Merge pull request #11705 from mheon/340

Release 3.4.0-rc2 (inc. backports)

90 files changed, 905 insertions, 832 deletions

diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index 0a37ef8a1..a5cfd9e2e 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -61,13 +61,22 @@
 - Fixed a bug where the `podman run` command could return 0 when the application in the container exited with 125 ([#11540](https://github.com/containers/podman/issues/11540)).
 - Fixed a bug where containers with `--restart=always` set using the rootlessport port-forwarding service could not be restarted automatically.
 - Fixed a bug where the `--cgroups=split` option to `podman create` and `podman run` was silently discarded if the container was part of a pod.
+- Fixed a bug where the `podman container runlabel` command could fail if the image name given included a tag.
+- Fixed a bug where Podman could add an extra `127.0.0.1` entry to `/etc/hosts` under some circumstances ([#11596](https://github.com/containers/podman/issues/11596)).
+- Fixed a bug where the remote Podman client's `podman untag` command did not properly handle tags including a digest ([#11557](https://github.com/containers/podman/issues/11557)).
+- Fixed a bug where the `--format` option to `podman ps` did not properly support the `table` argument for tabular output.
+- Fixed a bug where the `--filter` option to `podman ps` did not properly handle filtering by healthcheck status ([#11687](https://github.com/containers/podman/issues/11687)).
+- Fixed a bug where the `podman run` and `podman start --attach` commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external `podman rm -f`) ([#11633](https://github.com/containers/podman/issues/11633)).
+- Fixed a bug where the `podman generate kube` command would add default environment variables to generated YAML.
 
 ### API
 - The Libpod Pull endpoint for Images now has a new query parameter, `quiet`, which (when set to true) suppresses image pull progress reports ([#10612](https://github.com/containers/podman/issues/10612)).
 - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
+- The Compat List and Inspect endpoints for Images now prefix image IDs with `sha256:` for improved Docker compatibility ([#11623](https://github.com/containers/podman/issues/11623)).
 - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields ([#11225](https://github.com/containers/podman/issues/11225)).
 - The Compat Create endpoint for Containers now supports volume options provided by the `Mounts` field ([#10831](https://github.com/containers/podman/issues/10831)).
 - The Compat List endpoint for Secrets now supports a new query parameter, `filter`, which allows returned results to be filtered.
+- The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
 - The Version endpoint now includes information about the OCI runtime and Conmon in use ([#11227](https://github.com/containers/podman/issues/11227)).
 - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images ([#11235](https://github.com/containers/podman/issues/11235)).
 - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
diff --git a/cmd/podman/containers/ps.go b/cmd/podman/containers/ps.go
index a5b0795cd..2566c57de 100644
--- a/cmd/podman/containers/ps.go
+++ b/cmd/podman/containers/ps.go
@@ -221,7 +221,10 @@ func ps(cmd *cobra.Command, _ []string) error {
 	}
 
 	hdrs, format := createPsOut()
+
+	noHeading, _ := cmd.Flags().GetBool("noheading")
 	if cmd.Flags().Changed("format") {
+		noHeading = noHeading || !report.HasTable(listOpts.Format)
 		format = report.NormalizeFormat(listOpts.Format)
 		format = report.EnforceRange(format)
 	}
@@ -240,8 +243,7 @@ func ps(cmd *cobra.Command, _ []string) error {
 	defer w.Flush()
 
 	headers := func() error { return nil }
-	noHeading, _ := cmd.Flags().GetBool("noheading")
-	if !(noHeading || listOpts.Quiet || cmd.Flags().Changed("format")) {
+	if !noHeading {
 		headers = func() error {
 			return tmpl.Execute(w, hdrs)
 		}
@@ -298,9 +300,11 @@ func createPsOut() ([]map[string]string, string) {
 		"IPC":          "ipc",
 		"MNT":          "mnt",
 		"NET":          "net",
+		"Networks":     "networks",
 		"PIDNS":        "pidns",
 		"Pod":          "pod id",
 		"PodName":      "podname", // undo camelcase space break
+		"RunningFor":   "running for",
 		"UTS":          "uts",
 		"User":         "userns",
 	})
diff --git a/cmd/podman/images/inspect.go b/cmd/podman/images/inspect.go
index 35c173a60..dd8cf8056 100644
--- a/cmd/podman/images/inspect.go
+++ b/cmd/podman/images/inspect.go
@@ -17,9 +17,9 @@ var (
 		Long:              `Displays the low-level information of an image identified by name or ID.`,
 		RunE:              inspectExec,
 		ValidArgsFunction: common.AutocompleteImages,
-		Example: `podman inspect alpine
-  podman inspect --format "imageId: {{.Id}} size: {{.Size}}" alpine
-  podman inspect --format "image: {{.ImageName}} driver: {{.Driver}}" myctr`,
+		Example: `podman image inspect alpine
+  podman image inspect --format "imageId: {{.Id}} size: {{.Size}}" alpine
+  podman image inspect --format "image: {{.ImageName}} driver: {{.Driver}}" myctr`,
 	}
 	inspectOpts *entities.InspectOptions
 )
diff --git a/cmd/podman/networks/inspect.go b/cmd/podman/networks/inspect.go
index c0e5b9720..4f3e86fc9 100644
--- a/cmd/podman/networks/inspect.go
+++ b/cmd/podman/networks/inspect.go
@@ -12,7 +12,7 @@ var (
 	networkinspectDescription = `Inspect network`
 	networkinspectCommand     = &cobra.Command{
 		Use:               "inspect [options] NETWORK [NETWORK...]",
-		Short:             "network inspect",
+		Short:             "Displays the raw CNI network configuration for one or more networks.",
 		Long:              networkinspectDescription,
 		RunE:              networkInspect,
 		Example:           `podman network inspect podman`,
diff --git a/docs/requirements.txt b/docs/requirements.txt
index 84e7ec6a5..3ba6d658f 100644
--- a/docs/requirements.txt
+++ b/docs/requirements.txt
@@ -1,6 +1,4 @@
 # requirements file for readthedocs pip installs
 
 # use md instead of rst
-recommonmark
-# needed for markdown table support
-sphinx-markdown-tables
+myst_parser
diff --git a/docs/source/conf.py b/docs/source/conf.py
index 8210022f2..7684dd3f7 100644
--- a/docs/source/conf.py
+++ b/docs/source/conf.py
@@ -15,7 +15,6 @@
 # sys.path.insert(0, os.path.abspath('.'))
 
 import re
-from recommonmark.transform import AutoStructify
 
 # -- Project information -----------------------------------------------------
 
@@ -29,7 +28,7 @@ author = "team"
 # Add any Sphinx extension module names here, as strings. They can be
 # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
 # ones.
-extensions = ["sphinx_markdown_tables", "recommonmark"]
+extensions = ["myst_parser"]
 
 # Add any paths that contain templates here, relative to this directory.
 templates_path = ["_templates"]
@@ -63,27 +62,18 @@ html_css_files = [
 
 # -- Extension configuration -------------------------------------------------
 
+# IMPORTANT: explicitly unset the extensions, by default dollarmath is enabled.
+# We use the dollar sign as text and do not want it to be interpreted as math expression.
+myst_enable_extensions = []
+
 
 def convert_markdown_title(app, docname, source):
     # Process markdown files only
     docpath = app.env.doc2path(docname)
     if docpath.endswith(".md"):
-        # Convert pandoc title line into eval_rst block for recommonmark
-        source[0] = re.sub(r"^% (.*)", r"```eval_rst\n.. title:: \g<1>\n```", source[0])
+        # Convert pandoc title line into eval_rst block for myst_parser
+        source[0] = re.sub(r"^% (.*)", r"```{title} \g<1>\n```", source[0])
 
 
 def setup(app):
     app.connect("source-read", convert_markdown_title)
-
-    app.add_config_value(
-        "recommonmark_config",
-        {
-            "enable_eval_rst": True,
-            "enable_auto_doc_ref": False,
-            "enable_auto_toc_tree": False,
-            "enable_math": False,
-            "enable_inline_math": False,
-        },
-        True,
-    )
-    app.add_transform(AutoStructify)
diff --git a/docs/source/markdown/links/podman-container-inspect.1 b/docs/source/markdown/links/podman-container-inspect.1
deleted file mode 100644
index 261043845..000000000
--- a/docs/source/markdown/links/podman-container-inspect.1
+++ /dev/null
@@ -1 +0,0 @@
-.so man1/podman-inspect.1
diff --git a/docs/source/markdown/links/podman-image-inspect.1 b/docs/source/markdown/links/podman-image-inspect.1
deleted file mode 100644
index 261043845..000000000
--- a/docs/source/markdown/links/podman-image-inspect.1
+++ /dev/null
@@ -1 +0,0 @@
-.so man1/podman-inspect.1
diff --git a/docs/source/markdown/podman-container-inspect.1.md b/docs/source/markdown/podman-container-inspect.1.md
new file mode 100644
index 000000000..72b7cef3b
--- /dev/null
+++ b/docs/source/markdown/podman-container-inspect.1.md
@@ -0,0 +1,318 @@
+% podman-container-inspect(1)
+
+## NAME
+podman\-container\-inspect - Display a container's configuration
+
+## SYNOPSIS
+**podman container inspect** [*options*] *container* [*container* ...]
+
+## DESCRIPTION
+
+This displays the low-level information on containers identified by name or ID. By default, this will render
+all results in a JSON array. If a format is specified, the given template will be executed for each result.
+
+## OPTIONS
+
+#### **--format**, **-f**=*format*
+
+Format the output using the given Go template.
+The keys of the returned JSON can be used as the values for the --format flag (see examples below).
+
+#### **--latest**, **-l**
+
+Instead of providing the container name or ID, use the last created container. If you use methods other than Podman
+to run containers such as CRI-O, the last started container could be from either of those methods.
+
+(This option is not available with the remote Podman client.)
+
+#### **--size**, **-s**
+
+In addition to normal output, display the total file size if the type is a container.
+
+
+## EXAMPLE
+
+```
+$ podman container inspect foobar
+[
+    {
+        "Id": "99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6",
+        "Created": "2021-09-16T06:09:08.936623325-04:00",
+        "Path": "echo",
+        "Args": [
+            "hi"
+        ],
+        "State": {
+            "OciVersion": "1.0.2-dev",
+            "Status": "exited",
+            "Running": false,
+            "Paused": false,
+            "Restarting": false,
+            "OOMKilled": false,
+            "Dead": false,
+            "Pid": 0,
+            "ExitCode": 0,
+            "Error": "",
+            "StartedAt": "2021-09-16T06:09:09.033564436-04:00",
+            "FinishedAt": "2021-09-16T06:09:09.036184314-04:00",
+            "Healthcheck": {
+                "Status": "",
+                "FailingStreak": 0,
+                "Log": null
+            }
+        },
+        "Image": "14119a10abf4669e8cdbdff324a9f9605d99697215a0d21c360fe8dfa8471bab",
+        "ImageName": "docker.io/library/alpine:latest",
+        "Rootfs": "",
+        "Pod": "",
+        "ResolvConfPath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/resolv.conf",
+        "HostnamePath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/hostname",
+        "HostsPath": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/hosts",
+        "StaticDir": "/home/dwalsh/.local/share/containers/storage/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata",
+        "OCIConfigPath": "/home/dwalsh/.local/share/containers/storage/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/config.json",
+        "OCIRuntime": "crun",
+        "ConmonPidFile": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/conmon.pid",
+        "PidFile": "/run/user/3267/containers/overlay-containers/99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6/userdata/pidfile",
+        "Name": "foobar",
+        "RestartCount": 0,
+        "Driver": "overlay",
+        "MountLabel": "system_u:object_r:container_file_t:s0:c25,c695",
+        "ProcessLabel": "system_u:system_r:container_t:s0:c25,c695",
+        "AppArmorProfile": "",
+        "EffectiveCaps": [
+            "CAP_CHOWN",
+            "CAP_DAC_OVERRIDE",
+            "CAP_FOWNER",
+            "CAP_FSETID",
+            "CAP_KILL",
+            "CAP_NET_BIND_SERVICE",
+            "CAP_SETFCAP",
+            "CAP_SETGID",
+            "CAP_SETPCAP",
+            "CAP_SETUID",
+            "CAP_SYS_CHROOT"
+        ],
+        "BoundingCaps": [
+            "CAP_CHOWN",
+            "CAP_DAC_OVERRIDE",
+            "CAP_FOWNER",
+            "CAP_FSETID",
+            "CAP_KILL",
+            "CAP_NET_BIND_SERVICE",
+            "CAP_SETFCAP",
+            "CAP_SETGID",
+            "CAP_SETPCAP",
+            "CAP_SETUID",
+            "CAP_SYS_CHROOT"
+        ],
+        "ExecIDs": [],
+        "GraphDriver": {
+            "Name": "overlay",
+            "Data": {
+                "LowerDir": "/home/dwalsh/.local/share/containers/storage/overlay/e2eb06d8af8218cfec8210147357a68b7e13f7c485b991c288c2d01dc228bb68/diff",
+                "UpperDir": "/home/dwalsh/.local/share/containers/storage/overlay/8f3d70434a3db17410ec4710caf4f251f3e4ed0a96a08124e4b3d4af0a0ea300/diff",
+                "WorkDir": "/home/dwalsh/.local/share/containers/storage/overlay/8f3d70434a3db17410ec4710caf4f251f3e4ed0a96a08124e4b3d4af0a0ea300/work"
+            }
+        },
+        "Mounts": [],
+        "Dependencies": [],
+        "NetworkSettings": {
+            "EndpointID": "",
+            "Gateway": "",
+            "IPAddress": "",
+            "IPPrefixLen": 0,
+            "IPv6Gateway": "",
+            "GlobalIPv6Address": "",
+            "GlobalIPv6PrefixLen": 0,
+            "MacAddress": "",
+            "Bridge": "",
+            "SandboxID": "",
+            "HairpinMode": false,
+            "LinkLocalIPv6Address": "",
+            "LinkLocalIPv6PrefixLen": 0,
+            "Ports": {},
+            "SandboxKey": ""
+        },
+        "ExitCommand": [
+            "/usr/bin/podman",
+            "--root",
+            "/home/dwalsh/.local/share/containers/storage",
+            "--runroot",
+            "/run/user/3267/containers",
+            "--log-level",
+            "warning",
+            "--cgroup-manager",
+            "systemd",
+            "--tmpdir",
+            "/run/user/3267/libpod/tmp",
+            "--runtime",
+            "crun",
+            "--storage-driver",
+            "overlay",
+            "--events-backend",
+            "journald",
+            "container",
+            "cleanup",
+            "99f66530fe9c7249f7cf29f78e8661669d5831cbe4ee80ea757d5e922dd6a8a6"
+        ],
+        "Namespace": "",
+        "IsInfra": false,
+        "Config": {
+            "Hostname": "99f66530fe9c",
+            "Domainname": "",
+            "User": "",
+            "AttachStdin": false,
+            "AttachStdout": false,
+            "AttachStderr": false,
+            "Tty": false,
+            "OpenStdin": false,
+            "StdinOnce": false,
+            "Env": [
+                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+                "TERM=xterm",
+                "container=podman",
+                "HOME=/root",
+                "HOSTNAME=99f66530fe9c"
+            ],
+            "Cmd": [
+                "echo",
+                "hi"
+            ],
+            "Image": "docker.io/library/alpine:latest",
+            "Volumes": null,
+            "WorkingDir": "/",
+            "Entrypoint": "",
+            "OnBuild": null,
+            "Labels": null,
+            "Annotations": {
+                "io.container.manager": "libpod",
+                "io.kubernetes.cri-o.Created": "2021-09-16T06:09:08.936623325-04:00",
+                "io.kubernetes.cri-o.TTY": "false",
+                "io.podman.annotations.autoremove": "FALSE",
+                "io.podman.annotations.init": "FALSE",
+                "io.podman.annotations.privileged": "FALSE",
+                "io.podman.annotations.publish-all": "FALSE",
+                "org.opencontainers.image.stopSignal": "15"
+            },
+            "StopSignal": 15,
+            "CreateCommand": [
+                "podman",
+                "run",
+                "--name",
+                "foobar",
+                "alpine",
+                "echo",
+                "hi"
+            ],
+            "Timezone": "local",
+            "Umask": "0022",
+            "Timeout": 0,
+            "StopTimeout": 10
+        },
+        "HostConfig": {
+            "Binds": [],
+            "CgroupManager": "systemd",
+            "CgroupMode": "private",
+            "ContainerIDFile": "",
+            "LogConfig": {
+                "Type": "journald",
+                "Config": null,
+                "Path": "",
+                "Tag": "",
+                "Size": "0B"
+            },
+            "NetworkMode": "slirp4netns",
+            "PortBindings": {},
+            "RestartPolicy": {
+                "Name": "",
+                "MaximumRetryCount": 0
+            },
+            "AutoRemove": false,
+            "VolumeDriver": "",
+            "VolumesFrom": null,
+            "CapAdd": [],
+            "CapDrop": [
+                "CAP_AUDIT_WRITE",
+                "CAP_MKNOD",
+                "CAP_NET_RAW"
+            ],
+            "Dns": [],
+            "DnsOptions": [],
+            "DnsSearch": [],
+            "ExtraHosts": [],
+            "GroupAdd": [],
+            "IpcMode": "private",
+            "Cgroup": "",
+            "Cgroups": "default",
+            "Links": null,
+            "OomScoreAdj": 0,
+            "PidMode": "private",
+            "Privileged": false,
+            "PublishAllPorts": false,
+            "ReadonlyRootfs": false,
+            "SecurityOpt": [],
+            "Tmpfs": {},
+            "UTSMode": "private",
+            "UsernsMode": "",
+            "ShmSize": 65536000,
+            "Runtime": "oci",
+            "ConsoleSize": [
+                0,
+                0
+            ],
+            "Isolation": "",
+            "CpuShares": 0,
+            "Memory": 0,
+            "NanoCpus": 0,
+            "CgroupParent": "user.slice",
+            "BlkioWeight": 0,
+            "BlkioWeightDevice": null,
+            "BlkioDeviceReadBps": null,
+            "BlkioDeviceWriteBps": null,
+            "BlkioDeviceReadIOps": null,
+            "BlkioDeviceWriteIOps": null,
+            "CpuPeriod": 0,
+            "CpuQuota": 0,
+            "CpuRealtimePeriod": 0,
+            "CpuRealtimeRuntime": 0,
+            "CpusetCpus": "",
+            "CpusetMems": "",
+            "Devices": [],
+            "DiskQuota": 0,
+            "KernelMemory": 0,
+            "MemoryReservation": 0,
+            "MemorySwap": 0,
+            "MemorySwappiness": 0,
+            "OomKillDisable": false,
+            "PidsLimit": 2048,
+            "Ulimits": [],
+            "CpuCount": 0,
+            "CpuPercent": 0,
+            "IOMaximumIOps": 0,
+            "IOMaximumBandwidth": 0,
+            "CgroupConf": null
+        }
+    }
+]
+```
+
+```
+$ podman container inspect nervous_fermi --format "{{.ImageName}}"
+registry.access.redhat.com/ubi8:latest
+```
+
+```
+$ podman container inspect foobar --format "{{.GraphDriver.Name}}"
+overlay
+```
+
+```
+$ podman container inspect --latest --format {{.EffectiveCaps}}
+[CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FSETID CAP_KILL CAP_NET_BIND_SERVICE CAP_SETFCAP CAP_SETGID CAP_SETPCAP CAP_SETUID CAP_SYS_CHROOT]
+```
+
+## SEE ALSO
+**[podman(1)](podman.1.md)**,**[podman-container(1)](podman-container.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)**
+
+## HISTORY
+Sep 2021, Originally compiled by Dan Walsh <dwalsh@redhat.com>
diff --git a/docs/source/markdown/podman-container.1.md b/docs/source/markdown/podman-container.1.md
index 3cc90d9ec..c950347a9 100644
--- a/docs/source/markdown/podman-container.1.md
+++ b/docs/source/markdown/podman-container.1.md
@@ -24,7 +24,7 @@ The container command allows you to manage containers
 | exists     | [podman-container-exists(1)](podman-container-exists.1.md)  | Check if a container exists in local storage                         |
 | export     | [podman-export(1)](podman-export.1.md)              | Export a container's filesystem contents as a tar archive.                   |
 | init       | [podman-init(1)](podman-init.1.md)                  | Initialize a container                                                       |
-| inspect    | [podman-inspect(1)](podman-inspect.1.md)            | Display a container or image's configuration.                                |
+| inspect    | [podman-container-inspect(1)](podman-container-inspect.1.md)| Display a container's configuration.                                 |
 | kill       | [podman-kill(1)](podman-kill.1.md)                  | Kill the main process in one or more containers.                             |
 | list       | [podman-ps(1)](podman-ps.1.md)                      | List the containers on the system.(alias ls)                                 |
 | logs       | [podman-logs(1)](podman-logs.1.md)                  | Display the logs of a container.                                             |
diff --git a/docs/source/markdown/podman-create.1.md b/docs/source/markdown/podman-create.1.md
index 00e94b41d..00601e778 100644
--- a/docs/source/markdown/podman-create.1.md
+++ b/docs/source/markdown/podman-create.1.md
@@ -682,7 +682,7 @@ Valid _mode_ values are:
 
 #### **--network-alias**=*alias*
 
-Add network-scoped alias for the container
+Add network-scoped alias for the container.  NOTE: A container will only have access to aliases on the first network that it joins. This is a limitation that will be removed in a later release.
 
 #### **--no-healthcheck**=*true|false*
 
diff --git a/docs/source/markdown/podman-generate-kube.1.md b/docs/source/markdown/podman-generate-kube.1.md
index 2e9f68bf3..9ae3941ec 100644
--- a/docs/source/markdown/podman-generate-kube.1.md
+++ b/docs/source/markdown/podman-generate-kube.1.md
@@ -37,8 +37,6 @@ random port is assigned by Podman in the specification.
 Create Kubernetes Pod YAML for a container called `some-mariadb`.
 ```
 $ sudo podman generate kube some-mariadb
-# Generation of Kubernetes YAML is still under development!
-#
 # Save the output of this file and use kubectl create -f to import
 # it into Kubernetes.
 #
@@ -93,8 +91,6 @@ status: {}
 Create Kubernetes Pod YAML for a container with the directory `/home/user/my-data` on the host bind-mounted in the container to `/volume`.
 ```
 $ podman generate kube my-container-with-bind-mounted-data
-# Generation of Kubernetes YAML is still under development!
-#
 # Save the output of this file and use kubectl create -f to import
 # it into Kubernetes.
 #
@@ -147,8 +143,6 @@ status: {}
 Create Kubernetes Pod YAML for a container with the named volume `priceless-data` mounted in the container at `/volume`.
 ```
 $ podman generate kube my-container-using-priceless-data
-# Generation of Kubernetes YAML is still under development!
-#
 # Save the output of this file and use kubectl create -f to import
 # it into Kubernetes.
 #
@@ -200,8 +194,6 @@ status: {}
 Create Kubernetes Pod YAML for a pod called `demoweb` and include a service.
 ```
 $ sudo podman generate kube -s demoweb
-# Generation of Kubernetes YAML is still under development!
-#
 # Save the output of this file and use kubectl create -f to import
 # it into Kubernetes.
 #
diff --git a/docs/source/markdown/podman-image-inspect.1.md b/docs/source/markdown/podman-image-inspect.1.md
new file mode 100644
index 000000000..a4f81dfc0
--- /dev/null
+++ b/docs/source/markdown/podman-image-inspect.1.md
@@ -0,0 +1,105 @@
+% podman-image-inspect(1)
+
+## NAME
+podman\-image\-inspect - Display an image's configuration
+
+## SYNOPSIS
+**podman image inspect** [*options*] *image* [*image* ...]
+
+## DESCRIPTION
+
+This displays the low-level information on images identified by name or ID. By default, this will render
+all results in a JSON array.  If a format is specified, the given template will be executed for each result.
+
+## OPTIONS
+
+#### **--format**, **-f**=*format*
+
+Format the output using the given Go template.
+The keys of the returned JSON can be used as the values for the --format flag (see examples below).
+
+## EXAMPLE
+
+```
+$ podman image inspect fedora
+[
+    {
+        "Id": "37e5619f4a8ca9dbc4d6c0ae7890625674a10dbcfb76201399e2aaddb40da17d",
+        "Digest": "sha256:1b0d4ddd99b1a8c8a80e885aafe6034c95f266da44ead992aab388e6aa91611a",
+        "RepoTags": [
+            "registry.fedoraproject.org/fedora:latest"
+        ],
+        "RepoDigests": [
+            "registry.fedoraproject.org/fedora@sha256:1b0d4ddd99b1a8c8a80e885aafe6034c95f266da44ead992aab388e6aa91611a",
+            "registry.fedoraproject.org/fedora@sha256:b5290db40008aae9272ad3a6bd8070ef7ecd547c3bef014b894c327960acc582"
+        ],
+        "Parent": "",
+        "Comment": "Created by Image Factory",
+        "Created": "2021-08-09T05:48:47Z",
+        "Config": {
+            "Env": [
+                "DISTTAG=f34container",
+                "FGC=f34",
+                "container=oci"
+            ],
+            "Cmd": [
+                "/bin/bash"
+            ],
+            "Labels": {
+                "license": "MIT",
+                "name": "fedora",
+                "vendor": "Fedora Project",
+                "version": "34"
+            }
+        },
+        "Version": "1.10.1",
+        "Author": "",
+        "Architecture": "amd64",
+        "Os": "linux",
+        "Size": 183852302,
+        "VirtualSize": 183852302,
+        "GraphDriver": {
+            "Name": "overlay",
+            "Data": {
+                "UpperDir": "/home/dwalsh/.local/share/containers/storage/overlay/0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2/diff",
+                "WorkDir": "/home/dwalsh/.local/share/containers/storage/overlay/0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2/work"
+            }
+        },
+        "RootFS": {
+            "Type": "layers",
+            "Layers": [
+                "sha256:0203e243f1ca4b6bb49371ecd21363212467ec6d7d3fa9f324cd4e78cc6b5fa2"
+            ]
+        },
+        "Labels": {
+            "license": "MIT",
+            "name": "fedora",
+            "vendor": "Fedora Project",
+            "version": "34"
+        },
+        "Annotations": {},
+        "ManifestType": "application/vnd.docker.distribution.manifest.v2+json",
+        "User": "",
+        "History": [
+            {
+                "created": "2021-08-09T05:48:47Z",
+                "comment": "Created by Image Factory"
+            }
+        ],
+        "NamesHistory": [
+            "registry.fedoraproject.org/fedora:latest"
+        ]
+    }
+]
+```
+
+```
+$ podman image inspect --format '{{ .Id }}' fedora
+37e5619f4a8ca9dbc4d6c0ae7890625674a10dbcfb76201399e2aaddb40da17d
+```
+
+## SEE ALSO
+**[podman(1)](podman.1.md)**,**[podman-image(1)](podman-image.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)**
+
+## HISTORY
+Sep 2021, Originally compiled by Dan Walsh <dwalsh@redhat.com>
diff --git a/docs/source/markdown/podman-image.1.md b/docs/source/markdown/podman-image.1.md
index 3e6050d99..01024519f 100644
--- a/docs/source/markdown/podman-image.1.md
+++ b/docs/source/markdown/podman-image.1.md
@@ -11,30 +11,30 @@ The image command allows you to manage images
 
 ## COMMANDS
 
-| Command  | Man Page                                        | Description                                                                 |
-| -------- | ----------------------------------------------- | --------------------------------------------------------------------------- |
-| build    | [podman-build(1)](podman-build.1.md)            | Build a container using a Dockerfile.                                       |
-| diff     | [podman-image-diff(1)](podman-image-diff.1.md)  | Inspect changes on an image's filesystem.                                   |
-| exists   | [podman-image-exists(1)](podman-image-exists.1.md) | Check if an image exists in local storage.                               |
-| history  | [podman-history(1)](podman-history.1.md)        | Show the history of an image.                                               |
-| import   | [podman-import(1)](podman-import.1.md)              | Import a tarball and save it as a filesystem image.                         |
-| inspect  | [podman-inspect(1)](podman-inspect.1.md)            | Display an image or image's configuration.                                   |
-| list     | [podman-images(1)](podman-images.1.md)              | List the container images on the system.(alias ls)                          |
-| load     | [podman-load(1)](podman-load.1.md)                  | Load an image from the docker archive.                                      |
-| mount    | [podman-image-mount(1)](podman-image-mount.1.md)    | Mount an image's root filesystem.                                           |
-| prune    | [podman-image-prune(1)](podman-image-prune.1.md)    | Remove all unused images from the local store.                              |
-| pull     | [podman-pull(1)](podman-pull.1.md)                  | Pull an image from a registry.                                              |
-| push     | [podman-push(1)](podman-push.1.md)                  | Push an image from local storage to elsewhere.                              |
-| rm       | [podman-rmi(1)](podman-rmi.1.md)                    | Removes one or more locally stored images.                                  |
-| save     | [podman-save(1)](podman-save.1.md)                  | Save an image to docker-archive or oci.                                     |
-| scp      | [podman-image-scp(1)](podman-image-scp.1.md)         | Securely copy an image from one host to another.                            |
-| search   | [podman-search(1)](podman-search.1.md)              | Search a registry for an image.                                             |
-| sign     | [podman-image-sign(1)](podman-image-sign.1.md)      | Create a signature for an image.                                            |
-| tag      | [podman-tag(1)](podman-tag.1.md)                    | Add an additional name to a local image.                                    |
-| tree     | [podman-image-tree(1)](podman-image-tree.1.md)      | Prints layer hierarchy of an image in a tree format.                        |
-| trust    | [podman-image-trust(1)](podman-image-trust.1.md)    | Manage container registry image trust policy.                               |
-| unmount   | [podman-image-unmount(1)](podman-image-unmount.1.md)  | Unmount an image's root filesystem.                                         |
-| untag    | [podman-untag(1)](podman-untag.1.md)                | Removes one or more names from a locally-stored image.                      |
+| Command  | Man Page                                            | Description                                                             |
+| -------- | --------------------------------------------------- | ----------------------------------------------------------------------- |
+| build    | [podman-build(1)](podman-build.1.md)                | Build a container using a Dockerfile.                                   |
+| diff     | [podman-image-diff(1)](podman-image-diff.1.md)      | Inspect changes on an image's filesystem.                               |
+| exists   | [podman-image-exists(1)](podman-image-exists.1.md)  | Check if an image exists in local storage.                              |
+| history  | [podman-history(1)](podman-history.1.md)            | Show the history of an image.                                           |
+| import   | [podman-import(1)](podman-import.1.md)              | Import a tarball and save it as a filesystem image.                     |
+| inspect  | [podman-image-inspect(1)](podman-image-inspect.1.md)| Display an image's configuration.                                       |
+| list     | [podman-images(1)](podman-images.1.md)              | List the container images on the system.(alias ls)                      |
+| load     | [podman-load(1)](podman-load.1.md)                  | Load an image from the docker archive.                                  |
+| mount    | [podman-image-mount(1)](podman-image-mount.1.md)    | Mount an image's root filesystem.                                       |
+| prune    | [podman-image-prune(1)](podman-image-prune.1.md)    | Remove all unused images from the local store.                          |
+| pull     | [podman-pull(1)](podman-pull.1.md)                  | Pull an image from a registry.                                          |
+| push     | [podman-push(1)](podman-push.1.md)                  | Push an image from local storage to elsewhere.                          |
+| rm       | [podman-rmi(1)](podman-rmi.1.md)                    | Removes one or more locally stored images.                              |
+| save     | [podman-save(1)](podman-save.1.md)                  | Save an image to docker-archive or oci.                                 |
+| scp      | [podman-image-scp(1)](podman-image-scp.1.md)        | Securely copy an image from one host to another.                        |
+| search   | [podman-search(1)](podman-search.1.md)              | Search a registry for an image.                                         |
+| sign     | [podman-image-sign(1)](podman-image-sign.1.md)      | Create a signature for an image.                                        |
+| tag      | [podman-tag(1)](podman-tag.1.md)                    | Add an additional name to a local image.                                |
+| tree     | [podman-image-tree(1)](podman-image-tree.1.md)      | Prints layer hierarchy of an image in a tree format.                    |
+| trust    | [podman-image-trust(1)](podman-image-trust.1.md)    | Manage container registry image trust policy.                           |
+| unmount   | [podman-image-unmount(1)](podman-image-unmount.1.md)  | Unmount an image's root filesystem.                                  |
+| untag    | [podman-untag(1)](podman-untag.1.md)                | Removes one or more names from a locally-stored image.                  |
 
 ## SEE ALSO
 podman
diff --git a/docs/source/markdown/podman-inspect.1.md b/docs/source/markdown/podman-inspect.1.md
index bfd0cea3d..83dc5cbbe 100644
--- a/docs/source/markdown/podman-inspect.1.md
+++ b/docs/source/markdown/podman-inspect.1.md
@@ -13,14 +13,12 @@ all results in a JSON array. If the inspect type is all, the order of inspection
  So, if a container has the same name as an image, then the container JSON will be returned, and so on.
  If a format is specified, the given template will be executed for each result.
 
-For more inspection options, see:
-
-      podman container inspect
-      podman image inspect
-      podman network inspect
-      podman pod inspect
-      podman volume inspect
-
+For more inspection options, see also
+[podman-container-inspect(1)](podman-container-inspect.1.md),
+[podman-image-inspect(1)](podman-image-inspect.1.md),
+[podman-network-inspect(1)](podman-network-inspect.1.md),
+[podman-pod-inspect(1)](podman-pod-inspect.1.md), and
+[podman-volume-inspect(1)](podman-volume-inspect.1.md).
 
 ## OPTIONS
 
@@ -164,7 +162,7 @@ myNetwork
 ```
 
 ## SEE ALSO
-podman(1)
+**[podman(1)](podman.1.md)**,**[podman-container-inspect(1)](podman-container-inspect.1.md)**,**[podman-image-inspect(1)](podman-image-inspect.1.md)**,**[podman-network-inspect(1)](podman-network-inspect.1.md)**,**[podman-pod-inspect(1)](podman-pod-inspect.1.md)**,**[podman-volume-inspect(1)](podman-volume-inspect.1.md)**.
 
 ## HISTORY
 July 2017, Originally compiled by Dan Walsh <dwalsh@redhat.com>
diff --git a/docs/source/markdown/podman-network-connect.1.md b/docs/source/markdown/podman-network-connect.1.md
index 47a54bd33..39893c676 100644
--- a/docs/source/markdown/podman-network-connect.1.md
+++ b/docs/source/markdown/podman-network-connect.1.md
@@ -14,6 +14,8 @@ Once connected, the container can communicate with other containers in the same
 #### **--alias**
 Add network-scoped alias for the container.  If the network is using the `dnsname` CNI plugin, these aliases
 can be used for name resolution on the given network.  Multiple *--alias* options may be specified as input.
+NOTE: A container will only have access to aliases on the first network that it joins.  This is a limitation
+that will be removed in a later release.
 
 ## EXAMPLE
 
diff --git a/docs/source/markdown/podman-pod-create.1.md b/docs/source/markdown/podman-pod-create.1.md
index 5909bdaf0..2e568c971 100644
--- a/docs/source/markdown/podman-pod-create.1.md
+++ b/docs/source/markdown/podman-pod-create.1.md
@@ -125,7 +125,7 @@ Set network mode for the pod. Supported values are:
 
 #### **--network-alias**=strings
 
-Add a DNS alias for the container. When the container is joined to a CNI network with support for the dnsname plugin, the container will be accessible through this name from other containers in the network.
+Add a DNS alias for the pod. When the pod is joined to a CNI network with support for the dnsname plugin, the containers inside the pod will be accessible through this name from other containers in the network.
 
 #### **--no-hosts**=**true**|**false**
 
diff --git a/docs/source/markdown/podman-pod-inspect.1.md b/docs/source/markdown/podman-pod-inspect.1.md
index 1f4e6cb06..0c58b099e 100644
--- a/docs/source/markdown/podman-pod-inspect.1.md
+++ b/docs/source/markdown/podman-pod-inspect.1.md
@@ -70,7 +70,7 @@ Valid placeholders for the Go template are listed below:
 ```
 
 ## SEE ALSO
-podman-pod(1), podman-pod-ps(1)
+**[podman(1)](podman.1.md)**,**[podman-pod(1)](podman-pod.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)**
 
 ## HISTORY
 August 2018, Originally compiled by Brent Baude <bbaude@redhat.com>
diff --git a/docs/source/markdown/podman-pull.1.md b/docs/source/markdown/podman-pull.1.md
index aa0815f4b..d440e8476 100644
--- a/docs/source/markdown/podman-pull.1.md
+++ b/docs/source/markdown/podman-pull.1.md
@@ -234,7 +234,7 @@ Storing signatures
 ```
 
 ## SEE ALSO
-**[podman(1)](podman.1.md)**, **[podman-push(1)](podman-push.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.d.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)**
+**[podman(1)](podman.1.md)**, **[podman-push(1)](podman-push.1.md)**, **[podman-login(1)](podman-login.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.d.5.md)**, **[containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md)**
 
 ## HISTORY
 July 2017, Originally compiled by Urvashi Mohnani <umohnani@redhat.com>
diff --git a/docs/source/markdown/podman-rmi.1.md b/docs/source/markdown/podman-rmi.1.md
index e34b1964b..4f3ec5541 100644
--- a/docs/source/markdown/podman-rmi.1.md
+++ b/docs/source/markdown/podman-rmi.1.md
@@ -12,6 +12,8 @@ podman\-rmi - Removes one or more locally stored images
 Removes one or more locally stored images.
 Passing an argument _image_ deletes it, along with any of its dangling parent images.  A dangling image is an image without a tag and without being referenced by another image.
 
+Note: To delete an image from a remote registry, use the [**skopeo delete**](https://github.com/containers/skopeo/blob/main/docs/skopeo-delete.1.md) command. Some registries do not allow users to delete an image via a CLI remotely.
+
 ## OPTIONS
 
 #### **--all**, **-a**
@@ -51,7 +53,7 @@ $ podman rmi -a -f
   **125** The command fails for any other reason
 
 ## SEE ALSO
-podman(1)
+podman(1), skopeo-delete(1)
 
 ## HISTORY
 March 2017, Originally compiled by Dan Walsh <dwalsh@redhat.com>
diff --git a/docs/source/markdown/podman-run.1.md b/docs/source/markdown/podman-run.1.md
index 63224b49d..fccb51cd8 100644
--- a/docs/source/markdown/podman-run.1.md
+++ b/docs/source/markdown/podman-run.1.md
@@ -702,7 +702,7 @@ Valid _mode_ values are:
 
 #### **--network-alias**=*alias*
 
-Add network-scoped alias for the container
+Add network-scoped alias for the container.  NOTE: A container will only have access to aliases on the first network that it joins. This is a limitation that will be removed in a later release.
 
 #### **--no-healthcheck**=*true|false*
 
diff --git a/docs/source/markdown/podman-search.1.md b/docs/source/markdown/podman-search.1.md
index 661ad6742..0ae996bda 100644
--- a/docs/source/markdown/podman-search.1.md
+++ b/docs/source/markdown/podman-search.1.md
@@ -169,7 +169,7 @@ Note: This works only with registries that implement the v2 API. If tried with a
 
 **registries.conf** (`/etc/containers/registries.conf`)
 
-	registries.conf is the configuration file which specifies which container registries should be consulted when completing image names which do not include a registry or domain portion.
+registries.conf is the configuration file which specifies which container registries should be consulted when completing image names which do not include a registry or domain portion.
 
 ## SEE ALSO
 podman(1), containers-registries.conf(5)
diff --git a/docs/source/markdown/podman-volume-inspect.1.md b/docs/source/markdown/podman-volume-inspect.1.md
index ea0ee91b4..4595ccda6 100644
--- a/docs/source/markdown/podman-volume-inspect.1.md
+++ b/docs/source/markdown/podman-volume-inspect.1.md
@@ -40,7 +40,7 @@ $ podman volume inspect --format "{{.Driver}} {{.Scope}}" myvol
 ```
 
 ## SEE ALSO
-podman-volume(1)
+**[podman(1)](podman.1.md)**,**[podman-volume(1)](podman-volume.1.md)**, **[podman-inspect(1)](podman-inspect.1.md)**
 
 ## HISTORY
 November 2018, Originally compiled by Urvashi Mohnani <umohnani@redhat.com>
diff --git a/docs/source/markdown/podman.1.md b/docs/source/markdown/podman.1.md
index 2510eaa81..8abba3763 100644
--- a/docs/source/markdown/podman.1.md
+++ b/docs/source/markdown/podman.1.md
@@ -276,7 +276,7 @@ the exit codes follow the `chroot` standard, see below:
 
 **containers.conf** (`/usr/share/containers/containers.conf`, `/etc/containers/containers.conf`, `$HOME/.config/containers/containers.conf`)
 
-    Podman has builtin defaults for command line options. These defaults can be overridden using the containers.conf configuration files.
+Podman has builtin defaults for command line options. These defaults can be overridden using the containers.conf configuration files.
 
 Distributions ship the `/usr/share/containers/containers.conf` file with their default settings. Administrators can override fields in this file by creating the `/etc/containers/containers.conf` file.  Users can further modify defaults by creating the `$HOME/.config/containers/containers.conf` file. Podman merges its builtin defaults with the specified fields from these files, if they exist. Fields specified in the users file override the administrator's file, which overrides the distribution's file, which override the built-in defaults.
 
@@ -286,31 +286,31 @@ If the **CONTAINERS_CONF** environment variable is set, then its value is used f
 
 **mounts.conf** (`/usr/share/containers/mounts.conf`)
 
-    The mounts.conf file specifies volume mount directories that are automatically mounted inside containers when executing the `podman run` or `podman start` commands. Administrators can override the defaults file by creating `/etc/containers/mounts.conf`.
+The mounts.conf file specifies volume mount directories that are automatically mounted inside containers when executing the `podman run` or `podman start` commands. Administrators can override the defaults file by creating `/etc/containers/mounts.conf`.
 
 When Podman runs in rootless mode, the file `$HOME/.config/containers/mounts.conf` will override the default if it exists. Please refer to containers-mounts.conf(5) for further details.
 
 **policy.json** (`/etc/containers/policy.json`)
 
-    Signature verification policy files are used to specify policy, e.g. trusted keys, applicable when deciding whether to accept an image, or individual signatures of that image, as valid.
+Signature verification policy files are used to specify policy, e.g. trusted keys, applicable when deciding whether to accept an image, or individual signatures of that image, as valid.
 
 **registries.conf** (`/etc/containers/registries.conf`, `$HOME/.config/containers/registries.conf`)
 
-    registries.conf is the configuration file which specifies which container registries should be consulted when completing image names which do not include a registry or domain portion.
+registries.conf is the configuration file which specifies which container registries should be consulted when completing image names which do not include a registry or domain portion.
 
-    Non root users of Podman can create the `$HOME/.config/containers/registries.conf` file to be used instead of the system defaults.
+Non root users of Podman can create the `$HOME/.config/containers/registries.conf` file to be used instead of the system defaults.
 
-    If the **CONTAINERS_REGISTRIES_CONF** environment variable is set, then its value is used for the registries.conf file rather than the default.
+If the **CONTAINERS_REGISTRIES_CONF** environment variable is set, then its value is used for the registries.conf file rather than the default.
 
 **storage.conf** (`/etc/containers/storage.conf`, `$HOME/.config/containers/storage.conf`)
 
-    storage.conf is the storage configuration file for all tools using containers/storage
+storage.conf is the storage configuration file for all tools using containers/storage
 
-    The storage configuration file specifies all of the available container storage options for tools using shared container storage.
+The storage configuration file specifies all of the available container storage options for tools using shared container storage.
 
-    When Podman runs in rootless mode, the file `$HOME/.config/containers/storage.conf` is used instead of the system defaults.
+When Podman runs in rootless mode, the file `$HOME/.config/containers/storage.conf` is used instead of the system defaults.
 
-    If the **CONTAINERS_STORAGE_CONF** environment variable is set, the its value is used for the storage.conf file rather than the default.
+If the **CONTAINERS_STORAGE_CONF** environment variable is set, the its value is used for the storage.conf file rather than the default.
 
 ## Rootless mode
 Podman can also be used as non-root user. When podman runs in rootless mode, a user namespace is automatically created for the user, defined in /etc/subuid and /etc/subgid.
diff --git a/go.mod b/go.mod
index cffc26c11..bebf73093 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/containers/conmon v2.0.20+incompatible
 	github.com/containers/image/v5 v5.16.0
 	github.com/containers/ocicrypt v1.1.2
-	github.com/containers/psgo v1.6.0
+	github.com/containers/psgo v1.7.1
 	github.com/containers/storage v1.36.0
 	github.com/coreos/go-systemd/v22 v22.3.2
 	github.com/coreos/stream-metadata-go v0.0.0-20210225230131-70edb9eb47b3
diff --git a/go.sum b/go.sum
index b180683b4..30037c4f7 100644
--- a/go.sum
+++ b/go.sum
@@ -260,8 +260,8 @@ github.com/containers/ocicrypt v1.1.0/go.mod h1:b8AOe0YR67uU8OqfVNcznfFpAzu3rdgU
 github.com/containers/ocicrypt v1.1.1/go.mod h1:Dm55fwWm1YZAjYRaJ94z2mfZikIyIN4B0oB3dj3jFxY=
 github.com/containers/ocicrypt v1.1.2 h1:Ez+GAMP/4GLix5Ywo/fL7O0nY771gsBIigiqUm1aXz0=
 github.com/containers/ocicrypt v1.1.2/go.mod h1:Dm55fwWm1YZAjYRaJ94z2mfZikIyIN4B0oB3dj3jFxY=
-github.com/containers/psgo v1.6.0 h1:jkl/5kndKmJ/bnSFq8in6xRDAzgW26GnNuTxoycNFvk=
-github.com/containers/psgo v1.6.0/go.mod h1:ggVhB2KQi9qGZdqSlczqN0BwcJdotmpRru87S1anRO8=
+github.com/containers/psgo v1.7.1 h1:2N6KADeFvBm1aI2iXxu6+/Xh7CCkdh8p8F3F/cpIU5I=
+github.com/containers/psgo v1.7.1/go.mod h1:mWGpFzW73qWFA+blhF6l7GuKzbrACkYgr/ajiNQR+RM=
 github.com/containers/storage v1.23.5/go.mod h1:ha26Q6ngehFNhf3AWoXldvAvwI4jFe3ETQAf/CeZPyM=
 github.com/containers/storage v1.35.0/go.mod h1:qzYhasQP2/V9D9XdO+vRwkHBhsBO0oznMLzzRDQ8s20=
 github.com/containers/storage v1.36.0 h1:OelxllCW19tnNngYuZw2ty/zLabVMG5rSs3KSwO1Lzc=
diff --git a/libpod/boltdb_state_unsupported.go b/libpod/boltdb_state_unsupported.go
deleted file mode 100644
index 244dc51a0..000000000
--- a/libpod/boltdb_state_unsupported.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// +build !linux
-
-package libpod
-
-// replaceNetNS is exclusive to the Linux platform and is a no-op elsewhere
-func replaceNetNS(netNSPath string, ctr *Container, newState *ContainerState) error {
-	return nil
-}
-
-// getNetNSPath is exclusive to the Linux platform and is a no-op elsewhere
-func getNetNSPath(ctr *Container) string {
-	return ""
-}
diff --git a/libpod/container_copy_unsupported.go b/libpod/container_copy_unsupported.go
deleted file mode 100644
index b2bdd3e3d..000000000
--- a/libpod/container_copy_unsupported.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// +build !linux
-
-package libpod
-
-import (
-	"context"
-	"io"
-)
-
-func (c *Container) copyFromArchive(ctx context.Context, path string, reader io.Reader) (func() error, error) {
-	return nil, nil
-}
-
-func (c *Container) copyToArchive(ctx context.Context, path string, writer io.Writer) (func() error, error) {
-	return nil, nil
-}
diff --git a/libpod/container_inspect.go b/libpod/container_inspect.go
index 2ef4532cd..9fcf13d53 100644
--- a/libpod/container_inspect.go
+++ b/libpod/container_inspect.go
@@ -151,7 +151,7 @@ func (c *Container) getContainerInspectData(size bool, driverData *define.Driver
 
 	if c.config.HealthCheckConfig != nil {
 		// This container has a healthcheck defined in it; we need to add it's state
-		healthCheckState, err := c.GetHealthCheckLog()
+		healthCheckState, err := c.getHealthCheckLog()
 		if err != nil {
 			// An error here is not considered fatal; no health state will be displayed
 			logrus.Error(err)
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index 4194a0d93..89287efc9 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -2001,15 +2001,16 @@ func (c *Container) getHosts() string {
 
 		// Do we have a network namespace?
 		netNone := false
-		for _, ns := range c.config.Spec.Linux.Namespaces {
-			if ns.Type == spec.NetworkNamespace {
-				if ns.Path == "" && !c.config.CreateNetNS {
-					netNone = true
+		if c.config.NetNsCtr == "" && !c.config.CreateNetNS {
+			for _, ns := range c.config.Spec.Linux.Namespaces {
+				if ns.Type == spec.NetworkNamespace {
+					if ns.Path == "" {
+						netNone = true
+					}
+					break
 				}
-				break
 			}
 		}
-
 		// If we are net=none (have a network namespace, but not connected to
 		// anything) add the container's name and hostname to localhost.
 		if netNone {
diff --git a/libpod/container_internal_unsupported.go b/libpod/container_internal_unsupported.go
deleted file mode 100644
index 125329ce5..000000000
--- a/libpod/container_internal_unsupported.go
+++ /dev/null
@@ -1,64 +0,0 @@
-// +build !linux
-
-package libpod
-
-import (
-	"context"
-
-	"github.com/containers/podman/v3/libpod/define"
-	"github.com/containers/podman/v3/pkg/lookup"
-	spec "github.com/opencontainers/runtime-spec/specs-go"
-)
-
-func (c *Container) mountSHM(shmOptions string) error {
-	return define.ErrNotImplemented
-}
-
-func (c *Container) unmountSHM(mount string) error {
-	return define.ErrNotImplemented
-}
-
-func (c *Container) prepare() error {
-	return define.ErrNotImplemented
-}
-
-func (c *Container) cleanupNetwork() error {
-	return define.ErrNotImplemented
-}
-
-func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
-	return nil, define.ErrNotImplemented
-}
-
-func (c *Container) checkpoint(ctx context.Context, options ContainerCheckpointOptions) error {
-	return define.ErrNotImplemented
-}
-
-func (c *Container) restore(ctx context.Context, options ContainerCheckpointOptions) error {
-	return define.ErrNotImplemented
-}
-
-func (c *Container) copyOwnerAndPerms(source, dest string) error {
-	return nil
-}
-
-func (c *Container) getOCICgroupPath() (string, error) {
-	return "", define.ErrNotImplemented
-}
-
-func (c *Container) cleanupOverlayMounts() error {
-	return nil
-}
-
-func (c *Container) reloadNetwork() error {
-	return define.ErrNotImplemented
-}
-
-func (c *Container) getUserOverrides() *lookup.Overrides {
-	return nil
-}
-
-// Fix ownership and permissions of the specified volume if necessary.
-func (c *Container) fixVolumePermissions(v *ContainerNamedVolume) error {
-	return define.ErrNotImplemented
-}
diff --git a/libpod/container_stat_unsupported.go b/libpod/container_stat_unsupported.go
deleted file mode 100644
index c002e4d32..000000000
--- a/libpod/container_stat_unsupported.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// +build !linux
-
-package libpod
-
-import (
-	"context"
-
-	"github.com/containers/podman/v3/libpod/define"
-)
-
-func (c *Container) stat(ctx context.Context, containerMountPoint string, containerPath string) (*define.FileInfo, string, string, error) {
-	return nil, "", "", nil
-}
diff --git a/libpod/container_top_unsupported.go b/libpod/container_top_unsupported.go
deleted file mode 100644
index 1a096d248..000000000
--- a/libpod/container_top_unsupported.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// +build !linux
-
-package libpod
-
-import "github.com/containers/podman/v3/libpod/define"
-
-// Top gathers statistics about the running processes in a container. It returns a
-// []string for output
-func (c *Container) Top(descriptors []string) ([]string, error) {
-	return nil, define.ErrNotImplemented
-}
-
-// GetContainerPidInformation returns process-related data of all processes in
-// the container.  The output data can be controlled via the `descriptors`
-// argument which expects format descriptors and supports all AIXformat
-// descriptors of ps (1) plus some additional ones to for instance inspect the
-// set of effective capabilities.  Each element in the returned string slice
-// is a tab-separated string.
-//
-// For more details, please refer to github.com/containers/psgo.
-func (c *Container) GetContainerPidInformation(descriptors []string) ([]string, error) {
-	return nil, define.ErrNotImplemented
-}
diff --git a/libpod/container_unsupported.go b/libpod/container_unsupported.go
deleted file mode 100644
index e214b9465..000000000
--- a/libpod/container_unsupported.go
+++ /dev/null
@@ -1,5 +0,0 @@
-// +build !linux
-
-package libpod
-
-type containerPlatformState struct{}
diff --git a/libpod/healthcheck.go b/libpod/healthcheck.go
index c32ba85cb..91f031513 100644
--- a/libpod/healthcheck.go
+++ b/libpod/healthcheck.go
@@ -162,7 +162,7 @@ func newHealthCheckLog(start, end time.Time, exitCode int, log string) define.He
 // updatedHealthCheckStatus updates the health status of the container
 // in the healthcheck log
 func (c *Container) updateHealthStatus(status string) error {
-	healthCheck, err := c.GetHealthCheckLog()
+	healthCheck, err := c.getHealthCheckLog()
 	if err != nil {
 		return err
 	}
@@ -176,7 +176,7 @@ func (c *Container) updateHealthStatus(status string) error {
 
 // UpdateHealthCheckLog parses the health check results and writes the log
 func (c *Container) updateHealthCheckLog(hcl define.HealthCheckLog, inStartPeriod bool) error {
-	healthCheck, err := c.GetHealthCheckLog()
+	healthCheck, err := c.getHealthCheckLog()
 	if err != nil {
 		return err
 	}
@@ -213,10 +213,11 @@ func (c *Container) healthCheckLogPath() string {
 	return filepath.Join(filepath.Dir(c.state.RunDir), "healthcheck.log")
 }
 
-// GetHealthCheckLog returns HealthCheck results by reading the container's
+// getHealthCheckLog returns HealthCheck results by reading the container's
 // health check log file.  If the health check log file does not exist, then
 // an empty healthcheck struct is returned
-func (c *Container) GetHealthCheckLog() (define.HealthCheckResults, error) {
+// The caller should lock the container before this function is called.
+func (c *Container) getHealthCheckLog() (define.HealthCheckResults, error) {
 	var healthCheck define.HealthCheckResults
 	if _, err := os.Stat(c.healthCheckLogPath()); os.IsNotExist(err) {
 		return healthCheck, nil
@@ -236,7 +237,12 @@ func (c *Container) HealthCheckStatus() (string, error) {
 	if !c.HasHealthCheck() {
 		return "", errors.Errorf("container %s has no defined healthcheck", c.ID())
 	}
-	results, err := c.GetHealthCheckLog()
+	c.lock.Lock()
+	defer c.lock.Unlock()
+	if err := c.syncContainer(); err != nil {
+		return "", err
+	}
+	results, err := c.getHealthCheckLog()
 	if err != nil {
 		return "", errors.Wrapf(err, "unable to get healthcheck log for %s", c.ID())
 	}
diff --git a/libpod/healthcheck_unsupported.go b/libpod/healthcheck_unsupported.go
deleted file mode 100644
index 8b6a0209b..000000000
--- a/libpod/healthcheck_unsupported.go
+++ /dev/null
@@ -1,21 +0,0 @@
-// +build !linux
-
-package libpod
-
-import "github.com/containers/podman/v3/libpod/define"
-
-// createTimer systemd timers for healthchecks of a container
-func (c *Container) createTimer() error {
-	return define.ErrNotImplemented
-}
-
-// startTimer starts a systemd timer for the healthchecks
-func (c *Container) startTimer() error {
-	return define.ErrNotImplemented
-}
-
-// removeTimer removes the systemd timer and unit files
-// for the container
-func (c *Container) removeTimer() error {
-	return define.ErrNotImplemented
-}
diff --git a/libpod/kube.go b/libpod/kube.go
index 812bb101b..af3b0916e 100644
--- a/libpod/kube.go
+++ b/libpod/kube.go
@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/containers/podman/v3/libpod/define"
+	"github.com/containers/podman/v3/pkg/env"
 	"github.com/containers/podman/v3/pkg/lookup"
 	"github.com/containers/podman/v3/pkg/namespaces"
 	"github.com/containers/podman/v3/pkg/specgen"
@@ -570,12 +571,16 @@ func ocicniPortMappingToContainerPort(portMappings []ocicni.PortMapping) ([]v1.C
 
 // libpodEnvVarsToKubeEnvVars converts a key=value string slice to []v1.EnvVar
 func libpodEnvVarsToKubeEnvVars(envs []string) ([]v1.EnvVar, error) {
+	defaultEnv := env.DefaultEnvVariables()
 	envVars := make([]v1.EnvVar, 0, len(envs))
 	for _, e := range envs {
 		split := strings.SplitN(e, "=", 2)
 		if len(split) != 2 {
 			return envVars, errors.Errorf("environment variable %s is malformed; should be key=value", e)
 		}
+		if defaultEnv[split[0]] == split[1] {
+			continue
+		}
 		ev := v1.EnvVar{
 			Name:  split[0],
 			Value: split[1],
diff --git a/libpod/networking_unsupported.go b/libpod/networking_unsupported.go
deleted file mode 100644
index 20c27ca7f..000000000
--- a/libpod/networking_unsupported.go
+++ /dev/null
@@ -1,40 +0,0 @@
-// +build !linux
-
-package libpod
-
-import (
-	cnitypes "github.com/containernetworking/cni/pkg/types/current"
-	"github.com/containers/podman/v3/libpod/define"
-)
-
-func (r *Runtime) setupRootlessNetNS(ctr *Container) error {
-	return define.ErrNotImplemented
-}
-
-func (r *Runtime) setupSlirp4netns(ctr *Container) error {
-	return define.ErrNotImplemented
-}
-
-func (r *Runtime) setupNetNS(ctr *Container) error {
-	return define.ErrNotImplemented
-}
-
-func (r *Runtime) teardownNetNS(ctr *Container) error {
-	return define.ErrNotImplemented
-}
-
-func (r *Runtime) createNetNS(ctr *Container) error {
-	return define.ErrNotImplemented
-}
-
-func (c *Container) getContainerNetworkInfo() (*define.InspectNetworkSettings, error) {
-	return nil, define.ErrNotImplemented
-}
-
-func (r *Runtime) reloadContainerNetwork(ctr *Container) ([]*cnitypes.Result, error) {
-	return nil, define.ErrNotImplemented
-}
-
-func getCNINetworksDir() (string, error) {
-	return "", define.ErrNotImplemented
-}
diff --git a/libpod/oci_attach_unsupported.go b/libpod/oci_attach_unsupported.go
deleted file mode 100644
index 85e8b32e6..000000000
--- a/libpod/oci_attach_unsupported.go
+++ /dev/null
@@ -1,17 +0,0 @@
-//+build !linux
-
-package libpod
-
-import (
-	"os"
-
-	"github.com/containers/podman/v3/libpod/define"
-)
-
-func (c *Container) attach(streams *define.AttachStreams, keys string, resize <-chan define.TerminalSize, startContainer bool, started chan bool, attachRdy chan<- bool) error {
-	return define.ErrNotImplemented
-}
-
-func (c *Container) attachToExec(streams *define.AttachStreams, keys string, resize <-chan define.TerminalSize, sessionID string, startFd *os.File, attachFd *os.File) error {
-	return define.ErrNotImplemented
-}
diff --git a/libpod/oci_conmon_unsupported.go b/libpod/oci_conmon_unsupported.go
deleted file mode 100644
index 4de27d663..000000000
--- a/libpod/oci_conmon_unsupported.go
+++ /dev/null
@@ -1,132 +0,0 @@
-// +build !linux
-
-package libpod
-
-import (
-	"github.com/containers/common/pkg/config"
-
-	"github.com/containers/podman/v3/libpod/define"
-)
-
-const (
-	osNotSupported = "Not supported on this OS"
-)
-
-// ConmonOCIRuntime is not supported on this OS.
-type ConmonOCIRuntime struct {
-}
-
-// newConmonOCIRuntime is not supported on this OS.
-func newConmonOCIRuntime(name string, paths []string, conmonPath string, runtimeFlags []string, runtimeCfg *config.Config) (OCIRuntime, error) {
-	return nil, define.ErrNotImplemented
-}
-
-// Name is not supported on this OS.
-func (r *ConmonOCIRuntime) Name() string {
-	return osNotSupported
-}
-
-// Path is not supported on this OS.
-func (r *ConmonOCIRuntime) Path() string {
-	return osNotSupported
-}
-
-// CreateContainer is not supported on this OS.
-func (r *ConmonOCIRuntime) CreateContainer(ctr *Container, restoreOptions *ContainerCheckpointOptions) error {
-	return define.ErrNotImplemented
-}
-
-// UpdateContainerStatus is not supported on this OS.
-func (r *ConmonOCIRuntime) UpdateContainerStatus(ctr *Container, useRuntime bool) error {
-	return define.ErrNotImplemented
-}
-
-// StartContainer is not supported on this OS.
-func (r *ConmonOCIRuntime) StartContainer(ctr *Container) error {
-	return define.ErrNotImplemented
-}
-
-// KillContainer is not supported on this OS.
-func (r *ConmonOCIRuntime) KillContainer(ctr *Container, signal uint, all bool) error {
-	return define.ErrNotImplemented
-}
-
-// StopContainer is not supported on this OS.
-func (r *ConmonOCIRuntime) StopContainer(ctr *Container, timeout uint, all bool) error {
-	return define.ErrNotImplemented
-}
-
-// DeleteContainer is not supported on this OS.
-func (r *ConmonOCIRuntime) DeleteContainer(ctr *Container) error {
-	return define.ErrNotImplemented
-}
-
-// PauseContainer is not supported on this OS.
-func (r *ConmonOCIRuntime) PauseContainer(ctr *Container) error {
-	return define.ErrNotImplemented
-}
-
-// UnpauseContainer is not supported on this OS.
-func (r *ConmonOCIRuntime) UnpauseContainer(ctr *Container) error {
-	return define.ErrNotImplemented
-}
-
-// ExecContainer is not supported on this OS.
-func (r *ConmonOCIRuntime) ExecContainer(ctr *Container, sessionID string, options *ExecOptions) (int, chan error, error) {
-	return -1, nil, define.ErrNotImplemented
-}
-
-// ExecStopContainer is not supported on this OS.
-func (r *ConmonOCIRuntime) ExecStopContainer(ctr *Container, sessionID string, timeout uint) error {
-	return define.ErrNotImplemented
-}
-
-// CheckpointContainer is not supported on this OS.
-func (r *ConmonOCIRuntime) CheckpointContainer(ctr *Container, options ContainerCheckpointOptions) error {
-	return define.ErrNotImplemented
-}
-
-// SupportsCheckpoint is not supported on this OS.
-func (r *ConmonOCIRuntime) SupportsCheckpoint() bool {
-	return false
-}
-
-// SupportsJSONErrors is not supported on this OS.
-func (r *ConmonOCIRuntime) SupportsJSONErrors() bool {
-	return false
-}
-
-// SupportsNoCgroups is not supported on this OS.
-func (r *ConmonOCIRuntime) SupportsNoCgroups() bool {
-	return false
-}
-
-// AttachSocketPath is not supported on this OS.
-func (r *ConmonOCIRuntime) AttachSocketPath(ctr *Container) (string, error) {
-	return "", define.ErrNotImplemented
-}
-
-// ExecAttachSocketPath is not supported on this OS.
-func (r *ConmonOCIRuntime) ExecAttachSocketPath(ctr *Container, sessionID string) (string, error) {
-	return "", define.ErrNotImplemented
-}
-
-// ExitFilePath is not supported on this OS.
-func (r *ConmonOCIRuntime) ExitFilePath(ctr *Container) (string, error) {
-	return "", define.ErrNotImplemented
-}
-
-// RuntimeInfo is not supported on this OS.
-func (r *ConmonOCIRuntime) RuntimeInfo() (*define.ConmonInfo, *define.OCIRuntimeInfo, error) {
-	return nil, nil, define.ErrNotImplemented
-}
-
-// Package is not supported on this OS.
-func (r *ConmonOCIRuntime) Package() string {
-	return osNotSupported
-}
-
-// ConmonPackage is not supported on this OS.
-func (r *ConmonOCIRuntime) ConmonPackage() string {
-	return osNotSupported
-}
diff --git a/libpod/pod_top_unsupported.go b/libpod/pod_top_unsupported.go
deleted file mode 100644
index 59d2ff9a2..000000000
--- a/libpod/pod_top_unsupported.go
+++ /dev/null
@@ -1,10 +0,0 @@
-// +build !linux
-
-package libpod
-
-import "github.com/containers/podman/v3/libpod/define"
-
-// GetPodPidInformation is exclusive to linux
-func (p *Pod) GetPodPidInformation(descriptors []string) ([]string, error) {
-	return nil, define.ErrNotImplemented
-}
diff --git a/libpod/runtime_migrate_unsupported.go b/libpod/runtime_migrate_unsupported.go
deleted file mode 100644
index a9d351318..000000000
--- a/libpod/runtime_migrate_unsupported.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// +build !linux
-
-package libpod
-
-import (
-	"context"
-)
-
-func (r *Runtime) migrate(ctx context.Context) error {
-	return nil
-}
-
-func (r *Runtime) stopPauseProcess() error {
-	return nil
-}
diff --git a/libpod/runtime_pod_unsupported.go b/libpod/runtime_pod_unsupported.go
deleted file mode 100644
index 6dbcc9214..000000000
--- a/libpod/runtime_pod_unsupported.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// +build !linux
-
-package libpod
-
-import (
-	"context"
-
-	"github.com/containers/podman/v3/libpod/define"
-)
-
-// NewPod makes a new, empty pod
-func (r *Runtime) NewPod(ctx context.Context, options ...PodCreateOption) (*Pod, error) {
-	return nil, define.ErrOSNotSupported
-}
-
-func (r *Runtime) removePod(ctx context.Context, p *Pod, removeCtrs, force bool) error {
-	return define.ErrOSNotSupported
-}
diff --git a/libpod/runtime_volume_unsupported.go b/libpod/runtime_volume_unsupported.go
deleted file mode 100644
index da7ee3552..000000000
--- a/libpod/runtime_volume_unsupported.go
+++ /dev/null
@@ -1,21 +0,0 @@
-// +build !linux
-
-package libpod
-
-import (
-	"context"
-
-	"github.com/containers/podman/v3/libpod/define"
-)
-
-func (r *Runtime) removeVolume(ctx context.Context, v *Volume, force bool) error {
-	return define.ErrNotImplemented
-}
-
-func (r *Runtime) newVolume(ctx context.Context, options ...VolumeCreateOption) (*Volume, error) {
-	return nil, define.ErrNotImplemented
-}
-
-func (r *Runtime) NewVolume(ctx context.Context, options ...VolumeCreateOption) (*Volume, error) {
-	return nil, define.ErrNotImplemented
-}
diff --git a/libpod/stats_unsupported.go b/libpod/stats_unsupported.go
deleted file mode 100644
index 44a1c8d03..000000000
--- a/libpod/stats_unsupported.go
+++ /dev/null
@@ -1,10 +0,0 @@
-// +build !linux
-
-package libpod
-
-import "github.com/containers/podman/v3/libpod/define"
-
-// GetContainerStats gets the running stats for a given container
-func (c *Container) GetContainerStats(previousStats *define.ContainerStats) (*define.ContainerStats, error) {
-	return nil, define.ErrOSNotSupported
-}
diff --git a/libpod/util_unsupported.go b/libpod/util_unsupported.go
deleted file mode 100644
index b718d36aa..000000000
--- a/libpod/util_unsupported.go
+++ /dev/null
@@ -1,34 +0,0 @@
-// +build !linux
-
-package libpod
-
-import (
-	"github.com/containers/podman/v3/libpod/define"
-	"github.com/pkg/errors"
-)
-
-func systemdSliceFromPath(parent, name string) (string, error) {
-	return "", errors.Wrapf(define.ErrOSNotSupported, "cgroups are not supported on non-linux OSes")
-}
-
-func makeSystemdCgroup(path string) error {
-	return errors.Wrapf(define.ErrOSNotSupported, "cgroups are not supported on non-linux OSes")
-}
-
-func deleteSystemdCgroup(path string) error {
-	return errors.Wrapf(define.ErrOSNotSupported, "cgroups are not supported on non-linux OSes")
-}
-
-func assembleSystemdCgroupName(baseSlice, newSlice string) (string, error) {
-	return "", errors.Wrapf(define.ErrOSNotSupported, "cgroups are not supported on non-linux OSes")
-}
-
-// LabelVolumePath takes a mount path for a volume and gives it an
-// selinux label of either shared or not
-func LabelVolumePath(path string) error {
-	return define.ErrNotImplemented
-}
-
-func Unmount(mount string) error {
-	return define.ErrNotImplemented
-}
diff --git a/libpod/volume_internal_unsupported.go b/libpod/volume_internal_unsupported.go
deleted file mode 100644
index 77452cf22..000000000
--- a/libpod/volume_internal_unsupported.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// +build !linux
-
-package libpod
-
-import (
-	"github.com/containers/podman/v3/libpod/define"
-)
-
-func (v *Volume) mount() error {
-	return define.ErrNotImplemented
-}
-
-func (v *Volume) unmount(force bool) error {
-	return define.ErrNotImplemented
-}
diff --git a/pkg/api/handlers/compat/auth.go b/pkg/api/handlers/compat/auth.go
index 2244adc3d..cf53e060c 100644
--- a/pkg/api/handlers/compat/auth.go
+++ b/pkg/api/handlers/compat/auth.go
@@ -50,9 +50,19 @@ func Auth(w http.ResponseWriter, r *http.Request) {
 			Status:        "Login Succeeded",
 		})
 	} else {
-		utils.WriteResponse(w, http.StatusBadRequest, entities.AuthReport{
-			IdentityToken: "",
-			Status:        "login attempt to " + authConfig.ServerAddress + " failed with status: " + err.Error(),
+		var msg string
+
+		var unauthErr DockerClient.ErrUnauthorizedForCredentials
+		if errors.As(err, &unauthErr) {
+			msg = "401 Unauthorized"
+		} else {
+			msg = err.Error()
+		}
+
+		utils.WriteResponse(w, http.StatusInternalServerError, struct {
+			Message string `json:"message"`
+		}{
+			Message: "login attempt to " + authConfig.ServerAddress + " failed with status: " + msg,
 		})
 	}
 }
diff --git a/pkg/api/handlers/compat/images_push.go b/pkg/api/handlers/compat/images_push.go
index 07ff76819..8b6d3d56a 100644
--- a/pkg/api/handlers/compat/images_push.go
+++ b/pkg/api/handlers/compat/images_push.go
@@ -152,7 +152,7 @@ loop: // break out of for/select infinite loop
 		case err := <-pushErrChan:
 			if err != nil {
 				var msg string
-				if errors.Cause(err) != storage.ErrImageUnknown {
+				if errors.Is(err, storage.ErrImageUnknown) {
 					msg = "An image does not exist locally with the tag: " + imageName
 				} else {
 					msg = err.Error()
diff --git a/pkg/api/handlers/types.go b/pkg/api/handlers/types.go
index b82c586ea..fedab3bb3 100644
--- a/pkg/api/handlers/types.go
+++ b/pkg/api/handlers/types.go
@@ -183,7 +183,8 @@ func ImageToImageSummary(l *libimage.Image) (*entities.ImageSummary, error) {
 	}
 
 	is := entities.ImageSummary{
-		ID:           l.ID(),
+		// docker adds sha256: in front of the ID
+		ID:           "sha256:" + l.ID(),
 		ParentId:     imageData.Parent,
 		RepoTags:     imageData.RepoTags,
 		RepoDigests:  imageData.RepoDigests,
diff --git a/pkg/domain/infra/abi/containers.go b/pkg/domain/infra/abi/containers.go
index dc5f7a0df..affed64d1 100644
--- a/pkg/domain/infra/abi/containers.go
+++ b/pkg/domain/infra/abi/containers.go
@@ -830,21 +830,7 @@ func (ic *ContainerEngine) ContainerStart(ctx context.Context, namesOrIds []stri
 				}
 				return reports, errors.Wrapf(err, "unable to start container %s", ctr.ID())
 			}
-
-			if ecode, err := ctr.Wait(ctx); err != nil {
-				if errors.Cause(err) == define.ErrNoSuchCtr {
-					// Check events
-					event, err := ic.Libpod.GetLastContainerEvent(ctx, ctr.ID(), events.Exited)
-					if err != nil {
-						logrus.Errorf("Cannot get exit code: %v", err)
-						exitCode = define.ExecErrorCodeNotFound
-					} else {
-						exitCode = event.ContainerExitCode
-					}
-				}
-			} else {
-				exitCode = int(ecode)
-			}
+			exitCode = ic.GetContainerExitCode(ctx, ctr)
 			reports = append(reports, &entities.ContainerStartReport{
 				Id:       ctr.ID(),
 				RawInput: rawInput,
@@ -985,21 +971,7 @@ func (ic *ContainerEngine) ContainerRun(ctx context.Context, opts entities.Conta
 		report.ExitCode = define.ExitCode(err)
 		return &report, err
 	}
-
-	if ecode, err := ctr.Wait(ctx); err != nil {
-		if errors.Cause(err) == define.ErrNoSuchCtr {
-			// Check events
-			event, err := ic.Libpod.GetLastContainerEvent(ctx, ctr.ID(), events.Exited)
-			if err != nil {
-				logrus.Errorf("Cannot get exit code: %v", err)
-				report.ExitCode = define.ExecErrorCodeNotFound
-			} else {
-				report.ExitCode = event.ContainerExitCode
-			}
-		}
-	} else {
-		report.ExitCode = int(ecode)
-	}
+	report.ExitCode = ic.GetContainerExitCode(ctx, ctr)
 	if opts.Rm && !ctr.ShouldRestart(ctx) {
 		if err := ic.Libpod.RemoveContainer(ctx, ctr, false, true); err != nil {
 			if errors.Cause(err) == define.ErrNoSuchCtr ||
@@ -1013,6 +985,29 @@ func (ic *ContainerEngine) ContainerRun(ctx context.Context, opts entities.Conta
 	return &report, nil
 }
 
+func (ic *ContainerEngine) GetContainerExitCode(ctx context.Context, ctr *libpod.Container) int {
+	exitCode, err := ctr.Wait(ctx)
+	if err == nil {
+		return int(exitCode)
+	}
+	if errors.Cause(err) != define.ErrNoSuchCtr {
+		logrus.Errorf("Could not retrieve exit code: %v", err)
+		return define.ExecErrorCodeNotFound
+	}
+	// Make 4 attempt with 0.25s backoff between each for 1 second total
+	var event *events.Event
+	for i := 0; i < 4; i++ {
+		event, err = ic.Libpod.GetLastContainerEvent(ctx, ctr.ID(), events.Exited)
+		if err != nil {
+			time.Sleep(250 * time.Millisecond)
+			continue
+		}
+		return int(event.ContainerExitCode)
+	}
+	logrus.Errorf("Could not retrieve exit code from event: %v", err)
+	return define.ExecErrorCodeNotFound
+}
+
 func (ic *ContainerEngine) ContainerLogs(ctx context.Context, containers []string, options entities.ContainerLogsOptions) error {
 	if options.StdoutWriter == nil && options.StderrWriter == nil {
 		return errors.New("no io.Writer set for container logs")
diff --git a/pkg/domain/infra/abi/containers_runlabel.go b/pkg/domain/infra/abi/containers_runlabel.go
index d448627dc..435baa8c8 100644
--- a/pkg/domain/infra/abi/containers_runlabel.go
+++ b/pkg/domain/infra/abi/containers_runlabel.go
@@ -133,6 +133,9 @@ func generateRunlabelCommand(runlabel string, img *libimage.Image, inputName str
 		}
 		splitImageName := strings.Split(normalize, "/")
 		name = splitImageName[len(splitImageName)-1]
+		// make sure to remove the tag from the image name, otherwise the name cannot
+		// be used as container name because a colon is an illegal character
+		name = strings.SplitN(name, ":", 2)[0]
 	}
 
 	// Append the user-specified arguments to the runlabel (command).
diff --git a/pkg/domain/infra/abi/generate.go b/pkg/domain/infra/abi/generate.go
index 2d7bc15f5..1e614ce58 100644
--- a/pkg/domain/infra/abi/generate.go
+++ b/pkg/domain/infra/abi/generate.go
@@ -210,9 +210,7 @@ func generateKubeYAML(kubeKind interface{}) ([]byte, error) {
 func generateKubeOutput(content [][]byte) ([]byte, error) {
 	output := make([]byte, 0)
 
-	header := `# Generation of Kubernetes YAML is still under development!
-#
-# Save the output of this file and use kubectl create -f to import
+	header := `# Save the output of this file and use kubectl create -f to import
 # it into Kubernetes.
 #
 # Created with podman-%s
diff --git a/pkg/domain/infra/tunnel/images.go b/pkg/domain/infra/tunnel/images.go
index db4e14aba..9a746d68c 100644
--- a/pkg/domain/infra/tunnel/images.go
+++ b/pkg/domain/infra/tunnel/images.go
@@ -165,6 +165,9 @@ func (ir *ImageEngine) Untag(ctx context.Context, nameOrID string, tags []string
 		if t, ok := ref.(reference.Tagged); ok {
 			tag = t.Tag()
 		}
+		if t, ok := ref.(reference.Digested); ok {
+			tag += "@" + t.Digest().String()
+		}
 		if r, ok := ref.(reference.Named); ok {
 			repo = r.Name()
 		}
diff --git a/pkg/env/env.go b/pkg/env/env.go
index 0d55e5560..ecd2d62a5 100644
--- a/pkg/env/env.go
+++ b/pkg/env/env.go
@@ -17,8 +17,9 @@ const whiteSpaces = " \t"
 // DefaultEnvVariables returns a default environment, with $PATH and $TERM set.
 func DefaultEnvVariables() map[string]string {
 	return map[string]string{
-		"PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
-		"TERM": "xterm",
+		"PATH":      "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+		"TERM":      "xterm",
+		"container": "podman",
 	}
 }
 
diff --git a/test/apiv2/60-auth.at b/test/apiv2/60-auth.at
index cfde519c1..1e087d12b 100644
--- a/test/apiv2/60-auth.at
+++ b/test/apiv2/60-auth.at
@@ -5,10 +5,15 @@
 
 start_registry
 
+# Test unreachable
+t POST /v1.40/auth username=$REGISTRY_USERNAME password=WrOnGPassWord serveraddress=does.not.exist.io:1234/ \
+  500 \
+  .message~'.*no such host.*'
+
 # Test with wrong password. Confirm bad status and appropriate error message
 t POST /v1.40/auth username=$REGISTRY_USERNAME password=WrOnGPassWord serveraddress=localhost:$REGISTRY_PORT/ \
-  400 \
-  .Status~'.* invalid username/password'
+  500 \
+  .message~'.* 401 Unauthorized'
 
 # Test with the right password. Confirm status message
 t POST /v1.40/auth username=$REGISTRY_USERNAME password=$REGISTRY_PASSWORD serveraddress=localhost:$REGISTRY_PORT/ \
diff --git a/test/apiv2/python/rest_api/test_v2_0_0_image.py b/test/apiv2/python/rest_api/test_v2_0_0_image.py
index bcacaa935..58d03b149 100644
--- a/test/apiv2/python/rest_api/test_v2_0_0_image.py
+++ b/test/apiv2/python/rest_api/test_v2_0_0_image.py
@@ -32,6 +32,9 @@ class ImageTestCase(APITestCase):
             for k in required_keys:
                 self.assertIn(k, item)
 
+            # Id should be prefixed with sha256: (#11645)
+            self.assertIn("sha256:",item['Id'])
+
     def test_inspect(self):
         r = requests.get(self.podman_url + "/v1.40/images/alpine/json")
         self.assertEqual(r.status_code, 200, r.text)
@@ -59,6 +62,8 @@ class ImageTestCase(APITestCase):
         for item in required_keys:
             self.assertIn(item, image)
         _ = parse(image["Created"])
+        # Id should be prefixed with sha256: (#11645)
+        self.assertIn("sha256:",image['Id'])
 
     def test_delete(self):
         r = requests.delete(self.podman_url + "/v1.40/images/alpine?force=true")
diff --git a/test/e2e/commit_test.go b/test/e2e/commit_test.go
index fbd4068f8..d40faf54b 100644
--- a/test/e2e/commit_test.go
+++ b/test/e2e/commit_test.go
@@ -332,7 +332,7 @@ var _ = Describe("Podman commit", func() {
 
 	It("podman commit adds exposed ports", func() {
 		name := "testcon"
-		s := podmanTest.Podman([]string{"run", "--name", name, "-p", "8080:80", ALPINE, "true"})
+		s := podmanTest.Podman([]string{"run", "--name", name, "-p", "8585:80", ALPINE, "true"})
 		s.WaitWithDefaultTimeout()
 		Expect(s).Should(Exit(0))
 
diff --git a/test/e2e/container_inspect_test.go b/test/e2e/container_inspect_test.go
index 7d05b09fb..597eeb1a4 100644
--- a/test/e2e/container_inspect_test.go
+++ b/test/e2e/container_inspect_test.go
@@ -47,25 +47,25 @@ var _ = Describe("Podman container inspect", func() {
 
 	It("podman inspect shows exposed ports", func() {
 		name := "testcon"
-		session := podmanTest.Podman([]string{"run", "-d", "--stop-timeout", "0", "--expose", "8080/udp", "--name", name, ALPINE, "sleep", "inf"})
+		session := podmanTest.Podman([]string{"run", "-d", "--stop-timeout", "0", "--expose", "8787/udp", "--name", name, ALPINE, "sleep", "inf"})
 		session.WaitWithDefaultTimeout()
 		Expect(session).Should(Exit(0))
 		data := podmanTest.InspectContainer(name)
 
 		Expect(data).To(HaveLen(1))
 		Expect(data[0].NetworkSettings.Ports).
-			To(Equal(map[string][]define.InspectHostPort{"8080/udp": nil}))
+			To(Equal(map[string][]define.InspectHostPort{"8787/udp": nil}))
 	})
 
 	It("podman inspect shows exposed ports on image", func() {
 		name := "testcon"
-		session := podmanTest.Podman([]string{"run", "-d", "--expose", "8080", "--name", name, nginx})
+		session := podmanTest.Podman([]string{"run", "-d", "--expose", "8989", "--name", name, nginx})
 		session.WaitWithDefaultTimeout()
 		Expect(session).Should(Exit(0))
 
 		data := podmanTest.InspectContainer(name)
 		Expect(data).To(HaveLen(1))
 		Expect(data[0].NetworkSettings.Ports).
-			To(Equal(map[string][]define.InspectHostPort{"80/tcp": nil, "8080/tcp": nil}))
+			To(Equal(map[string][]define.InspectHostPort{"80/tcp": nil, "8989/tcp": nil}))
 	})
 })
diff --git a/test/e2e/create_test.go b/test/e2e/create_test.go
index 32d98c2a9..d20dc8874 100644
--- a/test/e2e/create_test.go
+++ b/test/e2e/create_test.go
@@ -618,7 +618,7 @@ var _ = Describe("Podman create", func() {
 		pod.WaitWithDefaultTimeout()
 		Expect(pod).Should(Exit(0))
 
-		session := podmanTest.Podman([]string{"create", "--pod", name, "-p", "8080:80", ALPINE, "top"})
+		session := podmanTest.Podman([]string{"create", "--pod", name, "-p", "8086:80", ALPINE, "top"})
 		session.WaitWithDefaultTimeout()
 		Expect(session).Should(ExitWithError())
 	})
diff --git a/test/e2e/healthcheck_run_test.go b/test/e2e/healthcheck_run_test.go
index 87f042ed9..1445a634b 100644
--- a/test/e2e/healthcheck_run_test.go
+++ b/test/e2e/healthcheck_run_test.go
@@ -214,5 +214,12 @@ var _ = Describe("Podman healthcheck run", func() {
 
 		inspect = podmanTest.InspectContainer("hc")
 		Expect(inspect[0].State.Healthcheck.Status).To(Equal(define.HealthCheckHealthy))
+
+		// Test podman ps --filter heath is working (#11687)
+		ps := podmanTest.Podman([]string{"ps", "--filter", "health=healthy"})
+		ps.WaitWithDefaultTimeout()
+		Expect(ps).Should(Exit(0))
+		Expect(len(ps.OutputToStringArray())).To(Equal(2))
+		Expect(ps.OutputToString()).To(ContainSubstring("hc"))
 	})
 })
diff --git a/test/e2e/inspect_test.go b/test/e2e/inspect_test.go
index 59615d009..30694a4b2 100644
--- a/test/e2e/inspect_test.go
+++ b/test/e2e/inspect_test.go
@@ -451,14 +451,14 @@ var _ = Describe("Podman inspect", func() {
 	It("podman inspect --format json .NetworkSettings.Ports", func() {
 		ctnrName := "Ctnr_" + RandomString(25)
 
-		create := podmanTest.Podman([]string{"create", "--name", ctnrName, "-p", "8080:80", ALPINE})
+		create := podmanTest.Podman([]string{"create", "--name", ctnrName, "-p", "8084:80", ALPINE})
 		create.WaitWithDefaultTimeout()
 		Expect(create).Should(Exit(0))
 
 		inspect := podmanTest.Podman([]string{"inspect", `--format="{{json .NetworkSettings.Ports}}"`, ctnrName})
 		inspect.WaitWithDefaultTimeout()
 		Expect(inspect).Should(Exit(0))
-		Expect(inspect.OutputToString()).To(Equal(`"{"80/tcp":[{"HostIp":"","HostPort":"8080"}]}"`))
+		Expect(inspect.OutputToString()).To(Equal(`"{"80/tcp":[{"HostIp":"","HostPort":"8084"}]}"`))
 	})
 
 	It("Verify container inspect has default network", func() {
diff --git a/test/e2e/play_kube_test.go b/test/e2e/play_kube_test.go
index fcda89fbc..0d5b9d52c 100644
--- a/test/e2e/play_kube_test.go
+++ b/test/e2e/play_kube_test.go
@@ -63,12 +63,6 @@ spec:
     - -d
     - "1.5"
     env:
-    - name: PATH
-      value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-    - name: TERM
-      value: xterm
-    - name: container
-      value: podman
     - name: HOSTNAME
       value: label-pod
     image: quay.io/libpod/alpine:latest
@@ -171,12 +165,6 @@ spec:
     - -d
     - "1.5"
     env:
-    - name: PATH
-      value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-    - name: TERM
-      value: xterm
-    - name: container
-      value: podman
     - name: HOSTNAME
       value: label-pod
     image: quay.io/libpod/alpine:latest
@@ -287,13 +275,7 @@ spec:
     - {{.}}
     {{ end }}
     env:
-    - name: PATH
-      value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-    - name: TERM
-      value: xterm
     - name: HOSTNAME
-    - name: container
-      value: podman
     {{ range .Env }}
     - name: {{ .Name }}
     {{ if (eq .ValueFrom "configmap") }}
@@ -453,13 +435,7 @@ spec:
         - {{.}}
         {{ end }}
         env:
-        - name: PATH
-          value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-        - name: TERM
-          value: xterm
         - name: HOSTNAME
-        - name: container
-          value: podman
         image: {{ .Image }}
         name: {{ .Name }}
         imagePullPolicy: {{ .PullPolicy }}
diff --git a/test/e2e/pod_create_test.go b/test/e2e/pod_create_test.go
index ed686b470..2ccca28d3 100644
--- a/test/e2e/pod_create_test.go
+++ b/test/e2e/pod_create_test.go
@@ -106,7 +106,7 @@ var _ = Describe("Podman pod create", func() {
 
 	It("podman create pod with network portbindings", func() {
 		name := "test"
-		session := podmanTest.Podman([]string{"pod", "create", "--name", name, "-p", "8080:80"})
+		session := podmanTest.Podman([]string{"pod", "create", "--name", name, "-p", "8081:80"})
 		session.WaitWithDefaultTimeout()
 		Expect(session).Should(Exit(0))
 		pod := session.OutputToString()
@@ -115,14 +115,14 @@ var _ = Describe("Podman pod create", func() {
 		webserver.WaitWithDefaultTimeout()
 		Expect(webserver).Should(Exit(0))
 
-		check := SystemExec("nc", []string{"-z", "localhost", "8080"})
+		check := SystemExec("nc", []string{"-z", "localhost", "8081"})
 		Expect(check).Should(Exit(0))
 	})
 
 	It("podman create pod with id file with network portbindings", func() {
 		file := filepath.Join(podmanTest.TempDir, "pod.id")
 		name := "test"
-		session := podmanTest.Podman([]string{"pod", "create", "--name", name, "--pod-id-file", file, "-p", "8080:80"})
+		session := podmanTest.Podman([]string{"pod", "create", "--name", name, "--pod-id-file", file, "-p", "8082:80"})
 		session.WaitWithDefaultTimeout()
 		Expect(session).Should(Exit(0))
 
@@ -130,7 +130,7 @@ var _ = Describe("Podman pod create", func() {
 		webserver.WaitWithDefaultTimeout()
 		Expect(webserver).Should(Exit(0))
 
-		check := SystemExec("nc", []string{"-z", "localhost", "8080"})
+		check := SystemExec("nc", []string{"-z", "localhost", "8082"})
 		Expect(check).Should(Exit(0))
 	})
 
diff --git a/test/e2e/pod_inspect_test.go b/test/e2e/pod_inspect_test.go
index 6633b228c..5728cf9b9 100644
--- a/test/e2e/pod_inspect_test.go
+++ b/test/e2e/pod_inspect_test.go
@@ -85,7 +85,7 @@ var _ = Describe("Podman pod inspect", func() {
 
 	It("podman pod inspect outputs port bindings", func() {
 		podName := "testPod"
-		create := podmanTest.Podman([]string{"pod", "create", "--name", podName, "-p", "8080:80"})
+		create := podmanTest.Podman([]string{"pod", "create", "--name", podName, "-p", "8383:80"})
 		create.WaitWithDefaultTimeout()
 		Expect(create).Should(Exit(0))
 
@@ -98,7 +98,7 @@ var _ = Describe("Podman pod inspect", func() {
 		Expect(err).To(BeNil())
 		Expect(inspectJSON.InfraConfig).To(Not(BeNil()))
 		Expect(len(inspectJSON.InfraConfig.PortBindings["80/tcp"])).To(Equal(1))
-		Expect(inspectJSON.InfraConfig.PortBindings["80/tcp"][0].HostPort).To(Equal("8080"))
+		Expect(inspectJSON.InfraConfig.PortBindings["80/tcp"][0].HostPort).To(Equal("8383"))
 	})
 
 	It("podman pod inspect outputs show correct MAC", func() {
diff --git a/test/e2e/pod_start_test.go b/test/e2e/pod_start_test.go
index 93c200389..e895b5598 100644
--- a/test/e2e/pod_start_test.go
+++ b/test/e2e/pod_start_test.go
@@ -92,7 +92,7 @@ var _ = Describe("Podman pod start", func() {
 		pod, _, podid1 := podmanTest.CreatePod(map[string][]string{
 			"--infra":   {"true"},
 			"--name":    {podName[0]},
-			"--publish": {"127.0.0.1:8080:80"},
+			"--publish": {"127.0.0.1:8083:80"},
 		})
 		Expect(pod).To(Exit(0))
 
@@ -103,7 +103,7 @@ var _ = Describe("Podman pod start", func() {
 		pod, _, podid2 := podmanTest.CreatePod(map[string][]string{
 			"--infra":   {"true"},
 			"--name":    {podName[1]},
-			"--publish": {"127.0.0.1:8080:80"},
+			"--publish": {"127.0.0.1:8083:80"},
 		})
 		Expect(pod).To(Exit(0))
 
diff --git a/test/e2e/ps_test.go b/test/e2e/ps_test.go
index aeb88e481..881d9fcf0 100644
--- a/test/e2e/ps_test.go
+++ b/test/e2e/ps_test.go
@@ -6,7 +6,6 @@ import (
 	"regexp"
 	"sort"
 	"strconv"
-	"strings"
 
 	. "github.com/containers/podman/v3/test/utils"
 	"github.com/containers/storage/pkg/stringid"
@@ -187,7 +186,10 @@ var _ = Describe("Podman ps", func() {
 		result.WaitWithDefaultTimeout()
 		result.WaitWithDefaultTimeout()
 		Expect(result).Should(Exit(0))
-		Expect(result.OutputToString()).To(ContainSubstring("bravo"))
+
+		actual := result.OutputToString()
+		Expect(actual).To(ContainSubstring("bravo"))
+		Expect(actual).To(ContainSubstring("NAMES"))
 	})
 
 	It("podman ps --filter network=container:<id>", func() {
@@ -206,7 +208,9 @@ var _ = Describe("Podman ps", func() {
 		result.WaitWithDefaultTimeout()
 		result.WaitWithDefaultTimeout()
 		Expect(result).Should(Exit(0))
-		Expect(result.OutputToString()).To(ContainSubstring("second"))
+		actual := result.OutputToString()
+		Expect(actual).To(ContainSubstring("second"))
+		Expect(actual).ToNot(ContainSubstring("table"))
 	})
 
 	It("podman ps namespace flag", func() {
@@ -228,7 +232,7 @@ var _ = Describe("Podman ps", func() {
 		result.WaitWithDefaultTimeout()
 		Expect(result).Should(Exit(0))
 		// it must contains `::` when some ns is null. If it works normally, it should be "$num1:$num2:$num3"
-		Expect(result.OutputToString()).To(Not(ContainSubstring(`::`)))
+		Expect(result.OutputToString()).ToNot(ContainSubstring(`::`))
 	})
 
 	It("podman ps with no containers is valid json format", func() {
@@ -285,11 +289,14 @@ var _ = Describe("Podman ps", func() {
 
 		result := podmanTest.Podman([]string{"ps", "-a", "--format", "table {{.ID}} {{.Image}} {{.ImageID}} {{.Labels}}"})
 		result.WaitWithDefaultTimeout()
-
-		Expect(result.OutputToStringArray()[0]).ToNot(ContainSubstring("table"))
-		Expect(result.OutputToStringArray()[0]).ToNot(ContainSubstring("ImageID"))
-		Expect(result.OutputToStringArray()[0]).To(ContainSubstring("alpine:latest"))
 		Expect(result).Should(Exit(0))
+
+		Expect(result.OutputToString()).ToNot(ContainSubstring("table"))
+
+		actual := result.OutputToStringArray()
+		Expect(actual[0]).To(ContainSubstring("CONTAINER ID"))
+		Expect(actual[0]).ToNot(ContainSubstring("ImageID"))
+		Expect(actual[1]).To(ContainSubstring("alpine:latest"))
 	})
 
 	It("podman ps ancestor filter flag", func() {
@@ -380,7 +387,9 @@ var _ = Describe("Podman ps", func() {
 		psFilter.WaitWithDefaultTimeout()
 		Expect(psFilter).Should(Exit(0))
 
-		Expect(strings.Contains(psFilter.OutputToString(), ctrName)).To(BeFalse())
+		actual := psFilter.OutputToString()
+		Expect(actual).ToNot(ContainSubstring(ctrName))
+		Expect(actual).ToNot(ContainSubstring("NAMES"))
 	})
 
 	It("podman ps mutually exclusive flags", func() {
@@ -453,14 +462,13 @@ var _ = Describe("Podman ps", func() {
 		Expect(session).Should(Exit(0))
 
 		session = podmanTest.Podman([]string{"ps", "-a", "--sort=command", "--format", "{{.Command}}"})
-
 		session.WaitWithDefaultTimeout()
 		Expect(session).Should(Exit(0))
 
-		sortedArr := session.OutputToStringArray()
+		Expect(session.OutputToString()).ToNot(ContainSubstring("COMMAND"))
 
+		sortedArr := session.OutputToStringArray()
 		Expect(sort.SliceIsSorted(sortedArr, func(i, j int) bool { return sortedArr[i] < sortedArr[j] })).To(BeTrue())
-
 	})
 
 	It("podman --pod", func() {
@@ -474,7 +482,7 @@ var _ = Describe("Podman ps", func() {
 		session = podmanTest.Podman([]string{"ps", "--no-trunc"})
 		session.WaitWithDefaultTimeout()
 		Expect(session).Should(Exit(0))
-		Expect(session.OutputToString()).To(Not(ContainSubstring(podid)))
+		Expect(session.OutputToString()).ToNot(ContainSubstring(podid))
 
 		session = podmanTest.Podman([]string{"ps", "--pod", "--no-trunc"})
 		session.WaitWithDefaultTimeout()
@@ -510,7 +518,11 @@ var _ = Describe("Podman ps", func() {
 
 		session = podmanTest.Podman([]string{"ps", "--format", "{{.Ports}}"})
 		session.WaitWithDefaultTimeout()
-		Expect(session.OutputToString()).To(ContainSubstring("0.0.0.0:2000-2006"))
+		Expect(session).To(Exit(0))
+
+		actual := session.OutputToString()
+		Expect(actual).To(ContainSubstring("0.0.0.0:2000-2006"))
+		Expect(actual).ToNot(ContainSubstring("PORT"))
 	})
 
 	It("podman ps test with invalid port range", func() {
@@ -597,7 +609,7 @@ var _ = Describe("Podman ps", func() {
 
 	It("podman ps test with port shared with pod", func() {
 		podName := "testPod"
-		pod := podmanTest.Podman([]string{"pod", "create", "-p", "8080:80", "--name", podName})
+		pod := podmanTest.Podman([]string{"pod", "create", "-p", "8085:80", "--name", podName})
 		pod.WaitWithDefaultTimeout()
 		Expect(pod).Should(Exit(0))
 
@@ -609,7 +621,7 @@ var _ = Describe("Podman ps", func() {
 		ps := podmanTest.Podman([]string{"ps", "--filter", fmt.Sprintf("name=%s", ctrName), "--format", "{{.Ports}}"})
 		ps.WaitWithDefaultTimeout()
 		Expect(ps).Should(Exit(0))
-		Expect(ps.OutputToString()).To(ContainSubstring("0.0.0.0:8080->80/tcp"))
+		Expect(ps.OutputToString()).To(ContainSubstring("0.0.0.0:8085->80/tcp"))
 	})
 
 	It("podman ps truncate long create command", func() {
@@ -628,7 +640,10 @@ var _ = Describe("Podman ps", func() {
 		result := podmanTest.Podman([]string{"ps", "-a", "--format", "{{.RunningFor}}"})
 		result.WaitWithDefaultTimeout()
 		Expect(result).Should(Exit(0))
-		Expect(result.OutputToString()).To(ContainSubstring("ago"))
+
+		actual := result.OutputToString()
+		Expect(actual).To(ContainSubstring("ago"))
+		Expect(actual).ToNot(ContainSubstring("RUNNING FOR"))
 	})
 
 	It("podman ps filter test", func() {
@@ -823,8 +838,9 @@ var _ = Describe("Podman ps", func() {
 		session = podmanTest.Podman([]string{"ps", "--all", "--no-trunc", "--filter", "network=" + net})
 		session.WaitWithDefaultTimeout()
 		Expect(session).Should(Exit(0))
-		Expect(session.OutputToString()).To(ContainSubstring(ctrWithNet))
-		Expect(session.OutputToString()).To(Not(ContainSubstring(ctrWithoutNet)))
+		actual := session.OutputToString()
+		Expect(actual).To(ContainSubstring(ctrWithNet))
+		Expect(actual).ToNot(ContainSubstring(ctrWithoutNet))
 	})
 
 	It("podman ps --format networks", func() {
@@ -835,12 +851,15 @@ var _ = Describe("Podman ps", func() {
 		session = podmanTest.Podman([]string{"ps", "--all", "--format", "{{ .Networks }}"})
 		session.WaitWithDefaultTimeout()
 		Expect(session).Should(Exit(0))
+
+		actual := session.OutputToString()
+		Expect(actual).ToNot(ContainSubstring("NETWORKS"))
 		if isRootless() {
 			// rootless container don't have a network by default
-			Expect(session.OutputToString()).To(Equal(""))
+			Expect(actual).To(BeEmpty())
 		} else {
 			// default network name is podman
-			Expect(session.OutputToString()).To(Equal("podman"))
+			Expect(actual).To(Equal("podman"))
 		}
 
 		net1 := stringid.GenerateNonCryptoID()
diff --git a/test/e2e/run_networking_test.go b/test/e2e/run_networking_test.go
index 8eabeba97..84707732b 100644
--- a/test/e2e/run_networking_test.go
+++ b/test/e2e/run_networking_test.go
@@ -98,9 +98,9 @@ var _ = Describe("Podman run networking", func() {
 		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostIP).To(Equal(""))
 	})
 
-	It("podman run -p 80-82 -p 8080:8080", func() {
+	It("podman run -p 80-82 -p 8090:8090", func() {
 		name := "testctr"
-		session := podmanTest.Podman([]string{"create", "-t", "-p", "80-82", "-p", "8080:8080", "--name", name, ALPINE, "/bin/sh"})
+		session := podmanTest.Podman([]string{"create", "-t", "-p", "80-82", "-p", "8090:8090", "--name", name, ALPINE, "/bin/sh"})
 		session.WaitWithDefaultTimeout()
 		inspectOut := podmanTest.InspectContainer(name)
 		Expect(len(inspectOut)).To(Equal(1))
@@ -114,14 +114,14 @@ var _ = Describe("Podman run networking", func() {
 		Expect(len(inspectOut[0].NetworkSettings.Ports["82/tcp"])).To(Equal(1))
 		Expect(inspectOut[0].NetworkSettings.Ports["82/tcp"][0].HostPort).To(Not(Equal("82")))
 		Expect(inspectOut[0].NetworkSettings.Ports["82/tcp"][0].HostIP).To(Equal(""))
-		Expect(len(inspectOut[0].NetworkSettings.Ports["8080/tcp"])).To(Equal(1))
-		Expect(inspectOut[0].NetworkSettings.Ports["8080/tcp"][0].HostPort).To(Equal("8080"))
-		Expect(inspectOut[0].NetworkSettings.Ports["8080/tcp"][0].HostIP).To(Equal(""))
+		Expect(len(inspectOut[0].NetworkSettings.Ports["8090/tcp"])).To(Equal(1))
+		Expect(inspectOut[0].NetworkSettings.Ports["8090/tcp"][0].HostPort).To(Equal("8090"))
+		Expect(inspectOut[0].NetworkSettings.Ports["8090/tcp"][0].HostIP).To(Equal(""))
 	})
 
-	It("podman run -p 80-81 -p 8080-8081", func() {
+	It("podman run -p 80-81 -p 8180-8181", func() {
 		name := "testctr"
-		session := podmanTest.Podman([]string{"create", "-t", "-p", "80-81", "-p", "8080-8081", "--name", name, ALPINE, "/bin/sh"})
+		session := podmanTest.Podman([]string{"create", "-t", "-p", "80-81", "-p", "8180-8181", "--name", name, ALPINE, "/bin/sh"})
 		session.WaitWithDefaultTimeout()
 		inspectOut := podmanTest.InspectContainer(name)
 		Expect(len(inspectOut)).To(Equal(1))
@@ -132,17 +132,17 @@ var _ = Describe("Podman run networking", func() {
 		Expect(len(inspectOut[0].NetworkSettings.Ports["81/tcp"])).To(Equal(1))
 		Expect(inspectOut[0].NetworkSettings.Ports["81/tcp"][0].HostPort).To(Not(Equal("81")))
 		Expect(inspectOut[0].NetworkSettings.Ports["81/tcp"][0].HostIP).To(Equal(""))
-		Expect(len(inspectOut[0].NetworkSettings.Ports["8080/tcp"])).To(Equal(1))
-		Expect(inspectOut[0].NetworkSettings.Ports["8080/tcp"][0].HostPort).To(Not(Equal("8080")))
-		Expect(inspectOut[0].NetworkSettings.Ports["8080/tcp"][0].HostIP).To(Equal(""))
-		Expect(len(inspectOut[0].NetworkSettings.Ports["8081/tcp"])).To(Equal(1))
-		Expect(inspectOut[0].NetworkSettings.Ports["8081/tcp"][0].HostPort).To(Not(Equal("8081")))
-		Expect(inspectOut[0].NetworkSettings.Ports["8081/tcp"][0].HostIP).To(Equal(""))
+		Expect(len(inspectOut[0].NetworkSettings.Ports["8180/tcp"])).To(Equal(1))
+		Expect(inspectOut[0].NetworkSettings.Ports["8180/tcp"][0].HostPort).To(Not(Equal("8180")))
+		Expect(inspectOut[0].NetworkSettings.Ports["8180/tcp"][0].HostIP).To(Equal(""))
+		Expect(len(inspectOut[0].NetworkSettings.Ports["8181/tcp"])).To(Equal(1))
+		Expect(inspectOut[0].NetworkSettings.Ports["8181/tcp"][0].HostPort).To(Not(Equal("8181")))
+		Expect(inspectOut[0].NetworkSettings.Ports["8181/tcp"][0].HostIP).To(Equal(""))
 	})
 
-	It("podman run -p 80 -p 8080-8082:8080-8082", func() {
+	It("podman run -p 80 -p 8280-8282:8280-8282", func() {
 		name := "testctr"
-		session := podmanTest.Podman([]string{"create", "-t", "-p", "80", "-p", "8080-8082:8080-8082", "--name", name, ALPINE, "/bin/sh"})
+		session := podmanTest.Podman([]string{"create", "-t", "-p", "80", "-p", "8280-8282:8280-8282", "--name", name, ALPINE, "/bin/sh"})
 		session.WaitWithDefaultTimeout()
 		inspectOut := podmanTest.InspectContainer(name)
 		Expect(len(inspectOut)).To(Equal(1))
@@ -150,40 +150,40 @@ var _ = Describe("Podman run networking", func() {
 		Expect(len(inspectOut[0].NetworkSettings.Ports["80/tcp"])).To(Equal(1))
 		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostPort).To(Not(Equal("80")))
 		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostIP).To(Equal(""))
-		Expect(len(inspectOut[0].NetworkSettings.Ports["8080/tcp"])).To(Equal(1))
-		Expect(inspectOut[0].NetworkSettings.Ports["8080/tcp"][0].HostPort).To(Equal("8080"))
-		Expect(inspectOut[0].NetworkSettings.Ports["8080/tcp"][0].HostIP).To(Equal(""))
-		Expect(len(inspectOut[0].NetworkSettings.Ports["8081/tcp"])).To(Equal(1))
-		Expect(inspectOut[0].NetworkSettings.Ports["8081/tcp"][0].HostPort).To(Equal("8081"))
-		Expect(inspectOut[0].NetworkSettings.Ports["8081/tcp"][0].HostIP).To(Equal(""))
-		Expect(len(inspectOut[0].NetworkSettings.Ports["8082/tcp"])).To(Equal(1))
-		Expect(inspectOut[0].NetworkSettings.Ports["8082/tcp"][0].HostPort).To(Equal("8082"))
-		Expect(inspectOut[0].NetworkSettings.Ports["8082/tcp"][0].HostIP).To(Equal(""))
-	})
-
-	It("podman run -p 8080:80", func() {
+		Expect(len(inspectOut[0].NetworkSettings.Ports["8280/tcp"])).To(Equal(1))
+		Expect(inspectOut[0].NetworkSettings.Ports["8280/tcp"][0].HostPort).To(Equal("8280"))
+		Expect(inspectOut[0].NetworkSettings.Ports["8280/tcp"][0].HostIP).To(Equal(""))
+		Expect(len(inspectOut[0].NetworkSettings.Ports["8281/tcp"])).To(Equal(1))
+		Expect(inspectOut[0].NetworkSettings.Ports["8281/tcp"][0].HostPort).To(Equal("8281"))
+		Expect(inspectOut[0].NetworkSettings.Ports["8281/tcp"][0].HostIP).To(Equal(""))
+		Expect(len(inspectOut[0].NetworkSettings.Ports["8282/tcp"])).To(Equal(1))
+		Expect(inspectOut[0].NetworkSettings.Ports["8282/tcp"][0].HostPort).To(Equal("8282"))
+		Expect(inspectOut[0].NetworkSettings.Ports["8282/tcp"][0].HostIP).To(Equal(""))
+	})
+
+	It("podman run -p 8380:80", func() {
 		name := "testctr"
-		session := podmanTest.Podman([]string{"create", "-t", "-p", "8080:80", "--name", name, ALPINE, "/bin/sh"})
+		session := podmanTest.Podman([]string{"create", "-t", "-p", "8380:80", "--name", name, ALPINE, "/bin/sh"})
 		session.WaitWithDefaultTimeout()
 		inspectOut := podmanTest.InspectContainer(name)
 		Expect(len(inspectOut)).To(Equal(1))
 		Expect(len(inspectOut[0].NetworkSettings.Ports)).To(Equal(1))
 		Expect(len(inspectOut[0].NetworkSettings.Ports["80/tcp"])).To(Equal(1))
-		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostPort).To(Equal("8080"))
+		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostPort).To(Equal("8380"))
 		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostIP).To(Equal(""))
 	})
 
-	It("podman run -p 8080:80/TCP", func() {
+	It("podman run -p 8480:80/TCP", func() {
 		name := "testctr"
 		// "TCP" in upper characters
-		session := podmanTest.Podman([]string{"create", "-t", "-p", "8080:80/TCP", "--name", name, ALPINE, "/bin/sh"})
+		session := podmanTest.Podman([]string{"create", "-t", "-p", "8480:80/TCP", "--name", name, ALPINE, "/bin/sh"})
 		session.WaitWithDefaultTimeout()
 		inspectOut := podmanTest.InspectContainer(name)
 		Expect(len(inspectOut)).To(Equal(1))
 		Expect(len(inspectOut[0].NetworkSettings.Ports)).To(Equal(1))
 		// "tcp" in lower characters
 		Expect(len(inspectOut[0].NetworkSettings.Ports["80/tcp"])).To(Equal(1))
-		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostPort).To(Equal("8080"))
+		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostPort).To(Equal("8480"))
 		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostIP).To(Equal(""))
 	})
 
@@ -199,51 +199,51 @@ var _ = Describe("Podman run networking", func() {
 		Expect(inspectOut[0].NetworkSettings.Ports["80/udp"][0].HostIP).To(Equal(""))
 	})
 
-	It("podman run -p 127.0.0.1:8080:80", func() {
+	It("podman run -p 127.0.0.1:8580:80", func() {
 		name := "testctr"
-		session := podmanTest.Podman([]string{"create", "-t", "-p", "127.0.0.1:8080:80", "--name", name, ALPINE, "/bin/sh"})
+		session := podmanTest.Podman([]string{"create", "-t", "-p", "127.0.0.1:8580:80", "--name", name, ALPINE, "/bin/sh"})
 		session.WaitWithDefaultTimeout()
 		inspectOut := podmanTest.InspectContainer(name)
 		Expect(len(inspectOut)).To(Equal(1))
 		Expect(len(inspectOut[0].NetworkSettings.Ports)).To(Equal(1))
 		Expect(len(inspectOut[0].NetworkSettings.Ports["80/tcp"])).To(Equal(1))
-		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostPort).To(Equal("8080"))
+		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostPort).To(Equal("8580"))
 		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostIP).To(Equal("127.0.0.1"))
 	})
 
-	It("podman run -p 127.0.0.1:8080:80/udp", func() {
+	It("podman run -p 127.0.0.1:8680:80/udp", func() {
 		name := "testctr"
-		session := podmanTest.Podman([]string{"create", "-t", "-p", "127.0.0.1:8080:80/udp", "--name", name, ALPINE, "/bin/sh"})
+		session := podmanTest.Podman([]string{"create", "-t", "-p", "127.0.0.1:8680:80/udp", "--name", name, ALPINE, "/bin/sh"})
 		session.WaitWithDefaultTimeout()
 		inspectOut := podmanTest.InspectContainer(name)
 		Expect(len(inspectOut)).To(Equal(1))
 		Expect(len(inspectOut[0].NetworkSettings.Ports)).To(Equal(1))
 		Expect(len(inspectOut[0].NetworkSettings.Ports["80/udp"])).To(Equal(1))
-		Expect(inspectOut[0].NetworkSettings.Ports["80/udp"][0].HostPort).To(Equal("8080"))
+		Expect(inspectOut[0].NetworkSettings.Ports["80/udp"][0].HostPort).To(Equal("8680"))
 		Expect(inspectOut[0].NetworkSettings.Ports["80/udp"][0].HostIP).To(Equal("127.0.0.1"))
 	})
 
-	It("podman run -p [::1]:8080:80/udp", func() {
+	It("podman run -p [::1]:8780:80/udp", func() {
 		name := "testctr"
-		session := podmanTest.Podman([]string{"create", "-t", "-p", "[::1]:8080:80/udp", "--name", name, ALPINE, "/bin/sh"})
+		session := podmanTest.Podman([]string{"create", "-t", "-p", "[::1]:8780:80/udp", "--name", name, ALPINE, "/bin/sh"})
 		session.WaitWithDefaultTimeout()
 		inspectOut := podmanTest.InspectContainer(name)
 		Expect(len(inspectOut)).To(Equal(1))
 		Expect(len(inspectOut[0].NetworkSettings.Ports)).To(Equal(1))
 		Expect(len(inspectOut[0].NetworkSettings.Ports["80/udp"])).To(Equal(1))
-		Expect(inspectOut[0].NetworkSettings.Ports["80/udp"][0].HostPort).To(Equal("8080"))
+		Expect(inspectOut[0].NetworkSettings.Ports["80/udp"][0].HostPort).To(Equal("8780"))
 		Expect(inspectOut[0].NetworkSettings.Ports["80/udp"][0].HostIP).To(Equal("::1"))
 	})
 
-	It("podman run -p [::1]:8080:80/tcp", func() {
+	It("podman run -p [::1]:8880:80/tcp", func() {
 		name := "testctr"
-		session := podmanTest.Podman([]string{"create", "-t", "-p", "[::1]:8080:80/tcp", "--name", name, ALPINE, "/bin/sh"})
+		session := podmanTest.Podman([]string{"create", "-t", "-p", "[::1]:8880:80/tcp", "--name", name, ALPINE, "/bin/sh"})
 		session.WaitWithDefaultTimeout()
 		inspectOut := podmanTest.InspectContainer(name)
 		Expect(len(inspectOut)).To(Equal(1))
 		Expect(len(inspectOut[0].NetworkSettings.Ports)).To(Equal(1))
 		Expect(len(inspectOut[0].NetworkSettings.Ports["80/tcp"])).To(Equal(1))
-		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostPort).To(Equal("8080"))
+		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostPort).To(Equal("8880"))
 		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostIP).To(Equal("::1"))
 	})
 
@@ -283,33 +283,33 @@ var _ = Describe("Podman run networking", func() {
 		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostIP).To(Equal(""))
 	})
 
-	It("podman run -p 127.0.0.1::8080/udp", func() {
+	It("podman run -p 127.0.0.1::8980/udp", func() {
 		name := "testctr"
-		session := podmanTest.Podman([]string{"create", "-t", "-p", "127.0.0.1::8080/udp", "--name", name, ALPINE, "/bin/sh"})
+		session := podmanTest.Podman([]string{"create", "-t", "-p", "127.0.0.1::8980/udp", "--name", name, ALPINE, "/bin/sh"})
 		session.WaitWithDefaultTimeout()
 		inspectOut := podmanTest.InspectContainer(name)
 		Expect(len(inspectOut)).To(Equal(1))
 		Expect(len(inspectOut[0].NetworkSettings.Ports)).To(Equal(1))
-		Expect(len(inspectOut[0].NetworkSettings.Ports["8080/udp"])).To(Equal(1))
-		Expect(inspectOut[0].NetworkSettings.Ports["8080/udp"][0].HostPort).To(Not(Equal("8080")))
-		Expect(inspectOut[0].NetworkSettings.Ports["8080/udp"][0].HostIP).To(Equal("127.0.0.1"))
+		Expect(len(inspectOut[0].NetworkSettings.Ports["8980/udp"])).To(Equal(1))
+		Expect(inspectOut[0].NetworkSettings.Ports["8980/udp"][0].HostPort).To(Not(Equal("8980")))
+		Expect(inspectOut[0].NetworkSettings.Ports["8980/udp"][0].HostIP).To(Equal("127.0.0.1"))
 	})
 
-	It("podman run -p :8080", func() {
+	It("podman run -p :8181", func() {
 		name := "testctr"
-		session := podmanTest.Podman([]string{"create", "-t", "-p", ":8080", "--name", name, ALPINE, "/bin/sh"})
+		session := podmanTest.Podman([]string{"create", "-t", "-p", ":8181", "--name", name, ALPINE, "/bin/sh"})
 		session.WaitWithDefaultTimeout()
 		inspectOut := podmanTest.InspectContainer(name)
 		Expect(len(inspectOut)).To(Equal(1))
 		Expect(len(inspectOut[0].NetworkSettings.Ports)).To(Equal(1))
-		Expect(len(inspectOut[0].NetworkSettings.Ports["8080/tcp"])).To(Equal(1))
-		Expect(inspectOut[0].NetworkSettings.Ports["8080/tcp"][0].HostPort).To(Not(Equal("8080")))
-		Expect(inspectOut[0].NetworkSettings.Ports["8080/tcp"][0].HostIP).To(Equal(""))
+		Expect(len(inspectOut[0].NetworkSettings.Ports["8181/tcp"])).To(Equal(1))
+		Expect(inspectOut[0].NetworkSettings.Ports["8181/tcp"][0].HostPort).To(Not(Equal("8181")))
+		Expect(inspectOut[0].NetworkSettings.Ports["8181/tcp"][0].HostIP).To(Equal(""))
 	})
 
-	It("podman run -p 8080:8080 -p 8081:8080", func() {
+	It("podman run -p xxx:8080 -p yyy:8080", func() {
 		name := "testctr"
-		session := podmanTest.Podman([]string{"create", "-t", "-p", "4000:8080", "-p", "8000:8080", "--name", name, ALPINE, "/bin/sh"})
+		session := podmanTest.Podman([]string{"create", "-t", "-p", "4444:8080", "-p", "5555:8080", "--name", name, ALPINE, "/bin/sh"})
 		session.WaitWithDefaultTimeout()
 		inspectOut := podmanTest.InspectContainer(name)
 		Expect(len(inspectOut)).To(Equal(1))
@@ -320,18 +320,18 @@ var _ = Describe("Podman run networking", func() {
 		hp2 := inspectOut[0].NetworkSettings.Ports["8080/tcp"][1].HostPort
 
 		// We can't guarantee order
-		Expect((hp1 == "4000" && hp2 == "8000") || (hp1 == "8000" && hp2 == "4000")).To(BeTrue())
+		Expect((hp1 == "4444" && hp2 == "5555") || (hp1 == "5555" && hp2 == "4444")).To(BeTrue())
 	})
 
-	It("podman run -p 0.0.0.0:8080:80", func() {
+	It("podman run -p 0.0.0.0:9280:80", func() {
 		name := "testctr"
-		session := podmanTest.Podman([]string{"create", "-t", "-p", "0.0.0.0:8080:80", "--name", name, ALPINE, "/bin/sh"})
+		session := podmanTest.Podman([]string{"create", "-t", "-p", "0.0.0.0:9280:80", "--name", name, ALPINE, "/bin/sh"})
 		session.WaitWithDefaultTimeout()
 		inspectOut := podmanTest.InspectContainer(name)
 		Expect(len(inspectOut)).To(Equal(1))
 		Expect(len(inspectOut[0].NetworkSettings.Ports)).To(Equal(1))
 		Expect(len(inspectOut[0].NetworkSettings.Ports["80/tcp"])).To(Equal(1))
-		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostPort).To(Equal("8080"))
+		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostPort).To(Equal("9280"))
 		Expect(inspectOut[0].NetworkSettings.Ports["80/tcp"][0].HostIP).To(Equal(""))
 	})
 
@@ -348,20 +348,20 @@ var _ = Describe("Podman run networking", func() {
 		Expect(ncBusy).To(ExitWithError())
 	})
 
-	It("podman run network expose host port 8081 to container port 8000 using rootlesskit port handler", func() {
-		session := podmanTest.Podman([]string{"run", "--network", "slirp4netns:port_handler=rootlesskit", "-dt", "-p", "8081:8000", ALPINE, "/bin/sh"})
+	It("podman run network expose host port 18081 to container port 8000 using rootlesskit port handler", func() {
+		session := podmanTest.Podman([]string{"run", "--network", "slirp4netns:port_handler=rootlesskit", "-dt", "-p", "18081:8000", ALPINE, "/bin/sh"})
 		session.Wait(30)
 		Expect(session).Should(Exit(0))
 
-		ncBusy := SystemExec("nc", []string{"-l", "-p", "8081"})
+		ncBusy := SystemExec("nc", []string{"-l", "-p", "18081"})
 		Expect(ncBusy).To(ExitWithError())
 	})
 
-	It("podman run network expose host port 8082 to container port 8000 using slirp4netns port handler", func() {
-		session := podmanTest.Podman([]string{"run", "--network", "slirp4netns:port_handler=slirp4netns", "-dt", "-p", "8082:8000", ALPINE, "/bin/sh"})
+	It("podman run network expose host port 18082 to container port 8000 using slirp4netns port handler", func() {
+		session := podmanTest.Podman([]string{"run", "--network", "slirp4netns:port_handler=slirp4netns", "-dt", "-p", "18082:8000", ALPINE, "/bin/sh"})
 		session.Wait(30)
 		Expect(session).Should(Exit(0))
-		ncBusy := SystemExec("nc", []string{"-l", "-p", "8082"})
+		ncBusy := SystemExec("nc", []string{"-l", "-p", "18082"})
 		Expect(ncBusy).To(ExitWithError())
 	})
 
@@ -650,13 +650,13 @@ var _ = Describe("Podman run networking", func() {
 		defer podmanTest.removeCNINetwork(netName)
 
 		name := "nc-server"
-		run := podmanTest.Podman([]string{"run", "--log-driver", "k8s-file", "-d", "--name", name, "--net", netName, ALPINE, "nc", "-l", "-p", "8080"})
+		run := podmanTest.Podman([]string{"run", "--log-driver", "k8s-file", "-d", "--name", name, "--net", netName, ALPINE, "nc", "-l", "-p", "9480"})
 		run.WaitWithDefaultTimeout()
 		Expect(run).Should(Exit(0))
 
 		// NOTE: we force the k8s-file log driver to make sure the
 		// tests are passing inside a container.
-		run = podmanTest.Podman([]string{"run", "--log-driver", "k8s-file", "--rm", "--net", netName, "--uidmap", "0:1:4096", ALPINE, "sh", "-c", fmt.Sprintf("echo podman | nc -w 1 %s.dns.podman 8080", name)})
+		run = podmanTest.Podman([]string{"run", "--log-driver", "k8s-file", "--rm", "--net", netName, "--uidmap", "0:1:4096", ALPINE, "sh", "-c", fmt.Sprintf("echo podman | nc -w 1 %s.dns.podman 9480", name)})
 		run.WaitWithDefaultTimeout()
 		Expect(run).Should(Exit(0))
 
@@ -709,6 +709,18 @@ var _ = Describe("Podman run networking", func() {
 		Expect(strings.Contains(run.OutputToString(), hostname)).To(BeTrue())
 	})
 
+	It("podman run with pod does not add extra 127 entry to /etc/hosts", func() {
+		pod := "testpod"
+		hostname := "test-hostname"
+		run := podmanTest.Podman([]string{"pod", "create", "--hostname", hostname, "--name", pod})
+		run.WaitWithDefaultTimeout()
+		Expect(run).Should(Exit(0))
+		run = podmanTest.Podman([]string{"run", "--pod", pod, ALPINE, "cat", "/etc/hosts"})
+		run.WaitWithDefaultTimeout()
+		Expect(run).Should(Exit(0))
+		Expect(run.OutputToString()).ToNot(ContainSubstring("127.0.0.1 %s", hostname))
+	})
+
 	ping_test := func(netns string) {
 		hostname := "testctr"
 		run := podmanTest.Podman([]string{"run", netns, "--hostname", hostname, ALPINE, "ping", "-c", "1", hostname})
diff --git a/test/e2e/run_test.go b/test/e2e/run_test.go
index ec4b0d997..b6743f4b7 100644
--- a/test/e2e/run_test.go
+++ b/test/e2e/run_test.go
@@ -1148,11 +1148,11 @@ USER mail`, BB)
 	})
 
 	It("podman run --pod automatically", func() {
-		session := podmanTest.Podman([]string{"run", "-d", "--pod", "new:foobar", ALPINE, "nc", "-l", "-p", "8080"})
+		session := podmanTest.Podman([]string{"run", "-d", "--pod", "new:foobar", ALPINE, "nc", "-l", "-p", "8686"})
 		session.WaitWithDefaultTimeout()
 		Expect(session).Should(Exit(0))
 
-		session = podmanTest.Podman([]string{"run", "--pod", "foobar", ALPINE, "/bin/sh", "-c", "echo test | nc -w 1 127.0.0.1 8080"})
+		session = podmanTest.Podman([]string{"run", "--pod", "foobar", ALPINE, "/bin/sh", "-c", "echo test | nc -w 1 127.0.0.1 8686"})
 		session.WaitWithDefaultTimeout()
 		Expect(session).Should(Exit(0))
 
diff --git a/test/e2e/runlabel_test.go b/test/e2e/runlabel_test.go
index e67b6cba1..656eaaceb 100644
--- a/test/e2e/runlabel_test.go
+++ b/test/e2e/runlabel_test.go
@@ -22,6 +22,10 @@ var GlobalDockerfile = fmt.Sprintf(`
 FROM %s
 LABEL RUN echo \$GLOBAL_OPTS`, ALPINE)
 
+var PodmanRunlabelNameDockerfile = fmt.Sprintf(`
+FROM  %s
+LABEL RUN podman run --name NAME IMAGE`, ALPINE)
+
 var _ = Describe("podman container runlabel", func() {
 	var (
 		tempdir    string
@@ -128,4 +132,18 @@ var _ = Describe("podman container runlabel", func() {
 		result.WaitWithDefaultTimeout()
 		Expect(result).Should(Exit(0))
 	})
+
+	It("podman container runlabel name removes tag from image", func() {
+		image := "podman-runlabel-name:sometag"
+		podmanTest.BuildImage(PodmanRunlabelNameDockerfile, image, "false")
+
+		result := podmanTest.Podman([]string{"container", "runlabel", "--display", "RUN", image})
+		result.WaitWithDefaultTimeout()
+		Expect(result).Should(Exit(0))
+		Expect(result.OutputToString()).To(Equal("command: " + podmanTest.PodmanBinary + " run --name podman-runlabel-name localhost/" + image))
+
+		result = podmanTest.Podman([]string{"rmi", image})
+		result.WaitWithDefaultTimeout()
+		Expect(result).Should(Exit(0))
+	})
 })
diff --git a/test/e2e/system_connection_test.go b/test/e2e/system_connection_test.go
index 21398887a..6cdb78c5e 100644
--- a/test/e2e/system_connection_test.go
+++ b/test/e2e/system_connection_test.go
@@ -138,7 +138,7 @@ var _ = Describe("podman system connection", func() {
 	It("add tcp", func() {
 		cmd := []string{"system", "connection", "add",
 			"QA-TCP",
-			"tcp://localhost:8080",
+			"tcp://localhost:8888",
 		}
 		session := podmanTest.Podman(cmd)
 		session.WaitWithDefaultTimeout()
@@ -150,7 +150,7 @@ var _ = Describe("podman system connection", func() {
 		Expect(cfg.Engine.ActiveService).To(Equal("QA-TCP"))
 		Expect(cfg.Engine.ServiceDestinations["QA-TCP"]).To(Equal(
 			config.Destination{
-				URI:      "tcp://localhost:8080",
+				URI:      "tcp://localhost:8888",
 				Identity: "",
 			},
 		))
diff --git a/test/e2e/top_test.go b/test/e2e/top_test.go
index 3cf6244b6..93c4f3f12 100644
--- a/test/e2e/top_test.go
+++ b/test/e2e/top_test.go
@@ -73,6 +73,12 @@ var _ = Describe("Podman top", func() {
 		result.WaitWithDefaultTimeout()
 		Expect(result).Should(Exit(0))
 		Expect(len(result.OutputToStringArray())).To(BeNumerically(">", 1))
+
+		// Just a smoke test since groups may change over time.
+		result = podmanTest.Podman([]string{"container", "top", "test", "groups", "hgroups"})
+		result.WaitWithDefaultTimeout()
+		Expect(result).Should(Exit(0))
+		Expect(len(result.OutputToStringArray())).To(BeNumerically(">", 1))
 	})
 
 	It("podman top with options", func() {
diff --git a/test/system/001-basic.bats b/test/system/001-basic.bats
index 963c89281..888c075b8 100644
--- a/test/system/001-basic.bats
+++ b/test/system/001-basic.bats
@@ -57,6 +57,9 @@ function setup() {
 
     # Now untag the digest reference again.
     run_podman untag $IMAGE $IMAGE@$digest
+
+    # Make sure the original image is still present (#11557).
+    run_podman image exists $IMAGE
 }
 
 # PR #7212: allow --remote anywhere before subcommand, not just as 1st flag
diff --git a/test/system/070-build.bats b/test/system/070-build.bats
index 03c7984e2..0e1396fc6 100644
--- a/test/system/070-build.bats
+++ b/test/system/070-build.bats
@@ -285,21 +285,11 @@ EOF
         build_arg_implicit+="=$arg_implicit_value"
     fi
 
-    # FIXME FIXME FIXME: 2021-03-15: workaround for #9567 (slow ubuntu 2004):
-    # we're seeing lots of timeouts in CI. Until/unless #9567 gets fixed,
-    # let's get CI passing by extending the timeout when remote on ubuntu
-    local localtimeout=${PODMAN_TIMEOUT}
-    if is_remote; then
-        if grep -qi ubuntu /etc/os-release; then
-            localtimeout=$(( 2 * $localtimeout ))
-        fi
-    fi
-
     # cd to the dir, so we test relative paths (important for podman-remote)
     cd $PODMAN_TMPDIR
     export arg_explicit="THIS SHOULD BE OVERRIDDEN BY COMMAND LINE!"
     export arg_implicit=${arg_implicit_value}
-    PODMAN_TIMEOUT=$localtimeout run_podman ${MOUNTS_CONF} build \
+    run_podman ${MOUNTS_CONF} build \
                --build-arg arg_explicit=${arg_explicit_value} \
                $build_arg_implicit \
                --dns-search $nosuchdomain \
@@ -456,16 +446,24 @@ Labels.$label_name | $label_value
 
 @test "podman build - COPY with ignore" {
     local tmpdir=$PODMAN_TMPDIR/build-test-$(random_string 10)
-    mkdir -p $tmpdir/subdir
+    mkdir -p $tmpdir/subdir{1,2}
 
     # Create a bunch of files. Declare this as an array to avoid duplication
     # because we iterate over that list below, checking for each file.
     # A leading "-" indicates that the file SHOULD NOT exist in the built image
+    #
+    # Weird side effect of Buildah 3486, relating to subdirectories and
+    # wildcard patterns. See that PR for details, it's way too confusing
+    # to explain in a comment.
     local -a files=(
         -test1 -test1.txt
          test2  test2.txt
-         -subdir/sub1 -subdir/sub1.txt
-         -subdir/sub2 -subdir/sub2.txt
+          subdir1/sub1  subdir1/sub1.txt
+         -subdir1/sub2 -subdir1/sub2.txt
+          subdir1/sub3  subdir1/sub3.txt
+         -subdir2/sub1 -subdir2/sub1.txt
+         -subdir2/sub2 -subdir2/sub2.txt
+         -subdir2/sub3 -subdir2/sub3.txt
          this-file-does-not-match-anything-in-ignore-file
          comment
     )
@@ -492,8 +490,10 @@ EOF
 # comment
 test*
 !test2*
-subdir
+subdir1
+subdir2
 !*/sub1*
+!subdir1/sub3*
 EOF
 
         # Build an image. For .dockerignore
diff --git a/test/system/160-volumes.bats b/test/system/160-volumes.bats
index f6dc3f0af..e21be9ea4 100644
--- a/test/system/160-volumes.bats
+++ b/test/system/160-volumes.bats
@@ -21,8 +21,6 @@ function teardown() {
 
 # Simple volume tests: share files between host and container
 @test "podman run --volumes : basic" {
-    skip_if_remote "volumes cannot be shared across hosts"
-
     run_podman volume list --noheading
     is "$output" "" "baseline: empty results from list --noheading"
 
@@ -192,9 +190,12 @@ EOF
     run_podman volume create my_vol
     run_podman run --rm -v my_vol:/data $IMAGE sh -c "echo hello >> /data/test"
     run_podman volume create my_vol2
-    run_podman volume export my_vol --output=hello.tar
+
+    tarfile=hello$(random_string | tr A-Z a-z).tar
+    run_podman volume export my_vol --output=$tarfile
     # we want to use `run_podman volume export my_vol` but run_podman is wrapping EOF
-    cat hello.tar | run_podman volume import my_vol2 -
+    run_podman volume import my_vol2 - < $tarfile
+    rm -f $tarfile
     run_podman run --rm -v my_vol2:/data $IMAGE sh -c "cat /data/test"
     is "$output" "hello" "output from second container"
     run_podman volume rm my_vol
diff --git a/test/utils/utils.go b/test/utils/utils.go
index 80af7fb7c..bfefc58ec 100644
--- a/test/utils/utils.go
+++ b/test/utils/utils.go
@@ -19,7 +19,7 @@ import (
 )
 
 var (
-	defaultWaitTimeout   = 90
+	DefaultWaitTimeout   = 90
 	OSReleasePath        = "/etc/os-release"
 	ProcessOneCgroupPath = "/proc/1/cgroup"
 )
@@ -317,15 +317,20 @@ func (s *PodmanSession) IsJSONOutputValid() bool {
 	return true
 }
 
-// WaitWithDefaultTimeout waits for process finished with defaultWaitTimeout
+// WaitWithDefaultTimeout waits for process finished with DefaultWaitTimeout
 func (s *PodmanSession) WaitWithDefaultTimeout() {
-	Eventually(s, defaultWaitTimeout).Should(Exit())
+	s.WaitWithTimeout(DefaultWaitTimeout)
+}
+
+// WaitWithTimeout waits for process finished with DefaultWaitTimeout
+func (s *PodmanSession) WaitWithTimeout(timeout int) {
+	Eventually(s, timeout).Should(Exit())
 	os.Stdout.Sync()
 	os.Stderr.Sync()
 	fmt.Println("output:", s.OutputToString())
 }
 
-// CreateTempDirinTempDir create a temp dir with prefix podman_test
+// CreateTempDirInTempDir create a temp dir with prefix podman_test
 func CreateTempDirInTempDir() (string, error) {
 	return ioutil.TempDir("", "podman_test")
 }
@@ -337,7 +342,7 @@ func SystemExec(command string, args []string) *PodmanSession {
 	if err != nil {
 		Fail(fmt.Sprintf("unable to run command: %s %s", command, strings.Join(args, " ")))
 	}
-	session.Wait(defaultWaitTimeout)
+	session.Wait(DefaultWaitTimeout)
 	return &PodmanSession{session}
 }
 
diff --git a/vendor/github.com/containers/psgo/.codespellrc b/vendor/github.com/containers/psgo/.codespellrc
new file mode 100644
index 000000000..604bc21da
--- /dev/null
+++ b/vendor/github.com/containers/psgo/.codespellrc
@@ -0,0 +1,2 @@
+[codespell]
+skip = ./vendor,./.git
diff --git a/vendor/github.com/containers/psgo/.golangci.yml b/vendor/github.com/containers/psgo/.golangci.yml
new file mode 100644
index 000000000..a098068fe
--- /dev/null
+++ b/vendor/github.com/containers/psgo/.golangci.yml
@@ -0,0 +1,6 @@
+# For documentation, see https://golangci-lint.run/usage/configuration/
+
+linters:
+  enable:
+    - errorlint
+    - gofumpt
diff --git a/vendor/github.com/containers/psgo/.travis.yml b/vendor/github.com/containers/psgo/.travis.yml
deleted file mode 100644
index c07bb140b..000000000
--- a/vendor/github.com/containers/psgo/.travis.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-language: go
-
-sudo: required
-
-servics:
-        - docker
-
-go:
-        - tip
-
-before_install:
-        - sudo add-apt-repository ppa:duggan/bats --yes
-        - sudo apt-get update -qq
-        - sudo apt-get install -qq bats
-
-script:
-        - make validate
-        - make build
-        - make test
diff --git a/vendor/github.com/containers/psgo/Makefile b/vendor/github.com/containers/psgo/Makefile
index 831dfa31f..fb6126e7c 100644
--- a/vendor/github.com/containers/psgo/Makefile
+++ b/vendor/github.com/containers/psgo/Makefile
@@ -1,28 +1,25 @@
-export GO111MODULE=off
-export GOPROXY=https://proxy.golang.org
-
 SHELL= /bin/bash
 GO ?= go
 BUILD_DIR := ./bin
 BIN_DIR := /usr/local/bin
 NAME := psgo
-PROJECT := github.com/containers/psgo
 BATS_TESTS := *.bats
-GO_SRC=$(shell find . -name \*.go)
 
-GO_BUILD=$(GO) build
-# Go module support: set `-mod=vendor` to use the vendored sources
-ifeq ($(shell go help mod >/dev/null 2>&1 && echo true), true)
-	GO_BUILD=GO111MODULE=on $(GO) build -mod=vendor
+# Not all platforms support -buildmode=pie, plus it's incompatible with -race.
+ifeq ($(shell $(GO) env GOOS),linux)
+	ifeq (,$(filter $(shell $(GO) env GOARCH),mips mipsle mips64 mips64le ppc64 riscv64))
+		ifeq (,$(findstring -race,$(EXTRA_BUILD_FLAGS)))
+			GO_BUILDMODE := "-buildmode=pie"
+		endif
+	endif
 endif
-
-GOBIN ?= $(GO)/bin
+GO_BUILD := $(GO) build $(GO_BUILDMODE)
 
 all: validate build
 
 .PHONY: build
-build: $(GO_SRC)
-	 $(GO_BUILD) -buildmode=pie -o $(BUILD_DIR)/$(NAME) $(PROJECT)/sample
+build:
+	 $(GO_BUILD) $(EXTRA_BUILD_FLAGS) -o $(BUILD_DIR)/$(NAME) ./sample
 
 .PHONY: clean
 clean:
@@ -30,13 +27,13 @@ clean:
 
 .PHONY: vendor
 vendor:
-	GO111MODULE=on go mod tidy
-	GO111MODULE=on go mod vendor
-	GO111MODULE=on go mod verify
+	go mod tidy
+	go mod vendor
+	go mod verify
 
 .PHONY: validate
-validate: .install.lint
-	$(GOBIN)/golangci-lint run
+validate:
+	golangci-lint run
 
 .PHONY: test
 test: test-unit test-integration
@@ -47,17 +44,12 @@ test-integration:
 
 .PHONY: test-unit
 test-unit:
-	go test -v $(PROJECT)
-	go test -v $(PROJECT)/internal/...
+	$(GO) test -v $(EXTRA_TEST_FLAGS) ./...
 
 .PHONY: install
 install:
 	sudo install -D -m755 $(BUILD_DIR)/$(NAME) $(BIN_DIR)
 
-.PHONY: .install.lint
-.install.lint:
-	VERSION=1.24.0 GOBIN=$(GOBIN) sh ./hack/install_golangci.sh
-
 .PHONY: uninstall
 uninstall:
 	sudo rm $(BIN_DIR)/$(NAME)
diff --git a/vendor/github.com/containers/psgo/README.md b/vendor/github.com/containers/psgo/README.md
index fed42c683..684c80a0c 100644
--- a/vendor/github.com/containers/psgo/README.md
+++ b/vendor/github.com/containers/psgo/README.md
@@ -73,8 +73,12 @@ The ps library is compatible with all AIX format descriptors of the ps command-l
   - Set of inheritable capabilities. See capabilities(7) for more information.
 - **capprm**
   - Set of permitted capabilities. See capabilities(7) for more information.
+- **groups**
+  - Supplmentary groups inside the container.
 - **hgroup**
   - The corresponding effective group of a container process on the host.
+- **hgroups**
+  - Supplmentary groups on the host.
 - **hpid**
   - The corresponding host PID of a container process.
 - **huser**
diff --git a/vendor/github.com/containers/psgo/go.mod b/vendor/github.com/containers/psgo/go.mod
index 699874cf7..fd19d9b48 100644
--- a/vendor/github.com/containers/psgo/go.mod
+++ b/vendor/github.com/containers/psgo/go.mod
@@ -1,10 +1,9 @@
 module github.com/containers/psgo
 
-go 1.13
+go 1.14
 
 require (
 	github.com/opencontainers/runc v1.0.2
-	github.com/sirupsen/logrus v1.8.1
 	github.com/stretchr/testify v1.7.0
 	golang.org/x/sys v0.0.0-20210817190340-bfb29a6856f2
 )
diff --git a/vendor/github.com/containers/psgo/go.sum b/vendor/github.com/containers/psgo/go.sum
index 0ba04956f..85b0f4ff7 100644
--- a/vendor/github.com/containers/psgo/go.sum
+++ b/vendor/github.com/containers/psgo/go.sum
@@ -39,7 +39,6 @@ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZN
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
diff --git a/vendor/github.com/containers/psgo/internal/host/host.go b/vendor/github.com/containers/psgo/internal/host/host.go
index 33ad67a11..3c708a2b8 100644
--- a/vendor/github.com/containers/psgo/internal/host/host.go
+++ b/vendor/github.com/containers/psgo/internal/host/host.go
@@ -54,7 +54,7 @@ func BootTime() (int64, error) {
 
 	btimeSec, err := strconv.ParseInt(btimeStr, 10, 64)
 	if err != nil {
-		return 0, fmt.Errorf("error parsing boot time from /proc/stat: %s", err)
+		return 0, fmt.Errorf("error parsing boot time from /proc/stat: %w", err)
 	}
 	bootTime = &btimeSec
 	return btimeSec, nil
diff --git a/vendor/github.com/containers/psgo/internal/proc/ns.go b/vendor/github.com/containers/psgo/internal/proc/ns.go
index 4778048f2..28ee6a2c9 100644
--- a/vendor/github.com/containers/psgo/internal/proc/ns.go
+++ b/vendor/github.com/containers/psgo/internal/proc/ns.go
@@ -59,7 +59,7 @@ func ReadMappings(path string) ([]IDMap, error) {
 	for {
 		line, _, err := buf.ReadLine()
 		if err != nil {
-			if err == io.EOF {
+			if err == io.EOF { //nolint:errorlint // False positive, see https://github.com/polyfloyd/go-errorlint/pull/12
 				return mappings, nil
 			}
 			return nil, fmt.Errorf("cannot read line from %s: %w", path, err)
diff --git a/vendor/github.com/containers/psgo/internal/proc/pids.go b/vendor/github.com/containers/psgo/internal/proc/pids.go
index 69e8befc1..2687396e1 100644
--- a/vendor/github.com/containers/psgo/internal/proc/pids.go
+++ b/vendor/github.com/containers/psgo/internal/proc/pids.go
@@ -52,7 +52,7 @@ func GetPIDs() ([]string, error) {
 	return pids, nil
 }
 
-// GetPIDsFromCgroup returns a strings slice of all pids listesd in pid's pids
+// GetPIDsFromCgroup returns a strings slice of all pids listed in pid's pids
 // cgroup.  It automatically detects if we're running in unified mode or not.
 func GetPIDsFromCgroup(pid string) ([]string, error) {
 	unified, err := cgroups.IsCgroup2UnifiedMode()
@@ -65,11 +65,12 @@ func GetPIDsFromCgroup(pid string) ([]string, error) {
 	return getPIDsFromCgroupV1(pid)
 }
 
-// getPIDsFromCgroupV1 returns a strings slice of all pids listesd in pid's pids
+// getPIDsFromCgroupV1 returns a strings slice of all pids listed in pid's pids
 // cgroup.
 func getPIDsFromCgroupV1(pid string) ([]string, error) {
 	// First, find the corresponding path to the PID cgroup.
-	f, err := os.Open(fmt.Sprintf("/proc/%s/cgroup", pid))
+	pidPath := fmt.Sprintf("/proc/%s/cgroup", pid)
+	f, err := os.Open(pidPath)
 	if err != nil {
 		return nil, err
 	}
@@ -83,7 +84,8 @@ func getPIDsFromCgroupV1(pid string) ([]string, error) {
 			continue
 		}
 		if fields[1] == "pids" {
-			cgroupPath = fmt.Sprintf("/sys/fs/cgroup/pids/%s/cgroup.procs", fields[2])
+			cgroupPath = filepath.Join(cgroups.CgroupRoot, "pids", fields[2], "cgroup.procs")
+			break
 		}
 	}
 
@@ -94,7 +96,18 @@ func getPIDsFromCgroupV1(pid string) ([]string, error) {
 	// Second, extract the PIDs inside the cgroup.
 	f, err = os.Open(cgroupPath)
 	if err != nil {
-		return nil, err
+		if os.IsNotExist(err) {
+			// OCI runtimes might mount the container cgroup at the root, breaking what it showed
+			// in /proc/$PID/cgroup and the path.
+			// Check if the PID still exists to make sure the process is still alive.
+			if _, errStat := os.Stat(pidPath); errStat == nil {
+				cgroupPath = filepath.Join(cgroups.CgroupRoot, "pids", "cgroup.procs")
+				f, err = os.Open(cgroupPath)
+			}
+		}
+		if err != nil {
+			return nil, err
+		}
 	}
 	defer f.Close()
 
@@ -107,7 +120,7 @@ func getPIDsFromCgroupV1(pid string) ([]string, error) {
 	return pids, nil
 }
 
-// getPIDsFromCgroupV2 returns a strings slice of all pids listesd in pid's pids
+// getPIDsFromCgroupV2 returns a strings slice of all pids listed in pid's pids
 // cgroup.
 func getPIDsFromCgroupV2(pid string) ([]string, error) {
 	// First, find the corresponding path to the PID cgroup.
@@ -124,8 +137,10 @@ func getPIDsFromCgroupV2(pid string) ([]string, error) {
 		if len(fields) != 3 {
 			continue
 		}
-		cgroupSlice = fields[2]
-		break
+		if fields[1] == "" {
+			cgroupSlice = fields[2]
+			break
+		}
 	}
 
 	if cgroupSlice == "" {
diff --git a/vendor/github.com/containers/psgo/internal/proc/status.go b/vendor/github.com/containers/psgo/internal/proc/status.go
index 2753915fd..1896b5c07 100644
--- a/vendor/github.com/containers/psgo/internal/proc/status.go
+++ b/vendor/github.com/containers/psgo/internal/proc/status.go
@@ -182,7 +182,7 @@ func readStatusUserNS(pid string) ([]string, error) {
 	c := exec.Command(args[0], args[1:]...)
 	output, err := c.CombinedOutput()
 	if err != nil {
-		return nil, fmt.Errorf("error executing %q: %v", strings.Join(args, " "), err)
+		return nil, fmt.Errorf("error executing %q: %w", strings.Join(args, " "), err)
 	}
 
 	return strings.Split(string(output), "\n"), nil
diff --git a/vendor/github.com/containers/psgo/internal/process/process.go b/vendor/github.com/containers/psgo/internal/process/process.go
index 8fd49e416..715039610 100644
--- a/vendor/github.com/containers/psgo/internal/process/process.go
+++ b/vendor/github.com/containers/psgo/internal/process/process.go
@@ -215,7 +215,7 @@ func (p *Process) StartTime() (time.Time, error) {
 	return time.Unix(sinceBoot+bootTime, 0), nil
 }
 
-// CPUTime returns the cumlative CPU time of process p as a time.Duration.
+// CPUTime returns the cumulative CPU time of process p as a time.Duration.
 func (p *Process) CPUTime() (time.Duration, error) {
 	user, err := strconv.ParseInt(p.Stat.Utime, 10, 64)
 	if err != nil {
diff --git a/vendor/github.com/containers/psgo/psgo.go b/vendor/github.com/containers/psgo/psgo.go
index b0569fa1c..ea893e7ca 100644
--- a/vendor/github.com/containers/psgo/psgo.go
+++ b/vendor/github.com/containers/psgo/psgo.go
@@ -175,6 +175,11 @@ var (
 			procFn: processGROUP,
 		},
 		{
+			normal: "groups",
+			header: "GROUPS",
+			procFn: processGROUPS,
+		},
+		{
 			code:   "%P",
 			normal: "ppid",
 			header: "PPID",
@@ -306,6 +311,12 @@ var (
 			procFn: processHGROUP,
 		},
 		{
+			normal: "hgroups",
+			header: "HGROUPS",
+			onHost: true,
+			procFn: processHGROUPS,
+		},
+		{
 			normal: "rss",
 			header: "RSS",
 			procFn: processRSS,
@@ -620,14 +631,29 @@ func findHostProcess(p *process.Process, ctx *psContext) *process.Process {
 }
 
 // processGROUP returns the effective group ID of the process.  This will be
-// the textual group ID, if it can be optained, or a decimal representation
+// the textual group ID, if it can be obtained, or a decimal representation
 // otherwise.
 func processGROUP(p *process.Process, ctx *psContext) (string, error) {
 	return process.LookupGID(p.Status.Gids[1])
 }
 
+// processGROUPS returns the supplementary groups of the process separated by
+// comma. This will be the textual group ID, if it can be obtained, or a
+// decimal representation otherwise.
+func processGROUPS(p *process.Process, ctx *psContext) (string, error) {
+	var err error
+	groups := make([]string, len(p.Status.Groups))
+	for i, g := range p.Status.Groups {
+		groups[i], err = process.LookupGID(g)
+		if err != nil {
+			return "", err
+		}
+	}
+	return strings.Join(groups, ","), nil
+}
+
 // processRGROUP returns the real group ID of the process.  This will be
-// the textual group ID, if it can be optained, or a decimal representation
+// the textual group ID, if it can be obtained, or a decimal representation
 // otherwise.
 func processRGROUP(p *process.Process, ctx *psContext) (string, error) {
 	return process.LookupGID(p.Status.Gids[0])
@@ -639,14 +665,14 @@ func processPPID(p *process.Process, ctx *psContext) (string, error) {
 }
 
 // processUSER returns the effective user name of the process.  This will be
-// the textual user ID, if it can be optained, or a decimal representation
+// the textual user ID, if it can be obtained, or a decimal representation
 // otherwise.
 func processUSER(p *process.Process, ctx *psContext) (string, error) {
 	return process.LookupUID(p.Status.Uids[1])
 }
 
 // processRUSER returns the effective user name of the process.  This will be
-// the textual user ID, if it can be optained, or a decimal representation
+// the textual user ID, if it can be obtained, or a decimal representation
 // otherwise.
 func processRUSER(p *process.Process, ctx *psContext) (string, error) {
 	return process.LookupUID(p.Status.Uids[0])
@@ -867,6 +893,26 @@ func processHGROUP(p *process.Process, ctx *psContext) (string, error) {
 	return "?", nil
 }
 
+// processHGROUPS returns the supplementary groups of the corresponding host
+// process of the (container) or "?" if no corresponding process could be
+// found.
+func processHGROUPS(p *process.Process, ctx *psContext) (string, error) {
+	if hp := findHostProcess(p, ctx); hp != nil {
+		groups := hp.Status.Groups
+		if ctx.opts != nil && len(ctx.opts.GIDMap) > 0 {
+			var err error
+			for i, g := range groups {
+				groups[i], err = findID(g, ctx.opts.GIDMap, process.LookupGID, "/proc/sys/fs/overflowgid")
+				if err != nil {
+					return "", err
+				}
+			}
+		}
+		return strings.Join(groups, ","), nil
+	}
+	return "?", nil
+}
+
 // processRSS returns the resident set size of process p in KiB (1024-byte
 // units).
 func processRSS(p *process.Process, ctx *psContext) (string, error) {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 65177d70d..60810c6b1 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -196,7 +196,7 @@ github.com/containers/ocicrypt/keywrap/pkcs7
 github.com/containers/ocicrypt/spec
 github.com/containers/ocicrypt/utils
 github.com/containers/ocicrypt/utils/keyprovider
-# github.com/containers/psgo v1.6.0
+# github.com/containers/psgo v1.7.1
 github.com/containers/psgo
 github.com/containers/psgo/internal/capabilities
 github.com/containers/psgo/internal/cgroups