diff --git a/integration-cli/docker_cli_run_test.go b/integration-cli/docker_cli_run_test.go
index f72a8bb70e..c96a0f6a9b 100644
--- a/integration-cli/docker_cli_run_test.go
+++ b/integration-cli/docker_cli_run_test.go
@@ -54,7 +54,7 @@ func (s *DockerCLIRunSuite) OnTimeout(c *testing.T) {
 
 // "test123" should be printed by docker run
 func (s *DockerCLIRunSuite) TestRunEchoStdout(c *testing.T) {
-	out, _ := dockerCmd(c, "run", "busybox", "echo", "test123")
+	out := cli.DockerCmd(c, "run", "busybox", "echo", "test123").Combined()
 	if out != "test123\n" {
 		c.Fatalf("container should've printed 'test123', got '%s'", out)
 	}
@@ -62,7 +62,7 @@ func (s *DockerCLIRunSuite) TestRunEchoStdout(c *testing.T) {
 
 // "test" should be printed
 func (s *DockerCLIRunSuite) TestRunEchoNamedContainer(c *testing.T) {
-	out, _ := dockerCmd(c, "run", "--name", "testfoonamedcontainer", "busybox", "echo", "test")
+	out := cli.DockerCmd(c, "run", "--name", "testfoonamedcontainer", "busybox", "echo", "test").Combined()
 	if out != "test\n" {
 		c.Errorf("container should've printed 'test'")
 	}
@@ -72,7 +72,7 @@ func (s *DockerCLIRunSuite) TestRunEchoNamedContainer(c *testing.T) {
 // specific functionality and cannot run on Windows.
 func (s *DockerCLIRunSuite) TestRunLeakyFileDescriptors(c *testing.T) {
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "busybox", "ls", "-C", "/proc/self/fd")
+	out := cli.DockerCmd(c, "run", "busybox", "ls", "-C", "/proc/self/fd").Combined()
 
 	// normally, we should only get 0, 1, and 2, but 3 gets created by "ls" when it does "opendir" on the "fd" directory
 	if out != "0  1  2  3\n" {
@@ -87,15 +87,15 @@ func (s *DockerCLIRunSuite) TestRunLookupGoogleDNS(c *testing.T) {
 	if testEnv.DaemonInfo.OSType == "windows" {
 		// nslookup isn't present in Windows busybox. Is built-in. Further,
 		// nslookup isn't present in nanoserver. Hence just use PowerShell...
-		dockerCmd(c, "run", testEnv.PlatformDefaults.BaseImage, "powershell", "Resolve-DNSName", "google.com")
+		cli.DockerCmd(c, "run", testEnv.PlatformDefaults.BaseImage, "powershell", "Resolve-DNSName", "google.com")
 	} else {
-		dockerCmd(c, "run", "busybox", "nslookup", "google.com")
+		cli.DockerCmd(c, "run", "busybox", "nslookup", "google.com")
 	}
 }
 
 // the exit code should be 0
 func (s *DockerCLIRunSuite) TestRunExitCodeZero(c *testing.T) {
-	dockerCmd(c, "run", "busybox", "true")
+	cli.DockerCmd(c, "run", "busybox", "true")
 }
 
 // the exit code should be 1
@@ -117,30 +117,27 @@ func (s *DockerCLIRunSuite) TestRunStdinPipe(c *testing.T) {
 	out := result.Stdout()
 
 	out = strings.TrimSpace(out)
-	dockerCmd(c, "wait", out)
+	cli.DockerCmd(c, "wait", out)
 
-	logsOut, _ := dockerCmd(c, "logs", out)
-
-	containerLogs := strings.TrimSpace(logsOut)
+	containerLogs := cli.DockerCmd(c, "logs", out).Combined()
+	containerLogs = strings.TrimSpace(containerLogs)
 	if containerLogs != "blahblah" {
 		c.Errorf("logs didn't print the container's logs %s", containerLogs)
 	}
 
-	dockerCmd(c, "rm", out)
+	cli.DockerCmd(c, "rm", out)
 }
 
 // the container's ID should be printed when starting a container in detached mode
 func (s *DockerCLIRunSuite) TestRunDetachedContainerIDPrinting(c *testing.T) {
-	out, _ := dockerCmd(c, "run", "-d", "busybox", "true")
-
-	out = strings.TrimSpace(out)
-	dockerCmd(c, "wait", out)
-
-	rmOut, _ := dockerCmd(c, "rm", out)
+	id := cli.DockerCmd(c, "run", "-d", "busybox", "true").Stdout()
+	id = strings.TrimSpace(id)
+	cli.DockerCmd(c, "wait", id)
 
+	rmOut := cli.DockerCmd(c, "rm", id).Stdout()
 	rmOut = strings.TrimSpace(rmOut)
-	if rmOut != out {
-		c.Errorf("rm didn't print the container ID %s %s", out, rmOut)
+	if rmOut != id {
+		c.Errorf("rm didn't print the container ID %s %s", id, rmOut)
 	}
 }
 
@@ -153,16 +150,14 @@ func (s *DockerCLIRunSuite) TestRunWorkingDirectory(c *testing.T) {
 	}
 
 	// First with -w
-	out, _ := dockerCmd(c, "run", "-w", dir, image, "pwd")
-	out = strings.TrimSpace(out)
-	if out != dir {
+	out := cli.DockerCmd(c, "run", "-w", dir, image, "pwd").Stdout()
+	if strings.TrimSpace(out) != dir {
 		c.Errorf("-w failed to set working directory")
 	}
 
 	// Then with --workdir
-	out, _ = dockerCmd(c, "run", "--workdir", dir, image, "pwd")
-	out = strings.TrimSpace(out)
-	if out != dir {
+	out = cli.DockerCmd(c, "run", "--workdir", dir, image, "pwd").Stdout()
+	if strings.TrimSpace(out) != dir {
 		c.Errorf("--workdir failed to set working directory")
 	}
 }
@@ -191,11 +186,11 @@ func (s *DockerCLIRunSuite) TestRunLinksContainerWithContainerName(c *testing.T)
 	// TODO Windows: This test cannot run on a Windows daemon as the networking
 	// settings are not populated back yet on inspect.
 	testRequires(c, DaemonIsLinux)
-	dockerCmd(c, "run", "-i", "-t", "-d", "--name", "parent", "busybox")
+	cli.DockerCmd(c, "run", "-i", "-t", "-d", "--name", "parent", "busybox")
 
 	ip := inspectField(c, "parent", "NetworkSettings.Networks.bridge.IPAddress")
 
-	out, _ := dockerCmd(c, "run", "--link", "parent:test", "busybox", "/bin/cat", "/etc/hosts")
+	out := cli.DockerCmd(c, "run", "--link", "parent:test", "busybox", "/bin/cat", "/etc/hosts").Combined()
 	if !strings.Contains(out, ip+"	test") {
 		c.Fatalf("use a container name to link target failed")
 	}
@@ -206,12 +201,11 @@ func (s *DockerCLIRunSuite) TestRunLinksContainerWithContainerID(c *testing.T) {
 	// TODO Windows: This test cannot run on a Windows daemon as the networking
 	// settings are not populated back yet on inspect.
 	testRequires(c, DaemonIsLinux)
-	cID, _ := dockerCmd(c, "run", "-i", "-t", "-d", "busybox")
-
+	cID := cli.DockerCmd(c, "run", "-i", "-t", "-d", "busybox").Stdout()
 	cID = strings.TrimSpace(cID)
 	ip := inspectField(c, cID, "NetworkSettings.Networks.bridge.IPAddress")
 
-	out, _ := dockerCmd(c, "run", "--link", cID+":test", "busybox", "/bin/cat", "/etc/hosts")
+	out := cli.DockerCmd(c, "run", "--link", cID+":test", "busybox", "/bin/cat", "/etc/hosts").Combined()
 	if !strings.Contains(out, ip+"	test") {
 		c.Fatalf("use a container id to link target failed")
 	}
@@ -219,16 +213,15 @@ func (s *DockerCLIRunSuite) TestRunLinksContainerWithContainerID(c *testing.T) {
 
 func (s *DockerCLIRunSuite) TestUserDefinedNetworkLinks(c *testing.T) {
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
-	dockerCmd(c, "network", "create", "-d", "bridge", "udlinkNet")
+	cli.DockerCmd(c, "network", "create", "-d", "bridge", "udlinkNet")
 
-	dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=first", "busybox", "top")
-	assert.Assert(c, waitRun("first") == nil)
+	cli.DockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=first", "busybox", "top")
+	cli.WaitRun(c, "first")
 
 	// run a container in user-defined network udlinkNet with a link for an existing container
 	// and a link for a container that doesn't exist
-	dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=second", "--link=first:foo",
-		"--link=third:bar", "busybox", "top")
-	assert.Assert(c, waitRun("second") == nil)
+	cli.DockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=second", "--link=first:foo", "--link=third:bar", "busybox", "top")
+	cli.WaitRun(c, "second")
 
 	// ping to first and its alias foo must succeed
 	_, _, err := dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
@@ -243,8 +236,8 @@ func (s *DockerCLIRunSuite) TestUserDefinedNetworkLinks(c *testing.T) {
 	assert.ErrorContains(c, err, "")
 
 	// start third container now
-	dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=third", "busybox", "top")
-	assert.Assert(c, waitRun("third") == nil)
+	cli.DockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=third", "busybox", "top")
+	cli.WaitRun(c, "third")
 
 	// ping to third and its alias must succeed now
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "third")
@@ -255,14 +248,13 @@ func (s *DockerCLIRunSuite) TestUserDefinedNetworkLinks(c *testing.T) {
 
 func (s *DockerCLIRunSuite) TestUserDefinedNetworkLinksWithRestart(c *testing.T) {
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
-	dockerCmd(c, "network", "create", "-d", "bridge", "udlinkNet")
+	cli.DockerCmd(c, "network", "create", "-d", "bridge", "udlinkNet")
 
-	dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=first", "busybox", "top")
-	assert.Assert(c, waitRun("first") == nil)
+	cli.DockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=first", "busybox", "top")
+	cli.WaitRun(c, "first")
 
-	dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=second", "--link=first:foo",
-		"busybox", "top")
-	assert.Assert(c, waitRun("second") == nil)
+	cli.DockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=second", "--link=first:foo", "busybox", "top")
+	cli.WaitRun(c, "second")
 
 	// ping to first and its alias foo must succeed
 	_, _, err := dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
@@ -271,8 +263,8 @@ func (s *DockerCLIRunSuite) TestUserDefinedNetworkLinksWithRestart(c *testing.T)
 	assert.NilError(c, err)
 
 	// Restart first container
-	dockerCmd(c, "restart", "first")
-	assert.Assert(c, waitRun("first") == nil)
+	cli.DockerCmd(c, "restart", "first")
+	cli.WaitRun(c, "first")
 
 	// ping to first and its alias foo must still succeed
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
@@ -281,8 +273,8 @@ func (s *DockerCLIRunSuite) TestUserDefinedNetworkLinksWithRestart(c *testing.T)
 	assert.NilError(c, err)
 
 	// Restart second container
-	dockerCmd(c, "restart", "second")
-	assert.Assert(c, waitRun("second") == nil)
+	cli.DockerCmd(c, "restart", "second")
+	cli.WaitRun(c, "second")
 
 	// ping to first and its alias foo must still succeed
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
@@ -295,8 +287,8 @@ func (s *DockerCLIRunSuite) TestRunWithNetAliasOnDefaultNetworks(c *testing.T) {
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
 
 	defaults := []string{"bridge", "host", "none"}
-	for _, net := range defaults {
-		out, _, err := dockerCmdWithError("run", "-d", "--net", net, "--net-alias", "alias_"+net, "busybox", "top")
+	for _, nw := range defaults {
+		out, _, err := dockerCmdWithError("run", "-d", "--net", nw, "--net-alias", "alias_"+nw, "busybox", "top")
 		assert.ErrorContains(c, err, "")
 		assert.Assert(c, strings.Contains(out, runconfig.ErrUnsupportedNetworkAndAlias.Error()))
 	}
@@ -304,17 +296,17 @@ func (s *DockerCLIRunSuite) TestRunWithNetAliasOnDefaultNetworks(c *testing.T) {
 
 func (s *DockerCLIRunSuite) TestUserDefinedNetworkAlias(c *testing.T) {
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
-	dockerCmd(c, "network", "create", "-d", "bridge", "net1")
+	cli.DockerCmd(c, "network", "create", "-d", "bridge", "net1")
 
-	cid1, _ := dockerCmd(c, "run", "-d", "--net=net1", "--name=first", "--net-alias=foo1", "--net-alias=foo2", "busybox:glibc", "top")
-	assert.Assert(c, waitRun("first") == nil)
+	cid1 := cli.DockerCmd(c, "run", "-d", "--net=net1", "--name=first", "--net-alias=foo1", "--net-alias=foo2", "busybox:glibc", "top").Stdout()
+	cli.WaitRun(c, "first")
 
 	// Check if default short-id alias is added automatically
 	id := strings.TrimSpace(cid1)
 	aliases := inspectField(c, id, "NetworkSettings.Networks.net1.Aliases")
 	assert.Assert(c, strings.Contains(aliases, stringid.TruncateID(id)))
-	cid2, _ := dockerCmd(c, "run", "-d", "--net=net1", "--name=second", "busybox:glibc", "top")
-	assert.Assert(c, waitRun("second") == nil)
+	cid2 := cli.DockerCmd(c, "run", "-d", "--net=net1", "--name=second", "busybox:glibc", "top").Stdout()
+	cli.WaitRun(c, "second")
 
 	// Check if default short-id alias is added automatically
 	id = strings.TrimSpace(cid2)
@@ -332,8 +324,8 @@ func (s *DockerCLIRunSuite) TestUserDefinedNetworkAlias(c *testing.T) {
 	assert.NilError(c, err)
 
 	// Restart first container
-	dockerCmd(c, "restart", "first")
-	assert.Assert(c, waitRun("first") == nil)
+	cli.DockerCmd(c, "restart", "first")
+	cli.WaitRun(c, "first")
 
 	// ping to first and its network-scoped aliases must succeed
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
@@ -356,29 +348,26 @@ func (s *DockerCLIRunSuite) TestRunWithDaemonFlags(c *testing.T) {
 
 // Regression test for #4979
 func (s *DockerCLIRunSuite) TestRunWithVolumesFromExited(c *testing.T) {
-	var (
-		out      string
-		exitCode int
-	)
+	var result *icmd.Result
 
 	// Create a file in a volume
 	if testEnv.DaemonInfo.OSType == "windows" {
-		out, exitCode = dockerCmd(c, "run", "--name", "test-data", "--volume", `c:\some\dir`, testEnv.PlatformDefaults.BaseImage, "cmd", "/c", `echo hello > c:\some\dir\file`)
+		result = cli.DockerCmd(c, "run", "--name", "test-data", "--volume", `c:\some\dir`, testEnv.PlatformDefaults.BaseImage, "cmd", "/c", `echo hello > c:\some\dir\file`)
 	} else {
-		out, exitCode = dockerCmd(c, "run", "--name", "test-data", "--volume", "/some/dir", "busybox", "touch", "/some/dir/file")
+		result = cli.DockerCmd(c, "run", "--name", "test-data", "--volume", "/some/dir", "busybox", "touch", "/some/dir/file")
 	}
-	if exitCode != 0 {
-		c.Fatal("1", out, exitCode)
+	if result.ExitCode != 0 {
+		c.Fatal("1", result.Combined(), result.ExitCode)
 	}
 
 	// Read the file from another container using --volumes-from to access the volume in the second container
 	if testEnv.DaemonInfo.OSType == "windows" {
-		out, exitCode = dockerCmd(c, "run", "--volumes-from", "test-data", testEnv.PlatformDefaults.BaseImage, "cmd", "/c", `type c:\some\dir\file`)
+		result = cli.DockerCmd(c, "run", "--volumes-from", "test-data", testEnv.PlatformDefaults.BaseImage, "cmd", "/c", `type c:\some\dir\file`)
 	} else {
-		out, exitCode = dockerCmd(c, "run", "--volumes-from", "test-data", "busybox", "cat", "/some/dir/file")
+		result = cli.DockerCmd(c, "run", "--volumes-from", "test-data", "busybox", "cat", "/some/dir/file")
 	}
-	if exitCode != 0 {
-		c.Fatal("2", out, exitCode)
+	if result.ExitCode != 0 {
+		c.Fatal("2", result.Combined(), result.ExitCode)
 	}
 }
 
@@ -424,7 +413,7 @@ func (s *DockerCLIRunSuite) TestRunCreateVolumesInSymlinkDir(c *testing.T) {
 		cmd = "true"
 	}
 	buildImageSuccessfully(c, name, build.WithDockerfile(dockerFile))
-	dockerCmd(c, "run", "-v", containerPath, name, cmd)
+	cli.DockerCmd(c, "run", "-v", containerPath, name, cmd)
 }
 
 // Volume path is a symlink in the container
@@ -449,7 +438,7 @@ func (s *DockerCLIRunSuite) TestRunCreateVolumesInSymlinkDir2(c *testing.T) {
 		cmd = "true"
 	}
 	buildImageSuccessfully(c, name, build.WithDockerfile(dockerFile))
-	dockerCmd(c, "run", "-v", containerPath, name, cmd)
+	cli.DockerCmd(c, "run", "-v", containerPath, name, cmd)
 }
 
 func (s *DockerCLIRunSuite) TestRunVolumesMountedAsReadonly(c *testing.T) {
@@ -471,7 +460,7 @@ func (s *DockerCLIRunSuite) TestRunVolumesFromInReadonlyModeFails(c *testing.T)
 		volumeDir = "/test"
 		fileInVol = `/test/file`
 	}
-	dockerCmd(c, "run", "--name", "parent", "-v", volumeDir, "busybox", "true")
+	cli.DockerCmd(c, "run", "--name", "parent", "-v", volumeDir, "busybox", "true")
 
 	if _, code, err := dockerCmdWithError("run", "--volumes-from", "parent:ro", "busybox", "touch", fileInVol); err == nil || code == 0 {
 		c.Fatalf("run should fail because volume is ro: exit code %d", code)
@@ -492,14 +481,14 @@ func (s *DockerCLIRunSuite) TestRunVolumesFromInReadWriteMode(c *testing.T) {
 		fileInVol = "/test/file"
 	}
 
-	dockerCmd(c, "run", "--name", "parent", "-v", volumeDir, "busybox", "true")
-	dockerCmd(c, "run", "--volumes-from", "parent:rw", "busybox", "touch", fileInVol)
+	cli.DockerCmd(c, "run", "--name", "parent", "-v", volumeDir, "busybox", "true")
+	cli.DockerCmd(c, "run", "--volumes-from", "parent:rw", "busybox", "touch", fileInVol)
 
 	if out, _, err := dockerCmdWithError("run", "--volumes-from", "parent:bar", "busybox", "touch", fileInVol); err == nil || !strings.Contains(out, `invalid mode: bar`) {
 		c.Fatalf("running --volumes-from parent:bar should have failed with invalid mode: %q", out)
 	}
 
-	dockerCmd(c, "run", "--volumes-from", "parent", "busybox", "touch", fileInVol)
+	cli.DockerCmd(c, "run", "--volumes-from", "parent", "busybox", "touch", fileInVol)
 }
 
 func (s *DockerCLIRunSuite) TestVolumesFromGetsProperMode(c *testing.T) {
@@ -511,14 +500,14 @@ func (s *DockerCLIRunSuite) TestVolumesFromGetsProperMode(c *testing.T) {
 	}
 	defer os.RemoveAll(hostpath)
 
-	dockerCmd(c, "run", "--name", "parent", "-v", hostpath+":"+prefix+slash+"test:ro", "busybox", "true")
+	cli.DockerCmd(c, "run", "--name", "parent", "-v", hostpath+":"+prefix+slash+"test:ro", "busybox", "true")
 
 	// Expect this "rw" mode to be be ignored since the inherited volume is "ro"
 	if _, _, err := dockerCmdWithError("run", "--volumes-from", "parent:rw", "busybox", "touch", prefix+slash+"test"+slash+"file"); err == nil {
 		c.Fatal("Expected volumes-from to inherit read-only volume even when passing in `rw`")
 	}
 
-	dockerCmd(c, "run", "--name", "parent2", "-v", hostpath+":"+prefix+slash+"test:ro", "busybox", "true")
+	cli.DockerCmd(c, "run", "--name", "parent2", "-v", hostpath+":"+prefix+slash+"test:ro", "busybox", "true")
 
 	// Expect this to be read-only since both are "ro"
 	if _, _, err := dockerCmdWithError("run", "--volumes-from", "parent2:ro", "busybox", "touch", prefix+slash+"test"+slash+"file"); err == nil {
@@ -570,11 +559,11 @@ func (s *DockerCLIRunSuite) TestRunNoDupVolumes(c *testing.T) {
 	}
 	// create failed should have create volume volumename1 or volumename2
 	// we should remove volumename2 or volumename2 successfully
-	out, _ := dockerCmd(c, "volume", "ls")
+	out := cli.DockerCmd(c, "volume", "ls").Stdout()
 	if strings.Contains(out, volumename1) {
-		dockerCmd(c, "volume", "rm", volumename1)
+		cli.DockerCmd(c, "volume", "rm", volumename1)
 	} else {
-		dockerCmd(c, "volume", "rm", volumename2)
+		cli.DockerCmd(c, "volume", "rm", volumename2)
 	}
 }
 
@@ -584,8 +573,8 @@ func (s *DockerCLIRunSuite) TestRunApplyVolumesFromBeforeVolumes(c *testing.T) {
 	if testEnv.DaemonInfo.OSType == "windows" {
 		prefix = `c:`
 	}
-	dockerCmd(c, "run", "--name", "parent", "-v", prefix+"/test", "busybox", "touch", prefix+"/test/foo")
-	dockerCmd(c, "run", "--volumes-from", "parent", "-v", prefix+"/test", "busybox", "cat", prefix+"/test/foo")
+	cli.DockerCmd(c, "run", "--name", "parent", "-v", prefix+"/test", "busybox", "touch", prefix+"/test/foo")
+	cli.DockerCmd(c, "run", "--volumes-from", "parent", "-v", prefix+"/test", "busybox", "cat", prefix+"/test/foo")
 }
 
 func (s *DockerCLIRunSuite) TestRunMultipleVolumesFrom(c *testing.T) {
@@ -593,9 +582,9 @@ func (s *DockerCLIRunSuite) TestRunMultipleVolumesFrom(c *testing.T) {
 	if testEnv.DaemonInfo.OSType == "windows" {
 		prefix = `c:`
 	}
-	dockerCmd(c, "run", "--name", "parent1", "-v", prefix+"/test", "busybox", "touch", prefix+"/test/foo")
-	dockerCmd(c, "run", "--name", "parent2", "-v", prefix+"/other", "busybox", "touch", prefix+"/other/bar")
-	dockerCmd(c, "run", "--volumes-from", "parent1", "--volumes-from", "parent2", "busybox", "sh", "-c", "cat /test/foo && cat /other/bar")
+	cli.DockerCmd(c, "run", "--name", "parent1", "-v", prefix+"/test", "busybox", "touch", prefix+"/test/foo")
+	cli.DockerCmd(c, "run", "--name", "parent2", "-v", prefix+"/other", "busybox", "touch", prefix+"/other/bar")
+	cli.DockerCmd(c, "run", "--volumes-from", "parent1", "--volumes-from", "parent2", "busybox", "sh", "-c", "cat /test/foo && cat /other/bar")
 }
 
 // this tests verifies the ID format for the container
@@ -623,7 +612,7 @@ func (s *DockerCLIRunSuite) TestRunCreateVolume(c *testing.T) {
 	if testEnv.DaemonInfo.OSType == "windows" {
 		prefix = `c:`
 	}
-	dockerCmd(c, "run", "-v", prefix+"/var/lib/data", "busybox", "true")
+	cli.DockerCmd(c, "run", "-v", prefix+"/var/lib/data", "busybox", "true")
 }
 
 // Test that creating a volume with a symlink in its path works correctly. Test for #5152.
@@ -726,7 +715,7 @@ func (s *DockerCLIRunSuite) TestRunUserDefaults(c *testing.T) {
 	if testEnv.DaemonInfo.OSType == "windows" {
 		expected = "uid=0(root) gid=0(root) groups=0(root)"
 	}
-	out, _ := dockerCmd(c, "run", "busybox", "id")
+	out := cli.DockerCmd(c, "run", "busybox", "id").Stdout()
 	if !strings.Contains(out, expected) {
 		c.Fatalf("expected '%s' got %s", expected, out)
 	}
@@ -736,7 +725,7 @@ func (s *DockerCLIRunSuite) TestRunUserByName(c *testing.T) {
 	// TODO Windows: This test cannot run on a Windows daemon as Windows does
 	// not support the use of -u
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "-u", "root", "busybox", "id")
+	out := cli.DockerCmd(c, "run", "-u", "root", "busybox", "id").Stdout()
 	if !strings.Contains(out, "uid=0(root) gid=0(root)") {
 		c.Fatalf("expected root user got %s", out)
 	}
@@ -746,7 +735,7 @@ func (s *DockerCLIRunSuite) TestRunUserByID(c *testing.T) {
 	// TODO Windows: This test cannot run on a Windows daemon as Windows does
 	// not support the use of -u
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "-u", "1", "busybox", "id")
+	out := cli.DockerCmd(c, "run", "-u", "1", "busybox", "id").Stdout()
 	if !strings.Contains(out, "uid=1(daemon) gid=1(daemon)") {
 		c.Fatalf("expected daemon user got %s", out)
 	}
@@ -931,9 +920,9 @@ func (s *DockerCLIRunSuite) TestRunEnvironmentOverride(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunContainerNetwork(c *testing.T) {
 	if testEnv.DaemonInfo.OSType == "windows" {
 		// Windows busybox does not have ping. Use built in ping instead.
-		dockerCmd(c, "run", testEnv.PlatformDefaults.BaseImage, "ping", "-n", "1", "127.0.0.1")
+		cli.DockerCmd(c, "run", testEnv.PlatformDefaults.BaseImage, "ping", "-n", "1", "127.0.0.1")
 	} else {
-		dockerCmd(c, "run", "busybox", "ping", "-c", "1", "127.0.0.1")
+		cli.DockerCmd(c, "run", "busybox", "ping", "-c", "1", "127.0.0.1")
 	}
 }
 
@@ -941,7 +930,7 @@ func (s *DockerCLIRunSuite) TestRunNetHostNotAllowedWithLinks(c *testing.T) {
 	// TODO Windows: This is Linux specific as --link is not supported and
 	// this will be deprecated in favor of container networking model.
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
-	dockerCmd(c, "run", "--name", "linked", "busybox", "true")
+	cli.DockerCmd(c, "run", "--name", "linked", "busybox", "true")
 
 	_, _, err := dockerCmdWithError("run", "--net=host", "--link", "linked:linked", "busybox", "true")
 	if err == nil {
@@ -957,7 +946,7 @@ func (s *DockerCLIRunSuite) TestRunNetHostNotAllowedWithLinks(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunFullHostnameSet(c *testing.T) {
 	// TODO Windows: -h is not yet functional.
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "-h", "foo.bar.baz", "busybox", "hostname")
+	out := cli.DockerCmd(c, "run", "-h", "foo.bar.baz", "busybox", "hostname").Combined()
 	if actual := strings.Trim(out, "\r\n"); actual != "foo.bar.baz" {
 		c.Fatalf("expected hostname 'foo.bar.baz', received %s", actual)
 	}
@@ -967,7 +956,7 @@ func (s *DockerCLIRunSuite) TestRunPrivilegedCanMknod(c *testing.T) {
 	// Not applicable for Windows as Windows daemon does not support
 	// the concept of --privileged, and mknod is a Unix concept.
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
-	out, _ := dockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")
+	out := cli.DockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok").Combined()
 	if actual := strings.Trim(out, "\r\n"); actual != "ok" {
 		c.Fatalf("expected output ok received %s", actual)
 	}
@@ -977,7 +966,7 @@ func (s *DockerCLIRunSuite) TestRunUnprivilegedCanMknod(c *testing.T) {
 	// Not applicable for Windows as Windows daemon does not support
 	// the concept of --privileged, and mknod is a Unix concept.
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
-	out, _ := dockerCmd(c, "run", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")
+	out := cli.DockerCmd(c, "run", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok").Combined()
 	if actual := strings.Trim(out, "\r\n"); actual != "ok" {
 		c.Fatalf("expected output ok received %s", actual)
 	}
@@ -1033,7 +1022,7 @@ func (s *DockerCLIRunSuite) TestRunCapDropALLCannotMknod(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunCapDropALLAddMknodCanMknod(c *testing.T) {
 	// Not applicable for Windows as there is no concept of --cap-drop or mknod
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
-	out, _ := dockerCmd(c, "run", "--cap-drop=ALL", "--cap-add=MKNOD", "--cap-add=SETGID", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")
+	out := cli.DockerCmd(c, "run", "--cap-drop=ALL", "--cap-add=MKNOD", "--cap-add=SETGID", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok").Combined()
 
 	if actual := strings.Trim(out, "\r\n"); actual != "ok" {
 		c.Fatalf("expected output ok received %s", actual)
@@ -1052,7 +1041,7 @@ func (s *DockerCLIRunSuite) TestRunCapAddInvalid(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunCapAddCanDownInterface(c *testing.T) {
 	// Not applicable for Windows as there is no concept of --cap-add
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "--cap-add=NET_ADMIN", "busybox", "sh", "-c", "ip link set eth0 down && echo ok")
+	out := cli.DockerCmd(c, "run", "--cap-add=NET_ADMIN", "busybox", "sh", "-c", "ip link set eth0 down && echo ok").Combined()
 
 	if actual := strings.Trim(out, "\r\n"); actual != "ok" {
 		c.Fatalf("expected output ok received %s", actual)
@@ -1062,7 +1051,7 @@ func (s *DockerCLIRunSuite) TestRunCapAddCanDownInterface(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunCapAddALLCanDownInterface(c *testing.T) {
 	// Not applicable for Windows as there is no concept of --cap-add
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "--cap-add=ALL", "busybox", "sh", "-c", "ip link set eth0 down && echo ok")
+	out := cli.DockerCmd(c, "run", "--cap-add=ALL", "busybox", "sh", "-c", "ip link set eth0 down && echo ok").Combined()
 
 	if actual := strings.Trim(out, "\r\n"); actual != "ok" {
 		c.Fatalf("expected output ok received %s", actual)
@@ -1084,7 +1073,7 @@ func (s *DockerCLIRunSuite) TestRunCapAddALLDropNetAdminCanDownInterface(c *test
 func (s *DockerCLIRunSuite) TestRunGroupAdd(c *testing.T) {
 	// Not applicable for Windows as there is no concept of --group-add
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "--group-add=audio", "--group-add=staff", "--group-add=777", "busybox", "sh", "-c", "id")
+	out := cli.DockerCmd(c, "run", "--group-add=audio", "--group-add=staff", "--group-add=777", "busybox", "sh", "-c", "id").Combined()
 
 	groupsList := "uid=0(root) gid=0(root) groups=0(root),10(wheel),29(audio),50(staff),777"
 	if actual := strings.Trim(out, "\r\n"); actual != groupsList {
@@ -1095,7 +1084,7 @@ func (s *DockerCLIRunSuite) TestRunGroupAdd(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunPrivilegedCanMount(c *testing.T) {
 	// Not applicable for Windows as there is no concept of --privileged
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
-	out, _ := dockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "mount -t tmpfs none /tmp && echo ok")
+	out := cli.DockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "mount -t tmpfs none /tmp && echo ok").Combined()
 
 	if actual := strings.Trim(out, "\r\n"); actual != "ok" {
 		c.Fatalf("expected output ok received %s", actual)
@@ -1142,7 +1131,7 @@ func (s *DockerCLIRunSuite) TestRunProcNotWritableInNonPrivilegedContainers(c *t
 func (s *DockerCLIRunSuite) TestRunProcWritableInPrivilegedContainers(c *testing.T) {
 	// Not applicable for Windows as there is no concept of --privileged
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
-	if _, code := dockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "touch /proc/sysrq-trigger"); code != 0 {
+	if result := cli.DockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "touch /proc/sysrq-trigger"); result.ExitCode != 0 {
 		c.Fatalf("proc should be writable in privileged container")
 	}
 }
@@ -1151,7 +1140,7 @@ func (s *DockerCLIRunSuite) TestRunDeviceNumbers(c *testing.T) {
 	// Not applicable on Windows as /dev/ is a Unix specific concept
 	// TODO: NotUserNamespace could be removed here if "root" "root" is replaced w user
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
-	out, _ := dockerCmd(c, "run", "busybox", "sh", "-c", "ls -l /dev/null")
+	out := cli.DockerCmd(c, "run", "busybox", "sh", "-c", "ls -l /dev/null").Combined()
 	deviceLineFields := strings.Fields(out)
 	deviceLineFields[6] = ""
 	deviceLineFields[7] = ""
@@ -1166,7 +1155,7 @@ func (s *DockerCLIRunSuite) TestRunDeviceNumbers(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunThatCharacterDevicesActLikeCharacterDevices(c *testing.T) {
 	// Not applicable on Windows as /dev/ is a Unix specific concept
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "busybox", "sh", "-c", "dd if=/dev/zero of=/zero bs=1k count=5 2> /dev/null ; du -h /zero")
+	out := cli.DockerCmd(c, "run", "busybox", "sh", "-c", "dd if=/dev/zero of=/zero bs=1k count=5 2> /dev/null ; du -h /zero").Combined()
 	if actual := strings.Trim(out, "\r\n"); actual[0] == '0' {
 		c.Fatalf("expected a new file called /zero to be create that is greater than 0 bytes long, but du says: %s", actual)
 	}
@@ -1175,13 +1164,13 @@ func (s *DockerCLIRunSuite) TestRunThatCharacterDevicesActLikeCharacterDevices(c
 func (s *DockerCLIRunSuite) TestRunUnprivilegedWithChroot(c *testing.T) {
 	// Not applicable on Windows as it does not support chroot
 	testRequires(c, DaemonIsLinux)
-	dockerCmd(c, "run", "busybox", "chroot", "/", "true")
+	cli.DockerCmd(c, "run", "busybox", "chroot", "/", "true")
 }
 
 func (s *DockerCLIRunSuite) TestRunAddingOptionalDevices(c *testing.T) {
 	// Not applicable on Windows as Windows does not support --device
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
-	out, _ := dockerCmd(c, "run", "--device", "/dev/zero:/dev/nulo", "busybox", "sh", "-c", "ls /dev/nulo")
+	out := cli.DockerCmd(c, "run", "--device", "/dev/zero:/dev/nulo", "busybox", "sh", "-c", "ls /dev/nulo").Combined()
 	if actual := strings.Trim(out, "\r\n"); actual != "/dev/nulo" {
 		c.Fatalf("expected output /dev/nulo, received %s", actual)
 	}
@@ -1190,7 +1179,7 @@ func (s *DockerCLIRunSuite) TestRunAddingOptionalDevices(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunAddingOptionalDevicesNoSrc(c *testing.T) {
 	// Not applicable on Windows as Windows does not support --device
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
-	out, _ := dockerCmd(c, "run", "--device", "/dev/zero:rw", "busybox", "sh", "-c", "ls /dev/zero")
+	out := cli.DockerCmd(c, "run", "--device", "/dev/zero:rw", "busybox", "sh", "-c", "ls /dev/zero").Combined()
 	if actual := strings.Trim(out, "\r\n"); actual != "/dev/zero" {
 		c.Fatalf("expected output /dev/zero, received %s", actual)
 	}
@@ -1209,13 +1198,13 @@ func (s *DockerCLIRunSuite) TestRunModeHostname(c *testing.T) {
 	// Not applicable on Windows as Windows does not support -h
 	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
 
-	out, _ := dockerCmd(c, "run", "-h=testhostname", "busybox", "cat", "/etc/hostname")
+	out := cli.DockerCmd(c, "run", "-h=testhostname", "busybox", "cat", "/etc/hostname").Combined()
 
 	if actual := strings.Trim(out, "\r\n"); actual != "testhostname" {
 		c.Fatalf("expected 'testhostname', but says: %q", actual)
 	}
 
-	out, _ = dockerCmd(c, "run", "--net=host", "busybox", "cat", "/etc/hostname")
+	out = cli.DockerCmd(c, "run", "--net=host", "busybox", "cat", "/etc/hostname").Combined()
 
 	hostname, err := os.Hostname()
 	if err != nil {
@@ -1227,7 +1216,7 @@ func (s *DockerCLIRunSuite) TestRunModeHostname(c *testing.T) {
 }
 
 func (s *DockerCLIRunSuite) TestRunRootWorkdir(c *testing.T) {
-	out, _ := dockerCmd(c, "run", "--workdir", "/", "busybox", "pwd")
+	out := cli.DockerCmd(c, "run", "--workdir", "/", "busybox", "pwd").Combined()
 	expected := "/\n"
 	if testEnv.DaemonInfo.OSType == "windows" {
 		expected = "C:" + expected
@@ -1240,9 +1229,9 @@ func (s *DockerCLIRunSuite) TestRunRootWorkdir(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunAllowBindMountingRoot(c *testing.T) {
 	if testEnv.DaemonInfo.OSType == "windows" {
 		// Windows busybox will fail with Permission Denied on items such as pagefile.sys
-		dockerCmd(c, "run", "-v", `c:\:c:\host`, testEnv.PlatformDefaults.BaseImage, "cmd", "-c", "dir", `c:\host`)
+		cli.DockerCmd(c, "run", "-v", `c:\:c:\host`, testEnv.PlatformDefaults.BaseImage, "cmd", "-c", "dir", `c:\host`)
 	} else {
-		dockerCmd(c, "run", "-v", "/:/host", "busybox", "ls", "/host")
+		cli.DockerCmd(c, "run", "-v", "/:/host", "busybox", "ls", "/host")
 	}
 }
 
@@ -1284,7 +1273,7 @@ func (s *DockerCLIRunSuite) TestRunDNSDefaultOptions(c *testing.T) {
 		c.Fatal(err)
 	}
 
-	actual, _ := dockerCmd(c, "run", "busybox", "cat", "/etc/resolv.conf")
+	actual := cli.DockerCmd(c, "run", "busybox", "cat", "/etc/resolv.conf").Combined()
 	// check that the actual defaults are appended to the commented out
 	// localhost resolver (which should be preserved)
 	// NOTE: if we ever change the defaults from google dns, this will break
@@ -1340,8 +1329,7 @@ func (s *DockerCLIRunSuite) TestRunDNSOptionsBasedOnHostResolvConf(c *testing.T)
 	hostNameservers := resolvconf.GetNameservers(origResolvConf, resolvconf.IP)
 	hostSearch := resolvconf.GetSearchDomains(origResolvConf)
 
-	var out string
-	out, _ = dockerCmd(c, "run", "--dns=127.0.0.1", "busybox", "cat", "/etc/resolv.conf")
+	out := cli.DockerCmd(c, "run", "--dns=127.0.0.1", "busybox", "cat", "/etc/resolv.conf").Combined()
 
 	if actualNameservers := resolvconf.GetNameservers([]byte(out), resolvconf.IP); actualNameservers[0] != "127.0.0.1" {
 		c.Fatalf("expected '127.0.0.1', but says: %q", actualNameservers[0])
@@ -1357,7 +1345,7 @@ func (s *DockerCLIRunSuite) TestRunDNSOptionsBasedOnHostResolvConf(c *testing.T)
 		}
 	}
 
-	out, _ = dockerCmd(c, "run", "--dns-search=mydomain", "busybox", "cat", "/etc/resolv.conf")
+	out = cli.DockerCmd(c, "run", "--dns-search=mydomain", "busybox", "cat", "/etc/resolv.conf").Combined()
 
 	actualNameservers := resolvconf.GetNameservers([]byte(out), resolvconf.IP)
 	if len(actualNameservers) != len(hostNameservers) {
@@ -1392,7 +1380,7 @@ func (s *DockerCLIRunSuite) TestRunDNSOptionsBasedOnHostResolvConf(c *testing.T)
 
 	hostSearch = resolvconf.GetSearchDomains(resolvConf)
 
-	out, _ = dockerCmd(c, "run", "busybox", "cat", "/etc/resolv.conf")
+	out = cli.DockerCmd(c, "run", "busybox", "cat", "/etc/resolv.conf").Combined()
 	if actualNameservers = resolvconf.GetNameservers([]byte(out), resolvconf.IP); actualNameservers[0] != "12.34.56.78" || len(actualNameservers) != 1 {
 		c.Fatalf("expected '12.34.56.78', but has: %v", actualNameservers)
 	}
@@ -1414,7 +1402,7 @@ func (s *DockerCLIRunSuite) TestRunNonRootUserResolvName(c *testing.T) {
 	// Not applicable on Windows as Windows does not support --user
 	testRequires(c, testEnv.IsLocalDaemon, Network, DaemonIsLinux)
 
-	dockerCmd(c, "run", "--name=testperm", "--user=nobody", "busybox", "nslookup", "example.com")
+	cli.DockerCmd(c, "run", "--name=testperm", "--user=nobody", "busybox", "nslookup", "example.com")
 
 	cID := getIDByName(c, "testperm")
 
@@ -1465,7 +1453,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 	}()
 
 	// 1. test that a restarting container gets an updated resolv.conf
-	dockerCmd(c, "run", "--name=first", "busybox", "true")
+	cli.DockerCmd(c, "run", "--name=first", "busybox", "true")
 	containerID1 := getIDByName(c, "first")
 
 	// replace resolv.conf with our temporary copy
@@ -1474,7 +1462,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 	}
 
 	// start the container again to pickup changes
-	dockerCmd(c, "start", "first")
+	cli.DockerCmd(c, "start", "first")
 
 	// check for update in container
 	containerResolv := readContainerFile(c, containerID1, "resolv.conf")
@@ -1488,7 +1476,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 								} */
 	// 2. test that a restarting container does not receive resolv.conf updates
 	//   if it modified the container copy of the starting point resolv.conf
-	dockerCmd(c, "run", "--name=second", "busybox", "sh", "-c", "echo 'search mylittlepony.com' >>/etc/resolv.conf")
+	cli.DockerCmd(c, "run", "--name=second", "busybox", "sh", "-c", "echo 'search mylittlepony.com' >>/etc/resolv.conf")
 	containerID2 := getIDByName(c, "second")
 
 	// make a change to resolv.conf (in this case replacing our tmp copy with orig copy)
@@ -1497,7 +1485,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 	}
 
 	// start the container again
-	dockerCmd(c, "start", "second")
+	cli.DockerCmd(c, "start", "second")
 
 	// check for update in container
 	containerResolv = readContainerFile(c, containerID2, "resolv.conf")
@@ -1506,8 +1494,8 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 	}
 
 	// 3. test that a running container's resolv.conf is not modified while running
-	out, _ := dockerCmd(c, "run", "-d", "busybox", "top")
-	runningContainerID := strings.TrimSpace(out)
+	runningContainerID := cli.DockerCmd(c, "run", "-d", "busybox", "top").Stdout()
+	runningContainerID = strings.TrimSpace(runningContainerID)
 
 	// replace resolv.conf
 	if err := os.WriteFile("/etc/resolv.conf", tmpResolvConf, 0o644); err != nil {
@@ -1522,7 +1510,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 
 	// 4. test that a running container's resolv.conf is updated upon restart
 	//   (the above container is still running..)
-	dockerCmd(c, "restart", runningContainerID)
+	cli.DockerCmd(c, "restart", runningContainerID)
 
 	// check for update in container
 	containerResolv = readContainerFile(c, runningContainerID, "resolv.conf")
@@ -1539,7 +1527,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 	}
 
 	// start the container again to pickup changes
-	dockerCmd(c, "start", "first")
+	cli.DockerCmd(c, "start", "first")
 
 	// our first exited container ID should have been updated, but with default DNS
 	// after the cleanup of resolv.conf found only a localhost nameserver:
@@ -1558,7 +1546,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 	}
 
 	// Run the container so it picks up the old settings
-	dockerCmd(c, "run", "--name=third", "busybox", "true")
+	cli.DockerCmd(c, "run", "--name=third", "busybox", "true")
 	containerID3 := getIDByName(c, "third")
 
 	// Create a modified resolv.conf.aside and override resolv.conf with it
@@ -1572,7 +1560,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 	}
 
 	// start the container again to pickup changes
-	dockerCmd(c, "start", "third")
+	cli.DockerCmd(c, "start", "third")
 
 	// check for update in container
 	containerResolv = readContainerFile(c, containerID3, "resolv.conf")
@@ -1586,7 +1574,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunAddHost(c *testing.T) {
 	// Not applicable on Windows as it does not support --add-host
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "--add-host=extra:86.75.30.9", "busybox", "grep", "extra", "/etc/hosts")
+	out := cli.DockerCmd(c, "run", "--add-host=extra:86.75.30.9", "busybox", "grep", "extra", "/etc/hosts").Combined()
 
 	actual := strings.Trim(out, "\r\n")
 	if actual != "86.75.30.9\textra" {
@@ -1596,7 +1584,7 @@ func (s *DockerCLIRunSuite) TestRunAddHost(c *testing.T) {
 
 // Regression test for #6983
 func (s *DockerCLIRunSuite) TestRunAttachStdErrOnlyTTYMode(c *testing.T) {
-	_, exitCode := dockerCmd(c, "run", "-t", "-a", "stderr", "busybox", "true")
+	exitCode := cli.DockerCmd(c, "run", "-t", "-a", "stderr", "busybox", "true").ExitCode
 	if exitCode != 0 {
 		c.Fatalf("Container should have exited with error code 0")
 	}
@@ -1604,7 +1592,7 @@ func (s *DockerCLIRunSuite) TestRunAttachStdErrOnlyTTYMode(c *testing.T) {
 
 // Regression test for #6983
 func (s *DockerCLIRunSuite) TestRunAttachStdOutOnlyTTYMode(c *testing.T) {
-	_, exitCode := dockerCmd(c, "run", "-t", "-a", "stdout", "busybox", "true")
+	exitCode := cli.DockerCmd(c, "run", "-t", "-a", "stdout", "busybox", "true").ExitCode
 	if exitCode != 0 {
 		c.Fatalf("Container should have exited with error code 0")
 	}
@@ -1612,7 +1600,7 @@ func (s *DockerCLIRunSuite) TestRunAttachStdOutOnlyTTYMode(c *testing.T) {
 
 // Regression test for #6983
 func (s *DockerCLIRunSuite) TestRunAttachStdOutAndErrTTYMode(c *testing.T) {
-	_, exitCode := dockerCmd(c, "run", "-t", "-a", "stdout", "-a", "stderr", "busybox", "true")
+	exitCode := cli.DockerCmd(c, "run", "-t", "-a", "stdout", "-a", "stderr", "busybox", "true").ExitCode
 	if exitCode != 0 {
 		c.Fatalf("Container should have exited with error code 0")
 	}
@@ -1631,9 +1619,9 @@ func (s *DockerCLIRunSuite) TestRunAttachWithDetach(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunState(c *testing.T) {
 	// TODO Windows: This needs some rework as Windows busybox does not support top
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "-d", "busybox", "top")
+	id := cli.DockerCmd(c, "run", "-d", "busybox", "top").Stdout()
+	id = strings.TrimSpace(id)
 
-	id := strings.TrimSpace(out)
 	state := inspectField(c, id, "State.Running")
 	if state != "true" {
 		c.Fatal("Container state is 'not running'")
@@ -1643,7 +1631,7 @@ func (s *DockerCLIRunSuite) TestRunState(c *testing.T) {
 		c.Fatal("Container state Pid 0")
 	}
 
-	dockerCmd(c, "stop", id)
+	cli.DockerCmd(c, "stop", id)
 	state = inspectField(c, id, "State.Running")
 	if state != "false" {
 		c.Fatal("Container state is 'running'")
@@ -1653,7 +1641,7 @@ func (s *DockerCLIRunSuite) TestRunState(c *testing.T) {
 		c.Fatalf("Container state Pid %s, but expected %s", pid2, pid1)
 	}
 
-	dockerCmd(c, "start", id)
+	cli.DockerCmd(c, "start", id)
 	state = inspectField(c, id, "State.Running")
 	if state != "true" {
 		c.Fatal("Container state is 'not running'")
@@ -1675,7 +1663,7 @@ func (s *DockerCLIRunSuite) TestRunCopyVolumeUIDGID(c *testing.T) {
 		RUN mkdir -p /hello && touch /hello/test && chown dockerio.dockerio /hello`))
 
 	// Test that the uid and gid is copied from the image to the volume
-	out, _ := dockerCmd(c, "run", "--rm", "-v", "/hello", name, "sh", "-c", `ls -l / | grep hello | awk '{print $3":"$4}'`)
+	out := cli.DockerCmd(c, "run", "--rm", "-v", "/hello", name, "sh", "-c", `ls -l / | grep hello | awk '{print $3":"$4}'`).Combined()
 	out = strings.TrimSpace(out)
 	if out != "dockerio:dockerio" {
 		c.Fatalf("Wrong /hello ownership: %s, expected dockerio:dockerio", out)
@@ -1692,7 +1680,7 @@ func (s *DockerCLIRunSuite) TestRunCopyVolumeContent(c *testing.T) {
 		RUN mkdir -p /hello/local && echo hello > /hello/local/world`))
 
 	// Test that the content is copied from the image to the volume
-	out, _ := dockerCmd(c, "run", "--rm", "-v", "/hello", name, "find", "/hello")
+	out := cli.DockerCmd(c, "run", "--rm", "-v", "/hello", name, "find", "/hello").Combined()
 	if !(strings.Contains(out, "/hello/local/world") && strings.Contains(out, "/hello/local")) {
 		c.Fatal("Container failed to transfer content to volume")
 	}
@@ -1704,11 +1692,11 @@ func (s *DockerCLIRunSuite) TestRunCleanupCmdOnEntrypoint(c *testing.T) {
 		ENTRYPOINT ["echo"]
 		CMD ["testingpoint"]`))
 
-	out, exit := dockerCmd(c, "run", "--entrypoint", "whoami", name)
-	if exit != 0 {
-		c.Fatalf("expected exit code 0 received %d, out: %q", exit, out)
+	result := cli.DockerCmd(c, "run", "--entrypoint", "whoami", name)
+	out := strings.TrimSpace(result.Combined())
+	if result.ExitCode != 0 {
+		c.Fatalf("expected exit code 0 received %d, out: %q", result.ExitCode, out)
 	}
-	out = strings.TrimSpace(out)
 	expected := "root"
 	if testEnv.DaemonInfo.OSType == "windows" {
 		if strings.Contains(testEnv.PlatformDefaults.BaseImage, "servercore") {
@@ -1820,12 +1808,12 @@ func (s *DockerCLIRunSuite) TestRunWriteSpecialFilesAndNotCommit(c *testing.T) {
 
 func testRunWriteSpecialFilesAndNotCommit(c *testing.T, name, path string) {
 	command := fmt.Sprintf("echo test2267 >> %s && cat %s", path, path)
-	out, _ := dockerCmd(c, "run", "--name", name, "busybox", "sh", "-c", command)
+	out := cli.DockerCmd(c, "run", "--name", name, "busybox", "sh", "-c", command).Combined()
 	if !strings.Contains(out, "test2267") {
 		c.Fatalf("%s should contain 'test2267'", path)
 	}
 
-	out, _ = dockerCmd(c, "diff", name)
+	out = cli.DockerCmd(c, "diff", name).Combined()
 	if len(strings.Trim(out, "\r\n")) != 0 && !eqToBaseDiff(out, c) {
 		c.Fatal("diff should be empty")
 	}
@@ -1833,9 +1821,9 @@ func testRunWriteSpecialFilesAndNotCommit(c *testing.T, name, path string) {
 
 func eqToBaseDiff(out string, c *testing.T) bool {
 	name := "eqToBaseDiff" + testutil.GenerateRandomAlphaOnlyString(32)
-	dockerCmd(c, "run", "--name", name, "busybox", "echo", "hello")
+	cli.DockerCmd(c, "run", "--name", name, "busybox", "echo", "hello")
 	cID := getIDByName(c, name)
-	baseDiff, _ := dockerCmd(c, "diff", cID)
+	baseDiff := cli.DockerCmd(c, "diff", cID).Combined()
 	baseArr := strings.Split(baseDiff, "\n")
 	sort.Strings(baseArr)
 	outArr := strings.Split(out, "\n")
@@ -1873,11 +1861,10 @@ func (s *DockerCLIRunSuite) TestRunWithBadDevice(c *testing.T) {
 }
 
 func (s *DockerCLIRunSuite) TestRunEntrypoint(c *testing.T) {
-	name := "entrypoint"
-
-	out, _ := dockerCmd(c, "run", "--name", name, "--entrypoint", "echo", "busybox", "-n", "foobar")
-	expected := "foobar"
+	const name = "entrypoint"
+	const expected = "foobar"
 
+	out := cli.DockerCmd(c, "run", "--name", name, "--entrypoint", "echo", "busybox", "-n", "foobar").Combined()
 	if out != expected {
 		c.Fatalf("Output should be %q, actual out: %q", expected, out)
 	}
@@ -1900,16 +1887,16 @@ func (s *DockerCLIRunSuite) TestRunBindMounts(c *testing.T) {
 	writeFile(path.Join(tmpDir, "touch-me"), "", c)
 
 	// Test reading from a read-only bind mount
-	out, _ := dockerCmd(c, "run", "-v", fmt.Sprintf("%s:%s/tmpx:ro", tmpDir, prefix), "busybox", "ls", prefix+"/tmpx")
+	out := cli.DockerCmd(c, "run", "-v", fmt.Sprintf("%s:%s/tmpx:ro", tmpDir, prefix), "busybox", "ls", prefix+"/tmpx").Combined()
 	if !strings.Contains(out, "touch-me") {
 		c.Fatal("Container failed to read from bind mount")
 	}
 
 	// test writing to bind mount
 	if testEnv.DaemonInfo.OSType == "windows" {
-		dockerCmd(c, "run", "-v", fmt.Sprintf(`%s:c:\tmp:rw`, tmpDir), "busybox", "touch", "c:/tmp/holla")
+		cli.DockerCmd(c, "run", "-v", fmt.Sprintf(`%s:c:\tmp:rw`, tmpDir), "busybox", "touch", "c:/tmp/holla")
 	} else {
-		dockerCmd(c, "run", "-v", fmt.Sprintf("%s:/tmp:rw", tmpDir), "busybox", "touch", "/tmp/holla")
+		cli.DockerCmd(c, "run", "-v", fmt.Sprintf("%s:/tmp:rw", tmpDir), "busybox", "touch", "/tmp/holla")
 	}
 
 	readFile(path.Join(tmpDir, "holla"), c) // Will fail if the file doesn't exist
@@ -1923,7 +1910,7 @@ func (s *DockerCLIRunSuite) TestRunBindMounts(c *testing.T) {
 	// Windows does not (and likely never will) support mounting a single file
 	if testEnv.DaemonInfo.OSType != "windows" {
 		// test mount a file
-		dockerCmd(c, "run", "-v", fmt.Sprintf("%s/holla:/tmp/holla:rw", tmpDir), "busybox", "sh", "-c", "echo -n 'yotta' > /tmp/holla")
+		cli.DockerCmd(c, "run", "-v", fmt.Sprintf("%s/holla:/tmp/holla:rw", tmpDir), "busybox", "sh", "-c", "echo -n 'yotta' > /tmp/holla")
 		content := readFile(path.Join(tmpDir, "holla"), c) // Will fail if the file doesn't exist
 		expected := "yotta"
 		if content != expected {
@@ -1970,9 +1957,8 @@ func (s *DockerCLIRunSuite) TestRunCidFileCheckIDLength(c *testing.T) {
 	tmpCidFile := path.Join(tmpDir, "cid")
 	defer os.RemoveAll(tmpDir)
 
-	out, _ := dockerCmd(c, "run", "-d", "--cidfile", tmpCidFile, "busybox", "true")
-
-	id := strings.TrimSpace(out)
+	id := cli.DockerCmd(c, "run", "-d", "--cidfile", tmpCidFile, "busybox", "true").Stdout()
+	id = strings.TrimSpace(id)
 	buffer, err := os.ReadFile(tmpCidFile)
 	if err != nil {
 		c.Fatal(err)
@@ -1991,10 +1977,10 @@ func (s *DockerCLIRunSuite) TestRunSetMacAddress(c *testing.T) {
 	mac := "12:34:56:78:9a:bc"
 	var out string
 	if testEnv.DaemonInfo.OSType == "windows" {
-		out, _ = dockerCmd(c, "run", "-i", "--rm", fmt.Sprintf("--mac-address=%s", mac), "busybox", "sh", "-c", "ipconfig /all | grep 'Physical Address' | awk '{print $12}'")
+		out = cli.DockerCmd(c, "run", "-i", "--rm", fmt.Sprintf("--mac-address=%s", mac), "busybox", "sh", "-c", "ipconfig /all | grep 'Physical Address' | awk '{print $12}'").Combined()
 		mac = strings.ReplaceAll(strings.ToUpper(mac), ":", "-") // To Windows-style MACs
 	} else {
-		out, _ = dockerCmd(c, "run", "-i", "--rm", fmt.Sprintf("--mac-address=%s", mac), "busybox", "/bin/sh", "-c", "ip link show eth0 | tail -1 | awk '{print $2}'")
+		out = cli.DockerCmd(c, "run", "-i", "--rm", fmt.Sprintf("--mac-address=%s", mac), "busybox", "/bin/sh", "-c", "ip link show eth0 | tail -1 | awk '{print $2}'").Combined()
 	}
 
 	actualMac := strings.TrimSpace(out)
@@ -2006,8 +1992,8 @@ func (s *DockerCLIRunSuite) TestRunSetMacAddress(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunInspectMacAddress(c *testing.T) {
 	// TODO Windows. Network settings are not propagated back to inspect.
 	testRequires(c, DaemonIsLinux)
-	mac := "12:34:56:78:9a:bc"
-	out, _ := dockerCmd(c, "run", "-d", "--mac-address="+mac, "busybox", "top")
+	const mac = "12:34:56:78:9a:bc"
+	out := cli.DockerCmd(c, "run", "-d", "--mac-address="+mac, "busybox", "top").Combined()
 
 	id := strings.TrimSpace(out)
 	inspectedMac := inspectField(c, id, "NetworkSettings.Networks.bridge.MacAddress")
@@ -2048,7 +2034,7 @@ func (s *DockerCLIRunSuite) TestRunPortInUse(c *testing.T) {
 	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
 
 	port := "1234"
-	dockerCmd(c, "run", "-d", "-p", port+":80", "busybox", "top")
+	cli.DockerCmd(c, "run", "-d", "-p", port+":80", "busybox", "top")
 
 	out, _, err := dockerCmdWithError("run", "-d", "-p", port+":80", "busybox", "top")
 	if err == nil {
@@ -2064,10 +2050,10 @@ func (s *DockerCLIRunSuite) TestRunAllocatePortInReservedRange(c *testing.T) {
 	// TODO Windows. -P is not yet supported
 	testRequires(c, DaemonIsLinux)
 	// allocate a dynamic port to get the most recent
-	out, _ := dockerCmd(c, "run", "-d", "-P", "-p", "80", "busybox", "top")
+	id := cli.DockerCmd(c, "run", "-d", "-P", "-p", "80", "busybox", "top").Stdout()
+	id = strings.TrimSpace(id)
 
-	id := strings.TrimSpace(out)
-	out, _ = dockerCmd(c, "inspect", "--format", `{{index .NetworkSettings.Ports "80/tcp" 0 "HostPort" }}`, id)
+	out := cli.DockerCmd(c, "inspect", "--format", `{{index .NetworkSettings.Ports "80/tcp" 0 "HostPort" }}`, id).Stdout()
 	out = strings.TrimSpace(out)
 	port, err := strconv.ParseInt(out, 10, 64)
 	if err != nil {
@@ -2076,7 +2062,7 @@ func (s *DockerCLIRunSuite) TestRunAllocatePortInReservedRange(c *testing.T) {
 
 	// allocate a static port and a dynamic port together, with static port
 	// takes the next recent port in dynamic port range.
-	dockerCmd(c, "run", "-d", "-P", "-p", "80", "-p", fmt.Sprintf("%d:8080", port+1), "busybox", "top")
+	cli.DockerCmd(c, "run", "-d", "-P", "-p", "80", "-p", fmt.Sprintf("%d:8080", port+1), "busybox", "top")
 }
 
 // Regression test for #7792
@@ -2115,7 +2101,7 @@ func (s *DockerCLIRunSuite) TestRunMountOrdering(c *testing.T) {
 		c.Fatal(err)
 	}
 
-	dockerCmd(c, "run",
+	cli.DockerCmd(c, "run",
 		"-v", fmt.Sprintf("%s:"+prefix+"/tmp", tmpDir),
 		"-v", fmt.Sprintf("%s:"+prefix+"/tmp/foo", fooDir),
 		"-v", fmt.Sprintf("%s:"+prefix+"/tmp/tmp2", tmpDir2),
@@ -2143,11 +2129,11 @@ func (s *DockerCLIRunSuite) TestRunReuseBindVolumeThatIsSymlink(c *testing.T) {
 	defer os.RemoveAll(linkPath)
 
 	// Create first container
-	dockerCmd(c, "run", "-v", fmt.Sprintf("%s:"+prefix+"/tmp/test", linkPath), "busybox", "ls", prefix+"/tmp/test")
+	cli.DockerCmd(c, "run", "-v", fmt.Sprintf("%s:"+prefix+"/tmp/test", linkPath), "busybox", "ls", prefix+"/tmp/test")
 
 	// Create second container with same symlinked path
 	// This will fail if the referenced issue is hit with a "Volume exists" error
-	dockerCmd(c, "run", "-v", fmt.Sprintf("%s:"+prefix+"/tmp/test", linkPath), "busybox", "ls", prefix+"/tmp/test")
+	cli.DockerCmd(c, "run", "-v", fmt.Sprintf("%s:"+prefix+"/tmp/test", linkPath), "busybox", "ls", prefix+"/tmp/test")
 }
 
 // GH#10604: Test an "/etc" volume doesn't overlay special bind mounts in container
@@ -2155,17 +2141,17 @@ func (s *DockerCLIRunSuite) TestRunCreateVolumeEtc(c *testing.T) {
 	// While Windows supports volumes, it does not support --add-host hence
 	// this test is not applicable on Windows.
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "--dns=127.0.0.1", "-v", "/etc", "busybox", "cat", "/etc/resolv.conf")
+	out := cli.DockerCmd(c, "run", "--dns=127.0.0.1", "-v", "/etc", "busybox", "cat", "/etc/resolv.conf").Stdout()
 	if !strings.Contains(out, "nameserver 127.0.0.1") {
 		c.Fatal("/etc volume mount hides /etc/resolv.conf")
 	}
 
-	out, _ = dockerCmd(c, "run", "-h=test123", "-v", "/etc", "busybox", "cat", "/etc/hostname")
+	out = cli.DockerCmd(c, "run", "-h=test123", "-v", "/etc", "busybox", "cat", "/etc/hostname").Stdout()
 	if !strings.Contains(out, "test123") {
 		c.Fatal("/etc volume mount hides /etc/hostname")
 	}
 
-	out, _ = dockerCmd(c, "run", "--add-host=test:192.168.0.1", "-v", "/etc", "busybox", "cat", "/etc/hosts")
+	out = cli.DockerCmd(c, "run", "--add-host=test:192.168.0.1", "-v", "/etc", "busybox", "cat", "/etc/hosts").Stdout()
 	out = strings.ReplaceAll(out, "\n", " ")
 	if !strings.Contains(out, "192.168.0.1\ttest") || !strings.Contains(out, "127.0.0.1\tlocalhost") {
 		c.Fatal("/etc volume mount hides /etc/hosts")
@@ -2180,7 +2166,7 @@ func (s *DockerCLIRunSuite) TestVolumesNoCopyData(c *testing.T) {
 	buildImageSuccessfully(c, "dataimage", build.WithDockerfile(`FROM busybox
 		RUN ["mkdir", "-p", "/foo"]
 		RUN ["touch", "/foo/bar"]`))
-	dockerCmd(c, "run", "--name", "test", "-v", prefix+slash+"foo", "busybox")
+	cli.DockerCmd(c, "run", "--name", "test", "-v", prefix+slash+"foo", "busybox")
 
 	if out, _, err := dockerCmdWithError("run", "--volumes-from", "test", "dataimage", "ls", "-lh", "/foo/bar"); err == nil || !strings.Contains(out, "No such file or directory") {
 		c.Fatalf("Data was copied on volumes-from but shouldn't be:\n%q", out)
@@ -2210,7 +2196,7 @@ func (s *DockerCLIRunSuite) TestRunVolumesCleanPaths(c *testing.T) {
 	prefix, slash := getPrefixAndSlashFromDaemonPlatform()
 	buildImageSuccessfully(c, "run_volumes_clean_paths", build.WithDockerfile(`FROM busybox
 		VOLUME `+prefix+`/foo/`))
-	dockerCmd(c, "run", "-v", prefix+"/foo", "-v", prefix+"/bar/", "--name", "dark_helmet", "run_volumes_clean_paths")
+	cli.DockerCmd(c, "run", "-v", prefix+"/foo", "-v", prefix+"/bar/", "--name", "dark_helmet", "run_volumes_clean_paths")
 
 	out, err := inspectMountSourceField("dark_helmet", prefix+slash+"foo"+slash)
 	if err != errMountNotFound {
@@ -2268,9 +2254,9 @@ func (s *DockerCLIRunSuite) TestRunAllowPortRangeThroughExpose(c *testing.T) {
 	// TODO Windows: -P is not currently supported. Also network
 	// settings are not propagated back.
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "-d", "--expose", "3000-3003", "-P", "busybox", "top")
+	id := cli.DockerCmd(c, "run", "-d", "--expose", "3000-3003", "-P", "busybox", "top").Stdout()
+	id = strings.TrimSpace(id)
 
-	id := strings.TrimSpace(out)
 	portstr := inspectFieldJSON(c, id, "NetworkSettings.Ports")
 	var ports nat.PortMap
 	if err := json.Unmarshal([]byte(portstr), &ports); err != nil {
@@ -2302,13 +2288,13 @@ func (s *DockerCLIRunSuite) TestRunModeIpcHost(c *testing.T) {
 		c.Fatal(err)
 	}
 
-	out, _ := dockerCmd(c, "run", "--ipc=host", "busybox", "readlink", "/proc/self/ns/ipc")
+	out := cli.DockerCmd(c, "run", "--ipc=host", "busybox", "readlink", "/proc/self/ns/ipc").Combined()
 	out = strings.Trim(out, "\n")
 	if hostIpc != out {
 		c.Fatalf("IPC different with --ipc=host %s != %s\n", hostIpc, out)
 	}
 
-	out, _ = dockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/ipc")
+	out = cli.DockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/ipc").Combined()
 	out = strings.Trim(out, "\n")
 	if hostIpc == out {
 		c.Fatalf("IPC should be different without --ipc=host %s == %s\n", hostIpc, out)
@@ -2328,9 +2314,9 @@ func (s *DockerCLIRunSuite) TestRunModeIpcContainerNotRunning(c *testing.T) {
 	// Not applicable on Windows as uses Unix-specific capabilities
 	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
 
-	out, _ := dockerCmd(c, "create", "busybox")
+	id := cli.DockerCmd(c, "create", "busybox").Stdout()
+	id = strings.TrimSpace(id)
 
-	id := strings.TrimSpace(out)
 	out, _, err := dockerCmdWithError("run", fmt.Sprintf("--ipc=container:%s", id), "busybox")
 	if err == nil {
 		c.Fatalf("Run container with ipc mode container should fail with non running container: %s\n%s", out, err)
@@ -2341,9 +2327,9 @@ func (s *DockerCLIRunSuite) TestRunModePIDContainer(c *testing.T) {
 	// Not applicable on Windows as uses Unix-specific capabilities
 	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
 
-	out, _ := dockerCmd(c, "run", "-d", "busybox", "sh", "-c", "top")
+	id := cli.DockerCmd(c, "run", "-d", "busybox", "sh", "-c", "top").Stdout()
+	id = strings.TrimSpace(id)
 
-	id := strings.TrimSpace(out)
 	state := inspectField(c, id, "State.Running")
 	if state != "true" {
 		c.Fatal("Container state is 'not running'")
@@ -2355,7 +2341,7 @@ func (s *DockerCLIRunSuite) TestRunModePIDContainer(c *testing.T) {
 		c.Fatal(err)
 	}
 
-	out, _ = dockerCmd(c, "run", fmt.Sprintf("--pid=container:%s", id), "busybox", "readlink", "/proc/self/ns/pid")
+	out := cli.DockerCmd(c, "run", fmt.Sprintf("--pid=container:%s", id), "busybox", "readlink", "/proc/self/ns/pid").Combined()
 	out = strings.Trim(out, "\n")
 	if parentContainerPid != out {
 		c.Fatalf("PID different with --pid=container:%s %s != %s\n", id, parentContainerPid, out)
@@ -2375,9 +2361,9 @@ func (s *DockerCLIRunSuite) TestRunModePIDContainerNotRunning(c *testing.T) {
 	// Not applicable on Windows as uses Unix-specific capabilities
 	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
 
-	out, _ := dockerCmd(c, "create", "busybox")
+	id := cli.DockerCmd(c, "create", "busybox").Stdout()
+	id = strings.TrimSpace(id)
 
-	id := strings.TrimSpace(out)
 	out, _, err := dockerCmdWithError("run", fmt.Sprintf("--pid=container:%s", id), "busybox")
 	if err == nil {
 		c.Fatalf("Run container with pid mode container should fail with non running container: %s\n%s", out, err)
@@ -2388,7 +2374,7 @@ func (s *DockerCLIRunSuite) TestRunMountShmMqueueFromHost(c *testing.T) {
 	// Not applicable on Windows as uses Unix-specific capabilities
 	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
 
-	dockerCmd(c, "run", "-d", "--name", "shmfromhost", "-v", "/dev/shm:/dev/shm", "-v", "/dev/mqueue:/dev/mqueue", "busybox", "sh", "-c", "echo -n test > /dev/shm/test && touch /dev/mqueue/toto && top")
+	cli.DockerCmd(c, "run", "-d", "--name", "shmfromhost", "-v", "/dev/shm:/dev/shm", "-v", "/dev/mqueue:/dev/mqueue", "busybox", "sh", "-c", "echo -n test > /dev/shm/test && touch /dev/mqueue/toto && top")
 	defer os.Remove("/dev/mqueue/toto")
 	defer os.Remove("/dev/shm/test")
 	volPath, err := inspectMountSourceField("shmfromhost", "/dev/shm")
@@ -2397,7 +2383,7 @@ func (s *DockerCLIRunSuite) TestRunMountShmMqueueFromHost(c *testing.T) {
 		c.Fatalf("volumePath should have been /dev/shm, was %s", volPath)
 	}
 
-	out, _ := dockerCmd(c, "run", "--name", "ipchost", "--ipc", "host", "busybox", "cat", "/dev/shm/test")
+	out := cli.DockerCmd(c, "run", "--name", "ipchost", "--ipc", "host", "busybox", "cat", "/dev/shm/test").Combined()
 	if out != "test" {
 		c.Fatalf("Output of /dev/shm/test expected test but found: %s", out)
 	}
@@ -2412,9 +2398,9 @@ func (s *DockerCLIRunSuite) TestContainerNetworkMode(c *testing.T) {
 	// Not applicable on Windows as uses Unix-specific capabilities
 	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
 
-	out, _ := dockerCmd(c, "run", "-d", "busybox", "top")
-	id := strings.TrimSpace(out)
-	assert.NilError(c, waitRun(id))
+	id := cli.DockerCmd(c, "run", "-d", "busybox", "top").Stdout()
+	id = strings.TrimSpace(id)
+	cli.WaitRun(c, id)
 	pid1 := inspectField(c, id, "State.Pid")
 
 	parentContainerNet, err := os.Readlink(fmt.Sprintf("/proc/%s/ns/net", pid1))
@@ -2422,7 +2408,7 @@ func (s *DockerCLIRunSuite) TestContainerNetworkMode(c *testing.T) {
 		c.Fatal(err)
 	}
 
-	out, _ = dockerCmd(c, "run", fmt.Sprintf("--net=container:%s", id), "busybox", "readlink", "/proc/self/ns/net")
+	out := cli.DockerCmd(c, "run", fmt.Sprintf("--net=container:%s", id), "busybox", "readlink", "/proc/self/ns/net").Combined()
 	out = strings.Trim(out, "\n")
 	if parentContainerNet != out {
 		c.Fatalf("NET different with --net=container:%s %s != %s\n", id, parentContainerNet, out)
@@ -2438,13 +2424,13 @@ func (s *DockerCLIRunSuite) TestRunModeUTSHost(c *testing.T) {
 		c.Fatal(err)
 	}
 
-	out, _ := dockerCmd(c, "run", "--uts=host", "busybox", "readlink", "/proc/self/ns/uts")
+	out := cli.DockerCmd(c, "run", "--uts=host", "busybox", "readlink", "/proc/self/ns/uts").Combined()
 	out = strings.Trim(out, "\n")
 	if hostUTS != out {
 		c.Fatalf("UTS different with --uts=host %s != %s\n", hostUTS, out)
 	}
 
-	out, _ = dockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/uts")
+	out = cli.DockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/uts").Combined()
 	out = strings.Trim(out, "\n")
 	if hostUTS == out {
 		c.Fatalf("UTS should be different without --uts=host %s == %s\n", hostUTS, out)
@@ -2475,11 +2461,10 @@ func (s *DockerCLIRunSuite) TestRunPortFromDockerRangeInUse(c *testing.T) {
 	// re-instated.
 	testRequires(c, DaemonIsLinux)
 	// first find allocator current position
-	out, _ := dockerCmd(c, "run", "-d", "-p", ":80", "busybox", "top")
+	id := cli.DockerCmd(c, "run", "-d", "-p", ":80", "busybox", "top").Stdout()
+	id = strings.TrimSpace(id)
 
-	id := strings.TrimSpace(out)
-
-	out, _ = dockerCmd(c, "inspect", "--format", `{{index .NetworkSettings.Ports "80/tcp" 0 "HostPort" }}`, id)
+	out := cli.DockerCmd(c, "inspect", "--format", `{{index .NetworkSettings.Ports "80/tcp" 0 "HostPort" }}`, id).Stdout()
 	out = strings.TrimSpace(out)
 	if out == "" {
 		c.Fatal("docker port command output is empty")
@@ -2495,10 +2480,9 @@ func (s *DockerCLIRunSuite) TestRunPortFromDockerRangeInUse(c *testing.T) {
 	}
 	defer l.Close()
 
-	out, _ = dockerCmd(c, "run", "-d", "-p", ":80", "busybox", "top")
-
-	id = strings.TrimSpace(out)
-	dockerCmd(c, "port", id)
+	id = cli.DockerCmd(c, "run", "-d", "-p", ":80", "busybox", "top").Stdout()
+	id = strings.TrimSpace(id)
+	cli.DockerCmd(c, "port", id)
 }
 
 func (s *DockerCLIRunSuite) TestRunTTYWithPipe(c *testing.T) {
@@ -2545,7 +2529,7 @@ func (s *DockerCLIRunSuite) TestRunNonLocalMacAddress(c *testing.T) {
 		expected = strings.ReplaceAll(strings.ToUpper(addr), ":", "-")
 	}
 
-	if out, _ := dockerCmd(c, args...); !strings.Contains(out, expected) {
+	if out := cli.DockerCmd(c, args...).Combined(); !strings.Contains(out, expected) {
 		c.Fatalf("Output should have contained %q: %s", expected, out)
 	}
 }
@@ -2559,13 +2543,13 @@ func (s *DockerCLIRunSuite) TestRunNetHost(c *testing.T) {
 		c.Fatal(err)
 	}
 
-	out, _ := dockerCmd(c, "run", "--net=host", "busybox", "readlink", "/proc/self/ns/net")
+	out := cli.DockerCmd(c, "run", "--net=host", "busybox", "readlink", "/proc/self/ns/net").Combined()
 	out = strings.Trim(out, "\n")
 	if hostNet != out {
 		c.Fatalf("Net namespace different with --net=host %s != %s\n", hostNet, out)
 	}
 
-	out, _ = dockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/net")
+	out = cli.DockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/net").Combined()
 	out = strings.Trim(out, "\n")
 	if hostNet == out {
 		c.Fatalf("Net namespace should be different without --net=host %s == %s\n", hostNet, out)
@@ -2577,8 +2561,8 @@ func (s *DockerCLIRunSuite) TestRunNetHostTwiceSameName(c *testing.T) {
 	// CNM, this test may be possible to enable on Windows.
 	testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
 
-	dockerCmd(c, "run", "--rm", "--name=thost", "--net=host", "busybox", "true")
-	dockerCmd(c, "run", "--rm", "--name=thost", "--net=host", "busybox", "true")
+	cli.DockerCmd(c, "run", "--rm", "--name=thost", "--net=host", "busybox", "true")
+	cli.DockerCmd(c, "run", "--rm", "--name=thost", "--net=host", "busybox", "true")
 }
 
 func (s *DockerCLIRunSuite) TestRunNetContainerWhichHost(c *testing.T) {
@@ -2590,9 +2574,9 @@ func (s *DockerCLIRunSuite) TestRunNetContainerWhichHost(c *testing.T) {
 		c.Fatal(err)
 	}
 
-	dockerCmd(c, "run", "-d", "--net=host", "--name=test", "busybox", "top")
+	cli.DockerCmd(c, "run", "-d", "--net=host", "--name=test", "busybox", "top")
 
-	out, _ := dockerCmd(c, "run", "--net=container:test", "busybox", "readlink", "/proc/self/ns/net")
+	out := cli.DockerCmd(c, "run", "--net=container:test", "busybox", "readlink", "/proc/self/ns/net").Combined()
 	out = strings.Trim(out, "\n")
 	if hostNet != out {
 		c.Fatalf("Container should have host network namespace")
@@ -2604,21 +2588,20 @@ func (s *DockerCLIRunSuite) TestRunAllowPortRangeThroughPublish(c *testing.T) {
 	// Windows does not currently support --expose, or populate the network
 	// settings seen through inspect.
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "-d", "--expose", "3000-3003", "-p", "3000-3003", "busybox", "top")
-
-	id := strings.TrimSpace(out)
-	portstr := inspectFieldJSON(c, id, "NetworkSettings.Ports")
+	id := cli.DockerCmd(c, "run", "-d", "--expose", "3000-3003", "-p", "3000-3003", "busybox", "top").Stdout()
+	id = strings.TrimSpace(id)
+	portStr := inspectFieldJSON(c, id, "NetworkSettings.Ports")
 
 	var ports nat.PortMap
-	err := json.Unmarshal([]byte(portstr), &ports)
-	assert.NilError(c, err, "failed to unmarshal: %v", portstr)
+	err := json.Unmarshal([]byte(portStr), &ports)
+	assert.NilError(c, err, "failed to unmarshal: %v", portStr)
 	for port, binding := range ports {
 		portnum, _ := strconv.Atoi(strings.Split(string(port), "/")[0])
 		if portnum < 3000 || portnum > 3003 {
 			c.Fatalf("Port %d is out of range ", portnum)
 		}
 		if len(binding) == 0 || len(binding[0].HostPort) == 0 {
-			c.Fatal("Port is not mapped for the port "+port, out)
+			c.Fatal("Port is not mapped for the port "+port, id)
 		}
 	}
 }
@@ -2632,13 +2615,13 @@ func (s *DockerCLIRunSuite) TestRunSetDefaultRestartPolicy(c *testing.T) {
 }
 
 func (s *DockerCLIRunSuite) TestRunRestartMaxRetries(c *testing.T) {
-	out, _ := dockerCmd(c, "run", "-d", "--restart=on-failure:3", "busybox", "false")
+	id := cli.DockerCmd(c, "run", "-d", "--restart=on-failure:3", "busybox", "false").Stdout()
+	id = strings.TrimSpace(id)
 	timeout := 10 * time.Second
 	if testEnv.DaemonInfo.OSType == "windows" {
 		timeout = 120 * time.Second
 	}
 
-	id := strings.TrimSpace(out)
 	if err := waitInspect(id, "{{ .State.Restarting }} {{ .State.Running }}", "false false", timeout); err != nil {
 		c.Fatal(err)
 	}
@@ -2655,7 +2638,7 @@ func (s *DockerCLIRunSuite) TestRunRestartMaxRetries(c *testing.T) {
 }
 
 func (s *DockerCLIRunSuite) TestRunContainerWithWritableRootfs(c *testing.T) {
-	dockerCmd(c, "run", "--rm", "busybox", "touch", "/file")
+	cli.DockerCmd(c, "run", "--rm", "busybox", "touch", "/file")
 }
 
 func (s *DockerCLIRunSuite) TestRunContainerWithReadonlyRootfs(c *testing.T) {
@@ -2676,10 +2659,11 @@ func (s *DockerCLIRunSuite) TestPermissionsPtsReadonlyRootfs(c *testing.T) {
 	testRequires(c, DaemonIsLinux, UserNamespaceROMount)
 
 	// Ensure we have not broken writing /dev/pts
-	out, status := dockerCmd(c, "run", "--read-only", "--rm", "busybox", "mount")
-	if status != 0 {
+	result := cli.DockerCmd(c, "run", "--read-only", "--rm", "busybox", "mount")
+	if result.ExitCode != 0 {
 		c.Fatal("Could not obtain mounts when checking /dev/pts mntpnt.")
 	}
+	out := result.Combined()
 	expected := "type devpts (rw,"
 	if !strings.Contains(out, expected) {
 		c.Fatalf("expected output to contain %s but contains %s", expected, out)
@@ -2713,9 +2697,9 @@ func (s *DockerCLIRunSuite) TestRunContainerWithReadonlyEtcHostsAndLinkedContain
 	// Not applicable on Windows which does not support --link
 	testRequires(c, DaemonIsLinux, UserNamespaceROMount)
 
-	dockerCmd(c, "run", "-d", "--name", "test-etc-hosts-ro-linked", "busybox", "top")
+	cli.DockerCmd(c, "run", "-d", "--name", "test-etc-hosts-ro-linked", "busybox", "top")
 
-	out, _ := dockerCmd(c, "run", "--read-only", "--link", "test-etc-hosts-ro-linked:testlinked", "busybox", "cat", "/etc/hosts")
+	out := cli.DockerCmd(c, "run", "--read-only", "--link", "test-etc-hosts-ro-linked:testlinked", "busybox", "cat", "/etc/hosts").Stdout()
 	if !strings.Contains(out, "testlinked") {
 		c.Fatal("Expected /etc/hosts to be updated even if --read-only enabled")
 	}
@@ -2725,7 +2709,7 @@ func (s *DockerCLIRunSuite) TestRunContainerWithReadonlyRootfsWithDNSFlag(c *tes
 	// Not applicable on Windows which does not support either --read-only or --dns.
 	testRequires(c, DaemonIsLinux, UserNamespaceROMount)
 
-	out, _ := dockerCmd(c, "run", "--read-only", "--dns", "1.1.1.1", "busybox", "/bin/cat", "/etc/resolv.conf")
+	out := cli.DockerCmd(c, "run", "--read-only", "--dns", "1.1.1.1", "busybox", "/bin/cat", "/etc/resolv.conf").Stdout()
 	if !strings.Contains(out, "1.1.1.1") {
 		c.Fatal("Expected /etc/resolv.conf to be updated even if --read-only enabled and --dns flag used")
 	}
@@ -2735,7 +2719,7 @@ func (s *DockerCLIRunSuite) TestRunContainerWithReadonlyRootfsWithAddHostFlag(c
 	// Not applicable on Windows which does not support --read-only
 	testRequires(c, DaemonIsLinux, UserNamespaceROMount)
 
-	out, _ := dockerCmd(c, "run", "--read-only", "--add-host", "testreadonly:127.0.0.1", "busybox", "/bin/cat", "/etc/hosts")
+	out := cli.DockerCmd(c, "run", "--read-only", "--add-host", "testreadonly:127.0.0.1", "busybox", "/bin/cat", "/etc/hosts").Stdout()
 	if !strings.Contains(out, "testreadonly") {
 		c.Fatal("Expected /etc/hosts to be updated even if --read-only enabled and --add-host flag used")
 	}
@@ -2747,10 +2731,10 @@ func (s *DockerCLIRunSuite) TestRunVolumesFromRestartAfterRemoved(c *testing.T)
 	runSleepingContainer(c, "--name=restarter", "--volumes-from", "voltest")
 
 	// Remove the main volume container and restart the consuming container
-	dockerCmd(c, "rm", "-f", "voltest")
+	cli.DockerCmd(c, "rm", "-f", "voltest")
 
 	// This should not fail since the volumes-from were already applied
-	dockerCmd(c, "restart", "restarter")
+	cli.DockerCmd(c, "restart", "restarter")
 }
 
 // run container with --rm should remove container if exit code != 0
@@ -2790,9 +2774,8 @@ func (s *DockerCLIRunSuite) TestRunPIDHostWithChildIsKillable(c *testing.T) {
 	// Not applicable on Windows as uses Unix specific functionality
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
 	name := "ibuildthecloud"
-	dockerCmd(c, "run", "-d", "--pid=host", "--name", name, "busybox", "sh", "-c", "sleep 30; echo hi")
-
-	assert.Assert(c, waitRun(name) == nil)
+	cli.DockerCmd(c, "run", "-d", "--pid=host", "--name", name, "busybox", "sh", "-c", "sleep 30; echo hi")
+	cli.WaitRun(c, name)
 
 	errchan := make(chan error, 1)
 	go func() {
@@ -2900,7 +2883,7 @@ func (s *DockerCLIRunSuite) TestMountIntoSys(c *testing.T) {
 	// Not applicable on Windows as uses Unix specific functionality
 	testRequires(c, DaemonIsLinux)
 	testRequires(c, NotUserNamespace)
-	dockerCmd(c, "run", "-v", "/sys/fs/cgroup", "busybox", "true")
+	cli.DockerCmd(c, "run", "-v", "/sys/fs/cgroup", "busybox", "true")
 }
 
 func (s *DockerCLIRunSuite) TestRunUnshareProc(c *testing.T) {
@@ -2964,8 +2947,8 @@ func (s *DockerCLIRunSuite) TestRunUnshareProc(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunPublishPort(c *testing.T) {
 	// TODO Windows: This may be possible once Windows moves to libnetwork and CNM
 	testRequires(c, DaemonIsLinux)
-	dockerCmd(c, "run", "-d", "--name", "test", "--expose", "8080", "busybox", "top")
-	out, _ := dockerCmd(c, "port", "test")
+	cli.DockerCmd(c, "run", "-d", "--name", "test", "--expose", "8080", "busybox", "top")
+	out := cli.DockerCmd(c, "port", "test").Stdout()
 	out = strings.Trim(out, "\r\n")
 	if out != "" {
 		c.Fatalf("run without --publish-all should not publish port, out should be nil, but got: %s", out)
@@ -2977,10 +2960,11 @@ func (s *DockerCLIRunSuite) TestDevicePermissions(c *testing.T) {
 	// Not applicable on Windows as uses Unix specific functionality
 	testRequires(c, DaemonIsLinux)
 	const permissions = "crw-rw-rw-"
-	out, status := dockerCmd(c, "run", "--device", "/dev/fuse:/dev/fuse:mrw", "busybox:latest", "ls", "-l", "/dev/fuse")
-	if status != 0 {
-		c.Fatalf("expected status 0, got %d", status)
+	result := cli.DockerCmd(c, "run", "--device", "/dev/fuse:/dev/fuse:mrw", "busybox:latest", "ls", "-l", "/dev/fuse")
+	if result.ExitCode != 0 {
+		c.Fatalf("expected status 0, got %d", result.ExitCode)
 	}
+	out := result.Combined()
 	if !strings.HasPrefix(out, permissions) {
 		c.Fatalf("output should begin with %q, got %q", permissions, out)
 	}
@@ -2989,7 +2973,7 @@ func (s *DockerCLIRunSuite) TestDevicePermissions(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunCapAddCHOWN(c *testing.T) {
 	// Not applicable on Windows as uses Unix specific functionality
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "--cap-drop=ALL", "--cap-add=CHOWN", "busybox", "sh", "-c", "adduser -D -H newuser && chown newuser /home && echo ok")
+	out := cli.DockerCmd(c, "run", "--cap-drop=ALL", "--cap-add=CHOWN", "busybox", "sh", "-c", "adduser -D -H newuser && chown newuser /home && echo ok").Combined()
 
 	if actual := strings.Trim(out, "\r\n"); actual != "ok" {
 		c.Fatalf("expected output ok received %s", actual)
@@ -3000,10 +2984,10 @@ func (s *DockerCLIRunSuite) TestRunCapAddCHOWN(c *testing.T) {
 func (s *DockerCLIRunSuite) TestVolumeFromMixedRWOptions(c *testing.T) {
 	prefix, slash := getPrefixAndSlashFromDaemonPlatform()
 
-	dockerCmd(c, "run", "--name", "parent", "-v", prefix+"/test", "busybox", "true")
+	cli.DockerCmd(c, "run", "--name", "parent", "-v", prefix+"/test", "busybox", "true")
 
-	dockerCmd(c, "run", "--volumes-from", "parent:ro", "--name", "test-volumes-1", "busybox", "true")
-	dockerCmd(c, "run", "--volumes-from", "parent:rw", "--name", "test-volumes-2", "busybox", "true")
+	cli.DockerCmd(c, "run", "--volumes-from", "parent:ro", "--name", "test-volumes-1", "busybox", "true")
+	cli.DockerCmd(c, "run", "--volumes-from", "parent:rw", "--name", "test-volumes-2", "busybox", "true")
 
 	if testEnv.DaemonInfo.OSType != "windows" {
 		mRO, err := inspectMountPoint("test-volumes-1", prefix+slash+"test")
@@ -3064,7 +3048,7 @@ func (s *DockerCLIRunSuite) TestRunNetworkFilesBindMount(c *testing.T) {
 	nwfiles := []string{"/etc/resolv.conf", "/etc/hosts", "/etc/hostname"}
 
 	for i := range nwfiles {
-		actual, _ := dockerCmd(c, "run", "-v", filename+":"+nwfiles[i], "busybox", "cat", nwfiles[i])
+		actual := cli.DockerCmd(c, "run", "-v", filename+":"+nwfiles[i], "busybox", "cat", nwfiles[i]).Combined()
 		if actual != expected {
 			c.Fatalf("expected %s be: %q, but was: %q", nwfiles[i], expected, actual)
 		}
@@ -3108,7 +3092,7 @@ func (s *DockerCLIRunSuite) TestRunNetworkFilesBindMountROFilesystem(c *testing.
 	nwfiles := []string{"/etc/resolv.conf", "/etc/hosts", "/etc/hostname"}
 
 	for i := range nwfiles {
-		_, exitCode := dockerCmd(c, "run", "-v", filename+":"+nwfiles[i], "--read-only", "busybox", "touch", nwfiles[i])
+		exitCode := cli.DockerCmd(c, "run", "-v", filename+":"+nwfiles[i], "--read-only", "busybox", "touch", nwfiles[i]).ExitCode
 		if exitCode != 0 {
 			c.Fatalf("run should not fail because %s is mounted writable on read-only root filesystem: exit code %d", nwfiles[i], exitCode)
 		}
@@ -3126,9 +3110,9 @@ func (s *DockerCLIRunSuite) TestPtraceContainerProcsFromHost(c *testing.T) {
 	// Not applicable on Windows as uses Unix specific functionality
 	testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
 
-	out, _ := dockerCmd(c, "run", "-d", "busybox", "top")
-	id := strings.TrimSpace(out)
-	assert.NilError(c, waitRun(id))
+	id := cli.DockerCmd(c, "run", "-d", "busybox", "top").Stdout()
+	id = strings.TrimSpace(id)
+	cli.WaitRun(c, id)
 	pid1 := inspectField(c, id, "State.Pid")
 
 	_, err := os.Readlink(fmt.Sprintf("/proc/%s/ns/net", pid1))
@@ -3176,7 +3160,7 @@ func (s *DockerCLIRunSuite) TestRunCapAddSYSTIME(c *testing.T) {
 	// Not applicable on Windows as uses Unix specific functionality
 	testRequires(c, DaemonIsLinux)
 
-	dockerCmd(c, "run", "--cap-drop=ALL", "--cap-add=SYS_TIME", "busybox", "sh", "-c", "grep ^CapEff /proc/self/status | sed 's/^CapEff:\t//' | grep ^0000000002000000$")
+	cli.DockerCmd(c, "run", "--cap-drop=ALL", "--cap-add=SYS_TIME", "busybox", "sh", "-c", "grep ^CapEff /proc/self/status | sed 's/^CapEff:\t//' | grep ^0000000002000000$")
 }
 
 // run create container failed should clean up the container
@@ -3195,12 +3179,12 @@ func (s *DockerCLIRunSuite) TestRunCreateContainerFailedCleanUp(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunNamedVolume(c *testing.T) {
 	prefix, _ := getPrefixAndSlashFromDaemonPlatform()
 	testRequires(c, DaemonIsLinux)
-	dockerCmd(c, "run", "--name=test", "-v", "testing:"+prefix+"/foo", "busybox", "sh", "-c", "echo hello > "+prefix+"/foo/bar")
+	cli.DockerCmd(c, "run", "--name=test", "-v", "testing:"+prefix+"/foo", "busybox", "sh", "-c", "echo hello > "+prefix+"/foo/bar")
 
-	out, _ := dockerCmd(c, "run", "--volumes-from", "test", "busybox", "sh", "-c", "cat "+prefix+"/foo/bar")
+	out := cli.DockerCmd(c, "run", "--volumes-from", "test", "busybox", "sh", "-c", "cat "+prefix+"/foo/bar").Combined()
 	assert.Equal(c, strings.TrimSpace(out), "hello")
 
-	out, _ = dockerCmd(c, "run", "-v", "testing:"+prefix+"/foo", "busybox", "sh", "-c", "cat "+prefix+"/foo/bar")
+	out = cli.DockerCmd(c, "run", "-v", "testing:"+prefix+"/foo", "busybox", "sh", "-c", "cat "+prefix+"/foo/bar").Combined()
 	assert.Equal(c, strings.TrimSpace(out), "hello")
 }
 
@@ -3208,7 +3192,7 @@ func (s *DockerCLIRunSuite) TestRunWithUlimits(c *testing.T) {
 	// Not applicable on Windows as uses Unix specific functionality
 	testRequires(c, DaemonIsLinux)
 
-	out, _ := dockerCmd(c, "run", "--name=testulimits", "--ulimit", "nofile=42", "busybox", "/bin/sh", "-c", "ulimit -n")
+	out := cli.DockerCmd(c, "run", "--name=testulimits", "--ulimit", "nofile=42", "busybox", "/bin/sh", "-c", "ulimit -n").Combined()
 	ul := strings.TrimSpace(out)
 	if ul != "42" {
 		c.Fatalf("expected `ulimit -n` to be 42, got %s", ul)
@@ -3238,8 +3222,8 @@ func testRunContainerWithCgroupParent(c *testing.T, cgroupParent, name string) {
 	id := getIDByName(c, name)
 	expectedCgroup := path.Join(cgroupParent, id)
 	found := false
-	for _, path := range cgroupPaths {
-		if strings.HasSuffix(path, expectedCgroup) {
+	for _, p := range cgroupPaths {
+		if strings.HasSuffix(p, expectedCgroup) {
 			found = true
 			break
 		}
@@ -3278,8 +3262,8 @@ func testRunInvalidCgroupParent(c *testing.T, cgroupParent, cleanCgroupParent, n
 	id := getIDByName(c, name)
 	expectedCgroup := path.Join(cleanCgroupParent, id)
 	found := false
-	for _, path := range cgroupPaths {
-		if strings.HasSuffix(path, expectedCgroup) {
+	for _, p := range cgroupPaths {
+		if strings.HasSuffix(p, expectedCgroup) {
 			found = true
 			break
 		}
@@ -3341,7 +3325,7 @@ func (s *DockerCLIRunSuite) TestRunContainerNetModeWithDNSMacHosts(c *testing.T)
 func (s *DockerCLIRunSuite) TestRunContainerNetModeWithExposePort(c *testing.T) {
 	// Not applicable on Windows which does not support --net=container
 	testRequires(c, DaemonIsLinux)
-	dockerCmd(c, "run", "-d", "--name", "parent", "busybox", "top")
+	cli.DockerCmd(c, "run", "-d", "--name", "parent", "busybox", "top")
 
 	out, _, err := dockerCmdWithError("run", "-p", "5000:5000", "--net=container:parent", "busybox")
 	if err == nil || !strings.Contains(out, runconfig.ErrConflictNetworkPublishPorts.Error()) {
@@ -3362,17 +3346,17 @@ func (s *DockerCLIRunSuite) TestRunContainerNetModeWithExposePort(c *testing.T)
 func (s *DockerCLIRunSuite) TestRunLinkToContainerNetMode(c *testing.T) {
 	// Not applicable on Windows which does not support --net=container or --link
 	testRequires(c, DaemonIsLinux)
-	dockerCmd(c, "run", "--name", "test", "-d", "busybox", "top")
-	dockerCmd(c, "run", "--name", "parent", "-d", "--net=container:test", "busybox", "top")
-	dockerCmd(c, "run", "-d", "--link=parent:parent", "busybox", "top")
-	dockerCmd(c, "run", "--name", "child", "-d", "--net=container:parent", "busybox", "top")
-	dockerCmd(c, "run", "-d", "--link=child:child", "busybox", "top")
+	cli.DockerCmd(c, "run", "--name", "test", "-d", "busybox", "top")
+	cli.DockerCmd(c, "run", "--name", "parent", "-d", "--net=container:test", "busybox", "top")
+	cli.DockerCmd(c, "run", "-d", "--link=parent:parent", "busybox", "top")
+	cli.DockerCmd(c, "run", "--name", "child", "-d", "--net=container:parent", "busybox", "top")
+	cli.DockerCmd(c, "run", "-d", "--link=child:child", "busybox", "top")
 }
 
 func (s *DockerCLIRunSuite) TestRunLoopbackOnlyExistsWhenNetworkingDisabled(c *testing.T) {
 	// TODO Windows: This may be possible to convert.
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "--net=none", "busybox", "ip", "-o", "-4", "a", "show", "up")
+	out := cli.DockerCmd(c, "run", "--net=none", "busybox", "ip", "-o", "-4", "a", "show", "up").Combined()
 
 	var (
 		count = 0
@@ -3397,9 +3381,9 @@ func (s *DockerCLIRunSuite) TestRunLoopbackOnlyExistsWhenNetworkingDisabled(c *t
 // Issue #4681
 func (s *DockerCLIRunSuite) TestRunLoopbackWhenNetworkDisabled(c *testing.T) {
 	if testEnv.DaemonInfo.OSType == "windows" {
-		dockerCmd(c, "run", "--net=none", testEnv.PlatformDefaults.BaseImage, "ping", "-n", "1", "127.0.0.1")
+		cli.DockerCmd(c, "run", "--net=none", testEnv.PlatformDefaults.BaseImage, "ping", "-n", "1", "127.0.0.1")
 	} else {
-		dockerCmd(c, "run", "--net=none", "busybox", "ping", "-c", "1", "127.0.0.1")
+		cli.DockerCmd(c, "run", "--net=none", "busybox", "ping", "-c", "1", "127.0.0.1")
 	}
 }
 
@@ -3407,9 +3391,9 @@ func (s *DockerCLIRunSuite) TestRunModeNetContainerHostname(c *testing.T) {
 	// Windows does not support --net=container
 	testRequires(c, DaemonIsLinux)
 
-	dockerCmd(c, "run", "-i", "-d", "--name", "parent", "busybox", "top")
-	out, _ := dockerCmd(c, "exec", "parent", "cat", "/etc/hostname")
-	out1, _ := dockerCmd(c, "run", "--net=container:parent", "busybox", "cat", "/etc/hostname")
+	cli.DockerCmd(c, "run", "-i", "-d", "--name", "parent", "busybox", "top")
+	out := cli.DockerCmd(c, "exec", "parent", "cat", "/etc/hostname").Combined()
+	out1 := cli.DockerCmd(c, "run", "--net=container:parent", "busybox", "cat", "/etc/hostname").Combined()
 
 	if out1 != out {
 		c.Fatal("containers with shared net namespace should have same hostname")
@@ -3420,8 +3404,8 @@ func (s *DockerCLIRunSuite) TestRunNetworkNotInitializedNoneMode(c *testing.T) {
 	// TODO Windows: Network settings are not currently propagated. This may
 	// be resolved in the future with the move to libnetwork and CNM.
 	testRequires(c, DaemonIsLinux)
-	out, _ := dockerCmd(c, "run", "-d", "--net=none", "busybox", "top")
-	id := strings.TrimSpace(out)
+	id := cli.DockerCmd(c, "run", "-d", "--net=none", "busybox", "top").Stdout()
+	id = strings.TrimSpace(id)
 	res := inspectField(c, id, "NetworkSettings.Networks.none.IPAddress")
 	if res != "" {
 		c.Fatalf("For 'none' mode network must not be initialized, but container got IP: %s", res)
@@ -3431,61 +3415,61 @@ func (s *DockerCLIRunSuite) TestRunNetworkNotInitializedNoneMode(c *testing.T) {
 func (s *DockerCLIRunSuite) TestTwoContainersInNetHost(c *testing.T) {
 	// Not applicable as Windows does not support --net=host
 	testRequires(c, DaemonIsLinux, NotUserNamespace, NotUserNamespace)
-	dockerCmd(c, "run", "-d", "--net=host", "--name=first", "busybox", "top")
-	dockerCmd(c, "run", "-d", "--net=host", "--name=second", "busybox", "top")
-	dockerCmd(c, "stop", "first")
-	dockerCmd(c, "stop", "second")
+	cli.DockerCmd(c, "run", "-d", "--net=host", "--name=first", "busybox", "top")
+	cli.DockerCmd(c, "run", "-d", "--net=host", "--name=second", "busybox", "top")
+	cli.DockerCmd(c, "stop", "first")
+	cli.DockerCmd(c, "stop", "second")
 }
 
 func (s *DockerCLIRunSuite) TestContainersInUserDefinedNetwork(c *testing.T) {
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
-	dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork")
-	dockerCmd(c, "run", "-d", "--net=testnetwork", "--name=first", "busybox", "top")
-	assert.Assert(c, waitRun("first") == nil)
-	dockerCmd(c, "run", "-t", "--net=testnetwork", "--name=second", "busybox", "ping", "-c", "1", "first")
+	cli.DockerCmd(c, "network", "create", "-d", "bridge", "testnetwork")
+	cli.DockerCmd(c, "run", "-d", "--net=testnetwork", "--name=first", "busybox", "top")
+	cli.WaitRun(c, "first")
+	cli.DockerCmd(c, "run", "-t", "--net=testnetwork", "--name=second", "busybox", "ping", "-c", "1", "first")
 }
 
 func (s *DockerCLIRunSuite) TestContainersInMultipleNetworks(c *testing.T) {
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
 	// Create 2 networks using bridge driver
-	dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
-	dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork2")
+	cli.DockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
+	cli.DockerCmd(c, "network", "create", "-d", "bridge", "testnetwork2")
 	// Run and connect containers to testnetwork1
-	dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
-	assert.Assert(c, waitRun("first") == nil)
-	dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
-	assert.Assert(c, waitRun("second") == nil)
+	cli.DockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
+	cli.WaitRun(c, "first")
+	cli.DockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
+	cli.WaitRun(c, "second")
 	// Check connectivity between containers in testnetwork2
-	dockerCmd(c, "exec", "first", "ping", "-c", "1", "second.testnetwork1")
+	cli.DockerCmd(c, "exec", "first", "ping", "-c", "1", "second.testnetwork1")
 	// Connect containers to testnetwork2
-	dockerCmd(c, "network", "connect", "testnetwork2", "first")
-	dockerCmd(c, "network", "connect", "testnetwork2", "second")
+	cli.DockerCmd(c, "network", "connect", "testnetwork2", "first")
+	cli.DockerCmd(c, "network", "connect", "testnetwork2", "second")
 	// Check connectivity between containers
-	dockerCmd(c, "exec", "second", "ping", "-c", "1", "first.testnetwork2")
+	cli.DockerCmd(c, "exec", "second", "ping", "-c", "1", "first.testnetwork2")
 }
 
 func (s *DockerCLIRunSuite) TestContainersNetworkIsolation(c *testing.T) {
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
 	// Create 2 networks using bridge driver
-	dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
-	dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork2")
+	cli.DockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
+	cli.DockerCmd(c, "network", "create", "-d", "bridge", "testnetwork2")
 	// Run 1 container in testnetwork1 and another in testnetwork2
-	dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
-	assert.Assert(c, waitRun("first") == nil)
-	dockerCmd(c, "run", "-d", "--net=testnetwork2", "--name=second", "busybox", "top")
-	assert.Assert(c, waitRun("second") == nil)
+	cli.DockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
+	cli.WaitRun(c, "first")
+	cli.DockerCmd(c, "run", "-d", "--net=testnetwork2", "--name=second", "busybox", "top")
+	cli.WaitRun(c, "second")
 
 	// Check Isolation between containers : ping must fail
 	_, _, err := dockerCmdWithError("exec", "first", "ping", "-c", "1", "second")
 	assert.ErrorContains(c, err, "")
 	// Connect first container to testnetwork2
-	dockerCmd(c, "network", "connect", "testnetwork2", "first")
+	cli.DockerCmd(c, "network", "connect", "testnetwork2", "first")
 	// ping must succeed now
 	_, _, err = dockerCmdWithError("exec", "first", "ping", "-c", "1", "second")
 	assert.NilError(c, err)
 
 	// Disconnect first container from testnetwork2
-	dockerCmd(c, "network", "disconnect", "testnetwork2", "first")
+	cli.DockerCmd(c, "network", "disconnect", "testnetwork2", "first")
 	// ping must fail again
 	_, _, err = dockerCmdWithError("exec", "first", "ping", "-c", "1", "second")
 	assert.ErrorContains(c, err, "")
@@ -3494,17 +3478,17 @@ func (s *DockerCLIRunSuite) TestContainersNetworkIsolation(c *testing.T) {
 func (s *DockerCLIRunSuite) TestNetworkRmWithActiveContainers(c *testing.T) {
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
 	// Create 2 networks using bridge driver
-	dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
+	cli.DockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
 	// Run and connect containers to testnetwork1
-	dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
-	assert.Assert(c, waitRun("first") == nil)
-	dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
-	assert.Assert(c, waitRun("second") == nil)
+	cli.DockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
+	cli.WaitRun(c, "first")
+	cli.DockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
+	cli.WaitRun(c, "second")
 	// Network delete with active containers must fail
 	_, _, err := dockerCmdWithError("network", "rm", "testnetwork1")
 	assert.ErrorContains(c, err, "")
 
-	dockerCmd(c, "stop", "first")
+	cli.DockerCmd(c, "stop", "first")
 	_, _, err = dockerCmdWithError("network", "rm", "testnetwork1")
 	assert.ErrorContains(c, err, "")
 }
@@ -3512,43 +3496,43 @@ func (s *DockerCLIRunSuite) TestNetworkRmWithActiveContainers(c *testing.T) {
 func (s *DockerCLIRunSuite) TestContainerRestartInMultipleNetworks(c *testing.T) {
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
 	// Create 2 networks using bridge driver
-	dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
-	dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork2")
+	cli.DockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
+	cli.DockerCmd(c, "network", "create", "-d", "bridge", "testnetwork2")
 
 	// Run and connect containers to testnetwork1
-	dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
-	assert.Assert(c, waitRun("first") == nil)
-	dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
-	assert.Assert(c, waitRun("second") == nil)
+	cli.DockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
+	cli.WaitRun(c, "first")
+	cli.DockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
+	cli.WaitRun(c, "second")
 	// Check connectivity between containers in testnetwork2
-	dockerCmd(c, "exec", "first", "ping", "-c", "1", "second.testnetwork1")
+	cli.DockerCmd(c, "exec", "first", "ping", "-c", "1", "second.testnetwork1")
 	// Connect containers to testnetwork2
-	dockerCmd(c, "network", "connect", "testnetwork2", "first")
-	dockerCmd(c, "network", "connect", "testnetwork2", "second")
+	cli.DockerCmd(c, "network", "connect", "testnetwork2", "first")
+	cli.DockerCmd(c, "network", "connect", "testnetwork2", "second")
 	// Check connectivity between containers
-	dockerCmd(c, "exec", "second", "ping", "-c", "1", "first.testnetwork2")
+	cli.DockerCmd(c, "exec", "second", "ping", "-c", "1", "first.testnetwork2")
 
 	// Stop second container and test ping failures on both networks
-	dockerCmd(c, "stop", "second")
+	cli.DockerCmd(c, "stop", "second")
 	_, _, err := dockerCmdWithError("exec", "first", "ping", "-c", "1", "second.testnetwork1")
 	assert.ErrorContains(c, err, "")
 	_, _, err = dockerCmdWithError("exec", "first", "ping", "-c", "1", "second.testnetwork2")
 	assert.ErrorContains(c, err, "")
 
 	// Start second container and connectivity must be restored on both networks
-	dockerCmd(c, "start", "second")
-	dockerCmd(c, "exec", "first", "ping", "-c", "1", "second.testnetwork1")
-	dockerCmd(c, "exec", "second", "ping", "-c", "1", "first.testnetwork2")
+	cli.DockerCmd(c, "start", "second")
+	cli.DockerCmd(c, "exec", "first", "ping", "-c", "1", "second.testnetwork1")
+	cli.DockerCmd(c, "exec", "second", "ping", "-c", "1", "first.testnetwork2")
 }
 
 func (s *DockerCLIRunSuite) TestContainerWithConflictingHostNetworks(c *testing.T) {
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
 	// Run a container with --net=host
-	dockerCmd(c, "run", "-d", "--net=host", "--name=first", "busybox", "top")
-	assert.Assert(c, waitRun("first") == nil)
+	cli.DockerCmd(c, "run", "-d", "--net=host", "--name=first", "busybox", "top")
+	cli.WaitRun(c, "first")
 
 	// Create a network using bridge driver
-	dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
+	cli.DockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
 
 	// Connecting to the user defined network must fail
 	_, _, err := dockerCmdWithError("network", "connect", "testnetwork1", "first")
@@ -3557,14 +3541,14 @@ func (s *DockerCLIRunSuite) TestContainerWithConflictingHostNetworks(c *testing.
 
 func (s *DockerCLIRunSuite) TestContainerWithConflictingSharedNetwork(c *testing.T) {
 	testRequires(c, DaemonIsLinux)
-	dockerCmd(c, "run", "-d", "--name=first", "busybox", "top")
-	assert.Assert(c, waitRun("first") == nil)
+	cli.DockerCmd(c, "run", "-d", "--name=first", "busybox", "top")
+	cli.WaitRun(c, "first")
 	// Run second container in first container's network namespace
-	dockerCmd(c, "run", "-d", "--net=container:first", "--name=second", "busybox", "top")
-	assert.Assert(c, waitRun("second") == nil)
+	cli.DockerCmd(c, "run", "-d", "--net=container:first", "--name=second", "busybox", "top")
+	cli.WaitRun(c, "second")
 
 	// Create a network using bridge driver
-	dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
+	cli.DockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
 
 	// Connecting to the user defined network must fail
 	out, _, err := dockerCmdWithError("network", "connect", "testnetwork1", "second")
@@ -3574,19 +3558,19 @@ func (s *DockerCLIRunSuite) TestContainerWithConflictingSharedNetwork(c *testing
 
 func (s *DockerCLIRunSuite) TestContainerWithConflictingNoneNetwork(c *testing.T) {
 	testRequires(c, DaemonIsLinux)
-	dockerCmd(c, "run", "-d", "--net=none", "--name=first", "busybox", "top")
-	assert.Assert(c, waitRun("first") == nil)
+	cli.DockerCmd(c, "run", "-d", "--net=none", "--name=first", "busybox", "top")
+	cli.WaitRun(c, "first")
 
 	// Create a network using bridge driver
-	dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
+	cli.DockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
 
 	// Connecting to the user defined network must fail
 	out, _, err := dockerCmdWithError("network", "connect", "testnetwork1", "first")
 	assert.ErrorContains(c, err, "")
 	assert.Assert(c, strings.Contains(out, runconfig.ErrConflictNoNetwork.Error()))
 	// create a container connected to testnetwork1
-	dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
-	assert.Assert(c, waitRun("second") == nil)
+	cli.DockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
+	cli.WaitRun(c, "second")
 
 	// Connect second container to none network. it must fail as well
 	_, _, err = dockerCmdWithError("network", "connect", "none", "second")
@@ -3713,7 +3697,7 @@ func (s *DockerCLIRunSuite) TestRunInitLayerPathOwnership(c *testing.T) {
 		RUN chown dockerio:dockerio /etc`))
 
 	// Test that dockerio ownership of /etc is retained at runtime
-	out, _ := dockerCmd(c, "run", "--rm", name, "stat", "-c", "%U:%G", "/etc")
+	out := cli.DockerCmd(c, "run", "--rm", name, "stat", "-c", "%U:%G", "/etc").Combined()
 	out = strings.TrimSpace(out)
 	if out != "dockerio:dockerio" {
 		c.Fatalf("Wrong /etc ownership: expected dockerio:dockerio, got %q", out)
@@ -3723,10 +3707,10 @@ func (s *DockerCLIRunSuite) TestRunInitLayerPathOwnership(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunWithOomScoreAdj(c *testing.T) {
 	testRequires(c, DaemonIsLinux)
 
-	expected := "642"
-	out, _ := dockerCmd(c, "run", "--oom-score-adj", expected, "busybox", "cat", "/proc/self/oom_score_adj")
+	const expected = "642"
+	out := cli.DockerCmd(c, "run", "--oom-score-adj", expected, "busybox", "cat", "/proc/self/oom_score_adj").Combined()
 	oomScoreAdj := strings.TrimSpace(out)
-	if oomScoreAdj != "642" {
+	if oomScoreAdj != expected {
 		c.Fatalf("Expected oom_score_adj set to %q, got %q instead", expected, oomScoreAdj)
 	}
 }
@@ -3764,34 +3748,34 @@ func (s *DockerCLIRunSuite) TestRunNamedVolumeCopyImageData(c *testing.T) {
 	RUN mkdir -p /foo && echo hello > /foo/hello
 	`))
 
-	dockerCmd(c, "run", "-v", "foo:/foo", testImg)
-	out, _ := dockerCmd(c, "run", "-v", "foo:/foo", "busybox", "cat", "/foo/hello")
+	cli.DockerCmd(c, "run", "-v", "foo:/foo", testImg)
+	out := cli.DockerCmd(c, "run", "-v", "foo:/foo", "busybox", "cat", "/foo/hello").Stdout()
 	assert.Equal(c, strings.TrimSpace(out), "hello")
 }
 
 func (s *DockerCLIRunSuite) TestRunNamedVolumeNotRemoved(c *testing.T) {
 	prefix, _ := getPrefixAndSlashFromDaemonPlatform()
 
-	dockerCmd(c, "volume", "create", "test")
+	cli.DockerCmd(c, "volume", "create", "test")
 
-	dockerCmd(c, "run", "--rm", "-v", "test:"+prefix+"/foo", "-v", prefix+"/bar", "busybox", "true")
-	dockerCmd(c, "volume", "inspect", "test")
-	out, _ := dockerCmd(c, "volume", "ls", "-q")
+	cli.DockerCmd(c, "run", "--rm", "-v", "test:"+prefix+"/foo", "-v", prefix+"/bar", "busybox", "true")
+	cli.DockerCmd(c, "volume", "inspect", "test")
+	out := cli.DockerCmd(c, "volume", "ls", "-q").Combined()
 	assert.Assert(c, strings.Contains(out, "test"))
 
-	dockerCmd(c, "run", "--name=test", "-v", "test:"+prefix+"/foo", "-v", prefix+"/bar", "busybox", "true")
-	dockerCmd(c, "rm", "-fv", "test")
-	dockerCmd(c, "volume", "inspect", "test")
-	out, _ = dockerCmd(c, "volume", "ls", "-q")
+	cli.DockerCmd(c, "run", "--name=test", "-v", "test:"+prefix+"/foo", "-v", prefix+"/bar", "busybox", "true")
+	cli.DockerCmd(c, "rm", "-fv", "test")
+	cli.DockerCmd(c, "volume", "inspect", "test")
+	out = cli.DockerCmd(c, "volume", "ls", "-q").Combined()
 	assert.Assert(c, strings.Contains(out, "test"))
 }
 
 func (s *DockerCLIRunSuite) TestRunNamedVolumesFromNotRemoved(c *testing.T) {
 	prefix, _ := getPrefixAndSlashFromDaemonPlatform()
 
-	dockerCmd(c, "volume", "create", "test")
-	cid, _ := dockerCmd(c, "run", "-d", "--name=parent", "-v", "test:"+prefix+"/foo", "-v", prefix+"/bar", "busybox", "true")
-	dockerCmd(c, "run", "--name=child", "--volumes-from=parent", "busybox", "true")
+	cli.DockerCmd(c, "volume", "create", "test")
+	cid := cli.DockerCmd(c, "run", "-d", "--name=parent", "-v", "test:"+prefix+"/foo", "-v", prefix+"/bar", "busybox", "true").Stdout()
+	cli.DockerCmd(c, "run", "--name=child", "--volumes-from=parent", "busybox", "true")
 
 	apiClient, err := client.NewClientWithOpts(client.FromEnv)
 	assert.NilError(c, err)
@@ -3808,11 +3792,11 @@ func (s *DockerCLIRunSuite) TestRunNamedVolumesFromNotRemoved(c *testing.T) {
 	assert.Assert(c, vname != "")
 
 	// Remove the parent so there are not other references to the volumes
-	dockerCmd(c, "rm", "-f", "parent")
+	cli.DockerCmd(c, "rm", "-f", "parent")
 	// now remove the child and ensure the named volume (and only the named volume) still exists
-	dockerCmd(c, "rm", "-fv", "child")
-	dockerCmd(c, "volume", "inspect", "test")
-	out, _ := dockerCmd(c, "volume", "ls", "-q")
+	cli.DockerCmd(c, "rm", "-fv", "child")
+	cli.DockerCmd(c, "volume", "inspect", "test")
+	out := cli.DockerCmd(c, "volume", "ls", "-q").Combined()
 	assert.Assert(c, strings.Contains(out, "test"))
 	assert.Assert(c, !strings.Contains(strings.TrimSpace(out), vname))
 }
@@ -3872,7 +3856,7 @@ func (s *DockerCLIRunSuite) TestRunAttachFailedNoLeak(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunVolumeWithOneCharacter(c *testing.T) {
 	testRequires(c, DaemonIsLinux)
 
-	out, _ := dockerCmd(c, "run", "-v", "/tmp/q:/foo", "busybox", "sh", "-c", "find /foo")
+	out := cli.DockerCmd(c, "run", "-v", "/tmp/q:/foo", "busybox", "sh", "-c", "find /foo").Combined()
 	assert.Equal(c, strings.TrimSpace(out), "/foo")
 }
 
@@ -3881,23 +3865,23 @@ func (s *DockerCLIRunSuite) TestRunVolumeCopyFlag(c *testing.T) {
 	buildImageSuccessfully(c, "volumecopy", build.WithDockerfile(`FROM busybox
 		RUN mkdir /foo && echo hello > /foo/bar
 		CMD cat /foo/bar`))
-	dockerCmd(c, "volume", "create", "test")
+	cli.DockerCmd(c, "volume", "create", "test")
 
 	// test with the nocopy flag
 	out, _, err := dockerCmdWithError("run", "-v", "test:/foo:nocopy", "volumecopy")
 	assert.ErrorContains(c, err, "", out)
 	// test default behavior which is to copy for non-binds
-	out, _ = dockerCmd(c, "run", "-v", "test:/foo", "volumecopy")
+	out = cli.DockerCmd(c, "run", "-v", "test:/foo", "volumecopy").Combined()
 	assert.Equal(c, strings.TrimSpace(out), "hello")
 	// error out when the volume is already populated
 	out, _, err = dockerCmdWithError("run", "-v", "test:/foo:copy", "volumecopy")
 	assert.ErrorContains(c, err, "", out)
 	// do not error out when copy isn't explicitly set even though it's already populated
-	out, _ = dockerCmd(c, "run", "-v", "test:/foo", "volumecopy")
+	out = cli.DockerCmd(c, "run", "-v", "test:/foo", "volumecopy").Combined()
 	assert.Equal(c, strings.TrimSpace(out), "hello")
 
 	// do not allow copy modes on volumes-from
-	dockerCmd(c, "run", "--name=test", "-v", "/foo", "busybox", "true")
+	cli.DockerCmd(c, "run", "--name=test", "-v", "/foo", "busybox", "true")
 	out, _, err = dockerCmdWithError("run", "--volumes-from=test:copy", "busybox", "true")
 	assert.ErrorContains(c, err, "", out)
 	out, _, err = dockerCmdWithError("run", "--volumes-from=test:nocopy", "busybox", "true")
@@ -3950,12 +3934,12 @@ func (s *DockerCLIRunSuite) TestRunAddHostInHostMode(c *testing.T) {
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
 
 	expectedOutput := "1.2.3.4\textra"
-	out, _ := dockerCmd(c, "run", "--add-host=extra:1.2.3.4", "--net=host", "busybox", "cat", "/etc/hosts")
+	out := cli.DockerCmd(c, "run", "--add-host=extra:1.2.3.4", "--net=host", "busybox", "cat", "/etc/hosts").Combined()
 	assert.Assert(c, strings.Contains(out, expectedOutput), "Expected '%s', but got %q", expectedOutput, out)
 }
 
 func (s *DockerCLIRunSuite) TestRunRmAndWait(c *testing.T) {
-	dockerCmd(c, "run", "--name=test", "--rm", "-d", "busybox", "sh", "-c", "sleep 3;exit 2")
+	cli.DockerCmd(c, "run", "--name=test", "--rm", "-d", "busybox", "sh", "-c", "sleep 3;exit 2")
 
 	out, code, err := dockerCmdWithError("wait", "test")
 	assert.Assert(c, err == nil, "out: %s; exit code: %d", out, code)
@@ -4088,7 +4072,7 @@ func (s *DockerCLIRunSuite) TestRunCredentialSpecWellFormed(c *testing.T) {
 	for _, value := range []string{"file://valid.json", "raw://" + validCredSpecs} {
 		// `nltest /PARENTDOMAIN` simply reads the local config, and does not require having an AD
 		// controller handy
-		out, _ := dockerCmd(c, "run", "--rm", "--security-opt=credentialspec="+value, minimalBaseImage(), "nltest", "/PARENTDOMAIN")
+		out := cli.DockerCmd(c, "run", "--rm", "--security-opt=credentialspec="+value, minimalBaseImage(), "nltest", "/PARENTDOMAIN").Combined()
 
 		assert.Assert(c, strings.Contains(out, "hyperv.local."))
 		assert.Assert(c, strings.Contains(out, "The command completed successfully"))
@@ -4108,7 +4092,7 @@ func (s *DockerCLIRunSuite) TestRunDuplicateMount(c *testing.T) {
 	}
 
 	name := "test"
-	out, _ := dockerCmd(c, "run", "--name", name, "-v", "/tmp:/tmp", "-v", "/tmp:/tmp", "busybox", "sh", "-c", "cat "+tmpFile.Name()+" && ls /")
+	out := cli.DockerCmd(c, "run", "--name", name, "-v", "/tmp:/tmp", "-v", "/tmp:/tmp", "busybox", "sh", "-c", "cat "+tmpFile.Name()+" && ls /").Combined()
 	assert.Assert(c, !strings.Contains(out, "tmp:"))
 	assert.Assert(c, strings.Contains(out, data))
 	out = inspectFieldJSON(c, name, "Config.Volumes")
@@ -4118,7 +4102,7 @@ func (s *DockerCLIRunSuite) TestRunDuplicateMount(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunWindowsWithCPUCount(c *testing.T) {
 	testRequires(c, DaemonIsWindows)
 
-	out, _ := dockerCmd(c, "run", "--cpu-count=1", "--name", "test", "busybox", "echo", "testing")
+	out := cli.DockerCmd(c, "run", "--cpu-count=1", "--name", "test", "busybox", "echo", "testing").Combined()
 	assert.Equal(c, strings.TrimSpace(out), "testing")
 
 	out = inspectField(c, "test", "HostConfig.CPUCount")
@@ -4128,7 +4112,7 @@ func (s *DockerCLIRunSuite) TestRunWindowsWithCPUCount(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunWindowsWithCPUShares(c *testing.T) {
 	testRequires(c, DaemonIsWindows)
 
-	out, _ := dockerCmd(c, "run", "--cpu-shares=1000", "--name", "test", "busybox", "echo", "testing")
+	out := cli.DockerCmd(c, "run", "--cpu-shares=1000", "--name", "test", "busybox", "echo", "testing").Combined()
 	assert.Equal(c, strings.TrimSpace(out), "testing")
 
 	out = inspectField(c, "test", "HostConfig.CPUShares")
@@ -4138,7 +4122,7 @@ func (s *DockerCLIRunSuite) TestRunWindowsWithCPUShares(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunWindowsWithCPUPercent(c *testing.T) {
 	testRequires(c, DaemonIsWindows)
 
-	out, _ := dockerCmd(c, "run", "--cpu-percent=80", "--name", "test", "busybox", "echo", "testing")
+	out := cli.DockerCmd(c, "run", "--cpu-percent=80", "--name", "test", "busybox", "echo", "testing").Combined()
 	assert.Equal(c, strings.TrimSpace(out), "testing")
 
 	out = inspectField(c, "test", "HostConfig.CPUPercent")
@@ -4148,7 +4132,7 @@ func (s *DockerCLIRunSuite) TestRunWindowsWithCPUPercent(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunProcessIsolationWithCPUCountCPUSharesAndCPUPercent(c *testing.T) {
 	testRequires(c, DaemonIsWindows, testEnv.DaemonInfo.Isolation.IsProcess)
 
-	out, _ := dockerCmd(c, "run", "--cpu-count=1", "--cpu-shares=1000", "--cpu-percent=80", "--name", "test", "busybox", "echo", "testing")
+	out := cli.DockerCmd(c, "run", "--cpu-count=1", "--cpu-shares=1000", "--cpu-percent=80", "--name", "test", "busybox", "echo", "testing").Combined()
 	assert.Assert(c, strings.Contains(strings.TrimSpace(out), "WARNING: Conflicting options: CPU count takes priority over CPU shares on Windows Server Containers. CPU shares discarded"))
 	assert.Assert(c, strings.Contains(strings.TrimSpace(out), "WARNING: Conflicting options: CPU count takes priority over CPU percent on Windows Server Containers. CPU percent discarded"))
 	assert.Assert(c, strings.Contains(strings.TrimSpace(out), "testing"))
@@ -4165,7 +4149,7 @@ func (s *DockerCLIRunSuite) TestRunProcessIsolationWithCPUCountCPUSharesAndCPUPe
 func (s *DockerCLIRunSuite) TestRunHypervIsolationWithCPUCountCPUSharesAndCPUPercent(c *testing.T) {
 	testRequires(c, DaemonIsWindows, testEnv.DaemonInfo.Isolation.IsHyperV)
 
-	out, _ := dockerCmd(c, "run", "--cpu-count=1", "--cpu-shares=1000", "--cpu-percent=80", "--name", "test", "busybox", "echo", "testing")
+	out := cli.DockerCmd(c, "run", "--cpu-count=1", "--cpu-shares=1000", "--cpu-percent=80", "--name", "test", "busybox", "echo", "testing").Combined()
 	assert.Assert(c, strings.Contains(strings.TrimSpace(out), "testing"))
 	out = inspectField(c, "test", "HostConfig.CPUCount")
 	assert.Equal(c, out, "1")
@@ -4270,11 +4254,11 @@ func (s *DockerCLIRunSuite) TestRunMount(c *testing.T) {
 		c.Fatal(err)
 	}
 	testCatFooBar := func(cName string) error {
-		out, _ := dockerCmd(c, "exec", cName, "cat", "/foo/test1")
+		out := cli.DockerCmd(c, "exec", cName, "cat", "/foo/test1").Stdout()
 		if out != "test1" {
 			return fmt.Errorf("%s not mounted on /foo", mnt1)
 		}
-		out, _ = dockerCmd(c, "exec", cName, "cat", "/bar/test2")
+		out = cli.DockerCmd(c, "exec", cName, "cat", "/bar/test2").Stdout()
 		if out != "test2" {
 			return fmt.Errorf("%s not mounted on /bar", mnt2)
 		}
@@ -4361,7 +4345,7 @@ func (s *DockerCLIRunSuite) TestRunMount(c *testing.T) {
 			},
 			valid: true,
 			fn: func(cName string) error {
-				out, _ := dockerCmd(c, "exec", cName, "cat", "/foo/test1")
+				out := cli.DockerCmd(c, "exec", cName, "cat", "/foo/test1").Combined()
 				if out != "test1" {
 					return fmt.Errorf("%s not mounted on /foo", mnt1)
 				}
@@ -4414,7 +4398,7 @@ func (s *DockerCLIRunSuite) TestRunMount(c *testing.T) {
 			if testCase.valid {
 				assert.Assert(c, err == nil, "got error while creating a container with %v (%s)", opts, cName)
 				assert.Assert(c, testCase.fn(cName) == nil, "got error while executing test for %v (%s)", opts, cName)
-				dockerCmd(c, "rm", "-f", cName)
+				cli.DockerCmd(c, "rm", "-f", cName)
 			} else {
 				assert.Assert(c, err != nil, "got nil while creating a container with %v (%s)", opts, cName)
 			}
@@ -4428,10 +4412,10 @@ func (s *DockerCLIRunSuite) TestRunHostnameFQDN(c *testing.T) {
 	testRequires(c, DaemonIsLinux)
 
 	expectedOutput := "foobar.example.com\nfoobar.example.com\nfoobar\nexample.com\nfoobar.example.com"
-	out, _ := dockerCmd(c, "run", "--hostname=foobar.example.com", "busybox", "sh", "-c", `cat /etc/hostname && hostname && hostname -s && hostname -d && hostname -f`)
+	out := cli.DockerCmd(c, "run", "--hostname=foobar.example.com", "busybox", "sh", "-c", `cat /etc/hostname && hostname && hostname -s && hostname -d && hostname -f`).Combined()
 	assert.Equal(c, strings.TrimSpace(out), expectedOutput)
 
-	out, _ = dockerCmd(c, "run", "--hostname=foobar.example.com", "busybox", "sh", "-c", `cat /etc/hosts`)
+	out = cli.DockerCmd(c, "run", "--hostname=foobar.example.com", "busybox", "sh", "-c", `cat /etc/hosts`).Combined()
 	expectedOutput = "foobar.example.com foobar"
 	assert.Assert(c, strings.Contains(strings.TrimSpace(out), expectedOutput))
 }
@@ -4440,28 +4424,28 @@ func (s *DockerCLIRunSuite) TestRunHostnameFQDN(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunHostnameInHostMode(c *testing.T) {
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
 
-	expectedOutput := "foobar\nfoobar"
-	out, _ := dockerCmd(c, "run", "--net=host", "--hostname=foobar", "busybox", "sh", "-c", `echo $HOSTNAME && hostname`)
+	const expectedOutput = "foobar\nfoobar"
+	out := cli.DockerCmd(c, "run", "--net=host", "--hostname=foobar", "busybox", "sh", "-c", `echo $HOSTNAME && hostname`).Combined()
 	assert.Equal(c, strings.TrimSpace(out), expectedOutput)
 }
 
 func (s *DockerCLIRunSuite) TestRunAddDeviceCgroupRule(c *testing.T) {
 	testRequires(c, DaemonIsLinux)
 
-	deviceRule := "c 7:128 rwm"
+	const deviceRule = "c 7:128 rwm"
 
-	out, _ := dockerCmd(c, "run", "--rm", "busybox", "cat", "/sys/fs/cgroup/devices/devices.list")
+	out := cli.DockerCmd(c, "run", "--rm", "busybox", "cat", "/sys/fs/cgroup/devices/devices.list").Combined()
 	if strings.Contains(out, deviceRule) {
 		c.Fatalf("%s shouldn't been in the device.list", deviceRule)
 	}
 
-	out, _ = dockerCmd(c, "run", "--rm", fmt.Sprintf("--device-cgroup-rule=%s", deviceRule), "busybox", "grep", deviceRule, "/sys/fs/cgroup/devices/devices.list")
+	out = cli.DockerCmd(c, "run", "--rm", fmt.Sprintf("--device-cgroup-rule=%s", deviceRule), "busybox", "grep", deviceRule, "/sys/fs/cgroup/devices/devices.list").Combined()
 	assert.Equal(c, strings.TrimSpace(out), deviceRule)
 }
 
 // Verifies that running as local system is operating correctly on Windows
 func (s *DockerCLIRunSuite) TestWindowsRunAsSystem(c *testing.T) {
 	testRequires(c, DaemonIsWindows)
-	out, _ := dockerCmd(c, "run", "--net=none", `--user=nt authority\system`, "--hostname=XYZZY", minimalBaseImage(), "cmd", "/c", `@echo %USERNAME%`)
+	out := cli.DockerCmd(c, "run", "--net=none", `--user=nt authority\system`, "--hostname=XYZZY", minimalBaseImage(), "cmd", "/c", `@echo %USERNAME%`).Combined()
 	assert.Equal(c, strings.TrimSpace(out), "XYZZY$")
 }
diff --git a/integration-cli/docker_cli_run_unix_test.go b/integration-cli/docker_cli_run_unix_test.go
index d2049bb4fc..014137755f 100644
--- a/integration-cli/docker_cli_run_unix_test.go
+++ b/integration-cli/docker_cli_run_unix_test.go
@@ -75,7 +75,7 @@ func (s *DockerCLIRunSuite) TestRunWithVolumesIsRecursive(c *testing.T) {
 	assert.NilError(c, err)
 	defer f.Close()
 
-	out, _ := dockerCmd(c, "run", "--name", "test-data", "--volume", fmt.Sprintf("%s:/tmp:ro", tmpDir), "busybox:latest", "ls", "/tmp/tmpfs")
+	out := cli.DockerCmd(c, "run", "--name", "test-data", "--volume", fmt.Sprintf("%s:/tmp:ro", tmpDir), "busybox:latest", "ls", "/tmp/tmpfs").Combined()
 	assert.Assert(c, strings.Contains(out, filepath.Base(f.Name())), "Recursive bind mount test failed. Expected file not found")
 }
 
@@ -85,17 +85,17 @@ func (s *DockerCLIRunSuite) TestRunDeviceDirectory(c *testing.T) {
 		c.Skip("Host does not have /dev/snd")
 	}
 
-	out, _ := dockerCmd(c, "run", "--device", "/dev/snd:/dev/snd", "busybox", "sh", "-c", "ls /dev/snd/")
+	out := cli.DockerCmd(c, "run", "--device", "/dev/snd:/dev/snd", "busybox", "sh", "-c", "ls /dev/snd/").Combined()
 	assert.Assert(c, strings.Contains(strings.Trim(out, "\r\n"), "timer"), "expected output /dev/snd/timer")
-	out, _ = dockerCmd(c, "run", "--device", "/dev/snd:/dev/othersnd", "busybox", "sh", "-c", "ls /dev/othersnd/")
+	out = cli.DockerCmd(c, "run", "--device", "/dev/snd:/dev/othersnd", "busybox", "sh", "-c", "ls /dev/othersnd/").Combined()
 	assert.Assert(c, strings.Contains(strings.Trim(out, "\r\n"), "seq"), "expected output /dev/othersnd/seq")
 }
 
 // TestRunAttachDetach checks attaching and detaching with the default escape sequence.
 func (s *DockerCLIRunSuite) TestRunAttachDetach(c *testing.T) {
-	name := "attach-detach"
+	const name = "attach-detach"
 
-	dockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat")
+	cli.DockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat")
 
 	cmd := exec.Command(dockerBinary, "attach", name)
 	stdout, err := cmd.StdoutPipe()
@@ -105,7 +105,7 @@ func (s *DockerCLIRunSuite) TestRunAttachDetach(c *testing.T) {
 	defer cpty.Close()
 	cmd.Stdin = tty
 	assert.NilError(c, cmd.Start())
-	assert.Assert(c, waitRun(name) == nil)
+	cli.WaitRun(c, name)
 
 	_, err = cpty.Write([]byte("hello\n"))
 	assert.NilError(c, err)
@@ -136,7 +136,7 @@ func (s *DockerCLIRunSuite) TestRunAttachDetach(c *testing.T) {
 	running := inspectField(c, name, "State.Running")
 	assert.Equal(c, running, "true", "expected container to still be running")
 
-	out, _ = dockerCmd(c, "events", "--since=0", "--until", daemonUnixTime(c), "-f", "container="+name)
+	out = cli.DockerCmd(c, "events", "--since=0", "--until", daemonUnixTime(c), "-f", "container="+name).Stdout()
 	// attach and detach event should be monitored
 	assert.Assert(c, strings.Contains(out, "attach"))
 	assert.Assert(c, strings.Contains(out, "detach"))
@@ -144,11 +144,11 @@ func (s *DockerCLIRunSuite) TestRunAttachDetach(c *testing.T) {
 
 // TestRunAttachDetachFromFlag checks attaching and detaching with the escape sequence specified via flags.
 func (s *DockerCLIRunSuite) TestRunAttachDetachFromFlag(c *testing.T) {
-	name := "attach-detach"
+	const name = "attach-detach"
 	keyCtrlA := []byte{1}
 	keyA := []byte{97}
 
-	dockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat")
+	cli.DockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat")
 
 	cmd := exec.Command(dockerBinary, "attach", "--detach-keys=ctrl-a,a", name)
 	stdout, err := cmd.StdoutPipe()
@@ -164,7 +164,7 @@ func (s *DockerCLIRunSuite) TestRunAttachDetachFromFlag(c *testing.T) {
 	if err := cmd.Start(); err != nil {
 		c.Fatal(err)
 	}
-	assert.Assert(c, waitRun(name) == nil)
+	cli.WaitRun(c, name)
 
 	if _, err := cpty.Write([]byte("hello\n")); err != nil {
 		c.Fatal(err)
@@ -205,9 +205,9 @@ func (s *DockerCLIRunSuite) TestRunAttachDetachFromFlag(c *testing.T) {
 
 // TestRunAttachDetachFromInvalidFlag checks attaching and detaching with the escape sequence specified via flags.
 func (s *DockerCLIRunSuite) TestRunAttachDetachFromInvalidFlag(c *testing.T) {
-	name := "attach-detach"
-	dockerCmd(c, "run", "--name", name, "-itd", "busybox", "top")
-	assert.Assert(c, waitRun(name) == nil)
+	const name = "attach-detach"
+	cli.DockerCmd(c, "run", "--name", name, "-itd", "busybox", "top")
+	cli.WaitRun(c, name)
 
 	// specify an invalid detach key, container will ignore it and use default
 	cmd := exec.Command(dockerBinary, "attach", "--detach-keys=ctrl-A,a", name)
@@ -264,8 +264,8 @@ func (s *DockerCLIRunSuite) TestRunAttachDetachFromConfig(c *testing.T) {
 	assert.NilError(c, err)
 
 	// Then do the work
-	name := "attach-detach"
-	dockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat")
+	const name = "attach-detach"
+	cli.DockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat")
 
 	cmd := exec.Command(dockerBinary, "attach", name)
 	stdout, err := cmd.StdoutPipe()
@@ -281,7 +281,7 @@ func (s *DockerCLIRunSuite) TestRunAttachDetachFromConfig(c *testing.T) {
 	if err := cmd.Start(); err != nil {
 		c.Fatal(err)
 	}
-	assert.Assert(c, waitRun(name) == nil)
+	cli.WaitRun(c, name)
 
 	if _, err := cpty.Write([]byte("hello\n")); err != nil {
 		c.Fatal(err)
@@ -348,8 +348,8 @@ func (s *DockerCLIRunSuite) TestRunAttachDetachKeysOverrideConfig(c *testing.T)
 	assert.NilError(c, err)
 
 	// Then do the work
-	name := "attach-detach"
-	dockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat")
+	const name = "attach-detach"
+	cli.DockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat")
 
 	cmd := exec.Command(dockerBinary, "attach", "--detach-keys=ctrl-a,a", name)
 	stdout, err := cmd.StdoutPipe()
@@ -365,7 +365,7 @@ func (s *DockerCLIRunSuite) TestRunAttachDetachKeysOverrideConfig(c *testing.T)
 	if err := cmd.Start(); err != nil {
 		c.Fatal(err)
 	}
-	assert.Assert(c, waitRun(name) == nil)
+	cli.WaitRun(c, name)
 
 	if _, err := cpty.Write([]byte("hello\n")); err != nil {
 		c.Fatal(err)
@@ -405,11 +405,11 @@ func (s *DockerCLIRunSuite) TestRunAttachDetachKeysOverrideConfig(c *testing.T)
 }
 
 func (s *DockerCLIRunSuite) TestRunAttachInvalidDetachKeySequencePreserved(c *testing.T) {
-	name := "attach-detach"
+	const name = "attach-detach"
 	keyA := []byte{97}
 	keyB := []byte{98}
 
-	dockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat")
+	cli.DockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat")
 
 	cmd := exec.Command(dockerBinary, "attach", "--detach-keys=a,b,c", name)
 	stdout, err := cmd.StdoutPipe()
@@ -426,7 +426,7 @@ func (s *DockerCLIRunSuite) TestRunAttachInvalidDetachKeySequencePreserved(c *te
 		c.Fatal(err)
 	}
 	go cmd.Wait()
-	assert.Assert(c, waitRun(name) == nil)
+	cli.WaitRun(c, name)
 
 	// Invalid escape sequence aba, should print aba in output
 	if _, err := cpty.Write(keyA); err != nil {
@@ -458,8 +458,8 @@ func (s *DockerCLIRunSuite) TestRunAttachInvalidDetachKeySequencePreserved(c *te
 func (s *DockerCLIRunSuite) TestRunWithCPUQuota(c *testing.T) {
 	testRequires(c, cpuCfsQuota)
 
-	file := "/sys/fs/cgroup/cpu/cpu.cfs_quota_us"
-	out, _ := dockerCmd(c, "run", "--cpu-quota", "8000", "--name", "test", "busybox", "cat", file)
+	const file = "/sys/fs/cgroup/cpu/cpu.cfs_quota_us"
+	out := cli.DockerCmd(c, "run", "--cpu-quota", "8000", "--name", "test", "busybox", "cat", file).Combined()
 	assert.Equal(c, strings.TrimSpace(out), "8000")
 
 	out = inspectField(c, "test", "HostConfig.CpuQuota")
@@ -469,11 +469,11 @@ func (s *DockerCLIRunSuite) TestRunWithCPUQuota(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunWithCpuPeriod(c *testing.T) {
 	testRequires(c, cpuCfsPeriod)
 
-	file := "/sys/fs/cgroup/cpu/cpu.cfs_period_us"
-	out, _ := dockerCmd(c, "run", "--cpu-period", "50000", "--name", "test", "busybox", "cat", file)
+	const file = "/sys/fs/cgroup/cpu/cpu.cfs_period_us"
+	out := cli.DockerCmd(c, "run", "--cpu-period", "50000", "--name", "test", "busybox", "cat", file).Combined()
 	assert.Equal(c, strings.TrimSpace(out), "50000")
 
-	out, _ = dockerCmd(c, "run", "--cpu-period", "0", "busybox", "cat", file)
+	out = cli.DockerCmd(c, "run", "--cpu-period", "0", "busybox", "cat", file).Combined()
 	assert.Equal(c, strings.TrimSpace(out), "100000")
 
 	out = inspectField(c, "test", "HostConfig.CpuPeriod")
@@ -499,8 +499,8 @@ func (s *DockerCLIRunSuite) TestRunWithInvalidCpuPeriod(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunWithCPUShares(c *testing.T) {
 	testRequires(c, cpuShare)
 
-	file := "/sys/fs/cgroup/cpu/cpu.shares"
-	out, _ := dockerCmd(c, "run", "--cpu-shares", "1000", "--name", "test", "busybox", "cat", file)
+	const file = "/sys/fs/cgroup/cpu/cpu.shares"
+	out := cli.DockerCmd(c, "run", "--cpu-shares", "1000", "--name", "test", "busybox", "cat", file).Combined()
 	assert.Equal(c, strings.TrimSpace(out), "1000")
 
 	out = inspectField(c, "test", "HostConfig.CPUShares")
@@ -519,8 +519,8 @@ func (s *DockerCLIRunSuite) TestRunEchoStdoutWithCPUSharesAndMemoryLimit(c *test
 func (s *DockerCLIRunSuite) TestRunWithCpusetCpus(c *testing.T) {
 	testRequires(c, cgroupCpuset)
 
-	file := "/sys/fs/cgroup/cpuset/cpuset.cpus"
-	out, _ := dockerCmd(c, "run", "--cpuset-cpus", "0", "--name", "test", "busybox", "cat", file)
+	const file = "/sys/fs/cgroup/cpuset/cpuset.cpus"
+	out := cli.DockerCmd(c, "run", "--cpuset-cpus", "0", "--name", "test", "busybox", "cat", file).Combined()
 	assert.Equal(c, strings.TrimSpace(out), "0")
 
 	out = inspectField(c, "test", "HostConfig.CpusetCpus")
@@ -530,8 +530,8 @@ func (s *DockerCLIRunSuite) TestRunWithCpusetCpus(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunWithCpusetMems(c *testing.T) {
 	testRequires(c, cgroupCpuset)
 
-	file := "/sys/fs/cgroup/cpuset/cpuset.mems"
-	out, _ := dockerCmd(c, "run", "--cpuset-mems", "0", "--name", "test", "busybox", "cat", file)
+	const file = "/sys/fs/cgroup/cpuset/cpuset.mems"
+	out := cli.DockerCmd(c, "run", "--cpuset-mems", "0", "--name", "test", "busybox", "cat", file).Combined()
 	assert.Equal(c, strings.TrimSpace(out), "0")
 
 	out = inspectField(c, "test", "HostConfig.CpusetMems")
@@ -541,8 +541,8 @@ func (s *DockerCLIRunSuite) TestRunWithCpusetMems(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunWithBlkioWeight(c *testing.T) {
 	testRequires(c, blkioWeight)
 
-	file := "/sys/fs/cgroup/blkio/blkio.weight"
-	out, _ := dockerCmd(c, "run", "--blkio-weight", "300", "--name", "test", "busybox", "cat", file)
+	const file = "/sys/fs/cgroup/blkio/blkio.weight"
+	out := cli.DockerCmd(c, "run", "--blkio-weight", "300", "--name", "test", "busybox", "cat", file).Combined()
 	assert.Equal(c, strings.TrimSpace(out), "300")
 
 	out = inspectField(c, "test", "HostConfig.BlkioWeight")
@@ -610,7 +610,7 @@ func (s *DockerCLIRunSuite) TestRunOOMExitCode(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunWithMemoryLimit(c *testing.T) {
 	testRequires(c, memoryLimitSupport)
 
-	file := "/sys/fs/cgroup/memory/memory.limit_in_bytes"
+	const file = "/sys/fs/cgroup/memory/memory.limit_in_bytes"
 	cli.DockerCmd(c, "run", "-m", "32M", "--name", "test", "busybox", "cat", file).Assert(c, icmd.Expected{
 		Out: "33554432",
 	})
@@ -627,13 +627,13 @@ func (s *DockerCLIRunSuite) TestRunWithoutMemoryswapLimit(c *testing.T) {
 	testRequires(c, DaemonIsLinux)
 	testRequires(c, memoryLimitSupport)
 	testRequires(c, swapMemorySupport)
-	dockerCmd(c, "run", "-m", "32m", "--memory-swap", "-1", "busybox", "true")
+	cli.DockerCmd(c, "run", "-m", "32m", "--memory-swap", "-1", "busybox", "true")
 }
 
 func (s *DockerCLIRunSuite) TestRunWithSwappiness(c *testing.T) {
 	testRequires(c, memorySwappinessSupport)
-	file := "/sys/fs/cgroup/memory/memory.swappiness"
-	out, _ := dockerCmd(c, "run", "--memory-swappiness", "0", "--name", "test", "busybox", "cat", file)
+	const file = "/sys/fs/cgroup/memory/memory.swappiness"
+	out := cli.DockerCmd(c, "run", "--memory-swappiness", "0", "--name", "test", "busybox", "cat", file).Combined()
 	assert.Equal(c, strings.TrimSpace(out), "0")
 
 	out = inspectField(c, "test", "HostConfig.MemorySwappiness")
@@ -654,8 +654,8 @@ func (s *DockerCLIRunSuite) TestRunWithSwappinessInvalid(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunWithMemoryReservation(c *testing.T) {
 	testRequires(c, testEnv.IsLocalDaemon, memoryReservationSupport)
 
-	file := "/sys/fs/cgroup/memory/memory.soft_limit_in_bytes"
-	out, _ := dockerCmd(c, "run", "--memory-reservation", "200M", "--name", "test", "busybox", "cat", file)
+	const file = "/sys/fs/cgroup/memory/memory.soft_limit_in_bytes"
+	out := cli.DockerCmd(c, "run", "--memory-reservation", "200M", "--name", "test", "busybox", "cat", file).Combined()
 	assert.Equal(c, strings.TrimSpace(out), "209715200")
 
 	out = inspectField(c, "test", "HostConfig.MemoryReservation")
@@ -676,13 +676,12 @@ func (s *DockerCLIRunSuite) TestRunWithMemoryReservationInvalid(c *testing.T) {
 }
 
 func (s *DockerCLIRunSuite) TestStopContainerSignal(c *testing.T) {
-	out, _ := dockerCmd(c, "run", "--stop-signal", "SIGUSR1", "-d", "busybox", "/bin/sh", "-c", `trap 'echo "exit trapped"; exit 0' USR1; while true; do sleep 1; done`)
-	containerID := strings.TrimSpace(out)
+	containerID := cli.DockerCmd(c, "run", "--stop-signal", "SIGUSR1", "-d", "busybox", "/bin/sh", "-c", `trap 'echo "exit trapped"; exit 0' USR1; while true; do sleep 1; done`).Stdout()
+	containerID = strings.TrimSpace(containerID)
+	cli.WaitRun(c, containerID)
 
-	assert.Assert(c, waitRun(containerID) == nil)
-
-	dockerCmd(c, "stop", containerID)
-	out, _ = dockerCmd(c, "logs", containerID)
+	cli.DockerCmd(c, "stop", containerID)
+	out := cli.DockerCmd(c, "logs", containerID).Combined()
 
 	assert.Assert(c, strings.Contains(out, "exit trapped"), "Expected `exit trapped` in the log")
 }
@@ -756,8 +755,8 @@ func (s *DockerCLIRunSuite) TestRunInvalidCPUShares(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunWithDefaultShmSize(c *testing.T) {
 	testRequires(c, DaemonIsLinux)
 
-	name := "shm-default"
-	out, _ := dockerCmd(c, "run", "--name", name, "busybox", "mount")
+	const name = "shm-default"
+	out := cli.DockerCmd(c, "run", "--name", name, "busybox", "mount").Combined()
 	shmRegex := regexp.MustCompile(`shm on /dev/shm type tmpfs(.*)size=65536k`)
 	if !shmRegex.MatchString(out) {
 		c.Fatalf("Expected shm of 64MB in mount command, got %v", out)
@@ -769,8 +768,8 @@ func (s *DockerCLIRunSuite) TestRunWithDefaultShmSize(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunWithShmSize(c *testing.T) {
 	testRequires(c, DaemonIsLinux)
 
-	name := "shm"
-	out, _ := dockerCmd(c, "run", "--name", name, "--shm-size=1G", "busybox", "mount")
+	const name = "shm"
+	out := cli.DockerCmd(c, "run", "--name", name, "--shm-size=1G", "busybox", "mount").Combined()
 	shmRegex := regexp.MustCompile(`shm on /dev/shm type tmpfs(.*)size=1048576k`)
 	if !shmRegex.MatchString(out) {
 		c.Fatalf("Expected shm of 1GB in mount command, got %v", out)
@@ -783,7 +782,7 @@ func (s *DockerCLIRunSuite) TestRunTmpfsMountsEnsureOrdered(c *testing.T) {
 	tmpFile, err := os.CreateTemp("", "test")
 	assert.NilError(c, err)
 	defer tmpFile.Close()
-	out, _ := dockerCmd(c, "run", "--tmpfs", "/run", "-v", tmpFile.Name()+":/run/test", "busybox", "ls", "/run")
+	out := cli.DockerCmd(c, "run", "--tmpfs", "/run", "-v", tmpFile.Name()+":/run/test", "busybox", "ls", "/run").Combined()
 	assert.Assert(c, strings.Contains(out, "test"))
 }
 
@@ -809,13 +808,13 @@ func (s *DockerCLIRunSuite) TestRunTmpfsMounts(c *testing.T) {
 }
 
 func (s *DockerCLIRunSuite) TestRunTmpfsMountsOverrideImageVolumes(c *testing.T) {
-	name := "img-with-volumes"
+	const name = "img-with-volumes"
 	buildImageSuccessfully(c, name, build.WithDockerfile(`
     FROM busybox
     VOLUME /run
     RUN touch /run/stuff
     `))
-	out, _ := dockerCmd(c, "run", "--tmpfs", "/run", name, "ls", "/run")
+	out := cli.DockerCmd(c, "run", "--tmpfs", "/run", name, "ls", "/run").Combined()
 	assert.Assert(c, !strings.Contains(out, "stuff"))
 }
 
@@ -824,25 +823,25 @@ func (s *DockerCLIRunSuite) TestRunTmpfsMountsWithOptions(c *testing.T) {
 	testRequires(c, DaemonIsLinux)
 
 	expectedOptions := []string{"rw", "nosuid", "nodev", "noexec", "relatime"}
-	out, _ := dockerCmd(c, "run", "--tmpfs", "/tmp", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'")
+	out := cli.DockerCmd(c, "run", "--tmpfs", "/tmp", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'").Combined()
 	for _, option := range expectedOptions {
 		assert.Assert(c, strings.Contains(out, option))
 	}
 	assert.Assert(c, !strings.Contains(out, "size="))
 	expectedOptions = []string{"rw", "nosuid", "nodev", "noexec", "relatime"}
-	out, _ = dockerCmd(c, "run", "--tmpfs", "/tmp:rw", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'")
+	out = cli.DockerCmd(c, "run", "--tmpfs", "/tmp:rw", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'").Combined()
 	for _, option := range expectedOptions {
 		assert.Assert(c, strings.Contains(out, option))
 	}
 	assert.Assert(c, !strings.Contains(out, "size="))
 	expectedOptions = []string{"rw", "nosuid", "nodev", "relatime", "size=8192k"}
-	out, _ = dockerCmd(c, "run", "--tmpfs", "/tmp:rw,exec,size=8192k", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'")
+	out = cli.DockerCmd(c, "run", "--tmpfs", "/tmp:rw,exec,size=8192k", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'").Combined()
 	for _, option := range expectedOptions {
 		assert.Assert(c, strings.Contains(out, option))
 	}
 
 	expectedOptions = []string{"rw", "nosuid", "nodev", "noexec", "relatime", "size=4096k"}
-	out, _ = dockerCmd(c, "run", "--tmpfs", "/tmp:rw,size=8192k,exec,size=4096k,noexec", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'")
+	out = cli.DockerCmd(c, "run", "--tmpfs", "/tmp:rw,size=8192k,exec,size=4096k,noexec", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'").Combined()
 	for _, option := range expectedOptions {
 		assert.Assert(c, strings.Contains(out, option))
 	}
@@ -852,7 +851,7 @@ func (s *DockerCLIRunSuite) TestRunTmpfsMountsWithOptions(c *testing.T) {
 	// /tmp   shared
 	// so we only capture `shared` here.
 	expectedOptions = []string{"shared"}
-	out, _ = dockerCmd(c, "run", "--tmpfs", "/tmp:shared", "debian:bullseye-slim", "findmnt", "-o", "TARGET,PROPAGATION", "/tmp")
+	out = cli.DockerCmd(c, "run", "--tmpfs", "/tmp:shared", "debian:bullseye-slim", "findmnt", "-o", "TARGET,PROPAGATION", "/tmp").Combined()
 	for _, option := range expectedOptions {
 		assert.Assert(c, strings.Contains(out, option))
 	}
@@ -862,7 +861,7 @@ func (s *DockerCLIRunSuite) TestRunSysctls(c *testing.T) {
 	testRequires(c, DaemonIsLinux)
 	var err error
 
-	out, _ := dockerCmd(c, "run", "--sysctl", "net.ipv4.ip_forward=1", "--name", "test", "busybox", "cat", "/proc/sys/net/ipv4/ip_forward")
+	out := cli.DockerCmd(c, "run", "--sysctl", "net.ipv4.ip_forward=1", "--name", "test", "busybox", "cat", "/proc/sys/net/ipv4/ip_forward").Combined()
 	assert.Equal(c, strings.TrimSpace(out), "1")
 
 	out = inspectFieldJSON(c, "test", "HostConfig.Sysctls")
@@ -872,7 +871,7 @@ func (s *DockerCLIRunSuite) TestRunSysctls(c *testing.T) {
 	assert.NilError(c, err)
 	assert.Equal(c, sysctls["net.ipv4.ip_forward"], "1")
 
-	out, _ = dockerCmd(c, "run", "--sysctl", "net.ipv4.ip_forward=0", "--name", "test1", "busybox", "cat", "/proc/sys/net/ipv4/ip_forward")
+	out = cli.DockerCmd(c, "run", "--sysctl", "net.ipv4.ip_forward=0", "--name", "test1", "busybox", "cat", "/proc/sys/net/ipv4/ip_forward").Combined()
 	assert.Equal(c, strings.TrimSpace(out), "0")
 
 	out = inspectFieldJSON(c, "test1", "HostConfig.Sysctls")
@@ -891,7 +890,7 @@ func (s *DockerCLIRunSuite) TestRunSysctls(c *testing.T) {
 // TestRunSeccompProfileDenyUnshare checks that 'docker run --security-opt seccomp=/tmp/profile.json debian:bullseye-slim unshare' exits with operation not permitted.
 func (s *DockerCLIRunSuite) TestRunSeccompProfileDenyUnshare(c *testing.T) {
 	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, Apparmor)
-	jsonData := `{
+	const jsonData = `{
 	"defaultAction": "SCMP_ACT_ALLOW",
 	"syscalls": [
 		{
@@ -920,7 +919,7 @@ func (s *DockerCLIRunSuite) TestRunSeccompProfileDenyUnshare(c *testing.T) {
 // TestRunSeccompProfileDenyChmod checks that 'docker run --security-opt seccomp=/tmp/profile.json busybox chmod 400 /etc/hostname' exits with operation not permitted.
 func (s *DockerCLIRunSuite) TestRunSeccompProfileDenyChmod(c *testing.T) {
 	testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
-	jsonData := `{
+	const jsonData = `{
 	"defaultAction": "SCMP_ACT_ALLOW",
 	"syscalls": [
 		{
@@ -1139,7 +1138,7 @@ func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesChown(c *testing.T) {
 	ensureSyscallTest(testutil.GetContext(c), c)
 
 	// test that a root user has default capability CAP_CHOWN
-	dockerCmd(c, "run", "busybox", "chown", "100", "/tmp")
+	cli.DockerCmd(c, "run", "busybox", "chown", "100", "/tmp")
 	// test that non root user does not have default capability CAP_CHOWN
 	icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "busybox", "chown", "100", "/tmp").Assert(c, icmd.Expected{
 		ExitCode: 1,
@@ -1157,7 +1156,7 @@ func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesDacOverride(c *testin
 	ensureSyscallTest(testutil.GetContext(c), c)
 
 	// test that a root user has default capability CAP_DAC_OVERRIDE
-	dockerCmd(c, "run", "busybox", "sh", "-c", "echo test > /etc/passwd")
+	cli.DockerCmd(c, "run", "busybox", "sh", "-c", "echo test > /etc/passwd")
 	// test that non root user does not have default capability CAP_DAC_OVERRIDE
 	icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "busybox", "sh", "-c", "echo test > /etc/passwd").Assert(c, icmd.Expected{
 		ExitCode: 1,
@@ -1170,7 +1169,7 @@ func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesFowner(c *testing.T)
 	ensureSyscallTest(testutil.GetContext(c), c)
 
 	// test that a root user has default capability CAP_FOWNER
-	dockerCmd(c, "run", "busybox", "chmod", "777", "/etc/passwd")
+	cli.DockerCmd(c, "run", "busybox", "chmod", "777", "/etc/passwd")
 	// test that non root user does not have default capability CAP_FOWNER
 	icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "busybox", "chmod", "777", "/etc/passwd").Assert(c, icmd.Expected{
 		ExitCode: 1,
@@ -1186,7 +1185,7 @@ func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesSetuid(c *testing.T)
 	ensureSyscallTest(testutil.GetContext(c), c)
 
 	// test that a root user has default capability CAP_SETUID
-	dockerCmd(c, "run", "syscall-test", "setuid-test")
+	cli.DockerCmd(c, "run", "syscall-test", "setuid-test")
 	// test that non root user does not have default capability CAP_SETUID
 	icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "syscall-test", "setuid-test").Assert(c, icmd.Expected{
 		ExitCode: 1,
@@ -1204,7 +1203,7 @@ func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesSetgid(c *testing.T)
 	ensureSyscallTest(testutil.GetContext(c), c)
 
 	// test that a root user has default capability CAP_SETGID
-	dockerCmd(c, "run", "syscall-test", "setgid-test")
+	cli.DockerCmd(c, "run", "syscall-test", "setgid-test")
 	// test that non root user does not have default capability CAP_SETGID
 	icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "syscall-test", "setgid-test").Assert(c, icmd.Expected{
 		ExitCode: 1,
@@ -1232,7 +1231,7 @@ func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesNetBindService(c *tes
 	ensureSyscallTest(testutil.GetContext(c), c)
 
 	// test that a root user has default capability CAP_NET_BIND_SERVICE
-	dockerCmd(c, "run", "syscall-test", "socket-test")
+	cli.DockerCmd(c, "run", "syscall-test", "socket-test")
 	// test that non root user does not have default capability CAP_NET_BIND_SERVICE
 	// as we allow this via sysctl, also tweak the sysctl back to default
 	args := []string{"run", "--user", "1000:1000"}
@@ -1261,7 +1260,7 @@ func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesNetRaw(c *testing.T)
 	ensureSyscallTest(testutil.GetContext(c), c)
 
 	// test that a root user has default capability CAP_NET_RAW
-	dockerCmd(c, "run", "syscall-test", "raw-test")
+	cli.DockerCmd(c, "run", "syscall-test", "raw-test")
 	// test that non root user does not have default capability CAP_NET_RAW
 	icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "syscall-test", "raw-test").Assert(c, icmd.Expected{
 		ExitCode: 1,
@@ -1279,7 +1278,7 @@ func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesChroot(c *testing.T)
 	ensureSyscallTest(testutil.GetContext(c), c)
 
 	// test that a root user has default capability CAP_SYS_CHROOT
-	dockerCmd(c, "run", "busybox", "chroot", "/", "/bin/true")
+	cli.DockerCmd(c, "run", "busybox", "chroot", "/", "/bin/true")
 	// test that non root user does not have default capability CAP_SYS_CHROOT
 	icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "busybox", "chroot", "/", "/bin/true").Assert(c, icmd.Expected{
 		ExitCode: 1,
@@ -1297,7 +1296,7 @@ func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesMknod(c *testing.T) {
 	ensureSyscallTest(testutil.GetContext(c), c)
 
 	// test that a root user has default capability CAP_MKNOD
-	dockerCmd(c, "run", "busybox", "mknod", "/tmp/node", "b", "1", "2")
+	cli.DockerCmd(c, "run", "busybox", "mknod", "/tmp/node", "b", "1", "2")
 	// test that non root user does not have default capability CAP_MKNOD
 	// test that root user can drop default capability CAP_SYS_CHROOT
 	icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "busybox", "mknod", "/tmp/node", "b", "1", "2").Assert(c, icmd.Expected{
@@ -1377,14 +1376,14 @@ func (s *DockerCLIRunSuite) TestRunDeviceSymlink(c *testing.T) {
 	defer os.Remove("/dev/symzero")
 
 	// md5sum of 'dd if=/dev/zero bs=4K count=8' is bb7df04e1b0a2570657527a7e108ae23
-	out, _ := dockerCmd(c, "run", "--device", symZero+":/dev/symzero", "busybox", "sh", "-c", "dd if=/dev/symzero bs=4K count=8 | md5sum")
+	out := cli.DockerCmd(c, "run", "--device", symZero+":/dev/symzero", "busybox", "sh", "-c", "dd if=/dev/symzero bs=4K count=8 | md5sum").Combined()
 	assert.Assert(c, strings.Contains(strings.Trim(out, "\r\n"), "bb7df04e1b0a2570657527a7e108ae23"), "expected output bb7df04e1b0a2570657527a7e108ae23")
 	// symlink "tmpDir/file" to a file "tmpDir/temp" will result in an error as it is not a device.
 	out, _, err = dockerCmdWithError("run", "--device", symFile+":/dev/symzero", "busybox", "sh", "-c", "dd if=/dev/symzero bs=4K count=8 | md5sum")
 	assert.ErrorContains(c, err, "")
 	assert.Assert(c, strings.Contains(strings.Trim(out, "\r\n"), "not a device node"), "expected output 'not a device node'")
 	// md5sum of 'dd if=/dev/zero bs=4K count=8' is bb7df04e1b0a2570657527a7e108ae23 (this time check with relative path backed, see #22271)
-	out, _ = dockerCmd(c, "run", "--device", "/dev/symzero:/dev/symzero", "busybox", "sh", "-c", "dd if=/dev/symzero bs=4K count=8 | md5sum")
+	out = cli.DockerCmd(c, "run", "--device", "/dev/symzero:/dev/symzero", "busybox", "sh", "-c", "dd if=/dev/symzero bs=4K count=8 | md5sum").Combined()
 	assert.Assert(c, strings.Contains(strings.Trim(out, "\r\n"), "bb7df04e1b0a2570657527a7e108ae23"), "expected output bb7df04e1b0a2570657527a7e108ae23")
 }
 
@@ -1392,8 +1391,8 @@ func (s *DockerCLIRunSuite) TestRunDeviceSymlink(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunPIDsLimit(c *testing.T) {
 	testRequires(c, testEnv.IsLocalDaemon, pidsLimit)
 
-	file := "/sys/fs/cgroup/pids/pids.max"
-	out, _ := dockerCmd(c, "run", "--name", "skittles", "--pids-limit", "4", "busybox", "cat", file)
+	const file = "/sys/fs/cgroup/pids/pids.max"
+	out := cli.DockerCmd(c, "run", "--name", "skittles", "--pids-limit", "4", "busybox", "cat", file).Combined()
 	assert.Equal(c, strings.TrimSpace(out), "4")
 
 	out = inspectField(c, "skittles", "HostConfig.PidsLimit")
@@ -1403,8 +1402,8 @@ func (s *DockerCLIRunSuite) TestRunPIDsLimit(c *testing.T) {
 func (s *DockerCLIRunSuite) TestRunPrivilegedAllowedDevices(c *testing.T) {
 	testRequires(c, DaemonIsLinux, NotUserNamespace)
 
-	file := "/sys/fs/cgroup/devices/devices.list"
-	out, _ := dockerCmd(c, "run", "--privileged", "busybox", "cat", file)
+	const file = "/sys/fs/cgroup/devices/devices.list"
+	out := cli.DockerCmd(c, "run", "--privileged", "busybox", "cat", file).Combined()
 	c.Logf("out: %q", out)
 	assert.Equal(c, strings.TrimSpace(out), "a *:* rwm")
 }
@@ -1421,8 +1420,8 @@ func (s *DockerCLIRunSuite) TestRunUserDeviceAllowed(c *testing.T) {
 		c.Skip("Could not stat /dev/snd/timer")
 	}
 
-	file := "/sys/fs/cgroup/devices/devices.list"
-	out, _ := dockerCmd(c, "run", "--device", "/dev/snd/timer:w", "busybox", "cat", file)
+	const file = "/sys/fs/cgroup/devices/devices.list"
+	out := cli.DockerCmd(c, "run", "--device", "/dev/snd/timer:w", "busybox", "cat", file).Combined()
 	assert.Assert(c, strings.Contains(out, fmt.Sprintf("c %d:%d w", stat.Rdev/256, stat.Rdev%256)))
 }
 
@@ -1432,7 +1431,7 @@ func (s *DockerDaemonSuite) TestRunSeccompJSONNewFormat(c *testing.T) {
 
 	s.d.StartWithBusybox(ctx, c)
 
-	jsonData := `{
+	const jsonData = `{
 	"defaultAction": "SCMP_ACT_ALLOW",
 	"syscalls": [
 		{
@@ -1458,7 +1457,7 @@ func (s *DockerDaemonSuite) TestRunSeccompJSONNoNameAndNames(c *testing.T) {
 
 	s.d.StartWithBusybox(ctx, c)
 
-	jsonData := `{
+	const jsonData = `{
 	"defaultAction": "SCMP_ACT_ALLOW",
 	"syscalls": [
 		{
@@ -1485,7 +1484,7 @@ func (s *DockerDaemonSuite) TestRunSeccompJSONNoArchAndArchMap(c *testing.T) {
 
 	s.d.StartWithBusybox(ctx, c)
 
-	jsonData := `{
+	const jsonData = `{
 	"archMap": [
 		{
 			"architecture": "SCMP_ARCH_X86_64",
@@ -1527,7 +1526,7 @@ func (s *DockerDaemonSuite) TestRunWithDaemonDefaultSeccompProfile(c *testing.T)
 	_, err := s.d.Cmd("run", "busybox", "chmod", "777", ".")
 	assert.NilError(c, err)
 
-	jsonData := `{
+	const jsonData = `{
 	"defaultAction": "SCMP_ACT_ALLOW",
 	"syscalls": [
 		{
@@ -1557,9 +1556,9 @@ func (s *DockerDaemonSuite) TestRunWithDaemonDefaultSeccompProfile(c *testing.T)
 func (s *DockerCLIRunSuite) TestRunWithNanoCPUs(c *testing.T) {
 	testRequires(c, cpuCfsQuota, cpuCfsPeriod)
 
-	file1 := "/sys/fs/cgroup/cpu/cpu.cfs_quota_us"
-	file2 := "/sys/fs/cgroup/cpu/cpu.cfs_period_us"
-	out, _ := dockerCmd(c, "run", "--cpus", "0.5", "--name", "test", "busybox", "sh", "-c", fmt.Sprintf("cat %s && cat %s", file1, file2))
+	const file1 = "/sys/fs/cgroup/cpu/cpu.cfs_quota_us"
+	const file2 = "/sys/fs/cgroup/cpu/cpu.cfs_period_us"
+	out := cli.DockerCmd(c, "run", "--cpus", "0.5", "--name", "test", "busybox", "sh", "-c", fmt.Sprintf("cat %s && cat %s", file1, file2)).Combined()
 	assert.Equal(c, strings.TrimSpace(out), "50000\n100000")
 
 	clt, err := client.NewClientWithOpts(client.FromEnv)