Repository: containerd/nerdctl

Issue:
nerdctl network inspect does not list containers using the network
### Description

Title says all.

### Steps to reproduce the issue

```
docker network inspect bridge
nerdctl network inspect bridge
```

### Describe the results you received and expected

Docker list the containers that are attached to the network.

Nerdctl does not.

### What version of nerdctl are you using?

1.7.6

### Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

### Host information

_No response_

Discussion:
@tushar5526: Hey! Can I take this one? Looks like a good first issue. @apostasie: > Hey! Can I take this one? Looks like a good first issue.

Sure, go for it!@tushar5526: Thanks, I have a few doubts. 

In `docker`, `Containers` key is set to a JSON object as follows:

```json
        "Containers": {
            "9e08488505d6a20f0075da060b7ca81bfd12cf3475530b1696678313c155953b": {
                "Name": "hardcore_morse",
                "EndpointID": "742d754f3271d9f561e2067a5f9eb2d93713ea55c6c69b015299ec42db361fb1",
                "MacAddress": "42:05:47:7b:b2:e5",
                "IPv4Address": "172.17.0.2/16",
                "IPv6Address": ""
            }
        }
```
 
What should be the output in case of `--mode native`? 

In terms of implementation, it seems I can export the existing `filterContainers` function and use it the `--network filter` to figure out the appropriate containers for the network.  @apostasie: Thanks @tushar5526 
Let's move discussion in your PR.

Solution patch:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5fc6502c..3477b6fd 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -29,10 +29,10 @@ jobs:
             containerd: v1.6.38
             arch: amd64
           - runner: ubuntu-24.04
-            containerd: v2.0.4
+            containerd: v2.0.5
             arch: amd64
           - runner: ubuntu-24.04-arm
-            containerd: v2.0.4
+            containerd: v2.0.5
             arch: arm64
     env:
       CONTAINERD_VERSION: "${{ matrix.containerd }}"
@@ -42,7 +42,7 @@ jobs:
         with:
           fetch-depth: 1
       - name: "Expose GitHub Runtime variables for gha"
-        uses: crazy-max/ghaction-github-runtime@b3a9207c0e1ef41f4cf215303c976869d0c2c1c4  # v3.0.0
+        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
       - name: "Build dependencies for the integration test environment image"
         run: |
           docker buildx create --name with-gha --use
@@ -98,11 +98,11 @@ jobs:
             runner: "ubuntu-22.04"
             arch: amd64
           - ubuntu: 24.04
-            containerd: v2.0.4
+            containerd: v2.0.5
             runner: "ubuntu-24.04"
             arch: amd64
           - ubuntu: 24.04
-            containerd: v2.0.4
+            containerd: v2.0.5
             runner: "ubuntu-24.04-arm"
             arch: arm64
     env:
@@ -114,7 +114,7 @@ jobs:
         with:
           fetch-depth: 1
       - name: "Expose GitHub Runtime variables for gha"
-        uses: crazy-max/ghaction-github-runtime@b3a9207c0e1ef41f4cf215303c976869d0c2c1c4  # v3.0.0
+        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
       - name: "Prepare integration test environment"
         run: |
           docker buildx create --name with-gha --use
@@ -152,7 +152,7 @@ jobs:
       matrix:
         include:
           - ubuntu: 24.04
-            containerd: v2.0.4
+            containerd: v2.0.5
             arch: amd64
     env:
       CONTAINERD_VERSION: "${{ matrix.containerd }}"
@@ -167,7 +167,7 @@ jobs:
           sudo sysctl -w net.ipv6.conf.all.forwarding=1
           sudo sysctl -w net.ipv4.ip_forward=1
       - name: "Expose GitHub Runtime variables for gha"
-        uses: crazy-max/ghaction-github-runtime@b3a9207c0e1ef41f4cf215303c976869d0c2c1c4  # v3.0.0
+        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
       - name: Enable IPv6 for Docker, and configure docker to use containerd for gha
         run: |
           sudo mkdir -p /etc/docker
@@ -219,19 +219,19 @@ jobs:
             runner: "ubuntu-22.04"
             arch: amd64
           - ubuntu: 24.04
-            containerd: v2.0.4
+            containerd: v2.0.5
             rootlesskit: v2.3.4
             target: rootless
             arch: amd64
             runner: "ubuntu-24.04"
           - ubuntu: 24.04
-            containerd: v2.0.4
+            containerd: v2.0.5
             rootlesskit: v2.3.4
             target: rootless
             arch: arm64
             runner: "ubuntu-24.04-arm"
           - ubuntu: 24.04
-            containerd: v2.0.4
+            containerd: v2.0.5
             rootlesskit: v2.3.4
             target: rootless-port-slirp4netns
             arch: amd64
@@ -271,7 +271,7 @@ jobs:
           docker run --privileged --rm tonistiigi/binfmt --install linux/arm64
           docker run --privileged --rm tonistiigi/binfmt --install linux/arm/v7
       - name: "Expose GitHub Runtime variables for gha"
-        uses: crazy-max/ghaction-github-runtime@b3a9207c0e1ef41f4cf215303c976869d0c2c1c4  # v3.0.0
+        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
       - name: "Prepare (network driver=slirp4netns, port driver=builtin)"
         run: |
           docker buildx create --name with-gha --use
@@ -422,7 +422,7 @@ jobs:
     env:
       MODE: ${{ matrix.mode }}
       # FIXME: this is only necessary to access the build cache. To remove with build cleanup.
-      CONTAINERD_VERSION: v2.0.4
+      CONTAINERD_VERSION: v2.0.5
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
@@ -466,7 +466,7 @@ jobs:
           docker info
           docker version
       - name: "Expose GitHub Runtime variables for gha"
-        uses: crazy-max/ghaction-github-runtime@b3a9207c0e1ef41f4cf215303c976869d0c2c1c4  # v3.0.0
+        uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124  # v3.1.0
       - name: "Prepare integration tests"
         run: |
           set -eux
@@ -489,20 +489,20 @@ jobs:
         # This might be due to the old kernel shipped with Alma (4.18), or something else between centos/docker.
         run: |
           set -eux
-          [ "$MODE" = "rootless" ] && {
+          if [ "$MODE" = "rootless" ]; then
             echo "rootless"
             docker run -t -v /dev:/dev --rm --privileged test-integration /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=false
-          } || {
+          else
             echo "rootful"
             docker run -t -v /dev:/dev --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=false
-          }
+          fi
       - name: "Run integration tests (flaky)"
         run: |
           set -eux
-          [ "$MODE" = "rootless" ] && {
+          if [ "$MODE" = "rootless" ]; then
             echo "rootless"
             docker run -t -v /dev:/dev --rm --privileged test-integration /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=true
-          } || {
+          else
             echo "rootful"
             docker run -t -v /dev:/dev --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=true
-          }
+          fi
diff --git a/Dockerfile b/Dockerfile
index 4a31d8ee..4512babc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,7 +17,7 @@
 
 # Basic deps
 # @BINARY: the binary checksums are verified via Dockerfile.d/SHA256SUMS.d/<COMPONENT>-<VERSION>
-ARG CONTAINERD_VERSION=v2.0.4@1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20
+ARG CONTAINERD_VERSION=v2.0.5@fb4c30d4ede3531652d86197bf3fc9515e5276d9
 ARG RUNC_VERSION=v1.2.6@e89a29929c775025419ab0d218a43588b4c12b9a
 ARG CNI_PLUGINS_VERSION=v1.6.2@BINARY
 
diff --git a/cmd/nerdctl/container/container_create.go b/cmd/nerdctl/container/container_create.go
index 934551aa..67db1a4f 100644
--- a/cmd/nerdctl/container/container_create.go
+++ b/cmd/nerdctl/container/container_create.go
@@ -159,6 +159,14 @@ func createOptions(cmd *cobra.Command) (types.ContainerCreateOptions, error) {
 	if err != nil {
 		return opt, err
 	}
+	opt.CPURealtimePeriod, err = cmd.Flags().GetUint64("cpu-rt-period")
+	if err != nil {
+		return opt, err
+	}
+	opt.CPURealtimeRuntime, err = cmd.Flags().GetUint64("cpu-rt-runtime")
+	if err != nil {
+		return opt, err
+	}
 	opt.Memory, err = cmd.Flags().GetString("memory")
 	if err != nil {
 		return opt, err
diff --git a/cmd/nerdctl/container/container_run.go b/cmd/nerdctl/container/container_run.go
index 12b2ac9a..84bc42f0 100644
--- a/cmd/nerdctl/container/container_run.go
+++ b/cmd/nerdctl/container/container_run.go
@@ -166,6 +166,8 @@ func setCreateFlags(cmd *cobra.Command) {
 	cmd.Flags().Uint64("cpu-shares", 0, "CPU shares (relative weight)")
 	cmd.Flags().Int64("cpu-quota", -1, "Limit CPU CFS (Completely Fair Scheduler) quota")
 	cmd.Flags().Uint64("cpu-period", 0, "Limit CPU CFS (Completely Fair Scheduler) period")
+	cmd.Flags().Uint64("cpu-rt-period", 0, "Limit CPU real-time period in microseconds")
+	cmd.Flags().Uint64("cpu-rt-runtime", 0, "Limit CPU real-time runtime in microseconds")
 	// device is defined as StringSlice, not StringArray, to allow specifying "--device=DEV1,DEV2" (compatible with Podman)
 	cmd.Flags().StringSlice("device", nil, "Add a host device to the container")
 	// ulimit is defined as StringSlice, not StringArray, to allow specifying "--ulimit=ULIMIT1,ULIMIT2" (compatible with Podman)
diff --git a/cmd/nerdctl/network/network_inspect.go b/cmd/nerdctl/network/network_inspect.go
index adc1a965..c61fe893 100644
--- a/cmd/nerdctl/network/network_inspect.go
+++ b/cmd/nerdctl/network/network_inspect.go
@@ -22,6 +22,7 @@ import (
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/completion"
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
+	"github.com/containerd/nerdctl/v2/pkg/clientutil"
 	"github.com/containerd/nerdctl/v2/pkg/cmd/network"
 )
 
@@ -59,13 +60,22 @@ func inspectAction(cmd *cobra.Command, args []string) error {
 	if err != nil {
 		return err
 	}
-	return network.Inspect(cmd.Context(), types.NetworkInspectOptions{
+
+	options := types.NetworkInspectOptions{
 		GOptions: globalOptions,
 		Mode:     mode,
 		Format:   format,
 		Networks: args,
 		Stdout:   cmd.OutOrStdout(),
-	})
+	}
+
+	client, ctx, cancel, err := clientutil.NewClient(cmd.Context(), options.GOptions.Namespace, options.GOptions.Address)
+	if err != nil {
+		return err
+	}
+	defer cancel()
+
+	return network.Inspect(ctx, client, options)
 }
 
 func networkInspectShellComplete(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
diff --git a/docs/command-reference.md b/docs/command-reference.md
index a4d2f7af..dc9cdc78 100644
--- a/docs/command-reference.md
+++ b/docs/command-reference.md
@@ -203,6 +203,8 @@ Resource flags:
 - :whale: `--cpu-shares`: CPU shares (relative weight)
 - :whale: `--cpuset-cpus`: CPUs in which to allow execution (0-3, 0,1)
 - :whale: `--cpuset-mems`: Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on NUMA systems
+- :whale: `--cpu-rt-period`: Limit CPU real-time period in microseconds. Only supported with cgroup v1.
+- :whale: `--cpu-rt-runtime`: Limit CPU real-time runtime in microseconds. Only supported with cgroup v1.
 - :whale: `--memory`: Memory limit
 - :whale: `--memory-reservation`: Memory soft limit
 - :whale: `--memory-swap`: Swap limit equal to memory plus swap: '-1' to enable unlimited swap
@@ -419,10 +421,8 @@ IPFS flags:
 - :nerd_face: `--ipfs-address`: Multiaddr of IPFS API (default uses `$IPFS_PATH` env variable if defined or local directory `~/.ipfs`)
 
 Unimplemented `docker run` flags:
-    `--cpu-rt-*`, `--device-cgroup-rule`,
-    `--disable-content-trust`, `--expose`, `--health-*`, `--isolation`, `--no-healthcheck`,
-    `--link*`, `--publish-all`, `--storage-opt`,
-    `--userns`, `--volume-driver`
+    `--device-cgroup-rule`, `--disable-content-trust`, `--expose`, `--health-*`, `--isolation`, `--no-healthcheck`,
+    `--link*`, `--publish-all`, `--storage-opt`, `--userns`, `--volume-driver`
 
 ### :whale: :blue_square: nerdctl exec
 
diff --git a/docs/testing/tools.md b/docs/testing/tools.md
index 70230ae6..9b4f0d9d 100644
--- a/docs/testing/tools.md
+++ b/docs/testing/tools.md
@@ -109,7 +109,7 @@ that this name is then visible in the list of containers.
 
 To achieve that, you should write your own `Manager`, leveraging test `Data`.
 
-Here is an example, where we are using `data.Get("sometestdata")`.
+Here is an example, where we are using `data.Labels().Get("sometestdata")`.
 
 ```go
 package main
@@ -133,7 +133,7 @@ func TestMyThing(t *testing.T) {
 
 	// Declare your test
 	myTest := &test.Case{
-		Data:        test.WithData("sometestdata", "blah"),
+		Data:        test.WithLabels(map[string]string{"sometestdata": "blah"}),
 		Command:     test.Command("info"),
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
@@ -143,7 +143,7 @@ func TestMyThing(t *testing.T) {
 					errdefs.ErrNotFound,
 				},
 				Output: func(stdout string, info string, t *testing.T) {
-					assert.Assert(t, stdout == data.Get("sometestdata"), info)
+					assert.Assert(t, stdout == data.Labels().Get("sometestdata"), info)
 				},
 			}
 		},
@@ -157,7 +157,7 @@ func TestMyThing(t *testing.T) {
 
 `Data` is provided to allow storing mutable key-value information that pertain to the test.
 
-While it can be provided through `test.WithData(key string, value string)`,
+While it can be provided through `test.WithLabels(map[string]string{key: value})`,
 inside the testcase definition, it can also be dynamically manipulated inside `Setup`, or `Command`.
 
 Note that `Data` additionally exposes the following functions:
@@ -244,9 +244,9 @@ func TestMyThing(t *testing.T) {
 
 	// Declare your test
 	myTest := &test.Case{
-		Data:        test.WithData("sometestdata", "blah"),
+		Data:        test.WithLabels(map[string]string{"sometestdata": "blah"}),
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("run", "--name", data.Get("sometestdata"))
+			return helpers.Command("run", "--name", data.Labels().Get("sometestdata"))
 		},
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
@@ -256,7 +256,7 @@ func TestMyThing(t *testing.T) {
 					errdefs.ErrNotFound,
 				},
 				Output: func(stdout string, info string, t *testing.T) {
-					assert.Assert(t, stdout == data.Get("sometestdata"), info)
+					assert.Assert(t, stdout == data.Labels().Get("sometestdata"), info)
 				},
 			}
 		},
@@ -325,7 +325,7 @@ func TestMyThing(t *testing.T) {
 
 	// Declare your test
 	myTest := &test.Case{
-		Data:        test.WithData("sometestdata", "blah"),
+		Data:        test.WithLabels(map[string]string{"sometestdata": "blah"}),
 		Setup: func(data *test.Data, helpers test.Helpers){
 			helpers.Ensure("volume", "create", "foo")
 			helpers.Ensure("volume", "create", "bar")
@@ -335,7 +335,7 @@ func TestMyThing(t *testing.T) {
 			helpers.Anyhow("volume", "rm", "bar")
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("run", "--name", data.Identifier()+data.Get("sometestdata"))
+			return helpers.Command("run", "--name", data.Identifier()+data.Labels().Get("sometestdata"))
 		},
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
@@ -345,7 +345,7 @@ func TestMyThing(t *testing.T) {
 					errdefs.ErrNotFound,
 				},
 				Output: func(stdout string, info string, t *testing.T) {
-					assert.Assert(t, stdout == data.Get("sometestdata"), info)
+					assert.Assert(t, stdout == data.Labels().Get("sometestdata"), info)
 				},
 			}
 		},
diff --git a/go.mod b/go.mod
index 2d374b2e..ec2b281e 100644
--- a/go.mod
+++ b/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/containerd/cgroups/v3 v3.0.5
 	github.com/containerd/console v1.0.4
 	github.com/containerd/containerd/api v1.8.0
-	github.com/containerd/containerd/v2 v2.0.4
+	github.com/containerd/containerd/v2 v2.0.5
 	github.com/containerd/continuity v0.4.5
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/fifo v1.1.0
@@ -31,8 +31,8 @@ require (
 	github.com/coreos/go-systemd/v22 v22.5.0
 	github.com/cyphar/filepath-securejoin v0.4.1
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v28.0.4+incompatible
-	github.com/docker/docker v28.0.4+incompatible
+	github.com/docker/cli v28.1.0+incompatible
+	github.com/docker/docker v28.1.0+incompatible
 	github.com/docker/go-connections v0.5.0
 	github.com/docker/go-units v0.5.0
 	github.com/fahedouch/go-logrotate v0.3.0
diff --git a/go.sum b/go.sum
index a29d7128..cda53f54 100644
--- a/go.sum
+++ b/go.sum
@@ -31,8 +31,8 @@ github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn
 github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
 github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0=
 github.com/containerd/containerd/api v1.8.0/go.mod h1:dFv4lt6S20wTu/hMcP4350RL87qPWLVa/OHOwmmdnYc=
-github.com/containerd/containerd/v2 v2.0.4 h1:+r7yJMwhTfMm3CDyiBjMBQO8a9CTBxL2Bg/JtqtIwB8=
-github.com/containerd/containerd/v2 v2.0.4/go.mod h1:5j9QUUaV/cy9ZeAx4S+8n9ffpf+iYnEj4jiExgcbuLY=
+github.com/containerd/containerd/v2 v2.0.5 h1:2vg/TjUXnaohAxiHnthQg8K06L9I4gdYEMcOLiMc8BQ=
+github.com/containerd/containerd/v2 v2.0.5/go.mod h1:Qqo0UN43i2fX1FLkrSTCg6zcHNfjN7gEnx3NPRZI+N0=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -88,10 +88,10 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/docker/cli v28.0.4+incompatible h1:pBJSJeNd9QeIWPjRcV91RVJihd/TXB77q1ef64XEu4A=
-github.com/docker/cli v28.0.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/docker v28.0.4+incompatible h1:JNNkBctYKurkw6FrHfKqY0nKIDf5nrbxjVBtS+cdcok=
-github.com/docker/docker v28.0.4+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/cli v28.1.0+incompatible h1:WiJhUBbuIH/BsJtth+C1hPwra4P0nsKJiWy9ie5My5s=
+github.com/docker/cli v28.1.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/docker v28.1.0+incompatible h1:4iqpcWQCt3Txcz7iWIb1U3SZ/n9ffo4U+ryY5/3eOp0=
+github.com/docker/docker v28.1.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
diff --git a/hack/build-integration-canary.sh b/hack/build-integration-canary.sh
index 0396ada1..ff53db89 100755
--- a/hack/build-integration-canary.sh
+++ b/hack/build-integration-canary.sh
@@ -276,9 +276,10 @@ canary::build::integration(){
     fi
 
     while read -r line; do
-      # Extract value after "=" from a possible dockerfile `ARG XXX_VERSION`
+      # Extract value after "=" from a possible dockerfile `ARG XXX_VERSION`, stripping out @ suffixes
       old_version=$(echo "$line" | grep "ARG ${shortsafename}_VERSION=") || true
       old_version="${old_version##*=}"
+      old_version="${old_version%%@*}"
       [ "$old_version" != "" ] || continue
       # If the Dockerfile version does NOT start with a v, adapt to that
       [ "${old_version:0:1}" == "v" ] || higher_readable="${higher_readable:1}"
diff --git a/mod/tigron/.golangci.yml b/mod/tigron/.golangci.yml
index ab1817e4..dfaf0f0c 100644
--- a/mod/tigron/.golangci.yml
+++ b/mod/tigron/.golangci.yml
@@ -57,16 +57,19 @@ linters:
   settings:
     interfacebloat:
       # Default is 10
-      max: 13
+      max: 20
     revive:
       enable-all-rules: true
       rules:
+        - name: max-public-structs
+          # Default is 5
+          arguments: 7
         - name: cognitive-complexity
           # Default is 7
-          arguments: [60]
+          arguments: [100]
         - name: function-length
           # Default is 50, 75
-          arguments: [80, 200]
+          arguments: [80, 220]
         - name: cyclomatic
           # Default is 10
           arguments: [30]
diff --git a/mod/tigron/expect/doc.md b/mod/tigron/expect/doc.md
index 48b8d4be..7b2e9828 100644
--- a/mod/tigron/expect/doc.md
+++ b/mod/tigron/expect/doc.md
@@ -169,7 +169,7 @@ To achieve that, you should write your own `test.Manager` instead of using the h
 A manager is a simple function which only role is to return a `test.Expected` struct.
 The `test.Manager` signature makes available `test.Data` and `test.Helpers` to you.
 
-Here is an example, where we are using `data.Get("sometestdata")`.
+Here is an example, where we are using `data.Labels().Get("sometestdata")`.
 
 ```go
 package main
@@ -191,7 +191,7 @@ func TestMyThing(t *testing.T) {
         // Do things...
         // ...
         // Save this for later
-        data.Set("something", "lalala")
+        data.Labels().Set("something", "lalala")
     }
 
     // Attach a command to run
@@ -210,7 +210,7 @@ func TestMyThing(t *testing.T) {
                 t.Helper()
 
                 // Retrieve the data that was set during the Setup phase.
-                assert.Assert(t, stdout == data.Get("sometestdata"), info)
+                assert.Assert(t, stdout == data.Labels().Get("sometestdata"), info)
             },
         }
     }
diff --git a/mod/tigron/internal/com/command.go b/mod/tigron/internal/com/command.go
index cc8959a7..c8cd6c3d 100644
--- a/mod/tigron/internal/com/command.go
+++ b/mod/tigron/internal/com/command.go
@@ -70,6 +70,7 @@ type Result struct {
 	Stderr   string
 	ExitCode int
 	Signal   os.Signal
+	Duration time.Duration
 }
 
 type execution struct {
@@ -102,9 +103,10 @@ type Command struct {
 	ptyStderr bool
 	ptyStdin  bool
 
-	exec   *execution
-	mutex  sync.Mutex
-	result *Result
+	exec      *execution
+	mutex     sync.Mutex
+	result    *Result
+	startTime time.Time
 }
 
 // Clone does just duplicate a command, resetting its execution.
@@ -184,12 +186,12 @@ func (gc *Command) Run(parentCtx context.Context) error {
 	)
 
 	// Get a timing-out context
-	timeout := gc.Timeout
-	if timeout == 0 {
-		timeout = defaultTimeout
+	if gc.Timeout == 0 {
+		gc.Timeout = defaultTimeout
 	}
 
-	ctx, ctxCancel = context.WithTimeout(parentCtx, timeout)
+	ctx, ctxCancel = context.WithTimeout(parentCtx, gc.Timeout)
+	gc.startTime = time.Now()
 
 	// Create a contextual command, set the logger
 	cmd = gc.buildCommand(ctx)
@@ -366,6 +368,7 @@ func (gc *Command) wrap() error {
 		Stderr:   pipes.fromStderr,
 		Environ:  cmd.Environ(),
 		Signal:   signal,
+		Duration: time.Since(gc.startTime),
 	}
 
 	if gc.exec.err == nil {
diff --git a/mod/tigron/internal/formatter/formatter.go b/mod/tigron/internal/formatter/formatter.go
index 43ce9fe5..f0900acb 100644
--- a/mod/tigron/internal/formatter/formatter.go
+++ b/mod/tigron/internal/formatter/formatter.go
@@ -108,7 +108,10 @@ func chunk(s string, maxLength, maxLines int) []string {
 	}
 
 	if len(chunks) > maxLines {
-		chunks = append(chunks[0:maxLines], "...")
+		abbreviator := "..."
+		chunks = append(
+			append(chunks[0:maxLines/2], abbreviator+strings.Repeat(spacer, maxLength-len(abbreviator))),
+			chunks[len(chunks)-maxLines/2:]...)
 	} else if len(chunks) == 0 {
 		chunks = []string{strings.Repeat(spacer, maxLength)}
 	}
diff --git a/mod/tigron/require/doc.md b/mod/tigron/require/doc.md
new file mode 100644
index 00000000..5db53f9a
--- /dev/null
+++ b/mod/tigron/require/doc.md
@@ -0,0 +1,63 @@
+# Requirements
+
+Any `test.Case` has a `Require` property that allow enforcing specific, per-test requirements.
+
+A `Requirement` is expected to make you `Skip` tests when the environment does not match
+expectations.
+
+A number of ready-made requirements are provided:
+
+```go
+require.Windows // a test runs only on Windows
+require.Linux // a test runs only on Linux
+test.Darwin // a test runs only on Darwin
+test.OS(name string) // a test runs only on the OS `name`
+require.Binary(name string) // a test requires the binary `name` to be in the PATH
+require.Not(req Requirement) // a test runs only if the opposite of the requirement `req` is fulfilled
+require.All(req ...Requirement) // a test runs only if all requirements are fulfilled
+```
+
+## Custom requirements
+
+A requirement is a simple struct (`test.Requirement`), that must provide a `Check` function.
+
+`Check` function signature is `func(data Data, helpers Helpers) (bool, string)`, that is expected
+to return `true` if the environment is fine to run that test, or `false` if not.
+The second parameter should return a meaningful message explaining what the requirement is.
+
+For example: `found kernel version > 5.0`.
+
+Given requirements can be negated with `require.Not(req)`, your message should describe the state of the environment
+and not whether the conditions are met (or not met).
+
+A `test.Requirement` can optionally provide custom `Setup` and `Cleanup` routines, in case you need to perform
+specific operations before the test run (and cleanup something after).
+
+`Setup/Cleanup` will only run if the requirement `Check` returns true.
+
+Here is for example how the `require.Binary` method is implemented:
+
+```go
+package thing
+
+func Binary(name string) *test.Requirement {
+    return &test.Requirement{
+        Check: func(_ test.Data, _ test.Helpers) (bool, string) {
+            mess := fmt.Sprintf("executable %q has been found in PATH", name)
+            ret := true
+            if _, err := exec.LookPath(name); err != nil {
+                ret = false
+                mess = fmt.Sprintf("executable %q doesn't exist in PATH", name)
+            }
+
+            return ret, mess
+        },
+    }
+}
+```
+
+## Gotcha
+
+Obviously, `test.Not(otherreq)` will NOT perform any `Setup/Cleanup` provided by `otherreq`.
+
+Ambient requirements are currently undocumented.
diff --git a/pkg/api/types/container_types.go b/pkg/api/types/container_types.go
index 6505f4aa..a1b2d272 100644
--- a/pkg/api/types/container_types.go
+++ b/pkg/api/types/container_types.go
@@ -114,6 +114,10 @@ type ContainerCreateOptions struct {
 	CPUSetCPUs string
 	// CPUSetMems specifies the memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on NUMA systems.
 	CPUSetMems string
+	// Limit CPU real-time period in microseconds
+	CPURealtimePeriod uint64
+	// Limit CPU real-time runtime in microseconds
+	CPURealtimeRuntime uint64
 	// Memory specifies the memory limit
 	Memory string
 	// MemoryReservationChanged specifies whether the memory soft limit has been changed
diff --git a/pkg/cmd/container/run_cgroup_linux.go b/pkg/cmd/container/run_cgroup_linux.go
index 5216ecc9..75eb5f64 100644
--- a/pkg/cmd/container/run_cgroup_linux.go
+++ b/pkg/cmd/container/run_cgroup_linux.go
@@ -102,6 +102,19 @@ func generateCgroupOpts(id string, options types.ContainerCreateOptions, interna
 		opts = append(opts, oci.WithCPUsMems(options.CPUSetMems))
 	}
 
+	if options.CPURealtimePeriod != 0 || options.CPURealtimeRuntime != 0 {
+		if !infoutil.CPURealtime(options.GOptions.CgroupManager) {
+			// CPU realtime scheduling is not supported in cgroup V2
+			return nil, errors.New("kernel does not support CPU real-time scheduler")
+		}
+
+		if options.CPURealtimePeriod != 0 && options.CPURealtimeRuntime != 0 &&
+			options.CPURealtimeRuntime > options.CPURealtimePeriod {
+			return nil, errors.New("cpu real-time runtime cannot be higher than cpu real-time period")
+		}
+	}
+	opts = append(opts, oci.WithCPURT(int64(options.CPURealtimeRuntime), options.CPURealtimePeriod))
+
 	var mem64 int64
 	if options.Memory != "" {
 		mem64, err = units.RAMInBytes(options.Memory)
diff --git a/pkg/cmd/image/convert.go b/pkg/cmd/image/convert.go
index 460bf3c4..b7963ea2 100644
--- a/pkg/cmd/image/convert.go
+++ b/pkg/cmd/image/convert.go
@@ -208,8 +208,7 @@ func Convert(ctx context.Context, client *containerd.Client, srcRawRef, targetRa
 			return err
 		}
 		is := client.ImageService()
-		_ = is.Delete(ctx, newI.Name, images.SynchronousDelete())
-		finimg, err := is.Create(ctx, *newI)
+		finimg, err := is.Update(ctx, *newI)
 		if err != nil {
 			return err
 		}
diff --git a/pkg/cmd/image/remove.go b/pkg/cmd/image/remove.go
index 6baa1970..44aafa5f 100644
--- a/pkg/cmd/image/remove.go
+++ b/pkg/cmd/image/remove.go
@@ -79,18 +79,22 @@ func Remove(ctx context.Context, client *containerd.Client, args []string, optio
 
 			if cid, ok := runningImages[found.Image.Name]; ok {
 				if options.Force {
-					// FIXME: this is suspicious, but passing the opt seem to break some tests
-					// if err = is.Delete(ctx, found.Image.Name, delOpts...); err != nil {
-					if err = is.Delete(ctx, found.Image.Name); err != nil {
+					// This is a running image, so, we need to keep a ref on it so that containerd does not GC the layers
+					// First create the new image with an empty name
+					originalName := found.Image.Name
+					found.Image.Name = ":"
+					if _, err = is.Create(ctx, found.Image); err != nil {
 						return err
 					}
-					fmt.Fprintf(options.Stdout, "Untagged: %s\n", found.Image.Name)
-					fmt.Fprintf(options.Stdout, "Untagged: %s\n", found.Image.Target.Digest.String())
 
-					found.Image.Name = ":"
-					if _, err = is.Create(ctx, found.Image); err != nil {
+					// Now, delete the original
+					if err = is.Delete(ctx, originalName, delOpts...); err != nil {
 						return err
 					}
+
+					fmt.Fprintf(options.Stdout, "Untagged: %s\n", originalName)
+					fmt.Fprintf(options.Stdout, "Untagged: %s@%s\n", originalName, found.Image.Target.Digest.String())
+
 					return nil
 				}
 				return fmt.Errorf("conflict: unable to delete %s (cannot be forced) - image is being used by running container %s", found.Req, cid)
@@ -128,18 +132,22 @@ func Remove(ctx context.Context, client *containerd.Client, args []string, optio
 
 			if cid, ok := runningImages[found.Image.Name]; ok {
 				if options.Force {
-					// FIXME: this is suspicious, but passing the opt seem to break some tests
-					// if err = is.Delete(ctx, found.Image.Name, delOpts...); err != nil {
-					if err = is.Delete(ctx, found.Image.Name); err != nil {
+					// This is a running image, so, we need to keep a ref on it so that containerd does not GC the layers
+					// First create the new image with an empty name
+					originalName := found.Image.Name
+					found.Image.Name = ":"
+					if _, err = is.Create(ctx, found.Image); err != nil {
 						return false, err
 					}
-					fmt.Fprintf(options.Stdout, "Untagged: %s\n", found.Image.Name)
-					fmt.Fprintf(options.Stdout, "Untagged: %s\n", found.Image.Target.Digest.String())
 
-					found.Image.Name = ":"
-					if _, err = is.Create(ctx, found.Image); err != nil {
+					// Now, delete the original
+					if err = is.Delete(ctx, originalName, delOpts...); err != nil {
 						return false, err
 					}
+
+					fmt.Fprintf(options.Stdout, "Untagged: %s\n", originalName)
+					fmt.Fprintf(options.Stdout, "Untagged: %s@%s\n", originalName, found.Image.Target.Digest.String())
+
 					return false, nil
 				}
 				return false, fmt.Errorf("conflict: unable to delete %s (cannot be forced) - image is being used by running container %s", found.Req, cid)
diff --git a/pkg/cmd/network/inspect.go b/pkg/cmd/network/inspect.go
index 5fae2802..0a9090b9 100644
--- a/pkg/cmd/network/inspect.go
+++ b/pkg/cmd/network/inspect.go
@@ -22,16 +22,19 @@ import (
 	"errors"
 	"fmt"
 
+	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/log"
 
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
+	"github.com/containerd/nerdctl/v2/pkg/containerinspector"
 	"github.com/containerd/nerdctl/v2/pkg/formatter"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/native"
+	"github.com/containerd/nerdctl/v2/pkg/labels"
 	"github.com/containerd/nerdctl/v2/pkg/netutil"
 )
 
-func Inspect(ctx context.Context, options types.NetworkInspectOptions) error {
+func Inspect(ctx context.Context, client *containerd.Client, options types.NetworkInspectOptions) error {
 	if options.Mode != "native" && options.Mode != "dockercompat" {
 		return fmt.Errorf("unknown mode %q", options.Mode)
 	}
@@ -53,12 +56,35 @@ func Inspect(ctx context.Context, options types.NetworkInspectOptions) error {
 			errs = append(errs, fmt.Errorf("no network found matching: %s", req))
 			continue
 		}
+
 		network := netList[0]
+		var filters = []string{fmt.Sprintf("labels.%q==%q", labels.Networks, []string{network.Name})}
+
+		filteredContainers, err := client.Containers(ctx, filters...)
+
+		if err != nil {
+			return err
+		}
+
+		var containers []*native.Container
+
+		for _, container := range filteredContainers {
+			nativeContainer, err := containerinspector.Inspect(ctx, container)
+			if err != nil {
+				continue
+			}
+			if nativeContainer.Process == nil || nativeContainer.Process.Status.Status != containerd.Running {
+				continue
+			}
+			containers = append(containers, nativeContainer)
+		}
+
 		r := &native.Network{
 			CNI:           json.RawMessage(network.Bytes),
 			NerdctlID:     network.NerdctlID,
 			NerdctlLabels: network.NerdctlLabels,
 			File:          network.File,
+			Containers:    containers,
 		}
 		switch options.Mode {
 		case "native":
diff --git a/pkg/infoutil/infoutil.go b/pkg/infoutil/infoutil.go
index 965ae4a0..ce6bf908 100644
--- a/pkg/infoutil/infoutil.go
+++ b/pkg/infoutil/infoutil.go
@@ -284,3 +284,8 @@ func BlockIOReadIOpsDevice(cgroupManager string) bool {
 func BlockIOWriteIOpsDevice(cgroupManager string) bool {
 	return getMobySysInfo(cgroupManager).BlkioWriteIOpsDevice
 }
+
+// CPURealtime returns whether CPU realtime period is supported or not
+func CPURealtime(cgroupManager string) bool {
+	return getMobySysInfo(cgroupManager).CPURealtime
+}
diff --git a/pkg/inspecttypes/dockercompat/dockercompat.go b/pkg/inspecttypes/dockercompat/dockercompat.go
index e5b797e7..43321456 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat.go
@@ -167,17 +167,20 @@ type HostConfig struct {
 	Tmpfs   map[string]string `json:"Tmpfs,omitempty"` // List of tmpfs (mounts) used for the container
 	UTSMode string            // UTS namespace to use for the container
 	// UsernsMode      UsernsMode        // The user namespace to use for the container
-	ShmSize        int64             // Size of /dev/shm in bytes. The size must be greater than 0.
-	Sysctls        map[string]string // List of Namespaced sysctls used for the container
-	Runtime        string            // Runtime to use with this container
-	CPUSetMems     string            `json:"CpusetMems"` // CpusetMems 0-2, 0,1
-	CPUSetCPUs     string            `json:"CpusetCpus"` // CpusetCpus 0-2, 0,1
-	CPUQuota       int64             `json:"CpuQuota"`   // CPU CFS (Completely Fair Scheduler) quota
-	CPUShares      uint64            `json:"CpuShares"`  // CPU shares (relative weight vs. other containers)
-	Memory         int64             // Memory limit (in bytes)
-	MemorySwap     int64             // Total memory usage (memory + swap); set `-1` to enable unlimited swap
-	OomKillDisable bool              // specifies whether to disable OOM Killer
-	Devices        []DeviceMapping   // List of devices to map inside the container
+	ShmSize            int64             // Size of /dev/shm in bytes. The size must be greater than 0.
+	Sysctls            map[string]string // List of Namespaced sysctls used for the container
+	Runtime            string            // Runtime to use with this container
+	CPUSetMems         string            `json:"CpusetMems"`         // CpusetMems 0-2, 0,1
+	CPUSetCPUs         string            `json:"CpusetCpus"`         // CpusetCpus 0-2, 0,1
+	CPUQuota           int64             `json:"CpuQuota"`           // CPU CFS (Completely Fair Scheduler) quota
+	CPUShares          uint64            `json:"CpuShares"`          // CPU shares (relative weight vs. other containers)
+	CPUPeriod          uint64            `json:"CpuPeriod"`          // Limits the CPU CFS (Completely Fair Scheduler) period
+	CPURealtimePeriod  uint64            `json:"CpuRealtimePeriod"`  // Limits the CPU real-time period in microseconds
+	CPURealtimeRuntime int64             `json:"CpuRealtimeRuntime"` // Limits the CPU real-time runtime in microseconds
+	Memory             int64             // Memory limit (in bytes)
+	MemorySwap         int64             // Total memory usage (memory + swap); set `-1` to enable unlimited swap
+	OomKillDisable     bool              // specifies whether to disable OOM Killer
+	Devices            []DeviceMapping   // List of devices to map inside the container
 	LinuxBlkioSettings
 }
 
@@ -264,11 +267,14 @@ type DeviceMapping struct {
 	CgroupPermissions string
 }
 
-type cpuSettings struct {
-	cpuSetCpus string
-	cpuSetMems string
-	cpuShares  uint64
-	cpuQuota   int64
+type CPUSettings struct {
+	CPUSetCpus         string
+	CPUSetMems         string
+	CPUShares          uint64
+	CPUQuota           int64
+	CPUPeriod          uint64
+	CPURealtimePeriod  uint64
+	CPURealtimeRuntime int64
 }
 
 // DefaultNetworkSettings is from https://github.com/moby/moby/blob/v20.10.1/api/types/types.go#L405-L414
@@ -478,12 +484,15 @@ func ContainerFromNative(n *native.Container) (*Container, error) {
 
 	cpuSetting, err := cpuSettingsFromNative(n.Spec.(*specs.Spec))
 	if err != nil {
-		return nil, fmt.Errorf("failed to Decode cpuSettings: %v", err)
+		return nil, fmt.Errorf("failed to Decode cpuSetting: %v", err)
 	}
-	c.HostConfig.CPUSetCPUs = cpuSetting.cpuSetCpus
-	c.HostConfig.CPUSetMems = cpuSetting.cpuSetMems
-	c.HostConfig.CPUQuota = cpuSetting.cpuQuota
-	c.HostConfig.CPUShares = cpuSetting.cpuShares
+	c.HostConfig.CPUSetCPUs = cpuSetting.CPUSetCpus
+	c.HostConfig.CPUSetMems = cpuSetting.CPUSetMems
+	c.HostConfig.CPUQuota = cpuSetting.CPUQuota
+	c.HostConfig.CPUShares = cpuSetting.CPUShares
+	c.HostConfig.CPUPeriod = cpuSetting.CPUPeriod
+	c.HostConfig.CPURealtimePeriod = cpuSetting.CPURealtimePeriod
+	c.HostConfig.CPURealtimeRuntime = cpuSetting.CPURealtimeRuntime
 
 	cgroupNamespace, err := getCgroupnsFromNative(n.Spec.(*specs.Spec))
 	if err != nil {
@@ -728,23 +737,32 @@ func networkSettingsFromNative(n *native.NetNS, sp *specs.Spec) (*NetworkSetting
 	return res, nil
 }
 
-func cpuSettingsFromNative(sp *specs.Spec) (*cpuSettings, error) {
-	res := &cpuSettings{}
+func cpuSettingsFromNative(sp *specs.Spec) (*CPUSettings, error) {
+	res := &CPUSettings{}
 	if sp.Linux != nil && sp.Linux.Resources != nil && sp.Linux.Resources.CPU != nil {
 		if sp.Linux.Resources.CPU.Cpus != "" {
-			res.cpuSetCpus = sp.Linux.Resources.CPU.Cpus
+			res.CPUSetCpus = sp.Linux.Resources.CPU.Cpus
 		}
 
 		if sp.Linux.Resources.CPU.Mems != "" {
-			res.cpuSetMems = sp.Linux.Resources.CPU.Mems
+			res.CPUSetMems = sp.Linux.Resources.CPU.Mems
 		}
 
 		if sp.Linux.Resources.CPU.Shares != nil && *sp.Linux.Resources.CPU.Shares > 0 {
-			res.cpuShares = *sp.Linux.Resources.CPU.Shares
+			res.CPUShares = *sp.Linux.Resources.CPU.Shares
 		}
 
 		if sp.Linux.Resources.CPU.Quota != nil && *sp.Linux.Resources.CPU.Quota > 0 {
-			res.cpuQuota = *sp.Linux.Resources.CPU.Quota
+			res.CPUQuota = *sp.Linux.Resources.CPU.Quota
+		}
+		if sp.Linux.Resources.CPU.Period != nil && *sp.Linux.Resources.CPU.Period > 0 {
+			res.CPUPeriod = *sp.Linux.Resources.CPU.Period
+		}
+		if sp.Linux.Resources.CPU.RealtimePeriod != nil && *sp.Linux.Resources.CPU.RealtimePeriod > 0 {
+			res.CPURealtimePeriod = *sp.Linux.Resources.CPU.RealtimePeriod
+		}
+		if sp.Linux.Resources.CPU.RealtimeRuntime != nil && *sp.Linux.Resources.CPU.RealtimeRuntime > 0 {
+			res.CPURealtimeRuntime = *sp.Linux.Resources.CPU.RealtimeRuntime
 		}
 	}
 
@@ -884,13 +902,22 @@ type IPAM struct {
 // Network mimics a `docker network inspect` object.
 // From https://github.com/moby/moby/blob/v20.10.7/api/types/types.go#L430-L448
 type Network struct {
-	Name   string            `json:"Name"`
-	ID     string            `json:"Id,omitempty"` // optional in nerdctl
-	IPAM   IPAM              `json:"IPAM,omitempty"`
-	Labels map[string]string `json:"Labels"`
+	Name       string                      `json:"Name"`
+	ID         string                      `json:"Id,omitempty"` // optional in nerdctl
+	IPAM       IPAM                        `json:"IPAM,omitempty"`
+	Labels     map[string]string           `json:"Labels"`
+	Containers map[string]EndpointResource `json:"Containers"` // Containers contains endpoints belonging to the network
 	// Scope, Driver, etc. are omitted
 }
 
+type EndpointResource struct {
+	Name string `json:"Name"`
+	// EndpointID  string `json:"EndpointID"`
+	// MacAddress  string `json:"MacAddress"`
+	// IPv4Address string `json:"IPv4Address"`
+	// IPv6Address string `json:"IPv6Address"`
+}
+
 type structuredCNI struct {
 	Name    string `json:"name"`
 	Plugins []struct {
@@ -930,6 +957,17 @@ func NetworkFromNative(n *native.Network) (*Network, error) {
 		res.Labels = *n.NerdctlLabels
 	}
 
+	res.Containers = make(map[string]EndpointResource)
+	for _, container := range n.Containers {
+		res.Containers[container.ID] = EndpointResource{
+			Name: container.Labels[labels.Name],
+			// EndpointID:  container.EndpointID,
+			// MacAddress:  container.MacAddress,
+			// IPv4Address: container.IPv4Address,
+			// IPv6Address: container.IPv6Address,
+		}
+	}
+
 	return &res, nil
 }
 
diff --git a/pkg/inspecttypes/dockercompat/info.go b/pkg/inspecttypes/dockercompat/info.go
index c1f13765..4cfa3974 100644
--- a/pkg/inspecttypes/dockercompat/info.go
+++ b/pkg/inspecttypes/dockercompat/info.go
@@ -37,6 +37,7 @@ type Info struct {
 	CPUCfsQuota       bool `json:"CpuCfsQuota"`
 	CPUShares         bool
 	CPUSet            bool
+	CPURealtime       bool
 	PidsLimit         bool
 	IPv4Forwarding    bool
 	BridgeNfIptables  bool
diff --git a/pkg/inspecttypes/native/network.go b/pkg/inspecttypes/native/network.go
index 18d5e96b..f0e84d59 100644
--- a/pkg/inspecttypes/native/network.go
+++ b/pkg/inspecttypes/native/network.go
@@ -18,10 +18,11 @@ package native
 
 import "encoding/json"
 
-// Network corresponds to pkg/netutil.NetworkConfigList
+// Network corresponds to pkg/netutil.NetworkConfig
 type Network struct {
 	CNI           json.RawMessage    `json:"CNI,omitempty"`
 	NerdctlID     *string            `json:"NerdctlID"`
 	NerdctlLabels *map[string]string `json:"NerdctlLabels,omitempty"`
 	File          string             `json:"File,omitempty"`
+	Containers    []*Container       `json:"Containers"`
 }



Test patch:
diff --git a/cmd/nerdctl/builder/builder_build_oci_layout_test.go b/cmd/nerdctl/builder/builder_build_oci_layout_test.go
index 93cc4152..758675e8 100644
--- a/cmd/nerdctl/builder/builder_build_oci_layout_test.go
+++ b/cmd/nerdctl/builder/builder_build_oci_layout_test.go
@@ -18,13 +18,13 @@ package builder
 
 import (
 	"fmt"
-	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
 	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
@@ -44,17 +44,17 @@ func TestBuildContextWithOCILayout(t *testing.T) {
 		),
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			if nerdtest.IsDocker() {
-				helpers.Anyhow("buildx", "stop", data.Identifier("-container"))
-				helpers.Anyhow("buildx", "rm", "--force", data.Identifier("-container"))
+				helpers.Anyhow("buildx", "stop", data.Identifier("container"))
+				helpers.Anyhow("buildx", "rm", "--force", data.Identifier("container"))
 			}
-			helpers.Anyhow("rmi", "-f", data.Identifier("-parent"))
-			helpers.Anyhow("rmi", "-f", data.Identifier("-child"))
+			helpers.Anyhow("rmi", "-f", data.Identifier("parent"))
+			helpers.Anyhow("rmi", "-f", data.Identifier("child"))
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
 			// Default docker driver does not support OCI exporter.
 			// Reference: https://docs.docker.com/build/exporters/oci-docker/
 			if nerdtest.IsDocker() {
-				name := data.Identifier("-container")
+				name := data.Identifier("container")
 				helpers.Ensure("buildx", "create", "--name", name, "--driver=docker-container")
 				dockerBuilderArgs = []string{"buildx", "--builder", name}
 			}
@@ -63,25 +63,21 @@ func TestBuildContextWithOCILayout(t *testing.T) {
 LABEL layer=oci-layout-parent
 CMD ["echo", "test-nerdctl-build-context-oci-layout-parent"]`, testutil.CommonImage)
 
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
+			data.Temp().Save(dockerfile, "Dockerfile")
+			dest := data.Temp().Dir("parent")
+			tarPath := data.Temp().Path("parent.tar")
 
-			tarPath := filepath.Join(buildCtx, "parent.tar")
-			dest := filepath.Join(buildCtx, "parent")
-			assert.NilError(helpers.T(), os.MkdirAll(dest, 0o700))
-			helpers.Ensure("build", buildCtx, "--tag", data.Identifier("-parent"))
-			helpers.Ensure("image", "save", "--output", tarPath, data.Identifier("-parent"))
-			helpers.Custom("tar", "Cxf", dest, tarPath).Run(&test.Expected{})
+			helpers.Ensure("build", data.Temp().Path(), "--tag", data.Identifier("parent"))
+			helpers.Ensure("image", "save", "--output", tarPath, data.Identifier("parent"))
+			helpers.Custom("tar", "Cxf", dest, tarPath).Run(&test.Expected{
+				ExitCode: expect.ExitCodeSuccess,
+			})
 		},
 
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			dockerfile := `FROM parent
 CMD ["echo", "test-nerdctl-build-context-oci-layout"]`
-
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
+			data.Temp().Save(dockerfile, "Dockerfile")
 
 			var cmd test.TestableCommand
 			if nerdtest.IsDocker() {
@@ -89,7 +85,13 @@ CMD ["echo", "test-nerdctl-build-context-oci-layout"]`
 			} else {
 				cmd = helpers.Command()
 			}
-			cmd.WithArgs("build", buildCtx, fmt.Sprintf("--build-context=parent=oci-layout://%s", filepath.Join(buildCtx, "parent")), "--tag", data.Identifier("-child"))
+			cmd.WithArgs(
+				"build",
+				data.Temp().Path(),
+				fmt.Sprintf("--build-context=parent=oci-layout://%s", filepath.Join(data.Temp().Path(), "parent")),
+				"--tag",
+				data.Identifier("child"),
+			)
 			if nerdtest.IsDocker() {
 				// Need to load the container image from the builder to be able to run it.
 				cmd.WithArgs("--load")
@@ -99,7 +101,14 @@ CMD ["echo", "test-nerdctl-build-context-oci-layout"]`
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
 				Output: func(stdout string, info string, t *testing.T) {
-					assert.Assert(t, strings.Contains(helpers.Capture("run", "--rm", data.Identifier("-child")), "test-nerdctl-build-context-oci-layout"), info)
+					assert.Assert(
+						t,
+						strings.Contains(
+							helpers.Capture("run", "--rm", data.Identifier("child")),
+							"test-nerdctl-build-context-oci-layout",
+						),
+						info,
+					)
 				},
 			}
 		},
diff --git a/cmd/nerdctl/builder/builder_build_test.go b/cmd/nerdctl/builder/builder_build_test.go
index e4999a92..3260be3e 100644
--- a/cmd/nerdctl/builder/builder_build_test.go
+++ b/cmd/nerdctl/builder/builder_build_test.go
@@ -19,8 +19,6 @@ package builder
 import (
 	"errors"
 	"fmt"
-	"os"
-	"path/filepath"
 	"runtime"
 	"strings"
 	"testing"
@@ -39,23 +37,20 @@ import (
 func TestBuildBasics(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
-			err := os.WriteFile(filepath.Join(data.TempDir(), "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", data.TempDir())
-		},
-		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rmi", "-f", data.Identifier())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Labels().Set("buildCtx", data.Temp().Path())
 		},
 		SubTests: []*test.Case{
 			{
 				Description: "Successfully build with 'tag first', 'buildctx second'",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", "-t", data.Identifier(), data.Get("buildCtx"))
+					helpers.Ensure("build", "-t", data.Identifier(), data.Labels().Get("buildCtx"))
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -63,12 +58,12 @@ CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 			{
 				Description: "Successfully build with 'buildctx first', 'tag second'",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "-t", data.Identifier())
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -76,12 +71,18 @@ CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 			{
 				Description: "Successfully build with output docker, main tag still works",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "-t", data.Identifier(), "--output=type=docker,name="+data.Identifier("ignored"))
+					helpers.Ensure(
+						"build",
+						data.Labels().Get("buildCtx"),
+						"-t",
+						data.Identifier(),
+						"--output=type=docker,name="+data.Identifier("ignored"),
+					)
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -89,18 +90,24 @@ CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 			{
 				Description: "Successfully build with output docker, name cannot be used",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "-t", data.Identifier(), "--output=type=docker,name="+data.Identifier("ignored"))
+					helpers.Ensure(
+						"build",
+						data.Labels().Get("buildCtx"),
+						"-t",
+						data.Identifier(),
+						"--output=type=docker,name="+data.Identifier("ignored"),
+					)
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier("ignored"))
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					helpers.Anyhow("rmi", "-f", data.Identifier())
+					helpers.Anyhow("rmi", "-f", data.Identifier("ignored"))
 				},
 				Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 			},
@@ -122,32 +129,39 @@ func TestCanBuildOnOtherPlatform(t *testing.T) {
 			can, err := platformutil.CanExecProbably("linux/" + candidateArch)
 			assert.NilError(helpers.T(), err)
 
-			data.Set("OS", "linux")
-			data.Set("Architecture", candidateArch)
+			data.Labels().Set("OS", "linux")
+			data.Labels().Set("Architecture", candidateArch)
 			return can, "Current environment does not support emulation"
 		},
 	}
 
+	dockerfile := fmt.Sprintf(`FROM %s
+RUN echo hello > /hello
+CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: require.All(
 			nerdtest.Build,
 			requireEmulation,
 		),
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-RUN echo hello > /hello
-CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
-			err := os.WriteFile(filepath.Join(data.TempDir(), "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", data.TempDir())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Labels().Set("buildCtx", data.Temp().Path())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("build", data.Get("buildCtx"), "--platform", fmt.Sprintf("%s/%s", data.Get("OS"), data.Get("Architecture")), "-t", data.Identifier())
+			return helpers.Command(
+				"build",
+				data.Labels().Get("buildCtx"),
+				"--platform",
+				fmt.Sprintf("%s/%s", data.Labels().Get("OS"), data.Labels().Get("Architecture")),
+				"-t",
+				data.Identifier(),
+			)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
-		Expected: test.Expects(0, nil, nil),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 	}
 
 	testCase.Run(t)
@@ -168,21 +182,19 @@ func TestBuildBaseImage(t *testing.T) {
 			dockerfile := fmt.Sprintf(`FROM %s
 RUN echo hello > /hello
 CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
-			err := os.WriteFile(filepath.Join(data.TempDir(), "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", "-t", data.Identifier("first"), data.TempDir())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			helpers.Ensure("build", "-t", data.Identifier("first"), data.Temp().Path())
 
 			dockerfileSecond := fmt.Sprintf(`FROM %s
 RUN echo hello2 > /hello2
 CMD ["cat", "/hello2"]`, data.Identifier("first"))
-			err = os.WriteFile(filepath.Join(data.TempDir(), "Dockerfile"), []byte(dockerfileSecond), 0644)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", "-t", data.Identifier("second"), data.TempDir())
+			data.Temp().Save(dockerfileSecond, "Dockerfile")
+			helpers.Ensure("build", "-t", data.Identifier("second"), data.Temp().Path())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			return helpers.Command("run", "--rm", data.Identifier("second"))
 		},
-		Expected: test.Expects(0, nil, expect.Equals("hello2\n")),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("hello2\n")),
 	}
 
 	testCase.Run(t)
@@ -209,14 +221,13 @@ func TestBuildFromContainerd(t *testing.T) {
 			dockerfile := fmt.Sprintf(`FROM %s
 RUN echo hello2 > /hello2
 CMD ["cat", "/hello2"]`, data.Identifier("first"))
-			err := os.WriteFile(filepath.Join(data.TempDir(), "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", "-t", data.Identifier("second"), data.TempDir())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			helpers.Ensure("build", "-t", data.Identifier("second"), data.Temp().Path())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			return helpers.Command("run", "--rm", data.Identifier("second"))
 		},
-		Expected: test.Expects(0, nil, expect.Equals("hello2\n")),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("hello2\n")),
 	}
 
 	testCase.Run(t)
@@ -225,14 +236,15 @@ CMD ["cat", "/hello2"]`, data.Identifier("first"))
 func TestBuildFromStdin(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-stdin"]`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-stdin"]`, testutil.CommonImage)
 			cmd := helpers.Command("build", "-t", data.Identifier(), "-f", "-", ".")
 			cmd.Feed(strings.NewReader(dockerfile))
 			return cmd
@@ -250,21 +262,15 @@ CMD ["echo", "nerdctl-build-test-stdin"]`, testutil.CommonImage)
 func TestBuildWithDockerfile(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-dockerfile"]
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
-		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rmi", "-f", data.Identifier())
-		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-dockerfile"]
-	`, testutil.CommonImage)
-			buildCtx := filepath.Join(data.TempDir(), "test")
-			err := os.MkdirAll(buildCtx, 0755)
-			assert.NilError(helpers.T(), err)
-			err = os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Temp().Save(dockerfile, "test", "Dockerfile")
+			data.Labels().Set("buildCtx", data.Temp().Path("test"))
 		},
 		SubTests: []*test.Case{
 			{
@@ -274,10 +280,10 @@ CMD ["echo", "nerdctl-build-test-dockerfile"]
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					cmd := helpers.Command("build", "-t", data.Identifier(), "-f", "Dockerfile", "..")
-					cmd.WithCwd(data.Get("buildCtx"))
+					cmd.WithCwd(data.Labels().Get("buildCtx"))
 					return cmd
 				},
-				Expected: test.Expects(0, nil, nil),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 			},
 			{
 				Description: "Dockerfile .",
@@ -286,16 +292,16 @@ CMD ["echo", "nerdctl-build-test-dockerfile"]
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					cmd := helpers.Command("build", "-t", data.Identifier(), "-f", "Dockerfile", ".")
-					cmd.WithCwd(data.Get("buildCtx"))
+					cmd.WithCwd(data.Labels().Get("buildCtx"))
 					return cmd
 				},
-				Expected: test.Expects(0, nil, nil),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 			},
 			{
 				Description: "../Dockerfile .",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					cmd := helpers.Command("build", "-t", data.Identifier(), "-f", "../Dockerfile", ".")
-					cmd.WithCwd(data.Get("buildCtx"))
+					cmd.WithCwd(data.Labels().Get("buildCtx"))
 					return cmd
 				},
 				Expected: test.Expects(1, nil, nil),
@@ -312,53 +318,41 @@ func TestBuildLocal(t *testing.T) {
 	const testFileName = "nerdctl-build-test"
 	const testContent = "nerdctl"
 
+	dockerfile := fmt.Sprintf(`FROM scratch
+COPY %s /`, testFileName)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM scratch
-COPY %s /`, testFileName)
-
-			err := os.WriteFile(filepath.Join(data.TempDir(), "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-
-			err = os.WriteFile(filepath.Join(data.TempDir(), testFileName), []byte(testContent), 0644)
-			assert.NilError(helpers.T(), err)
-
-			data.Set("buildCtx", data.TempDir())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Temp().Save(testContent, testFileName)
+			data.Labels().Set("buildCtx", data.Temp().Path())
 		},
 		SubTests: []*test.Case{
 			{
-				Description: "destination 1",
+				// GOTCHA: avoid comma and = in the test name, or buildctl will misparse the destination direction
+				Description: "-o type local destination DIR: verify the file copied from context is in the output directory",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("build", "-o", fmt.Sprintf("type=local,dest=%s", data.TempDir()), data.Get("buildCtx"))
+					return helpers.Command("build", "-o", fmt.Sprintf("type=local,dest=%s", data.Temp().Path()), data.Labels().Get("buildCtx"))
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: func(stdout string, info string, t *testing.T) {
-							testFilePath := filepath.Join(data.TempDir(), testFileName)
-							_, err := os.Stat(testFilePath)
-							assert.NilError(helpers.T(), err, info)
-							dt, err := os.ReadFile(testFilePath)
-							assert.NilError(helpers.T(), err, info)
-							assert.Equal(helpers.T(), string(dt), testContent, info)
+						Output: func(stdout, info string, t *testing.T) {
+							// Expecting testFileName to exist inside the output target directory
+							assert.Equal(t, data.Temp().Load(testFileName), testContent, "file content is identical")
 						},
 					}
 				},
 			},
 			{
-				Description: "destination 2",
+				Description: "-o DIR: verify the file copied from context is in the output directory",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("build", "-o", data.TempDir(), data.Get("buildCtx"))
+					return helpers.Command("build", "-o", data.Temp().Path(), data.Labels().Get("buildCtx"))
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: func(stdout string, info string, t *testing.T) {
-							testFilePath := filepath.Join(data.TempDir(), testFileName)
-							_, err := os.Stat(testFilePath)
-							assert.NilError(helpers.T(), err, info)
-							dt, err := os.ReadFile(testFilePath)
-							assert.NilError(helpers.T(), err, info)
-							assert.Equal(helpers.T(), string(dt), testContent, info)
+						Output: func(stdout, info string, t *testing.T) {
+							assert.Equal(t, data.Temp().Load(testFileName), testContent, "file content is identical")
 						},
 					}
 				},
@@ -372,27 +366,26 @@ COPY %s /`, testFileName)
 func TestBuildWithBuildArg(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+ARG TEST_STRING=1
+ENV TEST_STRING=$TEST_STRING
+CMD echo $TEST_STRING
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-ARG TEST_STRING=1
-ENV TEST_STRING=$TEST_STRING
-CMD echo $TEST_STRING
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Labels().Set("buildCtx", data.Temp().Path())
 		},
 		SubTests: []*test.Case{
 			{
 				Description: "No args",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "-t", data.Identifier())
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -400,12 +393,12 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("1\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("1\n")),
 			},
 			{
 				Description: "ArgValueOverridesDefault",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "--build-arg", "TEST_STRING=2", "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "--build-arg", "TEST_STRING=2", "-t", data.Identifier())
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -413,12 +406,12 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("2\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("2\n")),
 			},
 			{
 				Description: "EmptyArgValueOverridesDefault",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "--build-arg", "TEST_STRING=", "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "--build-arg", "TEST_STRING=", "-t", data.Identifier())
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -426,12 +419,12 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("\n")),
 			},
 			{
 				Description: "UnsetArgKeyPreservesDefault",
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "--build-arg", "TEST_STRING", "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "--build-arg", "TEST_STRING", "-t", data.Identifier())
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -439,7 +432,7 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("1\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("1\n")),
 			},
 			{
 				Description: "EnvValueOverridesDefault",
@@ -447,7 +440,7 @@ CMD echo $TEST_STRING
 					"TEST_STRING": "3",
 				},
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "--build-arg", "TEST_STRING", "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "--build-arg", "TEST_STRING", "-t", data.Identifier())
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -455,7 +448,7 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("3\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("3\n")),
 			},
 			{
 				Description: "EmptyEnvValueOverridesDefault",
@@ -463,7 +456,7 @@ CMD echo $TEST_STRING
 					"TEST_STRING": "",
 				},
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "--build-arg", "TEST_STRING", "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "--build-arg", "TEST_STRING", "-t", data.Identifier())
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
@@ -471,7 +464,7 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("\n")),
 			},
 		},
 	}
@@ -482,27 +475,24 @@ CMD echo $TEST_STRING
 func TestBuildWithIIDFile(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-string"]
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-string"]
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", buildCtx, "--iidfile", filepath.Join(data.TempDir(), "id.txt"), "-t", data.Identifier())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			helpers.Ensure("build", data.Temp().Path(), "--iidfile", data.Temp().Path("id.txt"), "-t", data.Identifier())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			imageID, err := os.ReadFile(filepath.Join(data.TempDir(), "id.txt"))
-			assert.NilError(helpers.T(), err)
-			return helpers.Command("run", "--rm", string(imageID))
+			return helpers.Command("run", "--rm", data.Temp().Load("id.txt"))
 		},
 
-		Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 	}
 
 	testCase.Run(t)
@@ -511,25 +501,24 @@ CMD ["echo", "nerdctl-build-test-string"]
 func TestBuildWithLabels(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+LABEL name=nerdctl-build-test-label
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-LABEL name=nerdctl-build-test-label
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", buildCtx, "--label", "label=test", "-t", data.Identifier())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			helpers.Ensure("build", data.Temp().Path(), "--label", "label=test", "-t", data.Identifier())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			return helpers.Command("inspect", data.Identifier(), "--format", "{{json .Config.Labels }}")
 		},
 
-		Expected: test.Expects(0, nil, expect.Equals("{\"label\":\"test\",\"name\":\"nerdctl-build-test-label\"}\n")),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("{\"label\":\"test\",\"name\":\"nerdctl-build-test-label\"}\n")),
 	}
 
 	testCase.Run(t)
@@ -538,49 +527,54 @@ LABEL name=nerdctl-build-test-label
 func TestBuildMultipleTags(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-string"]
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
-		Data: test.WithData("i1", "image").
-			Set("i2", "image2").
-			Set("i3", "image3:hello"),
 		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rmi", "-f", data.Get("i1"))
-			helpers.Anyhow("rmi", "-f", data.Get("i2"))
-			helpers.Anyhow("rmi", "-f", data.Get("i3"))
+			helpers.Anyhow("rmi", "-f", data.Labels().Get("i1"))
+			helpers.Anyhow("rmi", "-f", data.Labels().Get("i2"))
+			helpers.Anyhow("rmi", "-f", data.Labels().Get("i3"))
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-string"]
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", buildCtx, "-t", data.Get("i1"), "-t", data.Get("i2"), "-t", data.Get("i3"))
+			data.Labels().Set("i1", data.Identifier("image"))
+			data.Labels().Set("i2", data.Identifier("image2"))
+			data.Labels().Set("i3", data.Identifier("image3")+":hello")
+			data.Temp().Save(dockerfile, "Dockerfile")
+			helpers.Ensure(
+				"build",
+				data.Temp().Path(),
+				"-t", data.Labels().Get("i1"),
+				"-t", data.Labels().Get("i2"),
+				"-t", data.Labels().Get("i3"),
+			)
 		},
 		SubTests: []*test.Case{
 			{
 				Description: "i1",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("run", "--rm", data.Get("i1"))
+					return helpers.Command("run", "--rm", data.Labels().Get("i1"))
 				},
 
-				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 			{
 				Description: "i2",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("run", "--rm", data.Get("i2"))
+					return helpers.Command("run", "--rm", data.Labels().Get("i2"))
 				},
 
-				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 			{
 				Description: "i3",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("run", "--rm", data.Get("i3"))
+					return helpers.Command("run", "--rm", data.Labels().Get("i3"))
 				},
 
-				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 		},
 	}
@@ -591,6 +585,10 @@ CMD ["echo", "nerdctl-build-test-string"]
 func TestBuildWithContainerfile(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-string"]
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: require.All(
 			nerdtest.Build,
@@ -600,18 +598,13 @@ func TestBuildWithContainerfile(t *testing.T) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-string"]
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Containerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", buildCtx, "-t", data.Identifier())
+			data.Temp().Save(dockerfile, "Dockerfile")
+			helpers.Ensure("build", data.Temp().Path(), "-t", data.Identifier())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			return helpers.Command("run", "--rm", data.Identifier())
 		},
-		Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nerdctl-build-test-string\n")),
 	}
 
 	testCase.Run(t)
@@ -629,20 +622,19 @@ func TestBuildWithDockerFileAndContainerfile(t *testing.T) {
 			dockerfile := fmt.Sprintf(`FROM %s
 CMD ["echo", "dockerfile"]
 	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
+			data.Temp().Save(dockerfile, "Dockerfile")
+
 			dockerfile = fmt.Sprintf(`FROM %s
 CMD ["echo", "containerfile"]
 	`, testutil.CommonImage)
-			err = os.WriteFile(filepath.Join(buildCtx, "Containerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", buildCtx, "-t", data.Identifier())
+			data.Temp().Save(dockerfile, "Containerfile")
+
+			helpers.Ensure("build", data.Temp().Path(), "-t", data.Identifier())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			return helpers.Command("run", "--rm", data.Identifier())
 		},
-		Expected: test.Expects(0, nil, expect.Equals("dockerfile\n")),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("dockerfile\n")),
 	}
 
 	testCase.Run(t)
@@ -651,6 +643,10 @@ CMD ["echo", "containerfile"]
 func TestBuildNoTag(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+CMD ["echo", "nerdctl-build-test-string"]
+	`, testutil.CommonImage)
+
 	// FIXME: this test should be rewritten and instead get the image id from the build, then query the image explicitly - instead of pruning / noparallel
 	testCase := &test.Case{
 		NoParallel: true,
@@ -659,16 +655,13 @@ func TestBuildNoTag(t *testing.T) {
 			helpers.Ensure("image", "prune", "--force", "--all")
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-CMD ["echo", "nerdctl-build-test-string"]
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			helpers.Ensure("build", buildCtx)
+			data.Temp().Save(dockerfile, "Dockerfile")
+
+			// XXX FIXME
+			helpers.Capture("build", data.Temp().Path())
 		},
 		Command:  test.Command("images"),
-		Expected: test.Expects(0, nil, expect.Contains("<none>")),
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("<none>")),
 	}
 
 	testCase.Run(t)
@@ -677,23 +670,27 @@ CMD ["echo", "nerdctl-build-test-string"]
 func TestBuildContextDockerImageAlias(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := `FROM myorg/myapp
+CMD ["echo", "nerdctl-build-myorg/myapp"]`
+
 	testCase := &test.Case{
 		Require: nerdtest.Build,
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := `FROM myorg/myapp
-CMD ["echo", "nerdctl-build-myorg/myapp"]`
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Temp().Save(dockerfile, "Dockerfile")
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("build", "-t", data.Identifier(), data.Get("buildCtx"), fmt.Sprintf("--build-context=myorg/myapp=docker-image://%s", testutil.CommonImage))
-		},
-		Expected: test.Expects(0, nil, nil),
+			return helpers.Command(
+				"build",
+				"-t",
+				data.Identifier(),
+				data.Temp().Path(),
+				fmt.Sprintf("--build-context=myorg/myapp=docker-image://%s", testutil.CommonImage),
+			)
+		},
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 	}
 
 	testCase.Run(t)
@@ -704,6 +701,9 @@ func TestBuildContextWithCopyFromDir(t *testing.T) {
 
 	content := "hello_from_dir_2"
 	filename := "hello.txt"
+	dockerfile := fmt.Sprintf(`FROM %s
+COPY --from=dir2 /%s /hello_from_dir2.txt
+RUN ["cat", "/hello_from_dir2.txt"]`, testutil.CommonImage, filename)
 
 	testCase := &test.Case{
 		Require: require.All(
@@ -714,23 +714,19 @@ func TestBuildContextWithCopyFromDir(t *testing.T) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dir2 := helpers.T().TempDir()
-			filePath := filepath.Join(dir2, filename)
-			err := os.WriteFile(filePath, []byte(content), 0o600)
-			assert.NilError(helpers.T(), err)
-			dockerfile := fmt.Sprintf(`FROM %s
-COPY --from=dir2 /%s /hello_from_dir2.txt
-RUN ["cat", "/hello_from_dir2.txt"]`, testutil.CommonImage, filename)
-			buildCtx := data.TempDir()
-			err = os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
-			data.Set("dir2", dir2)
+			data.Temp().Save(dockerfile, "context", "Dockerfile")
+			data.Temp().Save(content, "other-directory", filename)
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("build", "-t", data.Identifier(), data.Get("buildCtx"), fmt.Sprintf("--build-context=dir2=%s", data.Get("dir2")))
-		},
-		Expected: test.Expects(0, nil, nil),
+			return helpers.Command(
+				"build",
+				"-t",
+				data.Identifier(),
+				data.Temp().Path("context"),
+				fmt.Sprintf("--build-context=dir2=%s", data.Temp().Path("other-directory")),
+			)
+		},
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 	}
 
 	testCase.Run(t)
@@ -741,24 +737,20 @@ RUN ["cat", "/hello_from_dir2.txt"]`, testutil.CommonImage, filename)
 func TestBuildSourceDateEpoch(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+ARG SOURCE_DATE_EPOCH
+RUN echo $SOURCE_DATE_EPOCH >/source-date-epoch
+CMD ["cat", "/source-date-epoch"]
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: require.All(
 			nerdtest.Build,
 			require.Not(nerdtest.Docker),
 		),
-		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rmi", "-f", data.Identifier())
-		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-ARG SOURCE_DATE_EPOCH
-RUN echo $SOURCE_DATE_EPOCH >/source-date-epoch
-CMD ["cat", "/source-date-epoch"]
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Labels().Set("buildCtx", data.Temp().Path())
 		},
 		SubTests: []*test.Case{
 			{
@@ -767,7 +759,7 @@ CMD ["cat", "/source-date-epoch"]
 					"SOURCE_DATE_EPOCH": "1111111111",
 				},
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "-t", data.Identifier())
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
@@ -775,7 +767,7 @@ CMD ["cat", "/source-date-epoch"]
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("1111111111\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("1111111111\n")),
 			},
 			{
 				Description: "2222222222",
@@ -783,7 +775,7 @@ CMD ["cat", "/source-date-epoch"]
 					"SOURCE_DATE_EPOCH": "1111111111",
 				},
 				Setup: func(data test.Data, helpers test.Helpers) {
-					helpers.Ensure("build", data.Get("buildCtx"), "--build-arg", "SOURCE_DATE_EPOCH=2222222222", "-t", data.Identifier())
+					helpers.Ensure("build", data.Labels().Get("buildCtx"), "--build-arg", "SOURCE_DATE_EPOCH=2222222222", "-t", data.Identifier())
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
@@ -791,7 +783,7 @@ CMD ["cat", "/source-date-epoch"]
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, expect.Equals("2222222222\n")),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("2222222222\n")),
 			},
 		},
 	}
@@ -802,29 +794,25 @@ CMD ["cat", "/source-date-epoch"]
 func TestBuildNetwork(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+RUN apk add --no-cache curl
+RUN curl -I http://google.com
+	`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: require.All(
 			nerdtest.Build,
 			require.Not(nerdtest.Docker),
 		),
-		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rmi", "-f", data.Identifier())
-		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-RUN apk add --no-cache curl
-RUN curl -I http://google.com
-	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Labels().Set("buildCtx", data.Temp().Path())
 		},
 		SubTests: []*test.Case{
 			{
 				Description: "none",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("build", data.Get("buildCtx"), "-t", data.Identifier(), "--no-cache", "--network", "none")
+					return helpers.Command("build", data.Labels().Get("buildCtx"), "-t", data.Identifier(), "--no-cache", "--network", "none")
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
@@ -834,22 +822,22 @@ RUN curl -I http://google.com
 			{
 				Description: "empty",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("build", data.Get("buildCtx"), "-t", data.Identifier(), "--no-cache", "--network", "")
+					return helpers.Command("build", data.Labels().Get("buildCtx"), "-t", data.Identifier(), "--no-cache", "--network", "")
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, nil),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 			},
 			{
 				Description: "default",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("build", data.Get("buildCtx"), "-t", data.Identifier(), "--no-cache", "--network", "default")
+					return helpers.Command("build", data.Labels().Get("buildCtx"), "-t", data.Identifier(), "--no-cache", "--network", "default")
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, nil),
+				Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 			},
 		},
 	}
@@ -863,6 +851,8 @@ func TestBuildAttestation(t *testing.T) {
 	const testSBOMFileName = "sbom.spdx.json"
 	const testProvenanceFileName = "provenance.json"
 
+	dockerfile := fmt.Sprintf(`FROM %s`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: require.All(
 			nerdtest.Build,
@@ -872,38 +862,34 @@ func TestBuildAttestation(t *testing.T) {
 			if nerdtest.IsDocker() {
 				helpers.Anyhow("buildx", "rm", data.Identifier("builder"))
 			}
-			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
 			if nerdtest.IsDocker() {
 				helpers.Anyhow("buildx", "create", "--name", data.Identifier("builder"), "--bootstrap", "--use")
 			}
 
-			dockerfile := fmt.Sprintf(`FROM %s`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Temp().Save(dockerfile, "Dockerfile")
+			data.Labels().Set("buildCtx", data.Temp().Path())
 		},
 		SubTests: []*test.Case{
 			{
 				Description: "SBOM",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					outputSBOMDir := helpers.T().TempDir()
-					data.Set("outputSBOMFile", filepath.Join(outputSBOMDir, testSBOMFileName))
-
 					cmd := helpers.Command("build")
 					if nerdtest.IsDocker() {
 						cmd.WithArgs("--builder", data.Identifier("builder"))
 					}
-					cmd.WithArgs("--sbom=true", "-o", fmt.Sprintf("type=local,dest=%s", outputSBOMDir), data.Get("buildCtx"))
+					cmd.WithArgs(
+						"--sbom=true",
+						"-o", fmt.Sprintf("type=local,dest=%s", data.Temp().Path("dir-for-bom")),
+						data.Labels().Get("buildCtx"),
+					)
 					return cmd
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: func(stdout string, info string, t *testing.T) {
-							_, err := os.Stat(data.Get("outputSBOMFile"))
-							assert.NilError(t, err, info)
+						Output: func(stdout, info string, t *testing.T) {
+							data.Temp().Exists("dir-for-bom", testSBOMFileName)
 						},
 					}
 				},
@@ -911,21 +897,21 @@ func TestBuildAttestation(t *testing.T) {
 			{
 				Description: "Provenance",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					outputProvenanceDir := data.TempDir()
-					data.Set("outputProvenanceFile", filepath.Join(outputProvenanceDir, testProvenanceFileName))
-
 					cmd := helpers.Command("build")
 					if nerdtest.IsDocker() {
 						cmd.WithArgs("--builder", data.Identifier("builder"))
 					}
-					cmd.WithArgs("--provenance=mode=min", "-o", fmt.Sprintf("type=local,dest=%s", outputProvenanceDir), data.Get("buildCtx"))
+					cmd.WithArgs(
+						"--provenance=mode=min",
+						"-o", fmt.Sprintf("type=local,dest=%s", data.Temp().Path("dir-for-prov")),
+						data.Labels().Get("buildCtx"),
+					)
 					return cmd
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: func(stdout string, info string, t *testing.T) {
-							_, err := os.Stat(data.Get("outputProvenanceFile"))
-							assert.NilError(t, err, info)
+						Output: func(stdout, info string, t *testing.T) {
+							data.Temp().Exists("dir-for-prov", testProvenanceFileName)
 						},
 					}
 				},
@@ -933,24 +919,23 @@ func TestBuildAttestation(t *testing.T) {
 			{
 				Description: "Attestation",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					outputAttestationDir := data.TempDir()
-					data.Set("outputSBOMFile", filepath.Join(outputAttestationDir, testSBOMFileName))
-					data.Set("outputProvenanceFile", filepath.Join(outputAttestationDir, testProvenanceFileName))
-
 					cmd := helpers.Command("build")
 					if nerdtest.IsDocker() {
 						cmd.WithArgs("--builder", data.Identifier("builder"))
 					}
-					cmd.WithArgs("--attest=type=provenance,mode=min", "--attest=type=sbom", "-o", fmt.Sprintf("type=local,dest=%s", outputAttestationDir), data.Get("buildCtx"))
+					cmd.WithArgs(
+						"--attest=type=provenance,mode=min",
+						"--attest=type=sbom",
+						"-o", fmt.Sprintf("type=local,dest=%s", data.Temp().Path("dir-for-attest")),
+						data.Labels().Get("buildCtx"),
+					)
 					return cmd
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: func(stdout string, info string, t *testing.T) {
-							_, err := os.Stat(data.Get("outputSBOMFile"))
-							assert.NilError(t, err, info)
-							_, err = os.Stat(data.Get("outputProvenanceFile"))
-							assert.NilError(t, err, info)
+						Output: func(stdout, info string, t *testing.T) {
+							data.Temp().Exists("dir-for-attest", testSBOMFileName)
+							data.Temp().Exists("dir-for-attest", testProvenanceFileName)
 						},
 					}
 				},
@@ -964,6 +949,11 @@ func TestBuildAttestation(t *testing.T) {
 func TestBuildAddHost(t *testing.T) {
 	nerdtest.Setup()
 
+	dockerfile := fmt.Sprintf(`FROM %s
+RUN ping -c 5 alpha
+RUN ping -c 5 beta
+`, testutil.CommonImage)
+
 	testCase := &test.Case{
 		Require: require.All(
 			nerdtest.Build,
@@ -972,19 +962,17 @@ func TestBuildAddHost(t *testing.T) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Setup: func(data test.Data, helpers test.Helpers) {
-			dockerfile := fmt.Sprintf(`FROM %s
-RUN ping -c 5 alpha
-RUN ping -c 5 beta
-`, testutil.CommonImage)
-			buildCtx := data.TempDir()
-			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Temp().Save(dockerfile, "Dockerfile")
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("build", data.Get("buildCtx"), "-t", data.Identifier(), "--add-host", "alpha:127.0.0.1", "--add-host", "beta:127.0.0.1")
-		},
-		Expected: test.Expects(0, nil, nil),
+			return helpers.Command(
+				"build", data.Temp().Path(),
+				"-t", data.Identifier(),
+				"--add-host", "alpha:127.0.0.1",
+				"--add-host", "beta:127.0.0.1",
+			)
+		},
+		Expected: test.Expects(expect.ExitCodeSuccess, nil, nil),
 	}
 
 	testCase.Run(t)
diff --git a/cmd/nerdctl/builder/builder_builder_test.go b/cmd/nerdctl/builder/builder_builder_test.go
index a049e566..fdbfa199 100644
--- a/cmd/nerdctl/builder/builder_builder_test.go
+++ b/cmd/nerdctl/builder/builder_builder_test.go
@@ -17,15 +17,11 @@
 package builder
 
 import (
-	"bytes"
 	"errors"
 	"fmt"
-	"os"
-	"path/filepath"
+	"strings"
 	"testing"
 
-	"gotest.tools/v3/assert"
-
 	"github.com/containerd/nerdctl/mod/tigron/require"
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
@@ -49,10 +45,8 @@ func TestBuilder(t *testing.T) {
 				Setup: func(data test.Data, helpers test.Helpers) {
 					dockerfile := fmt.Sprintf(`FROM %s
 CMD ["echo", "nerdctl-test-builder-prune"]`, testutil.CommonImage)
-					buildCtx := data.TempDir()
-					err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-					assert.NilError(helpers.T(), err)
-					helpers.Ensure("build", buildCtx)
+					data.Temp().Save(dockerfile, "Dockerfile")
+					helpers.Ensure("build", data.Temp().Path())
 				},
 				Command:  test.Command("builder", "prune", "--force"),
 				Expected: test.Expects(0, nil, nil),
@@ -63,10 +57,8 @@ CMD ["echo", "nerdctl-test-builder-prune"]`, testutil.CommonImage)
 				Setup: func(data test.Data, helpers test.Helpers) {
 					dockerfile := fmt.Sprintf(`FROM %s
 CMD ["echo", "nerdctl-test-builder-prune"]`, testutil.CommonImage)
-					buildCtx := data.TempDir()
-					err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-					assert.NilError(helpers.T(), err)
-					helpers.Ensure("build", buildCtx)
+					data.Temp().Save(dockerfile, "Dockerfile")
+					helpers.Ensure("build", data.Temp().Path())
 				},
 				Command:  test.Command("builder", "prune", "--force", "--all"),
 				Expected: test.Expects(0, nil, nil),
@@ -79,11 +71,9 @@ CMD ["echo", "nerdctl-test-builder-prune"]`, testutil.CommonImage)
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					dockerfile := fmt.Sprintf(`FROM %s
 CMD ["echo", "nerdctl-builder-debug-test-string"]`, testutil.CommonImage)
-					buildCtx := data.TempDir()
-					err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-					assert.NilError(helpers.T(), err)
-					cmd := helpers.Command("builder", "debug", buildCtx)
-					cmd.Feed(bytes.NewReader([]byte("c\n")))
+					data.Temp().Save(dockerfile, "Dockerfile")
+					cmd := helpers.Command("builder", "debug", data.Temp().Path())
+					cmd.Feed(strings.NewReader("c\n"))
 					return cmd
 				},
 				Expected: test.Expects(0, nil, nil),
@@ -103,13 +93,10 @@ CMD ["echo", "nerdctl-builder-debug-test-string"]`, testutil.CommonImage)
 					helpers.Ensure("tag", oldImage, newImage)
 
 					dockerfile := fmt.Sprintf(`FROM %s`, newImage)
-					buildCtx := data.TempDir()
-					err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
-					assert.NilError(helpers.T(), err)
-
-					data.Set("buildCtx", buildCtx)
-					data.Set("oldImageSha", oldImageSha)
-					data.Set("newImageSha", newImageSha)
+					data.Temp().Save(dockerfile, "Dockerfile")
+					data.Labels().Set("oldImageSha", oldImageSha)
+					data.Labels().Set("newImageSha", newImageSha)
+					data.Labels().Set("base", data.Temp().Dir())
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", testutil.AlpineImage)
@@ -119,11 +106,11 @@ CMD ["echo", "nerdctl-builder-debug-test-string"]`, testutil.CommonImage)
 						Description: "pull false",
 						NoParallel:  true,
 						Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-							return helpers.Command("build", data.Get("buildCtx"), "--pull=false")
+							return helpers.Command("build", data.Labels().Get("base"), "--pull=false")
 						},
 						Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 							return &test.Expected{
-								Errors: []error{errors.New(data.Get("oldImageSha"))},
+								Errors: []error{errors.New(data.Labels().Get("oldImageSha"))},
 							}
 						},
 					},
@@ -131,11 +118,11 @@ CMD ["echo", "nerdctl-builder-debug-test-string"]`, testutil.CommonImage)
 						Description: "pull true",
 						NoParallel:  true,
 						Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-							return helpers.Command("build", data.Get("buildCtx"), "--pull=true")
+							return helpers.Command("build", data.Labels().Get("base"), "--pull=true")
 						},
 						Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 							return &test.Expected{
-								Errors: []error{errors.New(data.Get("newImageSha"))},
+								Errors: []error{errors.New(data.Labels().Get("newImageSha"))},
 							}
 						},
 					},
@@ -143,11 +130,11 @@ CMD ["echo", "nerdctl-builder-debug-test-string"]`, testutil.CommonImage)
 						Description: "no pull",
 						NoParallel:  true,
 						Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-							return helpers.Command("build", data.Get("buildCtx"))
+							return helpers.Command("build", data.Labels().Get("base"))
 						},
 						Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 							return &test.Expected{
-								Errors: []error{errors.New(data.Get("newImageSha"))},
+								Errors: []error{errors.New(data.Labels().Get("newImageSha"))},
 							}
 						},
 					},
diff --git a/cmd/nerdctl/completion/completion_test.go b/cmd/nerdctl/completion/completion_test.go
index 23bdf833..bde281ab 100644
--- a/cmd/nerdctl/completion/completion_test.go
+++ b/cmd/nerdctl/completion/completion_test.go
@@ -41,7 +41,7 @@ func TestCompletion(t *testing.T) {
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 			helpers.Ensure("network", "create", identifier)
 			helpers.Ensure("volume", "create", identifier)
-			data.Set("identifier", identifier)
+			data.Labels().Set("identifier", identifier)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			identifier := data.Identifier()
@@ -93,7 +93,7 @@ func TestCompletion(t *testing.T) {
 					return &test.Expected{
 						Output: expect.All(
 							expect.Contains("host\n"),
-							expect.Contains(data.Get("identifier")+"\n"),
+							expect.Contains(data.Labels().Get("identifier")+"\n"),
 						),
 					}
 				},
@@ -105,7 +105,7 @@ func TestCompletion(t *testing.T) {
 					return &test.Expected{
 						Output: expect.All(
 							expect.Contains("host\n"),
-							expect.Contains(data.Get("identifier")+"\n"),
+							expect.Contains(data.Labels().Get("identifier")+"\n"),
 						),
 					}
 				},
@@ -117,7 +117,7 @@ func TestCompletion(t *testing.T) {
 					return &test.Expected{
 						Output: expect.All(
 							expect.Contains("host\n"),
-							expect.Contains(data.Get("identifier")+"\n"),
+							expect.Contains(data.Labels().Get("identifier")+"\n"),
 						),
 					}
 				},
@@ -134,7 +134,7 @@ func TestCompletion(t *testing.T) {
 					return &test.Expected{
 						Output: expect.All(
 							expect.DoesNotContain("host\n"),
-							expect.Contains(data.Get("identifier")+"\n"),
+							expect.Contains(data.Labels().Get("identifier")+"\n"),
 						),
 					}
 				},
@@ -153,7 +153,7 @@ func TestCompletion(t *testing.T) {
 				Command:     test.Command("__complete", "volume", "inspect", ""),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.Contains(data.Get("identifier") + "\n"),
+						Output: expect.Contains(data.Labels().Get("identifier") + "\n"),
 					}
 				},
 			},
@@ -162,7 +162,7 @@ func TestCompletion(t *testing.T) {
 				Command:     test.Command("__complete", "volume", "rm", ""),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.Contains(data.Get("identifier") + "\n"),
+						Output: expect.Contains(data.Labels().Get("identifier") + "\n"),
 					}
 				},
 			},
diff --git a/cmd/nerdctl/container/container_commit_linux_test.go b/cmd/nerdctl/container/container_commit_linux_test.go
index 8da0ee01..e1a167c0 100644
--- a/cmd/nerdctl/container/container_commit_linux_test.go
+++ b/cmd/nerdctl/container/container_commit_linux_test.go
@@ -45,7 +45,7 @@ func TestKubeCommitSave(t *testing.T) {
 				containerID = strings.TrimPrefix(stdout, "containerd://")
 			},
 		})
-		data.Set("containerID", containerID)
+		data.Labels().Set("containerID", containerID)
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -53,7 +53,7 @@ func TestKubeCommitSave(t *testing.T) {
 	}
 
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
-		helpers.Ensure("commit", data.Get("containerID"), "testcommitsave")
+		helpers.Ensure("commit", data.Labels().Get("containerID"), "testcommitsave")
 		return helpers.Command("save", "testcommitsave")
 	}
 
diff --git a/cmd/nerdctl/container/container_create_linux_test.go b/cmd/nerdctl/container/container_create_linux_test.go
index 0a20ddac..3ea83d8a 100644
--- a/cmd/nerdctl/container/container_create_linux_test.go
+++ b/cmd/nerdctl/container/container_create_linux_test.go
@@ -199,7 +199,7 @@ func TestIssue2993(t *testing.T) {
 		{
 			Description: "Issue #2993 - nerdctl no longer leaks containers and etchosts directories and files when container creation fails.",
 			Setup: func(data test.Data, helpers test.Helpers) {
-				dataRoot := data.TempDir()
+				dataRoot := data.Temp().Path()
 
 				helpers.Ensure("run", "--data-root", dataRoot, "--name", data.Identifier(), "-d", testutil.AlpineImage, "sleep", nerdtest.Infinity)
 
@@ -218,25 +218,25 @@ func TestIssue2993(t *testing.T) {
 				assert.NilError(t, err)
 				assert.Equal(t, len(etchostsDirs), 1)
 
-				data.Set(containersPathKey, containersPath)
-				data.Set(etchostsPathKey, etchostsPath)
+				data.Labels().Set(containersPathKey, containersPath)
+				data.Labels().Set(etchostsPathKey, etchostsPath)
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				helpers.Anyhow("rm", "--data-root", data.TempDir(), "-f", data.Identifier())
+				helpers.Anyhow("rm", "--data-root", data.Temp().Path(), "-f", data.Identifier())
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--data-root", data.TempDir(), "--name", data.Identifier(), "-d", testutil.AlpineImage, "sleep", nerdtest.Infinity)
+				return helpers.Command("run", "--data-root", data.Temp().Path(), "--name", data.Identifier(), "-d", testutil.AlpineImage, "sleep", nerdtest.Infinity)
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: 1,
 					Errors:   []error{errors.New("is already used by ID")},
 					Output: func(stdout string, info string, t *testing.T) {
-						containersDirs, err := os.ReadDir(data.Get(containersPathKey))
+						containersDirs, err := os.ReadDir(data.Labels().Get(containersPathKey))
 						assert.NilError(t, err)
 						assert.Equal(t, len(containersDirs), 1)
 
-						etchostsDirs, err := os.ReadDir(data.Get(etchostsPathKey))
+						etchostsDirs, err := os.ReadDir(data.Labels().Get(etchostsPathKey))
 						assert.NilError(t, err)
 						assert.Equal(t, len(etchostsDirs), 1)
 					},
@@ -246,7 +246,7 @@ func TestIssue2993(t *testing.T) {
 		{
 			Description: "Issue #2993 - nerdctl no longer leaks containers and etchosts directories and files when containers are removed.",
 			Setup: func(data test.Data, helpers test.Helpers) {
-				dataRoot := data.TempDir()
+				dataRoot := data.Temp().Path()
 
 				helpers.Ensure("run", "--data-root", dataRoot, "--name", data.Identifier(), "-d", testutil.AlpineImage, "sleep", nerdtest.Infinity)
 
@@ -265,25 +265,25 @@ func TestIssue2993(t *testing.T) {
 				assert.NilError(t, err)
 				assert.Equal(t, len(etchostsDirs), 1)
 
-				data.Set(containersPathKey, containersPath)
-				data.Set(etchostsPathKey, etchostsPath)
+				data.Labels().Set(containersPathKey, containersPath)
+				data.Labels().Set(etchostsPathKey, etchostsPath)
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				helpers.Anyhow("--data-root", data.TempDir(), "rm", "-f", data.Identifier())
+				helpers.Anyhow("--data-root", data.Temp().Path(), "rm", "-f", data.Identifier())
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("--data-root", data.TempDir(), "rm", "-f", data.Identifier())
+				return helpers.Command("--data-root", data.Temp().Path(), "rm", "-f", data.Identifier())
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: 0,
 					Errors:   []error{},
 					Output: func(stdout string, info string, t *testing.T) {
-						containersDirs, err := os.ReadDir(data.Get(containersPathKey))
+						containersDirs, err := os.ReadDir(data.Labels().Get(containersPathKey))
 						assert.NilError(t, err)
 						assert.Equal(t, len(containersDirs), 0)
 
-						etchostsDirs, err := os.ReadDir(data.Get(etchostsPathKey))
+						etchostsDirs, err := os.ReadDir(data.Labels().Get(etchostsPathKey))
 						assert.NilError(t, err)
 						assert.Equal(t, len(etchostsDirs), 0)
 					},
diff --git a/cmd/nerdctl/container/container_create_test.go b/cmd/nerdctl/container/container_create_test.go
index 8b507d37..f10536ee 100644
--- a/cmd/nerdctl/container/container_create_test.go
+++ b/cmd/nerdctl/container/container_create_test.go
@@ -35,7 +35,7 @@ func TestCreate(t *testing.T) {
 	testCase := nerdtest.Setup()
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		helpers.Ensure("create", "--name", data.Identifier("container"), testutil.CommonImage, "echo", "foo")
-		data.Set("cID", data.Identifier("container"))
+		data.Labels().Set("cID", data.Identifier("container"))
 	}
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
 		helpers.Anyhow("rm", "-f", data.Identifier("container"))
@@ -55,7 +55,7 @@ func TestCreate(t *testing.T) {
 			Description: "start",
 			NoParallel:  true,
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("start", data.Get("cID"))
+				return helpers.Command("start", data.Labels().Get("cID"))
 			},
 			Expected: test.Expects(0, nil, nil),
 		},
@@ -63,7 +63,7 @@ func TestCreate(t *testing.T) {
 			Description: "logs",
 			NoParallel:  true,
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("logs", data.Get("cID"))
+				return helpers.Command("logs", data.Labels().Get("cID"))
 			},
 			Expected: test.Expects(0, nil, expect.Contains("foo")),
 		},
@@ -79,7 +79,7 @@ func TestCreateHyperVContainer(t *testing.T) {
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		helpers.Ensure("create", "--isolation", "hyperv", "--name", data.Identifier("container"), testutil.CommonImage, "echo", "foo")
-		data.Set("cID", data.Identifier("container"))
+		data.Labels().Set("cID", data.Identifier("container"))
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -98,10 +98,10 @@ func TestCreateHyperVContainer(t *testing.T) {
 			Description: "start",
 			NoParallel:  true,
 			Setup: func(data test.Data, helpers test.Helpers) {
-				helpers.Ensure("start", data.Get("cID"))
+				helpers.Ensure("start", data.Labels().Get("cID"))
 				ran := false
 				for i := 0; i < 10 && !ran; i++ {
-					helpers.Command("container", "inspect", data.Get("cID")).
+					helpers.Command("container", "inspect", data.Labels().Get("cID")).
 						Run(&test.Expected{
 							ExitCode: expect.ExitCodeNoCheck,
 							Output: func(stdout string, info string, t *testing.T) {
@@ -119,7 +119,7 @@ func TestCreateHyperVContainer(t *testing.T) {
 				assert.Assert(t, ran, "container did not ran after 10 seconds")
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("logs", data.Get("cID"))
+				return helpers.Command("logs", data.Labels().Get("cID"))
 			},
 			Expected: test.Expects(0, nil, expect.Contains("foo")),
 		},
diff --git a/cmd/nerdctl/container/container_exec_linux_test.go b/cmd/nerdctl/container/container_exec_linux_test.go
index c5624085..5ff812d9 100644
--- a/cmd/nerdctl/container/container_exec_linux_test.go
+++ b/cmd/nerdctl/container/container_exec_linux_test.go
@@ -65,14 +65,14 @@ func TestExecTTY(t *testing.T) {
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage, "sleep", nerdtest.Infinity)
-		data.Set("container_name", data.Identifier())
+		data.Labels().Set("container_name", data.Identifier())
 	}
 
 	testCase.SubTests = []*test.Case{
 		{
 			Description: "stty with -it",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				cmd := helpers.Command("exec", "-it", data.Get("container_name"), "stty")
+				cmd := helpers.Command("exec", "-it", data.Labels().Get("container_name"), "stty")
 				cmd.WithPseudoTTY()
 				return cmd
 			},
@@ -81,7 +81,7 @@ func TestExecTTY(t *testing.T) {
 		{
 			Description: "stty with -t",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				cmd := helpers.Command("exec", "-t", data.Get("container_name"), "stty")
+				cmd := helpers.Command("exec", "-t", data.Labels().Get("container_name"), "stty")
 				cmd.WithPseudoTTY()
 				return cmd
 			},
@@ -90,7 +90,7 @@ func TestExecTTY(t *testing.T) {
 		{
 			Description: "stty with -i",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				cmd := helpers.Command("exec", "-i", data.Get("container_name"), "stty")
+				cmd := helpers.Command("exec", "-i", data.Labels().Get("container_name"), "stty")
 				cmd.WithPseudoTTY()
 				return cmd
 			},
@@ -99,7 +99,7 @@ func TestExecTTY(t *testing.T) {
 		{
 			Description: "stty without params",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				cmd := helpers.Command("exec", data.Get("container_name"), "stty")
+				cmd := helpers.Command("exec", data.Labels().Get("container_name"), "stty")
 				cmd.WithPseudoTTY()
 				return cmd
 			},
diff --git a/cmd/nerdctl/container/container_inspect_linux_test.go b/cmd/nerdctl/container/container_inspect_linux_test.go
index c03a0a47..b070359f 100644
--- a/cmd/nerdctl/container/container_inspect_linux_test.go
+++ b/cmd/nerdctl/container/container_inspect_linux_test.go
@@ -531,10 +531,10 @@ RUN groupadd -r test && useradd -r -g test test
 USER test
 `, testutil.UbuntuImage)
 
-			err := os.WriteFile(filepath.Join(data.TempDir(), "Dockerfile"), []byte(dockerfile), 0o600)
+			err := os.WriteFile(filepath.Join(data.Temp().Path(), "Dockerfile"), []byte(dockerfile), 0o600)
 			assert.NilError(helpers.T(), err)
 
-			helpers.Ensure("build", "-t", data.Identifier(), data.TempDir())
+			helpers.Ensure("build", "-t", data.Identifier(), data.Temp().Path())
 			helpers.Ensure("create", "--name", data.Identifier(), "--user", "test", data.Identifier())
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
diff --git a/cmd/nerdctl/container/container_restart_linux_test.go b/cmd/nerdctl/container/container_restart_linux_test.go
index 95b40409..55996bcb 100644
--- a/cmd/nerdctl/container/container_restart_linux_test.go
+++ b/cmd/nerdctl/container/container_restart_linux_test.go
@@ -136,7 +136,7 @@ func TestRestartWithSignal(t *testing.T) {
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
 		cmd := nerdtest.RunSigProxyContainer(nerdtest.SigUsr1, false, nil, data, helpers)
 		// Capture the current pid
-		data.Set("oldpid", strconv.Itoa(nerdtest.InspectContainer(helpers, data.Identifier()).State.Pid))
+		data.Labels().Set("oldpid", strconv.Itoa(nerdtest.InspectContainer(helpers, data.Identifier()).State.Pid))
 		// Send the signal
 		helpers.Ensure("restart", "--signal", "SIGUSR1", data.Identifier())
 		return cmd
@@ -154,7 +154,7 @@ func TestRestartWithSignal(t *testing.T) {
 					nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 					// Check the new pid is different
 					newpid := strconv.Itoa(nerdtest.InspectContainer(helpers, data.Identifier()).State.Pid)
-					assert.Assert(helpers.T(), newpid != data.Get("oldpid"), info)
+					assert.Assert(helpers.T(), newpid != data.Labels().Get("oldpid"), info)
 				},
 			),
 		}
diff --git a/cmd/nerdctl/container/container_run_cgroup_linux_test.go b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
index 2e1fce34..aaef1b02 100644
--- a/cmd/nerdctl/container/container_run_cgroup_linux_test.go
+++ b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
@@ -242,7 +242,7 @@ func TestRunDevice(t *testing.T) {
 			t.Logf("lo[%d] = %+v", i, lo[i])
 			loContent := fmt.Sprintf("lo%d-content", i)
 			assert.NilError(t, os.WriteFile(lo[i].Device, []byte(loContent), 0o700))
-			data.Set("loContent"+strconv.Itoa(i), loContent)
+			data.Labels().Set("loContent"+strconv.Itoa(i), loContent)
 		}
 
 		// lo0 is readable but not writable.
@@ -254,7 +254,7 @@ func TestRunDevice(t *testing.T) {
 			"--device", lo[0].Device+":r",
 			"--device", lo[1].Device,
 			testutil.AlpineImage, "sleep", nerdtest.Infinity)
-		data.Set("id", data.Identifier())
+		data.Labels().Set("id", data.Identifier())
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -270,25 +270,25 @@ func TestRunDevice(t *testing.T) {
 		{
 			Description: "can read lo0",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("exec", data.Get("id"), "cat", lo[0].Device)
+				return helpers.Command("exec", data.Labels().Get("id"), "cat", lo[0].Device)
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: expect.Contains(data.Get("locontent0")),
+					Output: expect.Contains(data.Labels().Get("locontent0")),
 				}
 			},
 		},
 		{
 			Description: "cannot write lo0",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("exec", data.Get("id"), "sh", "-ec", "echo -n \"overwritten-lo1-content\">"+lo[0].Device)
+				return helpers.Command("exec", data.Labels().Get("id"), "sh", "-ec", "echo -n \"overwritten-lo1-content\">"+lo[0].Device)
 			},
 			Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 		},
 		{
 			Description: "cannot read lo2",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("exec", data.Get("id"), "cat", lo[2].Device)
+				return helpers.Command("exec", data.Labels().Get("id"), "cat", lo[2].Device)
 			},
 			Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 		},
@@ -296,11 +296,11 @@ func TestRunDevice(t *testing.T) {
 			Description: "can read lo1",
 			NoParallel:  true,
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("exec", data.Get("id"), "cat", lo[1].Device)
+				return helpers.Command("exec", data.Labels().Get("id"), "cat", lo[1].Device)
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: expect.Contains(data.Get("locontent1")),
+					Output: expect.Contains(data.Labels().Get("locontent1")),
 				}
 			},
 		},
@@ -308,7 +308,7 @@ func TestRunDevice(t *testing.T) {
 			Description: "can write lo1 and read back updated value",
 			NoParallel:  true,
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("exec", data.Get("id"), "sh", "-ec", "echo -n \"overwritten-lo1-content\">"+lo[1].Device)
+				return helpers.Command("exec", data.Labels().Get("id"), "sh", "-ec", "echo -n \"overwritten-lo1-content\">"+lo[1].Device)
 			},
 			Expected: test.Expects(expect.ExitCodeSuccess, nil, func(stdout string, info string, t *testing.T) {
 				lo1Read, err := os.ReadFile(lo[1].Device)
@@ -668,3 +668,39 @@ func TestRunBlkioSettingCgroupV2(t *testing.T) {
 
 	testCase.Run(t)
 }
+
+func TestRunCPURealTimeSettingCgroupV1(t *testing.T) {
+	nerdtest.Setup()
+
+	testCase := &test.Case{
+		Description: "cpu-rt-runtime-and-period",
+		Require: require.All(
+			require.Not(nerdtest.CGroupV2),
+			nerdtest.Rootful,
+		),
+		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+			return helpers.Command("create", "--name", data.Identifier(),
+				"--cpu-rt-runtime", "950000",
+				"--cpu-rt-period", "1000000",
+				testutil.AlpineImage, "sleep", "infinity")
+		},
+		Cleanup: func(data test.Data, helpers test.Helpers) {
+			helpers.Anyhow("rm", "-f", data.Identifier())
+		},
+		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+			return &test.Expected{
+				ExitCode: 0,
+				Output: expect.All(
+					func(stdout string, info string, t *testing.T) {
+						rtRuntime := helpers.Capture("inspect", "--format", "{{.HostConfig.CPURealtimeRuntime}}", data.Identifier())
+						rtPeriod := helpers.Capture("inspect", "--format", "{{.HostConfig.CPURealtimePeriod}}", data.Identifier())
+						assert.Assert(t, strings.Contains(rtRuntime, "950000"))
+						assert.Assert(t, strings.Contains(rtPeriod, "1000000"))
+					},
+				),
+			}
+		},
+	}
+
+	testCase.Run(t)
+}
diff --git a/cmd/nerdctl/container/container_run_network_linux_test.go b/cmd/nerdctl/container/container_run_network_linux_test.go
index e275669f..853e14e8 100644
--- a/cmd/nerdctl/container/container_run_network_linux_test.go
+++ b/cmd/nerdctl/container/container_run_network_linux_test.go
@@ -363,10 +363,10 @@ func TestRunWithInvalidPortThenCleanUp(t *testing.T) {
 		{
 			Description: "Run a container with invalid ports, and then clean up.",
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				helpers.Anyhow("rm", "--data-root", data.TempDir(), "-f", data.Identifier())
+				helpers.Anyhow("rm", "--data-root", data.Temp().Path(), "-f", data.Identifier())
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--data-root", data.TempDir(), "--rm", "--name", data.Identifier(), "-p", "22200-22299:22200-22299", testutil.CommonImage)
+				return helpers.Command("run", "--data-root", data.Temp().Path(), "--rm", "--name", data.Identifier(), "-p", "22200-22299:22200-22299", testutil.CommonImage)
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -382,7 +382,7 @@ func TestRunWithInvalidPortThenCleanUp(t *testing.T) {
 							return h
 						}
 
-						dataRoot := data.TempDir()
+						dataRoot := data.Temp().Path()
 						h := getAddrHash(defaults.DefaultAddress)
 						dataStore := filepath.Join(dataRoot, h)
 						namespace := string(helpers.Read(nerdtest.Namespace))
@@ -519,8 +519,8 @@ func TestSharedNetworkSetup(t *testing.T) {
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
-			data.Set("containerName1", data.Identifier("-container1"))
-			containerName1 := data.Get("containerName1")
+			data.Labels().Set("containerName1", data.Identifier("-container1"))
+			containerName1 := data.Labels().Get("containerName1")
 			helpers.Ensure("run", "-d", "--name", containerName1,
 				testutil.NginxAlpineImage)
 		},
@@ -538,7 +538,7 @@ func TestSharedNetworkSetup(t *testing.T) {
 					containerName2 := data.Identifier()
 					cmd := helpers.Command()
 					cmd.WithArgs("run", "-d", "--name", containerName2,
-						"--network=container:"+data.Get("containerName1"),
+						"--network=container:"+data.Labels().Get("containerName1"),
 						testutil.NginxAlpineImage)
 					return cmd
 				},
@@ -547,7 +547,7 @@ func TestSharedNetworkSetup(t *testing.T) {
 						Output: func(stdout string, info string, t *testing.T) {
 							containerName2 := data.Identifier()
 							assert.Assert(t, strings.Contains(helpers.Capture("exec", containerName2, "wget", "-qO-", "http://127.0.0.1:80"), testutil.NginxAlpineIndexHTMLSnippet), info)
-							helpers.Ensure("restart", data.Get("containerName1"))
+							helpers.Ensure("restart", data.Labels().Get("containerName1"))
 							helpers.Ensure("stop", "--time=1", containerName2)
 							helpers.Ensure("start", containerName2)
 							assert.Assert(t, strings.Contains(helpers.Capture("exec", containerName2, "wget", "-qO-", "http://127.0.0.1:80"), testutil.NginxAlpineIndexHTMLSnippet), info)
@@ -564,7 +564,7 @@ func TestSharedNetworkSetup(t *testing.T) {
 					containerName2 := data.Identifier()
 					cmd := helpers.Command()
 					cmd.WithArgs("run", "-d", "--name", containerName2, "--uts", "host",
-						"--network=container:"+data.Get("containerName1"),
+						"--network=container:"+data.Labels().Get("containerName1"),
 						testutil.AlpineImage)
 					return cmd
 				},
@@ -583,7 +583,7 @@ func TestSharedNetworkSetup(t *testing.T) {
 					containerName2 := data.Identifier()
 					cmd := helpers.Command()
 					cmd.WithArgs("run", "-d", "--name", containerName2, "--dns", "0.1.2.3",
-						"--network=container:"+data.Get("containerName1"),
+						"--network=container:"+data.Labels().Get("containerName1"),
 						testutil.AlpineImage)
 					return cmd
 				},
@@ -608,7 +608,7 @@ func TestSharedNetworkSetup(t *testing.T) {
 					containerName2 := data.Identifier()
 					cmd := helpers.Command()
 					cmd.WithArgs("run", "--name", containerName2, "--dns-option", "attempts:5",
-						"--network=container:"+data.Get("containerName1"),
+						"--network=container:"+data.Labels().Get("containerName1"),
 						testutil.AlpineImage, "cat", "/etc/resolv.conf")
 					return cmd
 				},
@@ -631,7 +631,7 @@ func TestSharedNetworkSetup(t *testing.T) {
 					containerName2 := data.Identifier()
 					cmd := helpers.Command()
 					cmd.WithArgs("run", "-d", "--name", containerName2, "--publish", "80:8080",
-						"--network=container:"+data.Get("containerName1"),
+						"--network=container:"+data.Labels().Get("containerName1"),
 						testutil.AlpineImage)
 					return cmd
 				},
@@ -656,7 +656,7 @@ func TestSharedNetworkSetup(t *testing.T) {
 					containerName2 := data.Identifier()
 					cmd := helpers.Command()
 					cmd.WithArgs("run", "-d", "--name", containerName2, "--hostname", "test",
-						"--network=container:"+data.Get("containerName1"),
+						"--network=container:"+data.Labels().Get("containerName1"),
 						testutil.AlpineImage)
 					return cmd
 				},
@@ -682,19 +682,19 @@ func TestSharedNetworkWithNone(t *testing.T) {
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
-			data.Set("containerName1", data.Identifier("-container1"))
-			containerName1 := data.Get("containerName1")
+			data.Labels().Set("containerName1", data.Identifier("-container1"))
+			containerName1 := data.Labels().Get("containerName1")
 			helpers.Ensure("run", "-d", "--name", containerName1, "--network", "none",
 				testutil.NginxAlpineImage)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
-			helpers.Anyhow("rm", "-f", data.Get("containerName1"))
+			helpers.Anyhow("rm", "-f", data.Labels().Get("containerName1"))
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			containerName2 := data.Identifier()
 			cmd := helpers.Command()
 			cmd.WithArgs("run", "-d", "--name", containerName2,
-				"--network=container:"+data.Get("containerName1"),
+				"--network=container:"+data.Labels().Get("containerName1"),
 				testutil.NginxAlpineImage)
 			return cmd
 		},
@@ -927,7 +927,7 @@ func TestNoneNetworkHostName(t *testing.T) {
 		Setup: func(data test.Data, helpers test.Helpers) {
 			output := helpers.Capture("run", "-d", "--name", data.Identifier(), "--network", "none", testutil.NginxAlpineImage)
 			assert.Assert(helpers.T(), len(output) > 12, output)
-			data.Set("hostname", output[:12])
+			data.Labels().Set("hostname", output[:12])
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rm", "-f", data.Identifier())
@@ -937,7 +937,7 @@ func TestNoneNetworkHostName(t *testing.T) {
 		},
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
-				Output: expect.Equals(data.Get("hostname") + "\n"),
+				Output: expect.Equals(data.Labels().Get("hostname") + "\n"),
 			}
 		},
 	}
@@ -949,7 +949,7 @@ func TestHostNetworkHostName(t *testing.T) {
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
-			data.Set("containerName1", data.Identifier())
+			data.Labels().Set("containerName1", data.Identifier())
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rm", "-f", data.Identifier())
@@ -974,7 +974,7 @@ func TestNoneNetworkDnsConfigs(t *testing.T) {
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
-			data.Set("containerName1", data.Identifier())
+			data.Labels().Set("containerName1", data.Identifier())
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rm", "-f", data.Identifier())
@@ -1003,7 +1003,7 @@ func TestHostNetworkDnsConfigs(t *testing.T) {
 	testCase := &test.Case{
 		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
-			data.Set("containerName1", data.Identifier())
+			data.Labels().Set("containerName1", data.Identifier())
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rm", "-f", data.Identifier())
diff --git a/cmd/nerdctl/container/container_stats_test.go b/cmd/nerdctl/container/container_stats_test.go
index 0648d502..59132d15 100644
--- a/cmd/nerdctl/container/container_stats_test.go
+++ b/cmd/nerdctl/container/container_stats_test.go
@@ -53,7 +53,7 @@ func TestStats(t *testing.T) {
 		helpers.Ensure("run", "-d", "--name", data.Identifier("container"), testutil.CommonImage, "sleep", nerdtest.Infinity)
 		helpers.Ensure("run", "-d", "--name", data.Identifier("memlimited"), "--memory", "1g", testutil.CommonImage, "sleep", nerdtest.Infinity)
 		helpers.Ensure("run", "--name", data.Identifier("exited"), testutil.CommonImage, "echo", "'exited'")
-		data.Set("id", data.Identifier("container"))
+		data.Labels().Set("id", data.Identifier("container"))
 	}
 
 	testCase.SubTests = []*test.Case{
@@ -62,7 +62,7 @@ func TestStats(t *testing.T) {
 			Command:     test.Command("stats", "--no-stream", "--no-trunc"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: expect.Contains(data.Get("id")),
+					Output: expect.Contains(data.Labels().Get("id")),
 				}
 			},
 		},
@@ -71,21 +71,21 @@ func TestStats(t *testing.T) {
 			Command:     test.Command("container", "stats", "--no-stream", "--no-trunc"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: expect.Contains(data.Get("id")),
+					Output: expect.Contains(data.Labels().Get("id")),
 				}
 			},
 		},
 		{
 			Description: "stats ID",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("stats", "--no-stream", data.Get("id"))
+				return helpers.Command("stats", "--no-stream", data.Labels().Get("id"))
 			},
 			Expected: test.Expects(0, nil, nil),
 		},
 		{
 			Description: "container stats ID",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("container", "stats", "--no-stream", data.Get("id"))
+				return helpers.Command("container", "stats", "--no-stream", data.Labels().Get("id"))
 			},
 			Expected: test.Expects(0, nil, nil),
 		},
diff --git a/cmd/nerdctl/container/container_top_test.go b/cmd/nerdctl/container/container_top_test.go
index 6f18721b..e63d71f4 100644
--- a/cmd/nerdctl/container/container_top_test.go
+++ b/cmd/nerdctl/container/container_top_test.go
@@ -38,7 +38,7 @@ func TestTop(t *testing.T) {
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		// FIXME: busybox 1.36 on windows still appears to not support sleep inf. Unclear why.
 		helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage, "sleep", nerdtest.Infinity)
-		data.Set("cID", data.Identifier())
+		data.Labels().Set("cID", data.Identifier())
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -51,7 +51,7 @@ func TestTop(t *testing.T) {
 			// Docker does not support top -o
 			Require: require.Not(nerdtest.Docker),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("top", data.Get("cID"), "-o", "pid,user,cmd")
+				return helpers.Command("top", data.Labels().Get("cID"), "-o", "pid,user,cmd")
 			},
 
 			Expected: test.Expects(0, nil, nil),
@@ -59,7 +59,7 @@ func TestTop(t *testing.T) {
 		{
 			Description: "simple",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("top", data.Get("cID"))
+				return helpers.Command("top", data.Labels().Get("cID"))
 			},
 
 			Expected: test.Expects(0, nil, nil),
diff --git a/cmd/nerdctl/image/image_convert_linux_test.go b/cmd/nerdctl/image/image_convert_linux_test.go
index 3d261574..b26358ec 100644
--- a/cmd/nerdctl/image/image_convert_linux_test.go
+++ b/cmd/nerdctl/image/image_convert_linux_test.go
@@ -115,16 +115,16 @@ func TestImageConvertNydusVerify(t *testing.T) {
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 			base := testutil.NewBase(t)
 			registry = testregistry.NewWithNoAuth(base, 0, false)
-			data.Set(remoteImageKey, fmt.Sprintf("%s:%d/nydusd-image:test", "localhost", registry.Port))
+			data.Labels().Set(remoteImageKey, fmt.Sprintf("%s:%d/nydusd-image:test", "localhost", registry.Port))
 			helpers.Ensure("image", "convert", "--nydus", "--oci", testutil.CommonImage, data.Identifier("converted-image"))
-			helpers.Ensure("tag", data.Identifier("converted-image"), data.Get(remoteImageKey))
-			helpers.Ensure("push", data.Get(remoteImageKey))
+			helpers.Ensure("tag", data.Identifier("converted-image"), data.Labels().Get(remoteImageKey))
+			helpers.Ensure("push", data.Labels().Get(remoteImageKey))
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier("converted-image"))
 			if registry != nil {
 				registry.Cleanup(nil)
-				helpers.Anyhow("rmi", "-f", data.Get(remoteImageKey))
+				helpers.Anyhow("rmi", "-f", data.Labels().Get(remoteImageKey))
 			}
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
@@ -133,7 +133,7 @@ func TestImageConvertNydusVerify(t *testing.T) {
 				"--source",
 				testutil.CommonImage,
 				"--target",
-				data.Get(remoteImageKey),
+				data.Labels().Get(remoteImageKey),
 				"--source-insecure",
 				"--target-insecure",
 			)
diff --git a/cmd/nerdctl/image/image_encrypt_linux_test.go b/cmd/nerdctl/image/image_encrypt_linux_test.go
index ac883133..f8d34dc0 100644
--- a/cmd/nerdctl/image/image_encrypt_linux_test.go
+++ b/cmd/nerdctl/image/image_encrypt_linux_test.go
@@ -51,7 +51,7 @@ func TestImageEncryptJWE(t *testing.T) {
 			if registry != nil {
 				registry.Cleanup(nil)
 				keyPair.Cleanup()
-				helpers.Anyhow("rmi", "-f", data.Get(remoteImageKey))
+				helpers.Anyhow("rmi", "-f", data.Labels().Get(remoteImageKey))
 			}
 			helpers.Anyhow("rmi", "-f", data.Identifier("decrypted"))
 		},
@@ -69,13 +69,13 @@ func TestImageEncryptJWE(t *testing.T) {
 			helpers.Ensure("push", encryptImageRef)
 			helpers.Anyhow("rmi", "-f", encryptImageRef)
 			helpers.Anyhow("rmi", "-f", testutil.CommonImage)
-			data.Set(remoteImageKey, encryptImageRef)
+			data.Labels().Set(remoteImageKey, encryptImageRef)
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			helpers.Fail("pull", data.Get(remoteImageKey))
-			helpers.Ensure("pull", "--quiet", "--unpack=false", data.Get(remoteImageKey))
-			helpers.Fail("image", "decrypt", "--key="+keyPair.Pub, data.Get(remoteImageKey), data.Identifier("decrypted")) // decryption needs prv key, not pub key
-			return helpers.Command("image", "decrypt", "--key="+keyPair.Prv, data.Get(remoteImageKey), data.Identifier("decrypted"))
+			helpers.Fail("pull", data.Labels().Get(remoteImageKey))
+			helpers.Ensure("pull", "--quiet", "--unpack=false", data.Labels().Get(remoteImageKey))
+			helpers.Fail("image", "decrypt", "--key="+keyPair.Pub, data.Labels().Get(remoteImageKey), data.Identifier("decrypted")) // decryption needs prv key, not pub key
+			return helpers.Command("image", "decrypt", "--key="+keyPair.Prv, data.Labels().Get(remoteImageKey), data.Identifier("decrypted"))
 		},
 		Expected: test.Expects(0, nil, nil),
 	}
diff --git a/cmd/nerdctl/image/image_history_test.go b/cmd/nerdctl/image/image_history_test.go
index 699a7cf6..1281c00f 100644
--- a/cmd/nerdctl/image/image_history_test.go
+++ b/cmd/nerdctl/image/image_history_test.go
@@ -83,7 +83,7 @@ func TestImageHistory(t *testing.T) {
 			// XXX: despite efforts to isolate this test, it keeps on having side effects linked to
 			// https://github.com/containerd/nerdctl/issues/3512
 			// Isolating it into a completely different root is the last ditched attempt at avoiding the issue
-			helpers.Write(nerdtest.DataRoot, test.ConfigValue(data.TempDir()))
+			helpers.Write(nerdtest.DataRoot, test.ConfigValue(data.Temp().Path()))
 			helpers.Ensure("pull", "--quiet", "--platform", "linux/arm64", testutil.CommonImage)
 		},
 		SubTests: []*test.Case{
diff --git a/cmd/nerdctl/image/image_list_test.go b/cmd/nerdctl/image/image_list_test.go
index 8956d2d9..a1db81ee 100644
--- a/cmd/nerdctl/image/image_list_test.go
+++ b/cmd/nerdctl/image/image_list_test.go
@@ -148,10 +148,10 @@ LABEL foo=bar
 LABEL version=0.1
 RUN echo "actually creating a layer so that docker sets the createdAt time"
 `, testutil.CommonImage)
-			buildCtx := data.TempDir()
+			buildCtx := data.Temp().Path()
 			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Labels().Set("buildCtx", buildCtx)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", "taggedimage:one-fragment-one")
@@ -159,8 +159,8 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			data.Set("builtImageID", data.Identifier())
-			return helpers.Command("build", "-t", data.Identifier(), data.Get("buildCtx"))
+			data.Labels().Set("builtImageID", data.Identifier())
+			return helpers.Command("build", "-t", data.Identifier(), data.Labels().Get("buildCtx"))
 		},
 		Expected: test.Expects(0, nil, nil),
 		SubTests: []*test.Case{
@@ -169,7 +169,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", "label=foo=bar"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.Contains(data.Get("builtImageID")),
+						Output: expect.Contains(data.Labels().Get("builtImageID")),
 					}
 				},
 			},
@@ -178,7 +178,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", "label=foo=bar1"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.DoesNotContain(data.Get("builtImageID")),
+						Output: expect.DoesNotContain(data.Labels().Get("builtImageID")),
 					}
 				},
 			},
@@ -187,7 +187,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", "label=foo=bar", "--filter", "label=version=0.1"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.Contains(data.Get("builtImageID")),
+						Output: expect.Contains(data.Labels().Get("builtImageID")),
 					}
 				},
 			},
@@ -196,7 +196,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", "label=foo=bar", "--filter", "label=version=0.2"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.DoesNotContain(data.Get("builtImageID")),
+						Output: expect.DoesNotContain(data.Labels().Get("builtImageID")),
 					}
 				},
 			},
@@ -205,18 +205,18 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", "label=version"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.Contains(data.Get("builtImageID")),
+						Output: expect.Contains(data.Labels().Get("builtImageID")),
 					}
 				},
 			},
 			{
 				Description: "reference=ID*",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("images", "--filter", fmt.Sprintf("reference=%s*", data.Get("builtImageID")))
+					return helpers.Command("images", "--filter", fmt.Sprintf("reference=%s*", data.Labels().Get("builtImageID")))
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: expect.Contains(data.Get("builtImageID")),
+						Output: expect.Contains(data.Labels().Get("builtImageID")),
 					}
 				},
 			},
@@ -231,13 +231,13 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 			{
 				Description: "before=ID:latest",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("images", "--filter", fmt.Sprintf("before=%s:latest", data.Get("builtImageID")))
+					return helpers.Command("images", "--filter", fmt.Sprintf("before=%s:latest", data.Labels().Get("builtImageID")))
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
 						Output: expect.All(
 							expect.Contains(testutil.ImageRepo(testutil.CommonImage)),
-							expect.DoesNotContain(data.Get("builtImageID")),
+							expect.DoesNotContain(data.Labels().Get("builtImageID")),
 						),
 					}
 				},
@@ -248,7 +248,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
 						Output: expect.All(
-							expect.Contains(data.Get("builtImageID")),
+							expect.Contains(data.Labels().Get("builtImageID")),
 							expect.DoesNotContain(testutil.ImageRepo(testutil.CommonImage)),
 						),
 					}
@@ -260,7 +260,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
 						Output: expect.All(
-							expect.DoesNotContain(data.Get("builtImageID")),
+							expect.DoesNotContain(data.Labels().Get("builtImageID")),
 							expect.DoesNotContain(testutil.ImageRepo(testutil.CommonImage)),
 						),
 					}
@@ -296,17 +296,17 @@ func TestImagesFilterDangling(t *testing.T) {
 			dockerfile := fmt.Sprintf(`FROM %s
 CMD ["echo", "nerdctl-build-notag-string"]
 	`, testutil.CommonImage)
-			buildCtx := data.TempDir()
+			buildCtx := data.Temp().Path()
 			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 			assert.NilError(helpers.T(), err)
-			data.Set("buildCtx", buildCtx)
+			data.Labels().Set("buildCtx", buildCtx)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("container", "prune", "-f")
 			helpers.Anyhow("image", "prune", "--all", "-f")
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("build", data.Get("buildCtx"))
+			return helpers.Command("build", data.Labels().Get("buildCtx"))
 		},
 		Expected: test.Expects(0, nil, nil),
 		SubTests: []*test.Case{
diff --git a/cmd/nerdctl/image/image_load_test.go b/cmd/nerdctl/image/image_load_test.go
index fc1fa549..6598ab93 100644
--- a/cmd/nerdctl/image/image_load_test.go
+++ b/cmd/nerdctl/image/image_load_test.go
@@ -43,7 +43,7 @@ func TestLoadStdinFromPipe(t *testing.T) {
 			identifier := data.Identifier()
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 			helpers.Ensure("tag", testutil.CommonImage, identifier)
-			helpers.Ensure("save", identifier, "-o", filepath.Join(data.TempDir(), "common.tar"))
+			helpers.Ensure("save", identifier, "-o", filepath.Join(data.Temp().Path(), "common.tar"))
 			helpers.Ensure("rmi", "-f", identifier)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
@@ -51,7 +51,7 @@ func TestLoadStdinFromPipe(t *testing.T) {
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			cmd := helpers.Command("load")
-			reader, err := os.Open(filepath.Join(data.TempDir(), "common.tar"))
+			reader, err := os.Open(filepath.Join(data.Temp().Path(), "common.tar"))
 			assert.NilError(t, err, "failed to open common.tar")
 			cmd.Feed(reader)
 			return cmd
@@ -94,14 +94,14 @@ func TestLoadQuiet(t *testing.T) {
 			identifier := data.Identifier()
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 			helpers.Ensure("tag", testutil.CommonImage, identifier)
-			helpers.Ensure("save", identifier, "-o", filepath.Join(data.TempDir(), "common.tar"))
+			helpers.Ensure("save", identifier, "-o", filepath.Join(data.Temp().Path(), "common.tar"))
 			helpers.Ensure("rmi", "-f", identifier)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("load", "--quiet", "--input", filepath.Join(data.TempDir(), "common.tar"))
+			return helpers.Command("load", "--quiet", "--input", filepath.Join(data.Temp().Path(), "common.tar"))
 		},
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
diff --git a/cmd/nerdctl/image/image_prune_test.go b/cmd/nerdctl/image/image_prune_test.go
index 1c8b402e..402ea7bb 100644
--- a/cmd/nerdctl/image/image_prune_test.go
+++ b/cmd/nerdctl/image/image_prune_test.go
@@ -71,7 +71,7 @@ func TestImagePrune(t *testing.T) {
 				CMD ["echo", "nerdctl-test-image-prune"]
 					`, testutil.CommonImage)
 
-				buildCtx := data.TempDir()
+				buildCtx := data.Temp().Path()
 				err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 				assert.NilError(helpers.T(), err)
 				helpers.Ensure("build", buildCtx)
@@ -119,7 +119,7 @@ func TestImagePrune(t *testing.T) {
 				CMD ["echo", "nerdctl-test-image-prune"]
 					`, testutil.CommonImage)
 
-				buildCtx := data.TempDir()
+				buildCtx := data.Temp().Path()
 				err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 				assert.NilError(helpers.T(), err)
 				helpers.Ensure("build", buildCtx)
@@ -163,7 +163,7 @@ func TestImagePrune(t *testing.T) {
 CMD ["echo", "nerdctl-test-image-prune-filter-label"]
 LABEL foo=bar
 LABEL version=0.1`, testutil.CommonImage)
-				buildCtx := data.TempDir()
+				buildCtx := data.Temp().Path()
 				err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 				assert.NilError(helpers.T(), err)
 				helpers.Ensure("build", "-t", data.Identifier(), buildCtx)
@@ -203,22 +203,22 @@ LABEL version=0.1`, testutil.CommonImage)
 				dockerfile := fmt.Sprintf(`FROM %s
 RUN echo "Anything, so that we create actual content for docker to set the current time for CreatedAt"
 CMD ["echo", "nerdctl-test-image-prune-until"]`, testutil.CommonImage)
-				buildCtx := data.TempDir()
+				buildCtx := data.Temp().Path()
 				err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 				assert.NilError(helpers.T(), err)
 				helpers.Ensure("build", "-t", data.Identifier(), buildCtx)
 				imgList := helpers.Capture("images")
 				assert.Assert(t, strings.Contains(imgList, data.Identifier()), "Missing "+data.Identifier())
-				data.Set("imageID", data.Identifier())
+				data.Labels().Set("imageID", data.Identifier())
 			},
 			Command: test.Command("image", "prune", "--force", "--all", "--filter", "until=12h"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.DoesNotContain(data.Get("imageID")),
+						expect.DoesNotContain(data.Labels().Get("imageID")),
 						func(stdout string, info string, t *testing.T) {
 							imgList := helpers.Capture("images")
-							assert.Assert(t, strings.Contains(imgList, data.Get("imageID")), info)
+							assert.Assert(t, strings.Contains(imgList, data.Labels().Get("imageID")), info)
 						},
 					),
 				}
@@ -234,10 +234,10 @@ CMD ["echo", "nerdctl-test-image-prune-until"]`, testutil.CommonImage)
 					Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 						return &test.Expected{
 							Output: expect.All(
-								expect.Contains(data.Get("imageID")),
+								expect.Contains(data.Labels().Get("imageID")),
 								func(stdout string, info string, t *testing.T) {
 									imgList := helpers.Capture("images")
-									assert.Assert(t, !strings.Contains(imgList, data.Get("imageID")), imgList, info)
+									assert.Assert(t, !strings.Contains(imgList, data.Labels().Get("imageID")), imgList, info)
 								},
 							),
 						}
diff --git a/cmd/nerdctl/image/image_pull_linux_test.go b/cmd/nerdctl/image/image_pull_linux_test.go
index 9939bc72..6156b82a 100644
--- a/cmd/nerdctl/image/image_pull_linux_test.go
+++ b/cmd/nerdctl/image/image_pull_linux_test.go
@@ -61,7 +61,7 @@ func TestImagePullWithCosign(t *testing.T) {
 CMD ["echo", "nerdctl-build-test-string"]
 	`, testutil.CommonImage)
 
-			buildCtx := data.TempDir()
+			buildCtx := data.Temp().Path()
 			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 			assert.NilError(helpers.T(), err)
 			helpers.Ensure("build", "-t", testImageRef+":one", buildCtx)
@@ -69,7 +69,7 @@ CMD ["echo", "nerdctl-build-test-string"]
 			helpers.Ensure("push", "--sign=cosign", "--cosign-key="+keyPair.PrivateKey, testImageRef+":one")
 			helpers.Ensure("push", "--sign=cosign", "--cosign-key="+keyPair.PrivateKey, testImageRef+":two")
 			helpers.Ensure("rmi", "-f", testImageRef)
-			data.Set("imageref", testImageRef)
+			data.Labels().Set("imageref", testImageRef)
 		},
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			if keyPair != nil {
@@ -86,7 +86,7 @@ CMD ["echo", "nerdctl-build-test-string"]
 			{
 				Description: "Pull with the correct key",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("pull", "--quiet", "--verify=cosign", "--cosign-key="+keyPair.PublicKey, data.Get("imageref")+":one")
+					return helpers.Command("pull", "--quiet", "--verify=cosign", "--cosign-key="+keyPair.PublicKey, data.Labels().Get("imageref")+":one")
 				},
 				Expected: test.Expects(0, nil, nil),
 			},
@@ -97,7 +97,7 @@ CMD ["echo", "nerdctl-build-test-string"]
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					newKeyPair := testhelpers.NewCosignKeyPair(t, "cosign-key-pair-test", "2")
-					return helpers.Command("pull", "--quiet", "--verify=cosign", "--cosign-key="+newKeyPair.PublicKey, data.Get("imageref")+":two")
+					return helpers.Command("pull", "--quiet", "--verify=cosign", "--cosign-key="+newKeyPair.PublicKey, data.Labels().Get("imageref")+":two")
 				},
 				Expected: test.Expects(12, nil, nil),
 			},
@@ -127,7 +127,7 @@ func TestImagePullPlainHttpWithDefaultPort(t *testing.T) {
 CMD ["echo", "nerdctl-build-test-string"]
 	`, testutil.CommonImage)
 
-			buildCtx := data.TempDir()
+			buildCtx := data.Temp().Path()
 			err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 			assert.NilError(helpers.T(), err)
 			helpers.Ensure("build", "-t", testImageRef, buildCtx)
@@ -169,13 +169,15 @@ func TestImagePullSoci(t *testing.T) {
 			{
 				Description: "Run without specifying SOCI index",
 				NoParallel:  true,
-				Data: test.WithData("remoteSnapshotsExpectedCount", "11").
-					Set("sociIndexDigest", ""),
+				Data: test.WithLabels(map[string]string{
+					"remoteSnapshotsExpectedCount": "11",
+					"sociIndexDigest":              "",
+				}),
 				Setup: func(data test.Data, helpers test.Helpers) {
 					cmd := helpers.Custom("mount")
 					cmd.Run(&test.Expected{
 						Output: func(stdout string, info string, t *testing.T) {
-							data.Set("remoteSnapshotsInitialCount", strconv.Itoa(strings.Count(stdout, "fuse.rawBridge")))
+							data.Labels().Set("remoteSnapshotsInitialCount", strconv.Itoa(strings.Count(stdout, "fuse.rawBridge")))
 						},
 					})
 					helpers.Ensure("--snapshotter=soci", "pull", testutil.FfmpegSociImage)
@@ -189,10 +191,10 @@ func TestImagePullSoci(t *testing.T) {
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
 						Output: func(stdout string, info string, t *testing.T) {
-							remoteSnapshotsInitialCount, _ := strconv.Atoi(data.Get("remoteSnapshotsInitialCount"))
+							remoteSnapshotsInitialCount, _ := strconv.Atoi(data.Labels().Get("remoteSnapshotsInitialCount"))
 							remoteSnapshotsActualCount := strings.Count(stdout, "fuse.rawBridge")
 							assert.Equal(t,
-								data.Get("remoteSnapshotsExpectedCount"),
+								data.Labels().Get("remoteSnapshotsExpectedCount"),
 								strconv.Itoa(remoteSnapshotsActualCount-remoteSnapshotsInitialCount),
 								info)
 						},
@@ -202,13 +204,15 @@ func TestImagePullSoci(t *testing.T) {
 			{
 				Description: "Run with bad SOCI index",
 				NoParallel:  true,
-				Data: test.WithData("remoteSnapshotsExpectedCount", "11").
-					Set("sociIndexDigest", "sha256:thisisabadindex0000000000000000000000000000000000000000000000000"),
+				Data: test.WithLabels(map[string]string{
+					"remoteSnapshotsExpectedCount": "11",
+					"sociIndexDigest":              "sha256:thisisabadindex0000000000000000000000000000000000000000000000000",
+				}),
 				Setup: func(data test.Data, helpers test.Helpers) {
 					cmd := helpers.Custom("mount")
 					cmd.Run(&test.Expected{
 						Output: func(stdout string, info string, t *testing.T) {
-							data.Set("remoteSnapshotsInitialCount", strconv.Itoa(strings.Count(stdout, "fuse.rawBridge")))
+							data.Labels().Set("remoteSnapshotsInitialCount", strconv.Itoa(strings.Count(stdout, "fuse.rawBridge")))
 						},
 					})
 					helpers.Ensure("--snapshotter=soci", "pull", testutil.FfmpegSociImage)
@@ -222,10 +226,10 @@ func TestImagePullSoci(t *testing.T) {
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
 						Output: func(stdout string, info string, t *testing.T) {
-							remoteSnapshotsInitialCount, _ := strconv.Atoi(data.Get("remoteSnapshotsInitialCount"))
+							remoteSnapshotsInitialCount, _ := strconv.Atoi(data.Labels().Get("remoteSnapshotsInitialCount"))
 							remoteSnapshotsActualCount := strings.Count(stdout, "fuse.rawBridge")
 							assert.Equal(t,
-								data.Get("remoteSnapshotsExpectedCount"),
+								data.Labels().Get("remoteSnapshotsExpectedCount"),
 								strconv.Itoa(remoteSnapshotsActualCount-remoteSnapshotsInitialCount),
 								info)
 						},
diff --git a/cmd/nerdctl/image/image_push_linux_test.go b/cmd/nerdctl/image/image_push_linux_test.go
index 66d26512..bf10f371 100644
--- a/cmd/nerdctl/image/image_push_linux_test.go
+++ b/cmd/nerdctl/image/image_push_linux_test.go
@@ -67,16 +67,16 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						registryNoAuthHTTPRandom.IP.String(), registryNoAuthHTTPRandom.Port, data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.CommonImage, testImageRef)
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", data.Get("testImageRef"))
+					return helpers.Command("push", data.Labels().Get("testImageRef"))
 				},
 				Expected: test.Expects(1, []error{errors.New("server gave HTTP response to HTTPS client")}, nil),
 			},
@@ -87,16 +87,16 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						registryNoAuthHTTPRandom.IP.String(), registryNoAuthHTTPRandom.Port, data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.CommonImage, testImageRef)
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", "--insecure-registry", data.Get("testImageRef"))
+					return helpers.Command("push", "--insecure-registry", data.Labels().Get("testImageRef"))
 				},
 				Expected: test.Expects(0, nil, nil),
 			},
@@ -106,11 +106,11 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						"127.0.0.1", registryNoAuthHTTPRandom.Port, data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.CommonImage, testImageRef)
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", data.Get("testImageRef"))
+					return helpers.Command("push", data.Labels().Get("testImageRef"))
 				},
 				Expected: test.Expects(0, nil, nil),
 			},
@@ -121,16 +121,16 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s/%s:%s",
 						registryNoAuthHTTPDefault.IP.String(), data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.CommonImage, testImageRef)
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", "--insecure-registry", data.Get("testImageRef"))
+					return helpers.Command("push", "--insecure-registry", data.Labels().Get("testImageRef"))
 				},
 				Expected: test.Expects(0, nil, nil),
 			},
@@ -141,19 +141,19 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						registryTokenAuthHTTPSRandom.IP.String(), registryTokenAuthHTTPSRandom.Port, data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.CommonImage, testImageRef)
 					helpers.Ensure("--insecure-registry", "login", "-u", "admin", "-p", "badmin",
 						fmt.Sprintf("%s:%d", registryTokenAuthHTTPSRandom.IP.String(), registryTokenAuthHTTPSRandom.Port))
 
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", "--insecure-registry", data.Get("testImageRef"))
+					return helpers.Command("push", "--insecure-registry", data.Labels().Get("testImageRef"))
 				},
 				Expected: test.Expects(0, nil, nil),
 			},
@@ -164,19 +164,19 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						registryTokenAuthHTTPSRandom.IP.String(), registryTokenAuthHTTPSRandom.Port, data.Identifier(), strings.Split(testutil.CommonImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.CommonImage, testImageRef)
 					helpers.Ensure("--hosts-dir", registryTokenAuthHTTPSRandom.HostsDir, "login", "-u", "admin", "-p", "badmin",
 						fmt.Sprintf("%s:%d", registryTokenAuthHTTPSRandom.IP.String(), registryTokenAuthHTTPSRandom.Port))
 
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", "--hosts-dir", registryTokenAuthHTTPSRandom.HostsDir, data.Get("testImageRef"))
+					return helpers.Command("push", "--hosts-dir", registryTokenAuthHTTPSRandom.HostsDir, data.Labels().Get("testImageRef"))
 				},
 				Expected: test.Expects(0, nil, nil),
 			},
@@ -187,16 +187,16 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.NonDistBlobImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						registryNoAuthHTTPRandom.IP.String(), registryNoAuthHTTPRandom.Port, data.Identifier(), strings.Split(testutil.NonDistBlobImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.NonDistBlobImage, testImageRef)
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", "--insecure-registry", data.Get("testImageRef"))
+					return helpers.Command("push", "--insecure-registry", data.Labels().Get("testImageRef"))
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
@@ -219,16 +219,16 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.NonDistBlobImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						registryNoAuthHTTPRandom.IP.String(), registryNoAuthHTTPRandom.Port, data.Identifier(), strings.Split(testutil.NonDistBlobImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.NonDistBlobImage, testImageRef)
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", "--insecure-registry", "--allow-nondistributable-artifacts", data.Get("testImageRef"))
+					return helpers.Command("push", "--insecure-registry", "--allow-nondistributable-artifacts", data.Labels().Get("testImageRef"))
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
@@ -254,16 +254,16 @@ func TestPush(t *testing.T) {
 					helpers.Ensure("pull", "--quiet", testutil.UbuntuImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
 						registryNoAuthHTTPRandom.IP.String(), registryNoAuthHTTPRandom.Port, data.Identifier(), strings.Split(testutil.UbuntuImage, ":")[1])
-					data.Set("testImageRef", testImageRef)
+					data.Labels().Set("testImageRef", testImageRef)
 					helpers.Ensure("tag", testutil.UbuntuImage, testImageRef)
 				},
 				Cleanup: func(data test.Data, helpers test.Helpers) {
-					if data.Get("testImageRef") != "" {
-						helpers.Anyhow("rmi", "-f", data.Get("testImageRef"))
+					if data.Labels().Get("testImageRef") != "" {
+						helpers.Anyhow("rmi", "-f", data.Labels().Get("testImageRef"))
 					}
 				},
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-					return helpers.Command("push", "--snapshotter=soci", "--insecure-registry", "--soci-span-size=2097152", "--soci-min-layer-size=20971520", data.Get("testImageRef"))
+					return helpers.Command("push", "--snapshotter=soci", "--insecure-registry", "--soci-span-size=2097152", "--soci-min-layer-size=20971520", data.Labels().Get("testImageRef"))
 				},
 				Expected: test.Expects(0, nil, nil),
 			},
diff --git a/cmd/nerdctl/image/image_remove_test.go b/cmd/nerdctl/image/image_remove_test.go
index e91f05c6..db5fa47f 100644
--- a/cmd/nerdctl/image/image_remove_test.go
+++ b/cmd/nerdctl/image/image_remove_test.go
@@ -129,11 +129,11 @@ func TestRemove(t *testing.T) {
 				repoName, _ := imgutil.ParseRepoTag(testutil.CommonImage)
 				imgShortID := strings.TrimPrefix(img.RepoDigests[0], repoName+"@sha256:")[0:8]
 
-				data.Set(imgShortIDKey, imgShortID)
+				data.Labels().Set(imgShortIDKey, imgShortID)
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
-				helpers.Anyhow("rmi", "-f", data.Get(imgShortIDKey))
+				helpers.Anyhow("rmi", "-f", data.Labels().Get(imgShortIDKey))
 			},
 			Command: test.Command("rmi", "-f", testutil.CommonImage),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
@@ -238,11 +238,11 @@ func TestRemove(t *testing.T) {
 				repoName, _ := imgutil.ParseRepoTag(testutil.CommonImage)
 				imgShortID := strings.TrimPrefix(img.RepoDigests[0], repoName+"@sha256:")[0:8]
 
-				data.Set(imgShortIDKey, imgShortID)
+				data.Labels().Set(imgShortIDKey, imgShortID)
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
-				helpers.Anyhow("rmi", "-f", data.Get(imgShortIDKey))
+				helpers.Anyhow("rmi", "-f", data.Labels().Get(imgShortIDKey))
 			},
 			Command: test.Command("rmi", "-f", testutil.CommonImage),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
@@ -330,17 +330,17 @@ func TestIssue3016(t *testing.T) {
 
 				helpers.Ensure("tag", testutil.CommonImage, tagID)
 
-				data.Set(tagIDKey, tagID)
+				data.Labels().Set(tagIDKey, tagID)
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("rmi", data.Get(tagIDKey))
+				return helpers.Command("rmi", data.Labels().Get(tagIDKey))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: 0,
 					Errors:   []error{},
 					Output: func(stdout string, info string, t *testing.T) {
-						helpers.Command("images", data.Get(tagIDKey)).Run(&test.Expected{
+						helpers.Command("images", data.Labels().Get(tagIDKey)).Run(&test.Expected{
 							ExitCode: 0,
 							Output: func(stdout string, info string, t *testing.T) {
 								assert.Equal(t, len(strings.Split(stdout, "\n")), 2)
diff --git a/cmd/nerdctl/image/image_save_test.go b/cmd/nerdctl/image/image_save_test.go
index 7e61ef6e..4f3bf58d 100644
--- a/cmd/nerdctl/image/image_save_test.go
+++ b/cmd/nerdctl/image/image_save_test.go
@@ -44,13 +44,13 @@ func TestSaveContent(t *testing.T) {
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 		},
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-			return helpers.Command("save", "-o", filepath.Join(data.TempDir(), "out.tar"), testutil.CommonImage)
+			return helpers.Command("save", "-o", filepath.Join(data.Temp().Path(), "out.tar"), testutil.CommonImage)
 		},
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
 				Output: func(stdout string, info string, t *testing.T) {
-					rootfsPath := filepath.Join(data.TempDir(), "rootfs")
-					err := testhelpers.ExtractDockerArchive(filepath.Join(data.TempDir(), "out.tar"), rootfsPath)
+					rootfsPath := filepath.Join(data.Temp().Path(), "rootfs")
+					err := testhelpers.ExtractDockerArchive(filepath.Join(data.Temp().Path(), "out.tar"), rootfsPath)
 					assert.NilError(t, err)
 					etcOSReleasePath := filepath.Join(rootfsPath, "/etc/os-release")
 					etcOSReleaseBytes, err := os.ReadFile(etcOSReleasePath)
@@ -83,8 +83,8 @@ func TestSave(t *testing.T) {
 			Description: "Single image, by id",
 			NoParallel:  true,
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get("id") != "" {
-					helpers.Anyhow("rmi", "-f", data.Get("id"))
+				if data.Labels().Get("id") != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get("id"))
 				}
 			},
 			Setup: func(data test.Data, helpers test.Helpers) {
@@ -97,14 +97,14 @@ func TestSave(t *testing.T) {
 				} else {
 					id = strings.Split(img.RepoDigests[0], ":")[1]
 				}
-				tarPath := filepath.Join(data.TempDir(), "out.tar")
+				tarPath := filepath.Join(data.Temp().Path(), "out.tar")
 				helpers.Ensure("save", "-o", tarPath, id)
 				helpers.Ensure("rmi", "-f", testutil.CommonImage)
 				helpers.Ensure("load", "-i", tarPath)
-				data.Set("id", id)
+				data.Labels().Set("id", id)
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get("id"), "sh", "-euxc", "echo foo")
+				return helpers.Command("run", "--rm", data.Labels().Get("id"), "sh", "-euxc", "echo foo")
 			},
 			Expected: test.Expects(0, nil, expect.Equals("foo\n")),
 		},
@@ -112,8 +112,8 @@ func TestSave(t *testing.T) {
 			Description: "Image with different names, by id",
 			NoParallel:  true,
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get("id") != "" {
-					helpers.Anyhow("rmi", "-f", data.Get("id"))
+				if data.Labels().Get("id") != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get("id"))
 				}
 			},
 			Setup: func(data test.Data, helpers test.Helpers) {
@@ -126,14 +126,14 @@ func TestSave(t *testing.T) {
 					id = strings.Split(img.RepoDigests[0], ":")[1]
 				}
 				helpers.Ensure("tag", testutil.CommonImage, data.Identifier())
-				tarPath := filepath.Join(data.TempDir(), "out.tar")
+				tarPath := filepath.Join(data.Temp().Path(), "out.tar")
 				helpers.Ensure("save", "-o", tarPath, id)
 				helpers.Ensure("rmi", "-f", testutil.CommonImage)
 				helpers.Ensure("load", "-i", tarPath)
-				data.Set("id", id)
+				data.Labels().Set("id", id)
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get("id"), "sh", "-euxc", "echo foo")
+				return helpers.Command("run", "--rm", data.Labels().Get("id"), "sh", "-euxc", "echo foo")
 			},
 			Expected: test.Expects(0, nil, expect.Equals("foo\n")),
 		},
@@ -161,8 +161,8 @@ func TestSaveMultipleImagesWithSameIDAndLoad(t *testing.T) {
 			Description: "Issue #3568 - Save multiple container images with the same image ID but different image names",
 			NoParallel:  true,
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get("id") != "" {
-					helpers.Anyhow("rmi", "-f", data.Get("id"))
+				if data.Labels().Get("id") != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get("id"))
 				}
 			},
 			Setup: func(data test.Data, helpers test.Helpers) {
@@ -175,11 +175,11 @@ func TestSaveMultipleImagesWithSameIDAndLoad(t *testing.T) {
 					id = strings.Split(img.RepoDigests[0], ":")[1]
 				}
 				helpers.Ensure("tag", testutil.CommonImage, data.Identifier())
-				tarPath := filepath.Join(data.TempDir(), "out.tar")
+				tarPath := filepath.Join(data.Temp().Path(), "out.tar")
 				helpers.Ensure("save", "-o", tarPath, testutil.CommonImage, data.Identifier())
 				helpers.Ensure("rmi", "-f", id)
 				helpers.Ensure("load", "-i", tarPath)
-				data.Set("id", id)
+				data.Labels().Set("id", id)
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("images", "--no-trunc")
@@ -189,7 +189,7 @@ func TestSaveMultipleImagesWithSameIDAndLoad(t *testing.T) {
 					ExitCode: 0,
 					Errors:   []error{},
 					Output: func(stdout string, info string, t *testing.T) {
-						assert.Equal(t, strings.Count(stdout, data.Get("id")), 2)
+						assert.Equal(t, strings.Count(stdout, data.Labels().Get("id")), 2)
 					},
 				}
 			},
diff --git a/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go b/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go
index 2387555c..9a7b0980 100644
--- a/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go
+++ b/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go
@@ -58,7 +58,7 @@ func TestIPFSCompNoBuild(t *testing.T) {
 		// Start Kubo
 		ipfsRegistry = registry.NewKuboRegistry(data, helpers, t, nil, 0, nil)
 		ipfsRegistry.Setup(data, helpers)
-		data.Set(ipfsAddrKey, fmt.Sprintf("/ip4/%s/tcp/%d", ipfsRegistry.IP, ipfsRegistry.Port))
+		data.Labels().Set(ipfsAddrKey, fmt.Sprintf("/ip4/%s/tcp/%d", ipfsRegistry.IP, ipfsRegistry.Port))
 
 		// Ensure we have the images
 		helpers.Ensure("pull", "--quiet", testutil.WordpressImage)
@@ -114,15 +114,15 @@ func subtestTestIPFSCompNoB(t *testing.T, stargz bool, byAddr bool) *test.Case {
 			ipfsCIDWP = pushToIPFS(helpers, testutil.WordpressImage, "--estargz")
 			ipfsCIDMD = pushToIPFS(helpers, testutil.MariaDBImage, "--estargz")
 		} else if byAddr {
-			ipfsCIDWP = pushToIPFS(helpers, testutil.WordpressImage, "--ipfs-address="+data.Get(ipfsAddrKey))
-			ipfsCIDMD = pushToIPFS(helpers, testutil.MariaDBImage, "--ipfs-address="+data.Get(ipfsAddrKey))
-			data.Set(composeExtraKey, "--ipfs-address="+data.Get(ipfsAddrKey))
+			ipfsCIDWP = pushToIPFS(helpers, testutil.WordpressImage, "--ipfs-address="+data.Labels().Get(ipfsAddrKey))
+			ipfsCIDMD = pushToIPFS(helpers, testutil.MariaDBImage, "--ipfs-address="+data.Labels().Get(ipfsAddrKey))
+			data.Labels().Set(composeExtraKey, "--ipfs-address="+data.Labels().Get(ipfsAddrKey))
 		} else {
 			ipfsCIDWP = pushToIPFS(helpers, testutil.WordpressImage)
 			ipfsCIDMD = pushToIPFS(helpers, testutil.MariaDBImage)
 		}
-		data.Set(wordpressImageCIDKey, ipfsCIDWP)
-		data.Set(mariaImageCIDKey, ipfsCIDMD)
+		data.Labels().Set(wordpressImageCIDKey, ipfsCIDWP)
+		data.Labels().Set(mariaImageCIDKey, ipfsCIDMD)
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -131,9 +131,9 @@ func subtestTestIPFSCompNoB(t *testing.T, stargz bool, byAddr bool) *test.Case {
 		// they have the same cid - except for the estargz version obviously)
 		// Deliberately electing to not remove them here so that we can parallelize and cut down the running time
 		/*
-			if data.Get(mariaImageCIDKey) != "" {
-				helpers.Anyhow("rmi", "-f", data.Get(mariaImageCIDKey))
-				helpers.Anyhow("rmi", "-f", data.Get(wordpressImageCIDKey))
+			if data.Labels().Get(mariaImageCIDKey) != "" {
+				helpers.Anyhow("rmi", "-f", data.Labels().Get(mariaImageCIDKey))
+				helpers.Anyhow("rmi", "-f", data.Labels().Get(wordpressImageCIDKey))
 			}
 		*/
 	}
@@ -141,7 +141,7 @@ func subtestTestIPFSCompNoB(t *testing.T, stargz bool, byAddr bool) *test.Case {
 	testCase.Command = func(data test.Data, helpers test.Helpers) test.TestableCommand {
 		safePort, err := portlock.Acquire(0)
 		assert.NilError(helpers.T(), err)
-		data.Set("wordpressPort", strconv.Itoa(safePort))
+		data.Labels().Set("wordpressPort", strconv.Itoa(safePort))
 		composeUP(data, helpers, fmt.Sprintf(`
 version: '3.1'
 
@@ -175,7 +175,7 @@ services:
 volumes:
   wordpress:
   db:
-`, data.Get(wordpressImageCIDKey), safePort, data.Get(mariaImageCIDKey)), data.Get(composeExtraKey))
+`, data.Labels().Get(wordpressImageCIDKey), safePort, data.Labels().Get(mariaImageCIDKey)), data.Labels().Get(composeExtraKey))
 		// FIXME: need to break down composeUP into testable commands instead
 		// Right now, this is just a dummy placeholder
 		return helpers.Command("info")
@@ -219,7 +219,7 @@ func TestIPFSCompBuild(t *testing.T) {
 		time.Sleep(time.Second)
 
 		// Save nginx to ipfs
-		data.Set(mainImageCIDKey, pushToIPFS(helpers, testutil.NginxAlpineImage))
+		data.Labels().Set(mainImageCIDKey, pushToIPFS(helpers, testutil.NginxAlpineImage))
 
 		const dockerComposeYAML = `
 services:
@@ -230,7 +230,7 @@ services:
 `
 		dockerfile := fmt.Sprintf(`FROM %s/ipfs/%s
 COPY index.html /usr/share/nginx/html/index.html
-`, listenAddr, data.Get(mainImageCIDKey))
+`, listenAddr, data.Labels().Get(mainImageCIDKey))
 
 		comp = testutil.NewComposeDir(t, dockerComposeYAML)
 		comp.WriteFile("Dockerfile", dockerfile)
@@ -239,7 +239,7 @@ COPY index.html /usr/share/nginx/html/index.html
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
 		if ipfsServer != nil {
-			helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
+			helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
 			ipfsServer.Signal(os.Kill)
 		}
 		if comp != nil {
@@ -290,7 +290,7 @@ func composeUP(data test.Data, helpers test.Helpers, dockerComposeYAML string, o
 
 	checkWordpress := func() error {
 		// FIXME: see other notes on using the same port repeatedly
-		resp, err := nettestutil.HTTPGet("http://127.0.0.1:"+data.Get("wordpressPort"), 5, false)
+		resp, err := nettestutil.HTTPGet("http://127.0.0.1:"+data.Labels().Get("wordpressPort"), 5, false)
 		if err != nil {
 			return err
 		}
diff --git a/cmd/nerdctl/ipfs/ipfs_kubo_linux_test.go b/cmd/nerdctl/ipfs/ipfs_kubo_linux_test.go
index 48068b07..de1dc16d 100644
--- a/cmd/nerdctl/ipfs/ipfs_kubo_linux_test.go
+++ b/cmd/nerdctl/ipfs/ipfs_kubo_linux_test.go
@@ -51,7 +51,7 @@ func TestIPFSAddrWithKubo(t *testing.T) {
 		ipfsRegistry = registry.NewKuboRegistry(data, helpers, t, nil, 0, nil)
 		ipfsRegistry.Setup(data, helpers)
 		ipfsAddr := fmt.Sprintf("/ip4/%s/tcp/%d", ipfsRegistry.IP, ipfsRegistry.Port)
-		data.Set(ipfsAddrKey, ipfsAddr)
+		data.Labels().Set(ipfsAddrKey, ipfsAddr)
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -65,17 +65,17 @@ func TestIPFSAddrWithKubo(t *testing.T) {
 			Description: "with default snapshotter",
 			NoParallel:  true,
 			Setup: func(data test.Data, helpers test.Helpers) {
-				ipfsCID := pushToIPFS(helpers, testutil.CommonImage, fmt.Sprintf("--ipfs-address=%s", data.Get(ipfsAddrKey)))
-				helpers.Ensure("pull", "--quiet", "--ipfs-address", data.Get(ipfsAddrKey), "ipfs://"+ipfsCID)
-				data.Set(mainImageCIDKey, ipfsCID)
+				ipfsCID := pushToIPFS(helpers, testutil.CommonImage, fmt.Sprintf("--ipfs-address=%s", data.Labels().Get(ipfsAddrKey)))
+				helpers.Ensure("pull", "--quiet", "--ipfs-address", data.Labels().Get(ipfsAddrKey), "ipfs://"+ipfsCID)
+				data.Labels().Set(mainImageCIDKey, ipfsCID)
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get(mainImageCIDKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
+				if data.Labels().Get(mainImageCIDKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
 				}
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(mainImageCIDKey), "echo", "hello")
+				return helpers.Command("run", "--rm", data.Labels().Get(mainImageCIDKey), "echo", "hello")
 			},
 			Expected: test.Expects(0, nil, expect.Equals("hello\n")),
 		},
@@ -88,17 +88,17 @@ func TestIPFSAddrWithKubo(t *testing.T) {
 				nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3475"),
 			),
 			Setup: func(data test.Data, helpers test.Helpers) {
-				ipfsCID := pushToIPFS(helpers, testutil.CommonImage, fmt.Sprintf("--ipfs-address=%s", data.Get(ipfsAddrKey)), "--estargz")
-				helpers.Ensure("pull", "--quiet", "--ipfs-address", data.Get(ipfsAddrKey), "ipfs://"+ipfsCID)
-				data.Set(mainImageCIDKey, ipfsCID)
+				ipfsCID := pushToIPFS(helpers, testutil.CommonImage, fmt.Sprintf("--ipfs-address=%s", data.Labels().Get(ipfsAddrKey)), "--estargz")
+				helpers.Ensure("pull", "--quiet", "--ipfs-address", data.Labels().Get(ipfsAddrKey), "ipfs://"+ipfsCID)
+				data.Labels().Set(mainImageCIDKey, ipfsCID)
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get(mainImageCIDKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
+				if data.Labels().Get(mainImageCIDKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
 				}
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(mainImageCIDKey), "ls", "/.stargz-snapshotter")
+				return helpers.Command("run", "--rm", data.Labels().Get(mainImageCIDKey), "ls", "/.stargz-snapshotter")
 			},
 			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("sha256:.*[.]json[\n]"))),
 		},
diff --git a/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go b/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go
index dcb0f742..5c044bf3 100644
--- a/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go
+++ b/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go
@@ -89,16 +89,16 @@ func TestIPFSNerdctlRegistry(t *testing.T) {
 			Description: "with default snapshotter",
 			NoParallel:  true,
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(ipfsImageURLKey, listenAddr+"/ipfs/"+pushToIPFS(helpers, testutil.CommonImage))
-				helpers.Ensure("pull", "--quiet", data.Get(ipfsImageURLKey))
+				data.Labels().Set(ipfsImageURLKey, listenAddr+"/ipfs/"+pushToIPFS(helpers, testutil.CommonImage))
+				helpers.Ensure("pull", "--quiet", data.Labels().Get(ipfsImageURLKey))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get(ipfsImageURLKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(ipfsImageURLKey))
+				if data.Labels().Get(ipfsImageURLKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(ipfsImageURLKey))
 				}
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(ipfsImageURLKey), "echo", "hello")
+				return helpers.Command("run", "--rm", data.Labels().Get(ipfsImageURLKey), "echo", "hello")
 			},
 			Expected: test.Expects(0, nil, expect.Equals("hello\n")),
 		},
@@ -107,16 +107,16 @@ func TestIPFSNerdctlRegistry(t *testing.T) {
 			NoParallel:  true,
 			Require:     nerdtest.Stargz,
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(ipfsImageURLKey, listenAddr+"/ipfs/"+pushToIPFS(helpers, testutil.CommonImage, "--estargz"))
-				helpers.Ensure("pull", "--quiet", data.Get(ipfsImageURLKey))
+				data.Labels().Set(ipfsImageURLKey, listenAddr+"/ipfs/"+pushToIPFS(helpers, testutil.CommonImage, "--estargz"))
+				helpers.Ensure("pull", "--quiet", data.Labels().Get(ipfsImageURLKey))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get(ipfsImageURLKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(ipfsImageURLKey))
+				if data.Labels().Get(ipfsImageURLKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(ipfsImageURLKey))
 				}
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(ipfsImageURLKey), "ls", "/.stargz-snapshotter")
+				return helpers.Command("run", "--rm", data.Labels().Get(ipfsImageURLKey), "ls", "/.stargz-snapshotter")
 			},
 			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("sha256:.*[.]json[\n]"))),
 		},
@@ -126,18 +126,18 @@ func TestIPFSNerdctlRegistry(t *testing.T) {
 			Require:     nerdtest.Build,
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rmi", "-f", data.Identifier("built-image"))
-				if data.Get(ipfsImageURLKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(ipfsImageURLKey))
+				if data.Labels().Get(ipfsImageURLKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(ipfsImageURLKey))
 				}
 			},
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(ipfsImageURLKey, listenAddr+"/ipfs/"+pushToIPFS(helpers, testutil.CommonImage))
+				data.Labels().Set(ipfsImageURLKey, listenAddr+"/ipfs/"+pushToIPFS(helpers, testutil.CommonImage))
 
 				dockerfile := fmt.Sprintf(`FROM %s
 CMD ["echo", "nerdctl-build-test-string"]
-	`, data.Get(ipfsImageURLKey))
+	`, data.Labels().Get(ipfsImageURLKey))
 
-				buildCtx := data.TempDir()
+				buildCtx := data.Temp().Path()
 				err := os.WriteFile(filepath.Join(buildCtx, "Dockerfile"), []byte(dockerfile), 0o600)
 				assert.NilError(helpers.T(), err)
 
diff --git a/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go b/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go
index dda1771c..eb1262cc 100644
--- a/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go
+++ b/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go
@@ -53,16 +53,16 @@ func TestIPFSSimple(t *testing.T) {
 			Description: "with default snapshotter",
 			NoParallel:  true,
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage))
-				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Get(mainImageCIDKey))
+				data.Labels().Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage))
+				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Labels().Get(mainImageCIDKey))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get(mainImageCIDKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
+				if data.Labels().Get(mainImageCIDKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
 				}
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(mainImageCIDKey), "echo", "hello")
+				return helpers.Command("run", "--rm", data.Labels().Get(mainImageCIDKey), "echo", "hello")
 			},
 			Expected: test.Expects(0, nil, expect.Equals("hello\n")),
 		},
@@ -74,16 +74,16 @@ func TestIPFSSimple(t *testing.T) {
 				nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3475"),
 			),
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage, "--estargz"))
-				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Get(mainImageCIDKey))
+				data.Labels().Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage, "--estargz"))
+				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Labels().Get(mainImageCIDKey))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get(mainImageCIDKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
+				if data.Labels().Get(mainImageCIDKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
 				}
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(mainImageCIDKey), "ls", "/.stargz-snapshotter")
+				return helpers.Command("run", "--rm", data.Labels().Get(mainImageCIDKey), "ls", "/.stargz-snapshotter")
 			},
 			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("sha256:.*[.]json[\n]"))),
 		},
@@ -91,32 +91,32 @@ func TestIPFSSimple(t *testing.T) {
 			Description: "with commit and push",
 			NoParallel:  true,
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage))
-				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Get(mainImageCIDKey))
+				data.Labels().Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage))
+				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Labels().Get(mainImageCIDKey))
 
 				// Run a container that does modify something, then commit and push it
-				helpers.Ensure("run", "--name", data.Identifier("commit-container"), data.Get(mainImageCIDKey), "sh", "-c", "--", "echo hello > /hello")
+				helpers.Ensure("run", "--name", data.Identifier("commit-container"), data.Labels().Get(mainImageCIDKey), "sh", "-c", "--", "echo hello > /hello")
 				helpers.Ensure("commit", data.Identifier("commit-container"), data.Identifier("commit-image"))
-				data.Set(transformedImageCIDKey, pushToIPFS(helpers, data.Identifier("commit-image")))
+				data.Labels().Set(transformedImageCIDKey, pushToIPFS(helpers, data.Identifier("commit-image")))
 
 				// Clean-up
 				helpers.Ensure("rm", data.Identifier("commit-container"))
 				helpers.Ensure("rmi", data.Identifier("commit-image"))
 
 				// Pull back the committed image
-				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Get(transformedImageCIDKey))
+				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Labels().Get(transformedImageCIDKey))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier("commit-container"))
 				helpers.Anyhow("rmi", "-f", data.Identifier("commit-image"))
-				if data.Get(mainImageCIDKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
-					helpers.Anyhow("rmi", "-f", data.Get(transformedImageCIDKey))
+				if data.Labels().Get(mainImageCIDKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(transformedImageCIDKey))
 				}
 			},
 
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(transformedImageCIDKey), "cat", "/hello")
+				return helpers.Command("run", "--rm", data.Labels().Get(transformedImageCIDKey), "cat", "/hello")
 			},
 
 			Expected: test.Expects(0, nil, expect.Equals("hello\n")),
@@ -129,32 +129,32 @@ func TestIPFSSimple(t *testing.T) {
 				nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3475"),
 			),
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage, "--estargz"))
-				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Get(mainImageCIDKey))
+				data.Labels().Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage, "--estargz"))
+				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Labels().Get(mainImageCIDKey))
 
 				// Run a container that does modify something, then commit and push it
-				helpers.Ensure("run", "--name", data.Identifier("commit-container"), data.Get(mainImageCIDKey), "sh", "-c", "--", "echo hello > /hello")
+				helpers.Ensure("run", "--name", data.Identifier("commit-container"), data.Labels().Get(mainImageCIDKey), "sh", "-c", "--", "echo hello > /hello")
 				helpers.Ensure("commit", data.Identifier("commit-container"), data.Identifier("commit-image"))
-				data.Set(transformedImageCIDKey, pushToIPFS(helpers, data.Identifier("commit-image")))
+				data.Labels().Set(transformedImageCIDKey, pushToIPFS(helpers, data.Identifier("commit-image")))
 
 				// Clean-up
 				helpers.Ensure("rm", data.Identifier("commit-container"))
 				helpers.Ensure("rmi", data.Identifier("commit-image"))
 
 				// Pull back the image
-				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Get(transformedImageCIDKey))
+				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Labels().Get(transformedImageCIDKey))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier("commit-container"))
 				helpers.Anyhow("rmi", "-f", data.Identifier("commit-image"))
-				if data.Get(mainImageCIDKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
-					helpers.Anyhow("rmi", "-f", data.Get(transformedImageCIDKey))
+				if data.Labels().Get(mainImageCIDKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(transformedImageCIDKey))
 				}
 			},
 
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("run", "--rm", data.Get(transformedImageCIDKey), "sh", "-c", "--", "cat /hello && ls /.stargz-snapshotter")
+				return helpers.Command("run", "--rm", data.Labels().Get(transformedImageCIDKey), "sh", "-c", "--", "cat /hello && ls /.stargz-snapshotter")
 			},
 
 			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("hello[\n]sha256:.*[.]json[\n]"))),
@@ -164,18 +164,18 @@ func TestIPFSSimple(t *testing.T) {
 			NoParallel:  true,
 			Require:     require.Binary("openssl"),
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage))
-				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Get(mainImageCIDKey))
+				data.Labels().Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage))
+				helpers.Ensure("pull", "--quiet", "ipfs://"+data.Labels().Get(mainImageCIDKey))
 
 				// Prep a key pair
 				keyPair := testhelpers.NewJWEKeyPair(t)
 				// FIXME: this will only cleanup when the group is done, not right, but it works
 				t.Cleanup(keyPair.Cleanup)
-				data.Set("pub", keyPair.Pub)
-				data.Set("prv", keyPair.Prv)
+				data.Labels().Set("pub", keyPair.Pub)
+				data.Labels().Set("prv", keyPair.Prv)
 
 				// Encrypt the image, and verify it is encrypted
-				helpers.Ensure("image", "encrypt", "--recipient=jwe:"+keyPair.Pub, data.Get(mainImageCIDKey), data.Identifier("encrypted"))
+				helpers.Ensure("image", "encrypt", "--recipient=jwe:"+keyPair.Pub, data.Labels().Get(mainImageCIDKey), data.Identifier("encrypted"))
 				cmd := helpers.Command("image", "inspect", "--mode=native", "--format={{len .Index.Manifests}}", data.Identifier("encrypted"))
 				cmd.Run(&test.Expected{
 					Output: expect.Equals("1\n"),
@@ -186,19 +186,19 @@ func TestIPFSSimple(t *testing.T) {
 				})
 
 				// Push the encrypted image and save the CID
-				data.Set(transformedImageCIDKey, pushToIPFS(helpers, data.Identifier("encrypted")))
+				data.Labels().Set(transformedImageCIDKey, pushToIPFS(helpers, data.Identifier("encrypted")))
 
 				// Remove both images locally
-				helpers.Ensure("rmi", "-f", data.Get(mainImageCIDKey))
-				helpers.Ensure("rmi", "-f", data.Get(transformedImageCIDKey))
+				helpers.Ensure("rmi", "-f", data.Labels().Get(mainImageCIDKey))
+				helpers.Ensure("rmi", "-f", data.Labels().Get(transformedImageCIDKey))
 
 				// Pull back without unpacking
-				helpers.Ensure("pull", "--quiet", "--unpack=false", "ipfs://"+data.Get(transformedImageCIDKey))
+				helpers.Ensure("pull", "--quiet", "--unpack=false", "ipfs://"+data.Labels().Get(transformedImageCIDKey))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get(mainImageCIDKey) != "" {
-					helpers.Anyhow("rmi", "-f", data.Get(mainImageCIDKey))
-					helpers.Anyhow("rmi", "-f", data.Get(transformedImageCIDKey))
+				if data.Labels().Get(mainImageCIDKey) != "" {
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(mainImageCIDKey))
+					helpers.Anyhow("rmi", "-f", data.Labels().Get(transformedImageCIDKey))
 				}
 			},
 			SubTests: []*test.Case{
@@ -208,7 +208,7 @@ func TestIPFSSimple(t *testing.T) {
 						helpers.Anyhow("rm", "-f", data.Identifier("decrypted"))
 					},
 					Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-						return helpers.Command("image", "decrypt", "--key="+data.Get("pub"), data.Get(transformedImageCIDKey), data.Identifier("decrypted"))
+						return helpers.Command("image", "decrypt", "--key="+data.Labels().Get("pub"), data.Labels().Get(transformedImageCIDKey), data.Identifier("decrypted"))
 					},
 					Expected: test.Expects(1, nil, nil),
 				},
@@ -218,7 +218,7 @@ func TestIPFSSimple(t *testing.T) {
 						helpers.Anyhow("rm", "-f", data.Identifier("decrypted"))
 					},
 					Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-						return helpers.Command("image", "decrypt", "--key="+data.Get("prv"), data.Get(transformedImageCIDKey), data.Identifier("decrypted"))
+						return helpers.Command("image", "decrypt", "--key="+data.Labels().Get("prv"), data.Labels().Get(transformedImageCIDKey), data.Identifier("decrypted"))
 					},
 					Expected: test.Expects(0, nil, nil),
 				},
diff --git a/cmd/nerdctl/main_test_test.go b/cmd/nerdctl/main_test_test.go
index ae9acc0f..4a06ea36 100644
--- a/cmd/nerdctl/main_test_test.go
+++ b/cmd/nerdctl/main_test_test.go
@@ -72,29 +72,29 @@ func TestTest(t *testing.T) {
 		},
 		{
 			Description: "data propagation",
-			Data:        test.WithData("status", "uninitialized"),
+			Data:        test.WithLabels(map[string]string{"status": "uninitialized"}),
 			Setup: func(data test.Data, helpers test.Helpers) {
-				data.Set("status", data.Get("status")+"-setup")
+				data.Labels().Set("status", data.Labels().Get("status")+"-setup")
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				cmd := helpers.Custom("printf", data.Get("status"))
-				data.Set("status", data.Get("status")+"-command")
+				cmd := helpers.Custom("printf", data.Labels().Get("status"))
+				data.Labels().Set("status", data.Labels().Get("status")+"-command")
 				return cmd
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				if data.Get("status") == "uninitialized" {
+				if data.Labels().Get("status") == "uninitialized" {
 					return
 				}
-				if data.Get("status") != "uninitialized-setup-command" {
-					log.Fatalf("unexpected status label %q", data.Get("status"))
+				if data.Labels().Get("status") != "uninitialized-setup-command" {
+					log.Fatalf("unexpected status label %q", data.Labels().Get("status"))
 				}
-				data.Set("status", data.Get("status")+"-cleanup")
+				data.Labels().Set("status", data.Labels().Get("status")+"-cleanup")
 			},
 			SubTests: []*test.Case{
 				{
 					Description: "Subtest data propagation",
 					Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-						return helpers.Custom("printf", data.Get("status"))
+						return helpers.Custom("printf", data.Labels().Get("status"))
 					},
 					Expected: test.Expects(0, nil, expect.Equals("uninitialized-setup-command")),
 				},
diff --git a/cmd/nerdctl/network/network_create_linux_test.go b/cmd/nerdctl/network/network_create_linux_test.go
index 418f07fd..5dd82655 100644
--- a/cmd/nerdctl/network/network_create_linux_test.go
+++ b/cmd/nerdctl/network/network_create_linux_test.go
@@ -42,7 +42,7 @@ func TestNetworkCreate(t *testing.T) {
 				helpers.Ensure("network", "create", identifier)
 				netw := nerdtest.InspectNetwork(helpers, identifier)
 				assert.Equal(t, len(netw.IPAM.Config), 1)
-				data.Set("subnet", netw.IPAM.Config[0].Subnet)
+				data.Labels().Set("subnet", netw.IPAM.Config[0].Subnet)
 
 				helpers.Ensure("network", "create", data.Identifier("1"))
 			},
@@ -51,7 +51,7 @@ func TestNetworkCreate(t *testing.T) {
 				helpers.Anyhow("network", "rm", data.Identifier("1"))
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				data.Set("container2", helpers.Capture("run", "--rm", "--net", data.Identifier("1"), testutil.CommonImage, "ip", "route"))
+				data.Labels().Set("container2", helpers.Capture("run", "--rm", "--net", data.Identifier("1"), testutil.CommonImage, "ip", "route"))
 				return helpers.Command("run", "--rm", "--net", data.Identifier(), testutil.CommonImage, "ip", "route")
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
@@ -59,8 +59,8 @@ func TestNetworkCreate(t *testing.T) {
 					ExitCode: 0,
 					Errors:   nil,
 					Output: func(stdout string, info string, t *testing.T) {
-						assert.Assert(t, strings.Contains(stdout, data.Get("subnet")), info)
-						assert.Assert(t, !strings.Contains(data.Get("container2"), data.Get("subnet")), info)
+						assert.Assert(t, strings.Contains(stdout, data.Labels().Get("subnet")), info)
+						assert.Assert(t, !strings.Contains(data.Labels().Get("container2"), data.Labels().Get("subnet")), info)
 					},
 				}
 			},
@@ -83,7 +83,7 @@ func TestNetworkCreate(t *testing.T) {
 			Require:     nerdtest.OnlyIPv6,
 			Setup: func(data test.Data, helpers test.Helpers) {
 				subnetStr := "2001:db8:8::/64"
-				data.Set("subnetStr", subnetStr)
+				data.Labels().Set("subnetStr", subnetStr)
 				_, _, err := net.ParseCIDR(subnetStr)
 				assert.Assert(t, err == nil)
 
@@ -99,7 +99,7 @@ func TestNetworkCreate(t *testing.T) {
 				return &test.Expected{
 					ExitCode: 0,
 					Output: func(stdout string, info string, t *testing.T) {
-						_, subnet, _ := net.ParseCIDR(data.Get("subnetStr"))
+						_, subnet, _ := net.ParseCIDR(data.Labels().Get("subnetStr"))
 						ip := ipv6helper.FindIPv6(stdout)
 						assert.Assert(t, subnet.Contains(ip), info)
 					},
diff --git a/cmd/nerdctl/network/network_inspect_test.go b/cmd/nerdctl/network/network_inspect_test.go
index cb89f25f..f00021e1 100644
--- a/cmd/nerdctl/network/network_inspect_test.go
+++ b/cmd/nerdctl/network/network_inspect_test.go
@@ -29,6 +29,7 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
+	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
 
@@ -43,7 +44,7 @@ func TestNetworkInspect(t *testing.T) {
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		helpers.Ensure("network", "create", data.Identifier("basenet"))
-		data.Set("basenet", data.Identifier("basenet"))
+		data.Labels().Set("basenet", data.Identifier("basenet"))
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -132,7 +133,7 @@ func TestNetworkInspect(t *testing.T) {
 			Description: "match exact id",
 			// See notes below
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				id := strings.TrimSpace(helpers.Capture("network", "inspect", data.Get("basenet"), "--format", "{{ .Id }}"))
+				id := strings.TrimSpace(helpers.Capture("network", "inspect", data.Labels().Get("basenet"), "--format", "{{ .Id }}"))
 				return helpers.Command("network", "inspect", id)
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
@@ -142,7 +143,7 @@ func TestNetworkInspect(t *testing.T) {
 						err := json.Unmarshal([]byte(stdout), &dc)
 						assert.NilError(t, err, "Unable to unmarshal output\n"+info)
 						assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
-						assert.Equal(t, dc[0].Name, data.Get("basenet"))
+						assert.Equal(t, dc[0].Name, data.Labels().Get("basenet"))
 					},
 				}
 			},
@@ -153,7 +154,7 @@ func TestNetworkInspect(t *testing.T) {
 			// This is bizarre, as it is working in the match exact id test - and there does not seem to be a particular reason for that
 			Require: require.Not(require.Windows),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				id := strings.TrimSpace(helpers.Capture("network", "inspect", data.Get("basenet"), "--format", "{{ .Id }}"))
+				id := strings.TrimSpace(helpers.Capture("network", "inspect", data.Labels().Get("basenet"), "--format", "{{ .Id }}"))
 				return helpers.Command("network", "inspect", id[0:25])
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
@@ -163,7 +164,7 @@ func TestNetworkInspect(t *testing.T) {
 						err := json.Unmarshal([]byte(stdout), &dc)
 						assert.NilError(t, err, "Unable to unmarshal output\n"+info)
 						assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
-						assert.Equal(t, dc[0].Name, data.Get("basenet"))
+						assert.Equal(t, dc[0].Name, data.Labels().Get("basenet"))
 					},
 				}
 			},
@@ -174,15 +175,15 @@ func TestNetworkInspect(t *testing.T) {
 			// This is bizarre, as it is working in the match exact id test - and there does not seem to be a particular reason for that
 			Require: require.Not(require.Windows),
 			Setup: func(data test.Data, helpers test.Helpers) {
-				id := strings.TrimSpace(helpers.Capture("network", "inspect", data.Get("basenet"), "--format", "{{ .Id }}"))
+				id := strings.TrimSpace(helpers.Capture("network", "inspect", data.Labels().Get("basenet"), "--format", "{{ .Id }}"))
 				helpers.Ensure("network", "create", id[0:12])
-				data.Set("netname", id[0:12])
+				data.Labels().Set("netname", id[0:12])
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				helpers.Anyhow("network", "remove", data.Get("netname"))
+				helpers.Anyhow("network", "remove", data.Labels().Get("netname"))
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("network", "inspect", data.Get("netname"))
+				return helpers.Command("network", "inspect", data.Labels().Get("netname"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -191,7 +192,7 @@ func TestNetworkInspect(t *testing.T) {
 						err := json.Unmarshal([]byte(stdout), &dc)
 						assert.NilError(t, err, "Unable to unmarshal output\n"+info)
 						assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
-						assert.Equal(t, dc[0].Name, data.Get("netname"))
+						assert.Equal(t, dc[0].Name, data.Labels().Get("netname"))
 					},
 				}
 			},
@@ -278,6 +279,42 @@ func TestNetworkInspect(t *testing.T) {
 				}
 			},
 		},
+		{
+			Description: "Verify that only active containers appear in the network inspect output",
+			Setup: func(data test.Data, helpers test.Helpers) {
+				helpers.Ensure("network", "create", data.Identifier("nginx-network-1"))
+				helpers.Ensure("network", "create", data.Identifier("nginx-network-2"))
+				helpers.Ensure("create", "--name", data.Identifier("nginx-container-1"), "--network", data.Identifier("nginx-network-1"), testutil.NginxAlpineImage)
+				helpers.Ensure("create", "--name", data.Identifier("nginx-container-2"), "--network", data.Identifier("nginx-network-1"), testutil.NginxAlpineImage)
+				helpers.Ensure("create", "--name", data.Identifier("nginx-container-on-diff-network"), "--network", data.Identifier("nginx-network-2"), testutil.NginxAlpineImage)
+				helpers.Ensure("start", data.Identifier("nginx-container-1"), data.Identifier("nginx-container-on-diff-network"))
+				data.Set("nginx-container-1-id", strings.Trim(helpers.Capture("inspect", data.Identifier("nginx-container-1"), "--format", "{{.Id}}"), "\n"))
+			},
+			Cleanup: func(data test.Data, helpers test.Helpers) {
+				helpers.Anyhow("rm", "-f", data.Identifier("nginx-container-1"))
+				helpers.Anyhow("rm", "-f", data.Identifier("nginx-container-2"))
+				helpers.Anyhow("rm", "-f", data.Identifier("nginx-container-on-diff-network"))
+				helpers.Anyhow("network", "remove", data.Identifier("nginx-network-1"))
+				helpers.Anyhow("network", "remove", data.Identifier("nginx-network-2"))
+			},
+			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
+				return helpers.Command("network", "inspect", data.Identifier("nginx-network-1"))
+			},
+			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
+				return &test.Expected{
+					Output: func(stdout string, info string, t *testing.T) {
+						var dc []dockercompat.Network
+						err := json.Unmarshal([]byte(stdout), &dc)
+						assert.NilError(t, err, "Unable to unmarshal output\n"+info)
+						assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
+						assert.Equal(t, dc[0].Name, data.Identifier("nginx-network-1"))
+						// Assert only the "running" containers on the same network are returned.
+						assert.Equal(t, 1, len(dc[0].Containers), "Expected a single container as per configuration, but got multiple.")
+						assert.Equal(t, data.Identifier("nginx-container-1"), dc[0].Containers[data.Get("nginx-container-1-id")].Name)
+					},
+				}
+			},
+		},
 	}
 
 	testCase.Run(t)
diff --git a/cmd/nerdctl/network/network_list_linux_test.go b/cmd/nerdctl/network/network_list_linux_test.go
index 96f35ded..3bf6f9e9 100644
--- a/cmd/nerdctl/network/network_list_linux_test.go
+++ b/cmd/nerdctl/network/network_list_linux_test.go
@@ -31,12 +31,12 @@ func TestNetworkLsFilter(t *testing.T) {
 	testCase := nerdtest.Setup()
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
-		data.Set("identifier", data.Identifier())
-		data.Set("label", "mylabel=label-1")
-		data.Set("net1", data.Identifier("1"))
-		data.Set("net2", data.Identifier("2"))
-		data.Set("netID1", helpers.Capture("network", "create", "--label="+data.Get("label"), data.Get("net1")))
-		data.Set("netID2", helpers.Capture("network", "create", data.Get("net2")))
+		data.Labels().Set("identifier", data.Identifier())
+		data.Labels().Set("label", "mylabel=label-1")
+		data.Labels().Set("net1", data.Identifier("1"))
+		data.Labels().Set("net2", data.Identifier("2"))
+		data.Labels().Set("netID1", helpers.Capture("network", "create", "--label="+data.Labels().Get("label"), data.Labels().Get("net1")))
+		data.Labels().Set("netID2", helpers.Capture("network", "create", data.Labels().Get("net2")))
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -48,7 +48,7 @@ func TestNetworkLsFilter(t *testing.T) {
 		{
 			Description: "filter label",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("network", "ls", "--quiet", "--filter", "label="+data.Get("label"))
+				return helpers.Command("network", "ls", "--quiet", "--filter", "label="+data.Labels().Get("label"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -56,7 +56,7 @@ func TestNetworkLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 1, info)
 						netNames := map[string]struct{}{
-							data.Get("netID1")[:12]: {},
+							data.Labels().Get("netID1")[:12]: {},
 						}
 
 						for _, name := range lines {
@@ -70,7 +70,7 @@ func TestNetworkLsFilter(t *testing.T) {
 		{
 			Description: "filter name",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("network", "ls", "--quiet", "--filter", "name="+data.Get("net2"))
+				return helpers.Command("network", "ls", "--quiet", "--filter", "name="+data.Labels().Get("net2"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -78,7 +78,7 @@ func TestNetworkLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 1, info)
 						netNames := map[string]struct{}{
-							data.Get("netID2")[:12]: {},
+							data.Labels().Get("netID2")[:12]: {},
 						}
 
 						for _, name := range lines {
diff --git a/cmd/nerdctl/network/network_remove_linux_test.go b/cmd/nerdctl/network/network_remove_linux_test.go
index 48906cba..7a86ec37 100644
--- a/cmd/nerdctl/network/network_remove_linux_test.go
+++ b/cmd/nerdctl/network/network_remove_linux_test.go
@@ -40,11 +40,11 @@ func TestNetworkRemove(t *testing.T) {
 			Setup: func(data test.Data, helpers test.Helpers) {
 				identifier := data.Identifier()
 				helpers.Ensure("network", "create", identifier)
-				data.Set("netID", nerdtest.InspectNetwork(helpers, identifier).ID)
+				data.Labels().Set("netID", nerdtest.InspectNetwork(helpers, identifier).ID)
 				helpers.Ensure("run", "--rm", "--net", identifier, "--name", identifier, testutil.CommonImage)
 				// Verity the network is here
-				_, err := netlink.LinkByName("br-" + data.Get("netID")[:12])
-				assert.NilError(t, err, "failed to find network br-"+data.Get("netID")[:12], "%v")
+				_, err := netlink.LinkByName("br-" + data.Labels().Get("netID")[:12])
+				assert.NilError(t, err, "failed to find network br-"+data.Labels().Get("netID")[:12], "%v")
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("network", "rm", data.Identifier())
@@ -56,7 +56,7 @@ func TestNetworkRemove(t *testing.T) {
 				return &test.Expected{
 					ExitCode: 0,
 					Output: func(stdout string, info string, t *testing.T) {
-						_, err := netlink.LinkByName("br-" + data.Get("netID")[:12])
+						_, err := netlink.LinkByName("br-" + data.Labels().Get("netID")[:12])
 						assert.Error(t, err, "Link not found", info)
 					},
 				}
@@ -81,14 +81,14 @@ func TestNetworkRemove(t *testing.T) {
 			Description: "Network remove by id",
 			Setup: func(data test.Data, helpers test.Helpers) {
 				helpers.Ensure("network", "create", data.Identifier())
-				data.Set("netID", nerdtest.InspectNetwork(helpers, data.Identifier()).ID)
+				data.Labels().Set("netID", nerdtest.InspectNetwork(helpers, data.Identifier()).ID)
 				helpers.Ensure("run", "--rm", "--net", data.Identifier(), "--name", data.Identifier(), testutil.CommonImage)
 				// Verity the network is here
-				_, err := netlink.LinkByName("br-" + data.Get("netID")[:12])
-				assert.NilError(t, err, "failed to find network br-"+data.Get("netID")[:12], "%v")
+				_, err := netlink.LinkByName("br-" + data.Labels().Get("netID")[:12])
+				assert.NilError(t, err, "failed to find network br-"+data.Labels().Get("netID")[:12], "%v")
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("network", "rm", data.Get("netID"))
+				return helpers.Command("network", "rm", data.Labels().Get("netID"))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("network", "rm", data.Identifier())
@@ -97,7 +97,7 @@ func TestNetworkRemove(t *testing.T) {
 				return &test.Expected{
 					ExitCode: 0,
 					Output: func(stdout string, info string, t *testing.T) {
-						_, err := netlink.LinkByName("br-" + data.Get("netID")[:12])
+						_, err := netlink.LinkByName("br-" + data.Labels().Get("netID")[:12])
 						assert.Error(t, err, "Link not found", info)
 					},
 				}
@@ -107,14 +107,14 @@ func TestNetworkRemove(t *testing.T) {
 			Description: "Network remove by short id",
 			Setup: func(data test.Data, helpers test.Helpers) {
 				helpers.Ensure("network", "create", data.Identifier())
-				data.Set("netID", nerdtest.InspectNetwork(helpers, data.Identifier()).ID)
+				data.Labels().Set("netID", nerdtest.InspectNetwork(helpers, data.Identifier()).ID)
 				helpers.Ensure("run", "--rm", "--net", data.Identifier(), "--name", data.Identifier(), testutil.CommonImage)
 				// Verity the network is here
-				_, err := netlink.LinkByName("br-" + data.Get("netID")[:12])
-				assert.NilError(t, err, "failed to find network br-"+data.Get("netID")[:12], "%v")
+				_, err := netlink.LinkByName("br-" + data.Labels().Get("netID")[:12])
+				assert.NilError(t, err, "failed to find network br-"+data.Labels().Get("netID")[:12], "%v")
 			},
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("network", "rm", data.Get("netID")[:12])
+				return helpers.Command("network", "rm", data.Labels().Get("netID")[:12])
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("network", "rm", data.Identifier())
@@ -123,7 +123,7 @@ func TestNetworkRemove(t *testing.T) {
 				return &test.Expected{
 					ExitCode: 0,
 					Output: func(stdout string, info string, t *testing.T) {
-						_, err := netlink.LinkByName("br-" + data.Get("netID")[:12])
+						_, err := netlink.LinkByName("br-" + data.Labels().Get("netID")[:12])
 						assert.Error(t, err, "Link not found", info)
 					},
 				}
diff --git a/cmd/nerdctl/system/system_events_linux_test.go b/cmd/nerdctl/system/system_events_linux_test.go
index bcf01bd0..37310bf9 100644
--- a/cmd/nerdctl/system/system_events_linux_test.go
+++ b/cmd/nerdctl/system/system_events_linux_test.go
@@ -29,7 +29,7 @@ import (
 )
 
 func testEventFilterExecutor(data test.Data, helpers test.Helpers) test.TestableCommand {
-	cmd := helpers.Command("events", "--filter", data.Get("filter"), "--format", "json")
+	cmd := helpers.Command("events", "--filter", data.Labels().Get("filter"), "--format", "json")
 	// 3 seconds is too short on slow rig (EL8)
 	cmd.WithTimeout(10 * time.Second)
 	cmd.Background()
@@ -48,11 +48,13 @@ func TestEventFilters(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: expect.ExitCodeTimeout,
-					Output:   expect.Contains(data.Get("output")),
+					Output:   expect.Contains(data.Labels().Get("output")),
 				}
 			},
-			Data: test.WithData("filter", "event=START").
-				Set("output", "\"Status\":\"start\""),
+			Data: test.WithLabels(map[string]string{
+				"filter": "event=START",
+				"output": "\"Status\":\"start\"",
+			}),
 		},
 		{
 			Description: "StartEventFilter",
@@ -60,11 +62,13 @@ func TestEventFilters(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: expect.ExitCodeTimeout,
-					Output:   expect.Contains(data.Get("output")),
+					Output:   expect.Contains(data.Labels().Get("output")),
 				}
 			},
-			Data: test.WithData("filter", "event=start").
-				Set("output", "tatus\":\"start\""),
+			Data: test.WithLabels(map[string]string{
+				"filter": "event=start",
+				"output": "tatus\":\"start\"",
+			}),
 		},
 		{
 			Description: "UnsupportedEventFilter",
@@ -73,11 +77,13 @@ func TestEventFilters(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: expect.ExitCodeTimeout,
-					Output:   expect.Contains(data.Get("output")),
+					Output:   expect.Contains(data.Labels().Get("output")),
 				}
 			},
-			Data: test.WithData("filter", "event=unknown").
-				Set("output", "\"Status\":\"unknown\""),
+			Data: test.WithLabels(map[string]string{
+				"filter": "event=unknown",
+				"output": "\"Status\":\"unknown\"",
+			}),
 		},
 		{
 			Description: "StatusFilter",
@@ -85,11 +91,13 @@ func TestEventFilters(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: expect.ExitCodeTimeout,
-					Output:   expect.Contains(data.Get("output")),
+					Output:   expect.Contains(data.Labels().Get("output")),
 				}
 			},
-			Data: test.WithData("filter", "status=start").
-				Set("output", "tatus\":\"start\""),
+			Data: test.WithLabels(map[string]string{
+				"filter": "status=start",
+				"output": "tatus\":\"start\"",
+			}),
 		},
 		{
 			Description: "UnsupportedStatusFilter",
@@ -98,11 +106,13 @@ func TestEventFilters(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: expect.ExitCodeTimeout,
-					Output:   expect.Contains(data.Get("output")),
+					Output:   expect.Contains(data.Labels().Get("output")),
 				}
 			},
-			Data: test.WithData("filter", "status=unknown").
-				Set("output", "\"Status\":\"unknown\""),
+			Data: test.WithLabels(map[string]string{
+				"filter": "status=unknown",
+				"output": "\"Status\":\"unknown\"",
+			}),
 		},
 	}
 
diff --git a/cmd/nerdctl/system/system_prune_linux_test.go b/cmd/nerdctl/system/system_prune_linux_test.go
index 45a0b896..70a4a9df 100644
--- a/cmd/nerdctl/system/system_prune_linux_test.go
+++ b/cmd/nerdctl/system/system_prune_linux_test.go
@@ -48,12 +48,12 @@ func TestSystemPrune(t *testing.T) {
 				helpers.Ensure("run", "-v", fmt.Sprintf("%s:/volume", data.Identifier()),
 					"--net", data.Identifier(), "--name", data.Identifier(), testutil.CommonImage)
 
-				data.Set("anonIdentifier", anonIdentifier)
+				data.Labels().Set("anonIdentifier", anonIdentifier)
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("network", "rm", data.Identifier())
 				helpers.Anyhow("volume", "rm", data.Identifier())
-				helpers.Anyhow("volume", "rm", data.Get("anonIdentifier"))
+				helpers.Anyhow("volume", "rm", data.Labels().Get("anonIdentifier"))
 				helpers.Anyhow("rm", "-f", data.Identifier())
 			},
 			Command: test.Command("system", "prune", "-f", "--volumes", "--all"),
@@ -66,7 +66,7 @@ func TestSystemPrune(t *testing.T) {
 						images := helpers.Capture("images")
 						containers := helpers.Capture("ps", "-a")
 						assert.Assert(t, strings.Contains(volumes, data.Identifier()), volumes)
-						assert.Assert(t, !strings.Contains(volumes, data.Get("anonIdentifier")), volumes)
+						assert.Assert(t, !strings.Contains(volumes, data.Labels().Get("anonIdentifier")), volumes)
 						assert.Assert(t, !strings.Contains(containers, data.Identifier()), containers)
 						assert.Assert(t, !strings.Contains(networks, data.Identifier()), networks)
 						assert.Assert(t, !strings.Contains(images, testutil.CommonImage), images)
diff --git a/cmd/nerdctl/volume/volume_inspect_test.go b/cmd/nerdctl/volume/volume_inspect_test.go
index 86d07006..af2e7938 100644
--- a/cmd/nerdctl/volume/volume_inspect_test.go
+++ b/cmd/nerdctl/volume/volume_inspect_test.go
@@ -65,8 +65,8 @@ func TestVolumeInspect(t *testing.T) {
 		vol := nerdtest.InspectVolume(helpers, data.Identifier("first"))
 		err := createFileWithSize(vol.Mountpoint, size)
 		assert.NilError(t, err, "File creation failed")
-		data.Set("vol1", data.Identifier("first"))
-		data.Set("vol2", data.Identifier("second"))
+		data.Labels().Set("vol1", data.Identifier("first"))
+		data.Labels().Set("vol2", data.Identifier("second"))
 	}
 
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
@@ -93,15 +93,15 @@ func TestVolumeInspect(t *testing.T) {
 		{
 			Description: "success",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "inspect", data.Get("vol1"))
+				return helpers.Command("volume", "inspect", data.Labels().Get("vol1"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.Contains(data.Get("vol1")),
+						expect.Contains(data.Labels().Get("vol1")),
 						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							assert.Assert(t, len(dc) == 1, fmt.Sprintf("one result, not %d", len(dc))+info)
-							assert.Assert(t, dc[0].Name == data.Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Get("vol1"), dc[0].Name)+info)
+							assert.Assert(t, dc[0].Name == data.Labels().Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Labels().Get("vol1"), dc[0].Name)+info)
 							assert.Assert(t, dc[0].Labels == nil, fmt.Sprintf("expected labels to be nil and were %v", dc[0].Labels)+info)
 						}),
 					),
@@ -111,12 +111,12 @@ func TestVolumeInspect(t *testing.T) {
 		{
 			Description: "inspect labels",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "inspect", data.Get("vol2"))
+				return helpers.Command("volume", "inspect", data.Labels().Get("vol2"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.Contains(data.Get("vol2")),
+						expect.Contains(data.Labels().Get("vol2")),
 						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							labels := *dc[0].Labels
 							assert.Assert(t, len(labels) == 2, fmt.Sprintf("two results, not %d", len(labels)))
@@ -131,12 +131,12 @@ func TestVolumeInspect(t *testing.T) {
 			Description: "inspect size",
 			Require:     require.Not(nerdtest.Docker),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "inspect", "--size", data.Get("vol1"))
+				return helpers.Command("volume", "inspect", "--size", data.Labels().Get("vol1"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.Contains(data.Get("vol1")),
+						expect.Contains(data.Labels().Get("vol1")),
 						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							assert.Assert(t, dc[0].Size == size, fmt.Sprintf("expected size to be %d (was %d)", size, dc[0].Size))
 						}),
@@ -147,17 +147,17 @@ func TestVolumeInspect(t *testing.T) {
 		{
 			Description: "multi success",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "inspect", data.Get("vol1"), data.Get("vol2"))
+				return helpers.Command("volume", "inspect", data.Labels().Get("vol1"), data.Labels().Get("vol2"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.Contains(data.Get("vol1")),
-						expect.Contains(data.Get("vol2")),
+						expect.Contains(data.Labels().Get("vol1")),
+						expect.Contains(data.Labels().Get("vol2")),
 						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							assert.Assert(t, len(dc) == 2, fmt.Sprintf("two results, not %d", len(dc)))
-							assert.Assert(t, dc[0].Name == data.Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Get("vol1"), dc[0].Name))
-							assert.Assert(t, dc[1].Name == data.Get("vol2"), fmt.Sprintf("expected name to be %q (was %q)", data.Get("vol2"), dc[1].Name))
+							assert.Assert(t, dc[0].Name == data.Labels().Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Labels().Get("vol1"), dc[0].Name))
+							assert.Assert(t, dc[1].Name == data.Labels().Get("vol2"), fmt.Sprintf("expected name to be %q (was %q)", data.Labels().Get("vol2"), dc[1].Name))
 						}),
 					),
 				}
@@ -166,17 +166,17 @@ func TestVolumeInspect(t *testing.T) {
 		{
 			Description: "part success multi",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "inspect", "invalid∞", "nonexistent", data.Get("vol1"))
+				return helpers.Command("volume", "inspect", "invalid∞", "nonexistent", data.Labels().Get("vol1"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					ExitCode: 1,
 					Errors:   []error{errdefs.ErrNotFound, errdefs.ErrInvalidArgument},
 					Output: expect.All(
-						expect.Contains(data.Get("vol1")),
+						expect.Contains(data.Labels().Get("vol1")),
 						expect.JSON([]native.Volume{}, func(dc []native.Volume, info string, t tig.T) {
 							assert.Assert(t, len(dc) == 1, fmt.Sprintf("one result, not %d", len(dc)))
-							assert.Assert(t, dc[0].Name == data.Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Get("vol1"), dc[0].Name))
+							assert.Assert(t, dc[0].Name == data.Labels().Get("vol1"), fmt.Sprintf("expected name to be %q (was %q)", data.Labels().Get("vol1"), dc[0].Name))
 						}),
 					),
 				}
diff --git a/cmd/nerdctl/volume/volume_list_test.go b/cmd/nerdctl/volume/volume_list_test.go
index 0610925d..d666595a 100644
--- a/cmd/nerdctl/volume/volume_list_test.go
+++ b/cmd/nerdctl/volume/volume_list_test.go
@@ -122,22 +122,22 @@ func TestVolumeLsFilter(t *testing.T) {
 		err = createFileWithSize(nerdtest.InspectVolume(helpers, vol4).Mountpoint, 1024000)
 		assert.NilError(t, err, "File creation failed")
 
-		data.Set("vol1", vol1)
-		data.Set("vol2", vol2)
-		data.Set("vol3", vol3)
-		data.Set("vol4", vol4)
-		data.Set("mainlabel", "mylabel")
-		data.Set("label1", label1)
-		data.Set("label2", label2)
-		data.Set("label3", label3)
-		data.Set("label4", label4)
+		data.Labels().Set("vol1", vol1)
+		data.Labels().Set("vol2", vol2)
+		data.Labels().Set("vol3", vol3)
+		data.Labels().Set("vol4", vol4)
+		data.Labels().Set("mainlabel", "mylabel")
+		data.Labels().Set("label1", label1)
+		data.Labels().Set("label2", label2)
+		data.Labels().Set("label3", label3)
+		data.Labels().Set("label4", label4)
 
 	}
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
-		helpers.Anyhow("volume", "rm", "-f", data.Get("vol1"))
-		helpers.Anyhow("volume", "rm", "-f", data.Get("vol2"))
-		helpers.Anyhow("volume", "rm", "-f", data.Get("vol3"))
-		helpers.Anyhow("volume", "rm", "-f", data.Get("vol4"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("vol1"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("vol2"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("vol3"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("vol4"))
 	}
 	testCase.SubTests = []*test.Case{
 		{
@@ -149,10 +149,10 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 4, "expected at least 4 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol1"): {},
-							data.Get("vol2"): {},
-							data.Get("vol3"): {},
-							data.Get("vol4"): {},
+							data.Labels().Get("vol1"): {},
+							data.Labels().Get("vol2"): {},
+							data.Labels().Get("vol3"): {},
+							data.Labels().Get("vol4"): {},
 						}
 						var numMatches = 0
 						for _, name := range lines {
@@ -170,7 +170,7 @@ func TestVolumeLsFilter(t *testing.T) {
 		{
 			Description: "Retrieving label=mainlabel",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Get("mainlabel"))
+				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Labels().Get("mainlabel"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -178,9 +178,9 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 3, "expected at least 3 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol1"): {},
-							data.Get("vol2"): {},
-							data.Get("vol3"): {},
+							data.Labels().Get("vol1"): {},
+							data.Labels().Get("vol2"): {},
+							data.Labels().Get("vol3"): {},
 						}
 						for _, name := range lines {
 							_, ok := volNames[name]
@@ -193,7 +193,7 @@ func TestVolumeLsFilter(t *testing.T) {
 		{
 			Description: "Retrieving label=mainlabel=label2",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Get("label2"))
+				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Labels().Get("label2"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -201,7 +201,7 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 1, "expected at least 1 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol2"): {},
+							data.Labels().Get("vol2"): {},
 						}
 						for _, name := range lines {
 							_, ok := volNames[name]
@@ -214,7 +214,7 @@ func TestVolumeLsFilter(t *testing.T) {
 		{
 			Description: "Retrieving label=mainlabel=",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Get("mainlabel")+"=")
+				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Labels().Get("mainlabel")+"=")
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -227,7 +227,7 @@ func TestVolumeLsFilter(t *testing.T) {
 		{
 			Description: "Retrieving label=mainlabel=label1 and label=mainlabel=label2",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Get("label1"), "--filter", "label="+data.Get("label2"))
+				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Labels().Get("label1"), "--filter", "label="+data.Labels().Get("label2"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -240,7 +240,7 @@ func TestVolumeLsFilter(t *testing.T) {
 		{
 			Description: "Retrieving label=mainlabel and label=grouplabel=label4",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Get("mainlabel"), "--filter", "label="+data.Get("label4"))
+				return helpers.Command("volume", "ls", "--quiet", "--filter", "label="+data.Labels().Get("mainlabel"), "--filter", "label="+data.Labels().Get("label4"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -248,8 +248,8 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 2, "expected at least 2 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol1"): {},
-							data.Get("vol2"): {},
+							data.Labels().Get("vol1"): {},
+							data.Labels().Get("vol2"): {},
 						}
 						for _, name := range lines {
 							_, ok := volNames[name]
@@ -262,7 +262,7 @@ func TestVolumeLsFilter(t *testing.T) {
 		{
 			Description: "Retrieving name=volume1",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "ls", "--quiet", "--filter", "name="+data.Get("vol1"))
+				return helpers.Command("volume", "ls", "--quiet", "--filter", "name="+data.Labels().Get("vol1"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -270,7 +270,7 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 1, "expected at least 1 line"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol1"): {},
+							data.Labels().Get("vol1"): {},
 						}
 						for _, name := range lines {
 							_, ok := volNames[name]
@@ -285,7 +285,7 @@ func TestVolumeLsFilter(t *testing.T) {
 			// Nerdctl filter behavior is broken
 			Require: nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3452"),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "ls", "--quiet", "--filter", "name="+data.Get("vol1"), "--filter", "name="+data.Get("vol2"))
+				return helpers.Command("volume", "ls", "--quiet", "--filter", "name="+data.Labels().Get("vol1"), "--filter", "name="+data.Labels().Get("vol2"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
@@ -293,8 +293,8 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 2, "expected at least 2 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol1"): {},
-							data.Get("vol2"): {},
+							data.Labels().Get("vol1"): {},
+							data.Labels().Get("vol2"): {},
 						}
 						for _, name := range lines {
 							_, ok := volNames[name]
@@ -316,8 +316,8 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 3, "expected at least 3 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol2"): {},
-							data.Get("vol4"): {},
+							data.Labels().Get("vol2"): {},
+							data.Labels().Get("vol4"): {},
 						}
 						var tab = tabutil.NewReader("VOLUME NAME\tDIRECTORY\tSIZE")
 						var err = tab.ParseHeader(lines[0])
@@ -347,8 +347,8 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 3, "expected at least 3 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol2"): {},
-							data.Get("vol4"): {},
+							data.Labels().Get("vol2"): {},
+							data.Labels().Get("vol4"): {},
 						}
 						var tab = tabutil.NewReader("VOLUME NAME\tDIRECTORY\tSIZE")
 						var err = tab.ParseHeader(lines[0])
@@ -378,8 +378,8 @@ func TestVolumeLsFilter(t *testing.T) {
 						var lines = strings.Split(strings.TrimSpace(stdout), "\n")
 						assert.Assert(t, len(lines) >= 3, "expected at least 3 lines"+info)
 						volNames := map[string]struct{}{
-							data.Get("vol1"): {},
-							data.Get("vol3"): {},
+							data.Labels().Get("vol1"): {},
+							data.Labels().Get("vol3"): {},
 						}
 						var tab = tabutil.NewReader("VOLUME NAME\tDIRECTORY\tSIZE")
 						var err = tab.ParseHeader(lines[0])
diff --git a/cmd/nerdctl/volume/volume_namespace_test.go b/cmd/nerdctl/volume/volume_namespace_test.go
index a4b351d9..341d2d37 100644
--- a/cmd/nerdctl/volume/volume_namespace_test.go
+++ b/cmd/nerdctl/volume/volume_namespace_test.go
@@ -35,14 +35,14 @@ func TestVolumeNamespace(t *testing.T) {
 
 	// Create a volume in a different namespace
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
-		data.Set("root_namespace", data.Identifier())
-		data.Set("root_volume", data.Identifier())
+		data.Labels().Set("root_namespace", data.Identifier())
+		data.Labels().Set("root_volume", data.Identifier())
 		helpers.Ensure("--namespace", data.Identifier(), "volume", "create", data.Identifier())
 	}
 
 	// Cleanup once done
 	testCase.Cleanup = func(data test.Data, helpers test.Helpers) {
-		if data.Get("root_namespace") != "" {
+		if data.Labels().Get("root_namespace") != "" {
 			helpers.Anyhow("--namespace", data.Identifier(), "volume", "remove", data.Identifier())
 			helpers.Anyhow("namespace", "remove", data.Identifier())
 		}
@@ -52,7 +52,7 @@ func TestVolumeNamespace(t *testing.T) {
 		{
 			Description: "inspect another namespace volume should fail",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "inspect", data.Get("root_volume"))
+				return helpers.Command("volume", "inspect", data.Labels().Get("root_volume"))
 			},
 			Expected: test.Expects(1, []error{
 				errdefs.ErrNotFound,
@@ -61,7 +61,7 @@ func TestVolumeNamespace(t *testing.T) {
 		{
 			Description: "removing another namespace volume should fail",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "remove", data.Get("root_volume"))
+				return helpers.Command("volume", "remove", data.Labels().Get("root_volume"))
 			},
 			Expected: test.Expects(1, []error{
 				errdefs.ErrNotFound,
@@ -75,9 +75,9 @@ func TestVolumeNamespace(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.DoesNotContain(data.Get("root_volume")),
+						expect.DoesNotContain(data.Labels().Get("root_volume")),
 						func(stdout string, info string, t *testing.T) {
-							helpers.Ensure("--namespace", data.Get("root_namespace"), "volume", "inspect", data.Get("root_volume"))
+							helpers.Ensure("--namespace", data.Labels().Get("root_namespace"), "volume", "inspect", data.Labels().Get("root_volume"))
 						},
 					),
 				}
@@ -87,17 +87,17 @@ func TestVolumeNamespace(t *testing.T) {
 			Description: "create with the same name should work, then delete it",
 			NoParallel:  true,
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
-				return helpers.Command("volume", "create", data.Get("root_volume"))
+				return helpers.Command("volume", "create", data.Labels().Get("root_volume"))
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
-				helpers.Anyhow("volume", "rm", data.Get("root_volume"))
+				helpers.Anyhow("volume", "rm", data.Labels().Get("root_volume"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: func(stdout string, info string, t *testing.T) {
-						helpers.Ensure("volume", "inspect", data.Get("root_volume"))
-						helpers.Ensure("volume", "rm", data.Get("root_volume"))
-						helpers.Ensure("--namespace", data.Get("root_namespace"), "volume", "inspect", data.Get("root_volume"))
+						helpers.Ensure("volume", "inspect", data.Labels().Get("root_volume"))
+						helpers.Ensure("volume", "rm", data.Labels().Get("root_volume"))
+						helpers.Ensure("--namespace", data.Labels().Get("root_namespace"), "volume", "inspect", data.Labels().Get("root_volume"))
 					},
 				}
 			},
diff --git a/cmd/nerdctl/volume/volume_prune_linux_test.go b/cmd/nerdctl/volume/volume_prune_linux_test.go
index 10b4e6b8..16f69bca 100644
--- a/cmd/nerdctl/volume/volume_prune_linux_test.go
+++ b/cmd/nerdctl/volume/volume_prune_linux_test.go
@@ -41,18 +41,18 @@ func TestVolumePrune(t *testing.T) {
 			"-v", namedBusy+":/namedbusyvolume",
 			"-v", anonIDBusy+":/anonbusyvolume", testutil.CommonImage)
 
-		data.Set("anonIDBusy", anonIDBusy)
-		data.Set("anonIDDangling", anonIDDangling)
-		data.Set("namedBusy", namedBusy)
-		data.Set("namedDangling", namedDangling)
+		data.Labels().Set("anonIDBusy", anonIDBusy)
+		data.Labels().Set("anonIDDangling", anonIDDangling)
+		data.Labels().Set("namedBusy", namedBusy)
+		data.Labels().Set("namedDangling", namedDangling)
 	}
 
 	var cleanup = func(data test.Data, helpers test.Helpers) {
 		helpers.Anyhow("rm", "-f", data.Identifier())
-		helpers.Anyhow("volume", "rm", "-f", data.Get("anonIDBusy"))
-		helpers.Anyhow("volume", "rm", "-f", data.Get("anonIDDangling"))
-		helpers.Anyhow("volume", "rm", "-f", data.Get("namedBusy"))
-		helpers.Anyhow("volume", "rm", "-f", data.Get("namedDangling"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("anonIDBusy"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("anonIDDangling"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("namedBusy"))
+		helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("namedDangling"))
 	}
 
 	testCase := nerdtest.Setup()
@@ -69,15 +69,15 @@ func TestVolumePrune(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.DoesNotContain(data.Get("anonIDBusy")),
-						expect.Contains(data.Get("anonIDDangling")),
-						expect.DoesNotContain(data.Get("namedBusy")),
-						expect.DoesNotContain(data.Get("namedDangling")),
+						expect.DoesNotContain(data.Labels().Get("anonIDBusy")),
+						expect.Contains(data.Labels().Get("anonIDDangling")),
+						expect.DoesNotContain(data.Labels().Get("namedBusy")),
+						expect.DoesNotContain(data.Labels().Get("namedDangling")),
 						func(stdout string, info string, t *testing.T) {
-							helpers.Ensure("volume", "inspect", data.Get("anonIDBusy"))
-							helpers.Fail("volume", "inspect", data.Get("anonIDDangling"))
-							helpers.Ensure("volume", "inspect", data.Get("namedBusy"))
-							helpers.Ensure("volume", "inspect", data.Get("namedDangling"))
+							helpers.Ensure("volume", "inspect", data.Labels().Get("anonIDBusy"))
+							helpers.Fail("volume", "inspect", data.Labels().Get("anonIDDangling"))
+							helpers.Ensure("volume", "inspect", data.Labels().Get("namedBusy"))
+							helpers.Ensure("volume", "inspect", data.Labels().Get("namedDangling"))
 						},
 					),
 				}
@@ -92,15 +92,15 @@ func TestVolumePrune(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
 					Output: expect.All(
-						expect.DoesNotContain(data.Get("anonIDBusy")),
-						expect.Contains(data.Get("anonIDDangling")),
-						expect.DoesNotContain(data.Get("namedBusy")),
-						expect.Contains(data.Get("namedDangling")),
+						expect.DoesNotContain(data.Labels().Get("anonIDBusy")),
+						expect.Contains(data.Labels().Get("anonIDDangling")),
+						expect.DoesNotContain(data.Labels().Get("namedBusy")),
+						expect.Contains(data.Labels().Get("namedDangling")),
 						func(stdout string, info string, t *testing.T) {
-							helpers.Ensure("volume", "inspect", data.Get("anonIDBusy"))
-							helpers.Fail("volume", "inspect", data.Get("anonIDDangling"))
-							helpers.Ensure("volume", "inspect", data.Get("namedBusy"))
-							helpers.Fail("volume", "inspect", data.Get("namedDangling"))
+							helpers.Ensure("volume", "inspect", data.Labels().Get("anonIDBusy"))
+							helpers.Fail("volume", "inspect", data.Labels().Get("anonIDDangling"))
+							helpers.Ensure("volume", "inspect", data.Labels().Get("namedBusy"))
+							helpers.Fail("volume", "inspect", data.Labels().Get("namedDangling"))
 						},
 					),
 				}
diff --git a/cmd/nerdctl/volume/volume_remove_linux_test.go b/cmd/nerdctl/volume/volume_remove_linux_test.go
index 01680bd3..1fb98e77 100644
--- a/cmd/nerdctl/volume/volume_remove_linux_test.go
+++ b/cmd/nerdctl/volume/volume_remove_linux_test.go
@@ -89,17 +89,17 @@ func TestVolumeRemove(t *testing.T) {
 					}
 				}
 				assert.Assert(t, anonName != "", "Failed to find anonymous volume id", inspect)
-				data.Set("anonName", anonName)
+				data.Labels().Set("anonName", anonName)
 			},
 
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
-				helpers.Anyhow("volume", "rm", "-f", data.Get("anonName"))
+				helpers.Anyhow("volume", "rm", "-f", data.Labels().Get("anonName"))
 			},
 
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				// Try to remove that anon volume
-				return helpers.Command("volume", "rm", data.Get("anonName"))
+				return helpers.Command("volume", "rm", data.Labels().Get("anonName"))
 			},
 
 			Expected: test.Expects(1, []error{errdefs.ErrFailedPrecondition}, nil),
diff --git a/mod/tigron/internal/com/command_test.go b/mod/tigron/internal/com/command_test.go
index 9c5d0b7e..ebbb5075 100644
--- a/mod/tigron/internal/com/command_test.go
+++ b/mod/tigron/internal/com/command_test.go
@@ -427,7 +427,10 @@ func TestTimeoutPlain(t *testing.T) {
 	end := time.Now()
 
 	assertive.ErrorIs(t, err, com.ErrTimeout, "Err")
-	assertive.IsEqual(t, res.ExitCode, -1, "ExitCode")
+	// FIXME? It seems like on windows exitcode is randomly 1 on timeout
+	// This is not a problem, as with a time-out we do not care about exit code, but is raising questions
+	// about golang underlying implementation / command cancellation mechanism.
+	// assertive.IsEqual(t, res.ExitCode, -1, "ExitCode")
 	assertive.IsEqual(t, res.Stdout, "one", "Stdout")
 	assertive.IsEqual(t, res.Stderr, "", "Stderr")
 	assertive.IsLessThan(t, end.Sub(start), 2*time.Second, "Total execution time")
@@ -455,7 +458,10 @@ func TestTimeoutDelayed(t *testing.T) {
 	end := time.Now()
 
 	assertive.ErrorIs(t, err, com.ErrTimeout, "Err")
-	assertive.IsEqual(t, res.ExitCode, -1, "ExitCode")
+	// FIXME? It seems like on windows exitcode is randomly 1 on timeout
+	// This is not a problem, as with a time-out we do not care about exit code, but is raising questions
+	// about golang underlying implementation / command cancellation mechanism.
+	// assertive.IsEqual(t, res.ExitCode, -1, "ExitCode")
 	assertive.IsEqual(t, res.Stdout, "one", "Stdout")
 	assertive.IsEqual(t, res.Stderr, "", "Stderr")
 	assertive.IsLessThan(t, end.Sub(start), 3*time.Second, "Total execution time")
diff --git a/mod/tigron/test/case.go b/mod/tigron/test/case.go
index 6a703e96..67846dfb 100644
--- a/mod/tigron/test/case.go
+++ b/mod/tigron/test/case.go
@@ -19,7 +19,9 @@ package test
 import (
 	"encoding/json"
 	"fmt"
+	"os"
 	"slices"
+	"strings"
 	"testing"
 
 	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
@@ -71,6 +73,7 @@ const (
 	setupDecorator  = "🏗"
 	subinDecorator  = "⤵️"
 	suboutDecorator = "↩️"
+	tempDecorator   = "⏳"
 )
 
 // Run prepares and executes the test, and any possible subtests.
@@ -115,7 +118,7 @@ func (test *Case) Run(t *testing.T) {
 		}
 
 		// Inherit and attach Data and Config
-		test.Data = configureData(test.t, test.Data, parentData)
+		test.Data = newData(test.t, test.Data, parentData)
 		test.Config = configureConfig(test.Config, parentConfig)
 
 		var custCom CustomizableCommand
@@ -125,9 +128,13 @@ func (test *Case) Run(t *testing.T) {
 			custCom = registeredTestable.CustomCommand(test, test.t)
 		}
 
-		custCom.WithCwd(test.Data.TempDir())
+		// Separate cwd from the temp directory
+		custCom.WithCwd(test.t.TempDir())
 		custCom.withT(test.t)
-		custCom.withTempDir(test.Data.TempDir())
+		// Set the command tempdir to another temp location.
+		// This is required for the current extension mechanism to allow creation of command dependent configuration
+		// assets. Note that this is a different location than both CWD and Data.Temp().Path().
+		custCom.withTempDir(test.t.TempDir())
 		custCom.withEnv(test.Env)
 		custCom.withConfig(test.Config)
 
@@ -229,18 +236,28 @@ func (test *Case) Run(t *testing.T) {
 			debugConfig, _ := json.MarshalIndent(test.Config.(*config).config, "", "  ")
 			debugData, _ := json.MarshalIndent(test.Data.(*data).labels, "", "  ")
 
+			// Show the files in the temp directory BEFORE the command is executed
+			tempFiles := []string{}
+
+			if files, err := os.ReadDir(test.Data.Temp().Path()); err == nil {
+				for _, file := range files {
+					tempFiles = append(tempFiles, file.Name())
+				}
+			}
+
 			test.t.Log(
 				"\n\n" + formatter.Table(
 					[][]any{
 						{startDecorator, fmt.Sprintf("%q: starting test!", test.t.Name())},
-						{"cwd", test.Data.TempDir()},
+						{tempDecorator, test.Data.Temp().Dir()},
+						{"", strings.Join(tempFiles, "\n")},
 						{"config", string(debugConfig)},
-						{"data", string(debugData)},
+						{"labels", string(debugData)},
 					},
 					"=",
 				) + "\n",
 			)
-
+			// FIXME: so, the expected function will run BEFORE the command
 			cmd.Run(test.Expected(test.Data, test.helpers))
 		}
 
diff --git a/mod/tigron/test/command.go b/mod/tigron/test/command.go
index 0c1970d8..1516cf8d 100644
--- a/mod/tigron/test/command.go
+++ b/mod/tigron/test/command.go
@@ -39,6 +39,10 @@ const (
 	exitDecorator           = "⚠️"
 	stdoutDecorator         = "🟢"
 	stderrDecorator         = "🟠"
+	timeoutDecorator        = "⏰"
+	cwdDecorator            = "📁"
+	envDecorator            = "🌱"
+	sigDecorator            = "⚡"
 )
 
 // CustomizableCommand is an interface meant for people who want to heavily customize the base
@@ -61,6 +65,7 @@ type CustomizableCommand interface {
 	// Note that this will override any variable defined in the embedding environment
 	withEnv(env map[string]string)
 	// withTempDir specifies a temporary directory to use
+	// FIXME: this is only required because of the current command extension mechanism
 	withTempDir(path string)
 	// WithConfig allows passing custom config properties from the test to the base command
 	withConfig(config Config)
@@ -126,6 +131,10 @@ func (gc *GenericCommand) Feed(r io.Reader) {
 	gc.cmd.Feed(r)
 }
 
+func (gc *GenericCommand) Setenv(key, value string) {
+	gc.cmd.Env[key] = value
+}
+
 func (gc *GenericCommand) WithFeeder(fun func() io.Reader) {
 	gc.cmd.WithFeeder(fun)
 }
@@ -138,6 +147,10 @@ func (gc *GenericCommand) WithBlacklist(env []string) {
 	gc.cmd.EnvBlackList = env
 }
 
+func (gc *GenericCommand) WithWhitelist(env []string) {
+	gc.cmd.EnvWhiteList = env
+}
+
 func (gc *GenericCommand) WithTimeout(timeout time.Duration) {
 	gc.cmd.Timeout = timeout
 }
@@ -193,12 +206,18 @@ func (gc *GenericCommand) Run(expect *Expected) {
 		}
 
 		if result.Signal != nil {
-			debug = append(debug, []any{"Signal", result.Signal.String()})
+			debug = append(debug, []any{"", sigDecorator + " " + result.Signal.String()})
+		}
+
+		duration := result.Duration.String()
+		if result.Duration < time.Second {
+			duration = "<1s"
 		}
 
 		debug = append(debug,
-			[]any{"Limit", gc.cmd.Timeout},
-			[]any{"Environ", strings.Join(result.Environ, "\n")},
+			[]any{envDecorator, strings.Join(result.Environ, "\n")},
+			[]any{timeoutDecorator, duration + " (limit: " + gc.cmd.Timeout.String() + ")"},
+			[]any{cwdDecorator, gc.cmd.WorkingDir},
 		)
 	}
 
diff --git a/mod/tigron/test/consts.go b/mod/tigron/test/consts.go
new file mode 100644
index 00000000..a54b54a9
--- /dev/null
+++ b/mod/tigron/test/consts.go
@@ -0,0 +1,26 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package test
+
+const (
+	// FilePermissionsDefault specifies the default creation mode for temporary files.
+	// Note that umask will affect these.
+	FilePermissionsDefault = 0o644
+	// DirPermissionsDefault specifies the default creation mode for temporary directories.
+	// Note that umask will affect these.
+	DirPermissionsDefault = 0o755
+)
diff --git a/mod/tigron/test/data.go b/mod/tigron/test/data.go
index 8907b9ca..d5583d60 100644
--- a/mod/tigron/test/data.go
+++ b/mod/tigron/test/data.go
@@ -19,9 +19,13 @@ package test
 import (
 	"crypto/sha256"
 	"fmt"
+	"os"
+	"path/filepath"
 	"regexp"
 	"strings"
-	"testing"
+
+	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
+	"github.com/containerd/nerdctl/mod/tigron/tig"
 )
 
 const (
@@ -30,79 +34,181 @@ const (
 	identifierSignatureLength = 8
 )
 
-// WithData returns a data object with a certain key value set.
-func WithData(key, value string) Data {
-	dat := &data{}
-	dat.Set(key, value)
+// WithLabels returns a Data object with specific key value labels set.
+func WithLabels(in map[string]string) Data {
+	dat := &data{
+		labels: &labels{
+			inMap: in,
+		},
+		temp: &temp{},
+	}
 
 	return dat
 }
 
-// Contains the implementation of the Data interface.
-func configureData(t *testing.T, seedData, parent Data) Data {
-	t.Helper()
+type labels struct {
+	inMap map[string]string
+}
 
-	if seedData == nil {
-		seedData = &data{}
-	}
+func (lb *labels) Get(key string) string {
+	return lb.inMap[key]
+}
 
-	//nolint:forcetypeassert
-	dat := &data{
-		// Note: implementation dependent
-		labels:  seedData.(*data).labels,
-		tempDir: t.TempDir(),
-		testID: func(suffix ...string) string {
-			suffix = append([]string{t.Name()}, suffix...)
+func (lb *labels) Set(key, value string) {
+	lb.inMap[key] = value
+}
 
-			return defaultIdentifierHashing(suffix...)
-		},
-	}
+type temp struct {
+	tempDir string
+	t       tig.T
+}
 
-	if parent != nil {
-		dat.adopt(parent)
-	}
+func (tp *temp) Load(key ...string) string {
+	tp.t.Helper()
 
-	return dat
+	pth := filepath.Join(append([]string{tp.tempDir}, key...)...)
+
+	//nolint:gosec // Fine in the context of testing
+	content, err := os.ReadFile(pth)
+
+	assertive.ErrorIsNil(
+		assertive.WithSilentSuccess(tp.t),
+		err,
+		fmt.Sprintf("Loading file %q must succeed", pth),
+	)
+
+	return string(content)
 }
 
-type data struct {
-	labels  map[string]string
-	testID  func(suffix ...string) string
-	tempDir string
+func (tp *temp) Exists(key ...string) {
+	tp.t.Helper()
+
+	pth := filepath.Join(append([]string{tp.tempDir}, key...)...)
+
+	_, err := os.Stat(pth)
+
+	assertive.ErrorIsNil(
+		assertive.WithSilentSuccess(tp.t),
+		err,
+		fmt.Sprintf("File %q must exist", pth),
+	)
 }
 
-func (dt *data) Get(key string) string {
-	return dt.labels[key]
+func (tp *temp) Save(value string, key ...string) string {
+	tp.t.Helper()
+
+	tp.Dir(key[:len(key)-1]...)
+
+	pth := filepath.Join(append([]string{tp.tempDir}, key...)...)
+
+	err := os.WriteFile(
+		pth,
+		[]byte(value),
+		FilePermissionsDefault,
+	)
+
+	assertive.ErrorIsNil(
+		assertive.WithSilentSuccess(tp.t),
+		err,
+		fmt.Sprintf("Saving file %q must succeed", filepath.Join(key...)),
+	)
+
+	return pth
 }
 
-func (dt *data) Set(key, value string) Data {
-	if dt.labels == nil {
-		dt.labels = map[string]string{}
-	}
+func (tp *temp) Dir(key ...string) string {
+	tp.t.Helper()
+
+	pth := filepath.Join(append([]string{tp.tempDir}, key...)...)
+	err := os.MkdirAll(pth, DirPermissionsDefault)
+
+	assertive.ErrorIsNil(
+		assertive.WithSilentSuccess(tp.t),
+		err,
+		fmt.Sprintf("Creating directory %q must succeed", pth),
+	)
+
+	return pth
+}
+
+func (tp *temp) Path(key ...string) string {
+	tp.t.Helper()
 
-	dt.labels[key] = value
+	return filepath.Join(append([]string{tp.tempDir}, key...)...)
+}
 
-	return dt
+type data struct {
+	temp   DataTemp
+	labels DataLabels
+	testID func(suffix ...string) string
 }
 
 func (dt *data) Identifier(suffix ...string) string {
 	return dt.testID(suffix...)
 }
 
-func (dt *data) TempDir() string {
-	return dt.tempDir
+func (dt *data) Labels() DataLabels {
+	return dt.labels
 }
 
-func (dt *data) adopt(parent Data) {
-	// Note: implementation dependent
-	if castData, ok := parent.(*data); ok {
-		for k, v := range castData.labels {
+func (dt *data) Temp() DataTemp {
+	return dt.temp
+}
+
+// Contains the implementation of the Data interface
+//
+//nolint:varnamelen
+func newData(t tig.T, seed, parent Data) Data {
+	t.Helper()
+
+	t = assertive.WithSilentSuccess(t)
+
+	seedMap := map[string]string{}
+
+	if seed != nil {
+		if inLab, ok := seed.Labels().(*labels); ok {
+			seedMap = inLab.inMap
+		}
+	}
+
+	if parent != nil {
+		for k, v := range parent.Labels().(*labels).inMap {
 			// Only copy keys that are not set already
-			if _, ok := dt.labels[k]; !ok {
-				dt.Set(k, v)
+			if _, ok := seedMap[k]; !ok {
+				seedMap[k] = v
 			}
 		}
 	}
+
+	// NOTE: certain systems will use the path dirname to decide how they name resources.
+	// t.TempDir() will always return /tmp/TestTempDir2153252249/001, meaning these systems will all
+	// use the identical 001 part. This is true for compose specifically.
+	// Appending the base test identifier here would guarantee better unicity.
+	// Note though that Windows will barf if >256 characters, so, hashing...
+	// Small caveat: identically named tests in different modules WILL still end-up with the same last segment.
+	tempDir := filepath.Join(
+		t.TempDir(),
+		fmt.Sprintf("%x", sha256.Sum256([]byte(t.Name())))[0:identifierSignatureLength],
+	)
+
+	assertive.ErrorIsNil(t, os.MkdirAll(tempDir, DirPermissionsDefault))
+
+	dat := &data{
+		labels: &labels{
+			inMap: seedMap,
+		},
+		temp: &temp{
+			tempDir: tempDir,
+			t:       t,
+		},
+		testID: func(suffix ...string) string {
+			suffix = append([]string{t.Name()}, suffix...)
+
+			return defaultIdentifierHashing(suffix...)
+		},
+	}
+
+	return dat
 }
 
 func defaultIdentifierHashing(names ...string) string {
diff --git a/mod/tigron/test/data_test.go b/mod/tigron/test/data_test.go
index dff839d6..37e0c1c0 100644
--- a/mod/tigron/test/data_test.go
+++ b/mod/tigron/test/data_test.go
@@ -24,34 +24,45 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/internal/assertive"
 )
 
-func TestDataBasic(t *testing.T) {
+func TestLabels(t *testing.T) {
 	t.Parallel()
 
-	dataObj := WithData("test", "create")
+	dataLabels := WithLabels(map[string]string{"test": "create"}).Labels()
 
-	assertive.IsEqual(t, dataObj.Get("test"), "create")
-	assertive.IsEqual(t, dataObj.Get("doesnotexist"), "")
+	assertive.IsEqual(t, dataLabels.Get("test"), "create")
+	assertive.IsEqual(t, dataLabels.Get("doesnotexist"), "")
 
-	dataObj.Set("test", "set")
-	assertive.IsEqual(t, dataObj.Get("test"), "set")
+	dataLabels.Set("test", "set")
+	assertive.IsEqual(t, dataLabels.Get("test"), "set")
+
+	dataLabels.Set("test", "reset")
+	assertive.IsEqual(t, dataLabels.Get("test"), "reset")
 }
 
-func TestDataTempDir(t *testing.T) {
+func TestTemp(t *testing.T) {
 	t.Parallel()
 
-	dataObj := configureData(t, nil, nil)
+	dataObj := newData(t, nil, nil)
 
-	one := dataObj.TempDir()
-	two := dataObj.TempDir()
+	one := dataObj.Temp().Path()
+	two := dataObj.Temp().Path()
 
 	assertive.IsEqual(t, one, two)
 	assertive.IsNotEqual(t, one, "")
+
+	t.Run("verify that subtest has an independent TempDir", func(t *testing.T) {
+		t.Parallel()
+
+		dataObj = newData(t, nil, nil)
+		three := dataObj.Temp().Path()
+		assertive.IsNotEqual(t, one, three)
+	})
 }
 
 func TestDataIdentifier(t *testing.T) {
 	t.Parallel()
 
-	dataObj := configureData(t, nil, nil)
+	dataObj := newData(t, nil, nil)
 
 	one := dataObj.Identifier()
 	two := dataObj.Identifier()
@@ -68,7 +79,7 @@ func TestDataIdentifierThatIsReallyReallyReallyReallyReallyReallyReallyReallyRea
 ) {
 	t.Parallel()
 
-	dataObj := configureData(t, nil, nil)
+	dataObj := newData(t, nil, nil)
 
 	one := dataObj.Identifier()
 	two := dataObj.Identifier()
diff --git a/mod/tigron/test/funct.go b/mod/tigron/test/funct.go
index 8614b9cb..45b4abbd 100644
--- a/mod/tigron/test/funct.go
+++ b/mod/tigron/test/funct.go
@@ -25,8 +25,11 @@ type Evaluator func(data Data, helpers Helpers) (bool, string)
 // or Requirement.
 type Butler func(data Data, helpers Helpers)
 
+// TODO: when we will break API:
+// - remove the info parameter
+// - move to tig.T
+
 // A Comparator is the function signature to implement for the Output property of an Expected.
-// TODO: when we will break API, remove the info parameter.
 type Comparator func(stdout, info string, t *testing.T)
 
 // A Manager is the function signature meant to produce expectations for a command.
diff --git a/mod/tigron/test/interfaces.go b/mod/tigron/test/interfaces.go
index 07f34899..afa52013 100644
--- a/mod/tigron/test/interfaces.go
+++ b/mod/tigron/test/interfaces.go
@@ -23,22 +23,44 @@ import (
 	"time"
 )
 
-// Data is meant to hold information about a test:
-// - first, any random key value data that the test implementer wants to carry / modify - this is
-// test data - second, some commonly useful immutable test properties (a way to generate unique
-// identifiers for that test, temporary directory, etc.)
-// Note that Data is inherited, from parent test to subtest (except for Identifier and TempDir of
-// course).
-type Data interface {
-	// Get returns the value of a certain key for custom data
+// DataLabels holds key-value test information set by the test authors.
+// Note that retrieving a non-existent label will return the empty string.
+type DataLabels interface {
+	// Get returns the value of the requested label.
 	Get(key string) string
-	// Set will save `value` for `key`
-	Set(key, value string) Data
+	// Set will save the label `key` with `value`.
+	Set(key, value string)
+}
 
-	// Identifier returns the test identifier that can be used to name resources
+// DataTemp allows test authors to easily manipulate test fixtures / temporary files.
+type DataTemp interface {
+	// Load will retrieve the content stored in the file
+	// Asserts on failure.
+	Load(key ...string) string
+	// Save will store the content in the file, ensuring parent dir exists, and return the path.
+	// Asserts on failure.
+	Save(data string, key ...string) string
+	// Path will return the absolute path for the asset, whether it exists or not.
+	Path(key ...string) string
+	// Exists asserts that the object exist.
+	Exists(key ...string)
+	// Dir ensures the directory under temp is created, and returns the path.
+	// Asserts on failure.
+	Dir(key ...string) string
+}
+
+// Data is meant to hold information about a test:
+// - first, key-value data that the test implementer wants to carry around - this is Labels()
+// - second, some commonly useful immutable test properties (eg: a way to generate unique
+// identifiers for that test)
+// - third, ability to manipulate test files inside managed temporary directories
+// Note that Data Labels are inherited from parent test to subtest.
+// This is not true for Identifier and Temp().Dir(), which are bound to the test itself, though temporary files
+// can be accessed by subtests if their location is passed around (in Labels).
+type Data interface {
+	Temp() DataTemp
+	Labels() DataLabels
 	Identifier(suffix ...string) string
-	// TempDir returns the test temporary directory
-	TempDir() string
 }
 
 // Helpers provides a set of helpers to run commands with simple expectations,
@@ -89,6 +111,8 @@ type TestableCommand interface {
 	WithCwd(path string)
 	// WithTimeout defines the execution timeout for a command.
 	WithTimeout(timeout time.Duration)
+	// Setenv allows to override a specific env variable directly for a specific command instead of test-wide
+	Setenv(key, value string)
 	// WithFeeder allows passing a reader to be fed to the command stdin.
 	WithFeeder(fun func() io.Reader)
 	// Feed allows passing a reader to be fed to the command stdin.
diff --git a/pkg/inspecttypes/dockercompat/dockercompat_test.go b/pkg/inspecttypes/dockercompat/dockercompat_test.go
index 4966ce89..a31286bf 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat_test.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat_test.go
@@ -417,3 +417,97 @@ func TestNetworkSettingsFromNative(t *testing.T) {
 		})
 	}
 }
+
+func TestCpuSettingsFromNative(t *testing.T) {
+	// Helper function to create uint64 pointer
+	uint64Ptr := func(i uint64) *uint64 {
+		return &i
+	}
+
+	int64Ptr := func(i int64) *int64 {
+		return &i
+	}
+
+	testcases := []struct {
+		name     string
+		spec     *specs.Spec
+		expected *CPUSettings
+	}{
+		{
+			name:     "Test with empty spec",
+			spec:     &specs.Spec{},
+			expected: &CPUSettings{},
+		},
+		{
+			name: "Full CPU Settings",
+			spec: &specs.Spec{
+				Linux: &specs.Linux{
+					Resources: &specs.LinuxResources{
+						CPU: &specs.LinuxCPU{
+							Cpus:            "0-3",
+							Mems:            "0-1",
+							Shares:          uint64Ptr(1024),
+							Quota:           int64Ptr(100000),
+							Period:          uint64Ptr(100000),
+							RealtimePeriod:  uint64Ptr(1000000),
+							RealtimeRuntime: int64Ptr(950000),
+						},
+					},
+				},
+			},
+			expected: &CPUSettings{
+				CPUSetCpus:         "0-3",
+				CPUSetMems:         "0-1",
+				CPUShares:          1024,
+				CPUQuota:           100000,
+				CPUPeriod:          100000,
+				CPURealtimePeriod:  1000000,
+				CPURealtimeRuntime: 950000,
+			},
+		},
+		{
+			name: "Partial CPU Settings",
+			spec: &specs.Spec{
+				Linux: &specs.Linux{
+					Resources: &specs.LinuxResources{
+						CPU: &specs.LinuxCPU{
+							Cpus:   "0,1",
+							Shares: uint64Ptr(512),
+						},
+					},
+				},
+			},
+			expected: &CPUSettings{
+				CPUSetCpus: "0,1",
+				CPUShares:  512,
+			},
+		},
+		{
+			name: "Zero Values Should Be Ignored",
+			spec: &specs.Spec{
+				Linux: &specs.Linux{
+					Resources: &specs.LinuxResources{
+						CPU: &specs.LinuxCPU{
+							Shares:          uint64Ptr(0),
+							Quota:           int64Ptr(0),
+							Period:          uint64Ptr(0),
+							RealtimePeriod:  uint64Ptr(0),
+							RealtimeRuntime: int64Ptr(0),
+						},
+					},
+				},
+			},
+			expected: &CPUSettings{},
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			result, err := cpuSettingsFromNative(tc.spec)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			assert.DeepEqual(t, result, tc.expected)
+		})
+	}
+}
diff --git a/pkg/testutil/nerdtest/ca/ca.go b/pkg/testutil/nerdtest/ca/ca.go
index 08615f70..49d69f81 100644
--- a/pkg/testutil/nerdtest/ca/ca.go
+++ b/pkg/testutil/nerdtest/ca/ca.go
@@ -69,8 +69,7 @@ func New(data test.Data, t *testing.T) *CA {
 		BasicConstraintsValid: true,
 	}
 
-	dir, err := os.MkdirTemp(data.TempDir(), "ca")
-	assert.NilError(t, err)
+	dir := data.Temp().Dir("ca")
 	keyPath := filepath.Join(dir, "ca.key")
 	certPath := filepath.Join(dir, "ca.cert")
 	writePair(t, keyPath, certPath, cert, cert, key, key)
diff --git a/pkg/testutil/nerdtest/command.go b/pkg/testutil/nerdtest/command.go
index dbeed949..d3ca8471 100644
--- a/pkg/testutil/nerdtest/command.go
+++ b/pkg/testutil/nerdtest/command.go
@@ -82,17 +82,14 @@ func newNerdCommand(conf test.Config, t *testing.T) *nerdCommand {
 	}
 
 	ret.WithBinary(binary)
-	// Not interested in these - and insulate us from parent environment side effects
-	ret.WithBlacklist([]string{
-		"LS_COLORS",
-		"DOCKER_CONFIG",
-		"CONTAINERD_SNAPSHOTTER",
-		"NERDCTL_TOML",
-		"CONTAINERD_ADDRESS",
-		"CNI_PATH",
-		"NETCONFPATH",
-		"NERDCTL_EXPERIMENTAL",
-		"NERDCTL_HOST_GATEWAY_IP",
+	ret.WithWhitelist([]string{
+		"PATH",
+		"HOME",
+		"XDG_*",
+		// Windows needs ProgramData, AppData, etc
+		"Program*",
+		"PROGRAM*",
+		"APPDATA",
 	})
 	return ret
 }
@@ -133,7 +130,7 @@ func (nc *nerdCommand) prep() {
 	if customDCConfig := nc.GenericCommand.Config.Read(DockerConfig); customDCConfig != "" {
 		if !nc.hasWrittenDockerConfig {
 			dest := filepath.Join(nc.Env["DOCKER_CONFIG"], "config.json")
-			err := os.WriteFile(dest, []byte(customDCConfig), 0400)
+			err := os.WriteFile(dest, []byte(customDCConfig), test.FilePermissionsDefault)
 			assert.NilError(nc.T(), err, "failed to write custom docker config json file for test")
 			nc.hasWrittenDockerConfig = true
 		}
@@ -177,7 +174,7 @@ func (nc *nerdCommand) prep() {
 		if nc.Config.Read(NerdctlToml) != "" {
 			if !nc.hasWrittenToml {
 				dest := nc.Env["NERDCTL_TOML"]
-				err := os.WriteFile(dest, []byte(nc.Config.Read(NerdctlToml)), 0400)
+				err := os.WriteFile(dest, []byte(nc.Config.Read(NerdctlToml)), test.FilePermissionsDefault)
 				assert.NilError(nc.T(), err, "failed to write NerdctlToml")
 				nc.hasWrittenToml = true
 			}
diff --git a/pkg/testutil/nerdtest/registry/cesanta.go b/pkg/testutil/nerdtest/registry/cesanta.go
index 58bc361f..111286e3 100644
--- a/pkg/testutil/nerdtest/registry/cesanta.go
+++ b/pkg/testutil/nerdtest/registry/cesanta.go
@@ -128,10 +128,6 @@ func NewCesantaAuthServer(data test.Data, helpers test.Helpers, ca *ca.CA, port
 	assert.NilError(helpers.T(), err, fmt.Errorf("failed bcrypt encrypting password: %w", err))
 	// Prepare configuration file for authentication server
 	// Details: https://github.com/cesanta/docker_auth/blob/1.7.1/examples/simple.yml
-	configFile, err := os.CreateTemp(data.TempDir(), "authconfig")
-	assert.NilError(helpers.T(), err, fmt.Errorf("failed creating temporary directory for config file: %w", err))
-	configFileName := configFile.Name()
-
 	cc := &CesantaConfig{
 		Server: CesantaConfigServer{
 			Addr: ":5100",
@@ -165,6 +161,7 @@ func NewCesantaAuthServer(data test.Data, helpers test.Helpers, ca *ca.CA, port
 		cc.Token.Key = "/auth/domain.key"
 	}
 
+	configFileName := data.Temp().Path("authconfig")
 	err = cc.Save(configFileName)
 	assert.NilError(helpers.T(), err, fmt.Errorf("failed writing configuration: %w", err))
 
@@ -181,20 +178,12 @@ func NewCesantaAuthServer(data test.Data, helpers test.Helpers, ca *ca.CA, port
 		helpers.Ensure("rm", "-f", containerName)
 		errPortRelease := portlock.Release(port)
 		errCertClose := cert.Close()
-		errConfigClose := configFile.Close()
-		errConfigRemove := os.Remove(configFileName)
 		if errPortRelease != nil {
 			helpers.T().Error(errPortRelease.Error())
 		}
 		if errCertClose != nil {
 			helpers.T().Error(errCertClose.Error())
 		}
-		if errConfigClose != nil {
-			helpers.T().Error(errConfigClose.Error())
-		}
-		if errConfigRemove != nil {
-			helpers.T().Error(errConfigRemove.Error())
-		}
 	}
 
 	setup := func(data test.Data, helpers test.Helpers) {
diff --git a/pkg/testutil/nerdtest/registry/common.go b/pkg/testutil/nerdtest/registry/common.go
index d662d00f..53877c08 100644
--- a/pkg/testutil/nerdtest/registry/common.go
+++ b/pkg/testutil/nerdtest/registry/common.go
@@ -19,8 +19,6 @@ package registry
 import (
 	"fmt"
 	"net"
-	"os"
-	"path/filepath"
 
 	"golang.org/x/crypto/bcrypt"
 
@@ -71,9 +69,7 @@ func (ba *BasicAuth) Params(data test.Data) []string {
 	if ba.HtFile == "" && ba.Username != "" && ba.Password != "" {
 		pass := ba.Password
 		encryptedPass, _ := bcrypt.GenerateFromPassword([]byte(pass), bcrypt.DefaultCost)
-		tmpDir, _ := os.MkdirTemp(data.TempDir(), "htpasswd")
-		ba.HtFile = filepath.Join(tmpDir, "htpasswd")
-		_ = os.WriteFile(ba.HtFile, []byte(fmt.Sprintf(`%s:%s`, ba.Username, string(encryptedPass[:]))), 0600)
+		ba.HtFile = data.Temp().Save(fmt.Sprintf(`%s:%s`, ba.Username, string(encryptedPass[:])), "htpasswd")
 	}
 	ret := []string{
 		"--env", "REGISTRY_AUTH=htpasswd",
diff --git a/pkg/testutil/nerdtest/registry/docker.go b/pkg/testutil/nerdtest/registry/docker.go
index 30ee7626..82cde7f2 100644
--- a/pkg/testutil/nerdtest/registry/docker.go
+++ b/pkg/testutil/nerdtest/registry/docker.go
@@ -96,7 +96,7 @@ func NewDockerRegistry(data test.Data, helpers test.Helpers, currentCA *ca.CA, p
 	// FIXME: in the future, we will want to further manipulate hosts toml file from the test
 	// This should then return the struct, instead of saving it on its own
 	hostsDir, err := func() (string, error) {
-		hDir, err := os.MkdirTemp(data.TempDir(), "certs.d")
+		hDir := data.Temp().Dir("certs.d")
 		assert.NilError(helpers.T(), err, fmt.Errorf("failed creating directory certs.d: %w", err))
 
 		if currentCA != nil {
diff --git a/pkg/testutil/nerdtest/requirements.go b/pkg/testutil/nerdtest/requirements.go
index 3566b273..90291a28 100644
--- a/pkg/testutil/nerdtest/requirements.go
+++ b/pkg/testutil/nerdtest/requirements.go
@@ -342,7 +342,7 @@ var Private = &test.Requirement{
 		// We need this to happen NOW and not in setup, as otherwise cleanup with operate on the default namespace
 		namespace := data.Identifier("private")
 		helpers.Write(Namespace, test.ConfigValue(namespace))
-		data.Set("_deletenamespace", namespace)
+		data.Labels().Set("_deletenamespace", namespace)
 		// FIXME: is this necessary? Should NoParallel be subsumed into config?
 		helpers.Write(modePrivate, enabled)
 		return true, "private mode creates a dedicated namespace for nerdctl, and disable parallelism for docker"
@@ -356,7 +356,7 @@ var Private = &test.Requirement{
 				helpers.Ensure(append([]string{"rm", "-f"}, strings.Split(containerList, "\n")...)...)
 			}
 			helpers.Ensure("system", "prune", "-f", "--all", "--volumes")
-			helpers.Anyhow("namespace", "remove", data.Get("_deletenamespace"))
+			helpers.Anyhow("namespace", "remove", data.Labels().Get("_deletenamespace"))
 		}
 	},
 }
diff --git a/pkg/testutil/nerdtest/utilities.go b/pkg/testutil/nerdtest/utilities.go
index 56cae946..71b2d662 100644
--- a/pkg/testutil/nerdtest/utilities.go
+++ b/pkg/testutil/nerdtest/utilities.go
@@ -25,6 +25,7 @@ import (
 
 	"github.com/containerd/nerdctl/mod/tigron/expect"
 	"github.com/containerd/nerdctl/mod/tigron/test"
+	"github.com/containerd/nerdctl/mod/tigron/tig"
 
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/native"
@@ -46,58 +47,54 @@ func IsDocker() bool {
 // InspectContainer is a helper that can be used inside custom commands or Setup
 func InspectContainer(helpers test.Helpers, name string) dockercompat.Container {
 	helpers.T().Helper()
-	var dc []dockercompat.Container
+	var res dockercompat.Container
 	cmd := helpers.Command("container", "inspect", name)
 	cmd.Run(&test.Expected{
-		Output: func(stdout string, info string, t *testing.T) {
-			err := json.Unmarshal([]byte(stdout), &dc)
-			assert.NilError(t, err, "Unable to unmarshal output\n"+info)
-			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
-		},
+		Output: expect.JSON([]dockercompat.Container{}, func(dc []dockercompat.Container, _ string, t tig.T) {
+			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results")
+			res = dc[0]
+		}),
 	})
-	return dc[0]
+	return res
 }
 
 func InspectVolume(helpers test.Helpers, name string) native.Volume {
 	helpers.T().Helper()
-	var dc []native.Volume
+	var res native.Volume
 	cmd := helpers.Command("volume", "inspect", name)
 	cmd.Run(&test.Expected{
-		Output: func(stdout string, info string, t *testing.T) {
-			err := json.Unmarshal([]byte(stdout), &dc)
-			assert.NilError(t, err, "Unable to unmarshal output\n"+info)
-			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
-		},
+		Output: expect.JSON([]native.Volume{}, func(dc []native.Volume, _ string, t tig.T) {
+			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results")
+			res = dc[0]
+		}),
 	})
-	return dc[0]
+	return res
 }
 
 func InspectNetwork(helpers test.Helpers, name string) dockercompat.Network {
 	helpers.T().Helper()
-	var dc []dockercompat.Network
+	var res dockercompat.Network
 	cmd := helpers.Command("network", "inspect", name)
 	cmd.Run(&test.Expected{
-		Output: func(stdout string, info string, t *testing.T) {
-			err := json.Unmarshal([]byte(stdout), &dc)
-			assert.NilError(t, err, "Unable to unmarshal output\n"+info)
-			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
-		},
+		Output: expect.JSON([]dockercompat.Network{}, func(dc []dockercompat.Network, _ string, t tig.T) {
+			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results")
+			res = dc[0]
+		}),
 	})
-	return dc[0]
+	return res
 }
 
 func InspectImage(helpers test.Helpers, name string) dockercompat.Image {
 	helpers.T().Helper()
-	var dc []dockercompat.Image
+	var res dockercompat.Image
 	cmd := helpers.Command("image", "inspect", name)
 	cmd.Run(&test.Expected{
-		Output: func(stdout string, info string, t *testing.T) {
-			err := json.Unmarshal([]byte(stdout), &dc)
-			assert.NilError(t, err, "Unable to unmarshal output\n"+info)
-			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results\n"+info)
-		},
+		Output: expect.JSON([]dockercompat.Image{}, func(dc []dockercompat.Image, _ string, t tig.T) {
+			assert.Equal(t, 1, len(dc), "Unexpectedly got multiple results")
+			res = dc[0]
+		}),
 	})
-	return dc[0]
+	return res
 }
 
 const (