Repository: containerd/nerdctl

Issue:
CI: golangci-lint config validation is useless and flaky
### Description

https://github.com/containerd/nerdctl/actions/runs/13476112452/job/37655514638?pr=3890#step:5:37

By default, the golangci-lint github action does a preflight configuration validation that requires retrieving a schema file from their servers.

This is useless in our context, as running golangci to verify code _will_ enforce validation of the config file anyhow, and this is prone to random failures if the remote location of the schema cannot be found.

Suggesting we disable config validation on the action. 

### Steps to reproduce the issue

_No response_

### Describe the results you received and expected

na

### What version of nerdctl are you using?

main

### Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

### Host information

_No response_

Discussion:

Solution patch:
diff --git a/.github/workflows/ghcr-image-build-and-publish.yml b/.github/workflows/ghcr-image-build-and-publish.yml
index f34d9d6f..dbfa167f 100644
--- a/.github/workflows/ghcr-image-build-and-publish.yml
+++ b/.github/workflows/ghcr-image-build-and-publish.yml
@@ -34,10 +34,10 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25  # v3.4.0
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392  # v3.6.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca  # v3.9.0
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2  # v3.10.0
 
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action
@@ -53,14 +53,14 @@ jobs:
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96  # v5.6.1
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804  # v5.7.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
-        uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497  # v6.14.0
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4  # v6.15.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 0be8c5aa..608bd9e1 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -8,7 +8,8 @@ on:
   pull_request:
 
 env:
-  GO_VERSION: 1.23.x
+  GO_VERSION: 1.24.x
+  GOTOOLCHAIN: local
 
 jobs:
   go:
@@ -55,6 +56,8 @@ jobs:
         uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837  # v6.5.0
         with:
           args: --verbose
+          # See https://github.com/containerd/nerdctl/issues/3914
+          verify: false
   other:
     timeout-minutes: 5
     name: yaml | shell | imports order
@@ -67,11 +70,13 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
+      - name: install required linters and dev-tools
+        run: |
+          make install-dev-tools
       - name: yaml
         run: make lint-yaml
       - name: shell
         run: make lint-shell
       - name: go imports ordering
         run: |
-          go install -v github.com/incu6us/goimports-reviser/v3@latest
           make lint-imports
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index 0330137c..d3fb17d0 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -7,6 +7,9 @@ on:
       - 'release/**'
   pull_request:
 
+env:
+  GOTOOLCHAIN: local
+
 jobs:
   project:
     name: checks
@@ -27,5 +30,3 @@ jobs:
           repo-access-token: ${{ secrets.GITHUB_TOKEN }}
       - run: ./hack/verify-no-patent.sh
         working-directory: src/github.com/containerd/nerdctl
-      - run: ./hack/verify-pkg-isolation.sh
-        working-directory: src/github.com/containerd/nerdctl
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8439f9a1..72940cf3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,10 @@ on:
     tags:
     - 'v*'
     - 'test-action-release-*'
+
+env:
+  GOTOOLCHAIN: local
+
 jobs:
   release:
     runs-on: ubuntu-24.04
@@ -13,7 +17,7 @@ jobs:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34  # v5.3.0
       with:
-        go-version: 1.23.x
+        go-version: 1.24.x
     - name: "Compile binaries"
       run: make artifacts
     - name: "SHA256SUMS"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2b3144b9..6fa8e272 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -10,7 +10,8 @@ on:
       - '**.md'
 
 env:
-  GO_VERSION: 1.23.x
+  GO_VERSION: 1.24.x
+  GOTOOLCHAIN: local
   SHORT_TIMEOUT: 5
   LONG_TIMEOUT: 60
 
@@ -33,7 +34,7 @@ jobs:
           - runner: ubuntu-24.04
             containerd: v2.0.2
             arch: amd64
-          - runner: arm64-8core-32gb
+          - runner: ubuntu-24.04-arm
             containerd: v2.0.2
             arch: arm64
     env:
@@ -119,7 +120,7 @@ jobs:
             arch: amd64
           - ubuntu: 24.04
             containerd: v2.0.2
-            runner: arm64-8core-32gb
+            runner: ubuntu-24.04-arm
             arch: arm64
     env:
       CONTAINERD_VERSION: "${{ matrix.containerd }}"
@@ -312,7 +313,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go-version: ["1.22.x", "1.23.x"]
+        go-version: ["1.23.x", "1.24.x"]
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
@@ -399,7 +400,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 1
-      - uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f  # v4.2.1
+      - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf  # v4.2.2
         with:
           path: /root/.vagrant.d
           key: vagrant-${{ matrix.box }}
diff --git a/.golangci.yml b/.golangci.yml
index f7dbbab9..83f4dc7f 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -5,7 +5,7 @@ run:
 linters:
   disable-all: true
   enable:
-    # - depguard
+    - depguard
     - gofmt
     - goimports
     - govet
@@ -135,8 +135,29 @@ linters-settings:
       - unnamedResult
       - unnecessaryBlock
 
+  depguard:
+    rules:
+      # pkg files must not depend on cobra nor anything in cmd
+      pkg:
+        files:
+          - "**/pkg/**/*.go"
+        deny:
+          - pkg: "github.com/spf13/cobra"
+            desc: "pkg must not depend on cobra"
+          - pkg: "github.com/spf13/pflag"
+            desc: "pkg must not depend on pflag"
+          - pkg: "github.com/spf13/viper"
+            desc: "pkg must not depend on viper"
+          - pkg: "github.com/containerd/nerdctl/v2/cmd"
+            desc: "pkg must not depend on any cmd files"
+
 issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
   exclude-rules:
     - linters:
         - revive
       text: "unused-parameter"
+
+output:
+  sort-results: true
diff --git a/Dockerfile b/Dockerfile
index d55b5be2..dd5ecae9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -42,7 +42,7 @@ ARG TINI_VERSION=v0.19.0
 ARG BUILDG_VERSION=v0.4.1
 
 # Test deps
-ARG GO_VERSION=1.23
+ARG GO_VERSION=1.24
 ARG UBUNTU_VERSION=24.04
 ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.1
 ARG GOTESTSUM_VERSION=v1.12.0
diff --git a/Makefile b/Makefile
index ae4e18c9..28cf5394 100644
--- a/Makefile
+++ b/Makefile
@@ -18,6 +18,12 @@
 # Licensed under the Apache License, Version 2.0
 # -----------------------------------------------------------------------------
 
+##########################
+# Configuration
+##########################
+PACKAGE := "github.com/containerd/nerdctl/v2"
+ORG_PREFIXES := "github.com/containerd"
+
 DOCKER ?= docker
 GO ?= go
 GOOS ?= $(shell $(GO) env GOOS)
@@ -25,78 +31,227 @@ ifeq ($(GOOS),windows)
 	BIN_EXT := .exe
 endif
 
-PACKAGE := github.com/containerd/nerdctl/v2
-
-# distro builders might wanna override these
+# distro builders might want to override these
 PREFIX  ?= /usr/local
 BINDIR  ?= $(PREFIX)/bin
 DATADIR ?= $(PREFIX)/share
 DOCDIR  ?= $(DATADIR)/doc
 
+BINARY ?= "nerdctl"
 MAKEFILE_DIR := $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST)))))
 VERSION ?= $(shell git -C $(MAKEFILE_DIR) describe --match 'v[0-9]*' --dirty='.m' --always --tags)
 VERSION_TRIMMED := $(VERSION:v%=%)
 REVISION ?= $(shell git -C $(MAKEFILE_DIR) rev-parse HEAD)$(shell if ! git -C $(MAKEFILE_DIR) diff --no-ext-diff --quiet --exit-code; then echo .m; fi)
+LINT_COMMIT_RANGE ?= main..HEAD
+GO_BUILD_LDFLAGS ?= -s -w
+GO_BUILD_FLAGS ?=
 
+##########################
+# Helpers
+##########################
 ifdef VERBOSE
 	VERBOSE_FLAG := -v
 	VERBOSE_FLAG_LONG := --verbose
 endif
 
-GO_BUILD_LDFLAGS ?= -s -w
-GO_BUILD_FLAGS ?=
 export GO_BUILD=CGO_ENABLED=0 GOOS=$(GOOS) $(GO) -C $(MAKEFILE_DIR) build -ldflags "$(GO_BUILD_LDFLAGS) $(VERBOSE_FLAG) -X $(PACKAGE)/pkg/version.Version=$(VERSION) -X $(PACKAGE)/pkg/version.Revision=$(REVISION)"
 
+ifndef NO_COLOR
+    NC := \033[0m
+    GREEN := \033[1;32m
+    ORANGE := \033[1;33m
+endif
+
 recursive_wildcard=$(wildcard $1$2) $(foreach e,$(wildcard $1*),$(call recursive_wildcard,$e/,$2))
 
+define title
+	@printf "$(GREEN)____________________________________________________________________________________________________\n"
+	@printf "$(GREEN)%*s\n" $$(( ( $(shell echo "🤓$(1) 🤓" | wc -c ) + 100 ) / 2 )) "🤓$(1) 🤓"
+	@printf "$(GREEN)____________________________________________________________________________________________________\n$(ORANGE)"
+endef
+
+define footer
+	@printf "$(GREEN)> %s: done!\n" "$(1)"
+	@printf "$(GREEN)____________________________________________________________________________________________________\n$(NC)"
+endef
+
+##########################
+# High-level tasks definitions
+##########################
 all: binaries
 
+lint: lint-go-all lint-imports lint-yaml lint-shell lint-commits lint-mod lint-licenses-all
+
+fix: fix-mod fix-imports fix-go-all
+
+# TODO: fix race task and add it
+test: test-unit # test-unit-race test-unit-bench
+
 help:
 	@echo "Usage: make <target>"
 	@echo
-	@echo " * 'install' - Install binaries to system locations."
+	@echo " * 'lint' - Run linters against codebase."
+	@echo " * 'fix' - Automatically fixes imports, modules, and simple formatting."
+	@echo " * 'test' - Run basic unit testing."
 	@echo " * 'binaries' - Build nerdctl."
+	@echo " * 'install' - Install binaries to system locations."
 	@echo " * 'clean' - Clean artifacts."
-	@echo " * 'lint' - Run various linters."
 
-nerdctl:
-	$(GO_BUILD) $(GO_BUILD_FLAGS) $(VERBOSE_FLAG) -o $(CURDIR)/_output/nerdctl$(BIN_EXT) ./cmd/nerdctl
+##########################
+# Building and installation tasks
+##########################
+binaries: $(CURDIR)/_output/$(BINARY)$(BIN_EXT)
+
+$(CURDIR)/_output/$(BINARY)$(BIN_EXT):
+	$(call title, $@)
+	$(GO_BUILD) $(GO_BUILD_FLAGS) $(VERBOSE_FLAG) -o $(CURDIR)/_output/$(BINARY)$(BIN_EXT) ./cmd/nerdctl
+	$(call footer, $@)
+
+install:
+	$(call title, $@)
+	install -D -m 755 $(CURDIR)/_output/$(BINARY) $(DESTDIR)$(BINDIR)/$(BINARY)
+	install -D -m 755 $(MAKEFILE_DIR)/extras/rootless/containerd-rootless.sh $(DESTDIR)$(BINDIR)/containerd-rootless.sh
+	install -D -m 755 $(MAKEFILE_DIR)/extras/rootless/containerd-rootless-setuptool.sh $(DESTDIR)$(BINDIR)/containerd-rootless-setuptool.sh
+	install -D -m 644 -t $(DESTDIR)$(DOCDIR)/nerdctl $(MAKEFILE_DIR)/docs/*.md
+	$(call footer, $@)
 
 clean:
+	$(call title, $@)
 	find . -name \*~ -delete
 	find . -name \#\* -delete
 	rm -rf $(CURDIR)/_output/* $(MAKEFILE_DIR)/vendor
+	$(call footer, $@)
 
-lint: lint-go lint-imports lint-yaml lint-shell
-
+##########################
+# Linting tasks
+##########################
 lint-go:
-	cd $(MAKEFILE_DIR) && GOOS=linux golangci-lint run $(VERBOSE_FLAG_LONG) ./... && \
-		GOOS=windows golangci-lint run $(VERBOSE_FLAG_LONG) ./... && \
-		GOOS=freebsd golangci-lint run $(VERBOSE_FLAG_LONG) ./...
+	$(call title, $@: $(GOOS))
+	@cd $(MAKEFILE_DIR) \
+		&& golangci-lint run $(VERBOSE_FLAG_LONG) ./...
+	$(call footer, $@)
+
+lint-go-all:
+	$(call title, $@)
+	@cd $(MAKEFILE_DIR) \
+		&& GOOS=linux make lint-go \
+		&& GOOS=windows make lint-go \
+		&& GOOS=freebsd make lint-go
+	$(call footer, $@)
 
 lint-imports:
-	cd $(MAKEFILE_DIR) && ./hack/lint-imports.sh
-
-lint-fix-imports:
-	cd $(MAKEFILE_DIR) && goimports-reviser -company-prefixes "github.com/containerd" ./...
+	$(call title, $@)
+	@cd $(MAKEFILE_DIR) \
+		&& goimports-reviser -recursive -list-diff -set-exit-status -output stdout -company-prefixes "$(ORG_PREFIXES)"  ./...
+	$(call footer, $@)
 
 lint-yaml:
-	cd $(MAKEFILE_DIR) && yamllint .
+	$(call title, $@)
+	cd $(MAKEFILE_DIR) \
+		&& yamllint .
+	$(call footer, $@)
 
 lint-shell: $(call recursive_wildcard,$(MAKEFILE_DIR)/,*.sh)
+	$(call title, $@)
 	shellcheck -a -x $^
-
+	$(call footer, $@)
+
+lint-commits:
+	$(call title, $@)
+	@cd $(MAKEFILE_DIR) \
+		&& git-validation $(VERBOSE_FLAG) -run DCO,short-subject,dangling-whitespace -range "$(LINT_COMMIT_RANGE)"
+	$(call footer, $@)
+
+lint-mod:
+	$(call title, $@)
+	@cd $(MAKEFILE_DIR) \
+		&& go mod tidy --diff
+	$(call footer, $@)
+
+lint-licenses:
+	$(call title, $@: $(GOOS))
+	@cd $(MAKEFILE_DIR) \
+		&& ./hack/make-lint-licenses.sh
+	$(call footer, $@)
+
+lint-licenses-all:
+	$(call title, $@)
+	@cd $(MAKEFILE_DIR) \
+		&& GOOS=linux make lint-licenses \
+		&& GOOS=freebsd make lint-licenses \
+		&& GOOS=windows make lint-licenses
+	$(call footer, $@)
+
+##########################
+# Automated fixing tasks
+##########################
+fix-go:
+	$(call title, $@: $(GOOS))
+	@cd $(MAKEFILE_DIR) \
+		&& golangci-lint run --fix
+	$(call footer, $@)
+
+fix-go-all:
+	$(call title, $@)
+	@cd $(MAKEFILE_DIR) \
+		&& GOOS=linux make fix-go \
+		&& GOOS=freebsd make fix-go \
+		&& GOOS=windows make fix-go
+	$(call footer, $@)
+
+fix-imports:
+	$(call title, $@)
+	@cd $(MAKEFILE_DIR) \
+		&& goimports-reviser -company-prefixes $(ORG_PREFIXES) ./...
+	$(call footer, $@)
+
+fix-mod:
+	$(call title, $@)
+	@cd $(MAKEFILE_DIR) \
+		&& go mod tidy
+	$(call footer, $@)
+
+##########################
+# Development tools installation
+##########################
+install-dev-tools:
+	$(call title, $@)
+	# golangci: v1.64.5
+	# git-validation: main from 2023/11
+	# ltag: v0.2.5
+	# go-licenses: v2.0.0-alpha.1
+	# goimports-reviser: v3.8.2
+	@cd $(MAKEFILE_DIR) \
+		&& go install github.com/golangci/golangci-lint/cmd/golangci-lint@0a603e49e5e9870f5f9f2035bcbe42cd9620a9d5 \
+		&& go install github.com/vbatts/git-validation@679e5cad8c50f1605ab3d8a0a947aaf72fb24c07 \
+		&& go install github.com/kunalkushwaha/ltag@b0cfa33e4cc9383095dc584d3990b62c95096de0 \
+		&& go install github.com/google/go-licenses/v2@d01822334fba5896920a060f762ea7ecdbd086e8 \
+		&& go install github.com/incu6us/goimports-reviser/v3@f034195cc8a7ffc7cc70d60aa3a25500874eaf04 \
+		&& go install gotest.tools/gotestsum@ac6dad9c7d87b969004f7749d1942938526c9716
+	@echo "Remember to add GOROOT/bin to your path"
+	$(call footer, $@)
+
+##########################
+# Testing tasks
+##########################
 test-unit:
-	go test -v $(MAKEFILE_DIR)/pkg/...
-
-binaries: nerdctl
-
-install:
-	install -D -m 755 $(CURDIR)/_output/nerdctl $(DESTDIR)$(BINDIR)/nerdctl
-	install -D -m 755 $(MAKEFILE_DIR)/extras/rootless/containerd-rootless.sh $(DESTDIR)$(BINDIR)/containerd-rootless.sh
-	install -D -m 755 $(MAKEFILE_DIR)/extras/rootless/containerd-rootless-setuptool.sh $(DESTDIR)$(BINDIR)/containerd-rootless-setuptool.sh
-	install -D -m 644 -t $(DESTDIR)$(DOCDIR)/nerdctl $(MAKEFILE_DIR)/docs/*.md
-
+	$(call title, $@)
+	@go test $(VERBOSE_FLAG) $(MAKEFILE_DIR)/pkg/...
+	$(call footer, $@)
+
+test-unit-bench:
+	$(call title, $@)
+	@go test $(VERBOSE_FLAG) $(MAKEFILE_DIR)/pkg/... -bench=.
+	$(call footer, $@)
+
+test-unit-race:
+	$(call title, $@)
+	@go test $(VERBOSE_FLAG) $(MAKEFILE_DIR)/pkg/... -race
+	$(call footer, $@)
+
+##########################
+# Release tasks
+##########################
 # Note that these options will not work on macOS - unless you use gnu-tar instead of tar
 TAR_OWNER0_FLAGS=--owner=0 --group=0
 TAR_FLATTEN_FLAGS=--transform 's/.*\///g'
@@ -107,6 +262,7 @@ define make_artifact_full_linux
 endef
 
 artifacts: clean
+	$(call title, $@)
 	GOOS=linux GOARCH=amd64       make -C $(CURDIR) -f $(MAKEFILE_DIR)/Makefile binaries
 	tar $(TAR_OWNER0_FLAGS) $(TAR_FLATTEN_FLAGS) -czvf $(CURDIR)/_output/nerdctl-$(VERSION_TRIMMED)-linux-amd64.tar.gz   $(CURDIR)/_output/nerdctl $(MAKEFILE_DIR)/extras/rootless/*
 
@@ -138,15 +294,19 @@ artifacts: clean
 
 	$(GO) -C $(MAKEFILE_DIR) mod vendor
 	tar $(TAR_OWNER0_FLAGS) -czf $(CURDIR)/_output/nerdctl-$(VERSION_TRIMMED)-go-mod-vendor.tar.gz $(MAKEFILE_DIR)/go.mod $(MAKEFILE_DIR)/go.sum $(MAKEFILE_DIR)/vendor
+	$(call footer, $@)
 
 .PHONY: \
+	all \
+	lint \
+	fix \
+	test \
 	help \
-	nerdctl \
-	clean \
 	binaries \
 	install \
+	clean \
+	lint-go lint-go-all lint-imports lint-yaml lint-shell lint-commits lint-mod lint-licenses lint-licenses-all \
+	fix-go fix-go-all fix-imports fix-mod \
+	install-dev-tools \
+	test-unit test-unit-race test-unit-bench \
 	artifacts
-	lint \
-	lint-yaml \
-	lint-go \
-	lint-shell
diff --git a/cmd/nerdctl/builder/builder.go b/cmd/nerdctl/builder/builder.go
index 3e8e120f..74403530 100644
--- a/cmd/nerdctl/builder/builder.go
+++ b/cmd/nerdctl/builder/builder.go
@@ -31,7 +31,7 @@ import (
 )
 
 func NewBuilderCommand() *cobra.Command {
-	var builderCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Annotations:   map[string]string{helpers.Category: helpers.Management},
 		Use:           "builder",
 		Short:         "Manage builds",
@@ -39,17 +39,17 @@ func NewBuilderCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	builderCommand.AddCommand(
+	cmd.AddCommand(
 		NewBuildCommand(),
 		newBuilderPruneCommand(),
 		newBuilderDebugCommand(),
 	)
-	return builderCommand
+	return cmd
 }
 
 func newBuilderPruneCommand() *cobra.Command {
 	shortHelp := `Clean up BuildKit build cache`
-	var buildPruneCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "prune",
 		Args:          cobra.NoArgs,
 		Short:         shortHelp,
@@ -58,11 +58,11 @@ func newBuilderPruneCommand() *cobra.Command {
 		SilenceErrors: true,
 	}
 
-	helpers.AddStringFlag(buildPruneCommand, "buildkit-host", nil, "", "BUILDKIT_HOST", "BuildKit address")
+	helpers.AddStringFlag(cmd, "buildkit-host", nil, "", "BUILDKIT_HOST", "BuildKit address")
 
-	buildPruneCommand.Flags().BoolP("all", "a", false, "Remove all unused build cache, not just dangling ones")
-	buildPruneCommand.Flags().BoolP("force", "f", false, "Do not prompt for confirmation")
-	return buildPruneCommand
+	cmd.Flags().BoolP("all", "a", false, "Remove all unused build cache, not just dangling ones")
+	cmd.Flags().BoolP("force", "f", false, "Do not prompt for confirmation")
+	return cmd
 }
 
 func builderPruneAction(cmd *cobra.Command, _ []string) error {
@@ -133,7 +133,7 @@ func processBuilderPruneOptions(cmd *cobra.Command) (types.BuilderPruneOptions,
 
 func newBuilderDebugCommand() *cobra.Command {
 	shortHelp := `Debug Dockerfile`
-	var buildDebugCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "debug",
 		Short:         shortHelp,
 		PreRunE:       helpers.CheckExperimental("`nerdctl builder debug`"),
@@ -141,13 +141,13 @@ func newBuilderDebugCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	buildDebugCommand.Flags().StringP("file", "f", "", "Name of the Dockerfile")
-	buildDebugCommand.Flags().String("target", "", "Set the target build stage to build")
-	buildDebugCommand.Flags().StringArray("build-arg", nil, "Set build-time variables")
-	buildDebugCommand.Flags().String("image", "", "Image to use for debugging stage")
-	buildDebugCommand.Flags().StringArray("ssh", nil, "Allow forwarding SSH agent to the build. Format: default|<id>[=<socket>|<key>[,<key>]]")
-	buildDebugCommand.Flags().StringArray("secret", nil, "Expose secret value to the build. Format: id=secretname,src=filepath")
-	return buildDebugCommand
+	cmd.Flags().StringP("file", "f", "", "Name of the Dockerfile")
+	cmd.Flags().String("target", "", "Set the target build stage to build")
+	cmd.Flags().StringArray("build-arg", nil, "Set build-time variables")
+	cmd.Flags().String("image", "", "Image to use for debugging stage")
+	cmd.Flags().StringArray("ssh", nil, "Allow forwarding SSH agent to the build. Format: default|<id>[=<socket>|<key>[,<key>]]")
+	cmd.Flags().StringArray("secret", nil, "Expose secret value to the build. Format: id=secretname,src=filepath")
+	return cmd
 }
 
 func builderDebugAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/builder/builder_build.go b/cmd/nerdctl/builder/builder_build.go
index f22bcb8d..305f0542 100644
--- a/cmd/nerdctl/builder/builder_build.go
+++ b/cmd/nerdctl/builder/builder_build.go
@@ -35,7 +35,7 @@ import (
 )
 
 func NewBuildCommand() *cobra.Command {
-	var buildCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:   "build [flags] PATH",
 		Short: "Build an image from a Dockerfile. Needs buildkitd to be running.",
 		Long: `Build an image from a Dockerfile. Needs buildkitd to be running.
@@ -44,44 +44,44 @@ If Dockerfile is not present and -f is not specified, it will look for Container
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	helpers.AddStringFlag(buildCommand, "buildkit-host", nil, "", "BUILDKIT_HOST", "BuildKit address")
-	buildCommand.Flags().StringArray("add-host", nil, "Add a custom host-to-IP mapping (format: \"host:ip\")")
-	buildCommand.Flags().StringArrayP("tag", "t", nil, "Name and optionally a tag in the 'name:tag' format")
-	buildCommand.Flags().StringP("file", "f", "", "Name of the Dockerfile")
-	buildCommand.Flags().String("target", "", "Set the target build stage to build")
-	buildCommand.Flags().StringArray("build-arg", nil, "Set build-time variables")
-	buildCommand.Flags().Bool("no-cache", false, "Do not use cache when building the image")
-	buildCommand.Flags().StringP("output", "o", "", "Output destination (format: type=local,dest=path)")
-	buildCommand.Flags().String("progress", "auto", "Set type of progress output (auto, plain, tty). Use plain to show container output")
-	buildCommand.Flags().String("provenance", "", "Shorthand for \"--attest=type=provenance\"")
-	buildCommand.Flags().Bool("pull", false, "On true, always attempt to pull latest image version from remote. Default uses buildkit's default.")
-	buildCommand.Flags().StringArray("secret", nil, "Secret file to expose to the build: id=mysecret,src=/local/secret")
-	buildCommand.Flags().StringArray("allow", nil, "Allow extra privileged entitlement, e.g. network.host, security.insecure")
-	buildCommand.RegisterFlagCompletionFunc("allow", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	helpers.AddStringFlag(cmd, "buildkit-host", nil, "", "BUILDKIT_HOST", "BuildKit address")
+	cmd.Flags().StringArray("add-host", nil, "Add a custom host-to-IP mapping (format: \"host:ip\")")
+	cmd.Flags().StringArrayP("tag", "t", nil, "Name and optionally a tag in the 'name:tag' format")
+	cmd.Flags().StringP("file", "f", "", "Name of the Dockerfile")
+	cmd.Flags().String("target", "", "Set the target build stage to build")
+	cmd.Flags().StringArray("build-arg", nil, "Set build-time variables")
+	cmd.Flags().Bool("no-cache", false, "Do not use cache when building the image")
+	cmd.Flags().StringP("output", "o", "", "Output destination (format: type=local,dest=path)")
+	cmd.Flags().String("progress", "auto", "Set type of progress output (auto, plain, tty). Use plain to show container output")
+	cmd.Flags().String("provenance", "", "Shorthand for \"--attest=type=provenance\"")
+	cmd.Flags().Bool("pull", false, "On true, always attempt to pull latest image version from remote. Default uses buildkit's default.")
+	cmd.Flags().StringArray("secret", nil, "Secret file to expose to the build: id=mysecret,src=/local/secret")
+	cmd.Flags().StringArray("allow", nil, "Allow extra privileged entitlement, e.g. network.host, security.insecure")
+	cmd.RegisterFlagCompletionFunc("allow", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"network.host", "security.insecure"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	buildCommand.Flags().StringArray("attest", nil, "Attestation parameters (format: \"type=sbom,generator=image\")")
-	buildCommand.Flags().StringArray("ssh", nil, "SSH agent socket or keys to expose to the build (format: default|<id>[=<socket>|<key>[,<key>]])")
-	buildCommand.Flags().BoolP("quiet", "q", false, "Suppress the build output and print image ID on success")
-	buildCommand.Flags().String("sbom", "", "Shorthand for \"--attest=type=sbom\"")
-	buildCommand.Flags().StringArray("cache-from", nil, "External cache sources (eg. user/app:cache, type=local,src=path/to/dir)")
-	buildCommand.Flags().StringArray("cache-to", nil, "Cache export destinations (eg. user/app:cache, type=local,dest=path/to/dir)")
-	buildCommand.Flags().Bool("rm", true, "Remove intermediate containers after a successful build")
-	buildCommand.Flags().String("network", "default", "Set type of network for build (format:network=default|none|host)")
-	buildCommand.RegisterFlagCompletionFunc("network", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().StringArray("attest", nil, "Attestation parameters (format: \"type=sbom,generator=image\")")
+	cmd.Flags().StringArray("ssh", nil, "SSH agent socket or keys to expose to the build (format: default|<id>[=<socket>|<key>[,<key>]])")
+	cmd.Flags().BoolP("quiet", "q", false, "Suppress the build output and print image ID on success")
+	cmd.Flags().String("sbom", "", "Shorthand for \"--attest=type=sbom\"")
+	cmd.Flags().StringArray("cache-from", nil, "External cache sources (eg. user/app:cache, type=local,src=path/to/dir)")
+	cmd.Flags().StringArray("cache-to", nil, "Cache export destinations (eg. user/app:cache, type=local,dest=path/to/dir)")
+	cmd.Flags().Bool("rm", true, "Remove intermediate containers after a successful build")
+	cmd.Flags().String("network", "default", "Set type of network for build (format:network=default|none|host)")
+	cmd.RegisterFlagCompletionFunc("network", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"default", "host", "none"}, cobra.ShellCompDirectiveNoFileComp
 	})
 	// #region platform flags
 	// platform is defined as StringSlice, not StringArray, to allow specifying "--platform=amd64,arm64"
-	buildCommand.Flags().StringSlice("platform", []string{}, "Set target platform for build (e.g., \"amd64\", \"arm64\")")
-	buildCommand.RegisterFlagCompletionFunc("platform", completion.Platforms)
-	buildCommand.Flags().StringArray("build-context", []string{}, "Additional build contexts (e.g., name=path)")
+	cmd.Flags().StringSlice("platform", []string{}, "Set target platform for build (e.g., \"amd64\", \"arm64\")")
+	cmd.RegisterFlagCompletionFunc("platform", completion.Platforms)
+	cmd.Flags().StringArray("build-context", []string{}, "Additional build contexts (e.g., name=path)")
 	// #endregion
 
-	buildCommand.Flags().String("iidfile", "", "Write the image ID to the file")
-	buildCommand.Flags().StringArray("label", nil, "Set metadata for an image")
+	cmd.Flags().String("iidfile", "", "Write the image ID to the file")
+	cmd.Flags().StringArray("label", nil, "Set metadata for an image")
 
-	return buildCommand
+	return cmd
 }
 
 func processBuildCommandFlag(cmd *cobra.Command, args []string) (types.BuilderBuildOptions, error) {
diff --git a/cmd/nerdctl/compose/compose.go b/cmd/nerdctl/compose/compose.go
index e85d3175..5e5d1b60 100644
--- a/cmd/nerdctl/compose/compose.go
+++ b/cmd/nerdctl/compose/compose.go
@@ -24,7 +24,7 @@ import (
 )
 
 func NewComposeCommand() *cobra.Command {
-	var composeCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:              "compose [flags] COMMAND",
 		Short:            "Compose",
 		RunE:             helpers.UnknownSubcommandAction,
@@ -33,14 +33,14 @@ func NewComposeCommand() *cobra.Command {
 		TraverseChildren: true, // required for global short hands like -f
 	}
 	// `-f` is a nonPersistentAlias, as it conflicts with `nerdctl compose logs --follow`
-	helpers.AddPersistentStringArrayFlag(composeCommand, "file", nil, []string{"f"}, nil, "", "Specify an alternate compose file")
-	composeCommand.PersistentFlags().String("project-directory", "", "Specify an alternate working directory")
-	composeCommand.PersistentFlags().StringP("project-name", "p", "", "Specify an alternate project name")
-	composeCommand.PersistentFlags().String("env-file", "", "Specify an alternate environment file")
-	composeCommand.PersistentFlags().String("ipfs-address", "", "multiaddr of IPFS API (default uses $IPFS_PATH env variable if defined or local directory ~/.ipfs)")
-	composeCommand.PersistentFlags().StringArray("profile", []string{}, "Specify a profile to enable")
+	helpers.AddPersistentStringArrayFlag(cmd, "file", nil, []string{"f"}, nil, "", "Specify an alternate compose file")
+	cmd.PersistentFlags().String("project-directory", "", "Specify an alternate working directory")
+	cmd.PersistentFlags().StringP("project-name", "p", "", "Specify an alternate project name")
+	cmd.PersistentFlags().String("env-file", "", "Specify an alternate environment file")
+	cmd.PersistentFlags().String("ipfs-address", "", "multiaddr of IPFS API (default uses $IPFS_PATH env variable if defined or local directory ~/.ipfs)")
+	cmd.PersistentFlags().StringArray("profile", []string{}, "Specify a profile to enable")
 
-	composeCommand.AddCommand(
+	cmd.AddCommand(
 		newComposeUpCommand(),
 		newComposeLogsCommand(),
 		newComposeConfigCommand(),
@@ -66,7 +66,7 @@ func NewComposeCommand() *cobra.Command {
 		newComposeCreateCommand(),
 	)
 
-	return composeCommand
+	return cmd
 }
 
 func getComposeOptions(cmd *cobra.Command, debugFull, experimental bool) (composer.Options, error) {
diff --git a/cmd/nerdctl/compose/compose_build.go b/cmd/nerdctl/compose/compose_build.go
index fbd72ff0..a87c120e 100644
--- a/cmd/nerdctl/compose/compose_build.go
+++ b/cmd/nerdctl/compose/compose_build.go
@@ -26,18 +26,18 @@ import (
 )
 
 func newComposeBuildCommand() *cobra.Command {
-	var composeBuildCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "build [flags] [SERVICE...]",
 		Short:         "Build or rebuild services",
 		RunE:          composeBuildAction,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composeBuildCommand.Flags().StringArray("build-arg", nil, "Set build-time variables for services.")
-	composeBuildCommand.Flags().Bool("no-cache", false, "Do not use cache when building the image.")
-	composeBuildCommand.Flags().String("progress", "", "Set type of progress output (auto, plain, tty). Use plain to show container output")
+	cmd.Flags().StringArray("build-arg", nil, "Set build-time variables for services.")
+	cmd.Flags().Bool("no-cache", false, "Do not use cache when building the image.")
+	cmd.Flags().String("progress", "", "Set type of progress output (auto, plain, tty). Use plain to show container output")
 
-	return composeBuildCommand
+	return cmd
 }
 
 func composeBuildAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_config.go b/cmd/nerdctl/compose/compose_config.go
index 25a33057..aa9eddd6 100644
--- a/cmd/nerdctl/compose/compose_config.go
+++ b/cmd/nerdctl/compose/compose_config.go
@@ -28,21 +28,21 @@ import (
 )
 
 func newComposeConfigCommand() *cobra.Command {
-	var composeConfigCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "config",
 		Short:         "Validate and view the Compose file",
 		RunE:          composeConfigAction,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composeConfigCommand.Flags().BoolP("quiet", "q", false, "Only validate the configuration, don't print anything.")
-	composeConfigCommand.Flags().Bool("services", false, "Print the service names, one per line.")
-	composeConfigCommand.Flags().Bool("volumes", false, "Print the volume names, one per line.")
-	composeConfigCommand.Flags().String("hash", "", "Print the service config hash, one per line.")
-	composeConfigCommand.RegisterFlagCompletionFunc("hash", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().BoolP("quiet", "q", false, "Only validate the configuration, don't print anything.")
+	cmd.Flags().Bool("services", false, "Print the service names, one per line.")
+	cmd.Flags().Bool("volumes", false, "Print the volume names, one per line.")
+	cmd.Flags().String("hash", "", "Print the service config hash, one per line.")
+	cmd.RegisterFlagCompletionFunc("hash", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"\"*\""}, cobra.ShellCompDirectiveNoFileComp
 	})
-	return composeConfigCommand
+	return cmd
 }
 
 func composeConfigAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_cp.go b/cmd/nerdctl/compose/compose_cp.go
index aafc6b0b..bc83efad 100644
--- a/cmd/nerdctl/compose/compose_cp.go
+++ b/cmd/nerdctl/compose/compose_cp.go
@@ -31,7 +31,7 @@ import (
 func newComposeCopyCommand() *cobra.Command {
 	usage := `cp [OPTIONS] SERVICE:SRC_PATH DEST_PATH|-
        nerdctl compose cp [OPTIONS] SRC_PATH|- SERVICE:DEST_PATH`
-	var composeCpCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           usage,
 		Short:         "Copy files/folders between a service container and the local filesystem",
 		Args:          cobra.ExactArgs(2),
@@ -39,10 +39,10 @@ func newComposeCopyCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composeCpCommand.Flags().Bool("dry-run", false, "Execute command in dry run mode")
-	composeCpCommand.Flags().BoolP("follow-link", "L", false, "Always follow symbol link in SRC_PATH")
-	composeCpCommand.Flags().Int("index", 0, "index of the container if service has multiple replicas")
-	return composeCpCommand
+	cmd.Flags().Bool("dry-run", false, "Execute command in dry run mode")
+	cmd.Flags().BoolP("follow-link", "L", false, "Always follow symbol link in SRC_PATH")
+	cmd.Flags().Int("index", 0, "index of the container if service has multiple replicas")
+	return cmd
 }
 
 func composeCopyAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_create.go b/cmd/nerdctl/compose/compose_create.go
index 9621398a..9a7ddb81 100644
--- a/cmd/nerdctl/compose/compose_create.go
+++ b/cmd/nerdctl/compose/compose_create.go
@@ -28,19 +28,19 @@ import (
 )
 
 func newComposeCreateCommand() *cobra.Command {
-	var composeCreateCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "create [flags] [SERVICE...]",
 		Short:         "Creates containers for one or more services",
 		RunE:          composeCreateAction,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composeCreateCommand.Flags().Bool("build", false, "Build images before starting containers.")
-	composeCreateCommand.Flags().Bool("no-build", false, "Don't build an image even if it's missing, conflict with --build.")
-	composeCreateCommand.Flags().Bool("force-recreate", false, "Recreate containers even if their configuration and image haven't changed.")
-	composeCreateCommand.Flags().Bool("no-recreate", false, "Don't recreate containers if they exist, conflict with --force-recreate.")
-	composeCreateCommand.Flags().String("pull", "missing", "Pull images before running. (support always|missing|never)")
-	return composeCreateCommand
+	cmd.Flags().Bool("build", false, "Build images before starting containers.")
+	cmd.Flags().Bool("no-build", false, "Don't build an image even if it's missing, conflict with --build.")
+	cmd.Flags().Bool("force-recreate", false, "Recreate containers even if their configuration and image haven't changed.")
+	cmd.Flags().Bool("no-recreate", false, "Don't recreate containers if they exist, conflict with --force-recreate.")
+	cmd.Flags().String("pull", "missing", "Pull images before running. (support always|missing|never)")
+	return cmd
 }
 
 func composeCreateAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_down.go b/cmd/nerdctl/compose/compose_down.go
index 30552d18..1f1899a4 100644
--- a/cmd/nerdctl/compose/compose_down.go
+++ b/cmd/nerdctl/compose/compose_down.go
@@ -26,7 +26,7 @@ import (
 )
 
 func newComposeDownCommand() *cobra.Command {
-	var composeDownCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "down",
 		Short:         "Remove containers and associated resources",
 		Args:          cobra.NoArgs,
@@ -34,9 +34,9 @@ func newComposeDownCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composeDownCommand.Flags().BoolP("volumes", "v", false, "Remove named volumes declared in the `volumes` section of the Compose file and anonymous volumes attached to containers.")
-	composeDownCommand.Flags().Bool("remove-orphans", false, "Remove containers for services not defined in the Compose file.")
-	return composeDownCommand
+	cmd.Flags().BoolP("volumes", "v", false, "Remove named volumes declared in the `volumes` section of the Compose file and anonymous volumes attached to containers.")
+	cmd.Flags().Bool("remove-orphans", false, "Remove containers for services not defined in the Compose file.")
+	return cmd
 }
 
 func composeDownAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_exec.go b/cmd/nerdctl/compose/compose_exec.go
index 79d5da5b..efd649c1 100644
--- a/cmd/nerdctl/compose/compose_exec.go
+++ b/cmd/nerdctl/compose/compose_exec.go
@@ -30,7 +30,7 @@ import (
 )
 
 func newComposeExecCommand() *cobra.Command {
-	var composeExecCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "exec [flags] SERVICE COMMAND [ARGS...]",
 		Short:         "Execute a command in a running container of the service",
 		Args:          cobra.MinimumNArgs(2),
@@ -38,27 +38,27 @@ func newComposeExecCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composeExecCommand.Flags().SetInterspersed(false)
+	cmd.Flags().SetInterspersed(false)
 
 	_, isTerminal := term.GetFdInfo(os.Stdout)
-	composeExecCommand.Flags().BoolP("no-TTY", "T", !isTerminal, "Disable pseudo-TTY allocation. By default nerdctl compose exec allocates a TTY.")
-	composeExecCommand.Flags().BoolP("detach", "d", false, "Detached mode: Run containers in the background")
-	composeExecCommand.Flags().StringP("workdir", "w", "", "Working directory inside the container")
+	cmd.Flags().BoolP("no-TTY", "T", !isTerminal, "Disable pseudo-TTY allocation. By default nerdctl compose exec allocates a TTY.")
+	cmd.Flags().BoolP("detach", "d", false, "Detached mode: Run containers in the background")
+	cmd.Flags().StringP("workdir", "w", "", "Working directory inside the container")
 	// env needs to be StringArray, not StringSlice, to prevent "FOO=foo1,foo2" from being split to {"FOO=foo1", "foo2"}
-	composeExecCommand.Flags().StringArrayP("env", "e", nil, "Set environment variables")
-	composeExecCommand.Flags().Bool("privileged", false, "Give extended privileges to the command")
-	composeExecCommand.Flags().StringP("user", "u", "", "Username or UID (format: <name|uid>[:<group|gid>])")
-	composeExecCommand.Flags().Int("index", 1, "index of the container if the service has multiple instances.")
+	cmd.Flags().StringArrayP("env", "e", nil, "Set environment variables")
+	cmd.Flags().Bool("privileged", false, "Give extended privileges to the command")
+	cmd.Flags().StringP("user", "u", "", "Username or UID (format: <name|uid>[:<group|gid>])")
+	cmd.Flags().Int("index", 1, "index of the container if the service has multiple instances.")
 
-	composeExecCommand.Flags().BoolP("interactive", "i", true, "Keep STDIN open even if not attached")
-	composeExecCommand.Flags().MarkHidden("interactive")
+	cmd.Flags().BoolP("interactive", "i", true, "Keep STDIN open even if not attached")
+	cmd.Flags().MarkHidden("interactive")
 	// The -t does not has effect to keep the compatibility with docker.
 	// The proposal of -t is to keep "muscle memory" with compose v1: https://github.com/docker/compose/issues/9207
 	// FYI: https://github.com/docker/compose/blob/v2.23.1/cmd/compose/exec.go#L77
-	composeExecCommand.Flags().BoolP("tty", "t", true, "Allocate a pseudo-TTY")
-	composeExecCommand.Flags().MarkHidden("tty")
+	cmd.Flags().BoolP("tty", "t", true, "Allocate a pseudo-TTY")
+	cmd.Flags().MarkHidden("tty")
 
-	return composeExecCommand
+	return cmd
 }
 
 func composeExecAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_images.go b/cmd/nerdctl/compose/compose_images.go
index 30212559..6191a408 100644
--- a/cmd/nerdctl/compose/compose_images.go
+++ b/cmd/nerdctl/compose/compose_images.go
@@ -39,16 +39,16 @@ import (
 )
 
 func newComposeImagesCommand() *cobra.Command {
-	var composeImagesCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "images [flags] [SERVICE...]",
 		Short:         "List images used by created containers in services",
 		RunE:          composeImagesAction,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composeImagesCommand.Flags().String("format", "", "Format the output. Supported values: [json]")
-	composeImagesCommand.Flags().BoolP("quiet", "q", false, "Only show numeric image IDs")
-	return composeImagesCommand
+	cmd.Flags().String("format", "", "Format the output. Supported values: [json]")
+	cmd.Flags().BoolP("quiet", "q", false, "Only show numeric image IDs")
+	return cmd
 }
 
 func composeImagesAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_kill.go b/cmd/nerdctl/compose/compose_kill.go
index b1adcf4c..fcac4650 100644
--- a/cmd/nerdctl/compose/compose_kill.go
+++ b/cmd/nerdctl/compose/compose_kill.go
@@ -26,15 +26,15 @@ import (
 )
 
 func newComposeKillCommand() *cobra.Command {
-	var composeKillCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "kill [flags] [SERVICE...]",
 		Short:         "Force stop service containers",
 		RunE:          composeKillAction,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composeKillCommand.Flags().StringP("signal", "s", "SIGKILL", "SIGNAL to send to the container.")
-	return composeKillCommand
+	cmd.Flags().StringP("signal", "s", "SIGKILL", "SIGNAL to send to the container.")
+	return cmd
 }
 
 func composeKillAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_logs.go b/cmd/nerdctl/compose/compose_logs.go
index 5a6fd723..9391937a 100644
--- a/cmd/nerdctl/compose/compose_logs.go
+++ b/cmd/nerdctl/compose/compose_logs.go
@@ -26,19 +26,19 @@ import (
 )
 
 func newComposeLogsCommand() *cobra.Command {
-	var composeLogsCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "logs [flags] [SERVICE...]",
 		Short:         "Show logs of running containers",
 		RunE:          composeLogsAction,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composeLogsCommand.Flags().BoolP("follow", "f", false, "Follow log output.")
-	composeLogsCommand.Flags().BoolP("timestamps", "t", false, "Show timestamps")
-	composeLogsCommand.Flags().String("tail", "all", "Number of lines to show from the end of the logs")
-	composeLogsCommand.Flags().Bool("no-color", false, "Produce monochrome output")
-	composeLogsCommand.Flags().Bool("no-log-prefix", false, "Don't print prefix in logs")
-	return composeLogsCommand
+	cmd.Flags().BoolP("follow", "f", false, "Follow log output.")
+	cmd.Flags().BoolP("timestamps", "t", false, "Show timestamps")
+	cmd.Flags().String("tail", "all", "Number of lines to show from the end of the logs")
+	cmd.Flags().Bool("no-color", false, "Produce monochrome output")
+	cmd.Flags().Bool("no-log-prefix", false, "Don't print prefix in logs")
+	return cmd
 }
 
 func composeLogsAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_pause.go b/cmd/nerdctl/compose/compose_pause.go
index 9fd02bf3..83ef7376 100644
--- a/cmd/nerdctl/compose/compose_pause.go
+++ b/cmd/nerdctl/compose/compose_pause.go
@@ -25,7 +25,7 @@ import (
 )
 
 func newComposePauseCommand() *cobra.Command {
-	var composePauseCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:                   "pause [SERVICE...]",
 		Short:                 "Pause all processes within containers of service(s). They can be unpaused with nerdctl compose unpause",
 		RunE:                  composePauseAction,
@@ -33,7 +33,7 @@ func newComposePauseCommand() *cobra.Command {
 		SilenceErrors:         true,
 		DisableFlagsInUseLine: true,
 	}
-	return composePauseCommand
+	return cmd
 }
 
 func composePauseAction(cmd *cobra.Command, args []string) error {
@@ -60,7 +60,7 @@ func composePauseAction(cmd *cobra.Command, args []string) error {
 }
 
 func newComposeUnpauseCommand() *cobra.Command {
-	var composeUnpauseCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:                   "unpause [SERVICE...]",
 		Short:                 "Unpause all processes within containers of service(s).",
 		RunE:                  composeUnpauseAction,
@@ -68,7 +68,7 @@ func newComposeUnpauseCommand() *cobra.Command {
 		SilenceErrors:         true,
 		DisableFlagsInUseLine: true,
 	}
-	return composeUnpauseCommand
+	return cmd
 }
 
 func composeUnpauseAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_port.go b/cmd/nerdctl/compose/compose_port.go
index 2cbf14b0..686e052b 100644
--- a/cmd/nerdctl/compose/compose_port.go
+++ b/cmd/nerdctl/compose/compose_port.go
@@ -29,7 +29,7 @@ import (
 )
 
 func newComposePortCommand() *cobra.Command {
-	var composePortCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "port [flags] SERVICE PRIVATE_PORT",
 		Short:         "Print the public port for a port binding",
 		Args:          cobra.ExactArgs(2),
@@ -37,10 +37,10 @@ func newComposePortCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composePortCommand.Flags().Int("index", 1, "index of the container if the service has multiple instances.")
-	composePortCommand.Flags().String("protocol", "tcp", "protocol of the port (tcp|udp)")
+	cmd.Flags().Int("index", 1, "index of the container if the service has multiple instances.")
+	cmd.Flags().String("protocol", "tcp", "protocol of the port (tcp|udp)")
 
-	return composePortCommand
+	return cmd
 }
 
 func composePortAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_ps.go b/cmd/nerdctl/compose/compose_ps.go
index 1626b14c..d448b8b6 100644
--- a/cmd/nerdctl/compose/compose_ps.go
+++ b/cmd/nerdctl/compose/compose_ps.go
@@ -42,20 +42,20 @@ import (
 )
 
 func newComposePsCommand() *cobra.Command {
-	var composePsCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "ps [flags] [SERVICE...]",
 		Short:         "List containers of services",
 		RunE:          composePsAction,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composePsCommand.Flags().String("format", "table", "Format the output. Supported values: [table|json]")
-	composePsCommand.Flags().String("filter", "", "Filter matches containers based on given conditions")
-	composePsCommand.Flags().StringArray("status", []string{}, "Filter services by status. Values: [paused | restarting | removing | running | dead | created | exited]")
-	composePsCommand.Flags().BoolP("quiet", "q", false, "Only display container IDs")
-	composePsCommand.Flags().Bool("services", false, "Display services")
-	composePsCommand.Flags().BoolP("all", "a", false, "Show all containers (default shows just running)")
-	return composePsCommand
+	cmd.Flags().String("format", "table", "Format the output. Supported values: [table|json]")
+	cmd.Flags().String("filter", "", "Filter matches containers based on given conditions")
+	cmd.Flags().StringArray("status", []string{}, "Filter services by status. Values: [paused | restarting | removing | running | dead | created | exited]")
+	cmd.Flags().BoolP("quiet", "q", false, "Only display container IDs")
+	cmd.Flags().Bool("services", false, "Display services")
+	cmd.Flags().BoolP("all", "a", false, "Show all containers (default shows just running)")
+	return cmd
 }
 
 type composeContainerPrintable struct {
diff --git a/cmd/nerdctl/compose/compose_pull.go b/cmd/nerdctl/compose/compose_pull.go
index 9763377d..df7a7160 100644
--- a/cmd/nerdctl/compose/compose_pull.go
+++ b/cmd/nerdctl/compose/compose_pull.go
@@ -26,15 +26,15 @@ import (
 )
 
 func newComposePullCommand() *cobra.Command {
-	var composePullCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "pull [flags] [SERVICE...]",
 		Short:         "Pull service images",
 		RunE:          composePullAction,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composePullCommand.Flags().BoolP("quiet", "q", false, "Pull without printing progress information")
-	return composePullCommand
+	cmd.Flags().BoolP("quiet", "q", false, "Pull without printing progress information")
+	return cmd
 }
 
 func composePullAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_push.go b/cmd/nerdctl/compose/compose_push.go
index 50063d55..5eddf05e 100644
--- a/cmd/nerdctl/compose/compose_push.go
+++ b/cmd/nerdctl/compose/compose_push.go
@@ -26,14 +26,14 @@ import (
 )
 
 func newComposePushCommand() *cobra.Command {
-	var composePushCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "push [flags] [SERVICE...]",
 		Short:         "Push service images",
 		RunE:          composePushAction,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	return composePushCommand
+	return cmd
 }
 
 func composePushAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_restart.go b/cmd/nerdctl/compose/compose_restart.go
index 0ee3a936..c65434c4 100644
--- a/cmd/nerdctl/compose/compose_restart.go
+++ b/cmd/nerdctl/compose/compose_restart.go
@@ -26,15 +26,15 @@ import (
 )
 
 func newComposeRestartCommand() *cobra.Command {
-	var composeRestartCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "restart [flags] [SERVICE...]",
 		Short:         "Restart containers of given (or all) services",
 		RunE:          composeRestartAction,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composeRestartCommand.Flags().UintP("timeout", "t", 10, "Seconds to wait before restarting them")
-	return composeRestartCommand
+	cmd.Flags().UintP("timeout", "t", 10, "Seconds to wait before restarting them")
+	return cmd
 }
 
 func composeRestartAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_rm.go b/cmd/nerdctl/compose/compose_rm.go
index d82e345d..b2ec4d0a 100644
--- a/cmd/nerdctl/compose/compose_rm.go
+++ b/cmd/nerdctl/compose/compose_rm.go
@@ -29,17 +29,17 @@ import (
 )
 
 func newComposeRemoveCommand() *cobra.Command {
-	var composeRemoveCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "rm [flags] [SERVICE...]",
 		Short:         "Remove stopped service containers",
 		RunE:          composeRemoveAction,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composeRemoveCommand.Flags().BoolP("force", "f", false, "Do not prompt for confirmation")
-	composeRemoveCommand.Flags().BoolP("stop", "s", false, "Stop containers before removing")
-	composeRemoveCommand.Flags().BoolP("volumes", "v", false, "Remove anonymous volumes associated with containers")
-	return composeRemoveCommand
+	cmd.Flags().BoolP("force", "f", false, "Do not prompt for confirmation")
+	cmd.Flags().BoolP("stop", "s", false, "Stop containers before removing")
+	cmd.Flags().BoolP("volumes", "v", false, "Remove anonymous volumes associated with containers")
+	return cmd
 }
 
 func composeRemoveAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_run.go b/cmd/nerdctl/compose/compose_run.go
index afe02895..f706f1dc 100644
--- a/cmd/nerdctl/compose/compose_run.go
+++ b/cmd/nerdctl/compose/compose_run.go
@@ -29,7 +29,7 @@ import (
 )
 
 func newComposeRunCommand() *cobra.Command {
-	var composeRunCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:                   "run [flags] SERVICE [COMMAND] [ARGS...]",
 		Short:                 "Run a one-off command on a service",
 		Args:                  cobra.MinimumNArgs(1),
@@ -38,35 +38,35 @@ func newComposeRunCommand() *cobra.Command {
 		SilenceErrors:         true,
 		DisableFlagsInUseLine: true,
 	}
-	composeRunCommand.Flags().SetInterspersed(false)
-	composeRunCommand.Flags().BoolP("detach", "d", false, "Detached mode: Run containers in the background")
-	composeRunCommand.Flags().Bool("no-build", false, "Don't build an image, even if it's missing.")
-	composeRunCommand.Flags().Bool("no-color", false, "Produce monochrome output")
-	composeRunCommand.Flags().Bool("no-log-prefix", false, "Don't print prefix in logs")
-	composeRunCommand.Flags().Bool("build", false, "Build images before starting containers.")
-	composeRunCommand.Flags().Bool("quiet-pull", false, "Pull without printing progress information")
-	composeRunCommand.Flags().Bool("remove-orphans", false, "Remove containers for services not defined in the Compose file.")
-
-	composeRunCommand.Flags().String("name", "", "Assign a name to the container")
-	composeRunCommand.Flags().Bool("no-deps", false, "Don't start dependencies")
+	cmd.Flags().SetInterspersed(false)
+	cmd.Flags().BoolP("detach", "d", false, "Detached mode: Run containers in the background")
+	cmd.Flags().Bool("no-build", false, "Don't build an image, even if it's missing.")
+	cmd.Flags().Bool("no-color", false, "Produce monochrome output")
+	cmd.Flags().Bool("no-log-prefix", false, "Don't print prefix in logs")
+	cmd.Flags().Bool("build", false, "Build images before starting containers.")
+	cmd.Flags().Bool("quiet-pull", false, "Pull without printing progress information")
+	cmd.Flags().Bool("remove-orphans", false, "Remove containers for services not defined in the Compose file.")
+
+	cmd.Flags().String("name", "", "Assign a name to the container")
+	cmd.Flags().Bool("no-deps", false, "Don't start dependencies")
 	// TODO: no-TTY flag
 	//       In docker-compose's documentation, no-TTY is automatically detected
 	//       But, it follows `-i` flag because currently `run` command needs `-it` simultaneously.
-	composeRunCommand.Flags().BoolP("interactive", "i", true, "Keep STDIN open even if not attached")
-	composeRunCommand.Flags().Bool("rm", false, "Automatically remove the container when it exits")
-	composeRunCommand.Flags().StringP("user", "u", "", "Username or UID (format: <name|uid>[:<group|gid>])")
-	composeRunCommand.Flags().StringArrayP("volume", "v", nil, "Bind mount a volume")
-	composeRunCommand.Flags().StringArray("entrypoint", nil, "Overwrite the default ENTRYPOINT of the image")
-	composeRunCommand.Flags().StringArrayP("env", "e", nil, "Set environment variables")
-	composeRunCommand.Flags().StringArrayP("label", "l", nil, "Set metadata on container")
-	composeRunCommand.Flags().StringP("workdir", "w", "", "Working directory inside the container")
+	cmd.Flags().BoolP("interactive", "i", true, "Keep STDIN open even if not attached")
+	cmd.Flags().Bool("rm", false, "Automatically remove the container when it exits")
+	cmd.Flags().StringP("user", "u", "", "Username or UID (format: <name|uid>[:<group|gid>])")
+	cmd.Flags().StringArrayP("volume", "v", nil, "Bind mount a volume")
+	cmd.Flags().StringArray("entrypoint", nil, "Overwrite the default ENTRYPOINT of the image")
+	cmd.Flags().StringArrayP("env", "e", nil, "Set environment variables")
+	cmd.Flags().StringArrayP("label", "l", nil, "Set metadata on container")
+	cmd.Flags().StringP("workdir", "w", "", "Working directory inside the container")
 	// FIXME: `-p` conflicts with the `--project-name` in PersistentFlags of parent command `compose`
 	//        For docker compatibility, it should be fixed.
-	composeRunCommand.Flags().StringSlice("publish", nil, "Publish a container's port(s) to the host")
-	composeRunCommand.Flags().Bool("service-ports", false, "Run command with the service's ports enabled and mapped to the host")
+	cmd.Flags().StringSlice("publish", nil, "Publish a container's port(s) to the host")
+	cmd.Flags().Bool("service-ports", false, "Run command with the service's ports enabled and mapped to the host")
 	// TODO: use-aliases
 
-	return composeRunCommand
+	return cmd
 }
 
 func composeRunAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_start.go b/cmd/nerdctl/compose/compose_start.go
index ce0cde46..e6bd17d2 100644
--- a/cmd/nerdctl/compose/compose_start.go
+++ b/cmd/nerdctl/compose/compose_start.go
@@ -35,7 +35,7 @@ import (
 )
 
 func newComposeStartCommand() *cobra.Command {
-	var composeRestartCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:                   "start [SERVICE...]",
 		Short:                 "Start existing containers for service(s)",
 		RunE:                  composeStartAction,
@@ -43,7 +43,7 @@ func newComposeStartCommand() *cobra.Command {
 		SilenceErrors:         true,
 		DisableFlagsInUseLine: true,
 	}
-	return composeRestartCommand
+	return cmd
 }
 
 func composeStartAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_stop.go b/cmd/nerdctl/compose/compose_stop.go
index 2f3382a9..7bf48d95 100644
--- a/cmd/nerdctl/compose/compose_stop.go
+++ b/cmd/nerdctl/compose/compose_stop.go
@@ -26,15 +26,15 @@ import (
 )
 
 func newComposeStopCommand() *cobra.Command {
-	var composeStopCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "stop [flags] [SERVICE...]",
 		Short:         "Stop running containers without removing them.",
 		RunE:          composeStopAction,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composeStopCommand.Flags().UintP("timeout", "t", 10, "Seconds to wait for stop before killing them")
-	return composeStopCommand
+	cmd.Flags().UintP("timeout", "t", 10, "Seconds to wait for stop before killing them")
+	return cmd
 }
 
 func composeStopAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_top.go b/cmd/nerdctl/compose/compose_top.go
index 0bb8dadc..4191ccb2 100644
--- a/cmd/nerdctl/compose/compose_top.go
+++ b/cmd/nerdctl/compose/compose_top.go
@@ -33,7 +33,7 @@ import (
 )
 
 func newComposeTopCommand() *cobra.Command {
-	var composeTopCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:                   "top [SERVICE...]",
 		Short:                 "Display the running processes of service containers",
 		RunE:                  composeTopAction,
@@ -41,7 +41,7 @@ func newComposeTopCommand() *cobra.Command {
 		SilenceErrors:         true,
 		DisableFlagsInUseLine: true,
 	}
-	return composeTopCommand
+	return cmd
 }
 
 func composeTopAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/compose/compose_up.go b/cmd/nerdctl/compose/compose_up.go
index 0cf2d6bc..9b2ef634 100644
--- a/cmd/nerdctl/compose/compose_up.go
+++ b/cmd/nerdctl/compose/compose_up.go
@@ -31,27 +31,27 @@ import (
 )
 
 func newComposeUpCommand() *cobra.Command {
-	var composeUpCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "up [flags] [SERVICE...]",
 		Short:         "Create and start containers",
 		RunE:          composeUpAction,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composeUpCommand.Flags().Bool("abort-on-container-exit", false, "Stops all containers if any container was stopped. Incompatible with -d.")
-	composeUpCommand.Flags().BoolP("detach", "d", false, "Detached mode: Run containers in the background. Incompatible with --abort-on-container-exit.")
-	composeUpCommand.Flags().Bool("no-build", false, "Don't build an image, even if it's missing.")
-	composeUpCommand.Flags().Bool("no-color", false, "Produce monochrome output")
-	composeUpCommand.Flags().Bool("no-log-prefix", false, "Don't print prefix in logs")
-	composeUpCommand.Flags().Bool("build", false, "Build images before starting containers.")
-	composeUpCommand.Flags().Bool("ipfs", false, "Allow pulling base images from IPFS during build")
-	composeUpCommand.Flags().Bool("quiet-pull", false, "Pull without printing progress information")
-	composeUpCommand.Flags().Bool("remove-orphans", false, "Remove containers for services not defined in the Compose file.")
-	composeUpCommand.Flags().Bool("force-recreate", false, "Recreate containers even if their configuration and image haven't changed.")
-	composeUpCommand.Flags().Bool("no-recreate", false, "Don't recreate containers if they exist, conflict with --force-recreate.")
-	composeUpCommand.Flags().StringArray("scale", []string{}, "Scale SERVICE to NUM instances. Overrides the `scale` setting in the Compose file if present.")
-	composeUpCommand.Flags().String("pull", "", "Pull image before running (\"always\"|\"missing\"|\"never\")")
-	return composeUpCommand
+	cmd.Flags().Bool("abort-on-container-exit", false, "Stops all containers if any container was stopped. Incompatible with -d.")
+	cmd.Flags().BoolP("detach", "d", false, "Detached mode: Run containers in the background. Incompatible with --abort-on-container-exit.")
+	cmd.Flags().Bool("no-build", false, "Don't build an image, even if it's missing.")
+	cmd.Flags().Bool("no-color", false, "Produce monochrome output")
+	cmd.Flags().Bool("no-log-prefix", false, "Don't print prefix in logs")
+	cmd.Flags().Bool("build", false, "Build images before starting containers.")
+	cmd.Flags().Bool("ipfs", false, "Allow pulling base images from IPFS during build")
+	cmd.Flags().Bool("quiet-pull", false, "Pull without printing progress information")
+	cmd.Flags().Bool("remove-orphans", false, "Remove containers for services not defined in the Compose file.")
+	cmd.Flags().Bool("force-recreate", false, "Recreate containers even if their configuration and image haven't changed.")
+	cmd.Flags().Bool("no-recreate", false, "Don't recreate containers if they exist, conflict with --force-recreate.")
+	cmd.Flags().StringArray("scale", []string{}, "Scale SERVICE to NUM instances. Overrides the `scale` setting in the Compose file if present.")
+	cmd.Flags().String("pull", "", "Pull image before running (\"always\"|\"missing\"|\"never\")")
+	return cmd
 }
 
 func composeUpAction(cmd *cobra.Command, services []string) error {
diff --git a/cmd/nerdctl/compose/compose_version.go b/cmd/nerdctl/compose/compose_version.go
index d4a74a4b..11f0abce 100644
--- a/cmd/nerdctl/compose/compose_version.go
+++ b/cmd/nerdctl/compose/compose_version.go
@@ -26,7 +26,7 @@ import (
 )
 
 func newComposeVersionCommand() *cobra.Command {
-	var composeVersionCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "version",
 		Short:         "Show the Compose version information",
 		Args:          cobra.NoArgs,
@@ -34,12 +34,12 @@ func newComposeVersionCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	composeVersionCommand.Flags().StringP("format", "f", "pretty", "Format the output. Values: [pretty | json]")
-	composeVersionCommand.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().StringP("format", "f", "pretty", "Format the output. Values: [pretty | json]")
+	cmd.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json", "pretty"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	composeVersionCommand.Flags().Bool("short", false, "Shows only Compose's version number")
-	return composeVersionCommand
+	cmd.Flags().Bool("short", false, "Shows only Compose's version number")
+	return cmd
 }
 
 func composeVersionAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/container/container.go b/cmd/nerdctl/container/container.go
index 21c7f9b6..3a2b3bb5 100644
--- a/cmd/nerdctl/container/container.go
+++ b/cmd/nerdctl/container/container.go
@@ -23,7 +23,7 @@ import (
 )
 
 func NewContainerCommand() *cobra.Command {
-	containerCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Annotations:   map[string]string{helpers.Category: helpers.Management},
 		Use:           "container",
 		Short:         "Manage containers",
@@ -31,7 +31,7 @@ func NewContainerCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	containerCommand.AddCommand(
+	cmd.AddCommand(
 		NewCreateCommand(),
 		NewRunCommand(),
 		NewUpdateCommand(),
@@ -55,8 +55,8 @@ func NewContainerCommand() *cobra.Command {
 		NewStatsCommand(),
 		NewAttachCommand(),
 	)
-	AddCpCommand(containerCommand)
-	return containerCommand
+	AddCpCommand(cmd)
+	return cmd
 }
 
 func containerLsCommand() *cobra.Command {
diff --git a/cmd/nerdctl/container/container_attach.go b/cmd/nerdctl/container/container_attach.go
index e92aa44b..0dee2331 100644
--- a/cmd/nerdctl/container/container_attach.go
+++ b/cmd/nerdctl/container/container_attach.go
@@ -45,7 +45,7 @@ Caveats:
 - Until dual logging (issue #1946) is implemented,
   a container that is spun up by either 'nerdctl run -d' or 'nerdctl start' (without '--attach') cannot be attached to.`
 
-	var attachCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "attach [flags] CONTAINER",
 		Args:              cobra.ExactArgs(1),
 		Short:             shortHelp,
@@ -55,8 +55,8 @@ Caveats:
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	attachCommand.Flags().String("detach-keys", consoleutil.DefaultDetachKeys, "Override the default detach keys")
-	return attachCommand
+	cmd.Flags().String("detach-keys", consoleutil.DefaultDetachKeys, "Override the default detach keys")
+	return cmd
 }
 
 func processContainerAttachOptions(cmd *cobra.Command) (types.ContainerAttachOptions, error) {
diff --git a/cmd/nerdctl/container/container_commit.go b/cmd/nerdctl/container/container_commit.go
index e7276499..c6653512 100644
--- a/cmd/nerdctl/container/container_commit.go
+++ b/cmd/nerdctl/container/container_commit.go
@@ -27,7 +27,7 @@ import (
 )
 
 func NewCommitCommand() *cobra.Command {
-	var commitCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "commit [flags] CONTAINER REPOSITORY[:TAG]",
 		Short:             "Create a new image from a container's changes",
 		Args:              helpers.IsExactArgs(2),
@@ -36,11 +36,11 @@ func NewCommitCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	commitCommand.Flags().StringP("author", "a", "", `Author (e.g., "nerdctl contributor <nerdctl-dev@example.com>")`)
-	commitCommand.Flags().StringP("message", "m", "", "Commit message")
-	commitCommand.Flags().StringArrayP("change", "c", nil, "Apply Dockerfile instruction to the created image (supported directives: [CMD, ENTRYPOINT])")
-	commitCommand.Flags().BoolP("pause", "p", true, "Pause container during commit")
-	return commitCommand
+	cmd.Flags().StringP("author", "a", "", `Author (e.g., "nerdctl contributor <nerdctl-dev@example.com>")`)
+	cmd.Flags().StringP("message", "m", "", "Commit message")
+	cmd.Flags().StringArrayP("change", "c", nil, "Apply Dockerfile instruction to the created image (supported directives: [CMD, ENTRYPOINT])")
+	cmd.Flags().BoolP("pause", "p", true, "Pause container during commit")
+	return cmd
 }
 
 func processCommitCommandOptions(cmd *cobra.Command) (types.ContainerCommitOptions, error) {
diff --git a/cmd/nerdctl/container/container_cp_linux.go b/cmd/nerdctl/container/container_cp_linux.go
index e9af6a72..9832c7f4 100644
--- a/cmd/nerdctl/container/container_cp_linux.go
+++ b/cmd/nerdctl/container/container_cp_linux.go
@@ -45,7 +45,7 @@ Using 'nerdctl cp' with untrusted or malicious containers is unsupported and may
 
 	usage := `cp [flags] CONTAINER:SRC_PATH DEST_PATH|-
   nerdctl cp [flags] SRC_PATH|- CONTAINER:DEST_PATH`
-	var cpCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               usage,
 		Args:              helpers.IsExactArgs(2),
 		Short:             shortHelp,
@@ -56,9 +56,9 @@ Using 'nerdctl cp' with untrusted or malicious containers is unsupported and may
 		SilenceErrors:     true,
 	}
 
-	cpCommand.Flags().BoolP("follow-link", "L", false, "Always follow symbolic link in SRC_PATH.")
+	cmd.Flags().BoolP("follow-link", "L", false, "Always follow symbolic link in SRC_PATH.")
 
-	return cpCommand
+	return cmd
 }
 
 func cpAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/container/container_create.go b/cmd/nerdctl/container/container_create.go
index 97d1b2f8..5b6de8bd 100644
--- a/cmd/nerdctl/container/container_create.go
+++ b/cmd/nerdctl/container/container_create.go
@@ -40,7 +40,7 @@ func NewCreateCommand() *cobra.Command {
 		longHelp += "\n"
 		longHelp += "WARNING: `nerdctl create` is experimental on FreeBSD and currently requires `--net=none` (https://github.com/containerd/nerdctl/blob/main/docs/freebsd.md)"
 	}
-	var createCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "create [flags] IMAGE [COMMAND] [ARG...]",
 		Args:              cobra.MinimumNArgs(1),
 		Short:             shortHelp,
@@ -50,9 +50,9 @@ func NewCreateCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	createCommand.Flags().SetInterspersed(false)
-	setCreateFlags(createCommand)
-	return createCommand
+	cmd.Flags().SetInterspersed(false)
+	setCreateFlags(cmd)
+	return cmd
 }
 
 func processContainerCreateOptions(cmd *cobra.Command) (types.ContainerCreateOptions, error) {
diff --git a/cmd/nerdctl/container/container_diff.go b/cmd/nerdctl/container/container_diff.go
index 9b3e5be4..0aa3e1a6 100644
--- a/cmd/nerdctl/container/container_diff.go
+++ b/cmd/nerdctl/container/container_diff.go
@@ -44,7 +44,7 @@ import (
 )
 
 func NewDiffCommand() *cobra.Command {
-	var diffCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "diff [CONTAINER]",
 		Short:             "Inspect changes to files or directories on a container's filesystem",
 		Args:              cobra.MinimumNArgs(1),
@@ -53,7 +53,7 @@ func NewDiffCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	return diffCommand
+	return cmd
 }
 
 func processContainerDiffOptions(cmd *cobra.Command) (types.ContainerDiffOptions, error) {
diff --git a/cmd/nerdctl/container/container_exec.go b/cmd/nerdctl/container/container_exec.go
index fc6f0c0c..92d758c9 100644
--- a/cmd/nerdctl/container/container_exec.go
+++ b/cmd/nerdctl/container/container_exec.go
@@ -31,7 +31,7 @@ import (
 )
 
 func NewExecCommand() *cobra.Command {
-	var execCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "exec [flags] CONTAINER COMMAND [ARG...]",
 		Args:              cobra.MinimumNArgs(2),
 		Short:             "Run a command in a running container",
@@ -40,19 +40,19 @@ func NewExecCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	execCommand.Flags().SetInterspersed(false)
+	cmd.Flags().SetInterspersed(false)
 
-	execCommand.Flags().BoolP("tty", "t", false, "Allocate a pseudo-TTY")
-	execCommand.Flags().BoolP("interactive", "i", false, "Keep STDIN open even if not attached")
-	execCommand.Flags().BoolP("detach", "d", false, "Detached mode: run command in the background")
-	execCommand.Flags().StringP("workdir", "w", "", "Working directory inside the container")
+	cmd.Flags().BoolP("tty", "t", false, "Allocate a pseudo-TTY")
+	cmd.Flags().BoolP("interactive", "i", false, "Keep STDIN open even if not attached")
+	cmd.Flags().BoolP("detach", "d", false, "Detached mode: run command in the background")
+	cmd.Flags().StringP("workdir", "w", "", "Working directory inside the container")
 	// env needs to be StringArray, not StringSlice, to prevent "FOO=foo1,foo2" from being split to {"FOO=foo1", "foo2"}
-	execCommand.Flags().StringArrayP("env", "e", nil, "Set environment variables")
+	cmd.Flags().StringArrayP("env", "e", nil, "Set environment variables")
 	// env-file is defined as StringSlice, not StringArray, to allow specifying "--env-file=FILE1,FILE2" (compatible with Podman)
-	execCommand.Flags().StringSlice("env-file", nil, "Set environment variables from file")
-	execCommand.Flags().Bool("privileged", false, "Give extended privileges to the command")
-	execCommand.Flags().StringP("user", "u", "", "Username or UID (format: <name|uid>[:<group|gid>])")
-	return execCommand
+	cmd.Flags().StringSlice("env-file", nil, "Set environment variables from file")
+	cmd.Flags().Bool("privileged", false, "Give extended privileges to the command")
+	cmd.Flags().StringP("user", "u", "", "Username or UID (format: <name|uid>[:<group|gid>])")
+	return cmd
 }
 
 func processExecCommandOptions(cmd *cobra.Command) (types.ContainerExecOptions, error) {
diff --git a/cmd/nerdctl/container/container_inspect.go b/cmd/nerdctl/container/container_inspect.go
index 6dae2cbf..739994e3 100644
--- a/cmd/nerdctl/container/container_inspect.go
+++ b/cmd/nerdctl/container/container_inspect.go
@@ -29,7 +29,7 @@ import (
 )
 
 func newContainerInspectCommand() *cobra.Command {
-	var containerInspectCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "inspect [flags] CONTAINER [CONTAINER, ...]",
 		Short:             "Display detailed information on one or more containers.",
 		Long:              "Hint: set `--mode=native` for showing the full output",
@@ -39,17 +39,17 @@ func newContainerInspectCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	containerInspectCommand.Flags().String("mode", "dockercompat", `Inspect mode, "dockercompat" for Docker-compatible output, "native" for containerd-native output`)
-	containerInspectCommand.Flags().BoolP("size", "s", false, "Display total file sizes")
+	cmd.Flags().String("mode", "dockercompat", `Inspect mode, "dockercompat" for Docker-compatible output, "native" for containerd-native output`)
+	cmd.Flags().BoolP("size", "s", false, "Display total file sizes")
 
-	containerInspectCommand.RegisterFlagCompletionFunc("mode", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.RegisterFlagCompletionFunc("mode", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"dockercompat", "native"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	containerInspectCommand.Flags().StringP("format", "f", "", "Format the output using the given Go template, e.g, '{{json .}}'")
-	containerInspectCommand.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().StringP("format", "f", "", "Format the output using the given Go template, e.g, '{{json .}}'")
+	cmd.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	return containerInspectCommand
+	return cmd
 }
 
 var validModeType = map[string]bool{
diff --git a/cmd/nerdctl/container/container_kill.go b/cmd/nerdctl/container/container_kill.go
index 154cec0e..b143d64f 100644
--- a/cmd/nerdctl/container/container_kill.go
+++ b/cmd/nerdctl/container/container_kill.go
@@ -29,7 +29,7 @@ import (
 )
 
 func NewKillCommand() *cobra.Command {
-	var killCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "kill [flags] CONTAINER [CONTAINER, ...]",
 		Short:             "Kill one or more running containers",
 		Args:              cobra.MinimumNArgs(1),
@@ -38,8 +38,8 @@ func NewKillCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	killCommand.Flags().StringP("signal", "s", "KILL", "Signal to send to the container")
-	return killCommand
+	cmd.Flags().StringP("signal", "s", "KILL", "Signal to send to the container")
+	return cmd
 }
 
 func killAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/container/container_list.go b/cmd/nerdctl/container/container_list.go
index c9f0d3bd..07b81983 100644
--- a/cmd/nerdctl/container/container_list.go
+++ b/cmd/nerdctl/container/container_list.go
@@ -34,7 +34,7 @@ import (
 )
 
 func NewPsCommand() *cobra.Command {
-	var psCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "ps",
 		Args:          cobra.NoArgs,
 		Short:         "List containers",
@@ -42,20 +42,20 @@ func NewPsCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	psCommand.Flags().BoolP("all", "a", false, "Show all containers (default shows just running)")
-	psCommand.Flags().IntP("last", "n", -1, "Show n last created containers (includes all states)")
-	psCommand.Flags().BoolP("latest", "l", false, "Show the latest created container (includes all states)")
-	psCommand.Flags().Bool("no-trunc", false, "Don't truncate output")
-	psCommand.Flags().BoolP("quiet", "q", false, "Only display container IDs")
-	psCommand.Flags().BoolP("size", "s", false, "Display total file sizes")
+	cmd.Flags().BoolP("all", "a", false, "Show all containers (default shows just running)")
+	cmd.Flags().IntP("last", "n", -1, "Show n last created containers (includes all states)")
+	cmd.Flags().BoolP("latest", "l", false, "Show the latest created container (includes all states)")
+	cmd.Flags().Bool("no-trunc", false, "Don't truncate output")
+	cmd.Flags().BoolP("quiet", "q", false, "Only display container IDs")
+	cmd.Flags().BoolP("size", "s", false, "Display total file sizes")
 
 	// Alias "-f" is reserved for "--filter"
-	psCommand.Flags().String("format", "", "Format the output using the given Go template, e.g, '{{json .}}', 'wide'")
-	psCommand.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().String("format", "", "Format the output using the given Go template, e.g, '{{json .}}', 'wide'")
+	cmd.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json", "table", "wide"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	psCommand.Flags().StringSliceP("filter", "f", nil, "Filter matches containers based on given conditions. When specifying the condition 'status', it filters all containers")
-	return psCommand
+	cmd.Flags().StringSliceP("filter", "f", nil, "Filter matches containers based on given conditions. When specifying the condition 'status', it filters all containers")
+	return cmd
 }
 
 func processOptions(cmd *cobra.Command) (types.ContainerListOptions, FormattingAndPrintingOptions, error) {
diff --git a/cmd/nerdctl/container/container_logs.go b/cmd/nerdctl/container/container_logs.go
index 005d4b19..d0f1b64b 100644
--- a/cmd/nerdctl/container/container_logs.go
+++ b/cmd/nerdctl/container/container_logs.go
@@ -38,7 +38,7 @@ The following containers are supported:
 - Containers created with 'nerdctl compose'.
 - Containers created with Kubernetes (EXPERIMENTAL).
 `
-	var logsCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "logs [flags] CONTAINER",
 		Args:              helpers.IsExactArgs(1),
 		Short:             shortUsage,
@@ -48,12 +48,12 @@ The following containers are supported:
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	logsCommand.Flags().BoolP("follow", "f", false, "Follow log output")
-	logsCommand.Flags().BoolP("timestamps", "t", false, "Show timestamps")
-	logsCommand.Flags().StringP("tail", "n", "all", "Number of lines to show from the end of the logs")
-	logsCommand.Flags().String("since", "", "Show logs since timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)")
-	logsCommand.Flags().String("until", "", "Show logs before a timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)")
-	return logsCommand
+	cmd.Flags().BoolP("follow", "f", false, "Follow log output")
+	cmd.Flags().BoolP("timestamps", "t", false, "Show timestamps")
+	cmd.Flags().StringP("tail", "n", "all", "Number of lines to show from the end of the logs")
+	cmd.Flags().String("since", "", "Show logs since timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)")
+	cmd.Flags().String("until", "", "Show logs before a timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)")
+	return cmd
 }
 
 func processContainerLogsOptions(cmd *cobra.Command) (types.ContainerLogsOptions, error) {
diff --git a/cmd/nerdctl/container/container_pause.go b/cmd/nerdctl/container/container_pause.go
index 338652f8..c5993746 100644
--- a/cmd/nerdctl/container/container_pause.go
+++ b/cmd/nerdctl/container/container_pause.go
@@ -29,7 +29,7 @@ import (
 )
 
 func NewPauseCommand() *cobra.Command {
-	var pauseCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "pause [flags] CONTAINER [CONTAINER, ...]",
 		Args:              cobra.MinimumNArgs(1),
 		Short:             "Pause all processes within one or more containers",
@@ -38,7 +38,7 @@ func NewPauseCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	return pauseCommand
+	return cmd
 }
 
 func processContainerPauseOptions(cmd *cobra.Command) (types.ContainerPauseOptions, error) {
diff --git a/cmd/nerdctl/container/container_port.go b/cmd/nerdctl/container/container_port.go
index 1b618be0..164a5963 100644
--- a/cmd/nerdctl/container/container_port.go
+++ b/cmd/nerdctl/container/container_port.go
@@ -32,7 +32,7 @@ import (
 )
 
 func NewPortCommand() *cobra.Command {
-	var portCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "port [flags] CONTAINER [PRIVATE_PORT[/PROTO]]",
 		Args:              cobra.RangeArgs(1, 2),
 		Short:             "List port mappings or a specific mapping for the container",
@@ -41,7 +41,7 @@ func NewPortCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	return portCommand
+	return cmd
 }
 
 func portAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/container/container_prune.go b/cmd/nerdctl/container/container_prune.go
index 79ce0d8b..9717c1c3 100644
--- a/cmd/nerdctl/container/container_prune.go
+++ b/cmd/nerdctl/container/container_prune.go
@@ -26,7 +26,7 @@ import (
 )
 
 func newContainerPruneCommand() *cobra.Command {
-	containerPruneCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:           "prune [flags]",
 		Short:         "Remove all stopped containers",
 		Args:          cobra.NoArgs,
@@ -34,8 +34,8 @@ func newContainerPruneCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	containerPruneCommand.Flags().BoolP("force", "f", false, "Do not prompt for confirmation")
-	return containerPruneCommand
+	cmd.Flags().BoolP("force", "f", false, "Do not prompt for confirmation")
+	return cmd
 }
 
 func processContainerPruneOptions(cmd *cobra.Command) (types.ContainerPruneOptions, error) {
diff --git a/cmd/nerdctl/container/container_remove.go b/cmd/nerdctl/container/container_remove.go
index fd50457a..915091e0 100644
--- a/cmd/nerdctl/container/container_remove.go
+++ b/cmd/nerdctl/container/container_remove.go
@@ -27,7 +27,7 @@ import (
 )
 
 func NewRmCommand() *cobra.Command {
-	var rmCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "rm [flags] CONTAINER [CONTAINER, ...]",
 		Args:              cobra.MinimumNArgs(1),
 		Short:             "Remove one or more containers",
@@ -36,10 +36,10 @@ func NewRmCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	rmCommand.Aliases = []string{"remove"}
-	rmCommand.Flags().BoolP("force", "f", false, "Force the removal of a running|paused|unknown container (uses SIGKILL)")
-	rmCommand.Flags().BoolP("volumes", "v", false, "Remove volumes associated with the container")
-	return rmCommand
+	cmd.Aliases = []string{"remove"}
+	cmd.Flags().BoolP("force", "f", false, "Force the removal of a running|paused|unknown container (uses SIGKILL)")
+	cmd.Flags().BoolP("volumes", "v", false, "Remove volumes associated with the container")
+	return cmd
 }
 
 func rmAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/container/container_rename.go b/cmd/nerdctl/container/container_rename.go
index 46b48aae..7c5c177f 100644
--- a/cmd/nerdctl/container/container_rename.go
+++ b/cmd/nerdctl/container/container_rename.go
@@ -27,7 +27,7 @@ import (
 )
 
 func NewRenameCommand() *cobra.Command {
-	var renameCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "rename [flags] CONTAINER NEW_NAME",
 		Args:              helpers.IsExactArgs(2),
 		Short:             "rename a container",
@@ -36,7 +36,7 @@ func NewRenameCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	return renameCommand
+	return cmd
 }
 
 func processContainerRenameOptions(cmd *cobra.Command) (types.ContainerRenameOptions, error) {
diff --git a/cmd/nerdctl/container/container_restart.go b/cmd/nerdctl/container/container_restart.go
index 60c0f100..c1e8dd9c 100644
--- a/cmd/nerdctl/container/container_restart.go
+++ b/cmd/nerdctl/container/container_restart.go
@@ -28,7 +28,7 @@ import (
 )
 
 func NewRestartCommand() *cobra.Command {
-	var restartCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "restart [flags] CONTAINER [CONTAINER, ...]",
 		Args:              cobra.MinimumNArgs(1),
 		Short:             "Restart one or more running containers",
@@ -37,9 +37,9 @@ func NewRestartCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	restartCommand.Flags().UintP("time", "t", 10, "Seconds to wait for stop before killing it")
-	restartCommand.Flags().StringP("signal", "s", "", "Signal to send to stop the container, before killing it")
-	return restartCommand
+	cmd.Flags().UintP("time", "t", 10, "Seconds to wait for stop before killing it")
+	cmd.Flags().StringP("signal", "s", "", "Signal to send to stop the container, before killing it")
+	return cmd
 }
 
 func processContainerRestartOptions(cmd *cobra.Command) (types.ContainerRestartOptions, error) {
diff --git a/cmd/nerdctl/container/container_run.go b/cmd/nerdctl/container/container_run.go
index 2053958f..361a3e0d 100644
--- a/cmd/nerdctl/container/container_run.go
+++ b/cmd/nerdctl/container/container_run.go
@@ -58,7 +58,7 @@ func NewRunCommand() *cobra.Command {
 		longHelp += "\n"
 		longHelp += "WARNING: `nerdctl run` is experimental on FreeBSD and currently requires `--net=none` (https://github.com/containerd/nerdctl/blob/main/docs/freebsd.md)"
 	}
-	var runCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "run [flags] IMAGE [COMMAND] [ARG...]",
 		Args:              cobra.MinimumNArgs(1),
 		Short:             shortHelp,
@@ -69,13 +69,13 @@ func NewRunCommand() *cobra.Command {
 		SilenceErrors:     true,
 	}
 
-	runCommand.Flags().SetInterspersed(false)
-	setCreateFlags(runCommand)
+	cmd.Flags().SetInterspersed(false)
+	setCreateFlags(cmd)
 
-	runCommand.Flags().BoolP("detach", "d", false, "Run container in background and print container ID")
-	runCommand.Flags().StringSliceP("attach", "a", []string{}, "Attach STDIN, STDOUT, or STDERR")
+	cmd.Flags().BoolP("detach", "d", false, "Run container in background and print container ID")
+	cmd.Flags().StringSliceP("attach", "a", []string{}, "Attach STDIN, STDOUT, or STDERR")
 
-	return runCommand
+	return cmd
 }
 
 func setCreateFlags(cmd *cobra.Command) {
diff --git a/cmd/nerdctl/container/container_start.go b/cmd/nerdctl/container/container_start.go
index 1bf361b8..d6d72c66 100644
--- a/cmd/nerdctl/container/container_start.go
+++ b/cmd/nerdctl/container/container_start.go
@@ -30,7 +30,7 @@ import (
 )
 
 func NewStartCommand() *cobra.Command {
-	var startCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "start [flags] CONTAINER [CONTAINER, ...]",
 		Args:              cobra.MinimumNArgs(1),
 		Short:             "Start one or more running containers",
@@ -40,11 +40,11 @@ func NewStartCommand() *cobra.Command {
 		SilenceErrors:     true,
 	}
 
-	startCommand.Flags().SetInterspersed(false)
-	startCommand.Flags().BoolP("attach", "a", false, "Attach STDOUT/STDERR and forward signals")
-	startCommand.Flags().String("detach-keys", consoleutil.DefaultDetachKeys, "Override the default detach keys")
+	cmd.Flags().SetInterspersed(false)
+	cmd.Flags().BoolP("attach", "a", false, "Attach STDOUT/STDERR and forward signals")
+	cmd.Flags().String("detach-keys", consoleutil.DefaultDetachKeys, "Override the default detach keys")
 
-	return startCommand
+	return cmd
 }
 
 func processContainerStartOptions(cmd *cobra.Command) (types.ContainerStartOptions, error) {
diff --git a/cmd/nerdctl/container/container_stats.go b/cmd/nerdctl/container/container_stats.go
index 10b927a7..643304b8 100644
--- a/cmd/nerdctl/container/container_stats.go
+++ b/cmd/nerdctl/container/container_stats.go
@@ -29,7 +29,7 @@ import (
 )
 
 func NewStatsCommand() *cobra.Command {
-	var statsCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "stats",
 		Short:             "Display a live stream of container(s) resource usage statistics.",
 		RunE:              statsAction,
@@ -38,9 +38,9 @@ func NewStatsCommand() *cobra.Command {
 		SilenceErrors:     true,
 	}
 
-	addStatsFlags(statsCommand)
+	addStatsFlags(cmd)
 
-	return statsCommand
+	return cmd
 }
 
 func addStatsFlags(cmd *cobra.Command) {
diff --git a/cmd/nerdctl/container/container_stop.go b/cmd/nerdctl/container/container_stop.go
index 708c422f..8aff8d3b 100644
--- a/cmd/nerdctl/container/container_stop.go
+++ b/cmd/nerdctl/container/container_stop.go
@@ -31,7 +31,7 @@ import (
 )
 
 func NewStopCommand() *cobra.Command {
-	var stopCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "stop [flags] CONTAINER [CONTAINER, ...]",
 		Args:              cobra.MinimumNArgs(1),
 		Short:             "Stop one or more running containers",
@@ -40,9 +40,9 @@ func NewStopCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	stopCommand.Flags().IntP("time", "t", 10, "Seconds to wait before sending a SIGKILL")
-	stopCommand.Flags().StringP("signal", "s", "SIGTERM", "Signal to send to the container")
-	return stopCommand
+	cmd.Flags().IntP("time", "t", 10, "Seconds to wait before sending a SIGKILL")
+	cmd.Flags().StringP("signal", "s", "SIGTERM", "Signal to send to the container")
+	return cmd
 }
 
 func processContainerStopOptions(cmd *cobra.Command) (types.ContainerStopOptions, error) {
diff --git a/cmd/nerdctl/container/container_top.go b/cmd/nerdctl/container/container_top.go
index 0f20e45a..06769ba0 100644
--- a/cmd/nerdctl/container/container_top.go
+++ b/cmd/nerdctl/container/container_top.go
@@ -34,7 +34,7 @@ import (
 )
 
 func NewTopCommand() *cobra.Command {
-	var topCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "top CONTAINER [ps OPTIONS]",
 		Args:              cobra.MinimumNArgs(1),
 		Short:             "Display the running processes of a container",
@@ -43,8 +43,8 @@ func NewTopCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	topCommand.Flags().SetInterspersed(false)
-	return topCommand
+	cmd.Flags().SetInterspersed(false)
+	return cmd
 }
 
 func topAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/container/container_unpause.go b/cmd/nerdctl/container/container_unpause.go
index 8d835c93..c8506687 100644
--- a/cmd/nerdctl/container/container_unpause.go
+++ b/cmd/nerdctl/container/container_unpause.go
@@ -29,7 +29,7 @@ import (
 )
 
 func NewUnpauseCommand() *cobra.Command {
-	var unpauseCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "unpause [flags] CONTAINER [CONTAINER, ...]",
 		Args:              cobra.MinimumNArgs(1),
 		Short:             "Unpause all processes within one or more containers",
@@ -38,7 +38,7 @@ func NewUnpauseCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	return unpauseCommand
+	return cmd
 }
 
 func processContainerUnpauseOptions(cmd *cobra.Command) (types.ContainerUnpauseOptions, error) {
diff --git a/cmd/nerdctl/container/container_update.go b/cmd/nerdctl/container/container_update.go
index 0ce83e5a..742ca19e 100644
--- a/cmd/nerdctl/container/container_update.go
+++ b/cmd/nerdctl/container/container_update.go
@@ -58,7 +58,7 @@ type updateResourceOptions struct {
 }
 
 func NewUpdateCommand() *cobra.Command {
-	var updateCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "update [flags] CONTAINER [CONTAINER, ...]",
 		Args:              cobra.MinimumNArgs(1),
 		Short:             "Update one or more running containers",
@@ -67,9 +67,9 @@ func NewUpdateCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	updateCommand.Flags().SetInterspersed(false)
-	setUpdateFlags(updateCommand)
-	return updateCommand
+	cmd.Flags().SetInterspersed(false)
+	setUpdateFlags(cmd)
+	return cmd
 }
 
 func setUpdateFlags(cmd *cobra.Command) {
diff --git a/cmd/nerdctl/container/container_wait.go b/cmd/nerdctl/container/container_wait.go
index c28168b0..fd2f1a14 100644
--- a/cmd/nerdctl/container/container_wait.go
+++ b/cmd/nerdctl/container/container_wait.go
@@ -29,7 +29,7 @@ import (
 )
 
 func NewWaitCommand() *cobra.Command {
-	var waitCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "wait [flags] CONTAINER [CONTAINER, ...]",
 		Args:              cobra.MinimumNArgs(1),
 		Short:             "Block until one or more containers stop, then print their exit codes.",
@@ -38,7 +38,7 @@ func NewWaitCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	return waitCommand
+	return cmd
 }
 
 func processContainerWaitOptions(cmd *cobra.Command) (types.ContainerWaitOptions, error) {
diff --git a/cmd/nerdctl/image/image_convert.go b/cmd/nerdctl/image/image_convert.go
index 5b181580..6be190cd 100644
--- a/cmd/nerdctl/image/image_convert.go
+++ b/cmd/nerdctl/image/image_convert.go
@@ -40,7 +40,7 @@ For encryption and decryption, use 'nerdctl image (encrypt|decrypt)' command.
 
 // imageConvertCommand is from https://github.com/containerd/stargz-snapshotter/blob/d58f43a8235e46da73fb94a1a35280cb4d607b2c/cmd/ctr-remote/commands/convert.go
 func newImageConvertCommand() *cobra.Command {
-	imageConvertCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:               "convert [flags] <source_ref> <target_ref>...",
 		Short:             "convert an image",
 		Long:              imageConvertHelp,
@@ -51,57 +51,57 @@ func newImageConvertCommand() *cobra.Command {
 		SilenceErrors:     true,
 	}
 
-	imageConvertCommand.Flags().String("format", "", "Format the output using the given Go template, e.g, 'json'")
+	cmd.Flags().String("format", "", "Format the output using the given Go template, e.g, 'json'")
 
 	// #region estargz flags
-	imageConvertCommand.Flags().Bool("estargz", false, "Convert legacy tar(.gz) layers to eStargz for lazy pulling. Should be used in conjunction with '--oci'")
-	imageConvertCommand.Flags().String("estargz-record-in", "", "Read 'ctr-remote optimize --record-out=<FILE>' record file (EXPERIMENTAL)")
-	imageConvertCommand.Flags().Int("estargz-compression-level", gzip.BestCompression, "eStargz compression level")
-	imageConvertCommand.Flags().Int("estargz-chunk-size", 0, "eStargz chunk size")
-	imageConvertCommand.Flags().Int("estargz-min-chunk-size", 0, "The minimal number of bytes of data must be written in one gzip stream. (requires stargz-snapshotter >= v0.13.0)")
-	imageConvertCommand.Flags().Bool("estargz-external-toc", false, "Separate TOC JSON into another image (called \"TOC image\"). The name of TOC image is the original + \"-esgztoc\" suffix. Both eStargz and the TOC image should be pushed to the same registry. (requires stargz-snapshotter >= v0.13.0) (EXPERIMENTAL)")
-	imageConvertCommand.Flags().Bool("estargz-keep-diff-id", false, "Convert to esgz without changing diffID (cannot be used in conjunction with '--estargz-record-in'. must be specified with '--estargz-external-toc')")
+	cmd.Flags().Bool("estargz", false, "Convert legacy tar(.gz) layers to eStargz for lazy pulling. Should be used in conjunction with '--oci'")
+	cmd.Flags().String("estargz-record-in", "", "Read 'ctr-remote optimize --record-out=<FILE>' record file (EXPERIMENTAL)")
+	cmd.Flags().Int("estargz-compression-level", gzip.BestCompression, "eStargz compression level")
+	cmd.Flags().Int("estargz-chunk-size", 0, "eStargz chunk size")
+	cmd.Flags().Int("estargz-min-chunk-size", 0, "The minimal number of bytes of data must be written in one gzip stream. (requires stargz-snapshotter >= v0.13.0)")
+	cmd.Flags().Bool("estargz-external-toc", false, "Separate TOC JSON into another image (called \"TOC image\"). The name of TOC image is the original + \"-esgztoc\" suffix. Both eStargz and the TOC image should be pushed to the same registry. (requires stargz-snapshotter >= v0.13.0) (EXPERIMENTAL)")
+	cmd.Flags().Bool("estargz-keep-diff-id", false, "Convert to esgz without changing diffID (cannot be used in conjunction with '--estargz-record-in'. must be specified with '--estargz-external-toc')")
 	// #endregion
 
 	// #region zstd flags
-	imageConvertCommand.Flags().Bool("zstd", false, "Convert legacy tar(.gz) layers to zstd. Should be used in conjunction with '--oci'")
-	imageConvertCommand.Flags().Int("zstd-compression-level", 3, "zstd compression level")
+	cmd.Flags().Bool("zstd", false, "Convert legacy tar(.gz) layers to zstd. Should be used in conjunction with '--oci'")
+	cmd.Flags().Int("zstd-compression-level", 3, "zstd compression level")
 	// #endregion
 
 	// #region zstd:chunked flags
-	imageConvertCommand.Flags().Bool("zstdchunked", false, "Convert legacy tar(.gz) layers to zstd:chunked for lazy pulling. Should be used in conjunction with '--oci'")
-	imageConvertCommand.Flags().String("zstdchunked-record-in", "", "Read 'ctr-remote optimize --record-out=<FILE>' record file (EXPERIMENTAL)")
-	imageConvertCommand.Flags().Int("zstdchunked-compression-level", 3, "zstd:chunked compression level") // SpeedDefault; see also https://pkg.go.dev/github.com/klauspost/compress/zstd#EncoderLevel
-	imageConvertCommand.Flags().Int("zstdchunked-chunk-size", 0, "zstd:chunked chunk size")
+	cmd.Flags().Bool("zstdchunked", false, "Convert legacy tar(.gz) layers to zstd:chunked for lazy pulling. Should be used in conjunction with '--oci'")
+	cmd.Flags().String("zstdchunked-record-in", "", "Read 'ctr-remote optimize --record-out=<FILE>' record file (EXPERIMENTAL)")
+	cmd.Flags().Int("zstdchunked-compression-level", 3, "zstd:chunked compression level") // SpeedDefault; see also https://pkg.go.dev/github.com/klauspost/compress/zstd#EncoderLevel
+	cmd.Flags().Int("zstdchunked-chunk-size", 0, "zstd:chunked chunk size")
 	// #endregion
 
 	// #region nydus flags
-	imageConvertCommand.Flags().Bool("nydus", false, "Convert an OCI image to Nydus image. Should be used in conjunction with '--oci'")
-	imageConvertCommand.Flags().String("nydus-builder-path", "nydus-image", "The nydus-image binary path, if unset, search in PATH environment")
-	imageConvertCommand.Flags().String("nydus-work-dir", "", "Work directory path for image conversion, default is the nerdctl data root directory")
-	imageConvertCommand.Flags().String("nydus-prefetch-patterns", "", "The file path pattern list want to prefetch")
-	imageConvertCommand.Flags().String("nydus-compressor", "lz4_block", "Nydus blob compression algorithm, possible values: `none`, `lz4_block`, `zstd`, default is `lz4_block`")
+	cmd.Flags().Bool("nydus", false, "Convert an OCI image to Nydus image. Should be used in conjunction with '--oci'")
+	cmd.Flags().String("nydus-builder-path", "nydus-image", "The nydus-image binary path, if unset, search in PATH environment")
+	cmd.Flags().String("nydus-work-dir", "", "Work directory path for image conversion, default is the nerdctl data root directory")
+	cmd.Flags().String("nydus-prefetch-patterns", "", "The file path pattern list want to prefetch")
+	cmd.Flags().String("nydus-compressor", "lz4_block", "Nydus blob compression algorithm, possible values: `none`, `lz4_block`, `zstd`, default is `lz4_block`")
 	// #endregion
 
 	// #region overlaybd flags
-	imageConvertCommand.Flags().Bool("overlaybd", false, "Convert tar.gz layers to overlaybd layers")
-	imageConvertCommand.Flags().String("overlaybd-fs-type", "ext4", "Filesystem type for overlaybd")
-	imageConvertCommand.Flags().String("overlaybd-dbstr", "", "Database config string for overlaybd")
+	cmd.Flags().Bool("overlaybd", false, "Convert tar.gz layers to overlaybd layers")
+	cmd.Flags().String("overlaybd-fs-type", "ext4", "Filesystem type for overlaybd")
+	cmd.Flags().String("overlaybd-dbstr", "", "Database config string for overlaybd")
 	// #endregion
 
 	// #region generic flags
-	imageConvertCommand.Flags().Bool("uncompress", false, "Convert tar.gz layers to uncompressed tar layers")
-	imageConvertCommand.Flags().Bool("oci", false, "Convert Docker media types to OCI media types")
+	cmd.Flags().Bool("uncompress", false, "Convert tar.gz layers to uncompressed tar layers")
+	cmd.Flags().Bool("oci", false, "Convert Docker media types to OCI media types")
 	// #endregion
 
 	// #region platform flags
 	// platform is defined as StringSlice, not StringArray, to allow specifying "--platform=amd64,arm64"
-	imageConvertCommand.Flags().StringSlice("platform", []string{}, "Convert content for a specific platform")
-	imageConvertCommand.RegisterFlagCompletionFunc("platform", completion.Platforms)
-	imageConvertCommand.Flags().Bool("all-platforms", false, "Convert content for all platforms")
+	cmd.Flags().StringSlice("platform", []string{}, "Convert content for a specific platform")
+	cmd.RegisterFlagCompletionFunc("platform", completion.Platforms)
+	cmd.Flags().Bool("all-platforms", false, "Convert content for all platforms")
 	// #endregion
 
-	return imageConvertCommand
+	return cmd
 }
 
 func processImageConvertOptions(cmd *cobra.Command) (types.ImageConvertOptions, error) {
diff --git a/cmd/nerdctl/image/image_history.go b/cmd/nerdctl/image/image_history.go
index d4f4aa9b..8fc8ddac 100644
--- a/cmd/nerdctl/image/image_history.go
+++ b/cmd/nerdctl/image/image_history.go
@@ -44,7 +44,7 @@ import (
 )
 
 func NewHistoryCommand() *cobra.Command {
-	var historyCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "history [flags] IMAGE",
 		Short:             "Show the history of an image",
 		Args:              helpers.IsExactArgs(1),
@@ -53,8 +53,8 @@ func NewHistoryCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	addHistoryFlags(historyCommand)
-	return historyCommand
+	addHistoryFlags(cmd)
+	return cmd
 }
 
 func addHistoryFlags(cmd *cobra.Command) {
diff --git a/cmd/nerdctl/image/image_inspect.go b/cmd/nerdctl/image/image_inspect.go
index fdd6dd2c..84705f4a 100644
--- a/cmd/nerdctl/image/image_inspect.go
+++ b/cmd/nerdctl/image/image_inspect.go
@@ -29,7 +29,7 @@ import (
 )
 
 func newImageInspectCommand() *cobra.Command {
-	imageInspectCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:               "inspect [flags] IMAGE [IMAGE...]",
 		Args:              cobra.MinimumNArgs(1),
 		Short:             "Display detailed information on one or more images.",
@@ -39,21 +39,21 @@ func newImageInspectCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	imageInspectCommand.Flags().String("mode", "dockercompat", `Inspect mode, "dockercompat" for Docker-compatible output, "native" for containerd-native output`)
-	imageInspectCommand.RegisterFlagCompletionFunc("mode", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().String("mode", "dockercompat", `Inspect mode, "dockercompat" for Docker-compatible output, "native" for containerd-native output`)
+	cmd.RegisterFlagCompletionFunc("mode", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"dockercompat", "native"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	imageInspectCommand.Flags().StringP("format", "f", "", "Format the output using the given Go template, e.g, '{{json .}}'")
-	imageInspectCommand.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().StringP("format", "f", "", "Format the output using the given Go template, e.g, '{{json .}}'")
+	cmd.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json"}, cobra.ShellCompDirectiveNoFileComp
 	})
 
 	// #region platform flags
-	imageInspectCommand.Flags().String("platform", "", "Inspect a specific platform") // not a slice, and there is no --all-platforms
-	imageInspectCommand.RegisterFlagCompletionFunc("platform", completion.Platforms)
+	cmd.Flags().String("platform", "", "Inspect a specific platform") // not a slice, and there is no --all-platforms
+	cmd.RegisterFlagCompletionFunc("platform", completion.Platforms)
 	// #endregion
 
-	return imageInspectCommand
+	return cmd
 }
 
 func ProcessImageInspectOptions(cmd *cobra.Command, platform *string) (types.ImageInspectOptions, error) {
diff --git a/cmd/nerdctl/image/image_list.go b/cmd/nerdctl/image/image_list.go
index 06566f47..1b3dd693 100644
--- a/cmd/nerdctl/image/image_list.go
+++ b/cmd/nerdctl/image/image_list.go
@@ -43,7 +43,7 @@ Properties:
 - SIZE:       Size of the unpacked snapshots
 - BLOB SIZE:  Size of the blobs (such as layer tarballs) in the content store
 `
-	var imagesCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:                   "images [flags] [REPOSITORY[:TAG]]",
 		Short:                 shortHelp,
 		Long:                  longHelp,
@@ -55,19 +55,19 @@ Properties:
 		DisableFlagsInUseLine: true,
 	}
 
-	imagesCommand.Flags().BoolP("quiet", "q", false, "Only show numeric IDs")
-	imagesCommand.Flags().Bool("no-trunc", false, "Don't truncate output")
+	cmd.Flags().BoolP("quiet", "q", false, "Only show numeric IDs")
+	cmd.Flags().Bool("no-trunc", false, "Don't truncate output")
 	// Alias "-f" is reserved for "--filter"
-	imagesCommand.Flags().String("format", "", "Format the output using the given Go template, e.g, '{{json .}}', 'wide'")
-	imagesCommand.Flags().StringSliceP("filter", "f", []string{}, "Filter output based on conditions provided")
-	imagesCommand.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().String("format", "", "Format the output using the given Go template, e.g, '{{json .}}', 'wide'")
+	cmd.Flags().StringSliceP("filter", "f", []string{}, "Filter output based on conditions provided")
+	cmd.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json", "table", "wide"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	imagesCommand.Flags().Bool("digests", false, "Show digests (compatible with Docker, unlike ID)")
-	imagesCommand.Flags().Bool("names", false, "Show image names")
-	imagesCommand.Flags().BoolP("all", "a", true, "(unimplemented yet, always true)")
+	cmd.Flags().Bool("digests", false, "Show digests (compatible with Docker, unlike ID)")
+	cmd.Flags().Bool("names", false, "Show image names")
+	cmd.Flags().BoolP("all", "a", true, "(unimplemented yet, always true)")
 
-	return imagesCommand
+	return cmd
 }
 
 func processImageListOptions(cmd *cobra.Command, args []string) (*types.ImageListOptions, error) {
diff --git a/cmd/nerdctl/image/image_load.go b/cmd/nerdctl/image/image_load.go
index 3ff8b18a..3a0e2566 100644
--- a/cmd/nerdctl/image/image_load.go
+++ b/cmd/nerdctl/image/image_load.go
@@ -27,7 +27,7 @@ import (
 )
 
 func NewLoadCommand() *cobra.Command {
-	var loadCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "load",
 		Args:          cobra.NoArgs,
 		Short:         "Load an image from a tar archive or STDIN",
@@ -37,17 +37,17 @@ func NewLoadCommand() *cobra.Command {
 		SilenceErrors: true,
 	}
 
-	loadCommand.Flags().StringP("input", "i", "", "Read from tar archive file, instead of STDIN")
-	loadCommand.Flags().BoolP("quiet", "q", false, "Suppress the load output")
+	cmd.Flags().StringP("input", "i", "", "Read from tar archive file, instead of STDIN")
+	cmd.Flags().BoolP("quiet", "q", false, "Suppress the load output")
 
 	// #region platform flags
 	// platform is defined as StringSlice, not StringArray, to allow specifying "--platform=amd64,arm64"
-	loadCommand.Flags().StringSlice("platform", []string{}, "Import content for a specific platform")
-	loadCommand.RegisterFlagCompletionFunc("platform", completion.Platforms)
-	loadCommand.Flags().Bool("all-platforms", false, "Import content for all platforms")
+	cmd.Flags().StringSlice("platform", []string{}, "Import content for a specific platform")
+	cmd.RegisterFlagCompletionFunc("platform", completion.Platforms)
+	cmd.Flags().Bool("all-platforms", false, "Import content for all platforms")
 	// #endregion
 
-	return loadCommand
+	return cmd
 }
 
 func processLoadCommandFlags(cmd *cobra.Command) (types.ImageLoadOptions, error) {
diff --git a/cmd/nerdctl/image/image_prune.go b/cmd/nerdctl/image/image_prune.go
index 9eefa288..d30438c7 100644
--- a/cmd/nerdctl/image/image_prune.go
+++ b/cmd/nerdctl/image/image_prune.go
@@ -28,7 +28,7 @@ import (
 )
 
 func newImagePruneCommand() *cobra.Command {
-	imagePruneCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:           "prune [flags]",
 		Short:         "Remove unused images",
 		Args:          cobra.NoArgs,
@@ -37,10 +37,10 @@ func newImagePruneCommand() *cobra.Command {
 		SilenceErrors: true,
 	}
 
-	imagePruneCommand.Flags().BoolP("all", "a", false, "Remove all unused images, not just dangling ones")
-	imagePruneCommand.Flags().StringSlice("filter", []string{}, "Filter output based on conditions provided")
-	imagePruneCommand.Flags().BoolP("force", "f", false, "Do not prompt for confirmation")
-	return imagePruneCommand
+	cmd.Flags().BoolP("all", "a", false, "Remove all unused images, not just dangling ones")
+	cmd.Flags().StringSlice("filter", []string{}, "Filter output based on conditions provided")
+	cmd.Flags().BoolP("force", "f", false, "Do not prompt for confirmation")
+	return cmd
 }
 
 func processImagePruneOptions(cmd *cobra.Command) (types.ImagePruneOptions, error) {
diff --git a/cmd/nerdctl/image/image_pull.go b/cmd/nerdctl/image/image_pull.go
index cedef1af..542c3dfb 100644
--- a/cmd/nerdctl/image/image_pull.go
+++ b/cmd/nerdctl/image/image_pull.go
@@ -29,7 +29,7 @@ import (
 )
 
 func NewPullCommand() *cobra.Command {
-	var pullCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "pull [flags] NAME[:TAG]",
 		Short:         "Pull an image from a registry. Optionally specify \"ipfs://\" or \"ipns://\" scheme to pull image from IPFS.",
 		Args:          helpers.IsExactArgs(1),
@@ -37,39 +37,39 @@ func NewPullCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	pullCommand.Flags().String("unpack", "auto", "Unpack the image for the current single platform (auto/true/false)")
-	pullCommand.RegisterFlagCompletionFunc("unpack", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().String("unpack", "auto", "Unpack the image for the current single platform (auto/true/false)")
+	cmd.RegisterFlagCompletionFunc("unpack", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"auto", "true", "false"}, cobra.ShellCompDirectiveNoFileComp
 	})
 
 	// #region platform flags
 	// platform is defined as StringSlice, not StringArray, to allow specifying "--platform=amd64,arm64"
-	pullCommand.Flags().StringSlice("platform", nil, "Pull content for a specific platform")
-	pullCommand.RegisterFlagCompletionFunc("platform", completion.Platforms)
-	pullCommand.Flags().Bool("all-platforms", false, "Pull content for all platforms")
+	cmd.Flags().StringSlice("platform", nil, "Pull content for a specific platform")
+	cmd.RegisterFlagCompletionFunc("platform", completion.Platforms)
+	cmd.Flags().Bool("all-platforms", false, "Pull content for all platforms")
 	// #endregion
 
 	// #region verify flags
-	pullCommand.Flags().String("verify", "none", "Verify the image (none|cosign|notation)")
-	pullCommand.RegisterFlagCompletionFunc("verify", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().String("verify", "none", "Verify the image (none|cosign|notation)")
+	cmd.RegisterFlagCompletionFunc("verify", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"none", "cosign", "notation"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	pullCommand.Flags().String("cosign-key", "", "Path to the public key file, KMS, URI or Kubernetes Secret for --verify=cosign")
-	pullCommand.Flags().String("cosign-certificate-identity", "", "The identity expected in a valid Fulcio certificate for --verify=cosign. Valid values include email address, DNS names, IP addresses, and URIs. Either --cosign-certificate-identity or --cosign-certificate-identity-regexp must be set for keyless flows")
-	pullCommand.Flags().String("cosign-certificate-identity-regexp", "", "A regular expression alternative to --cosign-certificate-identity for --verify=cosign. Accepts the Go regular expression syntax described at https://golang.org/s/re2syntax. Either --cosign-certificate-identity or --cosign-certificate-identity-regexp must be set for keyless flows")
-	pullCommand.Flags().String("cosign-certificate-oidc-issuer", "", "The OIDC issuer expected in a valid Fulcio certificate for --verify=cosign,, e.g. https://token.actions.githubusercontent.com or https://oauth2.sigstore.dev/auth. Either --cosign-certificate-oidc-issuer or --cosign-certificate-oidc-issuer-regexp must be set for keyless flows")
-	pullCommand.Flags().String("cosign-certificate-oidc-issuer-regexp", "", "A regular expression alternative to --certificate-oidc-issuer for --verify=cosign,. Accepts the Go regular expression syntax described at https://golang.org/s/re2syntax. Either --cosign-certificate-oidc-issuer or --cosign-certificate-oidc-issuer-regexp must be set for keyless flows")
+	cmd.Flags().String("cosign-key", "", "Path to the public key file, KMS, URI or Kubernetes Secret for --verify=cosign")
+	cmd.Flags().String("cosign-certificate-identity", "", "The identity expected in a valid Fulcio certificate for --verify=cosign. Valid values include email address, DNS names, IP addresses, and URIs. Either --cosign-certificate-identity or --cosign-certificate-identity-regexp must be set for keyless flows")
+	cmd.Flags().String("cosign-certificate-identity-regexp", "", "A regular expression alternative to --cosign-certificate-identity for --verify=cosign. Accepts the Go regular expression syntax described at https://golang.org/s/re2syntax. Either --cosign-certificate-identity or --cosign-certificate-identity-regexp must be set for keyless flows")
+	cmd.Flags().String("cosign-certificate-oidc-issuer", "", "The OIDC issuer expected in a valid Fulcio certificate for --verify=cosign,, e.g. https://token.actions.githubusercontent.com or https://oauth2.sigstore.dev/auth. Either --cosign-certificate-oidc-issuer or --cosign-certificate-oidc-issuer-regexp must be set for keyless flows")
+	cmd.Flags().String("cosign-certificate-oidc-issuer-regexp", "", "A regular expression alternative to --certificate-oidc-issuer for --verify=cosign,. Accepts the Go regular expression syntax described at https://golang.org/s/re2syntax. Either --cosign-certificate-oidc-issuer or --cosign-certificate-oidc-issuer-regexp must be set for keyless flows")
 	// #endregion
 
 	// #region socipull flags
-	pullCommand.Flags().String("soci-index-digest", "", "Specify a particular index digest for SOCI. If left empty, SOCI will automatically use the index determined by the selection policy.")
+	cmd.Flags().String("soci-index-digest", "", "Specify a particular index digest for SOCI. If left empty, SOCI will automatically use the index determined by the selection policy.")
 	// #endregion
 
-	pullCommand.Flags().BoolP("quiet", "q", false, "Suppress verbose output")
+	cmd.Flags().BoolP("quiet", "q", false, "Suppress verbose output")
 
-	pullCommand.Flags().String("ipfs-address", "", "multiaddr of IPFS API (default uses $IPFS_PATH env variable if defined or local directory ~/.ipfs)")
+	cmd.Flags().String("ipfs-address", "", "multiaddr of IPFS API (default uses $IPFS_PATH env variable if defined or local directory ~/.ipfs)")
 
-	return pullCommand
+	return cmd
 }
 
 func processPullCommandFlags(cmd *cobra.Command) (types.ImagePullOptions, error) {
diff --git a/cmd/nerdctl/image/image_push.go b/cmd/nerdctl/image/image_push.go
index eebadbf7..62999af9 100644
--- a/cmd/nerdctl/image/image_push.go
+++ b/cmd/nerdctl/image/image_push.go
@@ -31,7 +31,7 @@ const (
 )
 
 func NewPushCommand() *cobra.Command {
-	var pushCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "push [flags] NAME[:TAG]",
 		Short:             "Push an image or a repository to a registry. Optionally specify \"ipfs://\" or \"ipns://\" scheme to push image to IPFS.",
 		Args:              helpers.IsExactArgs(1),
@@ -42,34 +42,34 @@ func NewPushCommand() *cobra.Command {
 	}
 	// #region platform flags
 	// platform is defined as StringSlice, not StringArray, to allow specifying "--platform=amd64,arm64"
-	pushCommand.Flags().StringSlice("platform", []string{}, "Push content for a specific platform")
-	pushCommand.RegisterFlagCompletionFunc("platform", completion.Platforms)
-	pushCommand.Flags().Bool("all-platforms", false, "Push content for all platforms")
+	cmd.Flags().StringSlice("platform", []string{}, "Push content for a specific platform")
+	cmd.RegisterFlagCompletionFunc("platform", completion.Platforms)
+	cmd.Flags().Bool("all-platforms", false, "Push content for all platforms")
 	// #endregion
 
-	pushCommand.Flags().Bool("estargz", false, "Convert the image into eStargz")
-	pushCommand.Flags().Bool("ipfs-ensure-image", true, "Ensure the entire contents of the image is locally available before push")
-	pushCommand.Flags().String("ipfs-address", "", "multiaddr of IPFS API (default uses $IPFS_PATH env variable if defined or local directory ~/.ipfs)")
+	cmd.Flags().Bool("estargz", false, "Convert the image into eStargz")
+	cmd.Flags().Bool("ipfs-ensure-image", true, "Ensure the entire contents of the image is locally available before push")
+	cmd.Flags().String("ipfs-address", "", "multiaddr of IPFS API (default uses $IPFS_PATH env variable if defined or local directory ~/.ipfs)")
 
 	// #region sign flags
-	pushCommand.Flags().String("sign", "none", "Sign the image (none|cosign|notation")
-	pushCommand.RegisterFlagCompletionFunc("sign", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().String("sign", "none", "Sign the image (none|cosign|notation")
+	cmd.RegisterFlagCompletionFunc("sign", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"none", "cosign", "notation"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	pushCommand.Flags().String("cosign-key", "", "Path to the private key file, KMS URI or Kubernetes Secret for --sign=cosign")
-	pushCommand.Flags().String("notation-key-name", "", "Signing key name for a key previously added to notation's key list for --sign=notation")
+	cmd.Flags().String("cosign-key", "", "Path to the private key file, KMS URI or Kubernetes Secret for --sign=cosign")
+	cmd.Flags().String("notation-key-name", "", "Signing key name for a key previously added to notation's key list for --sign=notation")
 	// #endregion
 
 	// #region soci flags
-	pushCommand.Flags().Int64("soci-span-size", -1, "Span size that soci index uses to segment layer data. Default is 4 MiB.")
-	pushCommand.Flags().Int64("soci-min-layer-size", -1, "Minimum layer size to build zTOC for. Smaller layers won't have zTOC and not lazy pulled. Default is 10 MiB.")
+	cmd.Flags().Int64("soci-span-size", -1, "Span size that soci index uses to segment layer data. Default is 4 MiB.")
+	cmd.Flags().Int64("soci-min-layer-size", -1, "Minimum layer size to build zTOC for. Smaller layers won't have zTOC and not lazy pulled. Default is 10 MiB.")
 	// #endregion
 
-	pushCommand.Flags().BoolP("quiet", "q", false, "Suppress verbose output")
+	cmd.Flags().BoolP("quiet", "q", false, "Suppress verbose output")
 
-	pushCommand.Flags().Bool(allowNonDistFlag, false, "Allow pushing images with non-distributable blobs")
+	cmd.Flags().Bool(allowNonDistFlag, false, "Allow pushing images with non-distributable blobs")
 
-	return pushCommand
+	return cmd
 }
 
 func processImagePushOptions(cmd *cobra.Command) (types.ImagePushOptions, error) {
diff --git a/cmd/nerdctl/image/image_remove.go b/cmd/nerdctl/image/image_remove.go
index cb9a86c3..84753d17 100644
--- a/cmd/nerdctl/image/image_remove.go
+++ b/cmd/nerdctl/image/image_remove.go
@@ -27,7 +27,7 @@ import (
 )
 
 func NewRmiCommand() *cobra.Command {
-	var rmiCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "rmi [flags] IMAGE [IMAGE, ...]",
 		Short:             "Remove one or more images",
 		Args:              cobra.MinimumNArgs(1),
@@ -36,10 +36,10 @@ func NewRmiCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	rmiCommand.Flags().BoolP("force", "f", false, "Force removal of the image")
+	cmd.Flags().BoolP("force", "f", false, "Force removal of the image")
 	// Alias `-a` is reserved for `--all`. Should be compatible with `podman rmi --all`.
-	rmiCommand.Flags().Bool("async", false, "Asynchronous mode")
-	return rmiCommand
+	cmd.Flags().Bool("async", false, "Asynchronous mode")
+	return cmd
 }
 
 func processImageRemoveOptions(cmd *cobra.Command) (types.ImageRemoveOptions, error) {
diff --git a/cmd/nerdctl/image/image_save.go b/cmd/nerdctl/image/image_save.go
index 8c2ce38d..880406ad 100644
--- a/cmd/nerdctl/image/image_save.go
+++ b/cmd/nerdctl/image/image_save.go
@@ -31,7 +31,7 @@ import (
 )
 
 func NewSaveCommand() *cobra.Command {
-	var saveCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "save",
 		Args:              cobra.MinimumNArgs(1),
 		Short:             "Save one or more images to a tar archive (streamed to STDOUT by default)",
@@ -41,16 +41,16 @@ func NewSaveCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	saveCommand.Flags().StringP("output", "o", "", "Write to a file, instead of STDOUT")
+	cmd.Flags().StringP("output", "o", "", "Write to a file, instead of STDOUT")
 
 	// #region platform flags
 	// platform is defined as StringSlice, not StringArray, to allow specifying "--platform=amd64,arm64"
-	saveCommand.Flags().StringSlice("platform", []string{}, "Export content for a specific platform")
-	saveCommand.RegisterFlagCompletionFunc("platform", completion.Platforms)
-	saveCommand.Flags().Bool("all-platforms", false, "Export content for all platforms")
+	cmd.Flags().StringSlice("platform", []string{}, "Export content for a specific platform")
+	cmd.RegisterFlagCompletionFunc("platform", completion.Platforms)
+	cmd.Flags().Bool("all-platforms", false, "Export content for all platforms")
 	// #endregion
 
-	return saveCommand
+	return cmd
 }
 
 func processImageSaveOptions(cmd *cobra.Command) (types.ImageSaveOptions, error) {
diff --git a/cmd/nerdctl/image/image_tag.go b/cmd/nerdctl/image/image_tag.go
index 4e3d5b96..5fd8b3f7 100644
--- a/cmd/nerdctl/image/image_tag.go
+++ b/cmd/nerdctl/image/image_tag.go
@@ -27,7 +27,7 @@ import (
 )
 
 func NewTagCommand() *cobra.Command {
-	var tagCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "tag [flags] SOURCE_IMAGE[:TAG] TARGET_IMAGE[:TAG]",
 		Short:             "Create a tag TARGET_IMAGE that refers to SOURCE_IMAGE",
 		Args:              helpers.IsExactArgs(2),
@@ -36,7 +36,7 @@ func NewTagCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	return tagCommand
+	return cmd
 }
 
 func tagAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/inspect/inspect.go b/cmd/nerdctl/inspect/inspect.go
index a91624b2..76febcd6 100644
--- a/cmd/nerdctl/inspect/inspect.go
+++ b/cmd/nerdctl/inspect/inspect.go
@@ -35,7 +35,7 @@ import (
 )
 
 func NewInspectCommand() *cobra.Command {
-	var inspectCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:               "inspect",
 		Short:             "Return low-level information on objects.",
 		Args:              cobra.MinimumNArgs(1),
@@ -45,9 +45,9 @@ func NewInspectCommand() *cobra.Command {
 		SilenceErrors:     true,
 	}
 
-	addInspectFlags(inspectCommand)
+	addInspectFlags(cmd)
 
-	return inspectCommand
+	return cmd
 }
 
 var validInspectType = map[string]bool{
diff --git a/cmd/nerdctl/internal/internal.go b/cmd/nerdctl/internal/internal.go
index c1594528..b19b2f36 100644
--- a/cmd/nerdctl/internal/internal.go
+++ b/cmd/nerdctl/internal/internal.go
@@ -21,7 +21,7 @@ import (
 )
 
 func NewInternalCommand() *cobra.Command {
-	var internalCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "internal",
 		Short:         "DO NOT EXECUTE MANUALLY",
 		Hidden:        true,
@@ -29,9 +29,9 @@ func NewInternalCommand() *cobra.Command {
 		SilenceErrors: true,
 	}
 
-	internalCommand.AddCommand(
+	cmd.AddCommand(
 		newInternalOCIHookCommandCommand(),
 	)
 
-	return internalCommand
+	return cmd
 }
diff --git a/cmd/nerdctl/internal/internal_oci_hook.go b/cmd/nerdctl/internal/internal_oci_hook.go
index 31c8e5b9..973730ff 100644
--- a/cmd/nerdctl/internal/internal_oci_hook.go
+++ b/cmd/nerdctl/internal/internal_oci_hook.go
@@ -28,14 +28,14 @@ import (
 )
 
 func newInternalOCIHookCommandCommand() *cobra.Command {
-	var internalOCIHookCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "oci-hook",
 		Short:         "OCI hook",
 		RunE:          internalOCIHookAction,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	return internalOCIHookCommand
+	return cmd
 }
 
 func internalOCIHookAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/ipfs/ipfs_registry_serve.go b/cmd/nerdctl/ipfs/ipfs_registry_serve.go
index 739d3d3e..2d748c25 100644
--- a/cmd/nerdctl/ipfs/ipfs_registry_serve.go
+++ b/cmd/nerdctl/ipfs/ipfs_registry_serve.go
@@ -31,7 +31,7 @@ const (
 )
 
 func newIPFSRegistryServeCommand() *cobra.Command {
-	var ipfsRegistryServeCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "serve",
 		Short:         "serve read-only registry backed by IPFS on localhost.",
 		RunE:          ipfsRegistryServeAction,
@@ -39,12 +39,12 @@ func newIPFSRegistryServeCommand() *cobra.Command {
 		SilenceErrors: true,
 	}
 
-	helpers.AddStringFlag(ipfsRegistryServeCommand, "listen-registry", nil, defaultIPFSRegistry, "IPFS_REGISTRY_SERVE_LISTEN_REGISTRY", "address to listen")
-	helpers.AddStringFlag(ipfsRegistryServeCommand, "ipfs-address", nil, "", "IPFS_REGISTRY_SERVE_IPFS_ADDRESS", "multiaddr of IPFS API (default is pulled from $IPFS_PATH/api file. If $IPFS_PATH env var is not present, it defaults to ~/.ipfs)")
-	helpers.AddIntFlag(ipfsRegistryServeCommand, "read-retry-num", nil, defaultIPFSReadRetryNum, "IPFS_REGISTRY_SERVE_READ_RETRY_NUM", "times to retry query on IPFS. Zero or lower means no retry.")
-	helpers.AddDurationFlag(ipfsRegistryServeCommand, "read-timeout", nil, defaultIPFSReadTimeoutDuration, "IPFS_REGISTRY_SERVE_READ_TIMEOUT", "timeout duration of a read request to IPFS. Zero means no timeout.")
+	helpers.AddStringFlag(cmd, "listen-registry", nil, defaultIPFSRegistry, "IPFS_REGISTRY_SERVE_LISTEN_REGISTRY", "address to listen")
+	helpers.AddStringFlag(cmd, "ipfs-address", nil, "", "IPFS_REGISTRY_SERVE_IPFS_ADDRESS", "multiaddr of IPFS API (default is pulled from $IPFS_PATH/api file. If $IPFS_PATH env var is not present, it defaults to ~/.ipfs)")
+	helpers.AddIntFlag(cmd, "read-retry-num", nil, defaultIPFSReadRetryNum, "IPFS_REGISTRY_SERVE_READ_RETRY_NUM", "times to retry query on IPFS. Zero or lower means no retry.")
+	helpers.AddDurationFlag(cmd, "read-timeout", nil, defaultIPFSReadTimeoutDuration, "IPFS_REGISTRY_SERVE_READ_TIMEOUT", "timeout duration of a read request to IPFS. Zero means no timeout.")
 
-	return ipfsRegistryServeCommand
+	return cmd
 }
 
 func processIPFSRegistryServeOptions(cmd *cobra.Command) (opts types.IPFSRegistryServeOptions, err error) {
diff --git a/cmd/nerdctl/login/login.go b/cmd/nerdctl/login/login.go
index 64dc5f4b..374ac958 100644
--- a/cmd/nerdctl/login/login.go
+++ b/cmd/nerdctl/login/login.go
@@ -31,7 +31,7 @@ import (
 )
 
 func NewLoginCommand() *cobra.Command {
-	var loginCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "login [flags] [SERVER]",
 		Args:          cobra.MaximumNArgs(1),
 		Short:         "Log in to a container registry",
@@ -39,10 +39,10 @@ func NewLoginCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	loginCommand.Flags().StringP("username", "u", "", "Username")
-	loginCommand.Flags().StringP("password", "p", "", "Password")
-	loginCommand.Flags().Bool("password-stdin", false, "Take the password from stdin")
-	return loginCommand
+	cmd.Flags().StringP("username", "u", "", "Username")
+	cmd.Flags().StringP("password", "p", "", "Password")
+	cmd.Flags().Bool("password-stdin", false, "Take the password from stdin")
+	return cmd
 }
 
 func processLoginOptions(cmd *cobra.Command) (types.LoginCommandOptions, error) {
diff --git a/cmd/nerdctl/namespace/namespace.go b/cmd/nerdctl/namespace/namespace.go
index 6885619d..a51d5a2c 100644
--- a/cmd/nerdctl/namespace/namespace.go
+++ b/cmd/nerdctl/namespace/namespace.go
@@ -33,7 +33,7 @@ import (
 )
 
 func NewNamespaceCommand() *cobra.Command {
-	namespaceCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Annotations:   map[string]string{helpers.Category: helpers.Management},
 		Use:           "namespace",
 		Aliases:       []string{"ns"},
@@ -43,16 +43,16 @@ func NewNamespaceCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	namespaceCommand.AddCommand(newNamespaceLsCommand())
-	namespaceCommand.AddCommand(newNamespaceRmCommand())
-	namespaceCommand.AddCommand(newNamespaceCreateCommand())
-	namespaceCommand.AddCommand(newNamespacelabelUpdateCommand())
-	namespaceCommand.AddCommand(newNamespaceInspectCommand())
-	return namespaceCommand
+	cmd.AddCommand(newNamespaceLsCommand())
+	cmd.AddCommand(newNamespaceRmCommand())
+	cmd.AddCommand(newNamespaceCreateCommand())
+	cmd.AddCommand(newNamespacelabelUpdateCommand())
+	cmd.AddCommand(newNamespaceInspectCommand())
+	return cmd
 }
 
 func newNamespaceLsCommand() *cobra.Command {
-	namespaceLsCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:           "ls",
 		Aliases:       []string{"list"},
 		Short:         "List containerd namespaces",
@@ -60,8 +60,8 @@ func newNamespaceLsCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	namespaceLsCommand.Flags().BoolP("quiet", "q", false, "Only display names")
-	return namespaceLsCommand
+	cmd.Flags().BoolP("quiet", "q", false, "Only display names")
+	return cmd
 }
 
 func namespaceLsAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/namespace/namespace_create.go b/cmd/nerdctl/namespace/namespace_create.go
index 4c6e5131..264c005a 100644
--- a/cmd/nerdctl/namespace/namespace_create.go
+++ b/cmd/nerdctl/namespace/namespace_create.go
@@ -26,7 +26,7 @@ import (
 )
 
 func newNamespaceCreateCommand() *cobra.Command {
-	namespaceCreateCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:           "create NAMESPACE",
 		Short:         "Create a new namespace",
 		Args:          cobra.MinimumNArgs(1),
@@ -35,8 +35,8 @@ func newNamespaceCreateCommand() *cobra.Command {
 		SilenceErrors: true,
 	}
 
-	namespaceCreateCommand.Flags().StringArrayP("label", "l", nil, "Set labels for a namespace")
-	return namespaceCreateCommand
+	cmd.Flags().StringArrayP("label", "l", nil, "Set labels for a namespace")
+	return cmd
 }
 
 func processNamespaceCreateCommandOption(cmd *cobra.Command) (types.NamespaceCreateOptions, error) {
diff --git a/cmd/nerdctl/namespace/namespace_inspect.go b/cmd/nerdctl/namespace/namespace_inspect.go
index cd3a5ff9..a201ad0c 100644
--- a/cmd/nerdctl/namespace/namespace_inspect.go
+++ b/cmd/nerdctl/namespace/namespace_inspect.go
@@ -26,7 +26,7 @@ import (
 )
 
 func newNamespaceInspectCommand() *cobra.Command {
-	namespaceInspectCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:           "inspect NAMESPACE",
 		Short:         "Display detailed information on one or more namespaces.",
 		RunE:          labelInspectAction,
@@ -34,11 +34,11 @@ func newNamespaceInspectCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	namespaceInspectCommand.Flags().StringP("format", "f", "", "Format the output using the given Go template, e.g, '{{json .}}'")
-	namespaceInspectCommand.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().StringP("format", "f", "", "Format the output using the given Go template, e.g, '{{json .}}'")
+	cmd.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	return namespaceInspectCommand
+	return cmd
 }
 
 func processNamespaceInspectOptions(cmd *cobra.Command) (types.NamespaceInspectOptions, error) {
diff --git a/cmd/nerdctl/namespace/namespace_remove.go b/cmd/nerdctl/namespace/namespace_remove.go
index b665736b..deb62bc1 100644
--- a/cmd/nerdctl/namespace/namespace_remove.go
+++ b/cmd/nerdctl/namespace/namespace_remove.go
@@ -26,7 +26,7 @@ import (
 )
 
 func newNamespaceRmCommand() *cobra.Command {
-	namespaceRmCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:           "remove [flags] NAMESPACE [NAMESPACE...]",
 		Aliases:       []string{"rm"},
 		Args:          cobra.MinimumNArgs(1),
@@ -35,8 +35,8 @@ func newNamespaceRmCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	namespaceRmCommand.Flags().BoolP("cgroup", "c", false, "delete the namespace's cgroup")
-	return namespaceRmCommand
+	cmd.Flags().BoolP("cgroup", "c", false, "delete the namespace's cgroup")
+	return cmd
 }
 
 func processNamespaceRemoveOptions(cmd *cobra.Command) (types.NamespaceRemoveOptions, error) {
diff --git a/cmd/nerdctl/namespace/namespace_update.go b/cmd/nerdctl/namespace/namespace_update.go
index b390dc26..fc48d84e 100644
--- a/cmd/nerdctl/namespace/namespace_update.go
+++ b/cmd/nerdctl/namespace/namespace_update.go
@@ -26,7 +26,7 @@ import (
 )
 
 func newNamespacelabelUpdateCommand() *cobra.Command {
-	namespaceLableCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:           "update [flags] NAMESPACE",
 		Short:         "Update labels for a namespace",
 		RunE:          labelUpdateAction,
@@ -34,8 +34,8 @@ func newNamespacelabelUpdateCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	namespaceLableCommand.Flags().StringArrayP("label", "l", nil, "Set labels for a namespace")
-	return namespaceLableCommand
+	cmd.Flags().StringArrayP("label", "l", nil, "Set labels for a namespace")
+	return cmd
 }
 
 func processNamespaceUpdateCommandOption(cmd *cobra.Command) (types.NamespaceUpdateOptions, error) {
diff --git a/cmd/nerdctl/network/network.go b/cmd/nerdctl/network/network.go
index b953135c..655f5b0e 100644
--- a/cmd/nerdctl/network/network.go
+++ b/cmd/nerdctl/network/network.go
@@ -23,7 +23,7 @@ import (
 )
 
 func NewNetworkCommand() *cobra.Command {
-	networkCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Annotations:   map[string]string{helpers.Category: helpers.Management},
 		Use:           "network",
 		Short:         "Manage networks",
@@ -31,12 +31,12 @@ func NewNetworkCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	networkCommand.AddCommand(
+	cmd.AddCommand(
 		newNetworkLsCommand(),
 		newNetworkInspectCommand(),
 		newNetworkCreateCommand(),
 		newNetworkRmCommand(),
 		newNetworkPruneCommand(),
 	)
-	return networkCommand
+	return cmd
 }
diff --git a/cmd/nerdctl/network/network_create.go b/cmd/nerdctl/network/network_create.go
index 1b996d27..d0c39afe 100644
--- a/cmd/nerdctl/network/network_create.go
+++ b/cmd/nerdctl/network/network_create.go
@@ -30,7 +30,7 @@ import (
 )
 
 func newNetworkCreateCommand() *cobra.Command {
-	var networkCreateCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "create [flags] NETWORK",
 		Short:         "Create a network",
 		Long:          `NOTE: To isolate CNI bridge, CNI plugin "firewall" (>= v1.1.0) is needed.`,
@@ -39,18 +39,18 @@ func newNetworkCreateCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	networkCreateCommand.Flags().StringP("driver", "d", DefaultNetworkDriver, "Driver to manage the Network")
-	networkCreateCommand.RegisterFlagCompletionFunc("driver", completion.NetworkDrivers)
-	networkCreateCommand.Flags().StringArrayP("opt", "o", nil, "Set driver specific options")
-	networkCreateCommand.Flags().String("ipam-driver", "default", "IP Address helpers.Management Driver")
-	networkCreateCommand.RegisterFlagCompletionFunc("ipam-driver", completion.IPAMDrivers)
-	networkCreateCommand.Flags().StringArray("ipam-opt", nil, "Set IPAM driver specific options")
-	networkCreateCommand.Flags().StringArray("subnet", nil, `Subnet in CIDR format that represents a network segment, e.g. "10.5.0.0/16"`)
-	networkCreateCommand.Flags().String("gateway", "", `Gateway for the master subnet`)
-	networkCreateCommand.Flags().String("ip-range", "", `Allocate container ip from a sub-range`)
-	networkCreateCommand.Flags().StringArray("label", nil, "Set metadata for a network")
-	networkCreateCommand.Flags().Bool("ipv6", false, "Enable IPv6 networking")
-	return networkCreateCommand
+	cmd.Flags().StringP("driver", "d", DefaultNetworkDriver, "Driver to manage the Network")
+	cmd.RegisterFlagCompletionFunc("driver", completion.NetworkDrivers)
+	cmd.Flags().StringArrayP("opt", "o", nil, "Set driver specific options")
+	cmd.Flags().String("ipam-driver", "default", "IP Address helpers.Management Driver")
+	cmd.RegisterFlagCompletionFunc("ipam-driver", completion.IPAMDrivers)
+	cmd.Flags().StringArray("ipam-opt", nil, "Set IPAM driver specific options")
+	cmd.Flags().StringArray("subnet", nil, `Subnet in CIDR format that represents a network segment, e.g. "10.5.0.0/16"`)
+	cmd.Flags().String("gateway", "", `Gateway for the master subnet`)
+	cmd.Flags().String("ip-range", "", `Allocate container ip from a sub-range`)
+	cmd.Flags().StringArray("label", nil, "Set metadata for a network")
+	cmd.Flags().Bool("ipv6", false, "Enable IPv6 networking")
+	return cmd
 }
 
 func networkCreateAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/network/network_inspect.go b/cmd/nerdctl/network/network_inspect.go
index 6a0c0a6b..fe3010cd 100644
--- a/cmd/nerdctl/network/network_inspect.go
+++ b/cmd/nerdctl/network/network_inspect.go
@@ -26,7 +26,7 @@ import (
 )
 
 func newNetworkInspectCommand() *cobra.Command {
-	networkInspectCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:               "inspect [flags] NETWORK [NETWORK, ...]",
 		Short:             "Display detailed information on one or more networks",
 		Args:              cobra.MinimumNArgs(1),
@@ -35,15 +35,15 @@ func newNetworkInspectCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	networkInspectCommand.Flags().String("mode", "dockercompat", `Inspect mode, "dockercompat" for Docker-compatible output, "native" for containerd-native output`)
-	networkInspectCommand.RegisterFlagCompletionFunc("mode", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().String("mode", "dockercompat", `Inspect mode, "dockercompat" for Docker-compatible output, "native" for containerd-native output`)
+	cmd.RegisterFlagCompletionFunc("mode", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"dockercompat", "native"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	networkInspectCommand.Flags().StringP("format", "f", "", "Format the output using the given Go template, e.g, '{{json .}}'")
-	networkInspectCommand.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().StringP("format", "f", "", "Format the output using the given Go template, e.g, '{{json .}}'")
+	cmd.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	return networkInspectCommand
+	return cmd
 }
 
 func networkInspectAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/network/network_prune.go b/cmd/nerdctl/network/network_prune.go
index f9114fe6..0edccda7 100644
--- a/cmd/nerdctl/network/network_prune.go
+++ b/cmd/nerdctl/network/network_prune.go
@@ -31,7 +31,7 @@ import (
 var NetworkDriversToKeep = []string{"host", "none", DefaultNetworkDriver}
 
 func newNetworkPruneCommand() *cobra.Command {
-	networkPruneCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:           "prune [flags]",
 		Short:         "Remove all unused networks",
 		Args:          cobra.NoArgs,
@@ -39,8 +39,8 @@ func newNetworkPruneCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	networkPruneCommand.Flags().BoolP("force", "f", false, "Do not prompt for confirmation")
-	return networkPruneCommand
+	cmd.Flags().BoolP("force", "f", false, "Do not prompt for confirmation")
+	return cmd
 }
 
 func networkPruneAction(cmd *cobra.Command, _ []string) error {
diff --git a/cmd/nerdctl/network/network_remove.go b/cmd/nerdctl/network/network_remove.go
index 90790897..9db93888 100644
--- a/cmd/nerdctl/network/network_remove.go
+++ b/cmd/nerdctl/network/network_remove.go
@@ -28,7 +28,7 @@ import (
 )
 
 func newNetworkRmCommand() *cobra.Command {
-	networkRmCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:               "rm [flags] NETWORK [NETWORK, ...]",
 		Aliases:           []string{"remove"},
 		Short:             "Remove one or more networks",
@@ -39,7 +39,7 @@ func newNetworkRmCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	return networkRmCommand
+	return cmd
 }
 
 func networkRmAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/system/system.go b/cmd/nerdctl/system/system.go
index f4a41aba..985594d4 100644
--- a/cmd/nerdctl/system/system.go
+++ b/cmd/nerdctl/system/system.go
@@ -23,7 +23,7 @@ import (
 )
 
 func NewSystemCommand() *cobra.Command {
-	var systemCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Annotations:   map[string]string{helpers.Category: helpers.Management},
 		Use:           "system",
 		Short:         "Manage containerd",
@@ -32,10 +32,10 @@ func NewSystemCommand() *cobra.Command {
 		SilenceErrors: true,
 	}
 	// versionCommand is not here
-	systemCommand.AddCommand(
+	cmd.AddCommand(
 		NewEventsCommand(),
 		NewInfoCommand(),
 		newSystemPruneCommand(),
 	)
-	return systemCommand
+	return cmd
 }
diff --git a/cmd/nerdctl/system/system_events.go b/cmd/nerdctl/system/system_events.go
index 69832df3..368ed016 100644
--- a/cmd/nerdctl/system/system_events.go
+++ b/cmd/nerdctl/system/system_events.go
@@ -28,7 +28,7 @@ import (
 func NewEventsCommand() *cobra.Command {
 	shortHelp := `Get real time events from the server`
 	longHelp := shortHelp + "\nNOTE: The output format is not compatible with Docker."
-	var eventsCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "events",
 		Args:          cobra.NoArgs,
 		Short:         shortHelp,
@@ -37,12 +37,12 @@ func NewEventsCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	eventsCommand.Flags().String("format", "", "Format the output using the given Go template, e.g, '{{json .}}'")
-	eventsCommand.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().String("format", "", "Format the output using the given Go template, e.g, '{{json .}}'")
+	cmd.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	eventsCommand.Flags().StringSliceP("filter", "f", []string{}, "Filter matches containers based on given conditions")
-	return eventsCommand
+	cmd.Flags().StringSliceP("filter", "f", []string{}, "Filter matches containers based on given conditions")
+	return cmd
 }
 
 func processSystemEventsOptions(cmd *cobra.Command) (types.SystemEventsOptions, error) {
diff --git a/cmd/nerdctl/system/system_info.go b/cmd/nerdctl/system/system_info.go
index 10eeed9c..fa012077 100644
--- a/cmd/nerdctl/system/system_info.go
+++ b/cmd/nerdctl/system/system_info.go
@@ -26,7 +26,7 @@ import (
 )
 
 func NewInfoCommand() *cobra.Command {
-	var infoCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "info",
 		Args:          cobra.NoArgs,
 		Short:         "Display system-wide information",
@@ -34,15 +34,15 @@ func NewInfoCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	infoCommand.Flags().String("mode", "dockercompat", `Information mode, "dockercompat" for Docker-compatible output, "native" for containerd-native output`)
-	infoCommand.RegisterFlagCompletionFunc("mode", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().String("mode", "dockercompat", `Information mode, "dockercompat" for Docker-compatible output, "native" for containerd-native output`)
+	cmd.RegisterFlagCompletionFunc("mode", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"dockercompat", "native"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	infoCommand.Flags().StringP("format", "f", "", "Format the output using the given Go template, e.g, '{{json .}}'")
-	infoCommand.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().StringP("format", "f", "", "Format the output using the given Go template, e.g, '{{json .}}'")
+	cmd.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	return infoCommand
+	return cmd
 }
 
 func processInfoOptions(cmd *cobra.Command) (types.SystemInfoOptions, error) {
diff --git a/cmd/nerdctl/system/system_prune.go b/cmd/nerdctl/system/system_prune.go
index 29a43cb1..2c3859ed 100644
--- a/cmd/nerdctl/system/system_prune.go
+++ b/cmd/nerdctl/system/system_prune.go
@@ -33,7 +33,7 @@ import (
 )
 
 func newSystemPruneCommand() *cobra.Command {
-	systemPruneCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:           "prune [flags]",
 		Short:         "Remove unused data",
 		Args:          cobra.NoArgs,
@@ -41,10 +41,10 @@ func newSystemPruneCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	systemPruneCommand.Flags().BoolP("all", "a", false, "Remove all unused images, not just dangling ones")
-	systemPruneCommand.Flags().BoolP("force", "f", false, "Do not prompt for confirmation")
-	systemPruneCommand.Flags().Bool("volumes", false, "Prune volumes")
-	return systemPruneCommand
+	cmd.Flags().BoolP("all", "a", false, "Remove all unused images, not just dangling ones")
+	cmd.Flags().BoolP("force", "f", false, "Do not prompt for confirmation")
+	cmd.Flags().Bool("volumes", false, "Prune volumes")
+	return cmd
 }
 
 func processSystemPruneOptions(cmd *cobra.Command) (types.SystemPruneOptions, error) {
diff --git a/cmd/nerdctl/version.go b/cmd/nerdctl/version.go
index 627c8b19..b08f5976 100644
--- a/cmd/nerdctl/version.go
+++ b/cmd/nerdctl/version.go
@@ -36,7 +36,7 @@ import (
 )
 
 func newVersionCommand() *cobra.Command {
-	var versionCommand = &cobra.Command{
+	var cmd = &cobra.Command{
 		Use:           "version",
 		Args:          cobra.NoArgs,
 		Short:         "Show the nerdctl version information",
@@ -44,11 +44,11 @@ func newVersionCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	versionCommand.Flags().StringP("format", "f", "", "Format the output using the given Go template, e.g, '{{json .}}'")
-	versionCommand.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().StringP("format", "f", "", "Format the output using the given Go template, e.g, '{{json .}}'")
+	cmd.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	return versionCommand
+	return cmd
 }
 
 func versionAction(cmd *cobra.Command, args []string) error {
diff --git a/cmd/nerdctl/volume/volume.go b/cmd/nerdctl/volume/volume.go
index 35299309..b8fb896a 100644
--- a/cmd/nerdctl/volume/volume.go
+++ b/cmd/nerdctl/volume/volume.go
@@ -23,7 +23,7 @@ import (
 )
 
 func NewVolumeCommand() *cobra.Command {
-	volumeCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Annotations:   map[string]string{helpers.Category: helpers.Management},
 		Use:           "volume",
 		Short:         "Manage volumes",
@@ -31,12 +31,12 @@ func NewVolumeCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	volumeCommand.AddCommand(
+	cmd.AddCommand(
 		newVolumeLsCommand(),
 		newVolumeInspectCommand(),
 		newVolumeCreateCommand(),
 		newVolumeRmCommand(),
 		newVolumePruneCommand(),
 	)
-	return volumeCommand
+	return cmd
 }
diff --git a/cmd/nerdctl/volume/volume_create.go b/cmd/nerdctl/volume/volume_create.go
index 6927c4a5..8df0daef 100644
--- a/cmd/nerdctl/volume/volume_create.go
+++ b/cmd/nerdctl/volume/volume_create.go
@@ -29,7 +29,7 @@ import (
 )
 
 func newVolumeCreateCommand() *cobra.Command {
-	volumeCreateCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:           "create [flags] [VOLUME]",
 		Short:         "Create a volume",
 		Args:          cobra.MaximumNArgs(1),
@@ -37,8 +37,8 @@ func newVolumeCreateCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	volumeCreateCommand.Flags().StringArray("label", nil, "Set a label on the volume")
-	return volumeCreateCommand
+	cmd.Flags().StringArray("label", nil, "Set a label on the volume")
+	return cmd
 }
 
 func processVolumeCreateOptions(cmd *cobra.Command) (types.VolumeCreateOptions, error) {
diff --git a/cmd/nerdctl/volume/volume_inspect.go b/cmd/nerdctl/volume/volume_inspect.go
index 422df57a..a3937196 100644
--- a/cmd/nerdctl/volume/volume_inspect.go
+++ b/cmd/nerdctl/volume/volume_inspect.go
@@ -26,7 +26,7 @@ import (
 )
 
 func newVolumeInspectCommand() *cobra.Command {
-	volumeInspectCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:               "inspect [flags] VOLUME [VOLUME...]",
 		Short:             "Display detailed information on one or more volumes",
 		Args:              cobra.MinimumNArgs(1),
@@ -35,12 +35,12 @@ func newVolumeInspectCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	volumeInspectCommand.Flags().StringP("format", "f", "", "Format the output using the given Go template, e.g, '{{json .}}'")
-	volumeInspectCommand.Flags().BoolP("size", "s", false, "Display the disk usage of the volume")
-	volumeInspectCommand.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().StringP("format", "f", "", "Format the output using the given Go template, e.g, '{{json .}}'")
+	cmd.Flags().BoolP("size", "s", false, "Display the disk usage of the volume")
+	cmd.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	return volumeInspectCommand
+	return cmd
 }
 
 func processVolumeInspectOptions(cmd *cobra.Command) (types.VolumeInspectOptions, error) {
diff --git a/cmd/nerdctl/volume/volume_list.go b/cmd/nerdctl/volume/volume_list.go
index 891a626a..f2f32bcf 100644
--- a/cmd/nerdctl/volume/volume_list.go
+++ b/cmd/nerdctl/volume/volume_list.go
@@ -25,7 +25,7 @@ import (
 )
 
 func newVolumeLsCommand() *cobra.Command {
-	volumeLsCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:           "ls",
 		Aliases:       []string{"list"},
 		Short:         "List volumes",
@@ -34,15 +34,15 @@ func newVolumeLsCommand() *cobra.Command {
 		SilenceErrors: true,
 	}
 
-	volumeLsCommand.Flags().BoolP("quiet", "q", false, "Only display volume names")
+	cmd.Flags().BoolP("quiet", "q", false, "Only display volume names")
 	// Alias "-f" is reserved for "--filter"
-	volumeLsCommand.Flags().String("format", "", "Format the output using the given go template")
-	volumeLsCommand.Flags().BoolP("size", "s", false, "Display the disk usage of volumes. Can be slow with volumes having loads of directories.")
-	volumeLsCommand.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cmd.Flags().String("format", "", "Format the output using the given go template")
+	cmd.Flags().BoolP("size", "s", false, "Display the disk usage of volumes. Can be slow with volumes having loads of directories.")
+	cmd.RegisterFlagCompletionFunc("format", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json", "table", "wide"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	volumeLsCommand.Flags().StringSliceP("filter", "f", []string{}, "Filter matches volumes based on given conditions")
-	return volumeLsCommand
+	cmd.Flags().StringSliceP("filter", "f", []string{}, "Filter matches volumes based on given conditions")
+	return cmd
 }
 
 func processVolumeLsOptions(cmd *cobra.Command) (types.VolumeListOptions, error) {
diff --git a/cmd/nerdctl/volume/volume_prune.go b/cmd/nerdctl/volume/volume_prune.go
index cbc74fb8..848cbaf2 100644
--- a/cmd/nerdctl/volume/volume_prune.go
+++ b/cmd/nerdctl/volume/volume_prune.go
@@ -29,7 +29,7 @@ import (
 )
 
 func newVolumePruneCommand() *cobra.Command {
-	volumePruneCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:           "prune [flags]",
 		Short:         "Remove all unused local volumes",
 		Args:          cobra.NoArgs,
@@ -37,9 +37,9 @@ func newVolumePruneCommand() *cobra.Command {
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}
-	volumePruneCommand.Flags().BoolP("all", "a", false, "Remove all unused volumes, not just anonymous ones")
-	volumePruneCommand.Flags().BoolP("force", "f", false, "Do not prompt for confirmation")
-	return volumePruneCommand
+	cmd.Flags().BoolP("all", "a", false, "Remove all unused volumes, not just anonymous ones")
+	cmd.Flags().BoolP("force", "f", false, "Do not prompt for confirmation")
+	return cmd
 }
 
 func processVolumePruneOptions(cmd *cobra.Command) (types.VolumePruneOptions, error) {
diff --git a/cmd/nerdctl/volume/volume_remove.go b/cmd/nerdctl/volume/volume_remove.go
index d4350b93..ccc299a5 100644
--- a/cmd/nerdctl/volume/volume_remove.go
+++ b/cmd/nerdctl/volume/volume_remove.go
@@ -27,7 +27,7 @@ import (
 )
 
 func newVolumeRmCommand() *cobra.Command {
-	volumeRmCommand := &cobra.Command{
+	cmd := &cobra.Command{
 		Use:               "rm [flags] VOLUME [VOLUME...]",
 		Aliases:           []string{"remove"},
 		Short:             "Remove one or more volumes",
@@ -38,8 +38,8 @@ func newVolumeRmCommand() *cobra.Command {
 		SilenceUsage:      true,
 		SilenceErrors:     true,
 	}
-	volumeRmCommand.Flags().BoolP("force", "f", false, "(unimplemented yet)")
-	return volumeRmCommand
+	cmd.Flags().BoolP("force", "f", false, "(unimplemented yet)")
+	return cmd
 }
 
 func processVolumeRmOptions(cmd *cobra.Command) (types.VolumeRemoveOptions, error) {
diff --git a/docs/config.md b/docs/config.md
index 1f0b4cd1..b4c6a20a 100644
--- a/docs/config.md
+++ b/docs/config.md
@@ -46,7 +46,7 @@ experimental   = true
 | `experimental`      | `--experimental`                   | `NERDCTL_EXPERIMENTAL`    | Enable  [experimental features](experimental.md)                                                                                                                 | Since 0.22.3     |
 | `host_gateway_ip`   | `--host-gateway-ip`                | `NERDCTL_HOST_GATEWAY_IP` | IP address that the special 'host-gateway' string in --add-host resolves to. Defaults to the IP address of the host. It has no effect without setting --add-host | Since 1.3.0      |
 | `bridge_ip`         | `--bridge-ip`                      | `NERDCTL_BRIDGE_IP`       | IP address for the default nerdctl bridge network, e.g., 10.1.100.1/24                                                                                           | Since 2.0.1      |
-| `kube-hide-dupe`    | `--kube-hide-dupe`                 |                           | Deduplicate images for Kubernetes with namespace k8s.io, no more redundant <none> ones are displayed    | Since 2.0.3      |
+| `kube_hide_dupe`    | `--kube-hide-dupe`                 |                           | Deduplicate images for Kubernetes with namespace k8s.io, no more redundant <none> ones are displayed    | Since 2.0.3      |
 
 The properties are parsed in the following precedence:
 1. CLI flag
diff --git a/docs/testing/README.md b/docs/testing/README.md
index c5bddc99..faca8ab4 100644
--- a/docs/testing/README.md
+++ b/docs/testing/README.md
@@ -5,18 +5,40 @@ and principles about writing tests.
 
 For more comprehensive information about nerdctl test tools, see [tools.md](tools.md).
 
-## Lint
+## Code, fix, lint, rinse, repeat
 
 ```
-go mod tidy
-golangci-lint run ./...
+# Do hack
+
+# When done:
+# This will ensure proper import formatting, modules, and basic formatting of your code
+make fix
+
+# And this will run all linters and report if any modification is required
+make lint
 ```
 
-This works on macOS as well - just pass along `GOOS=linux`.
+Note that both these tasks will work on any OS, including macOS.
+
+Also note that `make lint` does call on subtask `make lint-commits` which is going to lint commits for the range
+`main..HEAD` by default (this is fine for most development flows that expect to be merged in main).
+
+If you are targeting a specific branch that is not `main` (for example working against `release/1.7`),
+you likely want to explicitly set the commit range to that instead.
+
+eg:
+`LINT_COMMIT_RANGE=target_branch..HEAD make lint-commits`
+or
+`LINT_COMMIT_RANGE=target_branch..HEAD make lint`
 
 ## Unit testing
 
-Run `go test -v ./pkg/...`
+```
+# This will run basic unit testing
+make test
+```
+
+This task must be run on a supported OS (linux, windows, or freebsd).
 
 ## Integration testing
 
diff --git a/docs/testing/tools.md b/docs/testing/tools.md
index 2f53441b..70230ae6 100644
--- a/docs/testing/tools.md
+++ b/docs/testing/tools.md
@@ -24,7 +24,9 @@ import (
 	"testing"
 
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
 )
 
 func TestMyThing(t *testing.T) {
@@ -33,7 +35,7 @@ func TestMyThing(t *testing.T) {
 	// This is going to run `nerdctl info` (or `docker info`)
 	mytest.Command = test.Command("info")
     // Verify the command exits with 0, and stdout contains the word `Kernel`
-    myTest.Expected = test.Expects(0, nil, test.Contains("Kernel"))
+    myTest.Expected = test.Expects(0, nil, expect.Contains("Kernel"))
 	// Run it
 	myTest.Run(t)
 }
@@ -63,11 +65,11 @@ Secondly, `test.Contains` - which is a `Comparator`.
 
 ### Comparators
 
-Besides `test.Contains(string)`, there are a few more:
-- `test.DoesNotContain(string)`
-- `test.Equals(string)`
-- `test.Match(*regexp.Regexp)`
-- `test.All(comparators ...Comparator)`, which allows you to bundle together a bunch of other comparators
+Besides `expect.Contains(string)`, there are a few more:
+- `expect.DoesNotContain(string)`
+- `expect.Equals(string)`
+- `expect.Match(*regexp.Regexp)`
+- `expect.All(comparators ...Comparator)`, which allows you to bundle together a bunch of other comparators
 
 The following example shows how to implement your own custom `Comparator`
 (this is actually the `Equals` comparator).
@@ -80,7 +82,9 @@ import (
 
 	"gotest.tools/v3/assert"
 
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
 )
 
 func MyComparator(compare string) test.Comparator {
@@ -119,7 +123,9 @@ import (
 	"github.com/containerd/errdefs"
 
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
 )
 
 func TestMyThing(t *testing.T) {
@@ -228,7 +234,9 @@ import (
 	"github.com/containerd/errdefs"
 
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
 )
 
 func TestMyThing(t *testing.T) {
@@ -307,7 +315,9 @@ import (
 	"github.com/containerd/errdefs"
 
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
 )
 
 func TestMyThing(t *testing.T) {
@@ -375,15 +385,15 @@ expectations.
 
 Here are a few:
 ```go
-test.Windows // a test runs only on Windows (or Not(Windows))
-test.Linux // a test runs only on Linux
+require.Windows // a test runs only on Windows (or Not(Windows))
+require.Linux // a test runs only on Linux
 test.Darwin // a test runs only on Darwin
 test.OS(name string) // a test runs only on the OS `name`
-test.Binary(name string) // a test requires the bin `name` to be in the PATH
-test.Not(req Requirement) // a test runs only if the opposite of the requirement `req` is fulfilled
-test.Require(req ...Requirement) // a test runs only if all requirements are fulfilled
+require.Binary(name string) // a test requires the bin `name` to be in the PATH
+require.Not(req Requirement) // a test runs only if the opposite of the requirement `req` is fulfilled
+require.All(req ...Requirement) // a test runs only if all requirements are fulfilled
 
-nerdtest.Docker // a test only run on Docker - normally used with test.Not(nerdtest.Docker)
+nerdtest.Docker // a test only run on Docker - normally used with require.Not(nerdtest.Docker)
 nerdtest.Soci // a test requires the soci snapshotter
 nerdtest.Stargz // a test requires the stargz snapshotter
 nerdtest.Rootless // a test requires Rootless
diff --git a/go.mod b/go.mod
index 7c7e36d9..d3e9d9bf 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/containerd/nerdctl/v2
 
-go 1.22.7
+go 1.23.0
 
 require (
 	github.com/Masterminds/semver/v3 v3.3.1
@@ -11,14 +11,14 @@ require (
 	github.com/containerd/cgroups/v3 v3.0.5
 	github.com/containerd/console v1.0.4
 	github.com/containerd/containerd/api v1.8.0
-	github.com/containerd/containerd/v2 v2.0.2
+	github.com/containerd/containerd/v2 v2.0.3
 	github.com/containerd/continuity v0.4.5
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/fifo v1.1.0
 	github.com/containerd/go-cni v1.1.12
 	github.com/containerd/imgcrypt/v2 v2.0.0
 	github.com/containerd/log v0.1.0
-	github.com/containerd/nerdctl/v2/pkg/testutil/test v0.0.0
+	github.com/containerd/nerdctl/mod/tigron v0.0.0
 	github.com/containerd/nydus-snapshotter v0.15.0
 	github.com/containerd/platforms v1.0.0-rc.1
 	github.com/containerd/stargz-snapshotter v0.16.3
@@ -26,13 +26,13 @@ require (
 	github.com/containerd/stargz-snapshotter/ipfs v0.16.3
 	github.com/containerd/typeurl/v2 v2.2.3
 	github.com/containernetworking/cni v1.2.3
-	github.com/containernetworking/plugins v1.5.1
+	github.com/containernetworking/plugins v1.6.2
 	github.com/coreos/go-iptables v0.8.0
 	github.com/coreos/go-systemd/v22 v22.5.0
 	github.com/cyphar/filepath-securejoin v0.4.1
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v28.0.0+incompatible
-	github.com/docker/docker v28.0.0+incompatible
+	github.com/docker/cli v28.0.1+incompatible
+	github.com/docker/docker v28.0.1+incompatible
 	github.com/docker/go-connections v0.5.0
 	github.com/docker/go-units v0.5.0
 	github.com/fahedouch/go-logrotate v0.2.1
@@ -50,7 +50,7 @@ require (
 	github.com/muesli/cancelreader v0.2.2
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.0
-	github.com/opencontainers/runtime-spec v1.2.0
+	github.com/opencontainers/runtime-spec v1.2.1
 	github.com/pelletier/go-toml/v2 v2.2.3
 	github.com/rootless-containers/bypass4netns v0.4.2
 	github.com/rootless-containers/rootlesskit/v2 v2.3.2
@@ -60,7 +60,7 @@ require (
 	github.com/vishvananda/netns v0.0.5
 	github.com/yuchanns/srslog v1.1.0
 	go.uber.org/mock v0.5.0
-	golang.org/x/crypto v0.33.0
+	golang.org/x/crypto v0.35.0
 	golang.org/x/net v0.35.0
 	golang.org/x/sync v0.11.0
 	golang.org/x/sys v0.30.0
@@ -112,7 +112,6 @@ require (
 	github.com/multiformats/go-multibase v0.2.0 // indirect
 	github.com/multiformats/go-multihash v0.2.3 // indirect
 	github.com/multiformats/go-varint v0.0.7 // indirect
-	github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626 // indirect
 	github.com/opencontainers/selinux v1.11.1 // indirect
 	github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7 // indirect
 	github.com/philhofer/fwd v1.1.3-0.20240612014219-fbbf4953d986 // indirect
@@ -122,7 +121,6 @@ require (
 	github.com/smallstep/pkcs7 v0.1.1 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
-	github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
 	github.com/tinylib/msgp v1.2.0 // indirect
 	github.com/vbatts/tar-split v0.11.6 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
@@ -134,14 +132,10 @@ require (
 	go.opentelemetry.io/otel/metric v1.31.0 // indirect
 	go.opentelemetry.io/otel/trace v1.31.0 // indirect
 	golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
-	golang.org/x/mod v0.22.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 // indirect
 	google.golang.org/grpc v1.69.4 // indirect
 	google.golang.org/protobuf v1.36.2 // indirect
 	lukechampine.com/blake3 v1.3.0 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
-	tags.cncf.io/container-device-interface v0.8.0 // indirect
-	tags.cncf.io/container-device-interface/specs-go v0.8.0 // indirect
 )
 
-replace github.com/containerd/nerdctl/v2/pkg/testutil/test v0.0.0 => ./pkg/testutil/test
+replace github.com/containerd/nerdctl/mod/tigron v0.0.0 => ./mod/tigron
diff --git a/go.sum b/go.sum
index ecfd7086..3de86add 100644
--- a/go.sum
+++ b/go.sum
@@ -14,8 +14,6 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/Microsoft/hcsshim v0.12.9 h1:2zJy5KA+l0loz1HzEGqyNnjd3fyZA31ZBCGKacp6lLg=
 github.com/Microsoft/hcsshim v0.12.9/go.mod h1:fJ0gkFAna6ukt0bLdKB8djt4XIJhF/vEPuoIWYVvZ8Y=
-github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
-github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -33,8 +31,8 @@ github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn
 github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
 github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0=
 github.com/containerd/containerd/api v1.8.0/go.mod h1:dFv4lt6S20wTu/hMcP4350RL87qPWLVa/OHOwmmdnYc=
-github.com/containerd/containerd/v2 v2.0.2 h1:GmH/tRBlTvrXOLwSpWE2vNAm8+MqI6nmxKpKBNKY8Wc=
-github.com/containerd/containerd/v2 v2.0.2/go.mod h1:wIqEvQ/6cyPFUGJ5yMFanspPabMLor+bF865OHvNTTI=
+github.com/containerd/containerd/v2 v2.0.3 h1:zBKgwgZsuu+LPCMzCLgA4sC4MiZzZ59ZT31XkmiISQM=
+github.com/containerd/containerd/v2 v2.0.3/go.mod h1:5j9QUUaV/cy9ZeAx4S+8n9ffpf+iYnEj4jiExgcbuLY=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -69,8 +67,8 @@ github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++
 github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
 github.com/containernetworking/cni v1.2.3 h1:hhOcjNVUQTnzdRJ6alC5XF+wd9mfGIUaj8FuJbEslXM=
 github.com/containernetworking/cni v1.2.3/go.mod h1:DuLgF+aPd3DzcTQTtp/Nvl1Kim23oFKdm2okJzBQA5M=
-github.com/containernetworking/plugins v1.5.1 h1:T5ji+LPYjjgW0QM+KyrigZbLsZ8jaX+E5J/EcKOE4gQ=
-github.com/containernetworking/plugins v1.5.1/go.mod h1:MIQfgMayGuHYs0XdNudf31cLLAC+i242hNm6KuDGqCM=
+github.com/containernetworking/plugins v1.6.2 h1:pqP8Mq923TLyef5g97XfJ/xpDeVek4yF8A4mzy9Tc4U=
+github.com/containernetworking/plugins v1.6.2/go.mod h1:SP5UG3jDO9LtmfbBJdP+nl3A1atOtbj2MBOYsnaxy64=
 github.com/containers/ocicrypt v1.2.1 h1:0qIOTT9DoYwcKmxSt8QJt+VzMY18onl9jUXsxpVhSmM=
 github.com/containers/ocicrypt v1.2.1/go.mod h1:aD0AAqfMp0MtwqWgHM1bUwe1anx0VazI108CRrSKINQ=
 github.com/coreos/go-iptables v0.8.0 h1:MPc2P89IhuVpLI7ETL/2tx3XZ61VeICZjYqDEgNsPRc=
@@ -90,10 +88,10 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/docker/cli v28.0.0+incompatible h1:ido37VmLUqEp+5NFb9icd6BuBB+SNDgCn+5kPCr2buA=
-github.com/docker/cli v28.0.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/docker v28.0.0+incompatible h1:Olh0KS820sJ7nPsBKChVhk5pzqcwDR15fumfAd/p9hM=
-github.com/docker/docker v28.0.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/cli v28.0.1+incompatible h1:g0h5NQNda3/CxIsaZfH4Tyf6vpxFth7PYl3hgCPOKzs=
+github.com/docker/cli v28.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/docker v28.0.1+incompatible h1:FCHjSRdXhNRFjlHMTv4jUNlIBbTeRjrWfeFuJp7jpo0=
+github.com/docker/docker v28.0.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
@@ -154,20 +152,13 @@ github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6 h1:k7nVchz72niMH6YLQNvHSdIE7iqsQxK1P41mySCvssg=
-github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6/go.mod h1:kf6iHlnVGwgKolg33glAes7Yg/8iWP8ukqeldJSO7jw=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
-github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
-github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/ipfs/go-cid v0.5.0 h1:goEKKhaGm0ul11IHA7I6p1GmKz8kEYniqFopaB5Otwg=
@@ -195,15 +186,14 @@ github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebG
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
 github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
-github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
-github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
+github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
+github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
 github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
 github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
 github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mndrix/tap-go v0.0.0-20171203230836-629fa407e90b/go.mod h1:pzzDgJWZ34fGzaAZGFW22KVZDfyrYW+QABMrWnJBnSs=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
@@ -226,7 +216,6 @@ github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
 github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o=
 github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
-github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
 github.com/multiformats/go-base32 v0.1.0 h1:pVx9xoSPqEIQG8o+UbAe7DNi51oej1NtK+aGkbLYxPE=
@@ -241,20 +230,16 @@ github.com/multiformats/go-multihash v0.2.3 h1:7Lyc8XfX/IY2jWb/gI7JP+o7JEq9hOa7B
 github.com/multiformats/go-multihash v0.2.3/go.mod h1:dXgKXCXjBzdscBLk9JkjINiEsCKRVch90MdaGiKsvSM=
 github.com/multiformats/go-varint v0.0.7 h1:sWSGR+f/eu5ABZA2ZpYKBILXTTs9JWpdEM/nEGOHFS8=
 github.com/multiformats/go-varint v0.0.7/go.mod h1:r8PUYw/fD/SjBCiKOoDlGF6QawOELpZAu9eioSos/OU=
-github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
-github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
-github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk=
-github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0=
+github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
+github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/gomega v1.36.0 h1:Pb12RlruUtj4XUuPUqeEWc6j5DkVVVA49Uf6YLfC95Y=
+github.com/onsi/gomega v1.36.0/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
 github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
-github.com/opencontainers/runtime-spec v1.0.3-0.20220825212826-86290f6a00fb/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.2.0 h1:z97+pHb3uELt/yiAWD691HNHQIF07bE7dzrbT927iTk=
-github.com/opencontainers/runtime-spec v1.2.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626 h1:DmNGcqH3WDbV5k8OJ+esPWbqUOX5rMLR2PMvziDMJi0=
-github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626/go.mod h1:BRHJJd0E+cx42OybVYSgUvZmU0B8P9gZuRXlZUP7TKI=
-github.com/opencontainers/selinux v1.9.1/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
+github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
+github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.11.1 h1:nHFvthhM0qY8/m+vfhJylliSshm8G1jJ2jDMcgULaH8=
 github.com/opencontainers/selinux v1.11.1/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec=
 github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
@@ -280,7 +265,6 @@ github.com/rootless-containers/rootlesskit/v2 v2.3.2/go.mod h1:RL7YzL02nA2d8HAzt
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sasha-s/go-deadlock v0.3.5 h1:tNCOEEDG6tBqrNDOX35j/7hL5FcFViG6awUGROb2NsU=
 github.com/sasha-s/go-deadlock v0.3.5/go.mod h1:bugP6EGbdGYObIlx7pUZtWqlvo8k9H6vCBBsiChJQ5U=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/smallstep/pkcs7 v0.1.1 h1:x+rPdt2W088V9Vkjho4KtoggyktZJlMduZAtRHm68LU=
@@ -297,7 +281,6 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -305,11 +288,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
-github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/tinylib/msgp v1.2.0 h1:0uKB/662twsVBpYUPbokj4sTSKhWFKB7LopO2kWK8lY=
 github.com/tinylib/msgp v1.2.0/go.mod h1:2vIGs3lcUo8izAATNobrCHevYZC/LMsJtw4JPiYPHro=
-github.com/urfave/cli v1.19.1/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
 github.com/vbatts/tar-split v0.11.6 h1:4SjTW5+PU11n6fZenf2IPoV8/tz3AaYHMWjf23envGs=
 github.com/vbatts/tar-split v0.11.6/go.mod h1:dqKNtesIOr2j2Qv3W/cHjnvk9I8+G7oAkFDFN6TCBEI=
 github.com/vishvananda/netlink v1.3.0 h1:X7l42GfcV4S6E4vHTsw48qbrV+9PVojNfIhZcwQdrZk=
@@ -355,8 +335,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.30.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus=
-golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
+golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
+golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f h1:XdNn9LlyWAhLVp6P/i8QYBW+hlyhrhei9uErw2B5GJo=
 golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f/go.mod h1:D5SMRVC3C2/4+F/DB1wZsLRnSNimn2Sp/NPsCrsv8ak=
@@ -370,8 +350,6 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
-golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -407,8 +385,6 @@ golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -508,9 +484,3 @@ honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 lukechampine.com/blake3 v1.3.0 h1:sJ3XhFINmHSrYCgl958hscfIa3bw8x4DqMP3u1YvoYE=
 lukechampine.com/blake3 v1.3.0/go.mod h1:0OFRp7fBtAylGVCO40o87sbupkyIGgbpv1+M1k1LM6k=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
-tags.cncf.io/container-device-interface v0.8.0 h1:8bCFo/g9WODjWx3m6EYl3GfUG31eKJbaggyBDxEldRc=
-tags.cncf.io/container-device-interface v0.8.0/go.mod h1:Apb7N4VdILW0EVdEMRYXIDVRZfNJZ+kmEUss2kRRQ6Y=
-tags.cncf.io/container-device-interface/specs-go v0.8.0 h1:QYGFzGxvYK/ZLMrjhvY0RjpUavIn4KcmRmVP/JjdBTA=
-tags.cncf.io/container-device-interface/specs-go v0.8.0/go.mod h1:BhJIkjjPh4qpys+qm4DAYtUyryaTDg9zris+AczXyws=
diff --git a/hack/build-integration-kubernetes.sh b/hack/build-integration-kubernetes.sh
index 5647e4dd..0fcc4747 100755
--- a/hack/build-integration-kubernetes.sh
+++ b/hack/build-integration-kubernetes.sh
@@ -21,7 +21,7 @@ readonly root
 # shellcheck source=/dev/null
 . "$root/scripts/lib.sh"
 
-GO_VERSION=1.23
+GO_VERSION=1.24
 KIND_VERSION=v0.24.0
 CNI_PLUGINS_VERSION=v1.5.1
 
diff --git a/hack/lint-imports.sh b/hack/lint-imports.sh
deleted file mode 100755
index d37df1a0..00000000
--- a/hack/lint-imports.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env bash
-
-#   Copyright The containerd Authors.
-
-#   Licensed under the Apache License, Version 2.0 (the "License");
-#   you may not use this file except in compliance with the License.
-#   You may obtain a copy of the License at
-
-#       http://www.apache.org/licenses/LICENSE-2.0
-
-#   Unless required by applicable law or agreed to in writing, software
-#   distributed under the License is distributed on an "AS IS" BASIS,
-#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#   See the License for the specific language governing permissions and
-#   limitations under the License.
-
-# FIXME: goimports-reviser is currently broken when it comes to ./...
-# Specifically, it will ignore arguments, and will return exit 0 regardless
-# This here is a workaround, until they fix it upstream: https://github.com/incu6us/goimports-reviser/pull/157
-
-# shellcheck disable=SC2034,SC2015
-set -o errexit -o errtrace -o functrace -o nounset -o pipefail
-
-ex=0
-
-while read -r file; do
-  goimports-reviser -list-diff -set-exit-status -output stdout -company-prefixes "github.com/containerd" "$file" || {
-    ex=$?
-    >&2 printf "Imports are not listed properly in %s. Consider calling make lint-fix-imports.\n" "$file"
-  }
-done < <(find ./ -type f -name '*.go')
-
-exit "$ex"
diff --git a/hack/verify-pkg-isolation.sh b/hack/verify-pkg-isolation.sh
deleted file mode 100755
index 3f1edd22..00000000
--- a/hack/verify-pkg-isolation.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/bin/bash
-
-#   Copyright The containerd Authors.
-
-#   Licensed under the Apache License, Version 2.0 (the "License");
-#   you may not use this file except in compliance with the License.
-#   You may obtain a copy of the License at
-
-#       http://www.apache.org/licenses/LICENSE-2.0
-
-#   Unless required by applicable law or agreed to in writing, software
-#   distributed under the License is distributed on an "AS IS" BASIS,
-#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#   See the License for the specific language governing permissions and
-#   limitations under the License.
-
-echo "Verifying that ./pkg/... is decoupled from the CLI packages"
-set -eux -o pipefail
-
-if go list -f '{{join .Deps "\n"}}' ./pkg/... | grep -E '^(github.com/spf13/cobra|github.com/spf13/pflag|github.com/containerd/nerdctl/v2/cmd)'; then
-	echo >&2 "ERROR: ./pkg/... is not decoupled from the CLI packages"
-	exit 1
-fi
-
-echo "OK"
diff --git a/mod/tigron/expect/consts.go b/mod/tigron/expect/consts.go
new file mode 100644
index 00000000..670e12b4
--- /dev/null
+++ b/mod/tigron/expect/consts.go
@@ -0,0 +1,24 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package expect
+
+const (
+	ExitCodeSuccess     = 0
+	ExitCodeGenericFail = -1
+	ExitCodeNoCheck     = -2
+	ExitCodeTimeout     = -3
+)
diff --git a/pkg/cmd/container/create.go b/pkg/cmd/container/create.go
index 3faf01c4..671ab145 100644
--- a/pkg/cmd/container/create.go
+++ b/pkg/cmd/container/create.go
@@ -99,6 +99,7 @@ func Create(ctx context.Context, client *containerd.Client, args []string, netMa
 		if err := writeCIDFile(options.CidFile, id); err != nil {
 			return nil, nil, err
 		}
+		internalLabels.cidFile = options.CidFile
 	}
 	dataStore, err := clientutil.DataStore(options.GOptions.DataRoot, options.GOptions.Address)
 	if err != nil {
@@ -222,6 +223,10 @@ func Create(ctx context.Context, client *containerd.Client, args []string, netMa
 		return nil, generateRemoveStateDirFunc(ctx, id, internalLabels), err
 	}
 	internalLabels.logURI = logConfig.LogURI
+	internalLabels.logConfig = logConfig
+	if logConfig.Driver == "" && logConfig.Address == options.GOptions.Address {
+		internalLabels.logConfig.Driver = "json-file"
+	}
 
 	restartOpts, err := generateRestartOpts(ctx, client, options.Restart, logConfig.LogURI, options.InRun)
 	if err != nil {
@@ -268,6 +273,7 @@ func Create(ctx context.Context, client *containerd.Client, args []string, netMa
 	}
 	opts = append(opts, uOpts...)
 	gOpts, err := generateGroupsOpts(options.GroupAdd)
+	internalLabels.groupAdd = options.GroupAdd
 	if err != nil {
 		return nil, generateRemoveOrphanedDirsFunc(ctx, id, dataStore, internalLabels), err
 	}
@@ -325,6 +331,8 @@ func Create(ctx context.Context, client *containerd.Client, args []string, netMa
 
 	internalLabels.rm = containerutil.EncodeContainerRmOptLabel(options.Rm)
 
+	internalLabels.blkioWeight = options.BlkioWeight
+
 	// TODO: abolish internal labels and only use annotations
 	ilOpt, err := withInternalLabels(internalLabels)
 	if err != nil {
@@ -616,10 +624,11 @@ func withStop(stopSignal string, stopTimeout int, ensuredImage *imgutil.EnsuredI
 
 type internalLabels struct {
 	// labels from cmd options
-	namespace  string
-	platform   string
-	extraHosts []string
-	pidFile    string
+	namespace   string
+	platform    string
+	extraHosts  []string
+	pidFile     string
+	blkioWeight uint16
 	// labels from cmd options or automatically set
 	name       string
 	hostname   string
@@ -627,11 +636,14 @@ type internalLabels struct {
 	// automatically generated
 	stateDir string
 	// network
-	networks   []string
-	ipAddress  string
-	ip6Address string
-	ports      []cni.PortMapping
-	macAddress string
+	networks             []string
+	ipAddress            string
+	ip6Address           string
+	ports                []cni.PortMapping
+	macAddress           string
+	dnsServers           []string
+	dnsSearchDomains     []string
+	dnsResolvConfOptions []string
 	// volume
 	mountPoints []*mountutil.Processed
 	anonVolumes []string
@@ -642,12 +654,24 @@ type internalLabels struct {
 	// log
 	logURI string
 	// a label to check whether the --rm option is specified.
-	rm string
+	rm        string
+	logConfig logging.LogConfig
+
+	// a label to chek if --cidfile is set
+	cidFile string
+
+	// label to check if --group-add is set
+	groupAdd []string
+
+	// label for device mapping set by the --device flag
+	deviceMapping []dockercompat.DeviceMapping
 }
 
 // WithInternalLabels sets the internal labels for a container.
 func withInternalLabels(internalLabels internalLabels) (containerd.NewContainerOpts, error) {
 	m := make(map[string]string)
+	var hostConfigLabel dockercompat.HostConfigLabel
+	var dnsSettings dockercompat.DNSSettings
 	m[labels.Namespace] = internalLabels.namespace
 	if internalLabels.name != "" {
 		m[labels.Name] = internalLabels.name
@@ -674,6 +698,11 @@ func withInternalLabels(internalLabels internalLabels) (containerd.NewContainerO
 	}
 	if internalLabels.logURI != "" {
 		m[labels.LogURI] = internalLabels.logURI
+		logConfigJSON, err := json.Marshal(internalLabels.logConfig)
+		if err != nil {
+			return nil, err
+		}
+		m[labels.LogConfig] = string(logConfigJSON)
 	}
 	if len(internalLabels.anonVolumes) > 0 {
 		anonVolumeJSON, err := json.Marshal(internalLabels.anonVolumes)
@@ -725,6 +754,42 @@ func withInternalLabels(internalLabels internalLabels) (containerd.NewContainerO
 		m[labels.ContainerAutoRemove] = internalLabels.rm
 	}
 
+	if internalLabels.blkioWeight > 0 {
+		hostConfigLabel.BlkioWeight = internalLabels.blkioWeight
+	}
+
+	if internalLabels.cidFile != "" {
+		hostConfigLabel.CidFile = internalLabels.cidFile
+	}
+
+	if len(internalLabels.dnsServers) > 0 {
+		dnsSettings.DNSServers = internalLabels.dnsServers
+	}
+
+	if len(internalLabels.dnsSearchDomains) > 0 {
+		dnsSettings.DNSSearchDomains = internalLabels.dnsSearchDomains
+	}
+
+	if len(internalLabels.dnsResolvConfOptions) > 0 {
+		dnsSettings.DNSResolvConfOptions = internalLabels.dnsResolvConfOptions
+	}
+
+	if len(internalLabels.deviceMapping) > 0 {
+		hostConfigLabel.Devices = append(hostConfigLabel.Devices, internalLabels.deviceMapping...)
+	}
+
+	hostConfigJSON, err := json.Marshal(hostConfigLabel)
+	if err != nil {
+		return nil, err
+	}
+	m[labels.HostConfigLabel] = string(hostConfigJSON)
+
+	dnsSettingsJSON, err := json.Marshal(dnsSettings)
+	if err != nil {
+		return nil, err
+	}
+	m[labels.DNSSetting] = string(dnsSettingsJSON)
+
 	return containerd.WithAdditionalContainerLabels(m), nil
 }
 
@@ -737,6 +802,9 @@ func (il *internalLabels) loadNetOpts(opts types.NetworkOptions) {
 	il.ip6Address = opts.IP6Address
 	il.networks = opts.NetworkSlice
 	il.macAddress = opts.MACAddress
+	il.dnsServers = opts.DNSServers
+	il.dnsSearchDomains = opts.DNSSearchDomains
+	il.dnsResolvConfOptions = opts.DNSResolvConfOptions
 }
 
 func dockercompatMounts(mountPoints []*mountutil.Processed) []dockercompat.MountPoint {
diff --git a/pkg/cmd/container/run_cgroup_linux.go b/pkg/cmd/container/run_cgroup_linux.go
index af43b12c..a4d6fb7a 100644
--- a/pkg/cmd/container/run_cgroup_linux.go
+++ b/pkg/cmd/container/run_cgroup_linux.go
@@ -32,6 +32,7 @@ import (
 
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
 	"github.com/containerd/nerdctl/v2/pkg/infoutil"
+	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 )
 
@@ -41,7 +42,7 @@ type customMemoryOptions struct {
 	disableOOMKiller  *bool
 }
 
-func generateCgroupOpts(id string, options types.ContainerCreateOptions) ([]oci.SpecOpts, error) {
+func generateCgroupOpts(id string, options types.ContainerCreateOptions, internalLabels *internalLabels) ([]oci.SpecOpts, error) {
 	if options.KernelMemory != "" {
 		log.L.Warnf("The --kernel-memory flag is no longer supported. This flag is a noop.")
 	}
@@ -206,6 +207,11 @@ func generateCgroupOpts(id string, options types.ContainerCreateOptions) ([]oci.
 			return nil, fmt.Errorf("failed to parse device %q: %w", f, err)
 		}
 		opts = append(opts, oci.WithDevices(devPath, conPath, mode))
+		var deviceMap dockercompat.DeviceMapping
+		deviceMap.PathOnHost = devPath
+		deviceMap.PathInContainer = conPath
+		deviceMap.CgroupPermissions = mode
+		internalLabels.deviceMapping = append(internalLabels.deviceMapping, deviceMap)
 	}
 
 	return opts, nil
diff --git a/pkg/cmd/container/run_linux.go b/pkg/cmd/container/run_linux.go
index cbe38d62..3280d3e5 100644
--- a/pkg/cmd/container/run_linux.go
+++ b/pkg/cmd/container/run_linux.go
@@ -56,7 +56,7 @@ func setPlatformOptions(ctx context.Context, client *containerd.Client, id, uts
 			{Type: "cgroup", Source: "cgroup", Destination: "/sys/fs/cgroup", Options: []string{"ro", "nosuid", "noexec", "nodev"}},
 		}))
 
-	cgOpts, err := generateCgroupOpts(id, options)
+	cgOpts, err := generateCgroupOpts(id, options, internalLabels)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/cmd/image/convert.go b/pkg/cmd/image/convert.go
index 71a2cca4..47fe2103 100644
--- a/pkg/cmd/image/convert.go
+++ b/pkg/cmd/image/convert.go
@@ -76,7 +76,7 @@ func Convert(ctx context.Context, client *containerd.Client, srcRawRef, targetRa
 	convertOpts = append(convertOpts, converter.WithPlatform(platMC))
 
 	// Ensure all the layers are here: https://github.com/containerd/nerdctl/issues/3425
-	err = EnsureAllContent(ctx, client, srcRef, options.GOptions)
+	err = EnsureAllContent(ctx, client, srcRef, platMC, options.GOptions)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/cmd/image/ensure.go b/pkg/cmd/image/ensure.go
index fe5f6ca8..c3315e58 100644
--- a/pkg/cmd/image/ensure.go
+++ b/pkg/cmd/image/ensure.go
@@ -27,6 +27,7 @@ import (
 	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/containerd/v2/core/images"
 	"github.com/containerd/log"
+	"github.com/containerd/platforms"
 
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
 	"github.com/containerd/nerdctl/v2/pkg/containerdutil"
@@ -37,7 +38,7 @@ import (
 	"github.com/containerd/nerdctl/v2/pkg/referenceutil"
 )
 
-func EnsureAllContent(ctx context.Context, client *containerd.Client, srcName string, options types.GlobalCommandOptions) error {
+func EnsureAllContent(ctx context.Context, client *containerd.Client, srcName string, platMC platforms.MatchComparer, options types.GlobalCommandOptions) error {
 	// Get the image from the srcName
 	imageService := client.ImageService()
 	img, err := imageService.Get(ctx, srcName)
@@ -51,9 +52,11 @@ func EnsureAllContent(ctx context.Context, client *containerd.Client, srcName st
 	imagesList, _ := read(ctx, provider, snapshotter, img.Target)
 	// Iterate through the list
 	for _, i := range imagesList {
-		err = ensureOne(ctx, client, srcName, img.Target, i.platform, options)
-		if err != nil {
-			return err
+		if platMC.Match(i.platform) {
+			err = ensureOne(ctx, client, srcName, img.Target, i.platform, options)
+			if err != nil {
+				return err
+			}
 		}
 	}
 
diff --git a/pkg/cmd/image/push.go b/pkg/cmd/image/push.go
index a940f832..ac5602b6 100644
--- a/pkg/cmd/image/push.go
+++ b/pkg/cmd/image/push.go
@@ -67,7 +67,12 @@ func Push(ctx context.Context, client *containerd.Client, rawRef string, options
 
 		// Ensure all the layers are here: https://github.com/containerd/nerdctl/issues/3489
 		// XXX what if the image is a CID, or only otherwise available on ipfs?
-		err = EnsureAllContent(ctx, client, parsedReference.String(), options.GOptions)
+		platMC, err := platformutil.NewMatchComparer(options.AllPlatforms, options.Platforms)
+		if err != nil {
+			return err
+		}
+
+		err = EnsureAllContent(ctx, client, parsedReference.String(), platMC, options.GOptions)
 		if err != nil {
 			return err
 		}
diff --git a/pkg/cmd/image/save.go b/pkg/cmd/image/save.go
index 2b5d6d12..0a499b3f 100644
--- a/pkg/cmd/image/save.go
+++ b/pkg/cmd/image/save.go
@@ -50,7 +50,7 @@ func Save(ctx context.Context, client *containerd.Client, images []string, optio
 			}
 
 			// Ensure all the layers are here: https://github.com/containerd/nerdctl/issues/3425
-			err = EnsureAllContent(ctx, client, found.Image.Name, options.GOptions)
+			err = EnsureAllContent(ctx, client, found.Image.Name, platMC, options.GOptions)
 			if err != nil {
 				return err
 			}
diff --git a/pkg/cmd/image/tag.go b/pkg/cmd/image/tag.go
index 5323080f..dc975c9f 100644
--- a/pkg/cmd/image/tag.go
+++ b/pkg/cmd/image/tag.go
@@ -26,6 +26,7 @@ import (
 
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
 	"github.com/containerd/nerdctl/v2/pkg/idutil/imagewalker"
+	"github.com/containerd/nerdctl/v2/pkg/platformutil"
 	"github.com/containerd/nerdctl/v2/pkg/referenceutil"
 )
 
@@ -61,7 +62,12 @@ func Tag(ctx context.Context, client *containerd.Client, options types.ImageTagO
 	defer done(ctx)
 
 	// Ensure all the layers are here: https://github.com/containerd/nerdctl/issues/3425
-	err = EnsureAllContent(ctx, client, srcName, options.GOptions)
+	platMC, err := platformutil.NewMatchComparer(true, nil)
+	if err != nil {
+		return err
+	}
+
+	err = EnsureAllContent(ctx, client, srcName, platMC, options.GOptions)
 	if err != nil {
 		log.G(ctx).Warn("Unable to fetch missing layers before committing. " +
 			"If you try to save or push this image, it might fail. See https://github.com/containerd/nerdctl/issues/3439.")
diff --git a/pkg/imgutil/commit/commit.go b/pkg/imgutil/commit/commit.go
index 101cf798..d660d86e 100644
--- a/pkg/imgutil/commit/commit.go
+++ b/pkg/imgutil/commit/commit.go
@@ -128,7 +128,7 @@ func Commit(ctx context.Context, client *containerd.Client, container containerd
 	}
 
 	// Ensure all the layers are here: https://github.com/containerd/nerdctl/issues/3425
-	err = image.EnsureAllContent(ctx, client, baseImg.Name(), globalOptions)
+	err = image.EnsureAllContent(ctx, client, baseImg.Name(), platformMC, globalOptions)
 	if err != nil {
 		log.G(ctx).Warn("Unable to fetch missing layers before committing. " +
 			"If you try to save or push this image, it might fail. See https://github.com/containerd/nerdctl/issues/3439.")
diff --git a/pkg/inspecttypes/dockercompat/dockercompat.go b/pkg/inspecttypes/dockercompat/dockercompat.go
index 317da3cc..027726f1 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat.go
@@ -36,6 +36,7 @@ import (
 	"time"
 
 	"github.com/docker/go-connections/nat"
+	"github.com/docker/go-units"
 	"github.com/opencontainers/runtime-spec/specs-go"
 
 	containerd "github.com/containerd/containerd/v2/client"
@@ -45,6 +46,7 @@ import (
 
 	"github.com/containerd/nerdctl/v2/pkg/imgutil"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/native"
+	"github.com/containerd/nerdctl/v2/pkg/ipcutil"
 	"github.com/containerd/nerdctl/v2/pkg/labels"
 	"github.com/containerd/nerdctl/v2/pkg/ocihook/state"
 )
@@ -94,6 +96,13 @@ type ImageMetadata struct {
 	LastTagTime time.Time `json:",omitempty"`
 }
 
+type loggerLogConfig struct {
+	Driver  string            `json:"driver"`
+	Opts    map[string]string `json:"opts,omitempty"`
+	LogURI  string            `json:"-"`
+	Address string            `json:"address"`
+}
+
 // Container mimics a `docker container inspect` object.
 // From https://github.com/moby/moby/blob/v20.10.1/api/types/types.go#L340-L374
 type Container struct {
@@ -105,8 +114,8 @@ type Container struct {
 	Image          string
 	ResolvConfPath string
 	HostnamePath   string
-	// TODO: HostsPath      string
-	LogPath string
+	HostsPath      string
+	LogPath        string
 	// Unimplemented: Node            *ContainerNode `json:",omitempty"` // Node is only propagated by Docker Swarm standalone API
 	Name         string
 	RestartCount int
@@ -116,7 +125,7 @@ type Container struct {
 	// TODO: ProcessLabel    string
 	AppArmorProfile string
 	// TODO: ExecIDs         []string
-	// TODO: HostConfig      *container.HostConfig
+	HostConfig *HostConfig
 	// TODO: GraphDriver     GraphDriverData
 	SizeRw     *int64 `json:",omitempty"`
 	SizeRootFs *int64 `json:",omitempty"`
@@ -126,6 +135,53 @@ type Container struct {
 	NetworkSettings *NetworkSettings
 }
 
+// From https://github.com/moby/moby/blob/8dbd90ec00daa26dc45d7da2431c965dec99e8b4/api/types/container/host_config.go#L391
+// HostConfig the non-portable Config structure of a container.
+type HostConfig struct {
+	// Binds           []string      // List of volume bindings for this container
+	ContainerIDFile string          // File (path) where the containerId is written
+	LogConfig       loggerLogConfig // Configuration of the logs for this container
+	// NetworkMode     NetworkMode   // Network mode to use for the container
+	PortBindings nat.PortMap // Port mapping between the exposed port (container) and the host
+	// RestartPolicy   RestartPolicy // Restart policy to be used for the container
+	// AutoRemove      bool          // Automatically remove container when it exits
+	// VolumeDriver    string        // Name of the volume driver used to mount volumes
+	// VolumesFrom     []string      // List of volumes to take from other container
+	// CapAdd          strslice.StrSlice // List of kernel capabilities to add to the container
+	// CapDrop         strslice.StrSlice // List of kernel capabilities to remove from the container
+
+	CgroupnsMode string   // Cgroup namespace mode to use for the container
+	DNS          []string `json:"Dns"`        // List of DNS server to lookup
+	DNSOptions   []string `json:"DnsOptions"` // List of DNSOption to look for
+	DNSSearch    []string `json:"DnsSearch"`  // List of DNSSearch to look for
+	ExtraHosts   []string // List of extra hosts
+	GroupAdd     []string // GroupAdd specifies additional groups to join
+	IpcMode      string   `json:"IpcMode"` // IPC namespace to use for the container
+	// Cgroup          CgroupSpec        // Cgroup to use for the container
+	OomScoreAdj int    // specifies the tune container’s OOM preferences (-1000 to 1000, rootless: 100 to 1000)
+	PidMode     string // PID namespace to use for the container
+	// Privileged      bool              // Is the container in privileged mode
+	// PublishAllPorts bool              // Should docker publish all exposed port for the container
+	ReadonlyRootfs bool // Is the container root filesystem in read-only
+	// SecurityOpt     []string          // List of string values to customize labels for MLS systems, such as SELinux.
+	Tmpfs   map[string]string `json:"Tmpfs,omitempty"` // List of tmpfs (mounts) used for the container
+	UTSMode string            // UTS namespace to use for the container
+	// UsernsMode      UsernsMode        // The user namespace to use for the container
+	ShmSize int64             // Size of /dev/shm in bytes. The size must be greater than 0.
+	Sysctls map[string]string // List of Namespaced sysctls used for the container
+	Runtime string            // Runtime to use with this container
+
+	BlkioWeight    uint16          // Block IO weight (relative weight vs. other containers)
+	CPUSetMems     string          `json:"CpusetMems"` // CpusetMems 0-2, 0,1
+	CPUSetCPUs     string          `json:"CpusetCpus"` // CpusetCpus 0-2, 0,1
+	CPUQuota       int64           `json:"CpuQuota"`   // CPU CFS (Completely Fair Scheduler) quota
+	CPUShares      uint64          `json:"CpuShares"`  // CPU shares (relative weight vs. other containers)
+	Memory         int64           // Memory limit (in bytes)
+	MemorySwap     int64           // Total memory usage (memory + swap); set `-1` to enable unlimited swap
+	OomKillDisable bool            // specifies whether to disable OOM Killer
+	Devices        []DeviceMapping // List of devices to map inside the container
+}
+
 // From https://github.com/moby/moby/blob/v20.10.1/api/types/types.go#L416-L427
 // MountPoint represents a mount point configuration inside the container.
 // This is used for reporting the mountpoints in use by a container.
@@ -191,6 +247,31 @@ type NetworkSettings struct {
 	Networks map[string]*NetworkEndpointSettings
 }
 
+type DNSSettings struct {
+	DNSServers           []string
+	DNSResolvConfOptions []string
+	DNSSearchDomains     []string
+}
+
+type HostConfigLabel struct {
+	BlkioWeight uint16
+	CidFile     string
+	Devices     []DeviceMapping
+}
+
+type DeviceMapping struct {
+	PathOnHost        string
+	PathInContainer   string
+	CgroupPermissions string
+}
+
+type cpuSettings struct {
+	cpuSetCpus string
+	cpuSetMems string
+	cpuShares  uint64
+	cpuQuota   int64
+}
+
 // DefaultNetworkSettings is from https://github.com/moby/moby/blob/v20.10.1/api/types/types.go#L405-L414
 type DefaultNetworkSettings struct {
 	// TODO EndpointID          string // EndpointID uniquely represents a service endpoint in a Sandbox
@@ -234,6 +315,7 @@ func ContainerFromNative(n *native.Container) (*Container, error) {
 		// XXX is this always right? what if the container OS is NOT the same as the host OS?
 		Platform: runtime.GOOS, // for Docker compatibility, this Platform string does NOT contain arch like "/amd64"
 	}
+	c.HostConfig = new(HostConfig)
 	if n.Labels[restart.StatusLabel] == string(containerd.Running) {
 		c.RestartCount, _ = strconv.Atoi(n.Labels[restart.CountLabel])
 	}
@@ -255,6 +337,8 @@ func ContainerFromNative(n *native.Container) (*Container, error) {
 				c.ResolvConfPath = mount.Source
 			} else if mount.Destination == "/etc/hostname" {
 				c.HostnamePath = mount.Source
+			} else if mount.Destination == "/etc/hosts" {
+				c.HostsPath = mount.Source
 			}
 		}
 		hostname = sp.Hostname
@@ -272,14 +356,79 @@ func ContainerFromNative(n *native.Container) (*Container, error) {
 		if _, err := os.Stat(c.LogPath); err != nil {
 			c.LogPath = ""
 		}
+		hostsPath := filepath.Join(nerdctlStateDir, "hosts")
+		if _, err := os.Stat(hostsPath); err == nil {
+			c.HostsPath = hostsPath
+		}
 	}
 
+	c.HostConfig.Tmpfs = make(map[string]string)
 	if nerdctlMounts := n.Labels[labels.Mounts]; nerdctlMounts != "" {
 		mounts, err := parseMounts(nerdctlMounts)
 		if err != nil {
 			return nil, err
 		}
 		c.Mounts = mounts
+		for _, mount := range mounts {
+			if mount.Type == "tmpfs" {
+				c.HostConfig.Tmpfs[mount.Destination] = mount.Mode
+			}
+		}
+	}
+
+	if nedctlExtraHosts := n.Labels[labels.ExtraHosts]; nedctlExtraHosts != "" {
+		c.HostConfig.ExtraHosts = parseExtraHosts(nedctlExtraHosts)
+	}
+
+	if nerdctlLoguri := n.Labels[labels.LogURI]; nerdctlLoguri != "" {
+		c.HostConfig.LogConfig.LogURI = nerdctlLoguri
+	}
+	if logConfigJSON, ok := n.Labels[labels.LogConfig]; ok {
+		var logConfig loggerLogConfig
+		err := json.Unmarshal([]byte(logConfigJSON), &logConfig)
+		if err != nil {
+			return nil, fmt.Errorf("failed to unmarshal log config: %v", err)
+		}
+
+		// Assign the parsed LogConfig to c.HostConfig.LogConfig
+		c.HostConfig.LogConfig = logConfig
+	} else {
+		// If LogConfig label is not present, set default values
+		c.HostConfig.LogConfig = loggerLogConfig{
+			Driver: "json-file",
+			Opts:   make(map[string]string),
+		}
+	}
+
+	hostConfigLabel, err := getHostConfigLabelFromNative(n.Labels)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch HostConfigLabel: %v", err)
+	}
+
+	c.HostConfig.BlkioWeight = hostConfigLabel.BlkioWeight
+	c.HostConfig.ContainerIDFile = hostConfigLabel.CidFile
+
+	groupAdd, err := groupAddFromNative(n.Spec.(*specs.Spec))
+	if err != nil {
+		return nil, fmt.Errorf("failed to groupAdd from native spec: %v", err)
+	}
+
+	c.HostConfig.GroupAdd = groupAdd
+	c.HostConfig.ShmSize = 0
+
+	if ipcMode := n.Labels[labels.IPC]; ipcMode != "" {
+		ipc, err := ipcutil.DecodeIPCLabel(ipcMode)
+		if err != nil {
+			return nil, fmt.Errorf("failed to Decode IPC Label: %v", err)
+		}
+		c.HostConfig.IpcMode = string(ipc.Mode)
+		if ipc.ShmSize != "" {
+			shmSize, err := units.RAMInBytes(ipc.ShmSize)
+			if err != nil {
+				return nil, fmt.Errorf("failed to parse ShmSize: %v", err)
+			}
+			c.HostConfig.ShmSize = shmSize
+		}
 	}
 
 	cs := new(ContainerState)
@@ -308,7 +457,69 @@ func ContainerFromNative(n *native.Container) (*Container, error) {
 			return nil, err
 		}
 		c.NetworkSettings = nSettings
+		c.HostConfig.PortBindings = *nSettings.Ports
 	}
+
+	cpuSetting, err := cpuSettingsFromNative(n.Spec.(*specs.Spec))
+	if err != nil {
+		return nil, fmt.Errorf("failed to Decode cpuSettings: %v", err)
+	}
+	c.HostConfig.CPUSetCPUs = cpuSetting.cpuSetCpus
+	c.HostConfig.CPUSetMems = cpuSetting.cpuSetMems
+	c.HostConfig.CPUQuota = cpuSetting.cpuQuota
+	c.HostConfig.CPUShares = cpuSetting.cpuShares
+
+	cgroupNamespace, err := getCgroupnsFromNative(n.Spec.(*specs.Spec))
+	if err != nil {
+		return nil, fmt.Errorf("failed to Decode cgroupNamespace: %v", err)
+	}
+	c.HostConfig.CgroupnsMode = cgroupNamespace
+
+	memorySettings, err := getMemorySettingsFromNative(n.Spec.(*specs.Spec))
+	if err != nil {
+		return nil, fmt.Errorf("failed to Decode memory Settings: %v", err)
+	}
+
+	c.HostConfig.OomKillDisable = memorySettings.DisableOOMKiller
+	c.HostConfig.Memory = memorySettings.Limit
+	c.HostConfig.MemorySwap = memorySettings.Swap
+
+	dnsSettings, err := getDNSFromNative(n.Labels)
+	if err != nil {
+		return nil, fmt.Errorf("failed to Decode dns Settings: %v", err)
+	}
+
+	c.HostConfig.DNS = dnsSettings.DNSServers
+	c.HostConfig.DNSOptions = dnsSettings.DNSResolvConfOptions
+	c.HostConfig.DNSSearch = dnsSettings.DNSSearchDomains
+
+	oomScoreAdj, err := getOomScoreAdjFromNative(n.Spec.(*specs.Spec))
+	if err != nil {
+		return nil, fmt.Errorf("failed to get OomScoreAdj value: %v", err)
+	}
+	c.HostConfig.OomScoreAdj = oomScoreAdj
+
+	c.HostConfig.ReadonlyRootfs = false
+	if n.Spec.(*specs.Spec).Root != nil && n.Spec.(*specs.Spec).Root.Readonly {
+		c.HostConfig.ReadonlyRootfs = n.Spec.(*specs.Spec).Root.Readonly
+	}
+
+	utsMode, err := getUtsModeFromNative(n.Spec.(*specs.Spec))
+	if err != nil {
+		return nil, fmt.Errorf("failed to get UtsMode value: %v", err)
+	}
+	c.HostConfig.UTSMode = utsMode
+
+	sysctls, err := getSysctlFromNative(n.Spec.(*specs.Spec))
+	if err != nil {
+		return nil, fmt.Errorf("failed to get UtsMode value: %v", err)
+	}
+	c.HostConfig.Sysctls = sysctls
+
+	if n.Runtime.Name != "" {
+		c.HostConfig.Runtime = n.Runtime.Name
+	}
+
 	c.State = cs
 	c.Config = &Config{
 		Labels: n.Labels,
@@ -322,6 +533,13 @@ func ContainerFromNative(n *native.Container) (*Container, error) {
 		c.Config.Domainname = n.Labels[labels.Domainname]
 	}
 
+	c.HostConfig.Devices = hostConfigLabel.Devices
+
+	var pidMode string
+	if n.Labels[labels.PIDContainer] != "" {
+		pidMode = n.Labels[labels.PIDContainer]
+	}
+	c.HostConfig.PidMode = pidMode
 	return c, nil
 }
 
@@ -479,6 +697,53 @@ func networkSettingsFromNative(n *native.NetNS, sp *specs.Spec) (*NetworkSetting
 	return res, nil
 }
 
+func cpuSettingsFromNative(sp *specs.Spec) (*cpuSettings, error) {
+	res := &cpuSettings{}
+	if sp.Linux != nil && sp.Linux.Resources != nil && sp.Linux.Resources.CPU != nil {
+		if sp.Linux.Resources.CPU.Cpus != "" {
+			res.cpuSetCpus = sp.Linux.Resources.CPU.Cpus
+		}
+
+		if sp.Linux.Resources.CPU.Mems != "" {
+			res.cpuSetMems = sp.Linux.Resources.CPU.Mems
+		}
+
+		if sp.Linux.Resources.CPU.Shares != nil && *sp.Linux.Resources.CPU.Shares > 0 {
+			res.cpuShares = *sp.Linux.Resources.CPU.Shares
+		}
+
+		if sp.Linux.Resources.CPU.Quota != nil && *sp.Linux.Resources.CPU.Quota > 0 {
+			res.cpuQuota = *sp.Linux.Resources.CPU.Quota
+		}
+	}
+
+	return res, nil
+}
+
+func getCgroupnsFromNative(sp *specs.Spec) (string, error) {
+	res := ""
+	if sp.Linux != nil && len(sp.Linux.Namespaces) != 0 {
+		for _, ns := range sp.Linux.Namespaces {
+			if ns.Type == "cgroup" {
+				res = "private"
+			}
+		}
+	}
+	return res, nil
+}
+
+func groupAddFromNative(sp *specs.Spec) ([]string, error) {
+	res := []string{}
+	if sp.Process != nil && sp.Process.User.AdditionalGids != nil {
+		for _, gid := range sp.Process.User.AdditionalGids {
+			if gid != 0 {
+				res = append(res, strconv.FormatUint(uint64(gid), 10))
+			}
+		}
+	}
+	return res, nil
+}
+
 func convertToNatPort(portMappings []cni.PortMapping) (*nat.PortMap, error) {
 	portMap := make(nat.PortMap)
 	for _, portMapping := range portMappings {
@@ -497,6 +762,83 @@ func convertToNatPort(portMappings []cni.PortMapping) (*nat.PortMap, error) {
 	return &portMap, nil
 }
 
+func parseExtraHosts(extraHostsJSON string) []string {
+	var extraHosts []string
+	if err := json.Unmarshal([]byte(extraHostsJSON), &extraHosts); err != nil {
+		// Handle error or return empty slice
+		return []string{}
+	}
+	return extraHosts
+}
+
+func getMemorySettingsFromNative(sp *specs.Spec) (*MemorySetting, error) {
+	res := &MemorySetting{}
+	if sp.Linux != nil && sp.Linux.Resources != nil && sp.Linux.Resources.Memory != nil {
+		if sp.Linux.Resources.Memory.DisableOOMKiller != nil {
+			res.DisableOOMKiller = *sp.Linux.Resources.Memory.DisableOOMKiller
+		}
+
+		if sp.Linux.Resources.Memory.Limit != nil {
+			res.Limit = *sp.Linux.Resources.Memory.Limit
+		}
+
+		if sp.Linux.Resources.Memory.Swap != nil {
+			res.Swap = *sp.Linux.Resources.Memory.Swap
+		}
+	}
+	return res, nil
+}
+
+func getDNSFromNative(Labels map[string]string) (*DNSSettings, error) {
+	res := &DNSSettings{}
+
+	if dnsSettingJSON, ok := Labels[labels.DNSSetting]; ok {
+		if err := json.Unmarshal([]byte(dnsSettingJSON), &res); err != nil {
+			return nil, fmt.Errorf("failed to parse DNS settings: %v", err)
+		}
+	}
+
+	return res, nil
+}
+
+func getHostConfigLabelFromNative(Labels map[string]string) (*HostConfigLabel, error) {
+	res := &HostConfigLabel{}
+
+	if hostConfigLabelJSON, ok := Labels[labels.HostConfigLabel]; ok {
+		if err := json.Unmarshal([]byte(hostConfigLabelJSON), &res); err != nil {
+			return nil, fmt.Errorf("failed to parse DNS servers: %v", err)
+		}
+	}
+	return res, nil
+}
+
+func getOomScoreAdjFromNative(sp *specs.Spec) (int, error) {
+	var res int
+	if sp.Process != nil && sp.Process.OOMScoreAdj != nil {
+		res = *sp.Process.OOMScoreAdj
+	}
+	return res, nil
+}
+
+func getUtsModeFromNative(sp *specs.Spec) (string, error) {
+	if sp.Linux != nil && len(sp.Linux.Namespaces) > 0 {
+		for _, ns := range sp.Linux.Namespaces {
+			if ns.Type == "uts" {
+				return "", nil
+			}
+		}
+	}
+	return "host", nil
+}
+
+func getSysctlFromNative(sp *specs.Spec) (map[string]string, error) {
+	var res map[string]string
+	if sp.Linux != nil && sp.Linux.Sysctl != nil {
+		res = sp.Linux.Sysctl
+	}
+	return res, nil
+}
+
 type IPAMConfig struct {
 	Subnet  string `json:"Subnet,omitempty"`
 	Gateway string `json:"Gateway,omitempty"`
@@ -527,6 +869,12 @@ type structuredCNI struct {
 	} `json:"plugins"`
 }
 
+type MemorySetting struct {
+	Limit            int64 `json:"limit"`
+	Swap             int64 `json:"swap"`
+	DisableOOMKiller bool  `json:"disableOOMKiller"`
+}
+
 func NetworkFromNative(n *native.Network) (*Network, error) {
 	var res Network
 
diff --git a/pkg/labels/labels.go b/pkg/labels/labels.go
index bfcd8b86..0376497a 100644
--- a/pkg/labels/labels.go
+++ b/pkg/labels/labels.go
@@ -106,4 +106,13 @@ const (
 
 	// ContainerAutoRemove is to check whether the --rm option is specified.
 	ContainerAutoRemove = Prefix + "auto-remove"
+
+	// LogConfig defines the logging configuration passed to the container
+	LogConfig = Prefix + "log-config"
+
+	// HostConfigLabel sets the dockercompat host config values
+	HostConfigLabel = Prefix + "host-config"
+
+	// DNSSettings sets the dockercompat DNS config values
+	DNSSetting = Prefix + "dns"
 )



Test patch:
diff --git a/cmd/nerdctl/builder/builder_build_oci_layout_test.go b/cmd/nerdctl/builder/builder_build_oci_layout_test.go
index a3fea9b5..93cc4152 100644
--- a/cmd/nerdctl/builder/builder_build_oci_layout_test.go
+++ b/cmd/nerdctl/builder/builder_build_oci_layout_test.go
@@ -25,9 +25,11 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestBuildContextWithOCILayout(t *testing.T) {
@@ -36,9 +38,9 @@ func TestBuildContextWithOCILayout(t *testing.T) {
 	var dockerBuilderArgs []string
 
 	testCase := &test.Case{
-		Require: test.Require(
+		Require: require.All(
 			nerdtest.Build,
-			test.Not(test.Windows),
+			require.Not(require.Windows),
 		),
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			if nerdtest.IsDocker() {
diff --git a/cmd/nerdctl/builder/builder_build_test.go b/cmd/nerdctl/builder/builder_build_test.go
index 407804f9..be8bc051 100644
--- a/cmd/nerdctl/builder/builder_build_test.go
+++ b/cmd/nerdctl/builder/builder_build_test.go
@@ -27,10 +27,13 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/platformutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestBuildBasics(t *testing.T) {
@@ -60,7 +63,7 @@ CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, test.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 			{
 				Description: "Successfully build with 'buildctx first', 'tag second'",
@@ -73,7 +76,7 @@ CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, test.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 			{
 				Description: "Successfully build with output docker, main tag still works",
@@ -86,7 +89,7 @@ CMD ["echo", "nerdctl-build-test-string"]`, testutil.CommonImage)
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, test.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 			{
 				Description: "Successfully build with output docker, name cannot be used",
@@ -126,7 +129,7 @@ func TestCanBuildOnOtherPlatform(t *testing.T) {
 	}
 
 	testCase := &test.Case{
-		Require: test.Require(
+		Require: require.All(
 			nerdtest.Build,
 			requireEmulation,
 		),
@@ -179,7 +182,7 @@ CMD ["cat", "/hello2"]`, data.Identifier("first"))
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			return helpers.Command("run", "--rm", data.Identifier("second"))
 		},
-		Expected: test.Expects(0, nil, test.Equals("hello2\n")),
+		Expected: test.Expects(0, nil, expect.Equals("hello2\n")),
 	}
 
 	testCase.Run(t)
@@ -191,9 +194,9 @@ func TestBuildFromContainerd(t *testing.T) {
 	nerdtest.Setup()
 
 	testCase := &test.Case{
-		Require: test.Require(
+		Require: require.All(
 			nerdtest.Build,
-			test.Not(nerdtest.Docker),
+			require.Not(nerdtest.Docker),
 		),
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier("first"))
@@ -213,7 +216,7 @@ CMD ["cat", "/hello2"]`, data.Identifier("first"))
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			return helpers.Command("run", "--rm", data.Identifier("second"))
 		},
-		Expected: test.Expects(0, nil, test.Equals("hello2\n")),
+		Expected: test.Expects(0, nil, expect.Equals("hello2\n")),
 	}
 
 	testCase.Run(t)
@@ -397,7 +400,7 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, test.Equals("1\n")),
+				Expected: test.Expects(0, nil, expect.Equals("1\n")),
 			},
 			{
 				Description: "ArgValueOverridesDefault",
@@ -410,7 +413,7 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, test.Equals("2\n")),
+				Expected: test.Expects(0, nil, expect.Equals("2\n")),
 			},
 			{
 				Description: "EmptyArgValueOverridesDefault",
@@ -423,7 +426,7 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, test.Equals("\n")),
+				Expected: test.Expects(0, nil, expect.Equals("\n")),
 			},
 			{
 				Description: "UnsetArgKeyPreservesDefault",
@@ -436,7 +439,7 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, test.Equals("1\n")),
+				Expected: test.Expects(0, nil, expect.Equals("1\n")),
 			},
 			{
 				Description: "EnvValueOverridesDefault",
@@ -452,7 +455,7 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, test.Equals("3\n")),
+				Expected: test.Expects(0, nil, expect.Equals("3\n")),
 			},
 			{
 				Description: "EmptyEnvValueOverridesDefault",
@@ -468,7 +471,7 @@ CMD echo $TEST_STRING
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, test.Equals("\n")),
+				Expected: test.Expects(0, nil, expect.Equals("\n")),
 			},
 		},
 	}
@@ -499,7 +502,7 @@ CMD ["echo", "nerdctl-build-test-string"]
 			return helpers.Command("run", "--rm", string(imageID))
 		},
 
-		Expected: test.Expects(0, nil, test.Equals("nerdctl-build-test-string\n")),
+		Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
 	}
 
 	testCase.Run(t)
@@ -526,7 +529,7 @@ LABEL name=nerdctl-build-test-label
 			return helpers.Command("inspect", data.Identifier(), "--format", "{{json .Config.Labels }}")
 		},
 
-		Expected: test.Expects(0, nil, test.Equals("{\"label\":\"test\",\"name\":\"nerdctl-build-test-label\"}\n")),
+		Expected: test.Expects(0, nil, expect.Equals("{\"label\":\"test\",\"name\":\"nerdctl-build-test-label\"}\n")),
 	}
 
 	testCase.Run(t)
@@ -561,7 +564,7 @@ CMD ["echo", "nerdctl-build-test-string"]
 					return helpers.Command("run", "--rm", data.Get("i1"))
 				},
 
-				Expected: test.Expects(0, nil, test.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 			{
 				Description: "i2",
@@ -569,7 +572,7 @@ CMD ["echo", "nerdctl-build-test-string"]
 					return helpers.Command("run", "--rm", data.Get("i2"))
 				},
 
-				Expected: test.Expects(0, nil, test.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 			{
 				Description: "i3",
@@ -577,7 +580,7 @@ CMD ["echo", "nerdctl-build-test-string"]
 					return helpers.Command("run", "--rm", data.Get("i3"))
 				},
 
-				Expected: test.Expects(0, nil, test.Equals("nerdctl-build-test-string\n")),
+				Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
 			},
 		},
 	}
@@ -589,9 +592,9 @@ func TestBuildWithContainerfile(t *testing.T) {
 	nerdtest.Setup()
 
 	testCase := &test.Case{
-		Require: test.Require(
+		Require: require.All(
 			nerdtest.Build,
-			test.Not(nerdtest.Docker),
+			require.Not(nerdtest.Docker),
 		),
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
@@ -608,7 +611,7 @@ CMD ["echo", "nerdctl-build-test-string"]
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			return helpers.Command("run", "--rm", data.Identifier())
 		},
-		Expected: test.Expects(0, nil, test.Equals("nerdctl-build-test-string\n")),
+		Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
 	}
 
 	testCase.Run(t)
@@ -639,7 +642,7 @@ CMD ["echo", "containerfile"]
 		Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 			return helpers.Command("run", "--rm", data.Identifier())
 		},
-		Expected: test.Expects(0, nil, test.Equals("dockerfile\n")),
+		Expected: test.Expects(0, nil, expect.Equals("dockerfile\n")),
 	}
 
 	testCase.Run(t)
@@ -665,7 +668,7 @@ CMD ["echo", "nerdctl-build-test-string"]
 			helpers.Ensure("build", buildCtx)
 		},
 		Command:  test.Command("images"),
-		Expected: test.Expects(0, nil, test.Contains("<none>")),
+		Expected: test.Expects(0, nil, expect.Contains("<none>")),
 	}
 
 	testCase.Run(t)
@@ -703,9 +706,9 @@ func TestBuildContextWithCopyFromDir(t *testing.T) {
 	filename := "hello.txt"
 
 	testCase := &test.Case{
-		Require: test.Require(
+		Require: require.All(
 			nerdtest.Build,
-			test.Not(nerdtest.Docker),
+			require.Not(nerdtest.Docker),
 		),
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
@@ -739,9 +742,9 @@ func TestBuildSourceDateEpoch(t *testing.T) {
 	nerdtest.Setup()
 
 	testCase := &test.Case{
-		Require: test.Require(
+		Require: require.All(
 			nerdtest.Build,
-			test.Not(nerdtest.Docker),
+			require.Not(nerdtest.Docker),
 		),
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
@@ -772,7 +775,7 @@ CMD ["cat", "/source-date-epoch"]
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, test.Equals("1111111111\n")),
+				Expected: test.Expects(0, nil, expect.Equals("1111111111\n")),
 			},
 			{
 				Description: "2222222222",
@@ -788,7 +791,7 @@ CMD ["cat", "/source-date-epoch"]
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", data.Identifier())
 				},
-				Expected: test.Expects(0, nil, test.Equals("2222222222\n")),
+				Expected: test.Expects(0, nil, expect.Equals("2222222222\n")),
 			},
 		},
 	}
@@ -800,9 +803,9 @@ func TestBuildNetwork(t *testing.T) {
 	nerdtest.Setup()
 
 	testCase := &test.Case{
-		Require: test.Require(
+		Require: require.All(
 			nerdtest.Build,
-			test.Not(nerdtest.Docker),
+			require.Not(nerdtest.Docker),
 		),
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			helpers.Anyhow("rmi", "-f", data.Identifier())
@@ -861,9 +864,9 @@ func TestBuildAttestation(t *testing.T) {
 	const testProvenanceFileName = "provenance.json"
 
 	testCase := &test.Case{
-		Require: test.Require(
+		Require: require.All(
 			nerdtest.Build,
-			test.Not(nerdtest.Docker),
+			require.Not(nerdtest.Docker),
 		),
 		Cleanup: func(data test.Data, helpers test.Helpers) {
 			if nerdtest.IsDocker() {
@@ -962,7 +965,7 @@ func TestBuildAddHost(t *testing.T) {
 	nerdtest.Setup()
 
 	testCase := &test.Case{
-		Require: test.Require(
+		Require: require.All(
 			nerdtest.Build,
 		),
 		Cleanup: func(data test.Data, helpers test.Helpers) {
diff --git a/cmd/nerdctl/builder/builder_builder_test.go b/cmd/nerdctl/builder/builder_builder_test.go
index f1092680..57c1a864 100644
--- a/cmd/nerdctl/builder/builder_builder_test.go
+++ b/cmd/nerdctl/builder/builder_builder_test.go
@@ -26,9 +26,11 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestBuilder(t *testing.T) {
@@ -36,9 +38,9 @@ func TestBuilder(t *testing.T) {
 
 	testCase := &test.Case{
 		NoParallel: true,
-		Require: test.Require(
+		Require: require.All(
 			nerdtest.Build,
-			test.Not(test.Windows),
+			require.Not(require.Windows),
 		),
 		SubTests: []*test.Case{
 			{
@@ -72,7 +74,7 @@ CMD ["echo", "nerdctl-test-builder-prune"]`, testutil.CommonImage)
 			{
 				Description: "Debug",
 				// `nerdctl builder debug` is currently incompatible with `docker buildx debug`.
-				Require:    test.Require(test.Not(nerdtest.Docker)),
+				Require:    require.All(require.Not(nerdtest.Docker)),
 				NoParallel: true,
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					dockerfile := fmt.Sprintf(`FROM %s
diff --git a/cmd/nerdctl/completion/completion_test.go b/cmd/nerdctl/completion/completion_test.go
index 84ba1377..23bdf833 100644
--- a/cmd/nerdctl/completion/completion_test.go
+++ b/cmd/nerdctl/completion/completion_test.go
@@ -19,9 +19,12 @@ package completion
 import (
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestMain(m *testing.M) {
@@ -32,7 +35,7 @@ func TestCompletion(t *testing.T) {
 	nerdtest.Setup()
 
 	testCase := &test.Case{
-		Require: test.Not(nerdtest.Docker),
+		Require: require.Not(nerdtest.Docker),
 		Setup: func(data test.Data, helpers test.Helpers) {
 			identifier := data.Identifier()
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
@@ -48,49 +51,49 @@ func TestCompletion(t *testing.T) {
 		SubTests: []*test.Case{
 			{
 				Description: "--cgroup-manager",
-				Require:     test.Not(test.Windows),
+				Require:     require.Not(require.Windows),
 				Command:     test.Command("__complete", "--cgroup-manager", ""),
-				Expected:    test.Expects(0, nil, test.Contains("cgroupfs\n")),
+				Expected:    test.Expects(0, nil, expect.Contains("cgroupfs\n")),
 			},
 			{
 				Description: "--snapshotter",
-				Require:     test.Not(test.Windows),
+				Require:     require.Not(require.Windows),
 				Command:     test.Command("__complete", "--snapshotter", ""),
-				Expected:    test.Expects(0, nil, test.Contains("native\n")),
+				Expected:    test.Expects(0, nil, expect.Contains("native\n")),
 			},
 			{
 				Description: "empty",
 				Command:     test.Command("__complete", ""),
-				Expected:    test.Expects(0, nil, test.Contains("run\t")),
+				Expected:    test.Expects(0, nil, expect.Contains("run\t")),
 			},
 			{
 				Description: "build --network",
 				Command:     test.Command("__complete", "build", "--network", ""),
-				Expected:    test.Expects(0, nil, test.Contains("default\n")),
+				Expected:    test.Expects(0, nil, expect.Contains("default\n")),
 			},
 			{
 				Description: "run -",
 				Command:     test.Command("__complete", "run", "-"),
-				Expected:    test.Expects(0, nil, test.Contains("--network\t")),
+				Expected:    test.Expects(0, nil, expect.Contains("--network\t")),
 			},
 			{
 				Description: "run --n",
 				Command:     test.Command("__complete", "run", "--n"),
-				Expected:    test.Expects(0, nil, test.Contains("--network\t")),
+				Expected:    test.Expects(0, nil, expect.Contains("--network\t")),
 			},
 			{
 				Description: "run --ne",
 				Command:     test.Command("__complete", "run", "--ne"),
-				Expected:    test.Expects(0, nil, test.Contains("--network\t")),
+				Expected:    test.Expects(0, nil, expect.Contains("--network\t")),
 			},
 			{
 				Description: "run --net",
 				Command:     test.Command("__complete", "run", "--net", ""),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.All(
-							test.Contains("host\n"),
-							test.Contains(data.Get("identifier")+"\n"),
+						Output: expect.All(
+							expect.Contains("host\n"),
+							expect.Contains(data.Get("identifier")+"\n"),
 						),
 					}
 				},
@@ -100,9 +103,9 @@ func TestCompletion(t *testing.T) {
 				Command:     test.Command("__complete", "run", "-it", "--net", ""),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.All(
-							test.Contains("host\n"),
-							test.Contains(data.Get("identifier")+"\n"),
+						Output: expect.All(
+							expect.Contains("host\n"),
+							expect.Contains(data.Get("identifier")+"\n"),
 						),
 					}
 				},
@@ -112,9 +115,9 @@ func TestCompletion(t *testing.T) {
 				Command:     test.Command("__complete", "run", "-it", "--rm", "--net", ""),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.All(
-							test.Contains("host\n"),
-							test.Contains(data.Get("identifier")+"\n"),
+						Output: expect.All(
+							expect.Contains("host\n"),
+							expect.Contains(data.Get("identifier")+"\n"),
 						),
 					}
 				},
@@ -122,27 +125,27 @@ func TestCompletion(t *testing.T) {
 			{
 				Description: "run --restart",
 				Command:     test.Command("__complete", "run", "--restart", ""),
-				Expected:    test.Expects(0, nil, test.Contains("always\n")),
+				Expected:    test.Expects(0, nil, expect.Contains("always\n")),
 			},
 			{
 				Description: "network --rm",
 				Command:     test.Command("__complete", "network", "rm", ""),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.All(
-							test.DoesNotContain("host\n"),
-							test.Contains(data.Get("identifier")+"\n"),
+						Output: expect.All(
+							expect.DoesNotContain("host\n"),
+							expect.Contains(data.Get("identifier")+"\n"),
 						),
 					}
 				},
 			},
 			{
 				Description: "run --cap-add",
-				Require:     test.Not(test.Windows),
+				Require:     require.Not(require.Windows),
 				Command:     test.Command("__complete", "run", "--cap-add", ""),
-				Expected: test.Expects(0, nil, test.All(
-					test.Contains("sys_admin\n"),
-					test.DoesNotContain("CAP_SYS_ADMIN\n"),
+				Expected: test.Expects(0, nil, expect.All(
+					expect.Contains("sys_admin\n"),
+					expect.DoesNotContain("CAP_SYS_ADMIN\n"),
 				)),
 			},
 			{
@@ -150,7 +153,7 @@ func TestCompletion(t *testing.T) {
 				Command:     test.Command("__complete", "volume", "inspect", ""),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.Contains(data.Get("identifier") + "\n"),
+						Output: expect.Contains(data.Get("identifier") + "\n"),
 					}
 				},
 			},
@@ -159,24 +162,24 @@ func TestCompletion(t *testing.T) {
 				Command:     test.Command("__complete", "volume", "rm", ""),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.Contains(data.Get("identifier") + "\n"),
+						Output: expect.Contains(data.Get("identifier") + "\n"),
 					}
 				},
 			},
 			{
 				Description: "no namespace --cgroup-manager",
-				Require:     test.Not(test.Windows),
+				Require:     require.Not(require.Windows),
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Custom("nerdctl", "__complete", "--cgroup-manager", "")
 				},
-				Expected: test.Expects(0, nil, test.Contains("cgroupfs\n")),
+				Expected: test.Expects(0, nil, expect.Contains("cgroupfs\n")),
 			},
 			{
 				Description: "no namespace empty",
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Custom("nerdctl", "__complete", "")
 				},
-				Expected: test.Expects(0, nil, test.Contains("run\t")),
+				Expected: test.Expects(0, nil, expect.Contains("run\t")),
 			},
 			{
 				Description: "namespace space empty",
@@ -184,22 +187,22 @@ func TestCompletion(t *testing.T) {
 					// mind {"--namespace=nerdctl-test"} vs {"--namespace", "nerdctl-test"}
 					return helpers.Custom("nerdctl", "__complete", "--namespace", string(helpers.Read(nerdtest.Namespace)), "")
 				},
-				Expected: test.Expects(0, nil, test.Contains("run\t")),
+				Expected: test.Expects(0, nil, expect.Contains("run\t")),
 			},
 			{
 				Description: "run -i",
 				Command:     test.Command("__complete", "run", "-i", ""),
-				Expected:    test.Expects(0, nil, test.Contains(testutil.CommonImage)),
+				Expected:    test.Expects(0, nil, expect.Contains(testutil.CommonImage)),
 			},
 			{
 				Description: "run -it",
 				Command:     test.Command("__complete", "run", "-it", ""),
-				Expected:    test.Expects(0, nil, test.Contains(testutil.CommonImage)),
+				Expected:    test.Expects(0, nil, expect.Contains(testutil.CommonImage)),
 			},
 			{
 				Description: "run -it --rm",
 				Command:     test.Command("__complete", "run", "-it", "--rm", ""),
-				Expected:    test.Expects(0, nil, test.Contains(testutil.CommonImage)),
+				Expected:    test.Expects(0, nil, expect.Contains(testutil.CommonImage)),
 			},
 			{
 				Description: "namespace run -i",
@@ -207,7 +210,7 @@ func TestCompletion(t *testing.T) {
 					// mind {"--namespace=nerdctl-test"} vs {"--namespace", "nerdctl-test"}
 					return helpers.Custom("nerdctl", "__complete", "--namespace", string(helpers.Read(nerdtest.Namespace)), "run", "-i", "")
 				},
-				Expected: test.Expects(0, nil, test.Contains(testutil.CommonImage+"\n")),
+				Expected: test.Expects(0, nil, expect.Contains(testutil.CommonImage+"\n")),
 			},
 		},
 	}
diff --git a/cmd/nerdctl/container/container_attach_linux_test.go b/cmd/nerdctl/container/container_attach_linux_test.go
index 6b550bf3..d2f5a7b7 100644
--- a/cmd/nerdctl/container/container_attach_linux_test.go
+++ b/cmd/nerdctl/container/container_attach_linux_test.go
@@ -25,9 +25,11 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 /*
@@ -90,8 +92,8 @@ func TestAttach(t *testing.T) {
 		return &test.Expected{
 			ExitCode: ex,
 			Errors:   []error{errors.New("read detach keys")},
-			Output: test.All(
-				test.Contains("markmark"),
+			Output: expect.All(
+				expect.Contains("markmark"),
 				func(stdout string, info string, t *testing.T) {
 					assert.Assert(t, strings.Contains(helpers.Capture("inspect", "--format", "json", data.Identifier()), "\"Running\":true"))
 				},
@@ -153,8 +155,8 @@ func TestAttachDetachKeys(t *testing.T) {
 		return &test.Expected{
 			ExitCode: ex,
 			Errors:   []error{errors.New("read detach keys")},
-			Output: test.All(
-				test.Contains("markmark"),
+			Output: expect.All(
+				expect.Contains("markmark"),
 				func(stdout string, info string, t *testing.T) {
 					assert.Assert(t, strings.Contains(helpers.Capture("inspect", "--format", "json", data.Identifier()), "\"Running\":true"))
 				},
@@ -206,8 +208,8 @@ func TestAttachForAutoRemovedContainer(t *testing.T) {
 	testCase.Expected = func(data test.Data, helpers test.Helpers) *test.Expected {
 		return &test.Expected{
 			ExitCode: 42,
-			Output: test.All(
-				test.Contains("markmark"),
+			Output: expect.All(
+				expect.Contains("markmark"),
 				func(stdout string, info string, t *testing.T) {
 					assert.Assert(t, !strings.Contains(helpers.Capture("ps", "-a"), data.Identifier()))
 				},
diff --git a/cmd/nerdctl/container/container_commit_linux_test.go b/cmd/nerdctl/container/container_commit_linux_test.go
index ca9bb15f..8da0ee01 100644
--- a/cmd/nerdctl/container/container_commit_linux_test.go
+++ b/cmd/nerdctl/container/container_commit_linux_test.go
@@ -20,9 +20,10 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestKubeCommitSave(t *testing.T) {
diff --git a/cmd/nerdctl/container/container_commit_test.go b/cmd/nerdctl/container/container_commit_test.go
index 22d3a3bf..b0744f01 100644
--- a/cmd/nerdctl/container/container_commit_test.go
+++ b/cmd/nerdctl/container/container_commit_test.go
@@ -19,9 +19,12 @@ package container
 import (
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestCommit(t *testing.T) {
@@ -51,11 +54,11 @@ func TestCommit(t *testing.T) {
 					identifier, identifier)
 				return helpers.Command("run", "--rm", identifier)
 			},
-			Expected: test.Expects(0, nil, test.Equals("hello-test-commit\n")),
+			Expected: test.Expects(0, nil, expect.Equals("hello-test-commit\n")),
 		},
 		{
 			Description: "no pause",
-			Require:     test.Not(test.Windows),
+			Require:     require.Not(require.Windows),
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				identifier := data.Identifier()
 				helpers.Anyhow("rm", "-f", identifier)
@@ -77,7 +80,7 @@ func TestCommit(t *testing.T) {
 					identifier, identifier)
 				return helpers.Command("run", "--rm", identifier)
 			},
-			Expected: test.Expects(0, nil, test.Equals("hello-test-commit\n")),
+			Expected: test.Expects(0, nil, expect.Equals("hello-test-commit\n")),
 		},
 	}
 
diff --git a/cmd/nerdctl/container/container_create_linux_test.go b/cmd/nerdctl/container/container_create_linux_test.go
index a4b3bc64..0a20ddac 100644
--- a/cmd/nerdctl/container/container_create_linux_test.go
+++ b/cmd/nerdctl/container/container_create_linux_test.go
@@ -28,12 +28,13 @@ import (
 	"gotest.tools/v3/assert"
 
 	"github.com/containerd/containerd/v2/defaults"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nettestutil"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestCreateWithLabel(t *testing.T) {
@@ -178,7 +179,7 @@ func TestCreateWithTty(t *testing.T) {
 func TestIssue2993(t *testing.T) {
 	testCase := nerdtest.Setup()
 
-	testCase.Require = test.Not(nerdtest.Docker)
+	testCase.Require = require.Not(nerdtest.Docker)
 
 	const (
 		containersPathKey = "containersPath"
diff --git a/cmd/nerdctl/container/container_create_test.go b/cmd/nerdctl/container/container_create_test.go
index 6885a1e6..8b507d37 100644
--- a/cmd/nerdctl/container/container_create_test.go
+++ b/cmd/nerdctl/container/container_create_test.go
@@ -23,10 +23,12 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestCreate(t *testing.T) {
@@ -47,7 +49,7 @@ func TestCreate(t *testing.T) {
 			NoParallel:  true,
 			Command:     test.Command("ps", "-a"),
 			// FIXME: this might get a false positive if other tests have created a container
-			Expected: test.Expects(0, nil, test.Contains("Created")),
+			Expected: test.Expects(0, nil, expect.Contains("Created")),
 		},
 		{
 			Description: "start",
@@ -63,7 +65,7 @@ func TestCreate(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("logs", data.Get("cID"))
 			},
-			Expected: test.Expects(0, nil, test.Contains("foo")),
+			Expected: test.Expects(0, nil, expect.Contains("foo")),
 		},
 	}
 
@@ -90,7 +92,7 @@ func TestCreateHyperVContainer(t *testing.T) {
 			NoParallel:  true,
 			Command:     test.Command("ps", "-a"),
 			// FIXME: this might get a false positive if other tests have created a container
-			Expected: test.Expects(0, nil, test.Contains("Created")),
+			Expected: test.Expects(0, nil, expect.Contains("Created")),
 		},
 		{
 			Description: "start",
@@ -101,7 +103,7 @@ func TestCreateHyperVContainer(t *testing.T) {
 				for i := 0; i < 10 && !ran; i++ {
 					helpers.Command("container", "inspect", data.Get("cID")).
 						Run(&test.Expected{
-							ExitCode: test.ExitCodeNoCheck,
+							ExitCode: expect.ExitCodeNoCheck,
 							Output: func(stdout string, info string, t *testing.T) {
 								var dc []dockercompat.Container
 								err := json.Unmarshal([]byte(stdout), &dc)
@@ -119,7 +121,7 @@ func TestCreateHyperVContainer(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("logs", data.Get("cID"))
 			},
-			Expected: test.Expects(0, nil, test.Contains("foo")),
+			Expected: test.Expects(0, nil, expect.Contains("foo")),
 		},
 	}
 
diff --git a/cmd/nerdctl/container/container_diff_test.go b/cmd/nerdctl/container/container_diff_test.go
index b47631dd..07e0cb4f 100644
--- a/cmd/nerdctl/container/container_diff_test.go
+++ b/cmd/nerdctl/container/container_diff_test.go
@@ -19,9 +19,12 @@ package container
 import (
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestDiff(t *testing.T) {
@@ -33,7 +36,7 @@ func TestDiff(t *testing.T) {
 		testCase.NoParallel = true
 	}
 
-	testCase.Require = test.Not(test.Windows)
+	testCase.Require = require.Not(require.Windows)
 
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
 		helpers.Ensure("run", "-d", "--name", data.Identifier(), testutil.CommonImage,
@@ -48,11 +51,11 @@ func TestDiff(t *testing.T) {
 		return helpers.Command("diff", data.Identifier())
 	}
 
-	testCase.Expected = test.Expects(0, nil, test.All(
-		test.Contains("A /a"),
-		test.Contains("C /bin"),
-		test.Contains("A /bin/b"),
-		test.Contains("D /bin/base64"),
+	testCase.Expected = test.Expects(0, nil, expect.All(
+		expect.Contains("A /a"),
+		expect.Contains("C /bin"),
+		expect.Contains("A /bin/b"),
+		expect.Contains("D /bin/base64"),
 	))
 
 	testCase.Run(t)
diff --git a/cmd/nerdctl/container/container_exec_linux_test.go b/cmd/nerdctl/container/container_exec_linux_test.go
index 917c8cc5..c5624085 100644
--- a/cmd/nerdctl/container/container_exec_linux_test.go
+++ b/cmd/nerdctl/container/container_exec_linux_test.go
@@ -19,9 +19,11 @@ package container
 import (
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestExecWithUser(t *testing.T) {
@@ -74,7 +76,7 @@ func TestExecTTY(t *testing.T) {
 				cmd.WithPseudoTTY()
 				return cmd
 			},
-			Expected: test.Expects(0, nil, test.Contains(sttyPartialOutput)),
+			Expected: test.Expects(0, nil, expect.Contains(sttyPartialOutput)),
 		},
 		{
 			Description: "stty with -t",
@@ -83,7 +85,7 @@ func TestExecTTY(t *testing.T) {
 				cmd.WithPseudoTTY()
 				return cmd
 			},
-			Expected: test.Expects(0, nil, test.Contains(sttyPartialOutput)),
+			Expected: test.Expects(0, nil, expect.Contains(sttyPartialOutput)),
 		},
 		{
 			Description: "stty with -i",
@@ -92,7 +94,7 @@ func TestExecTTY(t *testing.T) {
 				cmd.WithPseudoTTY()
 				return cmd
 			},
-			Expected: test.Expects(test.ExitCodeGenericFail, nil, nil),
+			Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 		},
 		{
 			Description: "stty without params",
@@ -101,7 +103,7 @@ func TestExecTTY(t *testing.T) {
 				cmd.WithPseudoTTY()
 				return cmd
 			},
-			Expected: test.Expects(test.ExitCodeGenericFail, nil, nil),
+			Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 		},
 	}
 
diff --git a/cmd/nerdctl/container/container_inspect_linux_test.go b/cmd/nerdctl/container/container_inspect_linux_test.go
index 2fadc2b5..2c7bc7b8 100644
--- a/cmd/nerdctl/container/container_inspect_linux_test.go
+++ b/cmd/nerdctl/container/container_inspect_linux_test.go
@@ -18,14 +18,18 @@ package container
 
 import (
 	"fmt"
+	"os"
+	"slices"
 	"strings"
 	"testing"
 
 	"github.com/docker/go-connections/nat"
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/v2/pkg/infoutil"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/labels"
+	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 )
 
@@ -68,13 +72,12 @@ func TestContainerInspectContainsMounts(t *testing.T) {
 		testutil.NginxAlpineImage).AssertOK()
 
 	inspect := base.InspectContainer(testContainer)
-
 	// convert array to map to get by key of Destination
 	actual := make(map[string]dockercompat.MountPoint)
 	for i := range inspect.Mounts {
 		actual[inspect.Mounts[i].Destination] = inspect.Mounts[i]
 	}
-
+	t.Logf("actual in TestContainerInspectContainsMounts: %+v", actual)
 	const localDriver = "local"
 
 	expected := []struct {
@@ -229,3 +232,234 @@ func TestContainerInspectState(t *testing.T) {
 	}
 
 }
+
+func TestContainerInspectHostConfig(t *testing.T) {
+	testContainer := testutil.Identifier(t)
+	if rootlessutil.IsRootless() && infoutil.CgroupsVersion() == "1" {
+		t.Skip("test skipped for rootless containers on cgroup v1")
+	}
+
+	base := testutil.NewBase(t)
+	defer base.Cmd("rm", "-f", testContainer).Run()
+
+	// Run a container with various HostConfig options
+	base.Cmd("run", "-d", "--name", testContainer,
+		"--cpuset-cpus", "0-1",
+		"--cpuset-mems", "0",
+		"--blkio-weight", "500",
+		"--cpu-shares", "1024",
+		"--cpu-quota", "100000",
+		"--group-add", "1000",
+		"--group-add", "2000",
+		"--add-host", "host1:10.0.0.1",
+		"--add-host", "host2:10.0.0.2",
+		"--ipc", "host",
+		"--memory", "512m",
+		"--read-only",
+		"--shm-size", "256m",
+		"--uts", "host",
+		"--sysctl", "net.core.somaxconn=1024",
+		"--runtime", "io.containerd.runc.v2",
+		testutil.AlpineImage, "sleep", "infinity").AssertOK()
+
+	inspect := base.InspectContainer(testContainer)
+
+	assert.Equal(t, "0-1", inspect.HostConfig.CPUSetCPUs)
+	assert.Equal(t, "0", inspect.HostConfig.CPUSetMems)
+	assert.Equal(t, uint16(500), inspect.HostConfig.BlkioWeight)
+	assert.Equal(t, uint64(1024), inspect.HostConfig.CPUShares)
+	assert.Equal(t, int64(100000), inspect.HostConfig.CPUQuota)
+	assert.Assert(t, slices.Contains(inspect.HostConfig.GroupAdd, "1000"), "Expected '1000' to be in GroupAdd")
+	assert.Assert(t, slices.Contains(inspect.HostConfig.GroupAdd, "2000"), "Expected '2000' to be in GroupAdd")
+	expectedExtraHosts := []string{"host1:10.0.0.1", "host2:10.0.0.2"}
+	assert.DeepEqual(t, expectedExtraHosts, inspect.HostConfig.ExtraHosts)
+	assert.Equal(t, "host", inspect.HostConfig.IpcMode)
+	assert.Equal(t, int64(536870912), inspect.HostConfig.Memory)
+	assert.Equal(t, int64(1073741824), inspect.HostConfig.MemorySwap)
+	assert.Equal(t, true, inspect.HostConfig.ReadonlyRootfs)
+	assert.Equal(t, "host", inspect.HostConfig.UTSMode)
+	assert.Equal(t, int64(268435456), inspect.HostConfig.ShmSize)
+}
+
+func TestContainerInspectHostConfigDefaults(t *testing.T) {
+	testContainer := testutil.Identifier(t)
+
+	base := testutil.NewBase(t)
+	defer base.Cmd("rm", "-f", testContainer).Run()
+
+	var hc hostConfigValues
+
+	// Hostconfig default values differ with Docker.
+	// This is because we directly retrieve the configured values instead of using preset defaults.
+	if testutil.GetTarget() == testutil.Docker {
+		hc.Driver = ""
+		hc.GroupAddSize = 0
+		hc.ShmSize = int64(67108864) // Docker default 64M
+		hc.Runtime = "runc"
+	} else {
+		hc.GroupAddSize = 10
+		hc.Driver = "json-file"
+		hc.ShmSize = int64(0)
+		hc.Runtime = "io.containerd.runc.v2"
+	}
+
+	// Run a container without specifying HostConfig options
+	base.Cmd("run", "-d", "--name", testContainer, testutil.AlpineImage, "sleep", "infinity").AssertOK()
+
+	inspect := base.InspectContainer(testContainer)
+	t.Logf("HostConfig in TestContainerInspectHostConfigDefaults: %+v", inspect.HostConfig)
+	assert.Equal(t, "", inspect.HostConfig.CPUSetCPUs)
+	assert.Equal(t, "", inspect.HostConfig.CPUSetMems)
+	assert.Equal(t, uint16(0), inspect.HostConfig.BlkioWeight)
+	assert.Equal(t, uint64(0), inspect.HostConfig.CPUShares)
+	assert.Equal(t, int64(0), inspect.HostConfig.CPUQuota)
+	assert.Equal(t, hc.GroupAddSize, len(inspect.HostConfig.GroupAdd))
+	assert.Equal(t, 0, len(inspect.HostConfig.ExtraHosts))
+	assert.Equal(t, "private", inspect.HostConfig.IpcMode)
+	assert.Equal(t, hc.Driver, inspect.HostConfig.LogConfig.Driver)
+	assert.Equal(t, int64(0), inspect.HostConfig.Memory)
+	assert.Equal(t, int64(0), inspect.HostConfig.MemorySwap)
+	assert.Equal(t, bool(false), inspect.HostConfig.OomKillDisable)
+	assert.Equal(t, bool(false), inspect.HostConfig.ReadonlyRootfs)
+	assert.Equal(t, "", inspect.HostConfig.UTSMode)
+	assert.Equal(t, hc.ShmSize, inspect.HostConfig.ShmSize)
+	assert.Equal(t, hc.Runtime, inspect.HostConfig.Runtime)
+	assert.Equal(t, 0, len(inspect.HostConfig.Sysctls))
+	assert.Equal(t, 0, len(inspect.HostConfig.Devices))
+}
+
+func TestContainerInspectHostConfigDNS(t *testing.T) {
+	testContainer := testutil.Identifier(t)
+
+	base := testutil.NewBase(t)
+	defer base.Cmd("rm", "-f", testContainer).Run()
+
+	// Run a container with DNS options
+	base.Cmd("run", "-d", "--name", testContainer,
+		"--dns", "8.8.8.8",
+		"--dns", "1.1.1.1",
+		"--dns-search", "example.com",
+		"--dns-search", "test.local",
+		"--dns-option", "ndots:5",
+		"--dns-option", "timeout:3",
+		testutil.AlpineImage, "sleep", "infinity").AssertOK()
+
+	inspect := base.InspectContainer(testContainer)
+
+	// Check DNS servers
+	expectedDNSServers := []string{"8.8.8.8", "1.1.1.1"}
+	assert.DeepEqual(t, expectedDNSServers, inspect.HostConfig.DNS)
+
+	// Check DNS search domains
+	expectedDNSSearch := []string{"example.com", "test.local"}
+	assert.DeepEqual(t, expectedDNSSearch, inspect.HostConfig.DNSSearch)
+
+	// Check DNS options
+	expectedDNSOptions := []string{"ndots:5", "timeout:3"}
+	assert.DeepEqual(t, expectedDNSOptions, inspect.HostConfig.DNSOptions)
+}
+
+func TestContainerInspectHostConfigDNSDefaults(t *testing.T) {
+	testContainer := testutil.Identifier(t)
+
+	base := testutil.NewBase(t)
+	defer base.Cmd("rm", "-f", testContainer).Run()
+
+	// Run a container without specifying DNS options
+	base.Cmd("run", "-d", "--name", testContainer, testutil.AlpineImage, "sleep", "infinity").AssertOK()
+
+	inspect := base.InspectContainer(testContainer)
+
+	// Check that DNS settings are empty by default
+	assert.Equal(t, 0, len(inspect.HostConfig.DNS))
+	assert.Equal(t, 0, len(inspect.HostConfig.DNSSearch))
+	assert.Equal(t, 0, len(inspect.HostConfig.DNSOptions))
+}
+
+func TestContainerInspectHostConfigPID(t *testing.T) {
+	testContainer1 := testutil.Identifier(t) + "-container1"
+	testContainer2 := testutil.Identifier(t) + "-container2"
+
+	base := testutil.NewBase(t)
+	defer base.Cmd("rm", "-f", testContainer1, testContainer2).Run()
+
+	// Run the first container
+	base.Cmd("run", "-d", "--name", testContainer1, testutil.AlpineImage, "sleep", "infinity").AssertOK()
+
+	containerID1 := strings.TrimSpace(base.Cmd("inspect", "-f", "{{.Id}}", testContainer1).Out())
+
+	var hc hostConfigValues
+
+	if testutil.GetTarget() == testutil.Docker {
+		hc.PidMode = "container:" + containerID1
+	} else {
+		hc.PidMode = containerID1
+	}
+
+	base.Cmd("run", "-d", "--name", testContainer2,
+		"--pid", fmt.Sprintf("container:%s", testContainer1),
+		testutil.AlpineImage, "sleep", "infinity").AssertOK()
+
+	inspect := base.InspectContainer(testContainer2)
+
+	assert.Equal(t, hc.PidMode, inspect.HostConfig.PidMode)
+
+}
+
+func TestContainerInspectHostConfigPIDDefaults(t *testing.T) {
+	testContainer := testutil.Identifier(t)
+
+	base := testutil.NewBase(t)
+	defer base.Cmd("rm", "-f", testContainer).Run()
+
+	base.Cmd("run", "-d", "--name", testContainer, testutil.AlpineImage, "sleep", "infinity").AssertOK()
+
+	inspect := base.InspectContainer(testContainer)
+
+	assert.Equal(t, "", inspect.HostConfig.PidMode)
+}
+
+func TestContainerInspectDevices(t *testing.T) {
+	testContainer := testutil.Identifier(t)
+
+	base := testutil.NewBase(t)
+	defer base.Cmd("rm", "-f", testContainer).Run()
+
+	if rootlessutil.IsRootless() && infoutil.CgroupsVersion() == "1" {
+		t.Skip("test skipped for rootless containers on cgroup v1")
+	}
+
+	// Create a temporary directory
+	dir, err := os.MkdirTemp(t.TempDir(), "device-dir")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if testutil.GetTarget() == testutil.Docker {
+		dir = "/dev/zero"
+	}
+
+	// Run the container with the directory mapped as a device
+	base.Cmd("run", "-d", "--name", testContainer,
+		"--device", dir+":/dev/xvda",
+		testutil.AlpineImage, "sleep", "infinity").AssertOK()
+
+	inspect := base.InspectContainer(testContainer)
+
+	expectedDevices := []dockercompat.DeviceMapping{
+		{
+			PathOnHost:        dir,
+			PathInContainer:   "/dev/xvda",
+			CgroupPermissions: "rwm",
+		},
+	}
+	assert.DeepEqual(t, expectedDevices, inspect.HostConfig.Devices)
+}
+
+type hostConfigValues struct {
+	Driver       string
+	ShmSize      int64
+	PidMode      string
+	GroupAddSize int
+	Runtime      string
+}
diff --git a/cmd/nerdctl/container/container_logs_test.go b/cmd/nerdctl/container/container_logs_test.go
index b15fc4c0..449e7803 100644
--- a/cmd/nerdctl/container/container_logs_test.go
+++ b/cmd/nerdctl/container/container_logs_test.go
@@ -27,9 +27,12 @@ import (
 	"gotest.tools/v3/assert"
 	"gotest.tools/v3/icmd"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestLogs(t *testing.T) {
@@ -164,7 +167,7 @@ func TestLogsWithFailingContainer(t *testing.T) {
 func TestLogsWithForegroundContainers(t *testing.T) {
 	testCase := nerdtest.Setup()
 	// dual logging is not supported on Windows
-	testCase.Require = test.Not(test.Windows)
+	testCase.Require = require.Not(require.Windows)
 
 	testCase.Run(t)
 
@@ -180,10 +183,10 @@ func TestLogsWithForegroundContainers(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("logs", data.Identifier())
 			},
-			Expected: test.Expects(0, nil, test.All(
-				test.Contains("foo"),
-				test.Contains("bar"),
-				test.DoesNotContain("baz"),
+			Expected: test.Expects(0, nil, expect.All(
+				expect.Contains("foo"),
+				expect.Contains("bar"),
+				expect.DoesNotContain("baz"),
 			)),
 		},
 		{
@@ -197,10 +200,10 @@ func TestLogsWithForegroundContainers(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("logs", data.Identifier())
 			},
-			Expected: test.Expects(0, nil, test.All(
-				test.Contains("foo"),
-				test.Contains("bar"),
-				test.DoesNotContain("baz"),
+			Expected: test.Expects(0, nil, expect.All(
+				expect.Contains("foo"),
+				expect.Contains("bar"),
+				expect.DoesNotContain("baz"),
 			)),
 		},
 		{
@@ -216,10 +219,10 @@ func TestLogsWithForegroundContainers(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("logs", data.Identifier())
 			},
-			Expected: test.Expects(0, nil, test.All(
-				test.Contains("foo"),
-				test.Contains("bar"),
-				test.DoesNotContain("baz"),
+			Expected: test.Expects(0, nil, expect.All(
+				expect.Contains("foo"),
+				expect.Contains("bar"),
+				expect.DoesNotContain("baz"),
 			)),
 		},
 		{
@@ -235,10 +238,10 @@ func TestLogsWithForegroundContainers(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("logs", data.Identifier())
 			},
-			Expected: test.Expects(0, nil, test.All(
-				test.Contains("foo"),
-				test.Contains("bar"),
-				test.DoesNotContain("baz"),
+			Expected: test.Expects(0, nil, expect.All(
+				expect.Contains("foo"),
+				expect.Contains("bar"),
+				expect.DoesNotContain("baz"),
 			)),
 		},
 	}
diff --git a/cmd/nerdctl/container/container_prune_linux_test.go b/cmd/nerdctl/container/container_prune_linux_test.go
index 4ff48954..c9e4b9a8 100644
--- a/cmd/nerdctl/container/container_prune_linux_test.go
+++ b/cmd/nerdctl/container/container_prune_linux_test.go
@@ -19,9 +19,10 @@ package container
 import (
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestPruneContainer(t *testing.T) {
diff --git a/cmd/nerdctl/container/container_remove_test.go b/cmd/nerdctl/container/container_remove_test.go
index 36c81c2c..8c3d8354 100644
--- a/cmd/nerdctl/container/container_remove_test.go
+++ b/cmd/nerdctl/container/container_remove_test.go
@@ -19,9 +19,10 @@ package container
 import (
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestRemoveContainer(t *testing.T) {
diff --git a/cmd/nerdctl/container/container_restart_linux_test.go b/cmd/nerdctl/container/container_restart_linux_test.go
index 231b0128..95b40409 100644
--- a/cmd/nerdctl/container/container_restart_linux_test.go
+++ b/cmd/nerdctl/container/container_restart_linux_test.go
@@ -25,9 +25,11 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestRestart(t *testing.T) {
@@ -144,9 +146,9 @@ func TestRestartWithSignal(t *testing.T) {
 		return &test.Expected{
 			// Check the container did indeed exit
 			ExitCode: 137,
-			Output: test.All(
+			Output: expect.All(
 				// Check that we saw SIGUSR1 inside the container
-				test.Contains(nerdtest.SignalCaught),
+				expect.Contains(nerdtest.SignalCaught),
 				func(stdout string, info string, t *testing.T) {
 					// Ensure the container was restarted
 					nerdtest.EnsureContainerStarted(helpers, data.Identifier())
diff --git a/cmd/nerdctl/container/container_run_cgroup_linux_test.go b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
index c4b5c77d..287d3729 100644
--- a/cmd/nerdctl/container/container_run_cgroup_linux_test.go
+++ b/cmd/nerdctl/container/container_run_cgroup_linux_test.go
@@ -30,12 +30,12 @@ import (
 	"github.com/containerd/cgroups/v3"
 	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/continuity/testutil/loopback"
+	"github.com/containerd/nerdctl/mod/tigron/require"
 
 	"github.com/containerd/nerdctl/v2/pkg/cmd/container"
 	"github.com/containerd/nerdctl/v2/pkg/idutil/containerwalker"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestRunCgroupV2(t *testing.T) {
@@ -178,7 +178,7 @@ func TestRunCgroupV1(t *testing.T) {
 func TestIssue3781(t *testing.T) {
 	t.Parallel()
 	testCase := nerdtest.Setup()
-	testCase.Require = test.Not(nerdtest.Docker)
+	testCase.Require = require.Not(nerdtest.Docker)
 
 	base := testutil.NewBase(t)
 	info := base.Info()
diff --git a/cmd/nerdctl/container/container_run_linux_test.go b/cmd/nerdctl/container/container_run_linux_test.go
index 8fcd8e0b..c0c37615 100644
--- a/cmd/nerdctl/container/container_run_linux_test.go
+++ b/cmd/nerdctl/container/container_run_linux_test.go
@@ -33,13 +33,15 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 	"github.com/containerd/nerdctl/v2/pkg/strutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nettestutil"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestRunCustomRootfs(t *testing.T) {
@@ -324,7 +326,7 @@ func TestRunTTY(t *testing.T) {
 				cmd.WithPseudoTTY()
 				return cmd
 			},
-			Expected: test.Expects(0, nil, test.Contains(sttyPartialOutput)),
+			Expected: test.Expects(0, nil, expect.Contains(sttyPartialOutput)),
 		},
 		{
 			Description: "stty with -t",
@@ -336,7 +338,7 @@ func TestRunTTY(t *testing.T) {
 				cmd.WithPseudoTTY()
 				return cmd
 			},
-			Expected: test.Expects(0, nil, test.Contains(sttyPartialOutput)),
+			Expected: test.Expects(0, nil, expect.Contains(sttyPartialOutput)),
 		},
 		{
 			Description: "stty with -i",
@@ -348,7 +350,7 @@ func TestRunTTY(t *testing.T) {
 				cmd.WithPseudoTTY()
 				return cmd
 			},
-			Expected: test.Expects(test.ExitCodeGenericFail, nil, nil),
+			Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 		},
 		{
 			Description: "stty without params",
@@ -360,7 +362,7 @@ func TestRunTTY(t *testing.T) {
 				cmd.WithPseudoTTY()
 				return cmd
 			},
-			Expected: test.Expects(test.ExitCodeGenericFail, nil, nil),
+			Expected: test.Expects(expect.ExitCodeGenericFail, nil, nil),
 		},
 	}
 }
@@ -383,7 +385,7 @@ func TestRunSigProxy(t *testing.T) {
 				return cmd
 			},
 
-			Expected: test.Expects(0, nil, test.Contains(nerdtest.SignalCaught)),
+			Expected: test.Expects(0, nil, expect.Contains(nerdtest.SignalCaught)),
 		},
 		{
 			Description: "SigProxyTrue",
@@ -399,7 +401,7 @@ func TestRunSigProxy(t *testing.T) {
 				return cmd
 			},
 
-			Expected: test.Expects(0, nil, test.Contains(nerdtest.SignalCaught)),
+			Expected: test.Expects(0, nil, expect.Contains(nerdtest.SignalCaught)),
 		},
 		{
 			Description: "SigProxyFalse",
@@ -415,7 +417,7 @@ func TestRunSigProxy(t *testing.T) {
 				return cmd
 			},
 
-			Expected: test.Expects(127, nil, test.DoesNotContain(nerdtest.SignalCaught)),
+			Expected: test.Expects(127, nil, expect.DoesNotContain(nerdtest.SignalCaught)),
 		},
 	}
 
@@ -523,8 +525,8 @@ func TestRunWithDetachKeys(t *testing.T) {
 		return &test.Expected{
 			ExitCode: 0,
 			Errors:   []error{errors.New("detach keys")},
-			Output: test.All(
-				test.Contains("markmark"),
+			Output: expect.All(
+				expect.Contains("markmark"),
 				func(stdout string, info string, t *testing.T) {
 					assert.Assert(t, strings.Contains(helpers.Capture("inspect", "--format", "json", data.Identifier()), "\"Running\":true"))
 				},
@@ -591,8 +593,8 @@ func TestIssue3568(t *testing.T) {
 		return &test.Expected{
 			ExitCode: 0,
 			Errors:   []error{errors.New("detach keys")},
-			Output: test.All(
-				test.Contains("markmark"),
+			Output: expect.All(
+				expect.Contains("markmark"),
 				func(stdout string, info string, t *testing.T) {
 					assert.Assert(t, strings.Contains(helpers.Capture("inspect", "--format", "json", data.Identifier()), "\"Running\":true"))
 				},
@@ -627,7 +629,7 @@ func TestPortBindingWithCustomHost(t *testing.T) {
 				return &test.Expected{
 					ExitCode: 0,
 					Errors:   []error{},
-					Output: test.All(
+					Output: expect.All(
 						func(stdout string, info string, t *testing.T) {
 							resp, err := nettestutil.HTTPGet(address, 30, false)
 							assert.NilError(t, err)
diff --git a/cmd/nerdctl/container/container_run_mount_linux_test.go b/cmd/nerdctl/container/container_run_mount_linux_test.go
index 0e810551..f02d47d5 100644
--- a/cmd/nerdctl/container/container_run_mount_linux_test.go
+++ b/cmd/nerdctl/container/container_run_mount_linux_test.go
@@ -706,6 +706,7 @@ func TestBindMountWhenHostFolderDoesNotExist(t *testing.T) {
 	}
 	defer os.RemoveAll(hostDir)
 	hp := filepath.Join(hostDir, "does-not-exist")
+	base.Cmd("rm", "-f", containerName).AssertOK()
 	base.Cmd("run", "--name", containerName, "-d", "-v", fmt.Sprintf("%s:/tmp",
 		hp), testutil.AlpineImage).AssertOK()
 	base.Cmd("rm", "-f", containerName).AssertOK()
diff --git a/cmd/nerdctl/container/container_run_network_linux_test.go b/cmd/nerdctl/container/container_run_network_linux_test.go
index 1ffe72b3..62e8770f 100644
--- a/cmd/nerdctl/container/container_run_network_linux_test.go
+++ b/cmd/nerdctl/container/container_run_network_linux_test.go
@@ -37,13 +37,14 @@ import (
 	"github.com/containerd/containerd/v2/defaults"
 	"github.com/containerd/containerd/v2/pkg/netns"
 	"github.com/containerd/errdefs"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nettestutil"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func extractHostPort(portMapping string, port string) (string, error) {
@@ -355,7 +356,7 @@ func TestRunPort(t *testing.T) {
 func TestRunWithInvalidPortThenCleanUp(t *testing.T) {
 	testCase := nerdtest.Setup()
 	// docker does not set label restriction to 4096 bytes
-	testCase.Require = test.Not(nerdtest.Docker)
+	testCase.Require = require.Not(nerdtest.Docker)
 
 	testCase.SubTests = []*test.Case{
 		{
@@ -515,7 +516,7 @@ func TestRunNetworkHost2613(t *testing.T) {
 func TestSharedNetworkSetup(t *testing.T) {
 	nerdtest.Setup()
 	testCase := &test.Case{
-		Require: test.Not(test.Windows),
+		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
 			data.Set("containerName1", data.Identifier("-container1"))
 			containerName1 := data.Get("containerName1")
@@ -678,7 +679,7 @@ func TestSharedNetworkSetup(t *testing.T) {
 func TestSharedNetworkWithNone(t *testing.T) {
 	nerdtest.Setup()
 	testCase := &test.Case{
-		Require: test.Not(test.Windows),
+		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
 			data.Set("containerName1", data.Identifier("-container1"))
 			containerName1 := data.Get("containerName1")
@@ -921,7 +922,7 @@ func TestRunContainerWithStaticIP6(t *testing.T) {
 func TestNoneNetworkHostName(t *testing.T) {
 	nerdtest.Setup()
 	testCase := &test.Case{
-		Require: test.Not(test.Windows),
+		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
 			data.Set("containerName1", data.Identifier())
 		},
@@ -949,7 +950,7 @@ func TestNoneNetworkHostName(t *testing.T) {
 func TestHostNetworkHostName(t *testing.T) {
 	nerdtest.Setup()
 	testCase := &test.Case{
-		Require: test.Not(test.Windows),
+		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
 			data.Set("containerName1", data.Identifier())
 		},
@@ -974,7 +975,7 @@ func TestHostNetworkHostName(t *testing.T) {
 func TestNoneNetworkDnsConfigs(t *testing.T) {
 	nerdtest.Setup()
 	testCase := &test.Case{
-		Require: test.Not(test.Windows),
+		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
 			data.Set("containerName1", data.Identifier())
 		},
@@ -1003,7 +1004,7 @@ func TestNoneNetworkDnsConfigs(t *testing.T) {
 func TestHostNetworkDnsConfigs(t *testing.T) {
 	nerdtest.Setup()
 	testCase := &test.Case{
-		Require: test.Not(test.Windows),
+		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
 			data.Set("containerName1", data.Identifier())
 		},
diff --git a/cmd/nerdctl/container/container_run_stargz_linux_test.go b/cmd/nerdctl/container/container_run_stargz_linux_test.go
index 523ef5cd..3132b28f 100644
--- a/cmd/nerdctl/container/container_run_stargz_linux_test.go
+++ b/cmd/nerdctl/container/container_run_stargz_linux_test.go
@@ -19,18 +19,20 @@ package container
 import (
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestRunStargz(t *testing.T) {
 	testCase := nerdtest.Setup()
 
-	testCase.Require = test.Require(
+	testCase.Require = require.All(
 		nerdtest.Stargz,
-		test.Amd64,
-		test.Not(nerdtest.Docker),
+		require.Amd64,
+		require.Not(nerdtest.Docker),
 	)
 
 	testCase.Command = test.Command("--snapshotter=stargz", "run", "--rm", testutil.FedoraESGZImage, "ls", "/.stargz-snapshotter")
diff --git a/cmd/nerdctl/container/container_run_windows_test.go b/cmd/nerdctl/container/container_run_windows_test.go
index 843a6eac..6c054292 100644
--- a/cmd/nerdctl/container/container_run_windows_test.go
+++ b/cmd/nerdctl/container/container_run_windows_test.go
@@ -24,9 +24,11 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestRunHostProcessContainer(t *testing.T) {
@@ -141,7 +143,7 @@ func TestRunWithTtyAndDetached(t *testing.T) {
 		return helpers.Command("logs", data.Identifier("with-terminal"))
 	}
 
-	testCase.Expected = test.Expects(0, nil, test.Contains("Hello, World with TTY!"))
+	testCase.Expected = test.Expects(0, nil, expect.Contains("Hello, World with TTY!"))
 
 	testCase.Run(t)
 }
diff --git a/cmd/nerdctl/container/container_start_linux_test.go b/cmd/nerdctl/container/container_start_linux_test.go
index eda4e5d8..afd7d1d7 100644
--- a/cmd/nerdctl/container/container_start_linux_test.go
+++ b/cmd/nerdctl/container/container_start_linux_test.go
@@ -24,9 +24,11 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestStartDetachKeys(t *testing.T) {
@@ -71,7 +73,7 @@ func TestStartDetachKeys(t *testing.T) {
 		return &test.Expected{
 			ExitCode: 0,
 			Errors:   []error{errors.New("detach keys")},
-			Output: test.All(
+			Output: expect.All(
 				func(stdout string, info string, t *testing.T) {
 					assert.Assert(t, strings.Contains(helpers.Capture("inspect", "--format", "json", data.Identifier()), "\"Running\":true"))
 				},
diff --git a/cmd/nerdctl/container/container_stats_test.go b/cmd/nerdctl/container/container_stats_test.go
index 9522e73e..0648d502 100644
--- a/cmd/nerdctl/container/container_stats_test.go
+++ b/cmd/nerdctl/container/container_stats_test.go
@@ -20,21 +20,24 @@ import (
 	"runtime"
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestStats(t *testing.T) {
 	testCase := nerdtest.Setup()
 
 	// FIXME: does not seem to work on windows
-	testCase.Require = test.Not(test.Windows)
+	testCase.Require = require.Not(require.Windows)
 
 	if runtime.GOOS == "linux" {
 		// this comment is for `nerdctl ps` but it also valid for `nerdctl stats` :
 		// https://github.com/containerd/nerdctl/pull/223#issuecomment-851395178
-		testCase.Require = test.Require(
+		testCase.Require = require.All(
 			testCase.Require,
 			nerdtest.CgroupsAccessible,
 		)
@@ -59,7 +62,7 @@ func TestStats(t *testing.T) {
 			Command:     test.Command("stats", "--no-stream", "--no-trunc"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.Contains(data.Get("id")),
+					Output: expect.Contains(data.Get("id")),
 				}
 			},
 		},
@@ -68,7 +71,7 @@ func TestStats(t *testing.T) {
 			Command:     test.Command("container", "stats", "--no-stream", "--no-trunc"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.Contains(data.Get("id")),
+					Output: expect.Contains(data.Get("id")),
 				}
 			},
 		},
@@ -93,14 +96,14 @@ func TestStats(t *testing.T) {
 			},
 			// https://github.com/containerd/nerdctl/issues/1240
 			// nerdctl used to print UINT64_MAX as the memory limit, so, ensure it does no more
-			Expected: test.Expects(0, nil, test.DoesNotContain("16EiB")),
+			Expected: test.Expects(0, nil, expect.DoesNotContain("16EiB")),
 		},
 		{
 			Description: "mem limit set",
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("stats", "--no-stream")
 			},
-			Expected: test.Expects(0, nil, test.Contains("1GiB")),
+			Expected: test.Expects(0, nil, expect.Contains("1GiB")),
 		},
 	}
 
diff --git a/cmd/nerdctl/container/container_stop_linux_test.go b/cmd/nerdctl/container/container_stop_linux_test.go
index bc12485c..c9ba8874 100644
--- a/cmd/nerdctl/container/container_stop_linux_test.go
+++ b/cmd/nerdctl/container/container_stop_linux_test.go
@@ -26,12 +26,14 @@ import (
 	"github.com/coreos/go-iptables/iptables"
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	iptablesutil "github.com/containerd/nerdctl/v2/pkg/testutil/iptables"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nettestutil"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestStopStart(t *testing.T) {
@@ -89,7 +91,7 @@ func TestStopWithStopSignal(t *testing.T) {
 	}
 
 	// Verify that SIGQUIT was sent to the container AND that the container did forcefully exit
-	testCase.Expected = test.Expects(137, nil, test.Contains(nerdtest.SignalCaught))
+	testCase.Expected = test.Expects(137, nil, expect.Contains(nerdtest.SignalCaught))
 
 	testCase.Run(t)
 }
diff --git a/cmd/nerdctl/container/container_top_test.go b/cmd/nerdctl/container/container_top_test.go
index 8042b32a..6f18721b 100644
--- a/cmd/nerdctl/container/container_top_test.go
+++ b/cmd/nerdctl/container/container_top_test.go
@@ -20,9 +20,11 @@ import (
 	"runtime"
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestTop(t *testing.T) {
@@ -47,7 +49,7 @@ func TestTop(t *testing.T) {
 		{
 			Description: "with o pid,user,cmd",
 			// Docker does not support top -o
-			Require: test.Not(nerdtest.Docker),
+			Require: require.Not(nerdtest.Docker),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("top", data.Get("cID"), "-o", "pid,user,cmd")
 			},
diff --git a/cmd/nerdctl/container/container_wait_test.go b/cmd/nerdctl/container/container_wait_test.go
index 9c0c93da..fdbfd367 100644
--- a/cmd/nerdctl/container/container_wait_test.go
+++ b/cmd/nerdctl/container/container_wait_test.go
@@ -19,9 +19,11 @@ package container
 import (
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestWait(t *testing.T) {
@@ -41,7 +43,7 @@ func TestWait(t *testing.T) {
 		return helpers.Command("wait", data.Identifier("1"), data.Identifier("2"), data.Identifier("3"))
 	}
 
-	testCase.Expected = test.Expects(0, nil, test.Equals(`0
+	testCase.Expected = test.Expects(0, nil, expect.Equals(`0
 0
 123
 `))
diff --git a/cmd/nerdctl/image/image_convert_linux_test.go b/cmd/nerdctl/image/image_convert_linux_test.go
index 6968e5ab..3d261574 100644
--- a/cmd/nerdctl/image/image_convert_linux_test.go
+++ b/cmd/nerdctl/image/image_convert_linux_test.go
@@ -20,9 +20,11 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/testregistry"
 )
 
@@ -30,10 +32,10 @@ func TestImageConvert(t *testing.T) {
 	nerdtest.Setup()
 
 	testCase := &test.Case{
-		Require: test.Require(
+		Require: require.All(
 			// FIXME: windows does not support stargz
-			test.Not(test.Windows),
-			test.Not(nerdtest.Docker),
+			require.Not(require.Windows),
+			require.Not(nerdtest.Docker),
 		),
 		Setup: func(data test.Data, helpers test.Helpers) {
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
@@ -52,8 +54,8 @@ func TestImageConvert(t *testing.T) {
 			},
 			{
 				Description: "nydus",
-				Require: test.Require(
-					test.Binary("nydus-image"),
+				Require: require.All(
+					require.Binary("nydus-image"),
 				),
 				Cleanup: func(data test.Data, helpers test.Helpers) {
 					helpers.Anyhow("rmi", "-f", data.Identifier("converted-image"))
@@ -101,12 +103,12 @@ func TestImageConvertNydusVerify(t *testing.T) {
 	var registry *testregistry.RegistryServer
 
 	testCase := &test.Case{
-		Require: test.Require(
-			test.Linux,
-			test.Binary("nydus-image"),
-			test.Binary("nydusify"),
-			test.Binary("nydusd"),
-			test.Not(nerdtest.Docker),
+		Require: require.All(
+			require.Linux,
+			require.Binary("nydus-image"),
+			require.Binary("nydusify"),
+			require.Binary("nydusd"),
+			require.Not(nerdtest.Docker),
 			nerdtest.Rootful,
 		),
 		Setup: func(data test.Data, helpers test.Helpers) {
diff --git a/cmd/nerdctl/image/image_encrypt_linux_test.go b/cmd/nerdctl/image/image_encrypt_linux_test.go
index 3e2e93ac..ac883133 100644
--- a/cmd/nerdctl/image/image_encrypt_linux_test.go
+++ b/cmd/nerdctl/image/image_encrypt_linux_test.go
@@ -23,10 +23,12 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	testhelpers "github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/testregistry"
 )
 
@@ -39,9 +41,9 @@ func TestImageEncryptJWE(t *testing.T) {
 	const remoteImageKey = "remoteImageKey"
 
 	testCase := &test.Case{
-		Require: test.Require(
-			test.Linux,
-			test.Not(nerdtest.Docker),
+		Require: require.All(
+			require.Linux,
+			require.Not(nerdtest.Docker),
 			// This test needs to rmi the common image
 			nerdtest.Private,
 		),
diff --git a/cmd/nerdctl/image/image_history_test.go b/cmd/nerdctl/image/image_history_test.go
index 9520e725..f4f0d2c0 100644
--- a/cmd/nerdctl/image/image_history_test.go
+++ b/cmd/nerdctl/image/image_history_test.go
@@ -26,9 +26,11 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 type historyObj struct {
@@ -69,12 +71,12 @@ func TestImageHistory(t *testing.T) {
 	nerdtest.Setup()
 
 	testCase := &test.Case{
-		Require: test.Require(
-			test.Not(nerdtest.Docker),
+		Require: require.All(
+			require.Not(nerdtest.Docker),
 			// XXX the results here are obviously platform dependent - and it seems like windows cannot pull a linux image?
-			test.Not(test.Windows),
+			require.Not(require.Windows),
 			// XXX Currently, history does not work on non-native platform, so, we cannot test reliably on other platforms
-			test.Arm64,
+			require.Arm64,
 		),
 		Setup: func(data test.Data, helpers test.Helpers) {
 			// XXX: despite efforts to isolate this test, it keeps on having side effects linked to
diff --git a/cmd/nerdctl/image/image_inspect_test.go b/cmd/nerdctl/image/image_inspect_test.go
index 808fd199..c4bd92c9 100644
--- a/cmd/nerdctl/image/image_inspect_test.go
+++ b/cmd/nerdctl/image/image_inspect_test.go
@@ -26,10 +26,12 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestImageInspectSimpleCases(t *testing.T) {
@@ -95,10 +97,10 @@ func TestImageInspectDifferentValidReferencesForTheSameImage(t *testing.T) {
 	}
 
 	testCase := &test.Case{
-		Require: test.Require(
-			test.Not(nerdtest.Docker),
+		Require: require.All(
+			require.Not(nerdtest.Docker),
 			// FIXME: this test depends on hub images that do not have windows versions
-			test.Not(test.Windows),
+			require.Not(require.Windows),
 			// We need a clean slate
 			nerdtest.Private,
 		),
diff --git a/cmd/nerdctl/image/image_list_test.go b/cmd/nerdctl/image/image_list_test.go
index bc88386e..38b0b034 100644
--- a/cmd/nerdctl/image/image_list_test.go
+++ b/cmd/nerdctl/image/image_list_test.go
@@ -28,17 +28,20 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/tabutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestImages(t *testing.T) {
 	nerdtest.Setup()
 
 	testCase := &test.Case{
-		Require: test.Not(nerdtest.Docker),
+		Require: require.Not(nerdtest.Docker),
 		Setup: func(data test.Data, helpers test.Helpers) {
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 			helpers.Ensure("pull", "--quiet", testutil.NginxAlpineImage)
@@ -78,8 +81,8 @@ func TestImages(t *testing.T) {
 				Command:     test.Command("images", "--names", testutil.CommonImage),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.All(
-							test.Contains(testutil.CommonImage),
+						Output: expect.All(
+							expect.Contains(testutil.CommonImage),
 							func(stdout string, info string, t *testing.T) {
 								lines := strings.Split(strings.TrimSpace(stdout), "\n")
 								assert.Assert(t, len(lines) >= 2, info)
@@ -120,7 +123,7 @@ func TestImages(t *testing.T) {
 	}
 
 	if runtime.GOOS == "windows" {
-		testCase.Require = test.Require(
+		testCase.Require = require.All(
 			testCase.Require,
 			nerdtest.IsFlaky("https://github.com/containerd/nerdctl/issues/3524"),
 		)
@@ -166,7 +169,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", "label=foo=bar"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.Contains(data.Get("builtImageID")),
+						Output: expect.Contains(data.Get("builtImageID")),
 					}
 				},
 			},
@@ -175,7 +178,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", "label=foo=bar1"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.DoesNotContain(data.Get("builtImageID")),
+						Output: expect.DoesNotContain(data.Get("builtImageID")),
 					}
 				},
 			},
@@ -184,7 +187,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", "label=foo=bar", "--filter", "label=version=0.1"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.Contains(data.Get("builtImageID")),
+						Output: expect.Contains(data.Get("builtImageID")),
 					}
 				},
 			},
@@ -193,7 +196,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", "label=foo=bar", "--filter", "label=version=0.2"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.DoesNotContain(data.Get("builtImageID")),
+						Output: expect.DoesNotContain(data.Get("builtImageID")),
 					}
 				},
 			},
@@ -202,7 +205,7 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", "label=version"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.Contains(data.Get("builtImageID")),
+						Output: expect.Contains(data.Get("builtImageID")),
 					}
 				},
 			},
@@ -213,16 +216,16 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.Contains(data.Get("builtImageID")),
+						Output: expect.Contains(data.Get("builtImageID")),
 					}
 				},
 			},
 			{
 				Description: "reference=tagged*:*fragment*",
 				Command:     test.Command("images", "--filter", "reference=tagged*:*fragment*"),
-				Expected: test.Expects(0, nil, test.All(
-					test.Contains("one-"),
-					test.Contains("two-"),
+				Expected: test.Expects(0, nil, expect.All(
+					expect.Contains("one-"),
+					expect.Contains("two-"),
 				)),
 			},
 			{
@@ -232,9 +235,9 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				},
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.All(
-							test.Contains(testutil.ImageRepo(testutil.CommonImage)),
-							test.DoesNotContain(data.Get("builtImageID")),
+						Output: expect.All(
+							expect.Contains(testutil.ImageRepo(testutil.CommonImage)),
+							expect.DoesNotContain(data.Get("builtImageID")),
 						),
 					}
 				},
@@ -244,9 +247,9 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", fmt.Sprintf("since=%s", testutil.CommonImage)),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.All(
-							test.Contains(data.Get("builtImageID")),
-							test.DoesNotContain(testutil.ImageRepo(testutil.CommonImage)),
+						Output: expect.All(
+							expect.Contains(data.Get("builtImageID")),
+							expect.DoesNotContain(testutil.ImageRepo(testutil.CommonImage)),
 						),
 					}
 				},
@@ -256,9 +259,9 @@ RUN echo "actually creating a layer so that docker sets the createdAt time"
 				Command:     test.Command("images", "--filter", fmt.Sprintf("since=%s", testutil.CommonImage), testutil.CommonImage),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.All(
-							test.DoesNotContain(data.Get("builtImageID")),
-							test.DoesNotContain(testutil.ImageRepo(testutil.CommonImage)),
+						Output: expect.All(
+							expect.DoesNotContain(data.Get("builtImageID")),
+							expect.DoesNotContain(testutil.ImageRepo(testutil.CommonImage)),
 						),
 					}
 				},
@@ -310,12 +313,12 @@ CMD ["echo", "nerdctl-build-notag-string"]
 			{
 				Description: "dangling",
 				Command:     test.Command("images", "--filter", "dangling=true"),
-				Expected:    test.Expects(0, nil, test.Contains("<none>")),
+				Expected:    test.Expects(0, nil, expect.Contains("<none>")),
 			},
 			{
 				Description: "not dangling",
 				Command:     test.Command("images", "--filter", "dangling=false"),
-				Expected:    test.Expects(0, nil, test.DoesNotContain("<none>")),
+				Expected:    test.Expects(0, nil, expect.DoesNotContain("<none>")),
 			},
 		},
 	}
@@ -327,7 +330,7 @@ func TestImagesKubeWithKubeHideDupe(t *testing.T) {
 	nerdtest.Setup()
 
 	testCase := &test.Case{
-		Require: test.Require(
+		Require: require.All(
 			nerdtest.OnlyKubernetes,
 		),
 		Setup: func(data test.Data, helpers test.Helpers) {
@@ -380,7 +383,7 @@ func TestImagesKubeWithKubeHideDupe(t *testing.T) {
 				Command:     test.Command("images"),
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
-						Output: test.Contains("<none>"),
+						Output: expect.Contains("<none>"),
 					}
 				},
 			},
diff --git a/cmd/nerdctl/image/image_load_test.go b/cmd/nerdctl/image/image_load_test.go
index 4a0e170f..d9d37812 100644
--- a/cmd/nerdctl/image/image_load_test.go
+++ b/cmd/nerdctl/image/image_load_test.go
@@ -25,9 +25,12 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestLoadStdinFromPipe(t *testing.T) {
@@ -35,7 +38,7 @@ func TestLoadStdinFromPipe(t *testing.T) {
 
 	testCase := &test.Case{
 		Description: "TestLoadStdinFromPipe",
-		Require:     test.Linux,
+		Require:     require.Linux,
 		Setup: func(data test.Data, helpers test.Helpers) {
 			identifier := data.Identifier()
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
@@ -56,8 +59,8 @@ func TestLoadStdinFromPipe(t *testing.T) {
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			identifier := data.Identifier()
 			return &test.Expected{
-				Output: test.All(
-					test.Contains(fmt.Sprintf("Loaded image: %s:latest", identifier)),
+				Output: expect.All(
+					expect.Contains(fmt.Sprintf("Loaded image: %s:latest", identifier)),
 					func(stdout string, info string, t *testing.T) {
 						assert.Assert(t, strings.Contains(helpers.Capture("images"), identifier))
 					},
@@ -74,7 +77,7 @@ func TestLoadStdinEmpty(t *testing.T) {
 
 	testCase := &test.Case{
 		Description: "TestLoadStdinEmpty",
-		Require:     test.Linux,
+		Require:     require.Linux,
 		Command:     test.Command("load"),
 		Expected:    test.Expects(1, nil, nil),
 	}
@@ -102,9 +105,9 @@ func TestLoadQuiet(t *testing.T) {
 		},
 		Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 			return &test.Expected{
-				Output: test.All(
-					test.Contains(fmt.Sprintf("Loaded image: %s:latest", data.Identifier())),
-					test.DoesNotContain("Loading layer"),
+				Output: expect.All(
+					expect.Contains(fmt.Sprintf("Loaded image: %s:latest", data.Identifier())),
+					expect.DoesNotContain("Loading layer"),
 				),
 			}
 		},
diff --git a/cmd/nerdctl/image/image_prune_test.go b/cmd/nerdctl/image/image_prune_test.go
index c71c99e6..1c8b402e 100644
--- a/cmd/nerdctl/image/image_prune_test.go
+++ b/cmd/nerdctl/image/image_prune_test.go
@@ -26,9 +26,12 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestImagePrune(t *testing.T) {
@@ -53,10 +56,10 @@ func TestImagePrune(t *testing.T) {
 		{
 			Description: "without all",
 			NoParallel:  true,
-			Require: test.Require(
+			Require: require.All(
 				// This never worked with Docker - the only reason we ever got <none> was side effects from other tests
 				// See inline comments.
-				test.Not(nerdtest.Docker),
+				require.Not(nerdtest.Docker),
 				nerdtest.Build,
 			),
 			Cleanup: func(data test.Data, helpers test.Helpers) {
@@ -83,7 +86,7 @@ func TestImagePrune(t *testing.T) {
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				identifier := data.Identifier()
 				return &test.Expected{
-					Output: test.All(
+					Output: expect.All(
 						func(stdout string, info string, t *testing.T) {
 							assert.Assert(t, !strings.Contains(stdout, identifier), info)
 						},
@@ -98,9 +101,9 @@ func TestImagePrune(t *testing.T) {
 		},
 		{
 			Description: "with all",
-			Require: test.Require(
+			Require: require.All(
 				// Same as above
-				test.Not(nerdtest.Docker),
+				require.Not(nerdtest.Docker),
 				nerdtest.Build,
 			),
 			// Cannot use a custom namespace with buildkitd right now, so, no parallel it is
@@ -129,7 +132,7 @@ func TestImagePrune(t *testing.T) {
 			Command: test.Command("image", "prune", "--force", "--all"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.All(
+					Output: expect.All(
 						func(stdout string, info string, t *testing.T) {
 							assert.Assert(t, !strings.Contains(stdout, data.Identifier()), info)
 						},
@@ -170,7 +173,7 @@ LABEL version=0.1`, testutil.CommonImage)
 			Command: test.Command("image", "prune", "--force", "--all", "--filter", "label=foo=baz"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.All(
+					Output: expect.All(
 						func(stdout string, info string, t *testing.T) {
 							assert.Assert(t, !strings.Contains(stdout, data.Identifier()), info)
 						},
@@ -211,8 +214,8 @@ CMD ["echo", "nerdctl-test-image-prune-until"]`, testutil.CommonImage)
 			Command: test.Command("image", "prune", "--force", "--all", "--filter", "until=12h"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.All(
-						test.DoesNotContain(data.Get("imageID")),
+					Output: expect.All(
+						expect.DoesNotContain(data.Get("imageID")),
 						func(stdout string, info string, t *testing.T) {
 							imgList := helpers.Capture("images")
 							assert.Assert(t, strings.Contains(imgList, data.Get("imageID")), info)
@@ -230,8 +233,8 @@ CMD ["echo", "nerdctl-test-image-prune-until"]`, testutil.CommonImage)
 					Command: test.Command("image", "prune", "--force", "--all", "--filter", "until=10ms"),
 					Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 						return &test.Expected{
-							Output: test.All(
-								test.Contains(data.Get("imageID")),
+							Output: expect.All(
+								expect.Contains(data.Get("imageID")),
 								func(stdout string, info string, t *testing.T) {
 									imgList := helpers.Capture("images")
 									assert.Assert(t, !strings.Contains(imgList, data.Get("imageID")), imgList, info)
diff --git a/cmd/nerdctl/image/image_pull_linux_test.go b/cmd/nerdctl/image/image_pull_linux_test.go
index c350d1e7..ebd79766 100644
--- a/cmd/nerdctl/image/image_pull_linux_test.go
+++ b/cmd/nerdctl/image/image_pull_linux_test.go
@@ -26,10 +26,13 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	testhelpers "github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/testregistry"
 )
 
@@ -40,11 +43,11 @@ func TestImagePullWithCosign(t *testing.T) {
 	var keyPair *testhelpers.CosignKeyPair
 
 	testCase := &test.Case{
-		Require: test.Require(
-			test.Linux,
+		Require: require.All(
+			require.Linux,
 			nerdtest.Build,
-			test.Binary("cosign"),
-			test.Not(nerdtest.Docker),
+			require.Binary("cosign"),
+			require.Not(nerdtest.Docker),
 		),
 		Env: map[string]string{
 			"COSIGN_PASSWORD": "1",
@@ -110,9 +113,9 @@ func TestImagePullPlainHttpWithDefaultPort(t *testing.T) {
 	var registry *testregistry.RegistryServer
 
 	testCase := &test.Case{
-		Require: test.Require(
-			test.Linux,
-			test.Not(nerdtest.Docker),
+		Require: require.All(
+			require.Linux,
+			require.Not(nerdtest.Docker),
 			nerdtest.Build,
 		),
 		Setup: func(data test.Data, helpers test.Helpers) {
@@ -154,9 +157,9 @@ func TestImagePullSoci(t *testing.T) {
 	nerdtest.Setup()
 
 	testCase := &test.Case{
-		Require: test.Require(
-			test.Linux,
-			test.Not(nerdtest.Docker),
+		Require: require.All(
+			require.Linux,
+			require.Not(nerdtest.Docker),
 			nerdtest.Soci,
 		),
 
@@ -166,8 +169,7 @@ func TestImagePullSoci(t *testing.T) {
 			{
 				Description: "Run without specifying SOCI index",
 				NoParallel:  true,
-				Data: test.
-					WithData("remoteSnapshotsExpectedCount", "11").
+				Data: test.WithData("remoteSnapshotsExpectedCount", "11").
 					Set("sociIndexDigest", ""),
 				Setup: func(data test.Data, helpers test.Helpers) {
 					cmd := helpers.Custom("mount")
@@ -200,8 +202,7 @@ func TestImagePullSoci(t *testing.T) {
 			{
 				Description: "Run with bad SOCI index",
 				NoParallel:  true,
-				Data: test.
-					WithData("remoteSnapshotsExpectedCount", "11").
+				Data: test.WithData("remoteSnapshotsExpectedCount", "11").
 					Set("sociIndexDigest", "sha256:thisisabadindex0000000000000000000000000000000000000000000000000"),
 				Setup: func(data test.Data, helpers test.Helpers) {
 					cmd := helpers.Custom("mount")
@@ -251,7 +252,7 @@ func TestImagePullProcessOutput(t *testing.T) {
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("pull", testutil.BusyboxImage)
 				},
-				Expected: test.Expects(0, nil, test.Contains(testutil.BusyboxImage)),
+				Expected: test.Expects(0, nil, expect.Contains(testutil.BusyboxImage)),
 			},
 			{
 				Description: "Run Container with image pull - output should be in stderr",
@@ -262,7 +263,7 @@ func TestImagePullProcessOutput(t *testing.T) {
 				Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 					return helpers.Command("run", "--rm", testutil.BusyboxImage)
 				},
-				Expected: test.Expects(0, nil, test.DoesNotContain(testutil.BusyboxImage)),
+				Expected: test.Expects(0, nil, expect.DoesNotContain(testutil.BusyboxImage)),
 			},
 		},
 	}
diff --git a/cmd/nerdctl/image/image_push_linux_test.go b/cmd/nerdctl/image/image_push_linux_test.go
index 79114187..66d26512 100644
--- a/cmd/nerdctl/image/image_push_linux_test.go
+++ b/cmd/nerdctl/image/image_push_linux_test.go
@@ -25,9 +25,11 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/testregistry"
 )
 
@@ -37,7 +39,7 @@ func TestPush(t *testing.T) {
 	var registryNoAuthHTTPRandom, registryNoAuthHTTPDefault, registryTokenAuthHTTPSRandom *testregistry.RegistryServer
 
 	testCase := &test.Case{
-		Require: test.Linux,
+		Require: require.Linux,
 
 		Setup: func(data test.Data, helpers test.Helpers) {
 			base := testutil.NewBase(t)
@@ -80,7 +82,7 @@ func TestPush(t *testing.T) {
 			},
 			{
 				Description: "plain http with insecure",
-				Require:     test.Not(nerdtest.Docker),
+				Require:     require.Not(nerdtest.Docker),
 				Setup: func(data test.Data, helpers test.Helpers) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
@@ -114,7 +116,7 @@ func TestPush(t *testing.T) {
 			},
 			{
 				Description: "plain http with insecure, default port",
-				Require:     test.Not(nerdtest.Docker),
+				Require:     require.Not(nerdtest.Docker),
 				Setup: func(data test.Data, helpers test.Helpers) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s/%s:%s",
@@ -134,7 +136,7 @@ func TestPush(t *testing.T) {
 			},
 			{
 				Description: "with insecure, with login",
-				Require:     test.Not(nerdtest.Docker),
+				Require:     require.Not(nerdtest.Docker),
 				Setup: func(data test.Data, helpers test.Helpers) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
@@ -157,7 +159,7 @@ func TestPush(t *testing.T) {
 			},
 			{
 				Description: "with hosts dir, with login",
-				Require:     test.Not(nerdtest.Docker),
+				Require:     require.Not(nerdtest.Docker),
 				Setup: func(data test.Data, helpers test.Helpers) {
 					helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
@@ -180,7 +182,7 @@ func TestPush(t *testing.T) {
 			},
 			{
 				Description: "non distributable artifacts",
-				Require:     test.Not(nerdtest.Docker),
+				Require:     require.Not(nerdtest.Docker),
 				Setup: func(data test.Data, helpers test.Helpers) {
 					helpers.Ensure("pull", "--quiet", testutil.NonDistBlobImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
@@ -212,7 +214,7 @@ func TestPush(t *testing.T) {
 			},
 			{
 				Description: "non distributable artifacts (with)",
-				Require:     test.Not(nerdtest.Docker),
+				Require:     require.Not(nerdtest.Docker),
 				Setup: func(data test.Data, helpers test.Helpers) {
 					helpers.Ensure("pull", "--quiet", testutil.NonDistBlobImage)
 					testImageRef := fmt.Sprintf("%s:%d/%s:%s",
@@ -244,9 +246,9 @@ func TestPush(t *testing.T) {
 			},
 			{
 				Description: "soci",
-				Require: test.Require(
+				Require: require.All(
 					nerdtest.Soci,
-					test.Not(nerdtest.Docker),
+					require.Not(nerdtest.Docker),
 				),
 				Setup: func(data test.Data, helpers test.Helpers) {
 					helpers.Ensure("pull", "--quiet", testutil.UbuntuImage)
diff --git a/cmd/nerdctl/image/image_remove_test.go b/cmd/nerdctl/image/image_remove_test.go
index e7e0e4d2..4dc1d683 100644
--- a/cmd/nerdctl/image/image_remove_test.go
+++ b/cmd/nerdctl/image/image_remove_test.go
@@ -23,10 +23,13 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/imgutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestRemove(t *testing.T) {
@@ -46,8 +49,8 @@ func TestRemove(t *testing.T) {
 		{
 			Description: "Remove image with stopped container - without -f",
 			NoParallel:  true,
-			Require: test.Require(
-				test.Not(nerdtest.Docker),
+			Require: require.All(
+				require.Not(nerdtest.Docker),
 			),
 			Setup: func(data test.Data, helpers test.Helpers) {
 				helpers.Ensure("run", "--pull", "always", "--name", data.Identifier(), testutil.CommonImage)
@@ -62,7 +65,7 @@ func TestRemove(t *testing.T) {
 					Errors:   []error{errors.New("image is being used")},
 					Output: func(stdout string, info string, t *testing.T) {
 						helpers.Command("images").Run(&test.Expected{
-							Output: test.Contains(repoName),
+							Output: expect.Contains(repoName),
 						})
 					},
 				}
@@ -82,7 +85,7 @@ func TestRemove(t *testing.T) {
 				return &test.Expected{
 					Output: func(stdout string, info string, t *testing.T) {
 						helpers.Command("images").Run(&test.Expected{
-							Output: test.DoesNotContain(repoName),
+							Output: expect.DoesNotContain(repoName),
 						})
 					},
 				}
@@ -91,8 +94,8 @@ func TestRemove(t *testing.T) {
 		{
 			Description: "Remove image with running container - without -f",
 			NoParallel:  true,
-			Require: test.Require(
-				test.Not(nerdtest.Docker),
+			Require: require.All(
+				require.Not(nerdtest.Docker),
 			),
 			Setup: func(data test.Data, helpers test.Helpers) {
 				helpers.Ensure("run", "--pull", "always", "-d", "--name", data.Identifier(), testutil.CommonImage, "sleep", nerdtest.Infinity)
@@ -107,7 +110,7 @@ func TestRemove(t *testing.T) {
 					Errors:   []error{errors.New("image is being used")},
 					Output: func(stdout string, info string, t *testing.T) {
 						helpers.Command("images").Run(&test.Expected{
-							Output: test.Contains(repoName),
+							Output: expect.Contains(repoName),
 						})
 					},
 				}
@@ -116,8 +119,8 @@ func TestRemove(t *testing.T) {
 		{
 			Description: "Remove image with running container - with -f",
 			NoParallel:  true,
-			Require: test.Require(
-				test.Not(nerdtest.Docker),
+			Require: require.All(
+				require.Not(nerdtest.Docker),
 			),
 			Setup: func(data test.Data, helpers test.Helpers) {
 				helpers.Ensure("run", "--pull", "always", "-d", "--name", data.Identifier(), testutil.CommonImage, "sleep", nerdtest.Infinity)
@@ -139,7 +142,7 @@ func TestRemove(t *testing.T) {
 					Errors:   []error{},
 					Output: func(stdout string, info string, t *testing.T) {
 						helpers.Command("images").Run(&test.Expected{
-							Output: test.Contains("<none>"),
+							Output: expect.Contains("<none>"),
 						})
 					},
 				}
@@ -161,7 +164,7 @@ func TestRemove(t *testing.T) {
 					Errors:   []error{errors.New("image is being used")},
 					Output: func(stdout string, info string, t *testing.T) {
 						helpers.Command("images").Run(&test.Expected{
-							Output: test.Contains(repoName),
+							Output: expect.Contains(repoName),
 						})
 					},
 				}
@@ -183,10 +186,10 @@ func TestRemove(t *testing.T) {
 				return &test.Expected{
 					Output: func(stdout string, info string, t *testing.T) {
 						helpers.Command("images").Run(&test.Expected{
-							Output: test.All(
-								test.DoesNotContain(repoName),
+							Output: expect.All(
+								expect.DoesNotContain(repoName),
 								// a created container with removed image doesn't impact other `rmi` command
-								test.DoesNotContain(nginxRepoName),
+								expect.DoesNotContain(nginxRepoName),
 							),
 						})
 					},
@@ -196,8 +199,8 @@ func TestRemove(t *testing.T) {
 		{
 			Description: "Remove image with paused container - without -f",
 			NoParallel:  true,
-			Require: test.Require(
-				test.Not(nerdtest.Docker),
+			Require: require.All(
+				require.Not(nerdtest.Docker),
 				nerdtest.CGroup,
 			),
 			Setup: func(data test.Data, helpers test.Helpers) {
@@ -214,7 +217,7 @@ func TestRemove(t *testing.T) {
 					Errors:   []error{errors.New("image is being used")},
 					Output: func(stdout string, info string, t *testing.T) {
 						helpers.Command("images").Run(&test.Expected{
-							Output: test.Contains(repoName),
+							Output: expect.Contains(repoName),
 						})
 					},
 				}
@@ -223,9 +226,9 @@ func TestRemove(t *testing.T) {
 		{
 			Description: "Remove image with paused container - with -f",
 			NoParallel:  true,
-			Require: test.Require(
+			Require: require.All(
 				nerdtest.CGroup,
-				test.Not(nerdtest.Docker),
+				require.Not(nerdtest.Docker),
 			),
 			Setup: func(data test.Data, helpers test.Helpers) {
 				helpers.Ensure("run", "--pull", "always", "-d", "--name", data.Identifier(), testutil.CommonImage, "sleep", nerdtest.Infinity)
@@ -248,7 +251,7 @@ func TestRemove(t *testing.T) {
 					Errors:   []error{},
 					Output: func(stdout string, info string, t *testing.T) {
 						helpers.Command("images").Run(&test.Expected{
-							Output: test.Contains("<none>"),
+							Output: expect.Contains("<none>"),
 						})
 					},
 				}
@@ -257,8 +260,8 @@ func TestRemove(t *testing.T) {
 		{
 			Description: "Remove image with killed container - without -f",
 			NoParallel:  true,
-			Require: test.Require(
-				test.Not(nerdtest.Docker),
+			Require: require.All(
+				require.Not(nerdtest.Docker),
 			),
 			Setup: func(data test.Data, helpers test.Helpers) {
 				helpers.Ensure("run", "--pull", "always", "-d", "--name", data.Identifier(), testutil.CommonImage, "sleep", nerdtest.Infinity)
@@ -274,7 +277,7 @@ func TestRemove(t *testing.T) {
 					Errors:   []error{errors.New("image is being used")},
 					Output: func(stdout string, info string, t *testing.T) {
 						helpers.Command("images").Run(&test.Expected{
-							Output: test.Contains(repoName),
+							Output: expect.Contains(repoName),
 						})
 					},
 				}
@@ -295,7 +298,7 @@ func TestRemove(t *testing.T) {
 				return &test.Expected{
 					Output: func(stdout string, info string, t *testing.T) {
 						helpers.Command("images").Run(&test.Expected{
-							Output: test.DoesNotContain(repoName),
+							Output: expect.DoesNotContain(repoName),
 						})
 					},
 				}
@@ -363,7 +366,7 @@ func TestRemoveKubeWithKubeHideDupe(t *testing.T) {
 		numTags = len(strings.Split(strings.TrimSpace(helpers.Capture("--kube-hide-dupe", "images")), "\n"))
 		numNoTags = len(strings.Split(strings.TrimSpace(helpers.Capture("images")), "\n"))
 	}
-	testCase.Require = test.Require(
+	testCase.Require = require.All(
 		nerdtest.OnlyKubernetes,
 	)
 	testCase.SubTests = []*test.Case{
diff --git a/cmd/nerdctl/image/image_save_test.go b/cmd/nerdctl/image/image_save_test.go
index 9e2dae5c..7e61ef6e 100644
--- a/cmd/nerdctl/image/image_save_test.go
+++ b/cmd/nerdctl/image/image_save_test.go
@@ -25,10 +25,13 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	testhelpers "github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestSaveContent(t *testing.T) {
@@ -36,7 +39,7 @@ func TestSaveContent(t *testing.T) {
 
 	testCase := &test.Case{
 		// FIXME: move to busybox for windows?
-		Require: test.Not(test.Windows),
+		Require: require.Not(require.Windows),
 		Setup: func(data test.Data, helpers test.Helpers) {
 			helpers.Ensure("pull", "--quiet", testutil.CommonImage)
 		},
@@ -103,7 +106,7 @@ func TestSave(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("run", "--rm", data.Get("id"), "sh", "-euxc", "echo foo")
 			},
-			Expected: test.Expects(0, nil, test.Equals("foo\n")),
+			Expected: test.Expects(0, nil, expect.Equals("foo\n")),
 		},
 		{
 			Description: "Image with different names, by id",
@@ -132,7 +135,7 @@ func TestSave(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("run", "--rm", data.Get("id"), "sh", "-euxc", "echo foo")
 			},
-			Expected: test.Expects(0, nil, test.Equals("foo\n")),
+			Expected: test.Expects(0, nil, expect.Equals("foo\n")),
 		},
 	}
 
diff --git a/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go b/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go
index e1b78cc4..aa36f35b 100644
--- a/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go
+++ b/cmd/nerdctl/ipfs/ipfs_compose_linux_test.go
@@ -26,12 +26,14 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/registry"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nettestutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/portlock"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestIPFSCompNoBuild(t *testing.T) {
@@ -41,9 +43,9 @@ func TestIPFSCompNoBuild(t *testing.T) {
 
 	var ipfsRegistry *registry.Server
 
-	testCase.Require = test.Require(
-		test.Linux,
-		test.Not(nerdtest.Docker),
+	testCase.Require = require.All(
+		require.Linux,
+		require.Not(nerdtest.Docker),
 		nerdtest.Registry,
 		nerdtest.IPFS,
 		nerdtest.IsFlaky("https://github.com/containerd/nerdctl/issues/3510"),
@@ -194,11 +196,11 @@ func TestIPFSCompBuild(t *testing.T) {
 	assert.NilError(t, err)
 	var listenAddr = "localhost:" + strconv.Itoa(safePort)
 
-	testCase.Require = test.Require(
+	testCase.Require = require.All(
 		// Linux only
-		test.Linux,
+		require.Linux,
 		// Obviously not docker supported
-		test.Not(nerdtest.Docker),
+		require.Not(nerdtest.Docker),
 		nerdtest.Build,
 		nerdtest.IPFS,
 	)
diff --git a/cmd/nerdctl/ipfs/ipfs_kubo_linux_test.go b/cmd/nerdctl/ipfs/ipfs_kubo_linux_test.go
index cb21a839..93cf046b 100644
--- a/cmd/nerdctl/ipfs/ipfs_kubo_linux_test.go
+++ b/cmd/nerdctl/ipfs/ipfs_kubo_linux_test.go
@@ -21,10 +21,13 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/registry"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestIPFSAddrWithKubo(t *testing.T) {
@@ -35,9 +38,9 @@ func TestIPFSAddrWithKubo(t *testing.T) {
 
 	var ipfsRegistry *registry.Server
 
-	testCase.Require = test.Require(
-		test.Linux,
-		test.Not(nerdtest.Docker),
+	testCase.Require = require.All(
+		require.Linux,
+		require.Not(nerdtest.Docker),
 		nerdtest.Registry,
 		nerdtest.Private,
 	)
@@ -74,12 +77,12 @@ func TestIPFSAddrWithKubo(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("run", "--rm", data.Get(mainImageCIDKey), "echo", "hello")
 			},
-			Expected: test.Expects(0, nil, test.Equals("hello\n")),
+			Expected: test.Expects(0, nil, expect.Equals("hello\n")),
 		},
 		{
 			Description: "with stargz snapshotter",
 			NoParallel:  true,
-			Require: test.Require(
+			Require: require.All(
 				nerdtest.Stargz,
 				nerdtest.Private,
 				nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3475"),
@@ -97,7 +100,7 @@ func TestIPFSAddrWithKubo(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("run", "--rm", data.Get(mainImageCIDKey), "ls", "/.stargz-snapshotter")
 			},
-			Expected: test.Expects(0, nil, test.Match(regexp.MustCompile("sha256:.*[.]json[\n]"))),
+			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("sha256:.*[.]json[\n]"))),
 		},
 	}
 
diff --git a/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go b/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go
index 3b4f6118..20865efc 100644
--- a/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go
+++ b/cmd/nerdctl/ipfs/ipfs_registry_linux_test.go
@@ -27,9 +27,12 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func pushToIPFS(helpers test.Helpers, name string, opts ...string) string {
@@ -56,9 +59,9 @@ func TestIPFSNerdctlRegistry(t *testing.T) {
 
 	var ipfsServer test.TestableCommand
 
-	testCase.Require = test.Require(
-		test.Linux,
-		test.Not(nerdtest.Docker),
+	testCase.Require = require.All(
+		require.Linux,
+		require.Not(nerdtest.Docker),
 		nerdtest.IPFS,
 	)
 
@@ -96,7 +99,7 @@ func TestIPFSNerdctlRegistry(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("run", "--rm", data.Get(ipfsImageURLKey), "echo", "hello")
 			},
-			Expected: test.Expects(0, nil, test.Equals("hello\n")),
+			Expected: test.Expects(0, nil, expect.Equals("hello\n")),
 		},
 		{
 			Description: "with stargz snapshotterr",
@@ -114,7 +117,7 @@ func TestIPFSNerdctlRegistry(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("run", "--rm", data.Get(ipfsImageURLKey), "ls", "/.stargz-snapshotter")
 			},
-			Expected: test.Expects(0, nil, test.Match(regexp.MustCompile("sha256:.*[.]json[\n]"))),
+			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("sha256:.*[.]json[\n]"))),
 		},
 		{
 			Description: "with build",
@@ -142,7 +145,7 @@ CMD ["echo", "nerdctl-build-test-string"]
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("run", "--rm", data.Identifier("built-image"))
 			},
-			Expected: test.Expects(0, nil, test.Equals("nerdctl-build-test-string\n")),
+			Expected: test.Expects(0, nil, expect.Equals("nerdctl-build-test-string\n")),
 		},
 	}
 
diff --git a/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go b/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go
index f2d59a15..581704ec 100644
--- a/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go
+++ b/cmd/nerdctl/ipfs/ipfs_simple_linux_test.go
@@ -20,10 +20,13 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	testhelpers "github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestIPFSSimple(t *testing.T) {
@@ -32,9 +35,9 @@ func TestIPFSSimple(t *testing.T) {
 	const mainImageCIDKey = "mainImageCIDKey"
 	const transformedImageCIDKey = "transformedImageCIDKey"
 
-	testCase.Require = test.Require(
-		test.Linux,
-		test.Not(nerdtest.Docker),
+	testCase.Require = require.All(
+		require.Linux,
+		require.Not(nerdtest.Docker),
 		nerdtest.IPFS,
 		// We constantly rmi the image by its CID which is shared across tests, so, we make this group private
 		// and every subtest NoParallel
@@ -61,12 +64,12 @@ func TestIPFSSimple(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("run", "--rm", data.Get(mainImageCIDKey), "echo", "hello")
 			},
-			Expected: test.Expects(0, nil, test.Equals("hello\n")),
+			Expected: test.Expects(0, nil, expect.Equals("hello\n")),
 		},
 		{
 			Description: "with stargz snapshotter",
 			NoParallel:  true,
-			Require: test.Require(
+			Require: require.All(
 				nerdtest.Stargz,
 				nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3475"),
 			),
@@ -82,7 +85,7 @@ func TestIPFSSimple(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("run", "--rm", data.Get(mainImageCIDKey), "ls", "/.stargz-snapshotter")
 			},
-			Expected: test.Expects(0, nil, test.Match(regexp.MustCompile("sha256:.*[.]json[\n]"))),
+			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("sha256:.*[.]json[\n]"))),
 		},
 		{
 			Description: "with commit and push",
@@ -116,12 +119,12 @@ func TestIPFSSimple(t *testing.T) {
 				return helpers.Command("run", "--rm", data.Get(transformedImageCIDKey), "cat", "/hello")
 			},
 
-			Expected: test.Expects(0, nil, test.Equals("hello\n")),
+			Expected: test.Expects(0, nil, expect.Equals("hello\n")),
 		},
 		{
 			Description: "with commit and push, stargz lazy pulling",
 			NoParallel:  true,
-			Require: test.Require(
+			Require: require.All(
 				nerdtest.Stargz,
 				nerdtest.NerdctlNeedsFixing("https://github.com/containerd/nerdctl/issues/3475"),
 			),
@@ -154,12 +157,12 @@ func TestIPFSSimple(t *testing.T) {
 				return helpers.Command("run", "--rm", data.Get(transformedImageCIDKey), "sh", "-c", "--", "cat /hello && ls /.stargz-snapshotter")
 			},
 
-			Expected: test.Expects(0, nil, test.Match(regexp.MustCompile("hello[\n]sha256:.*[.]json[\n]"))),
+			Expected: test.Expects(0, nil, expect.Match(regexp.MustCompile("hello[\n]sha256:.*[.]json[\n]"))),
 		},
 		{
 			Description: "with encryption",
 			NoParallel:  true,
-			Require:     test.Binary("openssl"),
+			Require:     require.Binary("openssl"),
 			Setup: func(data test.Data, helpers test.Helpers) {
 				data.Set(mainImageCIDKey, pushToIPFS(helpers, testutil.CommonImage))
 				helpers.Ensure("pull", "ipfs://"+data.Get(mainImageCIDKey))
@@ -175,11 +178,11 @@ func TestIPFSSimple(t *testing.T) {
 				helpers.Ensure("image", "encrypt", "--recipient=jwe:"+keyPair.Pub, data.Get(mainImageCIDKey), data.Identifier("encrypted"))
 				cmd := helpers.Command("image", "inspect", "--mode=native", "--format={{len .Index.Manifests}}", data.Identifier("encrypted"))
 				cmd.Run(&test.Expected{
-					Output: test.Equals("1\n"),
+					Output: expect.Equals("1\n"),
 				})
 				cmd = helpers.Command("image", "inspect", "--mode=native", "--format={{json (index .Manifest.Layers 0) }}", data.Identifier("encrypted"))
 				cmd.Run(&test.Expected{
-					Output: test.Contains("org.opencontainers.image.enc.keys.jwe"),
+					Output: expect.Contains("org.opencontainers.image.enc.keys.jwe"),
 				})
 
 				// Push the encrypted image and save the CID
diff --git a/cmd/nerdctl/issues/issues_linux_test.go b/cmd/nerdctl/issues/issues_linux_test.go
index 3f9e89ff..7b494929 100644
--- a/cmd/nerdctl/issues/issues_linux_test.go
+++ b/cmd/nerdctl/issues/issues_linux_test.go
@@ -22,10 +22,12 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/registry"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestIssue3425(t *testing.T) {
@@ -105,10 +107,10 @@ func TestIssue3425(t *testing.T) {
 			},
 			{
 				Description: "with convert",
-				Require: test.Require(
+				Require: require.All(
 					nerdtest.Private,
-					test.Not(test.Windows),
-					test.Not(nerdtest.Docker),
+					require.Not(require.Windows),
+					require.Not(nerdtest.Docker),
 				),
 				Setup: func(data test.Data, helpers test.Helpers) {
 					helpers.Ensure("image", "pull", testutil.CommonImage)
@@ -127,11 +129,11 @@ func TestIssue3425(t *testing.T) {
 			},
 			{
 				Description: "with ipfs",
-				Require: test.Require(
+				Require: require.All(
 					nerdtest.Private,
 					nerdtest.IPFS,
-					test.Not(test.Windows),
-					test.Not(nerdtest.Docker),
+					require.Not(require.Windows),
+					require.Not(nerdtest.Docker),
 				),
 				Setup: func(data test.Data, helpers test.Helpers) {
 					helpers.Ensure("image", "pull", testutil.CommonImage)
diff --git a/cmd/nerdctl/issues/main_linux_test.go b/cmd/nerdctl/issues/main_linux_test.go
index a1af21d8..4703897a 100644
--- a/cmd/nerdctl/issues/main_linux_test.go
+++ b/cmd/nerdctl/issues/main_linux_test.go
@@ -19,9 +19,11 @@ package issues
 import (
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestMain(m *testing.M) {
@@ -41,7 +43,7 @@ func TestIssue108(t *testing.T) {
 				cmd.WithPseudoTTY()
 				return cmd
 			},
-			Expected: test.Expects(0, nil, test.Equals("this was always working\r\n")),
+			Expected: test.Expects(0, nil, expect.Equals("this was always working\r\n")),
 		},
 		{
 			Description: "--net=host -it",
@@ -50,7 +52,7 @@ func TestIssue108(t *testing.T) {
 				cmd.WithPseudoTTY()
 				return cmd
 			},
-			Expected: test.Expects(0, nil, test.Equals("this was not working due to issue #108\r\n")),
+			Expected: test.Expects(0, nil, expect.Equals("this was not working due to issue #108\r\n")),
 		},
 	}
 
diff --git a/cmd/nerdctl/login/login_linux_test.go b/cmd/nerdctl/login/login_linux_test.go
index 2ac21fa3..3eab9293 100644
--- a/cmd/nerdctl/login/login_linux_test.go
+++ b/cmd/nerdctl/login/login_linux_test.go
@@ -29,9 +29,10 @@ import (
 
 	"gotest.tools/v3/icmd"
 
+	"github.com/containerd/nerdctl/mod/tigron/utils"
+
 	"github.com/containerd/nerdctl/v2/pkg/imgutil/dockerconfigresolver"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/testca"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/testregistry"
 )
@@ -109,8 +110,8 @@ func TestLoginPersistence(t *testing.T) {
 		t.Run(fmt.Sprintf("Server %s", tc.auth), func(t *testing.T) {
 			t.Parallel()
 
-			username := test.RandomStringBase64(30) + "∞"
-			password := test.RandomStringBase64(30) + ":∞"
+			username := utils.RandomStringBase64(30) + "∞"
+			password := utils.RandomStringBase64(30) + ":∞"
 
 			// Add the requested authentication
 			var auth testregistry.Auth
@@ -298,8 +299,8 @@ func TestLoginAgainstVariants(t *testing.T) {
 			}
 
 			// Generate credentials that are specific to each registry, so that we never cross hit another one
-			username := test.RandomStringBase64(30) + "∞"
-			password := test.RandomStringBase64(30) + ":∞"
+			username := utils.RandomStringBase64(30) + "∞"
+			password := utils.RandomStringBase64(30) + ":∞"
 
 			// Get a CA if we want TLS
 			var ca *testca.CA
diff --git a/cmd/nerdctl/main_test.go b/cmd/nerdctl/main_test.go
index e2ca845e..bcd84434 100644
--- a/cmd/nerdctl/main_test.go
+++ b/cmd/nerdctl/main_test.go
@@ -21,10 +21,12 @@ import (
 	"testing"
 
 	"github.com/containerd/containerd/v2/defaults"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestMain(m *testing.M) {
@@ -35,28 +37,28 @@ func TestMain(m *testing.M) {
 func TestUnknownCommand(t *testing.T) {
 	testCase := nerdtest.Setup()
 
-	var unknownSubCommand = errors.New("unknown subcommand")
+	var cmd = errors.New("unknown subcommand")
 
 	testCase.SubTests = []*test.Case{
 		{
 			Description: "non-existent-command",
 			Command:     test.Command("non-existent-command"),
-			Expected:    test.Expects(1, []error{unknownSubCommand}, nil),
+			Expected:    test.Expects(1, []error{cmd}, nil),
 		},
 		{
 			Description: "non-existent-command info",
 			Command:     test.Command("non-existent-command", "info"),
-			Expected:    test.Expects(1, []error{unknownSubCommand}, nil),
+			Expected:    test.Expects(1, []error{cmd}, nil),
 		},
 		{
 			Description: "system non-existent-command",
 			Command:     test.Command("system", "non-existent-command"),
-			Expected:    test.Expects(1, []error{unknownSubCommand}, nil),
+			Expected:    test.Expects(1, []error{cmd}, nil),
 		},
 		{
 			Description: "system non-existent-command info",
 			Command:     test.Command("system", "non-existent-command", "info"),
-			Expected:    test.Expects(1, []error{unknownSubCommand}, nil),
+			Expected:    test.Expects(1, []error{cmd}, nil),
 		},
 		{
 			Description: "system",
@@ -66,12 +68,12 @@ func TestUnknownCommand(t *testing.T) {
 		{
 			Description: "system info",
 			Command:     test.Command("system", "info"),
-			Expected:    test.Expects(0, nil, test.Contains("Kernel Version:")),
+			Expected:    test.Expects(0, nil, expect.Contains("Kernel Version:")),
 		},
 		{
 			Description: "info",
 			Command:     test.Command("info"),
-			Expected:    test.Expects(0, nil, test.Contains("Kernel Version:")),
+			Expected:    test.Expects(0, nil, expect.Contains("Kernel Version:")),
 		},
 	}
 
@@ -83,38 +85,38 @@ func TestNerdctlConfig(t *testing.T) {
 	testCase := nerdtest.Setup()
 
 	// Docker does not support nerdctl.toml obviously
-	testCase.Require = test.Not(nerdtest.Docker)
+	testCase.Require = require.Not(nerdtest.Docker)
 
 	testCase.SubTests = []*test.Case{
 		{
 			Description: "Default",
 			Command:     test.Command("info", "-f", "{{.Driver}}"),
-			Expected:    test.Expects(0, nil, test.Equals(defaults.DefaultSnapshotter+"\n")),
+			Expected:    test.Expects(0, nil, expect.Equals(defaults.DefaultSnapshotter+"\n")),
 		},
 		{
 			Description: "TOML > Default",
 			Command:     test.Command("info", "-f", "{{.Driver}}"),
-			Expected:    test.Expects(0, nil, test.Equals("dummy-snapshotter-via-toml\n")),
+			Expected:    test.Expects(0, nil, expect.Equals("dummy-snapshotter-via-toml\n")),
 			Config:      test.WithConfig(nerdtest.NerdctlToml, `snapshotter = "dummy-snapshotter-via-toml"`),
 		},
 		{
 			Description: "Cli > TOML > Default",
 			Command:     test.Command("info", "-f", "{{.Driver}}", "--snapshotter=dummy-snapshotter-via-cli"),
-			Expected:    test.Expects(0, nil, test.Equals("dummy-snapshotter-via-cli\n")),
+			Expected:    test.Expects(0, nil, expect.Equals("dummy-snapshotter-via-cli\n")),
 			Config:      test.WithConfig(nerdtest.NerdctlToml, `snapshotter = "dummy-snapshotter-via-toml"`),
 		},
 		{
 			Description: "Env > TOML > Default",
 			Command:     test.Command("info", "-f", "{{.Driver}}"),
 			Env:         map[string]string{"CONTAINERD_SNAPSHOTTER": "dummy-snapshotter-via-env"},
-			Expected:    test.Expects(0, nil, test.Equals("dummy-snapshotter-via-env\n")),
+			Expected:    test.Expects(0, nil, expect.Equals("dummy-snapshotter-via-env\n")),
 			Config:      test.WithConfig(nerdtest.NerdctlToml, `snapshotter = "dummy-snapshotter-via-toml"`),
 		},
 		{
 			Description: "Cli > Env > TOML > Default",
 			Command:     test.Command("info", "-f", "{{.Driver}}", "--snapshotter=dummy-snapshotter-via-cli"),
 			Env:         map[string]string{"CONTAINERD_SNAPSHOTTER": "dummy-snapshotter-via-env"},
-			Expected:    test.Expects(0, nil, test.Equals("dummy-snapshotter-via-cli\n")),
+			Expected:    test.Expects(0, nil, expect.Equals("dummy-snapshotter-via-cli\n")),
 			Config:      test.WithConfig(nerdtest.NerdctlToml, `snapshotter = "dummy-snapshotter-via-toml"`),
 		},
 		{
diff --git a/cmd/nerdctl/main_test_test.go b/cmd/nerdctl/main_test_test.go
index 695c52ba..36c6a96e 100644
--- a/cmd/nerdctl/main_test_test.go
+++ b/cmd/nerdctl/main_test_test.go
@@ -21,8 +21,10 @@ import (
 	"log"
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 // TestTest is testing the test tooling itself
@@ -48,12 +50,12 @@ func TestTest(t *testing.T) {
 		{
 			Description: "success with contains output testing",
 			Command:     test.Command("info"),
-			Expected:    test.Expects(0, nil, test.Contains("Kernel")),
+			Expected:    test.Expects(0, nil, expect.Contains("Kernel")),
 		},
 		{
 			Description: "success with negative output testing",
 			Command:     test.Command("info"),
-			Expected:    test.Expects(0, nil, test.DoesNotContain("foobar")),
+			Expected:    test.Expects(0, nil, expect.DoesNotContain("foobar")),
 		},
 		// Note that docker annoyingly returns 125 in a few conditions like this
 		{
@@ -66,7 +68,7 @@ func TestTest(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Custom("echo", "foobar")
 			},
-			Expected: test.Expects(0, nil, test.Equals("foobar\n")),
+			Expected: test.Expects(0, nil, expect.Equals("foobar\n")),
 		},
 		{
 			Description: "data propagation",
@@ -94,10 +96,10 @@ func TestTest(t *testing.T) {
 					Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 						return helpers.Custom("printf", data.Get("status"))
 					},
-					Expected: test.Expects(0, nil, test.Equals("uninitialized-setup-command")),
+					Expected: test.Expects(0, nil, expect.Equals("uninitialized-setup-command")),
 				},
 			},
-			Expected: test.Expects(0, nil, test.Equals("uninitialized-setup")),
+			Expected: test.Expects(0, nil, expect.Equals("uninitialized-setup")),
 		},
 	}
 
diff --git a/cmd/nerdctl/network/network_create_linux_test.go b/cmd/nerdctl/network/network_create_linux_test.go
index 15012eab..418f07fd 100644
--- a/cmd/nerdctl/network/network_create_linux_test.go
+++ b/cmd/nerdctl/network/network_create_linux_test.go
@@ -23,10 +23,12 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	ipv6helper "github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestNetworkCreate(t *testing.T) {
@@ -74,7 +76,7 @@ func TestNetworkCreate(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("run", "--rm", "--net", data.Identifier(), testutil.CommonImage, "ifconfig", "eth0")
 			},
-			Expected: test.Expects(0, nil, test.Contains("MTU:9216")),
+			Expected: test.Expects(0, nil, expect.Contains("MTU:9216")),
 		},
 		{
 			Description: "with ipv6",
diff --git a/cmd/nerdctl/network/network_inspect_test.go b/cmd/nerdctl/network/network_inspect_test.go
index d493db49..cb89f25f 100644
--- a/cmd/nerdctl/network/network_inspect_test.go
+++ b/cmd/nerdctl/network/network_inspect_test.go
@@ -24,9 +24,12 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestNetworkInspect(t *testing.T) {
@@ -86,7 +89,7 @@ func TestNetworkInspect(t *testing.T) {
 		},
 		{
 			Description: "bridge",
-			Require:     test.Not(test.Windows),
+			Require:     require.Not(require.Windows),
 			Command:     test.Command("network", "inspect", "bridge"),
 			Expected: test.Expects(0, nil, func(stdout string, info string, t *testing.T) {
 				var dc []dockercompat.Network
@@ -98,7 +101,7 @@ func TestNetworkInspect(t *testing.T) {
 		},
 		{
 			Description: "nat",
-			Require:     test.Windows,
+			Require:     require.Windows,
 			Command:     test.Command("network", "inspect", "nat"),
 			Expected: test.Expects(0, nil, func(stdout string, info string, t *testing.T) {
 				var dc []dockercompat.Network
@@ -148,7 +151,7 @@ func TestNetworkInspect(t *testing.T) {
 			Description: "match part of id",
 			// FIXME: for windows, network inspect testnetworkinspect-basenet-468cf999 --format {{ .Id }} MAY fail here
 			// This is bizarre, as it is working in the match exact id test - and there does not seem to be a particular reason for that
-			Require: test.Not(test.Windows),
+			Require: require.Not(require.Windows),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				id := strings.TrimSpace(helpers.Capture("network", "inspect", data.Get("basenet"), "--format", "{{ .Id }}"))
 				return helpers.Command("network", "inspect", id[0:25])
@@ -169,7 +172,7 @@ func TestNetworkInspect(t *testing.T) {
 			Description: "using another net short id",
 			// FIXME: for windows, network inspect testnetworkinspect-basenet-468cf999 --format {{ .Id }} MAY fail here
 			// This is bizarre, as it is working in the match exact id test - and there does not seem to be a particular reason for that
-			Require: test.Not(test.Windows),
+			Require: require.Not(require.Windows),
 			Setup: func(data test.Data, helpers test.Helpers) {
 				id := strings.TrimSpace(helpers.Capture("network", "inspect", data.Get("basenet"), "--format", "{{ .Id }}"))
 				helpers.Ensure("network", "create", id[0:12])
@@ -196,7 +199,7 @@ func TestNetworkInspect(t *testing.T) {
 		{
 			Description: "basic",
 			// FIXME: IPAMConfig is not implemented on Windows yet
-			Require: test.Not(test.Windows),
+			Require: require.Not(require.Windows),
 			Setup: func(data test.Data, helpers test.Helpers) {
 				helpers.Ensure("network", "create", "--label", "tag=testNetwork", "--subnet", testSubnet,
 					"--gateway", testGateway, "--ip-range", testIPRange, data.Identifier())
@@ -230,7 +233,7 @@ func TestNetworkInspect(t *testing.T) {
 		},
 		{
 			Description: "with namespace",
-			Require:     test.Not(nerdtest.Docker),
+			Require:     require.Not(nerdtest.Docker),
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				identifier := data.Identifier()
 				helpers.Anyhow("network", "rm", identifier)
@@ -263,13 +266,13 @@ func TestNetworkInspect(t *testing.T) {
 						com = cmd.Clone()
 						com.WithArgs("network", "ls")
 						com.Run(&test.Expected{
-							Output: test.DoesNotContain(data.Identifier()),
+							Output: expect.DoesNotContain(data.Identifier()),
 						})
 
 						com = cmd.Clone()
 						com.WithArgs("network", "prune", "-f")
 						com.Run(&test.Expected{
-							Output: test.DoesNotContain(data.Identifier()),
+							Output: expect.DoesNotContain(data.Identifier()),
 						})
 					},
 				}
diff --git a/cmd/nerdctl/network/network_list_linux_test.go b/cmd/nerdctl/network/network_list_linux_test.go
index 22620287..96f35ded 100644
--- a/cmd/nerdctl/network/network_list_linux_test.go
+++ b/cmd/nerdctl/network/network_list_linux_test.go
@@ -22,8 +22,9 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestNetworkLsFilter(t *testing.T) {
diff --git a/cmd/nerdctl/network/network_prune_linux_test.go b/cmd/nerdctl/network/network_prune_linux_test.go
index 5c1fc0bf..2cf6eb95 100644
--- a/cmd/nerdctl/network/network_prune_linux_test.go
+++ b/cmd/nerdctl/network/network_prune_linux_test.go
@@ -19,9 +19,11 @@ package network
 import (
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestNetworkPrune(t *testing.T) {
@@ -45,7 +47,7 @@ func TestNetworkPrune(t *testing.T) {
 			Command: test.Command("network", "prune", "-f"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.DoesNotContain(data.Identifier()),
+					Output: expect.DoesNotContain(data.Identifier()),
 				}
 			},
 		},
@@ -64,7 +66,7 @@ func TestNetworkPrune(t *testing.T) {
 			Command: test.Command("network", "prune", "-f"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.Contains(data.Identifier()),
+					Output: expect.Contains(data.Identifier()),
 				}
 			},
 		},
diff --git a/cmd/nerdctl/network/network_remove_linux_test.go b/cmd/nerdctl/network/network_remove_linux_test.go
index f1d6e2e5..48906cba 100644
--- a/cmd/nerdctl/network/network_remove_linux_test.go
+++ b/cmd/nerdctl/network/network_remove_linux_test.go
@@ -23,9 +23,10 @@ import (
 	"github.com/vishvananda/netlink"
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestNetworkRemove(t *testing.T) {
diff --git a/cmd/nerdctl/system/system_events_linux_test.go b/cmd/nerdctl/system/system_events_linux_test.go
index ae371ec4..20f1f8e3 100644
--- a/cmd/nerdctl/system/system_events_linux_test.go
+++ b/cmd/nerdctl/system/system_events_linux_test.go
@@ -20,9 +20,12 @@ import (
 	"testing"
 	"time"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func testEventFilterExecutor(data test.Data, helpers test.Helpers) test.TestableCommand {
@@ -38,12 +41,12 @@ func TestEventFilters(t *testing.T) {
 	testCase.SubTests = []*test.Case{
 		{
 			Description: "CapitalizedFilter",
-			Require:     test.Not(nerdtest.Docker),
+			Require:     require.Not(nerdtest.Docker),
 			Command:     testEventFilterExecutor,
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					ExitCode: test.ExitCodeTimeout,
-					Output:   test.Contains(data.Get("output")),
+					ExitCode: expect.ExitCodeTimeout,
+					Output:   expect.Contains(data.Get("output")),
 				}
 			},
 			Data: test.WithData("filter", "event=START").
@@ -54,8 +57,8 @@ func TestEventFilters(t *testing.T) {
 			Command:     testEventFilterExecutor,
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					ExitCode: test.ExitCodeTimeout,
-					Output:   test.Contains(data.Get("output")),
+					ExitCode: expect.ExitCodeTimeout,
+					Output:   expect.Contains(data.Get("output")),
 				}
 			},
 			Data: test.WithData("filter", "event=start").
@@ -63,12 +66,12 @@ func TestEventFilters(t *testing.T) {
 		},
 		{
 			Description: "UnsupportedEventFilter",
-			Require:     test.Not(nerdtest.Docker),
+			Require:     require.Not(nerdtest.Docker),
 			Command:     testEventFilterExecutor,
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					ExitCode: test.ExitCodeTimeout,
-					Output:   test.Contains(data.Get("output")),
+					ExitCode: expect.ExitCodeTimeout,
+					Output:   expect.Contains(data.Get("output")),
 				}
 			},
 			Data: test.WithData("filter", "event=unknown").
@@ -79,8 +82,8 @@ func TestEventFilters(t *testing.T) {
 			Command:     testEventFilterExecutor,
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					ExitCode: test.ExitCodeTimeout,
-					Output:   test.Contains(data.Get("output")),
+					ExitCode: expect.ExitCodeTimeout,
+					Output:   expect.Contains(data.Get("output")),
 				}
 			},
 			Data: test.WithData("filter", "status=start").
@@ -88,12 +91,12 @@ func TestEventFilters(t *testing.T) {
 		},
 		{
 			Description: "UnsupportedStatusFilter",
-			Require:     test.Not(nerdtest.Docker),
+			Require:     require.Not(nerdtest.Docker),
 			Command:     testEventFilterExecutor,
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					ExitCode: test.ExitCodeTimeout,
-					Output:   test.Contains(data.Get("output")),
+					ExitCode: expect.ExitCodeTimeout,
+					Output:   expect.Contains(data.Get("output")),
 				}
 			},
 			Data: test.WithData("filter", "status=unknown").
diff --git a/cmd/nerdctl/system/system_info_test.go b/cmd/nerdctl/system/system_info_test.go
index dc4af4b0..6248a1e0 100644
--- a/cmd/nerdctl/system/system_info_test.go
+++ b/cmd/nerdctl/system/system_info_test.go
@@ -23,10 +23,13 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/infoutil"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func testInfoComparator(stdout string, info string, t *testing.T) {
@@ -53,22 +56,22 @@ func TestInfo(t *testing.T) {
 		},
 		{
 			Description: "info with namespace",
-			Require:     test.Not(nerdtest.Docker),
+			Require:     require.Not(nerdtest.Docker),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Custom("nerdctl", "info")
 			},
-			Expected: test.Expects(0, nil, test.Contains("Namespace:	default")),
+			Expected: test.Expects(0, nil, expect.Contains("Namespace:	default")),
 		},
 		{
 			Description: "info with namespace env var",
 			Env: map[string]string{
 				"CONTAINERD_NAMESPACE": "test",
 			},
-			Require: test.Not(nerdtest.Docker),
+			Require: require.Not(nerdtest.Docker),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Custom("nerdctl", "info")
 			},
-			Expected: test.Expects(0, nil, test.Contains("Namespace:	test")),
+			Expected: test.Expects(0, nil, expect.Contains("Namespace:	test")),
 		},
 	}
 
diff --git a/cmd/nerdctl/system/system_prune_linux_test.go b/cmd/nerdctl/system/system_prune_linux_test.go
index 1d47b266..45a0b896 100644
--- a/cmd/nerdctl/system/system_prune_linux_test.go
+++ b/cmd/nerdctl/system/system_prune_linux_test.go
@@ -23,9 +23,12 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestSystemPrune(t *testing.T) {
@@ -76,7 +79,7 @@ func TestSystemPrune(t *testing.T) {
 			// FIXME: using a dedicated namespace does not work with rootful (because of buildkitd)
 			NoParallel: true,
 			// buildkitd is not available with docker
-			Require: test.Require(nerdtest.Build, test.Not(nerdtest.Docker)),
+			Require: require.All(nerdtest.Build, require.Not(nerdtest.Docker)),
 			// FIXME: this test will happily say "green" even if the command actually fails to do its duty
 			// if there is nothing in the build cache.
 			// Ensure with setup here that we DO build something first
@@ -86,7 +89,7 @@ func TestSystemPrune(t *testing.T) {
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return nerdtest.BuildCtlCommand(helpers, "du")
 			},
-			Expected: test.Expects(0, nil, test.Contains("Total:\t\t0B")),
+			Expected: test.Expects(0, nil, expect.Contains("Total:\t\t0B")),
 		},
 	}
 
diff --git a/cmd/nerdctl/volume/volume_create_test.go b/cmd/nerdctl/volume/volume_create_test.go
index 1cde5336..8e761c6e 100644
--- a/cmd/nerdctl/volume/volume_create_test.go
+++ b/cmd/nerdctl/volume/volume_create_test.go
@@ -22,9 +22,10 @@ import (
 	"testing"
 
 	"github.com/containerd/errdefs"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestVolumeCreate(t *testing.T) {
@@ -34,7 +35,7 @@ func TestVolumeCreate(t *testing.T) {
 		{
 			Description: "arg missing should create anonymous volume",
 			Command:     test.Command("volume", "create"),
-			Expected:    test.Expects(0, nil, test.Match(regexp.MustCompile("^[a-f0-9]{64}\n$"))),
+			Expected:    test.Expects(0, nil, expect.Match(regexp.MustCompile("^[a-f0-9]{64}\n$"))),
 		},
 		{
 			Description: "invalid identifier should fail",
@@ -56,7 +57,7 @@ func TestVolumeCreate(t *testing.T) {
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.Equals(data.Identifier() + "\n"),
+					Output: expect.Equals(data.Identifier() + "\n"),
 				}
 			},
 		},
@@ -70,7 +71,7 @@ func TestVolumeCreate(t *testing.T) {
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.Equals(data.Identifier() + "\n"),
+					Output: expect.Equals(data.Identifier() + "\n"),
 				}
 			},
 		},
@@ -99,7 +100,7 @@ func TestVolumeCreate(t *testing.T) {
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.Equals(data.Identifier() + "\n"),
+					Output: expect.Equals(data.Identifier() + "\n"),
 				}
 			},
 		},
diff --git a/cmd/nerdctl/volume/volume_inspect_test.go b/cmd/nerdctl/volume/volume_inspect_test.go
index a7ec478b..7e627a11 100644
--- a/cmd/nerdctl/volume/volume_inspect_test.go
+++ b/cmd/nerdctl/volume/volume_inspect_test.go
@@ -28,10 +28,12 @@ import (
 	"gotest.tools/v3/assert"
 
 	"github.com/containerd/errdefs"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/native"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func createFileWithSize(mountPoint string, size int64) error {
@@ -95,8 +97,8 @@ func TestVolumeInspect(t *testing.T) {
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.All(
-						test.Contains(data.Get("vol1")),
+					Output: expect.All(
+						expect.Contains(data.Get("vol1")),
 						func(stdout string, info string, t *testing.T) {
 							var dc []native.Volume
 							if err := json.Unmarshal([]byte(stdout), &dc); err != nil {
@@ -117,8 +119,8 @@ func TestVolumeInspect(t *testing.T) {
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.All(
-						test.Contains(data.Get("vol2")),
+					Output: expect.All(
+						expect.Contains(data.Get("vol2")),
 						func(stdout string, info string, t *testing.T) {
 							var dc []native.Volume
 							if err := json.Unmarshal([]byte(stdout), &dc); err != nil {
@@ -135,14 +137,14 @@ func TestVolumeInspect(t *testing.T) {
 		},
 		{
 			Description: "inspect size",
-			Require:     test.Not(nerdtest.Docker),
+			Require:     require.Not(nerdtest.Docker),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("volume", "inspect", "--size", data.Get("vol1"))
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.All(
-						test.Contains(data.Get("vol1")),
+					Output: expect.All(
+						expect.Contains(data.Get("vol1")),
 						func(stdout string, info string, t *testing.T) {
 							var dc []native.Volume
 							if err := json.Unmarshal([]byte(stdout), &dc); err != nil {
@@ -161,9 +163,9 @@ func TestVolumeInspect(t *testing.T) {
 			},
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.All(
-						test.Contains(data.Get("vol1")),
-						test.Contains(data.Get("vol2")),
+					Output: expect.All(
+						expect.Contains(data.Get("vol1")),
+						expect.Contains(data.Get("vol2")),
 						func(stdout string, info string, t *testing.T) {
 							var dc []native.Volume
 							if err := json.Unmarshal([]byte(stdout), &dc); err != nil {
@@ -186,8 +188,8 @@ func TestVolumeInspect(t *testing.T) {
 				return &test.Expected{
 					ExitCode: 1,
 					Errors:   []error{errdefs.ErrNotFound, errdefs.ErrInvalidArgument},
-					Output: test.All(
-						test.Contains(data.Get("vol1")),
+					Output: expect.All(
+						expect.Contains(data.Get("vol1")),
 						func(stdout string, info string, t *testing.T) {
 							var dc []native.Volume
 							if err := json.Unmarshal([]byte(stdout), &dc); err != nil {
diff --git a/cmd/nerdctl/volume/volume_list_test.go b/cmd/nerdctl/volume/volume_list_test.go
index d48b3580..0610925d 100644
--- a/cmd/nerdctl/volume/volume_list_test.go
+++ b/cmd/nerdctl/volume/volume_list_test.go
@@ -24,16 +24,18 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/tabutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestVolumeLsSize(t *testing.T) {
 	nerdtest.Setup()
 
 	tc := &test.Case{
-		Require: test.Not(nerdtest.Docker),
+		Require: require.Not(nerdtest.Docker),
 		Setup: func(data test.Data, helpers test.Helpers) {
 			helpers.Ensure("volume", "create", data.Identifier("1"))
 			helpers.Ensure("volume", "create", data.Identifier("2"))
@@ -304,7 +306,7 @@ func TestVolumeLsFilter(t *testing.T) {
 		},
 		{
 			Description: "Retrieving size=1024000",
-			Require:     test.Not(nerdtest.Docker),
+			Require:     require.Not(nerdtest.Docker),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("volume", "ls", "--size", "--filter", "size=1024000")
 			},
@@ -335,7 +337,7 @@ func TestVolumeLsFilter(t *testing.T) {
 		},
 		{
 			Description: "Retrieving size>=1024000 size<=2048000",
-			Require:     test.Not(nerdtest.Docker),
+			Require:     require.Not(nerdtest.Docker),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("volume", "ls", "--size", "--filter", "size>=1024000", "--filter", "size<=2048000")
 			},
@@ -366,7 +368,7 @@ func TestVolumeLsFilter(t *testing.T) {
 		},
 		{
 			Description: "Retrieving size>204800 size<1024000",
-			Require:     test.Not(nerdtest.Docker),
+			Require:     require.Not(nerdtest.Docker),
 			Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
 				return helpers.Command("volume", "ls", "--size", "--filter", "size>204800", "--filter", "size<1024000")
 			},
diff --git a/cmd/nerdctl/volume/volume_namespace_test.go b/cmd/nerdctl/volume/volume_namespace_test.go
index c2a2d6ce..a4b351d9 100644
--- a/cmd/nerdctl/volume/volume_namespace_test.go
+++ b/cmd/nerdctl/volume/volume_namespace_test.go
@@ -20,16 +20,18 @@ import (
 	"testing"
 
 	"github.com/containerd/errdefs"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestVolumeNamespace(t *testing.T) {
 	testCase := nerdtest.Setup()
 
 	// Docker does not support namespaces
-	testCase.Require = test.Not(nerdtest.Docker)
+	testCase.Require = require.Not(nerdtest.Docker)
 
 	// Create a volume in a different namespace
 	testCase.Setup = func(data test.Data, helpers test.Helpers) {
@@ -72,8 +74,8 @@ func TestVolumeNamespace(t *testing.T) {
 			Command: test.Command("volume", "prune", "-a", "-f"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.All(
-						test.DoesNotContain(data.Get("root_volume")),
+					Output: expect.All(
+						expect.DoesNotContain(data.Get("root_volume")),
 						func(stdout string, info string, t *testing.T) {
 							helpers.Ensure("--namespace", data.Get("root_namespace"), "volume", "inspect", data.Get("root_volume"))
 						},
diff --git a/cmd/nerdctl/volume/volume_prune_linux_test.go b/cmd/nerdctl/volume/volume_prune_linux_test.go
index c33922c7..10b4e6b8 100644
--- a/cmd/nerdctl/volume/volume_prune_linux_test.go
+++ b/cmd/nerdctl/volume/volume_prune_linux_test.go
@@ -20,9 +20,11 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func TestVolumePrune(t *testing.T) {
@@ -66,11 +68,11 @@ func TestVolumePrune(t *testing.T) {
 			Command:     test.Command("volume", "prune", "-f"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.All(
-						test.DoesNotContain(data.Get("anonIDBusy")),
-						test.Contains(data.Get("anonIDDangling")),
-						test.DoesNotContain(data.Get("namedBusy")),
-						test.DoesNotContain(data.Get("namedDangling")),
+					Output: expect.All(
+						expect.DoesNotContain(data.Get("anonIDBusy")),
+						expect.Contains(data.Get("anonIDDangling")),
+						expect.DoesNotContain(data.Get("namedBusy")),
+						expect.DoesNotContain(data.Get("namedDangling")),
 						func(stdout string, info string, t *testing.T) {
 							helpers.Ensure("volume", "inspect", data.Get("anonIDBusy"))
 							helpers.Fail("volume", "inspect", data.Get("anonIDDangling"))
@@ -89,11 +91,11 @@ func TestVolumePrune(t *testing.T) {
 			Command:     test.Command("volume", "prune", "-f", "--all"),
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.All(
-						test.DoesNotContain(data.Get("anonIDBusy")),
-						test.Contains(data.Get("anonIDDangling")),
-						test.DoesNotContain(data.Get("namedBusy")),
-						test.Contains(data.Get("namedDangling")),
+					Output: expect.All(
+						expect.DoesNotContain(data.Get("anonIDBusy")),
+						expect.Contains(data.Get("anonIDDangling")),
+						expect.DoesNotContain(data.Get("namedBusy")),
+						expect.Contains(data.Get("namedDangling")),
 						func(stdout string, info string, t *testing.T) {
 							helpers.Ensure("volume", "inspect", data.Get("anonIDBusy"))
 							helpers.Fail("volume", "inspect", data.Get("anonIDDangling"))
diff --git a/cmd/nerdctl/volume/volume_remove_linux_test.go b/cmd/nerdctl/volume/volume_remove_linux_test.go
index 50bd936d..01680bd3 100644
--- a/cmd/nerdctl/volume/volume_remove_linux_test.go
+++ b/cmd/nerdctl/volume/volume_remove_linux_test.go
@@ -24,10 +24,11 @@ import (
 	"gotest.tools/v3/assert"
 
 	"github.com/containerd/errdefs"
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 // TestVolumeRemove does test a large variety of volume remove situations, albeit none of them being
@@ -123,7 +124,7 @@ func TestVolumeRemove(t *testing.T) {
 
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.Equals(data.Identifier() + "\n"),
+					Output: expect.Equals(data.Identifier() + "\n"),
 				}
 			},
 		},
@@ -144,7 +145,7 @@ func TestVolumeRemove(t *testing.T) {
 
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.Equals(data.Identifier() + "\n"),
+					Output: expect.Equals(data.Identifier() + "\n"),
 				}
 			},
 		},
@@ -175,7 +176,7 @@ func TestVolumeRemove(t *testing.T) {
 						errdefs.ErrFailedPrecondition,
 						errdefs.ErrInvalidArgument,
 					},
-					Output: test.Equals(data.Identifier() + "\n"),
+					Output: expect.Equals(data.Identifier() + "\n"),
 				}
 			},
 		},
@@ -197,7 +198,7 @@ func TestVolumeRemove(t *testing.T) {
 
 			Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 				return &test.Expected{
-					Output: test.Equals(data.Identifier("1") + "\n" + data.Identifier("2") + "\n"),
+					Output: expect.Equals(data.Identifier("1") + "\n" + data.Identifier("2") + "\n"),
 				}
 			},
 		},
diff --git a/pkg/testutil/test/LICENSE b/mod/tigron/LICENSE
similarity index 100%
rename from pkg/testutil/test/LICENSE
rename to mod/tigron/LICENSE
diff --git a/pkg/testutil/test/Makefile b/mod/tigron/Makefile
similarity index 99%
rename from pkg/testutil/test/Makefile
rename to mod/tigron/Makefile
index 812eeb42..4e6b13ce 100644
--- a/pkg/testutil/test/Makefile
+++ b/mod/tigron/Makefile
@@ -34,7 +34,7 @@ ifdef VERBOSE
 	VERBOSE_FLAG_LONG := --verbose
 endif
 
-ifndef DC_NO_FANCY
+ifndef NO_COLOR
     NC := \033[0m
     GREEN := \033[1;32m
     ORANGE := \033[1;33m
diff --git a/pkg/testutil/test/README.md b/mod/tigron/README.md
similarity index 100%
rename from pkg/testutil/test/README.md
rename to mod/tigron/README.md
diff --git a/pkg/testutil/test/expected.go b/mod/tigron/expect/comparators.go
similarity index 52%
rename from pkg/testutil/test/expected.go
rename to mod/tigron/expect/comparators.go
index 9057974c..dde002db 100644
--- a/pkg/testutil/test/expected.go
+++ b/mod/tigron/expect/comparators.go
@@ -14,7 +14,7 @@
    limitations under the License.
 */
 
-package test
+package expect
 
 import (
 	"fmt"
@@ -23,65 +23,58 @@ import (
 	"testing"
 
 	"gotest.tools/v3/assert"
-)
 
-// RunCommand is the simplest way to express a test.TestableCommand for very basic cases when access to test data is not necessary
-func Command(args ...string) Executor {
-	return func(data Data, helpers Helpers) TestableCommand {
-		return helpers.Command(args...)
-	}
-}
-
-// Expects is provided as a simple helper covering "expectations" for simple use-cases where access to the test data is not necessary
-func Expects(exitCode int, errors []error, output Comparator) Manager {
-	return func(_ Data, _ Helpers) *Expected {
-		return &Expected{
-			ExitCode: exitCode,
-			Errors:   errors,
-			Output:   output,
-		}
-	}
-}
+	"github.com/containerd/nerdctl/mod/tigron/test"
+)
 
-// All can be used as a parameter for expected.Output to group a set of comparators
-func All(comparators ...Comparator) Comparator {
+// All can be used as a parameter for expected.Output to group a set of comparators.
+func All(comparators ...test.Comparator) test.Comparator {
+	//nolint:thelper
 	return func(stdout string, info string, t *testing.T) {
 		t.Helper()
+
 		for _, comparator := range comparators {
 			comparator(stdout, info, t)
 		}
 	}
 }
 
-// Contains can be used as a parameter for expected.Output and ensures a comparison string is found contained in the output
-func Contains(compare string) Comparator {
+// Contains can be used as a parameter for expected.Output and ensures a comparison string
+// is found contained in the output.
+func Contains(compare string) test.Comparator {
+	//nolint:thelper
 	return func(stdout string, info string, t *testing.T) {
 		t.Helper()
-		assert.Check(t, strings.Contains(stdout, compare), fmt.Sprintf("Output does not contain: %q", compare)+info)
+		assert.Check(t, strings.Contains(stdout, compare),
+			fmt.Sprintf("Output does not contain: %q", compare)+info)
 	}
 }
 
-// DoesNotContain is to be used for expected.Output to ensure a comparison string is NOT found in the output
-func DoesNotContain(compare string) Comparator {
+// DoesNotContain is to be used for expected.Output to ensure a comparison string is NOT found in the output.
+func DoesNotContain(compare string) test.Comparator {
+	//nolint:thelper
 	return func(stdout string, info string, t *testing.T) {
 		t.Helper()
-		assert.Check(t, !strings.Contains(stdout, compare), fmt.Sprintf("Output does contain: %q", compare)+info)
+		assert.Check(t, !strings.Contains(stdout, compare),
+			fmt.Sprintf("Output does contain: %q", compare)+info)
 	}
 }
 
-// Equals is to be used for expected.Output to ensure it is exactly the output
-func Equals(compare string) Comparator {
+// Equals is to be used for expected.Output to ensure it is exactly the output.
+func Equals(compare string) test.Comparator {
+	//nolint:thelper
 	return func(stdout string, info string, t *testing.T) {
 		t.Helper()
 		assert.Equal(t, compare, stdout, info)
 	}
 }
 
-// Provisional - expected use, but have not seen it so far
-// Match is to be used for expected.Output to ensure we match a regexp
-func Match(reg *regexp.Regexp) Comparator {
+// Match is to be used for expected.Output to ensure we match a regexp.
+// Provisional - expected use, but have not seen it so far.
+func Match(reg *regexp.Regexp) test.Comparator {
+	//nolint:thelper
 	return func(stdout string, info string, t *testing.T) {
 		t.Helper()
-		assert.Check(t, reg.MatchString(stdout), fmt.Sprintf("Output does not match: %s", reg), info)
+		assert.Check(t, reg.MatchString(stdout), "Output does not match: "+reg.String(), info)
 	}
 }
diff --git a/mod/tigron/expect/comparators_test.go b/mod/tigron/expect/comparators_test.go
new file mode 100644
index 00000000..211ca7ad
--- /dev/null
+++ b/mod/tigron/expect/comparators_test.go
@@ -0,0 +1,40 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package expect_test
+
+import (
+	"regexp"
+	"testing"
+
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+)
+
+func TestExpect(t *testing.T) {
+	t.Parallel()
+
+	expect.Contains("b")("a b c", "info", t)
+	expect.DoesNotContain("d")("a b c", "info", t)
+	expect.Equals("a b c")("a b c", "info", t)
+	expect.Match(regexp.MustCompile("[a-z ]+"))("a b c", "info", t)
+
+	expect.All(
+		expect.Contains("b"),
+		expect.DoesNotContain("d"),
+		expect.Equals("a b c"),
+		expect.Match(regexp.MustCompile("[a-z ]+")),
+	)("a b c", "info", t)
+}
diff --git a/pkg/testutil/test/go.mod b/mod/tigron/go.mod
similarity index 73%
rename from pkg/testutil/test/go.mod
rename to mod/tigron/go.mod
index 3fa134d2..78efedc5 100644
--- a/pkg/testutil/test/go.mod
+++ b/mod/tigron/go.mod
@@ -1,6 +1,6 @@
-module github.com/containerd/nerdctl/v2/pkg/testutil/test
+module github.com/containerd/nerdctl/mod/tigron
 
-go 1.22.7
+go 1.23
 
 require (
 	golang.org/x/sync v0.11.0
diff --git a/pkg/testutil/test/go.sum b/mod/tigron/go.sum
similarity index 100%
rename from pkg/testutil/test/go.sum
rename to mod/tigron/go.sum
diff --git a/pkg/testutil/test/hack/dev-setup-linux.sh b/mod/tigron/hack/dev-setup-linux.sh
similarity index 100%
rename from pkg/testutil/test/hack/dev-setup-linux.sh
rename to mod/tigron/hack/dev-setup-linux.sh
diff --git a/pkg/testutil/test/hack/dev-setup-macos.sh b/mod/tigron/hack/dev-setup-macos.sh
similarity index 100%
rename from pkg/testutil/test/hack/dev-setup-macos.sh
rename to mod/tigron/hack/dev-setup-macos.sh
diff --git a/pkg/testutil/test/hack/headers/bash.txt b/mod/tigron/hack/headers/bash.txt
similarity index 100%
rename from pkg/testutil/test/hack/headers/bash.txt
rename to mod/tigron/hack/headers/bash.txt
diff --git a/pkg/testutil/test/hack/headers/dockerfile.txt b/mod/tigron/hack/headers/dockerfile.txt
similarity index 100%
rename from pkg/testutil/test/hack/headers/dockerfile.txt
rename to mod/tigron/hack/headers/dockerfile.txt
diff --git a/pkg/testutil/test/hack/headers/go.txt b/mod/tigron/hack/headers/go.txt
similarity index 100%
rename from pkg/testutil/test/hack/headers/go.txt
rename to mod/tigron/hack/headers/go.txt
diff --git a/pkg/testutil/test/hack/headers/makefile.txt b/mod/tigron/hack/headers/makefile.txt
similarity index 100%
rename from pkg/testutil/test/hack/headers/makefile.txt
rename to mod/tigron/hack/headers/makefile.txt
diff --git a/pkg/testutil/test/hack/make-lint-licenses.sh b/mod/tigron/hack/make-lint-licenses.sh
similarity index 100%
rename from pkg/testutil/test/hack/make-lint-licenses.sh
rename to mod/tigron/hack/make-lint-licenses.sh
diff --git a/pkg/testutil/test/requirement.go b/mod/tigron/require/requirement.go
similarity index 68%
rename from pkg/testutil/test/requirement.go
rename to mod/tigron/require/requirement.go
index 9a7abe0c..15c1d0bb 100644
--- a/pkg/testutil/test/requirement.go
+++ b/mod/tigron/require/requirement.go
@@ -14,17 +14,19 @@
    limitations under the License.
 */
 
-package test
+package require
 
 import (
 	"fmt"
 	"os/exec"
 	"runtime"
+
+	"github.com/containerd/nerdctl/mod/tigron/test"
 )
 
-func Binary(name string) *Requirement {
-	return &Requirement{
-		Check: func(data Data, helpers Helpers) (bool, string) {
+func Binary(name string) *test.Requirement {
+	return &test.Requirement{
+		Check: func(data test.Data, helpers test.Helpers) (bool, string) {
 			mess := fmt.Sprintf("executable %q has been found in PATH", name)
 			ret := true
 			if _, err := exec.LookPath(name); err != nil {
@@ -37,9 +39,9 @@ func Binary(name string) *Requirement {
 	}
 }
 
-func OS(os string) *Requirement {
-	return &Requirement{
-		Check: func(data Data, helpers Helpers) (bool, string) {
+func OS(os string) *test.Requirement {
+	return &test.Requirement{
+		Check: func(data test.Data, helpers test.Helpers) (bool, string) {
 			mess := fmt.Sprintf("current operating system is %q", runtime.GOOS)
 			ret := true
 			if runtime.GOOS != os {
@@ -51,9 +53,9 @@ func OS(os string) *Requirement {
 	}
 }
 
-func Arch(arch string) *Requirement {
-	return &Requirement{
-		Check: func(data Data, helpers Helpers) (bool, string) {
+func Arch(arch string) *test.Requirement {
+	return &test.Requirement{
+		Check: func(data test.Data, helpers test.Helpers) (bool, string) {
 			mess := fmt.Sprintf("current architecture is %q", runtime.GOARCH)
 			ret := true
 			if runtime.GOARCH != arch {
@@ -73,18 +75,18 @@ var Darwin = OS("darwin")
 
 // NOTE: Not will always lose setups and cleanups...
 
-func Not(requirement *Requirement) *Requirement {
-	return &Requirement{
-		Check: func(data Data, helpers Helpers) (bool, string) {
+func Not(requirement *test.Requirement) *test.Requirement {
+	return &test.Requirement{
+		Check: func(data test.Data, helpers test.Helpers) (bool, string) {
 			ret, mess := requirement.Check(data, helpers)
 			return !ret, mess
 		},
 	}
 }
 
-func Require(requirements ...*Requirement) *Requirement {
-	return &Requirement{
-		Check: func(data Data, helpers Helpers) (bool, string) {
+func All(requirements ...*test.Requirement) *test.Requirement {
+	return &test.Requirement{
+		Check: func(data test.Data, helpers test.Helpers) (bool, string) {
 			ret := true
 			mess := ""
 			var subMess string
@@ -97,14 +99,14 @@ func Require(requirements ...*Requirement) *Requirement {
 			}
 			return ret, mess
 		},
-		Setup: func(data Data, helpers Helpers) {
+		Setup: func(data test.Data, helpers test.Helpers) {
 			for _, requirement := range requirements {
 				if requirement.Setup != nil {
 					requirement.Setup(data, helpers)
 				}
 			}
 		},
-		Cleanup: func(data Data, helpers Helpers) {
+		Cleanup: func(data test.Data, helpers test.Helpers) {
 			for _, requirement := range requirements {
 				if requirement.Cleanup != nil {
 					requirement.Cleanup(data, helpers)
diff --git a/pkg/testutil/test/case.go b/mod/tigron/test/case.go
similarity index 99%
rename from pkg/testutil/test/case.go
rename to mod/tigron/test/case.go
index 58f9f573..46c02f2f 100644
--- a/pkg/testutil/test/case.go
+++ b/mod/tigron/test/case.go
@@ -23,7 +23,7 @@ import (
 	"gotest.tools/v3/assert"
 )
 
-// Case describes an entire test-case, including data, setup and cleanup routines, command and expectations
+// Case describes an entire test-case, including data, setup and cleanup routines, command and expectations.
 type Case struct {
 	// Description contains a human-readable short desc, used as a seed for the identifier and as a title for the test
 	Description string
diff --git a/pkg/testutil/test/command.go b/mod/tigron/test/command.go
similarity index 79%
rename from pkg/testutil/test/command.go
rename to mod/tigron/test/command.go
index 6e81de74..764de70f 100644
--- a/pkg/testutil/test/command.go
+++ b/mod/tigron/test/command.go
@@ -30,12 +30,40 @@ import (
 	"gotest.tools/v3/assert"
 	"gotest.tools/v3/icmd"
 
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test/internal/pty"
+	"github.com/containerd/nerdctl/mod/tigron/test/internal"
+	"github.com/containerd/nerdctl/mod/tigron/test/internal/pty"
 )
 
-const ExitCodeGenericFail = -1
-const ExitCodeNoCheck = -2
-const ExitCodeTimeout = -3
+// CustomizableCommand is an interface meant for people who want to heavily customize the base command
+// of their test case.
+type CustomizableCommand interface {
+	TestableCommand
+
+	PrependArgs(args ...string)
+	// WithBlacklist allows to filter out unwanted variables from the embedding environment -
+	// default it pass any that is defined by WithEnv
+	WithBlacklist(env []string)
+
+	// withEnv *copies* the passed map to the environment of the command to be executed
+	// Note that this will override any variable defined in the embedding environment
+	withEnv(env map[string]string)
+	// withTempDir specifies a temporary directory to use
+	withTempDir(path string)
+	// WithConfig allows passing custom config properties from the test to the base command
+	withConfig(config Config)
+	withT(t *testing.T)
+	// Clear does a clone, but will clear binary and arguments, but retain the env, or any other custom properties
+	// Gotcha: if GenericCommand is embedded with a custom Run and an overridden clear to return the embedding type
+	// the result will be the embedding command, no longer the GenericCommand
+	clear() TestableCommand
+
+	// Will manipulate specific configuration option on the command
+	// Note that config is a copy of the test config
+	// Any modification done here will not be passed along to subtests, although they are shared
+	// amongst all commands of the test.
+	write(key ConfigKey, value ConfigValue)
+	read(key ConfigKey) ConfigValue
+}
 
 // GenericCommand is a concrete Command implementation
 type GenericCommand struct {
@@ -148,14 +176,14 @@ func (gc *GenericCommand) Run(expect *Expected) {
 		// Build the debug string - additionally attach the env (which iCmd does not do)
 		debug := result.String() + "Env:\n" + strings.Join(env, "\n")
 		// ExitCode goes first
-		if expect.ExitCode == ExitCodeNoCheck { //nolint:revive
+		if expect.ExitCode == internal.ExitCodeNoCheck { //nolint:revive
 			// ExitCodeNoCheck means we do not care at all about exit code. It can be a failure, a success, or a timeout.
-		} else if expect.ExitCode == ExitCodeGenericFail {
+		} else if expect.ExitCode == internal.ExitCodeGenericFail {
 			// ExitCodeGenericFail means we expect an error (excluding timeout).
 			assert.Assert(gc.t, result.ExitCode != 0,
 				"Command succeeded while we were expecting an error\n"+debug)
 		} else if result.Timeout {
-			assert.Assert(gc.t, expect.ExitCode == ExitCodeTimeout,
+			assert.Assert(gc.t, expect.ExitCode == internal.ExitCodeTimeout,
 				"Command unexpectedly timed-out\n"+debug)
 		} else {
 			assert.Assert(gc.t, expect.ExitCode == result.ExitCode,
diff --git a/pkg/testutil/test/config.go b/mod/tigron/test/config.go
similarity index 100%
rename from pkg/testutil/test/config.go
rename to mod/tigron/test/config.go
diff --git a/pkg/testutil/test/data.go b/mod/tigron/test/data.go
similarity index 100%
rename from pkg/testutil/test/data.go
rename to mod/tigron/test/data.go
diff --git a/mod/tigron/test/expected.go b/mod/tigron/test/expected.go
new file mode 100644
index 00000000..3ef181a7
--- /dev/null
+++ b/mod/tigron/test/expected.go
@@ -0,0 +1,35 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package test
+
+// RunCommand is the simplest way to express a test.TestableCommand for very basic cases when access to test data is not necessary
+func Command(args ...string) Executor {
+	return func(data Data, helpers Helpers) TestableCommand {
+		return helpers.Command(args...)
+	}
+}
+
+// Expects is provided as a simple helper covering "expectations" for simple use-cases where access to the test data is not necessary
+func Expects(exitCode int, errors []error, output Comparator) Manager {
+	return func(_ Data, _ Helpers) *Expected {
+		return &Expected{
+			ExitCode: exitCode,
+			Errors:   errors,
+			Output:   output,
+		}
+	}
+}
diff --git a/mod/tigron/test/funct.go b/mod/tigron/test/funct.go
new file mode 100644
index 00000000..cc6f80c0
--- /dev/null
+++ b/mod/tigron/test/funct.go
@@ -0,0 +1,34 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package test
+
+import "testing"
+
+// An Evaluator is a function that decides whether a test should run or not.
+type Evaluator func(data Data, helpers Helpers) (bool, string)
+
+// A Butler is the function signature meant to be attached to a Setup or Cleanup routine for a Case or Requirement.
+type Butler func(data Data, helpers Helpers)
+
+// A Comparator is the function signature to implement for the Output property of an Expected.
+type Comparator func(stdout string, info string, t *testing.T)
+
+// A Manager is the function signature meant to produce expectations for a command.
+type Manager func(data Data, helpers Helpers) *Expected
+
+// An Executor is the function signature meant to be attached to the Command property of a Case.
+type Executor func(data Data, helpers Helpers) TestableCommand
diff --git a/pkg/testutil/test/helpers.go b/mod/tigron/test/helpers.go
similarity index 64%
rename from pkg/testutil/test/helpers.go
rename to mod/tigron/test/helpers.go
index 9247f409..d09443b3 100644
--- a/pkg/testutil/test/helpers.go
+++ b/mod/tigron/test/helpers.go
@@ -16,36 +16,11 @@
 
 package test
 
-import "testing"
-
-// Helpers provides a set of helpers to run commands with simple expectations, available at all stages of a test (Setup, Cleanup, etc...)
-type Helpers interface {
-	// Ensure runs a command and verifies it is succeeding
-	Ensure(args ...string)
-	// Anyhow runs a command and ignores its result
-	Anyhow(args ...string)
-	// Fail runs a command and verifies it failed
-	Fail(args ...string)
-	// Capture runs a command, verifies it succeeded, and returns stdout
-	Capture(args ...string) string
-	// Err runs a command, and returns stderr regardless of its outcome
-	// This is mostly useful for debugging
-	Err(args ...string) string
-
-	// Command will return a populated command from the default internal command, with the provided arguments,
-	// ready to be Run or further configured
-	Command(args ...string) TestableCommand
-	// Custom will return a bare command, without configuration nor defaults (still has the Env)
-	Custom(binary string, args ...string) TestableCommand
-
-	// Read return the config value associated with a key
-	Read(key ConfigKey) ConfigValue
-	// Write saves a value in the config
-	Write(key ConfigKey, value ConfigValue)
-
-	// T returns the current testing object
-	T() *testing.T
-}
+import (
+	"testing"
+
+	"github.com/containerd/nerdctl/mod/tigron/test/internal"
+)
 
 // This is the implementation of Helpers
 
@@ -70,7 +45,7 @@ func (help *helpersInternal) Anyhow(args ...string) {
 // Fail will run a command and make sure it does fail
 func (help *helpersInternal) Fail(args ...string) {
 	help.Command(args...).Run(&Expected{
-		ExitCode: ExitCodeGenericFail,
+		ExitCode: internal.ExitCodeGenericFail,
 	})
 }
 
@@ -85,7 +60,7 @@ func (help *helpersInternal) Capture(args ...string) string {
 	return ret
 }
 
-// Capture will run a command, ensure it is successful and return stdout
+// Err will run a command, ensure it is successful and return stdout
 func (help *helpersInternal) Err(args ...string) string {
 	cmd := help.Command(args...)
 	cmd.Run(nil)
diff --git a/mod/tigron/test/interfaces.go b/mod/tigron/test/interfaces.go
new file mode 100644
index 00000000..d83b3117
--- /dev/null
+++ b/mod/tigron/test/interfaces.go
@@ -0,0 +1,109 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package test
+
+import (
+	"io"
+	"os"
+	"testing"
+	"time"
+)
+
+// Data is meant to hold information about a test:
+// - first, any random key value data that the test implementer wants to carry / modify - this is test data
+// - second, some commonly useful immutable test properties (a way to generate unique identifiers for that test,
+// temporary directory, etc.)
+// Note that Data is inherited, from parent test to subtest (except for Identifier and TempDir of course).
+type Data interface {
+	// Get returns the value of a certain key for custom data
+	Get(key string) string
+	// Set will save `value` for `key`
+	Set(key string, value string) Data
+
+	// Identifier returns the test identifier that can be used to name resources
+	Identifier(suffix ...string) string
+	// TempDir returns the test temporary directory
+	TempDir() string
+}
+
+// Helpers provides a set of helpers to run commands with simple expectations,
+// available at all stages of a test (Setup, Cleanup, etc...)
+type Helpers interface {
+	// Ensure runs a command and verifies it is succeeding
+	Ensure(args ...string)
+	// Anyhow runs a command and ignores its result
+	Anyhow(args ...string)
+	// Fail runs a command and verifies it failed
+	Fail(args ...string)
+	// Capture runs a command, verifies it succeeded, and returns stdout
+	Capture(args ...string) string
+	// Err runs a command, and returns stderr regardless of its outcome
+	// This is mostly useful for debugging
+	Err(args ...string) string
+
+	// Command will return a populated command from the default internal command, with the provided arguments,
+	// ready to be Run or further configured
+	Command(args ...string) TestableCommand
+	// Custom will return a bare command, without configuration nor defaults (still has the Env)
+	Custom(binary string, args ...string) TestableCommand
+
+	// Read return the config value associated with a key
+	Read(key ConfigKey) ConfigValue
+	// Write saves a value in the config
+	Write(key ConfigKey, value ConfigValue)
+
+	// T returns the current testing object
+	T() *testing.T
+}
+
+// The TestableCommand interface represents a low-level command to execute, typically to be compared with an Expected
+// A TestableCommand can be used as a Case Command obviously, but also as part of a Setup or Cleanup routine,
+// and as the basis of any type of helper.
+// For more powerful use-cases outside of test cases, see below CustomizableCommand.
+type TestableCommand interface {
+	// WithBinary specifies what binary to execute
+	WithBinary(binary string)
+	// WithArgs specifies the args to pass to the binary. Note that WithArgs can be used multiple times and is additive.
+	WithArgs(args ...string)
+	// WithWrapper allows wrapping a command with another command (for example: `time`)
+	WithWrapper(binary string, args ...string)
+	WithPseudoTTY(writers ...func(*os.File) error)
+	// WithStdin allows passing a reader to be used for stdin for the command
+	WithStdin(r io.Reader)
+	// WithCwd allows specifying the working directory for the command
+	WithCwd(path string)
+	// Clone returns a copy of the command
+	Clone() TestableCommand
+
+	// Run does execute the command, and compare the output with the provided expectation.
+	// Passing nil for `Expected` will just run the command regardless of outcome.
+	// An empty `&Expected{}` is (of course) equivalent to &Expected{Exit: 0}, meaning the command is
+	// verified to be successful
+	Run(expect *Expected)
+	// Background allows starting a command in the background
+	Background(timeout time.Duration)
+	// Signal sends a signal to a backgrounded command
+	Signal(sig os.Signal) error
+	// Stderr allows retrieving the raw stderr output of the command once it has been run
+	Stderr() string
+}
+
+// Config is meant to hold information relevant to the binary (eg: flags defining certain behaviors, etc.)
+type Config interface {
+	Write(key ConfigKey, value ConfigValue) Config
+	Read(key ConfigKey) ConfigValue
+}
diff --git a/mod/tigron/test/internal/consts.go b/mod/tigron/test/internal/consts.go
new file mode 100644
index 00000000..dd058dcf
--- /dev/null
+++ b/mod/tigron/test/internal/consts.go
@@ -0,0 +1,25 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package internal
+
+// This is duplicated form `expect` to avoid circular imports.
+const (
+	ExitCodeSuccess     = 0
+	ExitCodeGenericFail = -1
+	ExitCodeNoCheck     = -2
+	ExitCodeTimeout     = -3
+)
diff --git a/pkg/testutil/test/internal/pty/pty.go b/mod/tigron/test/internal/pty/pty.go
similarity index 100%
rename from pkg/testutil/test/internal/pty/pty.go
rename to mod/tigron/test/internal/pty/pty.go
diff --git a/pkg/testutil/test/internal/pty/pty_darwin.go b/mod/tigron/test/internal/pty/pty_darwin.go
similarity index 100%
rename from pkg/testutil/test/internal/pty/pty_darwin.go
rename to mod/tigron/test/internal/pty/pty_darwin.go
diff --git a/pkg/testutil/test/internal/pty/pty_freebsd.go b/mod/tigron/test/internal/pty/pty_freebsd.go
similarity index 100%
rename from pkg/testutil/test/internal/pty/pty_freebsd.go
rename to mod/tigron/test/internal/pty/pty_freebsd.go
diff --git a/pkg/testutil/test/internal/pty/pty_linux.go b/mod/tigron/test/internal/pty/pty_linux.go
similarity index 100%
rename from pkg/testutil/test/internal/pty/pty_linux.go
rename to mod/tigron/test/internal/pty/pty_linux.go
diff --git a/pkg/testutil/test/internal/pty/pty_windows.go b/mod/tigron/test/internal/pty/pty_windows.go
similarity index 100%
rename from pkg/testutil/test/internal/pty/pty_windows.go
rename to mod/tigron/test/internal/pty/pty_windows.go
diff --git a/mod/tigron/test/test.go b/mod/tigron/test/test.go
new file mode 100644
index 00000000..d1d2490e
--- /dev/null
+++ b/mod/tigron/test/test.go
@@ -0,0 +1,34 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package test
+
+import (
+	"testing"
+)
+
+type Testable interface {
+	CustomCommand(testCase *Case, t *testing.T) CustomizableCommand
+	AmbientRequirements(testCase *Case, t *testing.T)
+}
+
+var (
+	registeredTestable Testable
+)
+
+func Customize(testable Testable) {
+	registeredTestable = testable
+}
diff --git a/mod/tigron/test/types.go b/mod/tigron/test/types.go
new file mode 100644
index 00000000..7544d808
--- /dev/null
+++ b/mod/tigron/test/types.go
@@ -0,0 +1,45 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package test
+
+type (
+	ConfigKey   string
+	ConfigValue string
+)
+
+// A Requirement offers a way to verify random conditions to decide if a test should be skipped or run.
+// It can also (optionally) provide custom Setup and Cleanup routines.
+type Requirement struct {
+	// Check is expected to verify if the requirement is fulfilled, and return a boolean and an explanatory message
+	Check Evaluator
+	// Setup, if provided, will be run before any test-specific Setup routine, in the order that requirements
+	// have been declared
+	Setup Butler
+	// Cleanup, if provided, will be run after any test-specific Cleanup routine, in the reverse order that
+	// requirements have been declared
+	Cleanup Butler
+}
+
+// Expected expresses the expected output of a command.
+type Expected struct {
+	// ExitCode
+	ExitCode int
+	// Errors contains any error that (once serialized) should be seen in stderr
+	Errors []error
+	// Output function to match against stdout
+	Output Comparator
+}
diff --git a/pkg/testutil/test/utilities.go b/mod/tigron/utils/utilities.go
similarity index 98%
rename from pkg/testutil/test/utilities.go
rename to mod/tigron/utils/utilities.go
index 26da36bd..ea8fa458 100644
--- a/pkg/testutil/test/utilities.go
+++ b/mod/tigron/utils/utilities.go
@@ -14,7 +14,7 @@
    limitations under the License.
 */
 
-package test
+package utils
 
 import (
 	"crypto/rand"
diff --git a/pkg/inspecttypes/dockercompat/dockercompat_test.go b/pkg/inspecttypes/dockercompat/dockercompat_test.go
index 12814bc3..27beead6 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat_test.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat_test.go
@@ -75,6 +75,16 @@ func TestContainerFromNative(t *testing.T) {
 					Pid:        10000,
 					FinishedAt: "",
 				},
+				HostConfig: &HostConfig{
+					PortBindings: nat.PortMap{},
+					GroupAdd:     []string{},
+					LogConfig: loggerLogConfig{
+						Driver: "json-file",
+						Opts:   map[string]string{},
+					},
+					UTSMode: "host",
+					Tmpfs:   map[string]string{},
+				},
 				Mounts: []MountPoint{
 					{
 						Type:        "bind",
@@ -130,6 +140,12 @@ func TestContainerFromNative(t *testing.T) {
 							Source:      "sysfs",
 							Options:     []string{"nosuid", "noexec", "nodev", "ro"},
 						},
+						{
+							Destination: "/etc/hosts",
+							Type:        "bind",
+							Source:      "/mock-sandbox-dir/hosts",
+							Options:     []string{"bind", "rprivate", "rw"},
+						},
 					},
 				},
 				Process: &native.Process{
@@ -144,12 +160,23 @@ func TestContainerFromNative(t *testing.T) {
 				Platform:       runtime.GOOS,
 				ResolvConfPath: "/mock-sandbox-dir/resolv.conf",
 				HostnamePath:   "/mock-sandbox-dir/hostname",
+				HostsPath:      "/mock-sandbox-dir/hosts",
 				State: &ContainerState{
 					Status:     "running",
 					Running:    true,
 					Pid:        10000,
 					FinishedAt: "",
 				},
+				HostConfig: &HostConfig{
+					PortBindings: nat.PortMap{},
+					GroupAdd:     []string{},
+					LogConfig: loggerLogConfig{
+						Driver: "json-file",
+						Opts:   map[string]string{},
+					},
+					UTSMode: "host",
+					Tmpfs:   map[string]string{},
+				},
 				Mounts: []MountPoint{
 					{
 						Type:        "bind",
@@ -175,6 +202,14 @@ func TestContainerFromNative(t *testing.T) {
 						RW:          true,
 						Propagation: "rslave",
 					},
+					{
+						Type:        "bind",
+						Source:      "/mock-sandbox-dir/hosts",
+						Destination: "/etc/hosts",
+						Mode:        "bind,rprivate,rw",
+						RW:          true,
+						Propagation: "rprivate",
+					},
 					// ignore sysfs mountpoint
 				},
 				Config: &Config{},
@@ -222,6 +257,16 @@ func TestContainerFromNative(t *testing.T) {
 					Pid:        10000,
 					FinishedAt: "",
 				},
+				HostConfig: &HostConfig{
+					PortBindings: nat.PortMap{},
+					GroupAdd:     []string{},
+					LogConfig: loggerLogConfig{
+						Driver: "json-file",
+						Opts:   map[string]string{},
+					},
+					UTSMode: "host",
+					Tmpfs:   map[string]string{},
+				},
 				Mounts: []MountPoint{
 					{
 						Type:        "bind",
diff --git a/pkg/testutil/nerdtest/ca/ca.go b/pkg/testutil/nerdtest/ca/ca.go
index da367d46..08615f70 100644
--- a/pkg/testutil/nerdtest/ca/ca.go
+++ b/pkg/testutil/nerdtest/ca/ca.go
@@ -32,7 +32,7 @@ import (
 
 	"gotest.tools/v3/assert"
 
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 )
 
 type CA struct {
diff --git a/pkg/testutil/nerdtest/command.go b/pkg/testutil/nerdtest/command.go
index 99fb0e3b..2675d07a 100644
--- a/pkg/testutil/nerdtest/command.go
+++ b/pkg/testutil/nerdtest/command.go
@@ -25,10 +25,11 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/platform"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 const defaultNamespace = testutil.Namespace
diff --git a/pkg/testutil/nerdtest/registry/cesanta.go b/pkg/testutil/nerdtest/registry/cesanta.go
index cf074542..58bc361f 100644
--- a/pkg/testutil/nerdtest/registry/cesanta.go
+++ b/pkg/testutil/nerdtest/registry/cesanta.go
@@ -29,12 +29,14 @@ import (
 	"gopkg.in/yaml.v3"
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/ca"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/platform"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nettestutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/portlock"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 type CesantaConfigServer struct {
@@ -92,7 +94,7 @@ func ensureContainerStarted(helpers test.Helpers, con string) {
 	for i := 0; i < 5 && !started; i++ {
 		helpers.Command("container", "inspect", con).
 			Run(&test.Expected{
-				ExitCode: test.ExitCodeNoCheck,
+				ExitCode: expect.ExitCodeNoCheck,
 				Output: func(stdout string, info string, t *testing.T) {
 					var dc []dockercompat.Container
 					err := json.Unmarshal([]byte(stdout), &dc)
diff --git a/pkg/testutil/nerdtest/registry/common.go b/pkg/testutil/nerdtest/registry/common.go
index 0f7496b0..d662d00f 100644
--- a/pkg/testutil/nerdtest/registry/common.go
+++ b/pkg/testutil/nerdtest/registry/common.go
@@ -24,7 +24,7 @@ import (
 
 	"golang.org/x/crypto/bcrypt"
 
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 )
 
 // Auth describes a struct able to serialize authenticator information into arguments to be fed to a registry container run
diff --git a/pkg/testutil/nerdtest/registry/docker.go b/pkg/testutil/nerdtest/registry/docker.go
index 9248dc56..30ee7626 100644
--- a/pkg/testutil/nerdtest/registry/docker.go
+++ b/pkg/testutil/nerdtest/registry/docker.go
@@ -24,12 +24,13 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/ca"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/hoststoml"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/platform"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nettestutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/portlock"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func NewDockerRegistry(data test.Data, helpers test.Helpers, currentCA *ca.CA, port int, auth Auth) *Server {
diff --git a/pkg/testutil/nerdtest/registry/kubo.go b/pkg/testutil/nerdtest/registry/kubo.go
index 8cb350a6..1a9a3ca2 100644
--- a/pkg/testutil/nerdtest/registry/kubo.go
+++ b/pkg/testutil/nerdtest/registry/kubo.go
@@ -24,11 +24,12 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/ca"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/platform"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nettestutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/portlock"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func NewKuboRegistry(data test.Data, helpers test.Helpers, t *testing.T, currentCA *ca.CA, port int, auth Auth) *Server {
diff --git a/pkg/testutil/nerdtest/requirements.go b/pkg/testutil/nerdtest/requirements.go
index a5d89481..88acba18 100644
--- a/pkg/testutil/nerdtest/requirements.go
+++ b/pkg/testutil/nerdtest/requirements.go
@@ -25,11 +25,13 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/require"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/buildkitutil"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/platform"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 var BuildkitHost test.ConfigKey = "BuildkitHost"
@@ -94,7 +96,7 @@ var IsFlaky = func(issueLink string) *test.Requirement {
 }
 
 // Docker marks a test as suitable solely for Docker and not Nerdctl
-// Generally used as test.Not(nerdtest.Docker), which of course it the opposite
+// Generally used as require.Not(nerdtest.Docker), which of course it the opposite
 var Docker = &test.Requirement{
 	Check: func(data test.Data, helpers test.Helpers) (ret bool, mess string) {
 		ret = getTarget() == targetDocker
@@ -151,7 +153,7 @@ var Rootless = &test.Requirement{
 }
 
 // Rootful marks a test as suitable only for rootful env
-var Rootful = test.Not(Rootless)
+var Rootful = require.Not(Rootless)
 
 // CGroup requires that cgroup is enabled
 var CGroup = &test.Requirement{
@@ -171,7 +173,7 @@ var CGroup = &test.Requirement{
 	},
 }
 
-var CgroupsAccessible = test.Require(
+var CgroupsAccessible = require.All(
 	CGroup,
 	&test.Requirement{
 		Check: func(data test.Data, helpers test.Helpers) (ret bool, mess string) {
@@ -229,9 +231,9 @@ var Stargz = &test.Requirement{
 }
 
 // Registry marks a test as requiring a registry to be deployed
-var Registry = test.Require(
+var Registry = require.All(
 	// Registry requires Linux currently
-	test.Linux,
+	require.Linux,
 	(func() *test.Requirement {
 		// Provisional: see note in cleanup
 		// var reg *registry.Server
@@ -307,7 +309,7 @@ var IPFS = &test.Requirement{
 		// FIXME: we should be able to access the env (at least through helpers.Command().) instead of this gym
 		helpers.Write(ipfs, enabled)
 		// FIXME: this is incomplete. We obviously need a daemon running, properly configured
-		return test.Binary("ipfs").Check(data, helpers)
+		return require.Binary("ipfs").Check(data, helpers)
 	},
 }
 
diff --git a/pkg/testutil/nerdtest/requirements_other.go b/pkg/testutil/nerdtest/requirements_other.go
index 74e28067..bc2e0292 100644
--- a/pkg/testutil/nerdtest/requirements_other.go
+++ b/pkg/testutil/nerdtest/requirements_other.go
@@ -19,7 +19,7 @@
 package nerdtest
 
 import (
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 )
 
 var HyperV = &test.Requirement{
diff --git a/pkg/testutil/nerdtest/requirements_windows.go b/pkg/testutil/nerdtest/requirements_windows.go
index a1155a97..7cf9b6e8 100644
--- a/pkg/testutil/nerdtest/requirements_windows.go
+++ b/pkg/testutil/nerdtest/requirements_windows.go
@@ -17,8 +17,9 @@
 package nerdtest
 
 import (
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 var HyperV = &test.Requirement{
diff --git a/pkg/testutil/nerdtest/test.go b/pkg/testutil/nerdtest/test.go
index 7bfd485c..9aa623c7 100644
--- a/pkg/testutil/nerdtest/test.go
+++ b/pkg/testutil/nerdtest/test.go
@@ -19,7 +19,7 @@ package nerdtest
 import (
 	"testing"
 
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
+	"github.com/containerd/nerdctl/mod/tigron/test"
 )
 
 var DockerConfig test.ConfigKey = "DockerConfig"
diff --git a/pkg/testutil/nerdtest/third-party.go b/pkg/testutil/nerdtest/third-party.go
index 087ed50e..0a090659 100644
--- a/pkg/testutil/nerdtest/third-party.go
+++ b/pkg/testutil/nerdtest/third-party.go
@@ -21,9 +21,10 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/ca"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest/registry"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 func BuildCtlCommand(helpers test.Helpers, args ...string) test.TestableCommand {
diff --git a/pkg/testutil/nerdtest/utilities.go b/pkg/testutil/nerdtest/utilities.go
index 18f34a8a..b15e5e53 100644
--- a/pkg/testutil/nerdtest/utilities.go
+++ b/pkg/testutil/nerdtest/utilities.go
@@ -23,10 +23,12 @@ import (
 
 	"gotest.tools/v3/assert"
 
+	"github.com/containerd/nerdctl/mod/tigron/expect"
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/dockercompat"
 	"github.com/containerd/nerdctl/v2/pkg/inspecttypes/native"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 const (
@@ -104,7 +106,7 @@ func EnsureContainerStarted(helpers test.Helpers, con string) {
 	for i := 0; i < maxRetry && !started; i++ {
 		helpers.Command("container", "inspect", con).
 			Run(&test.Expected{
-				ExitCode: test.ExitCodeNoCheck,
+				ExitCode: expect.ExitCodeNoCheck,
 				Output: func(stdout string, info string, t *testing.T) {
 					var dc []dockercompat.Container
 					err := json.Unmarshal([]byte(stdout), &dc)
diff --git a/pkg/testutil/nerdtest/utilities_linux.go b/pkg/testutil/nerdtest/utilities_linux.go
index 08df2087..2a12bfd1 100644
--- a/pkg/testutil/nerdtest/utilities_linux.go
+++ b/pkg/testutil/nerdtest/utilities_linux.go
@@ -23,8 +23,9 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/containerd/nerdctl/mod/tigron/test"
+
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
-	"github.com/containerd/nerdctl/v2/pkg/testutil/test"
 )
 
 const SignalCaught = "received"
diff --git a/pkg/testutil/test/test.go b/pkg/testutil/test/test.go
deleted file mode 100644
index 5d4202e3..00000000
--- a/pkg/testutil/test/test.go
+++ /dev/null
@@ -1,165 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package test
-
-import (
-	"io"
-	"os"
-	"testing"
-	"time"
-)
-
-// A Requirement offers a way to verify random conditions to decide if a test should be skipped or run.
-// It can furthermore (optionally) provide custom Setup and Cleanup routines.
-type Requirement struct {
-	// Check is expected to perform random operations and return a boolean and an explanatory message
-	Check Evaluator
-	// Setup, if provided, will be run before any test-specific Setup routine, in the order that requirements have been declared
-	Setup Butler
-	// Cleanup, if provided, will be run after any test-specific Cleanup routine, in the revers order that requirements have been declared
-	Cleanup Butler
-}
-
-// An Evaluator is a function that decides whether a test should run or not
-type Evaluator func(data Data, helpers Helpers) (bool, string)
-
-// A Butler is the function signature meant to be attached to a Setup or Cleanup routine for a Case or Requirement
-type Butler func(data Data, helpers Helpers)
-
-// An Executor is the function signature meant to be attached to the Command property of a Case
-type Executor func(data Data, helpers Helpers) TestableCommand
-
-// A Manager is the function signature to be run to produce expectations to be fed to a command
-type Manager func(data Data, helpers Helpers) *Expected
-
-// A Comparator is the function signature to implement for the Output property of an Expected
-type Comparator func(stdout string, info string, t *testing.T)
-
-// Expected expresses the expected output of a command
-type Expected struct {
-	// ExitCode
-	ExitCode int
-	// Errors contains any error that (once serialized) should be seen in stderr
-	Errors []error
-	// Output function to match against stdout
-	Output Comparator
-}
-
-// Data is meant to hold information about a test:
-// - first, any random key value data that the test implementer wants to carry / modify - this is test data
-// - second, some commonly useful immutable test properties (a way to generate unique identifiers for that test,
-// temporary directory, etc.)
-// Note that Data is inherited, from parent test to subtest (except for Identifier and TempDir of course)
-type Data interface {
-	// Get returns the value of a certain key for custom data
-	Get(key string) string
-	// Set will save `value` for `key`
-	Set(key string, value string) Data
-
-	// Identifier returns the test identifier that can be used to name resources
-	Identifier(suffix ...string) string
-	// TempDir returns the test temporary directory
-	TempDir() string
-}
-
-type ConfigKey string
-type ConfigValue string
-
-// Config is meant to hold information relevant to the binary (eg: flags defining certain behaviors, etc.)
-type Config interface {
-	// Write
-	Write(key ConfigKey, value ConfigValue) Config
-	// Read
-	Read(key ConfigKey) ConfigValue
-}
-
-// The TestableCommand interface represents a low-level command to execute, typically to be compared with an Expected
-// A TestableCommand can be used as a Case Command obviously, but also as part of a Setup or Cleanup routine,
-// and as the basis of any type of helper.
-// For more powerful usecase outside of test cases, see below CustomizableCommand
-type TestableCommand interface {
-	// WithBinary specifies what binary to execute
-	WithBinary(binary string)
-	// WithArgs specifies the args to pass to the binary. Note that WithArgs can be used multiple times and is additive.
-	WithArgs(args ...string)
-	// WithWrapper allows wrapping a command with another command (for example: `time`, `unbuffer`)
-	WithWrapper(binary string, args ...string)
-	// WithPseudoTTY
-	WithPseudoTTY(writers ...func(*os.File) error)
-	// WithStdin allows passing a reader to be used for stdin for the command
-	WithStdin(r io.Reader)
-	// WithCwd allows specifying the working directory for the command
-	WithCwd(path string)
-	// Clone returns a copy of the command
-	Clone() TestableCommand
-
-	// Run does execute the command, and compare the output with the provided expectation.
-	// Passing nil for `Expected` will just run the command regardless of outcome.
-	// An empty `&Expected{}` is (of course) equivalent to &Expected{Exit: 0}, meaning the command is verified to be
-	// successful
-	Run(expect *Expected)
-	// Background allows starting a command in the background
-	Background(timeout time.Duration)
-	// Signal sends a signal to a backgrounded command
-	Signal(sig os.Signal) error
-	// Stderr allows retrieving the raw stderr output of the command
-	Stderr() string
-}
-
-// /////////////////////////////////////////////
-// CustomizableCommand is an interface meant for people who want to heavily customize the base command of their test case
-// It is passed along
-type CustomizableCommand interface {
-	TestableCommand
-
-	PrependArgs(args ...string)
-	// WithBlacklist allows to filter out unwanted variables from the embedding environment - default it pass any that is
-	// defined by WithEnv
-	WithBlacklist(env []string)
-
-	// withEnv *copies* the passed map to the environment of the command to be executed
-	// Note that this will override any variable defined in the embedding environment
-	withEnv(env map[string]string)
-	// withTempDir specifies a temporary directory to use
-	withTempDir(path string)
-	// WithConfig allows passing custom config properties from the test to the base command
-	withConfig(config Config)
-	withT(t *testing.T)
-	// Clear does a clone, but will clear binary and arguments, but retain the env, or any other custom properties
-	// Gotcha: if GenericCommand is embedded with a custom Run and an overridden clear to return the embedding type
-	// the result will be the embedding command, no longer the GenericCommand
-	clear() TestableCommand
-
-	// Will manipulate specific configuration option on the command
-	// Note that config is a copy of the test config
-	// Any modification done here will not be passed along to subtests, although they are shared amongst all commands of the test.
-	write(key ConfigKey, value ConfigValue)
-	read(key ConfigKey) ConfigValue
-}
-
-type Testable interface {
-	CustomCommand(testCase *Case, t *testing.T) CustomizableCommand
-	AmbientRequirements(testCase *Case, t *testing.T)
-}
-
-var (
-	registeredTestable Testable
-)
-
-func Customize(testable Testable) {
-	registeredTestable = testable
-}