Repository: containers/podman
Pull request #21226 (2024-01-10 21:00:32)

Fix `podman system reset` with external containers
It looks like we had some logic for this from #10789 but it does not appear to have ever worked; we can't pull external containers out of the DB, so the ContainerRm call failed unconditionally.

Instead, just handle them in Libpod when we're removing images. We're removing every image, so setting Force when removing images should get rid of all external containers. It's a little later in the process than the current (nonfunctional) solution is but I can't think of a reason why that would be bad.

[NO NEW TESTS NEEDED] We do not currently test `system reset`. We should probably reevaluate that at some point this year.

Fixes https://issues.redhat.com/browse/RHEL-21261

<!--
Thanks for sending a pull request!

Please make sure you've read our contributing guidelines and how to submit a pull request (https://github.com/containers/podman/blob/main/CONTRIBUTING.md#submitting-pull-requests).

In case you're only changing docs, make sure to prefix the pull-request title with "[CI:DOCS]". That will prevent functional tests from running and save time and energy.

Finally, be sure to sign commits with your real name. Since by opening
a PR you already have commits, you can add signatures if needed with
something like `git commit -s --amend`.
-->

#### Does this PR introduce a user-facing change?

<!--
If no, just write `None` in the release-note block below. If yes, a release note
is required: Enter your extended release note in the block below. If the PR
requires additional action from users switching to the new release, include the
string "action required".

For more information on release notes, please follow the Kubernetes model:
https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
Fixed a bug where `podman system reset -f` would fail when non-Podman containers were present.
```


openshift-ci[bot]: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/containers/podman/pull/21226#" title="Author self-approved">mheon</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=containers%2Fpodman).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/containers/podman/blob/main/OWNERS)~~ [mheon]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
packit-as-a-service[bot]: Cockpit tests failed for commit dd1330a4ecdf3098cd8e0b30d880aea2af6292f3. @martinpitt, @jelly, @mvollmer please check.
TomSweeneyRedHat: @mheon could you add a card to the backlog for system reset tests please?

Code LGTM, @Luap99 PTAL
martinpitt: I'm a bit stumped by the failures here -- [cockpit-podman rawhide failed](https://artifacts.dev.testing-farm.io/01ce7d57-2f12-4702-a993-b3ce79722616/) like this:
```
# podman run -d -p 6000:5000 --name registry_alt --stop-timeout 0 localhost/test
Error: cannot listen on the TCP port: listen tcp4 :6000: bind: address already in use
```

and similiarly on [f39](https://artifacts.dev.testing-farm.io/291ce325-18af-41ac-9f2a-345fc254f1f4/):
```
# podman run -d --pod testpod1 --name test-pod-1 --stop-timeout 0 localhost/test-alpine sleep 500
time="2024-01-10T21:22:22Z" level=error msg="Starting some container dependencies"
time="2024-01-10T21:22:22Z" level=error msg="\"rootlessport listen tcp 0.0.0.0:6000: bind: address already in use\""
Error: starting some containers: internal libpod error
```

where `ps -a` is as expected:
```
CONTAINER ID  IMAGE                                                  COMMAND     CREATED        STATUS      PORTS                                                                        NAMES
ec0e9a595ac3  localhost/podman-pause:5.0.0-dev-dd1330a4e-1704920869              3 seconds ago  Created     0.0.0.0:6000->5000/tcp, 127.0.0.1:6001->5001/udp, 127.0.0.2:44925->9001/tcp  5579bc451063-infra
e40ed81a2eaf  localhost/test-alpine:latest                           sleep 500   3 seconds ago  Created     0.0.0.0:6000->5000/tcp, 127.0.0.1:6001->5001/udp, 127.0.0.2:44925->9001/tcp  test-pod-1
```

c-podman doesn't test `system reset` either, so unrelated to *this* PR. Of course you'll need at least one more push to fix the [arm static check failure](https://github.com/containers/podman/pull/21226/checks?check_run_id=20361034499), so we'll get a retry here.

I haven't seen this failure mode before, and recent podman PRs were also green. In the last 12 hours we got a [netavark](https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/build/6880057/) build in podman-next. But this is a race condition, it doesn't happen every time, and I can't immediately reproduce it. I'll stare at the log for a little longer, maybe I'll get an idea.

Locally I can at least reproduce the `testHealthcheck` failure. That is our fault, I sent a fix to https://github.com/cockpit-project/cockpit-podman/pull/1533
Luap99: > I'm a bit stumped by the failures here -- [cockpit-podman rawhide failed](https://artifacts.dev.testing-farm.io/01ce7d57-2f12-4702-a993-b3ce79722616/) like this:
> 
> ```
> # podman run -d -p 6000:5000 --name registry_alt --stop-timeout 0 localhost/test
> Error: cannot listen on the TCP port: listen tcp4 :6000: bind: address already in use
> ```
> 
> and similiarly on [f39](https://artifacts.dev.testing-farm.io/291ce325-18af-41ac-9f2a-345fc254f1f4/):
> 
> ```
> # podman run -d --pod testpod1 --name test-pod-1 --stop-timeout 0 localhost/test-alpine sleep 500
> time="2024-01-10T21:22:22Z" level=error msg="Starting some container dependencies"
> time="2024-01-10T21:22:22Z" level=error msg="\"rootlessport listen tcp 0.0.0.0:6000: bind: address already in use\""
> Error: starting some containers: internal libpod error
> ```
> 
> where `ps -a` is as expected:
> 
> ```
> CONTAINER ID  IMAGE                                                  COMMAND     CREATED        STATUS      PORTS                                                                        NAMES
> ec0e9a595ac3  localhost/podman-pause:5.0.0-dev-dd1330a4e-1704920869              3 seconds ago  Created     0.0.0.0:6000->5000/tcp, 127.0.0.1:6001->5001/udp, 127.0.0.2:44925->9001/tcp  5579bc451063-infra
> e40ed81a2eaf  localhost/test-alpine:latest                           sleep 500   3 seconds ago  Created     0.0.0.0:6000->5000/tcp, 127.0.0.1:6001->5001/udp, 127.0.0.2:44925->9001/tcp  test-pod-1
> ```
> 
> c-podman doesn't test `system reset` either, so unrelated to _this_ PR. Of course you'll need at least one more push to fix the [arm static check failure](https://github.com/containers/podman/pull/21226/checks?check_run_id=20361034499), so we'll get a retry here.
> 
> I haven't seen this failure mode before, and recent podman PRs were also green. In the last 12 hours we got a [netavark](https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/build/6880057/) build in podman-next. But this is a race condition, it doesn't happen every time, and I can't immediately reproduce it. I'll stare at the log for a little longer, maybe I'll get an idea.
> 
> Locally I can at least reproduce the `testHealthcheck` failure. That is our fault, I sent a fix to [cockpit-project/cockpit-podman#1533](https://github.com/cockpit-project/cockpit-podman/pull/1533)

Did they got the a new kernel? We had several issues with kernel regressions in regards to the bind() syscall in the past.
Netavark should not matter at all for such an error as it does not bind any ports and I certainly am not aware of any podman changes that touched any of this code
martinpitt: @Luap99 Not [in the last few days](https://bodhi.fedoraproject.org/updates/?packages=kernel); 4 hours ago there was a new upload, but it's not yet in -updates. I'm testing locally against 6.6.9-200.fc39.x86_64 , TF ran 6.6.8-200. [This log](https://artifacts.dev.testing-farm.io/291ce325-18af-41ac-9f2a-345fc254f1f4/) certainly sounds like some initial test does something that keeps port 6000 busy in the "background" despite killing all containers, pods, etc, and then breaks any subsequent test which tries to publish port 6000. Unfortunately the [journal](https://artifacts.dev.testing-farm.io/291ce325-18af-41ac-9f2a-345fc254f1f4/work-podman-usermla2alfz/plans/cockpit-podman/podman-user/execute/data/guest/default-0/test/browser/user-1/data/TestApplication-testCreatePodUser-fedora-39-127.0.0.1-22-FAIL.log.gz) doesn't have any useful error message for that, it just shows the previous accesses to the "localhost:6000" registry which `TestApplication.testBasicUser` (first test that ran) started. At the end of each test, all container get stopped (`podman rm --all --force`, same with `pod`) and /var/lib/containers / ~/.local/share/containers gets restored to the pristine default. So somehow port 6000 survives that.

Well, l'll keep watching for this. If it happens again, I'll throw some more time on it and try to repro on a real TF instance.
martinpitt: @Luap99 No, we are not running system reset, what I [mentioned above](https://github.com/containers/podman/pull/21226#issuecomment-1886635046). There is certainly *a* bug here, but not in this PR in particular. But note  [this failure](https://github.com/containers/podman/pull/21226/checks?check_run_id=20361034499), which does look related to this PR.
Luap99: How sure are you because I did a quick search I see this: https://github.com/cockpit-project/cockpit-podman/blob/31a410f1a8ec89d3bc5d5b9f4d6e66b9c9d80b0d/test/check-application#L116-L123?

Assuming a prior container bound the port it can only be released if the conmon process died as well, so the root cause is likely leaking conmon somewhere.
Luap99: Ok this is trivial to reproduce with this PR locally,
```
$ bin/podman run -d -p 8080:80  alpine sleep inf
$ bin/podman --log-level debug system reset --force
$ bin/podman ps -a
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES
$ ps aux | grep conmon
pholzing   17043  0.0  0.0 225932  2064 ?        Ss   11:35   0:00 /usr/bin/conmon --api-versio...
```

Thus this path is clearly not working, for some reason we are able to delete containers without stopping them first which hints at a much bigger issue in the reset code somewhere.
mheon: The container is gone (was successfully unmounted and removed), but `sleep inf` is still happily running. Fascinating.

Patch:
diff --git a/cmd/podman/common/build.go b/cmd/podman/common/build.go
index 95bad7320d..5e60d7f0f3 100644
--- a/cmd/podman/common/build.go
+++ b/cmd/podman/common/build.go
@@ -333,15 +333,15 @@ func buildFlagsWrapperToOptions(c *cobra.Command, contextDir string, flags *Buil
 	}
 	if c.Flag("build-arg").Changed {
 		for _, arg := range flags.BuildArg {
-			key, val, hasVal := strings.Cut(arg, "=")
-			if hasVal {
-				args[key] = val
+			av := strings.SplitN(arg, "=", 2)
+			if len(av) > 1 {
+				args[av[0]] = av[1]
 			} else {
 				// check if the env is set in the local environment and use that value if it is
-				if val, present := os.LookupEnv(key); present {
-					args[key] = val
+				if val, present := os.LookupEnv(av[0]); present {
+					args[av[0]] = val
 				} else {
-					delete(args, key)
+					delete(args, av[0])
 				}
 			}
 		}
@@ -450,15 +450,15 @@ func buildFlagsWrapperToOptions(c *cobra.Command, contextDir string, flags *Buil
 	additionalBuildContext := make(map[string]*buildahDefine.AdditionalBuildContext)
 	if c.Flag("build-context").Changed {
 		for _, contextString := range flags.BuildContext {
-			key, val, hasVal := strings.Cut(contextString, "=")
-			if hasVal {
-				parseAdditionalBuildContext, err := parse.GetAdditionalBuildContext(val)
+			av := strings.SplitN(contextString, "=", 2)
+			if len(av) > 1 {
+				parseAdditionalBuildContext, err := parse.GetAdditionalBuildContext(av[1])
 				if err != nil {
 					return nil, fmt.Errorf("while parsing additional build context: %w", err)
 				}
-				additionalBuildContext[key] = &parseAdditionalBuildContext
+				additionalBuildContext[av[0]] = &parseAdditionalBuildContext
 			} else {
-				return nil, fmt.Errorf("while parsing additional build context: %s, accepts value in the form of key=value", contextString)
+				return nil, fmt.Errorf("while parsing additional build context: %q, accepts value in the form of key=value", av)
 			}
 		}
 	}
diff --git a/cmd/podman/common/completion.go b/cmd/podman/common/completion.go
index 40804f5a9f..75825f1ea1 100644
--- a/cmd/podman/common/completion.go
+++ b/cmd/podman/common/completion.go
@@ -423,9 +423,9 @@ func prefixSlice(pre string, slice []string) []string {
 
 func suffixCompSlice(suf string, slice []string) []string {
 	for i := range slice {
-		key, val, hasVal := strings.Cut(slice[i], "\t")
-		if hasVal {
-			slice[i] = key + suf + "\t" + val
+		split := strings.SplitN(slice[i], "\t", 2)
+		if len(split) > 1 {
+			slice[i] = split[0] + suf + "\t" + split[1]
 		} else {
 			slice[i] += suf
 		}
@@ -878,10 +878,10 @@ func AutocompleteScp(cmd *cobra.Command, args []string, toComplete string) ([]st
 	}
 	switch len(args) {
 	case 0:
-		prefix, imagesToComplete, isImages := strings.Cut(toComplete, "::")
-		if isImages {
-			imageSuggestions, _ := getImages(cmd, imagesToComplete)
-			return prefixSlice(prefix+"::", imageSuggestions), cobra.ShellCompDirectiveNoFileComp
+		split := strings.SplitN(toComplete, "::", 2)
+		if len(split) > 1 {
+			imageSuggestions, _ := getImages(cmd, split[1])
+			return prefixSlice(split[0]+"::", imageSuggestions), cobra.ShellCompDirectiveNoFileComp
 		}
 		connectionSuggestions, _ := AutocompleteSystemConnections(cmd, args, toComplete)
 		imageSuggestions, _ := getImages(cmd, toComplete)
@@ -893,9 +893,9 @@ func AutocompleteScp(cmd *cobra.Command, args []string, toComplete string) ([]st
 		}
 		return totalSuggestions, directive
 	case 1:
-		_, imagesToComplete, isImages := strings.Cut(args[0], "::")
-		if isImages {
-			if len(imagesToComplete) > 0 {
+		split := strings.SplitN(args[0], "::", 2)
+		if len(split) > 1 {
+			if len(split[1]) > 0 {
 				return nil, cobra.ShellCompDirectiveNoFileComp
 			}
 			imageSuggestions, _ := getImages(cmd, toComplete)
@@ -1076,7 +1076,7 @@ func AutocompleteUserFlag(cmd *cobra.Command, args []string, toComplete string)
 
 		var groups []string
 		scanner := bufio.NewScanner(file)
-		user, _, _ := strings.Cut(toComplete, ":")
+		user := strings.SplitN(toComplete, ":", 2)[0]
 		for scanner.Scan() {
 			entries := strings.SplitN(scanner.Text(), ":", 4)
 			groups = append(groups, user+":"+entries[0])
diff --git a/cmd/podman/containers/create.go b/cmd/podman/containers/create.go
index 8fe845d449..b48b096878 100644
--- a/cmd/podman/containers/create.go
+++ b/cmd/podman/containers/create.go
@@ -342,10 +342,10 @@ func PullImage(imageName string, cliVals *entities.ContainerCreateOptions) (stri
 			if cliVals.Arch != "" || cliVals.OS != "" {
 				return "", errors.New("--platform option can not be specified with --arch or --os")
 			}
-			OS, Arch, hasArch := strings.Cut(cliVals.Platform, "/")
-			cliVals.OS = OS
-			if hasArch {
-				cliVals.Arch = Arch
+			split := strings.SplitN(cliVals.Platform, "/", 2)
+			cliVals.OS = split[0]
+			if len(split) > 1 {
+				cliVals.Arch = split[1]
 			}
 		}
 	}
diff --git a/cmd/podman/containers/pause.go b/cmd/podman/containers/pause.go
index 402faaa26c..4b0ae5fe36 100644
--- a/cmd/podman/containers/pause.go
+++ b/cmd/podman/containers/pause.go
@@ -102,11 +102,11 @@ func pause(cmd *cobra.Command, args []string) error {
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		pauseOpts.Filters[fname] = append(pauseOpts.Filters[fname], filter)
+		pauseOpts.Filters[split[0]] = append(pauseOpts.Filters[split[0]], split[1])
 	}
 
 	responses, err := registry.ContainerEngine().ContainerPause(context.Background(), args, pauseOpts)
diff --git a/cmd/podman/containers/ps.go b/cmd/podman/containers/ps.go
index 4848cd6955..0c21a30ae8 100644
--- a/cmd/podman/containers/ps.go
+++ b/cmd/podman/containers/ps.go
@@ -195,11 +195,11 @@ func ps(cmd *cobra.Command, _ []string) error {
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) == 1 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		listOpts.Filters[fname] = append(listOpts.Filters[fname], filter)
+		listOpts.Filters[split[0]] = append(listOpts.Filters[split[0]], split[1])
 	}
 	listContainers, err := getResponses()
 	if err != nil {
diff --git a/cmd/podman/containers/restart.go b/cmd/podman/containers/restart.go
index 06da8a0a2a..e5e7b0add7 100644
--- a/cmd/podman/containers/restart.go
+++ b/cmd/podman/containers/restart.go
@@ -114,11 +114,11 @@ func restart(cmd *cobra.Command, args []string) error {
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		restartOpts.Filters[fname] = append(restartOpts.Filters[fname], filter)
+		restartOpts.Filters[split[0]] = append(restartOpts.Filters[split[0]], split[1])
 	}
 
 	responses, err := registry.ContainerEngine().ContainerRestart(context.Background(), args, restartOpts)
diff --git a/cmd/podman/containers/rm.go b/cmd/podman/containers/rm.go
index 74d43da2ec..a29233cf3c 100644
--- a/cmd/podman/containers/rm.go
+++ b/cmd/podman/containers/rm.go
@@ -116,16 +116,16 @@ func rm(cmd *cobra.Command, args []string) error {
 			}
 			return fmt.Errorf("reading CIDFile: %w", err)
 		}
-		id, _, _ := strings.Cut(string(content), "\n")
+		id := strings.Split(string(content), "\n")[0]
 		args = append(args, id)
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		rmOptions.Filters[fname] = append(rmOptions.Filters[fname], filter)
+		rmOptions.Filters[split[0]] = append(rmOptions.Filters[split[0]], split[1])
 	}
 
 	if rmOptions.All {
diff --git a/cmd/podman/containers/start.go b/cmd/podman/containers/start.go
index 709e9d57b6..eba46d707a 100644
--- a/cmd/podman/containers/start.go
+++ b/cmd/podman/containers/start.go
@@ -124,11 +124,11 @@ func start(cmd *cobra.Command, args []string) error {
 
 	containers := utils.RemoveSlash(args)
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		startOptions.Filters[fname] = append(startOptions.Filters[fname], filter)
+		startOptions.Filters[split[0]] = append(startOptions.Filters[split[0]], split[1])
 	}
 
 	responses, err := registry.ContainerEngine().ContainerStart(registry.GetContext(), containers, startOptions)
diff --git a/cmd/podman/containers/stop.go b/cmd/podman/containers/stop.go
index 84822cf53e..e62ec7b675 100644
--- a/cmd/podman/containers/stop.go
+++ b/cmd/podman/containers/stop.go
@@ -119,11 +119,11 @@ func stop(cmd *cobra.Command, args []string) error {
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		stopOptions.Filters[fname] = append(stopOptions.Filters[fname], filter)
+		stopOptions.Filters[split[0]] = append(stopOptions.Filters[split[0]], split[1])
 	}
 
 	responses, err := registry.ContainerEngine().ContainerStop(context.Background(), args, stopOptions)
diff --git a/cmd/podman/containers/unpause.go b/cmd/podman/containers/unpause.go
index 7d04daa578..68ef8e1f54 100644
--- a/cmd/podman/containers/unpause.go
+++ b/cmd/podman/containers/unpause.go
@@ -110,11 +110,11 @@ func unpause(cmd *cobra.Command, args []string) error {
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		unpauseOpts.Filters[fname] = append(unpauseOpts.Filters[fname], filter)
+		unpauseOpts.Filters[split[0]] = append(unpauseOpts.Filters[split[0]], split[1])
 	}
 
 	responses, err := registry.ContainerEngine().ContainerUnpause(context.Background(), args, unpauseOpts)
diff --git a/cmd/podman/images/pull.go b/cmd/podman/images/pull.go
index 8399f6c9c2..2bcfd2055c 100644
--- a/cmd/podman/images/pull.go
+++ b/cmd/podman/images/pull.go
@@ -149,14 +149,10 @@ func imagePull(cmd *cobra.Command, args []string) error {
 		if pullOptions.Arch != "" || pullOptions.OS != "" {
 			return errors.New("--platform option can not be specified with --arch or --os")
 		}
-
-		specs := strings.Split(platform, "/")
-		pullOptions.OS = specs[0] // may be empty
-		if len(specs) > 1 {
-			pullOptions.Arch = specs[1]
-			if len(specs) > 2 {
-				pullOptions.Variant = specs[2]
-			}
+		split := strings.SplitN(platform, "/", 2)
+		pullOptions.OS = split[0]
+		if len(split) > 1 {
+			pullOptions.Arch = split[1]
 		}
 	}
 
diff --git a/cmd/podman/kube/play.go b/cmd/podman/kube/play.go
index 21bb45260b..8c6aa6a788 100644
--- a/cmd/podman/kube/play.go
+++ b/cmd/podman/kube/play.go
@@ -246,17 +246,18 @@ func play(cmd *cobra.Command, args []string) error {
 	}
 
 	for _, annotation := range playOptions.annotations {
-		key, val, hasVal := strings.Cut(annotation, "=")
-		if !hasVal {
+		splitN := strings.SplitN(annotation, "=", 2)
+		if len(splitN) != 2 {
 			return fmt.Errorf("annotation %q must include an '=' sign", annotation)
 		}
 		if playOptions.Annotations == nil {
 			playOptions.Annotations = make(map[string]string)
 		}
-		if len(val) > define.MaxKubeAnnotation && !playOptions.UseLongAnnotations {
-			return fmt.Errorf("annotation exceeds maximum size, %d, of kubernetes annotation: %s", define.MaxKubeAnnotation, val)
+		annotation := splitN[1]
+		if len(annotation) > define.MaxKubeAnnotation && !playOptions.UseLongAnnotations {
+			return fmt.Errorf("annotation exceeds maximum size, %d, of kubernetes annotation: %s", define.MaxKubeAnnotation, annotation)
 		}
-		playOptions.Annotations[key] = val
+		playOptions.Annotations[splitN[0]] = annotation
 	}
 
 	for _, mac := range playOptions.macs {
diff --git a/cmd/podman/networks/create.go b/cmd/podman/networks/create.go
index 2a8c641c7f..4998462602 100644
--- a/cmd/podman/networks/create.go
+++ b/cmd/podman/networks/create.go
@@ -245,16 +245,16 @@ func parseRoute(routeStr string) (*types.Route, error) {
 }
 
 func parseRange(iprange string) (*types.LeaseRange, error) {
-	startIPString, endIPString, hasDash := strings.Cut(iprange, "-")
-	if hasDash {
+	split := strings.SplitN(iprange, "-", 2)
+	if len(split) > 1 {
 		// range contains dash so assume form is start-end
-		start := net.ParseIP(startIPString)
+		start := net.ParseIP(split[0])
 		if start == nil {
-			return nil, fmt.Errorf("range start ip %q is not a ip address", startIPString)
+			return nil, fmt.Errorf("range start ip %q is not a ip address", split[0])
 		}
-		end := net.ParseIP(endIPString)
+		end := net.ParseIP(split[1])
 		if end == nil {
-			return nil, fmt.Errorf("range end ip %q is not a ip address", endIPString)
+			return nil, fmt.Errorf("range end ip %q is not a ip address", split[1])
 		}
 		return &types.LeaseRange{
 			StartIP: start,
diff --git a/cmd/podman/parse/filters.go b/cmd/podman/parse/filters.go
index af9157cde7..e4ab942afa 100644
--- a/cmd/podman/parse/filters.go
+++ b/cmd/podman/parse/filters.go
@@ -9,11 +9,11 @@ import (
 func FilterArgumentsIntoFilters(filters []string) (url.Values, error) {
 	parsedFilters := make(url.Values)
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		t := strings.SplitN(f, "=", 2)
+		if len(t) < 2 {
 			return parsedFilters, fmt.Errorf("filter input must be in the form of filter=value: %s is invalid", f)
 		}
-		parsedFilters.Add(fname, filter)
+		parsedFilters.Add(t[0], t[1])
 	}
 	return parsedFilters, nil
 }
diff --git a/cmd/podman/parse/net.go b/cmd/podman/parse/net.go
index 9d6ae1947c..b1331464a7 100644
--- a/cmd/podman/parse/net.go
+++ b/cmd/podman/parse/net.go
@@ -33,15 +33,15 @@ var (
 // for add-host flag
 func ValidateExtraHost(val string) (string, error) {
 	// allow for IPv6 addresses in extra hosts by only splitting on first ":"
-	name, ip, hasIP := strings.Cut(val, ":")
-	if !hasIP || len(name) == 0 {
+	arr := strings.SplitN(val, ":", 2)
+	if len(arr) != 2 || len(arr[0]) == 0 {
 		return "", fmt.Errorf("bad format for add-host: %q", val)
 	}
-	if ip == etchosts.HostGateway {
+	if arr[1] == etchosts.HostGateway {
 		return val, nil
 	}
-	if _, err := validateIPAddress(ip); err != nil {
-		return "", fmt.Errorf("invalid IP address in add-host: %q", ip)
+	if _, err := validateIPAddress(arr[1]); err != nil {
+		return "", fmt.Errorf("invalid IP address in add-host: %q", arr[1])
 	}
 	return val, nil
 }
@@ -82,37 +82,45 @@ func GetAllLabels(labelFile, inputLabels []string) (map[string]string, error) {
 		}
 	}
 	for _, label := range inputLabels {
-		key, value, _ := strings.Cut(label, "=")
-		if key == "" {
+		split := strings.SplitN(label, "=", 2)
+		if split[0] == "" {
 			return nil, fmt.Errorf("invalid label format: %q", label)
 		}
-		labels[key] = value
+		value := ""
+		if len(split) > 1 {
+			value = split[1]
+		}
+		labels[split[0]] = value
 	}
 	return labels, nil
 }
 
 func parseEnvOrLabel(env map[string]string, line, configType string) error {
-	key, val, hasVal := strings.Cut(line, "=")
+	data := strings.SplitN(line, "=", 2)
 
 	// catch invalid variables such as "=" or "=A"
-	if key == "" {
+	if data[0] == "" {
 		return fmt.Errorf("invalid environment variable: %q", line)
 	}
 
 	// trim the front of a variable, but nothing else
-	name := strings.TrimLeft(key, whiteSpaces)
+	name := strings.TrimLeft(data[0], whiteSpaces)
 	if strings.ContainsAny(name, whiteSpaces) {
 		return fmt.Errorf("name %q has white spaces, poorly formatted name", name)
 	}
 
-	if hasVal {
-		env[name] = val
+	if len(data) > 1 {
+		env[name] = data[1]
 	} else {
-		if name, hasStar := strings.CutSuffix(name, "*"); hasStar {
+		if strings.HasSuffix(name, "*") {
+			name = strings.TrimSuffix(name, "*")
 			for _, e := range os.Environ() {
-				envKey, envVal, hasEq := strings.Cut(e, "=")
-				if hasEq && strings.HasPrefix(envKey, name) {
-					env[envKey] = envVal
+				part := strings.SplitN(e, "=", 2)
+				if len(part) < 2 {
+					continue
+				}
+				if strings.HasPrefix(part[0], name) {
+					env[part[0]] = part[1]
 				}
 			}
 		} else if configType == ENVType {
diff --git a/cmd/podman/pods/ps.go b/cmd/podman/pods/ps.go
index 4efc7e9f57..45fbd86165 100644
--- a/cmd/podman/pods/ps.go
+++ b/cmd/podman/pods/ps.go
@@ -81,11 +81,11 @@ func pods(cmd *cobra.Command, _ []string) error {
 	if cmd.Flag("filter").Changed {
 		psInput.Filters = make(map[string][]string)
 		for _, f := range inputFilters {
-			fname, filter, hasFilter := strings.Cut(f, "=")
-			if !hasFilter {
+			split := strings.SplitN(f, "=", 2)
+			if len(split) < 2 {
 				return fmt.Errorf("filter input must be in the form of filter=value: %s is invalid", f)
 			}
-			psInput.Filters[fname] = append(psInput.Filters[fname], filter)
+			psInput.Filters[split[0]] = append(psInput.Filters[split[0]], split[1])
 		}
 	}
 	responses, err := registry.ContainerEngine().PodPs(context.Background(), psInput)
diff --git a/cmd/podman/registry/registry.go b/cmd/podman/registry/registry.go
index 100856f2fb..d1b9e56018 100644
--- a/cmd/podman/registry/registry.go
+++ b/cmd/podman/registry/registry.go
@@ -64,6 +64,14 @@ func ContainerEngine() entities.ContainerEngine {
 func NewContainerEngine(cmd *cobra.Command, args []string) (entities.ContainerEngine, error) {
 	if containerEngine == nil {
 		podmanOptions.FlagSet = cmd.Flags()
+		if cmd.Name() == "reset" && cmd.Parent().Name() == "system" {
+			logrus.Debugf("Performing system reset, runtime validation checks will be relaxed")
+			podmanOptions.IsReset = true
+		}
+		if cmd.Name() == "renumber" && cmd.Parent().Name() == "system" {
+			logrus.Debugf("Performing system renumber, runtime validation checks will be relaxed")
+			podmanOptions.IsRenumber = true
+		}
 		engine, err := infra.NewContainerEngine(&podmanOptions)
 		if err != nil {
 			return nil, err
diff --git a/cmd/podman/system/connection/add.go b/cmd/podman/system/connection/add.go
index 786bc0b955..4c31a6d1b5 100644
--- a/cmd/podman/system/connection/add.go
+++ b/cmd/podman/system/connection/add.go
@@ -261,15 +261,15 @@ func translateDest(path string) (string, error) {
 	if path == "" {
 		return "", nil
 	}
-	key, val, hasVal := strings.Cut(path, "=")
-	if !hasVal {
-		return key, nil
+	split := strings.SplitN(path, "=", 2)
+	if len(split) == 1 {
+		return split[0], nil
 	}
-	if key != "host" {
-		return "", fmt.Errorf("\"host\" is required for --docker option")
+	if split[0] != "host" {
+		return "", fmt.Errorf("\"host\" is requited for --docker option")
 	}
 	// "host=tcp://myserver:2376,ca=~/ca-file,cert=~/cert-file,key=~/key-file"
-	vals := strings.Split(val, ",")
+	vals := strings.Split(split[1], ",")
 	if len(vals) > 1 {
 		return "", fmt.Errorf("--docker additional options %q not supported", strings.Join(vals[1:], ","))
 	}
diff --git a/cmd/podman/system/migrate.go b/cmd/podman/system/migrate.go
index c1fa0a5307..f74137597d 100644
--- a/cmd/podman/system/migrate.go
+++ b/cmd/podman/system/migrate.go
@@ -11,7 +11,6 @@ import (
 	"github.com/containers/podman/v4/cmd/podman/validate"
 	"github.com/containers/podman/v4/libpod/define"
 	"github.com/containers/podman/v4/pkg/domain/entities"
-	"github.com/containers/podman/v4/pkg/domain/infra"
 	"github.com/spf13/cobra"
 )
 
@@ -54,19 +53,7 @@ func init() {
 }
 
 func migrate(cmd *cobra.Command, args []string) {
-	// Shutdown all running engines, `renumber` will hijack repository
-	registry.ContainerEngine().Shutdown(registry.Context())
-	registry.ImageEngine().Shutdown(registry.Context())
-
-	engine, err := infra.NewSystemEngine(entities.MigrateMode, registry.PodmanConfig())
-	if err != nil {
-		fmt.Println(err)
-		os.Exit(define.ExecErrorCodeGeneric)
-	}
-	defer engine.Shutdown(registry.Context())
-
-	err = engine.Migrate(registry.Context(), cmd.Flags(), registry.PodmanConfig(), migrateOptions)
-	if err != nil {
+	if err := registry.ContainerEngine().Migrate(registry.Context(), migrateOptions); err != nil {
 		fmt.Println(err)
 
 		// FIXME change this to return the error like other commands
diff --git a/cmd/podman/system/renumber.go b/cmd/podman/system/renumber.go
index a4d3906541..62f6221c37 100644
--- a/cmd/podman/system/renumber.go
+++ b/cmd/podman/system/renumber.go
@@ -10,8 +10,6 @@ import (
 	"github.com/containers/podman/v4/cmd/podman/registry"
 	"github.com/containers/podman/v4/cmd/podman/validate"
 	"github.com/containers/podman/v4/libpod/define"
-	"github.com/containers/podman/v4/pkg/domain/entities"
-	"github.com/containers/podman/v4/pkg/domain/infra"
 	"github.com/spf13/cobra"
 )
 
@@ -41,19 +39,7 @@ func init() {
 	})
 }
 func renumber(cmd *cobra.Command, args []string) {
-	// Shutdown all running engines, `renumber` will hijack all methods
-	registry.ContainerEngine().Shutdown(registry.Context())
-	registry.ImageEngine().Shutdown(registry.Context())
-
-	engine, err := infra.NewSystemEngine(entities.RenumberMode, registry.PodmanConfig())
-	if err != nil {
-		fmt.Println(err)
-		os.Exit(define.ExecErrorCodeGeneric)
-	}
-	defer engine.Shutdown(registry.Context())
-
-	err = engine.Renumber(registry.Context(), cmd.Flags(), registry.PodmanConfig())
-	if err != nil {
+	if err := registry.ContainerEngine().Renumber(registry.Context()); err != nil {
 		fmt.Println(err)
 		// FIXME change this to return the error like other commands
 		// defer will never run on os.Exit()
diff --git a/cmd/podman/system/reset.go b/cmd/podman/system/reset.go
index 89c7e2dbf3..6e2c6ceed1 100644
--- a/cmd/podman/system/reset.go
+++ b/cmd/podman/system/reset.go
@@ -12,9 +12,6 @@ import (
 	"github.com/containers/common/pkg/completion"
 	"github.com/containers/podman/v4/cmd/podman/registry"
 	"github.com/containers/podman/v4/cmd/podman/validate"
-	"github.com/containers/podman/v4/libpod/define"
-	"github.com/containers/podman/v4/pkg/domain/entities"
-	"github.com/containers/podman/v4/pkg/domain/infra"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )
@@ -48,10 +45,9 @@ func init() {
 
 func reset(cmd *cobra.Command, args []string) {
 	// Get all the external containers in use
-	listCtn, _ := registry.ContainerEngine().ContainerListExternal(registry.Context())
-	listCtnIds := make([]string, 0, len(listCtn))
-	for _, externalCtn := range listCtn {
-		listCtnIds = append(listCtnIds, externalCtn.ID)
+	listCtn, err := registry.ContainerEngine().ContainerListExternal(registry.Context())
+	if err != nil {
+		logrus.Error(err)
 	}
 	// Prompt for confirmation if --force is not set
 	if !forceFlag {
@@ -90,25 +86,14 @@ func reset(cmd *cobra.Command, args []string) {
 		}
 	}
 
-	// Purge all the external containers with storage
-	_, err := registry.ContainerEngine().ContainerRm(registry.Context(), listCtnIds, entities.RmOptions{Force: true, All: true, Ignore: true, Volumes: true})
-	if err != nil {
-		logrus.Error(err)
-	}
 	// Clean build cache if any
-	err = volumes.CleanCacheMount()
-	if err != nil {
+	if err := volumes.CleanCacheMount(); err != nil {
 		logrus.Error(err)
 	}
-	// Shutdown all running engines, `reset` will hijack repository
-	registry.ContainerEngine().Shutdown(registry.Context())
-	registry.ImageEngine().Shutdown(registry.Context())
 
-	// Do not try to shut the engine down, as a Reset engine is not valid
-	// after its creation.
-	if _, err := infra.NewSystemEngine(entities.ResetMode, registry.PodmanConfig()); err != nil {
+	// ContainerEngine() is unusable and shut down after this.
+	if err := registry.ContainerEngine().Reset(registry.Context()); err != nil {
 		logrus.Error(err)
-		os.Exit(define.ExecErrorCodeGeneric)
 	}
 
 	// Shutdown podman-machine and delete all machine files
diff --git a/docs/source/markdown/podman-systemd.unit.5.md b/docs/source/markdown/podman-systemd.unit.5.md
index 2c2a07c9ab..1876434ab9 100644
--- a/docs/source/markdown/podman-systemd.unit.5.md
+++ b/docs/source/markdown/podman-systemd.unit.5.md
@@ -174,12 +174,12 @@ Valid options for `[Container]` are listed below:
 | GIDMap=0:10000:10                    | --gidmap=0:10000:10                                  |
 | Group=1234                           | --user UID:1234                                      |
 | GlobalArgs=--log-level=debug         | --log-level=debug                                    |
-| HealthCmd=/usr/bin/command           | --health-cmd=/usr/bin/command                        |
+| HealthCmd="/usr/bin/command"         | --health-cmd="/usr/bin/command"                      |
 | HealthInterval=2m                    | --health-interval=2m                                 |
 | HealthOnFailure=kill                 | --health-on-failure=kill                             |
 | HealthRetries=5                      | --health-retries=5                                   |
 | HealthStartPeriod=1m                 | --health-start-period=period=1m                      |
-| HealthStartupCmd=command             | --health-startup-cmd=command                         |
+| HealthStartupCmd="command"           | --health-startup-cmd="command"                       |
 | HealthStartupInterval=1m             | --health-startup-interval=1m                         |
 | HealthStartupRetries=8               | --health-startup-retries=8                           |
 | HealthStartupSuccess=2               | --health-startup-success=2                           |
diff --git a/libpod/container_commit.go b/libpod/container_commit.go
index 8dca951b9f..9ef7970613 100644
--- a/libpod/container_commit.go
+++ b/libpod/container_commit.go
@@ -97,8 +97,8 @@ func (c *Container) Commit(ctx context.Context, destImage string, options Contai
 	// Should we store the ENV we actually want in the spec separately?
 	if c.config.Spec.Process != nil {
 		for _, e := range c.config.Spec.Process.Env {
-			key, val, _ := strings.Cut(e, "=")
-			importBuilder.SetEnv(key, val)
+			splitEnv := strings.SplitN(e, "=", 2)
+			importBuilder.SetEnv(splitEnv[0], splitEnv[1])
 		}
 	}
 	// Expose ports
diff --git a/libpod/container_internal_common.go b/libpod/container_internal_common.go
index 6ecbeaf8d6..80323b7280 100644
--- a/libpod/container_internal_common.go
+++ b/libpod/container_internal_common.go
@@ -84,7 +84,7 @@ func parseOptionIDs(ctrMappings []idtools.IDMap, option string) ([]idtools.IDMap
 		if relative {
 			found := false
 			for _, m := range ctrMappings {
-				if v.HostID >= m.ContainerID && v.HostID < m.ContainerID+m.Size {
+				if v.ContainerID >= m.ContainerID && v.ContainerID < m.ContainerID+m.Size {
 					v.HostID += m.HostID - m.ContainerID
 					found = true
 					break
diff --git a/libpod/container_internal_freebsd.go b/libpod/container_internal_freebsd.go
index 042e165525..b594089200 100644
--- a/libpod/container_internal_freebsd.go
+++ b/libpod/container_internal_freebsd.go
@@ -254,7 +254,7 @@ func (c *Container) addSharedNamespaces(g *generate.Generator) error {
 	}
 	needEnv := true
 	for _, checkEnv := range g.Config.Process.Env {
-		if strings.HasPrefix(checkEnv, "HOSTNAME=") {
+		if strings.SplitN(checkEnv, "=", 2)[0] == "HOSTNAME" {
 			needEnv = false
 			break
 		}
diff --git a/libpod/kube.go b/libpod/kube.go
index 72514d03e1..12895e4c30 100644
--- a/libpod/kube.go
+++ b/libpod/kube.go
@@ -73,13 +73,13 @@ func (p *Pod) GenerateForKube(ctx context.Context, getService, useLongAnnotation
 			return nil, servicePorts, err
 		}
 		for _, host := range infraContainer.config.ContainerNetworkConfig.HostAdd {
-			hostname, ip, hasIP := strings.Cut(host, ":")
-			if !hasIP {
+			hostSli := strings.SplitN(host, ":", 2)
+			if len(hostSli) != 2 {
 				return nil, servicePorts, errors.New("invalid hostAdd")
 			}
 			extraHost = append(extraHost, v1.HostAlias{
-				IP:        ip,
-				Hostnames: []string{hostname},
+				IP:        hostSli[1],
+				Hostnames: []string{hostSli[0]},
 			})
 		}
 		ports, err = portMappingToContainerPort(infraContainer.config.PortMappings, getService)
@@ -1001,10 +1001,10 @@ func containerToV1Container(ctx context.Context, c *Container, getService bool)
 		dnsOptions := make([]v1.PodDNSConfigOption, 0)
 		for _, option := range options {
 			// the option can be "k:v" or just "k", no delimiter is required
-			name, value, _ := strings.Cut(option, ":")
+			opts := strings.SplitN(option, ":", 2)
 			dnsOpt := v1.PodDNSConfigOption{
-				Name:  name,
-				Value: &value,
+				Name:  opts[0],
+				Value: &opts[1],
 			}
 			dnsOptions = append(dnsOptions, dnsOpt)
 		}
@@ -1055,23 +1055,23 @@ func libpodEnvVarsToKubeEnvVars(envs []string, imageEnvs []string) ([]v1.EnvVar,
 	envVars := make([]v1.EnvVar, 0, len(envs))
 	imageMap := make(map[string]string, len(imageEnvs))
 	for _, ie := range imageEnvs {
-		key, val, _ := strings.Cut(ie, "=")
-		imageMap[key] = val
+		split := strings.SplitN(ie, "=", 2)
+		imageMap[split[0]] = split[1]
 	}
 	for _, e := range envs {
-		envName, envValue, hasValue := strings.Cut(e, "=")
-		if !hasValue {
+		split := strings.SplitN(e, "=", 2)
+		if len(split) != 2 {
 			return envVars, fmt.Errorf("environment variable %s is malformed; should be key=value", e)
 		}
-		if defaultEnv[envName] == envValue {
+		if defaultEnv[split[0]] == split[1] {
 			continue
 		}
-		if imageMap[envName] == envValue {
+		if imageMap[split[0]] == split[1] {
 			continue
 		}
 		ev := v1.EnvVar{
-			Name:  envName,
-			Value: envValue,
+			Name:  split[0],
+			Value: split[1],
 		}
 		envVars = append(envVars, ev)
 	}
@@ -1286,22 +1286,25 @@ func generateKubeSecurityContext(c *Container) (*v1.SecurityContext, bool, error
 	var selinuxOpts v1.SELinuxOptions
 	selinuxHasData := false
 	for _, label := range strings.Split(c.config.Spec.Annotations[define.InspectAnnotationLabel], ",label=") {
-		opt, val, hasVal := strings.Cut(label, ":")
-		if hasVal {
-			switch opt {
+		opts := strings.SplitN(label, ":", 2)
+		switch len(opts) {
+		case 2:
+			switch opts[0] {
 			case "filetype":
-				selinuxOpts.FileType = val
+				selinuxOpts.FileType = opts[1]
 				selinuxHasData = true
 			case "type":
-				selinuxOpts.Type = val
+				selinuxOpts.Type = opts[1]
 				selinuxHasData = true
 			case "level":
-				selinuxOpts.Level = val
+				selinuxOpts.Level = opts[1]
+				selinuxHasData = true
+			}
+		case 1:
+			if opts[0] == "disable" {
+				selinuxOpts.Type = "spc_t"
 				selinuxHasData = true
 			}
-		} else if opt == "disable" {
-			selinuxOpts.Type = "spc_t"
-			selinuxHasData = true
 		}
 	}
 	if selinuxHasData {
diff --git a/libpod/options.go b/libpod/options.go
index d382854625..5c2301a880 100644
--- a/libpod/options.go
+++ b/libpod/options.go
@@ -454,9 +454,10 @@ func WithDefaultInfraCommand(cmd string) RuntimeOption {
 	}
 }
 
-// WithReset instructs libpod to reset all storage to factory defaults.
-// All containers, pods, volumes, images, and networks will be removed.
-// All directories created by Libpod will be removed.
+// WithReset tells Libpod that the runtime will be used to perform a system
+// reset. A number of checks at initialization are relaxed as the runtime is
+// going to be used to remove all containers, pods, volumes, images, and
+// networks.
 func WithReset() RuntimeOption {
 	return func(rt *Runtime) error {
 		if rt.valid {
@@ -469,10 +470,8 @@ func WithReset() RuntimeOption {
 	}
 }
 
-// WithRenumber instructs libpod to perform a lock renumbering while
-// initializing. This will handle migrations from early versions of libpod with
-// file locks to newer versions with SHM locking, as well as changes in the
-// number of configured locks.
+// WithRenumber tells Libpod that the runtime will be used to perform a system
+// renumber. A number of checks on initialization related to locks are relaxed.
 func WithRenumber() RuntimeOption {
 	return func(rt *Runtime) error {
 		if rt.valid {
@@ -485,43 +484,6 @@ func WithRenumber() RuntimeOption {
 	}
 }
 
-// WithMigrate instructs libpod to migrate container configurations to account
-// for changes between Engine versions. All running containers will be stopped
-// during a migration, then restarted after the migration is complete.
-func WithMigrate() RuntimeOption {
-	return func(rt *Runtime) error {
-		if rt.valid {
-			return define.ErrRuntimeFinalized
-		}
-
-		rt.doMigrate = true
-
-		return nil
-	}
-}
-
-// WithMigrateRuntime instructs Engine to change the default OCI runtime on all
-// containers during a migration. This is not used if `MigrateRuntime()` is not
-// also passed.
-// Engine makes no promises that your containers continue to work with the new
-// runtime - migrations between dissimilar runtimes may well break things.
-// Use with caution.
-func WithMigrateRuntime(requestedRuntime string) RuntimeOption {
-	return func(rt *Runtime) error {
-		if rt.valid {
-			return define.ErrRuntimeFinalized
-		}
-
-		if requestedRuntime == "" {
-			return fmt.Errorf("must provide a non-empty name for new runtime: %w", define.ErrInvalidArg)
-		}
-
-		rt.migrateRuntime = requestedRuntime
-
-		return nil
-	}
-}
-
 // WithEventsLogger sets the events backend to use.
 // Currently supported values are "file" for file backend and "journald" for
 // journald backend.
diff --git a/libpod/reset.go b/libpod/reset.go
index db82ae53d8..215e278114 100644
--- a/libpod/reset.go
+++ b/libpod/reset.go
@@ -90,8 +90,24 @@ func (r *Runtime) removeAllDirs() error {
 	return lastErr
 }
 
-// Reset removes all storage
-func (r *Runtime) reset(ctx context.Context) error {
+// Reset removes all Libpod files.
+// All containers, images, volumes, pods, and networks will be removed.
+// Calls Shutdown(), rendering the runtime unusable after this is run.
+func (r *Runtime) Reset(ctx context.Context) error {
+	// Acquire the alive lock and hold it.
+	// Ensures that we don't let other Podman commands run while we are
+	// removing everything.
+	aliveLock, err := r.getRuntimeAliveLock()
+	if err != nil {
+		return fmt.Errorf("retrieving alive lock: %w", err)
+	}
+	aliveLock.Lock()
+	defer aliveLock.Unlock()
+
+	if !r.valid {
+		return define.ErrRuntimeStopped
+	}
+
 	var timeout *uint
 	pods, err := r.GetAllPods()
 	if err != nil {
@@ -117,13 +133,23 @@ func (r *Runtime) reset(ctx context.Context) error {
 	}
 
 	for _, c := range ctrs {
-		if err := r.RemoveContainer(ctx, c, true, true, timeout); err != nil {
-			if err := r.RemoveStorageContainer(c.ID(), true); err != nil {
-				if errors.Is(err, define.ErrNoSuchCtr) {
-					continue
-				}
-				logrus.Errorf("Removing container %s: %v", c.ID(), err)
+		if ctrs, _, err := r.RemoveContainerAndDependencies(ctx, c, true, true, timeout); err != nil {
+			for ctr, err := range ctrs {
+				logrus.Errorf("Error removing container %s: %v", ctr, err)
 			}
+
+			if errors.Is(err, define.ErrNoSuchCtr) || errors.Is(err, define.ErrCtrRemoved) {
+				continue
+			}
+
+			logrus.Errorf("Removing container %s: %v", c.ID(), err)
+
+			// There's no point trying a storage container removal
+			// here. High likelihood it doesn't work
+			// (RemoveStorageContainer will refuse to remove if a
+			// container exists in the Libpod database) and, even if
+			// it would, we'll get the container later on during
+			// image removal.
 		}
 	}
 
@@ -131,11 +157,7 @@ func (r *Runtime) reset(ctx context.Context) error {
 		logrus.Errorf("Stopping pause process: %v", err)
 	}
 
-	rmiOptions := &libimage.RemoveImagesOptions{Filters: []string{"readonly=false"}}
-	if _, rmiErrors := r.LibimageRuntime().RemoveImages(ctx, nil, rmiOptions); rmiErrors != nil {
-		return errorhandling.JoinErrors(rmiErrors)
-	}
-
+	// Volumes before images, as volumes can mount images.
 	volumes, err := r.state.AllVolumes()
 	if err != nil {
 		return err
@@ -149,6 +171,19 @@ func (r *Runtime) reset(ctx context.Context) error {
 		}
 	}
 
+	// Set force and ignore.
+	// Ignore shouldn't be necessary, but it seems safer. We want everything
+	// gone anyways...
+	rmiOptions := &libimage.RemoveImagesOptions{
+		Force:               true,
+		Ignore:              true,
+		RemoveContainerFunc: r.RemoveContainersForImageCallback(ctx),
+		Filters:             []string{"readonly=false"},
+	}
+	if _, rmiErrors := r.LibimageRuntime().RemoveImages(ctx, nil, rmiOptions); rmiErrors != nil {
+		return errorhandling.JoinErrors(rmiErrors)
+	}
+
 	// remove all networks
 	nets, err := r.network.NetworkList()
 	if err != nil {
@@ -239,5 +274,13 @@ func (r *Runtime) reset(ctx context.Context) error {
 		prevError = err
 	}
 
+	// Shut down the runtime, it's no longer usable after mass-deletion.
+	if err := r.Shutdown(false); err != nil {
+		if prevError != nil {
+			logrus.Error(prevError)
+		}
+		prevError = err
+	}
+
 	return prevError
 }
diff --git a/libpod/runtime.go b/libpod/runtime.go
index fdc32bc773..e30455da5f 100644
--- a/libpod/runtime.go
+++ b/libpod/runtime.go
@@ -89,22 +89,21 @@ type Runtime struct {
 	// This bool is just needed so that we can set it for netavark interface.
 	syslog bool
 
-	// doReset indicates that the runtime should perform a system reset.
-	// All Podman files will be removed.
+	// doReset indicates that the runtime will perform a system reset.
+	// A reset will remove all containers, pods, volumes, networks, etc.
+	// A number of validation checks are relaxed, or replaced with logic to
+	// remove as much of the runtime as possible if they fail. This ensures
+	// that even a broken Libpod can still be removed via `system reset`.
+	// This does not actually perform a `system reset`. That is done by
+	// calling "Reset()" on the returned runtime.
 	doReset bool
-
-	// doRenumber indicates that the runtime should perform a lock renumber
-	// during initialization.
-	// Once the runtime has been initialized and returned, this variable is
-	// unused.
+	// doRenumber indicates that the runtime will perform a system renumber.
+	// A renumber will reassign lock numbers for all containers, pods, etc.
+	// This will not perform the renumber itself, but will ignore some
+	// errors related to lock initialization so a renumber can be performed
+	// if something has gone wrong.
 	doRenumber bool
 
-	doMigrate bool
-	// System migrate can move containers to a new runtime.
-	// We make no promises that these migrated containers work on the new
-	// runtime, though.
-	migrateRuntime string
-
 	// valid indicates whether the runtime is ready to use.
 	// valid is set to true when a runtime is returned from GetRuntime(),
 	// and remains true until the runtime is shut down (rendering its
@@ -230,11 +229,6 @@ func newRuntimeFromConfig(conf *config.Config, options ...RuntimeOption) (*Runti
 
 	runtime.config.CheckCgroupsAndAdjustConfig()
 
-	// If resetting storage, do *not* return a runtime.
-	if runtime.doReset {
-		return nil, nil
-	}
-
 	return runtime, nil
 }
 
@@ -347,10 +341,6 @@ func makeRuntime(runtime *Runtime) (retErr error) {
 	}
 	runtime.conmonPath = cPath
 
-	if runtime.doReset && runtime.doRenumber {
-		return fmt.Errorf("cannot perform system reset while renumbering locks: %w", define.ErrInvalidArg)
-	}
-
 	if runtime.config.Engine.StaticDir == "" {
 		runtime.config.Engine.StaticDir = filepath.Join(runtime.storageConfig.GraphRoot, "libpod")
 		runtime.storageSet.StaticDirSet = true
@@ -555,9 +545,8 @@ func makeRuntime(runtime *Runtime) (retErr error) {
 	// We now need to see if the system has restarted
 	// We check for the presence of a file in our tmp directory to verify this
 	// This check must be locked to prevent races
-	runtimeAliveLock := filepath.Join(runtime.config.Engine.TmpDir, "alive.lck")
 	runtimeAliveFile := filepath.Join(runtime.config.Engine.TmpDir, "alive")
-	aliveLock, err := lockfile.GetLockFile(runtimeAliveLock)
+	aliveLock, err := runtime.getRuntimeAliveLock()
 	if err != nil {
 		return fmt.Errorf("acquiring runtime init lock: %w", err)
 	}
@@ -631,27 +620,6 @@ func makeRuntime(runtime *Runtime) (retErr error) {
 		return err
 	}
 
-	// If we're resetting storage, do it now.
-	// We will not return a valid runtime.
-	// TODO: Plumb this context out so it can be set.
-	if runtime.doReset {
-		// Mark the runtime as valid, so normal functionality "mostly"
-		// works and we can use regular functions to remove
-		// ctrs/pods/etc
-		runtime.valid = true
-
-		return runtime.reset(context.Background())
-	}
-
-	// If we're renumbering locks, do it now.
-	// It breaks out of normal runtime init, and will not return a valid
-	// runtime.
-	if runtime.doRenumber {
-		if err := runtime.renumberLocks(); err != nil {
-			return err
-		}
-	}
-
 	// If we need to refresh the state, do it now - things are guaranteed to
 	// be set up by now.
 	if doRefresh {
@@ -673,12 +641,6 @@ func makeRuntime(runtime *Runtime) (retErr error) {
 	// further
 	runtime.valid = true
 
-	if runtime.doMigrate {
-		if err := runtime.migrate(); err != nil {
-			return err
-		}
-	}
-
 	return nil
 }
 
@@ -1187,6 +1149,11 @@ func (r *Runtime) graphRootMountedFlag(mounts []spec.Mount) string {
 	return ""
 }
 
+// Returns a copy of the runtime alive lock
+func (r *Runtime) getRuntimeAliveLock() (*lockfile.LockFile, error) {
+	return lockfile.GetLockFile(filepath.Join(r.config.Engine.TmpDir, "alive.lck"))
+}
+
 // Network returns the network interface which is used by the runtime
 func (r *Runtime) Network() nettypes.ContainerNetwork {
 	return r.network
diff --git a/libpod/runtime_migrate_linux.go b/libpod/runtime_migrate_linux.go
index 07ed237165..d642a682de 100644
--- a/libpod/runtime_migrate_linux.go
+++ b/libpod/runtime_migrate_linux.go
@@ -42,7 +42,24 @@ func (r *Runtime) stopPauseProcess() error {
 	return nil
 }
 
-func (r *Runtime) migrate() error {
+// Migrate stops the rootless pause process and performs any necessary database
+// migrations that are required. It can also migrate all containers to a new OCI
+// runtime, if requested.
+func (r *Runtime) Migrate(newRuntime string) error {
+	// Acquire the alive lock and hold it.
+	// Ensures that we don't let other Podman commands run while we are
+	// rewriting things in the DB.
+	aliveLock, err := r.getRuntimeAliveLock()
+	if err != nil {
+		return fmt.Errorf("retrieving alive lock: %w", err)
+	}
+	aliveLock.Lock()
+	defer aliveLock.Unlock()
+
+	if !r.valid {
+		return define.ErrRuntimeStopped
+	}
+
 	runningContainers, err := r.GetRunningContainers()
 	if err != nil {
 		return err
@@ -62,10 +79,14 @@ func (r *Runtime) migrate() error {
 	}
 
 	// Did the user request a new runtime?
-	runtimeChangeRequested := r.migrateRuntime != ""
-	requestedRuntime, runtimeExists := r.ociRuntimes[r.migrateRuntime]
-	if !runtimeExists && runtimeChangeRequested {
-		return fmt.Errorf("change to runtime %q requested but no such runtime is defined: %w", r.migrateRuntime, define.ErrInvalidArg)
+	runtimeChangeRequested := newRuntime != ""
+	var requestedRuntime OCIRuntime
+	if runtimeChangeRequested {
+		runtime, exists := r.ociRuntimes[newRuntime]
+		if !exists {
+			return fmt.Errorf("change to runtime %q requested but no such runtime is defined: %w", newRuntime, define.ErrInvalidArg)
+		}
+		requestedRuntime = runtime
 	}
 
 	for _, ctr := range allCtrs {
@@ -80,9 +101,9 @@ func (r *Runtime) migrate() error {
 		}
 
 		// Reset runtime
-		if runtimeChangeRequested {
-			logrus.Infof("Resetting container %s runtime to runtime %s", ctr.ID(), r.migrateRuntime)
-			ctr.config.OCIRuntime = r.migrateRuntime
+		if runtimeChangeRequested && ctr.config.OCIRuntime != newRuntime {
+			logrus.Infof("Resetting container %s runtime to runtime %s", ctr.ID(), newRuntime)
+			ctr.config.OCIRuntime = newRuntime
 			ctr.ociRuntime = requestedRuntime
 
 			needsWrite = true
diff --git a/libpod/runtime_migrate_unsupported.go b/libpod/runtime_migrate_unsupported.go
index 039843428e..9a8c2fda7f 100644
--- a/libpod/runtime_migrate_unsupported.go
+++ b/libpod/runtime_migrate_unsupported.go
@@ -10,6 +10,6 @@ func (r *Runtime) stopPauseProcess() error {
 	return errors.New("not implemented (*Runtime) stopPauseProcess")
 }
 
-func (r *Runtime) migrate() error {
+func (r *Runtime) Migrate(newRuntime string) error {
 	return errors.New("not implemented (*Runtime) migrate")
 }
diff --git a/libpod/runtime_renumber.go b/libpod/runtime_renumber.go
index 43ad1f2e6a..6d857048cc 100644
--- a/libpod/runtime_renumber.go
+++ b/libpod/runtime_renumber.go
@@ -5,18 +5,34 @@ package libpod
 import (
 	"fmt"
 
+	"github.com/containers/podman/v4/libpod/define"
 	"github.com/containers/podman/v4/libpod/events"
 )
 
-// renumberLocks reassigns lock numbers for all containers and pods in the
-// state.
-// TODO: It would be desirable to make it impossible to call this until all
-// other libpod sessions are dead.
-// Possibly use a read-write file lock, with all non-renumber podmans owning the
-// lock as read, renumber attempting to take a write lock?
-// The alternative is some sort of session tracking, and I don't know how
-// reliable that can be.
-func (r *Runtime) renumberLocks() error {
+// RenumberLocks reassigns lock numbers for all containers and pods in the
+// state. This should NOT be run while there are other Libpod
+func (r *Runtime) RenumberLocks() error {
+	// TODO: It would be desirable to make it impossible to call this until all
+	// other libpod sessions are dead.
+	// Possibly use a read-write file lock, with all non-renumber podmans owning the
+	// lock as read, renumber attempting to take a write lock?
+	// The alternative is some sort of session tracking, and I don't know how
+	// reliable that can be.
+
+	// Acquire the alive lock and hold it.
+	// Ensures that we don't let other Podman commands run while we are
+	// changing around lock numbers.
+	aliveLock, err := r.getRuntimeAliveLock()
+	if err != nil {
+		return fmt.Errorf("retrieving alive lock: %w", err)
+	}
+	aliveLock.Lock()
+	defer aliveLock.Unlock()
+
+	if !r.valid {
+		return define.ErrRuntimeStopped
+	}
+
 	// Start off by deallocating all locks
 	if err := r.lockManager.FreeAllLocks(); err != nil {
 		return err
@@ -76,5 +92,5 @@ func (r *Runtime) renumberLocks() error {
 
 	r.NewSystemEvent(events.Renumber)
 
-	return nil
+	return r.Shutdown(false)
 }
diff --git a/pkg/api/handlers/compat/containers.go b/pkg/api/handlers/compat/containers.go
index a3b5846123..32a8024ed2 100644
--- a/pkg/api/handlers/compat/containers.go
+++ b/pkg/api/handlers/compat/containers.go
@@ -524,11 +524,11 @@ func LibpodToContainerJSON(l *libpod.Container, sz bool) (*types.ContainerJSON,
 
 	exposedPorts := make(nat.PortSet)
 	for ep := range inspect.NetworkSettings.Ports {
-		port, proto, ok := strings.Cut(ep, "/")
-		if !ok {
+		splitp := strings.SplitN(ep, "/", 2)
+		if len(splitp) != 2 {
 			return nil, fmt.Errorf("PORT/PROTOCOL Format required for %q", ep)
 		}
-		exposedPort, err := nat.NewPort(proto, port)
+		exposedPort, err := nat.NewPort(splitp[1], splitp[0])
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/api/handlers/compat/exec.go b/pkg/api/handlers/compat/exec.go
index 68d3335b8a..819a096ef1 100644
--- a/pkg/api/handlers/compat/exec.go
+++ b/pkg/api/handlers/compat/exec.go
@@ -49,12 +49,12 @@ func ExecCreateHandler(w http.ResponseWriter, r *http.Request) {
 	}
 	libpodConfig.Environment = make(map[string]string)
 	for _, envStr := range input.Env {
-		key, val, hasVal := strings.Cut(envStr, "=")
-		if !hasVal {
+		split := strings.SplitN(envStr, "=", 2)
+		if len(split) != 2 {
 			utils.Error(w, http.StatusBadRequest, fmt.Errorf("environment variable %q badly formed, must be key=value", envStr))
 			return
 		}
-		libpodConfig.Environment[key] = val
+		libpodConfig.Environment[split[0]] = split[1]
 	}
 	libpodConfig.WorkDir = input.WorkingDir
 	libpodConfig.Privileged = input.Privileged
diff --git a/pkg/api/handlers/compat/images_build.go b/pkg/api/handlers/compat/images_build.go
index 195a916227..5619a95033 100644
--- a/pkg/api/handlers/compat/images_build.go
+++ b/pkg/api/handlers/compat/images_build.go
@@ -330,15 +330,15 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
 			if len(secretOpt) > 0 {
 				modifiedOpt := []string{}
 				for _, token := range secretOpt {
-					key, val, hasVal := strings.Cut(token, "=")
-					if hasVal {
-						if key == "src" {
+					arr := strings.SplitN(token, "=", 2)
+					if len(arr) > 1 {
+						if arr[0] == "src" {
 							/* move secret away from contextDir */
 							/* to make sure we dont accidentally commit temporary secrets to image*/
 							builderDirectory, _ := filepath.Split(contextDirectory)
 							// following path is outside build context
-							newSecretPath := filepath.Join(builderDirectory, val)
-							oldSecretPath := filepath.Join(contextDirectory, val)
+							newSecretPath := filepath.Join(builderDirectory, arr[1])
+							oldSecretPath := filepath.Join(contextDirectory, arr[1])
 							err := os.Rename(oldSecretPath, newSecretPath)
 							if err != nil {
 								utils.BadRequest(w, "secrets", query.Secrets, err)
@@ -551,19 +551,19 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
 					utils.BadRequest(w, "securityopt", query.SecurityOpt, errors.New("no-new-privileges is not supported"))
 					return
 				}
-				name, value, hasValue := strings.Cut(opt, "=")
-				if !hasValue {
+				con := strings.SplitN(opt, "=", 2)
+				if len(con) != 2 {
 					utils.BadRequest(w, "securityopt", query.SecurityOpt, fmt.Errorf("invalid --security-opt name=value pair: %q", opt))
 					return
 				}
 
-				switch name {
+				switch con[0] {
 				case "label":
-					labelOpts = append(labelOpts, value)
+					labelOpts = append(labelOpts, con[1])
 				case "apparmor":
-					apparmor = value
+					apparmor = con[1]
 				case "seccomp":
-					seccomp = value
+					seccomp = con[1]
 				default:
 					utils.BadRequest(w, "securityopt", query.SecurityOpt, fmt.Errorf("invalid --security-opt 2: %q", opt))
 					return
diff --git a/pkg/api/handlers/libpod/manifests.go b/pkg/api/handlers/libpod/manifests.go
index 6c7752b8f7..2c53e2162c 100644
--- a/pkg/api/handlers/libpod/manifests.go
+++ b/pkg/api/handlers/libpod/manifests.go
@@ -489,12 +489,12 @@ func ManifestModify(w http.ResponseWriter, r *http.Request) {
 		}
 		annotations := make(map[string]string)
 		for _, annotationSpec := range body.ManifestAddOptions.Annotation {
-			key, val, hasVal := strings.Cut(annotationSpec, "=")
-			if !hasVal {
-				utils.Error(w, http.StatusBadRequest, fmt.Errorf("no value given for annotation %q", key))
+			spec := strings.SplitN(annotationSpec, "=", 2)
+			if len(spec) != 2 {
+				utils.Error(w, http.StatusBadRequest, fmt.Errorf("no value given for annotation %q", spec[0]))
 				return
 			}
-			annotations[key] = val
+			annotations[spec[0]] = spec[1]
 		}
 		body.ManifestAddOptions.Annotations = envLib.Join(body.ManifestAddOptions.Annotations, annotations)
 		body.ManifestAddOptions.Annotation = nil
diff --git a/pkg/auth/auth.go b/pkg/auth/auth.go
index ecbf4d3aee..12ea2458bb 100644
--- a/pkg/auth/auth.go
+++ b/pkg/auth/auth.go
@@ -268,7 +268,7 @@ func normalizeAuthFileKey(authFileKey string) string {
 	stripped = strings.TrimPrefix(stripped, "https://")
 
 	if stripped != authFileKey { // URLs are interpreted to mean complete registries
-		stripped, _, _ = strings.Cut(stripped, "/")
+		stripped = strings.SplitN(stripped, "/", 2)[0]
 	}
 
 	// Only non-namespaced registry names (or URLs) need to be normalized; repo namespaces
diff --git a/pkg/bindings/images/build.go b/pkg/bindings/images/build.go
index 0f0f2dee89..b286b1a496 100644
--- a/pkg/bindings/images/build.go
+++ b/pkg/bindings/images/build.go
@@ -530,9 +530,9 @@ func Build(ctx context.Context, containerFiles []string, options entities.BuildO
 			if len(secretOpt) > 0 {
 				modifiedOpt := []string{}
 				for _, token := range secretOpt {
-					opt, val, hasVal := strings.Cut(token, "=")
-					if hasVal {
-						if opt == "src" {
+					arr := strings.SplitN(token, "=", 2)
+					if len(arr) > 1 {
+						if arr[0] == "src" {
 							// read specified secret into a tmp file
 							// move tmp file to tar and change secret source to relative tmp file
 							tmpSecretFile, err := os.CreateTemp(options.ContextDirectory, "podman-build-secret")
@@ -541,7 +541,7 @@ func Build(ctx context.Context, containerFiles []string, options entities.BuildO
 							}
 							defer os.Remove(tmpSecretFile.Name()) // clean up
 							defer tmpSecretFile.Close()
-							srcSecretFile, err := os.Open(val)
+							srcSecretFile, err := os.Open(arr[1])
 							if err != nil {
 								return nil, err
 							}
diff --git a/pkg/copy/parse.go b/pkg/copy/parse.go
index d58942f571..50f1d211d8 100644
--- a/pkg/copy/parse.go
+++ b/pkg/copy/parse.go
@@ -40,9 +40,9 @@ func parseUserInput(input string) (container string, path string) {
 		return
 	}
 
-	if parsedContainer, parsedPath, ok := strings.Cut(path, ":"); ok {
-		container = parsedContainer
-		path = parsedPath
+	if spl := strings.SplitN(path, ":", 2); len(spl) == 2 {
+		container = spl[0]
+		path = spl[1]
 	}
 	return
 }
diff --git a/pkg/domain/entities/engine.go b/pkg/domain/entities/engine.go
index 3346110d60..1a2fcefd03 100644
--- a/pkg/domain/entities/engine.go
+++ b/pkg/domain/entities/engine.go
@@ -14,12 +14,6 @@ type EngineSetup string
 const (
 	ABIMode    = EngineMode("abi")
 	TunnelMode = EngineMode("tunnel")
-
-	MigrateMode  = EngineSetup("migrate")
-	NoFDsMode    = EngineSetup("disablefds")
-	NormalMode   = EngineSetup("normal")
-	RenumberMode = EngineSetup("renumber")
-	ResetMode    = EngineSetup("reset")
 )
 
 // Convert EngineMode to String
@@ -42,6 +36,8 @@ type PodmanConfig struct {
 	EngineMode               EngineMode     // ABI or Tunneling mode
 	HooksDir                 []string
 	Identity                 string   // ssh identity for connecting to server
+	IsRenumber               bool     // Is this a system renumber command? If so, a number of checks will be relaxed
+	IsReset                  bool     // Is this a system reset command? If so, a number of checks will be skipped/omitted
 	MaxWorks                 int      // maximum number of parallel threads
 	MemoryProfile            string   // Hidden: Should memory profile be taken
 	RegistriesConf           string   // allows for specifying a custom registries.conf
diff --git a/pkg/domain/entities/engine_container.go b/pkg/domain/entities/engine_container.go
index 1ae819c5ab..e697b60115 100644
--- a/pkg/domain/entities/engine_container.go
+++ b/pkg/domain/entities/engine_container.go
@@ -63,6 +63,7 @@ type ContainerEngine interface { //nolint:interfacebloat
 	Info(ctx context.Context) (*define.Info, error)
 	KubeApply(ctx context.Context, body io.Reader, opts ApplyOptions) error
 	Locks(ctx context.Context) (*LocksReport, error)
+	Migrate(ctx context.Context, options SystemMigrateOptions) error
 	NetworkConnect(ctx context.Context, networkname string, options NetworkConnectOptions) error
 	NetworkCreate(ctx context.Context, network types.Network, createOptions *types.NetworkCreateOptions) (*types.Network, error)
 	NetworkUpdate(ctx context.Context, networkname string, options NetworkUpdateOptions) error
@@ -91,6 +92,8 @@ type ContainerEngine interface { //nolint:interfacebloat
 	PodStop(ctx context.Context, namesOrIds []string, options PodStopOptions) ([]*PodStopReport, error)
 	PodTop(ctx context.Context, options PodTopOptions) (*StringSliceReport, error)
 	PodUnpause(ctx context.Context, namesOrIds []string, options PodunpauseOptions) ([]*PodUnpauseReport, error)
+	Renumber(ctx context.Context) error
+	Reset(ctx context.Context) error
 	SetupRootless(ctx context.Context, noMoveProcess bool) error
 	SecretCreate(ctx context.Context, name string, reader io.Reader, options SecretCreateOptions) (*SecretCreateReport, error)
 	SecretInspect(ctx context.Context, nameOrIDs []string, options SecretInspectOptions) ([]*SecretInfoReport, []error, error)
diff --git a/pkg/domain/entities/engine_system.go b/pkg/domain/entities/engine_system.go
deleted file mode 100644
index a0ecfe9ea0..0000000000
--- a/pkg/domain/entities/engine_system.go
+++ /dev/null
@@ -1,14 +0,0 @@
-package entities
-
-import (
-	"context"
-
-	"github.com/spf13/pflag"
-)
-
-type SystemEngine interface {
-	Renumber(ctx context.Context, flags *pflag.FlagSet, config *PodmanConfig) error
-	Migrate(ctx context.Context, flags *pflag.FlagSet, config *PodmanConfig, options SystemMigrateOptions) error
-	Reset(ctx context.Context) error
-	Shutdown(ctx context.Context)
-}
diff --git a/pkg/domain/filters/containers.go b/pkg/domain/filters/containers.go
index d690a0bdc9..52ddc746d4 100644
--- a/pkg/domain/filters/containers.go
+++ b/pkg/domain/filters/containers.go
@@ -98,10 +98,10 @@ func GenerateContainerFilterFuncs(filter string, filterValues []string, r *libpo
 				var imageNameWithoutTag string
 				// Compare with ImageID, ImageName
 				// Will match ImageName if running image has tag latest for other tags exact complete filter must be given
-				name, tag, hasColon := strings.Cut(rootfsImageName, ":")
-				if hasColon {
-					imageNameWithoutTag = name
-					imageTag = tag
+				imageNameSlice := strings.SplitN(rootfsImageName, ":", 2)
+				if len(imageNameSlice) == 2 {
+					imageNameWithoutTag = imageNameSlice[0]
+					imageTag = imageNameSlice[1]
 				}
 
 				if (rootfsImageID == filterValue) ||
@@ -144,8 +144,13 @@ func GenerateContainerFilterFuncs(filter string, filterValues []string, r *libpo
 		//- volume=(<volume-name>|<mount-point-destination>)
 		return func(c *libpod.Container) bool {
 			containerConfig := c.ConfigNoCopy()
+			var dest string
 			for _, filterValue := range filterValues {
-				source, dest, _ := strings.Cut(filterValue, ":")
+				arr := strings.SplitN(filterValue, ":", 2)
+				source := arr[0]
+				if len(arr) == 2 {
+					dest = arr[1]
+				}
 				for _, mount := range containerConfig.Spec.Mounts {
 					if dest != "" && (mount.Source == source && mount.Destination == dest) {
 						return true
@@ -228,10 +233,19 @@ func GenerateContainerFilterFuncs(filter string, filterValues []string, r *libpo
 			// check if networkMode is configured as `container:<ctr>`
 			// perform a match against filter `container:<IDorName>`
 			// networks is already going to be empty if `container:<ctr>` is configured as Mode
-			if networkModeContainerID, ok := strings.CutPrefix(networkMode, "container:"); ok {
+			if strings.HasPrefix(networkMode, "container:") {
+				networkModeContainerPart := strings.SplitN(networkMode, ":", 2)
+				if len(networkModeContainerPart) < 2 {
+					return false
+				}
+				networkModeContainerID := networkModeContainerPart[1]
 				for _, val := range filterValues {
-					if idOrName, ok := strings.CutPrefix(val, "container:"); ok {
-						filterNetworkModeIDorName := idOrName
+					if strings.HasPrefix(val, "container:") {
+						filterNetworkModePart := strings.SplitN(val, ":", 2)
+						if len(filterNetworkModePart) < 2 {
+							return false
+						}
+						filterNetworkModeIDorName := filterNetworkModePart[1]
 						filterID, err := r.LookupContainerID(filterNetworkModeIDorName)
 						if err != nil {
 							return false
diff --git a/pkg/domain/filters/volumes.go b/pkg/domain/filters/volumes.go
index 28e541b522..3d629548d4 100644
--- a/pkg/domain/filters/volumes.go
+++ b/pkg/domain/filters/volumes.go
@@ -49,7 +49,14 @@ func GenerateVolumeFilters(filter string, filterValues []string, runtime *libpod
 	case "opt":
 		return func(v *libpod.Volume) bool {
 			for _, val := range filterValues {
-				filterKey, filterVal, _ := strings.Cut(val, "=")
+				filterArray := strings.SplitN(val, "=", 2)
+				filterKey := filterArray[0]
+				var filterVal string
+				if len(filterArray) > 1 {
+					filterVal = filterArray[1]
+				} else {
+					filterVal = ""
+				}
 
 				for labelKey, labelValue := range v.Options() {
 					if labelKey == filterKey && (filterVal == "" || labelValue == filterVal) {
diff --git a/pkg/domain/infra/abi/containers_runlabel.go b/pkg/domain/infra/abi/containers_runlabel.go
index 26626fd501..463988c87e 100644
--- a/pkg/domain/infra/abi/containers_runlabel.go
+++ b/pkg/domain/infra/abi/containers_runlabel.go
@@ -135,7 +135,7 @@ func generateRunlabelCommand(runlabel string, img *libimage.Image, inputName str
 		name = splitImageName[len(splitImageName)-1]
 		// make sure to remove the tag from the image name, otherwise the name cannot
 		// be used as container name because a colon is an illegal character
-		name, _, _ = strings.Cut(name, ":")
+		name = strings.SplitN(name, ":", 2)[0]
 	}
 
 	// Append the user-specified arguments to the runlabel (command).
diff --git a/pkg/domain/infra/abi/manifest.go b/pkg/domain/infra/abi/manifest.go
index d5436a7129..24b89872ee 100644
--- a/pkg/domain/infra/abi/manifest.go
+++ b/pkg/domain/infra/abi/manifest.go
@@ -230,11 +230,11 @@ func (ir *ImageEngine) ManifestAdd(ctx context.Context, name string, images []st
 		if len(opts.Annotation) != 0 {
 			annotations := make(map[string]string)
 			for _, annotationSpec := range opts.Annotation {
-				key, val, hasVal := strings.Cut(annotationSpec, "=")
-				if !hasVal {
-					return "", fmt.Errorf("no value given for annotation %q", key)
+				spec := strings.SplitN(annotationSpec, "=", 2)
+				if len(spec) != 2 {
+					return "", fmt.Errorf("no value given for annotation %q", spec[0])
 				}
-				annotations[key] = val
+				annotations[spec[0]] = spec[1]
 			}
 			opts.Annotations = envLib.Join(opts.Annotations, annotations)
 		}
@@ -269,11 +269,11 @@ func (ir *ImageEngine) ManifestAnnotate(ctx context.Context, name, image string,
 	if len(opts.Annotation) != 0 {
 		annotations := make(map[string]string)
 		for _, annotationSpec := range opts.Annotation {
-			key, val, hasVal := strings.Cut(annotationSpec, "=")
-			if !hasVal {
-				return "", fmt.Errorf("no value given for annotation %q", key)
+			spec := strings.SplitN(annotationSpec, "=", 2)
+			if len(spec) != 2 {
+				return "", fmt.Errorf("no value given for annotation %q", spec[0])
 			}
-			annotations[key] = val
+			annotations[spec[0]] = spec[1]
 		}
 		opts.Annotations = envLib.Join(opts.Annotations, annotations)
 	}
diff --git a/pkg/domain/infra/abi/parse/parse.go b/pkg/domain/infra/abi/parse/parse.go
index 19d26c39e2..0cb95aa042 100644
--- a/pkg/domain/infra/abi/parse/parse.go
+++ b/pkg/domain/infra/abi/parse/parse.go
@@ -27,64 +27,64 @@ func VolumeOptions(opts map[string]string) ([]libpod.VolumeCreateOption, error)
 			for _, o := range splitVal {
 				// Options will be formatted as either "opt" or
 				// "opt=value"
-				opt, val, hasVal := strings.Cut(o, "=")
-				switch strings.ToLower(opt) {
+				splitO := strings.SplitN(o, "=", 2)
+				switch strings.ToLower(splitO[0]) {
 				case "size":
-					size, err := units.FromHumanSize(val)
+					size, err := units.FromHumanSize(splitO[1])
 					if err != nil {
-						return nil, fmt.Errorf("cannot convert size %s to integer: %w", val, err)
+						return nil, fmt.Errorf("cannot convert size %s to integer: %w", splitO[1], err)
 					}
 					libpodOptions = append(libpodOptions, libpod.WithVolumeSize(uint64(size)))
 					finalVal = append(finalVal, o)
 					// set option "SIZE": "$size"
-					volumeOptions["SIZE"] = val
+					volumeOptions["SIZE"] = splitO[1]
 				case "inodes":
-					inodes, err := strconv.ParseUint(val, 10, 64)
+					inodes, err := strconv.ParseUint(splitO[1], 10, 64)
 					if err != nil {
-						return nil, fmt.Errorf("cannot convert inodes %s to integer: %w", val, err)
+						return nil, fmt.Errorf("cannot convert inodes %s to integer: %w", splitO[1], err)
 					}
 					libpodOptions = append(libpodOptions, libpod.WithVolumeInodes(inodes))
 					finalVal = append(finalVal, o)
 					// set option "INODES": "$size"
-					volumeOptions["INODES"] = val
+					volumeOptions["INODES"] = splitO[1]
 				case "uid":
-					if !hasVal {
+					if len(splitO) != 2 {
 						return nil, fmt.Errorf("uid option must provide a UID: %w", define.ErrInvalidArg)
 					}
-					intUID, err := strconv.Atoi(val)
+					intUID, err := strconv.Atoi(splitO[1])
 					if err != nil {
-						return nil, fmt.Errorf("cannot convert UID %s to integer: %w", val, err)
+						return nil, fmt.Errorf("cannot convert UID %s to integer: %w", splitO[1], err)
 					}
 					logrus.Debugf("Removing uid= from options and adding WithVolumeUID for UID %d", intUID)
 					libpodOptions = append(libpodOptions, libpod.WithVolumeUID(intUID), libpod.WithVolumeNoChown())
 					finalVal = append(finalVal, o)
 					// set option "UID": "$uid"
-					volumeOptions["UID"] = val
+					volumeOptions["UID"] = splitO[1]
 				case "gid":
-					if !hasVal {
+					if len(splitO) != 2 {
 						return nil, fmt.Errorf("gid option must provide a GID: %w", define.ErrInvalidArg)
 					}
-					intGID, err := strconv.Atoi(val)
+					intGID, err := strconv.Atoi(splitO[1])
 					if err != nil {
-						return nil, fmt.Errorf("cannot convert GID %s to integer: %w", val, err)
+						return nil, fmt.Errorf("cannot convert GID %s to integer: %w", splitO[1], err)
 					}
 					logrus.Debugf("Removing gid= from options and adding WithVolumeGID for GID %d", intGID)
 					libpodOptions = append(libpodOptions, libpod.WithVolumeGID(intGID), libpod.WithVolumeNoChown())
 					finalVal = append(finalVal, o)
 					// set option "GID": "$gid"
-					volumeOptions["GID"] = val
+					volumeOptions["GID"] = splitO[1]
 				case "noquota":
 					logrus.Debugf("Removing noquota from options and adding WithVolumeDisableQuota")
 					libpodOptions = append(libpodOptions, libpod.WithVolumeDisableQuota())
 					// set option "NOQUOTA": "true"
 					volumeOptions["NOQUOTA"] = "true"
 				case "timeout":
-					if !hasVal {
+					if len(splitO) != 2 {
 						return nil, fmt.Errorf("timeout option must provide a valid timeout in seconds: %w", define.ErrInvalidArg)
 					}
-					intTimeout, err := strconv.Atoi(val)
+					intTimeout, err := strconv.Atoi(splitO[1])
 					if err != nil {
-						return nil, fmt.Errorf("cannot convert Timeout %s to an integer: %w", val, err)
+						return nil, fmt.Errorf("cannot convert Timeout %s to an integer: %w", splitO[1], err)
 					}
 					if intTimeout < 0 {
 						return nil, fmt.Errorf("volume timeout cannot be negative (got %d)", intTimeout)
diff --git a/pkg/domain/infra/abi/system.go b/pkg/domain/infra/abi/system.go
index 112a332b20..b5eaadbf4d 100644
--- a/pkg/domain/infra/abi/system.go
+++ b/pkg/domain/infra/abi/system.go
@@ -16,7 +16,6 @@ import (
 	"github.com/containers/storage"
 	"github.com/containers/storage/pkg/directory"
 	"github.com/sirupsen/logrus"
-	"github.com/spf13/pflag"
 )
 
 func (ic *ContainerEngine) Info(ctx context.Context) (*define.Info, error) {
@@ -277,16 +276,16 @@ func (ic *ContainerEngine) SystemDf(ctx context.Context, options entities.System
 	}, nil
 }
 
-func (se *SystemEngine) Reset(ctx context.Context) error {
-	return nil
+func (ic *ContainerEngine) Reset(ctx context.Context) error {
+	return ic.Libpod.Reset(ctx)
 }
 
-func (se *SystemEngine) Renumber(ctx context.Context, flags *pflag.FlagSet, config *entities.PodmanConfig) error {
-	return nil
+func (ic *ContainerEngine) Renumber(ctx context.Context) error {
+	return ic.Libpod.RenumberLocks()
 }
 
-func (se SystemEngine) Migrate(ctx context.Context, flags *pflag.FlagSet, config *entities.PodmanConfig, options entities.SystemMigrateOptions) error {
-	return nil
+func (ic *ContainerEngine) Migrate(ctx context.Context, options entities.SystemMigrateOptions) error {
+	return ic.Libpod.Migrate(options.NewRuntime)
 }
 
 func (se SystemEngine) Shutdown(ctx context.Context) {
diff --git a/pkg/domain/infra/runtime_abi.go b/pkg/domain/infra/runtime_abi.go
index bc967c2f50..e2e01eb176 100644
--- a/pkg/domain/infra/runtime_abi.go
+++ b/pkg/domain/infra/runtime_abi.go
@@ -6,10 +6,8 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/containers/podman/v4/libpod"
 	"github.com/containers/podman/v4/pkg/bindings"
 	"github.com/containers/podman/v4/pkg/domain/entities"
-	"github.com/containers/podman/v4/pkg/domain/infra/abi"
 	"github.com/containers/podman/v4/pkg/domain/infra/tunnel"
 )
 
@@ -42,32 +40,3 @@ func NewImageEngine(facts *entities.PodmanConfig) (entities.ImageEngine, error)
 	}
 	return nil, fmt.Errorf("runtime mode '%v' is not supported", facts.EngineMode)
 }
-
-// NewSystemEngine factory provides a libpod runtime for specialized system operations
-func NewSystemEngine(setup entities.EngineSetup, facts *entities.PodmanConfig) (entities.SystemEngine, error) {
-	switch facts.EngineMode {
-	case entities.ABIMode:
-		var r *libpod.Runtime
-		var err error
-		switch setup {
-		case entities.NormalMode:
-			r, err = GetRuntime(context.Background(), facts.FlagSet, facts)
-		case entities.RenumberMode:
-			r, err = GetRuntimeRenumber(context.Background(), facts.FlagSet, facts)
-		case entities.ResetMode:
-			r, err = GetRuntimeReset(context.Background(), facts.FlagSet, facts)
-		case entities.MigrateMode:
-			name, flagErr := facts.FlagSet.GetString("new-runtime")
-			if flagErr != nil {
-				return nil, flagErr
-			}
-			r, err = GetRuntimeMigrate(context.Background(), facts.FlagSet, facts, name)
-		case entities.NoFDsMode:
-			r, err = GetRuntimeDisableFDs(context.Background(), facts.FlagSet, facts)
-		}
-		return &abi.SystemEngine{Libpod: r}, err
-	case entities.TunnelMode:
-		return nil, fmt.Errorf("tunnel system runtime not supported")
-	}
-	return nil, fmt.Errorf("runtime mode '%v' is not supported", facts.EngineMode)
-}
diff --git a/pkg/domain/infra/runtime_abi_unsupported.go b/pkg/domain/infra/runtime_abi_unsupported.go
deleted file mode 100644
index 099e82d209..0000000000
--- a/pkg/domain/infra/runtime_abi_unsupported.go
+++ /dev/null
@@ -1,14 +0,0 @@
-//go:build remote
-
-package infra
-
-import (
-	"errors"
-
-	"github.com/containers/podman/v4/pkg/domain/entities"
-)
-
-// NewSystemEngine factory provides a libpod runtime for specialized system operations
-func NewSystemEngine(setup entities.EngineSetup, facts *entities.PodmanConfig) (entities.SystemEngine, error) {
-	return nil, errors.New("not implemented")
-}
diff --git a/pkg/domain/infra/runtime_libpod.go b/pkg/domain/infra/runtime_libpod.go
index 6b90bebb93..a7a4acdcf1 100644
--- a/pkg/domain/infra/runtime_libpod.go
+++ b/pkg/domain/infra/runtime_libpod.go
@@ -33,72 +33,25 @@ var (
 )
 
 type engineOpts struct {
-	name     string
-	renumber bool
-	migrate  bool
 	withFDS  bool
 	reset    bool
+	renumber bool
 	config   *entities.PodmanConfig
 }
 
-// GetRuntimeMigrate gets a libpod runtime that will perform a migration of existing containers
-func GetRuntimeMigrate(ctx context.Context, fs *flag.FlagSet, cfg *entities.PodmanConfig, newRuntime string) (*libpod.Runtime, error) {
-	return getRuntime(ctx, fs, &engineOpts{
-		name:     newRuntime,
-		renumber: false,
-		migrate:  true,
-		withFDS:  true,
-		reset:    false,
-		config:   cfg,
-	})
-}
-
-// GetRuntimeDisableFDs gets a libpod runtime that will disable sd notify
-func GetRuntimeDisableFDs(ctx context.Context, fs *flag.FlagSet, cfg *entities.PodmanConfig) (*libpod.Runtime, error) {
-	return getRuntime(ctx, fs, &engineOpts{
-		renumber: false,
-		migrate:  false,
-		withFDS:  false,
-		reset:    false,
-		config:   cfg,
-	})
-}
-
-// GetRuntimeRenumber gets a libpod runtime that will perform a lock renumber
-func GetRuntimeRenumber(ctx context.Context, fs *flag.FlagSet, cfg *entities.PodmanConfig) (*libpod.Runtime, error) {
-	return getRuntime(ctx, fs, &engineOpts{
-		renumber: true,
-		migrate:  false,
-		withFDS:  true,
-		reset:    false,
-		config:   cfg,
-	})
-}
-
 // GetRuntime generates a new libpod runtime configured by command line options
 func GetRuntime(ctx context.Context, flags *flag.FlagSet, cfg *entities.PodmanConfig) (*libpod.Runtime, error) {
 	runtimeSync.Do(func() {
 		runtimeLib, runtimeErr = getRuntime(ctx, flags, &engineOpts{
-			renumber: false,
-			migrate:  false,
 			withFDS:  true,
-			reset:    false,
+			reset:    cfg.IsReset,
+			renumber: cfg.IsRenumber,
 			config:   cfg,
 		})
 	})
 	return runtimeLib, runtimeErr
 }
 
-func GetRuntimeReset(ctx context.Context, fs *flag.FlagSet, cfg *entities.PodmanConfig) (*libpod.Runtime, error) {
-	return getRuntime(ctx, fs, &engineOpts{
-		renumber: false,
-		migrate:  false,
-		withFDS:  true,
-		reset:    true,
-		config:   cfg,
-	})
-}
-
 func getRuntime(ctx context.Context, fs *flag.FlagSet, opts *engineOpts) (*libpod.Runtime, error) {
 	options := []libpod.RuntimeOption{}
 	storageOpts := types.StoreOptions{}
@@ -161,17 +114,10 @@ func getRuntime(ctx context.Context, fs *flag.FlagSet, opts *engineOpts) (*libpo
 	if fs.Changed("transient-store") {
 		options = append(options, libpod.WithTransientStore(cfg.TransientStore))
 	}
-	if opts.migrate {
-		options = append(options, libpod.WithMigrate())
-		if opts.name != "" {
-			options = append(options, libpod.WithMigrateRuntime(opts.name))
-		}
-	}
 
 	if opts.reset {
 		options = append(options, libpod.WithReset())
 	}
-
 	if opts.renumber {
 		options = append(options, libpod.WithRenumber())
 	}
diff --git a/pkg/domain/infra/tunnel/manifest.go b/pkg/domain/infra/tunnel/manifest.go
index f4aec45b0b..5b176e31ed 100644
--- a/pkg/domain/infra/tunnel/manifest.go
+++ b/pkg/domain/infra/tunnel/manifest.go
@@ -64,11 +64,11 @@ func (ir *ImageEngine) ManifestAdd(_ context.Context, name string, imageNames []
 	if len(opts.Annotation) != 0 {
 		annotations := make(map[string]string)
 		for _, annotationSpec := range opts.Annotation {
-			key, val, hasVal := strings.Cut(annotationSpec, "=")
-			if !hasVal {
-				return "", fmt.Errorf("no value given for annotation %q", key)
+			spec := strings.SplitN(annotationSpec, "=", 2)
+			if len(spec) != 2 {
+				return "", fmt.Errorf("no value given for annotation %q", spec[0])
 			}
-			annotations[key] = val
+			annotations[spec[0]] = spec[1]
 		}
 		opts.Annotations = envLib.Join(opts.Annotations, annotations)
 	}
@@ -97,11 +97,11 @@ func (ir *ImageEngine) ManifestAnnotate(ctx context.Context, name, images string
 	if len(opts.Annotation) != 0 {
 		annotations := make(map[string]string)
 		for _, annotationSpec := range opts.Annotation {
-			key, val, hasVal := strings.Cut(annotationSpec, "=")
-			if !hasVal {
-				return "", fmt.Errorf("no value given for annotation %q", key)
+			spec := strings.SplitN(annotationSpec, "=", 2)
+			if len(spec) != 2 {
+				return "", fmt.Errorf("no value given for annotation %q", spec[0])
 			}
-			annotations[key] = val
+			annotations[spec[0]] = spec[1]
 		}
 		opts.Annotations = envLib.Join(opts.Annotations, annotations)
 	}
diff --git a/pkg/domain/infra/tunnel/system.go b/pkg/domain/infra/tunnel/system.go
index 7096c2ccd5..fc82e7b2bb 100644
--- a/pkg/domain/infra/tunnel/system.go
+++ b/pkg/domain/infra/tunnel/system.go
@@ -23,6 +23,18 @@ func (ic *ContainerEngine) SystemPrune(ctx context.Context, opts entities.System
 	return system.Prune(ic.ClientCtx, options)
 }
 
+func (ic *ContainerEngine) Migrate(ctx context.Context, options entities.SystemMigrateOptions) error {
+	return errors.New("runtime migration is not supported on remote clients")
+}
+
+func (ic *ContainerEngine) Renumber(ctx context.Context) error {
+	return errors.New("lock renumbering is not supported on remote clients")
+}
+
+func (ic *ContainerEngine) Reset(ctx context.Context) error {
+	return errors.New("system reset is not supported on remote clients")
+}
+
 func (ic *ContainerEngine) SystemDf(ctx context.Context, options entities.SystemDfOptions) (*entities.SystemDfReport, error) {
 	return system.DiskUsage(ic.ClientCtx, nil)
 }
diff --git a/pkg/domain/utils/scp.go b/pkg/domain/utils/scp.go
index cd466843d7..0bd1b0d3e6 100644
--- a/pkg/domain/utils/scp.go
+++ b/pkg/domain/utils/scp.go
@@ -406,8 +406,8 @@ func GetServiceInformation(sshInfo *entities.ImageScpConnections, cliConnections
 	var urlS string
 	var iden string
 	for i, val := range cliConnections {
-		connection, _, _ := strings.Cut(val, "::")
-		sshInfo.Connections = append(sshInfo.Connections, connection)
+		splitEnv := strings.SplitN(val, "::", 2)
+		sshInfo.Connections = append(sshInfo.Connections, splitEnv[0])
 		conn, found := cfg.Engine.ServiceDestinations[sshInfo.Connections[i]]
 		if found {
 			urlS = conn.URI
diff --git a/pkg/domain/utils/utils.go b/pkg/domain/utils/utils.go
index ca7a3210fb..ee213e1b62 100644
--- a/pkg/domain/utils/utils.go
+++ b/pkg/domain/utils/utils.go
@@ -34,8 +34,8 @@ func ToLibpodFilters(f url.Values) (filters []string) {
 func ToURLValues(f []string) (filters url.Values) {
 	filters = make(url.Values)
 	for _, v := range f {
-		key, val, _ := strings.Cut(v, "=")
-		filters.Add(key, val)
+		t := strings.SplitN(v, "=", 2)
+		filters.Add(t[0], t[1])
 	}
 	return
 }
diff --git a/pkg/env/env.go b/pkg/env/env.go
index 6dbfb02017..8e87834f85 100644
--- a/pkg/env/env.go
+++ b/pkg/env/env.go
@@ -40,9 +40,14 @@ func Slice(m map[string]string) []string {
 // map.
 func Map(slice []string) map[string]string {
 	envmap := make(map[string]string, len(slice))
-	for _, line := range slice {
-		key, val, _ := strings.Cut(line, "=")
-		envmap[key] = val
+	for _, val := range slice {
+		data := strings.SplitN(val, "=", 2)
+
+		if len(data) > 1 {
+			envmap[data[0]] = data[1]
+		} else {
+			envmap[data[0]] = ""
+		}
 	}
 	return envmap
 }
@@ -89,25 +94,26 @@ func ParseFile(path string) (_ map[string]string, err error) {
 }
 
 func parseEnv(env map[string]string, line string) error {
-	key, val, hasVal := strings.Cut(line, "=")
+	data := strings.SplitN(line, "=", 2)
 
 	// catch invalid variables such as "=" or "=A"
-	if key == "" {
+	if data[0] == "" {
 		return fmt.Errorf("invalid variable: %q", line)
 	}
 	// trim the front of a variable, but nothing else
-	name := strings.TrimLeft(key, whiteSpaces)
-	if hasVal {
-		env[name] = val
+	name := strings.TrimLeft(data[0], whiteSpaces)
+	if len(data) > 1 {
+		env[name] = data[1]
 	} else {
-		if name, hasStar := strings.CutSuffix(name, "*"); hasStar {
+		if strings.HasSuffix(name, "*") {
+			name = strings.TrimSuffix(name, "*")
 			for _, e := range os.Environ() {
-				envKey, envVal, hasEq := strings.Cut(e, "=")
-				if !hasEq {
+				part := strings.SplitN(e, "=", 2)
+				if len(part) < 2 {
 					continue
 				}
-				if strings.HasPrefix(envKey, name) {
-					env[envKey] = envVal
+				if strings.HasPrefix(part[0], name) {
+					env[part[0]] = part[1]
 				}
 			}
 		} else if val, ok := os.LookupEnv(name); ok {
diff --git a/pkg/machine/applehv/config.go b/pkg/machine/applehv/config.go
index 26fa74665a..eb11c93e3b 100644
--- a/pkg/machine/applehv/config.go
+++ b/pkg/machine/applehv/config.go
@@ -12,16 +12,16 @@ import (
 	"github.com/containers/podman/v4/pkg/machine"
 	"github.com/containers/podman/v4/pkg/machine/compression"
 	"github.com/containers/podman/v4/pkg/machine/define"
-	"github.com/containers/podman/v4/pkg/machine/ignition"
 	"github.com/containers/podman/v4/pkg/machine/vmconfigs"
+	"github.com/containers/podman/v4/pkg/machine/ignition"
 	vfConfig "github.com/crc-org/vfkit/pkg/config"
 	"github.com/docker/go-units"
 	"golang.org/x/sys/unix"
 )
 
 const (
-	localhostURI       = "http://localhost"
-	ignitionSocketName = "ignition.sock"
+	defaultVFKitEndpoint = "http://localhost:8081"
+	ignitionSocketName   = "ignition.sock"
 )
 
 type AppleHVVirtualization struct {
diff --git a/pkg/machine/applehv/machine.go b/pkg/machine/applehv/machine.go
index b617ab055b..2ca843c83e 100644
--- a/pkg/machine/applehv/machine.go
+++ b/pkg/machine/applehv/machine.go
@@ -116,12 +116,7 @@ func (m *MacMachine) setVfkitInfo(cfg *config.Config, readySocket define.VMFile)
 	}
 
 	m.Vfkit.VirtualMachine.Devices = defaultDevices
-	randPort, err := utils.GetRandomPort()
-	if err != nil {
-		return err
-	}
-
-	m.Vfkit.Endpoint = localhostURI + ":" + strconv.Itoa(randPort)
+	m.Vfkit.Endpoint = defaultVFKitEndpoint
 	m.Vfkit.VfkitBinaryPath = vfkitBinaryPath
 
 	return nil
@@ -410,15 +405,6 @@ func (m *MacMachine) writeConfig() error {
 	return os.WriteFile(m.ConfigPath.Path, b, 0644)
 }
 
-func (m *MacMachine) setRootful(rootful bool) error {
-	if err := machine.SetRootful(rootful, m.Name, m.Name+"-root"); err != nil {
-		return err
-	}
-
-	m.HostUser.Modified = true
-	return nil
-}
-
 func (m *MacMachine) Set(name string, opts machine.SetOptions) ([]error, error) {
 	var setErrors []error
 
@@ -452,14 +438,6 @@ func (m *MacMachine) Set(name string, opts machine.SetOptions) ([]error, error)
 		setErrors = append(setErrors, errors.New("changing USBs not supported for applehv machines"))
 	}
 
-	if opts.Rootful != nil && m.Rootful != *opts.Rootful {
-		if err := m.setRootful(*opts.Rootful); err != nil {
-			setErrors = append(setErrors, fmt.Errorf("failed to set rootful option: %w", err))
-		} else {
-			m.Rootful = *opts.Rootful
-		}
-	}
-
 	// Write the machine config to the filesystem
 	err = m.writeConfig()
 	setErrors = append(setErrors, err)
@@ -719,17 +697,6 @@ func (m *MacMachine) Start(name string, opts machine.StartOptions) error {
 		m.isIncompatible(),
 		m.Rootful,
 	)
-
-	// update the podman/docker socket service if the host user has been modified at all (UID or Rootful)
-	if m.HostUser.Modified {
-		if machine.UpdatePodmanDockerSockService(m, name, m.UID, m.Rootful) == nil {
-			// Reset modification state if there are no errors, otherwise ignore errors
-			// which are already logged
-			m.HostUser.Modified = false
-			_ = m.writeConfig()
-		}
-	}
-
 	return nil
 }
 
diff --git a/pkg/namespaces/namespaces.go b/pkg/namespaces/namespaces.go
index 3c0622c7d5..2731fe95ad 100644
--- a/pkg/namespaces/namespaces.go
+++ b/pkg/namespaces/namespaces.go
@@ -48,21 +48,24 @@ func (n CgroupMode) IsNS() bool {
 
 // NS gets the path associated with a ns:<path> cgroup ns
 func (n CgroupMode) NS() string {
-	_, path, _ := strings.Cut(string(n), ":")
-	return path
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 {
+		return parts[1]
+	}
+	return ""
 }
 
 // IsContainer indicates whether the container uses a new cgroup namespace.
 func (n CgroupMode) IsContainer() bool {
-	typ, _, hasColon := strings.Cut(string(n), ":")
-	return hasColon && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // Container returns the name of the container whose cgroup namespace is going to be used.
 func (n CgroupMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -120,36 +123,36 @@ func (n UsernsMode) IsDefaultValue() bool {
 // GetKeepIDOptions returns a KeepIDUserNsOptions with the settings to keepIDmatically set up
 // a user namespace.
 func (n UsernsMode) GetKeepIDOptions() (*KeepIDUserNsOptions, error) {
-	nsmode, nsopts, hasOpts := strings.Cut(string(n), ":")
-	if nsmode != "keep-id" {
+	parts := strings.SplitN(string(n), ":", 2)
+	if parts[0] != "keep-id" {
 		return nil, fmt.Errorf("wrong user namespace mode")
 	}
 	options := KeepIDUserNsOptions{}
-	if !hasOpts {
+	if len(parts) == 1 {
 		return &options, nil
 	}
-	for _, o := range strings.Split(nsopts, ",") {
-		opt, val, hasVal := strings.Cut(o, "=")
-		if !hasVal {
+	for _, o := range strings.Split(parts[1], ",") {
+		v := strings.SplitN(o, "=", 2)
+		if len(v) != 2 {
 			return nil, fmt.Errorf("invalid option specified: %q", o)
 		}
-		switch opt {
+		switch v[0] {
 		case "uid":
-			s, err := strconv.ParseUint(val, 10, 32)
+			s, err := strconv.ParseUint(v[1], 10, 32)
 			if err != nil {
 				return nil, err
 			}
 			v := uint32(s)
 			options.UID = &v
 		case "gid":
-			s, err := strconv.ParseUint(val, 10, 32)
+			s, err := strconv.ParseUint(v[1], 10, 32)
 			if err != nil {
 				return nil, err
 			}
 			v := uint32(s)
 			options.GID = &v
 		default:
-			return nil, fmt.Errorf("unknown option specified: %q", opt)
+			return nil, fmt.Errorf("unknown option specified: %q", v[0])
 		}
 	}
 	return &options, nil
@@ -182,21 +185,24 @@ func (n UsernsMode) IsNS() bool {
 
 // NS gets the path associated with a ns:<path> userns ns
 func (n UsernsMode) NS() string {
-	_, path, _ := strings.Cut(string(n), ":")
-	return path
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 {
+		return parts[1]
+	}
+	return ""
 }
 
 // IsContainer indicates whether container uses a container userns.
 func (n UsernsMode) IsContainer() bool {
-	typ, _, hasName := strings.Cut(string(n), ":")
-	return hasName && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // Container is the id of the container which network this container is connected to.
 func (n UsernsMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -216,15 +222,15 @@ func (n UTSMode) IsHost() bool {
 
 // IsContainer indicates whether the container uses a container's UTS namespace.
 func (n UTSMode) IsContainer() bool {
-	typ, _, hasName := strings.Cut(string(n), ":")
-	return hasName && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // Container returns the name of the container whose uts namespace is going to be used.
 func (n UTSMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -264,8 +270,8 @@ func (n IpcMode) IsShareable() bool {
 
 // IsContainer indicates whether the container uses another container's ipc namespace.
 func (n IpcMode) IsContainer() bool {
-	typ, _, hasName := strings.Cut(string(n), ":")
-	return hasName && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // IsNone indicates whether container IpcMode is set to "none".
@@ -285,9 +291,9 @@ func (n IpcMode) Valid() bool {
 
 // Container returns the name of the container ipc stack is going to be used.
 func (n IpcMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -307,8 +313,8 @@ func (n PidMode) IsHost() bool {
 
 // IsContainer indicates whether the container uses a container's pid namespace.
 func (n PidMode) IsContainer() bool {
-	typ, _, hasName := strings.Cut(string(n), ":")
-	return hasName && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // Valid indicates whether the pid namespace is valid.
@@ -328,9 +334,9 @@ func (n PidMode) Valid() bool {
 
 // Container returns the name of the container whose pid namespace is going to be used.
 func (n PidMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -360,15 +366,15 @@ func (n NetworkMode) IsPrivate() bool {
 
 // IsContainer indicates whether container uses a container network stack.
 func (n NetworkMode) IsContainer() bool {
-	typ, _, hasName := strings.Cut(string(n), ":")
-	return hasName && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // Container is the id of the container which network this container is connected to.
 func (n NetworkMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -403,8 +409,11 @@ func (n NetworkMode) IsNS() bool {
 
 // NS gets the path associated with a ns:<path> network ns
 func (n NetworkMode) NS() string {
-	_, path, _ := strings.Cut(string(n), ":")
-	return path
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 {
+		return parts[1]
+	}
+	return ""
 }
 
 // IsPod returns whether the network refers to pod networking
diff --git a/pkg/rctl/rctl.go b/pkg/rctl/rctl.go
index 75588c79c6..54ccf40b1b 100644
--- a/pkg/rctl/rctl.go
+++ b/pkg/rctl/rctl.go
@@ -31,8 +31,9 @@ func GetRacct(filter string) (map[string]uint64, error) {
 	entries := strings.Split(string(buf[:len]), ",")
 	res := make(map[string]uint64)
 	for _, entry := range entries {
-		key, valstr, _ := strings.Cut(entry, "=")
-		val, err := strconv.ParseUint(valstr, 10, 0)
+		kv := strings.SplitN(entry, "=", 2)
+		key := kv[0]
+		val, err := strconv.ParseUint(kv[1], 10, 0)
 		if err != nil {
 			logrus.Warnf("unexpected rctl entry, ignoring: %s", entry)
 		}
diff --git a/pkg/specgen/generate/container.go b/pkg/specgen/generate/container.go
index 11541ab809..4471942f24 100644
--- a/pkg/specgen/generate/container.go
+++ b/pkg/specgen/generate/container.go
@@ -236,8 +236,13 @@ func CompleteSpec(ctx context.Context, r *libpod.Runtime, s *specgen.SpecGenerat
 		}
 	}
 
-	for _, annotation := range rtc.Containers.Annotations.Get() {
-		k, v, _ := strings.Cut(annotation, "=")
+	for _, v := range rtc.Containers.Annotations.Get() {
+		split := strings.SplitN(v, "=", 2)
+		k := split[0]
+		v := ""
+		if len(split) == 2 {
+			v = split[1]
+		}
 		annotations[k] = v
 	}
 	// now pass in the values from client
@@ -351,9 +356,9 @@ func ConfigToSpec(rt *libpod.Runtime, specg *specgen.SpecGenerator, containerID
 		if conf.Spec.Process != nil && conf.Spec.Process.Env != nil {
 			env := make(map[string]string)
 			for _, entry := range conf.Spec.Process.Env {
-				key, val, hasVal := strings.Cut(entry, "=")
-				if hasVal {
-					env[key] = val
+				split := strings.SplitN(entry, "=", 2)
+				if len(split) == 2 {
+					env[split[0]] = split[1]
 				}
 			}
 			specg.Env = env
diff --git a/pkg/specgen/generate/container_create.go b/pkg/specgen/generate/container_create.go
index 09483bbb9b..c0878d5000 100644
--- a/pkg/specgen/generate/container_create.go
+++ b/pkg/specgen/generate/container_create.go
@@ -54,12 +54,12 @@ func MakeContainer(ctx context.Context, rt *libpod.Runtime, s *specgen.SpecGener
 			s.ResourceLimits.Unified = make(map[string]string)
 		}
 		for _, cgroupConf := range rtc.Containers.CgroupConf.Get() {
-			key, val, hasVal := strings.Cut(cgroupConf, "=")
-			if !hasVal {
-				return nil, nil, nil, fmt.Errorf("CgroupConf %s from containers.conf invalid, must be name=value", cgroupConf)
+			cgr := strings.SplitN(cgroupConf, "=", 2)
+			if len(cgr) != 2 {
+				return nil, nil, nil, fmt.Errorf("CgroupConf %q from containers.conf invalid, must be name=value", cgr)
 			}
-			if _, ok := s.ResourceLimits.Unified[key]; !ok {
-				s.ResourceLimits.Unified[key] = val
+			if _, ok := s.ResourceLimits.Unified[cgr[0]]; !ok {
+				s.ResourceLimits.Unified[cgr[0]] = cgr[1]
 			}
 		}
 	}
diff --git a/pkg/specgen/generate/kube/kube.go b/pkg/specgen/generate/kube/kube.go
index f10fc21c68..930f1497f0 100644
--- a/pkg/specgen/generate/kube/kube.go
+++ b/pkg/specgen/generate/kube/kube.go
@@ -221,29 +221,29 @@ func ToSpecGen(ctx context.Context, opts *CtrSpecGenOptions) (*specgen.SpecGener
 
 	s.LogConfiguration.Options = make(map[string]string)
 	for _, o := range opts.LogOptions {
-		opt, val, hasVal := strings.Cut(o, "=")
-		if !hasVal {
+		split := strings.SplitN(o, "=", 2)
+		if len(split) < 2 {
 			return nil, fmt.Errorf("invalid log option %q", o)
 		}
-		switch strings.ToLower(opt) {
+		switch strings.ToLower(split[0]) {
 		case "driver":
-			s.LogConfiguration.Driver = val
+			s.LogConfiguration.Driver = split[1]
 		case "path":
-			s.LogConfiguration.Path = val
+			s.LogConfiguration.Path = split[1]
 		case "max-size":
-			logSize, err := units.FromHumanSize(val)
+			logSize, err := units.FromHumanSize(split[1])
 			if err != nil {
 				return nil, err
 			}
 			s.LogConfiguration.Size = logSize
 		default:
-			switch len(val) {
+			switch len(split[1]) {
 			case 0:
 				return nil, fmt.Errorf("invalid log option: %w", define.ErrInvalidArg)
 			default:
 				// tags for journald only
 				if s.LogConfiguration.Driver == "" || s.LogConfiguration.Driver == define.JournaldLogging {
-					s.LogConfiguration.Options[opt] = val
+					s.LogConfiguration.Options[split[0]] = split[1]
 				} else {
 					logrus.Warnf("Can only set tags with journald log driver but driver is %q", s.LogConfiguration.Driver)
 				}
@@ -434,8 +434,8 @@ func ToSpecGen(ctx context.Context, opts *CtrSpecGenOptions) (*specgen.SpecGener
 	// Environment Variables
 	envs := map[string]string{}
 	for _, env := range imageData.Config.Env {
-		key, val, _ := strings.Cut(env, "=")
-		envs[key] = val
+		keyval := strings.SplitN(env, "=", 2)
+		envs[keyval[0]] = keyval[1]
 	}
 
 	for _, env := range opts.Container.Env {
diff --git a/pkg/specgen/generate/storage.go b/pkg/specgen/generate/storage.go
index 8c65783b43..fa66359069 100644
--- a/pkg/specgen/generate/storage.go
+++ b/pkg/specgen/generate/storage.go
@@ -262,9 +262,9 @@ func getVolumesFrom(volumesFrom []string, runtime *libpod.Runtime) (map[string]s
 	for _, volume := range volumesFrom {
 		var options []string
 
-		idOrName, volOpts, hasVolOpts := strings.Cut(volume, ":")
-		if hasVolOpts {
-			splitOpts := strings.Split(volOpts, ",")
+		splitVol := strings.SplitN(volume, ":", 2)
+		if len(splitVol) == 2 {
+			splitOpts := strings.Split(splitVol[1], ",")
 			setRORW := false
 			setZ := false
 			for _, opt := range splitOpts {
@@ -286,9 +286,9 @@ func getVolumesFrom(volumesFrom []string, runtime *libpod.Runtime) (map[string]s
 			options = splitOpts
 		}
 
-		ctr, err := runtime.LookupContainer(idOrName)
+		ctr, err := runtime.LookupContainer(splitVol[0])
 		if err != nil {
-			return nil, nil, fmt.Errorf("looking up container %q for volumes-from: %w", idOrName, err)
+			return nil, nil, fmt.Errorf("looking up container %q for volumes-from: %w", splitVol[0], err)
 		}
 
 		logrus.Debugf("Adding volumes from container %s", ctr.ID())
diff --git a/pkg/specgen/namespaces.go b/pkg/specgen/namespaces.go
index 4b8a6bee41..04d4b08f43 100644
--- a/pkg/specgen/namespaces.go
+++ b/pkg/specgen/namespaces.go
@@ -230,23 +230,29 @@ func (n *Namespace) validate() error {
 // function.
 func ParseNamespace(ns string) (Namespace, error) {
 	toReturn := Namespace{}
-	switch ns {
-	case "pod":
+	switch {
+	case ns == "pod":
 		toReturn.NSMode = FromPod
-	case "host":
+	case ns == "host":
 		toReturn.NSMode = Host
-	case "private", "":
+	case ns == "private", ns == "":
 		toReturn.NSMode = Private
-	default:
-		if value, ok := strings.CutPrefix(ns, "ns:"); ok {
-			toReturn.NSMode = Path
-			toReturn.Value = value
-		} else if value, ok := strings.CutPrefix(ns, "container:"); ok {
-			toReturn.NSMode = FromContainer
-			toReturn.Value = value
-		} else {
-			return toReturn, fmt.Errorf("unrecognized namespace mode %s passed", ns)
+	case strings.HasPrefix(ns, "ns:"):
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, fmt.Errorf("must provide a path to a namespace when specifying \"ns:\"")
 		}
+		toReturn.NSMode = Path
+		toReturn.Value = split[1]
+	case strings.HasPrefix(ns, "container:"):
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, fmt.Errorf("must provide name or ID or a container when specifying \"container:\"")
+		}
+		toReturn.NSMode = FromContainer
+		toReturn.Value = split[1]
+	default:
+		return toReturn, fmt.Errorf("unrecognized namespace mode %s passed", ns)
 	}
 
 	return toReturn, nil
@@ -296,32 +302,37 @@ func ParseIPCNamespace(ns string) (Namespace, error) {
 // form.
 func ParseUserNamespace(ns string) (Namespace, error) {
 	toReturn := Namespace{}
-	switch ns {
-	case "auto":
+	switch {
+	case ns == "auto":
+		toReturn.NSMode = Auto
+		return toReturn, nil
+	case strings.HasPrefix(ns, "auto:"):
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, errors.New("invalid setting for auto: mode")
+		}
 		toReturn.NSMode = Auto
+		toReturn.Value = split[1]
 		return toReturn, nil
-	case "keep-id":
+	case ns == "keep-id":
 		toReturn.NSMode = KeepID
 		return toReturn, nil
-	case "nomap":
+	case strings.HasPrefix(ns, "keep-id:"):
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, errors.New("invalid setting for keep-id: mode")
+		}
+		toReturn.NSMode = KeepID
+		toReturn.Value = split[1]
+		return toReturn, nil
+	case ns == "nomap":
 		toReturn.NSMode = NoMap
 		return toReturn, nil
-	case "":
+	case ns == "":
 		toReturn.NSMode = Host
 		return toReturn, nil
-	default:
-		if value, ok := strings.CutPrefix(ns, "auto:"); ok {
-			toReturn.NSMode = Auto
-			toReturn.Value = value
-			return toReturn, nil
-		} else if value, ok := strings.CutPrefix(ns, "keep-id:"); ok {
-			toReturn.NSMode = KeepID
-			toReturn.Value = value
-			return toReturn, nil
-		} else {
-			return ParseNamespace(ns)
-		}
 	}
+	return ParseNamespace(ns)
 }
 
 // ParseNetworkFlag parses a network string slice into the network options
@@ -341,10 +352,10 @@ func ParseNetworkFlag(networks []string, pastaNetworkNameExists bool) (Namespace
 
 	switch {
 	case ns == string(Slirp), strings.HasPrefix(ns, string(Slirp)+":"):
-		key, options, hasOptions := strings.Cut(ns, ":")
-		if hasOptions {
+		parts := strings.SplitN(ns, ":", 2)
+		if len(parts) > 1 {
 			networkOptions = make(map[string][]string)
-			networkOptions[key] = strings.Split(options, ",")
+			networkOptions[parts[0]] = strings.Split(parts[1], ",")
 		}
 		toReturn.NSMode = Slirp
 	case ns == string(FromPod):
@@ -353,11 +364,11 @@ func ParseNetworkFlag(networks []string, pastaNetworkNameExists bool) (Namespace
 		toReturn.NSMode = Private
 	case ns == string(Bridge), strings.HasPrefix(ns, string(Bridge)+":"):
 		toReturn.NSMode = Bridge
-		_, options, hasOptions := strings.Cut(ns, ":")
+		parts := strings.SplitN(ns, ":", 2)
 		netOpts := types.PerNetworkOptions{}
-		if hasOptions {
+		if len(parts) > 1 {
 			var err error
-			netOpts, err = parseBridgeNetworkOptions(options)
+			netOpts, err = parseBridgeNetworkOptions(parts[1])
 			if err != nil {
 				return toReturn, nil, nil, err
 			}
@@ -370,23 +381,30 @@ func ParseNetworkFlag(networks []string, pastaNetworkNameExists bool) (Namespace
 	case ns == string(Host):
 		toReturn.NSMode = Host
 	case strings.HasPrefix(ns, "ns:"):
-		_, value, _ := strings.Cut(ns, ":")
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, nil, nil, errors.New("must provide a path to a namespace when specifying \"ns:\"")
+		}
 		toReturn.NSMode = Path
-		toReturn.Value = value
+		toReturn.Value = split[1]
 	case strings.HasPrefix(ns, string(FromContainer)+":"):
-		_, value, _ := strings.Cut(ns, ":")
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, nil, nil, errors.New("must provide name or ID or a container when specifying \"container:\"")
+		}
 		toReturn.NSMode = FromContainer
-		toReturn.Value = value
+		toReturn.Value = split[1]
 	case ns == string(Pasta), strings.HasPrefix(ns, string(Pasta)+":"):
-		key, options, hasOptions := strings.Cut(ns, ":")
+		var parts []string
 
 		if pastaNetworkNameExists {
 			goto nextCase
 		}
 
-		if hasOptions {
+		parts = strings.SplitN(ns, ":", 2)
+		if len(parts) > 1 {
 			networkOptions = make(map[string][]string)
-			networkOptions[key] = strings.Split(options, ",")
+			networkOptions[parts[0]] = strings.Split(parts[1], ",")
 		}
 		toReturn.NSMode = Pasta
 		break
@@ -394,22 +412,22 @@ func ParseNetworkFlag(networks []string, pastaNetworkNameExists bool) (Namespace
 		fallthrough
 	default:
 		// we should have a normal network
-		name, options, hasOptions := strings.Cut(ns, ":")
-		if hasOptions {
-			if name == "" {
-				return toReturn, nil, nil, errors.New("network name cannot be empty")
-			}
-			netOpts, err := parseBridgeNetworkOptions(options)
-			if err != nil {
-				return toReturn, nil, nil, fmt.Errorf("invalid option for network %s: %w", name, err)
-			}
-			podmanNetworks[name] = netOpts
-		} else {
+		parts := strings.SplitN(ns, ":", 2)
+		if len(parts) == 1 {
 			// Assume we have been given a comma separated list of networks for backwards compat.
 			networkList := strings.Split(ns, ",")
 			for _, net := range networkList {
 				podmanNetworks[net] = types.PerNetworkOptions{}
 			}
+		} else {
+			if parts[0] == "" {
+				return toReturn, nil, nil, errors.New("network name cannot be empty")
+			}
+			netOpts, err := parseBridgeNetworkOptions(parts[1])
+			if err != nil {
+				return toReturn, nil, nil, fmt.Errorf("invalid option for network %s: %w", parts[0], err)
+			}
+			podmanNetworks[parts[0]] = netOpts
 		}
 
 		// networks need bridge mode
@@ -422,24 +440,24 @@ func ParseNetworkFlag(networks []string, pastaNetworkNameExists bool) (Namespace
 		}
 
 		for _, network := range networks[1:] {
-			name, options, hasOptions := strings.Cut(network, ":")
-			if name == "" {
+			parts := strings.SplitN(network, ":", 2)
+			if parts[0] == "" {
 				return toReturn, nil, nil, fmt.Errorf("network name cannot be empty: %w", define.ErrInvalidArg)
 			}
 			// TODO (5.0): Don't accept string(Pasta) here once we drop pastaNetworkNameExists
 			if slices.Contains([]string{string(Bridge), string(Slirp), string(FromPod), string(NoNetwork),
-				string(Default), string(Private), string(Path), string(FromContainer), string(Host)}, name) {
-				return toReturn, nil, nil, fmt.Errorf("can only set extra network names, selected mode %s conflicts with bridge: %w", name, define.ErrInvalidArg)
+				string(Default), string(Private), string(Path), string(FromContainer), string(Host)}, parts[0]) {
+				return toReturn, nil, nil, fmt.Errorf("can only set extra network names, selected mode %s conflicts with bridge: %w", parts[0], define.ErrInvalidArg)
 			}
 			netOpts := types.PerNetworkOptions{}
-			if hasOptions {
+			if len(parts) > 1 {
 				var err error
-				netOpts, err = parseBridgeNetworkOptions(options)
+				netOpts, err = parseBridgeNetworkOptions(parts[1])
 				if err != nil {
-					return toReturn, nil, nil, fmt.Errorf("invalid option for network %s: %w", name, err)
+					return toReturn, nil, nil, fmt.Errorf("invalid option for network %s: %w", parts[0], err)
 				}
 			}
-			podmanNetworks[name] = netOpts
+			podmanNetworks[parts[0]] = netOpts
 		}
 	}
 
@@ -453,36 +471,36 @@ func parseBridgeNetworkOptions(opts string) (types.PerNetworkOptions, error) {
 	}
 	allopts := strings.Split(opts, ",")
 	for _, opt := range allopts {
-		name, value, _ := strings.Cut(opt, "=")
-		switch name {
+		split := strings.SplitN(opt, "=", 2)
+		switch split[0] {
 		case "ip", "ip6":
-			ip := net.ParseIP(value)
+			ip := net.ParseIP(split[1])
 			if ip == nil {
-				return netOpts, fmt.Errorf("invalid ip address %q", value)
+				return netOpts, fmt.Errorf("invalid ip address %q", split[1])
 			}
 			netOpts.StaticIPs = append(netOpts.StaticIPs, ip)
 
 		case "mac":
-			mac, err := net.ParseMAC(value)
+			mac, err := net.ParseMAC(split[1])
 			if err != nil {
 				return netOpts, err
 			}
 			netOpts.StaticMAC = types.HardwareAddr(mac)
 
 		case "alias":
-			if value == "" {
+			if split[1] == "" {
 				return netOpts, errors.New("alias cannot be empty")
 			}
-			netOpts.Aliases = append(netOpts.Aliases, value)
+			netOpts.Aliases = append(netOpts.Aliases, split[1])
 
 		case "interface_name":
-			if value == "" {
+			if split[1] == "" {
 				return netOpts, errors.New("interface_name cannot be empty")
 			}
-			netOpts.InterfaceName = value
+			netOpts.InterfaceName = split[1]
 
 		default:
-			return netOpts, fmt.Errorf("unknown bridge network option: %s", name)
+			return netOpts, fmt.Errorf("unknown bridge network option: %s", split[0])
 		}
 	}
 	return netOpts, nil
diff --git a/pkg/specgenutil/specgen.go b/pkg/specgenutil/specgen.go
index e9e90cae43..306a19b394 100644
--- a/pkg/specgenutil/specgen.go
+++ b/pkg/specgenutil/specgen.go
@@ -502,11 +502,11 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 
 	// Last, add user annotations
 	for _, annotation := range c.Annotation {
-		key, val, hasVal := strings.Cut(annotation, "=")
-		if !hasVal {
+		splitAnnotation := strings.SplitN(annotation, "=", 2)
+		if len(splitAnnotation) < 2 {
 			return errors.New("annotations must be formatted KEY=VALUE")
 		}
-		annotations[key] = val
+		annotations[splitAnnotation[0]] = splitAnnotation[1]
 	}
 	if len(s.Annotations) == 0 {
 		s.Annotations = annotations
@@ -515,11 +515,11 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 	if len(c.StorageOpts) > 0 {
 		opts := make(map[string]string, len(c.StorageOpts))
 		for _, opt := range c.StorageOpts {
-			key, val, hasVal := strings.Cut(opt, "=")
-			if !hasVal {
+			split := strings.SplitN(opt, "=", 2)
+			if len(split) != 2 {
 				return errors.New("storage-opt must be formatted KEY=VALUE")
 			}
-			opts[key] = val
+			opts[split[0]] = split[1]
 		}
 		s.StorageOpts = opts
 	}
@@ -673,11 +673,11 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 	// check if key=value and convert
 	sysmap := make(map[string]string)
 	for _, ctl := range c.Sysctl {
-		key, val, hasVal := strings.Cut(ctl, "=")
-		if !hasVal {
+		splitCtl := strings.SplitN(ctl, "=", 2)
+		if len(splitCtl) < 2 {
 			return fmt.Errorf("invalid sysctl value %q", ctl)
 		}
-		sysmap[key] = val
+		sysmap[splitCtl[0]] = splitCtl[1]
 	}
 	if len(s.Sysctl) == 0 || len(c.Sysctl) != 0 {
 		s.Sysctl = sysmap
@@ -690,51 +690,48 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 	for _, opt := range c.SecurityOpt {
 		// Docker deprecated the ":" syntax but still supports it,
 		// so we need to as well
-		var key, val string
-		var hasVal bool
+		var con []string
 		if strings.Contains(opt, "=") {
-			key, val, hasVal = strings.Cut(opt, "=")
+			con = strings.SplitN(opt, "=", 2)
 		} else {
-			key, val, hasVal = strings.Cut(opt, ":")
+			con = strings.SplitN(opt, ":", 2)
 		}
-		if !hasVal &&
-			key != "no-new-privileges" {
+		if len(con) != 2 &&
+			con[0] != "no-new-privileges" {
 			return fmt.Errorf("invalid --security-opt 1: %q", opt)
 		}
-		switch key {
+		switch con[0] {
 		case "apparmor":
-			s.ContainerSecurityConfig.ApparmorProfile = val
-			s.Annotations[define.InspectAnnotationApparmor] = val
+			s.ContainerSecurityConfig.ApparmorProfile = con[1]
+			s.Annotations[define.InspectAnnotationApparmor] = con[1]
 		case "label":
-			if val == "nested" {
+			if con[1] == "nested" {
 				s.ContainerSecurityConfig.LabelNested = true
 				continue
 			}
 			// TODO selinux opts and label opts are the same thing
-			s.ContainerSecurityConfig.SelinuxOpts = append(s.ContainerSecurityConfig.SelinuxOpts, val)
+			s.ContainerSecurityConfig.SelinuxOpts = append(s.ContainerSecurityConfig.SelinuxOpts, con[1])
 			s.Annotations[define.InspectAnnotationLabel] = strings.Join(s.ContainerSecurityConfig.SelinuxOpts, ",label=")
 		case "mask":
-			s.ContainerSecurityConfig.Mask = append(s.ContainerSecurityConfig.Mask, strings.Split(val, ":")...)
+			s.ContainerSecurityConfig.Mask = append(s.ContainerSecurityConfig.Mask, strings.Split(con[1], ":")...)
 		case "proc-opts":
-			s.ProcOpts = strings.Split(val, ",")
+			s.ProcOpts = strings.Split(con[1], ",")
 		case "seccomp":
-			s.SeccompProfilePath = val
-			s.Annotations[define.InspectAnnotationSeccomp] = val
+			s.SeccompProfilePath = con[1]
+			s.Annotations[define.InspectAnnotationSeccomp] = con[1]
 			// this option is for docker compatibility, it is the same as unmask=ALL
 		case "systempaths":
-			if val == "unconfined" {
+			if con[1] == "unconfined" {
 				s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, []string{"ALL"}...)
 			} else {
-				return fmt.Errorf("invalid systempaths option %q, only `unconfined` is supported", val)
+				return fmt.Errorf("invalid systempaths option %q, only `unconfined` is supported", con[1])
 			}
 		case "unmask":
-			if hasVal {
-				s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, val)
-			}
+			s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, con[1:]...)
 		case "no-new-privileges":
 			noNewPrivileges := true
-			if hasVal {
-				noNewPrivileges, err = strconv.ParseBool(val)
+			if len(con) == 2 {
+				noNewPrivileges, err = strconv.ParseBool(con[1])
 				if err != nil {
 					return fmt.Errorf("invalid --security-opt 2: %q", opt)
 				}
@@ -816,23 +813,23 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 
 	logOpts := make(map[string]string)
 	for _, o := range c.LogOptions {
-		key, val, hasVal := strings.Cut(o, "=")
-		if !hasVal {
+		split := strings.SplitN(o, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid log option %q", o)
 		}
-		switch strings.ToLower(key) {
+		switch strings.ToLower(split[0]) {
 		case "driver":
-			s.LogConfiguration.Driver = val
+			s.LogConfiguration.Driver = split[1]
 		case "path":
-			s.LogConfiguration.Path = val
+			s.LogConfiguration.Path = split[1]
 		case "max-size":
-			logSize, err := units.FromHumanSize(val)
+			logSize, err := units.FromHumanSize(split[1])
 			if err != nil {
 				return err
 			}
 			s.LogConfiguration.Size = logSize
 		default:
-			logOpts[key] = val
+			logOpts[split[0]] = split[1]
 		}
 	}
 	if len(s.LogConfiguration.Options) == 0 || len(c.LogOptions) != 0 {
@@ -1007,23 +1004,23 @@ func makeHealthCheckFromCli(inCmd, interval string, retries uint, timeout, start
 
 func parseWeightDevices(weightDevs []string) (map[string]specs.LinuxWeightDevice, error) {
 	wd := make(map[string]specs.LinuxWeightDevice)
-	for _, dev := range weightDevs {
-		key, val, hasVal := strings.Cut(dev, ":")
-		if !hasVal {
-			return nil, fmt.Errorf("bad format: %s", dev)
+	for _, val := range weightDevs {
+		split := strings.SplitN(val, ":", 2)
+		if len(split) != 2 {
+			return nil, fmt.Errorf("bad format: %s", val)
 		}
-		if !strings.HasPrefix(key, "/dev/") {
-			return nil, fmt.Errorf("bad format for device path: %s", dev)
+		if !strings.HasPrefix(split[0], "/dev/") {
+			return nil, fmt.Errorf("bad format for device path: %s", val)
 		}
-		weight, err := strconv.ParseUint(val, 10, 0)
+		weight, err := strconv.ParseUint(split[1], 10, 0)
 		if err != nil {
-			return nil, fmt.Errorf("invalid weight for device: %s", dev)
+			return nil, fmt.Errorf("invalid weight for device: %s", val)
 		}
 		if weight > 0 && (weight < 10 || weight > 1000) {
-			return nil, fmt.Errorf("invalid weight for device: %s", dev)
+			return nil, fmt.Errorf("invalid weight for device: %s", val)
 		}
 		w := uint16(weight)
-		wd[key] = specs.LinuxWeightDevice{
+		wd[split[0]] = specs.LinuxWeightDevice{
 			Weight:     &w,
 			LeafWeight: nil,
 		}
@@ -1033,41 +1030,41 @@ func parseWeightDevices(weightDevs []string) (map[string]specs.LinuxWeightDevice
 
 func parseThrottleBPSDevices(bpsDevices []string) (map[string]specs.LinuxThrottleDevice, error) {
 	td := make(map[string]specs.LinuxThrottleDevice)
-	for _, dev := range bpsDevices {
-		key, val, hasVal := strings.Cut(dev, ":")
-		if !hasVal {
-			return nil, fmt.Errorf("bad format: %s", dev)
+	for _, val := range bpsDevices {
+		split := strings.SplitN(val, ":", 2)
+		if len(split) != 2 {
+			return nil, fmt.Errorf("bad format: %s", val)
 		}
-		if !strings.HasPrefix(key, "/dev/") {
-			return nil, fmt.Errorf("bad format for device path: %s", dev)
+		if !strings.HasPrefix(split[0], "/dev/") {
+			return nil, fmt.Errorf("bad format for device path: %s", val)
 		}
-		rate, err := units.RAMInBytes(val)
+		rate, err := units.RAMInBytes(split[1])
 		if err != nil {
-			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", dev)
+			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", val)
 		}
 		if rate < 0 {
-			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", dev)
+			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", val)
 		}
-		td[key] = specs.LinuxThrottleDevice{Rate: uint64(rate)}
+		td[split[0]] = specs.LinuxThrottleDevice{Rate: uint64(rate)}
 	}
 	return td, nil
 }
 
 func parseThrottleIOPsDevices(iopsDevices []string) (map[string]specs.LinuxThrottleDevice, error) {
 	td := make(map[string]specs.LinuxThrottleDevice)
-	for _, dev := range iopsDevices {
-		key, val, hasVal := strings.Cut(dev, ":")
-		if !hasVal {
-			return nil, fmt.Errorf("bad format: %s", dev)
+	for _, val := range iopsDevices {
+		split := strings.SplitN(val, ":", 2)
+		if len(split) != 2 {
+			return nil, fmt.Errorf("bad format: %s", val)
 		}
-		if !strings.HasPrefix(key, "/dev/") {
-			return nil, fmt.Errorf("bad format for device path: %s", dev)
+		if !strings.HasPrefix(split[0], "/dev/") {
+			return nil, fmt.Errorf("bad format for device path: %s", val)
 		}
-		rate, err := strconv.ParseUint(val, 10, 64)
+		rate, err := strconv.ParseUint(split[1], 10, 64)
 		if err != nil {
-			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>. Number must be a positive integer", dev)
+			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>. Number must be a positive integer", val)
 		}
-		td[key] = specs.LinuxThrottleDevice{Rate: rate}
+		td[split[0]] = specs.LinuxThrottleDevice{Rate: rate}
 	}
 	return td, nil
 }
@@ -1106,42 +1103,42 @@ func parseSecrets(secrets []string) ([]specgen.Secret, map[string]string, error)
 		}
 
 		for _, val := range split {
-			name, value, hasValue := strings.Cut(val, "=")
-			if !hasValue {
+			kv := strings.SplitN(val, "=", 2)
+			if len(kv) < 2 {
 				return nil, nil, fmt.Errorf("option %s must be in form option=value: %w", val, secretParseError)
 			}
-			switch name {
+			switch kv[0] {
 			case "source":
-				source = value
+				source = kv[1]
 			case "type":
 				if secretType != "" {
 					return nil, nil, fmt.Errorf("cannot set more than one secret type: %w", secretParseError)
 				}
-				if value != "mount" && value != "env" {
-					return nil, nil, fmt.Errorf("type %s is invalid: %w", value, secretParseError)
+				if kv[1] != "mount" && kv[1] != "env" {
+					return nil, nil, fmt.Errorf("type %s is invalid: %w", kv[1], secretParseError)
 				}
-				secretType = value
+				secretType = kv[1]
 			case "target":
-				target = value
+				target = kv[1]
 			case "mode":
 				mountOnly = true
-				mode64, err := strconv.ParseUint(value, 8, 32)
+				mode64, err := strconv.ParseUint(kv[1], 8, 32)
 				if err != nil {
-					return nil, nil, fmt.Errorf("mode %s invalid: %w", value, secretParseError)
+					return nil, nil, fmt.Errorf("mode %s invalid: %w", kv[1], secretParseError)
 				}
 				mode = uint32(mode64)
 			case "uid", "UID":
 				mountOnly = true
-				uid64, err := strconv.ParseUint(value, 10, 32)
+				uid64, err := strconv.ParseUint(kv[1], 10, 32)
 				if err != nil {
-					return nil, nil, fmt.Errorf("UID %s invalid: %w", value, secretParseError)
+					return nil, nil, fmt.Errorf("UID %s invalid: %w", kv[1], secretParseError)
 				}
 				uid = uint32(uid64)
 			case "gid", "GID":
 				mountOnly = true
-				gid64, err := strconv.ParseUint(value, 10, 32)
+				gid64, err := strconv.ParseUint(kv[1], 10, 32)
 				if err != nil {
-					return nil, nil, fmt.Errorf("GID %s invalid: %w", value, secretParseError)
+					return nil, nil, fmt.Errorf("GID %s invalid: %w", kv[1], secretParseError)
 				}
 				gid = uint32(gid64)
 
@@ -1206,17 +1203,17 @@ func parseLinuxResourcesDeviceAccess(device string) (specs.LinuxDeviceCgroup, er
 		return specs.LinuxDeviceCgroup{}, fmt.Errorf("invalid device type in device-access-add: %s", devType)
 	}
 
-	majorNumber, minorNumber, hasMinor := strings.Cut(value[1], ":")
-	if majorNumber != "*" {
-		i, err := strconv.ParseUint(majorNumber, 10, 64)
+	number := strings.SplitN(value[1], ":", 2)
+	if number[0] != "*" {
+		i, err := strconv.ParseUint(number[0], 10, 64)
 		if err != nil {
 			return specs.LinuxDeviceCgroup{}, err
 		}
 		m := int64(i)
 		major = &m
 	}
-	if hasMinor && minorNumber != "*" {
-		i, err := strconv.ParseUint(minorNumber, 10, 64)
+	if len(number) == 2 && number[1] != "*" {
+		i, err := strconv.ParseUint(number[1], 10, 64)
 		if err != nil {
 			return specs.LinuxDeviceCgroup{}, err
 		}
@@ -1266,11 +1263,11 @@ func GetResources(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions)
 
 	unifieds := make(map[string]string)
 	for _, unified := range c.CgroupConf {
-		key, val, hasVal := strings.Cut(unified, "=")
-		if !hasVal {
+		splitUnified := strings.SplitN(unified, "=", 2)
+		if len(splitUnified) < 2 {
 			return nil, errors.New("--cgroup-conf must be formatted KEY=VALUE")
 		}
-		unifieds[key] = val
+		unifieds[splitUnified[0]] = splitUnified[1]
 	}
 	if len(unifieds) > 0 {
 		s.ResourceLimits.Unified = unifieds
diff --git a/pkg/specgenutil/volumes.go b/pkg/specgenutil/volumes.go
index 5155e779fd..4e663f6e73 100644
--- a/pkg/specgenutil/volumes.go
+++ b/pkg/specgenutil/volumes.go
@@ -256,29 +256,29 @@ func parseMountOptions(mountType string, args []string) (*spec.Mount, error) {
 	var setTmpcopyup, setRORW, setSuid, setDev, setExec, setRelabel, setOwnership, setSwap bool
 
 	mnt := spec.Mount{}
-	for _, arg := range args {
-		name, value, hasValue := strings.Cut(arg, "=")
-		switch name {
+	for _, val := range args {
+		kv := strings.SplitN(val, "=", 2)
+		switch kv[0] {
 		case "bind-nonrecursive":
 			if mountType != define.TypeBind {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
 			mnt.Options = append(mnt.Options, define.TypeBind)
 		case "bind-propagation":
 			if mountType != define.TypeBind {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			mnt.Options = append(mnt.Options, value)
+			mnt.Options = append(mnt.Options, kv[1])
 		case "consistency":
 			// Often used on MACs and mistakenly on Linux platforms.
 			// Since Docker ignores this option so shall we.
 			continue
 		case "idmap":
-			if hasValue {
-				mnt.Options = append(mnt.Options, fmt.Sprintf("idmap=%s", value))
+			if len(kv) > 1 {
+				mnt.Options = append(mnt.Options, fmt.Sprintf("idmap=%s", kv[1]))
 			} else {
 				mnt.Options = append(mnt.Options, "idmap")
 			}
@@ -294,41 +294,42 @@ func parseMountOptions(mountType string, args []string) (*spec.Mount, error) {
 			// ro=[true|false]
 			// rw
 			// rw=[true|false]
-			if name == "readonly" {
-				name = "ro"
-			}
-			if hasValue {
-				switch strings.ToLower(value) {
+			if kv[0] == "readonly" {
+				kv[0] = "ro"
+			}
+			switch len(kv) {
+			case 1:
+				mnt.Options = append(mnt.Options, kv[0])
+			case 2:
+				switch strings.ToLower(kv[1]) {
 				case "true":
-					mnt.Options = append(mnt.Options, name)
+					mnt.Options = append(mnt.Options, kv[0])
 				case "false":
 					// Set the opposite only for rw
 					// ro's opposite is the default
-					if name == "rw" {
+					if kv[0] == "rw" {
 						mnt.Options = append(mnt.Options, "ro")
 					}
 				}
-			} else {
-				mnt.Options = append(mnt.Options, name)
 			}
 		case "nodev", "dev":
 			if setDev {
 				return nil, fmt.Errorf("cannot pass 'nodev' and 'dev' mnt.Options more than once: %w", errOptionArg)
 			}
 			setDev = true
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "noexec", "exec":
 			if setExec {
 				return nil, fmt.Errorf("cannot pass 'noexec' and 'exec' mnt.Options more than once: %w", errOptionArg)
 			}
 			setExec = true
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "nosuid", "suid":
 			if setSuid {
 				return nil, fmt.Errorf("cannot pass 'nosuid' and 'suid' mnt.Options more than once: %w", errOptionArg)
 			}
 			setSuid = true
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "noswap":
 			if setSwap {
 				return nil, fmt.Errorf("cannot pass 'noswap' mnt.Options more than once: %w", errOptionArg)
@@ -337,80 +338,80 @@ func parseMountOptions(mountType string, args []string) (*spec.Mount, error) {
 				return nil, fmt.Errorf("the 'noswap' option is only allowed with rootful tmpfs mounts: %w", errOptionArg)
 			}
 			setSwap = true
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "relabel":
 			if setRelabel {
 				return nil, fmt.Errorf("cannot pass 'relabel' option more than once: %w", errOptionArg)
 			}
 			setRelabel = true
-			if !hasValue {
-				return nil, fmt.Errorf("%s mount option must be 'private' or 'shared': %w", name, util.ErrBadMntOption)
+			if len(kv) != 2 {
+				return nil, fmt.Errorf("%s mount option must be 'private' or 'shared': %w", kv[0], util.ErrBadMntOption)
 			}
-			switch value {
+			switch kv[1] {
 			case "private":
 				mnt.Options = append(mnt.Options, "Z")
 			case "shared":
 				mnt.Options = append(mnt.Options, "z")
 			default:
-				return nil, fmt.Errorf("%s mount option must be 'private' or 'shared': %w", name, util.ErrBadMntOption)
+				return nil, fmt.Errorf("%s mount option must be 'private' or 'shared': %w", kv[0], util.ErrBadMntOption)
 			}
 		case "shared", "rshared", "private", "rprivate", "slave", "rslave", "unbindable", "runbindable", "Z", "z", "no-dereference":
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "src", "source":
 			if mountType == define.TypeTmpfs {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
 			if mnt.Source != "" {
-				return nil, fmt.Errorf("cannot pass %q option more than once: %w", name, errOptionArg)
+				return nil, fmt.Errorf("cannot pass %q option more than once: %w", kv[0], errOptionArg)
 			}
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			if len(value) == 0 {
+			if len(kv[1]) == 0 {
 				return nil, fmt.Errorf("host directory cannot be empty: %w", errOptionArg)
 			}
-			mnt.Source = value
+			mnt.Source = kv[1]
 		case "target", "dst", "destination":
 			if mnt.Destination != "" {
-				return nil, fmt.Errorf("cannot pass %q option more than once: %w", name, errOptionArg)
+				return nil, fmt.Errorf("cannot pass %q option more than once: %w", kv[0], errOptionArg)
 			}
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			if err := parse.ValidateVolumeCtrDir(value); err != nil {
+			if err := parse.ValidateVolumeCtrDir(kv[1]); err != nil {
 				return nil, err
 			}
-			mnt.Destination = unixPathClean(value)
+			mnt.Destination = unixPathClean(kv[1])
 		case "tmpcopyup", "notmpcopyup":
 			if mountType != define.TypeTmpfs {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
 			if setTmpcopyup {
 				return nil, fmt.Errorf("cannot pass 'tmpcopyup' and 'notmpcopyup' mnt.Options more than once: %w", errOptionArg)
 			}
 			setTmpcopyup = true
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "tmpfs-mode":
 			if mountType != define.TypeTmpfs {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			mnt.Options = append(mnt.Options, fmt.Sprintf("mode=%s", value))
+			mnt.Options = append(mnt.Options, fmt.Sprintf("mode=%s", kv[1]))
 		case "tmpfs-size":
 			if mountType != define.TypeTmpfs {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			mnt.Options = append(mnt.Options, fmt.Sprintf("size=%s", value))
+			mnt.Options = append(mnt.Options, fmt.Sprintf("size=%s", kv[1]))
 		case "U", "chown":
 			if setOwnership {
 				return nil, fmt.Errorf("cannot pass 'U' or 'chown' option more than once: %w", errOptionArg)
 			}
-			ok, err := validChownFlag(value)
+			ok, err := validChownFlag(val)
 			if err != nil {
 				return nil, err
 			}
@@ -420,16 +421,16 @@ func parseMountOptions(mountType string, args []string) (*spec.Mount, error) {
 			setOwnership = true
 		case "volume-label":
 			if mountType != define.TypeVolume {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
 			return nil, fmt.Errorf("the --volume-label option is not presently implemented")
 		case "volume-opt":
 			if mountType != define.TypeVolume {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
-			mnt.Options = append(mnt.Options, arg)
+			mnt.Options = append(mnt.Options, val)
 		default:
-			return nil, fmt.Errorf("%s: %w", name, util.ErrBadMntOption)
+			return nil, fmt.Errorf("%s: %w", kv[0], util.ErrBadMntOption)
 		}
 	}
 	if mountType != "glob" && len(mnt.Destination) == 0 {
@@ -533,22 +534,22 @@ func getDevptsMount(args []string) (spec.Mount, error) {
 
 	var setDest bool
 
-	for _, arg := range args {
-		name, value, hasValue := strings.Cut(arg, "=")
-		switch name {
+	for _, val := range args {
+		kv := strings.SplitN(val, "=", 2)
+		switch kv[0] {
 		case "uid", "gid", "mode", "ptxmode", "newinstance", "max":
-			newMount.Options = append(newMount.Options, arg)
+			newMount.Options = append(newMount.Options, val)
 		case "target", "dst", "destination":
-			if !hasValue {
-				return newMount, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return newMount, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			if err := parse.ValidateVolumeCtrDir(value); err != nil {
+			if err := parse.ValidateVolumeCtrDir(kv[1]); err != nil {
 				return newMount, err
 			}
-			newMount.Destination = unixPathClean(value)
+			newMount.Destination = unixPathClean(kv[1])
 			setDest = true
 		default:
-			return newMount, fmt.Errorf("%s: %w", name, util.ErrBadMntOption)
+			return newMount, fmt.Errorf("%s: %w", kv[0], util.ErrBadMntOption)
 		}
 	}
 
@@ -585,37 +586,37 @@ func getNamedVolume(args []string) (*specgen.NamedVolume, error) {
 func getImageVolume(args []string) (*specgen.ImageVolume, error) {
 	newVolume := new(specgen.ImageVolume)
 
-	for _, arg := range args {
-		name, value, hasValue := strings.Cut(arg, "=")
-		switch name {
+	for _, val := range args {
+		kv := strings.SplitN(val, "=", 2)
+		switch kv[0] {
 		case "src", "source":
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			newVolume.Source = value
+			newVolume.Source = kv[1]
 		case "target", "dst", "destination":
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			if err := parse.ValidateVolumeCtrDir(value); err != nil {
+			if err := parse.ValidateVolumeCtrDir(kv[1]); err != nil {
 				return nil, err
 			}
-			newVolume.Destination = unixPathClean(value)
+			newVolume.Destination = unixPathClean(kv[1])
 		case "rw", "readwrite":
-			switch value {
+			switch kv[1] {
 			case "true":
 				newVolume.ReadWrite = true
 			case "false":
 				// Nothing to do. RO is default.
 			default:
-				return nil, fmt.Errorf("invalid rw value %q: %w", value, util.ErrBadMntOption)
+				return nil, fmt.Errorf("invalid rw value %q: %w", kv[1], util.ErrBadMntOption)
 			}
 		case "consistency":
 			// Often used on MACs and mistakenly on Linux platforms.
 			// Since Docker ignores this option so shall we.
 			continue
 		default:
-			return nil, fmt.Errorf("%s: %w", name, util.ErrBadMntOption)
+			return nil, fmt.Errorf("%s: %w", kv[0], util.ErrBadMntOption)
 		}
 	}
 
@@ -659,16 +660,24 @@ func getTmpfsMounts(tmpfsFlag []string) (map[string]spec.Mount, error) {
 }
 
 // validChownFlag ensures that the U or chown flag is correctly used
-func validChownFlag(value string) (bool, error) {
-	// U=[true|false]
-	switch {
-	case strings.EqualFold(value, "true"), value == "":
-		return true, nil
-	case strings.EqualFold(value, "false"):
-		return false, nil
+func validChownFlag(flag string) (bool, error) {
+	kv := strings.SplitN(flag, "=", 2)
+	switch len(kv) {
+	case 1:
+	case 2:
+		// U=[true|false]
+		switch strings.ToLower(kv[1]) {
+		case "true":
+		case "false":
+			return false, nil
+		default:
+			return false, fmt.Errorf("'U' or 'chown' must be set to true or false, instead received %q: %w", kv[1], errOptionArg)
+		}
 	default:
-		return false, fmt.Errorf("'U' or 'chown' must be set to true or false, instead received %q: %w", value, errOptionArg)
+		return false, fmt.Errorf("badly formatted option %q: %w", flag, errOptionArg)
 	}
+
+	return true, nil
 }
 
 // Use path instead of filepath to preserve Unix style paths on Windows
diff --git a/pkg/systemd/generate/containers.go b/pkg/systemd/generate/containers.go
index e7bb77d6db..821c993df4 100644
--- a/pkg/systemd/generate/containers.go
+++ b/pkg/systemd/generate/containers.go
@@ -471,8 +471,8 @@ func executeContainerTemplate(info *containerInfo, options entities.GenerateSyst
 			// because it does try to red the value from the environment
 			if !strings.Contains(env, "=") {
 				for _, containerEnv := range info.containerEnv {
-					key, _, _ := strings.Cut(containerEnv, "=")
-					if key == env {
+					split := strings.SplitN(containerEnv, "=", 2)
+					if split[0] == env {
 						info.ExtraEnvs = append(info.ExtraEnvs, escapeSystemdArg(containerEnv))
 					}
 				}
diff --git a/pkg/systemd/quadlet/quadlet.go b/pkg/systemd/quadlet/quadlet.go
index e18857aa7d..a7845cade9 100644
--- a/pkg/systemd/quadlet/quadlet.go
+++ b/pkg/systemd/quadlet/quadlet.go
@@ -1118,10 +1118,10 @@ func ConvertKube(kube *parser.UnitFile, names map[string]string, isUser bool) (*
 	for _, update := range updateMaps {
 		annotation := fmt.Sprintf("--annotation=%s", autoUpdateLabel)
 		updateType := update
-		annoValue, typ, hasSlash := strings.Cut(update, "/")
-		if hasSlash {
-			annotation = annotation + "/" + annoValue
-			updateType = typ
+		val := strings.SplitN(update, "/", 2)
+		if len(val) == 2 {
+			annotation = annotation + "/" + val[0]
+			updateType = val[1]
 		}
 		execStart.addf("%s=%s", annotation, updateType)
 	}
@@ -1741,13 +1741,13 @@ func resolveContainerMountParams(containerUnitFile, serviceUnitFile *parser.Unit
 	sourceIndex := -1
 	originalSource := ""
 	for i, token := range tokens {
-		key, val, hasVal := strings.Cut(token, "=")
-		if key == "source" || key == "src" {
-			if !hasVal {
+		kv := strings.SplitN(token, "=", 2)
+		if kv[0] == "source" || kv[0] == "src" {
+			if len(kv) < 2 {
 				return "", fmt.Errorf("source parameter does not include a value")
 			}
 			sourceIndex = i
-			originalSource = val
+			originalSource = kv[1]
 		}
 	}
 
diff --git a/pkg/timetype/timestamp.go b/pkg/timetype/timestamp.go
index 3c70ac971f..4defa32ea6 100644
--- a/pkg/timetype/timestamp.go
+++ b/pkg/timetype/timestamp.go
@@ -116,19 +116,19 @@ func ParseTimestamps(value string, def int64) (int64, int64, error) {
 }
 
 func parseTimestamp(value string) (int64, int64, error) {
-	spart, npart, hasParts := strings.Cut(value, ".")
-	s, err := strconv.ParseInt(spart, 10, 64)
+	sa := strings.SplitN(value, ".", 2)
+	s, err := strconv.ParseInt(sa[0], 10, 64)
 	if err != nil {
 		return s, 0, err
 	}
-	if !hasParts {
+	if len(sa) != 2 {
 		return s, 0, nil
 	}
-	n, err := strconv.ParseInt(npart, 10, 64)
+	n, err := strconv.ParseInt(sa[1], 10, 64)
 	if err != nil {
 		return s, n, err
 	}
 	// should already be in nanoseconds but just in case convert n to nanoseconds
-	n = int64(float64(n) * math.Pow(float64(10), float64(9-len(npart))))
+	n = int64(float64(n) * math.Pow(float64(10), float64(9-len(sa[1]))))
 	return s, n, nil
 }
diff --git a/pkg/trust/policy.go b/pkg/trust/policy.go
index 1424ffe91e..b5d8e7a41c 100644
--- a/pkg/trust/policy.go
+++ b/pkg/trust/policy.go
@@ -131,11 +131,8 @@ func parseUids(colonDelimitKeys []byte) []string {
 				continue
 			}
 			parseduid := uid
-			if ltidx := strings.Index(uid, "<"); ltidx != -1 {
-				subuid := parseduid[ltidx+1:]
-				if gtidx := strings.Index(subuid, ">"); gtidx != -1 {
-					parseduid = subuid[:gtidx]
-				}
+			if strings.Contains(uid, "<") && strings.Contains(uid, ">") {
+				parseduid = strings.SplitN(strings.SplitAfterN(uid, "<", 2)[1], ">", 2)[0]
 			}
 			parseduids = append(parseduids, parseduid)
 		}
diff --git a/pkg/util/filters.go b/pkg/util/filters.go
index d1e33b1081..765b5c4db0 100644
--- a/pkg/util/filters.go
+++ b/pkg/util/filters.go
@@ -65,9 +65,9 @@ func PrepareFilters(r *http.Request) (*map[string][]string, error) {
 	}
 	filterMap := map[string][]string{}
 	for _, filter := range filtersList {
-		fname, filter, hasFilter := strings.Cut(filter, "=")
-		if hasFilter {
-			filterMap[fname] = append(filterMap[fname], filter)
+		split := strings.SplitN(filter, "=", 2)
+		if len(split) > 1 {
+			filterMap[split[0]] = append(filterMap[split[0]], split[1])
 		}
 	}
 	return &filterMap, nil
diff --git a/pkg/util/mountOpts.go b/pkg/util/mountOpts.go
index 2b515aa5df..a35ac77f77 100644
--- a/pkg/util/mountOpts.go
+++ b/pkg/util/mountOpts.go
@@ -34,7 +34,7 @@ func ProcessOptions(options []string, isTmpfs bool, sourcePath string) ([]string
 	newOptions := make([]string, 0, len(options))
 	for _, opt := range options {
 		// Some options have parameters - size, mode
-		key, _, _ := strings.Cut(opt, "=")
+		splitOpt := strings.SplitN(opt, "=", 2)
 
 		// add advanced options such as upperdir=/path and workdir=/path, when overlay is specified
 		if foundOverlay {
@@ -47,11 +47,11 @@ func ProcessOptions(options []string, isTmpfs bool, sourcePath string) ([]string
 				continue
 			}
 		}
-		if strings.HasPrefix(key, "subpath") {
+		if strings.HasPrefix(splitOpt[0], "subpath") {
 			newOptions = append(newOptions, opt)
 			continue
 		}
-		if strings.HasPrefix(key, "idmap") {
+		if strings.HasPrefix(splitOpt[0], "idmap") {
 			if foundIdmap {
 				return nil, fmt.Errorf("the 'idmap' option can only be set once: %w", ErrDupeMntOption)
 			}
@@ -60,7 +60,7 @@ func ProcessOptions(options []string, isTmpfs bool, sourcePath string) ([]string
 			continue
 		}
 
-		switch key {
+		switch splitOpt[0] {
 		case "copy", "nocopy":
 			if foundCopy {
 				return nil, fmt.Errorf("only one of 'nocopy' and 'copy' can be used: %w", ErrDupeMntOption)
@@ -210,13 +210,13 @@ func ProcessOptions(options []string, isTmpfs bool, sourcePath string) ([]string
 }
 
 func ParseDriverOpts(option string) (string, string, error) {
-	_, val, hasVal := strings.Cut(option, "=")
-	if !hasVal {
+	token := strings.SplitN(option, "=", 2)
+	if len(token) != 2 {
 		return "", "", fmt.Errorf("cannot parse driver opts: %w", ErrBadMntOption)
 	}
-	optKey, optVal, hasOptVal := strings.Cut(val, "=")
-	if !hasOptVal {
+	opt := strings.SplitN(token[1], "=", 2)
+	if len(opt) != 2 {
 		return "", "", fmt.Errorf("cannot parse driver opts: %w", ErrBadMntOption)
 	}
-	return optKey, optVal, nil
+	return opt[0], opt[1], nil
 }
diff --git a/pkg/util/utils.go b/pkg/util/utils.go
index 0eefd60559..f9faf07fd1 100644
--- a/pkg/util/utils.go
+++ b/pkg/util/utils.go
@@ -55,8 +55,14 @@ func init() {
 // Helper function to determine the username/password passed
 // in the creds string.  It could be either or both.
 func parseCreds(creds string) (string, string) {
-	username, password, _ := strings.Cut(creds, ":")
-	return username, password
+	if creds == "" {
+		return "", ""
+	}
+	up := strings.SplitN(creds, ":", 2)
+	if len(up) == 1 {
+		return up[0], ""
+	}
+	return up[0], up[1]
 }
 
 // Takes build context and validates `.containerignore` or `.dockerignore`
@@ -912,12 +918,12 @@ func parseAutoIDMap(mapSpec string, mapSetting string, parentMapping []ruser.IDM
 // GetAutoOptions returns an AutoUserNsOptions with the settings to automatically set up
 // a user namespace.
 func GetAutoOptions(n namespaces.UsernsMode) (*stypes.AutoUserNsOptions, error) {
-	mode, opts, hasOpts := strings.Cut(string(n), ":")
-	if mode != "auto" {
+	parts := strings.SplitN(string(n), ":", 2)
+	if parts[0] != "auto" {
 		return nil, fmt.Errorf("wrong user namespace mode")
 	}
 	options := stypes.AutoUserNsOptions{}
-	if !hasOpts {
+	if len(parts) == 1 {
 		return &options, nil
 	}
 
@@ -931,32 +937,32 @@ func GetAutoOptions(n namespaces.UsernsMode) (*stypes.AutoUserNsOptions, error)
 		}
 	}
 
-	for _, o := range strings.Split(opts, ",") {
-		key, val, hasVal := strings.Cut(o, "=")
-		if !hasVal {
+	for _, o := range strings.Split(parts[1], ",") {
+		v := strings.SplitN(o, "=", 2)
+		if len(v) != 2 {
 			return nil, fmt.Errorf("invalid option specified: %q", o)
 		}
-		switch key {
+		switch v[0] {
 		case "size":
-			s, err := strconv.ParseUint(val, 10, 32)
+			s, err := strconv.ParseUint(v[1], 10, 32)
 			if err != nil {
 				return nil, err
 			}
 			options.Size = uint32(s)
 		case "uidmapping":
-			mapping, err := parseAutoIDMap(val, "UID", parentUIDMap)
+			mapping, err := parseAutoIDMap(v[1], "UID", parentUIDMap)
 			if err != nil {
 				return nil, err
 			}
 			options.AdditionalUIDMappings = append(options.AdditionalUIDMappings, mapping...)
 		case "gidmapping":
-			mapping, err := parseAutoIDMap(val, "GID", parentGIDMap)
+			mapping, err := parseAutoIDMap(v[1], "GID", parentGIDMap)
 			if err != nil {
 				return nil, err
 			}
 			options.AdditionalGIDMappings = append(options.AdditionalGIDMappings, mapping...)
 		default:
-			return nil, fmt.Errorf("unknown option specified: %q", key)
+			return nil, fmt.Errorf("unknown option specified: %q", v[0])
 		}
 	}
 	return &options, nil
@@ -1071,9 +1077,9 @@ func getTomlStorage(storeOptions *stypes.StoreOptions) *tomlConfig {
 	config.Storage.RunRoot = storeOptions.RunRoot
 	config.Storage.GraphRoot = storeOptions.GraphRoot
 	for _, i := range storeOptions.GraphDriverOptions {
-		program, hasPrefix := strings.CutPrefix(i, "overlay.mount_program=")
-		if hasPrefix {
-			config.Storage.Options.MountProgram = program
+		s := strings.SplitN(i, "=", 2)
+		if s[0] == "overlay.mount_program" && len(s) == 2 {
+			config.Storage.Options.MountProgram = s[1]
 		}
 	}
 


Test patch:
diff --git a/pkg/machine/e2e/config_inspect_test.go b/pkg/machine/e2e/config_inspect_test.go
index f0d4aa5bdd..ffd74220f1 100644
--- a/pkg/machine/e2e/config_inspect_test.go
+++ b/pkg/machine/e2e/config_inspect_test.go
@@ -13,7 +13,7 @@ func (i *inspectMachine) buildCmd(m *machineTestBuilder) []string {
 	if len(i.format) > 0 {
 		cmd = append(cmd, "--format", i.format)
 	}
-	cmd = append(cmd, m.name)
+	cmd = append(cmd, m.names...)
 	i.cmd = cmd
 	return cmd
 }
diff --git a/pkg/machine/e2e/config_test.go b/pkg/machine/e2e/config_test.go
index 9692bccc01..354b3be742 100644
--- a/pkg/machine/e2e/config_test.go
+++ b/pkg/machine/e2e/config_test.go
@@ -132,7 +132,7 @@ func (m *machineTestBuilder) setCmd(mc machineCommand) *machineTestBuilder {
 	return m
 }
 
-func (m *machineTestBuilder) setTimeout(timeout time.Duration) *machineTestBuilder { //nolint: unparam
+func (m *machineTestBuilder) setTimeout(timeout time.Duration) *machineTestBuilder {
 	m.timeout = timeout
 	return m
 }
diff --git a/pkg/machine/e2e/start_test.go b/pkg/machine/e2e/start_test.go
index 8c77bde6bc..d1001a45d2 100644
--- a/pkg/machine/e2e/start_test.go
+++ b/pkg/machine/e2e/start_test.go
@@ -1,8 +1,6 @@
 package e2e_test
 
 import (
-	"time"
-
 	"github.com/containers/podman/v4/pkg/machine/define"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -86,36 +84,4 @@ var _ = Describe("podman machine start", func() {
 		Expect(startSession).To(Exit(125))
 		Expect(startSession.errorToString()).To(ContainSubstring("VM already running or starting"))
 	})
-	It("start only starts specified machine", func() {
-		i := initMachine{}
-		startme := randomString()
-		session, err := mb.setName(startme).setCmd(i.withImagePath(mb.imagePath)).run()
-		Expect(err).ToNot(HaveOccurred())
-		Expect(session).To(Exit(0))
-
-		j := initMachine{}
-		dontstartme := randomString()
-		session2, err := mb.setName(dontstartme).setCmd(j.withImagePath(mb.imagePath)).run()
-		Expect(err).ToNot(HaveOccurred())
-		Expect(session2).To(Exit(0))
-
-		s := startMachine{}
-		session3, err := mb.setName(startme).setCmd(s).setTimeout(time.Minute * 10).run()
-		Expect(err).ToNot(HaveOccurred())
-		Expect(session3).Should(Exit(0))
-
-		inspect := new(inspectMachine)
-		inspect = inspect.withFormat("{{.State}}")
-		inspectSession, err := mb.setName(startme).setCmd(inspect).run()
-		Expect(err).ToNot(HaveOccurred())
-		Expect(inspectSession).To(Exit(0))
-		Expect(inspectSession.outputToString()).To(Equal(define.Running))
-
-		inspect2 := new(inspectMachine)
-		inspect2 = inspect2.withFormat("{{.State}}")
-		inspectSession2, err := mb.setName(dontstartme).setCmd(inspect2).run()
-		Expect(err).ToNot(HaveOccurred())
-		Expect(inspectSession2).To(Exit(0))
-		Expect(inspectSession2.outputToString()).To(Not(Equal(define.Running)))
-	})
 })
diff --git a/pkg/machine/qemu/command/command_test.go b/pkg/machine/qemu/command/command_test.go
index c56d9341f5..e2307f3693 100644
--- a/pkg/machine/qemu/command/command_test.go
+++ b/pkg/machine/qemu/command/command_test.go
@@ -75,8 +75,8 @@ func TestPropagateHostEnv(t *testing.T) {
 	// envs looks like: {"BAR": "bar", "FOO": "foo"}
 	envs := make(map[string]string)
 	for _, env := range envsRawArr {
-		key, value, _ := strings.Cut(env, "=")
-		envs[key] = strings.Trim(value, "\"")
+		item := strings.SplitN(env, "=", 2)
+		envs[item[0]] = strings.Trim(item[1], "\"")
 	}
 
 	for key, test := range tests {
diff --git a/pkg/specgenutil/volumes_test.go b/pkg/specgenutil/volumes_test.go
index 18009a8e99..712d9fd455 100644
--- a/pkg/specgenutil/volumes_test.go
+++ b/pkg/specgenutil/volumes_test.go
@@ -13,41 +13,41 @@ func Test_validChownFlag(t *testing.T) {
 		wantErr bool
 	}{
 		{
-			name: "lower-case true",
+			name: "U true",
 			args: args{
-				flag: "true",
+				flag: "U=true",
 			},
 			want:    true,
 			wantErr: false,
 		},
 		{
-			name: "case-insensitive true",
+			name: "U true case does not matter",
 			args: args{
-				flag: "True",
+				flag: "u=True",
 			},
 			want:    true,
 			wantErr: false,
 		},
 		{
-			name: "lower-case false",
+			name: "U is false",
 			args: args{
-				flag: "false",
+				flag: "U=false",
 			},
 			want:    false,
 			wantErr: false,
 		},
 		{
-			name: "case-insensitive false",
+			name: "chown should also work",
 			args: args{
-				flag: "falsE",
+				flag: "chown=true",
 			},
-			want:    false,
+			want:    true,
 			wantErr: false,
 		},
 		{
 			name: "garbage value should fail",
 			args: args{
-				flag: "foobar",
+				flag: "U=foobar",
 			},
 			want:    false,
 			wantErr: true,
diff --git a/test/e2e/common_test.go b/test/e2e/common_test.go
index d04e7e38c8..f3f02da3d8 100644
--- a/test/e2e/common_test.go
+++ b/test/e2e/common_test.go
@@ -209,11 +209,12 @@ var _ = SynchronizedAfterSuite(func() {
 			scanner := bufio.NewScanner(f)
 			for scanner.Scan() {
 				text := scanner.Text()
-				name, durationString, ok := strings.Cut(text, "\t\t")
-				if !ok {
+				timing := strings.SplitN(text, "\t\t", 2)
+				if len(timing) != 2 {
 					Fail(fmt.Sprintf("incorrect timing line: %q", text))
 				}
-				duration, err := strconv.ParseFloat(durationString, 64)
+				name := timing[0]
+				duration, err := strconv.ParseFloat(timing[1], 64)
 				Expect(err).ToNot(HaveOccurred(), "failed to parse float from timings file")
 				testTimings = append(testTimings, testResult{name: name, length: duration})
 			}
diff --git a/test/e2e/quadlet_test.go b/test/e2e/quadlet_test.go
index ef0057da25..8fac352f2b 100644
--- a/test/e2e/quadlet_test.go
+++ b/test/e2e/quadlet_test.go
@@ -202,8 +202,12 @@ func keyValueStringToMap(keyValueString, separator string) (map[string]string, e
 		return nil, err
 	}
 	for _, param := range keyVarList[0] {
-		key, val, _ := strings.Cut(param, "=")
-		keyValMap[key] = val
+		val := ""
+		kv := strings.SplitN(param, "=", 2)
+		if len(kv) == 2 {
+			val = kv[1]
+		}
+		keyValMap[kv[0]] = val
 	}
 
 	return keyValMap, nil
diff --git a/test/e2e/system_reset_test.go b/test/e2e/system_reset_test.go
index 76fa544b63..fd9b82d036 100644
--- a/test/e2e/system_reset_test.go
+++ b/test/e2e/system_reset_test.go
@@ -1,6 +1,8 @@
 package integration
 
 import (
+	"fmt"
+
 	. "github.com/containers/podman/v4/test/utils"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -74,4 +76,32 @@ var _ = Describe("podman system reset", Serial, func() {
 			Expect(session.OutputToStringArray()).To(BeEmpty())
 		}
 	})
+
+	It("system reset completely removes container", func() {
+		SkipIfRemote("system reset not supported on podman --remote")
+		useCustomNetworkDir(podmanTest, tempdir)
+
+		rmi := podmanTest.Podman([]string{"rmi", "--force", "--all"})
+		rmi.WaitWithDefaultTimeout()
+		Expect(rmi).Should(ExitCleanly())
+		podmanTest.AddImageToRWStore(ALPINE)
+
+		// The name ensures that we have a Libpod resource that we'll
+		// hit if we recreate the container after a reset and it still
+		// exists. The port does the same for a system-level resource.
+		ctrName := "testctr"
+		port1 := GetPort()
+		port2 := GetPort()
+		session := podmanTest.Podman([]string{"run", "--name", ctrName, "-p", fmt.Sprintf("%d:%d", port1, port2), "-d", ALPINE, "top"})
+		session.WaitWithDefaultTimeout()
+		Expect(session).Should(ExitCleanly())
+
+		reset := podmanTest.Podman([]string{"system", "reset", "--force"})
+		reset.WaitWithDefaultTimeout()
+		Expect(reset).Should(ExitCleanly())
+
+		session2 := podmanTest.Podman([]string{"run", "--name", ctrName, "-p", fmt.Sprintf("%d:%d", port1, port2), "-d", ALPINE, "top"})
+		session2.WaitWithDefaultTimeout()
+		Expect(session2).Should(ExitCleanly())
+	})
 })
diff --git a/test/system/030-run.bats b/test/system/030-run.bats
index 057b1d646c..ad5e16ac24 100644
--- a/test/system/030-run.bats
+++ b/test/system/030-run.bats
@@ -1251,11 +1251,6 @@ EOF
     run_podman run --uidmap=0:1000:10000 --rm --rootfs "$romount:idmap=uids=0-1001-10000;gids=0-1002-10000" stat -c %u:%g /bin
     is "$output" "1:2"
 
-    touch $romount/testfile
-    chown 2000:2000 $romount/testfile
-    run_podman run --uidmap=0:1000:2 --rm --rootfs "$romount:idmap=uids=@2000-1-1;gids=@2000-1-1" stat -c %u:%g /testfile
-    is "$output" "1:1"
-
     rm -rf $romount
 }