@@ -41,7 +41,7 @@ func getCgroupFromBuildOutput(buildOutput io.Reader) (string, error) {

 // Returns the container cgroup and daemon cgroup.

 func testBuildWithCgroupNs(ctx context.Context, t *testing.T, daemonNsMode string) (string, string) {

 	d := daemon.New(t, daemon.WithDefaultCgroupNamespaceMode(daemonNsMode))

-	d.StartWithBusybox(ctx, t)

+	d.StartWithBusybox(ctx, t, "--iptables=false", "--ip6tables=false")

 	defer d.Stop(t)

 	dockerfile := `

@@ -72,6 +72,8 @@ func TestCgroupNamespacesBuild(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon())

 	skip.If(t, !requirement.CgroupNamespacesEnabled())

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	// When the daemon defaults to private cgroup namespaces, containers launched

@@ -85,6 +87,8 @@ func TestCgroupNamespacesBuildDaemonHostMode(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon())

 	skip.If(t, !requirement.CgroupNamespacesEnabled())

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	// When the daemon defaults to host cgroup namespaces, containers

@@ -26,13 +26,15 @@ func TestCreateWithCDIDevices(t *testing.T) {

 	skip.If(t, testEnv.DaemonInfo.OSType != "linux", "CDI devices are only supported on Linux")

 	skip.If(t, testEnv.IsRemoteDaemon, "cannot run cdi tests with a remote daemon")

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	cwd, err := os.Getwd()

 	assert.NilError(t, err)

 	d := daemon.New(t)

-	d.StartWithBusybox(ctx, t, "--cdi-spec-dir="+filepath.Join(cwd, "testdata", "cdi"))

+	d.StartWithBusybox(ctx, t, "--cdi-spec-dir="+filepath.Join(cwd, "testdata", "cdi"), "--iptables=false", "--ip6tables=false")

 	defer d.Stop(t)

 	apiClient := d.NewClientT(t)

@@ -74,6 +76,8 @@ func TestCDISpecDirsAreInSystemInfo(t *testing.T) {

 	// TODO: This restriction can be relaxed with https://github.com/moby/moby/pull/46158

 	skip.If(t, testEnv.IsRootless, "the t.TempDir test creates a folder with incorrect permissions for rootless")

+	t.Parallel()

+

 	testCases := []struct {

 		description             string

 		config                  string

@@ -146,6 +150,7 @@ func TestCDISpecDirsAreInSystemInfo(t *testing.T) {

 				args = append(args, "--config-file="+configPath)

 			}

+			args = append(args, "--iptables=false", "--ip6tables=false")

 			d.Start(t, args...)

 			defer d.Stop(t)

@@ -160,6 +165,8 @@ func TestCDIInfoDiscoveredDevices(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon, "cannot run daemon when remote daemon")

 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "CDI not supported on Windows")

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	// Create a sample CDI spec file

@@ -185,7 +192,7 @@ func TestCDIInfoDiscoveredDevices(t *testing.T) {

 	assert.NilError(t, err, "Failed to write sample CDI spec file")

 	d := daemon.New(t)

-	d.Start(t, "--feature", "cdi", "--cdi-spec-dir="+cdiDir)

+	d.Start(t, "--feature", "cdi", "--cdi-spec-dir="+cdiDir, "--iptables=false", "--ip6tables=false")

 	defer d.Stop(t)

 	c := d.NewClientT(t)

@@ -59,17 +59,19 @@ func TestExportContainerAfterDaemonRestart(t *testing.T) {

 	skip.If(t, testEnv.DaemonInfo.OSType == "windows")

 	skip.If(t, testEnv.IsRemoteDaemon)

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	d := daemon.New(t)

 	c := d.NewClientT(t)

-	d.StartWithBusybox(ctx, t)

+	d.StartWithBusybox(ctx, t, "--iptables=false", "--ip6tables=false")

 	defer d.Stop(t)

 	ctrID := container.Create(ctx, t, c)

-	d.Restart(t)

+	d.Restart(t, "--iptables=false", "--ip6tables=false")

 	res, err := c.ContainerExport(ctx, ctrID, client.ContainerExportOptions{})

 	assert.NilError(t, err)

@@ -18,7 +18,7 @@ func testRunWithCgroupNs(ctx context.Context, t *testing.T, daemonNsMode string,

 	d := daemon.New(t, daemon.WithDefaultCgroupNamespaceMode(daemonNsMode))

 	apiClient := d.NewClientT(t)

-	d.StartWithBusybox(ctx, t)

+	d.StartWithBusybox(ctx, t, "--iptables=false", "--ip6tables=false")

 	defer d.Stop(t)

 	cID := container.Run(ctx, t, apiClient, containerOpts...)

@@ -34,7 +34,7 @@ func testCreateFailureWithCgroupNs(ctx context.Context, t *testing.T, daemonNsMo

 	d := daemon.New(t, daemon.WithDefaultCgroupNamespaceMode(daemonNsMode))

 	apiClient := d.NewClientT(t)

-	d.StartWithBusybox(ctx, t)

+	d.StartWithBusybox(ctx, t, "--iptables=false", "--ip6tables=false")

 	defer d.Stop(t)

 	_, err := container.CreateFromConfig(ctx, apiClient, container.NewTestConfig(containerOpts...))

 	assert.ErrorContains(t, err, errStr)

@@ -45,6 +45,8 @@ func TestCgroupNamespacesRun(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon())

 	skip.If(t, !requirement.CgroupNamespacesEnabled())

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	// When the daemon defaults to private cgroup namespaces, containers launched

@@ -59,6 +61,8 @@ func TestCgroupNamespacesRunPrivileged(t *testing.T) {

 	skip.If(t, !requirement.CgroupNamespacesEnabled())

 	skip.If(t, testEnv.DaemonInfo.CgroupVersion == "2", "on cgroup v2, privileged containers use private cgroupns")

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	// When the daemon defaults to private cgroup namespaces, privileged containers

@@ -72,6 +76,8 @@ func TestCgroupNamespacesRunDaemonHostMode(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon())

 	skip.If(t, !requirement.CgroupNamespacesEnabled())

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	// When the daemon defaults to host cgroup namespaces, containers

@@ -85,6 +91,8 @@ func TestCgroupNamespacesRunHostMode(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon())

 	skip.If(t, !requirement.CgroupNamespacesEnabled())

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	// When the daemon defaults to private cgroup namespaces, containers launched

@@ -98,6 +106,8 @@ func TestCgroupNamespacesRunPrivateMode(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon())

 	skip.If(t, !requirement.CgroupNamespacesEnabled())

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	// When the daemon defaults to private cgroup namespaces, containers launched

@@ -111,6 +121,8 @@ func TestCgroupNamespacesRunPrivilegedAndPrivate(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon())

 	skip.If(t, !requirement.CgroupNamespacesEnabled())

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	containerCgroup, daemonCgroup := testRunWithCgroupNs(ctx, t, "private", container.WithPrivileged(true), container.WithCgroupnsMode("private"))

@@ -122,6 +134,8 @@ func TestCgroupNamespacesRunInvalidMode(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon())

 	skip.If(t, !requirement.CgroupNamespacesEnabled())

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	// An invalid cgroup namespace mode should return an error on container creation

@@ -136,12 +150,14 @@ func TestCgroupNamespacesRunOlderClient(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon())

 	skip.If(t, !requirement.CgroupNamespacesEnabled())

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	d := daemon.New(t, daemon.WithEnvVars("DOCKER_MIN_API_VERSION=1.39"), daemon.WithDefaultCgroupNamespaceMode("private"))

 	apiClient := d.NewClientT(t, client.WithAPIVersion("1.39"))

-	d.StartWithBusybox(ctx, t)

+	d.StartWithBusybox(ctx, t, "--iptables=false", "--ip6tables=false")

 	defer d.Stop(t)

 	cID := container.Run(ctx, t, apiClient)

@@ -23,6 +23,8 @@ func TestNRIContainerCreateEnvVarMod(t *testing.T) {

 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "cannot start a separate daemon with NRI enabled on Windows")

 	skip.If(t, testEnv.IsRootless)

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	sockPath := filepath.Join(t.TempDir(), "nri.sock")

@@ -78,6 +80,8 @@ func TestNRIContainerCreateUnsupportedAdj(t *testing.T) {

 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "cannot start a separate daemon with NRI enabled on Windows")

 	skip.If(t, testEnv.IsRootless)

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	sockPath := filepath.Join(t.TempDir(), "nri.sock")

@@ -138,6 +142,8 @@ func TestNRIContainerCreateAddMount(t *testing.T) {

 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "cannot start a separate daemon with NRI enabled on Windows")

 	skip.If(t, testEnv.IsRootless)

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	sockPath := filepath.Join(t.TempDir(), "nri.sock")

@@ -258,6 +264,8 @@ func TestNRIReload(t *testing.T) {

 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "cannot start a separate daemon with NRI enabled on Windows")

 	skip.If(t, testEnv.IsRootless)

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	const pluginName = "00-nri-test-plugin"

@@ -56,9 +56,11 @@ func TestUsernsCommit(t *testing.T) {

 	skip.If(t, !testEnv.IsUserNamespaceInKernel())

 	skip.If(t, testEnv.IsRootless())

+	t.Parallel()

+

 	ctx := context.Background()

 	dUserRemap := daemon.New(t, daemon.WithUserNsRemap("default"))

-	dUserRemap.StartWithBusybox(ctx, t)

+	dUserRemap.StartWithBusybox(ctx, t, "--iptables=false", "--ip6tables=false")

 	clientUserRemap := dUserRemap.NewClientT(t)

 	defer clientUserRemap.Close()

@@ -24,6 +24,8 @@ func TestDiskUsageConcurrentPrune(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon, "cannot run daemon when remote daemon")

 	skip.If(t, !testEnv.UsingSnapshotter(), "only happens with containerd image store")

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	d := daemon.New(t)

@@ -18,6 +18,8 @@ import (

 func TestDiskUsage(t *testing.T) {

 	skip.If(t, testEnv.DaemonInfo.OSType == "windows") // d.Start fails on Windows with `protocol not available`

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	d := daemon.New(t)

@@ -45,12 +45,14 @@ func TestInfoAPIWarnings(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon, "cannot run daemon when remote daemon")

 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "FIXME")

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	d := daemon.New(t)

 	c := d.NewClientT(t)

-	d.Start(t, "-H=0.0.0.0:23756", "-H="+d.Sock())

+	d.Start(t, "-H=0.0.0.0:23756", "-H="+d.Sock(), "--iptables=false", "--ip6tables=false")

 	defer d.Stop(t)

 	result, err := c.Info(ctx, client.InfoOptions{})

@@ -73,10 +75,12 @@ func TestInfoDebug(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon, "cannot run daemon when remote daemon")

 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "FIXME: test starts daemon with -H unix://.....")

+	t.Parallel()

+

 	_ = testutil.StartSpan(baseContext, t)

 	d := daemon.New(t)

-	d.Start(t, "--debug")

+	d.Start(t, "--debug", "--iptables=false", "--ip6tables=false")

 	defer d.Stop(t)

 	info := d.Info(t)

@@ -95,13 +99,15 @@ func TestInfoInsecureRegistries(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon, "cannot run daemon when remote daemon")

 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "FIXME: test starts daemon with -H unix://.....")

+	t.Parallel()

+

 	const (

 		registryCIDR = "192.168.1.0/24"

 		registryHost = "insecurehost.com:5000"

 	)

 	d := daemon.New(t)

-	d.Start(t, "--insecure-registry="+registryCIDR, "--insecure-registry="+registryHost)

+	d.Start(t, "--insecure-registry="+registryCIDR, "--insecure-registry="+registryHost, "--iptables=false", "--ip6tables=false")

 	defer d.Stop(t)

 	info := d.Info(t)

@@ -122,13 +128,15 @@ func TestInfoRegistryMirrors(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon, "cannot run daemon when remote daemon")

 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "FIXME: test starts daemon with -H unix://.....")

+	t.Parallel()

+

 	const (

 		registryMirror1 = "https://192.168.1.2"

 		registryMirror2 = "http://registry-mirror.example.com:5000"

 	)

 	d := daemon.New(t)

-	d.Start(t, "--registry-mirror="+registryMirror1, "--registry-mirror="+registryMirror2)

+	d.Start(t, "--registry-mirror="+registryMirror1, "--registry-mirror="+registryMirror2, "--iptables=false", "--ip6tables=false")

 	defer d.Stop(t)

 	info := d.Info(t)

@@ -101,14 +101,16 @@ func TestPingBuilderHeader(t *testing.T) {

 	skip.If(t, testEnv.IsRemoteDaemon)

 	skip.If(t, testEnv.DaemonInfo.OSType == "windows", "cannot spin up additional daemons on windows")

-	ctx := setupTest(t)

+	t.Parallel()

+

+	ctx := testutil.StartSpan(baseContext, t)

 	d := daemon.New(t)

 	apiClient := d.NewClientT(t)

 	defer apiClient.Close()

 	t.Run("default config", func(t *testing.T) {

 		testutil.StartSpan(ctx, t)

-		d.Start(t)

+		d.Start(t, "--iptables=false", "--ip6tables=false")

 		defer d.Stop(t)

 		expected := build.BuilderBuildKit

@@ -126,7 +128,7 @@ func TestPingBuilderHeader(t *testing.T) {

 		cfg := filepath.Join(d.RootDir(), "daemon.json")

 		err := os.WriteFile(cfg, []byte(`{"features": { "buildkit": false }}`), 0o644)

 		assert.NilError(t, err)

-		d.Start(t, "--config-file", cfg)

+		d.Start(t, "--config-file", cfg, "--iptables=false", "--ip6tables=false")

 		defer d.Stop(t)

 		expected := build.BuilderV1

@@ -436,6 +436,8 @@ func TestRunMountImageSubpathDaemonRestart(t *testing.T) {

 	skip.If(t, testEnv.IsRootless, "FIXME: https://github.com/moby/moby/issues/50999")

 	skip.If(t, !testEnv.UsingSnapshotter(), "FIXME: https://github.com/moby/moby/issues/50999")

+	t.Parallel()

+

 	ctx := testutil.StartSpan(baseContext, t)

 	d := daemon.New(t)