Repository: containers/podman
Pull request #21232 (2024-01-11 16:46:08)

Assign separate ports for each appleHV machine
<!--
Thanks for sending a pull request!

Please make sure you've read our contributing guidelines and how to submit a pull request (https://github.com/containers/podman/blob/main/CONTRIBUTING.md#submitting-pull-requests).

In case you're only changing docs, make sure to prefix the pull-request title with "[CI:DOCS]". That will prevent functional tests from running and save time and energy.

Finally, be sure to sign commits with your real name. Since by opening
a PR you already have commits, you can add signatures if needed with
something like `git commit -s --amend`.
-->

#### Does this PR introduce a user-facing change?

<!--
If no, just write `None` in the release-note block below. If yes, a release note
is required: Enter your extended release note in the block below. If the PR
requires additional action from users switching to the new release, include the
string "action required".

For more information on release notes, please follow the Kubernetes model:
https://git.k8s.io/community/contributors/guide/release-notes.md
-->
Fixes: https://github.com/containers/podman/issues/21115
```release-note
Fixed a bug where podman machine commands were not relayed to the correct machine on AppleHV.
```



Patch:
diff --git a/cmd/podman/common/build.go b/cmd/podman/common/build.go
index 95bad7320d..5e60d7f0f3 100644
--- a/cmd/podman/common/build.go
+++ b/cmd/podman/common/build.go
@@ -333,15 +333,15 @@ func buildFlagsWrapperToOptions(c *cobra.Command, contextDir string, flags *Buil
 	}
 	if c.Flag("build-arg").Changed {
 		for _, arg := range flags.BuildArg {
-			key, val, hasVal := strings.Cut(arg, "=")
-			if hasVal {
-				args[key] = val
+			av := strings.SplitN(arg, "=", 2)
+			if len(av) > 1 {
+				args[av[0]] = av[1]
 			} else {
 				// check if the env is set in the local environment and use that value if it is
-				if val, present := os.LookupEnv(key); present {
-					args[key] = val
+				if val, present := os.LookupEnv(av[0]); present {
+					args[av[0]] = val
 				} else {
-					delete(args, key)
+					delete(args, av[0])
 				}
 			}
 		}
@@ -450,15 +450,15 @@ func buildFlagsWrapperToOptions(c *cobra.Command, contextDir string, flags *Buil
 	additionalBuildContext := make(map[string]*buildahDefine.AdditionalBuildContext)
 	if c.Flag("build-context").Changed {
 		for _, contextString := range flags.BuildContext {
-			key, val, hasVal := strings.Cut(contextString, "=")
-			if hasVal {
-				parseAdditionalBuildContext, err := parse.GetAdditionalBuildContext(val)
+			av := strings.SplitN(contextString, "=", 2)
+			if len(av) > 1 {
+				parseAdditionalBuildContext, err := parse.GetAdditionalBuildContext(av[1])
 				if err != nil {
 					return nil, fmt.Errorf("while parsing additional build context: %w", err)
 				}
-				additionalBuildContext[key] = &parseAdditionalBuildContext
+				additionalBuildContext[av[0]] = &parseAdditionalBuildContext
 			} else {
-				return nil, fmt.Errorf("while parsing additional build context: %s, accepts value in the form of key=value", contextString)
+				return nil, fmt.Errorf("while parsing additional build context: %q, accepts value in the form of key=value", av)
 			}
 		}
 	}
diff --git a/cmd/podman/common/completion.go b/cmd/podman/common/completion.go
index 40804f5a9f..75825f1ea1 100644
--- a/cmd/podman/common/completion.go
+++ b/cmd/podman/common/completion.go
@@ -423,9 +423,9 @@ func prefixSlice(pre string, slice []string) []string {
 
 func suffixCompSlice(suf string, slice []string) []string {
 	for i := range slice {
-		key, val, hasVal := strings.Cut(slice[i], "\t")
-		if hasVal {
-			slice[i] = key + suf + "\t" + val
+		split := strings.SplitN(slice[i], "\t", 2)
+		if len(split) > 1 {
+			slice[i] = split[0] + suf + "\t" + split[1]
 		} else {
 			slice[i] += suf
 		}
@@ -878,10 +878,10 @@ func AutocompleteScp(cmd *cobra.Command, args []string, toComplete string) ([]st
 	}
 	switch len(args) {
 	case 0:
-		prefix, imagesToComplete, isImages := strings.Cut(toComplete, "::")
-		if isImages {
-			imageSuggestions, _ := getImages(cmd, imagesToComplete)
-			return prefixSlice(prefix+"::", imageSuggestions), cobra.ShellCompDirectiveNoFileComp
+		split := strings.SplitN(toComplete, "::", 2)
+		if len(split) > 1 {
+			imageSuggestions, _ := getImages(cmd, split[1])
+			return prefixSlice(split[0]+"::", imageSuggestions), cobra.ShellCompDirectiveNoFileComp
 		}
 		connectionSuggestions, _ := AutocompleteSystemConnections(cmd, args, toComplete)
 		imageSuggestions, _ := getImages(cmd, toComplete)
@@ -893,9 +893,9 @@ func AutocompleteScp(cmd *cobra.Command, args []string, toComplete string) ([]st
 		}
 		return totalSuggestions, directive
 	case 1:
-		_, imagesToComplete, isImages := strings.Cut(args[0], "::")
-		if isImages {
-			if len(imagesToComplete) > 0 {
+		split := strings.SplitN(args[0], "::", 2)
+		if len(split) > 1 {
+			if len(split[1]) > 0 {
 				return nil, cobra.ShellCompDirectiveNoFileComp
 			}
 			imageSuggestions, _ := getImages(cmd, toComplete)
@@ -1076,7 +1076,7 @@ func AutocompleteUserFlag(cmd *cobra.Command, args []string, toComplete string)
 
 		var groups []string
 		scanner := bufio.NewScanner(file)
-		user, _, _ := strings.Cut(toComplete, ":")
+		user := strings.SplitN(toComplete, ":", 2)[0]
 		for scanner.Scan() {
 			entries := strings.SplitN(scanner.Text(), ":", 4)
 			groups = append(groups, user+":"+entries[0])
diff --git a/cmd/podman/containers/create.go b/cmd/podman/containers/create.go
index 8fe845d449..b48b096878 100644
--- a/cmd/podman/containers/create.go
+++ b/cmd/podman/containers/create.go
@@ -342,10 +342,10 @@ func PullImage(imageName string, cliVals *entities.ContainerCreateOptions) (stri
 			if cliVals.Arch != "" || cliVals.OS != "" {
 				return "", errors.New("--platform option can not be specified with --arch or --os")
 			}
-			OS, Arch, hasArch := strings.Cut(cliVals.Platform, "/")
-			cliVals.OS = OS
-			if hasArch {
-				cliVals.Arch = Arch
+			split := strings.SplitN(cliVals.Platform, "/", 2)
+			cliVals.OS = split[0]
+			if len(split) > 1 {
+				cliVals.Arch = split[1]
 			}
 		}
 	}
diff --git a/cmd/podman/containers/pause.go b/cmd/podman/containers/pause.go
index 402faaa26c..4b0ae5fe36 100644
--- a/cmd/podman/containers/pause.go
+++ b/cmd/podman/containers/pause.go
@@ -102,11 +102,11 @@ func pause(cmd *cobra.Command, args []string) error {
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		pauseOpts.Filters[fname] = append(pauseOpts.Filters[fname], filter)
+		pauseOpts.Filters[split[0]] = append(pauseOpts.Filters[split[0]], split[1])
 	}
 
 	responses, err := registry.ContainerEngine().ContainerPause(context.Background(), args, pauseOpts)
diff --git a/cmd/podman/containers/ps.go b/cmd/podman/containers/ps.go
index 4848cd6955..0c21a30ae8 100644
--- a/cmd/podman/containers/ps.go
+++ b/cmd/podman/containers/ps.go
@@ -195,11 +195,11 @@ func ps(cmd *cobra.Command, _ []string) error {
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) == 1 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		listOpts.Filters[fname] = append(listOpts.Filters[fname], filter)
+		listOpts.Filters[split[0]] = append(listOpts.Filters[split[0]], split[1])
 	}
 	listContainers, err := getResponses()
 	if err != nil {
diff --git a/cmd/podman/containers/restart.go b/cmd/podman/containers/restart.go
index 06da8a0a2a..e5e7b0add7 100644
--- a/cmd/podman/containers/restart.go
+++ b/cmd/podman/containers/restart.go
@@ -114,11 +114,11 @@ func restart(cmd *cobra.Command, args []string) error {
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		restartOpts.Filters[fname] = append(restartOpts.Filters[fname], filter)
+		restartOpts.Filters[split[0]] = append(restartOpts.Filters[split[0]], split[1])
 	}
 
 	responses, err := registry.ContainerEngine().ContainerRestart(context.Background(), args, restartOpts)
diff --git a/cmd/podman/containers/rm.go b/cmd/podman/containers/rm.go
index 74d43da2ec..a29233cf3c 100644
--- a/cmd/podman/containers/rm.go
+++ b/cmd/podman/containers/rm.go
@@ -116,16 +116,16 @@ func rm(cmd *cobra.Command, args []string) error {
 			}
 			return fmt.Errorf("reading CIDFile: %w", err)
 		}
-		id, _, _ := strings.Cut(string(content), "\n")
+		id := strings.Split(string(content), "\n")[0]
 		args = append(args, id)
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		rmOptions.Filters[fname] = append(rmOptions.Filters[fname], filter)
+		rmOptions.Filters[split[0]] = append(rmOptions.Filters[split[0]], split[1])
 	}
 
 	if rmOptions.All {
diff --git a/cmd/podman/containers/start.go b/cmd/podman/containers/start.go
index 709e9d57b6..eba46d707a 100644
--- a/cmd/podman/containers/start.go
+++ b/cmd/podman/containers/start.go
@@ -124,11 +124,11 @@ func start(cmd *cobra.Command, args []string) error {
 
 	containers := utils.RemoveSlash(args)
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		startOptions.Filters[fname] = append(startOptions.Filters[fname], filter)
+		startOptions.Filters[split[0]] = append(startOptions.Filters[split[0]], split[1])
 	}
 
 	responses, err := registry.ContainerEngine().ContainerStart(registry.GetContext(), containers, startOptions)
diff --git a/cmd/podman/containers/stop.go b/cmd/podman/containers/stop.go
index 84822cf53e..e62ec7b675 100644
--- a/cmd/podman/containers/stop.go
+++ b/cmd/podman/containers/stop.go
@@ -119,11 +119,11 @@ func stop(cmd *cobra.Command, args []string) error {
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		stopOptions.Filters[fname] = append(stopOptions.Filters[fname], filter)
+		stopOptions.Filters[split[0]] = append(stopOptions.Filters[split[0]], split[1])
 	}
 
 	responses, err := registry.ContainerEngine().ContainerStop(context.Background(), args, stopOptions)
diff --git a/cmd/podman/containers/unpause.go b/cmd/podman/containers/unpause.go
index 7d04daa578..68ef8e1f54 100644
--- a/cmd/podman/containers/unpause.go
+++ b/cmd/podman/containers/unpause.go
@@ -110,11 +110,11 @@ func unpause(cmd *cobra.Command, args []string) error {
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		unpauseOpts.Filters[fname] = append(unpauseOpts.Filters[fname], filter)
+		unpauseOpts.Filters[split[0]] = append(unpauseOpts.Filters[split[0]], split[1])
 	}
 
 	responses, err := registry.ContainerEngine().ContainerUnpause(context.Background(), args, unpauseOpts)
diff --git a/cmd/podman/images/pull.go b/cmd/podman/images/pull.go
index 8399f6c9c2..2bcfd2055c 100644
--- a/cmd/podman/images/pull.go
+++ b/cmd/podman/images/pull.go
@@ -149,14 +149,10 @@ func imagePull(cmd *cobra.Command, args []string) error {
 		if pullOptions.Arch != "" || pullOptions.OS != "" {
 			return errors.New("--platform option can not be specified with --arch or --os")
 		}
-
-		specs := strings.Split(platform, "/")
-		pullOptions.OS = specs[0] // may be empty
-		if len(specs) > 1 {
-			pullOptions.Arch = specs[1]
-			if len(specs) > 2 {
-				pullOptions.Variant = specs[2]
-			}
+		split := strings.SplitN(platform, "/", 2)
+		pullOptions.OS = split[0]
+		if len(split) > 1 {
+			pullOptions.Arch = split[1]
 		}
 	}
 
diff --git a/cmd/podman/kube/play.go b/cmd/podman/kube/play.go
index 21bb45260b..8c6aa6a788 100644
--- a/cmd/podman/kube/play.go
+++ b/cmd/podman/kube/play.go
@@ -246,17 +246,18 @@ func play(cmd *cobra.Command, args []string) error {
 	}
 
 	for _, annotation := range playOptions.annotations {
-		key, val, hasVal := strings.Cut(annotation, "=")
-		if !hasVal {
+		splitN := strings.SplitN(annotation, "=", 2)
+		if len(splitN) != 2 {
 			return fmt.Errorf("annotation %q must include an '=' sign", annotation)
 		}
 		if playOptions.Annotations == nil {
 			playOptions.Annotations = make(map[string]string)
 		}
-		if len(val) > define.MaxKubeAnnotation && !playOptions.UseLongAnnotations {
-			return fmt.Errorf("annotation exceeds maximum size, %d, of kubernetes annotation: %s", define.MaxKubeAnnotation, val)
+		annotation := splitN[1]
+		if len(annotation) > define.MaxKubeAnnotation && !playOptions.UseLongAnnotations {
+			return fmt.Errorf("annotation exceeds maximum size, %d, of kubernetes annotation: %s", define.MaxKubeAnnotation, annotation)
 		}
-		playOptions.Annotations[key] = val
+		playOptions.Annotations[splitN[0]] = annotation
 	}
 
 	for _, mac := range playOptions.macs {
diff --git a/cmd/podman/networks/create.go b/cmd/podman/networks/create.go
index 2a8c641c7f..4998462602 100644
--- a/cmd/podman/networks/create.go
+++ b/cmd/podman/networks/create.go
@@ -245,16 +245,16 @@ func parseRoute(routeStr string) (*types.Route, error) {
 }
 
 func parseRange(iprange string) (*types.LeaseRange, error) {
-	startIPString, endIPString, hasDash := strings.Cut(iprange, "-")
-	if hasDash {
+	split := strings.SplitN(iprange, "-", 2)
+	if len(split) > 1 {
 		// range contains dash so assume form is start-end
-		start := net.ParseIP(startIPString)
+		start := net.ParseIP(split[0])
 		if start == nil {
-			return nil, fmt.Errorf("range start ip %q is not a ip address", startIPString)
+			return nil, fmt.Errorf("range start ip %q is not a ip address", split[0])
 		}
-		end := net.ParseIP(endIPString)
+		end := net.ParseIP(split[1])
 		if end == nil {
-			return nil, fmt.Errorf("range end ip %q is not a ip address", endIPString)
+			return nil, fmt.Errorf("range end ip %q is not a ip address", split[1])
 		}
 		return &types.LeaseRange{
 			StartIP: start,
diff --git a/cmd/podman/parse/filters.go b/cmd/podman/parse/filters.go
index af9157cde7..e4ab942afa 100644
--- a/cmd/podman/parse/filters.go
+++ b/cmd/podman/parse/filters.go
@@ -9,11 +9,11 @@ import (
 func FilterArgumentsIntoFilters(filters []string) (url.Values, error) {
 	parsedFilters := make(url.Values)
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		t := strings.SplitN(f, "=", 2)
+		if len(t) < 2 {
 			return parsedFilters, fmt.Errorf("filter input must be in the form of filter=value: %s is invalid", f)
 		}
-		parsedFilters.Add(fname, filter)
+		parsedFilters.Add(t[0], t[1])
 	}
 	return parsedFilters, nil
 }
diff --git a/cmd/podman/parse/net.go b/cmd/podman/parse/net.go
index 9d6ae1947c..b1331464a7 100644
--- a/cmd/podman/parse/net.go
+++ b/cmd/podman/parse/net.go
@@ -33,15 +33,15 @@ var (
 // for add-host flag
 func ValidateExtraHost(val string) (string, error) {
 	// allow for IPv6 addresses in extra hosts by only splitting on first ":"
-	name, ip, hasIP := strings.Cut(val, ":")
-	if !hasIP || len(name) == 0 {
+	arr := strings.SplitN(val, ":", 2)
+	if len(arr) != 2 || len(arr[0]) == 0 {
 		return "", fmt.Errorf("bad format for add-host: %q", val)
 	}
-	if ip == etchosts.HostGateway {
+	if arr[1] == etchosts.HostGateway {
 		return val, nil
 	}
-	if _, err := validateIPAddress(ip); err != nil {
-		return "", fmt.Errorf("invalid IP address in add-host: %q", ip)
+	if _, err := validateIPAddress(arr[1]); err != nil {
+		return "", fmt.Errorf("invalid IP address in add-host: %q", arr[1])
 	}
 	return val, nil
 }
@@ -82,37 +82,45 @@ func GetAllLabels(labelFile, inputLabels []string) (map[string]string, error) {
 		}
 	}
 	for _, label := range inputLabels {
-		key, value, _ := strings.Cut(label, "=")
-		if key == "" {
+		split := strings.SplitN(label, "=", 2)
+		if split[0] == "" {
 			return nil, fmt.Errorf("invalid label format: %q", label)
 		}
-		labels[key] = value
+		value := ""
+		if len(split) > 1 {
+			value = split[1]
+		}
+		labels[split[0]] = value
 	}
 	return labels, nil
 }
 
 func parseEnvOrLabel(env map[string]string, line, configType string) error {
-	key, val, hasVal := strings.Cut(line, "=")
+	data := strings.SplitN(line, "=", 2)
 
 	// catch invalid variables such as "=" or "=A"
-	if key == "" {
+	if data[0] == "" {
 		return fmt.Errorf("invalid environment variable: %q", line)
 	}
 
 	// trim the front of a variable, but nothing else
-	name := strings.TrimLeft(key, whiteSpaces)
+	name := strings.TrimLeft(data[0], whiteSpaces)
 	if strings.ContainsAny(name, whiteSpaces) {
 		return fmt.Errorf("name %q has white spaces, poorly formatted name", name)
 	}
 
-	if hasVal {
-		env[name] = val
+	if len(data) > 1 {
+		env[name] = data[1]
 	} else {
-		if name, hasStar := strings.CutSuffix(name, "*"); hasStar {
+		if strings.HasSuffix(name, "*") {
+			name = strings.TrimSuffix(name, "*")
 			for _, e := range os.Environ() {
-				envKey, envVal, hasEq := strings.Cut(e, "=")
-				if hasEq && strings.HasPrefix(envKey, name) {
-					env[envKey] = envVal
+				part := strings.SplitN(e, "=", 2)
+				if len(part) < 2 {
+					continue
+				}
+				if strings.HasPrefix(part[0], name) {
+					env[part[0]] = part[1]
 				}
 			}
 		} else if configType == ENVType {
diff --git a/cmd/podman/pods/ps.go b/cmd/podman/pods/ps.go
index 4efc7e9f57..45fbd86165 100644
--- a/cmd/podman/pods/ps.go
+++ b/cmd/podman/pods/ps.go
@@ -81,11 +81,11 @@ func pods(cmd *cobra.Command, _ []string) error {
 	if cmd.Flag("filter").Changed {
 		psInput.Filters = make(map[string][]string)
 		for _, f := range inputFilters {
-			fname, filter, hasFilter := strings.Cut(f, "=")
-			if !hasFilter {
+			split := strings.SplitN(f, "=", 2)
+			if len(split) < 2 {
 				return fmt.Errorf("filter input must be in the form of filter=value: %s is invalid", f)
 			}
-			psInput.Filters[fname] = append(psInput.Filters[fname], filter)
+			psInput.Filters[split[0]] = append(psInput.Filters[split[0]], split[1])
 		}
 	}
 	responses, err := registry.ContainerEngine().PodPs(context.Background(), psInput)
diff --git a/cmd/podman/system/connection/add.go b/cmd/podman/system/connection/add.go
index 786bc0b955..4c31a6d1b5 100644
--- a/cmd/podman/system/connection/add.go
+++ b/cmd/podman/system/connection/add.go
@@ -261,15 +261,15 @@ func translateDest(path string) (string, error) {
 	if path == "" {
 		return "", nil
 	}
-	key, val, hasVal := strings.Cut(path, "=")
-	if !hasVal {
-		return key, nil
+	split := strings.SplitN(path, "=", 2)
+	if len(split) == 1 {
+		return split[0], nil
 	}
-	if key != "host" {
-		return "", fmt.Errorf("\"host\" is required for --docker option")
+	if split[0] != "host" {
+		return "", fmt.Errorf("\"host\" is requited for --docker option")
 	}
 	// "host=tcp://myserver:2376,ca=~/ca-file,cert=~/cert-file,key=~/key-file"
-	vals := strings.Split(val, ",")
+	vals := strings.Split(split[1], ",")
 	if len(vals) > 1 {
 		return "", fmt.Errorf("--docker additional options %q not supported", strings.Join(vals[1:], ","))
 	}
diff --git a/docs/source/markdown/podman-systemd.unit.5.md b/docs/source/markdown/podman-systemd.unit.5.md
index 2c2a07c9ab..1876434ab9 100644
--- a/docs/source/markdown/podman-systemd.unit.5.md
+++ b/docs/source/markdown/podman-systemd.unit.5.md
@@ -174,12 +174,12 @@ Valid options for `[Container]` are listed below:
 | GIDMap=0:10000:10                    | --gidmap=0:10000:10                                  |
 | Group=1234                           | --user UID:1234                                      |
 | GlobalArgs=--log-level=debug         | --log-level=debug                                    |
-| HealthCmd=/usr/bin/command           | --health-cmd=/usr/bin/command                        |
+| HealthCmd="/usr/bin/command"         | --health-cmd="/usr/bin/command"                      |
 | HealthInterval=2m                    | --health-interval=2m                                 |
 | HealthOnFailure=kill                 | --health-on-failure=kill                             |
 | HealthRetries=5                      | --health-retries=5                                   |
 | HealthStartPeriod=1m                 | --health-start-period=period=1m                      |
-| HealthStartupCmd=command             | --health-startup-cmd=command                         |
+| HealthStartupCmd="command"           | --health-startup-cmd="command"                       |
 | HealthStartupInterval=1m             | --health-startup-interval=1m                         |
 | HealthStartupRetries=8               | --health-startup-retries=8                           |
 | HealthStartupSuccess=2               | --health-startup-success=2                           |
diff --git a/libpod/container_commit.go b/libpod/container_commit.go
index 8dca951b9f..9ef7970613 100644
--- a/libpod/container_commit.go
+++ b/libpod/container_commit.go
@@ -97,8 +97,8 @@ func (c *Container) Commit(ctx context.Context, destImage string, options Contai
 	// Should we store the ENV we actually want in the spec separately?
 	if c.config.Spec.Process != nil {
 		for _, e := range c.config.Spec.Process.Env {
-			key, val, _ := strings.Cut(e, "=")
-			importBuilder.SetEnv(key, val)
+			splitEnv := strings.SplitN(e, "=", 2)
+			importBuilder.SetEnv(splitEnv[0], splitEnv[1])
 		}
 	}
 	// Expose ports
diff --git a/libpod/container_internal_freebsd.go b/libpod/container_internal_freebsd.go
index 042e165525..b594089200 100644
--- a/libpod/container_internal_freebsd.go
+++ b/libpod/container_internal_freebsd.go
@@ -254,7 +254,7 @@ func (c *Container) addSharedNamespaces(g *generate.Generator) error {
 	}
 	needEnv := true
 	for _, checkEnv := range g.Config.Process.Env {
-		if strings.HasPrefix(checkEnv, "HOSTNAME=") {
+		if strings.SplitN(checkEnv, "=", 2)[0] == "HOSTNAME" {
 			needEnv = false
 			break
 		}
diff --git a/libpod/kube.go b/libpod/kube.go
index 72514d03e1..12895e4c30 100644
--- a/libpod/kube.go
+++ b/libpod/kube.go
@@ -73,13 +73,13 @@ func (p *Pod) GenerateForKube(ctx context.Context, getService, useLongAnnotation
 			return nil, servicePorts, err
 		}
 		for _, host := range infraContainer.config.ContainerNetworkConfig.HostAdd {
-			hostname, ip, hasIP := strings.Cut(host, ":")
-			if !hasIP {
+			hostSli := strings.SplitN(host, ":", 2)
+			if len(hostSli) != 2 {
 				return nil, servicePorts, errors.New("invalid hostAdd")
 			}
 			extraHost = append(extraHost, v1.HostAlias{
-				IP:        ip,
-				Hostnames: []string{hostname},
+				IP:        hostSli[1],
+				Hostnames: []string{hostSli[0]},
 			})
 		}
 		ports, err = portMappingToContainerPort(infraContainer.config.PortMappings, getService)
@@ -1001,10 +1001,10 @@ func containerToV1Container(ctx context.Context, c *Container, getService bool)
 		dnsOptions := make([]v1.PodDNSConfigOption, 0)
 		for _, option := range options {
 			// the option can be "k:v" or just "k", no delimiter is required
-			name, value, _ := strings.Cut(option, ":")
+			opts := strings.SplitN(option, ":", 2)
 			dnsOpt := v1.PodDNSConfigOption{
-				Name:  name,
-				Value: &value,
+				Name:  opts[0],
+				Value: &opts[1],
 			}
 			dnsOptions = append(dnsOptions, dnsOpt)
 		}
@@ -1055,23 +1055,23 @@ func libpodEnvVarsToKubeEnvVars(envs []string, imageEnvs []string) ([]v1.EnvVar,
 	envVars := make([]v1.EnvVar, 0, len(envs))
 	imageMap := make(map[string]string, len(imageEnvs))
 	for _, ie := range imageEnvs {
-		key, val, _ := strings.Cut(ie, "=")
-		imageMap[key] = val
+		split := strings.SplitN(ie, "=", 2)
+		imageMap[split[0]] = split[1]
 	}
 	for _, e := range envs {
-		envName, envValue, hasValue := strings.Cut(e, "=")
-		if !hasValue {
+		split := strings.SplitN(e, "=", 2)
+		if len(split) != 2 {
 			return envVars, fmt.Errorf("environment variable %s is malformed; should be key=value", e)
 		}
-		if defaultEnv[envName] == envValue {
+		if defaultEnv[split[0]] == split[1] {
 			continue
 		}
-		if imageMap[envName] == envValue {
+		if imageMap[split[0]] == split[1] {
 			continue
 		}
 		ev := v1.EnvVar{
-			Name:  envName,
-			Value: envValue,
+			Name:  split[0],
+			Value: split[1],
 		}
 		envVars = append(envVars, ev)
 	}
@@ -1286,22 +1286,25 @@ func generateKubeSecurityContext(c *Container) (*v1.SecurityContext, bool, error
 	var selinuxOpts v1.SELinuxOptions
 	selinuxHasData := false
 	for _, label := range strings.Split(c.config.Spec.Annotations[define.InspectAnnotationLabel], ",label=") {
-		opt, val, hasVal := strings.Cut(label, ":")
-		if hasVal {
-			switch opt {
+		opts := strings.SplitN(label, ":", 2)
+		switch len(opts) {
+		case 2:
+			switch opts[0] {
 			case "filetype":
-				selinuxOpts.FileType = val
+				selinuxOpts.FileType = opts[1]
 				selinuxHasData = true
 			case "type":
-				selinuxOpts.Type = val
+				selinuxOpts.Type = opts[1]
 				selinuxHasData = true
 			case "level":
-				selinuxOpts.Level = val
+				selinuxOpts.Level = opts[1]
+				selinuxHasData = true
+			}
+		case 1:
+			if opts[0] == "disable" {
+				selinuxOpts.Type = "spc_t"
 				selinuxHasData = true
 			}
-		} else if opt == "disable" {
-			selinuxOpts.Type = "spc_t"
-			selinuxHasData = true
 		}
 	}
 	if selinuxHasData {
diff --git a/pkg/api/handlers/compat/containers.go b/pkg/api/handlers/compat/containers.go
index a3b5846123..32a8024ed2 100644
--- a/pkg/api/handlers/compat/containers.go
+++ b/pkg/api/handlers/compat/containers.go
@@ -524,11 +524,11 @@ func LibpodToContainerJSON(l *libpod.Container, sz bool) (*types.ContainerJSON,
 
 	exposedPorts := make(nat.PortSet)
 	for ep := range inspect.NetworkSettings.Ports {
-		port, proto, ok := strings.Cut(ep, "/")
-		if !ok {
+		splitp := strings.SplitN(ep, "/", 2)
+		if len(splitp) != 2 {
 			return nil, fmt.Errorf("PORT/PROTOCOL Format required for %q", ep)
 		}
-		exposedPort, err := nat.NewPort(proto, port)
+		exposedPort, err := nat.NewPort(splitp[1], splitp[0])
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/api/handlers/compat/exec.go b/pkg/api/handlers/compat/exec.go
index 68d3335b8a..819a096ef1 100644
--- a/pkg/api/handlers/compat/exec.go
+++ b/pkg/api/handlers/compat/exec.go
@@ -49,12 +49,12 @@ func ExecCreateHandler(w http.ResponseWriter, r *http.Request) {
 	}
 	libpodConfig.Environment = make(map[string]string)
 	for _, envStr := range input.Env {
-		key, val, hasVal := strings.Cut(envStr, "=")
-		if !hasVal {
+		split := strings.SplitN(envStr, "=", 2)
+		if len(split) != 2 {
 			utils.Error(w, http.StatusBadRequest, fmt.Errorf("environment variable %q badly formed, must be key=value", envStr))
 			return
 		}
-		libpodConfig.Environment[key] = val
+		libpodConfig.Environment[split[0]] = split[1]
 	}
 	libpodConfig.WorkDir = input.WorkingDir
 	libpodConfig.Privileged = input.Privileged
diff --git a/pkg/api/handlers/compat/images_build.go b/pkg/api/handlers/compat/images_build.go
index 195a916227..5619a95033 100644
--- a/pkg/api/handlers/compat/images_build.go
+++ b/pkg/api/handlers/compat/images_build.go
@@ -330,15 +330,15 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
 			if len(secretOpt) > 0 {
 				modifiedOpt := []string{}
 				for _, token := range secretOpt {
-					key, val, hasVal := strings.Cut(token, "=")
-					if hasVal {
-						if key == "src" {
+					arr := strings.SplitN(token, "=", 2)
+					if len(arr) > 1 {
+						if arr[0] == "src" {
 							/* move secret away from contextDir */
 							/* to make sure we dont accidentally commit temporary secrets to image*/
 							builderDirectory, _ := filepath.Split(contextDirectory)
 							// following path is outside build context
-							newSecretPath := filepath.Join(builderDirectory, val)
-							oldSecretPath := filepath.Join(contextDirectory, val)
+							newSecretPath := filepath.Join(builderDirectory, arr[1])
+							oldSecretPath := filepath.Join(contextDirectory, arr[1])
 							err := os.Rename(oldSecretPath, newSecretPath)
 							if err != nil {
 								utils.BadRequest(w, "secrets", query.Secrets, err)
@@ -551,19 +551,19 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
 					utils.BadRequest(w, "securityopt", query.SecurityOpt, errors.New("no-new-privileges is not supported"))
 					return
 				}
-				name, value, hasValue := strings.Cut(opt, "=")
-				if !hasValue {
+				con := strings.SplitN(opt, "=", 2)
+				if len(con) != 2 {
 					utils.BadRequest(w, "securityopt", query.SecurityOpt, fmt.Errorf("invalid --security-opt name=value pair: %q", opt))
 					return
 				}
 
-				switch name {
+				switch con[0] {
 				case "label":
-					labelOpts = append(labelOpts, value)
+					labelOpts = append(labelOpts, con[1])
 				case "apparmor":
-					apparmor = value
+					apparmor = con[1]
 				case "seccomp":
-					seccomp = value
+					seccomp = con[1]
 				default:
 					utils.BadRequest(w, "securityopt", query.SecurityOpt, fmt.Errorf("invalid --security-opt 2: %q", opt))
 					return
diff --git a/pkg/api/handlers/libpod/manifests.go b/pkg/api/handlers/libpod/manifests.go
index 6c7752b8f7..2c53e2162c 100644
--- a/pkg/api/handlers/libpod/manifests.go
+++ b/pkg/api/handlers/libpod/manifests.go
@@ -489,12 +489,12 @@ func ManifestModify(w http.ResponseWriter, r *http.Request) {
 		}
 		annotations := make(map[string]string)
 		for _, annotationSpec := range body.ManifestAddOptions.Annotation {
-			key, val, hasVal := strings.Cut(annotationSpec, "=")
-			if !hasVal {
-				utils.Error(w, http.StatusBadRequest, fmt.Errorf("no value given for annotation %q", key))
+			spec := strings.SplitN(annotationSpec, "=", 2)
+			if len(spec) != 2 {
+				utils.Error(w, http.StatusBadRequest, fmt.Errorf("no value given for annotation %q", spec[0]))
 				return
 			}
-			annotations[key] = val
+			annotations[spec[0]] = spec[1]
 		}
 		body.ManifestAddOptions.Annotations = envLib.Join(body.ManifestAddOptions.Annotations, annotations)
 		body.ManifestAddOptions.Annotation = nil
diff --git a/pkg/auth/auth.go b/pkg/auth/auth.go
index ecbf4d3aee..12ea2458bb 100644
--- a/pkg/auth/auth.go
+++ b/pkg/auth/auth.go
@@ -268,7 +268,7 @@ func normalizeAuthFileKey(authFileKey string) string {
 	stripped = strings.TrimPrefix(stripped, "https://")
 
 	if stripped != authFileKey { // URLs are interpreted to mean complete registries
-		stripped, _, _ = strings.Cut(stripped, "/")
+		stripped = strings.SplitN(stripped, "/", 2)[0]
 	}
 
 	// Only non-namespaced registry names (or URLs) need to be normalized; repo namespaces
diff --git a/pkg/bindings/images/build.go b/pkg/bindings/images/build.go
index 0f0f2dee89..b286b1a496 100644
--- a/pkg/bindings/images/build.go
+++ b/pkg/bindings/images/build.go
@@ -530,9 +530,9 @@ func Build(ctx context.Context, containerFiles []string, options entities.BuildO
 			if len(secretOpt) > 0 {
 				modifiedOpt := []string{}
 				for _, token := range secretOpt {
-					opt, val, hasVal := strings.Cut(token, "=")
-					if hasVal {
-						if opt == "src" {
+					arr := strings.SplitN(token, "=", 2)
+					if len(arr) > 1 {
+						if arr[0] == "src" {
 							// read specified secret into a tmp file
 							// move tmp file to tar and change secret source to relative tmp file
 							tmpSecretFile, err := os.CreateTemp(options.ContextDirectory, "podman-build-secret")
@@ -541,7 +541,7 @@ func Build(ctx context.Context, containerFiles []string, options entities.BuildO
 							}
 							defer os.Remove(tmpSecretFile.Name()) // clean up
 							defer tmpSecretFile.Close()
-							srcSecretFile, err := os.Open(val)
+							srcSecretFile, err := os.Open(arr[1])
 							if err != nil {
 								return nil, err
 							}
diff --git a/pkg/copy/parse.go b/pkg/copy/parse.go
index d58942f571..50f1d211d8 100644
--- a/pkg/copy/parse.go
+++ b/pkg/copy/parse.go
@@ -40,9 +40,9 @@ func parseUserInput(input string) (container string, path string) {
 		return
 	}
 
-	if parsedContainer, parsedPath, ok := strings.Cut(path, ":"); ok {
-		container = parsedContainer
-		path = parsedPath
+	if spl := strings.SplitN(path, ":", 2); len(spl) == 2 {
+		container = spl[0]
+		path = spl[1]
 	}
 	return
 }
diff --git a/pkg/domain/filters/containers.go b/pkg/domain/filters/containers.go
index d690a0bdc9..52ddc746d4 100644
--- a/pkg/domain/filters/containers.go
+++ b/pkg/domain/filters/containers.go
@@ -98,10 +98,10 @@ func GenerateContainerFilterFuncs(filter string, filterValues []string, r *libpo
 				var imageNameWithoutTag string
 				// Compare with ImageID, ImageName
 				// Will match ImageName if running image has tag latest for other tags exact complete filter must be given
-				name, tag, hasColon := strings.Cut(rootfsImageName, ":")
-				if hasColon {
-					imageNameWithoutTag = name
-					imageTag = tag
+				imageNameSlice := strings.SplitN(rootfsImageName, ":", 2)
+				if len(imageNameSlice) == 2 {
+					imageNameWithoutTag = imageNameSlice[0]
+					imageTag = imageNameSlice[1]
 				}
 
 				if (rootfsImageID == filterValue) ||
@@ -144,8 +144,13 @@ func GenerateContainerFilterFuncs(filter string, filterValues []string, r *libpo
 		//- volume=(<volume-name>|<mount-point-destination>)
 		return func(c *libpod.Container) bool {
 			containerConfig := c.ConfigNoCopy()
+			var dest string
 			for _, filterValue := range filterValues {
-				source, dest, _ := strings.Cut(filterValue, ":")
+				arr := strings.SplitN(filterValue, ":", 2)
+				source := arr[0]
+				if len(arr) == 2 {
+					dest = arr[1]
+				}
 				for _, mount := range containerConfig.Spec.Mounts {
 					if dest != "" && (mount.Source == source && mount.Destination == dest) {
 						return true
@@ -228,10 +233,19 @@ func GenerateContainerFilterFuncs(filter string, filterValues []string, r *libpo
 			// check if networkMode is configured as `container:<ctr>`
 			// perform a match against filter `container:<IDorName>`
 			// networks is already going to be empty if `container:<ctr>` is configured as Mode
-			if networkModeContainerID, ok := strings.CutPrefix(networkMode, "container:"); ok {
+			if strings.HasPrefix(networkMode, "container:") {
+				networkModeContainerPart := strings.SplitN(networkMode, ":", 2)
+				if len(networkModeContainerPart) < 2 {
+					return false
+				}
+				networkModeContainerID := networkModeContainerPart[1]
 				for _, val := range filterValues {
-					if idOrName, ok := strings.CutPrefix(val, "container:"); ok {
-						filterNetworkModeIDorName := idOrName
+					if strings.HasPrefix(val, "container:") {
+						filterNetworkModePart := strings.SplitN(val, ":", 2)
+						if len(filterNetworkModePart) < 2 {
+							return false
+						}
+						filterNetworkModeIDorName := filterNetworkModePart[1]
 						filterID, err := r.LookupContainerID(filterNetworkModeIDorName)
 						if err != nil {
 							return false
diff --git a/pkg/domain/filters/volumes.go b/pkg/domain/filters/volumes.go
index 28e541b522..3d629548d4 100644
--- a/pkg/domain/filters/volumes.go
+++ b/pkg/domain/filters/volumes.go
@@ -49,7 +49,14 @@ func GenerateVolumeFilters(filter string, filterValues []string, runtime *libpod
 	case "opt":
 		return func(v *libpod.Volume) bool {
 			for _, val := range filterValues {
-				filterKey, filterVal, _ := strings.Cut(val, "=")
+				filterArray := strings.SplitN(val, "=", 2)
+				filterKey := filterArray[0]
+				var filterVal string
+				if len(filterArray) > 1 {
+					filterVal = filterArray[1]
+				} else {
+					filterVal = ""
+				}
 
 				for labelKey, labelValue := range v.Options() {
 					if labelKey == filterKey && (filterVal == "" || labelValue == filterVal) {
diff --git a/pkg/domain/infra/abi/containers_runlabel.go b/pkg/domain/infra/abi/containers_runlabel.go
index 26626fd501..463988c87e 100644
--- a/pkg/domain/infra/abi/containers_runlabel.go
+++ b/pkg/domain/infra/abi/containers_runlabel.go
@@ -135,7 +135,7 @@ func generateRunlabelCommand(runlabel string, img *libimage.Image, inputName str
 		name = splitImageName[len(splitImageName)-1]
 		// make sure to remove the tag from the image name, otherwise the name cannot
 		// be used as container name because a colon is an illegal character
-		name, _, _ = strings.Cut(name, ":")
+		name = strings.SplitN(name, ":", 2)[0]
 	}
 
 	// Append the user-specified arguments to the runlabel (command).
diff --git a/pkg/domain/infra/abi/manifest.go b/pkg/domain/infra/abi/manifest.go
index d5436a7129..24b89872ee 100644
--- a/pkg/domain/infra/abi/manifest.go
+++ b/pkg/domain/infra/abi/manifest.go
@@ -230,11 +230,11 @@ func (ir *ImageEngine) ManifestAdd(ctx context.Context, name string, images []st
 		if len(opts.Annotation) != 0 {
 			annotations := make(map[string]string)
 			for _, annotationSpec := range opts.Annotation {
-				key, val, hasVal := strings.Cut(annotationSpec, "=")
-				if !hasVal {
-					return "", fmt.Errorf("no value given for annotation %q", key)
+				spec := strings.SplitN(annotationSpec, "=", 2)
+				if len(spec) != 2 {
+					return "", fmt.Errorf("no value given for annotation %q", spec[0])
 				}
-				annotations[key] = val
+				annotations[spec[0]] = spec[1]
 			}
 			opts.Annotations = envLib.Join(opts.Annotations, annotations)
 		}
@@ -269,11 +269,11 @@ func (ir *ImageEngine) ManifestAnnotate(ctx context.Context, name, image string,
 	if len(opts.Annotation) != 0 {
 		annotations := make(map[string]string)
 		for _, annotationSpec := range opts.Annotation {
-			key, val, hasVal := strings.Cut(annotationSpec, "=")
-			if !hasVal {
-				return "", fmt.Errorf("no value given for annotation %q", key)
+			spec := strings.SplitN(annotationSpec, "=", 2)
+			if len(spec) != 2 {
+				return "", fmt.Errorf("no value given for annotation %q", spec[0])
 			}
-			annotations[key] = val
+			annotations[spec[0]] = spec[1]
 		}
 		opts.Annotations = envLib.Join(opts.Annotations, annotations)
 	}
diff --git a/pkg/domain/infra/abi/parse/parse.go b/pkg/domain/infra/abi/parse/parse.go
index 19d26c39e2..0cb95aa042 100644
--- a/pkg/domain/infra/abi/parse/parse.go
+++ b/pkg/domain/infra/abi/parse/parse.go
@@ -27,64 +27,64 @@ func VolumeOptions(opts map[string]string) ([]libpod.VolumeCreateOption, error)
 			for _, o := range splitVal {
 				// Options will be formatted as either "opt" or
 				// "opt=value"
-				opt, val, hasVal := strings.Cut(o, "=")
-				switch strings.ToLower(opt) {
+				splitO := strings.SplitN(o, "=", 2)
+				switch strings.ToLower(splitO[0]) {
 				case "size":
-					size, err := units.FromHumanSize(val)
+					size, err := units.FromHumanSize(splitO[1])
 					if err != nil {
-						return nil, fmt.Errorf("cannot convert size %s to integer: %w", val, err)
+						return nil, fmt.Errorf("cannot convert size %s to integer: %w", splitO[1], err)
 					}
 					libpodOptions = append(libpodOptions, libpod.WithVolumeSize(uint64(size)))
 					finalVal = append(finalVal, o)
 					// set option "SIZE": "$size"
-					volumeOptions["SIZE"] = val
+					volumeOptions["SIZE"] = splitO[1]
 				case "inodes":
-					inodes, err := strconv.ParseUint(val, 10, 64)
+					inodes, err := strconv.ParseUint(splitO[1], 10, 64)
 					if err != nil {
-						return nil, fmt.Errorf("cannot convert inodes %s to integer: %w", val, err)
+						return nil, fmt.Errorf("cannot convert inodes %s to integer: %w", splitO[1], err)
 					}
 					libpodOptions = append(libpodOptions, libpod.WithVolumeInodes(inodes))
 					finalVal = append(finalVal, o)
 					// set option "INODES": "$size"
-					volumeOptions["INODES"] = val
+					volumeOptions["INODES"] = splitO[1]
 				case "uid":
-					if !hasVal {
+					if len(splitO) != 2 {
 						return nil, fmt.Errorf("uid option must provide a UID: %w", define.ErrInvalidArg)
 					}
-					intUID, err := strconv.Atoi(val)
+					intUID, err := strconv.Atoi(splitO[1])
 					if err != nil {
-						return nil, fmt.Errorf("cannot convert UID %s to integer: %w", val, err)
+						return nil, fmt.Errorf("cannot convert UID %s to integer: %w", splitO[1], err)
 					}
 					logrus.Debugf("Removing uid= from options and adding WithVolumeUID for UID %d", intUID)
 					libpodOptions = append(libpodOptions, libpod.WithVolumeUID(intUID), libpod.WithVolumeNoChown())
 					finalVal = append(finalVal, o)
 					// set option "UID": "$uid"
-					volumeOptions["UID"] = val
+					volumeOptions["UID"] = splitO[1]
 				case "gid":
-					if !hasVal {
+					if len(splitO) != 2 {
 						return nil, fmt.Errorf("gid option must provide a GID: %w", define.ErrInvalidArg)
 					}
-					intGID, err := strconv.Atoi(val)
+					intGID, err := strconv.Atoi(splitO[1])
 					if err != nil {
-						return nil, fmt.Errorf("cannot convert GID %s to integer: %w", val, err)
+						return nil, fmt.Errorf("cannot convert GID %s to integer: %w", splitO[1], err)
 					}
 					logrus.Debugf("Removing gid= from options and adding WithVolumeGID for GID %d", intGID)
 					libpodOptions = append(libpodOptions, libpod.WithVolumeGID(intGID), libpod.WithVolumeNoChown())
 					finalVal = append(finalVal, o)
 					// set option "GID": "$gid"
-					volumeOptions["GID"] = val
+					volumeOptions["GID"] = splitO[1]
 				case "noquota":
 					logrus.Debugf("Removing noquota from options and adding WithVolumeDisableQuota")
 					libpodOptions = append(libpodOptions, libpod.WithVolumeDisableQuota())
 					// set option "NOQUOTA": "true"
 					volumeOptions["NOQUOTA"] = "true"
 				case "timeout":
-					if !hasVal {
+					if len(splitO) != 2 {
 						return nil, fmt.Errorf("timeout option must provide a valid timeout in seconds: %w", define.ErrInvalidArg)
 					}
-					intTimeout, err := strconv.Atoi(val)
+					intTimeout, err := strconv.Atoi(splitO[1])
 					if err != nil {
-						return nil, fmt.Errorf("cannot convert Timeout %s to an integer: %w", val, err)
+						return nil, fmt.Errorf("cannot convert Timeout %s to an integer: %w", splitO[1], err)
 					}
 					if intTimeout < 0 {
 						return nil, fmt.Errorf("volume timeout cannot be negative (got %d)", intTimeout)
diff --git a/pkg/domain/infra/tunnel/manifest.go b/pkg/domain/infra/tunnel/manifest.go
index f4aec45b0b..5b176e31ed 100644
--- a/pkg/domain/infra/tunnel/manifest.go
+++ b/pkg/domain/infra/tunnel/manifest.go
@@ -64,11 +64,11 @@ func (ir *ImageEngine) ManifestAdd(_ context.Context, name string, imageNames []
 	if len(opts.Annotation) != 0 {
 		annotations := make(map[string]string)
 		for _, annotationSpec := range opts.Annotation {
-			key, val, hasVal := strings.Cut(annotationSpec, "=")
-			if !hasVal {
-				return "", fmt.Errorf("no value given for annotation %q", key)
+			spec := strings.SplitN(annotationSpec, "=", 2)
+			if len(spec) != 2 {
+				return "", fmt.Errorf("no value given for annotation %q", spec[0])
 			}
-			annotations[key] = val
+			annotations[spec[0]] = spec[1]
 		}
 		opts.Annotations = envLib.Join(opts.Annotations, annotations)
 	}
@@ -97,11 +97,11 @@ func (ir *ImageEngine) ManifestAnnotate(ctx context.Context, name, images string
 	if len(opts.Annotation) != 0 {
 		annotations := make(map[string]string)
 		for _, annotationSpec := range opts.Annotation {
-			key, val, hasVal := strings.Cut(annotationSpec, "=")
-			if !hasVal {
-				return "", fmt.Errorf("no value given for annotation %q", key)
+			spec := strings.SplitN(annotationSpec, "=", 2)
+			if len(spec) != 2 {
+				return "", fmt.Errorf("no value given for annotation %q", spec[0])
 			}
-			annotations[key] = val
+			annotations[spec[0]] = spec[1]
 		}
 		opts.Annotations = envLib.Join(opts.Annotations, annotations)
 	}
diff --git a/pkg/domain/utils/scp.go b/pkg/domain/utils/scp.go
index cd466843d7..0bd1b0d3e6 100644
--- a/pkg/domain/utils/scp.go
+++ b/pkg/domain/utils/scp.go
@@ -406,8 +406,8 @@ func GetServiceInformation(sshInfo *entities.ImageScpConnections, cliConnections
 	var urlS string
 	var iden string
 	for i, val := range cliConnections {
-		connection, _, _ := strings.Cut(val, "::")
-		sshInfo.Connections = append(sshInfo.Connections, connection)
+		splitEnv := strings.SplitN(val, "::", 2)
+		sshInfo.Connections = append(sshInfo.Connections, splitEnv[0])
 		conn, found := cfg.Engine.ServiceDestinations[sshInfo.Connections[i]]
 		if found {
 			urlS = conn.URI
diff --git a/pkg/domain/utils/utils.go b/pkg/domain/utils/utils.go
index ca7a3210fb..ee213e1b62 100644
--- a/pkg/domain/utils/utils.go
+++ b/pkg/domain/utils/utils.go
@@ -34,8 +34,8 @@ func ToLibpodFilters(f url.Values) (filters []string) {
 func ToURLValues(f []string) (filters url.Values) {
 	filters = make(url.Values)
 	for _, v := range f {
-		key, val, _ := strings.Cut(v, "=")
-		filters.Add(key, val)
+		t := strings.SplitN(v, "=", 2)
+		filters.Add(t[0], t[1])
 	}
 	return
 }
diff --git a/pkg/env/env.go b/pkg/env/env.go
index 6dbfb02017..8e87834f85 100644
--- a/pkg/env/env.go
+++ b/pkg/env/env.go
@@ -40,9 +40,14 @@ func Slice(m map[string]string) []string {
 // map.
 func Map(slice []string) map[string]string {
 	envmap := make(map[string]string, len(slice))
-	for _, line := range slice {
-		key, val, _ := strings.Cut(line, "=")
-		envmap[key] = val
+	for _, val := range slice {
+		data := strings.SplitN(val, "=", 2)
+
+		if len(data) > 1 {
+			envmap[data[0]] = data[1]
+		} else {
+			envmap[data[0]] = ""
+		}
 	}
 	return envmap
 }
@@ -89,25 +94,26 @@ func ParseFile(path string) (_ map[string]string, err error) {
 }
 
 func parseEnv(env map[string]string, line string) error {
-	key, val, hasVal := strings.Cut(line, "=")
+	data := strings.SplitN(line, "=", 2)
 
 	// catch invalid variables such as "=" or "=A"
-	if key == "" {
+	if data[0] == "" {
 		return fmt.Errorf("invalid variable: %q", line)
 	}
 	// trim the front of a variable, but nothing else
-	name := strings.TrimLeft(key, whiteSpaces)
-	if hasVal {
-		env[name] = val
+	name := strings.TrimLeft(data[0], whiteSpaces)
+	if len(data) > 1 {
+		env[name] = data[1]
 	} else {
-		if name, hasStar := strings.CutSuffix(name, "*"); hasStar {
+		if strings.HasSuffix(name, "*") {
+			name = strings.TrimSuffix(name, "*")
 			for _, e := range os.Environ() {
-				envKey, envVal, hasEq := strings.Cut(e, "=")
-				if !hasEq {
+				part := strings.SplitN(e, "=", 2)
+				if len(part) < 2 {
 					continue
 				}
-				if strings.HasPrefix(envKey, name) {
-					env[envKey] = envVal
+				if strings.HasPrefix(part[0], name) {
+					env[part[0]] = part[1]
 				}
 			}
 		} else if val, ok := os.LookupEnv(name); ok {
diff --git a/pkg/machine/applehv/config.go b/pkg/machine/applehv/config.go
index eb11c93e3b..26fa74665a 100644
--- a/pkg/machine/applehv/config.go
+++ b/pkg/machine/applehv/config.go
@@ -12,16 +12,16 @@ import (
 	"github.com/containers/podman/v4/pkg/machine"
 	"github.com/containers/podman/v4/pkg/machine/compression"
 	"github.com/containers/podman/v4/pkg/machine/define"
-	"github.com/containers/podman/v4/pkg/machine/vmconfigs"
 	"github.com/containers/podman/v4/pkg/machine/ignition"
+	"github.com/containers/podman/v4/pkg/machine/vmconfigs"
 	vfConfig "github.com/crc-org/vfkit/pkg/config"
 	"github.com/docker/go-units"
 	"golang.org/x/sys/unix"
 )
 
 const (
-	defaultVFKitEndpoint = "http://localhost:8081"
-	ignitionSocketName   = "ignition.sock"
+	localhostURI       = "http://localhost"
+	ignitionSocketName = "ignition.sock"
 )
 
 type AppleHVVirtualization struct {
diff --git a/pkg/machine/applehv/machine.go b/pkg/machine/applehv/machine.go
index 2ca843c83e..99f8d44896 100644
--- a/pkg/machine/applehv/machine.go
+++ b/pkg/machine/applehv/machine.go
@@ -116,7 +116,12 @@ func (m *MacMachine) setVfkitInfo(cfg *config.Config, readySocket define.VMFile)
 	}
 
 	m.Vfkit.VirtualMachine.Devices = defaultDevices
-	m.Vfkit.Endpoint = defaultVFKitEndpoint
+	randPort, err := utils.GetRandomPort()
+	if err != nil {
+		return err
+	}
+
+	m.Vfkit.Endpoint = localhostURI + ":" + strconv.Itoa(randPort)
 	m.Vfkit.VfkitBinaryPath = vfkitBinaryPath
 
 	return nil
diff --git a/pkg/namespaces/namespaces.go b/pkg/namespaces/namespaces.go
index 3c0622c7d5..2731fe95ad 100644
--- a/pkg/namespaces/namespaces.go
+++ b/pkg/namespaces/namespaces.go
@@ -48,21 +48,24 @@ func (n CgroupMode) IsNS() bool {
 
 // NS gets the path associated with a ns:<path> cgroup ns
 func (n CgroupMode) NS() string {
-	_, path, _ := strings.Cut(string(n), ":")
-	return path
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 {
+		return parts[1]
+	}
+	return ""
 }
 
 // IsContainer indicates whether the container uses a new cgroup namespace.
 func (n CgroupMode) IsContainer() bool {
-	typ, _, hasColon := strings.Cut(string(n), ":")
-	return hasColon && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // Container returns the name of the container whose cgroup namespace is going to be used.
 func (n CgroupMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -120,36 +123,36 @@ func (n UsernsMode) IsDefaultValue() bool {
 // GetKeepIDOptions returns a KeepIDUserNsOptions with the settings to keepIDmatically set up
 // a user namespace.
 func (n UsernsMode) GetKeepIDOptions() (*KeepIDUserNsOptions, error) {
-	nsmode, nsopts, hasOpts := strings.Cut(string(n), ":")
-	if nsmode != "keep-id" {
+	parts := strings.SplitN(string(n), ":", 2)
+	if parts[0] != "keep-id" {
 		return nil, fmt.Errorf("wrong user namespace mode")
 	}
 	options := KeepIDUserNsOptions{}
-	if !hasOpts {
+	if len(parts) == 1 {
 		return &options, nil
 	}
-	for _, o := range strings.Split(nsopts, ",") {
-		opt, val, hasVal := strings.Cut(o, "=")
-		if !hasVal {
+	for _, o := range strings.Split(parts[1], ",") {
+		v := strings.SplitN(o, "=", 2)
+		if len(v) != 2 {
 			return nil, fmt.Errorf("invalid option specified: %q", o)
 		}
-		switch opt {
+		switch v[0] {
 		case "uid":
-			s, err := strconv.ParseUint(val, 10, 32)
+			s, err := strconv.ParseUint(v[1], 10, 32)
 			if err != nil {
 				return nil, err
 			}
 			v := uint32(s)
 			options.UID = &v
 		case "gid":
-			s, err := strconv.ParseUint(val, 10, 32)
+			s, err := strconv.ParseUint(v[1], 10, 32)
 			if err != nil {
 				return nil, err
 			}
 			v := uint32(s)
 			options.GID = &v
 		default:
-			return nil, fmt.Errorf("unknown option specified: %q", opt)
+			return nil, fmt.Errorf("unknown option specified: %q", v[0])
 		}
 	}
 	return &options, nil
@@ -182,21 +185,24 @@ func (n UsernsMode) IsNS() bool {
 
 // NS gets the path associated with a ns:<path> userns ns
 func (n UsernsMode) NS() string {
-	_, path, _ := strings.Cut(string(n), ":")
-	return path
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 {
+		return parts[1]
+	}
+	return ""
 }
 
 // IsContainer indicates whether container uses a container userns.
 func (n UsernsMode) IsContainer() bool {
-	typ, _, hasName := strings.Cut(string(n), ":")
-	return hasName && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // Container is the id of the container which network this container is connected to.
 func (n UsernsMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -216,15 +222,15 @@ func (n UTSMode) IsHost() bool {
 
 // IsContainer indicates whether the container uses a container's UTS namespace.
 func (n UTSMode) IsContainer() bool {
-	typ, _, hasName := strings.Cut(string(n), ":")
-	return hasName && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // Container returns the name of the container whose uts namespace is going to be used.
 func (n UTSMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -264,8 +270,8 @@ func (n IpcMode) IsShareable() bool {
 
 // IsContainer indicates whether the container uses another container's ipc namespace.
 func (n IpcMode) IsContainer() bool {
-	typ, _, hasName := strings.Cut(string(n), ":")
-	return hasName && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // IsNone indicates whether container IpcMode is set to "none".
@@ -285,9 +291,9 @@ func (n IpcMode) Valid() bool {
 
 // Container returns the name of the container ipc stack is going to be used.
 func (n IpcMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -307,8 +313,8 @@ func (n PidMode) IsHost() bool {
 
 // IsContainer indicates whether the container uses a container's pid namespace.
 func (n PidMode) IsContainer() bool {
-	typ, _, hasName := strings.Cut(string(n), ":")
-	return hasName && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // Valid indicates whether the pid namespace is valid.
@@ -328,9 +334,9 @@ func (n PidMode) Valid() bool {
 
 // Container returns the name of the container whose pid namespace is going to be used.
 func (n PidMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -360,15 +366,15 @@ func (n NetworkMode) IsPrivate() bool {
 
 // IsContainer indicates whether container uses a container network stack.
 func (n NetworkMode) IsContainer() bool {
-	typ, _, hasName := strings.Cut(string(n), ":")
-	return hasName && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // Container is the id of the container which network this container is connected to.
 func (n NetworkMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -403,8 +409,11 @@ func (n NetworkMode) IsNS() bool {
 
 // NS gets the path associated with a ns:<path> network ns
 func (n NetworkMode) NS() string {
-	_, path, _ := strings.Cut(string(n), ":")
-	return path
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 {
+		return parts[1]
+	}
+	return ""
 }
 
 // IsPod returns whether the network refers to pod networking
diff --git a/pkg/rctl/rctl.go b/pkg/rctl/rctl.go
index 75588c79c6..54ccf40b1b 100644
--- a/pkg/rctl/rctl.go
+++ b/pkg/rctl/rctl.go
@@ -31,8 +31,9 @@ func GetRacct(filter string) (map[string]uint64, error) {
 	entries := strings.Split(string(buf[:len]), ",")
 	res := make(map[string]uint64)
 	for _, entry := range entries {
-		key, valstr, _ := strings.Cut(entry, "=")
-		val, err := strconv.ParseUint(valstr, 10, 0)
+		kv := strings.SplitN(entry, "=", 2)
+		key := kv[0]
+		val, err := strconv.ParseUint(kv[1], 10, 0)
 		if err != nil {
 			logrus.Warnf("unexpected rctl entry, ignoring: %s", entry)
 		}
diff --git a/pkg/specgen/generate/container.go b/pkg/specgen/generate/container.go
index 11541ab809..4471942f24 100644
--- a/pkg/specgen/generate/container.go
+++ b/pkg/specgen/generate/container.go
@@ -236,8 +236,13 @@ func CompleteSpec(ctx context.Context, r *libpod.Runtime, s *specgen.SpecGenerat
 		}
 	}
 
-	for _, annotation := range rtc.Containers.Annotations.Get() {
-		k, v, _ := strings.Cut(annotation, "=")
+	for _, v := range rtc.Containers.Annotations.Get() {
+		split := strings.SplitN(v, "=", 2)
+		k := split[0]
+		v := ""
+		if len(split) == 2 {
+			v = split[1]
+		}
 		annotations[k] = v
 	}
 	// now pass in the values from client
@@ -351,9 +356,9 @@ func ConfigToSpec(rt *libpod.Runtime, specg *specgen.SpecGenerator, containerID
 		if conf.Spec.Process != nil && conf.Spec.Process.Env != nil {
 			env := make(map[string]string)
 			for _, entry := range conf.Spec.Process.Env {
-				key, val, hasVal := strings.Cut(entry, "=")
-				if hasVal {
-					env[key] = val
+				split := strings.SplitN(entry, "=", 2)
+				if len(split) == 2 {
+					env[split[0]] = split[1]
 				}
 			}
 			specg.Env = env
diff --git a/pkg/specgen/generate/container_create.go b/pkg/specgen/generate/container_create.go
index 09483bbb9b..c0878d5000 100644
--- a/pkg/specgen/generate/container_create.go
+++ b/pkg/specgen/generate/container_create.go
@@ -54,12 +54,12 @@ func MakeContainer(ctx context.Context, rt *libpod.Runtime, s *specgen.SpecGener
 			s.ResourceLimits.Unified = make(map[string]string)
 		}
 		for _, cgroupConf := range rtc.Containers.CgroupConf.Get() {
-			key, val, hasVal := strings.Cut(cgroupConf, "=")
-			if !hasVal {
-				return nil, nil, nil, fmt.Errorf("CgroupConf %s from containers.conf invalid, must be name=value", cgroupConf)
+			cgr := strings.SplitN(cgroupConf, "=", 2)
+			if len(cgr) != 2 {
+				return nil, nil, nil, fmt.Errorf("CgroupConf %q from containers.conf invalid, must be name=value", cgr)
 			}
-			if _, ok := s.ResourceLimits.Unified[key]; !ok {
-				s.ResourceLimits.Unified[key] = val
+			if _, ok := s.ResourceLimits.Unified[cgr[0]]; !ok {
+				s.ResourceLimits.Unified[cgr[0]] = cgr[1]
 			}
 		}
 	}
diff --git a/pkg/specgen/generate/kube/kube.go b/pkg/specgen/generate/kube/kube.go
index f10fc21c68..930f1497f0 100644
--- a/pkg/specgen/generate/kube/kube.go
+++ b/pkg/specgen/generate/kube/kube.go
@@ -221,29 +221,29 @@ func ToSpecGen(ctx context.Context, opts *CtrSpecGenOptions) (*specgen.SpecGener
 
 	s.LogConfiguration.Options = make(map[string]string)
 	for _, o := range opts.LogOptions {
-		opt, val, hasVal := strings.Cut(o, "=")
-		if !hasVal {
+		split := strings.SplitN(o, "=", 2)
+		if len(split) < 2 {
 			return nil, fmt.Errorf("invalid log option %q", o)
 		}
-		switch strings.ToLower(opt) {
+		switch strings.ToLower(split[0]) {
 		case "driver":
-			s.LogConfiguration.Driver = val
+			s.LogConfiguration.Driver = split[1]
 		case "path":
-			s.LogConfiguration.Path = val
+			s.LogConfiguration.Path = split[1]
 		case "max-size":
-			logSize, err := units.FromHumanSize(val)
+			logSize, err := units.FromHumanSize(split[1])
 			if err != nil {
 				return nil, err
 			}
 			s.LogConfiguration.Size = logSize
 		default:
-			switch len(val) {
+			switch len(split[1]) {
 			case 0:
 				return nil, fmt.Errorf("invalid log option: %w", define.ErrInvalidArg)
 			default:
 				// tags for journald only
 				if s.LogConfiguration.Driver == "" || s.LogConfiguration.Driver == define.JournaldLogging {
-					s.LogConfiguration.Options[opt] = val
+					s.LogConfiguration.Options[split[0]] = split[1]
 				} else {
 					logrus.Warnf("Can only set tags with journald log driver but driver is %q", s.LogConfiguration.Driver)
 				}
@@ -434,8 +434,8 @@ func ToSpecGen(ctx context.Context, opts *CtrSpecGenOptions) (*specgen.SpecGener
 	// Environment Variables
 	envs := map[string]string{}
 	for _, env := range imageData.Config.Env {
-		key, val, _ := strings.Cut(env, "=")
-		envs[key] = val
+		keyval := strings.SplitN(env, "=", 2)
+		envs[keyval[0]] = keyval[1]
 	}
 
 	for _, env := range opts.Container.Env {
diff --git a/pkg/specgen/generate/storage.go b/pkg/specgen/generate/storage.go
index 8c65783b43..fa66359069 100644
--- a/pkg/specgen/generate/storage.go
+++ b/pkg/specgen/generate/storage.go
@@ -262,9 +262,9 @@ func getVolumesFrom(volumesFrom []string, runtime *libpod.Runtime) (map[string]s
 	for _, volume := range volumesFrom {
 		var options []string
 
-		idOrName, volOpts, hasVolOpts := strings.Cut(volume, ":")
-		if hasVolOpts {
-			splitOpts := strings.Split(volOpts, ",")
+		splitVol := strings.SplitN(volume, ":", 2)
+		if len(splitVol) == 2 {
+			splitOpts := strings.Split(splitVol[1], ",")
 			setRORW := false
 			setZ := false
 			for _, opt := range splitOpts {
@@ -286,9 +286,9 @@ func getVolumesFrom(volumesFrom []string, runtime *libpod.Runtime) (map[string]s
 			options = splitOpts
 		}
 
-		ctr, err := runtime.LookupContainer(idOrName)
+		ctr, err := runtime.LookupContainer(splitVol[0])
 		if err != nil {
-			return nil, nil, fmt.Errorf("looking up container %q for volumes-from: %w", idOrName, err)
+			return nil, nil, fmt.Errorf("looking up container %q for volumes-from: %w", splitVol[0], err)
 		}
 
 		logrus.Debugf("Adding volumes from container %s", ctr.ID())
diff --git a/pkg/specgen/namespaces.go b/pkg/specgen/namespaces.go
index 4b8a6bee41..04d4b08f43 100644
--- a/pkg/specgen/namespaces.go
+++ b/pkg/specgen/namespaces.go
@@ -230,23 +230,29 @@ func (n *Namespace) validate() error {
 // function.
 func ParseNamespace(ns string) (Namespace, error) {
 	toReturn := Namespace{}
-	switch ns {
-	case "pod":
+	switch {
+	case ns == "pod":
 		toReturn.NSMode = FromPod
-	case "host":
+	case ns == "host":
 		toReturn.NSMode = Host
-	case "private", "":
+	case ns == "private", ns == "":
 		toReturn.NSMode = Private
-	default:
-		if value, ok := strings.CutPrefix(ns, "ns:"); ok {
-			toReturn.NSMode = Path
-			toReturn.Value = value
-		} else if value, ok := strings.CutPrefix(ns, "container:"); ok {
-			toReturn.NSMode = FromContainer
-			toReturn.Value = value
-		} else {
-			return toReturn, fmt.Errorf("unrecognized namespace mode %s passed", ns)
+	case strings.HasPrefix(ns, "ns:"):
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, fmt.Errorf("must provide a path to a namespace when specifying \"ns:\"")
 		}
+		toReturn.NSMode = Path
+		toReturn.Value = split[1]
+	case strings.HasPrefix(ns, "container:"):
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, fmt.Errorf("must provide name or ID or a container when specifying \"container:\"")
+		}
+		toReturn.NSMode = FromContainer
+		toReturn.Value = split[1]
+	default:
+		return toReturn, fmt.Errorf("unrecognized namespace mode %s passed", ns)
 	}
 
 	return toReturn, nil
@@ -296,32 +302,37 @@ func ParseIPCNamespace(ns string) (Namespace, error) {
 // form.
 func ParseUserNamespace(ns string) (Namespace, error) {
 	toReturn := Namespace{}
-	switch ns {
-	case "auto":
+	switch {
+	case ns == "auto":
+		toReturn.NSMode = Auto
+		return toReturn, nil
+	case strings.HasPrefix(ns, "auto:"):
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, errors.New("invalid setting for auto: mode")
+		}
 		toReturn.NSMode = Auto
+		toReturn.Value = split[1]
 		return toReturn, nil
-	case "keep-id":
+	case ns == "keep-id":
 		toReturn.NSMode = KeepID
 		return toReturn, nil
-	case "nomap":
+	case strings.HasPrefix(ns, "keep-id:"):
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, errors.New("invalid setting for keep-id: mode")
+		}
+		toReturn.NSMode = KeepID
+		toReturn.Value = split[1]
+		return toReturn, nil
+	case ns == "nomap":
 		toReturn.NSMode = NoMap
 		return toReturn, nil
-	case "":
+	case ns == "":
 		toReturn.NSMode = Host
 		return toReturn, nil
-	default:
-		if value, ok := strings.CutPrefix(ns, "auto:"); ok {
-			toReturn.NSMode = Auto
-			toReturn.Value = value
-			return toReturn, nil
-		} else if value, ok := strings.CutPrefix(ns, "keep-id:"); ok {
-			toReturn.NSMode = KeepID
-			toReturn.Value = value
-			return toReturn, nil
-		} else {
-			return ParseNamespace(ns)
-		}
 	}
+	return ParseNamespace(ns)
 }
 
 // ParseNetworkFlag parses a network string slice into the network options
@@ -341,10 +352,10 @@ func ParseNetworkFlag(networks []string, pastaNetworkNameExists bool) (Namespace
 
 	switch {
 	case ns == string(Slirp), strings.HasPrefix(ns, string(Slirp)+":"):
-		key, options, hasOptions := strings.Cut(ns, ":")
-		if hasOptions {
+		parts := strings.SplitN(ns, ":", 2)
+		if len(parts) > 1 {
 			networkOptions = make(map[string][]string)
-			networkOptions[key] = strings.Split(options, ",")
+			networkOptions[parts[0]] = strings.Split(parts[1], ",")
 		}
 		toReturn.NSMode = Slirp
 	case ns == string(FromPod):
@@ -353,11 +364,11 @@ func ParseNetworkFlag(networks []string, pastaNetworkNameExists bool) (Namespace
 		toReturn.NSMode = Private
 	case ns == string(Bridge), strings.HasPrefix(ns, string(Bridge)+":"):
 		toReturn.NSMode = Bridge
-		_, options, hasOptions := strings.Cut(ns, ":")
+		parts := strings.SplitN(ns, ":", 2)
 		netOpts := types.PerNetworkOptions{}
-		if hasOptions {
+		if len(parts) > 1 {
 			var err error
-			netOpts, err = parseBridgeNetworkOptions(options)
+			netOpts, err = parseBridgeNetworkOptions(parts[1])
 			if err != nil {
 				return toReturn, nil, nil, err
 			}
@@ -370,23 +381,30 @@ func ParseNetworkFlag(networks []string, pastaNetworkNameExists bool) (Namespace
 	case ns == string(Host):
 		toReturn.NSMode = Host
 	case strings.HasPrefix(ns, "ns:"):
-		_, value, _ := strings.Cut(ns, ":")
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, nil, nil, errors.New("must provide a path to a namespace when specifying \"ns:\"")
+		}
 		toReturn.NSMode = Path
-		toReturn.Value = value
+		toReturn.Value = split[1]
 	case strings.HasPrefix(ns, string(FromContainer)+":"):
-		_, value, _ := strings.Cut(ns, ":")
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, nil, nil, errors.New("must provide name or ID or a container when specifying \"container:\"")
+		}
 		toReturn.NSMode = FromContainer
-		toReturn.Value = value
+		toReturn.Value = split[1]
 	case ns == string(Pasta), strings.HasPrefix(ns, string(Pasta)+":"):
-		key, options, hasOptions := strings.Cut(ns, ":")
+		var parts []string
 
 		if pastaNetworkNameExists {
 			goto nextCase
 		}
 
-		if hasOptions {
+		parts = strings.SplitN(ns, ":", 2)
+		if len(parts) > 1 {
 			networkOptions = make(map[string][]string)
-			networkOptions[key] = strings.Split(options, ",")
+			networkOptions[parts[0]] = strings.Split(parts[1], ",")
 		}
 		toReturn.NSMode = Pasta
 		break
@@ -394,22 +412,22 @@ func ParseNetworkFlag(networks []string, pastaNetworkNameExists bool) (Namespace
 		fallthrough
 	default:
 		// we should have a normal network
-		name, options, hasOptions := strings.Cut(ns, ":")
-		if hasOptions {
-			if name == "" {
-				return toReturn, nil, nil, errors.New("network name cannot be empty")
-			}
-			netOpts, err := parseBridgeNetworkOptions(options)
-			if err != nil {
-				return toReturn, nil, nil, fmt.Errorf("invalid option for network %s: %w", name, err)
-			}
-			podmanNetworks[name] = netOpts
-		} else {
+		parts := strings.SplitN(ns, ":", 2)
+		if len(parts) == 1 {
 			// Assume we have been given a comma separated list of networks for backwards compat.
 			networkList := strings.Split(ns, ",")
 			for _, net := range networkList {
 				podmanNetworks[net] = types.PerNetworkOptions{}
 			}
+		} else {
+			if parts[0] == "" {
+				return toReturn, nil, nil, errors.New("network name cannot be empty")
+			}
+			netOpts, err := parseBridgeNetworkOptions(parts[1])
+			if err != nil {
+				return toReturn, nil, nil, fmt.Errorf("invalid option for network %s: %w", parts[0], err)
+			}
+			podmanNetworks[parts[0]] = netOpts
 		}
 
 		// networks need bridge mode
@@ -422,24 +440,24 @@ func ParseNetworkFlag(networks []string, pastaNetworkNameExists bool) (Namespace
 		}
 
 		for _, network := range networks[1:] {
-			name, options, hasOptions := strings.Cut(network, ":")
-			if name == "" {
+			parts := strings.SplitN(network, ":", 2)
+			if parts[0] == "" {
 				return toReturn, nil, nil, fmt.Errorf("network name cannot be empty: %w", define.ErrInvalidArg)
 			}
 			// TODO (5.0): Don't accept string(Pasta) here once we drop pastaNetworkNameExists
 			if slices.Contains([]string{string(Bridge), string(Slirp), string(FromPod), string(NoNetwork),
-				string(Default), string(Private), string(Path), string(FromContainer), string(Host)}, name) {
-				return toReturn, nil, nil, fmt.Errorf("can only set extra network names, selected mode %s conflicts with bridge: %w", name, define.ErrInvalidArg)
+				string(Default), string(Private), string(Path), string(FromContainer), string(Host)}, parts[0]) {
+				return toReturn, nil, nil, fmt.Errorf("can only set extra network names, selected mode %s conflicts with bridge: %w", parts[0], define.ErrInvalidArg)
 			}
 			netOpts := types.PerNetworkOptions{}
-			if hasOptions {
+			if len(parts) > 1 {
 				var err error
-				netOpts, err = parseBridgeNetworkOptions(options)
+				netOpts, err = parseBridgeNetworkOptions(parts[1])
 				if err != nil {
-					return toReturn, nil, nil, fmt.Errorf("invalid option for network %s: %w", name, err)
+					return toReturn, nil, nil, fmt.Errorf("invalid option for network %s: %w", parts[0], err)
 				}
 			}
-			podmanNetworks[name] = netOpts
+			podmanNetworks[parts[0]] = netOpts
 		}
 	}
 
@@ -453,36 +471,36 @@ func parseBridgeNetworkOptions(opts string) (types.PerNetworkOptions, error) {
 	}
 	allopts := strings.Split(opts, ",")
 	for _, opt := range allopts {
-		name, value, _ := strings.Cut(opt, "=")
-		switch name {
+		split := strings.SplitN(opt, "=", 2)
+		switch split[0] {
 		case "ip", "ip6":
-			ip := net.ParseIP(value)
+			ip := net.ParseIP(split[1])
 			if ip == nil {
-				return netOpts, fmt.Errorf("invalid ip address %q", value)
+				return netOpts, fmt.Errorf("invalid ip address %q", split[1])
 			}
 			netOpts.StaticIPs = append(netOpts.StaticIPs, ip)
 
 		case "mac":
-			mac, err := net.ParseMAC(value)
+			mac, err := net.ParseMAC(split[1])
 			if err != nil {
 				return netOpts, err
 			}
 			netOpts.StaticMAC = types.HardwareAddr(mac)
 
 		case "alias":
-			if value == "" {
+			if split[1] == "" {
 				return netOpts, errors.New("alias cannot be empty")
 			}
-			netOpts.Aliases = append(netOpts.Aliases, value)
+			netOpts.Aliases = append(netOpts.Aliases, split[1])
 
 		case "interface_name":
-			if value == "" {
+			if split[1] == "" {
 				return netOpts, errors.New("interface_name cannot be empty")
 			}
-			netOpts.InterfaceName = value
+			netOpts.InterfaceName = split[1]
 
 		default:
-			return netOpts, fmt.Errorf("unknown bridge network option: %s", name)
+			return netOpts, fmt.Errorf("unknown bridge network option: %s", split[0])
 		}
 	}
 	return netOpts, nil
diff --git a/pkg/specgenutil/specgen.go b/pkg/specgenutil/specgen.go
index e9e90cae43..306a19b394 100644
--- a/pkg/specgenutil/specgen.go
+++ b/pkg/specgenutil/specgen.go
@@ -502,11 +502,11 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 
 	// Last, add user annotations
 	for _, annotation := range c.Annotation {
-		key, val, hasVal := strings.Cut(annotation, "=")
-		if !hasVal {
+		splitAnnotation := strings.SplitN(annotation, "=", 2)
+		if len(splitAnnotation) < 2 {
 			return errors.New("annotations must be formatted KEY=VALUE")
 		}
-		annotations[key] = val
+		annotations[splitAnnotation[0]] = splitAnnotation[1]
 	}
 	if len(s.Annotations) == 0 {
 		s.Annotations = annotations
@@ -515,11 +515,11 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 	if len(c.StorageOpts) > 0 {
 		opts := make(map[string]string, len(c.StorageOpts))
 		for _, opt := range c.StorageOpts {
-			key, val, hasVal := strings.Cut(opt, "=")
-			if !hasVal {
+			split := strings.SplitN(opt, "=", 2)
+			if len(split) != 2 {
 				return errors.New("storage-opt must be formatted KEY=VALUE")
 			}
-			opts[key] = val
+			opts[split[0]] = split[1]
 		}
 		s.StorageOpts = opts
 	}
@@ -673,11 +673,11 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 	// check if key=value and convert
 	sysmap := make(map[string]string)
 	for _, ctl := range c.Sysctl {
-		key, val, hasVal := strings.Cut(ctl, "=")
-		if !hasVal {
+		splitCtl := strings.SplitN(ctl, "=", 2)
+		if len(splitCtl) < 2 {
 			return fmt.Errorf("invalid sysctl value %q", ctl)
 		}
-		sysmap[key] = val
+		sysmap[splitCtl[0]] = splitCtl[1]
 	}
 	if len(s.Sysctl) == 0 || len(c.Sysctl) != 0 {
 		s.Sysctl = sysmap
@@ -690,51 +690,48 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 	for _, opt := range c.SecurityOpt {
 		// Docker deprecated the ":" syntax but still supports it,
 		// so we need to as well
-		var key, val string
-		var hasVal bool
+		var con []string
 		if strings.Contains(opt, "=") {
-			key, val, hasVal = strings.Cut(opt, "=")
+			con = strings.SplitN(opt, "=", 2)
 		} else {
-			key, val, hasVal = strings.Cut(opt, ":")
+			con = strings.SplitN(opt, ":", 2)
 		}
-		if !hasVal &&
-			key != "no-new-privileges" {
+		if len(con) != 2 &&
+			con[0] != "no-new-privileges" {
 			return fmt.Errorf("invalid --security-opt 1: %q", opt)
 		}
-		switch key {
+		switch con[0] {
 		case "apparmor":
-			s.ContainerSecurityConfig.ApparmorProfile = val
-			s.Annotations[define.InspectAnnotationApparmor] = val
+			s.ContainerSecurityConfig.ApparmorProfile = con[1]
+			s.Annotations[define.InspectAnnotationApparmor] = con[1]
 		case "label":
-			if val == "nested" {
+			if con[1] == "nested" {
 				s.ContainerSecurityConfig.LabelNested = true
 				continue
 			}
 			// TODO selinux opts and label opts are the same thing
-			s.ContainerSecurityConfig.SelinuxOpts = append(s.ContainerSecurityConfig.SelinuxOpts, val)
+			s.ContainerSecurityConfig.SelinuxOpts = append(s.ContainerSecurityConfig.SelinuxOpts, con[1])
 			s.Annotations[define.InspectAnnotationLabel] = strings.Join(s.ContainerSecurityConfig.SelinuxOpts, ",label=")
 		case "mask":
-			s.ContainerSecurityConfig.Mask = append(s.ContainerSecurityConfig.Mask, strings.Split(val, ":")...)
+			s.ContainerSecurityConfig.Mask = append(s.ContainerSecurityConfig.Mask, strings.Split(con[1], ":")...)
 		case "proc-opts":
-			s.ProcOpts = strings.Split(val, ",")
+			s.ProcOpts = strings.Split(con[1], ",")
 		case "seccomp":
-			s.SeccompProfilePath = val
-			s.Annotations[define.InspectAnnotationSeccomp] = val
+			s.SeccompProfilePath = con[1]
+			s.Annotations[define.InspectAnnotationSeccomp] = con[1]
 			// this option is for docker compatibility, it is the same as unmask=ALL
 		case "systempaths":
-			if val == "unconfined" {
+			if con[1] == "unconfined" {
 				s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, []string{"ALL"}...)
 			} else {
-				return fmt.Errorf("invalid systempaths option %q, only `unconfined` is supported", val)
+				return fmt.Errorf("invalid systempaths option %q, only `unconfined` is supported", con[1])
 			}
 		case "unmask":
-			if hasVal {
-				s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, val)
-			}
+			s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, con[1:]...)
 		case "no-new-privileges":
 			noNewPrivileges := true
-			if hasVal {
-				noNewPrivileges, err = strconv.ParseBool(val)
+			if len(con) == 2 {
+				noNewPrivileges, err = strconv.ParseBool(con[1])
 				if err != nil {
 					return fmt.Errorf("invalid --security-opt 2: %q", opt)
 				}
@@ -816,23 +813,23 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 
 	logOpts := make(map[string]string)
 	for _, o := range c.LogOptions {
-		key, val, hasVal := strings.Cut(o, "=")
-		if !hasVal {
+		split := strings.SplitN(o, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid log option %q", o)
 		}
-		switch strings.ToLower(key) {
+		switch strings.ToLower(split[0]) {
 		case "driver":
-			s.LogConfiguration.Driver = val
+			s.LogConfiguration.Driver = split[1]
 		case "path":
-			s.LogConfiguration.Path = val
+			s.LogConfiguration.Path = split[1]
 		case "max-size":
-			logSize, err := units.FromHumanSize(val)
+			logSize, err := units.FromHumanSize(split[1])
 			if err != nil {
 				return err
 			}
 			s.LogConfiguration.Size = logSize
 		default:
-			logOpts[key] = val
+			logOpts[split[0]] = split[1]
 		}
 	}
 	if len(s.LogConfiguration.Options) == 0 || len(c.LogOptions) != 0 {
@@ -1007,23 +1004,23 @@ func makeHealthCheckFromCli(inCmd, interval string, retries uint, timeout, start
 
 func parseWeightDevices(weightDevs []string) (map[string]specs.LinuxWeightDevice, error) {
 	wd := make(map[string]specs.LinuxWeightDevice)
-	for _, dev := range weightDevs {
-		key, val, hasVal := strings.Cut(dev, ":")
-		if !hasVal {
-			return nil, fmt.Errorf("bad format: %s", dev)
+	for _, val := range weightDevs {
+		split := strings.SplitN(val, ":", 2)
+		if len(split) != 2 {
+			return nil, fmt.Errorf("bad format: %s", val)
 		}
-		if !strings.HasPrefix(key, "/dev/") {
-			return nil, fmt.Errorf("bad format for device path: %s", dev)
+		if !strings.HasPrefix(split[0], "/dev/") {
+			return nil, fmt.Errorf("bad format for device path: %s", val)
 		}
-		weight, err := strconv.ParseUint(val, 10, 0)
+		weight, err := strconv.ParseUint(split[1], 10, 0)
 		if err != nil {
-			return nil, fmt.Errorf("invalid weight for device: %s", dev)
+			return nil, fmt.Errorf("invalid weight for device: %s", val)
 		}
 		if weight > 0 && (weight < 10 || weight > 1000) {
-			return nil, fmt.Errorf("invalid weight for device: %s", dev)
+			return nil, fmt.Errorf("invalid weight for device: %s", val)
 		}
 		w := uint16(weight)
-		wd[key] = specs.LinuxWeightDevice{
+		wd[split[0]] = specs.LinuxWeightDevice{
 			Weight:     &w,
 			LeafWeight: nil,
 		}
@@ -1033,41 +1030,41 @@ func parseWeightDevices(weightDevs []string) (map[string]specs.LinuxWeightDevice
 
 func parseThrottleBPSDevices(bpsDevices []string) (map[string]specs.LinuxThrottleDevice, error) {
 	td := make(map[string]specs.LinuxThrottleDevice)
-	for _, dev := range bpsDevices {
-		key, val, hasVal := strings.Cut(dev, ":")
-		if !hasVal {
-			return nil, fmt.Errorf("bad format: %s", dev)
+	for _, val := range bpsDevices {
+		split := strings.SplitN(val, ":", 2)
+		if len(split) != 2 {
+			return nil, fmt.Errorf("bad format: %s", val)
 		}
-		if !strings.HasPrefix(key, "/dev/") {
-			return nil, fmt.Errorf("bad format for device path: %s", dev)
+		if !strings.HasPrefix(split[0], "/dev/") {
+			return nil, fmt.Errorf("bad format for device path: %s", val)
 		}
-		rate, err := units.RAMInBytes(val)
+		rate, err := units.RAMInBytes(split[1])
 		if err != nil {
-			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", dev)
+			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", val)
 		}
 		if rate < 0 {
-			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", dev)
+			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", val)
 		}
-		td[key] = specs.LinuxThrottleDevice{Rate: uint64(rate)}
+		td[split[0]] = specs.LinuxThrottleDevice{Rate: uint64(rate)}
 	}
 	return td, nil
 }
 
 func parseThrottleIOPsDevices(iopsDevices []string) (map[string]specs.LinuxThrottleDevice, error) {
 	td := make(map[string]specs.LinuxThrottleDevice)
-	for _, dev := range iopsDevices {
-		key, val, hasVal := strings.Cut(dev, ":")
-		if !hasVal {
-			return nil, fmt.Errorf("bad format: %s", dev)
+	for _, val := range iopsDevices {
+		split := strings.SplitN(val, ":", 2)
+		if len(split) != 2 {
+			return nil, fmt.Errorf("bad format: %s", val)
 		}
-		if !strings.HasPrefix(key, "/dev/") {
-			return nil, fmt.Errorf("bad format for device path: %s", dev)
+		if !strings.HasPrefix(split[0], "/dev/") {
+			return nil, fmt.Errorf("bad format for device path: %s", val)
 		}
-		rate, err := strconv.ParseUint(val, 10, 64)
+		rate, err := strconv.ParseUint(split[1], 10, 64)
 		if err != nil {
-			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>. Number must be a positive integer", dev)
+			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>. Number must be a positive integer", val)
 		}
-		td[key] = specs.LinuxThrottleDevice{Rate: rate}
+		td[split[0]] = specs.LinuxThrottleDevice{Rate: rate}
 	}
 	return td, nil
 }
@@ -1106,42 +1103,42 @@ func parseSecrets(secrets []string) ([]specgen.Secret, map[string]string, error)
 		}
 
 		for _, val := range split {
-			name, value, hasValue := strings.Cut(val, "=")
-			if !hasValue {
+			kv := strings.SplitN(val, "=", 2)
+			if len(kv) < 2 {
 				return nil, nil, fmt.Errorf("option %s must be in form option=value: %w", val, secretParseError)
 			}
-			switch name {
+			switch kv[0] {
 			case "source":
-				source = value
+				source = kv[1]
 			case "type":
 				if secretType != "" {
 					return nil, nil, fmt.Errorf("cannot set more than one secret type: %w", secretParseError)
 				}
-				if value != "mount" && value != "env" {
-					return nil, nil, fmt.Errorf("type %s is invalid: %w", value, secretParseError)
+				if kv[1] != "mount" && kv[1] != "env" {
+					return nil, nil, fmt.Errorf("type %s is invalid: %w", kv[1], secretParseError)
 				}
-				secretType = value
+				secretType = kv[1]
 			case "target":
-				target = value
+				target = kv[1]
 			case "mode":
 				mountOnly = true
-				mode64, err := strconv.ParseUint(value, 8, 32)
+				mode64, err := strconv.ParseUint(kv[1], 8, 32)
 				if err != nil {
-					return nil, nil, fmt.Errorf("mode %s invalid: %w", value, secretParseError)
+					return nil, nil, fmt.Errorf("mode %s invalid: %w", kv[1], secretParseError)
 				}
 				mode = uint32(mode64)
 			case "uid", "UID":
 				mountOnly = true
-				uid64, err := strconv.ParseUint(value, 10, 32)
+				uid64, err := strconv.ParseUint(kv[1], 10, 32)
 				if err != nil {
-					return nil, nil, fmt.Errorf("UID %s invalid: %w", value, secretParseError)
+					return nil, nil, fmt.Errorf("UID %s invalid: %w", kv[1], secretParseError)
 				}
 				uid = uint32(uid64)
 			case "gid", "GID":
 				mountOnly = true
-				gid64, err := strconv.ParseUint(value, 10, 32)
+				gid64, err := strconv.ParseUint(kv[1], 10, 32)
 				if err != nil {
-					return nil, nil, fmt.Errorf("GID %s invalid: %w", value, secretParseError)
+					return nil, nil, fmt.Errorf("GID %s invalid: %w", kv[1], secretParseError)
 				}
 				gid = uint32(gid64)
 
@@ -1206,17 +1203,17 @@ func parseLinuxResourcesDeviceAccess(device string) (specs.LinuxDeviceCgroup, er
 		return specs.LinuxDeviceCgroup{}, fmt.Errorf("invalid device type in device-access-add: %s", devType)
 	}
 
-	majorNumber, minorNumber, hasMinor := strings.Cut(value[1], ":")
-	if majorNumber != "*" {
-		i, err := strconv.ParseUint(majorNumber, 10, 64)
+	number := strings.SplitN(value[1], ":", 2)
+	if number[0] != "*" {
+		i, err := strconv.ParseUint(number[0], 10, 64)
 		if err != nil {
 			return specs.LinuxDeviceCgroup{}, err
 		}
 		m := int64(i)
 		major = &m
 	}
-	if hasMinor && minorNumber != "*" {
-		i, err := strconv.ParseUint(minorNumber, 10, 64)
+	if len(number) == 2 && number[1] != "*" {
+		i, err := strconv.ParseUint(number[1], 10, 64)
 		if err != nil {
 			return specs.LinuxDeviceCgroup{}, err
 		}
@@ -1266,11 +1263,11 @@ func GetResources(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions)
 
 	unifieds := make(map[string]string)
 	for _, unified := range c.CgroupConf {
-		key, val, hasVal := strings.Cut(unified, "=")
-		if !hasVal {
+		splitUnified := strings.SplitN(unified, "=", 2)
+		if len(splitUnified) < 2 {
 			return nil, errors.New("--cgroup-conf must be formatted KEY=VALUE")
 		}
-		unifieds[key] = val
+		unifieds[splitUnified[0]] = splitUnified[1]
 	}
 	if len(unifieds) > 0 {
 		s.ResourceLimits.Unified = unifieds
diff --git a/pkg/specgenutil/volumes.go b/pkg/specgenutil/volumes.go
index 5155e779fd..4e663f6e73 100644
--- a/pkg/specgenutil/volumes.go
+++ b/pkg/specgenutil/volumes.go
@@ -256,29 +256,29 @@ func parseMountOptions(mountType string, args []string) (*spec.Mount, error) {
 	var setTmpcopyup, setRORW, setSuid, setDev, setExec, setRelabel, setOwnership, setSwap bool
 
 	mnt := spec.Mount{}
-	for _, arg := range args {
-		name, value, hasValue := strings.Cut(arg, "=")
-		switch name {
+	for _, val := range args {
+		kv := strings.SplitN(val, "=", 2)
+		switch kv[0] {
 		case "bind-nonrecursive":
 			if mountType != define.TypeBind {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
 			mnt.Options = append(mnt.Options, define.TypeBind)
 		case "bind-propagation":
 			if mountType != define.TypeBind {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			mnt.Options = append(mnt.Options, value)
+			mnt.Options = append(mnt.Options, kv[1])
 		case "consistency":
 			// Often used on MACs and mistakenly on Linux platforms.
 			// Since Docker ignores this option so shall we.
 			continue
 		case "idmap":
-			if hasValue {
-				mnt.Options = append(mnt.Options, fmt.Sprintf("idmap=%s", value))
+			if len(kv) > 1 {
+				mnt.Options = append(mnt.Options, fmt.Sprintf("idmap=%s", kv[1]))
 			} else {
 				mnt.Options = append(mnt.Options, "idmap")
 			}
@@ -294,41 +294,42 @@ func parseMountOptions(mountType string, args []string) (*spec.Mount, error) {
 			// ro=[true|false]
 			// rw
 			// rw=[true|false]
-			if name == "readonly" {
-				name = "ro"
-			}
-			if hasValue {
-				switch strings.ToLower(value) {
+			if kv[0] == "readonly" {
+				kv[0] = "ro"
+			}
+			switch len(kv) {
+			case 1:
+				mnt.Options = append(mnt.Options, kv[0])
+			case 2:
+				switch strings.ToLower(kv[1]) {
 				case "true":
-					mnt.Options = append(mnt.Options, name)
+					mnt.Options = append(mnt.Options, kv[0])
 				case "false":
 					// Set the opposite only for rw
 					// ro's opposite is the default
-					if name == "rw" {
+					if kv[0] == "rw" {
 						mnt.Options = append(mnt.Options, "ro")
 					}
 				}
-			} else {
-				mnt.Options = append(mnt.Options, name)
 			}
 		case "nodev", "dev":
 			if setDev {
 				return nil, fmt.Errorf("cannot pass 'nodev' and 'dev' mnt.Options more than once: %w", errOptionArg)
 			}
 			setDev = true
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "noexec", "exec":
 			if setExec {
 				return nil, fmt.Errorf("cannot pass 'noexec' and 'exec' mnt.Options more than once: %w", errOptionArg)
 			}
 			setExec = true
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "nosuid", "suid":
 			if setSuid {
 				return nil, fmt.Errorf("cannot pass 'nosuid' and 'suid' mnt.Options more than once: %w", errOptionArg)
 			}
 			setSuid = true
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "noswap":
 			if setSwap {
 				return nil, fmt.Errorf("cannot pass 'noswap' mnt.Options more than once: %w", errOptionArg)
@@ -337,80 +338,80 @@ func parseMountOptions(mountType string, args []string) (*spec.Mount, error) {
 				return nil, fmt.Errorf("the 'noswap' option is only allowed with rootful tmpfs mounts: %w", errOptionArg)
 			}
 			setSwap = true
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "relabel":
 			if setRelabel {
 				return nil, fmt.Errorf("cannot pass 'relabel' option more than once: %w", errOptionArg)
 			}
 			setRelabel = true
-			if !hasValue {
-				return nil, fmt.Errorf("%s mount option must be 'private' or 'shared': %w", name, util.ErrBadMntOption)
+			if len(kv) != 2 {
+				return nil, fmt.Errorf("%s mount option must be 'private' or 'shared': %w", kv[0], util.ErrBadMntOption)
 			}
-			switch value {
+			switch kv[1] {
 			case "private":
 				mnt.Options = append(mnt.Options, "Z")
 			case "shared":
 				mnt.Options = append(mnt.Options, "z")
 			default:
-				return nil, fmt.Errorf("%s mount option must be 'private' or 'shared': %w", name, util.ErrBadMntOption)
+				return nil, fmt.Errorf("%s mount option must be 'private' or 'shared': %w", kv[0], util.ErrBadMntOption)
 			}
 		case "shared", "rshared", "private", "rprivate", "slave", "rslave", "unbindable", "runbindable", "Z", "z", "no-dereference":
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "src", "source":
 			if mountType == define.TypeTmpfs {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
 			if mnt.Source != "" {
-				return nil, fmt.Errorf("cannot pass %q option more than once: %w", name, errOptionArg)
+				return nil, fmt.Errorf("cannot pass %q option more than once: %w", kv[0], errOptionArg)
 			}
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			if len(value) == 0 {
+			if len(kv[1]) == 0 {
 				return nil, fmt.Errorf("host directory cannot be empty: %w", errOptionArg)
 			}
-			mnt.Source = value
+			mnt.Source = kv[1]
 		case "target", "dst", "destination":
 			if mnt.Destination != "" {
-				return nil, fmt.Errorf("cannot pass %q option more than once: %w", name, errOptionArg)
+				return nil, fmt.Errorf("cannot pass %q option more than once: %w", kv[0], errOptionArg)
 			}
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			if err := parse.ValidateVolumeCtrDir(value); err != nil {
+			if err := parse.ValidateVolumeCtrDir(kv[1]); err != nil {
 				return nil, err
 			}
-			mnt.Destination = unixPathClean(value)
+			mnt.Destination = unixPathClean(kv[1])
 		case "tmpcopyup", "notmpcopyup":
 			if mountType != define.TypeTmpfs {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
 			if setTmpcopyup {
 				return nil, fmt.Errorf("cannot pass 'tmpcopyup' and 'notmpcopyup' mnt.Options more than once: %w", errOptionArg)
 			}
 			setTmpcopyup = true
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "tmpfs-mode":
 			if mountType != define.TypeTmpfs {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			mnt.Options = append(mnt.Options, fmt.Sprintf("mode=%s", value))
+			mnt.Options = append(mnt.Options, fmt.Sprintf("mode=%s", kv[1]))
 		case "tmpfs-size":
 			if mountType != define.TypeTmpfs {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			mnt.Options = append(mnt.Options, fmt.Sprintf("size=%s", value))
+			mnt.Options = append(mnt.Options, fmt.Sprintf("size=%s", kv[1]))
 		case "U", "chown":
 			if setOwnership {
 				return nil, fmt.Errorf("cannot pass 'U' or 'chown' option more than once: %w", errOptionArg)
 			}
-			ok, err := validChownFlag(value)
+			ok, err := validChownFlag(val)
 			if err != nil {
 				return nil, err
 			}
@@ -420,16 +421,16 @@ func parseMountOptions(mountType string, args []string) (*spec.Mount, error) {
 			setOwnership = true
 		case "volume-label":
 			if mountType != define.TypeVolume {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
 			return nil, fmt.Errorf("the --volume-label option is not presently implemented")
 		case "volume-opt":
 			if mountType != define.TypeVolume {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
-			mnt.Options = append(mnt.Options, arg)
+			mnt.Options = append(mnt.Options, val)
 		default:
-			return nil, fmt.Errorf("%s: %w", name, util.ErrBadMntOption)
+			return nil, fmt.Errorf("%s: %w", kv[0], util.ErrBadMntOption)
 		}
 	}
 	if mountType != "glob" && len(mnt.Destination) == 0 {
@@ -533,22 +534,22 @@ func getDevptsMount(args []string) (spec.Mount, error) {
 
 	var setDest bool
 
-	for _, arg := range args {
-		name, value, hasValue := strings.Cut(arg, "=")
-		switch name {
+	for _, val := range args {
+		kv := strings.SplitN(val, "=", 2)
+		switch kv[0] {
 		case "uid", "gid", "mode", "ptxmode", "newinstance", "max":
-			newMount.Options = append(newMount.Options, arg)
+			newMount.Options = append(newMount.Options, val)
 		case "target", "dst", "destination":
-			if !hasValue {
-				return newMount, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return newMount, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			if err := parse.ValidateVolumeCtrDir(value); err != nil {
+			if err := parse.ValidateVolumeCtrDir(kv[1]); err != nil {
 				return newMount, err
 			}
-			newMount.Destination = unixPathClean(value)
+			newMount.Destination = unixPathClean(kv[1])
 			setDest = true
 		default:
-			return newMount, fmt.Errorf("%s: %w", name, util.ErrBadMntOption)
+			return newMount, fmt.Errorf("%s: %w", kv[0], util.ErrBadMntOption)
 		}
 	}
 
@@ -585,37 +586,37 @@ func getNamedVolume(args []string) (*specgen.NamedVolume, error) {
 func getImageVolume(args []string) (*specgen.ImageVolume, error) {
 	newVolume := new(specgen.ImageVolume)
 
-	for _, arg := range args {
-		name, value, hasValue := strings.Cut(arg, "=")
-		switch name {
+	for _, val := range args {
+		kv := strings.SplitN(val, "=", 2)
+		switch kv[0] {
 		case "src", "source":
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			newVolume.Source = value
+			newVolume.Source = kv[1]
 		case "target", "dst", "destination":
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			if err := parse.ValidateVolumeCtrDir(value); err != nil {
+			if err := parse.ValidateVolumeCtrDir(kv[1]); err != nil {
 				return nil, err
 			}
-			newVolume.Destination = unixPathClean(value)
+			newVolume.Destination = unixPathClean(kv[1])
 		case "rw", "readwrite":
-			switch value {
+			switch kv[1] {
 			case "true":
 				newVolume.ReadWrite = true
 			case "false":
 				// Nothing to do. RO is default.
 			default:
-				return nil, fmt.Errorf("invalid rw value %q: %w", value, util.ErrBadMntOption)
+				return nil, fmt.Errorf("invalid rw value %q: %w", kv[1], util.ErrBadMntOption)
 			}
 		case "consistency":
 			// Often used on MACs and mistakenly on Linux platforms.
 			// Since Docker ignores this option so shall we.
 			continue
 		default:
-			return nil, fmt.Errorf("%s: %w", name, util.ErrBadMntOption)
+			return nil, fmt.Errorf("%s: %w", kv[0], util.ErrBadMntOption)
 		}
 	}
 
@@ -659,16 +660,24 @@ func getTmpfsMounts(tmpfsFlag []string) (map[string]spec.Mount, error) {
 }
 
 // validChownFlag ensures that the U or chown flag is correctly used
-func validChownFlag(value string) (bool, error) {
-	// U=[true|false]
-	switch {
-	case strings.EqualFold(value, "true"), value == "":
-		return true, nil
-	case strings.EqualFold(value, "false"):
-		return false, nil
+func validChownFlag(flag string) (bool, error) {
+	kv := strings.SplitN(flag, "=", 2)
+	switch len(kv) {
+	case 1:
+	case 2:
+		// U=[true|false]
+		switch strings.ToLower(kv[1]) {
+		case "true":
+		case "false":
+			return false, nil
+		default:
+			return false, fmt.Errorf("'U' or 'chown' must be set to true or false, instead received %q: %w", kv[1], errOptionArg)
+		}
 	default:
-		return false, fmt.Errorf("'U' or 'chown' must be set to true or false, instead received %q: %w", value, errOptionArg)
+		return false, fmt.Errorf("badly formatted option %q: %w", flag, errOptionArg)
 	}
+
+	return true, nil
 }
 
 // Use path instead of filepath to preserve Unix style paths on Windows
diff --git a/pkg/systemd/generate/containers.go b/pkg/systemd/generate/containers.go
index e7bb77d6db..821c993df4 100644
--- a/pkg/systemd/generate/containers.go
+++ b/pkg/systemd/generate/containers.go
@@ -471,8 +471,8 @@ func executeContainerTemplate(info *containerInfo, options entities.GenerateSyst
 			// because it does try to red the value from the environment
 			if !strings.Contains(env, "=") {
 				for _, containerEnv := range info.containerEnv {
-					key, _, _ := strings.Cut(containerEnv, "=")
-					if key == env {
+					split := strings.SplitN(containerEnv, "=", 2)
+					if split[0] == env {
 						info.ExtraEnvs = append(info.ExtraEnvs, escapeSystemdArg(containerEnv))
 					}
 				}
diff --git a/pkg/systemd/quadlet/quadlet.go b/pkg/systemd/quadlet/quadlet.go
index e18857aa7d..a7845cade9 100644
--- a/pkg/systemd/quadlet/quadlet.go
+++ b/pkg/systemd/quadlet/quadlet.go
@@ -1118,10 +1118,10 @@ func ConvertKube(kube *parser.UnitFile, names map[string]string, isUser bool) (*
 	for _, update := range updateMaps {
 		annotation := fmt.Sprintf("--annotation=%s", autoUpdateLabel)
 		updateType := update
-		annoValue, typ, hasSlash := strings.Cut(update, "/")
-		if hasSlash {
-			annotation = annotation + "/" + annoValue
-			updateType = typ
+		val := strings.SplitN(update, "/", 2)
+		if len(val) == 2 {
+			annotation = annotation + "/" + val[0]
+			updateType = val[1]
 		}
 		execStart.addf("%s=%s", annotation, updateType)
 	}
@@ -1741,13 +1741,13 @@ func resolveContainerMountParams(containerUnitFile, serviceUnitFile *parser.Unit
 	sourceIndex := -1
 	originalSource := ""
 	for i, token := range tokens {
-		key, val, hasVal := strings.Cut(token, "=")
-		if key == "source" || key == "src" {
-			if !hasVal {
+		kv := strings.SplitN(token, "=", 2)
+		if kv[0] == "source" || kv[0] == "src" {
+			if len(kv) < 2 {
 				return "", fmt.Errorf("source parameter does not include a value")
 			}
 			sourceIndex = i
-			originalSource = val
+			originalSource = kv[1]
 		}
 	}
 
diff --git a/pkg/timetype/timestamp.go b/pkg/timetype/timestamp.go
index 3c70ac971f..4defa32ea6 100644
--- a/pkg/timetype/timestamp.go
+++ b/pkg/timetype/timestamp.go
@@ -116,19 +116,19 @@ func ParseTimestamps(value string, def int64) (int64, int64, error) {
 }
 
 func parseTimestamp(value string) (int64, int64, error) {
-	spart, npart, hasParts := strings.Cut(value, ".")
-	s, err := strconv.ParseInt(spart, 10, 64)
+	sa := strings.SplitN(value, ".", 2)
+	s, err := strconv.ParseInt(sa[0], 10, 64)
 	if err != nil {
 		return s, 0, err
 	}
-	if !hasParts {
+	if len(sa) != 2 {
 		return s, 0, nil
 	}
-	n, err := strconv.ParseInt(npart, 10, 64)
+	n, err := strconv.ParseInt(sa[1], 10, 64)
 	if err != nil {
 		return s, n, err
 	}
 	// should already be in nanoseconds but just in case convert n to nanoseconds
-	n = int64(float64(n) * math.Pow(float64(10), float64(9-len(npart))))
+	n = int64(float64(n) * math.Pow(float64(10), float64(9-len(sa[1]))))
 	return s, n, nil
 }
diff --git a/pkg/trust/policy.go b/pkg/trust/policy.go
index 1424ffe91e..b5d8e7a41c 100644
--- a/pkg/trust/policy.go
+++ b/pkg/trust/policy.go
@@ -131,11 +131,8 @@ func parseUids(colonDelimitKeys []byte) []string {
 				continue
 			}
 			parseduid := uid
-			if ltidx := strings.Index(uid, "<"); ltidx != -1 {
-				subuid := parseduid[ltidx+1:]
-				if gtidx := strings.Index(subuid, ">"); gtidx != -1 {
-					parseduid = subuid[:gtidx]
-				}
+			if strings.Contains(uid, "<") && strings.Contains(uid, ">") {
+				parseduid = strings.SplitN(strings.SplitAfterN(uid, "<", 2)[1], ">", 2)[0]
 			}
 			parseduids = append(parseduids, parseduid)
 		}
diff --git a/pkg/util/filters.go b/pkg/util/filters.go
index d1e33b1081..765b5c4db0 100644
--- a/pkg/util/filters.go
+++ b/pkg/util/filters.go
@@ -65,9 +65,9 @@ func PrepareFilters(r *http.Request) (*map[string][]string, error) {
 	}
 	filterMap := map[string][]string{}
 	for _, filter := range filtersList {
-		fname, filter, hasFilter := strings.Cut(filter, "=")
-		if hasFilter {
-			filterMap[fname] = append(filterMap[fname], filter)
+		split := strings.SplitN(filter, "=", 2)
+		if len(split) > 1 {
+			filterMap[split[0]] = append(filterMap[split[0]], split[1])
 		}
 	}
 	return &filterMap, nil
diff --git a/pkg/util/mountOpts.go b/pkg/util/mountOpts.go
index 2b515aa5df..a35ac77f77 100644
--- a/pkg/util/mountOpts.go
+++ b/pkg/util/mountOpts.go
@@ -34,7 +34,7 @@ func ProcessOptions(options []string, isTmpfs bool, sourcePath string) ([]string
 	newOptions := make([]string, 0, len(options))
 	for _, opt := range options {
 		// Some options have parameters - size, mode
-		key, _, _ := strings.Cut(opt, "=")
+		splitOpt := strings.SplitN(opt, "=", 2)
 
 		// add advanced options such as upperdir=/path and workdir=/path, when overlay is specified
 		if foundOverlay {
@@ -47,11 +47,11 @@ func ProcessOptions(options []string, isTmpfs bool, sourcePath string) ([]string
 				continue
 			}
 		}
-		if strings.HasPrefix(key, "subpath") {
+		if strings.HasPrefix(splitOpt[0], "subpath") {
 			newOptions = append(newOptions, opt)
 			continue
 		}
-		if strings.HasPrefix(key, "idmap") {
+		if strings.HasPrefix(splitOpt[0], "idmap") {
 			if foundIdmap {
 				return nil, fmt.Errorf("the 'idmap' option can only be set once: %w", ErrDupeMntOption)
 			}
@@ -60,7 +60,7 @@ func ProcessOptions(options []string, isTmpfs bool, sourcePath string) ([]string
 			continue
 		}
 
-		switch key {
+		switch splitOpt[0] {
 		case "copy", "nocopy":
 			if foundCopy {
 				return nil, fmt.Errorf("only one of 'nocopy' and 'copy' can be used: %w", ErrDupeMntOption)
@@ -210,13 +210,13 @@ func ProcessOptions(options []string, isTmpfs bool, sourcePath string) ([]string
 }
 
 func ParseDriverOpts(option string) (string, string, error) {
-	_, val, hasVal := strings.Cut(option, "=")
-	if !hasVal {
+	token := strings.SplitN(option, "=", 2)
+	if len(token) != 2 {
 		return "", "", fmt.Errorf("cannot parse driver opts: %w", ErrBadMntOption)
 	}
-	optKey, optVal, hasOptVal := strings.Cut(val, "=")
-	if !hasOptVal {
+	opt := strings.SplitN(token[1], "=", 2)
+	if len(opt) != 2 {
 		return "", "", fmt.Errorf("cannot parse driver opts: %w", ErrBadMntOption)
 	}
-	return optKey, optVal, nil
+	return opt[0], opt[1], nil
 }
diff --git a/pkg/util/utils.go b/pkg/util/utils.go
index 0eefd60559..f9faf07fd1 100644
--- a/pkg/util/utils.go
+++ b/pkg/util/utils.go
@@ -55,8 +55,14 @@ func init() {
 // Helper function to determine the username/password passed
 // in the creds string.  It could be either or both.
 func parseCreds(creds string) (string, string) {
-	username, password, _ := strings.Cut(creds, ":")
-	return username, password
+	if creds == "" {
+		return "", ""
+	}
+	up := strings.SplitN(creds, ":", 2)
+	if len(up) == 1 {
+		return up[0], ""
+	}
+	return up[0], up[1]
 }
 
 // Takes build context and validates `.containerignore` or `.dockerignore`
@@ -912,12 +918,12 @@ func parseAutoIDMap(mapSpec string, mapSetting string, parentMapping []ruser.IDM
 // GetAutoOptions returns an AutoUserNsOptions with the settings to automatically set up
 // a user namespace.
 func GetAutoOptions(n namespaces.UsernsMode) (*stypes.AutoUserNsOptions, error) {
-	mode, opts, hasOpts := strings.Cut(string(n), ":")
-	if mode != "auto" {
+	parts := strings.SplitN(string(n), ":", 2)
+	if parts[0] != "auto" {
 		return nil, fmt.Errorf("wrong user namespace mode")
 	}
 	options := stypes.AutoUserNsOptions{}
-	if !hasOpts {
+	if len(parts) == 1 {
 		return &options, nil
 	}
 
@@ -931,32 +937,32 @@ func GetAutoOptions(n namespaces.UsernsMode) (*stypes.AutoUserNsOptions, error)
 		}
 	}
 
-	for _, o := range strings.Split(opts, ",") {
-		key, val, hasVal := strings.Cut(o, "=")
-		if !hasVal {
+	for _, o := range strings.Split(parts[1], ",") {
+		v := strings.SplitN(o, "=", 2)
+		if len(v) != 2 {
 			return nil, fmt.Errorf("invalid option specified: %q", o)
 		}
-		switch key {
+		switch v[0] {
 		case "size":
-			s, err := strconv.ParseUint(val, 10, 32)
+			s, err := strconv.ParseUint(v[1], 10, 32)
 			if err != nil {
 				return nil, err
 			}
 			options.Size = uint32(s)
 		case "uidmapping":
-			mapping, err := parseAutoIDMap(val, "UID", parentUIDMap)
+			mapping, err := parseAutoIDMap(v[1], "UID", parentUIDMap)
 			if err != nil {
 				return nil, err
 			}
 			options.AdditionalUIDMappings = append(options.AdditionalUIDMappings, mapping...)
 		case "gidmapping":
-			mapping, err := parseAutoIDMap(val, "GID", parentGIDMap)
+			mapping, err := parseAutoIDMap(v[1], "GID", parentGIDMap)
 			if err != nil {
 				return nil, err
 			}
 			options.AdditionalGIDMappings = append(options.AdditionalGIDMappings, mapping...)
 		default:
-			return nil, fmt.Errorf("unknown option specified: %q", key)
+			return nil, fmt.Errorf("unknown option specified: %q", v[0])
 		}
 	}
 	return &options, nil
@@ -1071,9 +1077,9 @@ func getTomlStorage(storeOptions *stypes.StoreOptions) *tomlConfig {
 	config.Storage.RunRoot = storeOptions.RunRoot
 	config.Storage.GraphRoot = storeOptions.GraphRoot
 	for _, i := range storeOptions.GraphDriverOptions {
-		program, hasPrefix := strings.CutPrefix(i, "overlay.mount_program=")
-		if hasPrefix {
-			config.Storage.Options.MountProgram = program
+		s := strings.SplitN(i, "=", 2)
+		if s[0] == "overlay.mount_program" && len(s) == 2 {
+			config.Storage.Options.MountProgram = s[1]
 		}
 	}
 


Test patch:
diff --git a/pkg/machine/e2e/config_inspect_test.go b/pkg/machine/e2e/config_inspect_test.go
index ffd74220f1..f0d4aa5bdd 100644
--- a/pkg/machine/e2e/config_inspect_test.go
+++ b/pkg/machine/e2e/config_inspect_test.go
@@ -13,7 +13,7 @@ func (i *inspectMachine) buildCmd(m *machineTestBuilder) []string {
 	if len(i.format) > 0 {
 		cmd = append(cmd, "--format", i.format)
 	}
-	cmd = append(cmd, m.names...)
+	cmd = append(cmd, m.name)
 	i.cmd = cmd
 	return cmd
 }
diff --git a/pkg/machine/e2e/config_test.go b/pkg/machine/e2e/config_test.go
index 354b3be742..9692bccc01 100644
--- a/pkg/machine/e2e/config_test.go
+++ b/pkg/machine/e2e/config_test.go
@@ -132,7 +132,7 @@ func (m *machineTestBuilder) setCmd(mc machineCommand) *machineTestBuilder {
 	return m
 }
 
-func (m *machineTestBuilder) setTimeout(timeout time.Duration) *machineTestBuilder {
+func (m *machineTestBuilder) setTimeout(timeout time.Duration) *machineTestBuilder { //nolint: unparam
 	m.timeout = timeout
 	return m
 }
diff --git a/pkg/machine/e2e/start_test.go b/pkg/machine/e2e/start_test.go
index d1001a45d2..8c77bde6bc 100644
--- a/pkg/machine/e2e/start_test.go
+++ b/pkg/machine/e2e/start_test.go
@@ -1,6 +1,8 @@
 package e2e_test
 
 import (
+	"time"
+
 	"github.com/containers/podman/v4/pkg/machine/define"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -84,4 +86,36 @@ var _ = Describe("podman machine start", func() {
 		Expect(startSession).To(Exit(125))
 		Expect(startSession.errorToString()).To(ContainSubstring("VM already running or starting"))
 	})
+	It("start only starts specified machine", func() {
+		i := initMachine{}
+		startme := randomString()
+		session, err := mb.setName(startme).setCmd(i.withImagePath(mb.imagePath)).run()
+		Expect(err).ToNot(HaveOccurred())
+		Expect(session).To(Exit(0))
+
+		j := initMachine{}
+		dontstartme := randomString()
+		session2, err := mb.setName(dontstartme).setCmd(j.withImagePath(mb.imagePath)).run()
+		Expect(err).ToNot(HaveOccurred())
+		Expect(session2).To(Exit(0))
+
+		s := startMachine{}
+		session3, err := mb.setName(startme).setCmd(s).setTimeout(time.Minute * 10).run()
+		Expect(err).ToNot(HaveOccurred())
+		Expect(session3).Should(Exit(0))
+
+		inspect := new(inspectMachine)
+		inspect = inspect.withFormat("{{.State}}")
+		inspectSession, err := mb.setName(startme).setCmd(inspect).run()
+		Expect(err).ToNot(HaveOccurred())
+		Expect(inspectSession).To(Exit(0))
+		Expect(inspectSession.outputToString()).To(Equal(define.Running))
+
+		inspect2 := new(inspectMachine)
+		inspect2 = inspect2.withFormat("{{.State}}")
+		inspectSession2, err := mb.setName(dontstartme).setCmd(inspect2).run()
+		Expect(err).ToNot(HaveOccurred())
+		Expect(inspectSession2).To(Exit(0))
+		Expect(inspectSession2.outputToString()).To(Not(Equal(define.Running)))
+	})
 })
diff --git a/pkg/machine/qemu/command/command_test.go b/pkg/machine/qemu/command/command_test.go
index c56d9341f5..e2307f3693 100644
--- a/pkg/machine/qemu/command/command_test.go
+++ b/pkg/machine/qemu/command/command_test.go
@@ -75,8 +75,8 @@ func TestPropagateHostEnv(t *testing.T) {
 	// envs looks like: {"BAR": "bar", "FOO": "foo"}
 	envs := make(map[string]string)
 	for _, env := range envsRawArr {
-		key, value, _ := strings.Cut(env, "=")
-		envs[key] = strings.Trim(value, "\"")
+		item := strings.SplitN(env, "=", 2)
+		envs[item[0]] = strings.Trim(item[1], "\"")
 	}
 
 	for key, test := range tests {
diff --git a/pkg/specgenutil/volumes_test.go b/pkg/specgenutil/volumes_test.go
index 18009a8e99..712d9fd455 100644
--- a/pkg/specgenutil/volumes_test.go
+++ b/pkg/specgenutil/volumes_test.go
@@ -13,41 +13,41 @@ func Test_validChownFlag(t *testing.T) {
 		wantErr bool
 	}{
 		{
-			name: "lower-case true",
+			name: "U true",
 			args: args{
-				flag: "true",
+				flag: "U=true",
 			},
 			want:    true,
 			wantErr: false,
 		},
 		{
-			name: "case-insensitive true",
+			name: "U true case does not matter",
 			args: args{
-				flag: "True",
+				flag: "u=True",
 			},
 			want:    true,
 			wantErr: false,
 		},
 		{
-			name: "lower-case false",
+			name: "U is false",
 			args: args{
-				flag: "false",
+				flag: "U=false",
 			},
 			want:    false,
 			wantErr: false,
 		},
 		{
-			name: "case-insensitive false",
+			name: "chown should also work",
 			args: args{
-				flag: "falsE",
+				flag: "chown=true",
 			},
-			want:    false,
+			want:    true,
 			wantErr: false,
 		},
 		{
 			name: "garbage value should fail",
 			args: args{
-				flag: "foobar",
+				flag: "U=foobar",
 			},
 			want:    false,
 			wantErr: true,
diff --git a/test/e2e/common_test.go b/test/e2e/common_test.go
index d04e7e38c8..f3f02da3d8 100644
--- a/test/e2e/common_test.go
+++ b/test/e2e/common_test.go
@@ -209,11 +209,12 @@ var _ = SynchronizedAfterSuite(func() {
 			scanner := bufio.NewScanner(f)
 			for scanner.Scan() {
 				text := scanner.Text()
-				name, durationString, ok := strings.Cut(text, "\t\t")
-				if !ok {
+				timing := strings.SplitN(text, "\t\t", 2)
+				if len(timing) != 2 {
 					Fail(fmt.Sprintf("incorrect timing line: %q", text))
 				}
-				duration, err := strconv.ParseFloat(durationString, 64)
+				name := timing[0]
+				duration, err := strconv.ParseFloat(timing[1], 64)
 				Expect(err).ToNot(HaveOccurred(), "failed to parse float from timings file")
 				testTimings = append(testTimings, testResult{name: name, length: duration})
 			}
diff --git a/test/e2e/quadlet_test.go b/test/e2e/quadlet_test.go
index ef0057da25..8fac352f2b 100644
--- a/test/e2e/quadlet_test.go
+++ b/test/e2e/quadlet_test.go
@@ -202,8 +202,12 @@ func keyValueStringToMap(keyValueString, separator string) (map[string]string, e
 		return nil, err
 	}
 	for _, param := range keyVarList[0] {
-		key, val, _ := strings.Cut(param, "=")
-		keyValMap[key] = val
+		val := ""
+		kv := strings.SplitN(param, "=", 2)
+		if len(kv) == 2 {
+			val = kv[1]
+		}
+		keyValMap[kv[0]] = val
 	}
 
 	return keyValMap, nil