@@ -79,12 +79,13 @@ func dispatchLabel(ctx context.Context, d dispatchRequest, c *instructions.Label

 	if d.state.runConfig.Labels == nil {

 		d.state.runConfig.Labels = make(map[string]string)

 	}

-	commitStr := "LABEL"

+	var commitStr strings.Builder

+	commitStr.WriteString("LABEL")

 	for _, v := range c.Labels {

 		d.state.runConfig.Labels[v.Key] = v.Value

-		commitStr += " " + v.String()

+		commitStr.WriteString(" " + v.String())

 	}

-	return d.builder.commit(ctx, d.state, commitStr)

+	return d.builder.commit(ctx, d.state, commitStr.String())

 }

 // ADD foo /path

@@ -10,6 +10,7 @@ import (

 	"path/filepath"

 	"reflect"

 	"runtime"

+	"strings"

 	"github.com/containerd/containerd/v2/pkg/tracing"

 	"github.com/containerd/log"

@@ -78,7 +79,7 @@ func (l *tarexporter) Load(ctx context.Context, inTar io.ReadCloser, outStream i

 	}

 	var parentLinks []parentLink

-	var imageIDsStr string

+	var imageIDsStr strings.Builder

 	var imageRefCount int

 	for _, m := range manifest {

@@ -142,7 +143,7 @@ func (l *tarexporter) Load(ctx context.Context, inTar io.ReadCloser, outStream i

 		if err != nil {

 			return err

 		}

-		imageIDsStr += fmt.Sprintf("Loaded image ID: %s\n", imgID)

+		imageIDsStr.WriteString(fmt.Sprintf("Loaded image ID: %s\n", imgID))

 		imageRefCount = 0

 		for _, repoTag := range m.RepoTags {

@@ -172,7 +173,7 @@ func (l *tarexporter) Load(ctx context.Context, inTar io.ReadCloser, outStream i

 	}

 	if imageRefCount == 0 {

-		outStream.Write([]byte(imageIDsStr))

+		outStream.Write([]byte(imageIDsStr.String()))

 	}

 	return nil

@@ -7,6 +7,7 @@ import (

 	"net"

 	"net/http"

 	"strconv"

+	"strings"

 	"sync"

 	"time"

@@ -154,13 +155,13 @@ func (s *Server) help(w http.ResponseWriter, r *http.Request) {

 		"url":       r.URL.String(),

 	}).Info("help done")

-	var result string

+	var result strings.Builder

 	s.mu.Lock()

 	for path := range s.handlers {

-		result += fmt.Sprintf("%s\n", path)

+		result.WriteString(fmt.Sprintf("%s\n", path))

 	}

 	s.mu.Unlock()

-	_, _ = HTTPReply(w, CommandSucceed(&StringCmd{Info: result}), jsonOutput)

+	_, _ = HTTPReply(w, CommandSucceed(&StringCmd{Info: result.String()}), jsonOutput)

 }

 func ready(w http.ResponseWriter, r *http.Request) {

@@ -3,6 +3,7 @@ package diagnostic

 import (

 	"fmt"

 	"net/netip"

+	"strings"

 )

 // StringInterface interface that has to be implemented by messages

@@ -82,11 +83,12 @@ type TableObj struct {

 }

 func (t *TableObj) String() string {

-	output := fmt.Sprintf("total entries: %d\n", t.Length)

+	var output strings.Builder

+	output.WriteString(fmt.Sprintf("total entries: %d\n", t.Length))

 	for _, e := range t.Elements {

-		output += e.String()

+		output.WriteString(e.String())

 	}

-	return output

+	return output.String()

 }

 // PeerEntryObj entry in the networkdb peer table

@@ -163,16 +163,16 @@ func testIptabler(t *testing.T, tn string, config firewaller.Config, netConfig f

 		// - iptables-nft and iptables-legacy pick a different order when dumping all tables

 		// - if the raw table isn't used it's not included in the all-tables dump but, once it's been used, it's always

 		//   included ... so, "cleaned" results would differ only in the empty raw table.

-		var dump string

+		var dump strings.Builder

 		for _, table := range []string{"raw", "filter", "nat"} {

 			res := icmd.RunCommand(cmd+"-save", "-t", table)

 			assert.Assert(t, res.Error)

 			if !en {

 				name = tn + "/no"

 			}

-			dump += res.Combined()

+			dump.WriteString(res.Combined())

 		}

-		assert.Check(t, golden.String(stripComments(dump), name+"__"+cmd+".golden"))

+		assert.Check(t, golden.String(stripComments(dump.String()), name+"__"+cmd+".golden"))

 	}

 	makePB := func(hip string, cip netip.Addr) types.PortBinding {

@@ -199,19 +199,19 @@ func TestRCModify(t *testing.T) {

 	for _, tc := range testcases {

 		t.Run(tc.name, func(t *testing.T) {

 			tc := tc

-			var input string

+			var input strings.Builder

 			if len(tc.inputNS) != 0 {

 				for _, ns := range tc.inputNS {

-					input += "nameserver " + ns + "\n"

+					input.WriteString("nameserver " + ns + "\n")

 				}

 			}

 			if len(tc.inputSearch) != 0 {

-				input += "search " + strings.Join(tc.inputSearch, " ") + "\n"

+				input.WriteString("search " + strings.Join(tc.inputSearch, " ") + "\n")

 			}

 			if len(tc.inputOptions) != 0 {

-				input += "options " + strings.Join(tc.inputOptions, " ") + "\n"

+				input.WriteString("options " + strings.Join(tc.inputOptions, " ") + "\n")

 			}

-			rc, err := Parse(bytes.NewBufferString(input), "")

+			rc, err := Parse(bytes.NewBufferString(input.String()), "")

 			assert.NilError(t, err)

 			assert.Check(t, is.DeepEqual(a2s(rc.NameServers()), tc.inputNS, cmpopts.EquateEmpty()))

 			assert.Check(t, is.DeepEqual(rc.Search(), tc.inputSearch))

@@ -4,6 +4,7 @@ import (

 	"context"

 	"fmt"

 	"runtime"

+	"strings"

 	"sync"

 	"github.com/moby/moby/v2/pkg/parsers/kernel"

@@ -80,19 +81,19 @@ const charsToEscape = `();\`

 // escapeStr returns s with every rune in charsToEscape escaped by a backslash

 func escapeStr(s string) string {

-	var ret string

+	var ret strings.Builder

 	for _, currRune := range s {

 		appended := false

 		for _, escapableRune := range charsToEscape {

 			if currRune == escapableRune {

-				ret += `\` + string(currRune)

+				ret.WriteString(`\` + string(currRune))

 				appended = true

 				break

 			}

 		}

 		if !appended {

-			ret += string(currRune)

+			ret.WriteRune(currRune)

 		}

 	}

-	return ret

+	return ret.String()

 }

@@ -16,19 +16,20 @@ func printArgs(args []fnArg) string {

 }

 func buildImports(specs []importSpec) string {

-	imports := `

+	var imports strings.Builder

+	imports.WriteString(`

 import(

 	"errors"

 	"time"

 	"github.com/moby/moby/v2/pkg/plugins"

-`

+`)

 	for _, i := range specs {

-		imports += "\t" + i.String() + "\n"

+		imports.WriteString("\t" + i.String() + "\n")

 	}

-	imports += `)

-`

-	return imports

+	imports.WriteString(`)

+`)

+	return imports.String()

 }

 func marshalType(t string) string {