@@ -586,14 +586,14 @@ func (d *Daemon) GetBaseDeviceSize(c *check.C) int64 {

 // Cmd executes a docker CLI command against this daemon.

 // Example: d.Cmd("version") will run docker -H unix://path/to/unix.sock version

 func (d *Daemon) Cmd(args ...string) (string, error) {

-	b, err := d.Command(args...).CombinedOutput()

-	return string(b), err

+	result := icmd.RunCmd(d.Command(args...))

+	return result.Combined(), result.Error

 }

 // Command creates a docker CLI command against this daemon, to be executed later.

 // Example: d.Command("version") creates a command to run "docker -H unix://path/to/unix.sock version"

-func (d *Daemon) Command(args ...string) *exec.Cmd {

-	return exec.Command(d.dockerBinary, d.PrependHostArg(args)...)

+func (d *Daemon) Command(args ...string) icmd.Cmd {

+	return icmd.Command(d.dockerBinary, d.PrependHostArg(args)...)

 }

 // PrependHostArg prepend the specified arguments by the daemon host flags

@@ -31,9 +31,7 @@ import (

 )

 func (s *DockerSuite) TestContainerAPIGetAll(c *check.C) {

-	startCount, err := getContainerCount()

-	c.Assert(err, checker.IsNil, check.Commentf("Cannot query container count"))

-

+	startCount := getContainerCount(c)

 	name := "getall"

 	dockerCmd(c, "run", "--name", name, "busybox", "true")

@@ -354,8 +352,7 @@ func (s *DockerSuite) TestContainerAPIPause(c *check.C) {

 	c.Assert(err, checker.IsNil)

 	c.Assert(status, checker.Equals, http.StatusNoContent)

-	pausedContainers, err := getPausedContainers()

-	c.Assert(err, checker.IsNil, check.Commentf("error thrown while checking if containers were paused"))

+	pausedContainers := getPausedContainers(c)

 	if len(pausedContainers) != 1 || stringid.TruncateID(ContainerID) != pausedContainers[0] {

 		c.Fatalf("there should be one paused container and not %d", len(pausedContainers))

@@ -365,8 +362,7 @@ func (s *DockerSuite) TestContainerAPIPause(c *check.C) {

 	c.Assert(err, checker.IsNil)

 	c.Assert(status, checker.Equals, http.StatusNoContent)

-	pausedContainers, err = getPausedContainers()

-	c.Assert(err, checker.IsNil, check.Commentf("error thrown while checking if containers were paused"))

+	pausedContainers = getPausedContainers(c)

 	c.Assert(pausedContainers, checker.HasLen, 0, check.Commentf("There should be no paused container."))

 }

@@ -7,7 +7,6 @@ import (

 	"fmt"

 	"io/ioutil"

 	"os"

-	"os/exec"

 	"path/filepath"

 	"reflect"

 	"regexp"

@@ -1149,10 +1148,7 @@ func (s *DockerSuite) TestBuildWithInaccessibleFilesInContext(c *check.C) {

 }

 func (s *DockerSuite) TestBuildForceRm(c *check.C) {

-	containerCountBefore, err := getContainerCount()

-	if err != nil {

-		c.Fatalf("failed to get the container count: %s", err)

-	}

+	containerCountBefore := getContainerCount(c)

 	name := "testbuildforcerm"

 	buildImage(name, withBuildFlags("--force-rm"), withBuildContext(c,

@@ -1162,11 +1158,7 @@ func (s *DockerSuite) TestBuildForceRm(c *check.C) {

 		ExitCode: 1,

 	})

-	containerCountAfter, err := getContainerCount()

-	if err != nil {

-		c.Fatalf("failed to get the container count: %s", err)

-	}

-

+	containerCountAfter := getContainerCount(c)

 	if containerCountBefore != containerCountAfter {

 		c.Fatalf("--force-rm shouldn't have left containers behind")

 	}

@@ -1196,19 +1188,12 @@ func (s *DockerSuite) TestBuildRm(c *check.C) {

 	}

 	for _, tc := range testCases {

-		containerCountBefore, err := getContainerCount()

-		if err != nil {

-			c.Fatalf("failed to get the container count: %s", err)

-		}

+		containerCountBefore := getContainerCount(c)

 		buildImageSuccessfully(c, name, withBuildFlags(tc.buildflags...), withDockerfile(`FROM busybox

 	RUN echo hello world`))

-		containerCountAfter, err := getContainerCount()

-		if err != nil {

-			c.Fatalf("failed to get the container count: %s", err)

-		}

-

+		containerCountAfter := getContainerCount(c)

 		if tc.shouldLeftContainerBehind {

 			if containerCountBefore == containerCountAfter {

 				c.Fatalf("flags %v should have left containers behind", tc.buildflags)

@@ -2863,13 +2848,10 @@ func (s *DockerSuite) TestBuildAddTarXz(c *check.C) {

 			c.Fatalf("failed to close tar archive: %v", err)

 		}

-		xzCompressCmd := exec.Command("xz", "-k", "test.tar")

-		xzCompressCmd.Dir = tmpDir

-		out, _, err := runCommandWithOutput(xzCompressCmd)

-		if err != nil {

-			c.Fatal(err, out)

-		}

-

+		icmd.RunCmd(icmd.Cmd{

+			Command: []string{"xz", "-k", "test.tar"},

+			Dir:     tmpDir,

+		}).Assert(c, icmd.Success)

 		if err := ioutil.WriteFile(filepath.Join(tmpDir, "Dockerfile"), []byte(dockerfile), 0644); err != nil {

 			c.Fatalf("failed to open destination dockerfile: %v", err)

 		}

@@ -2913,20 +2895,15 @@ func (s *DockerSuite) TestBuildAddTarXzGz(c *check.C) {

 			c.Fatalf("failed to close tar archive: %v", err)

 		}

-		xzCompressCmd := exec.Command("xz", "-k", "test.tar")

-		xzCompressCmd.Dir = tmpDir

-		out, _, err := runCommandWithOutput(xzCompressCmd)

-		if err != nil {

-			c.Fatal(err, out)

-		}

-

-		gzipCompressCmd := exec.Command("gzip", "test.tar.xz")

-		gzipCompressCmd.Dir = tmpDir

-		out, _, err = runCommandWithOutput(gzipCompressCmd)

-		if err != nil {

-			c.Fatal(err, out)

-		}

+		icmd.RunCmd(icmd.Cmd{

+			Command: []string{"xz", "-k", "test.tar"},

+			Dir:     tmpDir,

+		}).Assert(c, icmd.Success)

+		icmd.RunCmd(icmd.Cmd{

+			Command: []string{"gzip", "test.tar.xz"},

+			Dir:     tmpDir,

+		})

 		if err := ioutil.WriteFile(filepath.Join(tmpDir, "Dockerfile"), []byte(dockerfile), 0644); err != nil {

 			c.Fatalf("failed to open destination dockerfile: %v", err)

 		}

@@ -5591,8 +5568,7 @@ func (s *DockerSuite) TestBuildSquashParent(c *check.C) {

 	dockerCmd(c, "run", "--rm", id, "/bin/sh", "-c", `[ "$(echo $HELLO)" == "world" ]`)

 	// make sure the ID produced is the ID of the tag we specified

-	inspectID, err := inspectImage("test", ".ID")

-	c.Assert(err, checker.IsNil)

+	inspectID := inspectImage(c, "test", ".ID")

 	c.Assert(inspectID, checker.Equals, id)

 	origHistory, _ := dockerCmd(c, "history", origID)

@@ -5602,8 +5578,7 @@ func (s *DockerSuite) TestBuildSquashParent(c *check.C) {

 	splitTestHistory := strings.Split(strings.TrimSpace(testHistory), "\n")

 	c.Assert(len(splitTestHistory), checker.Equals, len(splitOrigHistory)+1)

-	out, err = inspectImage(id, "len .RootFS.Layers")

-	c.Assert(err, checker.IsNil)

+	out = inspectImage(c, id, "len .RootFS.Layers")

 	c.Assert(strings.TrimSpace(out), checker.Equals, "3")

 }

@@ -422,7 +422,7 @@ func (s *DockerSuite) TestCpSpecialFiles(c *check.C) {

 	// Copy actual /etc/resolv.conf

 	dockerCmd(c, "cp", containerID+":/etc/resolv.conf", outDir)

-	expected, err := readContainerFile(containerID, "resolv.conf")

+	expected := readContainerFile(c, containerID, "resolv.conf")

 	actual, err := ioutil.ReadFile(outDir + "/resolv.conf")

 	// Expected copied file to be duplicate of the container resolvconf

@@ -431,7 +431,7 @@ func (s *DockerSuite) TestCpSpecialFiles(c *check.C) {

 	// Copy actual /etc/hosts

 	dockerCmd(c, "cp", containerID+":/etc/hosts", outDir)

-	expected, err = readContainerFile(containerID, "hosts")

+	expected = readContainerFile(c, containerID, "hosts")

 	actual, err = ioutil.ReadFile(outDir + "/hosts")

 	// Expected copied file to be duplicate of the container hosts

@@ -440,7 +440,7 @@ func (s *DockerSuite) TestCpSpecialFiles(c *check.C) {

 	// Copy actual /etc/resolv.conf

 	dockerCmd(c, "cp", containerID+":/etc/hostname", outDir)

-	expected, err = readContainerFile(containerID, "hostname")

+	expected = readContainerFile(c, containerID, "hostname")

 	actual, err = ioutil.ReadFile(outDir + "/hostname")

 	c.Assert(err, checker.IsNil)

@@ -1951,11 +1951,11 @@ func (s *DockerDaemonSuite) TestDaemonRestartWithKilledRunningContainer(t *check

 	// Give time to containerd to process the command if we don't

 	// the exit event might be received after we do the inspect

-	pidCmd := exec.Command("kill", "-0", pid)

-	_, ec, _ := runCommandWithOutput(pidCmd)

-	for ec == 0 {

+	result := icmd.RunCommand("kill", "-0", pid)

+	for result.ExitCode == 0 {

 		time.Sleep(1 * time.Second)

-		_, ec, _ = runCommandWithOutput(pidCmd)

+		// FIXME(vdemeester) should we check it doesn't error out ?

+		result = icmd.RunCommand("kill", "-0", pid)

 	}

 	// restart the daemon

@@ -389,8 +389,7 @@ func (s *DockerSuite) TestRunMutableNetworkFiles(c *check.C) {

 	for _, fn := range []string{"resolv.conf", "hosts"} {

 		deleteAllContainers(c)

-		content, err := runCommandAndReadContainerFile(fn, exec.Command(dockerBinary, "run", "-d", "--name", "c1", "busybox", "sh", "-c", fmt.Sprintf("echo success >/etc/%s && top", fn)))

-		c.Assert(err, checker.IsNil)

+		content := runCommandAndReadContainerFile(c, fn, dockerBinary, "run", "-d", "--name", "c1", "busybox", "sh", "-c", fmt.Sprintf("echo success >/etc/%s && top", fn))

 		c.Assert(strings.TrimSpace(string(content)), checker.Equals, "success", check.Commentf("Content was not what was modified in the container", string(content)))

@@ -442,30 +441,27 @@ func (s *DockerSuite) TestExecWithPrivileged(c *check.C) {

 	dockerCmd(c, "run", "-d", "--name", "parent", "--cap-drop=ALL", "busybox", "sh", "-c", `while (true); do if [ -e /exec_priv ]; then cat /exec_priv && mknod /tmp/sda b 8 0 && echo "Success"; else echo "Privileged exec has not run yet"; fi; usleep 10000; done`)

 	// Check exec mknod doesn't work

-	cmd := exec.Command(dockerBinary, "exec", "parent", "sh", "-c", "mknod /tmp/sdb b 8 16")

-	out, _, err := runCommandWithOutput(cmd)

-	c.Assert(err, checker.NotNil, check.Commentf("exec mknod in --cap-drop=ALL container without --privileged should fail"))

-	c.Assert(out, checker.Contains, "Operation not permitted", check.Commentf("exec mknod in --cap-drop=ALL container without --privileged should fail"))

+	icmd.RunCommand(dockerBinary, "exec", "parent", "sh", "-c", "mknod /tmp/sdb b 8 16").Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Err:      "Operation not permitted",

+	})

 	// Check exec mknod does work with --privileged

-	cmd = exec.Command(dockerBinary, "exec", "--privileged", "parent", "sh", "-c", `echo "Running exec --privileged" > /exec_priv && mknod /tmp/sdb b 8 16 && usleep 50000 && echo "Finished exec --privileged" > /exec_priv && echo ok`)

-	out, _, err = runCommandWithOutput(cmd)

-	c.Assert(err, checker.IsNil)

+	result := icmd.RunCommand(dockerBinary, "exec", "--privileged", "parent", "sh", "-c", `echo "Running exec --privileged" > /exec_priv && mknod /tmp/sdb b 8 16 && usleep 50000 && echo "Finished exec --privileged" > /exec_priv && echo ok`)

+	result.Assert(c, icmd.Success)

-	actual := strings.TrimSpace(out)

-	c.Assert(actual, checker.Equals, "ok", check.Commentf("exec mknod in --cap-drop=ALL container with --privileged failed, output: %q", out))

+	actual := strings.TrimSpace(result.Combined())

+	c.Assert(actual, checker.Equals, "ok", check.Commentf("exec mknod in --cap-drop=ALL container with --privileged failed, output: %q", result.Combined()))

 	// Check subsequent unprivileged exec cannot mknod

-	cmd = exec.Command(dockerBinary, "exec", "parent", "sh", "-c", "mknod /tmp/sdc b 8 32")

-	out, _, err = runCommandWithOutput(cmd)

-	c.Assert(err, checker.NotNil, check.Commentf("repeating exec mknod in --cap-drop=ALL container after --privileged without --privileged should fail"))

-	c.Assert(out, checker.Contains, "Operation not permitted", check.Commentf("repeating exec mknod in --cap-drop=ALL container after --privileged without --privileged should fail"))

-

+	icmd.RunCommand(dockerBinary, "exec", "parent", "sh", "-c", "mknod /tmp/sdc b 8 32").Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Err:      "Operation not permitted",

+	})

 	// Confirm at no point was mknod allowed

-	logCmd := exec.Command(dockerBinary, "logs", "parent")

-	out, _, err = runCommandWithOutput(logCmd)

-	c.Assert(err, checker.IsNil)

-	c.Assert(out, checker.Not(checker.Contains), "Success")

+	result = icmd.RunCommand(dockerBinary, "logs", "parent")

+	result.Assert(c, icmd.Success)

+	c.Assert(result.Combined(), checker.Not(checker.Contains), "Success")

 }

@@ -146,11 +146,8 @@ func (s *DockerSuite) TestLinksHostsFilesInject(c *check.C) {

 	c.Assert(waitRun(idTwo), checker.IsNil)

-	contentOne, err := readContainerFileWithExec(idOne, "/etc/hosts")

-	c.Assert(err, checker.IsNil, check.Commentf("contentOne: %s", string(contentOne)))

-

-	contentTwo, err := readContainerFileWithExec(idTwo, "/etc/hosts")

-	c.Assert(err, checker.IsNil, check.Commentf("contentTwo: %s", string(contentTwo)))

+	readContainerFileWithExec(c, idOne, "/etc/hosts")

+	contentTwo := readContainerFileWithExec(c, idTwo, "/etc/hosts")

 	// Host is not present in updated hosts file

 	c.Assert(string(contentTwo), checker.Contains, "onetwo")

 }

@@ -163,8 +160,7 @@ func (s *DockerSuite) TestLinksUpdateOnRestart(c *check.C) {

 	id := strings.TrimSpace(string(out))

 	realIP := inspectField(c, "one", "NetworkSettings.Networks.bridge.IPAddress")

-	content, err := readContainerFileWithExec(id, "/etc/hosts")

-	c.Assert(err, checker.IsNil)

+	content := readContainerFileWithExec(c, id, "/etc/hosts")

 	getIP := func(hosts []byte, hostname string) string {

 		re := regexp.MustCompile(fmt.Sprintf(`(\S*)\t%s`, regexp.QuoteMeta(hostname)))

@@ -181,8 +177,7 @@ func (s *DockerSuite) TestLinksUpdateOnRestart(c *check.C) {

 	dockerCmd(c, "restart", "one")

 	realIP = inspectField(c, "one", "NetworkSettings.Networks.bridge.IPAddress")

-	content, err = readContainerFileWithExec(id, "/etc/hosts")

-	c.Assert(err, checker.IsNil, check.Commentf("content: %s", string(content)))

+	content = readContainerFileWithExec(c, id, "/etc/hosts")

 	ip = getIP(content, "one")

 	c.Assert(ip, checker.Equals, realIP)

@@ -869,18 +869,15 @@ func (s *DockerNetworkSuite) TestDockerNetworkAnonymousEndpoint(c *check.C) {

 	out, _ := dockerCmd(c, "run", "-d", "--net", cstmBridgeNw, "busybox", "top")

 	cid1 := strings.TrimSpace(out)

-	hosts1, err := readContainerFileWithExec(cid1, hostsFile)

-	c.Assert(err, checker.IsNil)

+	hosts1 := readContainerFileWithExec(c, cid1, hostsFile)

 	out, _ = dockerCmd(c, "run", "-d", "--net", cstmBridgeNw, "busybox", "top")

 	cid2 := strings.TrimSpace(out)

-	hosts2, err := readContainerFileWithExec(cid2, hostsFile)

-	c.Assert(err, checker.IsNil)

+	hosts2 := readContainerFileWithExec(c, cid2, hostsFile)

 	// verify first container etc/hosts file has not changed

-	hosts1post, err := readContainerFileWithExec(cid1, hostsFile)

-	c.Assert(err, checker.IsNil)

+	hosts1post := readContainerFileWithExec(c, cid1, hostsFile)

 	c.Assert(string(hosts1), checker.Equals, string(hosts1post),

 		check.Commentf("Unexpected %s change on anonymous container creation", hostsFile))

@@ -891,11 +888,8 @@ func (s *DockerNetworkSuite) TestDockerNetworkAnonymousEndpoint(c *check.C) {

 	dockerCmd(c, "network", "connect", cstmBridgeNw1, cid2)

-	hosts2, err = readContainerFileWithExec(cid2, hostsFile)

-	c.Assert(err, checker.IsNil)

-

-	hosts1post, err = readContainerFileWithExec(cid1, hostsFile)

-	c.Assert(err, checker.IsNil)

+	hosts2 = readContainerFileWithExec(c, cid2, hostsFile)

+	hosts1post = readContainerFileWithExec(c, cid1, hostsFile)

 	c.Assert(string(hosts1), checker.Equals, string(hosts1post),

 		check.Commentf("Unexpected %s change on container connect", hostsFile))

@@ -910,18 +904,16 @@ func (s *DockerNetworkSuite) TestDockerNetworkAnonymousEndpoint(c *check.C) {

 	// Stop named container and verify first two containers' etc/hosts file hasn't changed

 	dockerCmd(c, "stop", cid3)

-	hosts1post, err = readContainerFileWithExec(cid1, hostsFile)

-	c.Assert(err, checker.IsNil)

+	hosts1post = readContainerFileWithExec(c, cid1, hostsFile)

 	c.Assert(string(hosts1), checker.Equals, string(hosts1post),

 		check.Commentf("Unexpected %s change on name container creation", hostsFile))

-	hosts2post, err := readContainerFileWithExec(cid2, hostsFile)

-	c.Assert(err, checker.IsNil)

+	hosts2post := readContainerFileWithExec(c, cid2, hostsFile)

 	c.Assert(string(hosts2), checker.Equals, string(hosts2post),

 		check.Commentf("Unexpected %s change on name container creation", hostsFile))

 	// verify that container 1 and 2 can't ping the named container now

-	_, _, err = dockerCmdWithError("exec", cid1, "ping", "-c", "1", cName)

+	_, _, err := dockerCmdWithError("exec", cid1, "ping", "-c", "1", cName)

 	c.Assert(err, check.NotNil)

 	_, _, err = dockerCmdWithError("exec", cid2, "ping", "-c", "1", cName)

 	c.Assert(err, check.NotNil)

@@ -15,8 +15,7 @@ func (s *DockerSuite) TestPause(c *check.C) {

 	runSleepingContainer(c, "-d", "--name", name)

 	dockerCmd(c, "pause", name)

-	pausedContainers, err := getPausedContainers()

-	c.Assert(err, checker.IsNil)

+	pausedContainers := getPausedContainers(c)

 	c.Assert(len(pausedContainers), checker.Equals, 1)

 	dockerCmd(c, "unpause", name)

@@ -41,8 +40,7 @@ func (s *DockerSuite) TestPauseMultipleContainers(c *check.C) {

 		runSleepingContainer(c, "-d", "--name", name)

 	}

 	dockerCmd(c, append([]string{"pause"}, containers...)...)

-	pausedContainers, err := getPausedContainers()

-	c.Assert(err, checker.IsNil)

+	pausedContainers := getPausedContainers(c)

 	c.Assert(len(pausedContainers), checker.Equals, len(containers))

 	dockerCmd(c, append([]string{"unpause"}, containers...)...)

@@ -4,7 +4,6 @@ import (

 	"fmt"

 	"io/ioutil"

 	"os"

-	"os/exec"

 	"path/filepath"

 	"sort"

 	"strconv"

@@ -159,12 +158,11 @@ func (s *DockerSuite) TestPsListContainersSize(c *check.C) {

 	dockerCmd(c, "run", "--name", name, "busybox", "sh", "-c", "echo 1 > test")

 	id := getIDByName(c, name)

-	runCmd := exec.Command(dockerBinary, "ps", "-s", "-n=1")

-	var out string

+	var result *icmd.Result

 	wait := make(chan struct{})

 	go func() {

-		out, _, err = runCommandWithOutput(runCmd)

+		result = icmd.RunCommand(dockerBinary, "ps", "-s", "-n=1")

 		close(wait)

 	}()

 	select {

@@ -172,8 +170,8 @@ func (s *DockerSuite) TestPsListContainersSize(c *check.C) {

 	case <-time.After(3 * time.Second):

 		c.Fatalf("Calling \"docker ps -s\" timed out!")

 	}

-	c.Assert(err, checker.IsNil)

-	lines := strings.Split(strings.Trim(out, "\n "), "\n")

+	result.Assert(c, icmd.Success)

+	lines := strings.Split(strings.Trim(result.Combined(), "\n "), "\n")

 	c.Assert(lines, checker.HasLen, 2, check.Commentf("Expected 2 lines for 'ps -s -n=1' output, got %d", len(lines)))

 	sizeIndex := strings.Index(lines[0], "SIZE")

 	idIndex := strings.Index(lines[0], "CONTAINER ID")

@@ -1464,10 +1464,7 @@ func (s *DockerSuite) TestRunResolvconfUpdate(c *check.C) {

 	dockerCmd(c, "start", "first")

 	// check for update in container

-	containerResolv, err := readContainerFile(containerID1, "resolv.conf")

-	if err != nil {

-		c.Fatal(err)

-	}

+	containerResolv := readContainerFile(c, containerID1, "resolv.conf")

 	if !bytes.Equal(containerResolv, bytesResolvConf) {

 		c.Fatalf("Restarted container does not have updated resolv.conf; expected %q, got %q", tmpResolvConf, string(containerResolv))

 	}

@@ -1490,11 +1487,7 @@ func (s *DockerSuite) TestRunResolvconfUpdate(c *check.C) {

 	dockerCmd(c, "start", "second")

 	// check for update in container

-	containerResolv, err = readContainerFile(containerID2, "resolv.conf")

-	if err != nil {

-		c.Fatal(err)

-	}

-

+	containerResolv = readContainerFile(c, containerID2, "resolv.conf")

 	if bytes.Equal(containerResolv, resolvConfSystem) {

 		c.Fatalf("Container's resolv.conf should not have been updated with host resolv.conf: %q", string(containerResolv))

 	}

@@ -1509,11 +1502,7 @@ func (s *DockerSuite) TestRunResolvconfUpdate(c *check.C) {

 	}

 	// check for update in container

-	containerResolv, err = readContainerFile(runningContainerID, "resolv.conf")

-	if err != nil {

-		c.Fatal(err)

-	}

-

+	containerResolv = readContainerFile(c, runningContainerID, "resolv.conf")

 	if bytes.Equal(containerResolv, bytesResolvConf) {

 		c.Fatalf("Running container should not have updated resolv.conf; expected %q, got %q", string(resolvConfSystem), string(containerResolv))

 	}

@@ -1523,10 +1512,7 @@ func (s *DockerSuite) TestRunResolvconfUpdate(c *check.C) {

 	dockerCmd(c, "restart", runningContainerID)

 	// check for update in container

-	containerResolv, err = readContainerFile(runningContainerID, "resolv.conf")

-	if err != nil {

-		c.Fatal(err)

-	}

+	containerResolv = readContainerFile(c, runningContainerID, "resolv.conf")

 	if !bytes.Equal(containerResolv, bytesResolvConf) {

 		c.Fatalf("Restarted container should have updated resolv.conf; expected %q, got %q", string(bytesResolvConf), string(containerResolv))

 	}

@@ -1545,11 +1531,7 @@ func (s *DockerSuite) TestRunResolvconfUpdate(c *check.C) {

 	// our first exited container ID should have been updated, but with default DNS

 	// after the cleanup of resolv.conf found only a localhost nameserver:

-	containerResolv, err = readContainerFile(containerID1, "resolv.conf")

-	if err != nil {

-		c.Fatal(err)

-	}

-

+	containerResolv = readContainerFile(c, containerID1, "resolv.conf")

 	expected := "\nnameserver 8.8.8.8\nnameserver 8.8.4.4\n"

 	if !bytes.Equal(containerResolv, []byte(expected)) {

 		c.Fatalf("Container does not have cleaned/replaced DNS in resolv.conf; expected %q, got %q", expected, string(containerResolv))

@@ -1582,10 +1564,7 @@ func (s *DockerSuite) TestRunResolvconfUpdate(c *check.C) {

 	dockerCmd(c, "start", "third")

 	// check for update in container

-	containerResolv, err = readContainerFile(containerID3, "resolv.conf")

-	if err != nil {

-		c.Fatal(err)

-	}

+	containerResolv = readContainerFile(c, containerID3, "resolv.conf")

 	if !bytes.Equal(containerResolv, bytesResolvConf) {

 		c.Fatalf("Stopped container does not have updated resolv.conf; expected\n%q\n got\n%q", tmpResolvConf, string(containerResolv))

 	}

@@ -2840,11 +2819,7 @@ func (s *DockerSuite) TestRunContainerWithRmFlagExitCodeNotEqualToZero(c *check.

 		c.Fatal("Expected docker run to fail", out, err)

 	}

-	out, err = getAllContainers()

-	if err != nil {

-		c.Fatal(out, err)

-	}

-

+	out = getAllContainers(c)

 	if out != "" {

 		c.Fatal("Expected not to have containers", out)

 	}

@@ -2857,11 +2832,7 @@ func (s *DockerSuite) TestRunContainerWithRmFlagCannotStartContainer(c *check.C)

 		c.Fatal("Expected docker run to fail", out, err)

 	}

-	out, err = getAllContainers()

-	if err != nil {

-		c.Fatal(out, err)

-	}

-

+	out = getAllContainers(c)

 	if out != "" {

 		c.Fatal("Expected not to have containers", out)

 	}

@@ -15,6 +15,7 @@ import (

 	"github.com/docker/docker/integration-cli/checker"

 	"github.com/docker/docker/pkg/testutil"

+	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/go-check/check"

 	"github.com/opencontainers/go-digest"

 )

@@ -37,10 +38,12 @@ func (s *DockerSuite) TestSaveXzAndLoadRepoStdout(c *check.C) {

 	c.Assert(err, checker.IsNil, check.Commentf("failed to save repo: %v %v", out, err))

 	deleteImages(repoName)

-	loadCmd := exec.Command(dockerBinary, "load")

-	loadCmd.Stdin = strings.NewReader(repoTarball)

-	out, _, err = runCommandWithOutput(loadCmd)

-	c.Assert(err, checker.NotNil, check.Commentf("expected error, but succeeded with no error and output: %v", out))

+	icmd.RunCmd(icmd.Cmd{

+		Command: []string{dockerBinary, "load"},

+		Stdin:   strings.NewReader(repoTarball),

+	}).Assert(c, icmd.Expected{

+		ExitCode: 1,

+	})

 	after, _, err := dockerCmdWithError("inspect", repoName)

 	c.Assert(err, checker.NotNil, check.Commentf("the repo should not exist: %v", after))

@@ -65,10 +68,12 @@ func (s *DockerSuite) TestSaveXzGzAndLoadRepoStdout(c *check.C) {

 	deleteImages(repoName)

-	loadCmd := exec.Command(dockerBinary, "load")

-	loadCmd.Stdin = strings.NewReader(out)

-	out, _, err = runCommandWithOutput(loadCmd)

-	c.Assert(err, checker.NotNil, check.Commentf("expected error, but succeeded with no error and output: %v", out))

+	icmd.RunCmd(icmd.Cmd{

+		Command: []string{dockerBinary, "load"},

+		Stdin:   strings.NewReader(out),

+	}).Assert(c, icmd.Expected{

+		ExitCode: 1,

+	})

 	after, _, err := dockerCmdWithError("inspect", repoName)

 	c.Assert(err, checker.NotNil, check.Commentf("the repo should not exist: %v", after))

@@ -41,11 +41,10 @@ func (s *DockerSuite) TestSaveAndLoadRepoStdout(c *check.C) {

 	deleteImages(repoName)

-	loadCmd := exec.Command(dockerBinary, "load")

-	loadCmd.Stdin = tmpFile

-

-	out, _, err := runCommandWithOutput(loadCmd)

-	c.Assert(err, check.IsNil, check.Commentf(out))

+	icmd.RunCmd(icmd.Cmd{

+		Command: []string{dockerBinary, "load"},

+		Stdin:   tmpFile,

+	}).Assert(c, icmd.Success)

 	after := inspectField(c, repoName, "Id")

 	after = strings.TrimRight(after, "\n")

@@ -67,7 +66,7 @@ func (s *DockerSuite) TestSaveAndLoadRepoStdout(c *check.C) {

 	n, err := pty.Read(buf)

 	c.Assert(err, check.IsNil) //could not read tty output

-	c.Assert(string(buf[:n]), checker.Contains, "Cowardly refusing", check.Commentf("help output is not being yielded", out))

+	c.Assert(string(buf[:n]), checker.Contains, "Cowardly refusing", check.Commentf("help output is not being yielded"))

 }

 func (s *DockerSuite) TestSaveAndLoadWithProgressBar(c *check.C) {

@@ -17,6 +17,7 @@ import (

 	"github.com/docker/docker/api/types/swarm"

 	"github.com/docker/docker/integration-cli/checker"

 	"github.com/docker/docker/integration-cli/daemon"

+	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/docker/libnetwork/driverapi"

 	"github.com/docker/libnetwork/ipamapi"

 	remoteipam "github.com/docker/libnetwork/ipams/remote/api"

@@ -832,8 +833,7 @@ func checkSwarmLockedToUnlocked(c *check.C, d *daemon.Swarm, unlockKey string) {

 		// it must not have updated to be unlocked in time - unlock, wait 3 seconds, and try again

 		cmd := d.Command("swarm", "unlock")

 		cmd.Stdin = bytes.NewBufferString(unlockKey)

-		out, err := cmd.CombinedOutput()

-		c.Assert(err, checker.IsNil, check.Commentf("out: %v", string(out)))

+		icmd.RunCmd(cmd).Assert(c, icmd.Success)

 		c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)

@@ -860,22 +860,24 @@ func (s *DockerSwarmSuite) TestUnlockEngineAndUnlockedSwarm(c *check.C) {

 	// unlocking a normal engine should return an error - it does not even ask for the key

 	cmd := d.Command("swarm", "unlock")

-	outs, err := cmd.CombinedOutput()

-

-	c.Assert(err, checker.NotNil, check.Commentf("out: %v", string(outs)))

-	c.Assert(string(outs), checker.Contains, "Error: This node is not part of a swarm")

-	c.Assert(string(outs), checker.Not(checker.Contains), "Please enter unlock key")

+	result := icmd.RunCmd(cmd)

+	result.Assert(c, icmd.Expected{

+		ExitCode: 1,

+	})

+	c.Assert(result.Combined(), checker.Contains, "Error: This node is not part of a swarm")

+	c.Assert(result.Combined(), checker.Not(checker.Contains), "Please enter unlock key")

-	_, err = d.Cmd("swarm", "init")

+	_, err := d.Cmd("swarm", "init")

 	c.Assert(err, checker.IsNil)

 	// unlocking an unlocked swarm should return an error - it does not even ask for the key

 	cmd = d.Command("swarm", "unlock")

-	outs, err = cmd.CombinedOutput()

-

-	c.Assert(err, checker.NotNil, check.Commentf("out: %v", string(outs)))

-	c.Assert(string(outs), checker.Contains, "Error: swarm is not locked")

-	c.Assert(string(outs), checker.Not(checker.Contains), "Please enter unlock key")

+	result = icmd.RunCmd(cmd)

+	result.Assert(c, icmd.Expected{

+		ExitCode: 1,

+	})

+	c.Assert(result.Combined(), checker.Contains, "Error: swarm is not locked")

+	c.Assert(result.Combined(), checker.Not(checker.Contains), "Please enter unlock key")

 }

 func (s *DockerSwarmSuite) TestSwarmInitLocked(c *check.C) {

@@ -907,16 +909,16 @@ func (s *DockerSwarmSuite) TestSwarmInitLocked(c *check.C) {

 	cmd := d.Command("swarm", "unlock")

 	cmd.Stdin = bytes.NewBufferString("wrong-secret-key")

-	out, err := cmd.CombinedOutput()

-	c.Assert(err, checker.NotNil, check.Commentf("out: %v", string(out)))

-	c.Assert(string(out), checker.Contains, "invalid key")

+	icmd.RunCmd(cmd).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Err:      "invalid key",

+	})

 	c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateLocked)

 	cmd = d.Command("swarm", "unlock")

 	cmd.Stdin = bytes.NewBufferString(unlockKey)

-	out, err = cmd.CombinedOutput()

-	c.Assert(err, checker.IsNil, check.Commentf("out: %v", string(out)))

+	icmd.RunCmd(cmd).Assert(c, icmd.Success)

 	c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)

@@ -1007,8 +1009,7 @@ func (s *DockerSwarmSuite) TestSwarmLockUnlockCluster(c *check.C) {

 		cmd := d.Command("swarm", "unlock")

 		cmd.Stdin = bytes.NewBufferString(unlockKey)

-		out, err := cmd.CombinedOutput()

-		c.Assert(err, checker.IsNil, check.Commentf("out: %v", string(out)))

+		icmd.RunCmd(cmd).Assert(c, icmd.Success)

 		c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)

 	}

@@ -1034,8 +1035,7 @@ func (s *DockerSwarmSuite) TestSwarmLockUnlockCluster(c *check.C) {

 	// unlock it

 	cmd := d2.Command("swarm", "unlock")

 	cmd.Stdin = bytes.NewBufferString(unlockKey)

-	out, err := cmd.CombinedOutput()

-	c.Assert(err, checker.IsNil, check.Commentf("out: %v", string(out)))

+	icmd.RunCmd(cmd).Assert(c, icmd.Success)

 	c.Assert(getNodeStatus(c, d2), checker.Equals, swarm.LocalNodeStateActive)

 	// once it's caught up, d2 is set to not be locked

@@ -1088,8 +1088,7 @@ func (s *DockerSwarmSuite) TestSwarmJoinPromoteLocked(c *check.C) {

 		cmd := d.Command("swarm", "unlock")

 		cmd.Stdin = bytes.NewBufferString(unlockKey)

-		out, err := cmd.CombinedOutput()

-		c.Assert(err, checker.IsNil, check.Commentf("out: %v", string(out)))

+		icmd.RunCmd(cmd).Assert(c, icmd.Success)

 		c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)

 	}

@@ -1159,9 +1158,9 @@ func (s *DockerSwarmSuite) TestSwarmRotateUnlockKey(c *check.C) {

 		cmd := d.Command("swarm", "unlock")

 		cmd.Stdin = bytes.NewBufferString(unlockKey)

-		out, err := cmd.CombinedOutput()

+		result := icmd.RunCmd(cmd)

-		if err == nil {

+		if result.Error == nil {

 			// On occasion, the daemon may not have finished

 			// rotating the KEK before restarting. The test is

 			// intentionally written to explore this behavior.

@@ -1176,18 +1175,19 @@ func (s *DockerSwarmSuite) TestSwarmRotateUnlockKey(c *check.C) {

 			cmd = d.Command("swarm", "unlock")

 			cmd.Stdin = bytes.NewBufferString(unlockKey)

-			out, err = cmd.CombinedOutput()

+			result = icmd.RunCmd(cmd)

 		}

-		c.Assert(err, checker.NotNil, check.Commentf("out: %v", string(out)))

-		c.Assert(string(out), checker.Contains, "invalid key")

+		result.Assert(c, icmd.Expected{

+			ExitCode: 1,

+			Err:      "invalid key",

+		})

 		outs, _ = d.Cmd("node", "ls")

 		c.Assert(outs, checker.Contains, "Swarm is encrypted and needs to be unlocked")

 		cmd = d.Command("swarm", "unlock")

 		cmd.Stdin = bytes.NewBufferString(newUnlockKey)

-		out, err = cmd.CombinedOutput()

-		c.Assert(err, checker.IsNil, check.Commentf("out: %v", string(out)))

+		icmd.RunCmd(cmd).Assert(c, icmd.Success)

 		c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)

@@ -1245,9 +1245,9 @@ func (s *DockerSwarmSuite) TestSwarmClusterRotateUnlockKey(c *check.C) {

 			cmd := d.Command("swarm", "unlock")

 			cmd.Stdin = bytes.NewBufferString(unlockKey)

-			out, err := cmd.CombinedOutput()

+			result := icmd.RunCmd(cmd)

-			if err == nil {

+			if result.Error == nil {

 				// On occasion, the daemon may not have finished

 				// rotating the KEK before restarting. The test is

 				// intentionally written to explore this behavior.

@@ -1262,18 +1262,19 @@ func (s *DockerSwarmSuite) TestSwarmClusterRotateUnlockKey(c *check.C) {

 				cmd = d.Command("swarm", "unlock")

 				cmd.Stdin = bytes.NewBufferString(unlockKey)

-				out, err = cmd.CombinedOutput()

+				result = icmd.RunCmd(cmd)

 			}

-			c.Assert(err, checker.NotNil, check.Commentf("out: %v", string(out)))

-			c.Assert(string(out), checker.Contains, "invalid key")

+			result.Assert(c, icmd.Expected{

+				ExitCode: 1,

+				Err:      "invalid key",

+			})

 			outs, _ = d.Cmd("node", "ls")

 			c.Assert(outs, checker.Contains, "Swarm is encrypted and needs to be unlocked")

 			cmd = d.Command("swarm", "unlock")

 			cmd.Stdin = bytes.NewBufferString(newUnlockKey)

-			out, err = cmd.CombinedOutput()

-			c.Assert(err, checker.IsNil, check.Commentf("out: %v", string(out)))

+			icmd.RunCmd(cmd).Assert(c, icmd.Success)

 			c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)

@@ -1308,8 +1309,7 @@ func (s *DockerSwarmSuite) TestSwarmAlternateLockUnlock(c *check.C) {

 		cmd := d.Command("swarm", "unlock")

 		cmd.Stdin = bytes.NewBufferString(unlockKey)

-		out, err := cmd.CombinedOutput()

-		c.Assert(err, checker.IsNil, check.Commentf("out: %v", string(out)))

+		icmd.RunCmd(cmd).Assert(c, icmd.Success)

 		c.Assert(getNodeStatus(c, d), checker.Equals, swarm.LocalNodeStateActive)

@@ -1410,12 +1410,11 @@ func (s *DockerTrustedSwarmSuite) TestTrustedServiceCreate(c *check.C) {

 	name := "trusted"

 	serviceCmd := d.Command("-D", "service", "create", "--name", name, repoName, "top")

-	trustedExecCmd(serviceCmd)

-	out, _, err := runCommandWithOutput(serviceCmd)

-	c.Assert(err, checker.IsNil, check.Commentf(out))

-	c.Assert(out, checker.Contains, "resolved image tag to", check.Commentf(out))

+	icmd.RunCmd(serviceCmd, trustedCmd).Assert(c, icmd.Expected{

+		Err: "resolved image tag to",

+	})

-	out, err = d.Cmd("service", "inspect", "--pretty", name)

+	out, err := d.Cmd("service", "inspect", "--pretty", name)

 	c.Assert(err, checker.IsNil, check.Commentf(out))

 	c.Assert(out, checker.Contains, repoName+"@", check.Commentf(out))

@@ -1429,11 +1428,10 @@ func (s *DockerTrustedSwarmSuite) TestTrustedServiceCreate(c *check.C) {

 	name = "untrusted"

 	serviceCmd = d.Command("service", "create", "--name", name, repoName, "top")

-	trustedExecCmd(serviceCmd)

-	out, _, err = runCommandWithOutput(serviceCmd)

-

-	c.Assert(err, check.NotNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "Error: remote trust data does not exist", check.Commentf(out))

+	icmd.RunCmd(serviceCmd, trustedCmd).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Err:      "Error: remote trust data does not exist",

+	})

 	out, err = d.Cmd("service", "inspect", "--pretty", name)

 	c.Assert(err, checker.NotNil, check.Commentf(out))

@@ -1458,10 +1456,9 @@ func (s *DockerTrustedSwarmSuite) TestTrustedServiceUpdate(c *check.C) {

 	c.Assert(out, check.Not(checker.Contains), repoName+"@", check.Commentf(out))

 	serviceCmd := d.Command("-D", "service", "update", "--image", repoName, name)

-	trustedExecCmd(serviceCmd)

-	out, _, err = runCommandWithOutput(serviceCmd)

-	c.Assert(err, checker.IsNil, check.Commentf(out))

-	c.Assert(out, checker.Contains, "resolved image tag to", check.Commentf(out))

+	icmd.RunCmd(serviceCmd, trustedCmd).Assert(c, icmd.Expected{

+		Err: "resolved image tag to",

+	})

 	out, err = d.Cmd("service", "inspect", "--pretty", name)

 	c.Assert(err, checker.IsNil, check.Commentf(out))

@@ -1476,11 +1473,10 @@ func (s *DockerTrustedSwarmSuite) TestTrustedServiceUpdate(c *check.C) {

 	dockerCmd(c, "rmi", repoName)

 	serviceCmd = d.Command("service", "update", "--image", repoName, name)

-	trustedExecCmd(serviceCmd)

-	out, _, err = runCommandWithOutput(serviceCmd)

-

-	c.Assert(err, check.NotNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "Error: remote trust data does not exist", check.Commentf(out))

+	icmd.RunCmd(serviceCmd, trustedCmd).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Err:      "Error: remote trust data does not exist",

+	})

 }

 // Test case for issue #27866, which did not allow NW name that is the prefix of a swarm NW ID.

@@ -52,22 +52,16 @@ func deleteContainer(ignoreNoSuchContainer bool, container ...string) error {

 	return result.Compare(icmd.Success)

 }

-func getAllContainers() (string, error) {

-	getContainersCmd := exec.Command(dockerBinary, "ps", "-q", "-a")

-	out, exitCode, err := runCommandWithOutput(getContainersCmd)

-	if exitCode != 0 && err == nil {

-		err = fmt.Errorf("failed to get a list of containers: %v\n", out)

-	}

-

-	return out, err

+func getAllContainers(c *check.C) string {

+	result := icmd.RunCommand(dockerBinary, "ps", "-q", "-a")

+	result.Assert(c, icmd.Success)

+	return result.Combined()

 }

 func deleteAllContainers(c *check.C) {

-	containers, err := getAllContainers()

-	c.Assert(err, checker.IsNil, check.Commentf("containers: %v", containers))

-

+	containers := getAllContainers(c)

 	if containers != "" {

-		err = deleteContainer(true, strings.Split(strings.TrimSpace(containers), "\n")...)

+		err := deleteContainer(true, strings.Split(strings.TrimSpace(containers), "\n")...)

 		c.Assert(err, checker.IsNil)

 	}

 }

@@ -202,17 +196,10 @@ func deleteAllImages(c *check.C) {

 	}

 }

-func getPausedContainers() ([]string, error) {

-	getPausedContainersCmd := exec.Command(dockerBinary, "ps", "-f", "status=paused", "-q", "-a")

-	out, exitCode, err := runCommandWithOutput(getPausedContainersCmd)

-	if exitCode != 0 && err == nil {

-		err = fmt.Errorf("failed to get a list of paused containers: %v\n", out)

-	}

-	if err != nil {

-		return nil, err

-	}

-