.Labels().Get("net-container"), testutil.CommonImage, "sleep", "inf")
+				},
+				Cleanup: func(data test.Data, helpers test.Helpers) {
+					helpers.Anyhow("rm", "-f", data.Identifier())
+					helpers.Anyhow("rm", "-f", data.Labels().Get("net-container"))
+					removeUsernsConfig(t, data.Labels().Get("validUserns"), helpers)
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--tty", "-d", "--userns-remap", data.Labels().Get("validUserns"), "--net", fmt.Sprintf("container:%s", data.Labels().Get("net-container")), "--name", data.Identifier(), testutil.CommonImage, "sleep", "inf")
+				},
+				Expected: test.Expects(0, nil, nil),
+			},
+			{
+				Description: "Test container run with valid Userns with override --userns=host",
+				NoParallel:  true, // Changes system config so running in non parallel mode
+				Setup: func(data test.Data, helpers test.Helpers) {
+					err := appendUsernsConfig(data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID"), helpers)
+					assert.NilError(t, err, "Failed to append Userns config")
+				},
+				Cleanup: func(data test.Data, helpers test.Helpers) {
+					helpers.Anyhow("rm", "-f", data.Identifier())
+					removeUsernsConfig(t, data.Labels().Get("validUserns"), helpers)
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--tty", "-d", "--userns-remap", data.Labels().Get("validUserns"), "--userns", "host", "--name", data.Identifier(), testutil.CommonImage, "sleep", "inf")
+				},
+				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+					return &test.Expected{
+						ExitCode: 0,
+						Output: func(stdout string, info string, t *testing.T) {
+							actualHostUID, err := getContainerHostUID(helpers, data.Identifier())
+							if err != nil {
+								t.Fatalf("Failed to get container host UID: %v", err)
+							}
+							assert.Assert(t, actualHostUID == "0", info)
+						},
+					}
+				},
+			},
+			{
+				Description: "Test container run with valid Userns with invalid overrid --userns=hostinvalid",
+				NoParallel:  true, // Changes system config so running in non parallel mode
+				Setup: func(data test.Data, helpers test.Helpers) {
+					err := appendUsernsConfig(data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID"), helpers)
+					assert.NilError(t, err, "Failed to append Userns config")
+				},
+				Cleanup: func(data test.Data, helpers test.Helpers) {
+					helpers.Anyhow("rm", "-f", data.Identifier())
+					removeUsernsConfig(t, data.Labels().Get("validUserns"), helpers)
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--tty", "-d", "--userns-remap", data.Labels().Get("validUserns"), "--userns", "hostinvalid", "--name", data.Identifier(), testutil.CommonImage, "sleep", "inf")
+				},
+				Expected: test.Expects(1, nil, nil),
+			},
+			{
+				Description: "Test container run with invalid Userns",
+				Cleanup: func(data test.Data, helpers test.Helpers) {
+					helpers.Anyhow("rm", "-f", data.Identifier())
+				},
+				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+					return helpers.Command("run", "--tty", "-d", "--userns-remap", data.Labels().Get("invalidUserns"), "--name", data.Identifier(), testutil.CommonImage, "sleep", "inf")
+				},
+				Expected: test.Expects(1, nil, nil),
+			},
+		},
+	}
+	testCase.Run(t)
+}
diff --git a/cmd/nerdctl/main.go b/cmd/nerdctl/main.go
index 2b81f65b879..5223a68a959 100644
--- a/cmd/nerdctl/main.go
+++ b/cmd/nerdctl/main.go
@@ -187,6 +187,7 @@ func initRootCmdFlags(rootCmd *cobra.Command, tomlPath string) (*pflag.FlagSet,
 	helpers.AddPersistentStringFlag(rootCmd, "bridge-ip", nil, nil, nil, aliasToBeInherited, cfg.BridgeIP, "NERDCTL_BRIDGE_IP", "IP address for the default nerdctl bridge network")
 	rootCmd.PersistentFlags().Bool("kube-hide-dupe", cfg.KubeHideDupe, "Deduplicate images for Kubernetes with namespace k8s.io")
 	rootCmd.PersistentFlags().StringSlice("cdi-spec-dirs", cfg.CDISpecDirs, "The directories to search for CDI spec files. Defaults to /etc/cdi,/var/run/cdi")
+	rootCmd.PersistentFlags().String("userns-remap", cfg.UsernsRemap, "Support idmapping for creating and running containers. This options is only supported on linux. If `host` is passed, no idmapping is done. if a user name is passed, it does idmapping based on the uidmap and gidmap ranges specified in /etc/subuid and /etc/subgid respectively")
 	return aliasToBeInherited, nil
 }
 
diff --git a/docs/command-reference.md b/docs/command-reference.md
index 3f516ff3677..f95d5db1b4a 100644
--- a/docs/command-reference.md
+++ b/docs/command-reference.md
@@ -235,6 +235,8 @@ User flags:
 - :nerd_face: `--umask`: Set the umask inside the container. Defaults to 0022.
   Corresponds to Podman CLI.
 - :whale: `--group-add`: Add additional groups to join
+- :whale: `--userns`: Set it to `host` to disable user namespacing set in nerdctl.toml or in cli.
+
 
 Security flags:
 
@@ -426,7 +428,7 @@ IPFS flags:
 
 Unimplemented `docker run` flags:
     `--device-cgroup-rule`, `--disable-content-trust`, `--expose`, `--health-*`, `--isolation`, `--no-healthcheck`,
-    `--link*`, `--publish-all`, `--storage-opt`, `--userns`, `--volume-driver`
+    `--link*`, `--publish-all`, `--storage-opt`, `--volume-driver`
 
 ### :whale: :blue_square: nerdctl exec
 
@@ -1771,6 +1773,7 @@ Flags:
 - :nerd_face: `--insecure-registry`: skips verifying HTTPS certs, and allows falling back to plain HTTP
 - :nerd_face: `--host-gateway-ip`: IP address that the special 'host-gateway' string in --add-host resolves to. It has no effect without setting --add-host
   - Default: the IP address of the host
+- :nerd_face: `--userns-remap=<username>:<groupname>`: Support idmapping of containers. This options is only supported on rootful linux for container create and run if a user name and optionally group name is passed, it does idmapping based on the uidmap and gidmap ranges specified in /etc/subuid and /etc/subgid respectively. Note: `--userns-remap` is not supported for building containers. Nerdctl Build doesn't support userns-remap feature. (format: <name|uid>[:<group|gid>])
 
 The global flags can be also specified in `/etc/nerdctl/nerdctl.toml` (rootful) and `~/.config/nerdctl/nerdctl.toml` (rootless).
 See [`./config.md`](./config.md).
diff --git a/docs/config.md b/docs/config.md
index c7bccf72ad5..9d9369e2ebe 100644
--- a/docs/config.md
+++ b/docs/config.md
@@ -26,6 +26,7 @@ snapshotter    = "stargz"
 cgroup_manager = "cgroupfs"
 hosts_dir      = ["/etc/containerd/certs.d", "/etc/docker/certs.d"]
 experimental   = true
+userns_remap   = ""
 ```
 
 ## Properties
@@ -48,6 +49,7 @@ experimental   = true
 | `bridge_ip`         | `--bridge-ip`                      | `NERDCTL_BRIDGE_IP`       | IP address for the default nerdctl bridge network, e.g., 10.1.100.1/24                                                                                           | Since 2.0.1      |
 | `kube_hide_dupe`    | `--kube-hide-dupe`                 |                           | Deduplicate images for Kubernetes with namespace k8s.io, no more redundant <none> ones are displayed    | Since 2.0.3      |
 | `cdi_spec_dirs`     | `--cdi-spec-dirs`                   |                          | The folders to use when searching for CDI ([container-device-interface](https://github.com/cncf-tags/container-device-interface)) specifications.    | Since 2.1.0 |
+| `userns_remap`      | `--userns-remap`                   |                           | Support idmapping of containers. This options is only supported on rootful linux. If `host` is passed, no idmapping is done. if a user name is passed, it does idmapping based on the uidmap and gidmap ranges specified in /etc/subuid and /etc/subgid respectively. |   Since 2.1.0 |
 
 The properties are parsed in the following precedence:
 1. CLI flag
diff --git a/go.mod b/go.mod
index 1a70db9a359..4c8c3d72742 100644
--- a/go.mod
+++ b/go.mod
@@ -46,6 +46,7 @@ require (
 	github.com/mattn/go-isatty v0.0.20 //gomodjail:unconfined
 	github.com/moby/sys/mount v0.3.4
 	github.com/moby/sys/signal v0.7.1
+	github.com/moby/sys/user v0.4.0 //gomodjail:unconfined
 	github.com/moby/sys/userns v0.1.0 //gomodjail:unconfined
 	github.com/moby/term v0.5.2 //gomodjail:unconfined
 	github.com/muesli/cancelreader v0.2.2 //gomodjail:unconfined
@@ -105,8 +106,6 @@ require (
 	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/symlink v0.3.0 // indirect
-	//gomodjail:unconfined
-	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/multiformats/go-base32 v0.1.0 // indirect
 	github.com/multiformats/go-base36 v0.2.0 // indirect
diff --git a/pkg/api/types/container_types.go b/pkg/api/types/container_types.go
index 691f94b3dc9..3a7f89b0d5f 100644
--- a/pkg/api/types/container_types.go
+++ b/pkg/api/types/container_types.go
@@ -285,6 +285,9 @@ type ContainerCreateOptions struct {
 
 	// ImagePullOpt specifies image pull options which holds the ImageVerifyOptions for verifying the image.
 	ImagePullOpt ImagePullOptions
+
+	// UserNS name for user namespace mapping of container
+	UserNS string
 }
 
 // ContainerStopOptions specifies options for `nerdctl (container) stop`.
diff --git a/pkg/cmd/container/create.go b/pkg/cmd/container/create.go
index 2b3b885d2e6..c727dce03a0 100644
--- a/pkg/cmd/container/create.go
+++ b/pkg/cmd/container/create.go
@@ -196,6 +196,35 @@ func Create(ctx context.Context, client *containerd.Client, args []string, netMa
 	}
 	opts = append(opts, rootfsOpts...)
 	cOpts = append(cOpts, rootfsCOpts...)
+	if options.UserNS != "" {
+		if !options.Rootfs {
+			if runtime.GOOS != "linux" {
+				return nil, generateRemoveStateDirFunc(ctx, id, internalLabels), errors.New("UserNS is only supported on Rootful Linux")
+
+			} else if rootlessutil.IsRootless() {
+				return nil, generateRemoveStateDirFunc(ctx, id, internalLabels), errors.New("UserNS is only supported in Rootful Linux")
+			}
+			userNameSpaceOpts, userNameSpaceCOpts, err := getUserNamespaceOpts(ctx, client, &options, *ensuredImage, id)
+			if err != nil {
+				return nil, generateRemoveStateDirFunc(ctx, id, internalLabels), err
+			}
+			opts = append(opts, userNameSpaceOpts...)
+			cOpts = append(cOpts, userNameSpaceCOpts...)
+
+			userNsOpts, err := getContainerUserNamespaceNetOpts(ctx, client, netManager)
+			if err != nil {
+				return nil, generateRemoveStateDirFunc(ctx, id, internalLabels), err
+			}
+			opts = append(opts, userNsOpts...)
+		} else {
+			return nil, generateRemoveStateDirFunc(ctx, id, internalLabels), errors.New("UserNS is not supported with rootfs images")
+		}
+	} else {
+		if !options.Rootfs {
+			// UserNS not set and its a normal image
+			cOpts = append(cOpts, containerd.WithNewSnapshot(id, ensuredImage.Image))
+		}
+	}
 
 	if options.Workdir != "" {
 		opts = append(opts, oci.WithProcessCwd(options.Workdir))
@@ -383,7 +412,6 @@ func generateRootfsOpts(args []string, id string, ensured *imgutil.EnsuredImage,
 		cOpts = append(cOpts,
 			containerd.WithImage(ensured.Image),
 			containerd.WithSnapshotter(ensured.Snapshotter),
-			containerd.WithNewSnapshot(id, ensured.Image),
 			containerd.WithImageStopSignal(ensured.Image, "SIGTERM"),
 		)
 
diff --git a/pkg/cmd/container/create_userns_opts_darwin.go b/pkg/cmd/container/create_userns_opts_darwin.go
new file mode 100644
index 00000000000..98f0e24dc93
--- /dev/null
+++ b/pkg/cmd/container/create_userns_opts_darwin.go
@@ -0,0 +1,46 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package container
+
+import (
+	"context"
+
+	containerd "github.com/containerd/containerd/v2/client"
+	"github.com/containerd/containerd/v2/pkg/oci"
+
+	"github.com/containerd/nerdctl/v2/pkg/api/types"
+	"github.com/containerd/nerdctl/v2/pkg/containerutil"
+	"github.com/containerd/nerdctl/v2/pkg/imgutil"
+)
+
+func getUserNamespaceOpts(
+	ctx context.Context,
+	client *containerd.Client,
+	options *types.ContainerCreateOptions,
+	ensuredImage imgutil.EnsuredImage,
+	id string,
+) ([]oci.SpecOpts, []containerd.NewContainerOpts, error) {
+	return []oci.SpecOpts{}, []containerd.NewContainerOpts{}, nil
+}
+
+func getContainerUserNamespaceNetOpts(
+	ctx context.Context,
+	client *containerd.Client,
+	netManager containerutil.NetworkOptionsManager,
+) ([]oci.SpecOpts, error) {
+	return []oci.SpecOpts{}, nil
+}
diff --git a/pkg/cmd/container/create_userns_opts_freebsd.go b/pkg/cmd/container/create_userns_opts_freebsd.go
new file mode 100644
index 00000000000..98f0e24dc93
--- /dev/null
+++ b/pkg/cmd/container/create_userns_opts_freebsd.go
@@ -0,0 +1,46 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package container
+
+import (
+	"context"
+
+	containerd "github.com/containerd/containerd/v2/client"
+	"github.com/containerd/containerd/v2/pkg/oci"
+
+	"github.com/containerd/nerdctl/v2/pkg/api/types"
+	"github.com/containerd/nerdctl/v2/pkg/containerutil"
+	"github.com/containerd/nerdctl/v2/pkg/imgutil"
+)
+
+func getUserNamespaceOpts(
+	ctx context.Context,
+	client *containerd.Client,
+	options *types.ContainerCreateOptions,
+	ensuredImage imgutil.EnsuredImage,
+	id string,
+) ([]oci.SpecOpts, []containerd.NewContainerOpts, error) {
+	return []oci.SpecOpts{}, []containerd.NewContainerOpts{}, nil
+}
+
+func getContainerUserNamespaceNetOpts(
+	ctx context.Context,
+	client *containerd.Client,
+	netManager containerutil.NetworkOptionsManager,
+) ([]oci.SpecOpts, error) {
+	return []oci.SpecOpts{}, nil
+}
diff --git a/pkg/cmd/container/create_userns_opts_linux.go b/pkg/cmd/container/create_userns_opts_linux.go
new file mode 100644
index 00000000000..13f9275801c
--- /dev/null
+++ b/pkg/cmd/container/create_userns_opts_linux.go
@@ -0,0 +1,516 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package container
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/moby/sys/user"
+	"github.com/opencontainers/runtime-spec/specs-go"
+
+	containerd "github.com/containerd/containerd/v2/client"
+	"github.com/containerd/containerd/v2/core/snapshots"
+	"github.com/containerd/containerd/v2/pkg/oci"
+
+	"github.com/containerd/nerdctl/v2/pkg/api/types"
+	"github.com/containerd/nerdctl/v2/pkg/containerutil"
+	"github.com/containerd/nerdctl/v2/pkg/idutil/containerwalker"
+	"github.com/containerd/nerdctl/v2/pkg/imgutil"
+	"github.com/containerd/nerdctl/v2/pkg/netutil/nettype"
+)
+
+// IDMap contains a single entry for user namespace range remapping. An array
+// of IDMap entries represents the structure that will be provided to the Linux
+// kernel for creating a user namespace.
+type IDMap struct {
+	ContainerID int `json:"container_id"`
+	HostID      int `json:"host_id"`
+	Size        int `json:"size"`
+}
+
+// IdentityMapping contains a mappings of UIDs and GIDs.
+// The zero value represents an empty mapping.
+type IdentityMapping struct {
+	UIDMaps []IDMap `json:"UIDMaps"`
+	GIDMaps []IDMap `json:"GIDMaps"`
+}
+
+const (
+	capabRemapIDs = "remap-ids"
+)
+
+func getUserNamespaceOpts(
+	ctx context.Context,
+	client *containerd.Client,
+	options *types.ContainerCreateOptions,
+	ensuredImage imgutil.EnsuredImage,
+	id string,
+) ([]oci.SpecOpts, []containerd.NewContainerOpts, error) {
+	if isDefaultUserns(options) {
+		return nil, createDefaultSnapshotOpts(id, ensuredImage), nil
+	}
+
+	supportsRemap, err := snapshotterSupportsRemapLabels(ctx, client, ensuredImage.Snapshotter)
+	if err != nil {
+		return nil, nil, err
+	} else if !supportsRemap {
+		return nil, nil, errors.New("snapshotter does not support remap-ids capability")
+	}
+
+	idMapping, err := loadAndValidateIDMapping(options.UserNS)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	uidMaps, gidMaps := convertMappings(idMapping)
+	specOpts := getUserNamespaceSpecOpts(uidMaps, gidMaps)
+	snapshotOpts, err := createSnapshotOpts(id, ensuredImage, uidMaps, gidMaps)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return specOpts, snapshotOpts, nil
+}
+
+// getContainerUserNamespaceNetOpts retrieves the user namespace path for the specified container.
+func getContainerUserNamespaceNetOpts(
+	ctx context.Context,
+	client *containerd.Client,
+	netManager containerutil.NetworkOptionsManager,
+) ([]oci.SpecOpts, error) {
+	netOpts, err := netManager.InternalNetworkingOptionLabels(ctx)
+	if err != nil {
+		return nil, err
+	}
+	netType, err := nettype.Detect(netOpts.NetworkSlice)
+	if err != nil {
+		return nil, err
+	} else if netType == nettype.Container {
+		containerName, err := getContainerNameFromNetworkSlice(netOpts)
+		if err != nil {
+			return nil, err
+		}
+
+		container, err := findContainer(ctx, client, containerName)
+		if err != nil {
+			return nil, err
+		}
+
+		if err := validateContainerStatus(ctx, container); err != nil {
+			return nil, err
+		}
+
+		userNsPath, err := getUserNamespacePath(ctx, container)
+		if err != nil {
+			return nil, err
+		}
+
+		var userNameSpaceSpecOpts []oci.SpecOpts
+		userNameSpaceSpecOpts = append(userNameSpaceSpecOpts, oci.WithLinuxNamespace(specs.LinuxNamespace{
+			Type: specs.UserNamespace,
+			Path: userNsPath,
+		}))
+		return userNameSpaceSpecOpts, nil
+	} else if netType == nettype.Namespace {
+		netNsPath, err := getNamespacePathFromNetworkSlice(netOpts)
+		if err != nil {
+			return nil, err
+		}
+		userNsPath, err := getUserNamespacePathFromNetNsPath(netNsPath)
+		if err != nil {
+			return nil, err
+		}
+		var userNameSpaceSpecOpts []oci.SpecOpts
+		userNameSpaceSpecOpts = append(userNameSpaceSpecOpts, oci.WithLinuxNamespace(specs.LinuxNamespace{
+			Type: specs.UserNamespace,
+			Path: userNsPath,
+		}))
+		return userNameSpaceSpecOpts, nil
+
+	}
+	return []oci.SpecOpts{}, nil
+}
+
+func getNamespacePathFromNetworkSlice(netOpts types.NetworkOptions) (string, error) {
+	if len(netOpts.NetworkSlice) > 1 {
+		return "", fmt.Errorf("only one network namespace is supported")
+	}
+	netItems := strings.Split(netOpts.NetworkSlice[0], ":")
+	if len(netItems) < 2 {
+		return "", fmt.Errorf("namespace networking argument format must be 'ns:<path>', got: %q", netOpts.NetworkSlice[0])
+	}
+	return netItems[1], nil
+}
+
+func getUserNamespacePathFromNetNsPath(netNsPath string) (string, error) {
+	var path string
+	var maxSymlinkDepth = 255
+	depth := 0
+	for {
+		var err error
+		path, err = os.Readlink(netNsPath)
+		if err != nil {
+			break
+		} else if depth > maxSymlinkDepth {
+			return "", fmt.Errorf("EvalSymlinks: too many links")
+		}
+
+		depth++
+		_, err = os.Readlink(path)
+		if err != nil {
+			break
+		} else if depth > maxSymlinkDepth {
+			return "", fmt.Errorf("EvalSymlinks: too many links")
+		}
+
+		netNsPath = path
+		depth++
+	}
+	matched, err := regexp.MatchString(`^/proc/\d+/ns/net$`, netNsPath)
+	if err != nil {
+		return "", err
+	} else if !matched {
+		return "", fmt.Errorf("path is not of the form /proc/<pid>/ns/net, unable to resolve user namespace")
+	}
+	userNsPath := filepath.Join(filepath.Dir(netNsPath), "user")
+
+	return userNsPath, nil
+}
+
+func convertIDMapToLinuxIDMapping(idMaps []IDMap) []specs.LinuxIDMapping {
+	// Create a slice to hold the resulting LinuxIDMapping structs
+	linuxIDMappings := make([]specs.LinuxIDMapping, len(idMaps))
+
+	// Iterate through the IDMap slice and convert each one
+	for i, idMap := range idMaps {
+		linuxIDMappings[i] = specs.LinuxIDMapping{
+			ContainerID: uint32(idMap.ContainerID),
+			HostID:      uint32(idMap.HostID),
+			Size:        uint32(idMap.Size),
+		}
+	}
+
+	// Return the converted slice
+	return linuxIDMappings
+}
+
+// findContainer searches for a container by name and returns it if found.
+func findContainer(
+	ctx context.Context,
+	client *containerd.Client,
+	containerName string,
+) (containerd.Container, error) {
+	var container containerd.Container
+
+	walker := &containerwalker.ContainerWalker{
+		Client: client,
+		OnFound: func(_ context.Context, found containerwalker.Found) error {
+			if found.MatchCount > 1 {
+				return fmt.Errorf("multiple containers found with prefix: %s", containerName)
+			}
+			container = found.Container
+			return nil
+		},
+	}
+
+	if n, err := walker.Walk(ctx, containerName); err != nil {
+		return container, err
+	} else if n == 0 {
+		return container, fmt.Errorf("container not found: %s", containerName)
+	}
+
+	return container, nil
+}
+
+// validateContainerStatus checks if the container is running.
+func validateContainerStatus(ctx context.Context, container containerd.Container) error {
+	task, err := container.Task(ctx, nil)
+	if err != nil {
+		return err
+	}
+
+	status, err := task.Status(ctx)
+	if err != nil {
+		return err
+	}
+
+	if status.Status != containerd.Running {
+		return fmt.Errorf("container %s is not running", container.ID())
+	}
+
+	return nil
+}
+
+// getUserNamespacePath returns the path to the container's user namespace.
+func getUserNamespacePath(ctx context.Context, container containerd.Container) (string, error) {
+	task, err := container.Task(ctx, nil)
+	if err != nil {
+		return "", err
+	}
+
+	return fmt.Sprintf("/proc/%d/ns/user", task.Pid()), nil
+}
+
+// Determines if the default UserNS should be used.
+func isDefaultUserns(options *types.ContainerCreateOptions) bool {
+	return options.UserNS == "" || options.UserNS == "host"
+}
+
+// Creates default snapshot options.
+func createDefaultSnapshotOpts(id string, image imgutil.EnsuredImage) []containerd.NewContainerOpts {
+	return []containerd.NewContainerOpts{
+		containerd.WithNewSnapshot(id, image.Image),
+	}
+}
+
+// parseGroup parses a string identifier (name or ID) and returns the corresponding group
+func parseGroup(identifier string) (user.Group, bool, error) {
+	id, err := strconv.Atoi(identifier)
+	if err == nil {
+		grp, err := user.LookupGid(id)
+		if err != nil {
+			return user.Group{}, true, fmt.Errorf("could not get group for gid %d: %w", id, err)
+		}
+		return grp, true, nil
+	}
+
+	grp, err := user.LookupGroup(identifier)
+	if err != nil {
+		return user.Group{}, false, fmt.Errorf("could not get group for groupname %s: %w", identifier, err)
+	}
+	return grp, false, nil
+}
+
+// parseIdentifier parses a string identifier (name or ID) and returns the corresponding user
+func parseUser(identifier string) (user.User, bool, error) {
+	id, err := strconv.Atoi(identifier)
+	if err == nil {
+		usr, err := user.LookupUid(id)
+		if err != nil {
+			return user.User{}, true, fmt.Errorf("could not get user for uid %d: %w", id, err)
+		}
+		return usr, true, nil
+	}
+
+	usr, err := user.LookupUser(identifier)
+	if err != nil {
+		return user.User{}, false, fmt.Errorf("could not get user for username %s: %w", identifier, err)
+	}
+	return usr, false, nil
+}
+
+func getUserAndGroup(spec string) (user.User, user.Group, error) {
+	parts := strings.Split(spec, ":")
+	if len(parts) > 2 {
+		return user.User{}, user.Group{}, fmt.Errorf("invalid identity mapping format: %s", spec)
+	} else if len(parts) == 2 && (parts[0] == "" || parts[1] == "") {
+		return user.User{}, user.Group{}, fmt.Errorf("invalid identity mapping format: %s", spec)
+	}
+
+	userPart := parts[0]
+	usr, _, err := parseUser(userPart)
+	if err != nil {
+		return user.User{}, user.Group{}, err
+	}
+
+	var groupPart string
+	if len(parts) == 1 {
+		groupPart = userPart
+	} else {
+		groupPart = parts[1]
+	}
+
+	group, _, err := parseGroup(groupPart)
+	if err != nil {
+		return user.User{}, user.Group{}, err
+	}
+
+	return usr, group, nil
+}
+
+// LoadIdentityMapping takes a requested identity mapping specification and
+// using the data from /etc/sub{uid,gid} ranges, creates the
+// uid and gid remapping ranges for that user/group pair.
+// The specification can be in the following formats:
+// (format: <name|uid>[:<group|gid>])
+func LoadIdentityMapping(spec string) (IdentityMapping, error) {
+	usr, groupUsr, err := getUserAndGroup(spec)
+	if err != nil {
+		return IdentityMapping{}, err
+	}
+	subuidRanges, err := lookupUserSubRangesFile("/etc/subuid", usr)
+	if err != nil {
+		return IdentityMapping{}, err
+	}
+
+	subgidRanges, err := lookupGroupSubRangesFile("/etc/subgid", groupUsr)
+	if err != nil {
+		return IdentityMapping{}, err
+	}
+
+	return IdentityMapping{
+		UIDMaps: subuidRanges,
+		GIDMaps: subgidRanges,
+	}, nil
+}
+
+func lookupUserSubRangesFile(path string, usr user.User) ([]IDMap, error) {
+	uidstr := strconv.Itoa(usr.Uid)
+	rangeList, err := user.ParseSubIDFileFilter(path, func(sid user.SubID) bool {
+		return sid.Name == usr.Name || sid.Name == uidstr
+	})
+	if err != nil {
+		return nil, err
+	}
+	if len(rangeList) == 0 {
+		return nil, fmt.Errorf("no subuid ranges found for user %q", usr.Name)
+	}
+
+	idMap := []IDMap{}
+
+	containerID := 0
+	for _, idrange := range rangeList {
+		idMap = append(idMap, IDMap{
+			ContainerID: containerID,
+			HostID:      int(idrange.SubID),
+			Size:        int(idrange.Count),
+		})
+		containerID = containerID + int(idrange.Count)
+	}
+	return idMap, nil
+}
+
+func lookupGroupSubRangesFile(path string, grp user.Group) ([]IDMap, error) {
+	gidstr := strconv.Itoa(grp.Gid)
+	rangeList, err := user.ParseSubIDFileFilter(path, func(sid user.SubID) bool {
+		return sid.Name == grp.Name || sid.Name == gidstr
+	})
+	if err != nil {
+		return nil, err
+	}
+	if len(rangeList) == 0 {
+		return nil, fmt.Errorf("no subuid ranges found for user %q", grp.Name)
+	}
+
+	idMap := []IDMap{}
+	containerID := 0
+	for _, idrange := range rangeList {
+		idMap = append(idMap, IDMap{
+			ContainerID: containerID,
+			HostID:      int(idrange.SubID),
+			Size:        int(idrange.Count),
+		})
+		containerID = containerID + int(idrange.Count)
+	}
+	return idMap, nil
+}
+
+// Loads and validates the ID mapping from the given UserNS.
+func loadAndValidateIDMapping(userNS string) (IdentityMapping, error) {
+	idMapping, err := LoadIdentityMapping(userNS)
+	if err != nil {
+		return IdentityMapping{}, err
+	}
+	if !validIDMapping(idMapping) {
+		return IdentityMapping{}, errors.New("no valid UID/GID mappings found")
+	}
+	return idMapping, nil
+}
+
+// Validates that both UID and GID mappings are available.
+func validIDMapping(mapping IdentityMapping) bool {
+	return len(mapping.UIDMaps) > 0 && len(mapping.GIDMaps) > 0
+}
+
+// Converts IDMapping into LinuxIDMapping structures.
+func convertMappings(mapping IdentityMapping) ([]specs.LinuxIDMapping, []specs.LinuxIDMapping) {
+	return convertIDMapToLinuxIDMapping(mapping.UIDMaps),
+		convertIDMapToLinuxIDMapping(mapping.GIDMaps)
+}
+
+// Builds OCI spec options for the user namespace.
+func getUserNamespaceSpecOpts(
+	uidMaps, gidMaps []specs.LinuxIDMapping,
+) []oci.SpecOpts {
+	return []oci.SpecOpts{oci.WithUserNamespace(uidMaps, gidMaps)}
+}
+
+// Creates snapshot options based on ID mappings and snapshotter capabilities.
+func createSnapshotOpts(
+	id string,
+	image imgutil.EnsuredImage,
+	uidMaps, gidMaps []specs.LinuxIDMapping,
+) ([]containerd.NewContainerOpts, error) {
+	if !isValidMapping(uidMaps, gidMaps) {
+		return nil, errors.New("snapshotter uidmap gidmap config invalid")
+	}
+	return []containerd.NewContainerOpts{containerd.WithNewSnapshot(id, image.Image, WithUserNSRemapperLabels(uidMaps, gidMaps))}, nil
+}
+
+func WithUserNSRemapperLabels(uidmaps, gidmaps []specs.LinuxIDMapping) snapshots.Opt {
+	idMap := ContainerdIDMap{
+		UidMap: uidmaps,
+		GidMap: gidmaps,
+	}
+	uidmapLabel, gidmapLabel := idMap.Marshal()
+	return snapshots.WithLabels(map[string]string{
+		snapshots.LabelSnapshotUIDMapping: uidmapLabel,
+		snapshots.LabelSnapshotGIDMapping: gidmapLabel,
+	})
+}
+
+func isValidMapping(uidMaps, gidMaps []specs.LinuxIDMapping) bool {
+	return len(uidMaps) > 0 && len(gidMaps) > 0
+}
+
+func getContainerNameFromNetworkSlice(netOpts types.NetworkOptions) (string, error) {
+	netItems := strings.Split(netOpts.NetworkSlice[0], ":")
+	if len(netItems) < 2 || netItems[1] == "" {
+		return "", fmt.Errorf("container networking argument format must be 'container:<id|name>', got: %q", netOpts.NetworkSlice[0])
+	}
+	containerName := netItems[1]
+	return containerName, nil
+}
+
+func snapshotterSupportsRemapLabels(
+	ctx context.Context,
+	client *containerd.Client,
+	snapshotterName string,
+) (bool, error) {
+	caps, err := client.GetSnapshotterCapabilities(ctx, snapshotterName)
+	if err != nil {
+		return false, err
+	}
+	return hasCapability(caps, capabRemapIDs), nil
+}
+
+// Checks if the given capability exists in the list.
+func hasCapability(caps []string, capability string) bool {
+	for _, cap := range caps {
+		if cap == capability {
+			return true
+		}
+	}
+	return false
+}
diff --git a/pkg/cmd/container/create_userns_opts_linux_test.go b/pkg/cmd/container/create_userns_opts_linux_test.go
new file mode 100644
index 00000000000..f1a72026200
--- /dev/null
+++ b/pkg/cmd/container/create_userns_opts_linux_test.go
@@ -0,0 +1,144 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package container
+
+import (
+	"testing"
+
+	"github.com/opencontainers/runtime-spec/specs-go"
+	"gotest.tools/v3/assert"
+
+	"github.com/containerd/nerdctl/v2/pkg/api/types"
+	"github.com/containerd/nerdctl/v2/pkg/imgutil"
+)
+
+// TestCreateSnapshotOpts tests the createSnapshotOpts function.
+func TestCreateSnapshotOpts(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name        string
+		id          string
+		image       imgutil.EnsuredImage
+		uidMaps     []specs.LinuxIDMapping
+		gidMaps     []specs.LinuxIDMapping
+		expectError bool
+	}{
+		{
+			name:  "Single remapping",
+			id:    "container1",
+			image: imgutil.EnsuredImage{},
+			uidMaps: []specs.LinuxIDMapping{
+				{HostID: 1000, Size: 1},
+			},
+			gidMaps: []specs.LinuxIDMapping{
+				{HostID: 1000, Size: 1},
+			},
+			expectError: false,
+		},
+		{
+			name:  "Multi remapping with support",
+			id:    "container2",
+			image: imgutil.EnsuredImage{},
+			uidMaps: []specs.LinuxIDMapping{
+				{HostID: 1000, Size: 1},
+				{HostID: 2000, Size: 1},
+			},
+			gidMaps: []specs.LinuxIDMapping{
+				{HostID: 3000, Size: 1},
+			},
+			expectError: false,
+		},
+		{
+			name:        "Empty UID/GID maps",
+			id:          "container4",
+			image:       imgutil.EnsuredImage{},
+			uidMaps:     []specs.LinuxIDMapping{},
+			gidMaps:     []specs.LinuxIDMapping{},
+			expectError: true,
+		},
+	}
+
+	for _, testCase := range tests {
+		t.Run(testCase.name, func(t *testing.T) {
+			t.Parallel()
+			_, err := createSnapshotOpts(testCase.id, testCase.image, testCase.uidMaps, testCase.gidMaps)
+
+			if testCase.expectError {
+				assert.Assert(t, err != nil)
+			} else {
+				assert.NilError(t, err)
+			}
+		})
+	}
+}
+
+// TestGetContainerNameFromNetworkSlice tests the getContainerNameFromNetworkSlice function.
+func TestGetContainerNameFromNetworkSlice(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name        string
+		netOpts     types.NetworkOptions
+		expected    string
+		expectError bool
+	}{
+		{
+			name: "Valid input with container name",
+			netOpts: types.NetworkOptions{
+				NetworkSlice: []string{"container:mycontainer"},
+			},
+			expected:    "mycontainer",
+			expectError: false,
+		},
+		{
+			name: "Invalid input with no colon separator",
+			netOpts: types.NetworkOptions{
+				NetworkSlice: []string{"container-mycontainer"},
+			},
+			expected:    "",
+			expectError: true,
+		},
+		{
+			name: "Empty NetworkSlice",
+			netOpts: types.NetworkOptions{
+				NetworkSlice: []string{""},
+			},
+			expected:    "",
+			expectError: true,
+		},
+		{
+			name: "Missing container name",
+			netOpts: types.NetworkOptions{
+				NetworkSlice: []string{"container:"},
+			},
+			expected:    "",
+			expectError: true,
+		},
+	}
+
+	for _, testCase := range tests {
+		t.Run(testCase.name, func(t *testing.T) {
+			t.Parallel()
+			containerName, err := getContainerNameFromNetworkSlice(testCase.netOpts)
+			if testCase.expectError {
+				assert.Assert(t, err != nil)
+			} else {
+				assert.NilError(t, err)
+				assert.Equal(t, testCase.expected, containerName)
+			}
+		})
+	}
+}
diff --git a/pkg/cmd/container/create_userns_opts_windows.go b/pkg/cmd/container/create_userns_opts_windows.go
new file mode 100644
index 00000000000..98f0e24dc93
--- /dev/null
+++ b/pkg/cmd/container/create_userns_opts_windows.go
@@ -0,0 +1,46 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package container
+
+import (
+	"context"
+
+	containerd "github.com/containerd/containerd/v2/client"
+	"github.com/containerd/containerd/v2/pkg/oci"
+
+	"github.com/containerd/nerdctl/v2/pkg/api/types"
+	"github.com/containerd/nerdctl/v2/pkg/containerutil"
+	"github.com/containerd/nerdctl/v2/pkg/imgutil"
+)
+
+func getUserNamespaceOpts(
+	ctx context.Context,
+	client *containerd.Client,
+	options *types.ContainerCreateOptions,
+	ensuredImage imgutil.EnsuredImage,
+	id string,
+) ([]oci.SpecOpts, []containerd.NewContainerOpts, error) {
+	return []oci.SpecOpts{}, []containerd.NewContainerOpts{}, nil
+}
+
+func getContainerUserNamespaceNetOpts(
+	ctx context.Context,
+	client *containerd.Client,
+	netManager containerutil.NetworkOptionsManager,
+) ([]oci.SpecOpts, error) {
+	return []oci.SpecOpts{}, nil
+}
diff --git a/pkg/cmd/container/idmap.go b/pkg/cmd/container/idmap.go
new file mode 100644
index 00000000000..23d366e4082
--- /dev/null
+++ b/pkg/cmd/container/idmap.go
@@ -0,0 +1,170 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package container
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/opencontainers/runtime-spec/specs-go"
+)
+
+const invalidID = 1<<32 - 1
+
+var invalidUser = User{Uid: invalidID, Gid: invalidID}
+
+// User is a Uid and Gid pair of a user
+//
+//nolint:revive
+type User struct {
+	Uid uint32
+	Gid uint32
+}
+
+// IDMap contains the mappings of Uids and Gids.
+//
+//nolint:revive
+type ContainerdIDMap struct {
+	UidMap []specs.LinuxIDMapping `json:"UidMap"`
+	GidMap []specs.LinuxIDMapping `json:"GidMap"`
+}
+
+// RootPair returns the ID pair for the root user
+func (i *ContainerdIDMap) RootPair() (User, error) {
+	uid, err := toHost(0, i.UidMap)
+	if err != nil {
+		return invalidUser, err
+	}
+	gid, err := toHost(0, i.GidMap)
+	if err != nil {
+		return invalidUser, err
+	}
+	return User{Uid: uid, Gid: gid}, nil
+}
+
+// ToHost returns the host user ID pair for the container ID pair.
+func (i *ContainerdIDMap) ToHost(pair User) (User, error) {
+	var (
+		target User
+		err    error
+	)
+	target.Uid, err = toHost(pair.Uid, i.UidMap)
+	if err != nil {
+		return invalidUser, err
+	}
+	target.Gid, err = toHost(pair.Gid, i.GidMap)
+	if err != nil {
+		return invalidUser, err
+	}
+	return target, nil
+}
+
+// Marshal serializes the IDMap object into two strings:
+// one uidmap list and another one for gidmap list
+func (i *ContainerdIDMap) Marshal() (string, string) {
+	marshal := func(mappings []specs.LinuxIDMapping) string {
+		var arr []string
+		for _, m := range mappings {
+			arr = append(arr, serializeLinuxIDMapping(m))
+		}
+		return strings.Join(arr, ",")
+	}
+	return marshal(i.UidMap), marshal(i.GidMap)
+}
+
+// Unmarshal deserialize the passed uidmap and gidmap strings
+// into a IDMap object. Error is returned in case of failure
+func (i *ContainerdIDMap) Unmarshal(uidMap, gidMap string) error {
+	unmarshal := func(str string, fn func(m specs.LinuxIDMapping)) error {
+		if len(str) == 0 {
+			return nil
+		}
+		for _, mapping := range strings.Split(str, ",") {
+			m, err := deserializeLinuxIDMapping(mapping)
+			if err != nil {
+				return err
+			}
+			fn(m)
+		}
+		return nil
+	}
+	if err := unmarshal(uidMap, func(m specs.LinuxIDMapping) {
+		i.UidMap = append(i.UidMap, m)
+	}); err != nil {
+		return err
+	}
+	return unmarshal(gidMap, func(m specs.LinuxIDMapping) {
+		i.GidMap = append(i.GidMap, m)
+	})
+}
+
+// toHost takes an id mapping and a remapped ID, and translates the
+// ID to the mapped host ID. If no map is provided, then the translation
+// assumes a 1-to-1 mapping and returns the passed in id #
+func toHost(contID uint32, idMap []specs.LinuxIDMapping) (uint32, error) {
+	if idMap == nil {
+		return contID, nil
+	}
+	for _, m := range idMap {
+		high, err := safeSum(m.ContainerID, m.Size)
+		if err != nil {
+			break
+		}
+		if contID >= m.ContainerID && contID < high {
+			hostID, err := safeSum(m.HostID, contID-m.ContainerID)
+			if err != nil || hostID == invalidID {
+				break
+			}
+			return hostID, nil
+		}
+	}
+	return invalidID, fmt.Errorf("container ID %d cannot be mapped to a host ID", contID)
+}
+
+// safeSum returns the sum of x and y. or an error if the result overflows
+func safeSum(x, y uint32) (uint32, error) {
+	z := x + y
+	if z < x || z < y {
+		return invalidID, errors.New("ID overflow")
+	}
+	return z, nil
+}
+
+// serializeLinuxIDMapping marshals a LinuxIDMapping object to string
+func serializeLinuxIDMapping(m specs.LinuxIDMapping) string {
+	return fmt.Sprintf("%d:%d:%d", m.ContainerID, m.HostID, m.Size)
+}
+
+// deserializeLinuxIDMapping unmarshals a string to a LinuxIDMapping object
+func deserializeLinuxIDMapping(str string) (specs.LinuxIDMapping, error) {
+	var (
+		hostID, ctrID, length int64
+	)
+	_, err := fmt.Sscanf(str, "%d:%d:%d", &ctrID, &hostID, &length)
+	if err != nil {
+		return specs.LinuxIDMapping{}, fmt.Errorf("input value %s unparsable: %w", str, err)
+	}
+	if ctrID < 0 || ctrID >= invalidID || hostID < 0 || hostID >= invalidID || length < 0 || length >= invalidID {
+		return specs.LinuxIDMapping{}, fmt.Errorf("invalid mapping \"%s\"", str)
+	}
+	return specs.LinuxIDMapping{
+		ContainerID: uint32(ctrID),
+		HostID:      uint32(hostID),
+		Size:        uint32(length),
+	}, nil
+}
diff --git a/pkg/config/config.go b/pkg/config/config.go
index f8a002ff752..ce118de5edf 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -43,6 +43,7 @@ type Config struct {
 	KubeHideDupe     bool     `toml:"kube_hide_dupe"`
 	// CDISpecDirs is a list of directories in which CDI specifications can be found.
 	CDISpecDirs []string `toml:"cdi_spec_dirs,omitempty"`
+	UsernsRemap string   `toml:"userns_remap, omitempty"`
 }
 
 // New creates a default Config object statically,
@@ -64,5 +65,6 @@ func New() *Config {
 		HostGatewayIP:    ncdefaults.HostGatewayIP(),
 		KubeHideDupe:     false,
 		CDISpecDirs:      ncdefaults.CDISpecDirs(),
+		UsernsRemap:      "",
 	}
 }
diff --git a/pkg/testutil/nerdtest/requirements.go b/pkg/testutil/nerdtest/requirements.go
index b7118e86d06..237b349988b 100644
--- a/pkg/testutil/nerdtest/requirements.go
+++ b/pkg/testutil/nerdtest/requirements.go
@@ -17,6 +17,7 @@
 package nerdtest
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"os"
@@ -25,12 +26,15 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/containerd/v2/defaults"
 	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/pkg/buildkitutil"
+	"github.com/containerd/nerdctl/v2/pkg/clientutil"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/platform"
 )
 
@@ -375,3 +379,40 @@ var Gomodjail = &test.Requirement{
 		return ret, mess
 	},
 }
+
+var AllowModifyUserns = &test.Requirement{
+	Check: func(data test.Data, helpers test.Helpers) (ret bool, mess string) {
+		if testutil.GetAllowModifyUsers() {
+			return true, "allow modify userns is enabled"
+		}
+		return false, "allow modify userns is disabled"
+	},
+}
+
+var RemapIDs = &test.Requirement{
+	Check: func(data test.Data, helpers test.Helpers) (ret bool, mess string) {
+		// Create a cobra command for ProcessRootCmdFlags to get globalOptions
+		ctx := context.Background()
+		snapshotterName := defaults.DefaultSnapshotter
+		namespace := defaultNamespace
+		address := defaults.DefaultAddress
+
+		client, ctx, cancel, err := clientutil.NewClient(ctx, namespace, address)
+		if err != nil {
+			return false, fmt.Sprintf("failed to create client: %v", err)
+		}
+		defer cancel()
+
+		caps, err := client.GetSnapshotterCapabilities(ctx, snapshotterName)
+		if err != nil {
+			return false, fmt.Sprintf("failed to get snapshotter capabilities: %v", err)
+		}
+
+		for _, cap := range caps {
+			if cap == "remap-ids" {
+				return true, "snapshotter supports ID remapping"
+			}
+		}
+		return false, "snapshotter does not support ID remapping"
+	},
+}
diff --git a/pkg/testutil/testutil.go b/pkg/testutil/testutil.go
index 880302b6fb8..dd57f2821e7 100644
--- a/pkg/testutil/testutil.go
+++ b/pkg/testutil/testutil.go
@@ -479,11 +479,12 @@ func (c *Cmd) Out() string {
 }
 
 var (
-	flagTestTarget     string
-	flagTestKillDaemon bool
-	flagTestIPv6       bool
-	flagTestKube       bool
-	flagTestFlaky      bool
+	flagTestTarget      string
+	flagTestKillDaemon  bool
+	flagTestIPv6        bool
+	flagTestKube        bool
+	flagTestFlaky       bool
+	flagTestModifyUsers bool
 )
 
 var (
@@ -493,6 +494,7 @@ var (
 func M(m *testing.M) {
 	flag.StringVar(&flagTestTarget, "test.target", "nerdctl", "target to test")
 	flag.BoolVar(&flagTestKillDaemon, "test.allow-kill-daemon", false, "enable tests that kill the daemon")
+	flag.BoolVar(&flagTestModifyUsers, "test.allow-modify-users", false, "enable tests that creates/deletes user accounts on the host")
 	flag.BoolVar(&flagTestIPv6, "test.only-ipv6", false, "enable tests on IPv6")
 	flag.BoolVar(&flagTestKube, "test.only-kubernetes", false, "enable tests on Kubernetes")
 	flag.BoolVar(&flagTestFlaky, "test.only-flaky", false, "enable testing of flaky tests only (if false, flaky tests are ignored)")
@@ -573,6 +575,10 @@ func GetDaemonIsKillable() bool {
 	return flagTestKillDaemon
 }
 
+func GetAllowModifyUsers() bool {
+	return flagTestModifyUsers
+}
+
 func IsDocker() bool {
 	return strings.HasPrefix(filepath.Base(GetTarget()), "docker")
 }

From 0c50e70252294f0303d442f04abb39641ca695ba Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Wed, 7 May 2025 12:54:30 +0900
Subject: [PATCH 169/225] update gomodjail (0.1.2)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index e4d0fd15551..dbccb01d82b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -40,7 +40,7 @@ ARG TINI_VERSION=v0.19.0@BINARY
 # Extra deps: Debug
 ARG BUILDG_VERSION=v0.5.2@BINARY
 # Extra deps: gomodjail
-ARG GOMODJAIL_VERSION=v0.1.1@756b1b9636c6de78984cbad1a974d930e2f0e851
+ARG GOMODJAIL_VERSION=v0.1.2@0a86b34442a491fa8f5e4565e9c846fce310239c
 
 # Test deps
 # Currently, the Docker Official Images and the test deps are not pinned by the hash

From d8b17e7df6c6b728d9be62a592e85e09a7b675b7 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Wed, 7 May 2025 12:55:04 +0900
Subject: [PATCH 170/225] Revert "Workaround gomodjail concurrency issue"

This reverts commit 4039cfef3a010bbfab3b2e0f8f989a06b947c6c4.

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 hack/test-integration.sh | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/hack/test-integration.sh b/hack/test-integration.sh
index 8968b139e1d..3d1a21365a5 100755
--- a/hack/test-integration.sh
+++ b/hack/test-integration.sh
@@ -26,13 +26,6 @@ if [[ "$(id -u)" = "0" ]]; then
   fi
 fi
 
-# This is a temporary workaround for https://github.com/AkihiroSuda/gomodjail/issues/50
-# FIXME: remove this once above has been fixed.
-if command -v nerdctl.gomodjail >/dev/null 2>&1; then
-  # We do not care that it fails or succeeds - just need gomodjail to unpack once.
-  nerdctl.gomodjail info >/dev/null 2>&1 || true
-fi
-
 readonly timeout="60m"
 readonly retries="2"
 readonly needsudo="${WITH_SUDO:-}"

From 4a395634f5c9d3c42978702526acc04ef0352e29 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Wed, 7 May 2025 17:57:31 +0900
Subject: [PATCH 171/225] oci-hook: add /usr/sbin:/sbin to PATH for iptables

The directory of `iptables` is often missing in the default `$PATH`.

Fix issue 1536

Thanks to jeffrson for testing.

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 pkg/cmd/container/create.go | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkg/cmd/container/create.go b/pkg/cmd/container/create.go
index 2b3b885d2e6..c9896e3ff44 100644
--- a/pkg/cmd/container/create.go
+++ b/pkg/cmd/container/create.go
@@ -540,6 +540,8 @@ func withNerdctlOCIHook(cmd string, args []string) (oci.SpecOpts, error) {
 	}
 
 	args = append([]string{cmd}, append(args, "internal", "oci-hook")...)
+	// sbin is appended for iptables https://github.com/containerd/nerdctl/discussions/1536
+	env := append(os.Environ(), "PATH="+os.Getenv("PATH")+":/usr/sbin:/sbin")
 	return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {
 		if s.Hooks == nil {
 			s.Hooks = &specs.Hooks{}
@@ -548,14 +550,14 @@ func withNerdctlOCIHook(cmd string, args []string) (oci.SpecOpts, error) {
 		s.Hooks.CreateRuntime = append(s.Hooks.CreateRuntime, specs.Hook{
 			Path: cmd,
 			Args: crArgs,
-			Env:  os.Environ(),
+			Env:  env,
 		})
 		argsCopy := append([]string(nil), args...)
 		psArgs := append(argsCopy, "postStop")
 		s.Hooks.Poststop = append(s.Hooks.Poststop, specs.Hook{
 			Path: cmd,
 			Args: psArgs,
-			Env:  os.Environ(),
+			Env:  env,
 		})
 		return nil
 	}, nil

From 9a0695821dc6e4ec6779acb63f3852a76ccb60bf Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Thu, 8 May 2025 16:31:32 +0900
Subject: [PATCH 172/225] TestRunWithLogBinary: workaround for "package slices
 is not in GOROOT"

Fix issue 4214 as a quick workaround

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 cmd/nerdctl/container/container_run_test.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/cmd/nerdctl/container/container_run_test.go b/cmd/nerdctl/container/container_run_test.go
index 568fe851107..345523f1382 100644
--- a/cmd/nerdctl/container/container_run_test.go
+++ b/cmd/nerdctl/container/container_run_test.go
@@ -528,6 +528,8 @@ RUN echo '\
 
 
 RUN go mod init
+# Workaround for "package slices is not in GOROOT" https://github.com/containerd/nerdctl/issues/4214
+RUN go get github.com/containerd/containerd/v2@v2.0.5
 RUN go mod tidy
 RUN go build .
 

From e31a27ff4483a1019ce05a40b8b9af39c4c3f936 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 8 May 2025 13:18:29 -0700
Subject: [PATCH 173/225] Fix debug display issue with pty

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/internal/formatter/formatter.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mod/tigron/internal/formatter/formatter.go b/mod/tigron/internal/formatter/formatter.go
index a239273bda3..cbc87ddd5ed 100644
--- a/mod/tigron/internal/formatter/formatter.go
+++ b/mod/tigron/internal/formatter/formatter.go
@@ -39,6 +39,7 @@ func Table(data [][]any, mark string) string {
 	for _, row := range data {
 		key := fmt.Sprintf("%v", row[0])
 		value := strings.ReplaceAll(fmt.Sprintf("%v", row[1]), "\t", "  ")
+		value = strings.ReplaceAll(value, "\r", "")
 
 		output += fmt.Sprintf("+%s+\n", strings.Repeat(mark, maxLineLength-2))
 

From 69a21f36ec5492a09793d55f3bd91a35976f5759 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 8 May 2025 14:14:48 -0700
Subject: [PATCH 174/225] Disable docker testing for SigProxyFalse

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/container/container_run_linux_test.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/cmd/nerdctl/container/container_run_linux_test.go b/cmd/nerdctl/container/container_run_linux_test.go
index 736a346ac07..b025f681cfa 100644
--- a/cmd/nerdctl/container/container_run_linux_test.go
+++ b/cmd/nerdctl/container/container_run_linux_test.go
@@ -423,6 +423,10 @@ func TestRunSigProxy(t *testing.T) {
 		{
 			Description: "SigProxyFalse",
 
+			// Docker behavior changed sometimes with Docker 27
+			// See https://github.com/containerd/nerdctl/issues/4219 for details
+			Require: require.Not(nerdtest.Docker),
+
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
 			},

From f72aee44b20649d1ba9d877af0e2f5fbe4f1a632 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 8 May 2025 22:23:08 +0000
Subject: [PATCH 175/225] build(deps): bump github.com/containerd/containerd/v2

Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.1.0-rc.1 to 2.1.0.
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](https://github.com/containerd/containerd/compare/v2.1.0-rc.1...v2.1.0)

---
updated-dependencies:
- dependency-name: github.com/containerd/containerd/v2
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 4 ++--
 go.sum | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/go.mod b/go.mod
index 3cd8153ea80..7a13c8b6a17 100644
--- a/go.mod
+++ b/go.mod
@@ -11,8 +11,8 @@ require (
 	github.com/containerd/accelerated-container-image v1.3.0
 	github.com/containerd/cgroups/v3 v3.0.5 //gomodjail:unconfined
 	github.com/containerd/console v1.0.4 //gomodjail:unconfined
-	github.com/containerd/containerd/api v1.9.0-rc.0
-	github.com/containerd/containerd/v2 v2.1.0-rc.1 //gomodjail:unconfined
+	github.com/containerd/containerd/api v1.9.0
+	github.com/containerd/containerd/v2 v2.1.0 //gomodjail:unconfined
 	github.com/containerd/continuity v0.4.5 //gomodjail:unconfined
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/fifo v1.1.0 //gomodjail:unconfined
diff --git a/go.sum b/go.sum
index 3caf45a3462..093f2deb26c 100644
--- a/go.sum
+++ b/go.sum
@@ -29,10 +29,10 @@ github.com/containerd/cgroups/v3 v3.0.5 h1:44na7Ud+VwyE7LIoJ8JTNQOa549a8543BmzaJ
 github.com/containerd/cgroups/v3 v3.0.5/go.mod h1:SA5DLYnXO8pTGYiAHXz94qvLQTKfVM5GEVisn4jpins=
 github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn4ro=
 github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
-github.com/containerd/containerd/api v1.9.0-rc.0 h1:qs7q8DSuxFKF9oKdYuhRhmdDSck77JEqzf9ExaTL72E=
-github.com/containerd/containerd/api v1.9.0-rc.0/go.mod h1:GhghKFmTR3hNtyznBoQ0EMWr9ju5AqHjcZPsSpTKutI=
-github.com/containerd/containerd/v2 v2.1.0-rc.1 h1:b5sVLu3jkbI32v9oBwuqyKntiAgxtTB2p2HoSi7h0Ds=
-github.com/containerd/containerd/v2 v2.1.0-rc.1/go.mod h1:Hk5Q63X2x6zG6f+UNno9GbTEy1qO9ay8KE4O+T8UFVc=
+github.com/containerd/containerd/api v1.9.0 h1:HZ/licowTRazus+wt9fM6r/9BQO7S0vD5lMcWspGIg0=
+github.com/containerd/containerd/api v1.9.0/go.mod h1:GhghKFmTR3hNtyznBoQ0EMWr9ju5AqHjcZPsSpTKutI=
+github.com/containerd/containerd/v2 v2.1.0 h1:lS6iJ/CwZrxYxKd6zWBz5LR7xOlMVQC78z68YtizUAM=
+github.com/containerd/containerd/v2 v2.1.0/go.mod h1:t2VqM0zSiEdi33qgtsMwUKrYyVg4oq2FPe+cs3LBt7w=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=

From cc32660e21d2b8e5ac30dd240501c77681e8c9cb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 8 May 2025 22:24:17 +0000
Subject: [PATCH 176/225] build(deps): bump
 github.com/rootless-containers/rootlesskit/v2

Bumps [github.com/rootless-containers/rootlesskit/v2](https://github.com/rootless-containers/rootlesskit) from 2.3.4 to 2.3.5.
- [Release notes](https://github.com/rootless-containers/rootlesskit/releases)
- [Commits](https://github.com/rootless-containers/rootlesskit/compare/v2.3.4...v2.3.5)

---
updated-dependencies:
- dependency-name: github.com/rootless-containers/rootlesskit/v2
  dependency-version: 2.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 3cd8153ea80..64bbdad005f 100644
--- a/go.mod
+++ b/go.mod
@@ -55,7 +55,7 @@ require (
 	github.com/opencontainers/runtime-spec v1.2.1
 	github.com/pelletier/go-toml/v2 v2.2.4
 	github.com/rootless-containers/bypass4netns v0.4.2 //gomodjail:unconfined
-	github.com/rootless-containers/rootlesskit/v2 v2.3.4 //gomodjail:unconfined
+	github.com/rootless-containers/rootlesskit/v2 v2.3.5 //gomodjail:unconfined
 	github.com/spf13/cobra v1.9.1 //gomodjail:unconfined
 	github.com/spf13/pflag v1.0.6 //gomodjail:unconfined
 	github.com/vishvananda/netlink v1.3.1-0.20250303224720-0e7078ed04c8 //gomodjail:unconfined
diff --git a/go.sum b/go.sum
index 3caf45a3462..7f2a1ff2828 100644
--- a/go.sum
+++ b/go.sum
@@ -274,8 +274,8 @@ github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/rootless-containers/bypass4netns v0.4.2 h1:JUZcpX7VLRfDkLxBPC6fyNalJGv9MjnjECOilZIvKRc=
 github.com/rootless-containers/bypass4netns v0.4.2/go.mod h1:iOY28IeFVqFHnK0qkBCQ3eKzKQgSW5DtlXFQJyJMAQk=
-github.com/rootless-containers/rootlesskit/v2 v2.3.4 h1:EHiqqiq+ntTfdnQtIgDR3etiuqKkRCPr1qpoizJxW/E=
-github.com/rootless-containers/rootlesskit/v2 v2.3.4/go.mod h1:AJNM4jS0jFIF8GvBfnm4I0498zosnHGCIMRhUoEUmFg=
+github.com/rootless-containers/rootlesskit/v2 v2.3.5 h1:WGY05oHE7xQpSkCGfYP9lMY5z19tCxA8PhWlvP1cKx8=
+github.com/rootless-containers/rootlesskit/v2 v2.3.5/go.mod h1:83EIYLeMX8UeNgLHkR1PefoSV76aKEC+OyI3vzrEfvw=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sasha-s/go-deadlock v0.3.5 h1:tNCOEEDG6tBqrNDOX35j/7hL5FcFViG6awUGROb2NsU=
 github.com/sasha-s/go-deadlock v0.3.5/go.mod h1:bugP6EGbdGYObIlx7pUZtWqlvo8k9H6vCBBsiChJQ5U=

From d117accdae40558cfe2cd9167dc21bce70607cf5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 8 May 2025 22:42:39 +0000
Subject: [PATCH 177/225] build(deps): bump actions/setup-go from 5.4.0 to
 5.5.0

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.4.0 to 5.5.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/0aaccfd150d50ccaeb58ebd88d36e91967a5f35b...d35c59abb061a4a6fb18e82ac0862c26744d6ab5)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/job-build.yml        | 2 +-
 .github/workflows/job-lint-go.yml      | 2 +-
 .github/workflows/job-lint-project.yml | 2 +-
 .github/workflows/job-test-in-host.yml | 2 +-
 .github/workflows/job-test-unit.yml    | 2 +-
 .github/workflows/release.yml          | 2 +-
 .github/workflows/workflow-tigron.yml  | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/job-build.yml b/.github/workflows/job-build.yml
index 2567161442b..63c3c3e309d 100644
--- a/.github/workflows/job-build.yml
+++ b/.github/workflows/job-build.yml
@@ -50,7 +50,7 @@ jobs:
 
       - if: ${{ env.GO_VERSION != '' }}
         name: "Init: install go"
-        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
diff --git a/.github/workflows/job-lint-go.yml b/.github/workflows/job-lint-go.yml
index 6102d6cc69a..8ca82c91506 100644
--- a/.github/workflows/job-lint-go.yml
+++ b/.github/workflows/job-lint-go.yml
@@ -53,7 +53,7 @@ jobs:
 
       - if: ${{ env.GO_VERSION != '' }}
         name: "Init: install go"
-        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
diff --git a/.github/workflows/job-lint-project.yml b/.github/workflows/job-lint-project.yml
index fcadf7a8ba0..a3c840642a5 100644
--- a/.github/workflows/job-lint-project.yml
+++ b/.github/workflows/job-lint-project.yml
@@ -36,7 +36,7 @@ jobs:
           path: src/github.com/containerd/nerdctl
 
       - name: "Init: install go"
-        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
         with:
           go-version: ${{ inputs.go-version }}
           check-latest: true
diff --git a/.github/workflows/job-test-in-host.yml b/.github/workflows/job-test-in-host.yml
index 6262aa0ac33..f3d73cdae91 100644
--- a/.github/workflows/job-test-in-host.yml
+++ b/.github/workflows/job-test-in-host.yml
@@ -91,7 +91,7 @@ jobs:
 
       - if: ${{ env.SHOULD_RUN == 'yes' }}
         name: "Init: install go"
-        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
diff --git a/.github/workflows/job-test-unit.yml b/.github/workflows/job-test-unit.yml
index 3027e49beb4..c623b402b2b 100644
--- a/.github/workflows/job-test-unit.yml
+++ b/.github/workflows/job-test-unit.yml
@@ -61,7 +61,7 @@ jobs:
 
       - if: ${{ env.GO_VERSION != '' }}
         name: "Init: install go"
-        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 72587a7227d..4a920a20a52 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - name: "Install go"
-      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
       with:
         go-version: "1.24"
         check-latest: true
diff --git a/.github/workflows/workflow-tigron.yml b/.github/workflows/workflow-tigron.yml
index 81ddbac1e75..306ef75d55b 100644
--- a/.github/workflows/workflow-tigron.yml
+++ b/.github/workflows/workflow-tigron.yml
@@ -44,7 +44,7 @@ jobs:
             echo "::warning title=No canary go::There is currently no canary go version to test. Steps will not run."
       - if: ${{ env.GO_VERSION != '' }}
         name: "Install go"
-        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.4.0
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true

From aaaa3494b2d13e929d6b1f81fbc30a396e9f702a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 9 May 2025 00:51:10 +0000
Subject: [PATCH 178/225] build(deps): bump
 github.com/compose-spec/compose-go/v2

Bumps [github.com/compose-spec/compose-go/v2](https://github.com/compose-spec/compose-go) from 2.6.1 to 2.6.2.
- [Release notes](https://github.com/compose-spec/compose-go/releases)
- [Commits](https://github.com/compose-spec/compose-go/compare/v2.6.1...v2.6.2)

---
updated-dependencies:
- dependency-name: github.com/compose-spec/compose-go/v2
  dependency-version: 2.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index c1f8773dd3a..248ee3b3fc1 100644
--- a/go.mod
+++ b/go.mod
@@ -7,7 +7,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.3.1
 	github.com/Microsoft/go-winio v0.6.2
 	github.com/Microsoft/hcsshim v0.13.0-rc.3
-	github.com/compose-spec/compose-go/v2 v2.6.1 //gomodjail:unconfined
+	github.com/compose-spec/compose-go/v2 v2.6.2 //gomodjail:unconfined
 	github.com/containerd/accelerated-container-image v1.3.0
 	github.com/containerd/cgroups/v3 v3.0.5 //gomodjail:unconfined
 	github.com/containerd/console v1.0.4 //gomodjail:unconfined
diff --git a/go.sum b/go.sum
index 85aba1df677..cca14bfa126 100644
--- a/go.sum
+++ b/go.sum
@@ -21,8 +21,8 @@ github.com/cilium/ebpf v0.16.0 h1:+BiEnHL6Z7lXnlGUsXQPPAE7+kenAd4ES8MQ5min0Ok=
 github.com/cilium/ebpf v0.16.0/go.mod h1:L7u2Blt2jMM/vLAVgjxluxtBKlz3/GWjB0dMOEngfwE=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/compose-spec/compose-go/v2 v2.6.1 h1:276YiQKRcGGtgkxiymzWHJ2CTv5joQA+7DTNrUA+rys=
-github.com/compose-spec/compose-go/v2 v2.6.1/go.mod h1:vPlkN0i+0LjLf9rv52lodNMUTJF5YHVfHVGLLIP67NA=
+github.com/compose-spec/compose-go/v2 v2.6.2 h1:31uZNNLeRrKjtUCc56CzPpPykW1Tm6SxLn4gx9Jjzqw=
+github.com/compose-spec/compose-go/v2 v2.6.2/go.mod h1:vPlkN0i+0LjLf9rv52lodNMUTJF5YHVfHVGLLIP67NA=
 github.com/containerd/accelerated-container-image v1.3.0 h1:sFbTgSuMboeKHa9f7MY11hWF1XxVWjFoiTsXYtOtvdU=
 github.com/containerd/accelerated-container-image v1.3.0/go.mod h1:EvKVWor6ZQNUyYp0MZm5hw4k21ropuz7EegM+m/Jb/Q=
 github.com/containerd/cgroups/v3 v3.0.5 h1:44na7Ud+VwyE7LIoJ8JTNQOa549a8543BmzaJHo6Bzo=

From 8b85431ea2a43655c74943919490cd2d16dc5190 Mon Sep 17 00:00:00 2001
From: Shubharanshu Mahapatra <shubhum@amazon.com>
Date: Thu, 8 May 2025 01:59:34 -0700
Subject: [PATCH 179/225] update containerd version to 2.1.0

Signed-off-by: Shubharanshu Mahapatra <shubhum@amazon.com>
---
 .github/workflows/workflow-test.yml | 6 +++---
 Dockerfile                          | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/workflow-test.yml b/.github/workflows/workflow-test.yml
index dc5bbd358c5..c54e9deb570 100644
--- a/.github/workflows/workflow-test.yml
+++ b/.github/workflows/workflow-test.yml
@@ -140,9 +140,9 @@ jobs:
       canary: ${{ matrix.canary && true || false }}
       go-version: 1.24
       windows-cni-version: v0.3.1
-      containerd-version: 2.0.5
+      containerd-version: 2.1.0
       # Note: these as for amd64
-      containerd-sha: 88ab31f3e78e4d2fa12dcb933032122d11d441c83b79a89c6c8076f871e50df8
-      containerd-service-sha: 12a76c13cad132222d2b3d2025e56212d205d37eca77508dbbfcdf6ababbf70a
+      containerd-sha: 0e5359e957b66b679be807563a543c7416e305e3aafcf56bad90ef87a917014d
+      containerd-service-sha: 1941362cbaa89dd591b99c32b050d82c583d3cd2e5fa63085d7017457ec5fca8
       linux-cni-version: v1.7.1
       linux-cni-sha: 1a28a0506bfe5bcdc981caf1a49eeab7e72da8321f1119b7be85f22621013098
diff --git a/Dockerfile b/Dockerfile
index dbccb01d82b..25de5e11b6b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,7 +17,7 @@
 
 # Basic deps
 # @BINARY: the binary checksums are verified via Dockerfile.d/SHA256SUMS.d/<COMPONENT>-<VERSION>
-ARG CONTAINERD_VERSION=v2.0.5@fb4c30d4ede3531652d86197bf3fc9515e5276d9
+ARG CONTAINERD_VERSION=v2.1.0@061792f0ecf3684fb30a3a0eb006799b8c6638a7
 ARG RUNC_VERSION=v1.3.0@4ca628d1d4c974f92d24daccb901aa078aad748e
 ARG CNI_PLUGINS_VERSION=v1.7.1@BINARY
 

From 22bfe4d1b9a188cf64843bc949de8941414a8090 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 9 May 2025 13:41:30 +0000
Subject: [PATCH 180/225] build(deps): bump github.com/Microsoft/hcsshim

Bumps [github.com/Microsoft/hcsshim](https://github.com/Microsoft/hcsshim) from 0.13.0-rc.3 to 0.13.0.
- [Release notes](https://github.com/Microsoft/hcsshim/releases)
- [Commits](https://github.com/Microsoft/hcsshim/compare/v0.13.0-rc.3...v0.13.0)

---
updated-dependencies:
- dependency-name: github.com/Microsoft/hcsshim
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 248ee3b3fc1..40c88753935 100644
--- a/go.mod
+++ b/go.mod
@@ -6,7 +6,7 @@ go 1.23.0
 require (
 	github.com/Masterminds/semver/v3 v3.3.1
 	github.com/Microsoft/go-winio v0.6.2
-	github.com/Microsoft/hcsshim v0.13.0-rc.3
+	github.com/Microsoft/hcsshim v0.13.0
 	github.com/compose-spec/compose-go/v2 v2.6.2 //gomodjail:unconfined
 	github.com/containerd/accelerated-container-image v1.3.0
 	github.com/containerd/cgroups/v3 v3.0.5 //gomodjail:unconfined
diff --git a/go.sum b/go.sum
index cca14bfa126..5455c1222c1 100644
--- a/go.sum
+++ b/go.sum
@@ -10,8 +10,8 @@ github.com/Masterminds/semver/v3 v3.3.1 h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7r
 github.com/Masterminds/semver/v3 v3.3.1/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/Microsoft/hcsshim v0.13.0-rc.3 h1:c2Glm+kfftlSccp+rNIJ6mp1UppJYTq7q9SObIu3GZs=
-github.com/Microsoft/hcsshim v0.13.0-rc.3/go.mod h1:rc/I5c+x7rZHik6V5qj31JTATiLKh2BV7CsZpbNlt88=
+github.com/Microsoft/hcsshim v0.13.0 h1:/BcXOiS6Qi7N9XqUcv27vkIuVOkBEcWstd2pMlWSeaA=
+github.com/Microsoft/hcsshim v0.13.0/go.mod h1:9KWJ/8DgU+QzYGupX4tzMhRQE8h6w90lH6HAaclpEok=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=

From f4bf3913f2f6a345bf45be3ddfb4494a19c1ccfe Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Fri, 9 May 2025 23:49:15 +0900
Subject: [PATCH 181/225] release note: add containerd v2.1 as a compatible
 version

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 hack/generate-release-note.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hack/generate-release-note.sh b/hack/generate-release-note.sh
index 70276919be3..68f876e17f4 100755
--- a/hack/generate-release-note.sh
+++ b/hack/generate-release-note.sh
@@ -25,7 +25,7 @@ cat <<-EOX
 (To be documented)
 
 ## Compatible containerd versions
-This release of nerdctl is expected to be used with containerd v1.6, v1.7, or v2.0.
+This release of nerdctl is expected to be used with containerd v1.6, v1.7, v2.0, or v2.1.
 
 ## About the binaries
 - Minimal (\`${minimal_amd64tgz_basename}\`): nerdctl only

From db8eb683d7ed1f74c7d6ef4285a3efc89ad780fc Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Fri, 9 May 2025 23:53:24 +0900
Subject: [PATCH 182/225] update RootlessKit (2.3.5)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 Dockerfile                                   | 2 +-
 Dockerfile.d/SHA256SUMS.d/rootlesskit-v2.3.4 | 6 ------
 Dockerfile.d/SHA256SUMS.d/rootlesskit-v2.3.5 | 6 ++++++
 3 files changed, 7 insertions(+), 7 deletions(-)
 delete mode 100644 Dockerfile.d/SHA256SUMS.d/rootlesskit-v2.3.4
 create mode 100644 Dockerfile.d/SHA256SUMS.d/rootlesskit-v2.3.5

diff --git a/Dockerfile b/Dockerfile
index 25de5e11b6b..cf6fd3ee612 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -28,7 +28,7 @@ ARG STARGZ_SNAPSHOTTER_VERSION=v0.16.3@BINARY
 # Extra deps: Encryption
 ARG IMGCRYPT_VERSION=v2.0.1@c377ec98ff79ec9205eabf555ebd2ea784738c6c
 # Extra deps: Rootless
-ARG ROOTLESSKIT_VERSION=v2.3.4@BINARY
+ARG ROOTLESSKIT_VERSION=v2.3.5@BINARY
 ARG SLIRP4NETNS_VERSION=v1.3.2@BINARY
 # Extra deps: bypass4netns
 ARG BYPASS4NETNS_VERSION=v0.4.2@aa04bd3dcc48c6dae6d7327ba219bda8fe2a4634
diff --git a/Dockerfile.d/SHA256SUMS.d/rootlesskit-v2.3.4 b/Dockerfile.d/SHA256SUMS.d/rootlesskit-v2.3.4
deleted file mode 100644
index 00b02832926..00000000000
--- a/Dockerfile.d/SHA256SUMS.d/rootlesskit-v2.3.4
+++ /dev/null
@@ -1,6 +0,0 @@
-bc07dc45ebc9d19da033ddf4f2f93588d0acef5461d4daabb818f27942db6a22  rootlesskit-aarch64.tar.gz
-6d6b9d4749e7e20fea70b63e924323a735fbe7582bdc155cc1332bfd52952b18  rootlesskit-armv7l.tar.gz
-db320896ae94cfc08cf1765170c44ea67d3a87d8566e5ce55ca4650fdb7117b9  rootlesskit-ppc64le.tar.gz
-d17c9a854277f00bb9285495baf74cbcb7cfd970287dd0e68d7c679d112c05f5  rootlesskit-riscv64.tar.gz
-64302b1816aeb9f0b9e80834409c46e0603fb9bedac840f8c6d3b3281fe84b7e  rootlesskit-s390x.tar.gz
-86639a7d1af2b37413cf98d390b4c38597b88d6ab48749985c0ea30b6fb9eed7  rootlesskit-x86_64.tar.gz
diff --git a/Dockerfile.d/SHA256SUMS.d/rootlesskit-v2.3.5 b/Dockerfile.d/SHA256SUMS.d/rootlesskit-v2.3.5
new file mode 100644
index 00000000000..96d484fe5c7
--- /dev/null
+++ b/Dockerfile.d/SHA256SUMS.d/rootlesskit-v2.3.5
@@ -0,0 +1,6 @@
+478c14c3195bf989cd9a8e6bd129d227d5d88f1c11418967ffdc84a0072cc7a2  rootlesskit-aarch64.tar.gz
+0622e52952a848219b86b902c9bdb96e1ebe575a3015c05e7da02569e83b3a61  rootlesskit-armv7l.tar.gz
+b1ec12321c54860230c5d0bbbc6d651a746ac49bce7eeb36fd1ad1e0f0048d58  rootlesskit-ppc64le.tar.gz
+8ee59e518cdb5770afab49307b400f585598ed2c06b4ffc81f7c36fbeea422d6  rootlesskit-riscv64.tar.gz
+2a3198947cf322357106557c58a8d5f29a664961edf290ea305c94b03521f6c8  rootlesskit-s390x.tar.gz
+118208e25becd144ee7317c172fc9decce7b16174d5c1bbf80f1d1d0eacc6b5f  rootlesskit-x86_64.tar.gz

From fe5f1d1071ea8e52b06abbbbda47ca81c0a8e2a7 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Fri, 9 May 2025 23:54:53 +0900
Subject: [PATCH 183/225] update fuse-overlayfs (1.15)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 Dockerfile                                     | 2 +-
 Dockerfile.d/SHA256SUMS.d/fuse-overlayfs-v1.14 | 2 --
 Dockerfile.d/SHA256SUMS.d/fuse-overlayfs-v1.15 | 6 ++++++
 3 files changed, 7 insertions(+), 3 deletions(-)
 delete mode 100644 Dockerfile.d/SHA256SUMS.d/fuse-overlayfs-v1.14
 create mode 100644 Dockerfile.d/SHA256SUMS.d/fuse-overlayfs-v1.15

diff --git a/Dockerfile b/Dockerfile
index cf6fd3ee612..3ed329be513 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -33,7 +33,7 @@ ARG SLIRP4NETNS_VERSION=v1.3.2@BINARY
 # Extra deps: bypass4netns
 ARG BYPASS4NETNS_VERSION=v0.4.2@aa04bd3dcc48c6dae6d7327ba219bda8fe2a4634
 # Extra deps: FUSE-OverlayFS
-ARG FUSE_OVERLAYFS_VERSION=v1.14@BINARY
+ARG FUSE_OVERLAYFS_VERSION=v1.15@BINARY
 ARG CONTAINERD_FUSE_OVERLAYFS_VERSION=v2.1.2@BINARY
 # Extra deps: Init
 ARG TINI_VERSION=v0.19.0@BINARY
diff --git a/Dockerfile.d/SHA256SUMS.d/fuse-overlayfs-v1.14 b/Dockerfile.d/SHA256SUMS.d/fuse-overlayfs-v1.14
deleted file mode 100644
index 4ef7dca0da1..00000000000
--- a/Dockerfile.d/SHA256SUMS.d/fuse-overlayfs-v1.14
+++ /dev/null
@@ -1,2 +0,0 @@
-bf2c19b80e68afe1f53bae7a08cc9e7fb2f1b49bfdb9e5b49ab87cbe80b97cd1  fuse-overlayfs-aarch64
-4817a8896a9e6f0433080f88f5b71dec931e8829a89d64c71af94b0630ccb4a9  fuse-overlayfs-x86_64
diff --git a/Dockerfile.d/SHA256SUMS.d/fuse-overlayfs-v1.15 b/Dockerfile.d/SHA256SUMS.d/fuse-overlayfs-v1.15
new file mode 100644
index 00000000000..f3eea29017e
--- /dev/null
+++ b/Dockerfile.d/SHA256SUMS.d/fuse-overlayfs-v1.15
@@ -0,0 +1,6 @@
+a62829baa7a7d39d0a9a784d51ebd528efe226192c0a86ba6667d0fcae9129c3  fuse-overlayfs-aarch64
+7ad67a810100bebf63c41fbb621df3d552531db94d600a94f5f701b1e9f8aa5a  fuse-overlayfs-armv7l
+9778e1f0da1429469bcc65ea90a7504e63f0a258089b9bb1ae65105330e61808  fuse-overlayfs-ppc64le
+f7a2852983b3d0a8f15c31084c215b4965d5b62b9ce1014708283dd2dd909b28  fuse-overlayfs-riscv64
+89a410a67822002c20ff21d8a9e5353ebda00d3a2f79fd99f26fb47533e253a5  fuse-overlayfs-s390x
+1cd97f5ca7ac52fa192c94c1e605713cfb27d3dc417c0bef4dcfb9fb20e01e81  fuse-overlayfs-x86_64

From 4c8b367c5568b794d32c30789bcd50489d6c5f81 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Fri, 9 May 2025 23:55:26 +0900
Subject: [PATCH 184/225] update containerd-fuse-overlayfs (2.1.5)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 Dockerfile                                                 | 2 +-
 Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.2 | 6 ------
 Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.5 | 6 ++++++
 3 files changed, 7 insertions(+), 7 deletions(-)
 delete mode 100644 Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.2
 create mode 100644 Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.5

diff --git a/Dockerfile b/Dockerfile
index 3ed329be513..87bdf25b79e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -34,7 +34,7 @@ ARG SLIRP4NETNS_VERSION=v1.3.2@BINARY
 ARG BYPASS4NETNS_VERSION=v0.4.2@aa04bd3dcc48c6dae6d7327ba219bda8fe2a4634
 # Extra deps: FUSE-OverlayFS
 ARG FUSE_OVERLAYFS_VERSION=v1.15@BINARY
-ARG CONTAINERD_FUSE_OVERLAYFS_VERSION=v2.1.2@BINARY
+ARG CONTAINERD_FUSE_OVERLAYFS_VERSION=v2.1.5@BINARY
 # Extra deps: Init
 ARG TINI_VERSION=v0.19.0@BINARY
 # Extra deps: Debug
diff --git a/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.2 b/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.2
deleted file mode 100644
index 260fe0dedad..00000000000
--- a/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.2
+++ /dev/null
@@ -1,6 +0,0 @@
-b484d76468b7e91e215c7bdab99eb6322e3c396707cd72c3571d8bc6a62f4fb5  containerd-fuse-overlayfs-2.1.2-linux-amd64.tar.gz
-35648602f4eea1a84095ac19ca63752e3a9faa2e1a3b9ba95c6e555aee932820  containerd-fuse-overlayfs-2.1.2-linux-arm-v7.tar.gz
-0d9a75ef98e4538f039fea3da621560fd2b85a6bc34735f189121decf7d2266b  containerd-fuse-overlayfs-2.1.2-linux-arm64.tar.gz
-02a4f9c90b2fbabd4326a19f7659638b36910c4633fe1772f44da6239c4e95fa  containerd-fuse-overlayfs-2.1.2-linux-ppc64le.tar.gz
-febd653d766cc724383045509b6958d8f1bdfc4d4b8d5027099d7760c6374dca  containerd-fuse-overlayfs-2.1.2-linux-riscv64.tar.gz
-44a6c830d3371d522033ac47a2f90b6be12311d72a8b290a70d73771aa062e6c  containerd-fuse-overlayfs-2.1.2-linux-s390x.tar.gz
diff --git a/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.5 b/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.5
new file mode 100644
index 00000000000..faf34421cfb
--- /dev/null
+++ b/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.5
@@ -0,0 +1,6 @@
+acc149d60e2fad0cff480852c82f39bdaae2eb6faa265b2028c944ec572014f9  containerd-fuse-overlayfs-2.1.5-linux-amd64.tar.gz
+2c1c12a99ac16e6ad137c474517d04cc7864d26d9045f50f99a6d6e887b9c425  containerd-fuse-overlayfs-2.1.5-linux-arm-v7.tar.gz
+17759de9588cda1499877cc9587189eb24731ae41edda201087fd74658ddc127  containerd-fuse-overlayfs-2.1.5-linux-arm64.tar.gz
+ce0310573fd667a2fa348588b12f1867a1bad5befc79d7d39e6419a7d4687ea8  containerd-fuse-overlayfs-2.1.5-linux-ppc64le.tar.gz
+e9bbb9835346d8007a6429151eb7c7b23fa1f20b85aa6d20dd3702cb5a4c038a  containerd-fuse-overlayfs-2.1.5-linux-riscv64.tar.gz
+c088a7eee9b75f0a759e52d1ae2c8d69d21265594070f41021a94523d1c7bab1  containerd-fuse-overlayfs-2.1.5-linux-s390x.tar.gz

From a80f95f8fcc3a49ff8647ddf190b6e26432962f1 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Fri, 9 May 2025 23:56:11 +0900
Subject: [PATCH 185/225] update gotestsum (1.12.2)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 87bdf25b79e..533f16eba18 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -47,7 +47,7 @@ ARG GOMODJAIL_VERSION=v0.1.2@0a86b34442a491fa8f5e4565e9c846fce310239c
 ARG GO_VERSION=1.24
 ARG UBUNTU_VERSION=24.04
 ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.1
-ARG GOTESTSUM_VERSION=v1.12.1
+ARG GOTESTSUM_VERSION=v1.12.2
 ARG NYDUS_VERSION=v2.3.1
 ARG SOCI_SNAPSHOTTER_VERSION=0.9.0
 ARG KUBO_VERSION=v0.34.1

From 9cb28b4a31a44c79f5ccc2ecaf3b67a4b5a65a7b Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Sat, 10 May 2025 00:26:00 +0900
Subject: [PATCH 186/225] MAINTAINERS: add Shubharanshu Mahapatra
 (Shubhranshu153) as a REVIEWER

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 8fbc21ebdf6..d245e39c902 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -22,6 +22,7 @@
 # GitHub ID, Name, Email address, GPG fingerprint
 "jsturtevant","James Sturtevant","jstur@microsoft.com",""
 "manugupt1", "Manu Gupta", "manugupt1@gmail.com","FCA9 504A 4118 EA5C F466 CC30 A5C3 A8F4 E7FE 9E10"
+"Shubhranshu153","Shubharanshu Mahapatra","shubhum@amazon.com",""
 
 # EMERITUS
 # See EMERITUS.md

From bf7dac3c63cc441e3c24327dd3f3eee1c4acfe29 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 9 May 2025 09:40:45 -0700
Subject: [PATCH 187/225] CI: pin docker to a specific version

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/job-test-in-host.yml | 26 +++++++++--
 .github/workflows/workflow-test.yml    |  1 +
 hack/provisioning/gpg/docker           | 62 ++++++++++++++++++++++++++
 3 files changed, 85 insertions(+), 4 deletions(-)
 create mode 100644 hack/provisioning/gpg/docker

diff --git a/.github/workflows/job-test-in-host.yml b/.github/workflows/job-test-in-host.yml
index f3d73cdae91..f760c74780f 100644
--- a/.github/workflows/job-test-in-host.yml
+++ b/.github/workflows/job-test-in-host.yml
@@ -22,6 +22,9 @@ on:
       go-version:
         required: true
         type: string
+      docker-version:
+        required: true
+        type: string
       containerd-version:
         required: true
         type: string
@@ -105,7 +108,18 @@ jobs:
             echo "::group:: configure cdi for docker"
             sudo mkdir -p /etc/docker
             sudo jq '.features.cdi = true' /etc/docker/daemon.json | sudo tee /etc/docker/daemon.json.tmp && sudo mv /etc/docker/daemon.json.tmp /etc/docker/daemon.json
-            sudo systemctl restart docker
+            echo "::endgroup::"
+            echo "::group:: downgrade docker to the specific version we want to test (${{ inputs.docker-version }})"
+            sudo apt-get update -qq
+            sudo apt-get install -qq ca-certificates curl
+            sudo install -m 0755 -d /etc/apt/keyrings
+            sudo cp ./hack/provisioning/gpg/docker /etc/apt/keyrings/docker.asc
+            sudo chmod a+r /etc/apt/keyrings/docker.asc
+            echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
+              $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" \
+              | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+            sudo apt-get update -qq
+            sudo apt-get install -qq --allow-downgrades docker-ce=${{ inputs.docker-version }} docker-ce-cli=${{ inputs.docker-version }}
             echo "::endgroup::"
           else
             # FIXME: this is missing runc (see top level workflow note about the state of this)
@@ -129,12 +143,16 @@ jobs:
           # Since some arm64 platforms do provide native fallback execution for 32 bits,
           # armv7 emulation may or may not be installed, causing variance in the result of `uname -m`.
           # To avoid that, we explicitly list the architectures we do want emulation for.
-          docker run --privileged --rm tonistiigi/binfmt --install linux/amd64
-          docker run --privileged --rm tonistiigi/binfmt --install linux/arm64
-          docker run --privileged --rm tonistiigi/binfmt --install linux/arm/v7
+          echo "::group:: install binfmt"
+          docker run --quiet --privileged --rm tonistiigi/binfmt --install linux/amd64
+          docker run --quiet --privileged --rm tonistiigi/binfmt --install linux/arm64
+          docker run --quiet --privileged --rm tonistiigi/binfmt --install linux/arm/v7
+          echo "::endgroup::"
 
           # FIXME: remove expect when we are done removing unbuffer from tests
+          echo "::group:: installing test dependencies"
           sudo apt-get install -qq expect
+          echo "::endgroup::"
 
       - if: ${{ contains(inputs.runner, 'windows') && env.SHOULD_RUN == 'yes' }}
         name: "Init (windows): prepare host"
diff --git a/.github/workflows/workflow-test.yml b/.github/workflows/workflow-test.yml
index c54e9deb570..ef6748b3649 100644
--- a/.github/workflows/workflow-test.yml
+++ b/.github/workflows/workflow-test.yml
@@ -140,6 +140,7 @@ jobs:
       canary: ${{ matrix.canary && true || false }}
       go-version: 1.24
       windows-cni-version: v0.3.1
+      docker-version: 5:28.0.4-1~ubuntu.24.04~noble
       containerd-version: 2.1.0
       # Note: these as for amd64
       containerd-sha: 0e5359e957b66b679be807563a543c7416e305e3aafcf56bad90ef87a917014d
diff --git a/hack/provisioning/gpg/docker b/hack/provisioning/gpg/docker
new file mode 100644
index 00000000000..ee7872e5d03
--- /dev/null
+++ b/hack/provisioning/gpg/docker
@@ -0,0 +1,62 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFit2ioBEADhWpZ8/wvZ6hUTiXOwQHXMAlaFHcPH9hAtr4F1y2+OYdbtMuth
+lqqwp028AqyY+PRfVMtSYMbjuQuu5byyKR01BbqYhuS3jtqQmljZ/bJvXqnmiVXh
+38UuLa+z077PxyxQhu5BbqntTPQMfiyqEiU+BKbq2WmANUKQf+1AmZY/IruOXbnq
+L4C1+gJ8vfmXQt99npCaxEjaNRVYfOS8QcixNzHUYnb6emjlANyEVlZzeqo7XKl7
+UrwV5inawTSzWNvtjEjj4nJL8NsLwscpLPQUhTQ+7BbQXAwAmeHCUTQIvvWXqw0N
+cmhh4HgeQscQHYgOJjjDVfoY5MucvglbIgCqfzAHW9jxmRL4qbMZj+b1XoePEtht
+ku4bIQN1X5P07fNWzlgaRL5Z4POXDDZTlIQ/El58j9kp4bnWRCJW0lya+f8ocodo
+vZZ+Doi+fy4D5ZGrL4XEcIQP/Lv5uFyf+kQtl/94VFYVJOleAv8W92KdgDkhTcTD
+G7c0tIkVEKNUq48b3aQ64NOZQW7fVjfoKwEZdOqPE72Pa45jrZzvUFxSpdiNk2tZ
+XYukHjlxxEgBdC/J3cMMNRE1F4NCA3ApfV1Y7/hTeOnmDuDYwr9/obA8t016Yljj
+q5rdkywPf4JF8mXUW5eCN1vAFHxeg9ZWemhBtQmGxXnw9M+z6hWwc6ahmwARAQAB
+tCtEb2NrZXIgUmVsZWFzZSAoQ0UgZGViKSA8ZG9ja2VyQGRvY2tlci5jb20+iQI3
+BBMBCgAhBQJYrefAAhsvBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEI2BgDwO
+v82IsskP/iQZo68flDQmNvn8X5XTd6RRaUH33kXYXquT6NkHJciS7E2gTJmqvMqd
+tI4mNYHCSEYxI5qrcYV5YqX9P6+Ko+vozo4nseUQLPH/ATQ4qL0Zok+1jkag3Lgk
+jonyUf9bwtWxFp05HC3GMHPhhcUSexCxQLQvnFWXD2sWLKivHp2fT8QbRGeZ+d3m
+6fqcd5Fu7pxsqm0EUDK5NL+nPIgYhN+auTrhgzhK1CShfGccM/wfRlei9Utz6p9P
+XRKIlWnXtT4qNGZNTN0tR+NLG/6Bqd8OYBaFAUcue/w1VW6JQ2VGYZHnZu9S8LMc
+FYBa5Ig9PxwGQOgq6RDKDbV+PqTQT5EFMeR1mrjckk4DQJjbxeMZbiNMG5kGECA8
+g383P3elhn03WGbEEa4MNc3Z4+7c236QI3xWJfNPdUbXRaAwhy/6rTSFbzwKB0Jm
+ebwzQfwjQY6f55MiI/RqDCyuPj3r3jyVRkK86pQKBAJwFHyqj9KaKXMZjfVnowLh
+9svIGfNbGHpucATqREvUHuQbNnqkCx8VVhtYkhDb9fEP2xBu5VvHbR+3nfVhMut5
+G34Ct5RS7Jt6LIfFdtcn8CaSas/l1HbiGeRgc70X/9aYx/V/CEJv0lIe8gP6uDoW
+FPIZ7d6vH+Vro6xuWEGiuMaiznap2KhZmpkgfupyFmplh0s6knymuQINBFit2ioB
+EADneL9S9m4vhU3blaRjVUUyJ7b/qTjcSylvCH5XUE6R2k+ckEZjfAMZPLpO+/tF
+M2JIJMD4SifKuS3xck9KtZGCufGmcwiLQRzeHF7vJUKrLD5RTkNi23ydvWZgPjtx
+Q+DTT1Zcn7BrQFY6FgnRoUVIxwtdw1bMY/89rsFgS5wwuMESd3Q2RYgb7EOFOpnu
+w6da7WakWf4IhnF5nsNYGDVaIHzpiqCl+uTbf1epCjrOlIzkZ3Z3Yk5CM/TiFzPk
+z2lLz89cpD8U+NtCsfagWWfjd2U3jDapgH+7nQnCEWpROtzaKHG6lA3pXdix5zG8
+eRc6/0IbUSWvfjKxLLPfNeCS2pCL3IeEI5nothEEYdQH6szpLog79xB9dVnJyKJb
+VfxXnseoYqVrRz2VVbUI5Blwm6B40E3eGVfUQWiux54DspyVMMk41Mx7QJ3iynIa
+1N4ZAqVMAEruyXTRTxc9XW0tYhDMA/1GYvz0EmFpm8LzTHA6sFVtPm/ZlNCX6P1X
+zJwrv7DSQKD6GGlBQUX+OeEJ8tTkkf8QTJSPUdh8P8YxDFS5EOGAvhhpMBYD42kQ
+pqXjEC+XcycTvGI7impgv9PDY1RCC1zkBjKPa120rNhv/hkVk/YhuGoajoHyy4h7
+ZQopdcMtpN2dgmhEegny9JCSwxfQmQ0zK0g7m6SHiKMwjwARAQABiQQ+BBgBCAAJ
+BQJYrdoqAhsCAikJEI2BgDwOv82IwV0gBBkBCAAGBQJYrdoqAAoJEH6gqcPyc/zY
+1WAP/2wJ+R0gE6qsce3rjaIz58PJmc8goKrir5hnElWhPgbq7cYIsW5qiFyLhkdp
+YcMmhD9mRiPpQn6Ya2w3e3B8zfIVKipbMBnke/ytZ9M7qHmDCcjoiSmwEXN3wKYI
+mD9VHONsl/CG1rU9Isw1jtB5g1YxuBA7M/m36XN6x2u+NtNMDB9P56yc4gfsZVES
+KA9v+yY2/l45L8d/WUkUi0YXomn6hyBGI7JrBLq0CX37GEYP6O9rrKipfz73XfO7
+JIGzOKZlljb/D9RX/g7nRbCn+3EtH7xnk+TK/50euEKw8SMUg147sJTcpQmv6UzZ
+cM4JgL0HbHVCojV4C/plELwMddALOFeYQzTif6sMRPf+3DSj8frbInjChC3yOLy0
+6br92KFom17EIj2CAcoeq7UPhi2oouYBwPxh5ytdehJkoo+sN7RIWua6P2WSmon5
+U888cSylXC0+ADFdgLX9K2zrDVYUG1vo8CX0vzxFBaHwN6Px26fhIT1/hYUHQR1z
+VfNDcyQmXqkOnZvvoMfz/Q0s9BhFJ/zU6AgQbIZE/hm1spsfgvtsD1frZfygXJ9f
+irP+MSAI80xHSf91qSRZOj4Pl3ZJNbq4yYxv0b1pkMqeGdjdCYhLU+LZ4wbQmpCk
+SVe2prlLureigXtmZfkqevRz7FrIZiu9ky8wnCAPwC7/zmS18rgP/17bOtL4/iIz
+QhxAAoAMWVrGyJivSkjhSGx1uCojsWfsTAm11P7jsruIL61ZzMUVE2aM3Pmj5G+W
+9AcZ58Em+1WsVnAXdUR//bMmhyr8wL/G1YO1V3JEJTRdxsSxdYa4deGBBY/Adpsw
+24jxhOJR+lsJpqIUeb999+R8euDhRHG9eFO7DRu6weatUJ6suupoDTRWtr/4yGqe
+dKxV3qQhNLSnaAzqW/1nA3iUB4k7kCaKZxhdhDbClf9P37qaRW467BLCVO/coL3y
+Vm50dwdrNtKpMBh3ZpbB1uJvgi9mXtyBOMJ3v8RZeDzFiG8HdCtg9RvIt/AIFoHR
+H3S+U79NT6i0KPzLImDfs8T7RlpyuMc4Ufs8ggyg9v3Ae6cN3eQyxcK3w0cbBwsh
+/nQNfsA6uu+9H7NhbehBMhYnpNZyrHzCmzyXkauwRAqoCbGCNykTRwsur9gS41TQ
+M8ssD1jFheOJf3hODnkKU+HKjvMROl1DK7zdmLdNzA1cvtZH/nCC9KPj1z8QC47S
+xx+dTZSx4ONAhwbS/LN3PoKtn8LPjY9NP9uDWI+TWYquS2U+KHDrBDlsgozDbs/O
+jCxcpDzNmXpWQHEtHU7649OXHP7UeNST1mCUCH5qdank0V1iejF6/CfTFU4MfcrG
+YT90qFF93M3v01BbxP+EIY2/9tiIPbrd
+=0YYh
+-----END PGP PUBLIC KEY BLOCK-----

From a6585dd1227d51ea640e130ad83662339f695413 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 9 May 2025 10:33:06 -0700
Subject: [PATCH 188/225] Carry a copy of vagrant gpg key

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/job-test-in-vagrant.yml |  2 +-
 hack/provisioning/gpg/hashicorp           | 64 +++++++++++++++++++++++
 2 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 hack/provisioning/gpg/hashicorp

diff --git a/.github/workflows/job-test-in-vagrant.yml b/.github/workflows/job-test-in-vagrant.yml
index 843606c0987..2c12637326e 100644
--- a/.github/workflows/job-test-in-vagrant.yml
+++ b/.github/workflows/job-test-in-vagrant.yml
@@ -35,7 +35,7 @@ jobs:
           # from https://github.com/containerd/containerd/blob/v2.0.2/.github/workflows/ci.yml#L583-L596
           # which is based on https://github.com/opencontainers/runc/blob/v1.1.8/.cirrus.yml#L41-L49
           # FIXME: https://github.com/containerd/nerdctl/issues/4163
-          curl -fsSL --proto '=https' --tlsv1.2 https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
+          cat ./hack/provisioning/gpg/hashicorp | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
           echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
           sudo sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/ubuntu.sources
           sudo apt-get update -qq
diff --git a/hack/provisioning/gpg/hashicorp b/hack/provisioning/gpg/hashicorp
new file mode 100644
index 00000000000..495865561d5
--- /dev/null
+++ b/hack/provisioning/gpg/hashicorp
@@ -0,0 +1,64 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGO9u+MBEADmE9i8rpt8xhRqxbzlBG06z3qe+e1DI+SyjscyVVRcGDrEfo+J
+W5UWw0+afey7HFkaKqKqOHVVGSjmh6HO3MskxcpRm/pxRzfni/OcBBuJU2DcGXnG
+nuRZ+ltqBncOuONi6Wf00McTWviLKHRrP6oWwWww7sYF/RbZp5xGmMJ2vnsNhtp3
+8LIMOmY2xv9LeKMh++WcxQDpIeRohmSJyknbjJ0MNlhnezTIPajrs1laLh/IVKVz
+7/Z73UWX+rWI/5g+6yBSEtj368N7iyq+hUvQ/bL00eyg1Gs8nE1xiCmRHdNjMBLX
+lHi0V9fYgg3KVGo6Hi/Is2gUtmip4ZPnThVmB5fD5LzS7Y5joYVjHpwUtMD0V3s1
+HiHAUbTH+OY2JqxZDO9iW8Gl0rCLkfaFDBS2EVLPjo/kq9Sn7vfp2WHffWs1fzeB
+HI6iUl2AjCCotK61nyMR33rNuNcbPbp+17NkDEy80YPDRbABdgb+hQe0o8htEB2t
+CDA3Ev9t2g9IC3VD/jgncCRnPtKP3vhEhlhMo3fUCnJI7XETgbuGntLRHhmGJpTj
+ydudopoMWZAU/H9KxJvwlVXiNoBYFvdoxhV7/N+OBQDLMevB8XtPXNQ8ZOEHl22G
+hbL8I1c2SqjEPCa27OIccXwNY+s0A41BseBr44dmu9GoQVhI7TsetpR+qwARAQAB
+tFFIYXNoaUNvcnAgU2VjdXJpdHkgKEhhc2hpQ29ycCBQYWNrYWdlIFNpZ25pbmcp
+IDxzZWN1cml0eStwYWNrYWdpbmdAaGFzaGljb3JwLmNvbT6JAlQEEwEIAD4CGwMF
+CwkIBwIGFQoJCAsCBBYCAwECHgECF4AWIQR5iuxlTlwVQoyOQu6qFvy8piHnAQUC
+Y728PQUJCWYB2gAKCRCqFvy8piHnAd16EADeBtTgkdVEvct40TH/9HKkR/Lc/ohM
+rer6FFHdKmceJ6Ma8/Qm4nCO5C7c4+EPjsUXdhK5w8DSdC5VbKLJDY1EnDlmU5B1
+wSFkGoYKoB8lUn30E77E33MTu2kfrSuF605vetq269CyBwIJV7oNN6311dW8iQ6z
+IytTtlJbVr4YZ7Vst40/uR4myumk9bVBGEd6JhFAPmr/um+BZFhRf9/8xtOryOyB
+GF2d+bc9IoAugpxwv0IowHEqkI4RpK2U9hvxG80sTOcmerOuFbmNyPwnEgtJ6CM1
+bc8WAmObJiQcRSLbcgF+a7+2wqrUbCqRE7QoS2wjd1HpUVPmSdJN925c2uaua2A4
+QCbTEg8kV2HiP0HGXypVNhZJt5ouo0YgR6BSbMlsMHniDQaSIP1LgmEz5xD4UAxO
+Y/GRR3LWojGzVzBb0T98jpDgPtOu/NpKx3jhSpE2U9h/VRDiL/Pf7gvEIxPUTKuV
+5D8VqAiXovlk4wSH13Q05d9dIAjuinSlxb4DVr8IL0lmx9DyHehticmJVooHDyJl
+HoA2q2tFnlBBAFbN92662q8Pqi9HbljVRTD1vUjof6ohaoM+5K1C043dmcwZZMTc
+7gV1rbCuxh69rILpjwM1stqgI1ONUIkurKVGZHM6N2AatNKqtBRdGEroQo1aL4+4
+u+DKFrMxOqa5b7kCDQRjvbwTARAA0ut7iKLj9sOcp5kRG/5V+T0Ak2k2GSus7w8e
+kFh468SVCNUgLJpLzc5hBiXACQX6PEnyhLZa8RAG+ehBfPt03GbxW6cK9nx7HRFQ
+GA79H5B4AP3XdEdT1gIL2eaHdQot0mpF2b07GNfADgj99MhpxMCtTdVbBqHY8YEQ
+Uq7+E9UCNNs45w5ddq07EDk+o6C3xdJ42fvS2x44uNH6Z6sdApPXLrybeun74C1Z
+Oo4Ypre4+xkcw2q2WIhy0Qzeuw+9tn4CYjrhw/+fvvPGUAhtYlFGF6bSebmyua8Q
+MTKhwqHqwJxpjftM3ARdgFkhlH1H+PcmpnVutgTNKGcy+9b/lu/Rjq/47JZ+5VkK
+ZtYT/zO1oW5zRklHvB6R/OcSlXGdC0mfReIBcNvuNlLhNcBA9frNdOk3hpJgYDzg
+f8Ykkc+4z8SZ9gA3g0JmDHY1X3SnSadSPyMas3zH5W+16rq9E+MZztR0RWwmpDtg
+Ff1XGMmvc+FVEB8dRLKFWSt/E1eIhsK2CRnaR8uotKW/A/gosao0E3mnIygcyLB4
+fnOM3mnTF3CcRumxJvnTEmSDcoKSOpv0xbFgQkRAnVSn/gHkcbVw/ZnvZbXvvseh
+7dstp2ljCs0queKU+Zo22TCzZqXX/AINs/j9Ll67NyIJev445l3+0TWB0kego5Fi
+UVuSWkMAEQEAAYkEcgQYAQgAJhYhBHmK7GVOXBVCjI5C7qoW/LymIecBBQJjvbwT
+AhsCBQkJZgGAAkAJEKoW/LymIecBwXQgBBkBCAAdFiEE6wr14plJaVlvmYc+cG5m
+g2nAhekFAmO9vBMACgkQcG5mg2nAhenPURAAimI0EBZbqpyHpwpbeYq3Pygg1bdo
+IlBQUVoutaN1lR7kqGXwYH+BP6G40x79LwVy/fWV8gO7cDX6D1yeKLNbhnJHPBus
+FJDmzDPbjTlyWlDqJoWMiPqfAOc1A1cHodsUJDUlA01j1rPTho0S9iALX5R50Wa9
+sIenpfe7RVunDwW5gw6y8me7ncl5trD0LM2HURw6nYnLrxePiTAF1MF90jrAhJDV
++krYqd6IFq5RHKveRtCuTvpL7DlgVCtntmbXLbVC/Fbv6w1xY3A7rXko/03nswAi
+AXHKMP14UutVEcLYDBXbDrvgpb2p2ZUJnujs6cNyx9cOPeuxnke8+ACWvpnWxwjL
+M5u8OckiqzRRobNxQZ1vLxzdovYTwTlUAG7QjIXVvOk9VNp/ERhh0eviZK+1/ezk
+Z8nnPjx+elThQ+r16EM7hD0RDXtOR1VZ0R3OL64AlZYDZz1jEA3lrGhvbjSIfBQk
+T6mxKUsCy3YbElcOyuohmPRgT1iVDIZ/1iPL0Q0HGm4+EsWCdH6fAPB7TlHD8z2D
+7JCFLihFDWs5lrZyuWMO9nryZiVjJrOLPcStgJYVd/MhRHR4hC6g09bgo25RMJ6f
+gyzL4vlEB7aSUih7yjgL9s5DKXP2J71dAhIlF8nnM403R2xEeHyivnyeR/9Ifn7M
+PJvUMUuoG+ZANSMkrw//XA31o//TVk9WsLD1Edxt5XZCoR+fS+Vz8ScLwP1d/vQE
+OW/EWzeMRG15C0td1lfHvwPKvf2MN+WLenp9TGZ7A1kEHIpjKvY51AIkX2kW5QLu
+Y3LBb+HGiZ6j7AaU4uYR3kS1+L79v4kyvhhBOgx/8V+b3+2pQIsVOp79ySGvVwpL
+FJ2QUgO15hnlQJrFLRYa0PISKrSWf35KXAy04mjqCYqIGkLsz2qQCY2lGcD5k05z
+bBC4TvxwVxv0ftl2C5Bd0ydl/2YM7GfLrmZmTijK067t4OO+2SROT2oYPDsMtZ6S
+E8vUXvoGpQ8tf5Nkrn2t0zDG3UDtgZY5UVYnZI+xT7WHsCz//8fY3QMvPXAuc33T
+vVdiSfP0aBnZXj6oGs/4Vl1Dmm62XLr13+SMoepMWg2Vt7C8jqKOmhFmSOWyOmRH
+UZJR7nKvTpFnL8atSyFDa4o1bk2U3alOscWS8u8xJ/iMcoONEBhItft6olpMVdzP
+CTrnCAqMjTSPlQU/9EGtp21KQBed2KdAsJBYuPgwaQeyNIvQEOXmINavl58VD72Y
+2T4TFEY8dUiExAYpSodbwBL2fr8DJxOX68WH6e3fF7HwX8LRBjZq0XUwh0KxgHN+
+b9gGXBvgWnJr4NSQGGPiSQVNNHt2ZcBAClYhm+9eC5/VwB+Etg4+1wDmggztiqE=
+=FdUF
+-----END PGP PUBLIC KEY BLOCK-----
\ No newline at end of file

From 9b1cd0822be81e094043291f048e2b0a0ae0203c Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 9 May 2025 12:05:07 -0700
Subject: [PATCH 189/225] Fix flaky diff test

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/container/container_diff_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmd/nerdctl/container/container_diff_test.go b/cmd/nerdctl/container/container_diff_test.go
index dc09244a3a0..b2ab02191ab 100644
--- a/cmd/nerdctl/container/container_diff_test.go
+++ b/cmd/nerdctl/container/container_diff_test.go
@@ -39,7 +39,7 @@ func TestDiff(t *testing.T) {
 	testCase.Require = require.Not(require.Windows)
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
-		helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage,
+		helpers.Ensure("run", "--name", data.Identifier(), testutil.CommonImage,
 			"sh", "-euxc", "touch /a; touch /bin/b; rm /bin/base64")
 	}
 

From 7680b12378362c6c4bcae77fff7dce19042d1719 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 9 May 2025 13:09:23 -0700
Subject: [PATCH 190/225] Clarify corner case on Tigron WithFeeder

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 mod/tigron/internal/com/command.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mod/tigron/internal/com/command.go b/mod/tigron/internal/com/command.go
index c8cd6c3d21b..869a2589de2 100644
--- a/mod/tigron/internal/com/command.go
+++ b/mod/tigron/internal/com/command.go
@@ -150,6 +150,7 @@ func (gc *Command) WithPTY(stdin, stdout, stderr bool) {
 // WithFeeder ensures that the provider function will be executed and its output fed to the command stdin.
 // WithFeeder, like Feed, can be used multiple times, and writes will be performed sequentially, in order.
 // This command has no effect if Run has already been called.
+// Note that if the `writer` function runs a forever loop, we will deadlock and just Wait() forever on the errgroup.
 func (gc *Command) WithFeeder(writers ...func() io.Reader) {
 	gc.writers = append(gc.writers, writers...)
 }

From 38f07ca97f01547eaec6bcdb8cf880f3b6cf6ebb Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 9 May 2025 14:34:28 -0700
Subject: [PATCH 191/225] (re)-tackle CNI concurrency issues

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 pkg/netutil/netutil.go | 146 ++++++++++++++---------------------------
 pkg/netutil/store.go   | 100 ++++++++++++++++++++++++++++
 pkg/ocihook/ocihook.go |   4 +-
 3 files changed, 153 insertions(+), 97 deletions(-)
 create mode 100644 pkg/netutil/store.go

diff --git a/pkg/netutil/netutil.go b/pkg/netutil/netutil.go
index e97a9125c58..cbcc27bfde9 100644
--- a/pkg/netutil/netutil.go
+++ b/pkg/netutil/netutil.go
@@ -38,7 +38,6 @@ import (
 
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
 	"github.com/containerd/nerdctl/v2/pkg/labels"
-	"github.com/containerd/nerdctl/v2/pkg/lockutil"
 	"github.com/containerd/nerdctl/v2/pkg/netutil/nettype"
 	subnetutil "github.com/containerd/nerdctl/v2/pkg/netutil/subnet"
 	"github.com/containerd/nerdctl/v2/pkg/strutil"
@@ -53,14 +52,7 @@ type CNIEnv struct {
 type CNIEnvOpt func(e *CNIEnv) error
 
 func (e *CNIEnv) ListNetworksMatch(reqs []string, allowPseudoNetwork bool) (list map[string][]*NetworkConfig, errs []error) {
-	var err error
-
-	var networkConfigs []*NetworkConfig
-	// NOTE: we cannot lock NetconfPath directly, as Cilium (maybe others) are also locking it.
-	err = lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), func() error {
-		networkConfigs, err = e.networkConfigList()
-		return err
-	})
+	networkConfigs, err := fsRead(e)
 	if err != nil {
 		return nil, []error{err}
 	}
@@ -188,7 +180,8 @@ func WithDefaultNetwork(bridgeIP string) CNIEnvOpt {
 
 func WithNamespace(namespace string) CNIEnvOpt {
 	return func(e *CNIEnv) error {
-		if err := os.MkdirAll(filepath.Join(e.NetconfPath, namespace), 0755); err != nil {
+		err := fsEnsureRoot(e, namespace)
+		if err != nil {
 			return err
 		}
 		e.Namespace = namespace
@@ -201,7 +194,8 @@ func NewCNIEnv(cniPath, cniConfPath string, opts ...CNIEnvOpt) (*CNIEnv, error)
 		Path:        cniPath,
 		NetconfPath: cniConfPath,
 	}
-	if err := os.MkdirAll(e.NetconfPath, 0755); err != nil {
+
+	if err := fsEnsureRoot(&e, ""); err != nil {
 		return nil, err
 	}
 
@@ -215,25 +209,17 @@ func NewCNIEnv(cniPath, cniConfPath string, opts ...CNIEnvOpt) (*CNIEnv, error)
 }
 
 func (e *CNIEnv) NetworkList() ([]*NetworkConfig, error) {
-	var netConfigList []*NetworkConfig
-	var err error
-	fn := func() error {
-		netConfigList, err = e.networkConfigList()
-		return err
-	}
-	err = lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), fn)
-
-	return netConfigList, err
+	return fsRead(e)
 }
 
 func (e *CNIEnv) NetworkMap() (map[string]*NetworkConfig, error) { //nolint:revive
-	networks, err := e.networkConfigList()
+	netConfigList, err := fsRead(e)
 	if err != nil {
 		return nil, err
 	}
 
-	m := make(map[string]*NetworkConfig, len(networks))
-	for _, n := range networks {
+	m := make(map[string]*NetworkConfig, len(netConfigList))
+	for _, n := range netConfigList {
 		if original, exists := m[n.Name]; exists {
 			log.L.Warnf("duplicate network name %q, %#v will get superseded by %#v", n.Name, original, n)
 		}
@@ -243,12 +229,12 @@ func (e *CNIEnv) NetworkMap() (map[string]*NetworkConfig, error) { //nolint:revi
 }
 
 func (e *CNIEnv) NetworkByNameOrID(key string) (*NetworkConfig, error) {
-	networks, err := e.networkConfigList()
+	netConfigList, err := fsRead(e)
 	if err != nil {
 		return nil, err
 	}
 
-	for _, n := range networks {
+	for _, n := range netConfigList {
 		if n.Name == key {
 			return n, nil
 		}
@@ -261,12 +247,12 @@ func (e *CNIEnv) NetworkByNameOrID(key string) (*NetworkConfig, error) {
 }
 
 func (e *CNIEnv) filterNetworks(filterf func(*NetworkConfig) bool) ([]*NetworkConfig, error) {
-	networkConfigs, err := e.networkConfigList()
+	netConfigList, err := fsRead(e)
 	if err != nil {
 		return nil, err
 	}
 	result := []*NetworkConfig{}
-	for _, networkConfig := range networkConfigs {
+	for _, networkConfig := range netConfigList {
 		if filterf(networkConfig) {
 			result = append(result, networkConfig)
 		}
@@ -274,23 +260,18 @@ func (e *CNIEnv) filterNetworks(filterf func(*NetworkConfig) bool) ([]*NetworkCo
 	return result, nil
 }
 
-func (e *CNIEnv) getConfigPathForNetworkName(netName string) string {
-	if netName == DefaultNetworkName || e.Namespace == "" {
-		return filepath.Join(e.NetconfPath, "nerdctl-"+netName+".conflist")
-	}
-	return filepath.Join(e.NetconfPath, e.Namespace, "nerdctl-"+netName+".conflist")
-}
-
 func (e *CNIEnv) usedSubnets() ([]*net.IPNet, error) {
 	usedSubnets, err := subnetutil.GetLiveNetworkSubnets()
 	if err != nil {
 		return nil, err
 	}
-	networkConfigs, err := e.networkConfigList()
+
+	netConfigList, err := fsRead(e)
 	if err != nil {
 		return nil, err
 	}
-	for _, netConf := range networkConfigs {
+
+	for _, netConf := range netConfigList {
 		usedSubnets = append(usedSubnets, netConf.subnets()...)
 	}
 	return usedSubnets, nil
@@ -314,44 +295,39 @@ type cniNetworkConfig struct {
 func (e *CNIEnv) CreateNetwork(opts types.NetworkCreateOptions) (*NetworkConfig, error) { //nolint:revive
 	var netConf *NetworkConfig
 
-	fn := func() error {
-		netMap, err := e.NetworkMap()
-		if err != nil {
-			return err
-		}
+	netMap, err := e.NetworkMap()
+	if err != nil {
+		return nil, err
+	}
 
-		if _, ok := netMap[opts.Name]; ok {
-			return errdefs.ErrAlreadyExists
-		}
-		ipam, err := e.generateIPAM(opts.IPAMDriver, opts.Subnets, opts.Gateway, opts.IPRange, opts.IPAMOptions, opts.IPv6)
-		if err != nil {
-			return err
-		}
-		plugins, err := e.generateCNIPlugins(opts.Driver, opts.Name, ipam, opts.Options, opts.IPv6)
-		if err != nil {
-			return err
-		}
-		netConf, err = e.generateNetworkConfig(opts.Name, opts.Labels, plugins)
-		if err != nil {
-			return err
-		}
-		return e.writeNetworkConfig(netConf)
+	// See note in fsWrite. Just because it does not exist now does not guarantee it will still not exist later.
+	// This is more a perf optimization at this point than a true check.
+	if _, ok := netMap[opts.Name]; ok {
+		return nil, errdefs.ErrAlreadyExists
 	}
-	err := lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), fn)
+	ipam, err := e.generateIPAM(opts.IPAMDriver, opts.Subnets, opts.Gateway, opts.IPRange, opts.IPAMOptions, opts.IPv6)
 	if err != nil {
 		return nil, err
 	}
+	plugins, err := e.generateCNIPlugins(opts.Driver, opts.Name, ipam, opts.Options, opts.IPv6)
+	if err != nil {
+		return nil, err
+	}
+	netConf, err = e.generateNetworkConfig(opts.Name, opts.Labels, plugins)
+	if err != nil {
+		return nil, err
+	}
+	err = fsWrite(e, netConf)
+
+	// See note above. If it exists, we got raced out by another process. Consider this to NOT be a hard error.
+	if err != nil && !errdefs.IsAlreadyExists(err) {
+		return nil, err
+	}
 	return netConf, nil
 }
 
 func (e *CNIEnv) RemoveNetwork(net *NetworkConfig) error {
-	fn := func() error {
-		if err := os.RemoveAll(net.File); err != nil {
-			return err
-		}
-		return net.clean()
-	}
-	return lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), fn)
+	return fsRemove(e, net)
 }
 
 // GetDefaultNetworkConfig checks whether the default network exists
@@ -394,8 +370,8 @@ func (e *CNIEnv) GetDefaultNetworkConfig() (*NetworkConfig, error) {
 
 		// Warn the user if the default network was not created by nerdctl.
 		match := nameMatches[0]
-		_, statErr := os.Stat(e.getConfigPathForNetworkName(DefaultNetworkName))
-		if match.NerdctlID == nil || statErr != nil {
+		exists, statErr := fsExists(e, DefaultNetworkName)
+		if match.NerdctlID == nil || statErr != nil || !exists {
 			log.L.Warnf("default network named %q does not have an internal nerdctl ID or nerdctl-managed config file, it was most likely NOT created by nerdctl", DefaultNetworkName)
 		}
 
@@ -419,9 +395,12 @@ func (e *CNIEnv) ensureDefaultNetworkConfig(bridgeIP string) error {
 }
 
 func (e *CNIEnv) createDefaultNetworkConfig(bridgeIP string) error {
-	filename := e.getConfigPathForNetworkName(DefaultNetworkName)
-	if _, err := os.Stat(filename); err == nil {
-		return fmt.Errorf("already found existing network config at %q, cannot create new network named %q", filename, DefaultNetworkName)
+	exist, err := fsExists(e, DefaultNetworkName)
+	if err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	if exist {
+		return fmt.Errorf("already found existing network config, cannot create new network named %q", DefaultNetworkName)
 	}
 
 	bridgeCIDR := DefaultCIDR
@@ -443,7 +422,7 @@ func (e *CNIEnv) createDefaultNetworkConfig(bridgeIP string) error {
 		Labels:     []string{fmt.Sprintf("%s=true", labels.NerdctlDefaultNetwork)},
 	}
 
-	_, err := e.CreateNetwork(opts)
+	_, err = e.CreateNetwork(opts)
 	if err != nil && !errdefs.IsAlreadyExists(err) {
 		return err
 	}
@@ -490,31 +469,6 @@ func (e *CNIEnv) generateNetworkConfig(name string, labels []string, plugins []C
 	}, nil
 }
 
-// writeNetworkConfig writes NetworkConfig file to cni config path.
-func (e *CNIEnv) writeNetworkConfig(net *NetworkConfig) error {
-	filename := e.getConfigPathForNetworkName(net.Name)
-	if _, err := os.Stat(filename); err == nil {
-		return errdefs.ErrAlreadyExists
-	}
-	return os.WriteFile(filename, net.Bytes, 0644)
-}
-
-// networkConfigList loads config from dir if dir exists.
-func (e *CNIEnv) networkConfigList() ([]*NetworkConfig, error) {
-	common, err := libcni.ConfFiles(e.NetconfPath, []string{".conf", ".conflist", ".json"})
-	if err != nil {
-		return nil, err
-	}
-	namespaced := []string{}
-	if e.Namespace != "" {
-		namespaced, err = libcni.ConfFiles(filepath.Join(e.NetconfPath, e.Namespace), []string{".conf", ".conflist", ".json"})
-		if err != nil {
-			return nil, err
-		}
-	}
-	return cniLoad(append(common, namespaced...))
-}
-
 func wrapCNIError(fileName string, err error) error {
 	return fmt.Errorf("failed marshalling json out of network configuration file %q: %w\n"+
 		"For details on the schema, see https://pkg.go.dev/github.com/containernetworking/cni/libcni#NetworkConfigList", fileName, err)
diff --git a/pkg/netutil/store.go b/pkg/netutil/store.go
new file mode 100644
index 00000000000..4d07db28fa9
--- /dev/null
+++ b/pkg/netutil/store.go
@@ -0,0 +1,100 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package netutil
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/containernetworking/cni/libcni"
+
+	"github.com/containerd/errdefs"
+
+	"github.com/containerd/nerdctl/v2/pkg/lockutil"
+)
+
+// NOTE: libcni is not safe to use concurrently - or at least delegates concurrency management to the consumer.
+// Furthermore, CNIEnv (prior to this) is assuming the filesystem is ACID and other TOCTOU faults.
+// This small set of methods here are meant to isolate CNIEnv entirely from the filesystem.
+// This is NOT proper - we should instead use the Store implementation, which is the generic abstraction for ACID
+// operations - but for now that will do, waiting for a full rewrite of CNIEnv.
+
+func fsEnsureRoot(e *CNIEnv, namespace string) error {
+	path := e.NetconfPath
+	if namespace != "" {
+		path = filepath.Join(e.NetconfPath, namespace)
+	}
+	return os.MkdirAll(path, 0755)
+}
+
+func fsRemove(e *CNIEnv, net *NetworkConfig) error {
+	fn := func() error {
+		if err := os.RemoveAll(net.File); err != nil {
+			return err
+		}
+		return net.clean()
+	}
+	return lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), fn)
+}
+
+func fsExists(e *CNIEnv, name string) (bool, error) {
+	fi, err := os.Stat(getConfigPathForNetworkName(e, name))
+	return !os.IsNotExist(err) && !fi.IsDir(), err
+}
+
+func fsWrite(e *CNIEnv, net *NetworkConfig) error {
+	filename := getConfigPathForNetworkName(e, net.Name)
+	// FIXME: note that this is still problematic.
+	// Concurrent access may independently first figure out that a given network is missing, and while the lock
+	// here will prevent concurrent writes, one of the routines will fail.
+	// Consuming code MUST account for that scenario.
+	return lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), func() error {
+		if _, err := os.Stat(filename); err == nil {
+			return errdefs.ErrAlreadyExists
+		}
+		return os.WriteFile(filename, net.Bytes, 0644)
+	})
+}
+
+func fsRead(e *CNIEnv) ([]*NetworkConfig, error) {
+	var nc []*NetworkConfig
+	var err error
+	err = lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), func() error {
+		namespaced := []string{}
+		var common []string
+		common, err = libcni.ConfFiles(e.NetconfPath, []string{".conf", ".conflist", ".json"})
+		if err != nil {
+			return err
+		}
+		if e.Namespace != "" {
+			namespaced, err = libcni.ConfFiles(filepath.Join(e.NetconfPath, e.Namespace), []string{".conf", ".conflist", ".json"})
+			if err != nil {
+				return err
+			}
+		}
+		nc, err = cniLoad(append(common, namespaced...))
+		return err
+	})
+	return nc, err
+}
+
+func getConfigPathForNetworkName(e *CNIEnv, netName string) string {
+	if netName == DefaultNetworkName || e.Namespace == "" {
+		return filepath.Join(e.NetconfPath, "nerdctl-"+netName+".conflist")
+	}
+	return filepath.Join(e.NetconfPath, e.Namespace, "nerdctl-"+netName+".conflist")
+}
diff --git a/pkg/ocihook/ocihook.go b/pkg/ocihook/ocihook.go
index 2807b23e9d8..d035a4ad968 100644
--- a/pkg/ocihook/ocihook.go
+++ b/pkg/ocihook/ocihook.go
@@ -103,11 +103,13 @@ func Run(stdin io.Reader, stderr io.Writer, event, dataStore, cniPath, cniNetcon
 	// This below is a stopgap solution that just enforces a global lock
 	// Note this here is probably not enough, as concurrent CNI operations may happen outside of the scope of ocihooks
 	// through explicit calls to Remove, etc.
+	// Finally note that this is not the same (albeit similar) as libcni filesystem manipulation locking,
+	// hence the independent lock
 	err = os.MkdirAll(cniNetconfPath, 0o700)
 	if err != nil {
 		return err
 	}
-	lock, err := lockutil.Lock(filepath.Join(cniNetconfPath, ".nerdctl.lock"))
+	lock, err := lockutil.Lock(filepath.Join(cniNetconfPath, ".cni-concurrency.lock"))
 	if err != nil {
 		return err
 	}

From ad8be25f8d6ecb182bba2ea6b84299f6c4bf349f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 9 May 2025 22:37:33 +0000
Subject: [PATCH 192/225] build(deps): bump github.com/vishvananda/netlink

Bumps [github.com/vishvananda/netlink](https://github.com/vishvananda/netlink) from 1.3.1-0.20250303224720-0e7078ed04c8 to 1.3.1.
- [Release notes](https://github.com/vishvananda/netlink/releases)
- [Commits](https://github.com/vishvananda/netlink/commits/v1.3.1)

---
updated-dependencies:
- dependency-name: github.com/vishvananda/netlink
  dependency-version: 1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 5 ++---
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/go.mod b/go.mod
index 40c88753935..5a44ed35b05 100644
--- a/go.mod
+++ b/go.mod
@@ -58,7 +58,7 @@ require (
 	github.com/rootless-containers/rootlesskit/v2 v2.3.5 //gomodjail:unconfined
 	github.com/spf13/cobra v1.9.1 //gomodjail:unconfined
 	github.com/spf13/pflag v1.0.6 //gomodjail:unconfined
-	github.com/vishvananda/netlink v1.3.1-0.20250303224720-0e7078ed04c8 //gomodjail:unconfined
+	github.com/vishvananda/netlink v1.3.1 //gomodjail:unconfined
 	github.com/vishvananda/netns v0.0.5 //gomodjail:unconfined
 	github.com/yuchanns/srslog v1.1.0
 	go.uber.org/mock v0.5.2
diff --git a/go.sum b/go.sum
index 5455c1222c1..ac3bb575873 100644
--- a/go.sum
+++ b/go.sum
@@ -311,9 +311,8 @@ github.com/tinylib/msgp v1.2.0/go.mod h1:2vIGs3lcUo8izAATNobrCHevYZC/LMsJtw4JPiY
 github.com/urfave/cli v1.19.1/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
 github.com/vbatts/tar-split v0.11.6 h1:4SjTW5+PU11n6fZenf2IPoV8/tz3AaYHMWjf23envGs=
 github.com/vbatts/tar-split v0.11.6/go.mod h1:dqKNtesIOr2j2Qv3W/cHjnvk9I8+G7oAkFDFN6TCBEI=
-github.com/vishvananda/netlink v1.3.1-0.20250303224720-0e7078ed04c8 h1:Y4egeTrP7sccowz2GWTJVtHlwkZippgBTpUmMteFUWQ=
-github.com/vishvananda/netlink v1.3.1-0.20250303224720-0e7078ed04c8/go.mod h1:i6NetklAujEcC6fK0JPjT8qSwWyO0HLn4UKG+hGqeJs=
-github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
+github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0=
+github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
 github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=

From 3c376a817e6b825df192a4d3fdb65404e1276f81 Mon Sep 17 00:00:00 2001
From: fahed dorgaa <fahed.dorgaa@gmail.com>
Date: Fri, 9 May 2025 11:15:01 +0200
Subject: [PATCH 193/225] fix: avoid adding extraneous line feed when tail logs

Signed-off-by: fahed dorgaa <fahed.dorgaa@gmail.com>
---
 cmd/nerdctl/container/container_logs_test.go | 28 ++++++++++++++++++++
 pkg/logging/json_logger_test.go              |  3 ++-
 pkg/logging/jsonfile/jsonfile.go             |  2 +-
 pkg/logging/logging.go                       |  2 +-
 4 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/cmd/nerdctl/container/container_logs_test.go b/cmd/nerdctl/container/container_logs_test.go
index 0ea37dab378..12bf2568a5b 100644
--- a/cmd/nerdctl/container/container_logs_test.go
+++ b/cmd/nerdctl/container/container_logs_test.go
@@ -394,6 +394,34 @@ func TestLogsWithDetails(t *testing.T) {
 	testCase.Run(t)
 }
 
+func TestLogsFollowNoExtraneousLineFeed(t *testing.T) {
+	testCase := nerdtest.Setup()
+	// This test verifies that `nerdctl logs -f` does not add extraneous line feeds
+	testCase.Require = require.Not(require.Windows)
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		// Create a container that outputs a message without a trailing newline
+		// and then sleeps to keep the container running for the logs -f command
+		helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage,
+			"sh", "-c", "printf 'Hello without newline'; sleep 5")
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rm", "-f", data.Identifier())
+	}
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		// Use logs -f to follow the logs
+		// The container will exit after 5 seconds, so we don't need an explicit timeout
+		return helpers.Command("logs", "-f", data.Identifier())
+	}
+
+	// Verify that the output is exactly "Hello without newline" without any additional line feeds
+	testCase.Expected = test.Expects(0, nil, expect.Equals("Hello without newline"))
+
+	testCase.Run(t)
+}
+
 func TestLogsWithStartContainer(t *testing.T) {
 	testCase := nerdtest.Setup()
 
diff --git a/pkg/logging/json_logger_test.go b/pkg/logging/json_logger_test.go
index 7d0be36285d..7b41c10a68c 100644
--- a/pkg/logging/json_logger_test.go
+++ b/pkg/logging/json_logger_test.go
@@ -73,6 +73,7 @@ func TestReadRotatedJSONLog(t *testing.T) {
 		time.Sleep(1 * time.Millisecond)
 		logData, _ := json.Marshal(log)
 		file.Write(logData)
+		file.Write([]byte("\n"))
 
 		if line == 5 {
 			file.Close()
@@ -104,7 +105,7 @@ func TestReadRotatedJSONLog(t *testing.T) {
 	close(containerStopped)
 
 	if expectedStdout != stdoutBuf.String() {
-		t.Errorf("expected: %s, acoutal: %s", expectedStdout, stdoutBuf.String())
+		t.Errorf("expected: %s, actual: %s", expectedStdout, stdoutBuf.String())
 	}
 }
 
diff --git a/pkg/logging/jsonfile/jsonfile.go b/pkg/logging/jsonfile/jsonfile.go
index a1693cda0d7..6e6f7984eda 100644
--- a/pkg/logging/jsonfile/jsonfile.go
+++ b/pkg/logging/jsonfile/jsonfile.go
@@ -54,7 +54,7 @@ func Encode(stdout <-chan string, stderr <-chan string, writer io.Writer) error
 			Stream: name,
 		}
 		for logEntry := range dataChan {
-			e.Log = logEntry + "\n"
+			e.Log = logEntry
 			e.Time = time.Now().UTC()
 			encMu.Lock()
 			encErr := enc.Encode(e)
diff --git a/pkg/logging/logging.go b/pkg/logging/logging.go
index eab10cbd726..3030660cf0e 100644
--- a/pkg/logging/logging.go
+++ b/pkg/logging/logging.go
@@ -255,7 +255,7 @@ func loggingProcessAdapter(ctx context.Context, driver Driver, dataStore, addres
 			var s string
 			s, err = r.ReadString('\n')
 			if len(s) > 0 {
-				dataChan <- strings.TrimSuffix(s, "\n")
+				dataChan <- s
 			}
 
 			if err != nil && err != io.EOF {

From 87a976dc6354b73c0fa7bb400885b14dbd4741af Mon Sep 17 00:00:00 2001
From: fahed dorgaa <fahed.dorgaa@gmail.com>
Date: Sat, 10 May 2025 01:57:17 +0200
Subject: [PATCH 194/225] test: add delay to ensure logs are available before
 following

Signed-off-by: fahed dorgaa <fahed.dorgaa@gmail.com>
---
 cmd/nerdctl/container/container_logs_test.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/cmd/nerdctl/container/container_logs_test.go b/cmd/nerdctl/container/container_logs_test.go
index 12bf2568a5b..deac334f6e2 100644
--- a/cmd/nerdctl/container/container_logs_test.go
+++ b/cmd/nerdctl/container/container_logs_test.go
@@ -413,6 +413,8 @@ func TestLogsFollowNoExtraneousLineFeed(t *testing.T) {
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
 		// Use logs -f to follow the logs
 		// The container will exit after 5 seconds, so we don't need an explicit timeout
+		// Arbitrary, but we need to wait until the logs show up
+		time.Sleep(3 * time.Second)
 		return helpers.Command("logs", "-f", data.Identifier())
 	}
 

From 1ec8f840e53a06920a07f69e2c46a21b4e6a1362 Mon Sep 17 00:00:00 2001
From: zhaixiaojuan <zhaixiaojuan@loongson.cn>
Date: Mon, 25 Sep 2023 23:36:35 -0400
Subject: [PATCH 195/225] Add loong64 artifact

Signed-off-by: zhaixiaojuan <zhaixiaojuan@loongson.cn>
---
 Makefile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Makefile b/Makefile
index 3544c484612..65ec10c1c9a 100644
--- a/Makefile
+++ b/Makefile
@@ -268,6 +268,9 @@ artifacts: clean
 	GOOS=linux GOARCH=arm GOARM=7 make -C $(CURDIR) -f $(MAKEFILE_DIR)/Makefile binaries
 	tar $(TAR_OWNER0_FLAGS) $(TAR_FLATTEN_FLAGS) -czvf $(CURDIR)/_output/nerdctl-$(VERSION_TRIMMED)-linux-arm-v7.tar.gz  $(CURDIR)/_output/nerdctl $(MAKEFILE_DIR)/extras/rootless/*
 
+	GOOS=linux GOARCH=loong64     make -C $(CURDIR) -f $(MAKEFILE_DIR)/Makefile binaries
+	tar $(TAR_OWNER0_FLAGS) $(TAR_FLATTEN_FLAGS) -czvf $(CURDIR)/_output/nerdctl-$(VERSION_TRIMMED)-linux-loong64.tar.gz   $(CURDIR)/_output/nerdctl $(MAKEFILE_DIR)/extras/rootless/*
+
 	GOOS=linux GOARCH=ppc64le     make -C $(CURDIR) -f $(MAKEFILE_DIR)/Makefile binaries
 	tar $(TAR_OWNER0_FLAGS) $(TAR_FLATTEN_FLAGS) -czvf $(CURDIR)/_output/nerdctl-$(VERSION_TRIMMED)-linux-ppc64le.tar.gz $(CURDIR)/_output/nerdctl $(MAKEFILE_DIR)/extras/rootless/*
 

From a5d170183ce47d49f97213505aca1ce36d87d082 Mon Sep 17 00:00:00 2001
From: fahed dorgaa <fahed.dorgaa@gmail.com>
Date: Sat, 10 May 2025 14:44:27 +0200
Subject: [PATCH 196/225] test: remove unnecessary sleep in container setup for
 log tests

Signed-off-by: fahed dorgaa <fahed.dorgaa@gmail.com>
---
 cmd/nerdctl/container/container_logs_test.go | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/cmd/nerdctl/container/container_logs_test.go b/cmd/nerdctl/container/container_logs_test.go
index deac334f6e2..d6011260e4e 100644
--- a/cmd/nerdctl/container/container_logs_test.go
+++ b/cmd/nerdctl/container/container_logs_test.go
@@ -401,9 +401,8 @@ func TestLogsFollowNoExtraneousLineFeed(t *testing.T) {
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		// Create a container that outputs a message without a trailing newline
-		// and then sleeps to keep the container running for the logs -f command
 		helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage,
-			"sh", "-c", "printf 'Hello without newline'; sleep 5")
+			"sh", "-c", "printf 'Hello without newline'")
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -412,7 +411,6 @@ func TestLogsFollowNoExtraneousLineFeed(t *testing.T) {
 
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
 		// Use logs -f to follow the logs
-		// The container will exit after 5 seconds, so we don't need an explicit timeout
 		// Arbitrary, but we need to wait until the logs show up
 		time.Sleep(3 * time.Second)
 		return helpers.Command("logs", "-f", data.Identifier())

From dcd19765b4ec99b3d78afaee80ffd0014bae98e9 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Sat, 10 May 2025 10:32:42 -0700
Subject: [PATCH 197/225] Add loong64 as a build target + completion

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .github/workflows/job-build.yml      | 3 ++-
 cmd/nerdctl/completion/completion.go | 1 +
 docs/multi-platform.md               | 1 +
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/job-build.yml b/.github/workflows/job-build.yml
index 63c3c3e309d..2bf843e2ab6 100644
--- a/.github/workflows/job-build.yml
+++ b/.github/workflows/job-build.yml
@@ -88,9 +88,10 @@ jobs:
           build linux arm64
           build windows
           build freebsd
+          # These architectures are not released, but we still verify that we can at least compile
           build darwin
           build linux arm 6
-          # These architectures are not released, but we still verify that we can at least compile
+          build linux loong64
           build linux ppc64le
           build linux riscv64
           build linux s390x
diff --git a/cmd/nerdctl/completion/completion.go b/cmd/nerdctl/completion/completion.go
index 7718c1bb063..e12e2375a40 100644
--- a/cmd/nerdctl/completion/completion.go
+++ b/cmd/nerdctl/completion/completion.go
@@ -164,6 +164,7 @@ func Platforms(cmd *cobra.Command, args []string, toComplete string) ([]string,
 		"riscv64",
 		"ppc64le",
 		"s390x",
+		"loong64",
 		"386",
 		"arm",          // alias of "linux/arm/v7"
 		"linux/arm/v6", // "arm/v6" is invalid (interpreted as OS="arm", Arch="v7")
diff --git a/docs/multi-platform.md b/docs/multi-platform.md
index 5c2e05b9239..e70b5f18c7f 100644
--- a/docs/multi-platform.md
+++ b/docs/multi-platform.md
@@ -16,6 +16,7 @@ $ sudo nerdctl run --privileged --rm tonistiigi/binfmt:master --install all
 $ ls -1 /proc/sys/fs/binfmt_misc/qemu*
 /proc/sys/fs/binfmt_misc/qemu-aarch64
 /proc/sys/fs/binfmt_misc/qemu-arm
+/proc/sys/fs/binfmt_misc/qemu-loongarch64
 /proc/sys/fs/binfmt_misc/qemu-mips64
 /proc/sys/fs/binfmt_misc/qemu-mips64el
 /proc/sys/fs/binfmt_misc/qemu-ppc64le

From 8cc057fb077a3e200340fa7cb58d131e420fe5f4 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Mon, 12 May 2025 18:31:18 +0900
Subject: [PATCH 198/225] CI: test `make artifacts` on every PR

A preparation toward fixing issue 4241

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 .github/workflows/release.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4a920a20a52..bf1ec924b48 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,9 @@ on:
     tags:
     - 'v*'
     - 'test-action-release-*'
+  pull_request:
+    paths-ignore:
+    - '**.md'
 
 env:
   GOTOOLCHAIN: local
@@ -53,6 +56,7 @@ jobs:
       with:
         subject-path: _output/*
     - name: "Create release"
+      if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |

From 58a5fe058879ba7f791ffaea78da17634ee7106e Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Mon, 12 May 2025 18:40:17 +0900
Subject: [PATCH 199/225] Dockerfile: fix cross-compiling gomodjail

Fix issue 4241

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 .../ghcr-image-build-and-publish.yml          |  1 +
 .github/workflows/release.yml                 |  3 +++
 Dockerfile                                    | 20 +++++++++++++------
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ghcr-image-build-and-publish.yml b/.github/workflows/ghcr-image-build-and-publish.yml
index 47084653b93..969eb67229f 100644
--- a/.github/workflows/ghcr-image-build-and-publish.yml
+++ b/.github/workflows/ghcr-image-build-and-publish.yml
@@ -33,6 +33,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
+      # FIXME: setup-qemu-action is depended by `gomodjail pack`
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392  # v3.6.0
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bf1ec924b48..b68c6395047 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,6 +24,9 @@ jobs:
       attestations: write  # for provenances
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    # FIXME: setup-qemu-action is depended by `gomodjail pack`
+    - name: "Set up QEMU"
+      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392  # v3.6.0
     - name: "Install go"
       uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
       with:
diff --git a/Dockerfile b/Dockerfile
index 533f16eba18..d0c218b8f34 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -107,6 +107,16 @@ ENV CGO_ENABLED=1
 RUN GO=xx-go make static && \
   xx-verify --static bypass4netns && cp -a bypass4netns bypass4netnsd /out/${TARGETARCH}
 
+FROM build-base-debian AS build-gomodjail
+ARG GOMODJAIL_VERSION
+ARG TARGETARCH
+RUN git clone --quiet --depth 1 --branch "${GOMODJAIL_VERSION%@*}" https://github.com/AkihiroSuda/gomodjail.git /go/src/github.com/AkihiroSuda/gomodjail
+WORKDIR /go/src/github.com/AkihiroSuda/gomodjail
+RUN git-checkout-tag-with-hash.sh ${GOMODJAIL_VERSION} && \
+  mkdir -p /out/${TARGETARCH}
+RUN GO=xx-go make STATIC=1 && \
+  xx-verify --static _output/bin/gomodjail && cp -a _output/bin/gomodjail /out/${TARGETARCH}
+
 FROM build-base-debian AS build-kubo
 ARG KUBO_VERSION
 ARG TARGETARCH
@@ -234,12 +244,8 @@ RUN ROOTLESSKIT_VERSION=${ROOTLESSKIT_VERSION/@BINARY}; \
   rm -f "${fname}" /out/bin/rootlesskit-docker-proxy && \
   echo "- RootlessKit: ${ROOTLESSKIT_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG GOMODJAIL_VERSION
-RUN git clone https://github.com/AkihiroSuda/gomodjail.git /go/src/github.com/AkihiroSuda/gomodjail && \
-  cd /go/src/github.com/AkihiroSuda/gomodjail && \
-  git-checkout-tag-with-hash.sh "${GOMODJAIL_VERSION}" && \
-  make STATIC=1 && \
-  cp -a _output/bin/gomodjail /out/bin/ && \
-  echo "- gomodjail: ${GOMODJAIL_VERSION}" >> /out/share/doc/nerdctl-full/README.md
+COPY --from=build-gomodjail /out/${TARGETARCH:-amd64}/* /out/bin/
+RUN echo "- gomodjail: ${GOMODJAIL_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 
 RUN echo "" >> /out/share/doc/nerdctl-full/README.md && \
   echo "## License" >> /out/share/doc/nerdctl-full/README.md && \
@@ -254,6 +260,8 @@ COPY . /go/src/github.com/containerd/nerdctl
 RUN { echo "# nerdctl (full distribution)"; echo "- nerdctl: $(cd /go/src/github.com/containerd/nerdctl && git describe --tags)"; cat /out/share/doc/nerdctl-full/README.md; } > /out/share/doc/nerdctl-full/README.md.new; mv /out/share/doc/nerdctl-full/README.md.new /out/share/doc/nerdctl-full/README.md
 WORKDIR /go/src/github.com/containerd/nerdctl
 RUN BINDIR=/out/bin make binaries install
+# FIXME: `gomodjail pack` depends on QEMU for non-native architecture
+# TODO: gomodjail should provide a plain shell script that utilizes `zip(1)` for packing the self-extract archive, without running `gomodjail pack`..
 RUN /out/bin/gomodjail pack --go-mod=/go/src/github.com/containerd/nerdctl/go.mod /out/bin/nerdctl && \
   cp -a nerdctl.gomodjail /out/bin/
 COPY README.md /out/share/doc/nerdctl/

From 8586da2ae3e2cd377a79b4bbc1ea49ca96732e98 Mon Sep 17 00:00:00 2001
From: Subash Kotha <subash.kotha2@gmail.com>
Date: Fri, 2 May 2025 11:56:16 -0700
Subject: [PATCH 200/225] feat: add --no-stdin flag to container attach

Signed-off-by: Subash Kotha <subash.kotha2@gmail.com>
---
 cmd/nerdctl/container/container_attach.go     | 14 ++++++-
 .../container/container_attach_linux_test.go  | 41 +++++++++++++++++++
 docs/command-reference.md                     |  3 +-
 pkg/cmd/container/attach.go                   | 10 +++--
 4 files changed, 63 insertions(+), 5 deletions(-)

diff --git a/cmd/nerdctl/container/container_attach.go b/cmd/nerdctl/container/container_attach.go
index 958c7c4b7ec..5fd004ae36e 100644
--- a/cmd/nerdctl/container/container_attach.go
+++ b/cmd/nerdctl/container/container_attach.go
@@ -17,6 +17,8 @@
 package container
 
 import (
+	"io"
+
 	"github.com/spf13/cobra"
 
 	containerd "github.com/containerd/containerd/v2/client"
@@ -56,6 +58,7 @@ Caveats:
 		SilenceErrors:     true,
 	}
 	cmd.Flags().String("detach-keys", consoleutil.DefaultDetachKeys, "Override the default detach keys")
+	cmd.Flags().Bool("no-stdin", false, "Do not attach STDIN")
 	return cmd
 }
 
@@ -68,9 +71,18 @@ func attachOptions(cmd *cobra.Command) (types.ContainerAttachOptions, error) {
 	if err != nil {
 		return types.ContainerAttachOptions{}, err
 	}
+	noStdin, err := cmd.Flags().GetBool("no-stdin")
+	if err != nil {
+		return types.ContainerAttachOptions{}, err
+	}
+
+	var stdin io.Reader
+	if !noStdin {
+		stdin = cmd.InOrStdin()
+	}
 	return types.ContainerAttachOptions{
 		GOptions:   globalOptions,
-		Stdin:      cmd.InOrStdin(),
+		Stdin:      stdin,
 		Stdout:     cmd.OutOrStdout(),
 		Stderr:     cmd.ErrOrStderr(),
 		DetachKeys: detachKeys,
diff --git a/cmd/nerdctl/container/container_attach_linux_test.go b/cmd/nerdctl/container/container_attach_linux_test.go
index 083fd4a194e..88ab8bb5430 100644
--- a/cmd/nerdctl/container/container_attach_linux_test.go
+++ b/cmd/nerdctl/container/container_attach_linux_test.go
@@ -211,3 +211,44 @@ func TestAttachForAutoRemovedContainer(t *testing.T) {
 
 	testCase.Run(t)
 }
+
+func TestAttachNoStdin(t *testing.T) {
+	testCase := nerdtest.Setup()
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rm", "-f", data.Identifier())
+	}
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		cmd := helpers.Command("run", "-it", "--detach-keys=ctrl-p,ctrl-q", "--name", data.Identifier(),
+			testutil.CommonImage, "sleep", "5")
+		cmd.WithPseudoTTY()
+		cmd.Feed(bytes.NewReader([]byte{16, 17})) // Ctrl-p, Ctrl-q to detach (https://en.wikipedia.org/wiki/C0_and_C1_control_codes)
+		cmd.Run(&test.Expected{
+			ExitCode: 0,
+			Output: func(stdout string, info string, t *testing.T) {
+				assert.Assert(t, strings.Contains(helpers.Capture("inspect", "--format", "{{.State.Running}}", data.Identifier()), "true"))
+			},
+		})
+	}
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		cmd := helpers.Command("attach", "--no-stdin", data.Identifier())
+		cmd.WithPseudoTTY()
+		cmd.Feed(strings.NewReader("should-not-appear\n"))
+		cmd.Feed(bytes.NewReader([]byte{16, 17}))
+		return cmd
+	}
+
+	testCase.Expected = func(data test.Data, helpers test.Helpers) *test.Expected {
+		return &test.Expected{
+			ExitCode: 0, // Since it's a normal exit and not detach.
+			Output: func(stdout string, info string, t *testing.T) {
+				logs := helpers.Capture("logs", data.Identifier())
+				assert.Assert(t, !strings.Contains(logs, "should-not-appear"))
+			},
+		}
+	}
+
+	testCase.Run(t)
+}
diff --git a/docs/command-reference.md b/docs/command-reference.md
index f95d5db1b4a..60db48e2b43 100644
--- a/docs/command-reference.md
+++ b/docs/command-reference.md
@@ -686,8 +686,9 @@ Usage: `nerdctl attach CONTAINER`
 Flags:
 
 - :whale: `--detach-keys`: Override the default detach keys
+- :whale: `--no-stdin`: Do not attach STDIN
 
-Unimplemented `docker attach` flags: `--no-stdin`, `--sig-proxy`
+Unimplemented `docker attach` flags: `--sig-proxy`
 
 ### :whale: nerdctl container prune
 
diff --git a/pkg/cmd/container/attach.go b/pkg/cmd/container/attach.go
index 31a1523e9e9..a6295c76cb2 100644
--- a/pkg/cmd/container/attach.go
+++ b/pkg/cmd/container/attach.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
 
 	"golang.org/x/term"
 
@@ -114,9 +115,12 @@ func Attach(ctx context.Context, client *containerd.Client, req string, options
 			}
 			io.Cancel()
 		}
-		in, err := consoleutil.NewDetachableStdin(con, options.DetachKeys, closer)
-		if err != nil {
-			return err
+		var in io.Reader
+		if options.Stdin != nil {
+			in, err = consoleutil.NewDetachableStdin(con, options.DetachKeys, closer)
+			if err != nil {
+				return err
+			}
 		}
 		opt = cio.WithStreams(in, con, nil)
 	} else {

From 368d2e27c23e752f78a1df07ad4d455e24bb3ac4 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 14 May 2025 08:59:44 -0700
Subject: [PATCH 201/225] Consolidate filesystem ops into pkg

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/main.go                           |  4 +-
 pkg/composer/lock.go                          |  6 +-
 pkg/internal/filesystem/atomic.go             | 39 +++++++++
 pkg/internal/filesystem/consts.go             | 21 +++++
 pkg/internal/filesystem/errors.go             | 23 +++++
 .../filesystem}/lockutil_unix.go              |  2 +-
 .../filesystem}/lockutil_windows.go           |  2 +-
 pkg/internal/filesystem/path.go               | 47 ++++++++++
 pkg/internal/filesystem/path_test.go          | 85 +++++++++++++++++++
 .../filesystem/path_unix.go}                  |  8 +-
 .../filesystem/path_windows.go}               | 11 ++-
 pkg/logging/logging.go                        |  6 +-
 pkg/netutil/store.go                          |  8 +-
 pkg/ocihook/ocihook.go                        |  6 +-
 pkg/store/filestore.go                        | 54 ++++--------
 pkg/store/filestore_test.go                   | 59 -------------
 pkg/testutil/testutil.go                      |  6 +-
 17 files changed, 261 insertions(+), 126 deletions(-)
 create mode 100644 pkg/internal/filesystem/atomic.go
 create mode 100644 pkg/internal/filesystem/consts.go
 create mode 100644 pkg/internal/filesystem/errors.go
 rename pkg/{lockutil => internal/filesystem}/lockutil_unix.go (98%)
 rename pkg/{lockutil => internal/filesystem}/lockutil_windows.go (99%)
 create mode 100644 pkg/internal/filesystem/path.go
 create mode 100644 pkg/internal/filesystem/path_test.go
 rename pkg/{store/filestore_unix.go => internal/filesystem/path_unix.go} (75%)
 rename pkg/{store/filestore_windows.go => internal/filesystem/path_windows.go} (78%)

diff --git a/cmd/nerdctl/main.go b/cmd/nerdctl/main.go
index 5223a68a959..88d753a170c 100644
--- a/cmd/nerdctl/main.go
+++ b/cmd/nerdctl/main.go
@@ -248,12 +248,12 @@ Config file ($NERDCTL_TOML): %s
 		}
 
 		// Since we store containers' stateful information on the filesystem per namespace, we need namespaces to be
-		// valid, safe path segments. This is enforced by store.ValidatePathComponent.
+		// valid, safe path segments.
 		// Note that the container runtime will further enforce additional restrictions on namespace names
 		// (containerd treats namespaces as valid identifiers - eg: alphanumericals + dash, starting with a letter)
 		// See https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#path-segment-names for
 		// considerations about path segments identifiers.
-		if err = store.ValidatePathComponent(globalOptions.Namespace); err != nil {
+		if err = store.IsFilesystemSafe(globalOptions.Namespace); err != nil {
 			return err
 		}
 		if appNeedsRootlessParentMain(cmd, args) {
diff --git a/pkg/composer/lock.go b/pkg/composer/lock.go
index 8fedda7bfc4..9006eca4bb3 100644
--- a/pkg/composer/lock.go
+++ b/pkg/composer/lock.go
@@ -20,7 +20,7 @@ import (
 	"os"
 
 	"github.com/containerd/nerdctl/v2/pkg/clientutil"
-	"github.com/containerd/nerdctl/v2/pkg/lockutil"
+	"github.com/containerd/nerdctl/v2/pkg/internal/filesystem"
 )
 
 //nolint:unused
@@ -39,10 +39,10 @@ func Lock(dataRoot string, address string) error {
 	if err != nil {
 		return err
 	}
-	locked, err = lockutil.Lock(dataStore)
+	locked, err = filesystem.Lock(dataStore)
 	return err
 }
 
 func Unlock() error {
-	return lockutil.Unlock(locked)
+	return filesystem.Unlock(locked)
 }
diff --git a/pkg/internal/filesystem/atomic.go b/pkg/internal/filesystem/atomic.go
new file mode 100644
index 00000000000..fc45def648c
--- /dev/null
+++ b/pkg/internal/filesystem/atomic.go
@@ -0,0 +1,39 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package filesystem
+
+import (
+	"os"
+	"path/filepath"
+)
+
+func AtomicWrite(parent string, fileName string, perm os.FileMode, data []byte) error {
+	dest := filepath.Join(parent, fileName)
+	temp := filepath.Join(parent, ".temp."+fileName)
+
+	err := os.WriteFile(temp, data, perm)
+	if err != nil {
+		return err
+	}
+
+	err = os.Rename(temp, dest)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/pkg/internal/filesystem/consts.go b/pkg/internal/filesystem/consts.go
new file mode 100644
index 00000000000..32c30246ef1
--- /dev/null
+++ b/pkg/internal/filesystem/consts.go
@@ -0,0 +1,21 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package filesystem
+
+const (
+	pathComponentMaxLength = 255
+)
diff --git a/pkg/internal/filesystem/errors.go b/pkg/internal/filesystem/errors.go
new file mode 100644
index 00000000000..c2ed4a14918
--- /dev/null
+++ b/pkg/internal/filesystem/errors.go
@@ -0,0 +1,23 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package filesystem
+
+import "errors"
+
+var (
+	ErrInvalidPath = errors.New("invalid path")
+)
diff --git a/pkg/lockutil/lockutil_unix.go b/pkg/internal/filesystem/lockutil_unix.go
similarity index 98%
rename from pkg/lockutil/lockutil_unix.go
rename to pkg/internal/filesystem/lockutil_unix.go
index c4655c58b6c..8d50b15b071 100644
--- a/pkg/lockutil/lockutil_unix.go
+++ b/pkg/internal/filesystem/lockutil_unix.go
@@ -16,7 +16,7 @@
    limitations under the License.
 */
 
-package lockutil
+package filesystem
 
 import (
 	"fmt"
diff --git a/pkg/lockutil/lockutil_windows.go b/pkg/internal/filesystem/lockutil_windows.go
similarity index 99%
rename from pkg/lockutil/lockutil_windows.go
rename to pkg/internal/filesystem/lockutil_windows.go
index 205efde83f5..8dc6e3eb47d 100644
--- a/pkg/lockutil/lockutil_windows.go
+++ b/pkg/internal/filesystem/lockutil_windows.go
@@ -14,7 +14,7 @@
    limitations under the License.
 */
 
-package lockutil
+package filesystem
 
 import (
 	"fmt"
diff --git a/pkg/internal/filesystem/path.go b/pkg/internal/filesystem/path.go
new file mode 100644
index 00000000000..d0b99df7f40
--- /dev/null
+++ b/pkg/internal/filesystem/path.go
@@ -0,0 +1,47 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package filesystem
+
+import (
+	"errors"
+	"strings"
+)
+
+var (
+	errForbiddenChars     = errors.New("forbidden characters in path component")
+	errForbiddenKeywords  = errors.New("forbidden keywords in path component")
+	errInvalidPathTooLong = errors.New("path component must be shorter than 256 characters")
+	errInvalidPathEmpty   = errors.New("path component cannot be empty")
+)
+
+// ValidatePathComponent will enforce os specific filename restrictions on a single path component.
+func ValidatePathComponent(pathComponent string) error {
+	// https://en.wikipedia.org/wiki/Comparison_of_file_systems#Limits
+	if len(pathComponent) > pathComponentMaxLength {
+		return errors.Join(ErrInvalidPath, errInvalidPathTooLong)
+	}
+
+	if strings.TrimSpace(pathComponent) == "" {
+		return errors.Join(ErrInvalidPath, errInvalidPathEmpty)
+	}
+
+	if err := validatePlatformSpecific(pathComponent); err != nil {
+		return errors.Join(ErrInvalidPath, err)
+	}
+
+	return nil
+}
diff --git a/pkg/internal/filesystem/path_test.go b/pkg/internal/filesystem/path_test.go
new file mode 100644
index 00000000000..fa3d2b2fbf2
--- /dev/null
+++ b/pkg/internal/filesystem/path_test.go
@@ -0,0 +1,85 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package filesystem_test
+
+import (
+	"fmt"
+	"runtime"
+	"testing"
+
+	"gotest.tools/v3/assert"
+
+	"github.com/containerd/nerdctl/v2/pkg/internal/filesystem"
+)
+
+func TestFilesystemRestrictions(t *testing.T) {
+	t.Parallel()
+
+	invalid := []string{
+		"/",
+		"/start",
+		"mid/dle",
+		"end/",
+		".",
+		"..",
+		"",
+		fmt.Sprintf("A%0255s", "A"),
+	}
+
+	valid := []string{
+		fmt.Sprintf("A%0254s", "A"),
+		"test",
+		"test-hyphen",
+		".start.dot",
+		"mid.dot",
+		"∞",
+	}
+
+	if runtime.GOOS == "windows" {
+		invalid = append(invalid, []string{
+			"\\start",
+			"mid\\dle",
+			"end\\",
+			"\\",
+			"\\.",
+			"com².whatever",
+			"lpT2",
+			"Prn.",
+			"nUl",
+			"AUX",
+			"A<A",
+			"A>A",
+			"A:A",
+			"A\"A",
+			"A|A",
+			"A?A",
+			"A*A",
+			"end.dot.",
+			"end.space ",
+		}...)
+	}
+
+	for _, v := range invalid {
+		err := filesystem.ValidatePathComponent(v)
+		assert.ErrorIs(t, err, filesystem.ErrInvalidPath, v)
+	}
+
+	for _, v := range valid {
+		err := filesystem.ValidatePathComponent(v)
+		assert.NilError(t, err, v)
+	}
+}
diff --git a/pkg/store/filestore_unix.go b/pkg/internal/filesystem/path_unix.go
similarity index 75%
rename from pkg/store/filestore_unix.go
rename to pkg/internal/filesystem/path_unix.go
index b694b6fc744..4db2bd42e48 100644
--- a/pkg/store/filestore_unix.go
+++ b/pkg/internal/filesystem/path_unix.go
@@ -16,14 +16,14 @@
    limitations under the License.
 */
 
-package store
+package filesystem
 
 import (
 	"fmt"
 	"regexp"
 )
 
-// Note that Darwin has different restrictions - though, we do not support Darwin at this point...
+// Note that Darwin has different restrictions on colons.
 // https://stackoverflow.com/questions/1976007/what-characters-are-forbidden-in-windows-and-linux-directory-names
 var (
 	disallowedKeywords = regexp.MustCompile(`^([.]|[.][.])$`)
@@ -32,11 +32,11 @@ var (
 
 func validatePlatformSpecific(pathComponent string) error {
 	if reservedCharacters.MatchString(pathComponent) {
-		return fmt.Errorf("identifier %q cannot contain any of the following characters: %q", pathComponent, reservedCharacters)
+		return fmt.Errorf("%w: %q (%q)", errForbiddenChars, pathComponent, reservedCharacters)
 	}
 
 	if disallowedKeywords.MatchString(pathComponent) {
-		return fmt.Errorf("identifier %q cannot be any of the reserved keywords: %q", pathComponent, disallowedKeywords)
+		return fmt.Errorf("%w: %q (%q)", errForbiddenKeywords, pathComponent, disallowedKeywords)
 	}
 
 	return nil
diff --git a/pkg/store/filestore_windows.go b/pkg/internal/filesystem/path_windows.go
similarity index 78%
rename from pkg/store/filestore_windows.go
rename to pkg/internal/filesystem/path_windows.go
index 7c599803cb5..1853d3aed21 100644
--- a/pkg/store/filestore_windows.go
+++ b/pkg/internal/filesystem/path_windows.go
@@ -14,9 +14,10 @@
    limitations under the License.
 */
 
-package store
+package filesystem
 
 import (
+	"errors"
 	"fmt"
 	"regexp"
 )
@@ -26,19 +27,21 @@ import (
 var (
 	disallowedKeywords = regexp.MustCompile(`(?i)^(con|prn|nul|aux|com[1-9¹²³]|lpt[1-9¹²³])([.].*)?$`)
 	reservedCharacters = regexp.MustCompile(`[\x{0}-\x{1f}<>:"/\\|?*]`)
+
+	errNoEndingSpaceDot = errors.New("component cannot end with a space or dot")
 )
 
 func validatePlatformSpecific(pathComponent string) error {
 	if reservedCharacters.MatchString(pathComponent) {
-		return fmt.Errorf("identifier %q cannot contain any of the following characters: %q", pathComponent, reservedCharacters)
+		return fmt.Errorf("%w: %q (%q)", errForbiddenChars, pathComponent, reservedCharacters)
 	}
 
 	if disallowedKeywords.MatchString(pathComponent) {
-		return fmt.Errorf("identifier %q cannot be any of the reserved keywords: %q", pathComponent, disallowedKeywords)
+		return fmt.Errorf("%w: %q (%q)", errForbiddenKeywords, pathComponent, disallowedKeywords)
 	}
 
 	if pathComponent[len(pathComponent)-1:] == "." || pathComponent[len(pathComponent)-1:] == " " {
-		return fmt.Errorf("identifier %q cannot end with a space or dot", pathComponent)
+		return fmt.Errorf("%w: %q", errNoEndingSpaceDot, pathComponent)
 	}
 
 	return nil
diff --git a/pkg/logging/logging.go b/pkg/logging/logging.go
index 3030660cf0e..65cc1ddd31e 100644
--- a/pkg/logging/logging.go
+++ b/pkg/logging/logging.go
@@ -38,7 +38,7 @@ import (
 	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
 
-	"github.com/containerd/nerdctl/v2/pkg/lockutil"
+	"github.com/containerd/nerdctl/v2/pkg/internal/filesystem"
 )
 
 const (
@@ -160,7 +160,7 @@ func getLockPath(dataStore, ns, id string) string {
 
 // WaitForLogger waits until the logger has finished executing and processing container logs
 func WaitForLogger(dataStore, ns, id string) error {
-	return lockutil.WithDirLock(getLockPath(dataStore, ns, id), func() error {
+	return filesystem.WithDirLock(getLockPath(dataStore, ns, id), func() error {
 		return nil
 	})
 }
@@ -314,7 +314,7 @@ func loggerFunc(dataStore string) (logging.LoggerFunc, error) {
 			// the logger will obtain an exclusive lock on a file until the container is
 			// stopped and the driver has finished processing all output,
 			// so that waiting log viewers can be signalled when the process is complete.
-			return lockutil.WithDirLock(loggerLock, func() error {
+			return filesystem.WithDirLock(loggerLock, func() error {
 				if err := ready(); err != nil {
 					return err
 				}
diff --git a/pkg/netutil/store.go b/pkg/netutil/store.go
index 4d07db28fa9..627468e8f85 100644
--- a/pkg/netutil/store.go
+++ b/pkg/netutil/store.go
@@ -24,7 +24,7 @@ import (
 
 	"github.com/containerd/errdefs"
 
-	"github.com/containerd/nerdctl/v2/pkg/lockutil"
+	"github.com/containerd/nerdctl/v2/pkg/internal/filesystem"
 )
 
 // NOTE: libcni is not safe to use concurrently - or at least delegates concurrency management to the consumer.
@@ -48,7 +48,7 @@ func fsRemove(e *CNIEnv, net *NetworkConfig) error {
 		}
 		return net.clean()
 	}
-	return lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), fn)
+	return filesystem.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), fn)
 }
 
 func fsExists(e *CNIEnv, name string) (bool, error) {
@@ -62,7 +62,7 @@ func fsWrite(e *CNIEnv, net *NetworkConfig) error {
 	// Concurrent access may independently first figure out that a given network is missing, and while the lock
 	// here will prevent concurrent writes, one of the routines will fail.
 	// Consuming code MUST account for that scenario.
-	return lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), func() error {
+	return filesystem.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), func() error {
 		if _, err := os.Stat(filename); err == nil {
 			return errdefs.ErrAlreadyExists
 		}
@@ -73,7 +73,7 @@ func fsWrite(e *CNIEnv, net *NetworkConfig) error {
 func fsRead(e *CNIEnv) ([]*NetworkConfig, error) {
 	var nc []*NetworkConfig
 	var err error
-	err = lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), func() error {
+	err = filesystem.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), func() error {
 		namespaced := []string{}
 		var common []string
 		common, err = libcni.ConfFiles(e.NetconfPath, []string{".conf", ".conflist", ".json"})
diff --git a/pkg/ocihook/ocihook.go b/pkg/ocihook/ocihook.go
index d035a4ad968..79385396f59 100644
--- a/pkg/ocihook/ocihook.go
+++ b/pkg/ocihook/ocihook.go
@@ -38,8 +38,8 @@ import (
 
 	"github.com/containerd/nerdctl/v2/pkg/bypass4netnsutil"
 	"github.com/containerd/nerdctl/v2/pkg/dnsutil/hostsstore"
+	"github.com/containerd/nerdctl/v2/pkg/internal/filesystem"
 	"github.com/containerd/nerdctl/v2/pkg/labels"
-	"github.com/containerd/nerdctl/v2/pkg/lockutil"
 	"github.com/containerd/nerdctl/v2/pkg/namestore"
 	"github.com/containerd/nerdctl/v2/pkg/netutil"
 	"github.com/containerd/nerdctl/v2/pkg/netutil/nettype"
@@ -109,11 +109,11 @@ func Run(stdin io.Reader, stderr io.Writer, event, dataStore, cniPath, cniNetcon
 	if err != nil {
 		return err
 	}
-	lock, err := lockutil.Lock(filepath.Join(cniNetconfPath, ".cni-concurrency.lock"))
+	lock, err := filesystem.Lock(filepath.Join(cniNetconfPath, ".cni-concurrency.lock"))
 	if err != nil {
 		return err
 	}
-	defer lockutil.Unlock(lock)
+	defer filesystem.Unlock(lock)
 
 	opts, err := newHandlerOpts(&state, dataStore, cniPath, cniNetconfPath, bridgeIP)
 	if err != nil {
diff --git a/pkg/store/filestore.go b/pkg/store/filestore.go
index 312155230fa..2ad3982eb4b 100644
--- a/pkg/store/filestore.go
+++ b/pkg/store/filestore.go
@@ -21,10 +21,9 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"strings"
 	"sync"
 
-	"github.com/containerd/nerdctl/v2/pkg/lockutil"
+	"github.com/containerd/nerdctl/v2/pkg/internal/filesystem"
 )
 
 // TODO: implement a read-lock in lockutil, in addition to the current exclusive write-lock
@@ -75,7 +74,7 @@ type fileStore struct {
 func (vs *fileStore) Lock() error {
 	vs.mutex.Lock()
 
-	dirFile, err := lockutil.Lock(vs.dir)
+	dirFile, err := filesystem.Lock(vs.dir)
 	if err != nil {
 		return errors.Join(ErrLockFailure, err)
 	}
@@ -96,7 +95,7 @@ func (vs *fileStore) Release() error {
 		vs.locked = nil
 	}()
 
-	if err := lockutil.Unlock(vs.locked); err != nil {
+	if err := filesystem.Unlock(vs.locked); err != nil {
 		return errors.Join(ErrLockFailure, err)
 	}
 
@@ -194,7 +193,11 @@ func (vs *fileStore) Set(data []byte, key ...string) error {
 		}
 	}
 
-	return atomicWrite(parent, fileName, vs.filePerm, data)
+	if err := filesystem.AtomicWrite(parent, fileName, vs.filePerm, data); err != nil {
+		return errors.Join(ErrSystemFailure, err)
+	}
+
+	return nil
 }
 
 func (vs *fileStore) List(key ...string) ([]string, error) {
@@ -204,8 +207,8 @@ func (vs *fileStore) List(key ...string) ([]string, error) {
 
 	// Unlike Get, Set and Delete, List can have zero length key
 	for _, k := range key {
-		if err := ValidatePathComponent(k); err != nil {
-			return nil, err
+		if err := filesystem.ValidatePathComponent(k); err != nil {
+			return nil, errors.Join(ErrInvalidArgument, err)
 		}
 	}
 
@@ -333,24 +336,6 @@ func (vs *fileStore) GroupSize(key ...string) (int64, error) {
 	return size, nil
 }
 
-// ValidatePathComponent will enforce os specific filename restrictions on a single path component
-func ValidatePathComponent(pathComponent string) error {
-	// https://en.wikipedia.org/wiki/Comparison_of_file_systems#Limits
-	if len(pathComponent) > 255 {
-		return errors.Join(ErrInvalidArgument, errors.New("identifiers must be stricly shorter than 256 characters"))
-	}
-
-	if strings.TrimSpace(pathComponent) == "" {
-		return errors.Join(ErrInvalidArgument, errors.New("identifier cannot be empty"))
-	}
-
-	if err := validatePlatformSpecific(pathComponent); err != nil {
-		return errors.Join(ErrInvalidArgument, err)
-	}
-
-	return nil
-}
-
 // validateAllPathComponents will enforce validation for a slice of components
 func validateAllPathComponents(pathComponent ...string) error {
 	if len(pathComponent) == 0 {
@@ -358,26 +343,17 @@ func validateAllPathComponents(pathComponent ...string) error {
 	}
 
 	for _, key := range pathComponent {
-		if err := ValidatePathComponent(key); err != nil {
-			return err
+		if err := filesystem.ValidatePathComponent(key); err != nil {
+			return errors.Join(ErrInvalidArgument, err)
 		}
 	}
 
 	return nil
 }
 
-func atomicWrite(parent string, fileName string, perm os.FileMode, data []byte) error {
-	dest := filepath.Join(parent, fileName)
-	temp := filepath.Join(parent, ".temp."+fileName)
-
-	err := os.WriteFile(temp, data, perm)
-	if err != nil {
-		return errors.Join(ErrSystemFailure, err)
-	}
-
-	err = os.Rename(temp, dest)
-	if err != nil {
-		return errors.Join(ErrSystemFailure, err)
+func IsFilesystemSafe(identifier string) error {
+	if err := filesystem.ValidatePathComponent(identifier); err != nil {
+		return errors.Join(ErrInvalidArgument, err)
 	}
 
 	return nil
diff --git a/pkg/store/filestore_test.go b/pkg/store/filestore_test.go
index 58f4eebeef0..2496b96cbb1 100644
--- a/pkg/store/filestore_test.go
+++ b/pkg/store/filestore_test.go
@@ -17,8 +17,6 @@
 package store
 
 import (
-	"fmt"
-	"runtime"
 	"testing"
 	"time"
 
@@ -220,60 +218,3 @@ func TestFileStoreConcurrent(t *testing.T) {
 	})
 	assert.NilError(t, lErr, "locking should not error")
 }
-
-func TestFileStoreFilesystemRestrictions(t *testing.T) {
-	invalid := []string{
-		"/",
-		"/start",
-		"mid/dle",
-		"end/",
-		".",
-		"..",
-		"",
-		fmt.Sprintf("A%0255s", "A"),
-	}
-
-	valid := []string{
-		fmt.Sprintf("A%0254s", "A"),
-		"test",
-		"test-hyphen",
-		".start.dot",
-		"mid.dot",
-		"∞",
-	}
-
-	if runtime.GOOS == "windows" {
-		invalid = append(invalid, []string{
-			"\\start",
-			"mid\\dle",
-			"end\\",
-			"\\",
-			"\\.",
-			"com².whatever",
-			"lpT2",
-			"Prn.",
-			"nUl",
-			"AUX",
-			"A<A",
-			"A>A",
-			"A:A",
-			"A\"A",
-			"A|A",
-			"A?A",
-			"A*A",
-			"end.dot.",
-			"end.space ",
-		}...)
-	}
-
-	for _, v := range invalid {
-		err := ValidatePathComponent(v)
-		assert.ErrorIs(t, err, ErrInvalidArgument, v)
-	}
-
-	for _, v := range valid {
-		err := ValidatePathComponent(v)
-		assert.NilError(t, err, v)
-	}
-
-}
diff --git a/pkg/testutil/testutil.go b/pkg/testutil/testutil.go
index dd57f2821e7..14d322de07b 100644
--- a/pkg/testutil/testutil.go
+++ b/pkg/testutil/testutil.go
@@ -44,7 +44,7 @@ import (
 	"github.com/containerd/nerdctl/v2/pkg/infoutil"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/native"
-	"github.com/containerd/nerdctl/v2/pkg/lockutil"
+	"github.com/containerd/nerdctl/v2/pkg/internal/filesystem"
 	"github.com/containerd/nerdctl/v2/pkg/platformutil"
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 )
@@ -524,14 +524,14 @@ func M(m *testing.M) {
 		os.Chmod(filepath.Dir(testLockFile), 0o777)
 
 		// Acquire lock
-		lock, err := lockutil.Lock(filepath.Dir(testLockFile))
+		lock, err := filesystem.Lock(filepath.Dir(testLockFile))
 		if err != nil {
 			log.L.WithError(err).Errorf("failed acquiring testing lock %q", filepath.Dir(testLockFile))
 			return 1
 		}
 
 		// Release...
-		defer lockutil.Unlock(lock)
+		defer filesystem.Unlock(lock)
 
 		// Create marker file
 		err = os.WriteFile(testLockFile, []byte("prevent testing from running in parallel for subpackages integration tests"), 0o666)

From ff0e8ec80710a127f22eb6cac00b5d36bb19b3b8 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 15 May 2025 10:15:49 -0700
Subject: [PATCH 202/225] Cleanup leftover on build test

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/builder/builder_build_test.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cmd/nerdctl/builder/builder_build_test.go b/cmd/nerdctl/builder/builder_build_test.go
index 09ff4bfc8b4..839fd0d6e01 100644
--- a/cmd/nerdctl/builder/builder_build_test.go
+++ b/cmd/nerdctl/builder/builder_build_test.go
@@ -110,6 +110,7 @@ CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier("ignored"))
+					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
 				Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 			},

From d9cf5285101092f27d304d1898538ceb88e8c660 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 15 May 2025 10:39:06 -0700
Subject: [PATCH 203/225] Cleanup containers tests

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .../container/container_exec_linux_test.go    |   3 +
 .../container_run_mount_linux_test.go         |   2 +
 .../container_run_network_linux_test.go       | 272 +++++++-----------
 3 files changed, 104 insertions(+), 173 deletions(-)

diff --git a/cmd/nerdctl/container/container_exec_linux_test.go b/cmd/nerdctl/container/container_exec_linux_test.go
index 5ff812d9429..9eafe7939bd 100644
--- a/cmd/nerdctl/container/container_exec_linux_test.go
+++ b/cmd/nerdctl/container/container_exec_linux_test.go
@@ -65,6 +65,9 @@ func TestExecTTY(t *testing.T) {
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage, "sleep", nerdtest.Infinity)
+
+		nerdtest.EnsureContainerStarted(helpers, data.Identifier())
+
 		data.Labels().Set("container_name", data.Identifier())
 	}
 
diff --git a/cmd/nerdctl/container/container_run_mount_linux_test.go b/cmd/nerdctl/container/container_run_mount_linux_test.go
index c941d8d39fb..397ccf12969 100644
--- a/cmd/nerdctl/container/container_run_mount_linux_test.go
+++ b/cmd/nerdctl/container/container_run_mount_linux_test.go
@@ -352,6 +352,8 @@ func TestRunBindMountBind(t *testing.T) {
 			"top",
 		)
 
+		nerdtest.EnsureContainerStarted(helpers, data.Identifier("container"))
+
 		// Save host rwDir location and container id for subtests
 		data.Labels().Set("container", data.Identifier("container"))
 		data.Labels().Set("rwDir", rwDir)
diff --git a/cmd/nerdctl/container/container_run_network_linux_test.go b/cmd/nerdctl/container/container_run_network_linux_test.go
index 46b9057e11a..f8a93aaa6a2 100644
--- a/cmd/nerdctl/container/container_run_network_linux_test.go
+++ b/cmd/nerdctl/container/container_run_network_linux_test.go
@@ -361,11 +361,8 @@ func TestRunWithInvalidPortThenCleanUp(t *testing.T) {
 	testCase.SubTests = []*test.Case{
 		{
 			Description: "Run a container with invalid ports, and then clean up.",
-			Cleanup: func(data test.Data, helpers test.Helpers) {
-				helpers.Anyhow("rm", "--data-root", data.Temp().Path(), "-f", data.Identifier())
-			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--data-root", data.Temp().Path(), "--rm", "--name", data.Identifier(), "-p", "22200-22299:22200-22299", testutil.CommonImage)
+				return helpers.Command("run", "--data-root", data.Temp().Path(), "--rm", "-p", "22200-22299:22200-22299", testutil.CommonImage)
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -518,158 +515,104 @@ func TestSharedNetworkSetup(t *testing.T) {
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
-			data.Labels().Set("containerName1", data.Identifier("-container1"))
-			containerName1 := data.Labels().Get("containerName1")
-			helpers.Ensure("run", "-d", "--name", containerName1,
-				testutil.NginxAlpineImage)
+			data.Labels().Set("container1", data.Identifier("container1"))
+			helpers.Ensure("run", "-d", "--name", data.Identifier("container1"),
+				testutil.CommonImage, "sleep", "inf")
+			nerdtest.EnsureContainerStarted(helpers, data.Identifier("container1"))
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rm", "-f", data.Identifier("-container1"))
+			helpers.Anyhow("rm", "-f", data.Identifier("container1"))
 		},
 		SubTests: []*test.Case{
 			{
 				Description: "Test network is shared",
 				NoParallel:  true, // The validation involves starting of the main container: container1
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					helpers.Anyhow("rm", "-f", data.Identifier())
+					helpers.Anyhow("rm", "-f", data.Identifier("container2"))
 				},
-				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					containerName2 := data.Identifier()
-					cmd := helpers.Command()
-					cmd.WithArgs("run", "-d", "--name", containerName2,
-						"--network=container:"+data.Labels().Get("containerName1"),
+				Setup: func(data test.Data, helpers test.Helpers) {
+					helpers.Ensure(
+						"run", "-d", "--name", data.Identifier("container2"),
+						"--network=container:"+data.Labels().Get("container1"),
 						testutil.NginxAlpineImage)
-					return cmd
+					data.Labels().Set("container2", data.Identifier("container2"))
+					nerdtest.EnsureContainerStarted(helpers, data.Identifier("container2"))
 				},
-				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
-					return &test.Expected{
-						Output: func(stdout string, info string, t *testing.T) {
-							containerName2 := data.Identifier()
-							assert.Assert(t, strings.Contains(helpers.Capture("exec", containerName2, "wget", "-qO-", "http://127.0.0.1:80"), testutil.NginxAlpineIndexHTMLSnippet), info)
-							helpers.Ensure("restart", data.Labels().Get("containerName1"))
-							helpers.Ensure("stop", "--time=1", containerName2)
-							helpers.Ensure("start", containerName2)
-							assert.Assert(t, strings.Contains(helpers.Capture("exec", containerName2, "wget", "-qO-", "http://127.0.0.1:80"), testutil.NginxAlpineIndexHTMLSnippet), info)
+				SubTests: []*test.Case{
+					{
+						NoParallel:  true,
+						Description: "Test network is shared",
+						Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+							return helpers.Command("exec", data.Labels().Get("container2"), "wget", "-qO-", "http://127.0.0.1:80")
+
 						},
-					}
+						Expected: test.Expects(0, nil, expect.Contains(testutil.NginxAlpineIndexHTMLSnippet)),
+					},
+					{
+						NoParallel:  true,
+						Description: "Test network is shared after restart",
+						Setup: func(data test.Data, helpers test.Helpers) {
+							helpers.Ensure("restart", data.Labels().Get("container1"))
+							helpers.Ensure("stop", "--time=1", data.Labels().Get("container2"))
+							helpers.Ensure("start", data.Labels().Get("container2"))
+							nerdtest.EnsureContainerStarted(helpers, data.Labels().Get("container2"))
+						},
+						Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+							return helpers.Command("exec", data.Labels().Get("container2"), "wget", "-qO-", "http://127.0.0.1:80")
+
+						},
+						Expected: test.Expects(0, nil, expect.Contains(testutil.NginxAlpineIndexHTMLSnippet)),
+					},
 				},
 			},
 			{
 				Description: "Test uts is supported in shared network",
-				Cleanup: func(data test.Data, helpers test.Helpers) {
-					helpers.Anyhow("rm", "-f", data.Identifier())
-				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					containerName2 := data.Identifier()
-					cmd := helpers.Command()
-					cmd.WithArgs("run", "-d", "--name", containerName2, "--uts", "host",
-						"--network=container:"+data.Labels().Get("containerName1"),
-						testutil.AlpineImage)
-					return cmd
-				},
-				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
-					return &test.Expected{
-						ExitCode: 0,
-					}
+					return helpers.Command("run", "--rm", "--uts", "host",
+						"--network=container:"+data.Labels().Get("container1"),
+						testutil.CommonImage)
 				},
+				Expected: test.Expects(0, nil, nil),
 			},
 			{
 				Description: "Test dns is not supported",
-				Cleanup: func(data test.Data, helpers test.Helpers) {
-					helpers.Anyhow("rm", "-f", data.Identifier())
-				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					containerName2 := data.Identifier()
-					cmd := helpers.Command()
-					cmd.WithArgs("run", "-d", "--name", containerName2, "--dns", "0.1.2.3",
-						"--network=container:"+data.Labels().Get("containerName1"),
-						testutil.AlpineImage)
-					return cmd
-				},
-				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
-					if nerdtest.IsDocker() {
-						return &test.Expected{
-							ExitCode: 125,
-						}
-
-					}
-					return &test.Expected{
-						ExitCode: 1,
-					}
+					return helpers.Command("run", "--rm", "--dns", "0.1.2.3",
+						"--network=container:"+data.Labels().Get("container1"),
+						testutil.CommonImage)
 				},
+				// 1 for nerdctl, 125 for docker
+				Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 			},
 			{
 				Description: "Test dns options is not  supported",
-				Cleanup: func(data test.Data, helpers test.Helpers) {
-					helpers.Anyhow("rm", "-f", data.Identifier())
-				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					containerName2 := data.Identifier()
-					cmd := helpers.Command()
-					cmd.WithArgs("run", "--name", containerName2, "--dns-option", "attempts:5",
-						"--network=container:"+data.Labels().Get("containerName1"),
-						testutil.AlpineImage, "cat", "/etc/resolv.conf")
-					return cmd
-				},
-				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
-					// The Option doesnt throw an error but is never inserted to the resolv.conf
-					return &test.Expected{
-						ExitCode: 0,
-						Output: func(stdout string, info string, t *testing.T) {
-							assert.Assert(t, !strings.Contains(stdout, "attempts:5"), info)
-						},
-					}
+					return helpers.Command("run", "--rm", "--dns-option", "attempts:5",
+						"--network=container:"+data.Labels().Get("container1"),
+						testutil.CommonImage, "cat", "/etc/resolv.conf")
 				},
+				// The Option doesn't throw an error but is never inserted to the resolv.conf
+				Expected: test.Expects(0, nil, expect.DoesNotContain("attempts:5")),
 			},
 			{
 				Description: "Test publish is not supported",
-				Cleanup: func(data test.Data, helpers test.Helpers) {
-					helpers.Anyhow("rm", "-f", data.Identifier())
-				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					containerName2 := data.Identifier()
-					cmd := helpers.Command()
-					cmd.WithArgs("run", "-d", "--name", containerName2, "--publish", "80:8080",
-						"--network=container:"+data.Labels().Get("containerName1"),
+					return helpers.Command("run", "--rm", "--publish", "80:8080",
+						"--network=container:"+data.Labels().Get("container1"),
 						testutil.AlpineImage)
-					return cmd
-				},
-				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
-					if nerdtest.IsDocker() {
-						return &test.Expected{
-							ExitCode: 125,
-						}
-
-					}
-					return &test.Expected{
-						ExitCode: 1,
-					}
 				},
+				// 1 for nerdctl, 125 for docker
+				Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 			},
 			{
 				Description: "Test hostname is not supported",
-				Cleanup: func(data test.Data, helpers test.Helpers) {
-					helpers.Anyhow("rm", "-f", data.Identifier())
-				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					containerName2 := data.Identifier()
-					cmd := helpers.Command()
-					cmd.WithArgs("run", "-d", "--name", containerName2, "--hostname", "test",
-						"--network=container:"+data.Labels().Get("containerName1"),
+					return helpers.Command("run", "--rm", "--hostname", "test",
+						"--network=container:"+data.Labels().Get("container1"),
 						testutil.AlpineImage)
-					return cmd
-				},
-				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
-					if nerdtest.IsDocker() {
-						return &test.Expected{
-							ExitCode: 125,
-						}
-
-					}
-					return &test.Expected{
-						ExitCode: 1,
-					}
 				},
+				// 1 for nerdctl, 125 for docker
+				Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 			},
 		},
 	}
@@ -682,15 +625,15 @@ func TestSharedNetworkWithNone(t *testing.T) {
 		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
 			helpers.Ensure("run", "-d", "--name", data.Identifier("container1"), "--network", "none",
-				testutil.NginxAlpineImage)
+				testutil.CommonImage, "sleep", "inf")
+			nerdtest.EnsureContainerStarted(helpers, data.Identifier("container1"))
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rm", "-f", data.Identifier("container1"))
-			helpers.Anyhow("rm", "-f", data.Identifier("container2"))
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("run", "-d", "--name", data.Identifier("container2"),
-				"--network=container:"+data.Identifier("container1"), testutil.NginxAlpineImage)
+			return helpers.Command("run", "--rm",
+				"--network=container:"+data.Identifier("container1"), testutil.CommonImage)
 		},
 		Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 	}
@@ -914,13 +857,14 @@ func TestNoneNetworkHostName(t *testing.T) {
 	nerdtest.Setup()
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
+		Cleanup: func(data test.Data, helpers test.Helpers) {
+			helpers.Anyhow("rm", "-f", data.Identifier())
+		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			output := helpers.Capture("run", "-d", "--name", data.Identifier(), "--network", "none", testutil.NginxAlpineImage)
+			output := helpers.Capture("run", "-d", "--name", data.Identifier(), "--network", "none", testutil.CommonImage, "sleep", "inf")
 			assert.Assert(helpers.T(), len(output) > 12, output)
 			data.Labels().Set("hostname", output[:12])
-		},
-		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rm", "-f", data.Identifier())
+			nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			return helpers.Command("exec", data.Identifier(), "cat", "/etc/hostname")
@@ -939,20 +883,20 @@ func TestHostNetworkHostName(t *testing.T) {
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
-			data.Labels().Set("containerName1", data.Identifier())
-		},
-		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rm", "-f", data.Identifier())
+			helpers.Custom("cat", "/etc/hostname").Run(&test.Expected{
+				Output: func(stdout, info string, t *testing.T) {
+					data.Labels().Set("hostHostname", stdout)
+				},
+			})
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Custom("cat", "/etc/hostname")
+			return helpers.Command("run", "--rm",
+				"--network", "host",
+				testutil.AlpineImage, "cat", "/etc/hostname")
 		},
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
-				Output: func(stdout string, info string, t *testing.T) {
-					hostname := stdout
-					assert.Assert(t, strings.Compare(strings.TrimSpace(helpers.Capture("run", "--name", data.Identifier(), "--network", "host", testutil.AlpineImage, "cat", "/etc/hostname")), strings.TrimSpace(hostname)) == 0, info)
-				},
+				Output: expect.Equals(data.Labels().Get("hostHostname")),
 			}
 		},
 	}
@@ -963,27 +907,18 @@ func TestNoneNetworkDnsConfigs(t *testing.T) {
 	nerdtest.Setup()
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
-		Setup: func(data test.Data, helpers test.Helpers) {
-			data.Labels().Set("containerName1", data.Identifier())
-		},
-		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rm", "-f", data.Identifier())
-		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("run", "-d", "--name", data.Identifier(), "--network", "none", "--dns", "0.1.2.3", "--dns-search", "example.com", "--dns-option", "timeout:3", "--dns-option", "attempts:5", testutil.NginxAlpineImage)
-		},
-		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
-			return &test.Expected{
-				Output: func(stdout string, info string, t *testing.T) {
-					out := helpers.Capture("exec", data.Identifier(), "cat", "/etc/resolv.conf")
-					assert.Assert(t, strings.Contains(out, "0.1.2.3"), info)
-					assert.Assert(t, strings.Contains(out, "example.com"), info)
-					assert.Assert(t, strings.Contains(out, "attempts:5"), info)
-					assert.Assert(t, strings.Contains(out, "timeout:3"), info)
-
-				},
-			}
-		},
+			return helpers.Command("run", "--rm",
+				"--network", "none",
+				"--dns", "0.1.2.3", "--dns-search", "example.com", "--dns-option", "timeout:3", "--dns-option", "attempts:5",
+				testutil.CommonImage, "cat", "/etc/resolv.conf")
+		},
+		Expected: test.Expects(0, nil, expect.Contains(
+			"0.1.2.3",
+			"example.com",
+			"attempts:5",
+			"timeout:3",
+		)),
 	}
 	testCase.Run(t)
 }
@@ -992,27 +927,18 @@ func TestHostNetworkDnsConfigs(t *testing.T) {
 	nerdtest.Setup()
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
-		Setup: func(data test.Data, helpers test.Helpers) {
-			data.Labels().Set("containerName1", data.Identifier())
-		},
-		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rm", "-f", data.Identifier())
-		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("run", "-d", "--name", data.Identifier(), "--network", "host", "--dns", "0.1.2.3", "--dns-search", "example.com", "--dns-option", "timeout:3", "--dns-option", "attempts:5", testutil.NginxAlpineImage)
-		},
-		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
-			return &test.Expected{
-				Output: func(stdout string, info string, t *testing.T) {
-					out := helpers.Capture("exec", data.Identifier(), "cat", "/etc/resolv.conf")
-					assert.Assert(t, strings.Contains(out, "0.1.2.3"), info)
-					assert.Assert(t, strings.Contains(out, "example.com"), info)
-					assert.Assert(t, strings.Contains(out, "attempts:5"), info)
-					assert.Assert(t, strings.Contains(out, "timeout:3"), info)
-
-				},
-			}
-		},
+			return helpers.Command("run", "--rm",
+				"--network", "host",
+				"--dns", "0.1.2.3", "--dns-search", "example.com", "--dns-option", "timeout:3", "--dns-option", "attempts:5",
+				testutil.CommonImage, "cat", "/etc/resolv.conf")
+		},
+		Expected: test.Expects(0, nil, expect.Contains(
+			"0.1.2.3",
+			"example.com",
+			"attempts:5",
+			"timeout:3",
+		)),
 	}
 	testCase.Run(t)
 }

From 3388ef6a2252f3feb6fe6e04a1ca1462393b84f1 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 15 May 2025 12:01:02 -0700
Subject: [PATCH 204/225] Re-enable tests following fixes

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/image/image_list_test.go   | 6 ++----
 cmd/nerdctl/volume/volume_list_test.go | 2 --
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/cmd/nerdctl/image/image_list_test.go b/cmd/nerdctl/image/image_list_test.go
index 6eba01c84c5..96b04c3faa7 100644
--- a/cmd/nerdctl/image/image_list_test.go
+++ b/cmd/nerdctl/image/image_list_test.go
@@ -269,15 +269,13 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 			},
 			{
 				Description: "since=non-exists-image",
-				Require:     nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3511"),
 				Command:     test.Command("images", "--filter", "since=non-exists-image"),
-				Expected:    test.Expects(expect.ExitCodeGenericFail, []error{errors.New("No such image: ")}, nil),
+				Expected:    test.Expects(expect.ExitCodeGenericFail, []error{errors.New("no such image: ")}, nil),
 			},
 			{
 				Description: "before=non-exists-image",
-				Require:     nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3511"),
 				Command:     test.Command("images", "--filter", "before=non-exists-image"),
-				Expected:    test.Expects(expect.ExitCodeGenericFail, []error{errors.New("No such image: ")}, nil),
+				Expected:    test.Expects(expect.ExitCodeGenericFail, []error{errors.New("no such image: ")}, nil),
 			},
 		},
 	}
diff --git a/cmd/nerdctl/volume/volume_list_test.go b/cmd/nerdctl/volume/volume_list_test.go
index d666595abc6..8dca19fa584 100644
--- a/cmd/nerdctl/volume/volume_list_test.go
+++ b/cmd/nerdctl/volume/volume_list_test.go
@@ -282,8 +282,6 @@ func TestVolumeLsFilter(t *testing.T) {
 		},
 		{
 			Description: "Retrieving name=volume1 and name=volume2",
-			// Nerdctl filter behavior is broken
-			Require: nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3452"),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("volume", "ls", "--quiet", "--filter", "name="+data.Labels().Get("vol1"), "--filter", "name="+data.Labels().Get("vol2"))
 			},

From d4cfdd94c5f6dc92bca57264b610d5379ec3ee86 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Thu, 15 May 2025 13:52:55 -0700
Subject: [PATCH 205/225] Fix use on non unique identifier

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/container/container_commit_linux_test.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cmd/nerdctl/container/container_commit_linux_test.go b/cmd/nerdctl/container/container_commit_linux_test.go
index e1a167c0633..a2b26dbd88e 100644
--- a/cmd/nerdctl/container/container_commit_linux_test.go
+++ b/cmd/nerdctl/container/container_commit_linux_test.go
@@ -53,8 +53,8 @@ func TestKubeCommitSave(t *testing.T) {
 	}
 
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
-		helpers.Ensure("commit", data.Labels().Get("containerID"), "testcommitsave")
-		return helpers.Command("save", "testcommitsave")
+		helpers.Ensure("commit", data.Labels().Get("containerID"), data.Identifier("testcommitsave"))
+		return helpers.Command("save", data.Identifier("testcommitsave"))
 	}
 
 	testCase.Expected = test.Expects(0, nil, nil)

From d28b664b37319643856ef4efe14e3a10fb353bb6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 15 May 2025 22:04:43 +0000
Subject: [PATCH 206/225] build(deps): bump docker/build-push-action from
 6.16.0 to 6.17.0

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.16.0 to 6.17.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/14487ce63c7a62a4a324b0bfb37086795e31c6c1...1dc73863535b631f98b2378be8619f83b136f4a0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 6.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/ghcr-image-build-and-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ghcr-image-build-and-publish.yml b/.github/workflows/ghcr-image-build-and-publish.yml
index 969eb67229f..300fd4574f5 100644
--- a/.github/workflows/ghcr-image-build-and-publish.yml
+++ b/.github/workflows/ghcr-image-build-and-publish.yml
@@ -61,7 +61,7 @@ jobs:
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
-        uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1  # v6.16.0
+        uses: docker/build-push-action@1dc73863535b631f98b2378be8619f83b136f4a0  # v6.17.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64

From cd1a24243ecbdde5c0777f5fd65a0fe77d55eda4 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 16 May 2025 18:49:07 -0700
Subject: [PATCH 207/225] Relax --runtime restrictions

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/compose/compose_up_test.go |  7 +------
 pkg/cmd/container/run_runtime.go       | 11 +++++++++--
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/cmd/nerdctl/compose/compose_up_test.go b/cmd/nerdctl/compose/compose_up_test.go
index e162ee6806d..eb17c7151c9 100644
--- a/cmd/nerdctl/compose/compose_up_test.go
+++ b/cmd/nerdctl/compose/compose_up_test.go
@@ -27,7 +27,6 @@ import (
 	"gotest.tools/v3/icmd"
 
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 // https://github.com/containerd/nerdctl/issues/1942
@@ -48,11 +47,7 @@ services:
 	c := base.ComposeCmd("-f", comp.YAMLFullPath(), "up", "-d")
 	expected := icmd.Expected{
 		ExitCode: 1,
-		Err:      `exec: \"invalid\": executable file not found in $PATH`,
-	}
-	// Docker expected err is different
-	if nerdtest.IsDocker() {
-		expected.Err = `unknown or invalid runtime name: invalid`
+		Err:      `invalid runtime name`,
 	}
 	c.Assert(expected)
 }
diff --git a/pkg/cmd/container/run_runtime.go b/pkg/cmd/container/run_runtime.go
index b6d0ac4965e..ac03e7b5b8c 100644
--- a/pkg/cmd/container/run_runtime.go
+++ b/pkg/cmd/container/run_runtime.go
@@ -18,6 +18,7 @@ package container
 
 import (
 	"context"
+	"os/exec"
 	"strings"
 
 	"github.com/opencontainers/runtime-spec/specs-go"
@@ -49,8 +50,14 @@ func generateRuntimeCOpts(cgroupManager, runtimeStr string) ([]containerd.NewCon
 				runtimeOpts = nil
 			}
 		} else {
-			// runtimeStr is a runc binary
-			runcOpts.BinaryName = runtimeStr
+			// runtimeStr may be a runc binary - check that it exists
+			// if it does not, treat it as a runtime
+			ex, err := exec.LookPath(runtimeStr)
+			if err != nil {
+				runtime = runtimeStr
+			} else {
+				runcOpts.BinaryName = ex
+			}
 		}
 	}
 	o := containerd.WithRuntime(runtime, runtimeOpts)

From c0e32debaea7ea88746fc8ee39e101d8e6bf5b03 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 16 May 2025 20:56:16 -0700
Subject: [PATCH 208/225] Add support for compose AdditionalContexts

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 pkg/composer/serviceparser/build.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkg/composer/serviceparser/build.go b/pkg/composer/serviceparser/build.go
index c13b264301a..d797d0690ba 100644
--- a/pkg/composer/serviceparser/build.go
+++ b/pkg/composer/serviceparser/build.go
@@ -34,7 +34,7 @@ import (
 
 func parseBuildConfig(c *types.BuildConfig, project *types.Project, imageName string) (*Build, error) {
 	if unknown := reflectutil.UnknownNonEmptyFields(c,
-		"Context", "Dockerfile", "Args", "CacheFrom", "Target", "Labels", "Secrets",
+		"Context", "Dockerfile", "Args", "CacheFrom", "Target", "Labels", "Secrets", "AdditionalContexts",
 	); len(unknown) > 0 {
 		log.L.Warnf("Ignoring: build: %+v", unknown)
 	}
@@ -72,6 +72,10 @@ func parseBuildConfig(c *types.BuildConfig, project *types.Project, imageName st
 		b.BuildArgs = append(b.BuildArgs, "--cache-from="+s)
 	}
 
+	for k, v := range c.AdditionalContexts {
+		b.BuildArgs = append(b.BuildArgs, "--build-context="+k+"="+v)
+	}
+
 	if c.Target != "" {
 		b.BuildArgs = append(b.BuildArgs, "--target="+c.Target)
 	}

From d166c3b0d8d2656b7448b8049aaaf94d7e0161d7 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 16 May 2025 21:18:09 -0700
Subject: [PATCH 209/225] Use only one build base in Dockerfile

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 Dockerfile | 69 +++++++++++++++++++++++++++---------------------------
 1 file changed, 34 insertions(+), 35 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index d0c218b8f34..e66d165188d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -55,11 +55,13 @@ ARG KUBO_VERSION=v0.34.1
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.6.1@sha256:923441d7c25f1e2eb5789f82d987693c47b8ed987c4ab3b075d6ed2b5d6779a3 AS xx
 
 
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-bookworm AS build-base-debian
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-bookworm AS build-base
 COPY --from=xx / /
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update -qq && apt-get install -qq --no-install-recommends \
+  make \
   git \
+  curl \
   dpkg-dev
 ARG TARGETARCH
 # libbtrfs: for containerd
@@ -74,10 +76,10 @@ RUN xx-apt-get update -qq && xx-apt-get install -qq --no-install-recommends \
 RUN git config --global advice.detachedHead false
 ADD hack/git-checkout-tag-with-hash.sh /usr/local/bin/
 
-FROM build-base-debian AS build-containerd
+FROM build-base AS build-containerd
 ARG TARGETARCH
 ARG CONTAINERD_VERSION
-RUN git clone --quiet --depth 1 --branch "${CONTAINERD_VERSION%@*}" https://github.com/containerd/containerd.git /go/src/github.com/containerd/containerd
+RUN git clone --quiet --depth 1 --branch "${CONTAINERD_VERSION%%@*}" https://github.com/containerd/containerd.git /go/src/github.com/containerd/containerd
 WORKDIR /go/src/github.com/containerd/containerd
 RUN git-checkout-tag-with-hash.sh ${CONTAINERD_VERSION} && \
   mkdir -p /out /out/$TARGETARCH && \
@@ -85,10 +87,10 @@ RUN git-checkout-tag-with-hash.sh ${CONTAINERD_VERSION} && \
 RUN GO=xx-go make STATIC=1 && \
   cp -a bin/containerd bin/containerd-shim-runc-v2 bin/ctr /out/$TARGETARCH
 
-FROM build-base-debian AS build-runc
+FROM build-base AS build-runc
 ARG RUNC_VERSION
 ARG TARGETARCH
-RUN git clone --quiet --depth 1 --branch "${RUNC_VERSION%@*}" https://github.com/opencontainers/runc.git /go/src/github.com/opencontainers/runc
+RUN git clone --quiet --depth 1 --branch "${RUNC_VERSION%%@*}" https://github.com/opencontainers/runc.git /go/src/github.com/opencontainers/runc
 WORKDIR /go/src/github.com/opencontainers/runc
 RUN git-checkout-tag-with-hash.sh ${RUNC_VERSION} && \
   mkdir -p /out
@@ -96,10 +98,10 @@ ENV CGO_ENABLED=1
 RUN GO=xx-go CC=$(xx-info)-gcc STRIP=$(xx-info)-strip make static && \
   xx-verify --static runc && cp -v -a runc /out/runc.${TARGETARCH}
 
-FROM build-base-debian AS build-bypass4netns
+FROM build-base AS build-bypass4netns
 ARG BYPASS4NETNS_VERSION
 ARG TARGETARCH
-RUN git clone --quiet --depth 1 --branch "${BYPASS4NETNS_VERSION%@*}" https://github.com/rootless-containers/bypass4netns.git /go/src/github.com/rootless-containers/bypass4netns
+RUN git clone --quiet --depth 1 --branch "${BYPASS4NETNS_VERSION%%@*}" https://github.com/rootless-containers/bypass4netns.git /go/src/github.com/rootless-containers/bypass4netns
 WORKDIR /go/src/github.com/rootless-containers/bypass4netns
 RUN git-checkout-tag-with-hash.sh ${BYPASS4NETNS_VERSION} && \
   mkdir -p /out/${TARGETARCH}
@@ -107,20 +109,20 @@ ENV CGO_ENABLED=1
 RUN GO=xx-go make static && \
   xx-verify --static bypass4netns && cp -a bypass4netns bypass4netnsd /out/${TARGETARCH}
 
-FROM build-base-debian AS build-gomodjail
+FROM build-base AS build-gomodjail
 ARG GOMODJAIL_VERSION
 ARG TARGETARCH
-RUN git clone --quiet --depth 1 --branch "${GOMODJAIL_VERSION%@*}" https://github.com/AkihiroSuda/gomodjail.git /go/src/github.com/AkihiroSuda/gomodjail
+RUN git clone --quiet --depth 1 --branch "${GOMODJAIL_VERSION%%@*}" https://github.com/AkihiroSuda/gomodjail.git /go/src/github.com/AkihiroSuda/gomodjail
 WORKDIR /go/src/github.com/AkihiroSuda/gomodjail
 RUN git-checkout-tag-with-hash.sh ${GOMODJAIL_VERSION} && \
   mkdir -p /out/${TARGETARCH}
 RUN GO=xx-go make STATIC=1 && \
   xx-verify --static _output/bin/gomodjail && cp -a _output/bin/gomodjail /out/${TARGETARCH}
 
-FROM build-base-debian AS build-kubo
+FROM build-base AS build-kubo
 ARG KUBO_VERSION
 ARG TARGETARCH
-RUN git clone --quiet --depth 1 --branch "${KUBO_VERSION%@*}" https://github.com/ipfs/kubo.git /go/src/github.com/ipfs/kubo
+RUN git clone --quiet --depth 1 --branch "${KUBO_VERSION%%@*}" https://github.com/ipfs/kubo.git /go/src/github.com/ipfs/kubo
 WORKDIR /go/src/github.com/ipfs/kubo
 RUN git-checkout-tag-with-hash.sh ${KUBO_VERSION} && \
   mkdir -p /out/${TARGETARCH}
@@ -129,11 +131,6 @@ RUN xx-go --wrap && \
   make build && \
   xx-verify --static cmd/ipfs/ipfs && cp -a cmd/ipfs/ipfs /out/${TARGETARCH}
 
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS build-base
-RUN apk add --no-cache make git curl
-RUN git config --global advice.detachedHead false
-ADD hack/git-checkout-tag-with-hash.sh /usr/local/bin/
-
 FROM build-base AS build-minimal
 RUN BINDIR=/out/bin make binaries install
 # We do not set CMD to `go test` here, because it requires systemd
@@ -148,12 +145,12 @@ RUN mkdir -p /out/share/doc/nerdctl-full && touch /out/share/doc/nerdctl-full/RE
 ARG CONTAINERD_VERSION
 COPY --from=build-containerd /out/${TARGETARCH:-amd64}/* /out/bin/
 COPY --from=build-containerd /out/containerd.service /out/lib/systemd/system/containerd.service
-RUN echo "- containerd: ${CONTAINERD_VERSION/@*}" >> /out/share/doc/nerdctl-full/README.md
+RUN echo "- containerd: ${CONTAINERD_VERSION%%@*}" >> /out/share/doc/nerdctl-full/README.md
 ARG RUNC_VERSION
 COPY --from=build-runc /out/runc.${TARGETARCH:-amd64} /out/bin/runc
-RUN echo "- runc: ${RUNC_VERSION/@*}" >> /out/share/doc/nerdctl-full/README.md
+RUN echo "- runc: ${RUNC_VERSION%%@*}" >> /out/share/doc/nerdctl-full/README.md
 ARG CNI_PLUGINS_VERSION
-RUN CNI_PLUGINS_VERSION=${CNI_PLUGINS_VERSION/@BINARY}; \
+RUN CNI_PLUGINS_VERSION=${CNI_PLUGINS_VERSION%%@*}; \
   fname="cni-plugins-${TARGETOS:-linux}-${TARGETARCH:-amd64}-${CNI_PLUGINS_VERSION}.tgz" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/containernetworking/plugins/releases/download/${CNI_PLUGINS_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/cni-plugins-${CNI_PLUGINS_VERSION}" | sha256sum -c && \
@@ -162,7 +159,7 @@ RUN CNI_PLUGINS_VERSION=${CNI_PLUGINS_VERSION/@BINARY}; \
   rm -f "${fname}" && \
   echo "- CNI plugins: ${CNI_PLUGINS_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG BUILDKIT_VERSION
-RUN BUILDKIT_VERSION=${BUILDKIT_VERSION/@BINARY}; \
+RUN BUILDKIT_VERSION=${BUILDKIT_VERSION%%@*}; \
   fname="buildkit-${BUILDKIT_VERSION}.${TARGETOS:-linux}-${TARGETARCH:-amd64}.tar.gz" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/moby/buildkit/releases/download/${BUILDKIT_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/buildkit-${BUILDKIT_VERSION}" | sha256sum -c && \
@@ -177,7 +174,7 @@ RUN cd /out/lib/systemd/system && \
   echo "" >> buildkit.service && \
   echo "# This file was converted from containerd.service, with \`sed -E '${sedcomm}'\`" >> buildkit.service
 ARG STARGZ_SNAPSHOTTER_VERSION
-RUN STARGZ_SNAPSHOTTER_VERSION=${STARGZ_SNAPSHOTTER_VERSION/@BINARY}; \
+RUN STARGZ_SNAPSHOTTER_VERSION=${STARGZ_SNAPSHOTTER_VERSION%%@*}; \
   fname="stargz-snapshotter-${STARGZ_SNAPSHOTTER_VERSION}-${TARGETOS:-linux}-${TARGETARCH:-amd64}.tar.gz" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/containerd/stargz-snapshotter/releases/download/${STARGZ_SNAPSHOTTER_VERSION}/${fname}" && \
   curl -o "stargz-snapshotter.service" -fsSL --proto '=https' --tlsv1.2 "https://raw.githubusercontent.com/containerd/stargz-snapshotter/${STARGZ_SNAPSHOTTER_VERSION}/script/config/etc/systemd/system/stargz-snapshotter.service" && \
@@ -188,13 +185,13 @@ RUN STARGZ_SNAPSHOTTER_VERSION=${STARGZ_SNAPSHOTTER_VERSION/@BINARY}; \
   mv stargz-snapshotter.service /out/lib/systemd/system/stargz-snapshotter.service && \
   echo "- Stargz Snapshotter: ${STARGZ_SNAPSHOTTER_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG IMGCRYPT_VERSION
-RUN git clone --quiet --depth 1 --branch "${IMGCRYPT_VERSION%@*}" https://github.com/containerd/imgcrypt.git /go/src/github.com/containerd/imgcrypt && \
+RUN git clone --quiet --depth 1 --branch "${IMGCRYPT_VERSION%%@*}" https://github.com/containerd/imgcrypt.git /go/src/github.com/containerd/imgcrypt && \
   cd /go/src/github.com/containerd/imgcrypt && \
   git-checkout-tag-with-hash.sh "${IMGCRYPT_VERSION}" && \
   CGO_ENABLED=0 make && DESTDIR=/out make install && \
-  echo "- imgcrypt: ${IMGCRYPT_VERSION/@*}" >> /out/share/doc/nerdctl-full/README.md
+  echo "- imgcrypt: ${IMGCRYPT_VERSION%%@*}" >> /out/share/doc/nerdctl-full/README.md
 ARG SLIRP4NETNS_VERSION
-RUN SLIRP4NETNS_VERSION=${SLIRP4NETNS_VERSION/@BINARY}; \
+RUN SLIRP4NETNS_VERSION=${SLIRP4NETNS_VERSION%%@*}; \
   fname="slirp4netns-$(cat /target_uname_m)" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/rootless-containers/slirp4netns/releases/download/${SLIRP4NETNS_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/slirp4netns-${SLIRP4NETNS_VERSION}" | sha256sum -c && \
@@ -203,9 +200,9 @@ RUN SLIRP4NETNS_VERSION=${SLIRP4NETNS_VERSION/@BINARY}; \
   echo "- slirp4netns: ${SLIRP4NETNS_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG BYPASS4NETNS_VERSION
 COPY --from=build-bypass4netns /out/${TARGETARCH:-amd64}/* /out/bin/
-RUN echo "- bypass4netns: ${BYPASS4NETNS_VERSION/@*}" >> /out/share/doc/nerdctl-full/README.md
+RUN echo "- bypass4netns: ${BYPASS4NETNS_VERSION%%@*}" >> /out/share/doc/nerdctl-full/README.md
 ARG FUSE_OVERLAYFS_VERSION
-RUN FUSE_OVERLAYFS_VERSION=${FUSE_OVERLAYFS_VERSION/@BINARY}; \
+RUN FUSE_OVERLAYFS_VERSION=${FUSE_OVERLAYFS_VERSION%%@*}; \
   fname="fuse-overlayfs-$(cat /target_uname_m)" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/containers/fuse-overlayfs/releases/download/${FUSE_OVERLAYFS_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/fuse-overlayfs-${FUSE_OVERLAYFS_VERSION}" | sha256sum -c && \
@@ -213,22 +210,24 @@ RUN FUSE_OVERLAYFS_VERSION=${FUSE_OVERLAYFS_VERSION/@BINARY}; \
   chmod +x /out/bin/fuse-overlayfs && \
   echo "- fuse-overlayfs: ${FUSE_OVERLAYFS_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG CONTAINERD_FUSE_OVERLAYFS_VERSION
-RUN CONTAINERD_FUSE_OVERLAYFS_VERSION=${CONTAINERD_FUSE_OVERLAYFS_VERSION/@BINARY}; \
-  fname="containerd-fuse-overlayfs-${CONTAINERD_FUSE_OVERLAYFS_VERSION/v}-${TARGETOS:-linux}-${TARGETARCH:-amd64}.tar.gz" && \
+RUN CONTAINERD_FUSE_OVERLAYFS_VERSION=${CONTAINERD_FUSE_OVERLAYFS_VERSION%%@*}; \
+  fname="containerd-fuse-overlayfs-${CONTAINERD_FUSE_OVERLAYFS_VERSION##*v}-${TARGETOS:-linux}-${TARGETARCH:-amd64}.tar.gz" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/containerd/fuse-overlayfs-snapshotter/releases/download/${CONTAINERD_FUSE_OVERLAYFS_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/containerd-fuse-overlayfs-${CONTAINERD_FUSE_OVERLAYFS_VERSION}" | sha256sum -c && \
   tar xzf "${fname}" -C /out/bin && \
   rm -f "${fname}" && \
   echo "- containerd-fuse-overlayfs: ${CONTAINERD_FUSE_OVERLAYFS_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG TINI_VERSION
-RUN TINI_VERSION=${TINI_VERSION/@BINARY}; \
+RUN TINI_VERSION=${TINI_VERSION%%@*}; \
   fname="tini-static-${TARGETARCH:-amd64}" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/krallin/tini/releases/download/${TINI_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/tini-${TINI_VERSION}" | sha256sum -c && \
   cp -a "${fname}" /out/bin/tini && chmod +x /out/bin/tini && \
   echo "- Tini: ${TINI_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG BUILDG_VERSION
-RUN BUILDG_VERSION=${BUILDG_VERSION/@BINARY}; \
+# FIXME: this is a mildly-confusing approach. Buildkit will perform some "smart" replacement at build time and output
+# confusing debugging information, eg: BUILDG_VERSION will appear as if the original ARG value was used.
+RUN BUILDG_VERSION=${BUILDG_VERSION%%@*}; \
   fname="buildg-${BUILDG_VERSION}-${TARGETOS:-linux}-${TARGETARCH:-amd64}.tar.gz" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/ktock/buildg/releases/download/${BUILDG_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/buildg-${BUILDG_VERSION}" | sha256sum -c && \
@@ -236,7 +235,7 @@ RUN BUILDG_VERSION=${BUILDG_VERSION/@BINARY}; \
   rm -f "${fname}" && \
   echo "- buildg: ${BUILDG_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG ROOTLESSKIT_VERSION
-RUN ROOTLESSKIT_VERSION=${ROOTLESSKIT_VERSION/@BINARY}; \
+RUN ROOTLESSKIT_VERSION=${ROOTLESSKIT_VERSION%%@*}; \
   fname="rootlesskit-$(cat /target_uname_m).tar.gz" && \
   curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/rootless-containers/rootlesskit/releases/download/${ROOTLESSKIT_VERSION}/${fname}" && \
   grep "${fname}" "/SHA256SUMS.d/rootlesskit-${ROOTLESSKIT_VERSION}" | sha256sum -c && \
@@ -249,10 +248,10 @@ RUN echo "- gomodjail: ${GOMODJAIL_VERSION}" >> /out/share/doc/nerdctl-full/READ
 
 RUN echo "" >> /out/share/doc/nerdctl-full/README.md && \
   echo "## License" >> /out/share/doc/nerdctl-full/README.md && \
-  echo "- bin/slirp4netns:    [GNU GENERAL PUBLIC LICENSE, Version 2](https://github.com/rootless-containers/slirp4netns/blob/${SLIRP4NETNS_VERSION/@*}/COPYING)" >> /out/share/doc/nerdctl-full/README.md && \
-  echo "- bin/fuse-overlayfs: [GNU GENERAL PUBLIC LICENSE, Version 2](https://github.com/containers/fuse-overlayfs/blob/${FUSE_OVERLAYFS_VERSION/@*}/COPYING)" >> /out/share/doc/nerdctl-full/README.md && \
+  echo "- bin/slirp4netns:    [GNU GENERAL PUBLIC LICENSE, Version 2](https://github.com/rootless-containers/slirp4netns/blob/${SLIRP4NETNS_VERSION%%@*}/COPYING)" >> /out/share/doc/nerdctl-full/README.md && \
+  echo "- bin/fuse-overlayfs: [GNU GENERAL PUBLIC LICENSE, Version 2](https://github.com/containers/fuse-overlayfs/blob/${FUSE_OVERLAYFS_VERSION%%@*}/COPYING)" >> /out/share/doc/nerdctl-full/README.md && \
   echo "- bin/{runc,bypass4netns,bypass4netnsd}: Apache License 2.0, statically linked with libseccomp ([LGPL 2.1](https://github.com/seccomp/libseccomp/blob/main/LICENSE), source code available at https://github.com/seccomp/libseccomp/)" >> /out/share/doc/nerdctl-full/README.md && \
-  echo "- bin/tini: [MIT License](https://github.com/krallin/tini/blob/${TINI_VERSION/@*}/LICENSE)" >> /out/share/doc/nerdctl-full/README.md && \
+  echo "- bin/tini: [MIT License](https://github.com/krallin/tini/blob/${TINI_VERSION%%@*}/LICENSE)" >> /out/share/doc/nerdctl-full/README.md && \
   echo "- Other files: [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0)" >> /out/share/doc/nerdctl-full/README.md
 
 FROM build-dependencies AS build-full
@@ -310,7 +309,7 @@ RUN apt-get update -qq && apt-get install -qq --no-install-recommends \
   git \
   make
 # We wouldn't need this if Docker Hub could have "golang:${GO_VERSION}-ubuntu"
-COPY --from=build-base-debian /usr/local/go /usr/local/go
+COPY --from=build-base /usr/local/go /usr/local/go
 ARG TARGETARCH
 ENV PATH=/usr/local/go/bin:$PATH
 ARG GOTESTSUM_VERSION

From cbd4ef2360ef6bdeed518eb71fc6b379494cea61 Mon Sep 17 00:00:00 2001
From: Hayato Kiwata <haytok@amazon.co.jp>
Date: Sat, 17 May 2025 07:27:47 +0000
Subject: [PATCH 210/225] test: update test logic in TestParsePortsLabel

The current implementation does not compare []cni.PortMapping{} obtained
from labelMap and ParsePortsLabel() and want.
Therefore, this commit will update so that the evaluation is performed.

Signed-off-by: Hayato Kiwata <haytok@amazon.co.jp>
---
 pkg/portutil/portutil_test.go | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/pkg/portutil/portutil_test.go b/pkg/portutil/portutil_test.go
index d14c79786c3..16ad1fd9430 100644
--- a/pkg/portutil/portutil_test.go
+++ b/pkg/portutil/portutil_test.go
@@ -178,10 +178,10 @@ func TestParsePortsLabel(t *testing.T) {
 			},
 			want: []cni.PortMapping{
 				{
-					HostPort:      3000,
-					ContainerPort: 8080,
+					HostPort:      12345,
+					ContainerPort: 10000,
 					Protocol:      "tcp",
-					HostIP:        "127.0.0.1",
+					HostIP:        "0.0.0.0",
 				},
 			},
 			wantErr: false,
@@ -219,7 +219,7 @@ func TestParsePortsLabel(t *testing.T) {
 			}
 			if !reflect.DeepEqual(got, tt.want) {
 				if len(got) == len(tt.want) {
-					if len(got) > 1 {
+					if len(got) > 0 {
 						var hostPorts []int32
 						var containerPorts []int32
 						for _, value := range got {
@@ -235,6 +235,14 @@ func TestParsePortsLabel(t *testing.T) {
 						if (hostPorts[len(hostPorts)-1] - hostPorts[0]) != (containerPorts[len(hostPorts)-1] - containerPorts[0]) {
 							t.Errorf("ParsePortsLabel() = %v, want %v", got, tt.want)
 						}
+						sort.Slice(got, func(i, j int) bool {
+							return got[i].HostPort < got[j].HostPort
+						})
+						for i := 0; i < len(got); i++ {
+							if got[i].HostPort != tt.want[i].HostPort || got[i].ContainerPort != tt.want[i].ContainerPort || got[i].Protocol != tt.want[i].Protocol || got[i].HostIP != tt.want[i].HostIP {
+								t.Errorf("ParsePortsLabel() = %v, want %v", got, tt.want)
+							}
+						}
 					}
 				} else {
 					t.Errorf("ParsePortsLabel() = %v, want %v", got, tt.want)

From 1c74a704e30a1a3a0f6e18ce0c67a3ea55eb7ec4 Mon Sep 17 00:00:00 2001
From: Hayato Kiwata <haytok@amazon.co.jp>
Date: Sat, 17 May 2025 14:25:14 +0000
Subject: [PATCH 211/225] test: update test logic in
 TestTestParseFlagPWithPlatformSpec

This test does not run in the rootfull Linux environment.
Also, there are some cases where the test does not run.
Therefore, this commit modifies all tests to perform the evaluation.

Note that when the host ports are not specified in the -p option of
`nerdctl run`, ports are randomly assigned, but it is not known what port
number will be assigned in each test.
Therefore, this commit modifies not to compare host ports.

Signed-off-by: Hayato Kiwata <haytok@amazon.co.jp>
---
 pkg/portutil/portutil_test.go | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/pkg/portutil/portutil_test.go b/pkg/portutil/portutil_test.go
index 16ad1fd9430..8b79deb192d 100644
--- a/pkg/portutil/portutil_test.go
+++ b/pkg/portutil/portutil_test.go
@@ -29,7 +29,7 @@ import (
 )
 
 func TestTestParseFlagPWithPlatformSpec(t *testing.T) {
-	if runtime.GOOS != "Linux" || rootlessutil.IsRootless() {
+	if runtime.GOOS != "linux" || rootlessutil.IsRootless() {
 		t.Skip("no non-Linux platform or rootless mode in Linux are not supported yet")
 	}
 	type args struct {
@@ -48,7 +48,6 @@ func TestTestParseFlagPWithPlatformSpec(t *testing.T) {
 			},
 			want: []cni.PortMapping{
 				{
-					HostPort:      3000,
 					ContainerPort: 3000,
 					Protocol:      "tcp",
 					HostIP:        "0.0.0.0",
@@ -63,13 +62,11 @@ func TestTestParseFlagPWithPlatformSpec(t *testing.T) {
 			},
 			want: []cni.PortMapping{
 				{
-					HostPort:      3000,
 					ContainerPort: 3000,
 					Protocol:      "tcp",
 					HostIP:        "0.0.0.0",
 				},
 				{
-					HostPort:      3001,
 					ContainerPort: 3001,
 					Protocol:      "tcp",
 					HostIP:        "0.0.0.0",
@@ -92,13 +89,11 @@ func TestTestParseFlagPWithPlatformSpec(t *testing.T) {
 			},
 			want: []cni.PortMapping{
 				{
-					HostPort:      3000,
 					ContainerPort: 3000,
 					Protocol:      "tcp",
 					HostIP:        "0.0.0.0",
 				},
 				{
-					HostPort:      3001,
 					ContainerPort: 3001,
 					Protocol:      "tcp",
 					HostIP:        "0.0.0.0",
@@ -113,15 +108,13 @@ func TestTestParseFlagPWithPlatformSpec(t *testing.T) {
 			},
 			want: []cni.PortMapping{
 				{
-					HostPort:      3000,
 					ContainerPort: 3000,
-					Protocol:      "tcp",
+					Protocol:      "udp",
 					HostIP:        "0.0.0.0",
 				},
 				{
-					HostPort:      3001,
 					ContainerPort: 3001,
-					Protocol:      "tcp",
+					Protocol:      "udp",
 					HostIP:        "0.0.0.0",
 				},
 			},
@@ -138,7 +131,7 @@ func TestTestParseFlagPWithPlatformSpec(t *testing.T) {
 			}
 			if !reflect.DeepEqual(got, tt.want) {
 				if len(got) == len(tt.want) {
-					if len(got) > 1 {
+					if len(got) > 0 {
 						var hostPorts []int32
 						var containerPorts []int32
 						for _, value := range got {
@@ -154,6 +147,14 @@ func TestTestParseFlagPWithPlatformSpec(t *testing.T) {
 						if (hostPorts[len(hostPorts)-1] - hostPorts[0]) != (containerPorts[len(hostPorts)-1] - containerPorts[0]) {
 							t.Errorf("ParseFlagP() = %v, want %v", got, tt.want)
 						}
+						sort.Slice(got, func(i, j int) bool {
+							return got[i].HostPort < got[j].HostPort
+						})
+						for i := 0; i < len(got); i++ {
+							if got[i].ContainerPort != tt.want[i].ContainerPort || got[i].Protocol != tt.want[i].Protocol || got[i].HostIP != tt.want[i].HostIP {
+								t.Errorf("ParseFlagP() = %v, want %v", got, tt.want)
+							}
+						}
 					}
 				} else {
 					t.Errorf("ParseFlagP() = %v, want %v", got, tt.want)

From 721e285b0d23301444f73d2952a00aa7dc639651 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Fri, 16 May 2025 13:59:44 -0700
Subject: [PATCH 212/225] Revamp lock

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 pkg/internal/filesystem/consts.go           |   1 +
 pkg/internal/filesystem/errors.go           |   3 +
 pkg/internal/filesystem/lock.go             | 125 +++++++++
 pkg/internal/filesystem/lock_test.go        | 273 ++++++++++++++++++++
 pkg/internal/filesystem/lock_unix.go        |  59 +++++
 pkg/internal/filesystem/lock_windows.go     |  58 +++++
 pkg/internal/filesystem/lockutil_unix.go    |  78 ------
 pkg/internal/filesystem/lockutil_windows.go |  65 -----
 pkg/logging/logging.go                      |   9 +-
 pkg/netutil/store.go                        |   6 +-
 10 files changed, 524 insertions(+), 153 deletions(-)
 create mode 100644 pkg/internal/filesystem/lock.go
 create mode 100644 pkg/internal/filesystem/lock_test.go
 create mode 100644 pkg/internal/filesystem/lock_unix.go
 create mode 100644 pkg/internal/filesystem/lock_windows.go
 delete mode 100644 pkg/internal/filesystem/lockutil_unix.go
 delete mode 100644 pkg/internal/filesystem/lockutil_windows.go

diff --git a/pkg/internal/filesystem/consts.go b/pkg/internal/filesystem/consts.go
index 32c30246ef1..b17236822d2 100644
--- a/pkg/internal/filesystem/consts.go
+++ b/pkg/internal/filesystem/consts.go
@@ -17,5 +17,6 @@
 package filesystem
 
 const (
+	lockPermission         = 0o600
 	pathComponentMaxLength = 255
 )
diff --git a/pkg/internal/filesystem/errors.go b/pkg/internal/filesystem/errors.go
index c2ed4a14918..311f0c719bf 100644
--- a/pkg/internal/filesystem/errors.go
+++ b/pkg/internal/filesystem/errors.go
@@ -19,5 +19,8 @@ package filesystem
 import "errors"
 
 var (
+	ErrLockFail    = errors.New("failed to acquire lock")
+	ErrUnlockFail  = errors.New("failed to release lock")
+	ErrLockIsNil   = errors.New("nil lock")
 	ErrInvalidPath = errors.New("invalid path")
 )
diff --git a/pkg/internal/filesystem/lock.go b/pkg/internal/filesystem/lock.go
new file mode 100644
index 00000000000..82339c20a58
--- /dev/null
+++ b/pkg/internal/filesystem/lock.go
@@ -0,0 +1,125 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Portions from internal go
+//
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+//
+// https://cs.opensource.google/go/go/+/refs/tags/go1.24.3:LICENSE
+
+// https://cs.opensource.google/go/go/+/refs/tags/go1.24.3:src/cmd/go/internal/lockedfile/internal/filelock/filelock.go
+
+package filesystem
+
+import (
+	"errors"
+	"os"
+	"runtime"
+)
+
+// Lock places an advisory write lock on the file, blocking until it can be locked.
+//
+// If Lock returns nil, no other process will be able to place a read or write lock on the file until
+// this process exits, closes f, or calls Unlock on it.
+func Lock(path string) (file *os.File, err error) {
+	return commonlock(path, writeLock)
+}
+
+// ReadOnlyLock places an advisory read lock on the file, blocking until it can be locked.
+//
+// If ReadOnlyLock returns nil, no other process will be able to place a write lock on
+// the file until this process exits, closes f, or calls Unlock on it.
+func ReadOnlyLock(path string) (file *os.File, err error) {
+	return commonlock(path, readLock)
+}
+
+func commonlock(path string, mode lockType) (file *os.File, err error) {
+	defer func() {
+		if err != nil {
+			err = errors.Join(ErrLockFail, err, file.Close())
+		}
+	}()
+
+	if runtime.GOOS == "windows" {
+		// LockFileEx does not work on directories, so check what we have first.
+		// If that is a dir, swap out the path for a sidecar file instead (not inside the directory).
+		// Note that this cannot be done in platform specific implementation without moving all the fd Open and Close
+		// logic over there, which is undesirable.
+		if sl, err := os.Stat(path); err == nil && sl.IsDir() {
+			path = path + ".nerdctl.lock"
+		}
+	}
+
+	file, err = os.Open(path)
+	if errors.Is(err, os.ErrNotExist) {
+		file, err = os.OpenFile(path, os.O_RDONLY|os.O_CREATE, lockPermission)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if err = platformSpecificLock(file, mode); err != nil {
+		return nil, errors.Join(err, file.Close())
+	}
+
+	return file, nil
+}
+
+// Unlock removes an advisory lock placed on f by this process.
+func Unlock(lock *os.File) error {
+	if lock == nil {
+		return ErrLockIsNil
+	}
+
+	if err := errors.Join(platformSpecificUnlock(lock), lock.Close()); err != nil {
+		return errors.Join(ErrUnlockFail, err)
+	}
+
+	return nil
+}
+
+// WithLock executes the provided function after placing a write lock on `path`.
+// The lock is released once the function has been run, regardless of outcome.
+func WithLock(path string, function func() error) (err error) {
+	file, err := Lock(path)
+	if err != nil {
+		return err
+	}
+
+	defer func() {
+		err = errors.Join(Unlock(file), err)
+	}()
+
+	return function()
+}
+
+// WithReadOnlyLock executes the provided function after placing a read lock on `path`.
+// The lock is released once the function has been run, regardless of outcome.
+func WithReadOnlyLock(path string, function func() error) (err error) {
+	file, err := ReadOnlyLock(path)
+	if err != nil {
+		return err
+	}
+
+	defer func() {
+		err = errors.Join(Unlock(file), err)
+	}()
+
+	return function()
+}
diff --git a/pkg/internal/filesystem/lock_test.go b/pkg/internal/filesystem/lock_test.go
new file mode 100644
index 00000000000..e3405357be1
--- /dev/null
+++ b/pkg/internal/filesystem/lock_test.go
@@ -0,0 +1,273 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package filesystem_test
+
+import (
+	"os"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"gotest.tools/v3/assert"
+
+	"github.com/containerd/nerdctl/v2/pkg/internal/filesystem"
+)
+
+const (
+	mainroutine1 uint32 = 11
+	mainroutine2 uint32 = 12
+	routine1     uint32 = 1
+	routine2     uint32 = 2
+	routine3     uint32 = 3
+)
+
+func TestLockDir(t *testing.T) {
+	t.Parallel()
+
+	tempDir := t.TempDir()
+	// Lock acquisition
+	file, err := filesystem.Lock(tempDir)
+	assert.NilError(t, err, "acquiring a lock should succeed")
+	err = filesystem.Unlock(file)
+	assert.NilError(t, err, "releasing a lock should succeed")
+
+	file, err = filesystem.ReadOnlyLock(tempDir)
+	assert.NilError(t, err, "acquiring a read-only lock should succeed")
+	file2, err := filesystem.ReadOnlyLock(tempDir)
+	assert.NilError(t, err, "acquiring another read-only lock should succeed")
+	err = filesystem.Unlock(file)
+	assert.NilError(t, err, "releasing a read-only lock should succeed")
+	err = filesystem.Unlock(file2)
+	assert.NilError(t, err, "releasing another read-only lock should succeed")
+}
+
+func TestLockFile(t *testing.T) {
+	t.Parallel()
+
+	tempDir := t.TempDir()
+	lock, err := os.CreateTemp(tempDir, "lockfile")
+	assert.NilError(t, err, "creating temp file should succeed")
+	defer lock.Close()
+	// Lock acquisition
+	file, err := filesystem.Lock(lock.Name())
+	assert.NilError(t, err, "acquiring a lock should succeed")
+	err = filesystem.Unlock(file)
+	assert.NilError(t, err, "releasing a lock should succeed")
+
+	file, err = filesystem.ReadOnlyLock(lock.Name())
+	assert.NilError(t, err, "acquiring a read-only lock should succeed")
+	file2, err := filesystem.ReadOnlyLock(lock.Name())
+	assert.NilError(t, err, "acquiring another read-only lock should succeed")
+	err = filesystem.Unlock(file)
+	assert.NilError(t, err, "releasing a read-only lock should succeed")
+	err = filesystem.Unlock(file2)
+	assert.NilError(t, err, "releasing another read-only lock should succeed")
+}
+
+func TestLockWriteConcurrent(t *testing.T) {
+	t.Parallel()
+
+	var waitGroup sync.WaitGroup
+
+	var concurrentKey uint32
+
+	tempDir := t.TempDir()
+
+	waitGroup.Add(2)
+
+	// Start a lock, set the key, sleep 1s and confirm the key is still the same
+	go func() {
+		defer waitGroup.Done()
+
+		lErr := filesystem.WithLock(tempDir, func() error {
+			atomic.StoreUint32(&concurrentKey, routine1)
+
+			time.Sleep(1 * time.Second)
+			assert.Equal(t, atomic.LoadUint32(&concurrentKey), routine1)
+
+			return nil
+		})
+
+		assert.NilError(t, lErr, "locking should not error")
+	}()
+
+	// Wait 0.5s, start another lock, set the key, sleep 1s and confirm the key is still the same
+	go func() {
+		defer waitGroup.Done()
+
+		time.Sleep(500 * time.Millisecond)
+
+		lErr := filesystem.WithLock(tempDir, func() error {
+			atomic.StoreUint32(&concurrentKey, routine2)
+
+			time.Sleep(1 * time.Second)
+			assert.Equal(t, atomic.LoadUint32(&concurrentKey), routine2)
+
+			return nil
+		})
+
+		assert.NilError(t, lErr, "locking should not error")
+	}()
+
+	// Start a lock, set the key, wait 1s, confirm the key is still the same
+	lErr := filesystem.WithLock(tempDir, func() error {
+		atomic.StoreUint32(&concurrentKey, mainroutine1)
+
+		time.Sleep(1 * time.Second)
+		assert.Equal(t, atomic.LoadUint32(&concurrentKey), mainroutine1)
+
+		return nil
+	})
+	assert.NilError(t, lErr, "locking should not error")
+
+	// Wait 0.75s, start a lock, set the key, sleep 1s, confirm the key is unchanged
+	time.Sleep(750 * time.Millisecond)
+
+	lErr = filesystem.WithLock(tempDir, func() error {
+		atomic.StoreUint32(&concurrentKey, mainroutine2)
+
+		time.Sleep(1 * time.Second)
+		assert.Equal(t, atomic.LoadUint32(&concurrentKey), mainroutine2)
+
+		return nil
+	})
+
+	assert.NilError(t, lErr, "locking should not error")
+
+	waitGroup.Wait()
+}
+
+func TestLockMultiRead(t *testing.T) {
+	t.Parallel()
+
+	var waitGroup sync.WaitGroup
+
+	var concurrentKey uint32
+
+	tempDir := t.TempDir()
+
+	waitGroup.Add(3)
+
+	// Start a readonly lock immediately
+	// Then wait 1s inside the lock - confirm the key got changed by the second read routine
+	go func() {
+		t.Log("Entering routine 1")
+
+		defer waitGroup.Done()
+
+		lErr := filesystem.WithReadOnlyLock(tempDir, func() error {
+			t.Log("Entering routine 1 read lock")
+
+			atomic.StoreUint32(&concurrentKey, routine1)
+
+			time.Sleep(1 * time.Second)
+			assert.Equal(t, atomic.LoadUint32(&concurrentKey), routine2)
+
+			return nil
+		})
+
+		assert.NilError(t, lErr, "locking should not error")
+	}()
+
+	// Wait 0.5s before locking, then change the key
+	go func() {
+		t.Log("Entering routine 2")
+
+		defer waitGroup.Done()
+
+		time.Sleep(500 * time.Millisecond)
+
+		lErr := filesystem.WithReadOnlyLock(tempDir, func() error {
+			t.Log("Entering routine 2 read lock")
+
+			atomic.StoreUint32(&concurrentKey, routine2)
+
+			return nil
+		})
+
+		assert.NilError(t, lErr, "locking should not error")
+	}()
+
+	time.Sleep(50 * time.Millisecond)
+	// Start a write lock, confirm we have waited for the read locks to finish, change the key
+	go func() {
+		t.Log("Entering routine 3")
+
+		defer waitGroup.Done()
+
+		lErr := filesystem.WithLock(tempDir, func() error {
+			t.Log("Entering routine 3 write lock")
+			assert.Equal(t, atomic.LoadUint32(&concurrentKey), routine2)
+
+			atomic.StoreUint32(&concurrentKey, routine3)
+
+			return nil
+		})
+
+		assert.NilError(t, lErr, "locking should not error")
+	}()
+
+	waitGroup.Wait()
+}
+
+func TestLockWriteBlocksRead(t *testing.T) {
+	t.Parallel()
+
+	var waitGroup sync.WaitGroup
+
+	var concurrentKey uint32
+
+	tempDir := t.TempDir()
+
+	waitGroup.Add(2)
+
+	// Start a lock, set the key, sleep 1s and confirm the key is still the same
+	go func() {
+		defer waitGroup.Done()
+
+		lErr := filesystem.WithLock(tempDir, func() error {
+			time.Sleep(1 * time.Second)
+
+			atomic.StoreUint32(&concurrentKey, routine1)
+
+			assert.Equal(t, atomic.LoadUint32(&concurrentKey), routine1)
+
+			return nil
+		})
+
+		assert.NilError(t, lErr, "locking should not error")
+	}()
+
+	time.Sleep(50 * time.Millisecond)
+
+	// Start a readonly lock immediately
+	// Confirm the key has been set by the write lock
+	go func() {
+		defer waitGroup.Done()
+
+		lErr := filesystem.WithReadOnlyLock(tempDir, func() error {
+			assert.Equal(t, atomic.LoadUint32(&concurrentKey), routine1)
+
+			return nil
+		})
+
+		assert.NilError(t, lErr, "locking should not error")
+	}()
+
+	waitGroup.Wait()
+}
diff --git a/pkg/internal/filesystem/lock_unix.go b/pkg/internal/filesystem/lock_unix.go
new file mode 100644
index 00000000000..4f37a2fa368
--- /dev/null
+++ b/pkg/internal/filesystem/lock_unix.go
@@ -0,0 +1,59 @@
+//go:build unix
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Portions from internal go
+//
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+//
+// https://cs.opensource.google/go/go/+/refs/tags/go1.24.3:LICENSE
+
+// https://cs.opensource.google/go/go/+/refs/tags/go1.24.3:src/cmd/go/internal/lockedfile/internal/filelock/filelock_unix.go
+
+package filesystem
+
+import (
+	"errors"
+	"os"
+	"syscall"
+)
+
+type lockType int16
+
+const (
+	readLock  lockType = syscall.LOCK_SH
+	writeLock lockType = syscall.LOCK_EX
+)
+
+func platformSpecificLock(file *os.File, lockType lockType) error {
+	var err error
+
+	for {
+		err = syscall.Flock(int(file.Fd()), int(lockType))
+		if !errors.Is(err, syscall.EINTR) {
+			break
+		}
+	}
+
+	return err
+}
+
+func platformSpecificUnlock(file *os.File) error {
+	return syscall.Flock(int(file.Fd()), syscall.LOCK_UN)
+}
diff --git a/pkg/internal/filesystem/lock_windows.go b/pkg/internal/filesystem/lock_windows.go
new file mode 100644
index 00000000000..b81d71d0ff3
--- /dev/null
+++ b/pkg/internal/filesystem/lock_windows.go
@@ -0,0 +1,58 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Portions from internal go
+//
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+//
+// https://cs.opensource.google/go/go/+/refs/tags/go1.24.3:LICENSE
+
+// https://cs.opensource.google/go/go/+/refs/tags/go1.24.3:src/cmd/go/internal/lockedfile/internal/filelock/filelock_windows.go
+
+package filesystem
+
+import (
+	"os"
+
+	"golang.org/x/sys/windows"
+)
+
+type lockType uint32
+
+const (
+	// https://msdn.microsoft.com/en-us/library/windows/desktop/aa365203(v=vs.85).aspx
+	readLock  lockType = 0
+	writeLock lockType = windows.LOCKFILE_EXCLUSIVE_LOCK
+
+	reserved = 0
+	allBytes = ^uint32(0)
+)
+
+func platformSpecificLock(file *os.File, lockType lockType) error {
+	return windows.LockFileEx(
+		windows.Handle(file.Fd()),
+		uint32(lockType),
+		reserved,
+		allBytes,
+		allBytes,
+		new(windows.Overlapped))
+}
+
+func platformSpecificUnlock(file *os.File) error {
+	return windows.UnlockFileEx(windows.Handle(file.Fd()), reserved, allBytes, allBytes, new(windows.Overlapped))
+}
diff --git a/pkg/internal/filesystem/lockutil_unix.go b/pkg/internal/filesystem/lockutil_unix.go
deleted file mode 100644
index 8d50b15b071..00000000000
--- a/pkg/internal/filesystem/lockutil_unix.go
+++ /dev/null
@@ -1,78 +0,0 @@
-//go:build unix
-
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package filesystem
-
-import (
-	"fmt"
-	"os"
-
-	"golang.org/x/sys/unix"
-
-	"github.com/containerd/log"
-)
-
-func WithDirLock(dir string, fn func() error) error {
-	_ = os.MkdirAll(dir, 0700)
-	dirFile, err := os.Open(dir)
-	if err != nil {
-		return err
-	}
-	defer dirFile.Close()
-	if err := flock(dirFile, unix.LOCK_EX); err != nil {
-		return fmt.Errorf("failed to lock %q: %w", dir, err)
-	}
-	defer func() {
-		if err := flock(dirFile, unix.LOCK_UN); err != nil {
-			log.L.WithError(err).Errorf("failed to unlock %q", dir)
-		}
-	}()
-	return fn()
-}
-
-func flock(f *os.File, flags int) error {
-	fd := int(f.Fd())
-	for {
-		err := unix.Flock(fd, flags)
-		if err == nil || err != unix.EINTR {
-			return err
-		}
-	}
-}
-
-func Lock(dir string) (*os.File, error) {
-	_ = os.MkdirAll(dir, 0700)
-	dirFile, err := os.Open(dir)
-	if err != nil {
-		return nil, err
-	}
-
-	if err = flock(dirFile, unix.LOCK_EX); err != nil {
-		return nil, err
-	}
-
-	return dirFile, nil
-}
-
-func Unlock(locked *os.File) error {
-	defer func() {
-		_ = locked.Close()
-	}()
-
-	return flock(locked, unix.LOCK_UN)
-}
diff --git a/pkg/internal/filesystem/lockutil_windows.go b/pkg/internal/filesystem/lockutil_windows.go
deleted file mode 100644
index 8dc6e3eb47d..00000000000
--- a/pkg/internal/filesystem/lockutil_windows.go
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package filesystem
-
-import (
-	"fmt"
-	"os"
-
-	"golang.org/x/sys/windows"
-
-	"github.com/containerd/log"
-)
-
-func WithDirLock(dir string, fn func() error) error {
-	dirFile, err := os.OpenFile(dir+".lock", os.O_CREATE, 0644)
-	if err != nil {
-		return err
-	}
-	defer dirFile.Close()
-	// see https://msdn.microsoft.com/en-us/library/windows/desktop/aa365203(v=vs.85).aspx
-	if err = windows.LockFileEx(windows.Handle(dirFile.Fd()), windows.LOCKFILE_EXCLUSIVE_LOCK, 0, ^uint32(0), ^uint32(0), new(windows.Overlapped)); err != nil {
-		return fmt.Errorf("failed to lock %q: %w", dir, err)
-	}
-
-	defer func() {
-		if err := windows.UnlockFileEx(windows.Handle(dirFile.Fd()), 0, ^uint32(0), ^uint32(0), new(windows.Overlapped)); err != nil {
-			log.L.WithError(err).Errorf("failed to unlock %q", dir)
-		}
-	}()
-	return fn()
-}
-
-func Lock(dir string) (*os.File, error) {
-	dirFile, err := os.OpenFile(dir+".lock", os.O_CREATE, 0644)
-	if err != nil {
-		return nil, err
-	}
-	// see https://msdn.microsoft.com/en-us/library/windows/desktop/aa365203(v=vs.85).aspx
-	if err = windows.LockFileEx(windows.Handle(dirFile.Fd()), windows.LOCKFILE_EXCLUSIVE_LOCK, 0, ^uint32(0), ^uint32(0), new(windows.Overlapped)); err != nil {
-		return nil, fmt.Errorf("failed to lock %q: %w", dir, err)
-	}
-	return dirFile, nil
-}
-
-func Unlock(locked *os.File) error {
-	defer func() {
-		_ = locked.Close()
-	}()
-
-	return windows.UnlockFileEx(windows.Handle(locked.Fd()), 0, ^uint32(0), ^uint32(0), new(windows.Overlapped))
-}
diff --git a/pkg/logging/logging.go b/pkg/logging/logging.go
index 65cc1ddd31e..e60b28c23c7 100644
--- a/pkg/logging/logging.go
+++ b/pkg/logging/logging.go
@@ -160,7 +160,7 @@ func getLockPath(dataStore, ns, id string) string {
 
 // WaitForLogger waits until the logger has finished executing and processing container logs
 func WaitForLogger(dataStore, ns, id string) error {
-	return filesystem.WithDirLock(getLockPath(dataStore, ns, id), func() error {
+	return filesystem.WithLock(getLockPath(dataStore, ns, id), func() error {
 		return nil
 	})
 }
@@ -305,16 +305,11 @@ func loggerFunc(dataStore string) (logging.LoggerFunc, error) {
 			}
 
 			loggerLock := getLockPath(dataStore, config.Namespace, config.ID)
-			f, err := os.Create(loggerLock)
-			if err != nil {
-				return err
-			}
-			defer f.Close()
 
 			// the logger will obtain an exclusive lock on a file until the container is
 			// stopped and the driver has finished processing all output,
 			// so that waiting log viewers can be signalled when the process is complete.
-			return filesystem.WithDirLock(loggerLock, func() error {
+			return filesystem.WithLock(loggerLock, func() error {
 				if err := ready(); err != nil {
 					return err
 				}
diff --git a/pkg/netutil/store.go b/pkg/netutil/store.go
index 627468e8f85..c1fbe3744bd 100644
--- a/pkg/netutil/store.go
+++ b/pkg/netutil/store.go
@@ -48,7 +48,7 @@ func fsRemove(e *CNIEnv, net *NetworkConfig) error {
 		}
 		return net.clean()
 	}
-	return filesystem.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), fn)
+	return filesystem.WithLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), fn)
 }
 
 func fsExists(e *CNIEnv, name string) (bool, error) {
@@ -62,7 +62,7 @@ func fsWrite(e *CNIEnv, net *NetworkConfig) error {
 	// Concurrent access may independently first figure out that a given network is missing, and while the lock
 	// here will prevent concurrent writes, one of the routines will fail.
 	// Consuming code MUST account for that scenario.
-	return filesystem.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), func() error {
+	return filesystem.WithLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), func() error {
 		if _, err := os.Stat(filename); err == nil {
 			return errdefs.ErrAlreadyExists
 		}
@@ -73,7 +73,7 @@ func fsWrite(e *CNIEnv, net *NetworkConfig) error {
 func fsRead(e *CNIEnv) ([]*NetworkConfig, error) {
 	var nc []*NetworkConfig
 	var err error
-	err = filesystem.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), func() error {
+	err = filesystem.WithReadOnlyLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), func() error {
 		namespaced := []string{}
 		var common []string
 		common, err = libcni.ConfFiles(e.NetconfPath, []string{".conf", ".conflist", ".json"})

From 2c26839d137d5715dfed4aab7cf85f2577cde60c Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Tue, 6 May 2025 14:20:46 -0700
Subject: [PATCH 213/225] Rewrite some compose tests

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 .../compose/compose_build_linux_test.go       |   2 -
 .../compose/compose_create_linux_test.go      |   6 -
 .../compose/compose_images_linux_test.go      | 163 ++++++++----------
 .../compose/compose_pull_linux_test.go        |   4 -
 .../compose/compose_restart_linux_test.go     |   4 -
 cmd/nerdctl/compose/compose_rm_linux_test.go  | 101 +++++++----
 .../compose/compose_start_linux_test.go       |  88 ++++++----
 .../compose/compose_stop_linux_test.go        |  73 +++++---
 cmd/nerdctl/compose/compose_top_linux_test.go |  53 ++++--
 cmd/nerdctl/compose/compose_up_test.go        |  84 +++++----
 cmd/nerdctl/compose/compose_version_test.go   |  23 ++-
 11 files changed, 352 insertions(+), 249 deletions(-)

diff --git a/cmd/nerdctl/compose/compose_build_linux_test.go b/cmd/nerdctl/compose/compose_build_linux_test.go
index 2c967a331e2..d0092f0a9df 100644
--- a/cmd/nerdctl/compose/compose_build_linux_test.go
+++ b/cmd/nerdctl/compose/compose_build_linux_test.go
@@ -46,8 +46,6 @@ services:
   svc0:
     build: .
     image: %s
-    ports:
-    - 8080:80
     depends_on:
     - svc1
   svc1:
diff --git a/cmd/nerdctl/compose/compose_create_linux_test.go b/cmd/nerdctl/compose/compose_create_linux_test.go
index c1a94dfd2c6..58e92514b82 100644
--- a/cmd/nerdctl/compose/compose_create_linux_test.go
+++ b/cmd/nerdctl/compose/compose_create_linux_test.go
@@ -32,8 +32,6 @@ import (
 
 func TestComposeCreate(t *testing.T) {
 	var dockerComposeYAML = fmt.Sprintf(`
-version: '3.1'
-
 services:
   svc0:
     image: %s
@@ -87,8 +85,6 @@ services:
 
 func TestComposeCreateDependency(t *testing.T) {
 	var dockerComposeYAML = fmt.Sprintf(`
-version: '3.1'
-
 services:
   svc0:
     image: %s
@@ -152,8 +148,6 @@ func TestComposeCreatePull(t *testing.T) {
 
 	base := testutil.NewBase(t)
 	var dockerComposeYAML = fmt.Sprintf(`
-version: '3.1'
-
 services:
   svc0:
     image: %s
diff --git a/cmd/nerdctl/compose/compose_images_linux_test.go b/cmd/nerdctl/compose/compose_images_linux_test.go
index f9f7f475186..ae4d9f8eb16 100644
--- a/cmd/nerdctl/compose/compose_images_linux_test.go
+++ b/cmd/nerdctl/compose/compose_images_linux_test.go
@@ -17,24 +17,26 @@
 package compose
 
 import (
-	"encoding/json"
 	"fmt"
-	"strings"
 	"testing"
 
+	"gotest.tools/v3/assert"
+
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+	"github.com/containerd/nerdctl/mod/tigron/tig"
+
+	"github.com/containerd/nerdctl/v2/pkg/referenceutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestComposeImages(t *testing.T) {
-	base := testutil.NewBase(t)
 	var dockerComposeYAML = fmt.Sprintf(`
-version: '3.1'
-
 services:
   wordpress:
     image: %s
-    ports:
-      - 8080:80
+    container_name: wordpress
     environment:
       WORDPRESS_DB_HOST: db
       WORDPRESS_DB_USER: exampleuser
@@ -44,6 +46,7 @@ services:
       - wordpress:/var/www/html
   db:
     image: %s
+    container_name: db
     environment:
       MYSQL_DATABASE: exampledb
       MYSQL_USER: exampleuser
@@ -57,95 +60,71 @@ volumes:
   db:
 `, testutil.WordpressImage, testutil.MariaDBImage)
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
-
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "up", "-d").AssertOK()
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").Run()
-
-	wordpressImageName := strings.Split(testutil.WordpressImage, ":")[0]
-	dbImageName := strings.Split(testutil.MariaDBImage, ":")[0]
-
-	// check one service image
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "images", "db").AssertOutContains(dbImageName)
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "images", "db").AssertOutNotContains(wordpressImageName)
-
-	// check all service images
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "images").AssertOutContains(dbImageName)
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "images").AssertOutContains(wordpressImageName)
-}
+	wordpressImageName, _ := referenceutil.Parse(testutil.WordpressImage)
+	dbImageName, _ := referenceutil.Parse(testutil.MariaDBImage)
 
-func TestComposeImagesJson(t *testing.T) {
-	base := testutil.NewBase(t)
-	var dockerComposeYAML = fmt.Sprintf(`
-version: '3.1'
+	testCase := nerdtest.Setup()
 
-services:
-  wordpress:
-    image: %s
-    container_name: wordpress
-    ports:
-      - 8080:80
-    environment:
-      WORDPRESS_DB_HOST: db
-      WORDPRESS_DB_USER: exampleuser
-      WORDPRESS_DB_PASSWORD: examplepass
-      WORDPRESS_DB_NAME: exampledb
-    volumes:
-      - wordpress:/var/www/html
-  db:
-    image: %s
-    container_name: db
-    environment:
-      MYSQL_DATABASE: exampledb
-      MYSQL_USER: exampleuser
-      MYSQL_PASSWORD: examplepass
-      MYSQL_RANDOM_ROOT_PASSWORD: '1'
-    volumes:
-      - db:/var/lib/mysql
-
-volumes:
-  wordpress:
-  db:
-`, testutil.WordpressImage, testutil.MariaDBImage)
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		data.Temp().Save(dockerComposeYAML, "compose.yaml")
+		data.Labels().Set("composeYaml", data.Temp().Path("compose.yaml"))
+		helpers.Ensure("compose", "-f", data.Temp().Path("compose.yaml"), "up", "-d")
+	}
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
-
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "up", "-d").AssertOK()
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").Run()
-
-	assertHandler := func(svc string, count int, fields ...string) func(stdout string) error {
-		return func(stdout string) error {
-			// 1. check json output can be unmarshalled back to printables.
-			var printables []composeContainerPrintable
-			if err := json.Unmarshal([]byte(stdout), &printables); err != nil {
-				return fmt.Errorf("[service: %s]failed to unmarshal json output from `compose images`: %s", svc, stdout)
-			}
-			// 2. check #printables matches expected count.
-			if len(printables) != count {
-				return fmt.Errorf("[service: %s]unmarshal generates %d printables, expected %d: %s", svc, len(printables), count, stdout)
-			}
-			// 3. check marshalled json string has all expected substrings.
-			for _, field := range fields {
-				if !strings.Contains(stdout, field) {
-					return fmt.Errorf("[service: %s]marshalled json output doesn't have expected string (%s): %s", svc, field, stdout)
-				}
-			}
-			return nil
-		}
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("compose", "-f", data.Temp().Path("compose.yaml"), "down")
 	}
 
-	// check other formats are not supported
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "images", "--format", "yaml").AssertFail()
-	// check all services are up (can be marshalled and unmarshalled)
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "images", "--format", "json").
-		AssertOutWithFunc(assertHandler("all", 2, `"ContainerName":"wordpress"`, `"ContainerName":"db"`))
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "images db",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("composeYaml"), "images", "db")
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.All(
+				expect.Contains(dbImageName.Name()),
+				expect.DoesNotContain(wordpressImageName.Name()),
+			)),
+		},
+		{
+			Description: "images",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("composeYaml"), "images")
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains(dbImageName.Name(), wordpressImageName.Name())),
+		},
+		{
+			Description: "images --format yaml",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("composeYaml"), "images", "--format", "yaml")
+			},
+			Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
+		},
+		{
+			Description: "images --format json",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("composeYaml"), "images", "--format", "json")
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.All(
+				expect.JSON([]composeContainerPrintable{}, func(printables []composeContainerPrintable, s string, t tig.T) {
+					assert.Equal(t, len(printables), 2)
+				}),
+				expect.Contains(`"ContainerName":"wordpress"`, `"ContainerName":"db"`),
+			)),
+		},
+		{
+			Description: "images --format json wordpress",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("composeYaml"), "images", "--format", "json", "wordpress")
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.All(
+				expect.JSON([]composeContainerPrintable{}, func(printables []composeContainerPrintable, s string, t tig.T) {
+					assert.Equal(t, len(printables), 1)
+				}),
+				expect.Contains(`"ContainerName":"wordpress"`),
+			)),
+		},
+	}
 
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "images", "--format", "json", "wordpress").
-		AssertOutWithFunc(assertHandler("wordpress", 1, `"ContainerName":"wordpress"`))
+	testCase.Run(t)
 }
diff --git a/cmd/nerdctl/compose/compose_pull_linux_test.go b/cmd/nerdctl/compose/compose_pull_linux_test.go
index 64e267baa24..e0c79325326 100644
--- a/cmd/nerdctl/compose/compose_pull_linux_test.go
+++ b/cmd/nerdctl/compose/compose_pull_linux_test.go
@@ -26,14 +26,10 @@ import (
 func TestComposePullWithService(t *testing.T) {
 	base := testutil.NewBase(t)
 	var dockerComposeYAML = fmt.Sprintf(`
-version: '3.1'
-
 services:
 
   wordpress:
     image: %s
-    ports:
-      - 8080:80
     environment:
       WORDPRESS_DB_HOST: db
       WORDPRESS_DB_USER: exampleuser
diff --git a/cmd/nerdctl/compose/compose_restart_linux_test.go b/cmd/nerdctl/compose/compose_restart_linux_test.go
index 6d5fe1fdedc..1e2ca2c5c61 100644
--- a/cmd/nerdctl/compose/compose_restart_linux_test.go
+++ b/cmd/nerdctl/compose/compose_restart_linux_test.go
@@ -26,13 +26,9 @@ import (
 func TestComposeRestart(t *testing.T) {
 	base := testutil.NewBase(t)
 	var dockerComposeYAML = fmt.Sprintf(`
-version: '3.1'
-
 services:
   wordpress:
     image: %s
-    ports:
-      - 8080:80
     environment:
       WORDPRESS_DB_HOST: db
       WORDPRESS_DB_USER: exampleuser
diff --git a/cmd/nerdctl/compose/compose_rm_linux_test.go b/cmd/nerdctl/compose/compose_rm_linux_test.go
index 948ea9e119d..58d149693a9 100644
--- a/cmd/nerdctl/compose/compose_rm_linux_test.go
+++ b/cmd/nerdctl/compose/compose_rm_linux_test.go
@@ -18,23 +18,22 @@ package compose
 
 import (
 	"fmt"
+	"regexp"
 	"testing"
-	"time"
+
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestComposeRemove(t *testing.T) {
-	base := testutil.NewBase(t)
 	var dockerComposeYAML = fmt.Sprintf(`
-version: '3.1'
-
 services:
 
   wordpress:
     image: %s
-    ports:
-      - 8080:80
     environment:
       WORDPRESS_DB_HOST: db
       WORDPRESS_DB_USER: exampleuser
@@ -58,27 +57,71 @@ volumes:
   db:
 `, testutil.WordpressImage, testutil.MariaDBImage)
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
-
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "up", "-d").AssertOK()
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").Run()
-
-	// no stopped containers
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "rm", "-f").AssertOK()
-	time.Sleep(3 * time.Second)
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "ps", "wordpress").AssertOutContainsAny("Up", "running")
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "ps", "db").AssertOutContainsAny("Up", "running")
-	// remove one stopped service
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "stop", "wordpress").AssertOK()
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "rm", "-f", "wordpress").AssertOK()
-	time.Sleep(3 * time.Second)
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "ps", "wordpress").AssertOutNotContains("wordpress")
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "ps", "db").AssertOutContainsAny("Up", "running")
-	// remove all services with `--stop`
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "rm", "-f", "-s").AssertOK()
-	time.Sleep(3 * time.Second)
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "ps", "db").AssertOutNotContains("db")
+	testCase := nerdtest.Setup()
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("compose", "-f", data.Temp().Path("compose.yaml"), "down")
+	}
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		data.Temp().Save(dockerComposeYAML, "compose.yaml")
+		helpers.Ensure("compose", "-f", data.Temp().Path("compose.yaml"), "up", "-d")
+		data.Labels().Set("yamlPath", data.Temp().Path("compose.yaml"))
+	}
+
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "All services are still up",
+			NoParallel:  true,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("yamlPath"), "rm", "-f")
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					Output: func(stdout, info string, t *testing.T) {
+						wp := helpers.Capture("compose", "-f", data.Labels().Get("yamlPath"), "ps", "wordpress")
+						db := helpers.Capture("compose", "-f", data.Labels().Get("yamlPath"), "ps", "db")
+						comp := expect.Match(regexp.MustCompile("Up|running"))
+						comp(wp, "", t)
+						comp(db, "", t)
+					},
+				}
+			},
+		},
+		{
+			Description: "Remove stopped service",
+			NoParallel:  true,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				helpers.Ensure("compose", "-f", data.Labels().Get("yamlPath"), "stop", "wordpress")
+				return helpers.Command("compose", "-f", data.Labels().Get("yamlPath"), "rm", "-f")
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					Output: func(stdout, info string, t *testing.T) {
+						wp := helpers.Capture("compose", "-f", data.Labels().Get("yamlPath"), "ps", "wordpress")
+						db := helpers.Capture("compose", "-f", data.Labels().Get("yamlPath"), "ps", "db")
+						expect.DoesNotContain("wordpress")(wp, "", t)
+						expect.Match(regexp.MustCompile("Up|running"))(db, "", t)
+					},
+				}
+			},
+		},
+		{
+			Description: "Remove all services with stop",
+			NoParallel:  true,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("yamlPath"), "rm", "-f", "-s")
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					Output: func(stdout, info string, t *testing.T) {
+						db := helpers.Capture("compose", "-f", data.Labels().Get("yamlPath"), "ps", "db")
+						expect.DoesNotContain("db")(db, "", t)
+					},
+				}
+			},
+		},
+	}
+
+	testCase.Run(t)
 }
diff --git a/cmd/nerdctl/compose/compose_start_linux_test.go b/cmd/nerdctl/compose/compose_start_linux_test.go
index 11c1581cd92..bfb001ad5c9 100644
--- a/cmd/nerdctl/compose/compose_start_linux_test.go
+++ b/cmd/nerdctl/compose/compose_start_linux_test.go
@@ -18,16 +18,18 @@ package compose
 
 import (
 	"fmt"
+	"regexp"
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestComposeStart(t *testing.T) {
-	base := testutil.NewBase(t)
 	var dockerComposeYAML = fmt.Sprintf(`
-version: '3.1'
-
 services:
   svc0:
     image: %s
@@ -37,50 +39,68 @@ services:
     command: "sleep infinity"
 `, testutil.CommonImage, testutil.CommonImage)
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
+	testCase := nerdtest.Setup()
 
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "up", "-d").AssertOK()
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").AssertOK()
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("compose", "-f", data.Temp().Path("compose.yaml"), "down")
+	}
 
-	// calling `compose start` after all services up has no effect.
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "start").AssertOK()
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		data.Temp().Save(dockerComposeYAML, "compose.yaml")
+		helpers.Ensure("compose", "-f", data.Temp().Path("compose.yaml"), "up", "-d")
+		helpers.Ensure("compose", "-f", data.Temp().Path("compose.yaml"), "start")
+		helpers.Ensure("compose", "-f", data.Temp().Path("compose.yaml"), "stop", "--timeout", "1", "svc0")
+		helpers.Ensure("compose", "-f", data.Temp().Path("compose.yaml"), "kill", "svc1")
+	}
 
-	// `compose start`` can start a stopped/killed service container
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "stop", "--timeout", "1", "svc0").AssertOK()
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "kill", "svc1").AssertOK()
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "start").AssertOK()
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "ps", "svc0").AssertOutContainsAny("Up", "running")
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "ps", "svc1").AssertOutContainsAny("Up", "running")
-}
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		return helpers.Command("compose", "-f", data.Temp().Path("compose.yaml"), "start")
+	}
 
-func TestComposeStartFailWhenServicePause(t *testing.T) {
-	base := testutil.NewBase(t)
-	switch base.Info().CgroupDriver {
-	case "none", "":
-		t.Skip("requires cgroup (for pausing)")
+	testCase.Expected = func(data test.Data, helpers test.Helpers) *test.Expected {
+		return &test.Expected{
+			ExitCode: 0,
+			Errors:   nil,
+			Output: func(stdout, info string, t *testing.T) {
+				svc0 := helpers.Capture("compose", "-f", data.Temp().Path("compose.yaml"), "ps", "svc0")
+				svc1 := helpers.Capture("compose", "-f", data.Temp().Path("compose.yaml"), "ps", "svc1")
+				comp := expect.Match(regexp.MustCompile("Up|running"))
+				comp(svc0, "", t)
+				comp(svc1, "", t)
+			},
+		}
 	}
 
-	var dockerComposeYAML = fmt.Sprintf(`
-version: '3.1'
+	testCase.Run(t)
+}
 
+func TestComposeStartFailWhenServicePause(t *testing.T) {
+	var dockerComposeYAML = fmt.Sprintf(`
 services:
   svc0:
     image: %s
     command: "sleep infinity"
 `, testutil.CommonImage)
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
+	testCase := nerdtest.Setup()
+
+	testCase.Require = nerdtest.CGroup
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("compose", "-f", data.Temp().Path("compose.yaml"), "down")
+	}
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		data.Temp().Save(dockerComposeYAML, "compose.yaml")
+		helpers.Ensure("compose", "-f", data.Temp().Path("compose.yaml"), "up", "-d")
+		helpers.Ensure("compose", "-f", data.Temp().Path("compose.yaml"), "pause", "svc0")
+	}
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		return helpers.Command("compose", "-f", data.Temp().Path("compose.yaml"), "start")
+	}
 
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "up", "-d").AssertOK()
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").AssertOK()
+	testCase.Expected = test.Expects(expect.ExitCodeGenericFail, nil, nil)
 
-	// `compose start` cannot start a paused service container
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "pause", "svc0").AssertOK()
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "start").AssertFail()
+	testCase.Run(t)
 }
diff --git a/cmd/nerdctl/compose/compose_stop_linux_test.go b/cmd/nerdctl/compose/compose_stop_linux_test.go
index e10b16ff7b2..ac346b90507 100644
--- a/cmd/nerdctl/compose/compose_stop_linux_test.go
+++ b/cmd/nerdctl/compose/compose_stop_linux_test.go
@@ -18,22 +18,22 @@ package compose
 
 import (
 	"fmt"
+	"regexp"
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestComposeStop(t *testing.T) {
-	base := testutil.NewBase(t)
 	var dockerComposeYAML = fmt.Sprintf(`
-version: '3.1'
-
 services:
 
   wordpress:
     image: %s
-    ports:
-      - 8080:80
     environment:
       WORDPRESS_DB_HOST: db
       WORDPRESS_DB_USER: exampleuser
@@ -57,21 +57,50 @@ volumes:
   db:
 `, testutil.WordpressImage, testutil.MariaDBImage)
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
-
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "up", "-d").AssertOK()
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").Run()
-
-	// stop should (only) stop the given service.
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "stop", "db").AssertOK()
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "ps", "db", "-a").AssertOutContainsAny("Exit", "exited")
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "ps", "wordpress").AssertOutContainsAny("Up", "running")
-
-	// `--timeout` arg should work properly.
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "stop", "--timeout", "5", "wordpress").AssertOK()
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "ps", "wordpress", "-a").AssertOutContainsAny("Exit", "exited")
-
+	testCase := nerdtest.Setup()
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		data.Temp().Save(dockerComposeYAML, "compose.yaml")
+		helpers.Ensure("compose", "-f", data.Temp().Path("compose.yaml"), "up", "-d")
+		data.Labels().Set("yamlPath", data.Temp().Path("compose.yaml"))
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("compose", "-f", data.Temp().Path("compose.yaml"), "down")
+	}
+
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "stop db",
+			NoParallel:  true,
+			Setup: func(data test.Data, helpers test.Helpers) {
+				helpers.Ensure("compose", "-f", data.Labels().Get("yamlPath"), "stop", "db")
+			},
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("yamlPath"), "ps", "db", "-a")
+			},
+			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("Exit|exited"))),
+		},
+		{
+			Description: "wordpress is still running",
+			NoParallel:  true,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("yamlPath"), "ps", "wordpress")
+			},
+			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("Up|running"))),
+		},
+		{
+			Description: "stop wordpress",
+			NoParallel:  true,
+			Setup: func(data test.Data, helpers test.Helpers) {
+				helpers.Ensure("compose", "-f", data.Labels().Get("yamlPath"), "stop", "--timeout", "5", "wordpress")
+			},
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("yamlPath"), "ps", "wordpress", "-a")
+			},
+			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("Exit|exited"))),
+		},
+	}
+
+	testCase.Run(t)
 }
diff --git a/cmd/nerdctl/compose/compose_top_linux_test.go b/cmd/nerdctl/compose/compose_top_linux_test.go
index a0474c51b0b..9620aa113c1 100644
--- a/cmd/nerdctl/compose/compose_top_linux_test.go
+++ b/cmd/nerdctl/compose/compose_top_linux_test.go
@@ -20,20 +20,16 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/containerd/nerdctl/v2/pkg/infoutil"
-	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestComposeTop(t *testing.T) {
-	if rootlessutil.IsRootless() && infoutil.CgroupsVersion() == "1" {
-		t.Skip("test skipped for rootless containers on cgroup v1")
-	}
-
-	base := testutil.NewBase(t)
 	var dockerComposeYAML = fmt.Sprintf(`
-version: '3.1'
-
 services:
   svc0:
     image: %s
@@ -42,15 +38,36 @@ services:
     image: %s
 `, testutil.CommonImage, testutil.NginxAlpineImage)
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
-	projectName := comp.ProjectName()
-	t.Logf("projectName=%q", projectName)
+	testCase := nerdtest.Setup()
+
+	testCase.Require = require.All(nerdtest.CgroupsAccessible)
 
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "up", "-d").AssertOK()
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down", "-v").AssertOK()
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		data.Temp().Save(dockerComposeYAML, "compose.yaml")
+		helpers.Ensure("compose", "-f", data.Temp().Path("compose.yaml"), "up", "-d")
+		data.Labels().Set("yamlPath", data.Temp().Path("compose.yaml"))
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("compose", "-f", data.Temp().Path("compose.yaml"), "down")
+	}
+
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "svc0 contains sleep infinity",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("yamlPath"), "top", "svc0")
+			},
+			Expected: test.Expects(0, nil, expect.Contains("sleep infinity")),
+		},
+		{
+			Description: "svc1 contains sleep nginx",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("compose", "-f", data.Labels().Get("yamlPath"), "top", "svc1")
+			},
+			Expected: test.Expects(0, nil, expect.Contains("nginx")),
+		},
+	}
 
-	// a running container should have the process command in output
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "top", "svc0").AssertOutContains("sleep infinity")
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "top", "svc1").AssertOutContains("nginx")
+	testCase.Run(t)
 }
diff --git a/cmd/nerdctl/compose/compose_up_test.go b/cmd/nerdctl/compose/compose_up_test.go
index eb17c7151c9..48f1b5c688f 100644
--- a/cmd/nerdctl/compose/compose_up_test.go
+++ b/cmd/nerdctl/compose/compose_up_test.go
@@ -17,66 +17,88 @@
 package compose
 
 import (
+	"errors"
 	"fmt"
-	"os"
-	"path/filepath"
-	"runtime"
 	"testing"
 
 	"gotest.tools/v3/assert"
-	"gotest.tools/v3/icmd"
+
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 // https://github.com/containerd/nerdctl/issues/1942
 func TestComposeUpDetailedError(t *testing.T) {
-	if runtime.GOOS != "linux" {
-		t.Skip("FIXME: test does not work on Windows yet (runtime \"io.containerd.runc.v2\" binary not installed \"containerd-shim-runc-v2.exe\": file does not exist)")
-	}
-	base := testutil.NewBase(t)
 	dockerComposeYAML := fmt.Sprintf(`
 services:
   foo:
     image: %s
     runtime: invalid
 `, testutil.CommonImage)
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
 
-	c := base.ComposeCmd("-f", comp.YAMLFullPath(), "up", "-d")
-	expected := icmd.Expected{
-		ExitCode: 1,
-		Err:      `invalid runtime name`,
+	testCase := nerdtest.Setup()
+
+	// "FIXME: test does not work on Windows yet (runtime \"io.containerd.runc.v2\" binary not installed \"containerd-shim-runc-v2.exe\": file does not exist)
+	testCase.Require = require.Not(require.Windows)
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		data.Temp().Save(dockerComposeYAML, "compose.yaml")
 	}
-	c.Assert(expected)
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		return helpers.Command("compose", "-f", data.Temp().Path("compose.yaml"), "up", "-d")
+	}
+
+	testCase.Expected = test.Expects(
+		1,
+		[]error{errors.New(`invalid runtime name`)},
+		nil,
+	)
+
+	testCase.Run(t)
 }
 
 // https://github.com/containerd/nerdctl/issues/1652
 func TestComposeUpBindCreateHostPath(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip(`FIXME: no support for Windows path: (error: "volume target must be an absolute path, got \"/mnt\")`)
-	}
+	testCase := nerdtest.Setup()
 
-	base := testutil.NewBase(t)
+	// `FIXME: no support for Windows path: (error: "volume target must be an absolute path, got \"/mnt\")`
+	testCase.Require = require.Not(require.Windows)
 
-	var dockerComposeYAML = fmt.Sprintf(`
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		var dockerComposeYAML = fmt.Sprintf(`
 services:
   test:
     image: %s
     command: sh -euxc "echo hi >/mnt/test"
     volumes:
-      # ./foo should be automatically created
-      - ./foo:/mnt
-`, testutil.CommonImage)
+      # tempdir/foo should be automatically created
+      - %s:/mnt
+`, testutil.CommonImage, data.Temp().Path("foo"))
+
+		data.Temp().Save(dockerComposeYAML, "compose.yaml")
+	}
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		return helpers.Command("compose", "-f", data.Temp().Path("compose.yaml"), "up")
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("compose", "-f", data.Temp().Path("compose.yaml"), "down")
+	}
 
-	comp := testutil.NewComposeDir(t, dockerComposeYAML)
-	defer comp.CleanUp()
+	testCase.Expected = func(data test.Data, helpers test.Helpers) *test.Expected {
+		return &test.Expected{
+			ExitCode: 0,
+			Errors:   nil,
+			Output: func(stdout, info string, t *testing.T) {
+				assert.Equal(t, data.Temp().Load("foo", "test"), "hi\n")
+			},
+		}
+	}
 
-	base.ComposeCmd("-f", comp.YAMLFullPath(), "up").AssertOK()
-	defer base.ComposeCmd("-f", comp.YAMLFullPath(), "down").AssertOK()
-	testFile := filepath.Join(comp.Dir(), "foo", "test")
-	testB, err := os.ReadFile(testFile)
-	assert.NilError(t, err)
-	assert.Equal(t, "hi\n", string(testB))
+	testCase.Run(t)
 }
diff --git a/cmd/nerdctl/compose/compose_version_test.go b/cmd/nerdctl/compose/compose_version_test.go
index af3028b3d65..04cdd244052 100644
--- a/cmd/nerdctl/compose/compose_version_test.go
+++ b/cmd/nerdctl/compose/compose_version_test.go
@@ -19,20 +19,29 @@ package compose
 import (
 	"testing"
 
-	"github.com/containerd/nerdctl/v2/pkg/testutil"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
+	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
 func TestComposeVersion(t *testing.T) {
-	base := testutil.NewBase(t)
-	base.ComposeCmd("version").AssertOutContains("Compose version ")
+	testCase := nerdtest.Setup()
+	testCase.Command = test.Command("compose", "version")
+	testCase.Expected = test.Expects(0, nil, expect.Contains("Compose version "))
+	testCase.Run(t)
 }
 
 func TestComposeVersionShort(t *testing.T) {
-	base := testutil.NewBase(t)
-	base.ComposeCmd("version", "--short").AssertOK()
+	testCase := nerdtest.Setup()
+	testCase.Command = test.Command("compose", "version", "--short")
+	testCase.Expected = test.Expects(0, nil, nil)
+	testCase.Run(t)
 }
 
 func TestComposeVersionJson(t *testing.T) {
-	base := testutil.NewBase(t)
-	base.ComposeCmd("version", "--format", "json").AssertOutContains("{\"version\":\"")
+	testCase := nerdtest.Setup()
+	testCase.Command = test.Command("compose", "version", "--format", "json")
+	testCase.Expected = test.Expects(0, nil, expect.Contains("{\"version\":\""))
+	testCase.Run(t)
 }

From a91b1bb35bd26877873702b2315b08b3a2a0050e Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 7 May 2025 08:53:37 -0700
Subject: [PATCH 214/225] Reduce RunSigProxyContainer refresh frequency

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 pkg/testutil/nerdtest/utilities_linux.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/testutil/nerdtest/utilities_linux.go b/pkg/testutil/nerdtest/utilities_linux.go
index bc652564f83..017dd1adb00 100644
--- a/pkg/testutil/nerdtest/utilities_linux.go
+++ b/pkg/testutil/nerdtest/utilities_linux.go
@@ -68,7 +68,7 @@ func RunSigProxyContainer(signal os.Signal, exitOnSignal bool, args []string, da
 		if strings.Contains(out, ready) {
 			break
 		}
-		time.Sleep(100 * time.Millisecond)
+		time.Sleep(1 * time.Second)
 	}
 
 	return cmd

From 8bd7a7dc998c2dcc5960baf7b58be1fcdce9f663 Mon Sep 17 00:00:00 2001
From: apostasie <spam_blackhole@farcloser.world>
Date: Wed, 7 May 2025 08:54:02 -0700
Subject: [PATCH 215/225] Rewrite logs tests and fix flakyness

Signed-off-by: apostasie <spam_blackhole@farcloser.world>
---
 cmd/nerdctl/container/container_logs_test.go | 486 ++++++++++++-------
 1 file changed, 304 insertions(+), 182 deletions(-)

diff --git a/cmd/nerdctl/container/container_logs_test.go b/cmd/nerdctl/container/container_logs_test.go
index d6011260e4e..632ce955949 100644
--- a/cmd/nerdctl/container/container_logs_test.go
+++ b/cmd/nerdctl/container/container_logs_test.go
@@ -19,8 +19,7 @@ package container
 import (
 	"errors"
 	"fmt"
-	"io"
-	"os/exec"
+	"regexp"
 	"runtime"
 	"strconv"
 	"strings"
@@ -28,7 +27,6 @@ import (
 	"time"
 
 	"gotest.tools/v3/assert"
-	"gotest.tools/v3/icmd"
 
 	"github.com/containerd/nerdctl/mod/tigron/expect"
 	"github.com/containerd/nerdctl/mod/tigron/require"
@@ -39,41 +37,86 @@ import (
 )
 
 func TestLogs(t *testing.T) {
-	t.Parallel()
-	base := testutil.NewBase(t)
-	containerName := testutil.Identifier(t)
 	const expected = `foo
-bar`
+bar
+`
 
-	defer base.Cmd("rm", containerName).Run()
-	base.Cmd("run", "-d", "--name", containerName, testutil.CommonImage,
-		"sh", "-euxc", "echo foo; echo bar").AssertOK()
-
-	//test since / until flag
-	time.Sleep(3 * time.Second)
-	base.Cmd("logs", "--since", "1s", containerName).AssertOutNotContains(expected)
-	base.Cmd("logs", "--since", "10s", containerName).AssertOutContains(expected)
-	base.Cmd("logs", "--until", "10s", containerName).AssertOutNotContains(expected)
-	base.Cmd("logs", "--until", "1s", containerName).AssertOutContains(expected)
+	testCase := nerdtest.Setup()
 
-	// Ensure follow flag works as expected:
-	base.Cmd("logs", "-f", containerName).AssertOutContains("bar")
-	base.Cmd("logs", "-f", containerName).AssertOutContains("foo")
+	if runtime.GOOS == "windows" {
+		testCase.Require = nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/4237")
+	}
 
-	//test timestamps flag
-	base.Cmd("logs", "-t", containerName).AssertOutContains(time.Now().UTC().Format("2006-01-02"))
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rm", "-f", data.Identifier())
+	}
 
-	//test tail flag
-	base.Cmd("logs", "-n", "all", containerName).AssertOutContains(expected)
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		helpers.Ensure("run", "--quiet", "--name", data.Identifier(), testutil.CommonImage, "sh", "-euxc", "echo foo; echo bar;")
+		data.Labels().Set("cID", data.Identifier())
+	}
 
-	base.Cmd("logs", "-n", "1", containerName).AssertOutWithFunc(func(stdout string) error {
-		if !(stdout == "bar\n" || stdout == "") {
-			return fmt.Errorf("expected %q or %q, got %q", "bar", "", stdout)
-		}
-		return nil
-	})
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "since 1s",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("logs", "--since", "1s", data.Labels().Get("cID"))
+			},
+			Expected: test.Expects(0, nil, expect.DoesNotContain(expected)),
+		},
+		{
+			Description: "since 60s",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("logs", "--since", "60s", data.Labels().Get("cID"))
+			},
+			Expected: test.Expects(0, nil, expect.Equals(expected)),
+		},
+		{
+			Description: "until 60s",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("logs", "--until", "60s", data.Labels().Get("cID"))
+			},
+			Expected: test.Expects(0, nil, expect.DoesNotContain(expected)),
+		},
+		{
+			Description: "until 1s",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("logs", "--until", "1s", data.Labels().Get("cID"))
+			},
+			Expected: test.Expects(0, nil, expect.Equals(expected)),
+		},
+		{
+			Description: "follow",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("logs", "-f", data.Labels().Get("cID"))
+			},
+			Expected: test.Expects(0, nil, expect.Equals(expected)),
+		},
+		{
+			Description: "timestamp",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("logs", "-t", data.Labels().Get("cID"))
+			},
+			Expected: test.Expects(0, nil, expect.Contains(time.Now().UTC().Format("2006-01-02"))),
+		},
+		{
+			Description: "tail flag",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("logs", "-n", "all", data.Labels().Get("cID"))
+			},
+			Expected: test.Expects(0, nil, expect.Equals(expected)),
+		},
+		{
+			Description: "tail flag",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("logs", "-n", "1", data.Labels().Get("cID"))
+			},
+			// FIXME: why?
+			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("^(?:bar\n|)$"))),
+		},
+	}
 
-	base.Cmd("rm", "-f", containerName).AssertOK()
+	testCase.Run(t)
 }
 
 // Tests whether `nerdctl logs` properly separates stdout/stderr output
@@ -81,8 +124,13 @@ bar`
 func TestLogsOutStreamsSeparated(t *testing.T) {
 	testCase := nerdtest.Setup()
 
+	if runtime.GOOS == "windows" {
+		// Logging seems broken on windows.
+		testCase.Require = nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/4237")
+	}
+
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
-		helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage,
+		helpers.Ensure("run", "--name", data.Identifier(), testutil.CommonImage,
 			"sh", "-euc", "echo stdout1; echo stderr1 >&2; echo stdout2; echo stderr2 >&2")
 	}
 
@@ -91,8 +139,6 @@ func TestLogsOutStreamsSeparated(t *testing.T) {
 	}
 
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
-		// Arbitrary, but we need to wait until the logs show up
-		time.Sleep(3 * time.Second)
 		return helpers.Command("logs", data.Identifier())
 	}
 
@@ -105,116 +151,165 @@ func TestLogsOutStreamsSeparated(t *testing.T) {
 }
 
 func TestLogsWithInheritedFlags(t *testing.T) {
-	// Seen flaky with Docker
-	t.Parallel()
-	base := testutil.NewBase(t)
-	for k, v := range base.Args {
-		if strings.HasPrefix(v, "--namespace=") {
-			base.Args[k] = "-n=" + testutil.Namespace
-		}
+	testCase := nerdtest.Setup()
+
+	testCase.Require = require.Not(nerdtest.Docker)
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		helpers.Ensure("-n="+testutil.Namespace, "run", "--name", data.Identifier(), testutil.CommonImage,
+			"sh", "-euxc", "echo foo; echo bar")
 	}
-	containerName := testutil.Identifier(t)
 
-	defer base.Cmd("rm", containerName).Run()
-	base.Cmd("run", "-d", "--name", containerName, testutil.CommonImage,
-		"sh", "-euxc", "echo foo; echo bar").AssertOK()
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rm", "-f", data.Identifier())
+	}
 
-	// It appears this test flakes out with Docker seeing only "foo\n"
-	// Tentatively adding a pause in case this is just slow
-	time.Sleep(time.Second)
-	// test rootCmd alias `-n` already used in logs subcommand
-	base.Cmd("logs", "-n", "1", containerName).AssertOutWithFunc(func(stdout string) error {
-		if !(stdout == "bar\n" || stdout == "") {
-			return fmt.Errorf("expected %q or %q, got %q", "bar", "", stdout)
-		}
-		return nil
-	})
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		return helpers.Command("-n="+testutil.Namespace, "logs", "-n", "1", data.Identifier())
+	}
+
+	// FIXME: why?
+	testCase.Expected = test.Expects(0, nil, expect.Match(regexp.MustCompile("^(?:bar\n|)$")))
+
+	testCase.Run(t)
 }
 
 func TestLogsOfJournaldDriver(t *testing.T) {
-	testutil.RequireExecutable(t, "journalctl")
-	journalctl, _ := exec.LookPath("journalctl")
-	res := icmd.RunCmd(icmd.Command(journalctl, "-xe"))
-	if res.ExitCode != 0 {
-		t.Skipf("current user is not allowed to access journal logs: %s", res.Combined())
-	}
+	const expected = `foo
+bar
+`
 
-	t.Parallel()
-	base := testutil.NewBase(t)
-	containerName := testutil.Identifier(t)
+	testCase := nerdtest.Setup()
 
-	defer base.Cmd("rm", containerName).Run()
-	base.Cmd("run", "-d", "--network", "none", "--log-driver", "journald", "--name", containerName, testutil.CommonImage,
-		"sh", "-euxc", "echo foo; echo bar").AssertOK()
+	testCase.Require = require.All(
+		require.Binary("journalctl"),
+		&test.Requirement{
+			Check: func(data test.Data, helpers test.Helpers) (bool, string) {
+				works := false
+				cmd := helpers.Custom("journalctl", "-xe")
+				cmd.Run(&test.Expected{
+					ExitCode: expect.ExitCodeNoCheck,
+					Output: func(stdout, info string, t *testing.T) {
+						if stdout != "" {
+							works = true
+						}
+					},
+				})
+				return works, "Journactl to return data for the current user"
+			},
+		},
+	)
 
-	time.Sleep(3 * time.Second)
-	base.Cmd("logs", containerName).AssertOutContains("bar")
-	// Run logs twice, make sure that the logs are not removed
-	base.Cmd("logs", containerName).AssertOutContains("foo")
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rm", "-f", data.Identifier())
+	}
 
-	base.Cmd("logs", "--since", "5s", containerName).AssertOutWithFunc(func(stdout string) error {
-		if !strings.Contains(stdout, "bar") {
-			return fmt.Errorf("expected bar, got %s", stdout)
-		}
-		if !strings.Contains(stdout, "foo") {
-			return fmt.Errorf("expected foo, got %s", stdout)
-		}
-		return nil
-	})
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		helpers.Ensure("run", "--network", "none", "--log-driver", "journald", "--name", data.Identifier(), testutil.CommonImage,
+			"sh", "-euxc", "echo foo; echo bar")
+		data.Labels().Set("cID", data.Identifier())
+	}
 
-	base.Cmd("rm", "-f", containerName).AssertOK()
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "logs",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("logs", data.Labels().Get("cID"))
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals(expected)),
+		},
+		{
+			Description: "logs --since 60s",
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("logs", "--since", "60s", data.Labels().Get("cID"))
+			},
+			Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.DoesNotContain("foo", "bar")),
+		},
+	}
 }
 
 func TestLogsWithFailingContainer(t *testing.T) {
-	t.Parallel()
-	base := testutil.NewBase(t)
-	containerName := testutil.Identifier(t)
-	defer base.Cmd("rm", containerName).Run()
-	base.Cmd("run", "-d", "--name", containerName, testutil.CommonImage,
-		"sh", "-euxc", "echo foo; echo bar; exit 42; echo baz").AssertOK()
-	time.Sleep(3 * time.Second)
-	// AssertOutContains also asserts that the exit code of the logs command == 0,
-	// even when the container is failing
-	base.Cmd("logs", "-f", containerName).AssertOutContains("bar")
-	base.Cmd("logs", "-f", containerName).AssertOutNotContains("baz")
-	base.Cmd("rm", "-f", containerName).AssertOK()
+	const expected = `foo
+bar
+`
+
+	testCase := nerdtest.Setup()
+
+	if runtime.GOOS == "windows" {
+		// Logging seems broken on windows.
+		testCase.Require = nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/4237")
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rm", "-f", data.Identifier())
+	}
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("run", "--name", data.Identifier(), testutil.CommonImage, "sh", "-euxc", "echo foo; echo bar; exit 42; echo baz")
+	}
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		return helpers.Command("logs", data.Identifier())
+	}
+
+	testCase.Expected = test.Expects(0, nil, expect.Equals(expected))
+
+	testCase.Run(t)
 }
 
 func TestLogsWithRunningContainer(t *testing.T) {
-	t.Parallel()
-	base := testutil.NewBase(t)
-	containerName := testutil.Identifier(t)
-	defer base.Cmd("rm", "-f", containerName).Run()
 	expected := make([]string, 10)
 	for i := 0; i < 10; i++ {
 		expected[i] = fmt.Sprint(i + 1)
 	}
 
-	base.Cmd("run", "-d", "--name", containerName, testutil.CommonImage,
-		"sh", "-euc", "for i in `seq 1 10`; do echo $i; sleep 1; done").AssertOK()
-	base.Cmd("logs", "-f", containerName).AssertOutContainsAll(expected...)
+	testCase := nerdtest.Setup()
+
+	if runtime.GOOS == "windows" {
+		// Logging seems broken on windows.
+		testCase.Require = nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/4237")
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rm", "-f", data.Identifier())
+	}
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		helpers.Ensure("run", "--name", data.Identifier(), testutil.CommonImage, "sh", "-euc", "for i in `seq 1 10`; do echo $i; sleep 1; done")
+	}
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		return helpers.Command("logs", data.Identifier())
+	}
+
+	testCase.Expected = test.Expects(0, nil, expect.Contains(expected[0], expected[1:]...))
+
+	testCase.Run(t)
 }
 
 func TestLogsWithoutNewlineOrEOF(t *testing.T) {
 	testCase := nerdtest.Setup()
+
 	// FIXME: test does not work on Windows yet because containerd doesn't send an exit event appropriately after task exit on Windows")
 	// FIXME: nerdctl behavior does not match docker - test disabled for nerdctl until we fix
 	testCase.Require = require.All(
 		require.Linux,
-		nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/4201"),
 	)
+
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
-		helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage, "printf", "'Hello World!\nThere is no newline'")
+		helpers.Ensure("run", "--name", data.Identifier(), testutil.CommonImage, "printf", "'Hello World!\nThere is no newline'")
 	}
+
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
 		helpers.Anyhow("rm", "-f", data.Identifier())
 	}
+
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
-		// FIXME: arbitrary timeouts are by nature a problem.
-		time.Sleep(5 * time.Second)
 		return helpers.Command("logs", "-f", data.Identifier())
 	}
+
 	testCase.Expected = test.Expects(0, nil, expect.Equals("'Hello World!\nThere is no newline'"))
+
 	testCase.Run(t)
 }
 
@@ -222,19 +317,44 @@ func TestLogsAfterRestartingContainer(t *testing.T) {
 	if runtime.GOOS != "linux" {
 		t.Skip("FIXME: test does not work on Windows yet. Restarting a container fails with: failed to create shim task: hcs::CreateComputeSystem <id>: The requested operation for attach namespace failed.: unknown")
 	}
-	t.Parallel()
-	base := testutil.NewBase(t)
-	containerName := testutil.Identifier(t)
-	defer base.Cmd("rm", "-f", containerName).Run()
-	base.Cmd("run", "-d", "--name", containerName, testutil.CommonImage,
-		"printf", "'Hello World!\nThere is no newline'").AssertOK()
-	expected := []string{"Hello World!", "There is no newline"}
-	time.Sleep(3 * time.Second)
-	base.Cmd("logs", "-f", containerName).AssertOutContainsAll(expected...)
-	// restart and check logs again
-	base.Cmd("start", containerName)
-	time.Sleep(3 * time.Second)
-	base.Cmd("logs", "-f", containerName).AssertOutContainsAll(expected...)
+
+	testCase := nerdtest.Setup()
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		helpers.Ensure("run", "--name", data.Identifier(), testutil.CommonImage,
+			"printf", "'Hello World!\nThere is no newline'")
+		data.Labels().Set("cID", data.Identifier())
+	}
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rm", "-f", data.Identifier())
+	}
+
+	testCase.SubTests = []*test.Case{
+		{
+			Description: "logs -f works",
+			NoParallel:  true,
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("logs", "-f", data.Labels().Get("cID"))
+			},
+			Expected: test.Expects(0, nil, expect.Equals("'Hello World!\nThere is no newline'")),
+		},
+		{
+			Description: "logs -f works after restart",
+			NoParallel:  true,
+			Setup: func(data test.Data, helpers test.Helpers) {
+				helpers.Ensure("start", data.Labels().Get("cID"))
+				// FIXME: this is inherently flaky
+				time.Sleep(5 * time.Second)
+			},
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("logs", "-f", data.Labels().Get("cID"))
+			},
+			Expected: test.Expects(0, nil, expect.Equals("'Hello World!\nThere is no newline''Hello World!\nThere is no newline'")),
+		},
+	}
+
+	testCase.Run(t)
 }
 
 func TestLogsWithForegroundContainers(t *testing.T) {
@@ -256,10 +376,7 @@ func TestLogsWithForegroundContainers(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("logs", data.Identifier())
 			},
-			Expected: test.Expects(0, nil, expect.All(
-				expect.Contains("foo", "bar"),
-				expect.DoesNotContain("baz"),
-			)),
+			Expected: test.Expects(0, nil, expect.Equals("foo\nbar\n")),
 		},
 		{
 			Description: "interactive",
@@ -272,10 +389,7 @@ func TestLogsWithForegroundContainers(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("logs", data.Identifier())
 			},
-			Expected: test.Expects(0, nil, expect.All(
-				expect.Contains("foo", "bar"),
-				expect.DoesNotContain("baz"),
-			)),
+			Expected: test.Expects(0, nil, expect.Equals("foo\nbar\n")),
 		},
 		{
 			Description: "PTY",
@@ -290,10 +404,7 @@ func TestLogsWithForegroundContainers(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("logs", data.Identifier())
 			},
-			Expected: test.Expects(0, nil, expect.All(
-				expect.Contains("foo", "bar"),
-				expect.DoesNotContain("baz"),
-			)),
+			Expected: test.Expects(0, nil, expect.Equals("foo\nbar\n")),
 		},
 		{
 			Description: "interactivePTY",
@@ -308,69 +419,88 @@ func TestLogsWithForegroundContainers(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("logs", data.Identifier())
 			},
-			Expected: test.Expects(0, nil, expect.All(
-				expect.Contains("foo", "bar"),
-				expect.DoesNotContain("baz"),
-			)),
+			Expected: test.Expects(0, nil, expect.Equals("foo\nbar\n")),
 		},
 	}
 }
 
-func TestTailFollowRotateLogs(t *testing.T) {
-	// FIXME this is flaky by nature... 2 lines is arbitrary, 10000 ms is arbitrary, and both are some sort of educated
-	// guess that things will mostly always kinda work maybe...
-	// Furthermore, parallelizing will put pressure on the daemon which might be even slower in answering, increasing
-	// the risk of transient failure.
-	// This test needs to be rethought entirely
-	// t.Parallel()
-	if runtime.GOOS == "windows" {
-		t.Skip("tail log is not supported on Windows")
-	}
-	base := testutil.NewBase(t)
-	containerName := testutil.Identifier(t)
-
+func TestLogsTailFollowRotate(t *testing.T) {
+	// FIXME this is flaky by nature... the number of lines is arbitrary, the wait is arbitrary,
+	// and both are some sort of educated guess that things will mostly always kinda work maybe...
 	const sampleJSONLog = `{"log":"A\n","stream":"stdout","time":"2024-04-11T12:01:09.800288974Z"}`
 	const linesPerFile = 200
 
-	defer base.Cmd("rm", "-f", containerName).Run()
-	base.Cmd("run", "-d", "--log-driver", "json-file",
-		"--log-opt", fmt.Sprintf("max-size=%d", len(sampleJSONLog)*linesPerFile),
-		"--log-opt", "max-file=10",
-		"--name", containerName, testutil.CommonImage,
-		"sh", "-euc", "while true; do echo A; usleep 100; done").AssertOK()
-
-	tailLogCmd := base.Cmd("logs", "-f", containerName)
-	tailLogCmd.Timeout = 1000 * time.Millisecond
-	logRun := tailLogCmd.Run()
-	tailLogs := strings.Split(strings.TrimSpace(logRun.Stdout()), "\n")
-	for _, line := range tailLogs {
-		if line != "" {
-			assert.Equal(t, "A", line)
-		}
+	testCase := nerdtest.Setup()
+
+	// tail log is not supported on Windows
+	testCase.Require = require.Not(require.Windows)
+
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		helpers.Ensure("run", "-d", "--log-driver", "json-file",
+			"--log-opt", fmt.Sprintf("max-size=%d", len(sampleJSONLog)*linesPerFile),
+			"--log-opt", "max-file=10",
+			"--name", data.Identifier(), testutil.CommonImage,
+			"sh", "-euc", "while true; do echo A; usleep 100; done")
+		// FIXME: ... inherently racy...
+		time.Sleep(5 * time.Second)
 	}
-	assert.Equal(t, true, len(tailLogs) > linesPerFile, logRun.Stderr())
+
+	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
+		helpers.Anyhow("rm", "-f", data.Identifier())
+	}
+
+	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
+		cmd := helpers.Command("logs", "-f", data.Identifier())
+		// FIXME: this is flaky by nature. We assume that the container has started and will output enough in 5 seconds.
+		cmd.WithTimeout(5 * time.Second)
+		return cmd
+	}
+
+	testCase.Expected = test.Expects(expect.ExitCodeTimeout, nil, func(stdout, info string, t *testing.T) {
+		tailLogs := strings.Split(strings.TrimSpace(stdout), "\n")
+		for _, line := range tailLogs {
+			if line != "" {
+				assert.Equal(t, "A", line)
+			}
+		}
+
+		assert.Assert(t, len(tailLogs) > linesPerFile, fmt.Sprintf("expected %d lines or more, found %d", linesPerFile, len(tailLogs)))
+	})
+
+	testCase.Run(t)
 }
-func TestNoneLoggerHasNoLogURI(t *testing.T) {
+
+func TestLogsNoneLoggerHasNoLogURI(t *testing.T) {
 	testCase := nerdtest.Setup()
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		helpers.Ensure("run", "--name", data.Identifier(), "--log-driver", "none", testutil.CommonImage, "sh", "-euxc", "echo foo")
 	}
+
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
 		helpers.Anyhow("rm", "-f", data.Identifier())
 	}
+
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
 		return helpers.Command("logs", data.Identifier())
 	}
+
 	testCase.Expected = test.Expects(1, nil, nil)
+
 	testCase.Run(t)
 }
 
 func TestLogsWithDetails(t *testing.T) {
 	testCase := nerdtest.Setup()
 
+	// FIXME: this is not working on windows. There is some deep issue with windows logs:
+	// https://github.com/containerd/nerdctl/issues/4237
+	if runtime.GOOS == "windows" {
+		testCase.Require = nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/4237")
+	}
+
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
-		helpers.Ensure("run", "-d", "--log-driver", "json-file",
+		helpers.Ensure("run", "--log-driver", "json-file",
 			"--log-opt", "max-size=10m",
 			"--log-opt", "max-file=3",
 			"--log-opt", "env=ENV",
@@ -401,7 +531,7 @@ func TestLogsFollowNoExtraneousLineFeed(t *testing.T) {
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		// Create a container that outputs a message without a trailing newline
-		helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage,
+		helpers.Ensure("run", "--name", data.Identifier(), testutil.CommonImage,
 			"sh", "-c", "printf 'Hello without newline'")
 	}
 
@@ -411,8 +541,6 @@ func TestLogsFollowNoExtraneousLineFeed(t *testing.T) {
 
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
 		// Use logs -f to follow the logs
-		// Arbitrary, but we need to wait until the logs show up
-		time.Sleep(3 * time.Second)
 		return helpers.Command("logs", "-f", data.Identifier())
 	}
 
@@ -425,7 +553,7 @@ func TestLogsFollowNoExtraneousLineFeed(t *testing.T) {
 func TestLogsWithStartContainer(t *testing.T) {
 	testCase := nerdtest.Setup()
 
-	// For windows we  havent added support for dual logging so not adding the test.
+	// Windows does not support dual logging.
 	testCase.Require = require.Not(require.Windows)
 
 	testCase.SubTests = []*test.Case{
@@ -434,34 +562,28 @@ func TestLogsWithStartContainer(t *testing.T) {
 			Setup: func(data test.Data, helpers test.Helpers) {
 				cmd := helpers.Command("run", "-it", "--name", data.Identifier(), testutil.CommonImage)
 				cmd.WithPseudoTTY()
-				cmd.WithFeeder(func() io.Reader {
-					return strings.NewReader("echo foo\nexit\n")
+				cmd.Feed(strings.NewReader("echo foo\nexit\n"))
+				cmd.Run(&test.Expected{
+					ExitCode: 0,
 				})
 
+				cmd = helpers.Command("start", "-ia", data.Identifier())
+				cmd.WithPseudoTTY()
+				cmd.Feed(strings.NewReader("echo bar\nexit\n"))
 				cmd.Run(&test.Expected{
 					ExitCode: 0,
 				})
-
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				cmd := helpers.Command("start", "-ia", data.Identifier())
-				cmd.WithPseudoTTY()
-				cmd.WithFeeder(func() io.Reader {
-					return strings.NewReader("echo bar\nexit\n")
-				})
-				cmd.Run(&test.Expected{
-					ExitCode: 0,
-				})
-				cmd = helpers.Command("logs", data.Identifier())
-
-				return cmd
+				return helpers.Command("logs", data.Identifier())
 			},
 			Expected: test.Expects(0, nil, expect.Contains("foo", "bar")),
 		},
 		{
+			// FIXME: is this test safe or could it be racy?
 			Description: "Test logs are captured after stopping and starting a non-interactive container and continue capturing new logs",
 			Setup: func(data test.Data, helpers test.Helpers) {
 				helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage, "sh", "-c", "while true; do echo foo; sleep 1; done")

From 0365d394416da17aaed3bf0e853583dad2cb08db Mon Sep 17 00:00:00 2001
From: Hayato Kiwata <haytok@amazon.co.jp>
Date: Sun, 18 May 2025 08:17:37 +0000
Subject: [PATCH 216/225] test: refactor TestTestParseFlagPWithPlatformSpec and
 TestParsePortsLabel

Signed-off-by: Hayato Kiwata <haytok@amazon.co.jp>
---
 pkg/portutil/portutil_test.go | 100 +++++++++++++---------------------
 1 file changed, 37 insertions(+), 63 deletions(-)

diff --git a/pkg/portutil/portutil_test.go b/pkg/portutil/portutil_test.go
index 8b79deb192d..55930e07f3b 100644
--- a/pkg/portutil/portutil_test.go
+++ b/pkg/portutil/portutil_test.go
@@ -22,6 +22,8 @@ import (
 	"sort"
 	"testing"
 
+	"gotest.tools/v3/assert"
+
 	"github.com/containerd/go-cni"
 
 	"github.com/containerd/nerdctl/v2/pkg/labels"
@@ -124,45 +126,30 @@ func TestTestParseFlagPWithPlatformSpec(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got, err := ParseFlagP(tt.args.s)
-			t.Log(err)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("ParseFlagP() error = %v, wantErr %v", err, tt.wantErr)
-				return
+			if err != nil {
+				t.Log(err)
+				assert.Equal(t, true, tt.wantErr)
 			}
 			if !reflect.DeepEqual(got, tt.want) {
-				if len(got) == len(tt.want) {
-					if len(got) > 0 {
-						var hostPorts []int32
-						var containerPorts []int32
-						for _, value := range got {
-							hostPorts = append(hostPorts, value.HostPort)
-							containerPorts = append(containerPorts, value.ContainerPort)
-						}
-						sort.Slice(hostPorts, func(i, j int) bool {
-							return i < j
-						})
-						sort.Slice(containerPorts, func(i, j int) bool {
-							return i < j
-						})
-						if (hostPorts[len(hostPorts)-1] - hostPorts[0]) != (containerPorts[len(hostPorts)-1] - containerPorts[0]) {
-							t.Errorf("ParseFlagP() = %v, want %v", got, tt.want)
-						}
-						sort.Slice(got, func(i, j int) bool {
-							return got[i].HostPort < got[j].HostPort
-						})
-						for i := 0; i < len(got); i++ {
-							if got[i].ContainerPort != tt.want[i].ContainerPort || got[i].Protocol != tt.want[i].Protocol || got[i].HostIP != tt.want[i].HostIP {
-								t.Errorf("ParseFlagP() = %v, want %v", got, tt.want)
-							}
-						}
+				assert.Equal(t, len(got), len(tt.want))
+				if len(got) > 0 {
+					sort.Slice(got, func(i, j int) bool {
+						return got[i].HostPort < got[j].HostPort
+					})
+					assert.Equal(
+						t,
+						got[len(got)-1].HostPort-got[0].HostPort,
+						got[len(got)-1].ContainerPort-got[0].ContainerPort,
+					)
+					for i := range len(got) {
+						assert.Equal(t, got[i].ContainerPort, tt.want[i].ContainerPort)
+						assert.Equal(t, got[i].Protocol, tt.want[i].Protocol)
+						assert.Equal(t, got[i].HostIP, tt.want[i].HostIP)
 					}
-				} else {
-					t.Errorf("ParseFlagP() = %v, want %v", got, tt.want)
 				}
 			}
 		})
 	}
-
 }
 
 func TestParsePortsLabel(t *testing.T) {
@@ -213,40 +200,27 @@ func TestParsePortsLabel(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got, err := ParsePortsLabel(tt.labelMap)
-			t.Log(err)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("ParsePortsLabel() error = %v, wantErr %v", err, tt.wantErr)
-				return
+			if err != nil {
+				t.Log(err)
+				assert.Equal(t, true, tt.wantErr)
 			}
 			if !reflect.DeepEqual(got, tt.want) {
-				if len(got) == len(tt.want) {
-					if len(got) > 0 {
-						var hostPorts []int32
-						var containerPorts []int32
-						for _, value := range got {
-							hostPorts = append(hostPorts, value.HostPort)
-							containerPorts = append(containerPorts, value.ContainerPort)
-						}
-						sort.Slice(hostPorts, func(i, j int) bool {
-							return i < j
-						})
-						sort.Slice(containerPorts, func(i, j int) bool {
-							return i < j
-						})
-						if (hostPorts[len(hostPorts)-1] - hostPorts[0]) != (containerPorts[len(hostPorts)-1] - containerPorts[0]) {
-							t.Errorf("ParsePortsLabel() = %v, want %v", got, tt.want)
-						}
-						sort.Slice(got, func(i, j int) bool {
-							return got[i].HostPort < got[j].HostPort
-						})
-						for i := 0; i < len(got); i++ {
-							if got[i].HostPort != tt.want[i].HostPort || got[i].ContainerPort != tt.want[i].ContainerPort || got[i].Protocol != tt.want[i].Protocol || got[i].HostIP != tt.want[i].HostIP {
-								t.Errorf("ParsePortsLabel() = %v, want %v", got, tt.want)
-							}
-						}
+				assert.Equal(t, len(got), len(tt.want))
+				if len(got) > 0 {
+					sort.Slice(got, func(i, j int) bool {
+						return got[i].HostPort < got[j].HostPort
+					})
+					assert.Equal(
+						t,
+						got[len(got)-1].HostPort-got[0].HostPort,
+						got[len(got)-1].ContainerPort-got[0].ContainerPort,
+					)
+					for i := range len(got) {
+						assert.Equal(t, got[i].HostPort, tt.want[i].HostPort)
+						assert.Equal(t, got[i].ContainerPort, tt.want[i].ContainerPort)
+						assert.Equal(t, got[i].Protocol, tt.want[i].Protocol)
+						assert.Equal(t, got[i].HostIP, tt.want[i].HostIP)
 					}
-				} else {
-					t.Errorf("ParsePortsLabel() = %v, want %v", got, tt.want)
 				}
 			}
 		})

From 42367649a4aa9337f2b8d4b2642e7c654fa300ed Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 19 May 2025 22:25:23 +0000
Subject: [PATCH 217/225] build(deps): bump
 github.com/compose-spec/compose-go/v2

Bumps [github.com/compose-spec/compose-go/v2](https://github.com/compose-spec/compose-go) from 2.6.2 to 2.6.3.
- [Release notes](https://github.com/compose-spec/compose-go/releases)
- [Commits](https://github.com/compose-spec/compose-go/compare/v2.6.2...v2.6.3)

---
updated-dependencies:
- dependency-name: github.com/compose-spec/compose-go/v2
  dependency-version: 2.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 5a44ed35b05..1d8c95def7d 100644
--- a/go.mod
+++ b/go.mod
@@ -7,7 +7,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.3.1
 	github.com/Microsoft/go-winio v0.6.2
 	github.com/Microsoft/hcsshim v0.13.0
-	github.com/compose-spec/compose-go/v2 v2.6.2 //gomodjail:unconfined
+	github.com/compose-spec/compose-go/v2 v2.6.3 //gomodjail:unconfined
 	github.com/containerd/accelerated-container-image v1.3.0
 	github.com/containerd/cgroups/v3 v3.0.5 //gomodjail:unconfined
 	github.com/containerd/console v1.0.4 //gomodjail:unconfined
diff --git a/go.sum b/go.sum
index ac3bb575873..59b8b8d4686 100644
--- a/go.sum
+++ b/go.sum
@@ -21,8 +21,8 @@ github.com/cilium/ebpf v0.16.0 h1:+BiEnHL6Z7lXnlGUsXQPPAE7+kenAd4ES8MQ5min0Ok=
 github.com/cilium/ebpf v0.16.0/go.mod h1:L7u2Blt2jMM/vLAVgjxluxtBKlz3/GWjB0dMOEngfwE=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/compose-spec/compose-go/v2 v2.6.2 h1:31uZNNLeRrKjtUCc56CzPpPykW1Tm6SxLn4gx9Jjzqw=
-github.com/compose-spec/compose-go/v2 v2.6.2/go.mod h1:vPlkN0i+0LjLf9rv52lodNMUTJF5YHVfHVGLLIP67NA=
+github.com/compose-spec/compose-go/v2 v2.6.3 h1:zfW1Qp605ESySyth/zR+6yLr55XE0AiOAUlZLHKMoW0=
+github.com/compose-spec/compose-go/v2 v2.6.3/go.mod h1:vPlkN0i+0LjLf9rv52lodNMUTJF5YHVfHVGLLIP67NA=
 github.com/containerd/accelerated-container-image v1.3.0 h1:sFbTgSuMboeKHa9f7MY11hWF1XxVWjFoiTsXYtOtvdU=
 github.com/containerd/accelerated-container-image v1.3.0/go.mod h1:EvKVWor6ZQNUyYp0MZm5hw4k21ropuz7EegM+m/Jb/Q=
 github.com/containerd/cgroups/v3 v3.0.5 h1:44na7Ud+VwyE7LIoJ8JTNQOa549a8543BmzaJHo6Bzo=

From 901769d8ef2ae7fec7d75e38e5cd8693d64a3f30 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 20 May 2025 09:41:06 +0000
Subject: [PATCH 218/225] build(deps): bump github.com/containerd/console from
 1.0.4 to 1.0.5

Bumps [github.com/containerd/console](https://github.com/containerd/console) from 1.0.4 to 1.0.5.
- [Release notes](https://github.com/containerd/console/releases)
- [Commits](https://github.com/containerd/console/compare/v1.0.4...v1.0.5)

---
updated-dependencies:
- dependency-name: github.com/containerd/console
  dependency-version: 1.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 1d8c95def7d..ea6b0779fb3 100644
--- a/go.mod
+++ b/go.mod
@@ -10,7 +10,7 @@ require (
 	github.com/compose-spec/compose-go/v2 v2.6.3 //gomodjail:unconfined
 	github.com/containerd/accelerated-container-image v1.3.0
 	github.com/containerd/cgroups/v3 v3.0.5 //gomodjail:unconfined
-	github.com/containerd/console v1.0.4 //gomodjail:unconfined
+	github.com/containerd/console v1.0.5 //gomodjail:unconfined
 	github.com/containerd/containerd/api v1.9.0
 	github.com/containerd/containerd/v2 v2.1.0 //gomodjail:unconfined
 	github.com/containerd/continuity v0.4.5 //gomodjail:unconfined
diff --git a/go.sum b/go.sum
index 59b8b8d4686..88dfd2a2495 100644
--- a/go.sum
+++ b/go.sum
@@ -27,8 +27,8 @@ github.com/containerd/accelerated-container-image v1.3.0 h1:sFbTgSuMboeKHa9f7MY1
 github.com/containerd/accelerated-container-image v1.3.0/go.mod h1:EvKVWor6ZQNUyYp0MZm5hw4k21ropuz7EegM+m/Jb/Q=
 github.com/containerd/cgroups/v3 v3.0.5 h1:44na7Ud+VwyE7LIoJ8JTNQOa549a8543BmzaJHo6Bzo=
 github.com/containerd/cgroups/v3 v3.0.5/go.mod h1:SA5DLYnXO8pTGYiAHXz94qvLQTKfVM5GEVisn4jpins=
-github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn4ro=
-github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
+github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/qqsc=
+github.com/containerd/console v1.0.5/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
 github.com/containerd/containerd/api v1.9.0 h1:HZ/licowTRazus+wt9fM6r/9BQO7S0vD5lMcWspGIg0=
 github.com/containerd/containerd/api v1.9.0/go.mod h1:GhghKFmTR3hNtyznBoQ0EMWr9ju5AqHjcZPsSpTKutI=
 github.com/containerd/containerd/v2 v2.1.0 h1:lS6iJ/CwZrxYxKd6zWBz5LR7xOlMVQC78z68YtizUAM=

From 11054f701938d8071b96f075837011b6ddb15b61 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 20 May 2025 09:41:09 +0000
Subject: [PATCH 219/225] build(deps): bump
 github.com/fluent/fluent-logger-golang

Bumps [github.com/fluent/fluent-logger-golang](https://github.com/fluent/fluent-logger-golang) from 1.9.0 to 1.10.0.
- [Changelog](https://github.com/fluent/fluent-logger-golang/blob/master/CHANGELOG.md)
- [Commits](https://github.com/fluent/fluent-logger-golang/compare/v1.9.0...v1.10.0)

---
updated-dependencies:
- dependency-name: github.com/fluent/fluent-logger-golang
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod |  9 ++++-----
 go.sum | 14 ++++++--------
 2 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/go.mod b/go.mod
index 1d8c95def7d..c6d7f9bffe2 100644
--- a/go.mod
+++ b/go.mod
@@ -1,7 +1,7 @@
 //gomodjail:confined
 module github.com/containerd/nerdctl/v2
 
-go 1.23.0
+go 1.23.5
 
 require (
 	github.com/Masterminds/semver/v3 v3.3.1
@@ -38,7 +38,7 @@ require (
 	github.com/docker/go-units v0.5.0
 	github.com/fahedouch/go-logrotate v0.3.0 //gomodjail:unconfined
 	github.com/fatih/color v1.18.0 //gomodjail:unconfined
-	github.com/fluent/fluent-logger-golang v1.9.0
+	github.com/fluent/fluent-logger-golang v1.10.0
 	github.com/fsnotify/fsnotify v1.9.0 //gomodjail:unconfined
 	github.com/go-viper/mapstructure/v2 v2.2.1
 	github.com/ipfs/go-cid v0.5.0
@@ -75,7 +75,6 @@ require (
 
 require (
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
-	github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 // indirect
 	github.com/cilium/ebpf v0.16.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/go-runc v1.1.0 // indirect
@@ -116,7 +115,7 @@ require (
 	github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626 // indirect
 	github.com/opencontainers/selinux v1.12.0 // indirect
 	github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7 // indirect
-	github.com/philhofer/fwd v1.1.3-0.20240612014219-fbbf4953d986 // indirect
+	github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/sasha-s/go-deadlock v0.3.5 // indirect
 	//gomodjail:unconfined
@@ -126,7 +125,7 @@ require (
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
 	//gomodjail:unconfined
 	github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
-	github.com/tinylib/msgp v1.2.0 // indirect
+	github.com/tinylib/msgp v1.3.0 // indirect
 	github.com/vbatts/tar-split v0.11.6 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
diff --git a/go.sum b/go.sum
index 59b8b8d4686..18d6546c325 100644
--- a/go.sum
+++ b/go.sum
@@ -14,8 +14,6 @@ github.com/Microsoft/hcsshim v0.13.0 h1:/BcXOiS6Qi7N9XqUcv27vkIuVOkBEcWstd2pMlWS
 github.com/Microsoft/hcsshim v0.13.0/go.mod h1:9KWJ/8DgU+QzYGupX4tzMhRQE8h6w90lH6HAaclpEok=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
-github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
-github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cilium/ebpf v0.16.0 h1:+BiEnHL6Z7lXnlGUsXQPPAE7+kenAd4ES8MQ5min0Ok=
 github.com/cilium/ebpf v0.16.0/go.mod h1:L7u2Blt2jMM/vLAVgjxluxtBKlz3/GWjB0dMOEngfwE=
@@ -108,8 +106,8 @@ github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/fluent/fluent-logger-golang v1.9.0 h1:zUdY44CHX2oIUc7VTNZc+4m+ORuO/mldQDA7czhWXEg=
-github.com/fluent/fluent-logger-golang v1.9.0/go.mod h1:2/HCT/jTy78yGyeNGQLGQsjF3zzzAuy6Xlk6FCMV5eU=
+github.com/fluent/fluent-logger-golang v1.10.0 h1:JcLj8u3WclQv2juHGKTSzBRM5vIZjEqbrmvn/n+m1W0=
+github.com/fluent/fluent-logger-golang v1.10.0/go.mod h1:UNyv8FAGmQcYJRtk+yfxhWqWUwsabTipgjXvBDR8kTs=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
@@ -260,8 +258,8 @@ github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7 h1:Dx7Ovyv/SFnMFw3fD4oEoeorXc6saIiQ23LrGLth0Gw=
 github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
-github.com/philhofer/fwd v1.1.3-0.20240612014219-fbbf4953d986 h1:jYi87L8j62qkXzaYHAQAhEapgukhenIMZRBKTNRLHJ4=
-github.com/philhofer/fwd v1.1.3-0.20240612014219-fbbf4953d986/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
+github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c h1:dAMKvw0MlJT1GshSTtih8C2gDs04w8dReiOGXrGLNoY=
+github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -306,8 +304,8 @@ github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOf
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
-github.com/tinylib/msgp v1.2.0 h1:0uKB/662twsVBpYUPbokj4sTSKhWFKB7LopO2kWK8lY=
-github.com/tinylib/msgp v1.2.0/go.mod h1:2vIGs3lcUo8izAATNobrCHevYZC/LMsJtw4JPiYPHro=
+github.com/tinylib/msgp v1.3.0 h1:ULuf7GPooDaIlbyvgAxBV/FI7ynli6LZ1/nVUNu+0ww=
+github.com/tinylib/msgp v1.3.0/go.mod h1:ykjzy2wzgrlvpDCRc4LA8UXy6D8bzMSuAF3WD57Gok0=
 github.com/urfave/cli v1.19.1/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
 github.com/vbatts/tar-split v0.11.6 h1:4SjTW5+PU11n6fZenf2IPoV8/tz3AaYHMWjf23envGs=
 github.com/vbatts/tar-split v0.11.6/go.mod h1:dqKNtesIOr2j2Qv3W/cHjnvk9I8+G7oAkFDFN6TCBEI=

From 166ea55fd842b27355d50e45920623ecab769407 Mon Sep 17 00:00:00 2001
From: ningmingxiao <ning.mingxiao@zte.com.cn>
Date: Tue, 20 May 2025 20:43:41 +0800
Subject: [PATCH 220/225] [feature] enable --security-opt
 writable-cgroups=true|false as an option

Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>
---
 .../container/container_run_cgroup_linux_test.go    |  7 ++++++-
 docs/command-reference.md                           |  1 +
 pkg/cmd/container/run_security_linux.go             | 13 ++++++++++++-
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/cmd/nerdctl/container/container_run_cgroup_linux_test.go b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
index 9f9e9812f13..dd6e8f93fdf 100644
--- a/cmd/nerdctl/container/container_run_cgroup_linux_test.go
+++ b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
@@ -134,7 +134,9 @@ func TestRunCgroupV2(t *testing.T) {
 	base.Cmd("exec", testutil.Identifier(t)+"-testUpdate2",
 		"cat", "cpu.max", "memory.max", "memory.swap.max", "memory.low",
 		"pids.max", "cpu.weight", "cpuset.cpus", "cpuset.mems").AssertOutExactly(expected2)
-
+	base.Cmd("run", "--rm", "--security-opt", "writable-cgroups=true", testutil.AlpineImage, "mkdir", "/sys/fs/cgroup/foo").AssertOK()
+	base.Cmd("run", "--rm", "--security-opt", "writable-cgroups=false", testutil.AlpineImage, "mkdir", "/sys/fs/cgroup/foo").AssertFail()
+	base.Cmd("run", "--rm", testutil.AlpineImage, "mkdir", "/sys/fs/cgroup/foo").AssertFail()
 }
 
 func TestRunCgroupV1(t *testing.T) {
@@ -176,6 +178,9 @@ func TestRunCgroupV1(t *testing.T) {
 	const expected = "42000\n100000\n0\n44040192\n6291456\n104857600\n0\n42\n2000\n0-1\n"
 	base.Cmd("run", "--rm", "--cpus", "0.42", "--cpuset-mems", "0", "--memory", "42m", "--memory-reservation", "6m", "--memory-swap", "100m", "--memory-swappiness", "0", "--pids-limit", "42", "--cpu-shares", "2000", "--cpuset-cpus", "0-1", testutil.AlpineImage, "cat", quota, period, cpusetMems, memoryLimit, memoryReservation, memorySwap, memorySwappiness, pidsLimit, cpuShare, cpusetCpus).AssertOutExactly(expected)
 	base.Cmd("run", "--rm", "--cpu-quota", "42000", "--cpu-period", "100000", "--cpuset-mems", "0", "--memory", "42m", "--memory-reservation", "6m", "--memory-swap", "100m", "--memory-swappiness", "0", "--pids-limit", "42", "--cpu-shares", "2000", "--cpuset-cpus", "0-1", testutil.AlpineImage, "cat", quota, period, cpusetMems, memoryLimit, memoryReservation, memorySwap, memorySwappiness, pidsLimit, cpuShare, cpusetCpus).AssertOutExactly(expected)
+	base.Cmd("run", "--rm", "--security-opt", "writable-cgroups=true", testutil.AlpineImage, "mkdir", "/sys/fs/cgroup/pids/foo").AssertOK()
+	base.Cmd("run", "--rm", "--security-opt", "writable-cgroups=false", testutil.AlpineImage, "mkdir", "/sys/fs/cgroup/pids/foo").AssertFail()
+	base.Cmd("run", "--rm", testutil.AlpineImage, "mkdir", "/sys/fs/cgroup/pids/foo").AssertFail()
 }
 
 // TestIssue3781 tests https://github.com/containerd/nerdctl/issues/3781
diff --git a/docs/command-reference.md b/docs/command-reference.md
index 60db48e2b43..8d61e721c68 100644
--- a/docs/command-reference.md
+++ b/docs/command-reference.md
@@ -244,6 +244,7 @@ Security flags:
 - :whale: `--security-opt apparmor=<PROFILE>`: specify custom AppArmor profile
 - :whale: `--security-opt no-new-privileges`: disallow privilege escalation, e.g., setuid and file capabilities
 - :whale: `--security-opt systempaths=unconfined`: Turn off confinement for system paths (masked paths, read-only paths) for the container
+- :whale: `--security-opt writable-cgroups`: making the cgroups writeable
 - :nerd_face: `--security-opt privileged-without-host-devices`: Don't pass host devices to privileged containers
 - :whale: `--cap-add=<CAP>`: Add Linux capabilities
 - :whale: `--cap-drop=<CAP>`: Drop Linux capabilities
diff --git a/pkg/cmd/container/run_security_linux.go b/pkg/cmd/container/run_security_linux.go
index 510310f265a..dbd76234c1b 100644
--- a/pkg/cmd/container/run_security_linux.go
+++ b/pkg/cmd/container/run_security_linux.go
@@ -18,6 +18,8 @@ package container
 
 import (
 	"errors"
+	"fmt"
+	"strconv"
 	"strings"
 	"sync"
 
@@ -52,7 +54,7 @@ const (
 func generateSecurityOpts(privileged bool, securityOptsMap map[string]string) ([]oci.SpecOpts, error) {
 	for k := range securityOptsMap {
 		switch k {
-		case "seccomp", "apparmor", "no-new-privileges", "systempaths", "privileged-without-host-devices":
+		case "seccomp", "apparmor", "no-new-privileges", "systempaths", "privileged-without-host-devices", "writable-cgroups":
 		default:
 			log.L.Warnf("unknown security-opt: %q", k)
 		}
@@ -118,6 +120,15 @@ func generateSecurityOpts(privileged bool, securityOptsMap map[string]string) ([
 	if privilegedWithoutHostDevices && !privileged {
 		return nil, errors.New("flag `--security-opt privileged-without-host-devices` can't be used without `--privileged` enabled")
 	}
+	if value, ok := securityOptsMap["writable-cgroups"]; ok {
+		writable, err := strconv.ParseBool(value)
+		if err != nil {
+			return nil, fmt.Errorf("invalid \"writable-cgroups\" value: %q", value)
+		}
+		if writable {
+			opts = append(opts, oci.WithWriteableCgroupfs)
+		}
+	}
 
 	if privileged {
 		if privilegedWithoutHostDevices {

From f39631639738402107d05efa2c24fadd1e8b1d70 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 20 May 2025 18:03:56 +0000
Subject: [PATCH 221/225] build(deps): bump github.com/containerd/containerd/v2

Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.1.0 to 2.1.1.
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](https://github.com/containerd/containerd/compare/v2.1.0...v2.1.1)

---
updated-dependencies:
- dependency-name: github.com/containerd/containerd/v2
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 5b09dff9c7f..777eede6974 100644
--- a/go.mod
+++ b/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/containerd/cgroups/v3 v3.0.5 //gomodjail:unconfined
 	github.com/containerd/console v1.0.5 //gomodjail:unconfined
 	github.com/containerd/containerd/api v1.9.0
-	github.com/containerd/containerd/v2 v2.1.0 //gomodjail:unconfined
+	github.com/containerd/containerd/v2 v2.1.1 //gomodjail:unconfined
 	github.com/containerd/continuity v0.4.5 //gomodjail:unconfined
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/fifo v1.1.0 //gomodjail:unconfined
diff --git a/go.sum b/go.sum
index 98ebf01ef92..d9d8f080b4a 100644
--- a/go.sum
+++ b/go.sum
@@ -29,8 +29,8 @@ github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/q
 github.com/containerd/console v1.0.5/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
 github.com/containerd/containerd/api v1.9.0 h1:HZ/licowTRazus+wt9fM6r/9BQO7S0vD5lMcWspGIg0=
 github.com/containerd/containerd/api v1.9.0/go.mod h1:GhghKFmTR3hNtyznBoQ0EMWr9ju5AqHjcZPsSpTKutI=
-github.com/containerd/containerd/v2 v2.1.0 h1:lS6iJ/CwZrxYxKd6zWBz5LR7xOlMVQC78z68YtizUAM=
-github.com/containerd/containerd/v2 v2.1.0/go.mod h1:t2VqM0zSiEdi33qgtsMwUKrYyVg4oq2FPe+cs3LBt7w=
+github.com/containerd/containerd/v2 v2.1.1 h1:znnkm7Ajz8lg8BcIPMhc/9yjBRN3B+OkNKqKisKfwwM=
+github.com/containerd/containerd/v2 v2.1.1/go.mod h1:zIfkQj4RIodclYQkX7GSSswSwgP8d/XxDOtOAoSDIGU=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=

From 4d68bfc5fe895aab32de1517aa278a35efc69b6a Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Wed, 21 May 2025 03:11:29 +0900
Subject: [PATCH 222/225] update containerd (2.1.1)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 .github/workflows/workflow-test.yml | 4 ++--
 Dockerfile                          | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/workflow-test.yml b/.github/workflows/workflow-test.yml
index ef6748b3649..526d19cabf7 100644
--- a/.github/workflows/workflow-test.yml
+++ b/.github/workflows/workflow-test.yml
@@ -141,9 +141,9 @@ jobs:
       go-version: 1.24
       windows-cni-version: v0.3.1
       docker-version: 5:28.0.4-1~ubuntu.24.04~noble
-      containerd-version: 2.1.0
+      containerd-version: 2.1.1
       # Note: these as for amd64
-      containerd-sha: 0e5359e957b66b679be807563a543c7416e305e3aafcf56bad90ef87a917014d
+      containerd-sha: 918e88fd393c28c89424e6535df0546ca36c1dfa7d8a5d685dee70b449380a9b
       containerd-service-sha: 1941362cbaa89dd591b99c32b050d82c583d3cd2e5fa63085d7017457ec5fca8
       linux-cni-version: v1.7.1
       linux-cni-sha: 1a28a0506bfe5bcdc981caf1a49eeab7e72da8321f1119b7be85f22621013098
diff --git a/Dockerfile b/Dockerfile
index e66d165188d..59c6e0501c7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,7 +17,7 @@
 
 # Basic deps
 # @BINARY: the binary checksums are verified via Dockerfile.d/SHA256SUMS.d/<COMPONENT>-<VERSION>
-ARG CONTAINERD_VERSION=v2.1.0@061792f0ecf3684fb30a3a0eb006799b8c6638a7
+ARG CONTAINERD_VERSION=v2.1.1@cb1076646aa3740577fafbf3d914198b7fe8e3f7
 ARG RUNC_VERSION=v1.3.0@4ca628d1d4c974f92d24daccb901aa078aad748e
 ARG CNI_PLUGINS_VERSION=v1.7.1@BINARY
 

From 24eaa88bef9e1b5ebab97af2b8c41cfda32e0d2b Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Wed, 21 May 2025 03:12:14 +0900
Subject: [PATCH 223/225] update containerd-fuse-overlayfs (2.1.6)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 Dockerfile                                                 | 2 +-
 Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.5 | 6 ------
 Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.6 | 6 ++++++
 3 files changed, 7 insertions(+), 7 deletions(-)
 delete mode 100644 Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.5
 create mode 100644 Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.6

diff --git a/Dockerfile b/Dockerfile
index 59c6e0501c7..1553541603b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -34,7 +34,7 @@ ARG SLIRP4NETNS_VERSION=v1.3.2@BINARY
 ARG BYPASS4NETNS_VERSION=v0.4.2@aa04bd3dcc48c6dae6d7327ba219bda8fe2a4634
 # Extra deps: FUSE-OverlayFS
 ARG FUSE_OVERLAYFS_VERSION=v1.15@BINARY
-ARG CONTAINERD_FUSE_OVERLAYFS_VERSION=v2.1.5@BINARY
+ARG CONTAINERD_FUSE_OVERLAYFS_VERSION=v2.1.6@BINARY
 # Extra deps: Init
 ARG TINI_VERSION=v0.19.0@BINARY
 # Extra deps: Debug
diff --git a/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.5 b/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.5
deleted file mode 100644
index faf34421cfb..00000000000
--- a/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.5
+++ /dev/null
@@ -1,6 +0,0 @@
-acc149d60e2fad0cff480852c82f39bdaae2eb6faa265b2028c944ec572014f9  containerd-fuse-overlayfs-2.1.5-linux-amd64.tar.gz
-2c1c12a99ac16e6ad137c474517d04cc7864d26d9045f50f99a6d6e887b9c425  containerd-fuse-overlayfs-2.1.5-linux-arm-v7.tar.gz
-17759de9588cda1499877cc9587189eb24731ae41edda201087fd74658ddc127  containerd-fuse-overlayfs-2.1.5-linux-arm64.tar.gz
-ce0310573fd667a2fa348588b12f1867a1bad5befc79d7d39e6419a7d4687ea8  containerd-fuse-overlayfs-2.1.5-linux-ppc64le.tar.gz
-e9bbb9835346d8007a6429151eb7c7b23fa1f20b85aa6d20dd3702cb5a4c038a  containerd-fuse-overlayfs-2.1.5-linux-riscv64.tar.gz
-c088a7eee9b75f0a759e52d1ae2c8d69d21265594070f41021a94523d1c7bab1  containerd-fuse-overlayfs-2.1.5-linux-s390x.tar.gz
diff --git a/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.6 b/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.6
new file mode 100644
index 00000000000..b76b93d4d62
--- /dev/null
+++ b/Dockerfile.d/SHA256SUMS.d/containerd-fuse-overlayfs-v2.1.6
@@ -0,0 +1,6 @@
+8a768e4c953251d32b5e5d748d17593f7150834caaba403b483cf83f5856fea3  containerd-fuse-overlayfs-2.1.6-linux-amd64.tar.gz
+a3af866a12e913cd1d4dda8e41c08345eca928a15ac1d466fdb2b00b013e14ee  containerd-fuse-overlayfs-2.1.6-linux-arm-v7.tar.gz
+417ca0c838e43e446f498b384d73f7caaeb00dc4c1c0fe4b0ecfdd36fd355daa  containerd-fuse-overlayfs-2.1.6-linux-arm64.tar.gz
+5fdebd9fb7b50473318f0410bc3ab46f3388ac8aa586b45c91a314af9ce6569c  containerd-fuse-overlayfs-2.1.6-linux-ppc64le.tar.gz
+7e1a9d2ba68ff31a8dfb53bf6e71b2879063b13c759922c8cff3013893829bca  containerd-fuse-overlayfs-2.1.6-linux-riscv64.tar.gz
+3c022651cdaff666e88996d5d9c7e776bf59419a03d7d718a28aa708036419f9  containerd-fuse-overlayfs-2.1.6-linux-s390x.tar.gz

From 15cd2e0b97dac811f769afe010ed1cf221160776 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Wed, 21 May 2025 03:17:04 +0900
Subject: [PATCH 224/225] update buildg (0.5.3)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 Dockerfile                              | 2 +-
 Dockerfile.d/SHA256SUMS.d/buildg-v0.5.2 | 2 --
 Dockerfile.d/SHA256SUMS.d/buildg-v0.5.3 | 4 ++++
 3 files changed, 5 insertions(+), 3 deletions(-)
 delete mode 100644 Dockerfile.d/SHA256SUMS.d/buildg-v0.5.2
 create mode 100644 Dockerfile.d/SHA256SUMS.d/buildg-v0.5.3

diff --git a/Dockerfile b/Dockerfile
index 1553541603b..ef3b8d55282 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -38,7 +38,7 @@ ARG CONTAINERD_FUSE_OVERLAYFS_VERSION=v2.1.6@BINARY
 # Extra deps: Init
 ARG TINI_VERSION=v0.19.0@BINARY
 # Extra deps: Debug
-ARG BUILDG_VERSION=v0.5.2@BINARY
+ARG BUILDG_VERSION=v0.5.3@BINARY
 # Extra deps: gomodjail
 ARG GOMODJAIL_VERSION=v0.1.2@0a86b34442a491fa8f5e4565e9c846fce310239c
 
diff --git a/Dockerfile.d/SHA256SUMS.d/buildg-v0.5.2 b/Dockerfile.d/SHA256SUMS.d/buildg-v0.5.2
deleted file mode 100644
index bff0ce012f6..00000000000
--- a/Dockerfile.d/SHA256SUMS.d/buildg-v0.5.2
+++ /dev/null
@@ -1,2 +0,0 @@
-70371949ac56d118e55306091640e63537069a538a97c151eb7475c07cb5a8a4  buildg-v0.5.2-linux-amd64.tar.gz
-9c44a5f8ecc3035998a07e1c564338205700cf5287c723e8ccba1da2815168cc  buildg-v0.5.2-linux-arm64.tar.gz
\ No newline at end of file
diff --git a/Dockerfile.d/SHA256SUMS.d/buildg-v0.5.3 b/Dockerfile.d/SHA256SUMS.d/buildg-v0.5.3
new file mode 100644
index 00000000000..0e0aa45cbf4
--- /dev/null
+++ b/Dockerfile.d/SHA256SUMS.d/buildg-v0.5.3
@@ -0,0 +1,4 @@
+cf4c40c58ca795eeb6e75e2c6a0e5bb3a6a9c0623d51bc3b85163e5d483eeade  buildg-full-v0.5.3-linux-amd64.tar.gz
+47c479f2e5150c9c76294fa93a03ad20e5928f4315bf52ca8432bfb6707d4276  buildg-full-v0.5.3-linux-arm64.tar.gz
+c289a454ae8673ff99acf56dec9ba97274c20d2015e80f7ac3b8eb8e4f77888f  buildg-v0.5.3-linux-amd64.tar.gz
+b2e244250ce7ea5c090388f2025a9c546557861d25bba7b0666aa512f01fa6cd  buildg-v0.5.3-linux-arm64.tar.gz

From 4e09f46b138e11dd38fa75d475ab764d451bde78 Mon Sep 17 00:00:00 2001
From: Arjun Raja Yogidas <arjunry@amazon.com>
Date: Fri, 23 May 2025 05:11:51 +0000
Subject: [PATCH 225/225] add soci convert feature

Signed-off-by: Arjun Raja Yogidas <arjunry@amazon.com>
---
 cmd/nerdctl/image/image_convert.go |  28 ++++++
 pkg/api/types/image_types.go       |   8 +-
 pkg/cmd/image/convert.go           |  19 +++-
 pkg/snapshotterutil/sociutil.go    | 150 +++++++++++++++++++++++++----
 4 files changed, 181 insertions(+), 24 deletions(-)

diff --git a/cmd/nerdctl/image/image_convert.go b/cmd/nerdctl/image/image_convert.go
index 871d9c97d81..2a051e9e468 100644
--- a/cmd/nerdctl/image/image_convert.go
+++ b/cmd/nerdctl/image/image_convert.go
@@ -89,6 +89,12 @@ func convertCommand() *cobra.Command {
 	cmd.Flags().String("overlaybd-dbstr", "", "Database config string for overlaybd")
 	// #endregion
 
+	// #region soci flags
+	cmd.Flags().Bool("soci", false, "Convert image to SOCI format. Should be used in conjunction with '--oci'")
+	cmd.Flags().Int64("soci-min-layer-size", -1, "The minimum size of layers that will be converted to SOCI format")
+	cmd.Flags().Int64("soci-span-size", -1, "The size of SOCI spans")
+	// #endregion
+
 	// #region generic flags
 	cmd.Flags().Bool("uncompress", false, "Convert tar.gz layers to uncompressed tar layers")
 	cmd.Flags().Bool("oci", false, "Convert Docker media types to OCI media types")
@@ -213,6 +219,21 @@ func convertOptions(cmd *cobra.Command) (types.ImageConvertOptions, error) {
 	}
 	// #endregion
 
+	// #region soci flags
+	soci, err := cmd.Flags().GetBool("soci")
+	if err != nil {
+		return types.ImageConvertOptions{}, err
+	}
+	sociMinLayerSize, err := cmd.Flags().GetInt64("soci-min-layer-size")
+	if err != nil {
+		return types.ImageConvertOptions{}, err
+	}
+	sociSpanSize, err := cmd.Flags().GetInt64("soci-span-size")
+	if err != nil {
+		return types.ImageConvertOptions{}, err
+	}
+	// #endregion
+
 	// #region generic flags
 	uncompress, err := cmd.Flags().GetBool("uncompress")
 	if err != nil {
@@ -268,6 +289,13 @@ func convertOptions(cmd *cobra.Command) (types.ImageConvertOptions, error) {
 		OverlayFsType:  overlaybdFsType,
 		OverlaydbDBStr: overlaybdDbstr,
 		// #endregion
+		// #region soci flags
+		Soci: soci,
+		SociOptions: types.SociOptions{
+			SpanSize:     sociSpanSize,
+			MinLayerSize: sociMinLayerSize,
+		},
+		// #endregion
 		// #region generic flags
 		Uncompress: uncompress,
 		Oci:        oci,
diff --git a/pkg/api/types/image_types.go b/pkg/api/types/image_types.go
index d48e6318026..0578a9c2a8e 100644
--- a/pkg/api/types/image_types.go
+++ b/pkg/api/types/image_types.go
@@ -19,7 +19,7 @@ package types
 import (
 	"io"
 
-	"github.com/opencontainers/image-spec/specs-go/v1"
+	v1 "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 // ImageListOptions specifies options for `nerdctl image list`.
@@ -124,6 +124,12 @@ type ImageConvertOptions struct {
 	OverlaydbDBStr string
 	// #endregion
 
+	// #region soci flags
+	// Soci convert image to SOCI format. Should be used in conjunction with '--oci'
+	Soci bool
+	// SociOptions contains SOCI-specific options
+	SociOptions SociOptions
+	// #endregion
 }
 
 // ImageCryptOptions specifies options for `nerdctl image encrypt` and `nerdctl image decrypt`.
diff --git a/pkg/cmd/image/convert.go b/pkg/cmd/image/convert.go
index b7963ea2702..31cdc00ac52 100644
--- a/pkg/cmd/image/convert.go
+++ b/pkg/cmd/image/convert.go
@@ -47,6 +47,7 @@ import (
 	converterutil "github.com/containerd/nerdctl/v2/pkg/imgutil/converter"
 	"github.com/containerd/nerdctl/v2/pkg/platformutil"
 	"github.com/containerd/nerdctl/v2/pkg/referenceutil"
+	"github.com/containerd/nerdctl/v2/pkg/snapshotterutil"
 )
 
 func Convert(ctx context.Context, client *containerd.Client, srcRawRef, targetRawRef string, options types.ImageConvertOptions) error {
@@ -86,8 +87,9 @@ func Convert(ctx context.Context, client *containerd.Client, srcRawRef, targetRa
 	zstdchunked := options.ZstdChunked
 	overlaybd := options.Overlaybd
 	nydus := options.Nydus
+	soci := options.Soci
 	var finalize func(ctx context.Context, cs content.Store, ref string, desc *ocispec.Descriptor) (*images.Image, error)
-	if estargz || zstd || zstdchunked || overlaybd || nydus {
+	if estargz || zstd || zstdchunked || overlaybd || nydus || soci {
 		convertCount := 0
 		if estargz {
 			convertCount++
@@ -104,9 +106,12 @@ func Convert(ctx context.Context, client *containerd.Client, srcRawRef, targetRa
 		if nydus {
 			convertCount++
 		}
+		if soci {
+			convertCount++
+		}
 
 		if convertCount > 1 {
-			return errors.New("options --estargz, --zstdchunked, --overlaybd and --nydus lead to conflict, only one of them can be used")
+			return errors.New("options --estargz, --zstdchunked, --overlaybd, --nydus and --soci lead to conflict, only one of them can be used")
 		}
 
 		var convertFunc converter.ConvertFunc
@@ -164,6 +169,16 @@ func Convert(ctx context.Context, client *containerd.Client, srcRawRef, targetRa
 				)),
 			)
 			convertType = "nydus"
+		case soci:
+			// Convert image to SOCI format
+			convertedRef, err := snapshotterutil.ConvertSoci(ctx, client, srcRef, targetRef, options.GOptions, options.Platforms, options.SociOptions)
+			if err != nil {
+				return fmt.Errorf("failed to convert image to SOCI format: %w", err)
+			}
+			res := converterutil.ConvertedImageInfo{
+				Image: convertedRef,
+			}
+			return printConvertedImage(options.Stdout, options, res)
 		}
 
 		if convertType != "overlaybd" {
diff --git a/pkg/snapshotterutil/sociutil.go b/pkg/snapshotterutil/sociutil.go
index a2148de027c..31728e9eb07 100644
--- a/pkg/snapshotterutil/sociutil.go
+++ b/pkg/snapshotterutil/sociutil.go
@@ -18,23 +18,26 @@ package snapshotterutil
 
 import (
 	"bufio"
+	"context"
+	"fmt"
 	"os"
 	"os/exec"
 	"strconv"
 	"strings"
 
+	"github.com/containerd/containerd/v2/client"
 	"github.com/containerd/log"
 
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
 )
 
-// CreateSoci creates a SOCI index(`rawRef`)
-func CreateSoci(rawRef string, gOpts types.GlobalCommandOptions, allPlatform bool, platforms []string, sOpts types.SociOptions) error {
+// setupSociCommand creates and sets up a SOCI command with common configuration
+func setupSociCommand(gOpts types.GlobalCommandOptions) (*exec.Cmd, error) {
 	sociExecutable, err := exec.LookPath("soci")
 	if err != nil {
 		log.L.WithError(err).Error("soci executable not found in path $PATH")
 		log.L.Info("you might consider installing soci from: https://github.com/awslabs/soci-snapshotter/blob/main/docs/install.md")
-		return err
+		return nil, err
 	}
 
 	sociCmd := exec.Command(sociExecutable)
@@ -47,7 +50,77 @@ func CreateSoci(rawRef string, gOpts types.GlobalCommandOptions, allPlatform boo
 	if gOpts.Namespace != "" {
 		sociCmd.Args = append(sociCmd.Args, "--namespace", gOpts.Namespace)
 	}
-	// #endregion
+
+	return sociCmd, nil
+}
+
+// ConvertSoci converts an image to SOCI format and returns the converted image reference with digest
+func ConvertSoci(ctx context.Context, client *client.Client, srcRef string, destRef string, gOpts types.GlobalCommandOptions, platforms []string, sOpts types.SociOptions) (string, error) {
+	// Check minimum required version
+	// const minRequiredVersion = "0.9.0"
+	// if err := checkSociVersion(minRequiredVersion); err != nil {
+	// 	return err
+	// }
+
+	sociCmd, err := setupSociCommand(gOpts)
+	if err != nil {
+		return "", err
+	}
+
+	// TODO: Implement conversion logic
+	sociCmd.Args = append(sociCmd.Args, "convert")
+
+	if len(platforms) > 0 {
+		// multiple values need to be passed as separate, repeating flags in soci as it uses urfave
+		// https://github.com/urfave/cli/blob/main/docs/v2/examples/flags.md#multiple-values-per-single-flag
+		for _, p := range platforms {
+			sociCmd.Args = append(sociCmd.Args, "--platform", p)
+		}
+	}
+
+	if sOpts.SpanSize != -1 {
+		sociCmd.Args = append(sociCmd.Args, "--span-size", strconv.FormatInt(sOpts.SpanSize, 10))
+	}
+
+	if sOpts.MinLayerSize != -1 {
+		sociCmd.Args = append(sociCmd.Args, "--min-layer-size", strconv.FormatInt(sOpts.MinLayerSize, 10))
+	}
+
+	sociCmd.Args = append(sociCmd.Args, srcRef, destRef)
+
+	log.L.Infof("Converting image from %s to %s using SOCI format", srcRef, destRef)
+
+	err = processSociIO(sociCmd)
+	if err != nil {
+		return "", err
+	}
+	err = sociCmd.Wait()
+	if err != nil {
+		return "", err
+	}
+
+	// Get the converted image's digest
+	img, err := client.GetImage(ctx, destRef)
+	if err != nil {
+		return "", fmt.Errorf("failed to get converted image: %w", err)
+	}
+
+	// Return the full reference with digest
+	return fmt.Sprintf("%s@%s", destRef, img.Target().Digest), nil
+}
+
+// CreateSoci creates a SOCI index(`rawRef`)
+func CreateSoci(rawRef string, gOpts types.GlobalCommandOptions, allPlatform bool, platforms []string, sOpts types.SociOptions) error {
+	// Check minimum required version
+	// const minRequiredVersion = "0.9.0"
+	// if err := checkSociVersion(minRequiredVersion); err != nil {
+	// 	return err
+	// }
+
+	sociCmd, err := setupSociCommand(gOpts)
+	if err != nil {
+		return err
+	}
 
 	// Global flags have to be put before subcommand before soci upgrades to urfave v3.
 	// https://github.com/urfave/cli/issues/1113
@@ -73,7 +146,7 @@ func CreateSoci(rawRef string, gOpts types.GlobalCommandOptions, allPlatform boo
 	// --timeout, --debug, --content-store
 	sociCmd.Args = append(sociCmd.Args, rawRef)
 
-	log.L.Debugf("running %s %v", sociExecutable, sociCmd.Args)
+	log.L.Debugf("running soci %v", sociCmd.Args)
 
 	err = processSociIO(sociCmd)
 	if err != nil {
@@ -88,25 +161,11 @@ func CreateSoci(rawRef string, gOpts types.GlobalCommandOptions, allPlatform boo
 func PushSoci(rawRef string, gOpts types.GlobalCommandOptions, allPlatform bool, platforms []string) error {
 	log.L.Debugf("pushing SOCI index: %s", rawRef)
 
-	sociExecutable, err := exec.LookPath("soci")
+	sociCmd, err := setupSociCommand(gOpts)
 	if err != nil {
-		log.L.WithError(err).Error("soci executable not found in path $PATH")
-		log.L.Info("you might consider installing soci from: https://github.com/awslabs/soci-snapshotter/blob/main/docs/install.md")
 		return err
 	}
 
-	sociCmd := exec.Command(sociExecutable)
-	sociCmd.Env = os.Environ()
-
-	// #region for global flags.
-	if gOpts.Address != "" {
-		sociCmd.Args = append(sociCmd.Args, "--address", gOpts.Address)
-	}
-	if gOpts.Namespace != "" {
-		sociCmd.Args = append(sociCmd.Args, "--namespace", gOpts.Namespace)
-	}
-	// #endregion
-
 	// Global flags have to be put before subcommand before soci upgrades to urfave v3.
 	// https://github.com/urfave/cli/issues/1113
 	sociCmd.Args = append(sociCmd.Args, "push")
@@ -131,7 +190,7 @@ func PushSoci(rawRef string, gOpts types.GlobalCommandOptions, allPlatform bool,
 	}
 	sociCmd.Args = append(sociCmd.Args, rawRef)
 
-	log.L.Debugf("running %s %v", sociExecutable, sociCmd.Args)
+	log.L.Debugf("running soci %v", sociCmd.Args)
 
 	err = processSociIO(sociCmd)
 	if err != nil {
@@ -140,6 +199,55 @@ func PushSoci(rawRef string, gOpts types.GlobalCommandOptions, allPlatform bool,
 	return sociCmd.Wait()
 }
 
+// checkSociVersion checks if the installed SOCI version meets the minimum required version
+// func checkSociVersion(minVersion string) error {
+// 	sociExecutable, err := exec.LookPath("soci")
+// 	if err != nil {
+// 		log.L.WithError(err).Error("soci executable not found in path $PATH")
+// 		log.L.Info("you might consider installing soci from: https://github.com/awslabs/soci-snapshotter/blob/main/docs/install.md")
+// 		return err
+// 	}
+
+// 	cmd := exec.Command(sociExecutable, "--version")
+// 	output, err := cmd.Output()
+// 	if err != nil {
+// 		return fmt.Errorf("failed to get soci version: %w", err)
+// 	}
+
+// 	// Parse version from output
+// 	// Example output format: "soci version v0.9.0 737f61a3db40c386f997c1f126344158aa3ad43c"
+// 	versionStr := strings.TrimSpace(string(output))
+// 	parts := strings.Fields(versionStr)
+// 	if len(parts) < 3 {
+// 		return fmt.Errorf("unexpected soci version output format: %s", versionStr)
+// 	}
+
+// 	// Extract version number without 'v' prefix
+// 	installedVersion := strings.TrimPrefix(parts[2], "v")
+
+// 	// Compare versions
+// 	v1, err := semver.NewVersion(installedVersion)
+// 	if err != nil {
+// 		return fmt.Errorf("failed to parse installed version %s: %w", installedVersion, err)
+// 	}
+
+// 	v2, err := semver.NewVersion(minVersion)
+// 	if err != nil {
+// 		return fmt.Errorf("failed to parse minimum required version %s: %w", minVersion, err)
+// 	}
+
+// 	if v1.LessThan(v2) {
+// 		return fmt.Errorf("installed soci version %s is older than required version %s", installedVersion, minVersion)
+// 	}
+
+// 	// Log the full version info including commit hash for debugging purposes
+// 	if len(parts) > 3 {
+// 		log.L.Debugf("soci version: %s (commit: %s)", installedVersion, parts[3])
+// 	}
+
+// 	return nil
+// }
+
 func processSociIO(sociCmd *exec.Cmd) error {
 	stdout, err := sociCmd.StdoutPipe()
 	if err != nil {