diff --git a/pkg/api/controller_test.go b/pkg/api/controller_test.go
index 5d870203..037d6ea0 100644
--- a/pkg/api/controller_test.go
+++ b/pkg/api/controller_test.go
@@ -109,11 +109,7 @@ func TestRunAlreadyRunningServer(t *testing.T) {
 
 		ctlr := api.NewController(conf)
 
-		globalDir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(globalDir)
+		globalDir := t.TempDir()
 
 		ctlr.Config.Storage.RootDirectory = globalDir
 
@@ -137,7 +133,7 @@ func TestRunAlreadyRunningServer(t *testing.T) {
 			_ = ctlr.Server.Shutdown(ctx)
 		}()
 
-		err = ctlr.Run()
+		err := ctlr.Run()
 		So(err, ShouldNotBeNil)
 	})
 }
@@ -253,12 +249,7 @@ func TestHtpasswdSingleCred(t *testing.T) {
 					},
 				}
 				ctlr := api.NewController(conf)
-				dir, err := ioutil.TempDir("", "oci-repo-test")
-				if err != nil {
-					panic(err)
-				}
-				defer os.RemoveAll(dir)
-				ctlr.Config.Storage.RootDirectory = dir
+				ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 				go startServer(ctlr)
 				defer stopServer(ctlr)
@@ -308,12 +299,7 @@ func TestHtpasswdTwoCreds(t *testing.T) {
 					},
 				}
 				ctlr := api.NewController(conf)
-				dir, err := ioutil.TempDir("", "oci-repo-test")
-				if err != nil {
-					panic(err)
-				}
-				defer os.RemoveAll(dir)
-				ctlr.Config.Storage.RootDirectory = dir
+				ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 				go startServer(ctlr)
 				defer stopServer(ctlr)
@@ -364,12 +350,7 @@ func TestHtpasswdFiveCreds(t *testing.T) {
 				},
 			}
 			ctlr := api.NewController(conf)
-			dir, err := ioutil.TempDir("", "oci-repo-test")
-			if err != nil {
-				panic(err)
-			}
-			defer os.RemoveAll(dir)
-			ctlr.Config.Storage.RootDirectory = dir
+			ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 			go startServer(ctlr)
 			defer stopServer(ctlr)
@@ -402,12 +383,7 @@ func TestRatelimit(t *testing.T) {
 			Rate: &rate,
 		}
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 		go startServer(ctlr)
 		defer stopServer(ctlr)
@@ -443,12 +419,7 @@ func TestRatelimit(t *testing.T) {
 			},
 		}
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 		go startServer(ctlr)
 		defer stopServer(ctlr)
@@ -485,12 +456,7 @@ func TestRatelimit(t *testing.T) {
 			},
 		}
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 		go startServer(ctlr)
 		defer stopServer(ctlr)
@@ -526,12 +492,7 @@ func TestBasicAuth(t *testing.T) {
 			},
 		}
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 		go startServer(ctlr)
 		defer stopServer(ctlr)
@@ -565,13 +526,7 @@ func TestInterruptedBlobUpload(t *testing.T) {
 		conf.HTTP.Port = port
 
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 		go startServer(ctlr)
 		defer stopServer(ctlr)
@@ -805,17 +760,8 @@ func TestMultipleInstance(t *testing.T) {
 		err := ctlr.Run()
 		So(err, ShouldEqual, errors.ErrImgStoreNotFound)
 
-		globalDir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(globalDir)
-
-		subDir, err := ioutil.TempDir("", "oci-sub-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(subDir)
+		globalDir := t.TempDir()
+		subDir := t.TempDir()
 
 		ctlr.Config.Storage.RootDirectory = globalDir
 		subPathMap := make(map[string]config.StorageConfig)
@@ -848,17 +794,8 @@ func TestMultipleInstance(t *testing.T) {
 			},
 		}
 		ctlr := api.NewController(conf)
-		globalDir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(globalDir)
-
-		subDir, err := ioutil.TempDir("", "oci-sub-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(subDir)
+		globalDir := t.TempDir()
+		subDir := t.TempDir()
 
 		ctlr.Config.Storage.RootDirectory = globalDir
 		subPathMap := make(map[string]config.StorageConfig)
@@ -916,12 +853,7 @@ func TestTLSWithBasicAuth(t *testing.T) {
 		}
 
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 		go startServer(ctlr)
 		defer stopServer(ctlr)
@@ -982,12 +914,7 @@ func TestTLSWithBasicAuthAllowReadAccess(t *testing.T) {
 		conf.HTTP.AllowReadAccess = true
 
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 		go startServer(ctlr)
 		defer stopServer(ctlr)
@@ -1042,12 +969,7 @@ func TestTLSMutualAuth(t *testing.T) {
 		}
 
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 		go startServer(ctlr)
 		defer stopServer(ctlr)
@@ -1115,12 +1037,7 @@ func TestTLSMutualAuthAllowReadAccess(t *testing.T) {
 		conf.HTTP.AllowReadAccess = true
 
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 		go startServer(ctlr)
 		defer stopServer(ctlr)
@@ -1201,12 +1118,7 @@ func TestTLSMutualAndBasicAuth(t *testing.T) {
 		}
 
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 		go startServer(ctlr)
 		defer stopServer(ctlr)
@@ -1284,12 +1196,7 @@ func TestTLSMutualAndBasicAuthAllowReadAccess(t *testing.T) {
 		conf.HTTP.AllowReadAccess = true
 
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 		go startServer(ctlr)
 		defer stopServer(ctlr)
@@ -1443,12 +1350,7 @@ func TestBasicAuthWithLDAP(t *testing.T) {
 			},
 		}
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 		go startServer(ctlr)
 		defer stopServer(ctlr)
@@ -1532,10 +1434,7 @@ func TestBearerAuth(t *testing.T) {
 			},
 		}
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		So(err, ShouldBeNil)
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 		go startServer(ctlr)
 		defer stopServer(ctlr)
@@ -1699,10 +1598,7 @@ func TestBearerAuthWithAllowReadAccess(t *testing.T) {
 		}
 		conf.HTTP.AllowReadAccess = true
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		So(err, ShouldBeNil)
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 		go startServer(ctlr)
 		defer stopServer(ctlr)
@@ -1931,12 +1827,8 @@ func TestAuthorizationWithBasicAuth(t *testing.T) {
 		}
 
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		err = test.CopyFiles("../../test/data", dir)
+		dir := t.TempDir()
+		err := test.CopyFiles("../../test/data", dir)
 		if err != nil {
 			panic(err)
 		}
@@ -2459,12 +2351,7 @@ func TestHTTPReadOnly(t *testing.T) {
 					},
 				}
 				ctlr := api.NewController(conf)
-				dir, err := ioutil.TempDir("", "oci-repo-test")
-				if err != nil {
-					panic(err)
-				}
-				defer os.RemoveAll(dir)
-				ctlr.Config.Storage.RootDirectory = dir
+				ctlr.Config.Storage.RootDirectory = t.TempDir()
 
 				go startServer(ctlr)
 				defer stopServer(ctlr)
@@ -2476,7 +2363,7 @@ func TestHTTPReadOnly(t *testing.T) {
 				So(resp.StatusCode(), ShouldEqual, http.StatusOK)
 
 				// with creds, any modifications should still fail on read-only mode
-				resp, err = resty.R().SetBasicAuth(user, password).
+				resp, err := resty.R().SetBasicAuth(user, password).
 					Post(baseURL + "/v2/" + AuthorizedNamespace + "/blobs/uploads/")
 				So(err, ShouldBeNil)
 				So(resp, ShouldNotBeNil)
@@ -2510,16 +2397,12 @@ func TestCrossRepoMount(t *testing.T) {
 
 		ctlr := api.NewController(conf)
 
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
+		dir := t.TempDir()
 
-		err = test.CopyFiles("../../test/data", dir)
+		err := test.CopyFiles("../../test/data", dir)
 		if err != nil {
 			panic(err)
 		}
-		defer os.RemoveAll(dir)
 		ctlr.Config.Storage.RootDirectory = dir
 
 		go startServer(ctlr)
@@ -2694,16 +2577,12 @@ func TestCrossRepoMount(t *testing.T) {
 
 		ctlr := api.NewController(conf)
 
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
+		dir := t.TempDir()
 
-		err = test.CopyFiles("../../test/data", dir)
+		err := test.CopyFiles("../../test/data", dir)
 		if err != nil {
 			panic(err)
 		}
-		defer os.RemoveAll(dir)
 
 		ctlr.Config.Storage.RootDirectory = dir
 		ctlr.Config.Storage.Dedupe = false
@@ -2836,32 +2715,9 @@ func TestParallelRequests(t *testing.T) {
 
 	ctlr := api.NewController(conf)
 
-	dir, err := ioutil.TempDir("", "oci-repo-test")
-	if err != nil {
-		panic(err)
-	}
-
-	t.Cleanup(func() {
-		os.RemoveAll(dir)
-	})
-
-	firstSubDir, err := ioutil.TempDir("", "oci-sub-dir")
-	if err != nil {
-		panic(err)
-	}
-
-	t.Cleanup(func() {
-		os.RemoveAll(firstSubDir)
-	})
-
-	secondSubDir, err := ioutil.TempDir("", "oci-sub-dir")
-	if err != nil {
-		panic(err)
-	}
-
-	t.Cleanup(func() {
-		os.RemoveAll(secondSubDir)
-	})
+	dir := t.TempDir()
+	firstSubDir := t.TempDir()
+	secondSubDir := t.TempDir()
 
 	subPaths := make(map[string]config.StorageConfig)
 
@@ -3079,22 +2935,14 @@ func TestHardLink(t *testing.T) {
 
 		ctlr := api.NewController(conf)
 
-		dir, err := ioutil.TempDir("", "hard-link-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
-		err = os.Chmod(dir, 0o400)
+		err := os.Chmod(dir, 0o400)
 		if err != nil {
 			panic(err)
 		}
 
-		subDir, err := ioutil.TempDir("", "sub-hardlink-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(subDir)
+		subDir := t.TempDir()
 
 		err = os.Chmod(subDir, 0o400)
 		if err != nil {
@@ -3135,11 +2983,7 @@ func TestImageSignatures(t *testing.T) {
 		conf.HTTP.Port = port
 
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 		ctlr.Config.Storage.RootDirectory = dir
 		go func(controller *api.Controller) {
 			// this blocks
@@ -3235,9 +3079,7 @@ func TestImageSignatures(t *testing.T) {
 			cwd, err := os.Getwd()
 			So(err, ShouldBeNil)
 			defer func() { _ = os.Chdir(cwd) }()
-			tdir, err := ioutil.TempDir("", "cosign")
-			So(err, ShouldBeNil)
-			defer os.RemoveAll(tdir)
+			tdir := t.TempDir()
 			_ = os.Chdir(tdir)
 
 			// generate a keypair
@@ -3321,9 +3163,7 @@ func TestImageSignatures(t *testing.T) {
 			cwd, err := os.Getwd()
 			So(err, ShouldBeNil)
 			defer func() { _ = os.Chdir(cwd) }()
-			tdir, err := ioutil.TempDir("", "notation")
-			So(err, ShouldBeNil)
-			defer os.RemoveAll(tdir)
+			tdir := t.TempDir()
 			_ = os.Chdir(tdir)
 
 			// "notation" (notaryv2) doesn't yet support exported apis, so use the binary instead
@@ -3474,12 +3314,7 @@ func TestRouteFailures(t *testing.T) {
 		conf.HTTP.Port = port
 
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 		ctlr.Config.Storage.Commit = true
 
 		go startServer(ctlr)
@@ -4061,11 +3896,7 @@ func TestStorageCommit(t *testing.T) {
 		conf.HTTP.Port = port
 
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 		ctlr.Config.Storage.RootDirectory = dir
 		ctlr.Config.Storage.Commit = true
 
diff --git a/pkg/cli/client_test.go b/pkg/cli/client_test.go
index 90b1a3e3..ac00ba45 100644
--- a/pkg/cli/client_test.go
+++ b/pkg/cli/client_test.go
@@ -69,12 +69,7 @@ func TestTLSWithAuth(t *testing.T) {
 		}
 
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 		go func() {
 			// this blocks
 			if err := ctlr.Run(); err != nil {
@@ -166,12 +161,7 @@ func TestTLSWithoutAuth(t *testing.T) {
 		}
 
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 		go func() {
 			// this blocks
 			if err := ctlr.Run(); err != nil {
@@ -234,12 +224,7 @@ func TestTLSWithoutAuth(t *testing.T) {
 		}
 
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 		go func() {
 			// this blocks
 			if err := ctlr.Run(); err != nil {
@@ -297,12 +282,7 @@ func TestTLSBadCerts(t *testing.T) {
 		}
 
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 		go func() {
 			// this blocks
 			if err := ctlr.Run(); err != nil {
diff --git a/pkg/cli/cve_cmd_test.go b/pkg/cli/cve_cmd_test.go
index 9040c6d4..5cbf2ef2 100644
--- a/pkg/cli/cve_cmd_test.go
+++ b/pkg/cli/cve_cmd_test.go
@@ -7,7 +7,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path"
 	"regexp"
@@ -291,18 +290,13 @@ func TestServerCVEResponse(t *testing.T) {
 	conf := config.New()
 	conf.HTTP.Port = port
 
-	dir, err := ioutil.TempDir("", "oci-repo-test")
+	dir := t.TempDir()
+
+	err := test.CopyFiles("../../test/data/zot-cve-test", path.Join(dir, "zot-cve-test"))
 	if err != nil {
 		panic(err)
 	}
 
-	err = test.CopyFiles("../../test/data/zot-cve-test", path.Join(dir, "zot-cve-test"))
-	if err != nil {
-		panic(err)
-	}
-
-	defer os.RemoveAll(dir)
-
 	conf.Storage.RootDirectory = dir
 	cveConfig := &extconf.CVEConfig{
 		UpdateInterval: 2,
diff --git a/pkg/cli/image_cmd_test.go b/pkg/cli/image_cmd_test.go
index a697f124..555e1e14 100644
--- a/pkg/cli/image_cmd_test.go
+++ b/pkg/cli/image_cmd_test.go
@@ -291,13 +291,7 @@ func TestServerResponse(t *testing.T) {
 			Search: &extconf.SearchConfig{Enable: &defaultVal},
 		}
 		ctlr := api.NewController(conf)
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-
-		ctlr.Config.Storage.RootDirectory = dir
+		ctlr.Config.Storage.RootDirectory = t.TempDir()
 		go func(controller *api.Controller) {
 			// this blocks
 			if err := controller.Run(); err != nil {
@@ -329,7 +323,7 @@ func TestServerResponse(t *testing.T) {
 			cmd.SetOut(buff)
 			cmd.SetErr(buff)
 			cmd.SetArgs(args)
-			err = cmd.Execute()
+			err := cmd.Execute()
 			So(err, ShouldBeNil)
 			space := regexp.MustCompile(`\s+`)
 			str := space.ReplaceAllString(buff.String(), " ")
@@ -348,7 +342,7 @@ func TestServerResponse(t *testing.T) {
 			cmd.SetOut(buff)
 			cmd.SetErr(buff)
 			cmd.SetArgs(args)
-			err = cmd.Execute()
+			err := cmd.Execute()
 			So(err, ShouldBeNil)
 			space := regexp.MustCompile(`\s+`)
 			str := space.ReplaceAllString(buff.String(), " ")
@@ -373,7 +367,7 @@ func TestServerResponse(t *testing.T) {
 			cmd.SetOut(buff)
 			cmd.SetErr(buff)
 			cmd.SetArgs(args)
-			err = cmd.Execute()
+			err := cmd.Execute()
 			So(err, ShouldBeNil)
 			space := regexp.MustCompile(`\s+`)
 			str := space.ReplaceAllString(buff.String(), " ")
@@ -411,7 +405,7 @@ func TestServerResponse(t *testing.T) {
 			cmd.SetOut(buff)
 			cmd.SetErr(buff)
 			cmd.SetArgs(args)
-			err = cmd.Execute()
+			err := cmd.Execute()
 			So(err, ShouldBeNil)
 			space := regexp.MustCompile(`\s+`)
 			str := space.ReplaceAllString(buff.String(), " ")
@@ -452,7 +446,7 @@ func TestServerResponse(t *testing.T) {
 			cmd.SetOut(buff)
 			cmd.SetErr(buff)
 			cmd.SetArgs(args)
-			err = cmd.Execute()
+			err := cmd.Execute()
 			So(err, ShouldNotBeNil)
 			actual := buff.String()
 			So(actual, ShouldContainSubstring, "unknown")
diff --git a/pkg/cli/root_test.go b/pkg/cli/root_test.go
index 50f110c3..a8ef71ff 100644
--- a/pkg/cli/root_test.go
+++ b/pkg/cli/root_test.go
@@ -398,12 +398,7 @@ func TestScrub(t *testing.T) {
 			config.HTTP.Port = port
 			controller := api.NewController(config)
 
-			dir, err := ioutil.TempDir("", "scrub-test")
-			if err != nil {
-				panic(err)
-			}
-
-			defer os.RemoveAll(dir)
+			dir := t.TempDir()
 
 			controller.Config.Storage.RootDirectory = dir
 			go func(controller *api.Controller) {
@@ -480,11 +475,7 @@ func TestScrub(t *testing.T) {
 		Convey("bad index.json", func(c C) {
 			port := GetFreePort()
 
-			dir, err := ioutil.TempDir("", "scrub-test")
-			if err != nil {
-				panic(err)
-			}
-			defer os.RemoveAll(dir)
+			dir := t.TempDir()
 
 			repoName := "badIndex"
 
diff --git a/pkg/compliance/v1_0_0/check_test.go b/pkg/compliance/v1_0_0/check_test.go
index 96efeb9f..6130e53d 100644
--- a/pkg/compliance/v1_0_0/check_test.go
+++ b/pkg/compliance/v1_0_0/check_test.go
@@ -2,7 +2,6 @@ package v1_0_0_test
 
 import (
 	"context"
-	"io/ioutil"
 	"net/http"
 	"os"
 	"testing"
@@ -25,7 +24,7 @@ var (
 )
 
 func TestWorkflows(t *testing.T) {
-	ctrl, randomPort := startServer()
+	ctrl, randomPort := startServer(t)
 	defer stopServer(ctrl)
 
 	storageInfo := []string{defaultDir, firstDir, secondDir}
@@ -38,7 +37,7 @@ func TestWorkflows(t *testing.T) {
 }
 
 func TestWorkflowsOutputJSON(t *testing.T) {
-	ctrl, randomPort := startServer()
+	ctrl, randomPort := startServer(t)
 	defer stopServer(ctrl)
 
 	storageInfo := []string{defaultDir, firstDir, secondDir}
@@ -52,7 +51,9 @@ func TestWorkflowsOutputJSON(t *testing.T) {
 }
 
 // start local server on random open port.
-func startServer() (*api.Controller, string) {
+func startServer(t *testing.T) (*api.Controller, string) {
+	t.Helper()
+
 	port := GetFreePort()
 	baseURL := GetBaseURL(port)
 	conf := config.New()
@@ -60,25 +61,13 @@ func startServer() (*api.Controller, string) {
 	conf.HTTP.Port = port
 	ctrl := api.NewController(conf)
 
-	dir, err := ioutil.TempDir("", "oci-repo-test")
-	if err != nil {
-		panic(err)
-	}
-
+	dir := t.TempDir()
 	defaultDir = dir
 
-	firstSubDir, err := ioutil.TempDir("", "oci-repo-test")
-	if err != nil {
-		panic(err)
-	}
-
+	firstSubDir := t.TempDir()
 	firstDir = firstSubDir
 
-	secondSubDir, err := ioutil.TempDir("", "oci-repo-test")
-	if err != nil {
-		panic(err)
-	}
-
+	secondSubDir := t.TempDir()
 	secondDir = secondSubDir
 
 	subPaths := make(map[string]config.StorageConfig)
diff --git a/pkg/exporter/api/controller_test.go b/pkg/exporter/api/controller_test.go
index aae4d44e..d1e4e469 100644
--- a/pkg/exporter/api/controller_test.go
+++ b/pkg/exporter/api/controller_test.go
@@ -8,10 +8,8 @@ import (
 	"crypto/rand"
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"math/big"
 	"net/http"
-	"os"
 	"strings"
 	"sync"
 	"testing"
@@ -85,8 +83,7 @@ func TestNewExporter(t *testing.T) {
 		exporterPort := GetFreePort()
 		serverPort := GetFreePort()
 		exporterConfig.Exporter.Port = exporterPort
-		dir, _ := ioutil.TempDir("", "metrics")
-		exporterConfig.Exporter.Metrics.Path = strings.TrimPrefix(dir, "/tmp/")
+		exporterConfig.Exporter.Metrics.Path = strings.TrimPrefix(t.TempDir(), "/tmp/")
 		exporterConfig.Server.Port = serverPort
 		exporterController := api.NewController(exporterConfig)
 
@@ -126,9 +123,7 @@ func TestNewExporter(t *testing.T) {
 				serverController := zotapi.NewController(servercConfig)
 				So(serverController, ShouldNotBeNil)
 
-				dir, err := ioutil.TempDir("", "exporter-test")
-				So(err, ShouldBeNil)
-				defer os.RemoveAll(dir)
+				dir := t.TempDir()
 				serverController.Config.Storage.RootDirectory = dir
 				go func(c *zotapi.Controller) {
 					// this blocks
diff --git a/pkg/extensions/monitoring/monitoring_test.go b/pkg/extensions/monitoring/monitoring_test.go
index 1143e7de..06aea0e8 100644
--- a/pkg/extensions/monitoring/monitoring_test.go
+++ b/pkg/extensions/monitoring/monitoring_test.go
@@ -5,9 +5,7 @@ package monitoring_test
 
 import (
 	"context"
-	"io/ioutil"
 	"net/http"
-	"os"
 	"path"
 	"testing"
 	"time"
@@ -28,11 +26,7 @@ func TestExtensionMetrics(t *testing.T) {
 		conf := config.New()
 		conf.HTTP.Port = port
 
-		rootDir, err := ioutil.TempDir("", "metrics-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(rootDir)
+		rootDir := t.TempDir()
 
 		conf.Storage.RootDirectory = rootDir
 		conf.Extensions = &extconf.ExtensionConfig{}
@@ -61,7 +55,7 @@ func TestExtensionMetrics(t *testing.T) {
 		monitoring.IncDownloadCounter(ctlr.Metrics, "alpine")
 		monitoring.IncUploadCounter(ctlr.Metrics, "alpine")
 
-		err = test.CopyFiles("../../../test/data/zot-test", path.Join(rootDir, "alpine"))
+		err := test.CopyFiles("../../../test/data/zot-test", path.Join(rootDir, "alpine"))
 		if err != nil {
 			panic(err)
 		}
@@ -88,13 +82,7 @@ func TestExtensionMetrics(t *testing.T) {
 		conf := config.New()
 		conf.HTTP.Port = port
 
-		rootDir, err := ioutil.TempDir("", "metrics-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(rootDir)
-
-		conf.Storage.RootDirectory = rootDir
+		conf.Storage.RootDirectory = t.TempDir()
 		conf.Extensions = &extconf.ExtensionConfig{}
 		var disabled bool
 		conf.Extensions.Metrics = &extconf.MetricsConfig{Enable: &disabled}
diff --git a/pkg/extensions/search/common/common_test.go b/pkg/extensions/search/common/common_test.go
index c25e7d18..316d54e2 100644
--- a/pkg/extensions/search/common/common_test.go
+++ b/pkg/extensions/search/common/common_test.go
@@ -6,7 +6,6 @@ package common_test
 import (
 	"context"
 	"encoding/json"
-	"io/ioutil"
 	"os"
 	"path"
 	"testing"
@@ -66,22 +65,17 @@ type ImageInfo struct {
 	Labels      string
 }
 
-func testSetup() error {
-	dir, err := ioutil.TempDir("", "search_test")
-	if err != nil {
-		return err
-	}
+func testSetup(t *testing.T) error {
+	t.Helper()
+	dir := t.TempDir()
 
-	subDir, err := ioutil.TempDir("", "sub_search_test")
-	if err != nil {
-		return err
-	}
+	subDir := t.TempDir()
 
 	rootDir = dir
 
 	subRootDir = subDir
 
-	err = CopyFiles("../../../../test/data", rootDir)
+	err := CopyFiles("../../../../test/data", rootDir)
 	if err != nil {
 		return err
 	}
@@ -184,7 +178,7 @@ func TestImageFormat(t *testing.T) {
 
 func TestLatestTagSearchHTTP(t *testing.T) {
 	Convey("Test latest image search by timestamp", t, func() {
-		err := testSetup()
+		err := testSetup(t)
 		if err != nil {
 			panic(err)
 		}
@@ -322,7 +316,7 @@ func TestLatestTagSearchHTTP(t *testing.T) {
 
 func TestExpandedRepoInfo(t *testing.T) {
 	Convey("Test expanded repo info", t, func() {
-		err := testSetup()
+		err := testSetup(t)
 		if err != nil {
 			panic(err)
 		}
@@ -512,17 +506,9 @@ func TestUtilsMethod(t *testing.T) {
 
 		log := log.NewLogger("debug", "")
 
-		rootDir, err := ioutil.TempDir("", "common_utils_test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(rootDir)
+		rootDir := t.TempDir()
 
-		subRootDir, err := ioutil.TempDir("", "common_utils_test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(subRootDir)
+		subRootDir := t.TempDir()
 
 		metrics := monitoring.NewMetricsServer(false, log)
 		defaultStore := storage.NewImageStore(rootDir, false, storage.DefaultGCDelay, false, false, log, metrics)
diff --git a/pkg/extensions/search/cve/cve_test.go b/pkg/extensions/search/cve/cve_test.go
index b50cd319..061f7821 100644
--- a/pkg/extensions/search/cve/cve_test.go
+++ b/pkg/extensions/search/cve/cve_test.go
@@ -325,23 +325,9 @@ func makeTestFile(fileName string, content string) error {
 func TestMultipleStoragePath(t *testing.T) {
 	Convey("Test multiple storage path", t, func() {
 		// Create temporary directory
-		firstRootDir, err := ioutil.TempDir("", "util_test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(firstRootDir)
-
-		secondRootDir, err := ioutil.TempDir("", "util_test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(secondRootDir)
-
-		thirdRootDir, err := ioutil.TempDir("", "util_test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(thirdRootDir)
+		firstRootDir := t.TempDir()
+		secondRootDir := t.TempDir()
+		thirdRootDir := t.TempDir()
 
 		log := log.NewLogger("debug", "")
 		metrics := monitoring.NewMetricsServer(false, log)
@@ -628,19 +614,11 @@ func TestCVEConfig(t *testing.T) {
 
 		ctlr := api.NewController(conf)
 
-		firstDir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
+		firstDir := t.TempDir()
 
-		secondDir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(firstDir)
-		defer os.RemoveAll(secondDir)
+		secondDir := t.TempDir()
 
-		err = CopyFiles("../../../../test/data", path.Join(secondDir, "a"))
+		err := CopyFiles("../../../../test/data", path.Join(secondDir, "a"))
 		if err != nil {
 			panic(err)
 		}
diff --git a/pkg/extensions/search/digest/digest_test.go b/pkg/extensions/search/digest/digest_test.go
index 51217b5f..93c38407 100644
--- a/pkg/extensions/search/digest/digest_test.go
+++ b/pkg/extensions/search/digest/digest_test.go
@@ -342,13 +342,11 @@ func TestDigestSearchHTTPSubPaths(t *testing.T) {
 func TestDigestSearchDisabled(t *testing.T) {
 	Convey("Test disabling image search", t, func() {
 		var disabled bool
-		dir, err := ioutil.TempDir("", "digest_test")
-		So(err, ShouldBeNil)
 		port := GetFreePort()
 		baseURL := GetBaseURL(port)
 		conf := config.New()
 		conf.HTTP.Port = port
-		conf.Storage.RootDirectory = dir
+		conf.Storage.RootDirectory = t.TempDir()
 		conf.Extensions = &extconf.ExtensionConfig{
 			Search: &extconf.SearchConfig{Enable: &disabled},
 		}
diff --git a/pkg/extensions/sync/sync_internal_test.go b/pkg/extensions/sync/sync_internal_test.go
index 1c7c5421..19b10490 100644
--- a/pkg/extensions/sync/sync_internal_test.go
+++ b/pkg/extensions/sync/sync_internal_test.go
@@ -58,17 +58,10 @@ func TestInjectSyncUtils(t *testing.T) {
 			So(err, ShouldBeNil)
 		}
 
-		storageDir, err := ioutil.TempDir("", "oci-dest-repo-test")
-		if err != nil {
-			panic(err)
-		}
-
-		defer os.RemoveAll(storageDir)
-
 		log := log.Logger{Logger: zerolog.New(os.Stdout)}
 		metrics := monitoring.NewMetricsServer(false, log)
 
-		imageStore := storage.NewImageStore(storageDir, false, storage.DefaultGCDelay, false, false, log, metrics)
+		imageStore := storage.NewImageStore(t.TempDir(), false, storage.DefaultGCDelay, false, false, log, metrics)
 
 		injected = test.InjectFailure(0)
 		_, _, err = getLocalImageRef(imageStore, testImage, testImageTag)
@@ -155,19 +148,12 @@ func TestSyncInternal(t *testing.T) {
 	})
 
 	Convey("Verify getLocalImageRef()", t, func() {
-		storageDir, err := ioutil.TempDir("", "oci-dest-repo-test")
-		if err != nil {
-			panic(err)
-		}
-
-		defer os.RemoveAll(storageDir)
-
 		log := log.Logger{Logger: zerolog.New(os.Stdout)}
 		metrics := monitoring.NewMetricsServer(false, log)
 
-		imageStore := storage.NewImageStore(storageDir, false, storage.DefaultGCDelay, false, false, log, metrics)
+		imageStore := storage.NewImageStore(t.TempDir(), false, storage.DefaultGCDelay, false, false, log, metrics)
 
-		err = os.Chmod(imageStore.RootDir(), 0o000)
+		err := os.Chmod(imageStore.RootDir(), 0o000)
 		So(err, ShouldBeNil)
 
 		_, _, err = getLocalImageRef(imageStore, testImage, testImageTag)
@@ -206,17 +192,12 @@ func TestSyncInternal(t *testing.T) {
 	})
 
 	Convey("Test getHttpClient() with bad certs", t, func() {
-		badCertsDir, err := ioutil.TempDir("", "bad_certs*")
-		if err != nil {
-			panic(err)
-		}
+		badCertsDir := t.TempDir()
 
 		if err := os.WriteFile(path.Join(badCertsDir, "ca.crt"), []byte("certificate"), 0o600); err != nil {
 			panic(err)
 		}
 
-		defer os.RemoveAll(badCertsDir)
-
 		var tlsVerify bool
 		updateDuration := time.Microsecond
 		port := test.GetFreePort()
@@ -296,18 +277,13 @@ func TestSyncInternal(t *testing.T) {
 	})
 
 	Convey("Test canSkipImage()", t, func() {
-		storageDir, err := ioutil.TempDir("", "oci-dest-repo-test")
+		storageDir := t.TempDir()
+
+		err := test.CopyFiles("../../../test/data", storageDir)
 		if err != nil {
 			panic(err)
 		}
 
-		err = test.CopyFiles("../../../test/data", storageDir)
-		if err != nil {
-			panic(err)
-		}
-
-		defer os.RemoveAll(storageDir)
-
 		log := log.Logger{Logger: zerolog.New(os.Stdout)}
 		metrics := monitoring.NewMetricsServer(false, log)
 
@@ -369,12 +345,7 @@ func TestSyncInternal(t *testing.T) {
 	})
 
 	Convey("Verify pushSyncedLocalImage func", t, func() {
-		storageDir, err := ioutil.TempDir("", "oci-dest-repo-test")
-		if err != nil {
-			panic(err)
-		}
-
-		defer os.RemoveAll(storageDir)
+		storageDir := t.TempDir()
 
 		log := log.Logger{Logger: zerolog.New(os.Stdout)}
 		metrics := monitoring.NewMetricsServer(false, log)
@@ -387,7 +358,7 @@ func TestSyncInternal(t *testing.T) {
 		testRootDir := path.Join(imageStore.RootDir(), testImage, SyncBlobUploadDir)
 		// testImagePath := path.Join(testRootDir, testImage)
 
-		err = pushSyncedLocalImage(testImage, testImageTag, testRootDir, storeController, log)
+		err := pushSyncedLocalImage(testImage, testImageTag, testRootDir, storeController, log)
 		So(err, ShouldNotBeNil)
 
 		err = os.MkdirAll(testRootDir, 0o755)
diff --git a/pkg/extensions/sync/sync_test.go b/pkg/extensions/sync/sync_test.go
index c6c58e4a..9260172f 100644
--- a/pkg/extensions/sync/sync_test.go
+++ b/pkg/extensions/sync/sync_test.go
@@ -93,11 +93,13 @@ func copyFile(sourceFilePath, destFilePath string) error {
 	return nil
 }
 
-func startUpstreamServer(secure, basicAuth bool) (*api.Controller, string, string, string, *resty.Client) {
+func startUpstreamServer(
+	t *testing.T, secure, basicAuth bool,
+) (*api.Controller, string, string, string, *resty.Client) {
+	t.Helper()
+
 	srcPort := test.GetFreePort()
-
 	srcConfig := config.New()
-
 	client := resty.New()
 
 	var srcBaseURL string
@@ -142,12 +144,9 @@ func startUpstreamServer(secure, basicAuth bool) (*api.Controller, string, strin
 
 	srcConfig.HTTP.Port = srcPort
 
-	srcDir, err := ioutil.TempDir("", "oci-src-repo-test")
-	if err != nil {
-		panic(err)
-	}
+	srcDir := t.TempDir()
 
-	err = test.CopyFiles("../../../test/data", srcDir)
+	err := test.CopyFiles("../../../test/data", srcDir)
 	if err != nil {
 		panic(err)
 	}
@@ -176,11 +175,13 @@ func startUpstreamServer(secure, basicAuth bool) (*api.Controller, string, strin
 	return sctlr, srcBaseURL, srcDir, htpasswdPath, client
 }
 
-func startDownstreamServer(secure bool, syncConfig *sync.Config) (*api.Controller, string, string, *resty.Client) {
+func startDownstreamServer(
+	t *testing.T, secure bool, syncConfig *sync.Config,
+) (*api.Controller, string, string, *resty.Client) {
+	t.Helper()
+
 	destPort := test.GetFreePort()
-
 	destConfig := config.New()
-
 	client := resty.New()
 
 	var destBaseURL string
@@ -215,10 +216,7 @@ func startDownstreamServer(secure bool, syncConfig *sync.Config) (*api.Controlle
 
 	destConfig.HTTP.Port = destPort
 
-	destDir, err := ioutil.TempDir("", "oci-dest-repo-test")
-	if err != nil {
-		panic(err)
-	}
+	destDir := t.TempDir()
 
 	destConfig.Storage.RootDirectory = destDir
 	destConfig.Storage.Dedupe = false
@@ -252,8 +250,7 @@ func startDownstreamServer(secure bool, syncConfig *sync.Config) (*api.Controlle
 
 func TestOnDemand(t *testing.T) {
 	Convey("Verify sync on demand feature", t, func() {
-		sctlr, srcBaseURL, srcDir, _, srcClient := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, srcClient := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -286,8 +283,7 @@ func TestOnDemand(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dctlr, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, destBaseURL, destDir, destClient := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dctlr.Shutdown()
@@ -384,8 +380,7 @@ func TestPeriodically(t *testing.T) {
 	Convey("Verify sync feature", t, func() {
 		updateDuration, _ := time.ParseDuration("30m")
 
-		sctlr, srcBaseURL, srcDir, _, srcClient := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, srcClient := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -422,8 +417,7 @@ func TestPeriodically(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dctlr, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, destBaseURL, _, destClient := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dctlr.Shutdown()
@@ -497,8 +491,7 @@ func TestPeriodically(t *testing.T) {
 				Registries: []sync.RegistryConfig{syncRegistryConfig},
 			}
 
-			dctlr, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-			defer os.RemoveAll(destDir)
+			dctlr, destBaseURL, _, destClient := startDownstreamServer(t, false, syncConfig)
 
 			defer func() {
 				dctlr.Shutdown()
@@ -560,8 +553,7 @@ func TestOnDemandPermsDenied(t *testing.T) {
 	Convey("Verify sync on demand feature without perm on sync cache", t, func() {
 		updateDuration, _ := time.ParseDuration("30m")
 
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, _ := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -600,12 +592,7 @@ func TestOnDemandPermsDenied(t *testing.T) {
 
 		destConfig.HTTP.Port = destPort
 
-		destDir, err := ioutil.TempDir("", "oci-dest-repo-test")
-		if err != nil {
-			panic(err)
-		}
-
-		defer os.RemoveAll(destDir)
+		destDir := t.TempDir()
 
 		destConfig.Storage.RootDirectory = destDir
 
@@ -628,7 +615,7 @@ func TestOnDemandPermsDenied(t *testing.T) {
 
 		syncSubDir := path.Join(destDir, testImage, sync.SyncBlobUploadDir)
 
-		err = os.MkdirAll(syncSubDir, 0o755)
+		err := os.MkdirAll(syncSubDir, 0o755)
 		So(err, ShouldBeNil)
 
 		err = os.Chmod(syncSubDir, 0o000)
@@ -659,8 +646,7 @@ func TestBadTLS(t *testing.T) {
 	Convey("Verify sync TLS feature", t, func() {
 		updateDuration, _ := time.ParseDuration("30m")
 
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(true, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, _ := startUpstreamServer(t, true, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -692,8 +678,7 @@ func TestBadTLS(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dctlr, destBaseURL, destDir, destClient := startDownstreamServer(true, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, destBaseURL, _, destClient := startDownstreamServer(t, true, syncConfig)
 
 		defer func() {
 			dctlr.Shutdown()
@@ -720,8 +705,7 @@ func TestTLS(t *testing.T) {
 	Convey("Verify sync TLS feature", t, func() {
 		updateDuration, _ := time.ParseDuration("1h")
 
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(true, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(t, true, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -740,10 +724,7 @@ func TestTLS(t *testing.T) {
 		}
 
 		// copy upstream client certs, use them in sync config
-		destClientCertDir, err := ioutil.TempDir("", "destCerts")
-		if err != nil {
-			panic(err)
-		}
+		destClientCertDir := t.TempDir()
 
 		destFilePath := path.Join(destClientCertDir, "ca.crt")
 		err = copyFile(CACert, destFilePath)
@@ -763,8 +744,6 @@ func TestTLS(t *testing.T) {
 			panic(err)
 		}
 
-		defer os.RemoveAll(destClientCertDir)
-
 		regex := ".*"
 		var semver bool
 		tlsVerify := true
@@ -791,8 +770,7 @@ func TestTLS(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dctlr, _, destDir, _ := startDownstreamServer(true, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, _, destDir, _ := startDownstreamServer(t, true, syncConfig)
 
 		defer func() {
 			dctlr.Shutdown()
@@ -826,9 +804,8 @@ func TestBasicAuth(t *testing.T) {
 		updateDuration, _ := time.ParseDuration("1h")
 
 		Convey("Verify sync basic auth with file credentials", func() {
-			sctlr, srcBaseURL, srcDir, htpasswdPath, srcClient := startUpstreamServer(false, true)
+			sctlr, srcBaseURL, _, htpasswdPath, srcClient := startUpstreamServer(t, false, true)
 			defer os.Remove(htpasswdPath)
-			defer os.RemoveAll(srcDir)
 
 			defer func() {
 				sctlr.Shutdown()
@@ -858,8 +835,7 @@ func TestBasicAuth(t *testing.T) {
 				Registries:      []sync.RegistryConfig{syncRegistryConfig},
 			}
 
-			dctlr, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-			defer os.RemoveAll(destDir)
+			dctlr, destBaseURL, _, destClient := startDownstreamServer(t, false, syncConfig)
 
 			defer func() {
 				dctlr.Shutdown()
@@ -899,9 +875,8 @@ func TestBasicAuth(t *testing.T) {
 		})
 
 		Convey("Verify sync basic auth with wrong file credentials", func() {
-			sctlr, srcBaseURL, srcDir, htpasswdPath, _ := startUpstreamServer(false, true)
+			sctlr, srcBaseURL, _, htpasswdPath, _ := startUpstreamServer(t, false, true)
 			defer os.Remove(htpasswdPath)
-			defer os.RemoveAll(srcDir)
 
 			defer func() {
 				sctlr.Shutdown()
@@ -913,10 +888,7 @@ func TestBasicAuth(t *testing.T) {
 			destConfig := config.New()
 			destConfig.HTTP.Port = destPort
 
-			destDir, err := ioutil.TempDir("", "oci-dest-repo-test")
-			if err != nil {
-				panic(err)
-			}
+			destDir := t.TempDir()
 
 			destConfig.Storage.SubPaths = map[string]config.StorageConfig{
 				"a": {
@@ -927,8 +899,6 @@ func TestBasicAuth(t *testing.T) {
 				},
 			}
 
-			defer os.RemoveAll(destDir)
-
 			destConfig.Storage.RootDirectory = destDir
 
 			regex := ".*"
@@ -996,9 +966,8 @@ func TestBasicAuth(t *testing.T) {
 		})
 
 		Convey("Verify sync basic auth with bad file credentials", func() {
-			sctlr, srcBaseURL, srcDir, htpasswdPath, _ := startUpstreamServer(false, true)
+			sctlr, srcBaseURL, _, htpasswdPath, _ := startUpstreamServer(t, false, true)
 			defer os.Remove(htpasswdPath)
-			defer os.RemoveAll(srcDir)
 
 			defer func() {
 				sctlr.Shutdown()
@@ -1044,8 +1013,7 @@ func TestBasicAuth(t *testing.T) {
 				Registries:      []sync.RegistryConfig{syncRegistryConfig},
 			}
 
-			dctlr, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-			defer os.RemoveAll(destDir)
+			dctlr, destBaseURL, _, destClient := startDownstreamServer(t, false, syncConfig)
 
 			defer func() {
 				dctlr.Shutdown()
@@ -1059,9 +1027,8 @@ func TestBasicAuth(t *testing.T) {
 		})
 
 		Convey("Verify on demand sync with basic auth", func() {
-			sctlr, srcBaseURL, srcDir, htpasswdPath, srcClient := startUpstreamServer(false, true)
+			sctlr, srcBaseURL, _, htpasswdPath, srcClient := startUpstreamServer(t, false, true)
 			defer os.Remove(htpasswdPath)
-			defer os.RemoveAll(srcDir)
 
 			defer func() {
 				sctlr.Shutdown()
@@ -1097,8 +1064,7 @@ func TestBasicAuth(t *testing.T) {
 				},
 			}
 
-			dctlr, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-			defer os.RemoveAll(destDir)
+			dctlr, destBaseURL, _, destClient := startDownstreamServer(t, false, syncConfig)
 
 			defer func() {
 				dctlr.Shutdown()
@@ -1189,8 +1155,7 @@ func TestBadURL(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dctlr, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, destBaseURL, _, destClient := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dctlr.Shutdown()
@@ -1206,8 +1171,7 @@ func TestNoImagesByRegex(t *testing.T) {
 	Convey("Verify sync with no images on source based on regex", t, func() {
 		updateDuration, _ := time.ParseDuration("1h")
 
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, _ := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -1237,8 +1201,7 @@ func TestNoImagesByRegex(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dctlr, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, destBaseURL, _, destClient := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dctlr.Shutdown()
@@ -1267,8 +1230,7 @@ func TestInvalidRegex(t *testing.T) {
 	Convey("Verify sync with invalid regex", t, func() {
 		updateDuration, _ := time.ParseDuration("1h")
 
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, _ := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -1299,8 +1261,7 @@ func TestInvalidRegex(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dctlr, _, destDir, _ := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, _, _, _ := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dctlr.Shutdown()
@@ -1312,8 +1273,7 @@ func TestNotSemver(t *testing.T) {
 	Convey("Verify sync feature semver compliant", t, func() {
 		updateDuration, _ := time.ParseDuration("30m")
 
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, _ := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -1358,8 +1318,7 @@ func TestNotSemver(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dctlr, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, destBaseURL, _, destClient := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dctlr.Shutdown()
@@ -1392,21 +1351,17 @@ func TestInvalidCerts(t *testing.T) {
 	Convey("Verify sync with bad certs", t, func() {
 		updateDuration, _ := time.ParseDuration("1h")
 
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(true, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, _ := startUpstreamServer(t, true, false)
 
 		defer func() {
 			sctlr.Shutdown()
 		}()
 
 		// copy client certs, use them in sync config
-		clientCertDir, err := ioutil.TempDir("", "certs")
-		if err != nil {
-			panic(err)
-		}
+		clientCertDir := t.TempDir()
 
 		destFilePath := path.Join(clientCertDir, "ca.crt")
-		err = copyFile(CACert, destFilePath)
+		err := copyFile(CACert, destFilePath)
 		if err != nil {
 			panic(err)
 		}
@@ -1434,8 +1389,6 @@ func TestInvalidCerts(t *testing.T) {
 			panic(err)
 		}
 
-		defer os.RemoveAll(clientCertDir)
-
 		var tlsVerify bool
 
 		syncRegistryConfig := sync.RegistryConfig{
@@ -1457,8 +1410,7 @@ func TestInvalidCerts(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dctlr, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, destBaseURL, _, destClient := startDownstreamServer(t, false, syncConfig)
 
 		resp, err := destClient.R().Get(destBaseURL + "/v2/" + testImage + "/manifests/" + testImageTag)
 		So(err, ShouldBeNil)
@@ -1515,8 +1467,7 @@ func TestInvalidUrl(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dctlr, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, destBaseURL, _, destClient := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dctlr.Shutdown()
@@ -1532,8 +1483,7 @@ func TestInvalidTags(t *testing.T) {
 	Convey("Verify sync invalid tags", t, func() {
 		updateDuration, _ := time.ParseDuration("30m")
 
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, _ := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -1567,8 +1517,7 @@ func TestInvalidTags(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dctlr, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, destBaseURL, _, destClient := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dctlr.Shutdown()
@@ -1591,14 +1540,11 @@ func TestSubPaths(t *testing.T) {
 
 		srcConfig.HTTP.Port = srcPort
 
-		srcDir, err := ioutil.TempDir("", "oci-src-repo-test")
-		if err != nil {
-			panic(err)
-		}
+		srcDir := t.TempDir()
 
 		subpath := "/subpath"
 
-		err = test.CopyFiles("../../../test/data", path.Join(srcDir, subpath))
+		err := test.CopyFiles("../../../test/data", path.Join(srcDir, subpath))
 		if err != nil {
 			panic(err)
 		}
@@ -1658,17 +1604,9 @@ func TestSubPaths(t *testing.T) {
 		destPort := test.GetFreePort()
 		destConfig := config.New()
 
-		destDir, err := ioutil.TempDir("", "oci-dest-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(destDir)
+		destDir := t.TempDir()
 
-		subPathDestDir, err := ioutil.TempDir("", "oci-dest-subpath-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(subPathDestDir)
+		subPathDestDir := t.TempDir()
 
 		destConfig.Storage.RootDirectory = destDir
 
@@ -1765,8 +1703,7 @@ func TestOnDemandRepoErr(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dctlr, destBaseURL, destDir, _ := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, destBaseURL, _, _ := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dctlr.Shutdown()
@@ -1780,8 +1717,7 @@ func TestOnDemandRepoErr(t *testing.T) {
 
 func TestOnDemandContentFiltering(t *testing.T) {
 	Convey("Verify sync on demand feature", t, func() {
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, _ := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -1815,8 +1751,7 @@ func TestOnDemandContentFiltering(t *testing.T) {
 				Registries: []sync.RegistryConfig{syncRegistryConfig},
 			}
 
-			dctlr, destBaseURL, destDir, _ := startDownstreamServer(false, syncConfig)
-			defer os.RemoveAll(destDir)
+			dctlr, destBaseURL, _, _ := startDownstreamServer(t, false, syncConfig)
 
 			defer func() {
 				dctlr.Shutdown()
@@ -1855,8 +1790,7 @@ func TestOnDemandContentFiltering(t *testing.T) {
 				Registries: []sync.RegistryConfig{syncRegistryConfig},
 			}
 
-			dctlr, destBaseURL, destDir, _ := startDownstreamServer(false, syncConfig)
-			defer os.RemoveAll(destDir)
+			dctlr, destBaseURL, _, _ := startDownstreamServer(t, false, syncConfig)
 
 			defer func() {
 				dctlr.Shutdown()
@@ -1871,8 +1805,7 @@ func TestOnDemandContentFiltering(t *testing.T) {
 
 func TestConfigRules(t *testing.T) {
 	Convey("Verify sync config rules", t, func() {
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, _ := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -1905,8 +1838,7 @@ func TestConfigRules(t *testing.T) {
 				Registries: []sync.RegistryConfig{syncRegistryConfig},
 			}
 
-			dctlr, destBaseURL, destDir, _ := startDownstreamServer(false, syncConfig)
-			defer os.RemoveAll(destDir)
+			dctlr, destBaseURL, _, _ := startDownstreamServer(t, false, syncConfig)
 
 			defer func() {
 				dctlr.Shutdown()
@@ -1936,8 +1868,7 @@ func TestConfigRules(t *testing.T) {
 				Registries: []sync.RegistryConfig{syncRegistryConfig},
 			}
 
-			dctlr, destBaseURL, destDir, _ := startDownstreamServer(false, syncConfig)
-			defer os.RemoveAll(destDir)
+			dctlr, destBaseURL, _, _ := startDownstreamServer(t, false, syncConfig)
 
 			defer func() {
 				dctlr.Shutdown()
@@ -1964,8 +1895,7 @@ func TestConfigRules(t *testing.T) {
 				Registries: []sync.RegistryConfig{syncRegistryConfig},
 			}
 
-			dctlr, destBaseURL, destDir, _ := startDownstreamServer(false, syncConfig)
-			defer os.RemoveAll(destDir)
+			dctlr, destBaseURL, _, _ := startDownstreamServer(t, false, syncConfig)
 
 			defer func() {
 				dctlr.Shutdown()
@@ -1982,8 +1912,7 @@ func TestMultipleURLs(t *testing.T) {
 	Convey("Verify sync feature", t, func() {
 		updateDuration, _ := time.ParseDuration("30m")
 
-		sctlr, srcBaseURL, srcDir, _, srcClient := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, srcClient := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -2015,8 +1944,7 @@ func TestMultipleURLs(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dc, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dc, destBaseURL, _, destClient := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dc.Shutdown()
@@ -2060,8 +1988,7 @@ func TestPeriodicallySignatures(t *testing.T) {
 	Convey("Verify sync signatures", t, func() {
 		updateDuration, _ := time.ParseDuration("30m")
 
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -2079,9 +2006,7 @@ func TestPeriodicallySignatures(t *testing.T) {
 		So(err, ShouldBeNil)
 
 		defer func() { _ = os.Chdir(cwd) }()
-		tdir, err := ioutil.TempDir("", "sigs")
-		So(err, ShouldBeNil)
-		defer os.RemoveAll(tdir)
+		tdir := t.TempDir()
 		_ = os.Chdir(tdir)
 		generateKeyPairs(tdir)
 
@@ -2114,8 +2039,7 @@ func TestPeriodicallySignatures(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dctlr, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, destBaseURL, destDir, destClient := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dctlr.Shutdown()
@@ -2340,8 +2264,7 @@ func TestPeriodicallySignaturesErr(t *testing.T) {
 	Convey("Verify sync signatures gives error", t, func() {
 		updateDuration, _ := time.ParseDuration("30m")
 
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -2359,9 +2282,7 @@ func TestPeriodicallySignaturesErr(t *testing.T) {
 		So(err, ShouldBeNil)
 
 		defer func() { _ = os.Chdir(cwd) }()
-		tdir, err := ioutil.TempDir("", "sigs")
-		So(err, ShouldBeNil)
-		defer os.RemoveAll(tdir)
+		tdir := t.TempDir()
 		_ = os.Chdir(tdir)
 		generateKeyPairs(tdir)
 
@@ -2431,10 +2352,9 @@ func TestPeriodicallySignaturesErr(t *testing.T) {
 			}
 		}
 
-		dctlr, _, destDir, _ := startDownstreamServer(false, syncConfig)
+		dctlr, _, _, _ := startDownstreamServer(t, false, syncConfig)
 		defer func() {
 			dctlr.Shutdown()
-			defer os.RemoveAll(destDir)
 		}()
 	})
 }
@@ -2447,12 +2367,9 @@ func TestOnDemandRetryGoroutine(t *testing.T) {
 
 		srcConfig.HTTP.Port = srcPort
 
-		srcDir, err := ioutil.TempDir("", "oci-src-repo-test")
-		if err != nil {
-			panic(err)
-		}
+		srcDir := t.TempDir()
 
-		err = test.CopyFiles("../../../test/data", srcDir)
+		err := test.CopyFiles("../../../test/data", srcDir)
 		if err != nil {
 			panic(err)
 		}
@@ -2461,8 +2378,6 @@ func TestOnDemandRetryGoroutine(t *testing.T) {
 
 		sctlr := api.NewController(srcConfig)
 
-		defer os.RemoveAll(srcDir)
-
 		regex := ".*"
 		semver := true
 		var tlsVerify bool
@@ -2494,8 +2409,7 @@ func TestOnDemandRetryGoroutine(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dc, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dc, destBaseURL, destDir, destClient := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dc.Shutdown()
@@ -2540,12 +2454,9 @@ func TestOnDemandMultipleRetries(t *testing.T) {
 
 		srcConfig.HTTP.Port = srcPort
 
-		srcDir, err := ioutil.TempDir("", "oci-src-repo-test")
-		if err != nil {
-			panic(err)
-		}
+		srcDir := t.TempDir()
 
-		err = test.CopyFiles("../../../test/data", srcDir)
+		err := test.CopyFiles("../../../test/data", srcDir)
 		if err != nil {
 			panic(err)
 		}
@@ -2554,8 +2465,6 @@ func TestOnDemandMultipleRetries(t *testing.T) {
 
 		sctlr := api.NewController(srcConfig)
 
-		defer os.RemoveAll(srcDir)
-
 		var tlsVerify bool
 
 		syncRegistryConfig := sync.RegistryConfig{
@@ -2576,8 +2485,7 @@ func TestOnDemandMultipleRetries(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dc, destBaseURL, destDir, destClient := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dc, destBaseURL, destDir, destClient := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dc.Shutdown()
@@ -2657,8 +2565,7 @@ func TestOnDemandMultipleRetries(t *testing.T) {
 
 func TestOnDemandPullsOnce(t *testing.T) {
 	Convey("Verify sync on demand pulls only one time", t, func(conv C) {
-		sc, srcBaseURL, srcDir, _, _ := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sc, srcBaseURL, _, _, _ := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sc.Shutdown()
@@ -2690,8 +2597,7 @@ func TestOnDemandPullsOnce(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dc, destBaseURL, destDir, _ := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dc, destBaseURL, destDir, _ := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dc.Shutdown()
@@ -2757,8 +2663,7 @@ func TestError(t *testing.T) {
 	Convey("Verify periodically sync pushSyncedLocalImage() error", t, func() {
 		updateDuration, _ := time.ParseDuration("30m")
 
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, _ := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -2790,8 +2695,7 @@ func TestError(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dctlr, destBaseURL, destDir, client := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, destBaseURL, destDir, client := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dctlr.Shutdown()
@@ -2813,8 +2717,7 @@ func TestError(t *testing.T) {
 
 func TestSignaturesOnDemand(t *testing.T) {
 	Convey("Verify sync signatures on demand feature", t, func() {
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -2832,9 +2735,7 @@ func TestSignaturesOnDemand(t *testing.T) {
 		So(err, ShouldBeNil)
 
 		defer func() { _ = os.Chdir(cwd) }()
-		tdir, err := ioutil.TempDir("", "sigs")
-		So(err, ShouldBeNil)
-		defer os.RemoveAll(tdir)
+		tdir := t.TempDir()
 		_ = os.Chdir(tdir)
 
 		generateKeyPairs(tdir)
@@ -2856,8 +2757,7 @@ func TestSignaturesOnDemand(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncRegistryConfig},
 		}
 
-		dctlr, destBaseURL, destDir, _ := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, destBaseURL, destDir, _ := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dctlr.Shutdown()
@@ -2950,8 +2850,7 @@ func TestSignaturesOnDemand(t *testing.T) {
 
 func TestOnlySignaturesOnDemand(t *testing.T) {
 	Convey("Verify sync signatures on demand feature when we already have the image", t, func() {
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, _ := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -2969,9 +2868,7 @@ func TestOnlySignaturesOnDemand(t *testing.T) {
 		So(err, ShouldBeNil)
 
 		defer func() { _ = os.Chdir(cwd) }()
-		tdir, err := ioutil.TempDir("", "sigs")
-		So(err, ShouldBeNil)
-		defer os.RemoveAll(tdir)
+		tdir := t.TempDir()
 		_ = os.Chdir(tdir)
 
 		var tlsVerify bool
@@ -2996,8 +2893,7 @@ func TestOnlySignaturesOnDemand(t *testing.T) {
 			Registries: []sync.RegistryConfig{syncBadRegistryConfig, syncRegistryConfig},
 		}
 
-		dctlr, destBaseURL, destDir, _ := startDownstreamServer(false, syncConfig)
-		defer os.RemoveAll(destDir)
+		dctlr, destBaseURL, _, _ := startDownstreamServer(t, false, syncConfig)
 
 		defer func() {
 			dctlr.Shutdown()
@@ -3068,8 +2964,7 @@ func TestSyncOnlyDiff(t *testing.T) {
 	Convey("Verify sync only difference between local and upstream", t, func() {
 		updateDuration, _ := time.ParseDuration("30m")
 
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, _ := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -3101,13 +2996,10 @@ func TestSyncOnlyDiff(t *testing.T) {
 		destBaseURL := test.GetBaseURL(destPort)
 		destConfig.HTTP.Port = destPort
 
-		destDir, err := ioutil.TempDir("", "oci-dest-repo-test")
-		if err != nil {
-			panic(err)
-		}
+		destDir := t.TempDir()
 
 		// copy images so we have them before syncing, sync should not pull them again
-		err = test.CopyFiles("../../../test/data", destDir)
+		err := test.CopyFiles("../../../test/data", destDir)
 		if err != nil {
 			panic(err)
 		}
@@ -3141,7 +3033,6 @@ func TestSyncOnlyDiff(t *testing.T) {
 
 		defer func() {
 			dctlr.Shutdown()
-			os.RemoveAll(destDir)
 		}()
 
 		// watch .sync subdir, shouldn't be populated
@@ -3177,8 +3068,7 @@ func TestSyncWithDiffDigest(t *testing.T) {
 	Convey("Verify sync correctly detects changes in upstream images", t, func() {
 		updateDuration, _ := time.ParseDuration("30m")
 
-		sctlr, srcBaseURL, srcDir, _, _ := startUpstreamServer(false, false)
-		defer os.RemoveAll(srcDir)
+		sctlr, srcBaseURL, _, _, _ := startUpstreamServer(t, false, false)
 
 		defer func() {
 			sctlr.Shutdown()
@@ -3210,13 +3100,10 @@ func TestSyncWithDiffDigest(t *testing.T) {
 		destBaseURL := test.GetBaseURL(destPort)
 		destConfig.HTTP.Port = destPort
 
-		destDir, err := ioutil.TempDir("", "oci-dest-repo-test")
-		if err != nil {
-			panic(err)
-		}
+		destDir := t.TempDir()
 
 		// copy images so we have them before syncing, sync should not pull them again
-		err = test.CopyFiles("../../../test/data", destDir)
+		err := test.CopyFiles("../../../test/data", destDir)
 		if err != nil {
 			panic(err)
 		}
@@ -3311,7 +3198,6 @@ func TestSyncWithDiffDigest(t *testing.T) {
 
 		defer func() {
 			dctlr.Shutdown()
-			os.RemoveAll(destDir)
 		}()
 
 		// wait till ready
diff --git a/pkg/log/log_test.go b/pkg/log/log_test.go
index 8eccc28a..1a0dcd4f 100644
--- a/pkg/log/log_test.go
+++ b/pkg/log/log_test.go
@@ -43,12 +43,8 @@ type AuditLog struct {
 
 func TestAuditLogMessages(t *testing.T) {
 	Convey("Make a new controller", t, func() {
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
-		err = CopyFiles("../../test/data", dir)
+		dir := t.TempDir()
+		err := CopyFiles("../../test/data", dir)
 		if err != nil {
 			panic(err)
 		}
diff --git a/pkg/storage/cache_test.go b/pkg/storage/cache_test.go
index 188331b6..c35238fd 100644
--- a/pkg/storage/cache_test.go
+++ b/pkg/storage/cache_test.go
@@ -1,8 +1,6 @@
 package storage_test
 
 import (
-	"io/ioutil"
-	"os"
 	"path"
 	"testing"
 
@@ -14,10 +12,7 @@ import (
 
 func TestCache(t *testing.T) {
 	Convey("Make a new cache", t, func() {
-		dir, err := ioutil.TempDir("", "cache_test")
-		So(err, ShouldBeNil)
-		So(dir, ShouldNotBeEmpty)
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
 		log := log.NewLogger("debug", "")
 		So(log, ShouldNotBeNil)
diff --git a/pkg/storage/scrub_test.go b/pkg/storage/scrub_test.go
index 029c0cb2..b140f03d 100644
--- a/pkg/storage/scrub_test.go
+++ b/pkg/storage/scrub_test.go
@@ -25,12 +25,7 @@ const (
 )
 
 func TestCheckAllBlobsIntegrity(t *testing.T) {
-	dir, err := ioutil.TempDir("", "scrub-test")
-	if err != nil {
-		panic(err)
-	}
-
-	defer os.RemoveAll(dir)
+	dir := t.TempDir()
 
 	log := log.NewLogger("debug", "")
 
@@ -40,7 +35,7 @@ func TestCheckAllBlobsIntegrity(t *testing.T) {
 
 	Convey("Scrub only one repo", t, func(c C) {
 		// initialize repo
-		err = imgStore.InitRepo(repoName)
+		err := imgStore.InitRepo(repoName)
 		So(err, ShouldBeNil)
 		ok := imgStore.DirExists(path.Join(imgStore.RootDir(), repoName))
 		So(ok, ShouldBeTrue)
diff --git a/pkg/storage/storage_fs_test.go b/pkg/storage/storage_fs_test.go
index 1c083fd6..2e7dfad8 100644
--- a/pkg/storage/storage_fs_test.go
+++ b/pkg/storage/storage_fs_test.go
@@ -30,12 +30,7 @@ const (
 )
 
 func TestStorageFSAPIs(t *testing.T) {
-	dir, err := ioutil.TempDir("", "oci-repo-test")
-	if err != nil {
-		panic(err)
-	}
-
-	defer os.RemoveAll(dir)
+	dir := t.TempDir()
 
 	log := log.Logger{Logger: zerolog.New(os.Stdout)}
 	metrics := monitoring.NewMetricsServer(false, log)
@@ -167,12 +162,7 @@ func TestStorageFSAPIs(t *testing.T) {
 }
 
 func TestDedupeLinks(t *testing.T) {
-	dir, err := ioutil.TempDir("", "oci-repo-test")
-	if err != nil {
-		panic(err)
-	}
-
-	defer os.RemoveAll(dir)
+	dir := t.TempDir()
 
 	log := log.Logger{Logger: zerolog.New(os.Stdout)}
 	metrics := monitoring.NewMetricsServer(false, log)
@@ -308,11 +298,7 @@ func TestDedupe(t *testing.T) {
 		})
 
 		Convey("Valid ImageStore", func() {
-			dir, err := ioutil.TempDir("", "oci-repo-test")
-			if err != nil {
-				panic(err)
-			}
-			defer os.RemoveAll(dir)
+			dir := t.TempDir()
 
 			log := log.Logger{Logger: zerolog.New(os.Stdout)}
 			metrics := monitoring.NewMetricsServer(false, log)
@@ -326,11 +312,7 @@ func TestDedupe(t *testing.T) {
 // nolint: gocyclo
 func TestNegativeCases(t *testing.T) {
 	Convey("Invalid root dir", t, func(c C) {
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		os.RemoveAll(dir)
+		dir := t.TempDir()
 
 		log := log.Logger{Logger: zerolog.New(os.Stdout)}
 		metrics := monitoring.NewMetricsServer(false, log)
@@ -342,17 +324,13 @@ func TestNegativeCases(t *testing.T) {
 	})
 
 	Convey("Invalid init repo", t, func(c C) {
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
 		log := log.Logger{Logger: zerolog.New(os.Stdout)}
 		metrics := monitoring.NewMetricsServer(false, log)
 		imgStore := storage.NewImageStore(dir, true, storage.DefaultGCDelay, true, true, log, metrics)
 
-		err = os.Chmod(dir, 0o000) // remove all perms
+		err := os.Chmod(dir, 0o000) // remove all perms
 		if err != nil {
 			panic(err)
 		}
@@ -381,11 +359,7 @@ func TestNegativeCases(t *testing.T) {
 	})
 
 	Convey("Invalid validate repo", t, func(c C) {
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
 		log := log.Logger{Logger: zerolog.New(os.Stdout)}
 		metrics := monitoring.NewMetricsServer(false, log)
@@ -394,7 +368,7 @@ func TestNegativeCases(t *testing.T) {
 		So(imgStore, ShouldNotBeNil)
 		So(imgStore.InitRepo("test"), ShouldBeNil)
 
-		err = os.MkdirAll(path.Join(dir, "invalid-test"), 0o755)
+		err := os.MkdirAll(path.Join(dir, "invalid-test"), 0o755)
 		So(err, ShouldBeNil)
 
 		err = os.Chmod(path.Join(dir, "invalid-test"), 0o000) // remove all perms
@@ -499,11 +473,7 @@ func TestNegativeCases(t *testing.T) {
 		_, err := ilfs.GetImageTags("test")
 		So(err, ShouldNotBeNil)
 
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
 		log := log.Logger{Logger: zerolog.New(os.Stdout)}
 		metrics := monitoring.NewMetricsServer(false, log)
@@ -526,11 +496,7 @@ func TestNegativeCases(t *testing.T) {
 		_, _, _, err := ilfs.GetImageManifest("test", "")
 		So(err, ShouldNotBeNil)
 
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
 		log := log.Logger{Logger: zerolog.New(os.Stdout)}
 		metrics := monitoring.NewMetricsServer(false, log)
@@ -571,11 +537,7 @@ func TestNegativeCases(t *testing.T) {
 	})
 
 	Convey("Invalid new blob upload", t, func(c C) {
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
 		log := log.Logger{Logger: zerolog.New(os.Stdout)}
 		metrics := monitoring.NewMetricsServer(false, log)
@@ -584,7 +546,7 @@ func TestNegativeCases(t *testing.T) {
 		So(imgStore, ShouldNotBeNil)
 		So(imgStore.InitRepo("test"), ShouldBeNil)
 
-		err = os.Chmod(path.Join(dir, "test", ".uploads"), 0o000)
+		err := os.Chmod(path.Join(dir, "test", ".uploads"), 0o000)
 		if err != nil {
 			panic(err)
 		}
@@ -621,6 +583,12 @@ func TestNegativeCases(t *testing.T) {
 		if err != nil {
 			panic(err)
 		}
+		t.Cleanup(func() {
+			err = os.Chmod(path.Join(dir, "test", ".uploads"), 0o700)
+			if err != nil {
+				panic(err)
+			}
+		})
 
 		content := []byte("test-data3")
 		buf := bytes.NewBuffer(content)
@@ -633,11 +601,7 @@ func TestNegativeCases(t *testing.T) {
 	})
 
 	Convey("Invalid dedupe scenarios", t, func() {
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
 		log := log.Logger{Logger: zerolog.New(os.Stdout)}
 		metrics := monitoring.NewMetricsServer(false, log)
@@ -710,14 +674,10 @@ func TestNegativeCases(t *testing.T) {
 	})
 
 	Convey("DirExists call with a filename as argument", t, func(c C) {
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
 		filePath := path.Join(dir, "file.txt")
-		err = ioutil.WriteFile(filePath, []byte("some dummy file content"), 0o644) //nolint: gosec
+		err := ioutil.WriteFile(filePath, []byte("some dummy file content"), 0o644) //nolint: gosec
 		if err != nil {
 			panic(err)
 		}
@@ -748,14 +708,10 @@ func TestHardLink(t *testing.T) {
 		So(err, ShouldBeNil)
 	})
 	Convey("Test that ValidateHardLink returns error if rootDir is a file", t, func() {
-		dir, err := ioutil.TempDir("", "storage-hard-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
 		filePath := path.Join(dir, "file.txt")
-		err = ioutil.WriteFile(filePath, []byte("some dummy file content"), 0o644) //nolint: gosec
+		err := ioutil.WriteFile(filePath, []byte("some dummy file content"), 0o644) //nolint: gosec
 		if err != nil {
 			panic(err)
 		}
@@ -764,13 +720,9 @@ func TestHardLink(t *testing.T) {
 		So(err, ShouldNotBeNil)
 	})
 	Convey("Test if filesystem supports hardlink", t, func() {
-		dir, err := ioutil.TempDir("", "storage-hard-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
-		err = storage.ValidateHardLink(dir)
+		err := storage.ValidateHardLink(dir)
 		So(err, ShouldBeNil)
 
 		err = ioutil.WriteFile(path.Join(dir, "hardtest.txt"), []byte("testing hard link code"), 0o644) //nolint: gosec
@@ -782,6 +734,13 @@ func TestHardLink(t *testing.T) {
 		if err != nil {
 			panic(err)
 		}
+		// Allow hardtest.txt to be cleaned up by t.TempDir()
+		t.Cleanup(func() {
+			err = os.Chmod(dir, 0o700)
+			if err != nil {
+				t.Fatal(err)
+			}
+		})
 
 		err = os.Link(path.Join(dir, "hardtest.txt"), path.Join(dir, "duphardtest.txt"))
 		So(err, ShouldNotBeNil)
@@ -795,9 +754,7 @@ func TestHardLink(t *testing.T) {
 
 func TestInjectWriteFile(t *testing.T) {
 	Convey("writeFile with commit", t, func() {
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		So(err, ShouldBeNil)
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
 		log := log.Logger{Logger: zerolog.New(os.Stdout)}
 		metrics := monitoring.NewMetricsServer(false, log)
@@ -827,9 +784,7 @@ func TestInjectWriteFile(t *testing.T) {
 	})
 
 	Convey("writeFile without commit", t, func() {
-		dir, err := ioutil.TempDir("", "oci-repo-test")
-		So(err, ShouldBeNil)
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
 		log := log.Logger{Logger: zerolog.New(os.Stdout)}
 		metrics := monitoring.NewMetricsServer(false, log)
@@ -844,12 +799,7 @@ func TestInjectWriteFile(t *testing.T) {
 
 func TestGarbageCollect(t *testing.T) {
 	Convey("Repo layout", t, func(c C) {
-		dir, err := ioutil.TempDir("", "oci-gc-test")
-		if err != nil {
-			panic(err)
-		}
-
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
 		log := log.Logger{Logger: zerolog.New(os.Stdout)}
 		metrics := monitoring.NewMetricsServer(false, log)
diff --git a/pkg/storage/storage_test.go b/pkg/storage/storage_test.go
index 174c1baa..7d3928b2 100644
--- a/pkg/storage/storage_test.go
+++ b/pkg/storage/storage_test.go
@@ -6,7 +6,6 @@ import (
 	_ "crypto/sha256"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path"
 	"strings"
@@ -111,12 +110,7 @@ func TestStorageAPIs(t *testing.T) {
 				store, imgStore, _ = createObjectsStore(testDir)
 				defer cleanupStorage(store, testDir)
 			} else {
-				dir, err := ioutil.TempDir("", "oci-repo-test")
-				if err != nil {
-					panic(err)
-				}
-
-				defer os.RemoveAll(dir)
+				dir := t.TempDir()
 
 				log := log.Logger{Logger: zerolog.New(os.Stdout)}
 				metrics := monitoring.NewMetricsServer(false, log)
@@ -686,25 +680,9 @@ func TestStorageHandler(t *testing.T) {
 				defer cleanupStorage(thirdStorageDriver, thirdRootDir)
 			} else {
 				// Create temporary directory
-				var err error
-
-				firstRootDir, err = ioutil.TempDir("", "util_test")
-				if err != nil {
-					panic(err)
-				}
-				defer os.RemoveAll(firstRootDir)
-
-				secondRootDir, err = ioutil.TempDir("", "util_test")
-				if err != nil {
-					panic(err)
-				}
-				defer os.RemoveAll(secondRootDir)
-
-				thirdRootDir, err = ioutil.TempDir("", "util_test")
-				if err != nil {
-					panic(err)
-				}
-				defer os.RemoveAll(thirdRootDir)
+				firstRootDir = t.TempDir()
+				secondRootDir = t.TempDir()
+				thirdRootDir = t.TempDir()
 
 				log := log.NewLogger("debug", "")
 
diff --git a/pkg/test/common_test.go b/pkg/test/common_test.go
index fa55cdf5..e4335d8f 100644
--- a/pkg/test/common_test.go
+++ b/pkg/test/common_test.go
@@ -19,56 +19,40 @@ func TestCopyFiles(t *testing.T) {
 		So(err, ShouldNotBeNil)
 	})
 	Convey("destDir is a file", t, func() {
-		dir, err := ioutil.TempDir("", "copy-files-test")
+		dir := t.TempDir()
+
+		err := test.CopyFiles("../../test/data", dir)
 		if err != nil {
 			panic(err)
 		}
 
-		err = test.CopyFiles("../../test/data", dir)
-		if err != nil {
-			panic(err)
-		}
-
-		defer os.RemoveAll(dir)
 		err = test.CopyFiles(dir, "/etc/passwd")
 		So(err, ShouldNotBeNil)
 	})
 	Convey("sourceDir does not have read permissions", t, func() {
-		dir, err := ioutil.TempDir("", "copy-files-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
-		err = os.Chmod(dir, 0o300)
+		err := os.Chmod(dir, 0o300)
 		So(err, ShouldBeNil)
 
 		err = test.CopyFiles(dir, os.TempDir())
 		So(err, ShouldNotBeNil)
 	})
 	Convey("sourceDir has a subfolder that does not have read permissions", t, func() {
-		dir, err := ioutil.TempDir("", "copy-files-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
 		sdir := "subdir"
-		err = os.Mkdir(path.Join(dir, sdir), 0o300)
+		err := os.Mkdir(path.Join(dir, sdir), 0o300)
 		So(err, ShouldBeNil)
 
 		err = test.CopyFiles(dir, os.TempDir())
 		So(err, ShouldNotBeNil)
 	})
 	Convey("sourceDir has a file that does not have read permissions", t, func() {
-		dir, err := ioutil.TempDir("", "copy-files-test")
-		if err != nil {
-			panic(err)
-		}
-		defer os.RemoveAll(dir)
+		dir := t.TempDir()
 
 		filePath := path.Join(dir, "file.txt")
-		err = ioutil.WriteFile(filePath, []byte("some dummy file content"), 0o644) //nolint: gosec
+		err := ioutil.WriteFile(filePath, []byte("some dummy file content"), 0o644) //nolint: gosec
 		if err != nil {
 			panic(err)
 		}