diff --git a/integration-cli/check_test.go b/integration-cli/check_test.go
index dd036f3f0e..4cc7f37f04 100644
--- a/integration-cli/check_test.go
+++ b/integration-cli/check_test.go
@@ -342,8 +342,7 @@ func TestDockerHubPullSuite(t *testing.T) {
 	suite.Run(t, newDockerHubPullSuite())
 }
 
-type DockerSuite struct {
-}
+type DockerSuite struct{}
 
 func (s *DockerSuite) OnTimeout(c *testing.T) {
 	if testEnv.IsRemoteDaemon() {
@@ -598,6 +597,7 @@ func (ps *DockerPluginSuite) registryHost() string {
 func (ps *DockerPluginSuite) getPluginRepo() string {
 	return path.Join(ps.registryHost(), "plugin", "basic")
 }
+
 func (ps *DockerPluginSuite) getPluginRepoWithTag() string {
 	return ps.getPluginRepo() + ":" + "latest"
 }
diff --git a/integration-cli/docker_api_build_test.go b/integration-cli/docker_api_build_test.go
index 2bc9c9dd98..0286ff7c35 100644
--- a/integration-cli/docker_api_build_test.go
+++ b/integration-cli/docker_api_build_test.go
@@ -352,7 +352,7 @@ func (s *DockerAPISuite) TestBuildAddRemoteNoDecompress(c *testing.T) {
 	err := tw.WriteHeader(&tar.Header{
 		Name:     "foo",
 		Size:     int64(len(dt)),
-		Mode:     0600,
+		Mode:     0o600,
 		Typeflag: tar.TypeReg,
 	})
 	assert.NilError(c, err)
@@ -430,7 +430,7 @@ COPY file /file`
 		fakecontext.WithDockerfile(dockerfile),
 		fakecontext.WithFile("file", "bar"))
 
-	var build = func(ctx *fakecontext.Fake) string {
+	build := func(ctx *fakecontext.Fake) string {
 		res, body, err := request.Post("/build",
 			request.RawContent(ctx.AsTarReader(c)),
 			request.ContentType("application/x-tar"))
@@ -470,7 +470,7 @@ ADD file /file`
 		fakecontext.WithDockerfile(dockerfile),
 		fakecontext.WithFile("file", "bar"))
 
-	var build = func(ctx *fakecontext.Fake) string {
+	build := func(ctx *fakecontext.Fake) string {
 		res, body, err := request.Post("/build",
 			request.RawContent(ctx.AsTarReader(c)),
 			request.ContentType("application/x-tar"))
diff --git a/integration-cli/docker_api_containers_test.go b/integration-cli/docker_api_containers_test.go
index fff09a6369..245dc2b835 100644
--- a/integration-cli/docker_api_containers_test.go
+++ b/integration-cli/docker_api_containers_test.go
@@ -146,9 +146,7 @@ func (s *DockerAPISuite) TestContainerAPIGetChanges(c *testing.T) {
 }
 
 func (s *DockerAPISuite) TestGetContainerStats(c *testing.T) {
-	var (
-		name = "statscontainer"
-	)
+	const name = "statscontainer"
 	runSleepingContainer(c, "--name", name)
 
 	type b struct {
@@ -476,7 +474,8 @@ func (s *DockerAPISuite) TestContainerAPICommitWithLabelInConfig(c *testing.T) {
 	defer apiClient.Close()
 
 	config := container.Config{
-		Labels: map[string]string{"key1": "value1", "key2": "value2"}}
+		Labels: map[string]string{"key1": "value1", "key2": "value2"},
+	}
 
 	options := types.ContainerCommitOptions{
 		Reference: "testcontainerapicommitwithconfig",
@@ -513,7 +512,8 @@ func (s *DockerAPISuite) TestContainerAPIBadPort(c *testing.T) {
 			"8080/tcp": []nat.PortBinding{
 				{
 					HostIP:   "",
-					HostPort: "aa80"},
+					HostPort: "aa80",
+				},
 			},
 		},
 	}
@@ -1662,8 +1662,7 @@ func (s *DockerAPISuite) TestContainersAPICreateMountsValidation(c *testing.T) {
 				Mounts: []mount.Mount{{
 					Type:   "notreal",
 					Target: destPath,
-				},
-				},
+				}},
 			},
 
 			msg: "mount type unknown",
@@ -1674,7 +1673,9 @@ func (s *DockerAPISuite) TestContainersAPICreateMountsValidation(c *testing.T) {
 			},
 			hostConfig: container.HostConfig{
 				Mounts: []mount.Mount{{
-					Type: "bind"}}},
+					Type: "bind",
+				}},
+			},
 			msg: "Target must not be empty",
 		},
 		{
@@ -1684,7 +1685,9 @@ func (s *DockerAPISuite) TestContainersAPICreateMountsValidation(c *testing.T) {
 			hostConfig: container.HostConfig{
 				Mounts: []mount.Mount{{
 					Type:   "bind",
-					Target: destPath}}},
+					Target: destPath,
+				}},
+			},
 			msg: "Source must not be empty",
 		},
 		{
@@ -1695,7 +1698,9 @@ func (s *DockerAPISuite) TestContainersAPICreateMountsValidation(c *testing.T) {
 				Mounts: []mount.Mount{{
 					Type:   "bind",
 					Source: notExistPath,
-					Target: destPath}}},
+					Target: destPath,
+				}},
+			},
 			msg: "source path does not exist",
 			// FIXME(vdemeester) fails into e2e, migrate to integration/container anyway
 			// msg: "source path does not exist: " + notExistPath,
@@ -1706,7 +1711,9 @@ func (s *DockerAPISuite) TestContainersAPICreateMountsValidation(c *testing.T) {
 			},
 			hostConfig: container.HostConfig{
 				Mounts: []mount.Mount{{
-					Type: "volume"}}},
+					Type: "volume",
+				}},
+			},
 			msg: "Target must not be empty",
 		},
 		{
@@ -1717,7 +1724,9 @@ func (s *DockerAPISuite) TestContainersAPICreateMountsValidation(c *testing.T) {
 				Mounts: []mount.Mount{{
 					Type:   "volume",
 					Source: "hello",
-					Target: destPath}}},
+					Target: destPath,
+				}},
+			},
 			msg: "",
 		},
 		{
@@ -1731,7 +1740,11 @@ func (s *DockerAPISuite) TestContainersAPICreateMountsValidation(c *testing.T) {
 					Target: destPath,
 					VolumeOptions: &mount.VolumeOptions{
 						DriverConfig: &mount.Driver{
-							Name: "local"}}}}},
+							Name: "local",
+						},
+					},
+				}},
+			},
 			msg: "",
 		},
 	}
@@ -1749,7 +1762,9 @@ func (s *DockerAPISuite) TestContainersAPICreateMountsValidation(c *testing.T) {
 					Mounts: []mount.Mount{{
 						Type:   "bind",
 						Source: tmpDir,
-						Target: destPath}}},
+						Target: destPath,
+					}},
+				},
 				msg: "",
 			},
 			{
@@ -1761,7 +1776,9 @@ func (s *DockerAPISuite) TestContainersAPICreateMountsValidation(c *testing.T) {
 						Type:          "bind",
 						Source:        tmpDir,
 						Target:        destPath,
-						VolumeOptions: &mount.VolumeOptions{}}}},
+						VolumeOptions: &mount.VolumeOptions{},
+					}},
+				},
 				msg: "VolumeOptions must not be specified",
 			},
 		}...)
@@ -1886,7 +1903,9 @@ func (s *DockerAPISuite) TestContainersAPICreateMountsValidation(c *testing.T) {
 				hostConfig: container.HostConfig{
 					Mounts: []mount.Mount{{
 						Type:   "tmpfs",
-						Target: destPath}}},
+						Target: destPath,
+					}},
+				},
 				msg: "",
 			},
 			{
@@ -1899,8 +1918,10 @@ func (s *DockerAPISuite) TestContainersAPICreateMountsValidation(c *testing.T) {
 						Target: destPath,
 						TmpfsOptions: &mount.TmpfsOptions{
 							SizeBytes: 4096 * 1024,
-							Mode:      0700,
-						}}}},
+							Mode:      0o700,
+						},
+					}},
+				},
 				msg: "",
 			},
 			{
@@ -1911,7 +1932,9 @@ func (s *DockerAPISuite) TestContainersAPICreateMountsValidation(c *testing.T) {
 					Mounts: []mount.Mount{{
 						Type:   "tmpfs",
 						Source: "/shouldnotbespecified",
-						Target: destPath}}},
+						Target: destPath,
+					}},
+				},
 				msg: "Source must not be specified",
 			},
 		}...)
@@ -1942,7 +1965,7 @@ func (s *DockerAPISuite) TestContainerAPICreateMountsBindRead(c *testing.T) {
 	tmpDir, err := os.MkdirTemp("", "test-mounts-api-bind")
 	assert.NilError(c, err)
 	defer os.RemoveAll(tmpDir)
-	err = os.WriteFile(filepath.Join(tmpDir, "bar"), []byte("hello"), 0666)
+	err = os.WriteFile(filepath.Join(tmpDir, "bar"), []byte("hello"), 0o666)
 	assert.NilError(c, err)
 	config := container.Config{
 		Image: "busybox",
@@ -1969,9 +1992,7 @@ func (s *DockerAPISuite) TestContainersAPICreateMountsCreate(c *testing.T) {
 	prefix, slash := getPrefixAndSlashFromDaemonPlatform()
 	destPath := prefix + slash + "foo"
 
-	var (
-		testImg string
-	)
+	var testImg string
 	if testEnv.DaemonInfo.OSType != "windows" {
 		testImg = "test-mount-config"
 		buildImageSuccessfully(c, testImg, build.WithDockerfile(`
@@ -2184,7 +2205,8 @@ func (s *DockerAPISuite) TestContainersAPICreateMountsTmpfs(c *testing.T) {
 		{
 			cfg: mount.Mount{
 				Type:   "tmpfs",
-				Target: target},
+				Target: target,
+			},
 			expectedOptions: []string{"rw", "nosuid", "nodev", "noexec", "relatime"},
 		},
 		{
@@ -2192,7 +2214,9 @@ func (s *DockerAPISuite) TestContainersAPICreateMountsTmpfs(c *testing.T) {
 				Type:   "tmpfs",
 				Target: target,
 				TmpfsOptions: &mount.TmpfsOptions{
-					SizeBytes: 4096 * 1024, Mode: 0700}},
+					SizeBytes: 4096 * 1024, Mode: 0o700,
+				},
+			},
 			expectedOptions: []string{"rw", "nosuid", "nodev", "noexec", "relatime", "size=4096k", "mode=700"},
 		},
 	}
diff --git a/integration-cli/docker_api_inspect_test.go b/integration-cli/docker_api_inspect_test.go
index fe2f7eeb6b..77727bd78c 100644
--- a/integration-cli/docker_api_inspect_test.go
+++ b/integration-cli/docker_api_inspect_test.go
@@ -17,8 +17,10 @@ func (s *DockerAPISuite) TestInspectAPIContainerResponse(c *testing.T) {
 	out, _ := dockerCmd(c, "run", "-d", "busybox", "true")
 
 	cleanedContainerID := strings.TrimSpace(out)
-	keysBase := []string{"Id", "State", "Created", "Path", "Args", "Config", "Image", "NetworkSettings",
-		"ResolvConfPath", "HostnamePath", "HostsPath", "LogPath", "Name", "Driver", "MountLabel", "ProcessLabel", "GraphDriver"}
+	keysBase := []string{
+		"Id", "State", "Created", "Path", "Args", "Config", "Image", "NetworkSettings",
+		"ResolvConfPath", "HostnamePath", "HostsPath", "LogPath", "Name", "Driver", "MountLabel", "ProcessLabel", "GraphDriver",
+	}
 
 	type acase struct {
 		version string
diff --git a/integration-cli/docker_api_stats_test.go b/integration-cli/docker_api_stats_test.go
index b5fb6ad296..9c717c44bb 100644
--- a/integration-cli/docker_api_stats_test.go
+++ b/integration-cli/docker_api_stats_test.go
@@ -40,7 +40,7 @@ func (s *DockerAPISuite) TestAPIStatsNoStreamGetCpu(c *testing.T) {
 	assert.NilError(c, err)
 	body.Close()
 
-	var cpuPercent = 0.0
+	cpuPercent := 0.0
 
 	if testEnv.DaemonInfo.OSType != "windows" {
 		cpuDelta := float64(v.CPUStats.CPUUsage.TotalUsage - v.PreCPUStats.CPUUsage.TotalUsage)
diff --git a/integration-cli/docker_api_swarm_test.go b/integration-cli/docker_api_swarm_test.go
index 088a9eaf35..67a34b76f6 100644
--- a/integration-cli/docker_api_swarm_test.go
+++ b/integration-cli/docker_api_swarm_test.go
@@ -732,9 +732,7 @@ func checkClusterHealth(c *testing.T, cl []*daemon.Daemon, managerCount, workerC
 	var totalMCount, totalWCount int
 
 	for _, d := range cl {
-		var (
-			info swarm.Info
-		)
+		var info swarm.Info
 
 		// check info in a poll.WaitOn(), because if the cluster doesn't have a leader, `info` will return an error
 		checkInfo := func(c *testing.T) (interface{}, string) {
diff --git a/integration-cli/docker_cli_build_test.go b/integration-cli/docker_cli_build_test.go
index 6052a04fe8..7e81df4e70 100644
--- a/integration-cli/docker_cli_build_test.go
+++ b/integration-cli/docker_cli_build_test.go
@@ -933,9 +933,7 @@ func (s *DockerCLIBuildSuite) TestBuildAddBadLinks(c *testing.T) {
 		ADD foo.txt /symlink/
 		`
 	targetFile := "foo.txt"
-	var (
-		name = "test-link-absolute"
-	)
+	name := "test-link-absolute"
 	ctx := fakecontext.New(c, "", fakecontext.WithDockerfile(dockerfile))
 	defer ctx.Close()
 
@@ -974,7 +972,7 @@ func (s *DockerCLIBuildSuite) TestBuildAddBadLinks(c *testing.T) {
 		Name:     "symlink",
 		Typeflag: tar.TypeSymlink,
 		Linkname: symlinkTarget,
-		Mode:     0755,
+		Mode:     0o755,
 		Uid:      0,
 		Gid:      0,
 	}
@@ -1061,7 +1059,7 @@ func (s *DockerCLIBuildSuite) TestBuildWithInaccessibleFilesInContext(c *testing
 		if err := os.Chown(pathToFileWithoutReadAccess, 0, 0); err != nil {
 			c.Fatalf("failed to chown file to root: %s", err)
 		}
-		if err := os.Chmod(pathToFileWithoutReadAccess, 0700); err != nil {
+		if err := os.Chmod(pathToFileWithoutReadAccess, 0o700); err != nil {
 			c.Fatalf("failed to chmod file to 700: %s", err)
 		}
 		result := icmd.RunCmd(icmd.Cmd{
@@ -1095,10 +1093,10 @@ func (s *DockerCLIBuildSuite) TestBuildWithInaccessibleFilesInContext(c *testing
 		if err := os.Chown(pathToDirectoryWithoutReadAccess, 0, 0); err != nil {
 			c.Fatalf("failed to chown directory to root: %s", err)
 		}
-		if err := os.Chmod(pathToDirectoryWithoutReadAccess, 0444); err != nil {
+		if err := os.Chmod(pathToDirectoryWithoutReadAccess, 0o444); err != nil {
 			c.Fatalf("failed to chmod directory to 444: %s", err)
 		}
-		if err := os.Chmod(pathToFileInDirectoryWithoutReadAccess, 0700); err != nil {
+		if err := os.Chmod(pathToFileInDirectoryWithoutReadAccess, 0o700); err != nil {
 			c.Fatalf("failed to chmod file to 700: %s", err)
 		}
 
@@ -1149,17 +1147,19 @@ func (s *DockerCLIBuildSuite) TestBuildWithInaccessibleFilesInContext(c *testing
 		if err := os.Chown(pathToDirectoryWithoutReadAccess, 0, 0); err != nil {
 			c.Fatalf("failed to chown directory to root: %s", err)
 		}
-		if err := os.Chmod(pathToDirectoryWithoutReadAccess, 0444); err != nil {
+		if err := os.Chmod(pathToDirectoryWithoutReadAccess, 0o444); err != nil {
 			c.Fatalf("failed to chmod directory to 444: %s", err)
 		}
-		if err := os.Chmod(pathToFileInDirectoryWithoutReadAccess, 0700); err != nil {
+		if err := os.Chmod(pathToFileInDirectoryWithoutReadAccess, 0o700); err != nil {
 			c.Fatalf("failed to chmod file to 700: %s", err)
 		}
 
 		result := icmd.RunCmd(icmd.Cmd{
 			Dir: ctx.Dir,
-			Command: []string{"su", "unprivilegeduser", "-c",
-				fmt.Sprintf("%s build -t %s .", dockerBinary, name)},
+			Command: []string{
+				"su", "unprivilegeduser", "-c",
+				fmt.Sprintf("%s build -t %s .", dockerBinary, name),
+			},
 		})
 		result.Assert(c, icmd.Expected{})
 	}
@@ -2061,7 +2061,7 @@ func (s *DockerCLIBuildSuite) TestBuildDockerfileStdin(c *testing.T) {
 	name := "stdindockerfile"
 	tmpDir, err := os.MkdirTemp("", "fake-context")
 	assert.NilError(c, err)
-	err = os.WriteFile(filepath.Join(tmpDir, "foo"), []byte("bar"), 0600)
+	err = os.WriteFile(filepath.Join(tmpDir, "foo"), []byte("bar"), 0o600)
 	assert.NilError(c, err)
 
 	icmd.RunCmd(icmd.Cmd{
@@ -2106,7 +2106,7 @@ func (s *DockerCLIBuildSuite) testBuildDockerfileStdinNoExtraFiles(c *testing.T,
 	defer os.RemoveAll(tmpDir)
 
 	writeFile := func(filename, content string) {
-		err = os.WriteFile(filepath.Join(tmpDir, filename), []byte(content), 0600)
+		err = os.WriteFile(filepath.Join(tmpDir, filename), []byte(content), 0o600)
 		assert.NilError(c, err)
 	}
 
@@ -2856,7 +2856,7 @@ RUN cat /existing-directory-trailing-slash/test/foo | grep Hi`
 			c.Fatalf("failed to close tar archive: %v", err)
 		}
 
-		if err := os.WriteFile(filepath.Join(tmpDir, "Dockerfile"), []byte(dockerfile), 0644); err != nil {
+		if err := os.WriteFile(filepath.Join(tmpDir, "Dockerfile"), []byte(dockerfile), 0o644); err != nil {
 			c.Fatalf("failed to open destination dockerfile: %v", err)
 		}
 		return fakecontext.New(c, tmpDir)
@@ -2905,7 +2905,7 @@ ADD test.tar /`
 			c.Fatalf("failed to truncate tar archive: %v", err)
 		}
 
-		if err := os.WriteFile(filepath.Join(tmpDir, "Dockerfile"), []byte(dockerfile), 0644); err != nil {
+		if err := os.WriteFile(filepath.Join(tmpDir, "Dockerfile"), []byte(dockerfile), 0o644); err != nil {
 			c.Fatalf("failed to open destination dockerfile: %v", err)
 		}
 		return fakecontext.New(c, tmpDir)
@@ -2968,7 +2968,7 @@ func (s *DockerCLIBuildSuite) TestBuildAddTarXz(c *testing.T) {
 			Command: []string{"xz", "-k", "test.tar"},
 			Dir:     tmpDir,
 		}).Assert(c, icmd.Success)
-		if err := os.WriteFile(filepath.Join(tmpDir, "Dockerfile"), []byte(dockerfile), 0644); err != nil {
+		if err := os.WriteFile(filepath.Join(tmpDir, "Dockerfile"), []byte(dockerfile), 0o644); err != nil {
 			c.Fatalf("failed to open destination dockerfile: %v", err)
 		}
 		return fakecontext.New(c, tmpDir)
@@ -3020,7 +3020,7 @@ func (s *DockerCLIBuildSuite) TestBuildAddTarXzGz(c *testing.T) {
 			Command: []string{"gzip", "test.tar.xz"},
 			Dir:     tmpDir,
 		})
-		if err := os.WriteFile(filepath.Join(tmpDir, "Dockerfile"), []byte(dockerfile), 0644); err != nil {
+		if err := os.WriteFile(filepath.Join(tmpDir, "Dockerfile"), []byte(dockerfile), 0o644); err != nil {
 			c.Fatalf("failed to open destination dockerfile: %v", err)
 		}
 		return fakecontext.New(c, tmpDir)
@@ -3587,18 +3587,18 @@ func (s *DockerCLIBuildSuite) TestBuildSymlinkBreakout(c *testing.T) {
 
 	defer os.RemoveAll(tmpdir)
 	ctx := filepath.Join(tmpdir, "context")
-	if err := os.MkdirAll(ctx, 0755); err != nil {
+	if err := os.MkdirAll(ctx, 0o755); err != nil {
 		c.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(ctx, "Dockerfile"), []byte(`
 	from busybox
 	add symlink.tar /
 	add inject /symlink/
-	`), 0644); err != nil {
+	`), 0o644); err != nil {
 		c.Fatal(err)
 	}
 	inject := filepath.Join(ctx, "inject")
-	if err := os.WriteFile(inject, nil, 0644); err != nil {
+	if err := os.WriteFile(inject, nil, 0o644); err != nil {
 		c.Fatal(err)
 	}
 	f, err := os.Create(filepath.Join(ctx, "symlink.tar"))
@@ -4747,7 +4747,7 @@ func (s *DockerCLIBuildSuite) TestBuildCacheBrokenSymlink(c *testing.T) {
 	cli.BuildCmd(c, name, build.WithExternalBuildContext(ctx))
 
 	// add new file to context, should invalidate cache
-	err = os.WriteFile(filepath.Join(ctx.Dir, "newfile"), []byte("foo"), 0644)
+	err = os.WriteFile(filepath.Join(ctx.Dir, "newfile"), []byte("foo"), 0o644)
 	assert.NilError(c, err)
 
 	result := cli.BuildCmd(c, name, build.WithExternalBuildContext(ctx))
@@ -4776,14 +4776,13 @@ func (s *DockerCLIBuildSuite) TestBuildFollowSymlinkToFile(c *testing.T) {
 	assert.Assert(c, cmp.Regexp("^bar$", out))
 
 	// change target file should invalidate cache
-	err = os.WriteFile(filepath.Join(ctx.Dir, "foo"), []byte("baz"), 0644)
+	err = os.WriteFile(filepath.Join(ctx.Dir, "foo"), []byte("baz"), 0o644)
 	assert.NilError(c, err)
 
 	result := cli.BuildCmd(c, name, build.WithExternalBuildContext(ctx))
 	assert.Assert(c, !strings.Contains(result.Combined(), "Using cache"))
 	out = cli.DockerCmd(c, "run", "--rm", name, "cat", "target").Combined()
 	assert.Assert(c, cmp.Regexp("^baz$", out))
-
 }
 
 func (s *DockerCLIBuildSuite) TestBuildFollowSymlinkToDir(c *testing.T) {
@@ -4807,7 +4806,7 @@ func (s *DockerCLIBuildSuite) TestBuildFollowSymlinkToDir(c *testing.T) {
 	assert.Assert(c, cmp.Regexp("^barbaz$", out))
 
 	// change target file should invalidate cache
-	err = os.WriteFile(filepath.Join(ctx.Dir, "foo/def"), []byte("bax"), 0644)
+	err = os.WriteFile(filepath.Join(ctx.Dir, "foo/def"), []byte("bax"), 0o644)
 	assert.NilError(c, err)
 
 	result := cli.BuildCmd(c, name, build.WithExternalBuildContext(ctx))
@@ -4854,7 +4853,7 @@ func (s *DockerCLIBuildSuite) TestBuildCacheRootSource(c *testing.T) {
 	cli.BuildCmd(c, name, build.WithExternalBuildContext(ctx))
 
 	// change file, should invalidate cache
-	err := os.WriteFile(filepath.Join(ctx.Dir, "foo"), []byte("baz"), 0644)
+	err := os.WriteFile(filepath.Join(ctx.Dir, "foo"), []byte("baz"), 0o644)
 	assert.NilError(c, err)
 
 	result := cli.BuildCmd(c, name, build.WithExternalBuildContext(ctx))
@@ -5004,7 +5003,7 @@ func (s *DockerRegistryAuthHtpasswdSuite) TestBuildWithExternalAuth(c *testing.T
 	externalAuthConfig := `{ "credsStore": "shell-test" }`
 
 	configPath := filepath.Join(tmp, "config.json")
-	err = os.WriteFile(configPath, []byte(externalAuthConfig), 0644)
+	err = os.WriteFile(configPath, []byte(externalAuthConfig), 0o644)
 	assert.NilError(c, err)
 
 	dockerCmd(c, "--config", tmp, "login", "-u", s.reg.Username(), "-p", s.reg.Password(), privateRegistryURL)
@@ -5464,7 +5463,7 @@ func (s *DockerCLIBuildSuite) TestBuildCacheFrom(c *testing.T) {
 		ENV FOO=bar
 		ADD baz /
 		RUN touch newfile`
-	err = os.WriteFile(filepath.Join(ctx.Dir, "Dockerfile"), []byte(dockerfile), 0644)
+	err = os.WriteFile(filepath.Join(ctx.Dir, "Dockerfile"), []byte(dockerfile), 0o644)
 	assert.NilError(c, err)
 
 	result = cli.BuildCmd(c, "build2", cli.WithFlags("--cache-from=build1"), build.WithExternalBuildContext(ctx))
@@ -5621,14 +5620,14 @@ func (s *DockerCLIBuildSuite) TestBuildMultiStageCopyFromSyntax(c *testing.T) {
 	assert.Equal(c, strings.Count(result.Combined(), "Using cache"), 7)
 	assert.Equal(c, getIDByName(c, "build1"), getIDByName(c, "build2"))
 
-	err := os.WriteFile(filepath.Join(ctx.Dir, "Dockerfile"), []byte(fmt.Sprintf(dockerfile, "COPY baz/aa foo")), 0644)
+	err := os.WriteFile(filepath.Join(ctx.Dir, "Dockerfile"), []byte(fmt.Sprintf(dockerfile, "COPY baz/aa foo")), 0o644)
 	assert.NilError(c, err)
 
 	// changing file in parent block should not affect last block
 	result = cli.BuildCmd(c, "build3", build.WithExternalBuildContext(ctx))
 	assert.Equal(c, strings.Count(result.Combined(), "Using cache"), 5)
 
-	err = os.WriteFile(filepath.Join(ctx.Dir, "foo"), []byte("pqr"), 0644)
+	err = os.WriteFile(filepath.Join(ctx.Dir, "foo"), []byte("pqr"), 0o644)
 	assert.NilError(c, err)
 
 	// changing file in parent block should affect both first and last block
@@ -6145,7 +6144,7 @@ func (s *DockerCLIBuildSuite) TestBuildIidFileCleanupOnFail(c *testing.T) {
 	defer os.RemoveAll(tmpDir)
 	tmpIidFile := filepath.Join(tmpDir, "iid")
 
-	err = os.WriteFile(tmpIidFile, []byte("Dummy"), 0666)
+	err = os.WriteFile(tmpIidFile, []byte("Dummy"), 0o666)
 	assert.NilError(c, err)
 
 	cli.Docker(cli.Args("build", "-t", "testbuildiidfilecleanuponfail"),
diff --git a/integration-cli/docker_cli_build_unix_test.go b/integration-cli/docker_cli_build_unix_test.go
index 94909bd0b2..6b1667c93f 100644
--- a/integration-cli/docker_cli_build_unix_test.go
+++ b/integration-cli/docker_cli_build_unix_test.go
@@ -107,7 +107,7 @@ func (s *DockerCLIBuildSuite) TestBuildAddChangeOwnership(c *testing.T) {
 			Dir:     tmpDir,
 		}).Assert(c, icmd.Success)
 
-		if err := os.WriteFile(filepath.Join(tmpDir, "Dockerfile"), []byte(dockerfile), 0644); err != nil {
+		if err := os.WriteFile(filepath.Join(tmpDir, "Dockerfile"), []byte(dockerfile), 0o644); err != nil {
 			c.Fatalf("failed to open destination dockerfile: %v", err)
 		}
 		return fakecontext.New(c, tmpDir)
diff --git a/integration-cli/docker_cli_cp_from_container_test.go b/integration-cli/docker_cli_cp_from_container_test.go
index 997655cfe5..fc1999ca07 100644
--- a/integration-cli/docker_cli_cp_from_container_test.go
+++ b/integration-cli/docker_cli_cp_from_container_test.go
@@ -182,7 +182,7 @@ func (s *DockerCLICpSuite) TestCpFromCaseD(c *testing.T) {
 	// Now try again but using a trailing path separator for dstDir.
 
 	assert.NilError(c, os.RemoveAll(dstDir), "unable to remove dstDir")
-	assert.NilError(c, os.MkdirAll(dstDir, os.FileMode(0755)), "unable to make dstDir")
+	assert.NilError(c, os.MkdirAll(dstDir, os.FileMode(0o755)), "unable to make dstDir")
 
 	dstDir = cpPathTrailingSep(tmpDir, "dir1")
 
@@ -268,7 +268,7 @@ func (s *DockerCLICpSuite) TestCpFromCaseG(c *testing.T) {
 	// Now try again but using a trailing path separator for dstDir.
 
 	assert.NilError(c, os.RemoveAll(dstDir), "unable to remove dstDir")
-	assert.NilError(c, os.MkdirAll(dstDir, os.FileMode(0755)), "unable to make dstDir")
+	assert.NilError(c, os.MkdirAll(dstDir, os.FileMode(0o755)), "unable to make dstDir")
 
 	dstDir = cpPathTrailingSep(tmpDir, "dir2")
 
@@ -354,7 +354,7 @@ func (s *DockerCLICpSuite) TestCpFromCaseJ(c *testing.T) {
 	// Now try again but using a trailing path separator for dstDir.
 
 	assert.NilError(c, os.RemoveAll(dstDir), "unable to remove dstDir")
-	assert.NilError(c, os.MkdirAll(dstDir, os.FileMode(0755)), "unable to make dstDir")
+	assert.NilError(c, os.MkdirAll(dstDir, os.FileMode(0o755)), "unable to make dstDir")
 
 	dstDir = cpPathTrailingSep(tmpDir, "dir2")
 
diff --git a/integration-cli/docker_cli_cp_test.go b/integration-cli/docker_cli_cp_test.go
index 47d40a9ac3..d3be41d665 100644
--- a/integration-cli/docker_cli_cp_test.go
+++ b/integration-cli/docker_cli_cp_test.go
@@ -265,8 +265,8 @@ func (s *DockerCLICpSuite) TestCpToSymlinkToDirectory(c *testing.T) {
 	// This file will be at "/testDir/some/path/test" and will be copied into
 	// the test volume later.
 	hostTestFilename := filepath.Join(testDir, cpFullPath)
-	assert.NilError(c, os.MkdirAll(filepath.Dir(hostTestFilename), os.FileMode(0700)))
-	assert.NilError(c, os.WriteFile(hostTestFilename, []byte(cpHostContents), os.FileMode(0600)))
+	assert.NilError(c, os.MkdirAll(filepath.Dir(hostTestFilename), os.FileMode(0o700)))
+	assert.NilError(c, os.WriteFile(hostTestFilename, []byte(cpHostContents), os.FileMode(0o600)))
 
 	// Now create another temp directory to hold a symlink to the
 	// "/testDir/some" directory.
@@ -375,7 +375,7 @@ func (s *DockerCLICpSuite) TestCpUnprivilegedUser(c *testing.T) {
 
 	defer os.RemoveAll(tmpdir)
 
-	err = os.Chmod(tmpdir, 0777)
+	err = os.Chmod(tmpdir, 0o777)
 	assert.NilError(c, err)
 
 	result := icmd.RunCommand("su", "unprivilegeduser", "-c",
diff --git a/integration-cli/docker_cli_cp_utils_test.go b/integration-cli/docker_cli_cp_utils_test.go
index 562409fdfa..a62638b2a0 100644
--- a/integration-cli/docker_cli_cp_utils_test.go
+++ b/integration-cli/docker_cli_cp_utils_test.go
@@ -59,33 +59,33 @@ func mkFilesCommand(fds []fileData) string {
 }
 
 var defaultFileData = []fileData{
-	{ftRegular, "file1", "file1", 0, 0, 0666},
-	{ftRegular, "file2", "file2", 0, 0, 0666},
-	{ftRegular, "file3", "file3", 0, 0, 0666},
-	{ftRegular, "file4", "file4", 0, 0, 0666},
-	{ftRegular, "file5", "file5", 0, 0, 0666},
-	{ftRegular, "file6", "file6", 0, 0, 0666},
-	{ftRegular, "file7", "file7", 0, 0, 0666},
-	{ftDir, "dir1", "", 0, 0, 0777},
-	{ftRegular, "dir1/file1-1", "file1-1", 0, 0, 0666},
-	{ftRegular, "dir1/file1-2", "file1-2", 0, 0, 0666},
-	{ftDir, "dir2", "", 0, 0, 0666},
-	{ftRegular, "dir2/file2-1", "file2-1", 0, 0, 0666},
-	{ftRegular, "dir2/file2-2", "file2-2", 0, 0, 0666},
-	{ftDir, "dir3", "", 0, 0, 0666},
-	{ftRegular, "dir3/file3-1", "file3-1", 0, 0, 0666},
-	{ftRegular, "dir3/file3-2", "file3-2", 0, 0, 0666},
-	{ftDir, "dir4", "", 0, 0, 0666},
-	{ftRegular, "dir4/file3-1", "file4-1", 0, 0, 0666},
-	{ftRegular, "dir4/file3-2", "file4-2", 0, 0, 0666},
-	{ftDir, "dir5", "", 0, 0, 0666},
-	{ftSymlink, "symlinkToFile1", "file1", 0, 0, 0666},
-	{ftSymlink, "symlinkToDir1", "dir1", 0, 0, 0666},
-	{ftSymlink, "brokenSymlinkToFileX", "fileX", 0, 0, 0666},
-	{ftSymlink, "brokenSymlinkToDirX", "dirX", 0, 0, 0666},
-	{ftSymlink, "symlinkToAbsDir", "/root", 0, 0, 0666},
-	{ftDir, "permdirtest", "", 2, 2, 0700},
-	{ftRegular, "permdirtest/permtest", "perm_test", 65534, 65534, 0400},
+	{ftRegular, "file1", "file1", 0, 0, 0o666},
+	{ftRegular, "file2", "file2", 0, 0, 0o666},
+	{ftRegular, "file3", "file3", 0, 0, 0o666},
+	{ftRegular, "file4", "file4", 0, 0, 0o666},
+	{ftRegular, "file5", "file5", 0, 0, 0o666},
+	{ftRegular, "file6", "file6", 0, 0, 0o666},
+	{ftRegular, "file7", "file7", 0, 0, 0o666},
+	{ftDir, "dir1", "", 0, 0, 0o777},
+	{ftRegular, "dir1/file1-1", "file1-1", 0, 0, 0o666},
+	{ftRegular, "dir1/file1-2", "file1-2", 0, 0, 0o666},
+	{ftDir, "dir2", "", 0, 0, 0o666},
+	{ftRegular, "dir2/file2-1", "file2-1", 0, 0, 0o666},
+	{ftRegular, "dir2/file2-2", "file2-2", 0, 0, 0o666},
+	{ftDir, "dir3", "", 0, 0, 0o666},
+	{ftRegular, "dir3/file3-1", "file3-1", 0, 0, 0o666},
+	{ftRegular, "dir3/file3-2", "file3-2", 0, 0, 0o666},
+	{ftDir, "dir4", "", 0, 0, 0o666},
+	{ftRegular, "dir4/file3-1", "file4-1", 0, 0, 0o666},
+	{ftRegular, "dir4/file3-2", "file4-2", 0, 0, 0o666},
+	{ftDir, "dir5", "", 0, 0, 0o666},
+	{ftSymlink, "symlinkToFile1", "file1", 0, 0, 0o666},
+	{ftSymlink, "symlinkToDir1", "dir1", 0, 0, 0o666},
+	{ftSymlink, "brokenSymlinkToFileX", "fileX", 0, 0, 0o666},
+	{ftSymlink, "brokenSymlinkToDirX", "dirX", 0, 0, 0o666},
+	{ftSymlink, "symlinkToAbsDir", "/root", 0, 0, 0o666},
+	{ftDir, "permdirtest", "", 2, 2, 0o700},
+	{ftRegular, "permdirtest/permtest", "perm_test", 65534, 65534, 0o400},
 }
 
 func defaultMkContentCommand() string {
diff --git a/integration-cli/docker_cli_daemon_test.go b/integration-cli/docker_cli_daemon_test.go
index de9d8e6c42..b0d7528cc5 100644
--- a/integration-cli/docker_cli_daemon_test.go
+++ b/integration-cli/docker_cli_daemon_test.go
@@ -2215,7 +2215,7 @@ func (s *DockerDaemonSuite) TestRunWithRuntimeFromConfigFile(c *testing.T) {
     }
 }
 `
-	os.WriteFile(configName, []byte(config), 0644)
+	os.WriteFile(configName, []byte(config), 0o644)
 	s.d.StartWithBusybox(c, "--config-file", configName)
 
 	// Run with default runtime
@@ -2241,7 +2241,7 @@ func (s *DockerDaemonSuite) TestRunWithRuntimeFromConfigFile(c *testing.T) {
     }
 }
 `
-	os.WriteFile(configName, []byte(config), 0644)
+	os.WriteFile(configName, []byte(config), 0o644)
 	assert.Assert(c, s.d.Signal(unix.SIGHUP) == nil)
 	// Give daemon time to reload config
 	<-time.After(1 * time.Second)
@@ -2268,7 +2268,7 @@ func (s *DockerDaemonSuite) TestRunWithRuntimeFromConfigFile(c *testing.T) {
     }
 }
 `
-	os.WriteFile(configName, []byte(config), 0644)
+	os.WriteFile(configName, []byte(config), 0o644)
 	assert.Assert(c, s.d.Signal(unix.SIGHUP) == nil)
 	// Give daemon time to reload config
 	<-time.After(1 * time.Second)
@@ -2293,7 +2293,7 @@ func (s *DockerDaemonSuite) TestRunWithRuntimeFromConfigFile(c *testing.T) {
     }
 }
 `
-	os.WriteFile(configName, []byte(config), 0644)
+	os.WriteFile(configName, []byte(config), 0o644)
 	assert.Assert(c, s.d.Signal(unix.SIGHUP) == nil)
 	// Give daemon time to reload config
 	<-time.After(1 * time.Second)
@@ -2654,7 +2654,7 @@ func (s *DockerDaemonSuite) TestShmSizeReload(c *testing.T) {
 
 	size := 67108864 * 2
 	configData := []byte(fmt.Sprintf(`{"default-shm-size": "%dM"}`, size/1024/1024))
-	assert.Assert(c, os.WriteFile(configFile, configData, 0666) == nil, "could not write temp file for config reload")
+	assert.Assert(c, os.WriteFile(configFile, configData, 0o666) == nil, "could not write temp file for config reload")
 	pattern := regexp.MustCompile(fmt.Sprintf("shm on /dev/shm type tmpfs(.*)size=%dk", size/1024))
 
 	s.d.StartWithBusybox(c, "--config-file", configFile)
@@ -2669,7 +2669,7 @@ func (s *DockerDaemonSuite) TestShmSizeReload(c *testing.T) {
 
 	size = 67108864 * 3
 	configData = []byte(fmt.Sprintf(`{"default-shm-size": "%dM"}`, size/1024/1024))
-	assert.Assert(c, os.WriteFile(configFile, configData, 0666) == nil, "could not write temp file for config reload")
+	assert.Assert(c, os.WriteFile(configFile, configData, 0o666) == nil, "could not write temp file for config reload")
 	pattern = regexp.MustCompile(fmt.Sprintf("shm on /dev/shm type tmpfs(.*)size=%dk", size/1024))
 
 	err = s.d.ReloadConfig()
diff --git a/integration-cli/docker_cli_events_unix_test.go b/integration-cli/docker_cli_events_unix_test.go
index e98e0930c3..5a5b44636d 100644
--- a/integration-cli/docker_cli_events_unix_test.go
+++ b/integration-cli/docker_cli_events_unix_test.go
@@ -395,14 +395,14 @@ func (s *DockerDaemonSuite) TestDaemonEvents(c *testing.T) {
 	defer os.Remove(configFilePath)
 
 	daemonConfig := `{"labels":["foo=bar"]}`
-	err := os.WriteFile(configFilePath, []byte(daemonConfig), 0644)
+	err := os.WriteFile(configFilePath, []byte(daemonConfig), 0o644)
 	assert.NilError(c, err)
 	s.d.Start(c, "--config-file="+configFilePath)
 
 	info := s.d.Info(c)
 
 	daemonConfig = `{"max-concurrent-downloads":1,"labels":["bar=foo"], "shutdown-timeout": 10}`
-	err = os.WriteFile(configFilePath, []byte(daemonConfig), 0644)
+	err = os.WriteFile(configFilePath, []byte(daemonConfig), 0o644)
 	assert.NilError(c, err)
 
 	assert.NilError(c, s.d.Signal(unix.SIGHUP))
@@ -442,7 +442,7 @@ func (s *DockerDaemonSuite) TestDaemonEventsWithFilters(c *testing.T) {
 	defer os.Remove(configFilePath)
 
 	daemonConfig := `{"labels":["foo=bar"]}`
-	err := os.WriteFile(configFilePath, []byte(daemonConfig), 0644)
+	err := os.WriteFile(configFilePath, []byte(daemonConfig), 0o644)
 	assert.NilError(c, err)
 	s.d.Start(c, "--config-file="+configFilePath)
 
diff --git a/integration-cli/docker_cli_exec_test.go b/integration-cli/docker_cli_exec_test.go
index 5f6752ef35..7b5b139665 100644
--- a/integration-cli/docker_cli_exec_test.go
+++ b/integration-cli/docker_cli_exec_test.go
@@ -408,7 +408,7 @@ func (s *DockerCLIExecSuite) TestRunMutableNetworkFiles(c *testing.T) {
 		contID := strings.TrimSpace(out)
 		netFilePath := containerStorageFile(contID, fn)
 
-		f, err := os.OpenFile(netFilePath, os.O_WRONLY|os.O_SYNC|os.O_APPEND, 0644)
+		f, err := os.OpenFile(netFilePath, os.O_WRONLY|os.O_SYNC|os.O_APPEND, 0o644)
 		assert.NilError(c, err)
 
 		if _, err := f.Seek(0, 0); err != nil {
diff --git a/integration-cli/docker_cli_external_volume_driver_test.go b/integration-cli/docker_cli_external_volume_driver_test.go
index 46a5555e57..51480c88e7 100644
--- a/integration-cli/docker_cli_external_volume_driver_test.go
+++ b/integration-cli/docker_cli_external_volume_driver_test.go
@@ -216,17 +216,17 @@ func newVolumePlugin(c *testing.T, name string) *volumePlugin {
 		}
 
 		p := hostVolumePath(pr.Name)
-		if err := os.MkdirAll(p, 0755); err != nil {
+		if err := os.MkdirAll(p, 0o755); err != nil {
 			send(w, &pluginResp{Err: err.Error()})
 			return
 		}
 
-		if err := os.WriteFile(filepath.Join(p, "test"), []byte(s.Server.URL), 0644); err != nil {
+		if err := os.WriteFile(filepath.Join(p, "test"), []byte(s.Server.URL), 0o644); err != nil {
 			send(w, err)
 			return
 		}
 
-		if err := os.WriteFile(filepath.Join(p, "mountID"), []byte(pr.ID), 0644); err != nil {
+		if err := os.WriteFile(filepath.Join(p, "mountID"), []byte(pr.ID), 0o644); err != nil {
 			send(w, err)
 			return
 		}
@@ -258,10 +258,10 @@ func newVolumePlugin(c *testing.T, name string) *volumePlugin {
 		send(w, `{"Capabilities": { "Scope": "global" }}`)
 	})
 
-	err := os.MkdirAll("/etc/docker/plugins", 0755)
+	err := os.MkdirAll("/etc/docker/plugins", 0o755)
 	assert.NilError(c, err)
 
-	err = os.WriteFile("/etc/docker/plugins/"+name+".spec", []byte(s.Server.URL), 0644)
+	err = os.WriteFile("/etc/docker/plugins/"+name+".spec", []byte(s.Server.URL), 0o644)
 	assert.NilError(c, err)
 	return s
 }
@@ -360,7 +360,7 @@ func hostVolumePath(name string) string {
 // Make sure a request to use a down driver doesn't block other requests
 func (s *DockerExternalVolumeSuite) TestExternalVolumeDriverLookupNotBlocked(c *testing.T) {
 	specPath := "/etc/docker/plugins/down-driver.spec"
-	err := os.WriteFile(specPath, []byte("tcp://127.0.0.7:9999"), 0644)
+	err := os.WriteFile(specPath, []byte("tcp://127.0.0.7:9999"), 0o644)
 	assert.NilError(c, err)
 	defer os.RemoveAll(specPath)
 
diff --git a/integration-cli/docker_cli_images_test.go b/integration-cli/docker_cli_images_test.go
index b77f62e2d2..61d890cc96 100644
--- a/integration-cli/docker_cli_images_test.go
+++ b/integration-cli/docker_cli_images_test.go
@@ -367,7 +367,7 @@ func (s *DockerCLIImagesSuite) TestImagesFormatDefaultFormat(c *testing.T) {
 	assert.NilError(c, err)
 	defer os.RemoveAll(d)
 
-	err = os.WriteFile(filepath.Join(d, "config.json"), []byte(config), 0644)
+	err = os.WriteFile(filepath.Join(d, "config.json"), []byte(config), 0o644)
 	assert.NilError(c, err)
 
 	out, _ = dockerCmd(c, "--config", d, "images", "-q", "myimage")
diff --git a/integration-cli/docker_cli_links_test.go b/integration-cli/docker_cli_links_test.go
index bdcd4c59a5..4ed2d6c592 100644
--- a/integration-cli/docker_cli_links_test.go
+++ b/integration-cli/docker_cli_links_test.go
@@ -110,7 +110,7 @@ func (s *DockerCLILinksSuite) TestLinksInspectLinksStarted(c *testing.T) {
 	err := json.Unmarshal([]byte(links), &result)
 	assert.NilError(c, err)
 
-	var expected = []string{
+	expected := []string{
 		"/container1:/testinspectlink/alias1",
 		"/container2:/testinspectlink/alias2",
 	}
@@ -130,7 +130,7 @@ func (s *DockerCLILinksSuite) TestLinksInspectLinksStopped(c *testing.T) {
 	err := json.Unmarshal([]byte(links), &result)
 	assert.NilError(c, err)
 
-	var expected = []string{
+	expected := []string{
 		"/container1:/testinspectlink/alias1",
 		"/container2:/testinspectlink/alias2",
 	}
diff --git a/integration-cli/docker_cli_logout_test.go b/integration-cli/docker_cli_logout_test.go
index ef11655287..6f667006f5 100644
--- a/integration-cli/docker_cli_logout_test.go
+++ b/integration-cli/docker_cli_logout_test.go
@@ -33,7 +33,7 @@ func (s *DockerRegistryAuthHtpasswdSuite) TestLogoutWithExternalAuth(c *testing.
 	externalAuthConfig := `{ "credsStore": "shell-test" }`
 
 	configPath := filepath.Join(tmp, "config.json")
-	err = os.WriteFile(configPath, []byte(externalAuthConfig), 0644)
+	err = os.WriteFile(configPath, []byte(externalAuthConfig), 0o644)
 	assert.NilError(c, err)
 
 	_, err = s.d.Cmd("--config", tmp, "login", "-u", s.reg.Username(), "-p", s.reg.Password(), privateRegistryURL)
@@ -83,7 +83,7 @@ func (s *DockerRegistryAuthHtpasswdSuite) TestLogoutWithWrongHostnamesStored(c *
 	externalAuthConfig := fmt.Sprintf(`{ "auths": {"https://%s": {}}, "credsStore": "shell-test" }`, privateRegistryURL)
 
 	configPath := filepath.Join(tmp, "config.json")
-	err = os.WriteFile(configPath, []byte(externalAuthConfig), 0644)
+	err = os.WriteFile(configPath, []byte(externalAuthConfig), 0o644)
 	assert.NilError(c, err)
 
 	dockerCmd(c, "--config", tmp, "login", "-u", s.reg.Username(), "-p", s.reg.Password(), privateRegistryURL)
diff --git a/integration-cli/docker_cli_network_unix_test.go b/integration-cli/docker_cli_network_unix_test.go
index 6cdfad02ff..b6653521e2 100644
--- a/integration-cli/docker_cli_network_unix_test.go
+++ b/integration-cli/docker_cli_network_unix_test.go
@@ -31,8 +31,10 @@ import (
 	"gotest.tools/v3/icmd"
 )
 
-const dummyNetworkDriver = "dummy-network-driver"
-const dummyIPAMDriver = "dummy-ipam-driver"
+const (
+	dummyNetworkDriver = "dummy-network-driver"
+	dummyIPAMDriver    = "dummy-ipam-driver"
+)
 
 var remoteDriverNetworkRequest remoteapi.CreateNetworkRequest
 
@@ -90,7 +92,8 @@ func setupRemoteNetworkDrivers(c *testing.T, mux *http.ServeMux, url, netDrv, ip
 		w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
 
 		veth := &netlink.Veth{
-			LinkAttrs: netlink.LinkAttrs{Name: "randomIfName", TxQLen: 0}, PeerName: "cnt0"}
+			LinkAttrs: netlink.LinkAttrs{Name: "randomIfName", TxQLen: 0}, PeerName: "cnt0",
+		}
 		if err := netlink.LinkAdd(veth); err != nil {
 			fmt.Fprintf(w, `{"Error":"failed to add veth pair: `+err.Error()+`"}`)
 		} else {
@@ -194,15 +197,15 @@ func setupRemoteNetworkDrivers(c *testing.T, mux *http.ServeMux, url, netDrv, ip
 		}
 	})
 
-	err := os.MkdirAll("/etc/docker/plugins", 0755)
+	err := os.MkdirAll("/etc/docker/plugins", 0o755)
 	assert.NilError(c, err)
 
 	fileName := fmt.Sprintf("/etc/docker/plugins/%s.spec", netDrv)
-	err = os.WriteFile(fileName, []byte(url), 0644)
+	err = os.WriteFile(fileName, []byte(url), 0o644)
 	assert.NilError(c, err)
 
 	ipamFileName := fmt.Sprintf("/etc/docker/plugins/%s.spec", ipamDrv)
-	err = os.WriteFile(ipamFileName, []byte(url), 0644)
+	err = os.WriteFile(ipamFileName, []byte(url), 0o644)
 	assert.NilError(c, err)
 }
 
diff --git a/integration-cli/docker_cli_plugins_test.go b/integration-cli/docker_cli_plugins_test.go
index bccf574f22..48ad7fcf00 100644
--- a/integration-cli/docker_cli_plugins_test.go
+++ b/integration-cli/docker_cli_plugins_test.go
@@ -261,10 +261,10 @@ func (ps *DockerPluginSuite) TestPluginCreate(c *testing.T) {
 	defer os.RemoveAll(temp)
 
 	data := `{"description": "foo plugin"}`
-	err = os.WriteFile(filepath.Join(temp, "config.json"), []byte(data), 0644)
+	err = os.WriteFile(filepath.Join(temp, "config.json"), []byte(data), 0o644)
 	assert.NilError(c, err)
 
-	err = os.MkdirAll(filepath.Join(temp, "rootfs"), 0700)
+	err = os.MkdirAll(filepath.Join(temp, "rootfs"), 0o700)
 	assert.NilError(c, err)
 
 	out, _, err := dockerCmdWithError("plugin", "create", name, temp)
@@ -400,7 +400,7 @@ func (ps *DockerPluginSuite) TestPluginListDefaultFormat(c *testing.T) {
 	assert.NilError(c, err)
 	defer os.RemoveAll(config)
 
-	err = os.WriteFile(filepath.Join(config, "config.json"), []byte(`{"pluginsFormat": "raw"}`), 0644)
+	err = os.WriteFile(filepath.Join(config, "config.json"), []byte(`{"pluginsFormat": "raw"}`), 0o644)
 	assert.NilError(c, err)
 
 	name := "test:latest"
diff --git a/integration-cli/docker_cli_prune_unix_test.go b/integration-cli/docker_cli_prune_unix_test.go
index 1c029878e1..6e2162091f 100644
--- a/integration-cli/docker_cli_prune_unix_test.go
+++ b/integration-cli/docker_cli_prune_unix_test.go
@@ -156,7 +156,7 @@ func (s *DockerCLIPruneSuite) TestPruneContainerLabel(c *testing.T) {
 	d, err := os.MkdirTemp("", "integration-cli-")
 	assert.NilError(c, err)
 	defer os.RemoveAll(d)
-	err = os.WriteFile(filepath.Join(d, "config.json"), []byte(config), 0644)
+	err = os.WriteFile(filepath.Join(d, "config.json"), []byte(config), 0o644)
 	assert.NilError(c, err)
 
 	// With config.json only, prune based on label=foobar
@@ -208,7 +208,7 @@ func (s *DockerCLIPruneSuite) TestPruneVolumeLabel(c *testing.T) {
 	d, err := os.MkdirTemp("", "integration-cli-")
 	assert.NilError(c, err)
 	defer os.RemoveAll(d)
-	err = os.WriteFile(filepath.Join(d, "config.json"), []byte(config), 0644)
+	err = os.WriteFile(filepath.Join(d, "config.json"), []byte(config), 0o644)
 	assert.NilError(c, err)
 
 	// With config.json only, prune based on label=foobar
diff --git a/integration-cli/docker_cli_ps_test.go b/integration-cli/docker_cli_ps_test.go
index 5f09160da4..693cde7de5 100644
--- a/integration-cli/docker_cli_ps_test.go
+++ b/integration-cli/docker_cli_ps_test.go
@@ -356,7 +356,7 @@ func (s *DockerCLIPsSuite) TestPsListContainersFilterAncestorImage(c *testing.T)
 	dockerCmd(c, "run", "--name=fifth", imageName2, "echo", "hello")
 	fifthID := getIDByName(c, "fifth")
 
-	var filterTestSuite = []struct {
+	filterTestSuite := []struct {
 		filterName  string
 		expectedIDs []string
 	}{
diff --git a/integration-cli/docker_cli_pull_local_test.go b/integration-cli/docker_cli_pull_local_test.go
index aa7852a275..59dc27e00d 100644
--- a/integration-cli/docker_cli_pull_local_test.go
+++ b/integration-cli/docker_cli_pull_local_test.go
@@ -329,23 +329,23 @@ func (s *DockerRegistrySuite) TestPullManifestList(c *testing.T) {
 
 	// Write manifest list to blob store
 	blobDir := filepath.Join(registryV2Path, "blobs", "sha256", hexDigest[:2], hexDigest)
-	err = os.MkdirAll(blobDir, 0755)
+	err = os.MkdirAll(blobDir, 0o755)
 	assert.NilError(c, err, "error creating blob dir")
 	blobPath := filepath.Join(blobDir, "data")
-	err = os.WriteFile(blobPath, manifestListJSON, 0644)
+	err = os.WriteFile(blobPath, manifestListJSON, 0o644)
 	assert.NilError(c, err, "error writing manifest list")
 
 	// Add to revision store
 	revisionDir := filepath.Join(registryV2Path, "repositories", remoteRepoName, "_manifests", "revisions", "sha256", hexDigest)
-	err = os.Mkdir(revisionDir, 0755)
+	err = os.Mkdir(revisionDir, 0o755)
 	assert.Assert(c, err == nil, "error creating revision dir")
 	revisionPath := filepath.Join(revisionDir, "link")
-	err = os.WriteFile(revisionPath, []byte(manifestListDigest.String()), 0644)
+	err = os.WriteFile(revisionPath, []byte(manifestListDigest.String()), 0o644)
 	assert.Assert(c, err == nil, "error writing revision link")
 
 	// Update tag
 	tagPath := filepath.Join(registryV2Path, "repositories", remoteRepoName, "_manifests", "tags", "latest", "current", "link")
-	err = os.WriteFile(tagPath, []byte(manifestListDigest.String()), 0644)
+	err = os.WriteFile(tagPath, []byte(manifestListDigest.String()), 0o644)
 	assert.NilError(c, err, "error writing tag link")
 
 	// Verify that the image can be pulled through the manifest list.
@@ -384,7 +384,7 @@ func (s *DockerRegistryAuthHtpasswdSuite) TestPullWithExternalAuthLoginWithSchem
 	externalAuthConfig := `{ "credsStore": "shell-test" }`
 
 	configPath := filepath.Join(tmp, "config.json")
-	err = os.WriteFile(configPath, []byte(externalAuthConfig), 0644)
+	err = os.WriteFile(configPath, []byte(externalAuthConfig), 0o644)
 	assert.NilError(c, err)
 
 	dockerCmd(c, "--config", tmp, "login", "-u", s.reg.Username(), "-p", s.reg.Password(), privateRegistryURL)
@@ -426,7 +426,7 @@ func (s *DockerRegistryAuthHtpasswdSuite) TestPullWithExternalAuth(c *testing.T)
 	externalAuthConfig := `{ "credsStore": "shell-test" }`
 
 	configPath := filepath.Join(tmp, "config.json")
-	err = os.WriteFile(configPath, []byte(externalAuthConfig), 0644)
+	err = os.WriteFile(configPath, []byte(externalAuthConfig), 0o644)
 	assert.NilError(c, err)
 
 	dockerCmd(c, "--config", tmp, "login", "-u", s.reg.Username(), "-p", s.reg.Password(), privateRegistryURL)
diff --git a/integration-cli/docker_cli_push_test.go b/integration-cli/docker_cli_push_test.go
index d883b6956f..4f14a8c3f7 100644
--- a/integration-cli/docker_cli_push_test.go
+++ b/integration-cli/docker_cli_push_test.go
@@ -281,8 +281,8 @@ func (s *DockerRegistryAuthTokenSuite) TestPushMisconfiguredTokenServiceResponse
 	out, _, err := dockerCmdWithError("push", repoName)
 	assert.ErrorContains(c, err, "", out)
 	// TODO: isolate test so that it can be guaranteed that the 503 will trigger xfer retries
-	//assert.Assert(c, strings.Contains(out, "Retrying"))
-	//assert.Assert(c, !strings.Contains(out, "Retrying in 15"))
+	// assert.Assert(c, strings.Contains(out, "Retrying"))
+	// assert.Assert(c, !strings.Contains(out, "Retrying in 15"))
 	split := strings.Split(out, "\n")
 	assert.Equal(c, split[len(split)-2], "toomanyrequests: out of tokens")
 }
diff --git a/integration-cli/docker_cli_run_test.go b/integration-cli/docker_cli_run_test.go
index 350e777941..ad576778de 100644
--- a/integration-cli/docker_cli_run_test.go
+++ b/integration-cli/docker_cli_run_test.go
@@ -406,7 +406,7 @@ func (s *DockerCLIRunSuite) TestRunCreateVolumesInSymlinkDir(c *testing.T) {
 		c.Skip("Requires TEMP to point to C: drive")
 	}
 
-	f, err := os.OpenFile(filepath.Join(dir, "test"), os.O_CREATE, 0700)
+	f, err := os.OpenFile(filepath.Join(dir, "test"), os.O_CREATE, 0o700)
 	if err != nil {
 		c.Fatal(err)
 	}
@@ -504,7 +504,7 @@ func (s *DockerCLIRunSuite) TestVolumesFromGetsProperMode(c *testing.T) {
 	testRequires(c, testEnv.IsLocalDaemon)
 	prefix, slash := getPrefixAndSlashFromDaemonPlatform()
 	hostpath := RandomTmpDirPath("test", testEnv.DaemonInfo.OSType)
-	if err := os.MkdirAll(hostpath, 0755); err != nil {
+	if err := os.MkdirAll(hostpath, 0o755); err != nil {
 		c.Fatalf("Failed to create %s: %q", hostpath, err)
 	}
 	defer os.RemoveAll(hostpath)
@@ -534,11 +534,11 @@ func (s *DockerCLIRunSuite) TestRunNoDupVolumes(c *testing.T) {
 		// Windows requires that the source directory exists before calling HCS
 		testRequires(c, testEnv.IsLocalDaemon)
 		someplace = `:c:\someplace`
-		if err := os.MkdirAll(path1, 0755); err != nil {
+		if err := os.MkdirAll(path1, 0o755); err != nil {
 			c.Fatalf("Failed to create %s: %q", path1, err)
 		}
 		defer os.RemoveAll(path1)
-		if err := os.MkdirAll(path2, 0755); err != nil {
+		if err := os.MkdirAll(path2, 0o755); err != nil {
 			c.Fatalf("Failed to create %s: %q", path1, err)
 		}
 		defer os.RemoveAll(path2)
@@ -1269,7 +1269,7 @@ func (s *DockerCLIRunSuite) TestRunDNSDefaultOptions(c *testing.T) {
 	}
 	// defer restored original conf
 	defer func() {
-		if err := os.WriteFile("/etc/resolv.conf", origResolvConf, 0644); err != nil {
+		if err := os.WriteFile("/etc/resolv.conf", origResolvConf, 0o644); err != nil {
 			c.Fatal(err)
 		}
 	}()
@@ -1278,7 +1278,7 @@ func (s *DockerCLIRunSuite) TestRunDNSDefaultOptions(c *testing.T) {
 	// 2 are removed from the file at container start, and the 3rd (commented out) one is ignored by
 	// GetNameservers(), leading to a replacement of nameservers with the default set
 	tmpResolvConf := []byte("nameserver 127.0.0.1\n#nameserver 127.0.2.1\nnameserver ::1")
-	if err := os.WriteFile("/etc/resolv.conf", tmpResolvConf, 0644); err != nil {
+	if err := os.WriteFile("/etc/resolv.conf", tmpResolvConf, 0o644); err != nil {
 		c.Fatal(err)
 	}
 
@@ -1373,12 +1373,12 @@ func (s *DockerCLIRunSuite) TestRunDNSOptionsBasedOnHostResolvConf(c *testing.T)
 
 	// test with file
 	tmpResolvConf := []byte("search example.com\nnameserver 12.34.56.78\nnameserver 127.0.0.1")
-	if err := os.WriteFile("/etc/resolv.conf", tmpResolvConf, 0644); err != nil {
+	if err := os.WriteFile("/etc/resolv.conf", tmpResolvConf, 0o644); err != nil {
 		c.Fatal(err)
 	}
 	// put the old resolvconf back
 	defer func() {
-		if err := os.WriteFile("/etc/resolv.conf", origResolvConf, 0644); err != nil {
+		if err := os.WriteFile("/etc/resolv.conf", origResolvConf, 0o644); err != nil {
 			c.Fatal(err)
 		}
 	}()
@@ -1416,7 +1416,7 @@ func (s *DockerCLIRunSuite) TestRunNonRootUserResolvName(c *testing.T) {
 
 	cID := getIDByName(c, "testperm")
 
-	fmode := (os.FileMode)(0644)
+	fmode := (os.FileMode)(0o644)
 	finfo, err := os.Stat(containerStorageFile(cID, "resolv.conf"))
 	if err != nil {
 		c.Fatal(err)
@@ -1457,7 +1457,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 
 	// cleanup
 	defer func() {
-		if err := os.WriteFile("/etc/resolv.conf", resolvConfSystem, 0644); err != nil {
+		if err := os.WriteFile("/etc/resolv.conf", resolvConfSystem, 0o644); err != nil {
 			c.Fatal(err)
 		}
 	}()
@@ -1467,7 +1467,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 	containerID1 := getIDByName(c, "first")
 
 	// replace resolv.conf with our temporary copy
-	if err := os.WriteFile("/etc/resolv.conf", tmpResolvConf, 0644); err != nil {
+	if err := os.WriteFile("/etc/resolv.conf", tmpResolvConf, 0o644); err != nil {
 		c.Fatal(err)
 	}
 
@@ -1490,7 +1490,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 	containerID2 := getIDByName(c, "second")
 
 	// make a change to resolv.conf (in this case replacing our tmp copy with orig copy)
-	if err := os.WriteFile("/etc/resolv.conf", resolvConfSystem, 0644); err != nil {
+	if err := os.WriteFile("/etc/resolv.conf", resolvConfSystem, 0o644); err != nil {
 		c.Fatal(err)
 	}
 
@@ -1508,7 +1508,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 	runningContainerID := strings.TrimSpace(out)
 
 	// replace resolv.conf
-	if err := os.WriteFile("/etc/resolv.conf", tmpResolvConf, 0644); err != nil {
+	if err := os.WriteFile("/etc/resolv.conf", tmpResolvConf, 0o644); err != nil {
 		c.Fatal(err)
 	}
 
@@ -1532,7 +1532,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 	//   host resolv.conf before updating container's resolv.conf copies
 
 	// replace resolv.conf with a localhost-only nameserver copy
-	if err = os.WriteFile("/etc/resolv.conf", tmpLocalhostResolvConf, 0644); err != nil {
+	if err = os.WriteFile("/etc/resolv.conf", tmpLocalhostResolvConf, 0o644); err != nil {
 		c.Fatal(err)
 	}
 
@@ -1551,7 +1551,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 	//   of containers' resolv.conf.
 
 	// Restore the original resolv.conf
-	if err := os.WriteFile("/etc/resolv.conf", resolvConfSystem, 0644); err != nil {
+	if err := os.WriteFile("/etc/resolv.conf", resolvConfSystem, 0o644); err != nil {
 		c.Fatal(err)
 	}
 
@@ -1560,7 +1560,7 @@ func (s *DockerCLIRunSuite) TestRunResolvconfUpdate(c *testing.T) {
 	containerID3 := getIDByName(c, "third")
 
 	// Create a modified resolv.conf.aside and override resolv.conf with it
-	if err := os.WriteFile("/etc/resolv.conf.aside", tmpResolvConf, 0644); err != nil {
+	if err := os.WriteFile("/etc/resolv.conf.aside", tmpResolvConf, 0o644); err != nil {
 		c.Fatal(err)
 	}
 
@@ -2097,19 +2097,19 @@ func (s *DockerCLIRunSuite) TestRunMountOrdering(c *testing.T) {
 
 	// Create a temporary tmpfs mounc.
 	fooDir := filepath.Join(tmpDir, "foo")
-	if err := os.MkdirAll(filepath.Join(tmpDir, "foo"), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Join(tmpDir, "foo"), 0o755); err != nil {
 		c.Fatalf("failed to mkdir at %s - %s", fooDir, err)
 	}
 
-	if err := os.WriteFile(fmt.Sprintf("%s/touch-me", fooDir), []byte{}, 0644); err != nil {
+	if err := os.WriteFile(fmt.Sprintf("%s/touch-me", fooDir), []byte{}, 0o644); err != nil {
 		c.Fatal(err)
 	}
 
-	if err := os.WriteFile(fmt.Sprintf("%s/touch-me", tmpDir), []byte{}, 0644); err != nil {
+	if err := os.WriteFile(fmt.Sprintf("%s/touch-me", tmpDir), []byte{}, 0o644); err != nil {
 		c.Fatal(err)
 	}
 
-	if err := os.WriteFile(fmt.Sprintf("%s/touch-me", tmpDir2), []byte{}, 0644); err != nil {
+	if err := os.WriteFile(fmt.Sprintf("%s/touch-me", tmpDir2), []byte{}, 0o644); err != nil {
 		c.Fatal(err)
 	}
 
@@ -3055,7 +3055,7 @@ func (s *DockerCLIRunSuite) TestRunNetworkFilesBindMount(c *testing.T) {
 	defer os.Remove(filename)
 
 	// for user namespaced test runs, the temp file must be accessible to unprivileged root
-	if err := os.Chmod(filename, 0646); err != nil {
+	if err := os.Chmod(filename, 0o646); err != nil {
 		c.Fatalf("error modifying permissions of %s: %v", filename, err)
 	}
 
@@ -3077,7 +3077,7 @@ func (s *DockerCLIRunSuite) TestRunNetworkFilesBindMountRO(c *testing.T) {
 	defer os.Remove(filename)
 
 	// for user namespaced test runs, the temp file must be accessible to unprivileged root
-	if err := os.Chmod(filename, 0646); err != nil {
+	if err := os.Chmod(filename, 0o646); err != nil {
 		c.Fatalf("error modifying permissions of %s: %v", filename, err)
 	}
 
@@ -3099,7 +3099,7 @@ func (s *DockerCLIRunSuite) TestRunNetworkFilesBindMountROFilesystem(c *testing.
 	defer os.Remove(filename)
 
 	// for user namespaced test runs, the temp file must be accessible to unprivileged root
-	if err := os.Chmod(filename, 0646); err != nil {
+	if err := os.Chmod(filename, 0o646); err != nil {
 		c.Fatalf("error modifying permissions of %s: %v", filename, err)
 	}
 
@@ -4223,16 +4223,16 @@ func (s *DockerCLIRunSuite) TestRunMount(c *testing.T) {
 	}
 	defer os.RemoveAll(tmpDir)
 	mnt1, mnt2 := path.Join(tmpDir, "mnt1"), path.Join(tmpDir, "mnt2")
-	if err := os.Mkdir(mnt1, 0755); err != nil {
+	if err := os.Mkdir(mnt1, 0o755); err != nil {
 		c.Fatal(err)
 	}
-	if err := os.Mkdir(mnt2, 0755); err != nil {
+	if err := os.Mkdir(mnt2, 0o755); err != nil {
 		c.Fatal(err)
 	}
-	if err := os.WriteFile(path.Join(mnt1, "test1"), []byte("test1"), 0644); err != nil {
+	if err := os.WriteFile(path.Join(mnt1, "test1"), []byte("test1"), 0o644); err != nil {
 		c.Fatal(err)
 	}
-	if err := os.WriteFile(path.Join(mnt2, "test2"), []byte("test2"), 0644); err != nil {
+	if err := os.WriteFile(path.Join(mnt2, "test2"), []byte("test2"), 0o644); err != nil {
 		c.Fatal(err)
 	}
 	testCatFooBar := func(cName string) error {
diff --git a/integration-cli/docker_cli_run_unix_test.go b/integration-cli/docker_cli_run_unix_test.go
index e1112cdfd9..352484459c 100644
--- a/integration-cli/docker_cli_run_unix_test.go
+++ b/integration-cli/docker_cli_run_unix_test.go
@@ -68,7 +68,7 @@ func (s *DockerCLIRunSuite) TestRunWithVolumesIsRecursive(c *testing.T) {
 
 	// Create a temporary tmpfs mount.
 	tmpfsDir := filepath.Join(tmpDir, "tmpfs")
-	assert.Assert(c, os.MkdirAll(tmpfsDir, 0777) == nil, "failed to mkdir at %s", tmpfsDir)
+	assert.Assert(c, os.MkdirAll(tmpfsDir, 0o777) == nil, "failed to mkdir at %s", tmpfsDir)
 	assert.Assert(c, mount.Mount("tmpfs", tmpfsDir, "tmpfs", "") == nil, "failed to create a tmpfs mount at %s", tmpfsDir)
 
 	f, err := os.CreateTemp(tmpfsDir, "touch-me")
@@ -247,7 +247,7 @@ func (s *DockerCLIRunSuite) TestRunAttachDetachFromConfig(c *testing.T) {
 	defer os.RemoveAll(tmpDir)
 
 	dotDocker := filepath.Join(tmpDir, ".docker")
-	os.Mkdir(dotDocker, 0600)
+	os.Mkdir(dotDocker, 0o600)
 	tmpCfg := filepath.Join(dotDocker, "config.json")
 
 	if runtime.GOOS == "windows" {
@@ -260,7 +260,7 @@ func (s *DockerCLIRunSuite) TestRunAttachDetachFromConfig(c *testing.T) {
 		"detachKeys": "ctrl-a,a"
 	}`
 
-	err = os.WriteFile(tmpCfg, []byte(data), 0600)
+	err = os.WriteFile(tmpCfg, []byte(data), 0o600)
 	assert.NilError(c, err)
 
 	// Then do the work
@@ -331,7 +331,7 @@ func (s *DockerCLIRunSuite) TestRunAttachDetachKeysOverrideConfig(c *testing.T)
 	defer os.RemoveAll(tmpDir)
 
 	dotDocker := filepath.Join(tmpDir, ".docker")
-	os.Mkdir(dotDocker, 0600)
+	os.Mkdir(dotDocker, 0o600)
 	tmpCfg := filepath.Join(dotDocker, "config.json")
 
 	if runtime.GOOS == "windows" {
@@ -344,7 +344,7 @@ func (s *DockerCLIRunSuite) TestRunAttachDetachKeysOverrideConfig(c *testing.T)
 		"detachKeys": "ctrl-e,e"
 	}`
 
-	err = os.WriteFile(tmpCfg, []byte(data), 0600)
+	err = os.WriteFile(tmpCfg, []byte(data), 0o600)
 	assert.NilError(c, err)
 
 	// Then do the work
@@ -1362,7 +1362,7 @@ func (s *DockerCLIRunSuite) TestRunDeviceSymlink(c *testing.T) {
 	// Create a temporary file "temp" inside tmpDir, write some data to "tmpDir/temp",
 	// then create a symlink "tmpDir/file" to the temporary file "tmpDir/temp".
 	tmpFile := filepath.Join(tmpDir, "temp")
-	err = os.WriteFile(tmpFile, []byte("temp"), 0666)
+	err = os.WriteFile(tmpFile, []byte("temp"), 0o666)
 	assert.NilError(c, err)
 	symFile := filepath.Join(tmpDir, "file")
 	err = os.Symlink(tmpFile, symFile)
diff --git a/integration-cli/docker_cli_save_load_test.go b/integration-cli/docker_cli_save_load_test.go
index 1eefb2c77c..a46fd16011 100644
--- a/integration-cli/docker_cli_save_load_test.go
+++ b/integration-cli/docker_cli_save_load_test.go
@@ -202,9 +202,7 @@ func (s *DockerCLISaveLoadSuite) TestSaveLoadParents(c *testing.T) {
 	testRequires(c, DaemonIsLinux)
 
 	makeImage := func(from string, addfile string) string {
-		var (
-			out string
-		)
+		var out string
 		out, _ = dockerCmd(c, "run", "-d", from, "touch", addfile)
 		cleanedContainerID := strings.TrimSpace(out)
 
diff --git a/integration-cli/docker_cli_save_load_unix_test.go b/integration-cli/docker_cli_save_load_unix_test.go
index 816f5cc7f6..0c9c4e3fad 100644
--- a/integration-cli/docker_cli_save_load_unix_test.go
+++ b/integration-cli/docker_cli_save_load_unix_test.go
@@ -101,6 +101,6 @@ func (s *DockerCLISaveLoadSuite) TestLoadNoStdinFail(c *testing.T) {
 	buf := make([]byte, 1024)
 
 	n, err := pty.Read(buf)
-	assert.NilError(c, err) //could not read tty output
+	assert.NilError(c, err) // could not read tty output
 	assert.Assert(c, strings.Contains(string(buf[:n]), "requested load from stdin, but stdin is empty"))
 }
diff --git a/integration-cli/docker_cli_swarm_test.go b/integration-cli/docker_cli_swarm_test.go
index a4981b333b..5338bbd234 100644
--- a/integration-cli/docker_cli_swarm_test.go
+++ b/integration-cli/docker_cli_swarm_test.go
@@ -610,8 +610,10 @@ func (s *DockerSwarmSuite) TestPsListContainersFilterIsTask(c *testing.T) {
 	assert.Assert(c, lines[0] != bareID, "Expected not %s, but got it for is-task label, output %q", bareID, out)
 }
 
-const globalNetworkPlugin = "global-network-plugin"
-const globalIPAMPlugin = "global-ipam-plugin"
+const (
+	globalNetworkPlugin = "global-network-plugin"
+	globalIPAMPlugin    = "global-ipam-plugin"
+)
 
 func setupRemoteGlobalNetworkPlugin(c *testing.T, mux *http.ServeMux, url, netDrv, ipamDrv string) {
 	mux.HandleFunc("/Plugin.Activate", func(w http.ResponseWriter, r *http.Request) {
@@ -664,7 +666,8 @@ func setupRemoteGlobalNetworkPlugin(c *testing.T, mux *http.ServeMux, url, netDr
 		w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1+json")
 
 		veth := &netlink.Veth{
-			LinkAttrs: netlink.LinkAttrs{Name: "randomIfName", TxQLen: 0}, PeerName: "cnt0"}
+			LinkAttrs: netlink.LinkAttrs{Name: "randomIfName", TxQLen: 0}, PeerName: "cnt0",
+		}
 		if err := netlink.LinkAdd(veth); err != nil {
 			fmt.Fprintf(w, `{"Error":"failed to add veth pair: `+err.Error()+`"}`)
 		} else {
@@ -768,15 +771,15 @@ func setupRemoteGlobalNetworkPlugin(c *testing.T, mux *http.ServeMux, url, netDr
 		}
 	})
 
-	err := os.MkdirAll("/etc/docker/plugins", 0755)
+	err := os.MkdirAll("/etc/docker/plugins", 0o755)
 	assert.NilError(c, err)
 
 	fileName := fmt.Sprintf("/etc/docker/plugins/%s.spec", netDrv)
-	err = os.WriteFile(fileName, []byte(url), 0644)
+	err = os.WriteFile(fileName, []byte(url), 0o644)
 	assert.NilError(c, err)
 
 	ipamFileName := fmt.Sprintf("/etc/docker/plugins/%s.spec", ipamDrv)
-	err = os.WriteFile(ipamFileName, []byte(url), 0644)
+	err = os.WriteFile(ipamFileName, []byte(url), 0o644)
 	assert.NilError(c, err)
 }
 
@@ -803,7 +806,7 @@ func (s *DockerSwarmSuite) TestSwarmServiceEnvFile(c *testing.T) {
 	d := s.AddDaemon(c, true, true)
 
 	path := filepath.Join(d.Folder, "env.txt")
-	err := os.WriteFile(path, []byte("VAR1=A\nVAR2=A\n"), 0644)
+	err := os.WriteFile(path, []byte("VAR1=A\nVAR2=A\n"), 0o644)
 	assert.NilError(c, err)
 
 	name := "worker"
diff --git a/integration-cli/docker_cli_volume_test.go b/integration-cli/docker_cli_volume_test.go
index 9c2ced1fd9..f1980b329e 100644
--- a/integration-cli/docker_cli_volume_test.go
+++ b/integration-cli/docker_cli_volume_test.go
@@ -109,7 +109,7 @@ func (s *DockerCLIVolumeSuite) TestVolumeLsFormatDefaultFormat(c *testing.T) {
 	assert.NilError(c, err)
 	defer os.RemoveAll(d)
 
-	err = os.WriteFile(filepath.Join(d, "config.json"), []byte(config), 0644)
+	err = os.WriteFile(filepath.Join(d, "config.json"), []byte(config), 0o644)
 	assert.NilError(c, err)
 
 	out, _ := dockerCmd(c, "--config", d, "volume", "ls")
@@ -567,7 +567,7 @@ func (s *DockerCLIVolumeSuite) TestDuplicateMountpointsForVolumesFromAndMounts(c
 	out, _ = dockerCmd(c, "volume", "ls", "-q")
 	assert.Assert(c, strings.Contains(strings.TrimSpace(out), data1))
 	assert.Assert(c, strings.Contains(strings.TrimSpace(out), data2))
-	err := os.MkdirAll("/tmp/data", 0755)
+	err := os.MkdirAll("/tmp/data", 0o755)
 	assert.NilError(c, err)
 	// Mounts is available in API
 	apiClient, err := client.NewClientWithOpts(client.FromEnv)
diff --git a/integration-cli/docker_utils_test.go b/integration-cli/docker_utils_test.go
index 3fa6e38b18..faf2da53a4 100644
--- a/integration-cli/docker_utils_test.go
+++ b/integration-cli/docker_utils_test.go
@@ -186,8 +186,8 @@ func buildImage(name string, cmdOperators ...cli.CmdOperator) *icmd.Result {
 func writeFile(dst, content string, c *testing.T) {
 	c.Helper()
 	// Create subdirectories if necessary
-	assert.Assert(c, os.MkdirAll(path.Dir(dst), 0700) == nil)
-	f, err := os.OpenFile(dst, os.O_CREATE|os.O_RDWR|os.O_TRUNC, 0700)
+	assert.Assert(c, os.MkdirAll(path.Dir(dst), 0o700) == nil)
+	f, err := os.OpenFile(dst, os.O_CREATE|os.O_RDWR|os.O_TRUNC, 0o700)
 	assert.NilError(c, err)
 	defer f.Close()
 	// Write content (truncate if it exists)
@@ -302,7 +302,7 @@ func createTmpFile(c *testing.T, content string) string {
 
 	filename := f.Name()
 
-	err = os.WriteFile(filename, []byte(content), 0644)
+	err = os.WriteFile(filename, []byte(content), 0o644)
 	assert.NilError(c, err)
 
 	return filename
@@ -403,8 +403,10 @@ func getErrorMessage(c *testing.T, body []byte) string {
 	return strings.TrimSpace(resp.Message)
 }
 
-type checkF func(*testing.T) (interface{}, string)
-type reducer func(...interface{}) interface{}
+type (
+	checkF  func(*testing.T) (interface{}, string)
+	reducer func(...interface{}) interface{}
+)
 
 func pollCheck(t *testing.T, f checkF, compare func(x interface{}) assert.BoolOrComparison) poll.Check {
 	return func(poll.LogT) poll.Result {
diff --git a/integration-cli/environment/environment.go b/integration-cli/environment/environment.go
index 0dcf8d9294..5f28fb6907 100644
--- a/integration-cli/environment/environment.go
+++ b/integration-cli/environment/environment.go
@@ -7,10 +7,8 @@ import (
 	"github.com/docker/docker/testutil/environment"
 )
 
-var (
-	// DefaultClientBinary is the name of the docker binary
-	DefaultClientBinary = os.Getenv("TEST_CLIENT_BINARY")
-)
+// DefaultClientBinary is the name of the docker binary
+var DefaultClientBinary = os.Getenv("TEST_CLIENT_BINARY")
 
 func init() {
 	if DefaultClientBinary == "" {
diff --git a/integration-cli/fixtures_linux_daemon_test.go b/integration-cli/fixtures_linux_daemon_test.go
index 37c798925b..5de08cdf15 100644
--- a/integration-cli/fixtures_linux_daemon_test.go
+++ b/integration-cli/fixtures_linux_daemon_test.go
@@ -51,7 +51,7 @@ func ensureSyscallTest(c *testing.T) {
 	FROM debian:bullseye-slim
 	COPY . /usr/bin/
 	`)
-	err = os.WriteFile(dockerFile, content, 0600)
+	err = os.WriteFile(dockerFile, content, 0o600)
 	assert.NilError(c, err)
 
 	var buildArgs []string
@@ -106,7 +106,7 @@ func ensureNNPTest(c *testing.T) {
 	COPY . /usr/bin
 	RUN chmod +s /usr/bin/nnp-test
 	`
-	err = os.WriteFile(dockerfile, []byte(content), 0600)
+	err = os.WriteFile(dockerfile, []byte(content), 0o600)
 	assert.NilError(c, err, "could not write Dockerfile for nnp-test image")
 
 	var buildArgs []string
diff --git a/integration-cli/requirements_unix_test.go b/integration-cli/requirements_unix_test.go
index 45e5e7204d..7fd81e963e 100644
--- a/integration-cli/requirements_unix_test.go
+++ b/integration-cli/requirements_unix_test.go
@@ -11,10 +11,8 @@ import (
 	"github.com/docker/docker/pkg/sysinfo"
 )
 
-var (
-	// SysInfo stores information about which features a kernel supports.
-	SysInfo *sysinfo.SysInfo
-)
+// SysInfo stores information about which features a kernel supports.
+var SysInfo *sysinfo.SysInfo
 
 func cpuCfsPeriod() bool {
 	return testEnv.DaemonInfo.CPUCfsPeriod