diff --git a/go.mod b/go.mod
index 1c280d6570a..c95f74a4fd2 100644
--- a/go.mod
+++ b/go.mod
@@ -65,7 +65,7 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/disiqueira/gotree/v3 v3.0.2 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/docker-credential-helpers v0.9.3 // indirect
+	github.com/docker/docker-credential-helpers v0.9.4 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
@@ -89,7 +89,7 @@ require (
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mattn/go-sqlite3 v1.14.32 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
-	github.com/mistifyio/go-zfs/v3 v3.0.1 // indirect
+	github.com/mistifyio/go-zfs/v3 v3.1.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/go-archive v0.1.0 // indirect
 	github.com/moby/patternmatcher v0.6.0 // indirect
@@ -137,3 +137,9 @@ require (
 	sigs.k8s.io/yaml v1.6.0 // indirect
 	tags.cncf.io/container-device-interface/specs-go v1.0.0 // indirect
 )
+
+replace go.podman.io/common => github.com/nalind/containers-container-libs/common v0.0.0-20251008214453-186f379e5ba7
+
+replace go.podman.io/storage => github.com/nalind/containers-container-libs/storage v0.0.0-20251008214453-186f379e5ba7
+
+replace go.podman.io/image/v5 => github.com/nalind/containers-container-libs/image/v5 v5.0.0-20251008214453-186f379e5ba7
diff --git a/go.sum b/go.sum
index 85bddf0f5f2..923a5ac7aca 100644
--- a/go.sum
+++ b/go.sum
@@ -72,14 +72,14 @@ github.com/disiqueira/gotree/v3 v3.0.2 h1:ik5iuLQQoufZBNPY518dXhiO5056hyNBIK9lWh
 github.com/disiqueira/gotree/v3 v3.0.2/go.mod h1:ZuyjE4+mUQZlbpkI24AmruZKhg3VHEgPLDY8Qk+uUu8=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v28.4.0+incompatible h1:RBcf3Kjw2pMtwui5V0DIMdyeab8glEw5QY0UUU4C9kY=
-github.com/docker/cli v28.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v28.5.0+incompatible h1:crVqLrtKsrhC9c00ythRx435H8LiQnUKRtJLRR+Auxk=
+github.com/docker/cli v28.5.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v28.5.1+incompatible h1:Bm8DchhSD2J6PsFzxC35TZo4TLGR2PdW/E69rU45NhM=
 github.com/docker/docker v28.5.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
-github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
+github.com/docker/docker-credential-helpers v0.9.4 h1:76ItO69/AP/V4yT9V4uuuItG0B1N8hvt0T0c0NN/DzI=
+github.com/docker/docker-credential-helpers v0.9.4/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
 github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
 github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
@@ -162,8 +162,8 @@ github.com/mattn/go-sqlite3 v1.14.32 h1:JD12Ag3oLy1zQA+BNn74xRgaBbdhbNIDYvQUEuuE
 github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
 github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
-github.com/mistifyio/go-zfs/v3 v3.0.1 h1:YaoXgBePoMA12+S1u/ddkv+QqxcfiZK4prI6HPnkFiU=
-github.com/mistifyio/go-zfs/v3 v3.0.1/go.mod h1:CzVgeB0RvF2EGzQnytKVvVSDwmKJXxkOTUGbNrTja/k=
+github.com/mistifyio/go-zfs/v3 v3.1.0 h1:FZaylcg0hjUp27i23VcJJQiuBeAZjrC8lPqCGM1CopY=
+github.com/mistifyio/go-zfs/v3 v3.1.0/go.mod h1:CzVgeB0RvF2EGzQnytKVvVSDwmKJXxkOTUGbNrTja/k=
 github.com/moby/buildkit v0.25.1 h1:j7IlVkeNbEo+ZLoxdudYCHpmTsbwKvhgc/6UJ/mY/o8=
 github.com/moby/buildkit v0.25.1/go.mod h1:phM8sdqnvgK2y1dPDnbwI6veUCXHOZ6KFSl6E164tkc=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
@@ -195,8 +195,14 @@ github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/onsi/ginkgo/v2 v2.25.3 h1:Ty8+Yi/ayDAGtk4XxmmfUy4GabvM+MegeB4cDLRi6nw=
-github.com/onsi/ginkgo/v2 v2.25.3/go.mod h1:43uiyQC4Ed2tkOzLsEYm7hnrb7UJTWHYNsuy3bG/snE=
+github.com/nalind/containers-container-libs/common v0.0.0-20251008214453-186f379e5ba7 h1:cy9zneyaMmIRWViErk9cZx7ujEhhAKokh6cdGrDyvfw=
+github.com/nalind/containers-container-libs/common v0.0.0-20251008214453-186f379e5ba7/go.mod h1:C2MRx7m/VwjKPD7nQe5BDsqh21pPn8pqnNre7Lj6sgg=
+github.com/nalind/containers-container-libs/image/v5 v5.0.0-20251008214453-186f379e5ba7 h1:OoyWfsEqaKjsTfEoan1e+J/SYPEiI51MNXJooR3rZJc=
+github.com/nalind/containers-container-libs/image/v5 v5.0.0-20251008214453-186f379e5ba7/go.mod h1:XVw9N/RHN7HZQH6fHn7gENnrejqqqYG6OtnZVCW0k48=
+github.com/nalind/containers-container-libs/storage v0.0.0-20251008214453-186f379e5ba7 h1:Q1wNrpUcwPjXvAKnEv6gG+CqF6R5o8YnsJyveNwdCvA=
+github.com/nalind/containers-container-libs/storage v0.0.0-20251008214453-186f379e5ba7/go.mod h1:mz7wN7mBeQUxh/iYq9uoROZFO9bUuq85BLqQCdwbibI=
+github.com/onsi/ginkgo/v2 v2.26.0 h1:1J4Wut1IlYZNEAWIV3ALrT9NfiaGW2cDCJQSFQMs/gE=
+github.com/onsi/ginkgo/v2 v2.26.0/go.mod h1:qhEywmzWTBUY88kfO0BRvX4py7scov9yR+Az2oavUzw=
 github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
 github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
 github.com/opencontainers/cgroups v0.0.5 h1:DRITAqcOnY0uSBzIpt1RYWLjh5DPDiqUs4fY6Y0ktls=
@@ -317,12 +323,6 @@ go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKr
 go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
 go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
 go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
-go.podman.io/common v0.65.1-0.20250916163606-92222dcd3da4 h1:YjBqTOxz4cqfpifcd71VoBl1FTQL2U2La5NgMqmRRqU=
-go.podman.io/common v0.65.1-0.20250916163606-92222dcd3da4/go.mod h1:DyOdwtkwzYA8lE0TueJnxRju4Lmsrx6ZAC/ATAkYYck=
-go.podman.io/image/v5 v5.37.1-0.20250916163606-92222dcd3da4 h1:hfc3lZaxi6KGnWN3IusIaCkcMPR4rTR+vWZzakeD1EA=
-go.podman.io/image/v5 v5.37.1-0.20250916163606-92222dcd3da4/go.mod h1:cGWb3IyBziJGxhFikTOlt9Ap+zo6s3rz9Qd1rbzqs4s=
-go.podman.io/storage v1.60.1-0.20250916163606-92222dcd3da4 h1:jo0PSKh6muU7rmhXXqOV9aK+HrA8koqs47KhBsZf6LY=
-go.podman.io/storage v1.60.1-0.20250916163606-92222dcd3da4/go.mod h1:AeZXAN8Qu1gTlAEHIc6mVhxk+61oMSM3K3iLx5UAQWE=
 go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
diff --git a/vendor/github.com/mistifyio/go-zfs/v3/utils.go b/vendor/github.com/mistifyio/go-zfs/v3/utils.go
index b69942b530f..8e49be39ff6 100644
--- a/vendor/github.com/mistifyio/go-zfs/v3/utils.go
+++ b/vendor/github.com/mistifyio/go-zfs/v3/utils.go
@@ -2,6 +2,7 @@ package zfs
 
 import (
 	"bytes"
+	"context"
 	"errors"
 	"fmt"
 	"io"
@@ -10,10 +11,37 @@ import (
 	"runtime"
 	"strconv"
 	"strings"
+	"sync/atomic"
+	"syscall"
+	"time"
 
 	"github.com/google/uuid"
 )
 
+// Runner specifies the parameters used when executing ZFS commands.
+type Runner struct {
+	// Timeout specifies how long to wait before sending a SIGTERM signal to the running process.
+	Timeout time.Duration
+
+	// Grace specifies the time waited after signaling the running process with SIGTERM before it is forcefully
+	// killed with SIGKILL.
+	Grace time.Duration
+}
+
+var defaultRunner atomic.Value
+
+func init() {
+	defaultRunner.Store(&Runner{})
+}
+
+func Default() *Runner {
+	return defaultRunner.Load().(*Runner) //nolint: forcetypeassert // Impossible for it to be anything else.
+}
+
+func SetRunner(runner *Runner) {
+	defaultRunner.Store(runner)
+}
+
 type command struct {
 	Command string
 	Stdin   io.Reader
@@ -21,7 +49,19 @@ type command struct {
 }
 
 func (c *command) Run(arg ...string) ([][]string, error) {
-	cmd := exec.Command(c.Command, arg...)
+	var cmd *exec.Cmd
+	if Default().Timeout == 0 {
+		cmd = exec.Command(c.Command, arg...)
+	} else {
+		ctx, cancel := context.WithTimeout(context.Background(), Default().Timeout)
+		defer cancel()
+
+		cmd = exec.CommandContext(ctx, c.Command, arg...)
+		cmd.Cancel = func() error {
+			return cmd.Process.Signal(syscall.SIGTERM)
+		}
+		cmd.WaitDelay = Default().Grace
+	}
 
 	var stdout, stderr bytes.Buffer
 
diff --git a/vendor/go.podman.io/common/libimage/manifest_list.go b/vendor/go.podman.io/common/libimage/manifest_list.go
index f084bbe55f1..b8e587468b2 100644
--- a/vendor/go.podman.io/common/libimage/manifest_list.go
+++ b/vendor/go.podman.io/common/libimage/manifest_list.go
@@ -508,7 +508,7 @@ func (m *ManifestList) Add(ctx context.Context, name string, options *ManifestLi
 		}
 	}
 
-	ref, err := m.parseNameToExtantReference(ctx, systemContext, name, false, "image to add to manifest list")
+	ref, err := m.parseNameToExtantReference(ctx, systemContext, name, options.All, "image to add to manifest list")
 	if err != nil {
 		return "", err
 	}
diff --git a/vendor/go.podman.io/common/libimage/manifests/manifests.go b/vendor/go.podman.io/common/libimage/manifests/manifests.go
index 3caff540dde..40c485e16c6 100644
--- a/vendor/go.podman.io/common/libimage/manifests/manifests.go
+++ b/vendor/go.podman.io/common/libimage/manifests/manifests.go
@@ -518,6 +518,7 @@ func (l *list) Add(ctx context.Context, sys *types.SystemContext, ref types.Imag
 		Features, OSFeatures, Annotations    []string
 		Size                                 int64
 		ConfigInfo                           types.BlobInfo
+		MediaType                            string
 		ArtifactType                         string
 		URLs                                 []string
 	}
@@ -550,6 +551,7 @@ func (l *list) Add(ctx context.Context, sys *types.SystemContext, ref types.Imag
 					Features:       append([]string{}, lists.Docker().Manifests[i].Platform.Features...),
 					OSFeatures:     append([]string{}, platform.OSFeatures...),
 					Size:           instance.Size,
+					MediaType:      instance.MediaType,
 					ArtifactType:   instance.ArtifactType,
 					Annotations:    mapToSlice(instance.Annotations),
 					URLs:           instance.URLs,
@@ -583,10 +585,12 @@ func (l *list) Add(ctx context.Context, sys *types.SystemContext, ref types.Imag
 					Features:       append([]string{}, lists.Docker().Manifests[i].Platform.Features...),
 					OSFeatures:     append([]string{}, platform.OSFeatures...),
 					Size:           instance.Size,
+					MediaType:      instance.MediaType,
 					ArtifactType:   instance.ArtifactType,
 					Annotations:    mapToSlice(instance.Annotations),
 					URLs:           instance.URLs,
 				}
+				manifestDigest = instanceDigest
 				instanceInfos = append(instanceInfos, instanceInfo)
 				added = true
 			}
@@ -606,22 +610,28 @@ func (l *list) Add(ctx context.Context, sys *types.SystemContext, ref types.Imag
 				instanceInfo.ArtifactType = m.ArtifactType
 			}
 		}
+		instanceInfo.MediaType = primaryManifestType
+		instanceInfo.Size = int64(len(primaryManifestBytes))
 		instanceInfos = append(instanceInfos, instanceInfo)
 	}
 
 	knownConfigTypes := []string{manifest.DockerV2Schema2ConfigMediaType, v1.MediaTypeImageConfig}
 	for _, instanceInfo := range instanceInfos {
+		var hasPlatformConfig bool
 		unparsedInstance := image.UnparsedInstance(src, instanceInfo.instanceDigest)
-		manifestBytes, manifestType, err := unparsedInstance.Manifest(ctx)
-		if err != nil {
-			return "", fmt.Errorf("reading manifest from %q, instance %q: %w", transports.ImageName(ref), instanceInfo.instanceDigest, err)
-		}
-		instanceManifest, err := manifest.FromBlob(manifestBytes, manifestType)
-		if err != nil {
-			return "", fmt.Errorf("parsing manifest from %q, instance %q: %w", transports.ImageName(ref), instanceInfo.instanceDigest, err)
+		if mb, mt, err := unparsedInstance.Manifest(ctx); err == nil {
+			if instanceManifest, err := manifest.FromBlob(mb, mt); err == nil {
+				instanceDigest, err := manifest.Digest(mb)
+				if err != nil {
+					return "", fmt.Errorf("computing digest of manifest from %q: %w", transports.ImageName(ref), err)
+				}
+				instanceInfo.instanceDigest = &instanceDigest
+				instanceInfo.MediaType = mt
+				instanceInfo.Size = int64(len(mb))
+				instanceInfo.ConfigInfo = instanceManifest.ConfigInfo()
+				hasPlatformConfig = instanceInfo.ArtifactType == "" && slices.Contains(knownConfigTypes, instanceInfo.ConfigInfo.MediaType)
+			}
 		}
-		instanceInfo.ConfigInfo = instanceManifest.ConfigInfo()
-		hasPlatformConfig := instanceInfo.ArtifactType == "" && slices.Contains(knownConfigTypes, instanceInfo.ConfigInfo.MediaType)
 		needToParsePlatformConfig := (instanceInfo.OS == "" || instanceInfo.Architecture == "")
 		if hasPlatformConfig && needToParsePlatformConfig {
 			img, err := image.FromUnparsedImage(ctx, sys, unparsedInstance)
@@ -643,16 +653,15 @@ func (l *list) Add(ctx context.Context, sys *types.SystemContext, ref types.Imag
 			}
 		}
 		if instanceInfo.instanceDigest == nil {
-			manifestDigest, err = manifest.Digest(manifestBytes)
+			manifestDigest, err = manifest.Digest(primaryManifestBytes)
 			if err != nil {
 				return "", fmt.Errorf("computing digest of manifest from %q: %w", transports.ImageName(ref), err)
 			}
 			instanceInfo.instanceDigest = &manifestDigest
-			instanceInfo.Size = int64(len(manifestBytes))
 		} else if manifestDigest == "" {
 			manifestDigest = *instanceInfo.instanceDigest
 		}
-		err = l.List.AddInstance(*instanceInfo.instanceDigest, instanceInfo.Size, manifestType, instanceInfo.OS, instanceInfo.Architecture, instanceInfo.OSVersion, instanceInfo.OSFeatures, instanceInfo.Variant, instanceInfo.Features, instanceInfo.Annotations)
+		err = l.List.AddInstance(*instanceInfo.instanceDigest, instanceInfo.Size, instanceInfo.MediaType, instanceInfo.OS, instanceInfo.Architecture, instanceInfo.OSVersion, instanceInfo.OSFeatures, instanceInfo.Variant, instanceInfo.Features, instanceInfo.Annotations)
 		if err != nil {
 			return "", fmt.Errorf("adding instance with digest %q: %w", *instanceInfo.instanceDigest, err)
 		}
diff --git a/vendor/go.podman.io/common/pkg/config/config.go b/vendor/go.podman.io/common/pkg/config/config.go
index 2a11ccb0054..8bc23deba1b 100644
--- a/vendor/go.podman.io/common/pkg/config/config.go
+++ b/vendor/go.podman.io/common/pkg/config/config.go
@@ -707,6 +707,13 @@ type Destination struct {
 	// Identity file with ssh key, optional
 	Identity string `json:",omitempty" toml:"identity,omitempty"`
 
+	// Path to TLS client certificate PEM file, optional
+	TLSCert string `json:",omitempty" toml:"tls_cert,omitempty"`
+	// Path to TLS client certificate private key PEM file, optional
+	TLSKey string `json:",omitempty" toml:"tls_key,omitempty"`
+	// Path to TLS certificate authority PEM file, optional
+	TLSCA string `json:",omitempty" toml:"tls_ca,omitempty"`
+
 	// isMachine describes if the remote destination is a machine.
 	IsMachine bool `json:",omitempty" toml:"is_machine,omitempty"`
 }
diff --git a/vendor/go.podman.io/common/pkg/config/containers.conf b/vendor/go.podman.io/common/pkg/config/containers.conf
index 57a9fcfa4c4..2e392d048e1 100644
--- a/vendor/go.podman.io/common/pkg/config/containers.conf
+++ b/vendor/go.podman.io/common/pkg/config/containers.conf
@@ -779,10 +779,17 @@ default_sysctls = [
 #       rootful "unix:///run/podman/podman.sock (Default)
 #       remote rootless ssh://engineering.lab.company.com/run/user/1000/podman/podman.sock
 #       remote rootful ssh://root@10.10.1.136:22/run/podman/podman.sock
+#       tcp/tls remote tcp://10.10.1.136:9443
 #
 #    uri = "ssh://user@production.example.com/run/user/1001/podman/podman.sock"
 #    Path to file containing ssh identity key
 #    identity = "~/.ssh/id_rsa"
+#    Path to PEM file containing TLS client certificate
+#    tls_cert = "/path/to/certs/podman/tls.crt"
+#    Path to PEM file containing TLS client certificate private key
+#    tls_key = "/path/to/certs/podman/tls.key"
+#    Path to PEM file containing TLS certificate authority (CA) bundle
+#    tls_ca = "/path/to/certs/podman/ca.crt"
 
 # Directory for temporary files. Must be tmpfs (wiped after reboot)
 #
diff --git a/vendor/go.podman.io/common/pkg/config/containers.conf-freebsd b/vendor/go.podman.io/common/pkg/config/containers.conf-freebsd
index b57160b1097..bd999c339c9 100644
--- a/vendor/go.podman.io/common/pkg/config/containers.conf-freebsd
+++ b/vendor/go.podman.io/common/pkg/config/containers.conf-freebsd
@@ -598,10 +598,17 @@ default_sysctls = [
 #       rootful "unix:///run/podman/podman.sock (Default)
 #       remote rootless ssh://engineering.lab.company.com/run/user/1000/podman/podman.sock
 #       remote rootful ssh://root@10.10.1.136:22/run/podman/podman.sock
+#       tcp/tls remote tcp://10.10.1.136:9443
 #
 #    uri = "ssh://user@production.example.com/run/user/1001/podman/podman.sock"
 #    Path to file containing ssh identity key
 #    identity = "~/.ssh/id_rsa"
+#    Path to PEM file containing TLS client certificate
+#    tls_cert = "/path/to/certs/podman/tls.crt"
+#    Path to PEM file containing TLS client certificate private key
+#    tls_key = "/path/to/certs/podman/tls.key"
+#    Path to PEM file containing TLS certificate authority (CA) bundle
+#    tls_ca = "/path/to/certs/podman/ca.crt"
 
 # Directory for temporary files. Must be tmpfs (wiped after reboot)
 #
diff --git a/vendor/go.podman.io/storage/drivers/fsdiff.go b/vendor/go.podman.io/storage/drivers/fsdiff.go
index 37684466d21..77f98d49da1 100644
--- a/vendor/go.podman.io/storage/drivers/fsdiff.go
+++ b/vendor/go.podman.io/storage/drivers/fsdiff.go
@@ -151,7 +151,7 @@ func (gdw *NaiveDiffDriver) Changes(id string, idMappings *idtools.IDMappings, p
 // ApplyDiff extracts the changeset from the given diff into the
 // layer with the specified id and parent, returning the size of the
 // new layer in bytes.
-func (gdw *NaiveDiffDriver) ApplyDiff(id, parent string, options ApplyDiffOpts) (size int64, err error) {
+func (gdw *NaiveDiffDriver) ApplyDiff(id, parent string, options ApplyDiffOpts) (int64, error) {
 	driver := gdw.ProtoDriver
 
 	if options.Mappings == nil {
@@ -164,7 +164,7 @@ func (gdw *NaiveDiffDriver) ApplyDiff(id, parent string, options ApplyDiffOpts)
 	}
 	layerFs, err := driver.Get(id, mountOpts)
 	if err != nil {
-		return
+		return -1, err
 	}
 	defer driverPut(driver, id, &err)
 
@@ -185,19 +185,20 @@ func (gdw *NaiveDiffDriver) ApplyDiff(id, parent string, options ApplyDiffOpts)
 	}
 	start := time.Now().UTC()
 	logrus.Debug("Start untar layer")
-	if size, err = ApplyUncompressedLayer(layerFs, options.Diff, tarOptions); err != nil {
+	size, err := ApplyUncompressedLayer(layerFs, options.Diff, tarOptions)
+	if err != nil {
 		logrus.Errorf("While applying layer: %s", err)
-		return
+		return -1, err
 	}
 	logrus.Debugf("Untar time: %vs", time.Now().UTC().Sub(start).Seconds())
 
-	return
+	return size, nil
 }
 
 // DiffSize calculates the changes between the specified layer
 // and its parent and returns the size in bytes of the changes
 // relative to its base filesystem directory.
-func (gdw *NaiveDiffDriver) DiffSize(id string, idMappings *idtools.IDMappings, parent string, parentMappings *idtools.IDMappings, mountLabel string) (size int64, err error) {
+func (gdw *NaiveDiffDriver) DiffSize(id string, idMappings *idtools.IDMappings, parent string, parentMappings *idtools.IDMappings, mountLabel string) (int64, error) {
 	driver := gdw.ProtoDriver
 
 	if idMappings == nil {
@@ -209,7 +210,7 @@ func (gdw *NaiveDiffDriver) DiffSize(id string, idMappings *idtools.IDMappings,
 
 	changes, err := gdw.Changes(id, idMappings, parent, parentMappings, mountLabel)
 	if err != nil {
-		return
+		return 0, err
 	}
 
 	options := MountOpts{
@@ -217,7 +218,7 @@ func (gdw *NaiveDiffDriver) DiffSize(id string, idMappings *idtools.IDMappings,
 	}
 	layerFs, err := driver.Get(id, options)
 	if err != nil {
-		return
+		return 0, err
 	}
 	defer driverPut(driver, id, &err)
 
diff --git a/vendor/go.podman.io/storage/internal/tempdir/tempdir.go b/vendor/go.podman.io/storage/internal/tempdir/tempdir.go
index 666742c5a06..6522c45d18a 100644
--- a/vendor/go.podman.io/storage/internal/tempdir/tempdir.go
+++ b/vendor/go.podman.io/storage/internal/tempdir/tempdir.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/sirupsen/logrus"
 	"go.podman.io/storage/internal/staging_lockfile"
+	"go.podman.io/storage/pkg/system"
 )
 
 /*
@@ -148,7 +149,7 @@ func RecoverStaleDirs(rootDir string) error {
 			continue
 		}
 
-		if rmErr := os.RemoveAll(tempDirPath); rmErr != nil {
+		if rmErr := system.EnsureRemoveAll(tempDirPath); rmErr != nil {
 			recoveryErrors = append(recoveryErrors, fmt.Errorf("error removing stale temp dir: %w", rmErr))
 		}
 		if unlockErr := instanceLock.UnlockAndDelete(); unlockErr != nil {
@@ -218,7 +219,7 @@ func (td *TempDir) Cleanup() error {
 		return nil
 	}
 
-	if err := os.RemoveAll(td.tempDirPath); err != nil {
+	if err := system.EnsureRemoveAll(td.tempDirPath); err != nil {
 		return fmt.Errorf("removing temp dir failed: %w", err)
 	}
 
diff --git a/vendor/go.podman.io/storage/layers.go b/vendor/go.podman.io/storage/layers.go
index c6752927e3c..64d3f5c72cc 100644
--- a/vendor/go.podman.io/storage/layers.go
+++ b/vendor/go.podman.io/storage/layers.go
@@ -2694,5 +2694,5 @@ func closeAll(closes ...func() error) (rErr error) {
 			rErr = fmt.Errorf("%v: %w", err, rErr)
 		}
 	}
-	return
+	return rErr
 }
diff --git a/vendor/go.podman.io/storage/pkg/archive/archive.go b/vendor/go.podman.io/storage/pkg/archive/archive.go
index 5f8647af7c2..5cdd7513075 100644
--- a/vendor/go.podman.io/storage/pkg/archive/archive.go
+++ b/vendor/go.podman.io/storage/pkg/archive/archive.go
@@ -417,9 +417,7 @@ func FileInfoHeader(name string, fi os.FileInfo, link string) (*tar.Header, erro
 		return nil, fmt.Errorf("tar: cannot canonicalize path: %w", err)
 	}
 	hdr.Name = name
-	if err := setHeaderForSpecialDevice(hdr, name, fi.Sys()); err != nil {
-		return nil, err
-	}
+	setHeaderForSpecialDevice(hdr, name, fi.Sys())
 	return hdr, nil
 }
 
diff --git a/vendor/go.podman.io/storage/pkg/archive/archive_linux.go b/vendor/go.podman.io/storage/pkg/archive/archive_linux.go
index fd7123babc9..4613ee32f72 100644
--- a/vendor/go.podman.io/storage/pkg/archive/archive_linux.go
+++ b/vendor/go.podman.io/storage/pkg/archive/archive_linux.go
@@ -30,7 +30,7 @@ type overlayWhiteoutConverter struct {
 	rolayers []string
 }
 
-func (o overlayWhiteoutConverter) ConvertWrite(hdr *tar.Header, path string, fi os.FileInfo) (wo *tar.Header, err error) {
+func (o overlayWhiteoutConverter) ConvertWrite(hdr *tar.Header, path string, fi os.FileInfo) (*tar.Header, error) {
 	// convert whiteouts to AUFS format
 	if fi.Mode()&os.ModeCharDevice != 0 && hdr.Devmajor == 0 && hdr.Devminor == 0 {
 		// we just rename the file and make it normal
@@ -73,7 +73,7 @@ func (o overlayWhiteoutConverter) ConvertWrite(hdr *tar.Header, path string, fi
 					// add a whiteout for this item in this layer.
 					// create a header for the whiteout file
 					// it should inherit some properties from the parent, but be a regular file
-					wo = &tar.Header{
+					wo := &tar.Header{
 						Typeflag:   tar.TypeReg,
 						Mode:       hdr.Mode & int64(os.ModePerm),
 						Name:       filepath.Join(hdr.Name, WhiteoutOpaqueDir),
@@ -85,7 +85,7 @@ func (o overlayWhiteoutConverter) ConvertWrite(hdr *tar.Header, path string, fi
 						AccessTime: hdr.AccessTime,
 						ChangeTime: hdr.ChangeTime,
 					}
-					break
+					return wo, nil
 				}
 				for dir := filepath.Dir(hdr.Name); dir != "" && dir != "." && dir != string(os.PathSeparator); dir = filepath.Dir(dir) {
 					// Check for whiteout for a parent directory in a parent layer.
@@ -109,7 +109,7 @@ func (o overlayWhiteoutConverter) ConvertWrite(hdr *tar.Header, path string, fi
 		}
 	}
 
-	return
+	return nil, nil
 }
 
 func (overlayWhiteoutConverter) ConvertReadWithHandler(hdr *tar.Header, path string, handler TarWhiteoutHandler) (bool, error) {
diff --git a/vendor/go.podman.io/storage/pkg/archive/archive_unix.go b/vendor/go.podman.io/storage/pkg/archive/archive_unix.go
index 0ff57165846..b09b0644353 100644
--- a/vendor/go.podman.io/storage/pkg/archive/archive_unix.go
+++ b/vendor/go.podman.io/storage/pkg/archive/archive_unix.go
@@ -69,7 +69,7 @@ func chmodTarEntry(perm os.FileMode) os.FileMode {
 	return perm // noop for unix as golang APIs provide perm bits correctly
 }
 
-func setHeaderForSpecialDevice(hdr *tar.Header, name string, stat any) (err error) {
+func setHeaderForSpecialDevice(hdr *tar.Header, name string, stat any) {
 	s, ok := stat.(*syscall.Stat_t)
 
 	if ok {
@@ -82,8 +82,6 @@ func setHeaderForSpecialDevice(hdr *tar.Header, name string, stat any) (err erro
 			hdr.Devminor = int64(minor(uint64(s.Rdev))) //nolint: unconvert,nolintlint
 		}
 	}
-
-	return
 }
 
 func getInodeFromStat(stat any) (inode uint64) {
@@ -93,7 +91,7 @@ func getInodeFromStat(stat any) (inode uint64) {
 		inode = s.Ino
 	}
 
-	return
+	return inode
 }
 
 func getFileUIDGID(stat any) (idtools.IDPair, error) {
diff --git a/vendor/go.podman.io/storage/pkg/archive/archive_windows.go b/vendor/go.podman.io/storage/pkg/archive/archive_windows.go
index 1183f4a282e..2c84e9ea541 100644
--- a/vendor/go.podman.io/storage/pkg/archive/archive_windows.go
+++ b/vendor/go.podman.io/storage/pkg/archive/archive_windows.go
@@ -52,14 +52,13 @@ func chmodTarEntry(perm os.FileMode) os.FileMode {
 	return noPermPart | permPart
 }
 
-func setHeaderForSpecialDevice(hdr *tar.Header, name string, stat interface{}) (err error) {
+func setHeaderForSpecialDevice(hdr *tar.Header, name string, stat interface{}) {
 	// do nothing. no notion of Rdev, Nlink in stat on Windows
-	return
 }
 
-func getInodeFromStat(stat interface{}) (inode uint64) {
+func getInodeFromStat(stat interface{}) uint64 {
 	// do nothing. no notion of Inode in stat on Windows
-	return
+	return 0
 }
 
 // handleTarTypeBlockCharFifo is an OS-specific helper function used by
diff --git a/vendor/go.podman.io/storage/pkg/archive/changes.go b/vendor/go.podman.io/storage/pkg/archive/changes.go
index e9e35198198..a60c20dd361 100644
--- a/vendor/go.podman.io/storage/pkg/archive/changes.go
+++ b/vendor/go.podman.io/storage/pkg/archive/changes.go
@@ -86,12 +86,12 @@ func Changes(layers []string, rw string) ([]Change, error) {
 	return changes(layers, rw, aufsDeletedFile, aufsMetadataSkip, aufsWhiteoutPresent)
 }
 
-func aufsMetadataSkip(path string) (skip bool, err error) {
-	skip, err = filepath.Match(string(os.PathSeparator)+WhiteoutMetaPrefix+"*", path)
+func aufsMetadataSkip(path string) (bool, error) {
+	skip, err := filepath.Match(string(os.PathSeparator)+WhiteoutMetaPrefix+"*", path)
 	if err != nil {
 		skip = true
 	}
-	return
+	return skip, err
 }
 
 func aufsDeletedFile(root, path string, fi os.FileInfo) (string, error) {
diff --git a/vendor/go.podman.io/storage/pkg/archive/changes_windows.go b/vendor/go.podman.io/storage/pkg/archive/changes_windows.go
index 947ec2d224f..997ee574e2e 100644
--- a/vendor/go.podman.io/storage/pkg/archive/changes_windows.go
+++ b/vendor/go.podman.io/storage/pkg/archive/changes_windows.go
@@ -20,8 +20,8 @@ func (info *FileInfo) isDir() bool {
 	return info.parent == nil || info.stat.Mode().IsDir()
 }
 
-func getIno(fi os.FileInfo) (inode uint64) {
-	return
+func getIno(fi os.FileInfo) uint64 {
+	return 0
 }
 
 func hasHardlinks(fi os.FileInfo) bool {
diff --git a/vendor/go.podman.io/storage/pkg/archive/copy.go b/vendor/go.podman.io/storage/pkg/archive/copy.go
index 308f132d586..3f91c72b991 100644
--- a/vendor/go.podman.io/storage/pkg/archive/copy.go
+++ b/vendor/go.podman.io/storage/pkg/archive/copy.go
@@ -93,13 +93,13 @@ func TarResource(sourceInfo CopyInfo) (content io.ReadCloser, err error) {
 
 // TarResourceRebase is like TarResource but renames the first path element of
 // items in the resulting tar archive to match the given rebaseName if not "".
-func TarResourceRebase(sourcePath, rebaseName string) (content io.ReadCloser, err error) {
+func TarResourceRebase(sourcePath, rebaseName string) (io.ReadCloser, error) {
 	sourcePath = normalizePath(sourcePath)
-	if err = fileutils.Lexists(sourcePath); err != nil {
+	if err := fileutils.Lexists(sourcePath); err != nil {
 		// Catches the case where the source does not exist or is not a
 		// directory if asserted to be a directory, as this also causes an
 		// error.
-		return
+		return nil, err
 	}
 
 	// Separate the source path between its directory and
@@ -411,7 +411,7 @@ func ResolveHostSourcePath(path string, followLink bool) (resolvedPath, rebaseNa
 	if followLink {
 		resolvedPath, err = filepath.EvalSymlinks(path)
 		if err != nil {
-			return
+			return "", "", err
 		}
 
 		resolvedPath, rebaseName = GetRebaseName(path, resolvedPath)
@@ -422,7 +422,7 @@ func ResolveHostSourcePath(path string, followLink bool) (resolvedPath, rebaseNa
 		var resolvedDirPath string
 		resolvedDirPath, err = filepath.EvalSymlinks(dirPath)
 		if err != nil {
-			return
+			return "", "", err
 		}
 		// resolvedDirPath will have been cleaned (no trailing path separators) so
 		// we can manually join it with the base path element.
diff --git a/vendor/go.podman.io/storage/pkg/archive/time_linux.go b/vendor/go.podman.io/storage/pkg/archive/time_linux.go
index 3448569b1eb..a5233c09f60 100644
--- a/vendor/go.podman.io/storage/pkg/archive/time_linux.go
+++ b/vendor/go.podman.io/storage/pkg/archive/time_linux.go
@@ -10,7 +10,7 @@ func timeToTimespec(time time.Time) (ts syscall.Timespec) {
 		// Return UTIME_OMIT special value
 		ts.Sec = 0
 		ts.Nsec = ((1 << 30) - 2)
-		return
+		return ts
 	}
 	return syscall.NsecToTimespec(time.UnixNano())
 }
diff --git a/vendor/go.podman.io/storage/pkg/archive/wrap.go b/vendor/go.podman.io/storage/pkg/archive/wrap.go
index 903befd7630..f8a97254eed 100644
--- a/vendor/go.podman.io/storage/pkg/archive/wrap.go
+++ b/vendor/go.podman.io/storage/pkg/archive/wrap.go
@@ -45,8 +45,8 @@ func Generate(input ...string) (io.Reader, error) {
 	return buf, nil
 }
 
-func parseStringPairs(input ...string) (output [][2]string) {
-	output = make([][2]string, 0, len(input)/2+1)
+func parseStringPairs(input ...string) [][2]string {
+	output := make([][2]string, 0, len(input)/2+1)
 	for i := 0; i < len(input); i += 2 {
 		var pair [2]string
 		pair[0] = input[i]
@@ -55,5 +55,5 @@ func parseStringPairs(input ...string) (output [][2]string) {
 		}
 		output = append(output, pair)
 	}
-	return
+	return output
 }
diff --git a/vendor/go.podman.io/storage/pkg/chunked/filesystem_linux.go b/vendor/go.podman.io/storage/pkg/chunked/filesystem_linux.go
index 3f8311bffc0..ceba7d0f3d9 100644
--- a/vendor/go.podman.io/storage/pkg/chunked/filesystem_linux.go
+++ b/vendor/go.podman.io/storage/pkg/chunked/filesystem_linux.go
@@ -150,7 +150,7 @@ func timeToTimespec(time *time.Time) (ts unix.Timespec) {
 		// Return UTIME_OMIT special value
 		ts.Sec = 0
 		ts.Nsec = ((1 << 30) - 2)
-		return
+		return ts
 	}
 	return unix.NsecToTimespec(time.UnixNano())
 }
diff --git a/vendor/go.podman.io/storage/pkg/chunked/storage_linux.go b/vendor/go.podman.io/storage/pkg/chunked/storage_linux.go
index e6e3c9c6d14..23baef9a458 100644
--- a/vendor/go.podman.io/storage/pkg/chunked/storage_linux.go
+++ b/vendor/go.podman.io/storage/pkg/chunked/storage_linux.go
@@ -1277,7 +1277,7 @@ func ensureAllBlobsDone(streamsOrErrors chan streamOrErr) (retErr error) {
 			retErr = soe.err
 		}
 	}
-	return
+	return retErr
 }
 
 // getBlobAtConverterGoroutine reads from the streams and errs channels, then sends
diff --git a/vendor/go.podman.io/storage/pkg/directory/directory_unix.go b/vendor/go.podman.io/storage/pkg/directory/directory_unix.go
index 9855abd13e9..8f0a373911b 100644
--- a/vendor/go.podman.io/storage/pkg/directory/directory_unix.go
+++ b/vendor/go.podman.io/storage/pkg/directory/directory_unix.go
@@ -19,10 +19,10 @@ func Size(dir string) (size int64, err error) {
 }
 
 // Usage walks a directory tree and returns its total size in bytes and the number of inodes.
-func Usage(dir string) (usage *DiskUsage, err error) {
-	usage = &DiskUsage{}
+func Usage(dir string) (*DiskUsage, error) {
+	usage := &DiskUsage{}
 	data := make(map[uint64]struct{})
-	err = filepath.WalkDir(dir, func(d string, entry fs.DirEntry, err error) error {
+	err := filepath.WalkDir(dir, func(d string, entry fs.DirEntry, err error) error {
 		if err != nil {
 			// if dir does not exist, Usage() returns the error.
 			// if dir/x disappeared while walking, Usage() ignores dir/x.
@@ -58,5 +58,5 @@ func Usage(dir string) (usage *DiskUsage, err error) {
 	})
 	// inode count is the number of unique inode numbers we saw
 	usage.InodeCount = int64(len(data))
-	return
+	return usage, err
 }
diff --git a/vendor/go.podman.io/storage/pkg/directory/directory_windows.go b/vendor/go.podman.io/storage/pkg/directory/directory_windows.go
index c2145c26fc8..6acedcc8ced 100644
--- a/vendor/go.podman.io/storage/pkg/directory/directory_windows.go
+++ b/vendor/go.podman.io/storage/pkg/directory/directory_windows.go
@@ -18,9 +18,9 @@ func Size(dir string) (size int64, err error) {
 }
 
 // Usage walks a directory tree and returns its total size in bytes and the number of inodes.
-func Usage(dir string) (usage *DiskUsage, err error) {
-	usage = &DiskUsage{}
-	err = filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
+func Usage(dir string) (*DiskUsage, error) {
+	usage := &DiskUsage{}
+	err := filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
 		if err != nil {
 			// if dir does not exist, Size() returns the error.
 			// if dir/x disappeared while walking, Size() ignores dir/x.
@@ -48,5 +48,5 @@ func Usage(dir string) (usage *DiskUsage, err error) {
 
 		return nil
 	})
-	return
+	return usage, err
 }
diff --git a/vendor/go.podman.io/storage/pkg/ioutils/bytespipe.go b/vendor/go.podman.io/storage/pkg/ioutils/bytespipe.go
index cf605803598..47ab3450728 100644
--- a/vendor/go.podman.io/storage/pkg/ioutils/bytespipe.go
+++ b/vendor/go.podman.io/storage/pkg/ioutils/bytespipe.go
@@ -121,7 +121,8 @@ func (bp *BytesPipe) Close() error {
 
 // Read reads bytes from BytesPipe.
 // Data could be read only once.
-func (bp *BytesPipe) Read(p []byte) (n int, err error) {
+func (bp *BytesPipe) Read(p []byte) (int, error) {
+	var n int
 	bp.mu.Lock()
 	if bp.bufLen == 0 {
 		if bp.closeErr != nil {
@@ -158,7 +159,7 @@ func (bp *BytesPipe) Read(p []byte) (n int, err error) {
 
 	bp.wait.Broadcast()
 	bp.mu.Unlock()
-	return
+	return n, nil
 }
 
 func returnBuffer(b *fixedBuffer) {
diff --git a/vendor/go.podman.io/storage/pkg/ioutils/readers.go b/vendor/go.podman.io/storage/pkg/ioutils/readers.go
index 146e1a5ff05..aed1cb0331f 100644
--- a/vendor/go.podman.io/storage/pkg/ioutils/readers.go
+++ b/vendor/go.podman.io/storage/pkg/ioutils/readers.go
@@ -83,7 +83,7 @@ func (r *OnEOFReader) Read(p []byte) (n int, err error) {
 	if err == io.EOF {
 		r.runFunc()
 	}
-	return
+	return n, err
 }
 
 // Close closes the file and run the function.
diff --git a/vendor/go.podman.io/storage/pkg/ioutils/writers.go b/vendor/go.podman.io/storage/pkg/ioutils/writers.go
index 0b6d0a7a6de..2a8007e4461 100644
--- a/vendor/go.podman.io/storage/pkg/ioutils/writers.go
+++ b/vendor/go.podman.io/storage/pkg/ioutils/writers.go
@@ -59,8 +59,8 @@ func NewWriteCounter(w io.Writer) *WriteCounter {
 	}
 }
 
-func (wc *WriteCounter) Write(p []byte) (count int, err error) {
-	count, err = wc.Writer.Write(p)
+func (wc *WriteCounter) Write(p []byte) (int, error) {
+	count, err := wc.Writer.Write(p)
 	wc.Count += int64(count)
-	return
+	return count, err
 }
diff --git a/vendor/go.podman.io/storage/pkg/pools/pools.go b/vendor/go.podman.io/storage/pkg/pools/pools.go
index 78b729c2e37..1179d9b9336 100644
--- a/vendor/go.podman.io/storage/pkg/pools/pools.go
+++ b/vendor/go.podman.io/storage/pkg/pools/pools.go
@@ -59,11 +59,11 @@ func (bufPool *BufioReaderPool) Put(b *bufio.Reader) {
 }
 
 // Copy is a convenience wrapper which uses a buffer to avoid allocation in io.Copy.
-func Copy(dst io.Writer, src io.Reader) (written int64, err error) {
+func Copy(dst io.Writer, src io.Reader) (int64, error) {
 	buf := BufioReader32KPool.Get(src)
-	written, err = io.Copy(dst, buf)
+	written, err := io.Copy(dst, buf)
 	BufioReader32KPool.Put(buf)
-	return
+	return written, err
 }
 
 // NewReadCloserWrapper returns a wrapper which puts the bufio.Reader back
diff --git a/vendor/go.podman.io/storage/pkg/system/exitcode.go b/vendor/go.podman.io/storage/pkg/system/exitcode.go
index 60f0514b1dd..4d7b5c88058 100644
--- a/vendor/go.podman.io/storage/pkg/system/exitcode.go
+++ b/vendor/go.podman.io/storage/pkg/system/exitcode.go
@@ -29,5 +29,5 @@ func ProcessExitCode(err error) (exitCode int) {
 			exitCode = 127
 		}
 	}
-	return
+	return exitCode
 }
diff --git a/vendor/go.podman.io/storage/pkg/system/stat_netbsd.go b/vendor/go.podman.io/storage/pkg/system/stat_netbsd.go
index 715f05b9387..57850a883fe 100644
--- a/vendor/go.podman.io/storage/pkg/system/stat_netbsd.go
+++ b/vendor/go.podman.io/storage/pkg/system/stat_netbsd.go
@@ -4,10 +4,12 @@ import "syscall"
 
 // fromStatT converts a syscall.Stat_t type to a system.Stat_t type
 func fromStatT(s *syscall.Stat_t) (*StatT, error) {
-	return &StatT{size: s.Size,
+	return &StatT{
+		size: s.Size,
 		mode: uint32(s.Mode),
 		uid:  s.Uid,
 		gid:  s.Gid,
 		rdev: uint64(s.Rdev),
-		mtim: s.Mtimespec}, nil
+		mtim: s.Mtimespec,
+	}, nil
 }
diff --git a/vendor/go.podman.io/storage/pkg/system/xattrs_freebsd.go b/vendor/go.podman.io/storage/pkg/system/xattrs_freebsd.go
index 5d653976e54..f62f5f74549 100644
--- a/vendor/go.podman.io/storage/pkg/system/xattrs_freebsd.go
+++ b/vendor/go.podman.io/storage/pkg/system/xattrs_freebsd.go
@@ -17,12 +17,10 @@ const (
 	EOVERFLOW unix.Errno = unix.EOVERFLOW
 )
 
-var (
-	namespaceMap = map[string]int{
-		"user":   EXTATTR_NAMESPACE_USER,
-		"system": EXTATTR_NAMESPACE_SYSTEM,
-	}
-)
+var namespaceMap = map[string]int{
+	"user":   EXTATTR_NAMESPACE_USER,
+	"system": EXTATTR_NAMESPACE_SYSTEM,
+}
 
 func xattrToExtattr(xattr string) (namespace int, extattr string, err error) {
 	namespaceName, extattr, found := strings.Cut(xattr, ".")
diff --git a/vendor/go.podman.io/storage/pkg/truncindex/truncindex.go b/vendor/go.podman.io/storage/pkg/truncindex/truncindex.go
index c14a5cc4d2a..9b60338aa90 100644
--- a/vendor/go.podman.io/storage/pkg/truncindex/truncindex.go
+++ b/vendor/go.podman.io/storage/pkg/truncindex/truncindex.go
@@ -43,8 +43,8 @@ type TruncIndex struct {
 
 // NewTruncIndex creates a new TruncIndex and initializes with a list of IDs.
 // Invalid IDs are _silently_ ignored.
-func NewTruncIndex(ids []string) (idx *TruncIndex) {
-	idx = &TruncIndex{
+func NewTruncIndex(ids []string) *TruncIndex {
+	idx := &TruncIndex{
 		ids: make(map[string]struct{}),
 
 		// Change patricia max prefix per node length,
@@ -54,7 +54,7 @@ func NewTruncIndex(ids []string) (idx *TruncIndex) {
 	for _, id := range ids {
 		_ = idx.addID(id) // Ignore invalid IDs. Duplicate IDs are not a problem.
 	}
-	return
+	return idx
 }
 
 func (idx *TruncIndex) addID(id string) error {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 8279dce192c..d905471d531 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -136,7 +136,7 @@ github.com/docker/docker/client
 github.com/docker/docker/pkg/homedir
 github.com/docker/docker/pkg/jsonmessage
 github.com/docker/docker/pkg/stdcopy
-# github.com/docker/docker-credential-helpers v0.9.3
+# github.com/docker/docker-credential-helpers v0.9.4
 ## explicit; go 1.21
 github.com/docker/docker-credential-helpers/client
 github.com/docker/docker-credential-helpers/credentials
@@ -247,7 +247,7 @@ github.com/mattn/go-sqlite3
 # github.com/miekg/pkcs11 v1.1.1
 ## explicit; go 1.12
 github.com/miekg/pkcs11
-# github.com/mistifyio/go-zfs/v3 v3.0.1
+# github.com/mistifyio/go-zfs/v3 v3.1.0
 ## explicit; go 1.14
 github.com/mistifyio/go-zfs/v3
 # github.com/moby/buildkit v0.25.1
@@ -464,7 +464,7 @@ go.opentelemetry.io/otel/trace
 go.opentelemetry.io/otel/trace/embedded
 go.opentelemetry.io/otel/trace/internal/telemetry
 go.opentelemetry.io/otel/trace/noop
-# go.podman.io/common v0.65.1-0.20250916163606-92222dcd3da4
+# go.podman.io/common v0.65.1-0.20250916163606-92222dcd3da4 => github.com/nalind/containers-container-libs/common v0.0.0-20251008214453-186f379e5ba7
 ## explicit; go 1.24.2
 go.podman.io/common/internal
 go.podman.io/common/internal/attributedstring
@@ -518,7 +518,7 @@ go.podman.io/common/pkg/umask
 go.podman.io/common/pkg/util
 go.podman.io/common/pkg/version
 go.podman.io/common/version
-# go.podman.io/image/v5 v5.37.1-0.20250916163606-92222dcd3da4
+# go.podman.io/image/v5 v5.37.1-0.20250916163606-92222dcd3da4 => github.com/nalind/containers-container-libs/image/v5 v5.0.0-20251008214453-186f379e5ba7
 ## explicit; go 1.24.0
 go.podman.io/image/v5/copy
 go.podman.io/image/v5/directory
@@ -586,7 +586,7 @@ go.podman.io/image/v5/transports
 go.podman.io/image/v5/transports/alltransports
 go.podman.io/image/v5/types
 go.podman.io/image/v5/version
-# go.podman.io/storage v1.60.1-0.20250916163606-92222dcd3da4
+# go.podman.io/storage v1.60.1-0.20250916163606-92222dcd3da4 => github.com/nalind/containers-container-libs/storage v0.0.0-20251008214453-186f379e5ba7
 ## explicit; go 1.24.0
 go.podman.io/storage
 go.podman.io/storage/drivers
@@ -826,3 +826,6 @@ tags.cncf.io/container-device-interface/pkg/parser
 # tags.cncf.io/container-device-interface/specs-go v1.0.0
 ## explicit; go 1.19
 tags.cncf.io/container-device-interface/specs-go
+# go.podman.io/common => github.com/nalind/containers-container-libs/common v0.0.0-20251008214453-186f379e5ba7
+# go.podman.io/storage => github.com/nalind/containers-container-libs/storage v0.0.0-20251008214453-186f379e5ba7
+# go.podman.io/image/v5 => github.com/nalind/containers-container-libs/image/v5 v5.0.0-20251008214453-186f379e5ba7