Repository: containers/podman
Pull request #21161 (2024-01-04 16:14:33)

machine: Enable console autologin by default
There are no security concerns here; this is a convenience for people debugging things.  Some podman-machine developers were manually setting a password over SSH for example, but this is just better than that.

[NO NEW TESTS NEEDED]

(Also marking no release note as we don't expose a console by default, only when launched with --debug right now)
```release-note
None
```



openshift-ci[bot]: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/containers/podman/pull/21161#" title="Author self-approved">cgwalters</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign [n1hility](https://github.com/n1hility) for approval. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=containers%2Fpodman).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/containers/podman/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["n1hility"]} -->
openshift-ci[bot]: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/containers/podman/pull/21161#" title="Author self-approved">cgwalters</a>*, *<a href="https://github.com/containers/podman/pull/21161#pullrequestreview-1805772499" title="Approved">Luap99</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=containers%2Fpodman).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/containers/podman/blob/main/OWNERS)~~ [Luap99]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
rhatdan: Needs a rebase.
cgwalters: Rebased.
It looks like the machine-(hyperv|mac) CI checks are broken generally?

cgwalters: OK rebased 🏄 - let's see what happens with the hyper CI run on this.  I don't know what we do for a console on hyper actually, I'd expect this to be a no-op but perhaps it is somehow breaking something.
Luap99: ```
  > Enter [It] simple init with username - C:/Users/Administrator/AppData/Local/cirrus-ci-build/repo/pkg/machine/e2e/init_test.go:124 @ 01/09/24 00:47:44.738
  C:\Users\Administrator\AppData\Local\cirrus-ci-build\repo\bin\windows\podman.exe machine init --disk-size 11 --username remoteuser --image-path C:\Users\ADMINI~1\AppData\Local\Temp\podman_test872248153\fedora-coreos-39.20240104.2.0-hyperv.x86_64.vhdx e2d282390af6
  Error: EOF
  [FAILED] Expected
      <int>: 125
  to match exit code:
      <int>: 0
  In [It] at: C:/Users/Administrator/AppData/Local/cirrus-ci-build/repo/pkg/machine/e2e/init_test.go:129 @ 01/09/24 00:48:15.905
```

Just a guess but you seem to hardcode the username and this test uses a different one so that might cause the failure? So I think agetty fails because you call it on a non existing user. That does however not explain why only hyperV fails but not qemu.
cgwalters: > Just a guess but you seem to hardcode the username and this test uses a different one so that might cause the failure? 

Thanks yep, that appears to be right.  @baude and I agreed for this use case it's simplest to just hardcode autologin to root (this is always a recovery scenario today anyways so might as well be root).

cgwalters: btw @Luap99 thanks for all the reviews and work you do!

Patch:
diff --git a/.cirrus.yml b/.cirrus.yml
index 678e6febe3..89ec58e6d3 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -454,7 +454,6 @@ osx_alt_build_task:
         labels:
             os: darwin
             arch: arm64
-            purpose: prod
     env: &mac_env
         CIRRUS_SHELL: "/bin/bash"  # sh is the default
         CIRRUS_WORKING_DIR: "$HOME/ci/task-${CIRRUS_TASK_ID}"  # Isolation: $HOME will be set to "ci" dir.
diff --git a/.github/labeler.yml b/.github/labeler.yml
index ce5a69b115..321eeb97b6 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -3,6 +3,6 @@
 kind/api-change:
   - changed-files:
     - any-glob-to-any-file: pkg/api/**
-machine:
+area/machine:
   - changed-files:
     - any-glob-to-any-file: pkg/machine/**
diff --git a/cmd/podman/common/build.go b/cmd/podman/common/build.go
index 95bad7320d..5e60d7f0f3 100644
--- a/cmd/podman/common/build.go
+++ b/cmd/podman/common/build.go
@@ -333,15 +333,15 @@ func buildFlagsWrapperToOptions(c *cobra.Command, contextDir string, flags *Buil
 	}
 	if c.Flag("build-arg").Changed {
 		for _, arg := range flags.BuildArg {
-			key, val, hasVal := strings.Cut(arg, "=")
-			if hasVal {
-				args[key] = val
+			av := strings.SplitN(arg, "=", 2)
+			if len(av) > 1 {
+				args[av[0]] = av[1]
 			} else {
 				// check if the env is set in the local environment and use that value if it is
-				if val, present := os.LookupEnv(key); present {
-					args[key] = val
+				if val, present := os.LookupEnv(av[0]); present {
+					args[av[0]] = val
 				} else {
-					delete(args, key)
+					delete(args, av[0])
 				}
 			}
 		}
@@ -450,15 +450,15 @@ func buildFlagsWrapperToOptions(c *cobra.Command, contextDir string, flags *Buil
 	additionalBuildContext := make(map[string]*buildahDefine.AdditionalBuildContext)
 	if c.Flag("build-context").Changed {
 		for _, contextString := range flags.BuildContext {
-			key, val, hasVal := strings.Cut(contextString, "=")
-			if hasVal {
-				parseAdditionalBuildContext, err := parse.GetAdditionalBuildContext(val)
+			av := strings.SplitN(contextString, "=", 2)
+			if len(av) > 1 {
+				parseAdditionalBuildContext, err := parse.GetAdditionalBuildContext(av[1])
 				if err != nil {
 					return nil, fmt.Errorf("while parsing additional build context: %w", err)
 				}
-				additionalBuildContext[key] = &parseAdditionalBuildContext
+				additionalBuildContext[av[0]] = &parseAdditionalBuildContext
 			} else {
-				return nil, fmt.Errorf("while parsing additional build context: %s, accepts value in the form of key=value", contextString)
+				return nil, fmt.Errorf("while parsing additional build context: %q, accepts value in the form of key=value", av)
 			}
 		}
 	}
diff --git a/cmd/podman/common/completion.go b/cmd/podman/common/completion.go
index 40804f5a9f..75825f1ea1 100644
--- a/cmd/podman/common/completion.go
+++ b/cmd/podman/common/completion.go
@@ -423,9 +423,9 @@ func prefixSlice(pre string, slice []string) []string {
 
 func suffixCompSlice(suf string, slice []string) []string {
 	for i := range slice {
-		key, val, hasVal := strings.Cut(slice[i], "\t")
-		if hasVal {
-			slice[i] = key + suf + "\t" + val
+		split := strings.SplitN(slice[i], "\t", 2)
+		if len(split) > 1 {
+			slice[i] = split[0] + suf + "\t" + split[1]
 		} else {
 			slice[i] += suf
 		}
@@ -878,10 +878,10 @@ func AutocompleteScp(cmd *cobra.Command, args []string, toComplete string) ([]st
 	}
 	switch len(args) {
 	case 0:
-		prefix, imagesToComplete, isImages := strings.Cut(toComplete, "::")
-		if isImages {
-			imageSuggestions, _ := getImages(cmd, imagesToComplete)
-			return prefixSlice(prefix+"::", imageSuggestions), cobra.ShellCompDirectiveNoFileComp
+		split := strings.SplitN(toComplete, "::", 2)
+		if len(split) > 1 {
+			imageSuggestions, _ := getImages(cmd, split[1])
+			return prefixSlice(split[0]+"::", imageSuggestions), cobra.ShellCompDirectiveNoFileComp
 		}
 		connectionSuggestions, _ := AutocompleteSystemConnections(cmd, args, toComplete)
 		imageSuggestions, _ := getImages(cmd, toComplete)
@@ -893,9 +893,9 @@ func AutocompleteScp(cmd *cobra.Command, args []string, toComplete string) ([]st
 		}
 		return totalSuggestions, directive
 	case 1:
-		_, imagesToComplete, isImages := strings.Cut(args[0], "::")
-		if isImages {
-			if len(imagesToComplete) > 0 {
+		split := strings.SplitN(args[0], "::", 2)
+		if len(split) > 1 {
+			if len(split[1]) > 0 {
 				return nil, cobra.ShellCompDirectiveNoFileComp
 			}
 			imageSuggestions, _ := getImages(cmd, toComplete)
@@ -1076,7 +1076,7 @@ func AutocompleteUserFlag(cmd *cobra.Command, args []string, toComplete string)
 
 		var groups []string
 		scanner := bufio.NewScanner(file)
-		user, _, _ := strings.Cut(toComplete, ":")
+		user := strings.SplitN(toComplete, ":", 2)[0]
 		for scanner.Scan() {
 			entries := strings.SplitN(scanner.Text(), ":", 4)
 			groups = append(groups, user+":"+entries[0])
diff --git a/cmd/podman/containers/create.go b/cmd/podman/containers/create.go
index 8fe845d449..b48b096878 100644
--- a/cmd/podman/containers/create.go
+++ b/cmd/podman/containers/create.go
@@ -342,10 +342,10 @@ func PullImage(imageName string, cliVals *entities.ContainerCreateOptions) (stri
 			if cliVals.Arch != "" || cliVals.OS != "" {
 				return "", errors.New("--platform option can not be specified with --arch or --os")
 			}
-			OS, Arch, hasArch := strings.Cut(cliVals.Platform, "/")
-			cliVals.OS = OS
-			if hasArch {
-				cliVals.Arch = Arch
+			split := strings.SplitN(cliVals.Platform, "/", 2)
+			cliVals.OS = split[0]
+			if len(split) > 1 {
+				cliVals.Arch = split[1]
 			}
 		}
 	}
diff --git a/cmd/podman/containers/pause.go b/cmd/podman/containers/pause.go
index 402faaa26c..4b0ae5fe36 100644
--- a/cmd/podman/containers/pause.go
+++ b/cmd/podman/containers/pause.go
@@ -102,11 +102,11 @@ func pause(cmd *cobra.Command, args []string) error {
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		pauseOpts.Filters[fname] = append(pauseOpts.Filters[fname], filter)
+		pauseOpts.Filters[split[0]] = append(pauseOpts.Filters[split[0]], split[1])
 	}
 
 	responses, err := registry.ContainerEngine().ContainerPause(context.Background(), args, pauseOpts)
diff --git a/cmd/podman/containers/ps.go b/cmd/podman/containers/ps.go
index 4848cd6955..0c21a30ae8 100644
--- a/cmd/podman/containers/ps.go
+++ b/cmd/podman/containers/ps.go
@@ -195,11 +195,11 @@ func ps(cmd *cobra.Command, _ []string) error {
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) == 1 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		listOpts.Filters[fname] = append(listOpts.Filters[fname], filter)
+		listOpts.Filters[split[0]] = append(listOpts.Filters[split[0]], split[1])
 	}
 	listContainers, err := getResponses()
 	if err != nil {
diff --git a/cmd/podman/containers/restart.go b/cmd/podman/containers/restart.go
index 06da8a0a2a..e5e7b0add7 100644
--- a/cmd/podman/containers/restart.go
+++ b/cmd/podman/containers/restart.go
@@ -114,11 +114,11 @@ func restart(cmd *cobra.Command, args []string) error {
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		restartOpts.Filters[fname] = append(restartOpts.Filters[fname], filter)
+		restartOpts.Filters[split[0]] = append(restartOpts.Filters[split[0]], split[1])
 	}
 
 	responses, err := registry.ContainerEngine().ContainerRestart(context.Background(), args, restartOpts)
diff --git a/cmd/podman/containers/rm.go b/cmd/podman/containers/rm.go
index 74d43da2ec..a29233cf3c 100644
--- a/cmd/podman/containers/rm.go
+++ b/cmd/podman/containers/rm.go
@@ -116,16 +116,16 @@ func rm(cmd *cobra.Command, args []string) error {
 			}
 			return fmt.Errorf("reading CIDFile: %w", err)
 		}
-		id, _, _ := strings.Cut(string(content), "\n")
+		id := strings.Split(string(content), "\n")[0]
 		args = append(args, id)
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		rmOptions.Filters[fname] = append(rmOptions.Filters[fname], filter)
+		rmOptions.Filters[split[0]] = append(rmOptions.Filters[split[0]], split[1])
 	}
 
 	if rmOptions.All {
diff --git a/cmd/podman/containers/start.go b/cmd/podman/containers/start.go
index 709e9d57b6..eba46d707a 100644
--- a/cmd/podman/containers/start.go
+++ b/cmd/podman/containers/start.go
@@ -124,11 +124,11 @@ func start(cmd *cobra.Command, args []string) error {
 
 	containers := utils.RemoveSlash(args)
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		startOptions.Filters[fname] = append(startOptions.Filters[fname], filter)
+		startOptions.Filters[split[0]] = append(startOptions.Filters[split[0]], split[1])
 	}
 
 	responses, err := registry.ContainerEngine().ContainerStart(registry.GetContext(), containers, startOptions)
diff --git a/cmd/podman/containers/stop.go b/cmd/podman/containers/stop.go
index 84822cf53e..e62ec7b675 100644
--- a/cmd/podman/containers/stop.go
+++ b/cmd/podman/containers/stop.go
@@ -119,11 +119,11 @@ func stop(cmd *cobra.Command, args []string) error {
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		stopOptions.Filters[fname] = append(stopOptions.Filters[fname], filter)
+		stopOptions.Filters[split[0]] = append(stopOptions.Filters[split[0]], split[1])
 	}
 
 	responses, err := registry.ContainerEngine().ContainerStop(context.Background(), args, stopOptions)
diff --git a/cmd/podman/containers/unpause.go b/cmd/podman/containers/unpause.go
index 7d04daa578..68ef8e1f54 100644
--- a/cmd/podman/containers/unpause.go
+++ b/cmd/podman/containers/unpause.go
@@ -110,11 +110,11 @@ func unpause(cmd *cobra.Command, args []string) error {
 	}
 
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		split := strings.SplitN(f, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid filter %q", f)
 		}
-		unpauseOpts.Filters[fname] = append(unpauseOpts.Filters[fname], filter)
+		unpauseOpts.Filters[split[0]] = append(unpauseOpts.Filters[split[0]], split[1])
 	}
 
 	responses, err := registry.ContainerEngine().ContainerUnpause(context.Background(), args, unpauseOpts)
diff --git a/cmd/podman/images/pull.go b/cmd/podman/images/pull.go
index 8399f6c9c2..2bcfd2055c 100644
--- a/cmd/podman/images/pull.go
+++ b/cmd/podman/images/pull.go
@@ -149,14 +149,10 @@ func imagePull(cmd *cobra.Command, args []string) error {
 		if pullOptions.Arch != "" || pullOptions.OS != "" {
 			return errors.New("--platform option can not be specified with --arch or --os")
 		}
-
-		specs := strings.Split(platform, "/")
-		pullOptions.OS = specs[0] // may be empty
-		if len(specs) > 1 {
-			pullOptions.Arch = specs[1]
-			if len(specs) > 2 {
-				pullOptions.Variant = specs[2]
-			}
+		split := strings.SplitN(platform, "/", 2)
+		pullOptions.OS = split[0]
+		if len(split) > 1 {
+			pullOptions.Arch = split[1]
 		}
 	}
 
diff --git a/cmd/podman/kube/play.go b/cmd/podman/kube/play.go
index 21bb45260b..8c6aa6a788 100644
--- a/cmd/podman/kube/play.go
+++ b/cmd/podman/kube/play.go
@@ -246,17 +246,18 @@ func play(cmd *cobra.Command, args []string) error {
 	}
 
 	for _, annotation := range playOptions.annotations {
-		key, val, hasVal := strings.Cut(annotation, "=")
-		if !hasVal {
+		splitN := strings.SplitN(annotation, "=", 2)
+		if len(splitN) != 2 {
 			return fmt.Errorf("annotation %q must include an '=' sign", annotation)
 		}
 		if playOptions.Annotations == nil {
 			playOptions.Annotations = make(map[string]string)
 		}
-		if len(val) > define.MaxKubeAnnotation && !playOptions.UseLongAnnotations {
-			return fmt.Errorf("annotation exceeds maximum size, %d, of kubernetes annotation: %s", define.MaxKubeAnnotation, val)
+		annotation := splitN[1]
+		if len(annotation) > define.MaxKubeAnnotation && !playOptions.UseLongAnnotations {
+			return fmt.Errorf("annotation exceeds maximum size, %d, of kubernetes annotation: %s", define.MaxKubeAnnotation, annotation)
 		}
-		playOptions.Annotations[key] = val
+		playOptions.Annotations[splitN[0]] = annotation
 	}
 
 	for _, mac := range playOptions.macs {
diff --git a/cmd/podman/machine/ssh.go b/cmd/podman/machine/ssh.go
index 9e5084630a..dd39eff0c7 100644
--- a/cmd/podman/machine/ssh.go
+++ b/cmd/podman/machine/ssh.go
@@ -57,8 +57,10 @@ func ssh(cmd *cobra.Command, args []string) error {
 	// provided the VM name.  If so, we check.  The VM name,
 	// if provided, must be in args[0].
 	if len(args) > 0 {
-		// Ignore the error, See https://github.com/containers/podman/issues/21183#issuecomment-1879713572
-		validVM, _ = provider.IsValidVMName(args[0])
+		validVM, err = provider.IsValidVMName(args[0])
+		if err != nil {
+			return err
+		}
 		if validVM {
 			vmName = args[0]
 		} else {
diff --git a/cmd/podman/networks/create.go b/cmd/podman/networks/create.go
index 2a8c641c7f..4998462602 100644
--- a/cmd/podman/networks/create.go
+++ b/cmd/podman/networks/create.go
@@ -245,16 +245,16 @@ func parseRoute(routeStr string) (*types.Route, error) {
 }
 
 func parseRange(iprange string) (*types.LeaseRange, error) {
-	startIPString, endIPString, hasDash := strings.Cut(iprange, "-")
-	if hasDash {
+	split := strings.SplitN(iprange, "-", 2)
+	if len(split) > 1 {
 		// range contains dash so assume form is start-end
-		start := net.ParseIP(startIPString)
+		start := net.ParseIP(split[0])
 		if start == nil {
-			return nil, fmt.Errorf("range start ip %q is not a ip address", startIPString)
+			return nil, fmt.Errorf("range start ip %q is not a ip address", split[0])
 		}
-		end := net.ParseIP(endIPString)
+		end := net.ParseIP(split[1])
 		if end == nil {
-			return nil, fmt.Errorf("range end ip %q is not a ip address", endIPString)
+			return nil, fmt.Errorf("range end ip %q is not a ip address", split[1])
 		}
 		return &types.LeaseRange{
 			StartIP: start,
diff --git a/cmd/podman/parse/filters.go b/cmd/podman/parse/filters.go
index af9157cde7..e4ab942afa 100644
--- a/cmd/podman/parse/filters.go
+++ b/cmd/podman/parse/filters.go
@@ -9,11 +9,11 @@ import (
 func FilterArgumentsIntoFilters(filters []string) (url.Values, error) {
 	parsedFilters := make(url.Values)
 	for _, f := range filters {
-		fname, filter, hasFilter := strings.Cut(f, "=")
-		if !hasFilter {
+		t := strings.SplitN(f, "=", 2)
+		if len(t) < 2 {
 			return parsedFilters, fmt.Errorf("filter input must be in the form of filter=value: %s is invalid", f)
 		}
-		parsedFilters.Add(fname, filter)
+		parsedFilters.Add(t[0], t[1])
 	}
 	return parsedFilters, nil
 }
diff --git a/cmd/podman/parse/net.go b/cmd/podman/parse/net.go
index 9d6ae1947c..b1331464a7 100644
--- a/cmd/podman/parse/net.go
+++ b/cmd/podman/parse/net.go
@@ -33,15 +33,15 @@ var (
 // for add-host flag
 func ValidateExtraHost(val string) (string, error) {
 	// allow for IPv6 addresses in extra hosts by only splitting on first ":"
-	name, ip, hasIP := strings.Cut(val, ":")
-	if !hasIP || len(name) == 0 {
+	arr := strings.SplitN(val, ":", 2)
+	if len(arr) != 2 || len(arr[0]) == 0 {
 		return "", fmt.Errorf("bad format for add-host: %q", val)
 	}
-	if ip == etchosts.HostGateway {
+	if arr[1] == etchosts.HostGateway {
 		return val, nil
 	}
-	if _, err := validateIPAddress(ip); err != nil {
-		return "", fmt.Errorf("invalid IP address in add-host: %q", ip)
+	if _, err := validateIPAddress(arr[1]); err != nil {
+		return "", fmt.Errorf("invalid IP address in add-host: %q", arr[1])
 	}
 	return val, nil
 }
@@ -82,37 +82,45 @@ func GetAllLabels(labelFile, inputLabels []string) (map[string]string, error) {
 		}
 	}
 	for _, label := range inputLabels {
-		key, value, _ := strings.Cut(label, "=")
-		if key == "" {
+		split := strings.SplitN(label, "=", 2)
+		if split[0] == "" {
 			return nil, fmt.Errorf("invalid label format: %q", label)
 		}
-		labels[key] = value
+		value := ""
+		if len(split) > 1 {
+			value = split[1]
+		}
+		labels[split[0]] = value
 	}
 	return labels, nil
 }
 
 func parseEnvOrLabel(env map[string]string, line, configType string) error {
-	key, val, hasVal := strings.Cut(line, "=")
+	data := strings.SplitN(line, "=", 2)
 
 	// catch invalid variables such as "=" or "=A"
-	if key == "" {
+	if data[0] == "" {
 		return fmt.Errorf("invalid environment variable: %q", line)
 	}
 
 	// trim the front of a variable, but nothing else
-	name := strings.TrimLeft(key, whiteSpaces)
+	name := strings.TrimLeft(data[0], whiteSpaces)
 	if strings.ContainsAny(name, whiteSpaces) {
 		return fmt.Errorf("name %q has white spaces, poorly formatted name", name)
 	}
 
-	if hasVal {
-		env[name] = val
+	if len(data) > 1 {
+		env[name] = data[1]
 	} else {
-		if name, hasStar := strings.CutSuffix(name, "*"); hasStar {
+		if strings.HasSuffix(name, "*") {
+			name = strings.TrimSuffix(name, "*")
 			for _, e := range os.Environ() {
-				envKey, envVal, hasEq := strings.Cut(e, "=")
-				if hasEq && strings.HasPrefix(envKey, name) {
-					env[envKey] = envVal
+				part := strings.SplitN(e, "=", 2)
+				if len(part) < 2 {
+					continue
+				}
+				if strings.HasPrefix(part[0], name) {
+					env[part[0]] = part[1]
 				}
 			}
 		} else if configType == ENVType {
diff --git a/cmd/podman/pods/ps.go b/cmd/podman/pods/ps.go
index 4efc7e9f57..45fbd86165 100644
--- a/cmd/podman/pods/ps.go
+++ b/cmd/podman/pods/ps.go
@@ -81,11 +81,11 @@ func pods(cmd *cobra.Command, _ []string) error {
 	if cmd.Flag("filter").Changed {
 		psInput.Filters = make(map[string][]string)
 		for _, f := range inputFilters {
-			fname, filter, hasFilter := strings.Cut(f, "=")
-			if !hasFilter {
+			split := strings.SplitN(f, "=", 2)
+			if len(split) < 2 {
 				return fmt.Errorf("filter input must be in the form of filter=value: %s is invalid", f)
 			}
-			psInput.Filters[fname] = append(psInput.Filters[fname], filter)
+			psInput.Filters[split[0]] = append(psInput.Filters[split[0]], split[1])
 		}
 	}
 	responses, err := registry.ContainerEngine().PodPs(context.Background(), psInput)
diff --git a/cmd/podman/root.go b/cmd/podman/root.go
index a10ede54a9..86f42d1c4b 100644
--- a/cmd/podman/root.go
+++ b/cmd/podman/root.go
@@ -400,10 +400,7 @@ func persistentPostRunE(cmd *cobra.Command, args []string) error {
 
 func configHook() {
 	if dockerConfig != "" {
-		if err := os.Setenv("DOCKER_CONFIG", dockerConfig); err != nil {
-			fmt.Fprintf(os.Stderr, "cannot set DOCKER_CONFIG=%s: %s", dockerConfig, err.Error())
-			os.Exit(1)
-		}
+		logrus.Warn("The --config flag is ignored by Podman. Exists for Docker compatibility")
 	}
 }
 
@@ -479,10 +476,8 @@ func rootFlags(cmd *cobra.Command, podmanConfig *entities.PodmanConfig) {
 	lFlags.StringVarP(&podmanConfig.URI, "host", "H", podmanConfig.URI, "Used for Docker compatibility")
 	_ = lFlags.MarkHidden("host")
 
-	configFlagName := "config"
-	lFlags.StringVar(&dockerConfig, "config", "", "Location of authentication config file")
-	_ = cmd.RegisterFlagCompletionFunc(configFlagName, completion.AutocompleteDefault)
-
+	lFlags.StringVar(&dockerConfig, "config", "", "Ignored for Docker compatibility")
+	_ = lFlags.MarkHidden("config")
 	// Context option added just for compatibility with DockerCLI.
 	lFlags.String("context", "default", "Name of the context to use to connect to the daemon (This flag is a NOOP and provided solely for scripting compatibility.)")
 	_ = lFlags.MarkHidden("context")
diff --git a/cmd/podman/system/connection/add.go b/cmd/podman/system/connection/add.go
index 786bc0b955..4c31a6d1b5 100644
--- a/cmd/podman/system/connection/add.go
+++ b/cmd/podman/system/connection/add.go
@@ -261,15 +261,15 @@ func translateDest(path string) (string, error) {
 	if path == "" {
 		return "", nil
 	}
-	key, val, hasVal := strings.Cut(path, "=")
-	if !hasVal {
-		return key, nil
+	split := strings.SplitN(path, "=", 2)
+	if len(split) == 1 {
+		return split[0], nil
 	}
-	if key != "host" {
-		return "", fmt.Errorf("\"host\" is required for --docker option")
+	if split[0] != "host" {
+		return "", fmt.Errorf("\"host\" is requited for --docker option")
 	}
 	// "host=tcp://myserver:2376,ca=~/ca-file,cert=~/cert-file,key=~/key-file"
-	vals := strings.Split(val, ",")
+	vals := strings.Split(split[1], ",")
 	if len(vals) > 1 {
 		return "", fmt.Errorf("--docker additional options %q not supported", strings.Join(vals[1:], ","))
 	}
diff --git a/docs/source/markdown/podman-kube-generate.1.md b/docs/source/markdown/podman-kube-generate.1.md
index 2cc6a1ab65..b1935a680f 100644
--- a/docs/source/markdown/podman-kube-generate.1.md
+++ b/docs/source/markdown/podman-kube-generate.1.md
@@ -65,42 +65,42 @@ The Kubernetes kind to generate in the YAML file. Currently, the only supported
 
 Create Kubernetes Pod YAML for a container called `some-mariadb`.
 ```
-$ podman kube generate some-mariadb
+$ sudo podman kube generate some-mariadb
 # Save the output of this file and use kubectl create -f to import
 # it into Kubernetes.
 #
-# Created with podman-4.8.2
-
-# NOTE: If you generated this yaml from an unprivileged and rootless podman container on an SELinux
-# enabled system, check the podman generate kube man page for steps to follow to ensure that your pod/container
-# has the right permissions to access the volumes added.
----
+# Created with podman-0.11.2-dev
 apiVersion: v1
 kind: Pod
 metadata:
-  creationTimestamp: "2024-01-09T02:24:55Z"
+  creationTimestamp: 2018-12-03T19:07:59Z
   labels:
-    app: some-mariadb-pod
-  name: some-mariadb-pod
+    app: some-mariadb
+  name: some-mariadb-libpod
 spec:
   containers:
-  - args:
-    - mariadbd
+  - command:
+    - docker-entrypoint.sh
+    - mysqld
     env:
-    - name: MARIADB_ROOT_PASSWORD
+    - name: HOSTNAME
+    - name: GOSU_VERSION
+      value: "1.10"
+    - name: GPG_KEYS
+      value: "199369E5404BD5FC7D2FE43BCBCB082A1BB943DB \t177F4010FE56CA3336300305F1656F24C74CD1D8
+        \t430BDF5C56E7C94E848EE60C1C4CBDCDCD2EFD2A \t4D1BB29D63D98E422B2113B19334A25F8507EFA5"
+    - name: MARIADB_MAJOR
+      value: "10.3"
+    - name: MARIADB_VERSION
+      value: 1:10.3.10+maria~bionic
+    - name: MYSQL_ROOT_PASSWORD
       value: x
-    image: docker.io/library/mariadb:10.11
+    image: quay.io/baude/demodb:latest
     name: some-mariadb
     ports:
     - containerPort: 3306
-      hostPort: 34891
-    volumeMounts:
-    - mountPath: /var/lib/mysql
-      name: mariadb_data-pvc
-  volumes:
-  - name: mariadb_data-pvc
-    persistentVolumeClaim:
-      claimName: mariadb_data
+      hostPort: 36533
+    tty: true
 ```
 
 Create Kubernetes Deployment YAML with 3 replicas for a container called `dep-ctr`
diff --git a/docs/source/markdown/podman-run.1.md.in b/docs/source/markdown/podman-run.1.md.in
index 54ad0dbf6a..7132673861 100644
--- a/docs/source/markdown/podman-run.1.md.in
+++ b/docs/source/markdown/podman-run.1.md.in
@@ -606,7 +606,7 @@ $ podman run -v /var/cache/dnf:/var/cache/dnf:O -ti fedora dnf -y update
 
 If the container needs a writeable mounted volume by a non root user inside the container, use the **U** option. This option tells Podman to chown the source volume to match the default UID and GID used within the container.
 ```
-$ podman run -d -e MARIADB_ROOT_PASSWORD=root --user mysql --userns=keep-id -v ~/data:/var/lib/mysql:Z,U mariadb
+$ podman run -d -e MYSQL_ROOT_PASSWORD=root --user mysql --userns=keep-id -v ~/data:/var/lib/mysql:Z,U mariadb
 ```
 
 Alternatively if the container needs a writable volume by a non root
@@ -614,7 +614,7 @@ user inside of the container, the --userns=keep-id option allows users to
 specify the UID and GID of the user executing Podman to specific UIDs and GIDs
 within the container. Since the processes running in the container run as the user's UID, they can read/write files owned by the user.
 ```
-$ podman run -d -e MARIADB_ROOT_PASSWORD=root --user mysql --userns=keep-id:uid=999,gid=999 -v ~/data:/var/lib/mysql:Z mariadb
+$ podman run -d -e MYSQL_ROOT_PASSWORD=root --user mysql --userns=keep-id:uid=999,gid=999 -v ~/data:/var/lib/mysql:Z mariadb
 ```
 
 Using **--mount** flags to mount a host directory as a container folder, specify
diff --git a/docs/source/markdown/podman-systemd.unit.5.md b/docs/source/markdown/podman-systemd.unit.5.md
index 2c2a07c9ab..1876434ab9 100644
--- a/docs/source/markdown/podman-systemd.unit.5.md
+++ b/docs/source/markdown/podman-systemd.unit.5.md
@@ -174,12 +174,12 @@ Valid options for `[Container]` are listed below:
 | GIDMap=0:10000:10                    | --gidmap=0:10000:10                                  |
 | Group=1234                           | --user UID:1234                                      |
 | GlobalArgs=--log-level=debug         | --log-level=debug                                    |
-| HealthCmd=/usr/bin/command           | --health-cmd=/usr/bin/command                        |
+| HealthCmd="/usr/bin/command"         | --health-cmd="/usr/bin/command"                      |
 | HealthInterval=2m                    | --health-interval=2m                                 |
 | HealthOnFailure=kill                 | --health-on-failure=kill                             |
 | HealthRetries=5                      | --health-retries=5                                   |
 | HealthStartPeriod=1m                 | --health-start-period=period=1m                      |
-| HealthStartupCmd=command             | --health-startup-cmd=command                         |
+| HealthStartupCmd="command"           | --health-startup-cmd="command"                       |
 | HealthStartupInterval=1m             | --health-startup-interval=1m                         |
 | HealthStartupRetries=8               | --health-startup-retries=8                           |
 | HealthStartupSuccess=2               | --health-startup-success=2                           |
diff --git a/docs/source/markdown/podman.1.md b/docs/source/markdown/podman.1.md
index 37480b3ac6..151a7410d5 100644
--- a/docs/source/markdown/podman.1.md
+++ b/docs/source/markdown/podman.1.md
@@ -32,9 +32,6 @@ The CGroup manager to use for container cgroups. Supported values are __cgroupfs
 Note: Setting this flag can cause certain commands to break when called on containers previously created by the other CGroup manager type.
 Note: CGroup manager is not supported in rootless mode when using CGroups Version V1.
 
-#### **--config**
-Location of config file. Mainly for docker compatibility, only the authentication parts of the config are supported.
-
 #### **--conmon**
 Path of the conmon binary (Default path is configured in `containers.conf`)
 
diff --git a/libpod/container_commit.go b/libpod/container_commit.go
index 8dca951b9f..9ef7970613 100644
--- a/libpod/container_commit.go
+++ b/libpod/container_commit.go
@@ -97,8 +97,8 @@ func (c *Container) Commit(ctx context.Context, destImage string, options Contai
 	// Should we store the ENV we actually want in the spec separately?
 	if c.config.Spec.Process != nil {
 		for _, e := range c.config.Spec.Process.Env {
-			key, val, _ := strings.Cut(e, "=")
-			importBuilder.SetEnv(key, val)
+			splitEnv := strings.SplitN(e, "=", 2)
+			importBuilder.SetEnv(splitEnv[0], splitEnv[1])
 		}
 	}
 	// Expose ports
diff --git a/libpod/container_internal_common.go b/libpod/container_internal_common.go
index 6ecbeaf8d6..3d91f653bd 100644
--- a/libpod/container_internal_common.go
+++ b/libpod/container_internal_common.go
@@ -84,7 +84,7 @@ func parseOptionIDs(ctrMappings []idtools.IDMap, option string) ([]idtools.IDMap
 		if relative {
 			found := false
 			for _, m := range ctrMappings {
-				if v.HostID >= m.ContainerID && v.HostID < m.ContainerID+m.Size {
+				if v.ContainerID >= m.ContainerID && v.ContainerID < m.ContainerID+m.Size {
 					v.HostID += m.HostID - m.ContainerID
 					found = true
 					break
@@ -607,6 +607,9 @@ func (c *Container) generateSpec(ctx context.Context) (s *spec.Spec, cleanupFunc
 		if err != nil {
 			return nil, nil, err
 		}
+		if err != nil {
+			return nil, nil, err
+		}
 		for name, secr := range c.config.EnvSecrets {
 			_, data, err := manager.LookupSecretData(secr.Name)
 			if err != nil {
diff --git a/libpod/container_internal_freebsd.go b/libpod/container_internal_freebsd.go
index 042e165525..b594089200 100644
--- a/libpod/container_internal_freebsd.go
+++ b/libpod/container_internal_freebsd.go
@@ -254,7 +254,7 @@ func (c *Container) addSharedNamespaces(g *generate.Generator) error {
 	}
 	needEnv := true
 	for _, checkEnv := range g.Config.Process.Env {
-		if strings.HasPrefix(checkEnv, "HOSTNAME=") {
+		if strings.SplitN(checkEnv, "=", 2)[0] == "HOSTNAME" {
 			needEnv = false
 			break
 		}
diff --git a/libpod/kube.go b/libpod/kube.go
index 72514d03e1..12895e4c30 100644
--- a/libpod/kube.go
+++ b/libpod/kube.go
@@ -73,13 +73,13 @@ func (p *Pod) GenerateForKube(ctx context.Context, getService, useLongAnnotation
 			return nil, servicePorts, err
 		}
 		for _, host := range infraContainer.config.ContainerNetworkConfig.HostAdd {
-			hostname, ip, hasIP := strings.Cut(host, ":")
-			if !hasIP {
+			hostSli := strings.SplitN(host, ":", 2)
+			if len(hostSli) != 2 {
 				return nil, servicePorts, errors.New("invalid hostAdd")
 			}
 			extraHost = append(extraHost, v1.HostAlias{
-				IP:        ip,
-				Hostnames: []string{hostname},
+				IP:        hostSli[1],
+				Hostnames: []string{hostSli[0]},
 			})
 		}
 		ports, err = portMappingToContainerPort(infraContainer.config.PortMappings, getService)
@@ -1001,10 +1001,10 @@ func containerToV1Container(ctx context.Context, c *Container, getService bool)
 		dnsOptions := make([]v1.PodDNSConfigOption, 0)
 		for _, option := range options {
 			// the option can be "k:v" or just "k", no delimiter is required
-			name, value, _ := strings.Cut(option, ":")
+			opts := strings.SplitN(option, ":", 2)
 			dnsOpt := v1.PodDNSConfigOption{
-				Name:  name,
-				Value: &value,
+				Name:  opts[0],
+				Value: &opts[1],
 			}
 			dnsOptions = append(dnsOptions, dnsOpt)
 		}
@@ -1055,23 +1055,23 @@ func libpodEnvVarsToKubeEnvVars(envs []string, imageEnvs []string) ([]v1.EnvVar,
 	envVars := make([]v1.EnvVar, 0, len(envs))
 	imageMap := make(map[string]string, len(imageEnvs))
 	for _, ie := range imageEnvs {
-		key, val, _ := strings.Cut(ie, "=")
-		imageMap[key] = val
+		split := strings.SplitN(ie, "=", 2)
+		imageMap[split[0]] = split[1]
 	}
 	for _, e := range envs {
-		envName, envValue, hasValue := strings.Cut(e, "=")
-		if !hasValue {
+		split := strings.SplitN(e, "=", 2)
+		if len(split) != 2 {
 			return envVars, fmt.Errorf("environment variable %s is malformed; should be key=value", e)
 		}
-		if defaultEnv[envName] == envValue {
+		if defaultEnv[split[0]] == split[1] {
 			continue
 		}
-		if imageMap[envName] == envValue {
+		if imageMap[split[0]] == split[1] {
 			continue
 		}
 		ev := v1.EnvVar{
-			Name:  envName,
-			Value: envValue,
+			Name:  split[0],
+			Value: split[1],
 		}
 		envVars = append(envVars, ev)
 	}
@@ -1286,22 +1286,25 @@ func generateKubeSecurityContext(c *Container) (*v1.SecurityContext, bool, error
 	var selinuxOpts v1.SELinuxOptions
 	selinuxHasData := false
 	for _, label := range strings.Split(c.config.Spec.Annotations[define.InspectAnnotationLabel], ",label=") {
-		opt, val, hasVal := strings.Cut(label, ":")
-		if hasVal {
-			switch opt {
+		opts := strings.SplitN(label, ":", 2)
+		switch len(opts) {
+		case 2:
+			switch opts[0] {
 			case "filetype":
-				selinuxOpts.FileType = val
+				selinuxOpts.FileType = opts[1]
 				selinuxHasData = true
 			case "type":
-				selinuxOpts.Type = val
+				selinuxOpts.Type = opts[1]
 				selinuxHasData = true
 			case "level":
-				selinuxOpts.Level = val
+				selinuxOpts.Level = opts[1]
+				selinuxHasData = true
+			}
+		case 1:
+			if opts[0] == "disable" {
+				selinuxOpts.Type = "spc_t"
 				selinuxHasData = true
 			}
-		} else if opt == "disable" {
-			selinuxOpts.Type = "spc_t"
-			selinuxHasData = true
 		}
 	}
 	if selinuxHasData {
diff --git a/pkg/api/handlers/compat/containers.go b/pkg/api/handlers/compat/containers.go
index a3b5846123..32a8024ed2 100644
--- a/pkg/api/handlers/compat/containers.go
+++ b/pkg/api/handlers/compat/containers.go
@@ -524,11 +524,11 @@ func LibpodToContainerJSON(l *libpod.Container, sz bool) (*types.ContainerJSON,
 
 	exposedPorts := make(nat.PortSet)
 	for ep := range inspect.NetworkSettings.Ports {
-		port, proto, ok := strings.Cut(ep, "/")
-		if !ok {
+		splitp := strings.SplitN(ep, "/", 2)
+		if len(splitp) != 2 {
 			return nil, fmt.Errorf("PORT/PROTOCOL Format required for %q", ep)
 		}
-		exposedPort, err := nat.NewPort(proto, port)
+		exposedPort, err := nat.NewPort(splitp[1], splitp[0])
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/api/handlers/compat/exec.go b/pkg/api/handlers/compat/exec.go
index 68d3335b8a..819a096ef1 100644
--- a/pkg/api/handlers/compat/exec.go
+++ b/pkg/api/handlers/compat/exec.go
@@ -49,12 +49,12 @@ func ExecCreateHandler(w http.ResponseWriter, r *http.Request) {
 	}
 	libpodConfig.Environment = make(map[string]string)
 	for _, envStr := range input.Env {
-		key, val, hasVal := strings.Cut(envStr, "=")
-		if !hasVal {
+		split := strings.SplitN(envStr, "=", 2)
+		if len(split) != 2 {
 			utils.Error(w, http.StatusBadRequest, fmt.Errorf("environment variable %q badly formed, must be key=value", envStr))
 			return
 		}
-		libpodConfig.Environment[key] = val
+		libpodConfig.Environment[split[0]] = split[1]
 	}
 	libpodConfig.WorkDir = input.WorkingDir
 	libpodConfig.Privileged = input.Privileged
diff --git a/pkg/api/handlers/compat/images_build.go b/pkg/api/handlers/compat/images_build.go
index 195a916227..5619a95033 100644
--- a/pkg/api/handlers/compat/images_build.go
+++ b/pkg/api/handlers/compat/images_build.go
@@ -330,15 +330,15 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
 			if len(secretOpt) > 0 {
 				modifiedOpt := []string{}
 				for _, token := range secretOpt {
-					key, val, hasVal := strings.Cut(token, "=")
-					if hasVal {
-						if key == "src" {
+					arr := strings.SplitN(token, "=", 2)
+					if len(arr) > 1 {
+						if arr[0] == "src" {
 							/* move secret away from contextDir */
 							/* to make sure we dont accidentally commit temporary secrets to image*/
 							builderDirectory, _ := filepath.Split(contextDirectory)
 							// following path is outside build context
-							newSecretPath := filepath.Join(builderDirectory, val)
-							oldSecretPath := filepath.Join(contextDirectory, val)
+							newSecretPath := filepath.Join(builderDirectory, arr[1])
+							oldSecretPath := filepath.Join(contextDirectory, arr[1])
 							err := os.Rename(oldSecretPath, newSecretPath)
 							if err != nil {
 								utils.BadRequest(w, "secrets", query.Secrets, err)
@@ -551,19 +551,19 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
 					utils.BadRequest(w, "securityopt", query.SecurityOpt, errors.New("no-new-privileges is not supported"))
 					return
 				}
-				name, value, hasValue := strings.Cut(opt, "=")
-				if !hasValue {
+				con := strings.SplitN(opt, "=", 2)
+				if len(con) != 2 {
 					utils.BadRequest(w, "securityopt", query.SecurityOpt, fmt.Errorf("invalid --security-opt name=value pair: %q", opt))
 					return
 				}
 
-				switch name {
+				switch con[0] {
 				case "label":
-					labelOpts = append(labelOpts, value)
+					labelOpts = append(labelOpts, con[1])
 				case "apparmor":
-					apparmor = value
+					apparmor = con[1]
 				case "seccomp":
-					seccomp = value
+					seccomp = con[1]
 				default:
 					utils.BadRequest(w, "securityopt", query.SecurityOpt, fmt.Errorf("invalid --security-opt 2: %q", opt))
 					return
diff --git a/pkg/api/handlers/libpod/manifests.go b/pkg/api/handlers/libpod/manifests.go
index 6c7752b8f7..2c53e2162c 100644
--- a/pkg/api/handlers/libpod/manifests.go
+++ b/pkg/api/handlers/libpod/manifests.go
@@ -489,12 +489,12 @@ func ManifestModify(w http.ResponseWriter, r *http.Request) {
 		}
 		annotations := make(map[string]string)
 		for _, annotationSpec := range body.ManifestAddOptions.Annotation {
-			key, val, hasVal := strings.Cut(annotationSpec, "=")
-			if !hasVal {
-				utils.Error(w, http.StatusBadRequest, fmt.Errorf("no value given for annotation %q", key))
+			spec := strings.SplitN(annotationSpec, "=", 2)
+			if len(spec) != 2 {
+				utils.Error(w, http.StatusBadRequest, fmt.Errorf("no value given for annotation %q", spec[0]))
 				return
 			}
-			annotations[key] = val
+			annotations[spec[0]] = spec[1]
 		}
 		body.ManifestAddOptions.Annotations = envLib.Join(body.ManifestAddOptions.Annotations, annotations)
 		body.ManifestAddOptions.Annotation = nil
diff --git a/pkg/auth/auth.go b/pkg/auth/auth.go
index ecbf4d3aee..12ea2458bb 100644
--- a/pkg/auth/auth.go
+++ b/pkg/auth/auth.go
@@ -268,7 +268,7 @@ func normalizeAuthFileKey(authFileKey string) string {
 	stripped = strings.TrimPrefix(stripped, "https://")
 
 	if stripped != authFileKey { // URLs are interpreted to mean complete registries
-		stripped, _, _ = strings.Cut(stripped, "/")
+		stripped = strings.SplitN(stripped, "/", 2)[0]
 	}
 
 	// Only non-namespaced registry names (or URLs) need to be normalized; repo namespaces
diff --git a/pkg/bindings/images/build.go b/pkg/bindings/images/build.go
index 0f0f2dee89..b286b1a496 100644
--- a/pkg/bindings/images/build.go
+++ b/pkg/bindings/images/build.go
@@ -530,9 +530,9 @@ func Build(ctx context.Context, containerFiles []string, options entities.BuildO
 			if len(secretOpt) > 0 {
 				modifiedOpt := []string{}
 				for _, token := range secretOpt {
-					opt, val, hasVal := strings.Cut(token, "=")
-					if hasVal {
-						if opt == "src" {
+					arr := strings.SplitN(token, "=", 2)
+					if len(arr) > 1 {
+						if arr[0] == "src" {
 							// read specified secret into a tmp file
 							// move tmp file to tar and change secret source to relative tmp file
 							tmpSecretFile, err := os.CreateTemp(options.ContextDirectory, "podman-build-secret")
@@ -541,7 +541,7 @@ func Build(ctx context.Context, containerFiles []string, options entities.BuildO
 							}
 							defer os.Remove(tmpSecretFile.Name()) // clean up
 							defer tmpSecretFile.Close()
-							srcSecretFile, err := os.Open(val)
+							srcSecretFile, err := os.Open(arr[1])
 							if err != nil {
 								return nil, err
 							}
diff --git a/pkg/copy/parse.go b/pkg/copy/parse.go
index d58942f571..50f1d211d8 100644
--- a/pkg/copy/parse.go
+++ b/pkg/copy/parse.go
@@ -40,9 +40,9 @@ func parseUserInput(input string) (container string, path string) {
 		return
 	}
 
-	if parsedContainer, parsedPath, ok := strings.Cut(path, ":"); ok {
-		container = parsedContainer
-		path = parsedPath
+	if spl := strings.SplitN(path, ":", 2); len(spl) == 2 {
+		container = spl[0]
+		path = spl[1]
 	}
 	return
 }
diff --git a/pkg/domain/entities/engine.go b/pkg/domain/entities/engine.go
index 3346110d60..6c7f0abb4c 100644
--- a/pkg/domain/entities/engine.go
+++ b/pkg/domain/entities/engine.go
@@ -35,7 +35,7 @@ type PodmanConfig struct {
 	ContainersConf           *config.Config
 	ContainersConfDefaultsRO *config.Config // The read-only! defaults from containers.conf.
 	DBBackend                string         // Hidden: change the database backend
-	DockerConfig             string         // Location of authentication config file
+	DockerConfig             string         // Used for Docker compatibility
 	CgroupUsage              string         // rootless code determines Usage message
 	ConmonPath               string         // --conmon flag will set Engine.ConmonPath
 	CPUProfile               string         // Hidden: Should CPU profile be taken
diff --git a/pkg/domain/filters/containers.go b/pkg/domain/filters/containers.go
index d690a0bdc9..52ddc746d4 100644
--- a/pkg/domain/filters/containers.go
+++ b/pkg/domain/filters/containers.go
@@ -98,10 +98,10 @@ func GenerateContainerFilterFuncs(filter string, filterValues []string, r *libpo
 				var imageNameWithoutTag string
 				// Compare with ImageID, ImageName
 				// Will match ImageName if running image has tag latest for other tags exact complete filter must be given
-				name, tag, hasColon := strings.Cut(rootfsImageName, ":")
-				if hasColon {
-					imageNameWithoutTag = name
-					imageTag = tag
+				imageNameSlice := strings.SplitN(rootfsImageName, ":", 2)
+				if len(imageNameSlice) == 2 {
+					imageNameWithoutTag = imageNameSlice[0]
+					imageTag = imageNameSlice[1]
 				}
 
 				if (rootfsImageID == filterValue) ||
@@ -144,8 +144,13 @@ func GenerateContainerFilterFuncs(filter string, filterValues []string, r *libpo
 		//- volume=(<volume-name>|<mount-point-destination>)
 		return func(c *libpod.Container) bool {
 			containerConfig := c.ConfigNoCopy()
+			var dest string
 			for _, filterValue := range filterValues {
-				source, dest, _ := strings.Cut(filterValue, ":")
+				arr := strings.SplitN(filterValue, ":", 2)
+				source := arr[0]
+				if len(arr) == 2 {
+					dest = arr[1]
+				}
 				for _, mount := range containerConfig.Spec.Mounts {
 					if dest != "" && (mount.Source == source && mount.Destination == dest) {
 						return true
@@ -228,10 +233,19 @@ func GenerateContainerFilterFuncs(filter string, filterValues []string, r *libpo
 			// check if networkMode is configured as `container:<ctr>`
 			// perform a match against filter `container:<IDorName>`
 			// networks is already going to be empty if `container:<ctr>` is configured as Mode
-			if networkModeContainerID, ok := strings.CutPrefix(networkMode, "container:"); ok {
+			if strings.HasPrefix(networkMode, "container:") {
+				networkModeContainerPart := strings.SplitN(networkMode, ":", 2)
+				if len(networkModeContainerPart) < 2 {
+					return false
+				}
+				networkModeContainerID := networkModeContainerPart[1]
 				for _, val := range filterValues {
-					if idOrName, ok := strings.CutPrefix(val, "container:"); ok {
-						filterNetworkModeIDorName := idOrName
+					if strings.HasPrefix(val, "container:") {
+						filterNetworkModePart := strings.SplitN(val, ":", 2)
+						if len(filterNetworkModePart) < 2 {
+							return false
+						}
+						filterNetworkModeIDorName := filterNetworkModePart[1]
 						filterID, err := r.LookupContainerID(filterNetworkModeIDorName)
 						if err != nil {
 							return false
diff --git a/pkg/domain/filters/volumes.go b/pkg/domain/filters/volumes.go
index 28e541b522..3d629548d4 100644
--- a/pkg/domain/filters/volumes.go
+++ b/pkg/domain/filters/volumes.go
@@ -49,7 +49,14 @@ func GenerateVolumeFilters(filter string, filterValues []string, runtime *libpod
 	case "opt":
 		return func(v *libpod.Volume) bool {
 			for _, val := range filterValues {
-				filterKey, filterVal, _ := strings.Cut(val, "=")
+				filterArray := strings.SplitN(val, "=", 2)
+				filterKey := filterArray[0]
+				var filterVal string
+				if len(filterArray) > 1 {
+					filterVal = filterArray[1]
+				} else {
+					filterVal = ""
+				}
 
 				for labelKey, labelValue := range v.Options() {
 					if labelKey == filterKey && (filterVal == "" || labelValue == filterVal) {
diff --git a/pkg/domain/infra/abi/containers_runlabel.go b/pkg/domain/infra/abi/containers_runlabel.go
index 26626fd501..463988c87e 100644
--- a/pkg/domain/infra/abi/containers_runlabel.go
+++ b/pkg/domain/infra/abi/containers_runlabel.go
@@ -135,7 +135,7 @@ func generateRunlabelCommand(runlabel string, img *libimage.Image, inputName str
 		name = splitImageName[len(splitImageName)-1]
 		// make sure to remove the tag from the image name, otherwise the name cannot
 		// be used as container name because a colon is an illegal character
-		name, _, _ = strings.Cut(name, ":")
+		name = strings.SplitN(name, ":", 2)[0]
 	}
 
 	// Append the user-specified arguments to the runlabel (command).
diff --git a/pkg/domain/infra/abi/manifest.go b/pkg/domain/infra/abi/manifest.go
index d5436a7129..24b89872ee 100644
--- a/pkg/domain/infra/abi/manifest.go
+++ b/pkg/domain/infra/abi/manifest.go
@@ -230,11 +230,11 @@ func (ir *ImageEngine) ManifestAdd(ctx context.Context, name string, images []st
 		if len(opts.Annotation) != 0 {
 			annotations := make(map[string]string)
 			for _, annotationSpec := range opts.Annotation {
-				key, val, hasVal := strings.Cut(annotationSpec, "=")
-				if !hasVal {
-					return "", fmt.Errorf("no value given for annotation %q", key)
+				spec := strings.SplitN(annotationSpec, "=", 2)
+				if len(spec) != 2 {
+					return "", fmt.Errorf("no value given for annotation %q", spec[0])
 				}
-				annotations[key] = val
+				annotations[spec[0]] = spec[1]
 			}
 			opts.Annotations = envLib.Join(opts.Annotations, annotations)
 		}
@@ -269,11 +269,11 @@ func (ir *ImageEngine) ManifestAnnotate(ctx context.Context, name, image string,
 	if len(opts.Annotation) != 0 {
 		annotations := make(map[string]string)
 		for _, annotationSpec := range opts.Annotation {
-			key, val, hasVal := strings.Cut(annotationSpec, "=")
-			if !hasVal {
-				return "", fmt.Errorf("no value given for annotation %q", key)
+			spec := strings.SplitN(annotationSpec, "=", 2)
+			if len(spec) != 2 {
+				return "", fmt.Errorf("no value given for annotation %q", spec[0])
 			}
-			annotations[key] = val
+			annotations[spec[0]] = spec[1]
 		}
 		opts.Annotations = envLib.Join(opts.Annotations, annotations)
 	}
diff --git a/pkg/domain/infra/abi/parse/parse.go b/pkg/domain/infra/abi/parse/parse.go
index 19d26c39e2..0cb95aa042 100644
--- a/pkg/domain/infra/abi/parse/parse.go
+++ b/pkg/domain/infra/abi/parse/parse.go
@@ -27,64 +27,64 @@ func VolumeOptions(opts map[string]string) ([]libpod.VolumeCreateOption, error)
 			for _, o := range splitVal {
 				// Options will be formatted as either "opt" or
 				// "opt=value"
-				opt, val, hasVal := strings.Cut(o, "=")
-				switch strings.ToLower(opt) {
+				splitO := strings.SplitN(o, "=", 2)
+				switch strings.ToLower(splitO[0]) {
 				case "size":
-					size, err := units.FromHumanSize(val)
+					size, err := units.FromHumanSize(splitO[1])
 					if err != nil {
-						return nil, fmt.Errorf("cannot convert size %s to integer: %w", val, err)
+						return nil, fmt.Errorf("cannot convert size %s to integer: %w", splitO[1], err)
 					}
 					libpodOptions = append(libpodOptions, libpod.WithVolumeSize(uint64(size)))
 					finalVal = append(finalVal, o)
 					// set option "SIZE": "$size"
-					volumeOptions["SIZE"] = val
+					volumeOptions["SIZE"] = splitO[1]
 				case "inodes":
-					inodes, err := strconv.ParseUint(val, 10, 64)
+					inodes, err := strconv.ParseUint(splitO[1], 10, 64)
 					if err != nil {
-						return nil, fmt.Errorf("cannot convert inodes %s to integer: %w", val, err)
+						return nil, fmt.Errorf("cannot convert inodes %s to integer: %w", splitO[1], err)
 					}
 					libpodOptions = append(libpodOptions, libpod.WithVolumeInodes(inodes))
 					finalVal = append(finalVal, o)
 					// set option "INODES": "$size"
-					volumeOptions["INODES"] = val
+					volumeOptions["INODES"] = splitO[1]
 				case "uid":
-					if !hasVal {
+					if len(splitO) != 2 {
 						return nil, fmt.Errorf("uid option must provide a UID: %w", define.ErrInvalidArg)
 					}
-					intUID, err := strconv.Atoi(val)
+					intUID, err := strconv.Atoi(splitO[1])
 					if err != nil {
-						return nil, fmt.Errorf("cannot convert UID %s to integer: %w", val, err)
+						return nil, fmt.Errorf("cannot convert UID %s to integer: %w", splitO[1], err)
 					}
 					logrus.Debugf("Removing uid= from options and adding WithVolumeUID for UID %d", intUID)
 					libpodOptions = append(libpodOptions, libpod.WithVolumeUID(intUID), libpod.WithVolumeNoChown())
 					finalVal = append(finalVal, o)
 					// set option "UID": "$uid"
-					volumeOptions["UID"] = val
+					volumeOptions["UID"] = splitO[1]
 				case "gid":
-					if !hasVal {
+					if len(splitO) != 2 {
 						return nil, fmt.Errorf("gid option must provide a GID: %w", define.ErrInvalidArg)
 					}
-					intGID, err := strconv.Atoi(val)
+					intGID, err := strconv.Atoi(splitO[1])
 					if err != nil {
-						return nil, fmt.Errorf("cannot convert GID %s to integer: %w", val, err)
+						return nil, fmt.Errorf("cannot convert GID %s to integer: %w", splitO[1], err)
 					}
 					logrus.Debugf("Removing gid= from options and adding WithVolumeGID for GID %d", intGID)
 					libpodOptions = append(libpodOptions, libpod.WithVolumeGID(intGID), libpod.WithVolumeNoChown())
 					finalVal = append(finalVal, o)
 					// set option "GID": "$gid"
-					volumeOptions["GID"] = val
+					volumeOptions["GID"] = splitO[1]
 				case "noquota":
 					logrus.Debugf("Removing noquota from options and adding WithVolumeDisableQuota")
 					libpodOptions = append(libpodOptions, libpod.WithVolumeDisableQuota())
 					// set option "NOQUOTA": "true"
 					volumeOptions["NOQUOTA"] = "true"
 				case "timeout":
-					if !hasVal {
+					if len(splitO) != 2 {
 						return nil, fmt.Errorf("timeout option must provide a valid timeout in seconds: %w", define.ErrInvalidArg)
 					}
-					intTimeout, err := strconv.Atoi(val)
+					intTimeout, err := strconv.Atoi(splitO[1])
 					if err != nil {
-						return nil, fmt.Errorf("cannot convert Timeout %s to an integer: %w", val, err)
+						return nil, fmt.Errorf("cannot convert Timeout %s to an integer: %w", splitO[1], err)
 					}
 					if intTimeout < 0 {
 						return nil, fmt.Errorf("volume timeout cannot be negative (got %d)", intTimeout)
diff --git a/pkg/domain/infra/tunnel/manifest.go b/pkg/domain/infra/tunnel/manifest.go
index f4aec45b0b..5b176e31ed 100644
--- a/pkg/domain/infra/tunnel/manifest.go
+++ b/pkg/domain/infra/tunnel/manifest.go
@@ -64,11 +64,11 @@ func (ir *ImageEngine) ManifestAdd(_ context.Context, name string, imageNames []
 	if len(opts.Annotation) != 0 {
 		annotations := make(map[string]string)
 		for _, annotationSpec := range opts.Annotation {
-			key, val, hasVal := strings.Cut(annotationSpec, "=")
-			if !hasVal {
-				return "", fmt.Errorf("no value given for annotation %q", key)
+			spec := strings.SplitN(annotationSpec, "=", 2)
+			if len(spec) != 2 {
+				return "", fmt.Errorf("no value given for annotation %q", spec[0])
 			}
-			annotations[key] = val
+			annotations[spec[0]] = spec[1]
 		}
 		opts.Annotations = envLib.Join(opts.Annotations, annotations)
 	}
@@ -97,11 +97,11 @@ func (ir *ImageEngine) ManifestAnnotate(ctx context.Context, name, images string
 	if len(opts.Annotation) != 0 {
 		annotations := make(map[string]string)
 		for _, annotationSpec := range opts.Annotation {
-			key, val, hasVal := strings.Cut(annotationSpec, "=")
-			if !hasVal {
-				return "", fmt.Errorf("no value given for annotation %q", key)
+			spec := strings.SplitN(annotationSpec, "=", 2)
+			if len(spec) != 2 {
+				return "", fmt.Errorf("no value given for annotation %q", spec[0])
 			}
-			annotations[key] = val
+			annotations[spec[0]] = spec[1]
 		}
 		opts.Annotations = envLib.Join(opts.Annotations, annotations)
 	}
diff --git a/pkg/domain/utils/scp.go b/pkg/domain/utils/scp.go
index cd466843d7..0bd1b0d3e6 100644
--- a/pkg/domain/utils/scp.go
+++ b/pkg/domain/utils/scp.go
@@ -406,8 +406,8 @@ func GetServiceInformation(sshInfo *entities.ImageScpConnections, cliConnections
 	var urlS string
 	var iden string
 	for i, val := range cliConnections {
-		connection, _, _ := strings.Cut(val, "::")
-		sshInfo.Connections = append(sshInfo.Connections, connection)
+		splitEnv := strings.SplitN(val, "::", 2)
+		sshInfo.Connections = append(sshInfo.Connections, splitEnv[0])
 		conn, found := cfg.Engine.ServiceDestinations[sshInfo.Connections[i]]
 		if found {
 			urlS = conn.URI
diff --git a/pkg/domain/utils/utils.go b/pkg/domain/utils/utils.go
index ca7a3210fb..ee213e1b62 100644
--- a/pkg/domain/utils/utils.go
+++ b/pkg/domain/utils/utils.go
@@ -34,8 +34,8 @@ func ToLibpodFilters(f url.Values) (filters []string) {
 func ToURLValues(f []string) (filters url.Values) {
 	filters = make(url.Values)
 	for _, v := range f {
-		key, val, _ := strings.Cut(v, "=")
-		filters.Add(key, val)
+		t := strings.SplitN(v, "=", 2)
+		filters.Add(t[0], t[1])
 	}
 	return
 }
diff --git a/pkg/env/env.go b/pkg/env/env.go
index 6dbfb02017..8e87834f85 100644
--- a/pkg/env/env.go
+++ b/pkg/env/env.go
@@ -40,9 +40,14 @@ func Slice(m map[string]string) []string {
 // map.
 func Map(slice []string) map[string]string {
 	envmap := make(map[string]string, len(slice))
-	for _, line := range slice {
-		key, val, _ := strings.Cut(line, "=")
-		envmap[key] = val
+	for _, val := range slice {
+		data := strings.SplitN(val, "=", 2)
+
+		if len(data) > 1 {
+			envmap[data[0]] = data[1]
+		} else {
+			envmap[data[0]] = ""
+		}
 	}
 	return envmap
 }
@@ -89,25 +94,26 @@ func ParseFile(path string) (_ map[string]string, err error) {
 }
 
 func parseEnv(env map[string]string, line string) error {
-	key, val, hasVal := strings.Cut(line, "=")
+	data := strings.SplitN(line, "=", 2)
 
 	// catch invalid variables such as "=" or "=A"
-	if key == "" {
+	if data[0] == "" {
 		return fmt.Errorf("invalid variable: %q", line)
 	}
 	// trim the front of a variable, but nothing else
-	name := strings.TrimLeft(key, whiteSpaces)
-	if hasVal {
-		env[name] = val
+	name := strings.TrimLeft(data[0], whiteSpaces)
+	if len(data) > 1 {
+		env[name] = data[1]
 	} else {
-		if name, hasStar := strings.CutSuffix(name, "*"); hasStar {
+		if strings.HasSuffix(name, "*") {
+			name = strings.TrimSuffix(name, "*")
 			for _, e := range os.Environ() {
-				envKey, envVal, hasEq := strings.Cut(e, "=")
-				if !hasEq {
+				part := strings.SplitN(e, "=", 2)
+				if len(part) < 2 {
 					continue
 				}
-				if strings.HasPrefix(envKey, name) {
-					env[envKey] = envVal
+				if strings.HasPrefix(part[0], name) {
+					env[part[0]] = part[1]
 				}
 			}
 		} else if val, ok := os.LookupEnv(name); ok {
diff --git a/pkg/machine/applehv/config.go b/pkg/machine/applehv/config.go
index 26fa74665a..eb11c93e3b 100644
--- a/pkg/machine/applehv/config.go
+++ b/pkg/machine/applehv/config.go
@@ -12,16 +12,16 @@ import (
 	"github.com/containers/podman/v4/pkg/machine"
 	"github.com/containers/podman/v4/pkg/machine/compression"
 	"github.com/containers/podman/v4/pkg/machine/define"
-	"github.com/containers/podman/v4/pkg/machine/ignition"
 	"github.com/containers/podman/v4/pkg/machine/vmconfigs"
+	"github.com/containers/podman/v4/pkg/machine/ignition"
 	vfConfig "github.com/crc-org/vfkit/pkg/config"
 	"github.com/docker/go-units"
 	"golang.org/x/sys/unix"
 )
 
 const (
-	localhostURI       = "http://localhost"
-	ignitionSocketName = "ignition.sock"
+	defaultVFKitEndpoint = "http://localhost:8081"
+	ignitionSocketName   = "ignition.sock"
 )
 
 type AppleHVVirtualization struct {
diff --git a/pkg/machine/applehv/machine.go b/pkg/machine/applehv/machine.go
index fad985d959..2ca843c83e 100644
--- a/pkg/machine/applehv/machine.go
+++ b/pkg/machine/applehv/machine.go
@@ -116,12 +116,7 @@ func (m *MacMachine) setVfkitInfo(cfg *config.Config, readySocket define.VMFile)
 	}
 
 	m.Vfkit.VirtualMachine.Devices = defaultDevices
-	randPort, err := utils.GetRandomPort()
-	if err != nil {
-		return err
-	}
-
-	m.Vfkit.Endpoint = localhostURI + ":" + strconv.Itoa(randPort)
+	m.Vfkit.Endpoint = defaultVFKitEndpoint
 	m.Vfkit.VfkitBinaryPath = vfkitBinaryPath
 
 	return nil
@@ -410,15 +405,6 @@ func (m *MacMachine) writeConfig() error {
 	return os.WriteFile(m.ConfigPath.Path, b, 0644)
 }
 
-func (m *MacMachine) setRootful(rootful bool) error {
-	if err := machine.SetRootful(rootful, m.Name, m.Name+"-root"); err != nil {
-		return err
-	}
-
-	m.HostUser.Modified = true
-	return nil
-}
-
 func (m *MacMachine) Set(name string, opts machine.SetOptions) ([]error, error) {
 	var setErrors []error
 
@@ -452,14 +438,6 @@ func (m *MacMachine) Set(name string, opts machine.SetOptions) ([]error, error)
 		setErrors = append(setErrors, errors.New("changing USBs not supported for applehv machines"))
 	}
 
-	if opts.Rootful != nil && m.Rootful != *opts.Rootful {
-		if err := m.setRootful(*opts.Rootful); err != nil {
-			setErrors = append(setErrors, fmt.Errorf("failed to set rootful option: %w", err))
-		} else {
-			m.Rootful = *opts.Rootful
-		}
-	}
-
 	// Write the machine config to the filesystem
 	err = m.writeConfig()
 	setErrors = append(setErrors, err)
@@ -719,17 +697,6 @@ func (m *MacMachine) Start(name string, opts machine.StartOptions) error {
 		m.isIncompatible(),
 		m.Rootful,
 	)
-
-	// update the podman/docker socket service if the host user has been modified at all (UID or Rootful)
-	if m.HostUser.Modified {
-		if machine.UpdatePodmanDockerSockService(m, name, m.UID, m.Rootful) == nil {
-			// Reset modification state if there are no errors, otherwise ignore errors
-			// which are already logged
-			m.HostUser.Modified = false
-			_ = m.writeConfig()
-		}
-	}
-
 	return nil
 }
 
@@ -759,13 +726,8 @@ func (m *MacMachine) Stop(name string, opts machine.StopOptions) error {
 			logrus.Error(err)
 		}
 	}()
-	if err := m.Vfkit.Stop(false, true); err != nil {
-		return err
-	}
 
-	// keep track of last up
-	m.LastUp = time.Now()
-	return m.writeConfig()
+	return m.Vfkit.Stop(false, true)
 }
 
 // getVMConfigPath is a simple wrapper for getting the fully-qualified
diff --git a/pkg/machine/ignition/ignition.go b/pkg/machine/ignition/ignition.go
index 8e2cf1c408..0863f6f1d3 100644
--- a/pkg/machine/ignition/ignition.go
+++ b/pkg/machine/ignition/ignition.go
@@ -135,6 +135,14 @@ func (ign *DynamicIgnition) GenerateIgnitionConfig() error {
 		ignStorage.Links = append(ignStorage.Links, tzLink)
 	}
 
+	// Enables automatic login on the console;
+	// there's no security concerns here, and this makes debugging easier.
+	// xref https://docs.fedoraproject.org/en-US/fedora-coreos/tutorial-autologin/
+	var autologinDropin = `[Service]
+ExecStart=
+ExecStart=-/usr/sbin/agetty --autologin root --noclear %I $TERM
+`
+
 	deMoby := parser.NewUnitFile()
 	deMoby.Add("Unit", "Description", "Remove moby-engine")
 	deMoby.Add("Unit", "After", "systemd-machine-id-commit.service")
@@ -220,7 +228,26 @@ func (ign *DynamicIgnition) GenerateIgnitionConfig() error {
 				Enabled: BoolToPtr(false),
 				Name:    "zincati.service",
 			},
-		}}
+			{
+				Name: "serial-getty@.service",
+				Dropins: []Dropin{
+					{
+						Name:     "10-autologin.conf",
+						Contents: &autologinDropin,
+					},
+				},
+			},
+			{
+				Name: "getty@.service",
+				Dropins: []Dropin{
+					{
+						Name:     "10-autologin.conf",
+						Contents: &autologinDropin,
+					},
+				},
+			},
+		},
+	}
 
 	// Only qemu has the qemu firmware environment setting
 	if ign.VMType == define.QemuVirt {
@@ -318,7 +345,6 @@ func getFiles(usrName string, uid int, rootful bool, vmtype define.VMType) []Fil
 
 	containers := `[containers]
 netns="bridge"
-pids_limit=0
 `
 	// Set deprecated machine_enabled until podman package on fcos is
 	// current enough to no longer require it
diff --git a/pkg/namespaces/namespaces.go b/pkg/namespaces/namespaces.go
index 3c0622c7d5..2731fe95ad 100644
--- a/pkg/namespaces/namespaces.go
+++ b/pkg/namespaces/namespaces.go
@@ -48,21 +48,24 @@ func (n CgroupMode) IsNS() bool {
 
 // NS gets the path associated with a ns:<path> cgroup ns
 func (n CgroupMode) NS() string {
-	_, path, _ := strings.Cut(string(n), ":")
-	return path
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 {
+		return parts[1]
+	}
+	return ""
 }
 
 // IsContainer indicates whether the container uses a new cgroup namespace.
 func (n CgroupMode) IsContainer() bool {
-	typ, _, hasColon := strings.Cut(string(n), ":")
-	return hasColon && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // Container returns the name of the container whose cgroup namespace is going to be used.
 func (n CgroupMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -120,36 +123,36 @@ func (n UsernsMode) IsDefaultValue() bool {
 // GetKeepIDOptions returns a KeepIDUserNsOptions with the settings to keepIDmatically set up
 // a user namespace.
 func (n UsernsMode) GetKeepIDOptions() (*KeepIDUserNsOptions, error) {
-	nsmode, nsopts, hasOpts := strings.Cut(string(n), ":")
-	if nsmode != "keep-id" {
+	parts := strings.SplitN(string(n), ":", 2)
+	if parts[0] != "keep-id" {
 		return nil, fmt.Errorf("wrong user namespace mode")
 	}
 	options := KeepIDUserNsOptions{}
-	if !hasOpts {
+	if len(parts) == 1 {
 		return &options, nil
 	}
-	for _, o := range strings.Split(nsopts, ",") {
-		opt, val, hasVal := strings.Cut(o, "=")
-		if !hasVal {
+	for _, o := range strings.Split(parts[1], ",") {
+		v := strings.SplitN(o, "=", 2)
+		if len(v) != 2 {
 			return nil, fmt.Errorf("invalid option specified: %q", o)
 		}
-		switch opt {
+		switch v[0] {
 		case "uid":
-			s, err := strconv.ParseUint(val, 10, 32)
+			s, err := strconv.ParseUint(v[1], 10, 32)
 			if err != nil {
 				return nil, err
 			}
 			v := uint32(s)
 			options.UID = &v
 		case "gid":
-			s, err := strconv.ParseUint(val, 10, 32)
+			s, err := strconv.ParseUint(v[1], 10, 32)
 			if err != nil {
 				return nil, err
 			}
 			v := uint32(s)
 			options.GID = &v
 		default:
-			return nil, fmt.Errorf("unknown option specified: %q", opt)
+			return nil, fmt.Errorf("unknown option specified: %q", v[0])
 		}
 	}
 	return &options, nil
@@ -182,21 +185,24 @@ func (n UsernsMode) IsNS() bool {
 
 // NS gets the path associated with a ns:<path> userns ns
 func (n UsernsMode) NS() string {
-	_, path, _ := strings.Cut(string(n), ":")
-	return path
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 {
+		return parts[1]
+	}
+	return ""
 }
 
 // IsContainer indicates whether container uses a container userns.
 func (n UsernsMode) IsContainer() bool {
-	typ, _, hasName := strings.Cut(string(n), ":")
-	return hasName && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // Container is the id of the container which network this container is connected to.
 func (n UsernsMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -216,15 +222,15 @@ func (n UTSMode) IsHost() bool {
 
 // IsContainer indicates whether the container uses a container's UTS namespace.
 func (n UTSMode) IsContainer() bool {
-	typ, _, hasName := strings.Cut(string(n), ":")
-	return hasName && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // Container returns the name of the container whose uts namespace is going to be used.
 func (n UTSMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -264,8 +270,8 @@ func (n IpcMode) IsShareable() bool {
 
 // IsContainer indicates whether the container uses another container's ipc namespace.
 func (n IpcMode) IsContainer() bool {
-	typ, _, hasName := strings.Cut(string(n), ":")
-	return hasName && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // IsNone indicates whether container IpcMode is set to "none".
@@ -285,9 +291,9 @@ func (n IpcMode) Valid() bool {
 
 // Container returns the name of the container ipc stack is going to be used.
 func (n IpcMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -307,8 +313,8 @@ func (n PidMode) IsHost() bool {
 
 // IsContainer indicates whether the container uses a container's pid namespace.
 func (n PidMode) IsContainer() bool {
-	typ, _, hasName := strings.Cut(string(n), ":")
-	return hasName && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // Valid indicates whether the pid namespace is valid.
@@ -328,9 +334,9 @@ func (n PidMode) Valid() bool {
 
 // Container returns the name of the container whose pid namespace is going to be used.
 func (n PidMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -360,15 +366,15 @@ func (n NetworkMode) IsPrivate() bool {
 
 // IsContainer indicates whether container uses a container network stack.
 func (n NetworkMode) IsContainer() bool {
-	typ, _, hasName := strings.Cut(string(n), ":")
-	return hasName && typ == containerType
+	parts := strings.SplitN(string(n), ":", 2)
+	return len(parts) > 1 && parts[0] == containerType
 }
 
 // Container is the id of the container which network this container is connected to.
 func (n NetworkMode) Container() string {
-	typ, name, hasName := strings.Cut(string(n), ":")
-	if hasName && typ == containerType {
-		return name
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 && parts[0] == containerType {
+		return parts[1]
 	}
 	return ""
 }
@@ -403,8 +409,11 @@ func (n NetworkMode) IsNS() bool {
 
 // NS gets the path associated with a ns:<path> network ns
 func (n NetworkMode) NS() string {
-	_, path, _ := strings.Cut(string(n), ":")
-	return path
+	parts := strings.SplitN(string(n), ":", 2)
+	if len(parts) > 1 {
+		return parts[1]
+	}
+	return ""
 }
 
 // IsPod returns whether the network refers to pod networking
diff --git a/pkg/rctl/rctl.go b/pkg/rctl/rctl.go
index 75588c79c6..54ccf40b1b 100644
--- a/pkg/rctl/rctl.go
+++ b/pkg/rctl/rctl.go
@@ -31,8 +31,9 @@ func GetRacct(filter string) (map[string]uint64, error) {
 	entries := strings.Split(string(buf[:len]), ",")
 	res := make(map[string]uint64)
 	for _, entry := range entries {
-		key, valstr, _ := strings.Cut(entry, "=")
-		val, err := strconv.ParseUint(valstr, 10, 0)
+		kv := strings.SplitN(entry, "=", 2)
+		key := kv[0]
+		val, err := strconv.ParseUint(kv[1], 10, 0)
 		if err != nil {
 			logrus.Warnf("unexpected rctl entry, ignoring: %s", entry)
 		}
diff --git a/pkg/specgen/generate/container.go b/pkg/specgen/generate/container.go
index 11541ab809..4471942f24 100644
--- a/pkg/specgen/generate/container.go
+++ b/pkg/specgen/generate/container.go
@@ -236,8 +236,13 @@ func CompleteSpec(ctx context.Context, r *libpod.Runtime, s *specgen.SpecGenerat
 		}
 	}
 
-	for _, annotation := range rtc.Containers.Annotations.Get() {
-		k, v, _ := strings.Cut(annotation, "=")
+	for _, v := range rtc.Containers.Annotations.Get() {
+		split := strings.SplitN(v, "=", 2)
+		k := split[0]
+		v := ""
+		if len(split) == 2 {
+			v = split[1]
+		}
 		annotations[k] = v
 	}
 	// now pass in the values from client
@@ -351,9 +356,9 @@ func ConfigToSpec(rt *libpod.Runtime, specg *specgen.SpecGenerator, containerID
 		if conf.Spec.Process != nil && conf.Spec.Process.Env != nil {
 			env := make(map[string]string)
 			for _, entry := range conf.Spec.Process.Env {
-				key, val, hasVal := strings.Cut(entry, "=")
-				if hasVal {
-					env[key] = val
+				split := strings.SplitN(entry, "=", 2)
+				if len(split) == 2 {
+					env[split[0]] = split[1]
 				}
 			}
 			specg.Env = env
diff --git a/pkg/specgen/generate/container_create.go b/pkg/specgen/generate/container_create.go
index 09483bbb9b..c0878d5000 100644
--- a/pkg/specgen/generate/container_create.go
+++ b/pkg/specgen/generate/container_create.go
@@ -54,12 +54,12 @@ func MakeContainer(ctx context.Context, rt *libpod.Runtime, s *specgen.SpecGener
 			s.ResourceLimits.Unified = make(map[string]string)
 		}
 		for _, cgroupConf := range rtc.Containers.CgroupConf.Get() {
-			key, val, hasVal := strings.Cut(cgroupConf, "=")
-			if !hasVal {
-				return nil, nil, nil, fmt.Errorf("CgroupConf %s from containers.conf invalid, must be name=value", cgroupConf)
+			cgr := strings.SplitN(cgroupConf, "=", 2)
+			if len(cgr) != 2 {
+				return nil, nil, nil, fmt.Errorf("CgroupConf %q from containers.conf invalid, must be name=value", cgr)
 			}
-			if _, ok := s.ResourceLimits.Unified[key]; !ok {
-				s.ResourceLimits.Unified[key] = val
+			if _, ok := s.ResourceLimits.Unified[cgr[0]]; !ok {
+				s.ResourceLimits.Unified[cgr[0]] = cgr[1]
 			}
 		}
 	}
diff --git a/pkg/specgen/generate/kube/kube.go b/pkg/specgen/generate/kube/kube.go
index f10fc21c68..930f1497f0 100644
--- a/pkg/specgen/generate/kube/kube.go
+++ b/pkg/specgen/generate/kube/kube.go
@@ -221,29 +221,29 @@ func ToSpecGen(ctx context.Context, opts *CtrSpecGenOptions) (*specgen.SpecGener
 
 	s.LogConfiguration.Options = make(map[string]string)
 	for _, o := range opts.LogOptions {
-		opt, val, hasVal := strings.Cut(o, "=")
-		if !hasVal {
+		split := strings.SplitN(o, "=", 2)
+		if len(split) < 2 {
 			return nil, fmt.Errorf("invalid log option %q", o)
 		}
-		switch strings.ToLower(opt) {
+		switch strings.ToLower(split[0]) {
 		case "driver":
-			s.LogConfiguration.Driver = val
+			s.LogConfiguration.Driver = split[1]
 		case "path":
-			s.LogConfiguration.Path = val
+			s.LogConfiguration.Path = split[1]
 		case "max-size":
-			logSize, err := units.FromHumanSize(val)
+			logSize, err := units.FromHumanSize(split[1])
 			if err != nil {
 				return nil, err
 			}
 			s.LogConfiguration.Size = logSize
 		default:
-			switch len(val) {
+			switch len(split[1]) {
 			case 0:
 				return nil, fmt.Errorf("invalid log option: %w", define.ErrInvalidArg)
 			default:
 				// tags for journald only
 				if s.LogConfiguration.Driver == "" || s.LogConfiguration.Driver == define.JournaldLogging {
-					s.LogConfiguration.Options[opt] = val
+					s.LogConfiguration.Options[split[0]] = split[1]
 				} else {
 					logrus.Warnf("Can only set tags with journald log driver but driver is %q", s.LogConfiguration.Driver)
 				}
@@ -434,8 +434,8 @@ func ToSpecGen(ctx context.Context, opts *CtrSpecGenOptions) (*specgen.SpecGener
 	// Environment Variables
 	envs := map[string]string{}
 	for _, env := range imageData.Config.Env {
-		key, val, _ := strings.Cut(env, "=")
-		envs[key] = val
+		keyval := strings.SplitN(env, "=", 2)
+		envs[keyval[0]] = keyval[1]
 	}
 
 	for _, env := range opts.Container.Env {
diff --git a/pkg/specgen/generate/storage.go b/pkg/specgen/generate/storage.go
index 8c65783b43..fa66359069 100644
--- a/pkg/specgen/generate/storage.go
+++ b/pkg/specgen/generate/storage.go
@@ -262,9 +262,9 @@ func getVolumesFrom(volumesFrom []string, runtime *libpod.Runtime) (map[string]s
 	for _, volume := range volumesFrom {
 		var options []string
 
-		idOrName, volOpts, hasVolOpts := strings.Cut(volume, ":")
-		if hasVolOpts {
-			splitOpts := strings.Split(volOpts, ",")
+		splitVol := strings.SplitN(volume, ":", 2)
+		if len(splitVol) == 2 {
+			splitOpts := strings.Split(splitVol[1], ",")
 			setRORW := false
 			setZ := false
 			for _, opt := range splitOpts {
@@ -286,9 +286,9 @@ func getVolumesFrom(volumesFrom []string, runtime *libpod.Runtime) (map[string]s
 			options = splitOpts
 		}
 
-		ctr, err := runtime.LookupContainer(idOrName)
+		ctr, err := runtime.LookupContainer(splitVol[0])
 		if err != nil {
-			return nil, nil, fmt.Errorf("looking up container %q for volumes-from: %w", idOrName, err)
+			return nil, nil, fmt.Errorf("looking up container %q for volumes-from: %w", splitVol[0], err)
 		}
 
 		logrus.Debugf("Adding volumes from container %s", ctr.ID())
diff --git a/pkg/specgen/namespaces.go b/pkg/specgen/namespaces.go
index 4b8a6bee41..04d4b08f43 100644
--- a/pkg/specgen/namespaces.go
+++ b/pkg/specgen/namespaces.go
@@ -230,23 +230,29 @@ func (n *Namespace) validate() error {
 // function.
 func ParseNamespace(ns string) (Namespace, error) {
 	toReturn := Namespace{}
-	switch ns {
-	case "pod":
+	switch {
+	case ns == "pod":
 		toReturn.NSMode = FromPod
-	case "host":
+	case ns == "host":
 		toReturn.NSMode = Host
-	case "private", "":
+	case ns == "private", ns == "":
 		toReturn.NSMode = Private
-	default:
-		if value, ok := strings.CutPrefix(ns, "ns:"); ok {
-			toReturn.NSMode = Path
-			toReturn.Value = value
-		} else if value, ok := strings.CutPrefix(ns, "container:"); ok {
-			toReturn.NSMode = FromContainer
-			toReturn.Value = value
-		} else {
-			return toReturn, fmt.Errorf("unrecognized namespace mode %s passed", ns)
+	case strings.HasPrefix(ns, "ns:"):
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, fmt.Errorf("must provide a path to a namespace when specifying \"ns:\"")
 		}
+		toReturn.NSMode = Path
+		toReturn.Value = split[1]
+	case strings.HasPrefix(ns, "container:"):
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, fmt.Errorf("must provide name or ID or a container when specifying \"container:\"")
+		}
+		toReturn.NSMode = FromContainer
+		toReturn.Value = split[1]
+	default:
+		return toReturn, fmt.Errorf("unrecognized namespace mode %s passed", ns)
 	}
 
 	return toReturn, nil
@@ -296,32 +302,37 @@ func ParseIPCNamespace(ns string) (Namespace, error) {
 // form.
 func ParseUserNamespace(ns string) (Namespace, error) {
 	toReturn := Namespace{}
-	switch ns {
-	case "auto":
+	switch {
+	case ns == "auto":
+		toReturn.NSMode = Auto
+		return toReturn, nil
+	case strings.HasPrefix(ns, "auto:"):
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, errors.New("invalid setting for auto: mode")
+		}
 		toReturn.NSMode = Auto
+		toReturn.Value = split[1]
 		return toReturn, nil
-	case "keep-id":
+	case ns == "keep-id":
 		toReturn.NSMode = KeepID
 		return toReturn, nil
-	case "nomap":
+	case strings.HasPrefix(ns, "keep-id:"):
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, errors.New("invalid setting for keep-id: mode")
+		}
+		toReturn.NSMode = KeepID
+		toReturn.Value = split[1]
+		return toReturn, nil
+	case ns == "nomap":
 		toReturn.NSMode = NoMap
 		return toReturn, nil
-	case "":
+	case ns == "":
 		toReturn.NSMode = Host
 		return toReturn, nil
-	default:
-		if value, ok := strings.CutPrefix(ns, "auto:"); ok {
-			toReturn.NSMode = Auto
-			toReturn.Value = value
-			return toReturn, nil
-		} else if value, ok := strings.CutPrefix(ns, "keep-id:"); ok {
-			toReturn.NSMode = KeepID
-			toReturn.Value = value
-			return toReturn, nil
-		} else {
-			return ParseNamespace(ns)
-		}
 	}
+	return ParseNamespace(ns)
 }
 
 // ParseNetworkFlag parses a network string slice into the network options
@@ -341,10 +352,10 @@ func ParseNetworkFlag(networks []string, pastaNetworkNameExists bool) (Namespace
 
 	switch {
 	case ns == string(Slirp), strings.HasPrefix(ns, string(Slirp)+":"):
-		key, options, hasOptions := strings.Cut(ns, ":")
-		if hasOptions {
+		parts := strings.SplitN(ns, ":", 2)
+		if len(parts) > 1 {
 			networkOptions = make(map[string][]string)
-			networkOptions[key] = strings.Split(options, ",")
+			networkOptions[parts[0]] = strings.Split(parts[1], ",")
 		}
 		toReturn.NSMode = Slirp
 	case ns == string(FromPod):
@@ -353,11 +364,11 @@ func ParseNetworkFlag(networks []string, pastaNetworkNameExists bool) (Namespace
 		toReturn.NSMode = Private
 	case ns == string(Bridge), strings.HasPrefix(ns, string(Bridge)+":"):
 		toReturn.NSMode = Bridge
-		_, options, hasOptions := strings.Cut(ns, ":")
+		parts := strings.SplitN(ns, ":", 2)
 		netOpts := types.PerNetworkOptions{}
-		if hasOptions {
+		if len(parts) > 1 {
 			var err error
-			netOpts, err = parseBridgeNetworkOptions(options)
+			netOpts, err = parseBridgeNetworkOptions(parts[1])
 			if err != nil {
 				return toReturn, nil, nil, err
 			}
@@ -370,23 +381,30 @@ func ParseNetworkFlag(networks []string, pastaNetworkNameExists bool) (Namespace
 	case ns == string(Host):
 		toReturn.NSMode = Host
 	case strings.HasPrefix(ns, "ns:"):
-		_, value, _ := strings.Cut(ns, ":")
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, nil, nil, errors.New("must provide a path to a namespace when specifying \"ns:\"")
+		}
 		toReturn.NSMode = Path
-		toReturn.Value = value
+		toReturn.Value = split[1]
 	case strings.HasPrefix(ns, string(FromContainer)+":"):
-		_, value, _ := strings.Cut(ns, ":")
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, nil, nil, errors.New("must provide name or ID or a container when specifying \"container:\"")
+		}
 		toReturn.NSMode = FromContainer
-		toReturn.Value = value
+		toReturn.Value = split[1]
 	case ns == string(Pasta), strings.HasPrefix(ns, string(Pasta)+":"):
-		key, options, hasOptions := strings.Cut(ns, ":")
+		var parts []string
 
 		if pastaNetworkNameExists {
 			goto nextCase
 		}
 
-		if hasOptions {
+		parts = strings.SplitN(ns, ":", 2)
+		if len(parts) > 1 {
 			networkOptions = make(map[string][]string)
-			networkOptions[key] = strings.Split(options, ",")
+			networkOptions[parts[0]] = strings.Split(parts[1], ",")
 		}
 		toReturn.NSMode = Pasta
 		break
@@ -394,22 +412,22 @@ func ParseNetworkFlag(networks []string, pastaNetworkNameExists bool) (Namespace
 		fallthrough
 	default:
 		// we should have a normal network
-		name, options, hasOptions := strings.Cut(ns, ":")
-		if hasOptions {
-			if name == "" {
-				return toReturn, nil, nil, errors.New("network name cannot be empty")
-			}
-			netOpts, err := parseBridgeNetworkOptions(options)
-			if err != nil {
-				return toReturn, nil, nil, fmt.Errorf("invalid option for network %s: %w", name, err)
-			}
-			podmanNetworks[name] = netOpts
-		} else {
+		parts := strings.SplitN(ns, ":", 2)
+		if len(parts) == 1 {
 			// Assume we have been given a comma separated list of networks for backwards compat.
 			networkList := strings.Split(ns, ",")
 			for _, net := range networkList {
 				podmanNetworks[net] = types.PerNetworkOptions{}
 			}
+		} else {
+			if parts[0] == "" {
+				return toReturn, nil, nil, errors.New("network name cannot be empty")
+			}
+			netOpts, err := parseBridgeNetworkOptions(parts[1])
+			if err != nil {
+				return toReturn, nil, nil, fmt.Errorf("invalid option for network %s: %w", parts[0], err)
+			}
+			podmanNetworks[parts[0]] = netOpts
 		}
 
 		// networks need bridge mode
@@ -422,24 +440,24 @@ func ParseNetworkFlag(networks []string, pastaNetworkNameExists bool) (Namespace
 		}
 
 		for _, network := range networks[1:] {
-			name, options, hasOptions := strings.Cut(network, ":")
-			if name == "" {
+			parts := strings.SplitN(network, ":", 2)
+			if parts[0] == "" {
 				return toReturn, nil, nil, fmt.Errorf("network name cannot be empty: %w", define.ErrInvalidArg)
 			}
 			// TODO (5.0): Don't accept string(Pasta) here once we drop pastaNetworkNameExists
 			if slices.Contains([]string{string(Bridge), string(Slirp), string(FromPod), string(NoNetwork),
-				string(Default), string(Private), string(Path), string(FromContainer), string(Host)}, name) {
-				return toReturn, nil, nil, fmt.Errorf("can only set extra network names, selected mode %s conflicts with bridge: %w", name, define.ErrInvalidArg)
+				string(Default), string(Private), string(Path), string(FromContainer), string(Host)}, parts[0]) {
+				return toReturn, nil, nil, fmt.Errorf("can only set extra network names, selected mode %s conflicts with bridge: %w", parts[0], define.ErrInvalidArg)
 			}
 			netOpts := types.PerNetworkOptions{}
-			if hasOptions {
+			if len(parts) > 1 {
 				var err error
-				netOpts, err = parseBridgeNetworkOptions(options)
+				netOpts, err = parseBridgeNetworkOptions(parts[1])
 				if err != nil {
-					return toReturn, nil, nil, fmt.Errorf("invalid option for network %s: %w", name, err)
+					return toReturn, nil, nil, fmt.Errorf("invalid option for network %s: %w", parts[0], err)
 				}
 			}
-			podmanNetworks[name] = netOpts
+			podmanNetworks[parts[0]] = netOpts
 		}
 	}
 
@@ -453,36 +471,36 @@ func parseBridgeNetworkOptions(opts string) (types.PerNetworkOptions, error) {
 	}
 	allopts := strings.Split(opts, ",")
 	for _, opt := range allopts {
-		name, value, _ := strings.Cut(opt, "=")
-		switch name {
+		split := strings.SplitN(opt, "=", 2)
+		switch split[0] {
 		case "ip", "ip6":
-			ip := net.ParseIP(value)
+			ip := net.ParseIP(split[1])
 			if ip == nil {
-				return netOpts, fmt.Errorf("invalid ip address %q", value)
+				return netOpts, fmt.Errorf("invalid ip address %q", split[1])
 			}
 			netOpts.StaticIPs = append(netOpts.StaticIPs, ip)
 
 		case "mac":
-			mac, err := net.ParseMAC(value)
+			mac, err := net.ParseMAC(split[1])
 			if err != nil {
 				return netOpts, err
 			}
 			netOpts.StaticMAC = types.HardwareAddr(mac)
 
 		case "alias":
-			if value == "" {
+			if split[1] == "" {
 				return netOpts, errors.New("alias cannot be empty")
 			}
-			netOpts.Aliases = append(netOpts.Aliases, value)
+			netOpts.Aliases = append(netOpts.Aliases, split[1])
 
 		case "interface_name":
-			if value == "" {
+			if split[1] == "" {
 				return netOpts, errors.New("interface_name cannot be empty")
 			}
-			netOpts.InterfaceName = value
+			netOpts.InterfaceName = split[1]
 
 		default:
-			return netOpts, fmt.Errorf("unknown bridge network option: %s", name)
+			return netOpts, fmt.Errorf("unknown bridge network option: %s", split[0])
 		}
 	}
 	return netOpts, nil
diff --git a/pkg/specgenutil/specgen.go b/pkg/specgenutil/specgen.go
index e9e90cae43..306a19b394 100644
--- a/pkg/specgenutil/specgen.go
+++ b/pkg/specgenutil/specgen.go
@@ -502,11 +502,11 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 
 	// Last, add user annotations
 	for _, annotation := range c.Annotation {
-		key, val, hasVal := strings.Cut(annotation, "=")
-		if !hasVal {
+		splitAnnotation := strings.SplitN(annotation, "=", 2)
+		if len(splitAnnotation) < 2 {
 			return errors.New("annotations must be formatted KEY=VALUE")
 		}
-		annotations[key] = val
+		annotations[splitAnnotation[0]] = splitAnnotation[1]
 	}
 	if len(s.Annotations) == 0 {
 		s.Annotations = annotations
@@ -515,11 +515,11 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 	if len(c.StorageOpts) > 0 {
 		opts := make(map[string]string, len(c.StorageOpts))
 		for _, opt := range c.StorageOpts {
-			key, val, hasVal := strings.Cut(opt, "=")
-			if !hasVal {
+			split := strings.SplitN(opt, "=", 2)
+			if len(split) != 2 {
 				return errors.New("storage-opt must be formatted KEY=VALUE")
 			}
-			opts[key] = val
+			opts[split[0]] = split[1]
 		}
 		s.StorageOpts = opts
 	}
@@ -673,11 +673,11 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 	// check if key=value and convert
 	sysmap := make(map[string]string)
 	for _, ctl := range c.Sysctl {
-		key, val, hasVal := strings.Cut(ctl, "=")
-		if !hasVal {
+		splitCtl := strings.SplitN(ctl, "=", 2)
+		if len(splitCtl) < 2 {
 			return fmt.Errorf("invalid sysctl value %q", ctl)
 		}
-		sysmap[key] = val
+		sysmap[splitCtl[0]] = splitCtl[1]
 	}
 	if len(s.Sysctl) == 0 || len(c.Sysctl) != 0 {
 		s.Sysctl = sysmap
@@ -690,51 +690,48 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 	for _, opt := range c.SecurityOpt {
 		// Docker deprecated the ":" syntax but still supports it,
 		// so we need to as well
-		var key, val string
-		var hasVal bool
+		var con []string
 		if strings.Contains(opt, "=") {
-			key, val, hasVal = strings.Cut(opt, "=")
+			con = strings.SplitN(opt, "=", 2)
 		} else {
-			key, val, hasVal = strings.Cut(opt, ":")
+			con = strings.SplitN(opt, ":", 2)
 		}
-		if !hasVal &&
-			key != "no-new-privileges" {
+		if len(con) != 2 &&
+			con[0] != "no-new-privileges" {
 			return fmt.Errorf("invalid --security-opt 1: %q", opt)
 		}
-		switch key {
+		switch con[0] {
 		case "apparmor":
-			s.ContainerSecurityConfig.ApparmorProfile = val
-			s.Annotations[define.InspectAnnotationApparmor] = val
+			s.ContainerSecurityConfig.ApparmorProfile = con[1]
+			s.Annotations[define.InspectAnnotationApparmor] = con[1]
 		case "label":
-			if val == "nested" {
+			if con[1] == "nested" {
 				s.ContainerSecurityConfig.LabelNested = true
 				continue
 			}
 			// TODO selinux opts and label opts are the same thing
-			s.ContainerSecurityConfig.SelinuxOpts = append(s.ContainerSecurityConfig.SelinuxOpts, val)
+			s.ContainerSecurityConfig.SelinuxOpts = append(s.ContainerSecurityConfig.SelinuxOpts, con[1])
 			s.Annotations[define.InspectAnnotationLabel] = strings.Join(s.ContainerSecurityConfig.SelinuxOpts, ",label=")
 		case "mask":
-			s.ContainerSecurityConfig.Mask = append(s.ContainerSecurityConfig.Mask, strings.Split(val, ":")...)
+			s.ContainerSecurityConfig.Mask = append(s.ContainerSecurityConfig.Mask, strings.Split(con[1], ":")...)
 		case "proc-opts":
-			s.ProcOpts = strings.Split(val, ",")
+			s.ProcOpts = strings.Split(con[1], ",")
 		case "seccomp":
-			s.SeccompProfilePath = val
-			s.Annotations[define.InspectAnnotationSeccomp] = val
+			s.SeccompProfilePath = con[1]
+			s.Annotations[define.InspectAnnotationSeccomp] = con[1]
 			// this option is for docker compatibility, it is the same as unmask=ALL
 		case "systempaths":
-			if val == "unconfined" {
+			if con[1] == "unconfined" {
 				s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, []string{"ALL"}...)
 			} else {
-				return fmt.Errorf("invalid systempaths option %q, only `unconfined` is supported", val)
+				return fmt.Errorf("invalid systempaths option %q, only `unconfined` is supported", con[1])
 			}
 		case "unmask":
-			if hasVal {
-				s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, val)
-			}
+			s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, con[1:]...)
 		case "no-new-privileges":
 			noNewPrivileges := true
-			if hasVal {
-				noNewPrivileges, err = strconv.ParseBool(val)
+			if len(con) == 2 {
+				noNewPrivileges, err = strconv.ParseBool(con[1])
 				if err != nil {
 					return fmt.Errorf("invalid --security-opt 2: %q", opt)
 				}
@@ -816,23 +813,23 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 
 	logOpts := make(map[string]string)
 	for _, o := range c.LogOptions {
-		key, val, hasVal := strings.Cut(o, "=")
-		if !hasVal {
+		split := strings.SplitN(o, "=", 2)
+		if len(split) < 2 {
 			return fmt.Errorf("invalid log option %q", o)
 		}
-		switch strings.ToLower(key) {
+		switch strings.ToLower(split[0]) {
 		case "driver":
-			s.LogConfiguration.Driver = val
+			s.LogConfiguration.Driver = split[1]
 		case "path":
-			s.LogConfiguration.Path = val
+			s.LogConfiguration.Path = split[1]
 		case "max-size":
-			logSize, err := units.FromHumanSize(val)
+			logSize, err := units.FromHumanSize(split[1])
 			if err != nil {
 				return err
 			}
 			s.LogConfiguration.Size = logSize
 		default:
-			logOpts[key] = val
+			logOpts[split[0]] = split[1]
 		}
 	}
 	if len(s.LogConfiguration.Options) == 0 || len(c.LogOptions) != 0 {
@@ -1007,23 +1004,23 @@ func makeHealthCheckFromCli(inCmd, interval string, retries uint, timeout, start
 
 func parseWeightDevices(weightDevs []string) (map[string]specs.LinuxWeightDevice, error) {
 	wd := make(map[string]specs.LinuxWeightDevice)
-	for _, dev := range weightDevs {
-		key, val, hasVal := strings.Cut(dev, ":")
-		if !hasVal {
-			return nil, fmt.Errorf("bad format: %s", dev)
+	for _, val := range weightDevs {
+		split := strings.SplitN(val, ":", 2)
+		if len(split) != 2 {
+			return nil, fmt.Errorf("bad format: %s", val)
 		}
-		if !strings.HasPrefix(key, "/dev/") {
-			return nil, fmt.Errorf("bad format for device path: %s", dev)
+		if !strings.HasPrefix(split[0], "/dev/") {
+			return nil, fmt.Errorf("bad format for device path: %s", val)
 		}
-		weight, err := strconv.ParseUint(val, 10, 0)
+		weight, err := strconv.ParseUint(split[1], 10, 0)
 		if err != nil {
-			return nil, fmt.Errorf("invalid weight for device: %s", dev)
+			return nil, fmt.Errorf("invalid weight for device: %s", val)
 		}
 		if weight > 0 && (weight < 10 || weight > 1000) {
-			return nil, fmt.Errorf("invalid weight for device: %s", dev)
+			return nil, fmt.Errorf("invalid weight for device: %s", val)
 		}
 		w := uint16(weight)
-		wd[key] = specs.LinuxWeightDevice{
+		wd[split[0]] = specs.LinuxWeightDevice{
 			Weight:     &w,
 			LeafWeight: nil,
 		}
@@ -1033,41 +1030,41 @@ func parseWeightDevices(weightDevs []string) (map[string]specs.LinuxWeightDevice
 
 func parseThrottleBPSDevices(bpsDevices []string) (map[string]specs.LinuxThrottleDevice, error) {
 	td := make(map[string]specs.LinuxThrottleDevice)
-	for _, dev := range bpsDevices {
-		key, val, hasVal := strings.Cut(dev, ":")
-		if !hasVal {
-			return nil, fmt.Errorf("bad format: %s", dev)
+	for _, val := range bpsDevices {
+		split := strings.SplitN(val, ":", 2)
+		if len(split) != 2 {
+			return nil, fmt.Errorf("bad format: %s", val)
 		}
-		if !strings.HasPrefix(key, "/dev/") {
-			return nil, fmt.Errorf("bad format for device path: %s", dev)
+		if !strings.HasPrefix(split[0], "/dev/") {
+			return nil, fmt.Errorf("bad format for device path: %s", val)
 		}
-		rate, err := units.RAMInBytes(val)
+		rate, err := units.RAMInBytes(split[1])
 		if err != nil {
-			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", dev)
+			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", val)
 		}
 		if rate < 0 {
-			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", dev)
+			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", val)
 		}
-		td[key] = specs.LinuxThrottleDevice{Rate: uint64(rate)}
+		td[split[0]] = specs.LinuxThrottleDevice{Rate: uint64(rate)}
 	}
 	return td, nil
 }
 
 func parseThrottleIOPsDevices(iopsDevices []string) (map[string]specs.LinuxThrottleDevice, error) {
 	td := make(map[string]specs.LinuxThrottleDevice)
-	for _, dev := range iopsDevices {
-		key, val, hasVal := strings.Cut(dev, ":")
-		if !hasVal {
-			return nil, fmt.Errorf("bad format: %s", dev)
+	for _, val := range iopsDevices {
+		split := strings.SplitN(val, ":", 2)
+		if len(split) != 2 {
+			return nil, fmt.Errorf("bad format: %s", val)
 		}
-		if !strings.HasPrefix(key, "/dev/") {
-			return nil, fmt.Errorf("bad format for device path: %s", dev)
+		if !strings.HasPrefix(split[0], "/dev/") {
+			return nil, fmt.Errorf("bad format for device path: %s", val)
 		}
-		rate, err := strconv.ParseUint(val, 10, 64)
+		rate, err := strconv.ParseUint(split[1], 10, 64)
 		if err != nil {
-			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>. Number must be a positive integer", dev)
+			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>. Number must be a positive integer", val)
 		}
-		td[key] = specs.LinuxThrottleDevice{Rate: rate}
+		td[split[0]] = specs.LinuxThrottleDevice{Rate: rate}
 	}
 	return td, nil
 }
@@ -1106,42 +1103,42 @@ func parseSecrets(secrets []string) ([]specgen.Secret, map[string]string, error)
 		}
 
 		for _, val := range split {
-			name, value, hasValue := strings.Cut(val, "=")
-			if !hasValue {
+			kv := strings.SplitN(val, "=", 2)
+			if len(kv) < 2 {
 				return nil, nil, fmt.Errorf("option %s must be in form option=value: %w", val, secretParseError)
 			}
-			switch name {
+			switch kv[0] {
 			case "source":
-				source = value
+				source = kv[1]
 			case "type":
 				if secretType != "" {
 					return nil, nil, fmt.Errorf("cannot set more than one secret type: %w", secretParseError)
 				}
-				if value != "mount" && value != "env" {
-					return nil, nil, fmt.Errorf("type %s is invalid: %w", value, secretParseError)
+				if kv[1] != "mount" && kv[1] != "env" {
+					return nil, nil, fmt.Errorf("type %s is invalid: %w", kv[1], secretParseError)
 				}
-				secretType = value
+				secretType = kv[1]
 			case "target":
-				target = value
+				target = kv[1]
 			case "mode":
 				mountOnly = true
-				mode64, err := strconv.ParseUint(value, 8, 32)
+				mode64, err := strconv.ParseUint(kv[1], 8, 32)
 				if err != nil {
-					return nil, nil, fmt.Errorf("mode %s invalid: %w", value, secretParseError)
+					return nil, nil, fmt.Errorf("mode %s invalid: %w", kv[1], secretParseError)
 				}
 				mode = uint32(mode64)
 			case "uid", "UID":
 				mountOnly = true
-				uid64, err := strconv.ParseUint(value, 10, 32)
+				uid64, err := strconv.ParseUint(kv[1], 10, 32)
 				if err != nil {
-					return nil, nil, fmt.Errorf("UID %s invalid: %w", value, secretParseError)
+					return nil, nil, fmt.Errorf("UID %s invalid: %w", kv[1], secretParseError)
 				}
 				uid = uint32(uid64)
 			case "gid", "GID":
 				mountOnly = true
-				gid64, err := strconv.ParseUint(value, 10, 32)
+				gid64, err := strconv.ParseUint(kv[1], 10, 32)
 				if err != nil {
-					return nil, nil, fmt.Errorf("GID %s invalid: %w", value, secretParseError)
+					return nil, nil, fmt.Errorf("GID %s invalid: %w", kv[1], secretParseError)
 				}
 				gid = uint32(gid64)
 
@@ -1206,17 +1203,17 @@ func parseLinuxResourcesDeviceAccess(device string) (specs.LinuxDeviceCgroup, er
 		return specs.LinuxDeviceCgroup{}, fmt.Errorf("invalid device type in device-access-add: %s", devType)
 	}
 
-	majorNumber, minorNumber, hasMinor := strings.Cut(value[1], ":")
-	if majorNumber != "*" {
-		i, err := strconv.ParseUint(majorNumber, 10, 64)
+	number := strings.SplitN(value[1], ":", 2)
+	if number[0] != "*" {
+		i, err := strconv.ParseUint(number[0], 10, 64)
 		if err != nil {
 			return specs.LinuxDeviceCgroup{}, err
 		}
 		m := int64(i)
 		major = &m
 	}
-	if hasMinor && minorNumber != "*" {
-		i, err := strconv.ParseUint(minorNumber, 10, 64)
+	if len(number) == 2 && number[1] != "*" {
+		i, err := strconv.ParseUint(number[1], 10, 64)
 		if err != nil {
 			return specs.LinuxDeviceCgroup{}, err
 		}
@@ -1266,11 +1263,11 @@ func GetResources(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions)
 
 	unifieds := make(map[string]string)
 	for _, unified := range c.CgroupConf {
-		key, val, hasVal := strings.Cut(unified, "=")
-		if !hasVal {
+		splitUnified := strings.SplitN(unified, "=", 2)
+		if len(splitUnified) < 2 {
 			return nil, errors.New("--cgroup-conf must be formatted KEY=VALUE")
 		}
-		unifieds[key] = val
+		unifieds[splitUnified[0]] = splitUnified[1]
 	}
 	if len(unifieds) > 0 {
 		s.ResourceLimits.Unified = unifieds
diff --git a/pkg/specgenutil/volumes.go b/pkg/specgenutil/volumes.go
index 5155e779fd..4e663f6e73 100644
--- a/pkg/specgenutil/volumes.go
+++ b/pkg/specgenutil/volumes.go
@@ -256,29 +256,29 @@ func parseMountOptions(mountType string, args []string) (*spec.Mount, error) {
 	var setTmpcopyup, setRORW, setSuid, setDev, setExec, setRelabel, setOwnership, setSwap bool
 
 	mnt := spec.Mount{}
-	for _, arg := range args {
-		name, value, hasValue := strings.Cut(arg, "=")
-		switch name {
+	for _, val := range args {
+		kv := strings.SplitN(val, "=", 2)
+		switch kv[0] {
 		case "bind-nonrecursive":
 			if mountType != define.TypeBind {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
 			mnt.Options = append(mnt.Options, define.TypeBind)
 		case "bind-propagation":
 			if mountType != define.TypeBind {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			mnt.Options = append(mnt.Options, value)
+			mnt.Options = append(mnt.Options, kv[1])
 		case "consistency":
 			// Often used on MACs and mistakenly on Linux platforms.
 			// Since Docker ignores this option so shall we.
 			continue
 		case "idmap":
-			if hasValue {
-				mnt.Options = append(mnt.Options, fmt.Sprintf("idmap=%s", value))
+			if len(kv) > 1 {
+				mnt.Options = append(mnt.Options, fmt.Sprintf("idmap=%s", kv[1]))
 			} else {
 				mnt.Options = append(mnt.Options, "idmap")
 			}
@@ -294,41 +294,42 @@ func parseMountOptions(mountType string, args []string) (*spec.Mount, error) {
 			// ro=[true|false]
 			// rw
 			// rw=[true|false]
-			if name == "readonly" {
-				name = "ro"
-			}
-			if hasValue {
-				switch strings.ToLower(value) {
+			if kv[0] == "readonly" {
+				kv[0] = "ro"
+			}
+			switch len(kv) {
+			case 1:
+				mnt.Options = append(mnt.Options, kv[0])
+			case 2:
+				switch strings.ToLower(kv[1]) {
 				case "true":
-					mnt.Options = append(mnt.Options, name)
+					mnt.Options = append(mnt.Options, kv[0])
 				case "false":
 					// Set the opposite only for rw
 					// ro's opposite is the default
-					if name == "rw" {
+					if kv[0] == "rw" {
 						mnt.Options = append(mnt.Options, "ro")
 					}
 				}
-			} else {
-				mnt.Options = append(mnt.Options, name)
 			}
 		case "nodev", "dev":
 			if setDev {
 				return nil, fmt.Errorf("cannot pass 'nodev' and 'dev' mnt.Options more than once: %w", errOptionArg)
 			}
 			setDev = true
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "noexec", "exec":
 			if setExec {
 				return nil, fmt.Errorf("cannot pass 'noexec' and 'exec' mnt.Options more than once: %w", errOptionArg)
 			}
 			setExec = true
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "nosuid", "suid":
 			if setSuid {
 				return nil, fmt.Errorf("cannot pass 'nosuid' and 'suid' mnt.Options more than once: %w", errOptionArg)
 			}
 			setSuid = true
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "noswap":
 			if setSwap {
 				return nil, fmt.Errorf("cannot pass 'noswap' mnt.Options more than once: %w", errOptionArg)
@@ -337,80 +338,80 @@ func parseMountOptions(mountType string, args []string) (*spec.Mount, error) {
 				return nil, fmt.Errorf("the 'noswap' option is only allowed with rootful tmpfs mounts: %w", errOptionArg)
 			}
 			setSwap = true
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "relabel":
 			if setRelabel {
 				return nil, fmt.Errorf("cannot pass 'relabel' option more than once: %w", errOptionArg)
 			}
 			setRelabel = true
-			if !hasValue {
-				return nil, fmt.Errorf("%s mount option must be 'private' or 'shared': %w", name, util.ErrBadMntOption)
+			if len(kv) != 2 {
+				return nil, fmt.Errorf("%s mount option must be 'private' or 'shared': %w", kv[0], util.ErrBadMntOption)
 			}
-			switch value {
+			switch kv[1] {
 			case "private":
 				mnt.Options = append(mnt.Options, "Z")
 			case "shared":
 				mnt.Options = append(mnt.Options, "z")
 			default:
-				return nil, fmt.Errorf("%s mount option must be 'private' or 'shared': %w", name, util.ErrBadMntOption)
+				return nil, fmt.Errorf("%s mount option must be 'private' or 'shared': %w", kv[0], util.ErrBadMntOption)
 			}
 		case "shared", "rshared", "private", "rprivate", "slave", "rslave", "unbindable", "runbindable", "Z", "z", "no-dereference":
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "src", "source":
 			if mountType == define.TypeTmpfs {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
 			if mnt.Source != "" {
-				return nil, fmt.Errorf("cannot pass %q option more than once: %w", name, errOptionArg)
+				return nil, fmt.Errorf("cannot pass %q option more than once: %w", kv[0], errOptionArg)
 			}
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			if len(value) == 0 {
+			if len(kv[1]) == 0 {
 				return nil, fmt.Errorf("host directory cannot be empty: %w", errOptionArg)
 			}
-			mnt.Source = value
+			mnt.Source = kv[1]
 		case "target", "dst", "destination":
 			if mnt.Destination != "" {
-				return nil, fmt.Errorf("cannot pass %q option more than once: %w", name, errOptionArg)
+				return nil, fmt.Errorf("cannot pass %q option more than once: %w", kv[0], errOptionArg)
 			}
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			if err := parse.ValidateVolumeCtrDir(value); err != nil {
+			if err := parse.ValidateVolumeCtrDir(kv[1]); err != nil {
 				return nil, err
 			}
-			mnt.Destination = unixPathClean(value)
+			mnt.Destination = unixPathClean(kv[1])
 		case "tmpcopyup", "notmpcopyup":
 			if mountType != define.TypeTmpfs {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
 			if setTmpcopyup {
 				return nil, fmt.Errorf("cannot pass 'tmpcopyup' and 'notmpcopyup' mnt.Options more than once: %w", errOptionArg)
 			}
 			setTmpcopyup = true
-			mnt.Options = append(mnt.Options, name)
+			mnt.Options = append(mnt.Options, kv[0])
 		case "tmpfs-mode":
 			if mountType != define.TypeTmpfs {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			mnt.Options = append(mnt.Options, fmt.Sprintf("mode=%s", value))
+			mnt.Options = append(mnt.Options, fmt.Sprintf("mode=%s", kv[1]))
 		case "tmpfs-size":
 			if mountType != define.TypeTmpfs {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			mnt.Options = append(mnt.Options, fmt.Sprintf("size=%s", value))
+			mnt.Options = append(mnt.Options, fmt.Sprintf("size=%s", kv[1]))
 		case "U", "chown":
 			if setOwnership {
 				return nil, fmt.Errorf("cannot pass 'U' or 'chown' option more than once: %w", errOptionArg)
 			}
-			ok, err := validChownFlag(value)
+			ok, err := validChownFlag(val)
 			if err != nil {
 				return nil, err
 			}
@@ -420,16 +421,16 @@ func parseMountOptions(mountType string, args []string) (*spec.Mount, error) {
 			setOwnership = true
 		case "volume-label":
 			if mountType != define.TypeVolume {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
 			return nil, fmt.Errorf("the --volume-label option is not presently implemented")
 		case "volume-opt":
 			if mountType != define.TypeVolume {
-				return nil, fmt.Errorf("%q option not supported for %q mount types", name, mountType)
+				return nil, fmt.Errorf("%q option not supported for %q mount types", kv[0], mountType)
 			}
-			mnt.Options = append(mnt.Options, arg)
+			mnt.Options = append(mnt.Options, val)
 		default:
-			return nil, fmt.Errorf("%s: %w", name, util.ErrBadMntOption)
+			return nil, fmt.Errorf("%s: %w", kv[0], util.ErrBadMntOption)
 		}
 	}
 	if mountType != "glob" && len(mnt.Destination) == 0 {
@@ -533,22 +534,22 @@ func getDevptsMount(args []string) (spec.Mount, error) {
 
 	var setDest bool
 
-	for _, arg := range args {
-		name, value, hasValue := strings.Cut(arg, "=")
-		switch name {
+	for _, val := range args {
+		kv := strings.SplitN(val, "=", 2)
+		switch kv[0] {
 		case "uid", "gid", "mode", "ptxmode", "newinstance", "max":
-			newMount.Options = append(newMount.Options, arg)
+			newMount.Options = append(newMount.Options, val)
 		case "target", "dst", "destination":
-			if !hasValue {
-				return newMount, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return newMount, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			if err := parse.ValidateVolumeCtrDir(value); err != nil {
+			if err := parse.ValidateVolumeCtrDir(kv[1]); err != nil {
 				return newMount, err
 			}
-			newMount.Destination = unixPathClean(value)
+			newMount.Destination = unixPathClean(kv[1])
 			setDest = true
 		default:
-			return newMount, fmt.Errorf("%s: %w", name, util.ErrBadMntOption)
+			return newMount, fmt.Errorf("%s: %w", kv[0], util.ErrBadMntOption)
 		}
 	}
 
@@ -585,37 +586,37 @@ func getNamedVolume(args []string) (*specgen.NamedVolume, error) {
 func getImageVolume(args []string) (*specgen.ImageVolume, error) {
 	newVolume := new(specgen.ImageVolume)
 
-	for _, arg := range args {
-		name, value, hasValue := strings.Cut(arg, "=")
-		switch name {
+	for _, val := range args {
+		kv := strings.SplitN(val, "=", 2)
+		switch kv[0] {
 		case "src", "source":
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			newVolume.Source = value
+			newVolume.Source = kv[1]
 		case "target", "dst", "destination":
-			if !hasValue {
-				return nil, fmt.Errorf("%v: %w", name, errOptionArg)
+			if len(kv) == 1 {
+				return nil, fmt.Errorf("%v: %w", kv[0], errOptionArg)
 			}
-			if err := parse.ValidateVolumeCtrDir(value); err != nil {
+			if err := parse.ValidateVolumeCtrDir(kv[1]); err != nil {
 				return nil, err
 			}
-			newVolume.Destination = unixPathClean(value)
+			newVolume.Destination = unixPathClean(kv[1])
 		case "rw", "readwrite":
-			switch value {
+			switch kv[1] {
 			case "true":
 				newVolume.ReadWrite = true
 			case "false":
 				// Nothing to do. RO is default.
 			default:
-				return nil, fmt.Errorf("invalid rw value %q: %w", value, util.ErrBadMntOption)
+				return nil, fmt.Errorf("invalid rw value %q: %w", kv[1], util.ErrBadMntOption)
 			}
 		case "consistency":
 			// Often used on MACs and mistakenly on Linux platforms.
 			// Since Docker ignores this option so shall we.
 			continue
 		default:
-			return nil, fmt.Errorf("%s: %w", name, util.ErrBadMntOption)
+			return nil, fmt.Errorf("%s: %w", kv[0], util.ErrBadMntOption)
 		}
 	}
 
@@ -659,16 +660,24 @@ func getTmpfsMounts(tmpfsFlag []string) (map[string]spec.Mount, error) {
 }
 
 // validChownFlag ensures that the U or chown flag is correctly used
-func validChownFlag(value string) (bool, error) {
-	// U=[true|false]
-	switch {
-	case strings.EqualFold(value, "true"), value == "":
-		return true, nil
-	case strings.EqualFold(value, "false"):
-		return false, nil
+func validChownFlag(flag string) (bool, error) {
+	kv := strings.SplitN(flag, "=", 2)
+	switch len(kv) {
+	case 1:
+	case 2:
+		// U=[true|false]
+		switch strings.ToLower(kv[1]) {
+		case "true":
+		case "false":
+			return false, nil
+		default:
+			return false, fmt.Errorf("'U' or 'chown' must be set to true or false, instead received %q: %w", kv[1], errOptionArg)
+		}
 	default:
-		return false, fmt.Errorf("'U' or 'chown' must be set to true or false, instead received %q: %w", value, errOptionArg)
+		return false, fmt.Errorf("badly formatted option %q: %w", flag, errOptionArg)
 	}
+
+	return true, nil
 }
 
 // Use path instead of filepath to preserve Unix style paths on Windows
diff --git a/pkg/systemd/generate/containers.go b/pkg/systemd/generate/containers.go
index e7bb77d6db..821c993df4 100644
--- a/pkg/systemd/generate/containers.go
+++ b/pkg/systemd/generate/containers.go
@@ -471,8 +471,8 @@ func executeContainerTemplate(info *containerInfo, options entities.GenerateSyst
 			// because it does try to red the value from the environment
 			if !strings.Contains(env, "=") {
 				for _, containerEnv := range info.containerEnv {
-					key, _, _ := strings.Cut(containerEnv, "=")
-					if key == env {
+					split := strings.SplitN(containerEnv, "=", 2)
+					if split[0] == env {
 						info.ExtraEnvs = append(info.ExtraEnvs, escapeSystemdArg(containerEnv))
 					}
 				}
diff --git a/pkg/systemd/quadlet/quadlet.go b/pkg/systemd/quadlet/quadlet.go
index e18857aa7d..a7845cade9 100644
--- a/pkg/systemd/quadlet/quadlet.go
+++ b/pkg/systemd/quadlet/quadlet.go
@@ -1118,10 +1118,10 @@ func ConvertKube(kube *parser.UnitFile, names map[string]string, isUser bool) (*
 	for _, update := range updateMaps {
 		annotation := fmt.Sprintf("--annotation=%s", autoUpdateLabel)
 		updateType := update
-		annoValue, typ, hasSlash := strings.Cut(update, "/")
-		if hasSlash {
-			annotation = annotation + "/" + annoValue
-			updateType = typ
+		val := strings.SplitN(update, "/", 2)
+		if len(val) == 2 {
+			annotation = annotation + "/" + val[0]
+			updateType = val[1]
 		}
 		execStart.addf("%s=%s", annotation, updateType)
 	}
@@ -1741,13 +1741,13 @@ func resolveContainerMountParams(containerUnitFile, serviceUnitFile *parser.Unit
 	sourceIndex := -1
 	originalSource := ""
 	for i, token := range tokens {
-		key, val, hasVal := strings.Cut(token, "=")
-		if key == "source" || key == "src" {
-			if !hasVal {
+		kv := strings.SplitN(token, "=", 2)
+		if kv[0] == "source" || kv[0] == "src" {
+			if len(kv) < 2 {
 				return "", fmt.Errorf("source parameter does not include a value")
 			}
 			sourceIndex = i
-			originalSource = val
+			originalSource = kv[1]
 		}
 	}
 
diff --git a/pkg/timetype/timestamp.go b/pkg/timetype/timestamp.go
index 3c70ac971f..4defa32ea6 100644
--- a/pkg/timetype/timestamp.go
+++ b/pkg/timetype/timestamp.go
@@ -116,19 +116,19 @@ func ParseTimestamps(value string, def int64) (int64, int64, error) {
 }
 
 func parseTimestamp(value string) (int64, int64, error) {
-	spart, npart, hasParts := strings.Cut(value, ".")
-	s, err := strconv.ParseInt(spart, 10, 64)
+	sa := strings.SplitN(value, ".", 2)
+	s, err := strconv.ParseInt(sa[0], 10, 64)
 	if err != nil {
 		return s, 0, err
 	}
-	if !hasParts {
+	if len(sa) != 2 {
 		return s, 0, nil
 	}
-	n, err := strconv.ParseInt(npart, 10, 64)
+	n, err := strconv.ParseInt(sa[1], 10, 64)
 	if err != nil {
 		return s, n, err
 	}
 	// should already be in nanoseconds but just in case convert n to nanoseconds
-	n = int64(float64(n) * math.Pow(float64(10), float64(9-len(npart))))
+	n = int64(float64(n) * math.Pow(float64(10), float64(9-len(sa[1]))))
 	return s, n, nil
 }
diff --git a/pkg/trust/policy.go b/pkg/trust/policy.go
index 1424ffe91e..b5d8e7a41c 100644
--- a/pkg/trust/policy.go
+++ b/pkg/trust/policy.go
@@ -131,11 +131,8 @@ func parseUids(colonDelimitKeys []byte) []string {
 				continue
 			}
 			parseduid := uid
-			if ltidx := strings.Index(uid, "<"); ltidx != -1 {
-				subuid := parseduid[ltidx+1:]
-				if gtidx := strings.Index(subuid, ">"); gtidx != -1 {
-					parseduid = subuid[:gtidx]
-				}
+			if strings.Contains(uid, "<") && strings.Contains(uid, ">") {
+				parseduid = strings.SplitN(strings.SplitAfterN(uid, "<", 2)[1], ">", 2)[0]
 			}
 			parseduids = append(parseduids, parseduid)
 		}
diff --git a/pkg/util/filters.go b/pkg/util/filters.go
index d1e33b1081..765b5c4db0 100644
--- a/pkg/util/filters.go
+++ b/pkg/util/filters.go
@@ -65,9 +65,9 @@ func PrepareFilters(r *http.Request) (*map[string][]string, error) {
 	}
 	filterMap := map[string][]string{}
 	for _, filter := range filtersList {
-		fname, filter, hasFilter := strings.Cut(filter, "=")
-		if hasFilter {
-			filterMap[fname] = append(filterMap[fname], filter)
+		split := strings.SplitN(filter, "=", 2)
+		if len(split) > 1 {
+			filterMap[split[0]] = append(filterMap[split[0]], split[1])
 		}
 	}
 	return &filterMap, nil
diff --git a/pkg/util/mountOpts.go b/pkg/util/mountOpts.go
index 2b515aa5df..a35ac77f77 100644
--- a/pkg/util/mountOpts.go
+++ b/pkg/util/mountOpts.go
@@ -34,7 +34,7 @@ func ProcessOptions(options []string, isTmpfs bool, sourcePath string) ([]string
 	newOptions := make([]string, 0, len(options))
 	for _, opt := range options {
 		// Some options have parameters - size, mode
-		key, _, _ := strings.Cut(opt, "=")
+		splitOpt := strings.SplitN(opt, "=", 2)
 
 		// add advanced options such as upperdir=/path and workdir=/path, when overlay is specified
 		if foundOverlay {
@@ -47,11 +47,11 @@ func ProcessOptions(options []string, isTmpfs bool, sourcePath string) ([]string
 				continue
 			}
 		}
-		if strings.HasPrefix(key, "subpath") {
+		if strings.HasPrefix(splitOpt[0], "subpath") {
 			newOptions = append(newOptions, opt)
 			continue
 		}
-		if strings.HasPrefix(key, "idmap") {
+		if strings.HasPrefix(splitOpt[0], "idmap") {
 			if foundIdmap {
 				return nil, fmt.Errorf("the 'idmap' option can only be set once: %w", ErrDupeMntOption)
 			}
@@ -60,7 +60,7 @@ func ProcessOptions(options []string, isTmpfs bool, sourcePath string) ([]string
 			continue
 		}
 
-		switch key {
+		switch splitOpt[0] {
 		case "copy", "nocopy":
 			if foundCopy {
 				return nil, fmt.Errorf("only one of 'nocopy' and 'copy' can be used: %w", ErrDupeMntOption)
@@ -210,13 +210,13 @@ func ProcessOptions(options []string, isTmpfs bool, sourcePath string) ([]string
 }
 
 func ParseDriverOpts(option string) (string, string, error) {
-	_, val, hasVal := strings.Cut(option, "=")
-	if !hasVal {
+	token := strings.SplitN(option, "=", 2)
+	if len(token) != 2 {
 		return "", "", fmt.Errorf("cannot parse driver opts: %w", ErrBadMntOption)
 	}
-	optKey, optVal, hasOptVal := strings.Cut(val, "=")
-	if !hasOptVal {
+	opt := strings.SplitN(token[1], "=", 2)
+	if len(opt) != 2 {
 		return "", "", fmt.Errorf("cannot parse driver opts: %w", ErrBadMntOption)
 	}
-	return optKey, optVal, nil
+	return opt[0], opt[1], nil
 }
diff --git a/pkg/util/utils.go b/pkg/util/utils.go
index 0eefd60559..f9faf07fd1 100644
--- a/pkg/util/utils.go
+++ b/pkg/util/utils.go
@@ -55,8 +55,14 @@ func init() {
 // Helper function to determine the username/password passed
 // in the creds string.  It could be either or both.
 func parseCreds(creds string) (string, string) {
-	username, password, _ := strings.Cut(creds, ":")
-	return username, password
+	if creds == "" {
+		return "", ""
+	}
+	up := strings.SplitN(creds, ":", 2)
+	if len(up) == 1 {
+		return up[0], ""
+	}
+	return up[0], up[1]
 }
 
 // Takes build context and validates `.containerignore` or `.dockerignore`
@@ -912,12 +918,12 @@ func parseAutoIDMap(mapSpec string, mapSetting string, parentMapping []ruser.IDM
 // GetAutoOptions returns an AutoUserNsOptions with the settings to automatically set up
 // a user namespace.
 func GetAutoOptions(n namespaces.UsernsMode) (*stypes.AutoUserNsOptions, error) {
-	mode, opts, hasOpts := strings.Cut(string(n), ":")
-	if mode != "auto" {
+	parts := strings.SplitN(string(n), ":", 2)
+	if parts[0] != "auto" {
 		return nil, fmt.Errorf("wrong user namespace mode")
 	}
 	options := stypes.AutoUserNsOptions{}
-	if !hasOpts {
+	if len(parts) == 1 {
 		return &options, nil
 	}
 
@@ -931,32 +937,32 @@ func GetAutoOptions(n namespaces.UsernsMode) (*stypes.AutoUserNsOptions, error)
 		}
 	}
 
-	for _, o := range strings.Split(opts, ",") {
-		key, val, hasVal := strings.Cut(o, "=")
-		if !hasVal {
+	for _, o := range strings.Split(parts[1], ",") {
+		v := strings.SplitN(o, "=", 2)
+		if len(v) != 2 {
 			return nil, fmt.Errorf("invalid option specified: %q", o)
 		}
-		switch key {
+		switch v[0] {
 		case "size":
-			s, err := strconv.ParseUint(val, 10, 32)
+			s, err := strconv.ParseUint(v[1], 10, 32)
 			if err != nil {
 				return nil, err
 			}
 			options.Size = uint32(s)
 		case "uidmapping":
-			mapping, err := parseAutoIDMap(val, "UID", parentUIDMap)
+			mapping, err := parseAutoIDMap(v[1], "UID", parentUIDMap)
 			if err != nil {
 				return nil, err
 			}
 			options.AdditionalUIDMappings = append(options.AdditionalUIDMappings, mapping...)
 		case "gidmapping":
-			mapping, err := parseAutoIDMap(val, "GID", parentGIDMap)
+			mapping, err := parseAutoIDMap(v[1], "GID", parentGIDMap)
 			if err != nil {
 				return nil, err
 			}
 			options.AdditionalGIDMappings = append(options.AdditionalGIDMappings, mapping...)
 		default:
-			return nil, fmt.Errorf("unknown option specified: %q", key)
+			return nil, fmt.Errorf("unknown option specified: %q", v[0])
 		}
 	}
 	return &options, nil
@@ -1071,9 +1077,9 @@ func getTomlStorage(storeOptions *stypes.StoreOptions) *tomlConfig {
 	config.Storage.RunRoot = storeOptions.RunRoot
 	config.Storage.GraphRoot = storeOptions.GraphRoot
 	for _, i := range storeOptions.GraphDriverOptions {
-		program, hasPrefix := strings.CutPrefix(i, "overlay.mount_program=")
-		if hasPrefix {
-			config.Storage.Options.MountProgram = program
+		s := strings.SplitN(i, "=", 2)
+		if s[0] == "overlay.mount_program" && len(s) == 2 {
+			config.Storage.Options.MountProgram = s[1]
 		}
 	}
 


Test patch:
diff --git a/pkg/machine/e2e/config_inspect_test.go b/pkg/machine/e2e/config_inspect_test.go
index f0d4aa5bdd..ffd74220f1 100644
--- a/pkg/machine/e2e/config_inspect_test.go
+++ b/pkg/machine/e2e/config_inspect_test.go
@@ -13,7 +13,7 @@ func (i *inspectMachine) buildCmd(m *machineTestBuilder) []string {
 	if len(i.format) > 0 {
 		cmd = append(cmd, "--format", i.format)
 	}
-	cmd = append(cmd, m.name)
+	cmd = append(cmd, m.names...)
 	i.cmd = cmd
 	return cmd
 }
diff --git a/pkg/machine/e2e/config_test.go b/pkg/machine/e2e/config_test.go
index 9692bccc01..354b3be742 100644
--- a/pkg/machine/e2e/config_test.go
+++ b/pkg/machine/e2e/config_test.go
@@ -132,7 +132,7 @@ func (m *machineTestBuilder) setCmd(mc machineCommand) *machineTestBuilder {
 	return m
 }
 
-func (m *machineTestBuilder) setTimeout(timeout time.Duration) *machineTestBuilder { //nolint: unparam
+func (m *machineTestBuilder) setTimeout(timeout time.Duration) *machineTestBuilder {
 	m.timeout = timeout
 	return m
 }
diff --git a/pkg/machine/e2e/start_test.go b/pkg/machine/e2e/start_test.go
index 8c77bde6bc..d1001a45d2 100644
--- a/pkg/machine/e2e/start_test.go
+++ b/pkg/machine/e2e/start_test.go
@@ -1,8 +1,6 @@
 package e2e_test
 
 import (
-	"time"
-
 	"github.com/containers/podman/v4/pkg/machine/define"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -86,36 +84,4 @@ var _ = Describe("podman machine start", func() {
 		Expect(startSession).To(Exit(125))
 		Expect(startSession.errorToString()).To(ContainSubstring("VM already running or starting"))
 	})
-	It("start only starts specified machine", func() {
-		i := initMachine{}
-		startme := randomString()
-		session, err := mb.setName(startme).setCmd(i.withImagePath(mb.imagePath)).run()
-		Expect(err).ToNot(HaveOccurred())
-		Expect(session).To(Exit(0))
-
-		j := initMachine{}
-		dontstartme := randomString()
-		session2, err := mb.setName(dontstartme).setCmd(j.withImagePath(mb.imagePath)).run()
-		Expect(err).ToNot(HaveOccurred())
-		Expect(session2).To(Exit(0))
-
-		s := startMachine{}
-		session3, err := mb.setName(startme).setCmd(s).setTimeout(time.Minute * 10).run()
-		Expect(err).ToNot(HaveOccurred())
-		Expect(session3).Should(Exit(0))
-
-		inspect := new(inspectMachine)
-		inspect = inspect.withFormat("{{.State}}")
-		inspectSession, err := mb.setName(startme).setCmd(inspect).run()
-		Expect(err).ToNot(HaveOccurred())
-		Expect(inspectSession).To(Exit(0))
-		Expect(inspectSession.outputToString()).To(Equal(define.Running))
-
-		inspect2 := new(inspectMachine)
-		inspect2 = inspect2.withFormat("{{.State}}")
-		inspectSession2, err := mb.setName(dontstartme).setCmd(inspect2).run()
-		Expect(err).ToNot(HaveOccurred())
-		Expect(inspectSession2).To(Exit(0))
-		Expect(inspectSession2.outputToString()).To(Not(Equal(define.Running)))
-	})
 })
diff --git a/pkg/machine/qemu/command/command_test.go b/pkg/machine/qemu/command/command_test.go
index c56d9341f5..e2307f3693 100644
--- a/pkg/machine/qemu/command/command_test.go
+++ b/pkg/machine/qemu/command/command_test.go
@@ -75,8 +75,8 @@ func TestPropagateHostEnv(t *testing.T) {
 	// envs looks like: {"BAR": "bar", "FOO": "foo"}
 	envs := make(map[string]string)
 	for _, env := range envsRawArr {
-		key, value, _ := strings.Cut(env, "=")
-		envs[key] = strings.Trim(value, "\"")
+		item := strings.SplitN(env, "=", 2)
+		envs[item[0]] = strings.Trim(item[1], "\"")
 	}
 
 	for key, test := range tests {
diff --git a/pkg/specgenutil/volumes_test.go b/pkg/specgenutil/volumes_test.go
index 18009a8e99..712d9fd455 100644
--- a/pkg/specgenutil/volumes_test.go
+++ b/pkg/specgenutil/volumes_test.go
@@ -13,41 +13,41 @@ func Test_validChownFlag(t *testing.T) {
 		wantErr bool
 	}{
 		{
-			name: "lower-case true",
+			name: "U true",
 			args: args{
-				flag: "true",
+				flag: "U=true",
 			},
 			want:    true,
 			wantErr: false,
 		},
 		{
-			name: "case-insensitive true",
+			name: "U true case does not matter",
 			args: args{
-				flag: "True",
+				flag: "u=True",
 			},
 			want:    true,
 			wantErr: false,
 		},
 		{
-			name: "lower-case false",
+			name: "U is false",
 			args: args{
-				flag: "false",
+				flag: "U=false",
 			},
 			want:    false,
 			wantErr: false,
 		},
 		{
-			name: "case-insensitive false",
+			name: "chown should also work",
 			args: args{
-				flag: "falsE",
+				flag: "chown=true",
 			},
-			want:    false,
+			want:    true,
 			wantErr: false,
 		},
 		{
 			name: "garbage value should fail",
 			args: args{
-				flag: "foobar",
+				flag: "U=foobar",
 			},
 			want:    false,
 			wantErr: true,
diff --git a/test/e2e/common_test.go b/test/e2e/common_test.go
index d04e7e38c8..f3f02da3d8 100644
--- a/test/e2e/common_test.go
+++ b/test/e2e/common_test.go
@@ -209,11 +209,12 @@ var _ = SynchronizedAfterSuite(func() {
 			scanner := bufio.NewScanner(f)
 			for scanner.Scan() {
 				text := scanner.Text()
-				name, durationString, ok := strings.Cut(text, "\t\t")
-				if !ok {
+				timing := strings.SplitN(text, "\t\t", 2)
+				if len(timing) != 2 {
 					Fail(fmt.Sprintf("incorrect timing line: %q", text))
 				}
-				duration, err := strconv.ParseFloat(durationString, 64)
+				name := timing[0]
+				duration, err := strconv.ParseFloat(timing[1], 64)
 				Expect(err).ToNot(HaveOccurred(), "failed to parse float from timings file")
 				testTimings = append(testTimings, testResult{name: name, length: duration})
 			}
diff --git a/test/e2e/quadlet_test.go b/test/e2e/quadlet_test.go
index ef0057da25..8fac352f2b 100644
--- a/test/e2e/quadlet_test.go
+++ b/test/e2e/quadlet_test.go
@@ -202,8 +202,12 @@ func keyValueStringToMap(keyValueString, separator string) (map[string]string, e
 		return nil, err
 	}
 	for _, param := range keyVarList[0] {
-		key, val, _ := strings.Cut(param, "=")
-		keyValMap[key] = val
+		val := ""
+		kv := strings.SplitN(param, "=", 2)
+		if len(kv) == 2 {
+			val = kv[1]
+		}
+		keyValMap[kv[0]] = val
 	}
 
 	return keyValMap, nil
diff --git a/test/system/001-basic.bats b/test/system/001-basic.bats
index 7b4cc58b3e..0512accba9 100644
--- a/test/system/001-basic.bats
+++ b/test/system/001-basic.bats
@@ -35,6 +35,9 @@ function setup() {
 
     run_podman -v
     is "$output" "podman.*version \+"               "'Version line' in output"
+
+    run_podman 0+w --config foobar version
+    require_warning "The --config flag is ignored by Podman. Exists for Docker compatibility"
 }
 
 # bats test_tags=distro-integration
diff --git a/test/system/030-run.bats b/test/system/030-run.bats
index 057b1d646c..ad5e16ac24 100644
--- a/test/system/030-run.bats
+++ b/test/system/030-run.bats
@@ -1251,11 +1251,6 @@ EOF
     run_podman run --uidmap=0:1000:10000 --rm --rootfs "$romount:idmap=uids=0-1001-10000;gids=0-1002-10000" stat -c %u:%g /bin
     is "$output" "1:2"
 
-    touch $romount/testfile
-    chown 2000:2000 $romount/testfile
-    run_podman run --uidmap=0:1000:2 --rm --rootfs "$romount:idmap=uids=@2000-1-1;gids=@2000-1-1" stat -c %u:%g /testfile
-    is "$output" "1:1"
-
     rm -rf $romount
 }
 
diff --git a/test/system/060-mount.bats b/test/system/060-mount.bats
index fbc925a47c..4cb880feb5 100644
--- a/test/system/060-mount.bats
+++ b/test/system/060-mount.bats
@@ -308,21 +308,6 @@ EOF
 }
 
 @test "podman mount noswap memory mounts" {
-    # tmpfs+noswap new in kernel 6.x, mid-2023; likely not in RHEL for a while
-    if ! is_rootless; then
-        testmount=$PODMAN_TMPDIR/testmount
-        mkdir $testmount
-        run mount -t tmpfs -o noswap none $testmount
-        if [[ $status -ne 0 ]]; then
-            if [[ $output =~ "bad option" ]]; then
-                skip "requires kernel with tmpfs + noswap support"
-            fi
-            die "Could not test for tmpfs + noswap support: $output"
-        else
-            umount $testmount
-        fi
-    fi
-
     # if volumes source and dest match then pass
     run_podman run --rm --mount type=ramfs,destination=${PODMAN_TMPDIR} $IMAGE stat -f -c "%T" ${PODMAN_TMPDIR}
     is "$output" "ramfs" "ramfs mounted"
diff --git a/test/system/150-login.bats b/test/system/150-login.bats
index f8c2994d2c..f9c6b1394d 100644
--- a/test/system/150-login.bats
+++ b/test/system/150-login.bats
@@ -91,38 +91,6 @@ function setup() {
     assert "$output" =~ "Error: options for paths to the credential file and to the Docker-compatible credential file can not be set simultaneously"
 }
 
-@test "podman login - check with --config global option" {
-    dockerconfig=${PODMAN_LOGIN_WORKDIR}/docker
-    rm -rf $dockerconfig
-
-    registry=localhost:${PODMAN_LOGIN_REGISTRY_PORT}
-
-    run_podman --config $dockerconfig login \
-        --tls-verify=false \
-        --username ${PODMAN_LOGIN_USER} \
-        --password ${PODMAN_LOGIN_PASS} \
-        $registry
-
-    # Confirm that config file now exists
-    test -e $dockerconfig/config.json || \
-        die "podman login did not create config $dockerconfig/config.json"
-
-    # Special bracket form needed because of colon in host:port
-    run jq -r ".[\"auths\"][\"$registry\"][\"auth\"]" <$dockerconfig/config.json
-    is "$status" "0" "jq from $dockerconfig/config.json"
-
-    expect_userpass="${PODMAN_LOGIN_USER}:${PODMAN_LOGIN_PASS}"
-    actual_userpass=$(base64 -d <<<"$output")
-    is "$actual_userpass" "$expect_userpass" "credentials stored in $dockerconfig/config.json"
-
-    # Now log out and make sure credentials are removed
-    run_podman --config $dockerconfig logout $registry
-
-    run jq -r '.auths' <$dockerconfig/config.json
-    is "$status" "0" "jq from $dockerconfig/config.json"
-    is "$output" "{}" "credentials removed from $dockerconfig/config.json"
-}
-
 # Some push tests
 @test "podman push fail" {
 
diff --git a/test/system/250-systemd.bats b/test/system/250-systemd.bats
index 0e6a1ba3a8..5cf6a0978c 100644
--- a/test/system/250-systemd.bats
+++ b/test/system/250-systemd.bats
@@ -9,7 +9,7 @@ load helpers.systemd
 SERVICE_NAME="podman_test_$(random_string)"
 
 UNIT_FILE="$UNIT_DIR/$SERVICE_NAME.service"
-TEMPLATE_FILE="$UNIT_DIR/$SERVICE_NAME@.service"
+TEMPLATE_FILE_PREFIX="$UNIT_DIR/$SERVICE_NAME"
 
 function setup() {
     skip_if_remote "systemd tests are meaningless over remote"
@@ -33,19 +33,11 @@ function teardown() {
 
 # Helper to start a systemd service running a container
 function service_setup() {
-    # January 2024: we can no longer do "run_podman generate systemd" followed
-    # by "echo $output >file", because generate-systemd is deprecated and now
-    # says so loudly, to stderr, with no way to silence it. Since BATS gloms
-    # stdout + stderr, that warning goes to the unit file. (Today's systemd
-    # is forgiving about that, but RHEL8 systemd chokes with EINVAL)
-    (
-        cd $UNIT_DIR
-        run_podman generate systemd --files --name \
+    run_podman generate systemd \
                -e http_proxy -e https_proxy -e no_proxy \
                -e HTTP_PROXY -e HTTPS_PROXY -e NO_PROXY \
                --new $cname
-        mv "container-$cname.service" $UNIT_FILE
-    )
+    echo "$output" > "$UNIT_FILE"
     run_podman rm $cname
 
     systemctl daemon-reload
@@ -230,12 +222,8 @@ LISTEN_FDNAMES=listen_fdnames" | sort)
     cname=$(random_string)
     run_podman create --name $cname $IMAGE top
 
-    # See note in service_setup() above re: using --files
-    (
-        cd $UNIT_DIR
-        run_podman generate systemd --template --files -n $cname
-        mv "container-$cname.service" $TEMPLATE_FILE
-    )
+    run_podman generate systemd --template -n $cname
+    echo "$output" > "$TEMPLATE_FILE_PREFIX@.service"
     run_podman rm -f $cname
 
     systemctl daemon-reload
@@ -249,7 +237,7 @@ LISTEN_FDNAMES=listen_fdnames" | sort)
     run systemctl stop "$INSTANCE"
     assert $status -eq 0 "Error stopping systemd unit $INSTANCE: $output"
 
-    rm -f $TEMPLATE_FILE
+    rm -f "$TEMPLATE_FILE_PREFIX@.service"
     systemctl daemon-reload
 }
 
diff --git a/test/system/260-sdnotify.bats b/test/system/260-sdnotify.bats
index c139f53463..b48bec2530 100644
--- a/test/system/260-sdnotify.bats
+++ b/test/system/260-sdnotify.bats
@@ -352,18 +352,16 @@ EOF
         $PODMAN play kube --service-container=true --log-driver journald $yaml_source &>/dev/null &
 
     # Wait for both containers to be running
-    containers_running=
     for i in $(seq 1 20); do
         run_podman "?" container wait $container_a $container_b --condition="running"
         if [[ $status == 0 ]]; then
-            containers_running=1
             break
         fi
         sleep 0.5
         # Just for debugging
         run_podman ps -a
     done
-    if [[ -z "$containers_running" ]]; then
+    if [[ $status != 0 ]]; then
         die "container $container_a and/or $container_b did not start"
     fi
 
diff --git a/test/system/700-play.bats b/test/system/700-play.bats
index f06859848a..c964aa25d6 100644
--- a/test/system/700-play.bats
+++ b/test/system/700-play.bats
@@ -185,18 +185,16 @@ EOF
 
     # Wait for the container to be running
     container_a=test_pod-test
-    container_running=
     for i in $(seq 1 20); do
         run_podman "?" container wait $container_a --condition="running"
         if [[ $status == 0 ]]; then
-            container_running=1
             break
         fi
         sleep 0.5
         # Just for debugging
         run_podman ps -a
     done
-    if [[ -z "$container_running" ]]; then
+    if [[ $status != 0 ]]; then
         die "container $container_a did not start"
     fi
 
@@ -583,7 +581,7 @@ EOF
     # Create the YAMl file, with two pods, each with one container
     yaml_source="$PODMAN_TMPDIR/test.yaml"
     for n in 1 2;do
-        _write_test_yaml labels="app: pod$n" name="pod$n" ctrname="ctr$n" command=top
+        _write_test_yaml labels="app: pod$n" name="pod$n" ctrname="ctr$n"
 
         # Separator between two yaml halves
         if [[ $n = 1 ]]; then
@@ -602,19 +600,17 @@ EOF
     service_container="${yaml_sha:0:12}-service"
     # Wait for the containers to be running
     container_1=pod1-ctr1
-    container_2=pod2-ctr2
-    containers_running=
+    container_2=pod1-ctr2
     for i in $(seq 1 20); do
         run_podman "?" container wait $container_1 $container_2 $service_container --condition="running"
         if [[ $status == 0 ]]; then
-            containers_running=1
             break
         fi
         sleep 0.5
         # Just for debugging
         run_podman ps -a
     done
-    if [[ -z "$containers_running" ]]; then
+    if [[ $status != 0 ]]; then
         die "container $container_1, $container_2 and/or $service_container did not start"
     fi
 
diff --git a/test/system/helpers.bash b/test/system/helpers.bash
index d006c7c952..6f641703d7 100644
--- a/test/system/helpers.bash
+++ b/test/system/helpers.bash
@@ -4,9 +4,6 @@
 PODMAN=${PODMAN:-podman}
 QUADLET=${QUADLET:-/usr/libexec/podman/quadlet}
 
-# crun or runc, unlikely to change. Cache, because it's expensive to determine.
-PODMAN_RUNTIME=
-
 # Standard image to use for most tests
 PODMAN_TEST_IMAGE_REGISTRY=${PODMAN_TEST_IMAGE_REGISTRY:-"quay.io"}
 PODMAN_TEST_IMAGE_USER=${PODMAN_TEST_IMAGE_USER:-"libpod"}
@@ -198,11 +195,6 @@ function basic_setup() {
     # ancient BATS (v1.1) in RHEL gating tests.)
     PODMAN_TMPDIR=$(mktemp -d --tmpdir=${BATS_TMPDIR:-/tmp} podman_bats.XXXXXX)
 
-    # runtime is not likely to change
-    if [[ -z "$PODMAN_RUNTIME" ]]; then
-        PODMAN_RUNTIME=$(podman_runtime)
-    fi
-
     # In the unlikely event that a test runs is() before a run_podman()
     MOST_RECENT_PODMAN_COMMAND=
 
@@ -429,12 +421,10 @@ function run_podman() {
     # (see top of function) allows our caller to indicate that warnings are
     # expected, e.g., "podman stop" without -t0.
     if [[ $status -eq 0 ]]; then
-        # FIXME: don't do this on Debian or RHEL. runc is way too buggy:
-        #   - #11784 - lstat /sys/fs/.../*.scope: ENOENT
-        #   - #11785 - cannot toggle freezer: cgroups not configured
-        # As of January 2024 the freezer one seems to be fixed in Debian-runc
-        # but not in RHEL8-runc. The lstat one is closed-wontfix.
-        if [[ $PODMAN_RUNTIME != "runc" ]]; then
+        # FIXME: don't do this on Debian: runc is way, way too flaky:
+        # FIXME: #11784 - lstat /sys/fs/.../*.scope: ENOENT
+        # FIXME: #11785 - cannot toggle freezer: cgroups not configured
+        if [[ ! "${DISTRO_NV}" =~ debian ]]; then
             # FIXME: All kube commands emit unpredictable errors:
             #    "Storage for container <X> has been removed"
             #    "no container with ID <X> found in database"
@@ -599,9 +589,10 @@ function selinux_enabled() {
 # love to cache this result, we probably shouldn't.
 function podman_runtime() {
     # This function is intended to be used as '$(podman_runtime)', i.e.
-    # our caller wants our output. It's unsafe to use run_podman().
-    runtime=$($PODMAN $_PODMAN_TEST_OPTS info --format '{{ .Host.OCIRuntime.Name }}' 2>/dev/null)
-    basename "${runtime:-[null]}"
+    # our caller wants our output. run_podman() messes with output because
+    # it emits the command invocation to stdout, hence the redirection.
+    run_podman info --format '{{ .Host.OCIRuntime.Name }}' >/dev/null
+    basename "${output:-[null]}"
 }
 
 # Returns the storage driver: 'overlay' or 'vfs'