@@ -5433,7 +5433,7 @@ func (s *DockerTrustSuite) TestTrustedBuild(c *check.C) {

 	name := "testtrustedbuild"

 	buildCmd := buildImageCmd(name, dockerFile, true)

-	s.trustedCmd(buildCmd)

+	trustedExecCmd(buildCmd)

 	out, _, err := runCommandWithOutput(buildCmd)

 	if err != nil {

 		c.Fatalf("Error running trusted build: %s\n%s", err, out)

@@ -5464,7 +5464,7 @@ func (s *DockerTrustSuite) TestTrustedBuildUntrustedTag(c *check.C) {

 	name := "testtrustedbuilduntrustedtag"

 	buildCmd := buildImageCmd(name, dockerFile, true)

-	s.trustedCmd(buildCmd)

+	trustedExecCmd(buildCmd)

 	out, _, err := runCommandWithOutput(buildCmd)

 	if err == nil {

 		c.Fatalf("Expected error on trusted build with untrusted tag: %s\n%s", err, out)

@@ -5527,10 +5527,7 @@ func (s *DockerTrustSuite) TestTrustedBuildTagFromReleasesRole(c *check.C) {

 	otherTag := fmt.Sprintf("%s:other", repoName)

 	dockerCmd(c, "tag", "busybox", otherTag)

-	pushCmd := exec.Command(dockerBinary, "push", otherTag)

-	s.trustedCmd(pushCmd)

-	out, _, err := runCommandWithOutput(pushCmd)

-	c.Assert(err, check.IsNil, check.Commentf("Trusted push failed: %s", out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "push", otherTag), trustedCmd).Assert(c, icmd.Success)

 	s.assertTargetInRoles(c, repoName, "other", "targets/releases")

 	s.assertTargetNotInRoles(c, repoName, "other", "targets")

@@ -5545,8 +5542,8 @@ func (s *DockerTrustSuite) TestTrustedBuildTagFromReleasesRole(c *check.C) {

 	name := "testtrustedbuildreleasesrole"

 	buildCmd := buildImageCmd(name, dockerFile, true)

-	s.trustedCmd(buildCmd)

-	out, _, err = runCommandWithOutput(buildCmd)

+	trustedExecCmd(buildCmd)

+	out, _, err := runCommandWithOutput(buildCmd)

 	c.Assert(err, check.IsNil, check.Commentf("Trusted build failed: %s", out))

 	c.Assert(out, checker.Contains, fmt.Sprintf("FROM %s@sha", repoName))

 }

@@ -5566,10 +5563,7 @@ func (s *DockerTrustSuite) TestTrustedBuildTagIgnoresOtherDelegationRoles(c *che

 	otherTag := fmt.Sprintf("%s:other", repoName)

 	dockerCmd(c, "tag", "busybox", otherTag)

-	pushCmd := exec.Command(dockerBinary, "push", otherTag)

-	s.trustedCmd(pushCmd)

-	out, _, err := runCommandWithOutput(pushCmd)

-	c.Assert(err, check.IsNil, check.Commentf("Trusted push failed: %s", out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "push", otherTag), trustedCmd).Assert(c, icmd.Success)

 	s.assertTargetInRoles(c, repoName, "other", "targets/other")

 	s.assertTargetNotInRoles(c, repoName, "other", "targets")

@@ -5584,8 +5578,8 @@ func (s *DockerTrustSuite) TestTrustedBuildTagIgnoresOtherDelegationRoles(c *che

 	name := "testtrustedbuildotherrole"

 	buildCmd := buildImageCmd(name, dockerFile, true)

-	s.trustedCmd(buildCmd)

-	out, _, err = runCommandWithOutput(buildCmd)

+	trustedExecCmd(buildCmd)

+	out, _, err := runCommandWithOutput(buildCmd)

 	c.Assert(err, check.NotNil, check.Commentf("Trusted build expected to fail: %s", out))

 }

@@ -16,6 +16,7 @@ import (

 	"github.com/docker/docker/integration-cli/checker"

 	"github.com/docker/docker/pkg/testutil"

+	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/docker/go-units"

 	"github.com/go-check/check"

 )

@@ -100,12 +101,10 @@ func (s *DockerSuite) TestBuildAddChangeOwnership(c *check.C) {

 		}

 		defer testFile.Close()

-		chownCmd := exec.Command("chown", "daemon:daemon", "foo")

-		chownCmd.Dir = tmpDir

-		out, _, err := runCommandWithOutput(chownCmd)

-		if err != nil {

-			c.Fatal(err, out)

-		}

+		icmd.RunCmd(icmd.Cmd{

+			Command: []string{"chown", "daemon:daemon", "foo"},

+			Dir:     tmpDir,

+		}).Assert(c, icmd.Success)

 		if err := ioutil.WriteFile(filepath.Join(tmpDir, "Dockerfile"), []byte(dockerfile), 0644); err != nil {

 			c.Fatalf("failed to open destination dockerfile: %v", err)

@@ -5,7 +5,6 @@ import (

 	"net/http"

 	"net/http/httptest"

 	"os"

-	"os/exec"

 	"path/filepath"

 	"runtime"

@@ -13,6 +12,7 @@ import (

 	"github.com/docker/docker/dockerversion"

 	"github.com/docker/docker/integration-cli/checker"

 	"github.com/docker/docker/pkg/homedir"

+	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/go-check/check"

 )

@@ -51,15 +51,18 @@ func (s *DockerSuite) TestConfigHTTPHeader(c *check.C) {

 	err = ioutil.WriteFile(tmpCfg, []byte(data), 0600)

 	c.Assert(err, checker.IsNil)

-	cmd := exec.Command(dockerBinary, "-H="+server.URL[7:], "ps")

-	out, _, _ := runCommandWithOutput(cmd)

+	result := icmd.RunCommand(dockerBinary, "-H="+server.URL[7:], "ps")

+	result.Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Error:    "exit status 1",

+	})

 	c.Assert(headers["User-Agent"], checker.NotNil, check.Commentf("Missing User-Agent"))

-	c.Assert(headers["User-Agent"][0], checker.Equals, "Docker-Client/"+dockerversion.Version+" ("+runtime.GOOS+")", check.Commentf("Badly formatted User-Agent,out:%v", out))

+	c.Assert(headers["User-Agent"][0], checker.Equals, "Docker-Client/"+dockerversion.Version+" ("+runtime.GOOS+")", check.Commentf("Badly formatted User-Agent,out:%v", result.Combined()))

 	c.Assert(headers["Myheader"], checker.NotNil)

-	c.Assert(headers["Myheader"][0], checker.Equals, "MyValue", check.Commentf("Missing/bad header,out:%v", out))

+	c.Assert(headers["Myheader"][0], checker.Equals, "MyValue", check.Commentf("Missing/bad header,out:%v", result.Combined()))

 }

@@ -72,11 +75,10 @@ func (s *DockerSuite) TestConfigDir(c *check.C) {

 	dockerCmd(c, "--config", cDir, "ps")

 	// Test with env var too

-	cmd := exec.Command(dockerBinary, "ps")

-	cmd.Env = appendBaseEnv(true, "DOCKER_CONFIG="+cDir)

-	out, _, err := runCommandWithOutput(cmd)

-

-	c.Assert(err, checker.IsNil, check.Commentf("ps2 didn't work,out:%v", out))

+	icmd.RunCmd(icmd.Cmd{

+		Command: []string{dockerBinary, "ps"},

+		Env:     appendBaseEnv(true, "DOCKER_CONFIG="+cDir),

+	}).Assert(c, icmd.Success)

 	// Start a server so we can check to see if the config file was

 	// loaded properly

@@ -99,42 +101,51 @@ func (s *DockerSuite) TestConfigDir(c *check.C) {

 	env := appendBaseEnv(false)

-	cmd = exec.Command(dockerBinary, "--config", cDir, "-H="+server.URL[7:], "ps")

-	cmd.Env = env

-	out, _, err = runCommandWithOutput(cmd)

-

-	c.Assert(err, checker.NotNil, check.Commentf("out:%v", out))

+	icmd.RunCmd(icmd.Cmd{

+		Command: []string{dockerBinary, "--config", cDir, "-H=" + server.URL[7:], "ps"},

+		Env:     env,

+	}).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Error:    "exit status 1",

+	})

 	c.Assert(headers["Myheader"], checker.NotNil)

-	c.Assert(headers["Myheader"][0], checker.Equals, "MyValue", check.Commentf("ps3 - Missing header,out:%v", out))

+	c.Assert(headers["Myheader"][0], checker.Equals, "MyValue", check.Commentf("ps3 - Missing header"))

 	// Reset headers and try again using env var this time

 	headers = map[string][]string{}

-	cmd = exec.Command(dockerBinary, "-H="+server.URL[7:], "ps")

-	cmd.Env = append(env, "DOCKER_CONFIG="+cDir)

-	out, _, err = runCommandWithOutput(cmd)

-

-	c.Assert(err, checker.NotNil, check.Commentf("%v", out))

+	icmd.RunCmd(icmd.Cmd{

+		Command: []string{dockerBinary, "--config", cDir, "-H=" + server.URL[7:], "ps"},

+		Env:     append(env, "DOCKER_CONFIG="+cDir),

+	}).Assert(c, icmd.Expected{

+		ExitCode: 1,

+	})

 	c.Assert(headers["Myheader"], checker.NotNil)

-	c.Assert(headers["Myheader"][0], checker.Equals, "MyValue", check.Commentf("ps4 - Missing header,out:%v", out))

+	c.Assert(headers["Myheader"][0], checker.Equals, "MyValue", check.Commentf("ps4 - Missing header"))

+	// FIXME(vdemeester) should be a unit test

 	// Reset headers and make sure flag overrides the env var

 	headers = map[string][]string{}

-	cmd = exec.Command(dockerBinary, "--config", cDir, "-H="+server.URL[7:], "ps")

-	cmd.Env = append(env, "DOCKER_CONFIG=MissingDir")

-	out, _, err = runCommandWithOutput(cmd)

-

-	c.Assert(err, checker.NotNil, check.Commentf("out:%v", out))

+	icmd.RunCmd(icmd.Cmd{

+		Command: []string{dockerBinary, "--config", cDir, "-H=" + server.URL[7:], "ps"},

+		Env:     append(env, "DOCKER_CONFIG=MissingDir"),

+	}).Assert(c, icmd.Expected{

+		ExitCode: 1,

+	})

 	c.Assert(headers["Myheader"], checker.NotNil)

-	c.Assert(headers["Myheader"][0], checker.Equals, "MyValue", check.Commentf("ps5 - Missing header,out:%v", out))

+	c.Assert(headers["Myheader"][0], checker.Equals, "MyValue", check.Commentf("ps5 - Missing header"))

+	// FIXME(vdemeester) should be a unit test

 	// Reset headers and make sure flag overrides the env var.

 	// Almost same as previous but make sure the "MissingDir" isn't

 	// ignore - we don't want to default back to the env var.

 	headers = map[string][]string{}

-	cmd = exec.Command(dockerBinary, "--config", "MissingDir", "-H="+server.URL[7:], "ps")

-	cmd.Env = append(env, "DOCKER_CONFIG="+cDir)

-	out, _, err = runCommandWithOutput(cmd)

-

-	c.Assert(err, checker.NotNil, check.Commentf("out:%v", out))

-	c.Assert(headers["Myheader"], checker.IsNil, check.Commentf("ps6 - Headers shouldn't be the expected value,out:%v", out))

+	icmd.RunCmd(icmd.Cmd{

+		Command: []string{dockerBinary, "--config", "MissingDir", "-H=" + server.URL[7:], "ps"},

+		Env:     append(env, "DOCKER_CONFIG="+cDir),

+	}).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Error:    "exit status 1",

+	})

+

+	c.Assert(headers["Myheader"], checker.IsNil, check.Commentf("ps6 - Headers shouldn't be the expected value"))

 }

@@ -3,18 +3,16 @@ package main

 import (

 	"encoding/json"

 	"fmt"

+	"io/ioutil"

 	"os"

 	"reflect"

 	"strings"

 	"time"

-	"os/exec"

-

-	"io/ioutil"

-

 	"github.com/docker/docker/integration-cli/checker"

 	"github.com/docker/docker/pkg/stringid"

 	"github.com/docker/docker/pkg/testutil"

+	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/docker/go-connections/nat"

 	"github.com/go-check/check"

 )

@@ -302,21 +300,12 @@ func (s *DockerTrustSuite) TestTrustedCreate(c *check.C) {

 	repoName := s.setupTrustedImage(c, "trusted-create")

 	// Try create

-	createCmd := exec.Command(dockerBinary, "create", repoName)

-	s.trustedCmd(createCmd)

-	out, _, err := runCommandWithOutput(createCmd)

-	c.Assert(err, check.IsNil)

-	c.Assert(string(out), checker.Contains, "Tagging", check.Commentf("Missing expected output on trusted push:\n%s", out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "create", repoName), trustedCmd).Assert(c, SuccessTagging)

 	dockerCmd(c, "rmi", repoName)

 	// Try untrusted create to ensure we pushed the tag to the registry

-	createCmd = exec.Command(dockerBinary, "create", "--disable-content-trust=true", repoName)

-	s.trustedCmd(createCmd)

-	out, _, err = runCommandWithOutput(createCmd)

-	c.Assert(err, check.IsNil)

-	c.Assert(string(out), checker.Contains, "Status: Downloaded", check.Commentf("Missing expected output on trusted create with --disable-content-trust:\n%s", out))

-

+	icmd.RunCmd(icmd.Command(dockerBinary, "create", "--disable-content-trust=true", repoName), trustedCmd).Assert(c, SuccessDownloadedOnStderr)

 }

 func (s *DockerTrustSuite) TestUntrustedCreate(c *check.C) {

@@ -328,23 +317,17 @@ func (s *DockerTrustSuite) TestUntrustedCreate(c *check.C) {

 	dockerCmd(c, "rmi", withTagName)

 	// Try trusted create on untrusted tag

-	createCmd := exec.Command(dockerBinary, "create", withTagName)

-	s.trustedCmd(createCmd)

-	out, _, err := runCommandWithOutput(createCmd)

-	c.Assert(err, check.Not(check.IsNil))

-	c.Assert(string(out), checker.Contains, fmt.Sprintf("does not have trust data for %s", repoName), check.Commentf("Missing expected output on trusted create:\n%s", out))

-

+	icmd.RunCmd(icmd.Command(dockerBinary, "create", withTagName), trustedCmd).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Err:      fmt.Sprintf("does not have trust data for %s", repoName),

+	})

 }

 func (s *DockerTrustSuite) TestTrustedIsolatedCreate(c *check.C) {

 	repoName := s.setupTrustedImage(c, "trusted-isolated-create")

 	// Try create

-	createCmd := exec.Command(dockerBinary, "--config", "/tmp/docker-isolated-create", "create", repoName)

-	s.trustedCmd(createCmd)

-	out, _, err := runCommandWithOutput(createCmd)

-	c.Assert(err, check.IsNil)

-	c.Assert(string(out), checker.Contains, "Tagging", check.Commentf("Missing expected output on trusted push:\n%s", out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "--config", "/tmp/docker-isolated-create", "create", repoName), trustedCmd).Assert(c, SuccessTagging)

 	dockerCmd(c, "rmi", repoName)

 }

@@ -358,20 +341,19 @@ func (s *DockerTrustSuite) TestCreateWhenCertExpired(c *check.C) {

 	testutil.RunAtDifferentDate(elevenYearsFromNow, func() {

 		// Try create

-		createCmd := exec.Command(dockerBinary, "create", repoName)

-		s.trustedCmd(createCmd)

-		out, _, err := runCommandWithOutput(createCmd)

-		c.Assert(err, check.Not(check.IsNil))

-		c.Assert(string(out), checker.Contains, "could not validate the path to a trusted root", check.Commentf("Missing expected output on trusted create in the distant future:\n%s", out))

+		icmd.RunCmd(icmd.Cmd{

+			Command: []string{dockerBinary, "create", repoName},

+		}, trustedCmd).Assert(c, icmd.Expected{

+			ExitCode: 1,

+			Err:      "could not validate the path to a trusted root",

+		})

 	})

 	testutil.RunAtDifferentDate(elevenYearsFromNow, func() {

 		// Try create

-		createCmd := exec.Command(dockerBinary, "create", "--disable-content-trust", repoName)

-		s.trustedCmd(createCmd)

-		out, _, err := runCommandWithOutput(createCmd)

-		c.Assert(err, check.Not(check.IsNil))

-		c.Assert(string(out), checker.Contains, "Status: Downloaded", check.Commentf("Missing expected output on trusted create in the distant future:\n%s", out))

+		result := icmd.RunCmd(icmd.Command(dockerBinary, "create", "--disable-content-trust", repoName), trustedCmd)

+		c.Assert(result.Error, check.Not(check.IsNil))

+		c.Assert(string(result.Combined()), checker.Contains, "Status: Downloaded", check.Commentf("Missing expected output on trusted create in the distant future:\n%s", result.Combined()))

 	})

 }

@@ -384,20 +366,12 @@ func (s *DockerTrustSuite) TestTrustedCreateFromBadTrustServer(c *check.C) {

 	// tag the image and upload it to the private registry

 	dockerCmd(c, "tag", "busybox", repoName)

-	pushCmd := exec.Command(dockerBinary, "push", repoName)

-	s.trustedCmd(pushCmd)

-	out, _, err := runCommandWithOutput(pushCmd)

-	c.Assert(err, check.IsNil)

-	c.Assert(string(out), checker.Contains, "Signing and pushing trust metadata", check.Commentf("Missing expected output on trusted push:\n%s", out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

 	dockerCmd(c, "rmi", repoName)

 	// Try create

-	createCmd := exec.Command(dockerBinary, "create", repoName)

-	s.trustedCmd(createCmd)

-	out, _, err = runCommandWithOutput(createCmd)

-	c.Assert(err, check.IsNil)

-	c.Assert(string(out), checker.Contains, "Tagging", check.Commentf("Missing expected output on trusted push:\n%s", out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "create", repoName), trustedCmd).Assert(c, SuccessTagging)

 	dockerCmd(c, "rmi", repoName)

@@ -411,23 +385,13 @@ func (s *DockerTrustSuite) TestTrustedCreateFromBadTrustServer(c *check.C) {

 	dockerCmd(c, "--config", evilLocalConfigDir, "tag", "busybox", repoName)

 	// Push up to the new server

-	pushCmd = exec.Command(dockerBinary, "--config", evilLocalConfigDir, "push", repoName)

-	s.trustedCmd(pushCmd)

-	out, _, err = runCommandWithOutput(pushCmd)

-	c.Assert(err, check.IsNil)

-	c.Assert(string(out), checker.Contains, "Signing and pushing trust metadata", check.Commentf("Missing expected output on trusted push:\n%s", out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "--config", evilLocalConfigDir, "push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

 	// Now, try creating with the original client from this new trust server. This should fail because the new root is invalid.

-	createCmd = exec.Command(dockerBinary, "create", repoName)

-	s.trustedCmd(createCmd)

-	out, _, err = runCommandWithOutput(createCmd)

-	if err == nil {

-		c.Fatalf("Continuing with cached data even though it's an invalid root rotation: %s\n%s", err, out)

-	}

-	if !strings.Contains(out, "could not rotate trust to a new trusted root") {

-		c.Fatalf("Missing expected output on trusted create:\n%s", out)

-	}

-

+	icmd.RunCmd(icmd.Command(dockerBinary, "create", repoName), trustedCmd).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Err:      "could not rotate trust to a new trusted root",

+	})

 }

 func (s *DockerSuite) TestCreateStopSignal(c *check.C) {

@@ -4,13 +4,13 @@ package main

 import (

 	"os"

-	"os/exec"

 	"path/filepath"

 	"strings"

 	"syscall"

 	"github.com/docker/docker/integration-cli/checker"

 	"github.com/docker/docker/pkg/mount"

+	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/go-check/check"

 )

@@ -92,10 +92,7 @@ func (s *DockerDaemonSuite) TestDaemonKillLiveRestoreWithPlugins(c *check.C) {

 		c.Fatalf("Could not kill daemon: %v", err)

 	}

-	cmd := exec.Command("pgrep", "-f", pluginProcessName)

-	if out, ec, err := runCommandWithOutput(cmd); ec != 0 {

-		c.Fatalf("Expected exit code '0', got %d err: %v output: %s ", ec, err, out)

-	}

+	icmd.RunCommand("pgrep", "-f", pluginProcessName).Assert(c, icmd.Success)

 }

 // TestDaemonShutdownLiveRestoreWithPlugins SIGTERMs daemon started with --live-restore.

@@ -121,10 +118,7 @@ func (s *DockerDaemonSuite) TestDaemonShutdownLiveRestoreWithPlugins(c *check.C)

 		c.Fatalf("Could not kill daemon: %v", err)

 	}

-	cmd := exec.Command("pgrep", "-f", pluginProcessName)

-	if out, ec, err := runCommandWithOutput(cmd); ec != 0 {

-		c.Fatalf("Expected exit code '0', got %d err: %v output: %s ", ec, err, out)

-	}

+	icmd.RunCommand("pgrep", "-f", pluginProcessName).Assert(c, icmd.Success)

 }

 // TestDaemonShutdownWithPlugins shuts down running plugins.

@@ -156,15 +150,13 @@ func (s *DockerDaemonSuite) TestDaemonShutdownWithPlugins(c *check.C) {

 		}

 	}

-	cmd := exec.Command("pgrep", "-f", pluginProcessName)

-	if out, ec, err := runCommandWithOutput(cmd); ec != 1 {

-		c.Fatalf("Expected exit code '1', got %d err: %v output: %s ", ec, err, out)

-	}

+	icmd.RunCommand("pgrep", "-f", pluginProcessName).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Error:    "exit status 1",

+	})

 	s.d.Start(c, "--live-restore")

-	cmd = exec.Command("pgrep", "-f", pluginProcessName)

-	out, _, err := runCommandWithOutput(cmd)

-	c.Assert(err, checker.IsNil, check.Commentf(out))

+	icmd.RunCommand("pgrep", "-f", pluginProcessName).Assert(c, icmd.Success)

 }

 // TestVolumePlugin tests volume creation using a plugin.

@@ -262,30 +262,15 @@ func (s *DockerDaemonSuite) TestDaemonIptablesClean(c *check.C) {

 		c.Fatalf("Could not run top: %s, %v", out, err)

 	}

-	// get output from iptables with container running

 	ipTablesSearchString := "tcp dpt:80"

-	ipTablesCmd := exec.Command("iptables", "-nvL")

-	out, _, err := runCommandWithOutput(ipTablesCmd)

-	if err != nil {

-		c.Fatalf("Could not run iptables -nvL: %s, %v", out, err)

-	}

-	if !strings.Contains(out, ipTablesSearchString) {

-		c.Fatalf("iptables output should have contained %q, but was %q", ipTablesSearchString, out)

-	}

+	// get output from iptables with container running

+	verifyIPTablesContains(c, ipTablesSearchString)

 	s.d.Stop(c)

 	// get output from iptables after restart

-	ipTablesCmd = exec.Command("iptables", "-nvL")

-	out, _, err = runCommandWithOutput(ipTablesCmd)

-	if err != nil {

-		c.Fatalf("Could not run iptables -nvL: %s, %v", out, err)

-	}

-

-	if strings.Contains(out, ipTablesSearchString) {

-		c.Fatalf("iptables output should not have contained %q, but was %q", ipTablesSearchString, out)

-	}

+	verifyIPTablesDoesNotContains(c, ipTablesSearchString)

 }

 func (s *DockerDaemonSuite) TestDaemonIptablesCreate(c *check.C) {

@@ -297,36 +282,36 @@ func (s *DockerDaemonSuite) TestDaemonIptablesCreate(c *check.C) {

 	// get output from iptables with container running

 	ipTablesSearchString := "tcp dpt:80"

-	ipTablesCmd := exec.Command("iptables", "-nvL")

-	out, _, err := runCommandWithOutput(ipTablesCmd)

-	if err != nil {

-		c.Fatalf("Could not run iptables -nvL: %s, %v", out, err)

-	}

-

-	if !strings.Contains(out, ipTablesSearchString) {

-		c.Fatalf("iptables output should have contained %q, but was %q", ipTablesSearchString, out)

-	}

+	verifyIPTablesContains(c, ipTablesSearchString)

 	s.d.Restart(c)

 	// make sure the container is not running

 	runningOut, err := s.d.Cmd("inspect", "--format={{.State.Running}}", "top")

 	if err != nil {

-		c.Fatalf("Could not inspect on container: %s, %v", out, err)

+		c.Fatalf("Could not inspect on container: %s, %v", runningOut, err)

 	}

 	if strings.TrimSpace(runningOut) != "true" {

 		c.Fatalf("Container should have been restarted after daemon restart. Status running should have been true but was: %q", strings.TrimSpace(runningOut))

 	}

 	// get output from iptables after restart

-	ipTablesCmd = exec.Command("iptables", "-nvL")

-	out, _, err = runCommandWithOutput(ipTablesCmd)

-	if err != nil {

-		c.Fatalf("Could not run iptables -nvL: %s, %v", out, err)

+	verifyIPTablesContains(c, ipTablesSearchString)

+}

+

+func verifyIPTablesContains(c *check.C, ipTablesSearchString string) {

+	result := icmd.RunCommand("iptables", "-nvL")

+	result.Assert(c, icmd.Success)

+	if !strings.Contains(result.Combined(), ipTablesSearchString) {

+		c.Fatalf("iptables output should have contained %q, but was %q", ipTablesSearchString, result.Combined())

 	}

+}

-	if !strings.Contains(out, ipTablesSearchString) {

-		c.Fatalf("iptables output after restart should have contained %q, but was %q", ipTablesSearchString, out)

+func verifyIPTablesDoesNotContains(c *check.C, ipTablesSearchString string) {

+	result := icmd.RunCommand("iptables", "-nvL")

+	result.Assert(c, icmd.Success)

+	if strings.Contains(result.Combined(), ipTablesSearchString) {

+		c.Fatalf("iptables output should not have contained %q, but was %q", ipTablesSearchString, result.Combined())

 	}

 }

@@ -564,10 +549,7 @@ func (s *DockerDaemonSuite) TestDaemonExitOnFailure(c *check.C) {

 			c.Fatalf("Expected daemon not to start, got %v", err)

 		}

 		// look in the log and make sure we got the message that daemon is shutting down

-		runCmd := exec.Command("grep", "Error starting daemon", s.d.LogFileName())

-		if out, _, err := runCommandWithOutput(runCmd); err != nil {

-			c.Fatalf("Expected 'Error starting daemon' message; but doesn't exist in log: %q, err: %v", out, err)

-		}

+		icmd.RunCommand("grep", "Error starting daemon", s.d.LogFileName()).Assert(c, icmd.Success)

 	} else {

 		//if we didn't get an error and the daemon is running, this is a failure

 		c.Fatal("Conflicting options should cause the daemon to error out with a failure")

@@ -584,20 +566,15 @@ func (s *DockerDaemonSuite) TestDaemonBridgeExternal(c *check.C) {

 	bridgeIP := "192.169.1.1/24"

 	_, bridgeIPNet, _ := net.ParseCIDR(bridgeIP)

-	out, err := createInterface(c, "bridge", bridgeName, bridgeIP)

-	c.Assert(err, check.IsNil, check.Commentf(out))

+	createInterface(c, "bridge", bridgeName, bridgeIP)

 	defer deleteInterface(c, bridgeName)

 	d.StartWithBusybox(c, "--bridge", bridgeName)

 	ipTablesSearchString := bridgeIPNet.String()

-	ipTablesCmd := exec.Command("iptables", "-t", "nat", "-nvL")

-	out, _, err = runCommandWithOutput(ipTablesCmd)

-	c.Assert(err, check.IsNil)

-

-	c.Assert(strings.Contains(out, ipTablesSearchString), check.Equals, true,

-		check.Commentf("iptables output should have contained %q, but was %q",

-			ipTablesSearchString, out))

+	icmd.RunCommand("iptables", "-t", "nat", "-nvL").Assert(c, icmd.Expected{

+		Out: ipTablesSearchString,

+	})

 	_, err = d.Cmd("run", "-d", "--name", "ExtContainer", "busybox", "top")

 	c.Assert(err, check.IsNil)

@@ -617,41 +594,27 @@ func (s *DockerDaemonSuite) TestDaemonBridgeNone(c *check.C) {

 	defer d.Restart(c)

 	// verify docker0 iface is not there

-	out, _, err := runCommandWithOutput(exec.Command("ifconfig", "docker0"))

-	c.Assert(err, check.NotNil, check.Commentf("docker0 should not be present if daemon started with --bridge=none"))

-	c.Assert(strings.Contains(out, "Device not found"), check.Equals, true)

+	icmd.RunCommand("ifconfig", "docker0").Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Error:    "exit status 1",

+		Err:      "Device not found",

+	})

 	// verify default "bridge" network is not there

-	out, err = d.Cmd("network", "inspect", "bridge")

+	out, err := d.Cmd("network", "inspect", "bridge")

 	c.Assert(err, check.NotNil, check.Commentf("\"bridge\" network should not be present if daemon started with --bridge=none"))

 	c.Assert(strings.Contains(out, "No such network"), check.Equals, true)

 }

-func createInterface(c *check.C, ifType string, ifName string, ipNet string) (string, error) {

-	args := []string{"link", "add", "name", ifName, "type", ifType}

-	ipLinkCmd := exec.Command("ip", args...)

-	out, _, err := runCommandWithOutput(ipLinkCmd)

-	if err != nil {

-		return out, err

-	}

-

-	ifCfgCmd := exec.Command("ifconfig", ifName, ipNet, "up")

-	out, _, err = runCommandWithOutput(ifCfgCmd)

-	return out, err

+func createInterface(c *check.C, ifType string, ifName string, ipNet string) {

+	icmd.RunCommand("ip", "link", "add", "name", ifName, "type", ifType).Assert(c, icmd.Success)

+	icmd.RunCommand("ifconfig", ifName, ipNet, "up").Assert(c, icmd.Success)

 }

 func deleteInterface(c *check.C, ifName string) {

-	ifCmd := exec.Command("ip", "link", "delete", ifName)

-	out, _, err := runCommandWithOutput(ifCmd)

-	c.Assert(err, check.IsNil, check.Commentf(out))

-

-	flushCmd := exec.Command("iptables", "-t", "nat", "--flush")

-	out, _, err = runCommandWithOutput(flushCmd)

-	c.Assert(err, check.IsNil, check.Commentf(out))

-

-	flushCmd = exec.Command("iptables", "--flush")

-	out, _, err = runCommandWithOutput(flushCmd)

-	c.Assert(err, check.IsNil, check.Commentf(out))

+	icmd.RunCommand("ip", "link", "delete", ifName).Assert(c, icmd.Success)

+	icmd.RunCommand("iptables", "-t", "nat", "--flush").Assert(c, icmd.Success)

+	icmd.RunCommand("iptables", "--flush").Assert(c, icmd.Success)

 }

 func (s *DockerDaemonSuite) TestDaemonBridgeIP(c *check.C) {

@@ -723,8 +686,7 @@ func (s *DockerDaemonSuite) TestDaemonBridgeFixedCidr(c *check.C) {

 	bridgeName := "external-bridge"

 	bridgeIP := "192.169.1.1/24"

-	out, err := createInterface(c, "bridge", bridgeName, bridgeIP)

-	c.Assert(err, check.IsNil, check.Commentf(out))

+	createInterface(c, "bridge", bridgeName, bridgeIP)

 	defer deleteInterface(c, bridgeName)

 	args := []string{"--bridge", bridgeName, "--fixed-cidr", "192.169.1.0/30"}

@@ -747,14 +709,13 @@ func (s *DockerDaemonSuite) TestDaemonBridgeFixedCidr2(c *check.C) {

 	bridgeName := "external-bridge"

 	bridgeIP := "10.2.2.1/16"

-	out, err := createInterface(c, "bridge", bridgeName, bridgeIP)

-	c.Assert(err, check.IsNil, check.Commentf(out))

+	createInterface(c, "bridge", bridgeName, bridgeIP)

 	defer deleteInterface(c, bridgeName)

 	d.StartWithBusybox(c, "--bip", bridgeIP, "--fixed-cidr", "10.2.2.0/24")

 	defer s.d.Restart(c)

-	out, err = d.Cmd("run", "-d", "--name", "bb", "busybox", "top")

+	out, err := d.Cmd("run", "-d", "--name", "bb", "busybox", "top")

 	c.Assert(err, checker.IsNil, check.Commentf(out))

 	defer d.Cmd("stop", "bb")

@@ -772,14 +733,13 @@ func (s *DockerDaemonSuite) TestDaemonBridgeFixedCIDREqualBridgeNetwork(c *check

 	bridgeName := "external-bridge"

 	bridgeIP := "172.27.42.1/16"

-	out, err := createInterface(c, "bridge", bridgeName, bridgeIP)

-	c.Assert(err, check.IsNil, check.Commentf(out))

+	createInterface(c, "bridge", bridgeName, bridgeIP)

 	defer deleteInterface(c, bridgeName)

 	d.StartWithBusybox(c, "--bridge", bridgeName, "--fixed-cidr", bridgeIP)

 	defer s.d.Restart(c)

-	out, err = d.Cmd("run", "-d", "busybox", "top")

+	out, err := d.Cmd("run", "-d", "busybox", "top")

 	c.Assert(err, check.IsNil, check.Commentf(out))

 	cid1 := strings.TrimSpace(out)

 	defer d.Cmd("stop", cid1)

@@ -871,21 +831,18 @@ func (s *DockerDaemonSuite) TestDaemonIP(c *check.C) {

 	c.Assert(strings.Contains(out, "Error starting userland proxy"), check.Equals, true)

 	ifName := "dummy"

-	out, err = createInterface(c, "dummy", ifName, ipStr)

-	c.Assert(err, check.IsNil, check.Commentf(out))

+	createInterface(c, "dummy", ifName, ipStr)

 	defer deleteInterface(c, ifName)

 	_, err = d.Cmd("run", "-d", "-p", "8000:8000", "busybox", "top")

 	c.Assert(err, check.IsNil)

-	ipTablesCmd := exec.Command("iptables", "-t", "nat", "-nvL")

-	out, _, err = runCommandWithOutput(ipTablesCmd)

-	c.Assert(err, check.IsNil)

-

+	result := icmd.RunCommand("iptables", "-t", "nat", "-nvL")

+	result.Assert(c, icmd.Success)

 	regex := fmt.Sprintf("DNAT.*%s.*dpt:8000", ip.String())

-	matched, _ := regexp.MatchString(regex, out)

+	matched, _ := regexp.MatchString(regex, result.Combined())

 	c.Assert(matched, check.Equals, true,

-		check.Commentf("iptables output should have contained %q, but was %q", regex, out))

+		check.Commentf("iptables output should have contained %q, but was %q", regex, result.Combined()))

 }

 func (s *DockerDaemonSuite) TestDaemonICCPing(c *check.C) {

@@ -895,22 +852,18 @@ func (s *DockerDaemonSuite) TestDaemonICCPing(c *check.C) {

 	bridgeName := "external-bridge"

 	bridgeIP := "192.169.1.1/24"

-	out, err := createInterface(c, "bridge", bridgeName, bridgeIP)

-	c.Assert(err, check.IsNil, check.Commentf(out))

+	createInterface(c, "bridge", bridgeName, bridgeIP)

 	defer deleteInterface(c, bridgeName)

-	args := []string{"--bridge", bridgeName, "--icc=false"}

-	d.StartWithBusybox(c, args...)

+	d.StartWithBusybox(c, "--bridge", bridgeName, "--icc=false")

 	defer d.Restart(c)

-	ipTablesCmd := exec.Command("iptables", "-nvL", "FORWARD")

-	out, _, err = runCommandWithOutput(ipTablesCmd)

-	c.Assert(err, check.IsNil)

-

+	result := icmd.RunCommand("iptables", "-nvL", "FORWARD")

+	result.Assert(c, icmd.Success)

 	regex := fmt.Sprintf("DROP.*all.*%s.*%s", bridgeName, bridgeName)

-	matched, _ := regexp.MatchString(regex, out)

+	matched, _ := regexp.MatchString(regex, result.Combined())

 	c.Assert(matched, check.Equals, true,

-		check.Commentf("iptables output should have contained %q, but was %q", regex, out))

+		check.Commentf("iptables output should have contained %q, but was %q", regex, result.Combined()))

 	// Pinging another container must fail with --icc=false

 	pingContainers(c, d, true)

@@ -924,7 +877,7 @@ func (s *DockerDaemonSuite) TestDaemonICCPing(c *check.C) {

 	// But, Pinging external or a Host interface must succeed

 	pingCmd := fmt.Sprintf("ping -c 1 %s -W 1", ip.String())

 	runArgs := []string{"run", "--rm", "busybox", "sh", "-c", pingCmd}

-	_, err = d.Cmd(runArgs...)

+	_, err := d.Cmd(runArgs...)

 	c.Assert(err, check.IsNil)

 }

@@ -934,24 +887,20 @@ func (s *DockerDaemonSuite) TestDaemonICCLinkExpose(c *check.C) {

 	bridgeName := "external-bridge"

 	bridgeIP := "192.169.1.1/24"

-	out, err := createInterface(c, "bridge", bridgeName, bridgeIP)

-	c.Assert(err, check.IsNil, check.Commentf(out))

+	createInterface(c, "bridge", bridgeName, bridgeIP)

 	defer deleteInterface(c, bridgeName)

-	args := []string{"--bridge", bridgeName, "--icc=false"}

-	d.StartWithBusybox(c, args...)

+	d.StartWithBusybox(c, "--bridge", bridgeName, "--icc=false")

 	defer d.Restart(c)

-	ipTablesCmd := exec.Command("iptables", "-nvL", "FORWARD")

-	out, _, err = runCommandWithOutput(ipTablesCmd)

-	c.Assert(err, check.IsNil)

-

+	result := icmd.RunCommand("iptables", "-nvL", "FORWARD")

+	result.Assert(c, icmd.Success)

 	regex := fmt.Sprintf("DROP.*all.*%s.*%s", bridgeName, bridgeName)

-	matched, _ := regexp.MatchString(regex, out)

+	matched, _ := regexp.MatchString(regex, result.Combined())

 	c.Assert(matched, check.Equals, true,

-		check.Commentf("iptables output should have contained %q, but was %q", regex, out))

+		check.Commentf("iptables output should have contained %q, but was %q", regex, result.Combined()))

-	out, err = d.Cmd("run", "-d", "--expose", "4567", "--name", "icc1", "busybox", "nc", "-l", "-p", "4567")

+	out, err := d.Cmd("run", "-d", "--expose", "4567", "--name", "icc1", "busybox", "nc", "-l", "-p", "4567")

 	c.Assert(err, check.IsNil, check.Commentf(out))

 	out, err = d.Cmd("run", "--link", "icc1:icc1", "busybox", "nc", "icc1", "4567")

@@ -962,14 +911,13 @@ func (s *DockerDaemonSuite) TestDaemonLinksIpTablesRulesWhenLinkAndUnlink(c *che

 	bridgeName := "external-bridge"

 	bridgeIP := "192.169.1.1/24"

-	out, err := createInterface(c, "bridge", bridgeName, bridgeIP)

-	c.Assert(err, check.IsNil, check.Commentf(out))

+	createInterface(c, "bridge", bridgeName, bridgeIP)

 	defer deleteInterface(c, bridgeName)

 	s.d.StartWithBusybox(c, "--bridge", bridgeName, "--icc=false")

 	defer s.d.Restart(c)

-	_, err = s.d.Cmd("run", "-d", "--name", "child", "--publish", "8080:80", "busybox", "top")

+	_, err := s.d.Cmd("run", "-d", "--name", "child", "--publish", "8080:80", "busybox", "top")

 	c.Assert(err, check.IsNil)

 	_, err = s.d.Cmd("run", "-d", "--name", "parent", "--link", "child:http", "busybox", "top")

 	c.Assert(err, check.IsNil)

@@ -1464,10 +1412,7 @@ func (s *DockerDaemonSuite) TestCleanupMountsAfterDaemonAndContainerKill(c *chec

 	c.Assert(strings.Contains(string(mountOut), id), check.Equals, true, comment)

 	// kill the container

-	runCmd := exec.Command(ctrBinary, "--address", "unix:///var/run/docker/libcontainerd/docker-containerd.sock", "containers", "kill", id)

-	if out, ec, err := runCommandWithOutput(runCmd); err != nil {

-		c.Fatalf("Failed to run ctr, ExitCode: %d, err: %v output: %s id: %s\n", ec, err, out, id)

-	}

+	icmd.RunCommand(ctrBinary, "--address", "unix:///var/run/docker/libcontainerd/docker-containerd.sock", "containers", "kill", id).Assert(c, icmd.Success)

 	// restart daemon.

 	d.Restart(c)

@@ -1564,10 +1509,9 @@ func (s *DockerDaemonSuite) TestDaemonRestartCleanupNetns(c *check.C) {

 	}

 	// Test if the file still exists

-	out, _, err = runCommandWithOutput(exec.Command("stat", "-c", "%n", fileName))

-	out = strings.TrimSpace(out)

-	c.Assert(err, check.IsNil, check.Commentf("Output: %s", out))

-	c.Assert(out, check.Equals, fileName, check.Commentf("Output: %s", out))

+	icmd.RunCommand("stat", "-c", "%n", fileName).Assert(c, icmd.Expected{

+		Out: fileName,

+	})

 	// Remove the container and restart the daemon

 	if out, err := s.d.Cmd("rm", "netns"); err != nil {

@@ -1577,32 +1521,34 @@ func (s *DockerDaemonSuite) TestDaemonRestartCleanupNetns(c *check.C) {

 	s.d.Restart(c)

 	// Test again and see now the netns file does not exist

-	out, _, err = runCommandWithOutput(exec.Command("stat", "-c", "%n", fileName))

-	out = strings.TrimSpace(out)

-	c.Assert(err, check.Not(check.IsNil), check.Commentf("Output: %s", out))

+	icmd.RunCommand("stat", "-c", "%n", fileName).Assert(c, icmd.Expected{

+		Err:      "No such file or directory",

+		ExitCode: 1,

+	})

 }

 // tests regression detailed in #13964 where DOCKER_TLS_VERIFY env is ignored

 func (s *DockerDaemonSuite) TestDaemonTLSVerifyIssue13964(c *check.C) {

 	host := "tcp://localhost:4271"

 	s.d.Start(c, "-H", host)

-	cmd := exec.Command(dockerBinary, "-H", host, "info")

-	cmd.Env = []string{"DOCKER_TLS_VERIFY=1", "DOCKER_CERT_PATH=fixtures/https"}

-	out, _, err := runCommandWithOutput(cmd)

-	c.Assert(err, check.Not(check.IsNil), check.Commentf("%s", out))

-	c.Assert(strings.Contains(out, "error during connect"), check.Equals, true)

-

+	icmd.RunCmd(icmd.Cmd{

+		Command: []string{dockerBinary, "-H", host, "info"},

+		Env:     []string{"DOCKER_TLS_VERIFY=1", "DOCKER_CERT_PATH=fixtures/https"},

+	}).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Err:      "error during connect",

+	})

 }

 func setupV6(c *check.C) {

 	// Hack to get the right IPv6 address on docker0, which has already been created

 	result := icmd.RunCommand("ip", "addr", "add", "fe80::1/64", "dev", "docker0")

-	result.Assert(c, icmd.Expected{})

+	result.Assert(c, icmd.Success)

 }

 func teardownV6(c *check.C) {

 	result := icmd.RunCommand("ip", "addr", "del", "fe80::1/64", "dev", "docker0")

-	result.Assert(c, icmd.Expected{})

+	result.Assert(c, icmd.Success)

 }

 func (s *DockerDaemonSuite) TestDaemonRestartWithContainerWithRestartPolicyAlways(c *check.C) {

@@ -1708,10 +1654,7 @@ func (s *DockerDaemonSuite) TestDaemonCorruptedLogDriverAddress(c *check.C) {

 	})

 	c.Assert(d.StartWithError("--log-driver=syslog", "--log-opt", "syslog-address=corrupted:42"), check.NotNil)

 	expected := "Failed to set log opts: syslog-address should be in form proto://address"

-	runCmd := exec.Command("grep", expected, d.LogFileName())

-	if out, _, err := runCommandWithOutput(runCmd); err != nil {

-		c.Fatalf("Expected %q message; but doesn't exist in log: %q, err: %v", expected, out, err)

-	}

+	icmd.RunCommand("grep", expected, d.LogFileName()).Assert(c, icmd.Success)

 }

 // FIXME(vdemeester) should be a unit test

@@ -1721,10 +1664,7 @@ func (s *DockerDaemonSuite) TestDaemonCorruptedFluentdAddress(c *check.C) {

 	})

 	c.Assert(d.StartWithError("--log-driver=fluentd", "--log-opt", "fluentd-address=corrupted:c"), check.NotNil)

 	expected := "Failed to set log opts: invalid fluentd-address corrupted:c: "

-	runCmd := exec.Command("grep", expected, d.LogFileName())

-	if out, _, err := runCommandWithOutput(runCmd); err != nil {

-		c.Fatalf("Expected %q message; but doesn't exist in log: %q, err: %v", expected, out, err)

-	}

+	icmd.RunCommand("grep", expected, d.LogFileName()).Assert(c, icmd.Success)

 }

 // FIXME(vdemeester) Use a new daemon instance instead of the Suite one

@@ -1808,13 +1748,11 @@ func (s *DockerDaemonSuite) TestDaemonNoSpaceLeftOnDeviceError(c *check.C) {

 	// create a 2MiB image and mount it as graph root

 	// Why in a container? Because `mount` sometimes behaves weirdly and often fails outright on this test in debian:jessie (which is what the test suite runs under if run from the Makefile)

 	dockerCmd(c, "run", "--rm", "-v", testDir+":/test", "busybox", "sh", "-c", "dd of=/test/testfs.img bs=1M seek=2 count=0")

-	out, _, err := runCommandWithOutput(exec.Command("mkfs.ext4", "-F", filepath.Join(testDir, "testfs.img"))) // `mkfs.ext4` is not in busybox

-	c.Assert(err, checker.IsNil, check.Commentf(out))

+	icmd.RunCommand("mkfs.ext4", "-F", filepath.Join(testDir, "testfs.img")).Assert(c, icmd.Success)

-	cmd := exec.Command("losetup", "-f", "--show", filepath.Join(testDir, "testfs.img"))

-	loout, err := cmd.CombinedOutput()

-	c.Assert(err, checker.IsNil)

-	loopname := strings.TrimSpace(string(loout))

+	result := icmd.RunCommand("losetup", "-f", "--show", filepath.Join(testDir, "testfs.img"))

+	result.Assert(c, icmd.Success)