diff --git a/libcontainer/integration/checkpoint_test.go b/libcontainer/integration/checkpoint_test.go
index f2870ae05..9dbed42a3 100644
--- a/libcontainer/integration/checkpoint_test.go
+++ b/libcontainer/integration/checkpoint_test.go
@@ -3,7 +3,6 @@ package integration
 import (
 	"bufio"
 	"bytes"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -62,19 +61,8 @@ func testCheckpoint(t *testing.T, userns bool) {
 		t.Skipf("criu binary not found: %v", err)
 	}
 
-	root, err := newTestRoot()
-	ok(t, err)
-	defer remove(root)
-
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{
-		rootfs: rootfs,
-		userns: userns,
-	})
-	factory, err := libcontainer.New(root, libcontainer.Cgroupfs)
+	config := newTemplateConfig(t, &tParam{userns: userns})
+	factory, err := libcontainer.New(t.TempDir(), libcontainer.Cgroupfs)
 	ok(t, err)
 
 	container, err := factory.Create("test", config)
@@ -106,10 +94,9 @@ func testCheckpoint(t *testing.T, userns bool) {
 	process, err := os.FindProcess(pid)
 	ok(t, err)
 
-	parentDir, err := ioutil.TempDir("", "criu-parent")
-	ok(t, err)
-	defer remove(parentDir)
+	tmp := t.TempDir()
 
+	parentDir := filepath.Join(tmp, "criu-parent")
 	preDumpOpts := &libcontainer.CriuOpts{
 		ImagesDirectory: parentDir,
 		WorkDirectory:   parentDir,
@@ -129,9 +116,7 @@ func testCheckpoint(t *testing.T, userns bool) {
 		t.Fatal("Unexpected preDump state: ", state)
 	}
 
-	imagesDir, err := ioutil.TempDir("", "criu")
-	ok(t, err)
-	defer remove(imagesDir)
+	imagesDir := filepath.Join(tmp, "criu")
 
 	checkpointOpts := &libcontainer.CriuOpts{
 		ImagesDirectory: imagesDir,
diff --git a/libcontainer/integration/exec_test.go b/libcontainer/integration/exec_test.go
index 1e8e185f3..28f2e10d2 100644
--- a/libcontainer/integration/exec_test.go
+++ b/libcontainer/integration/exec_test.go
@@ -38,13 +38,7 @@ func testExecPS(t *testing.T, userns bool) {
 	if testing.Short() {
 		return
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-	config := newTemplateConfig(t, &tParam{
-		rootfs: rootfs,
-		userns: userns,
-	})
+	config := newTemplateConfig(t, &tParam{userns: userns})
 
 	buffers, exitCode, err := runContainer(t, config, "", "ps", "-o", "pid,user,comm")
 	if err != nil {
@@ -69,14 +63,10 @@ func TestIPCPrivate(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
 	l, err := os.Readlink("/proc/1/ns/ipc")
 	ok(t, err)
 
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	buffers, exitCode, err := runContainer(t, config, "", "readlink", "/proc/self/ns/ipc")
 	ok(t, err)
 
@@ -94,14 +84,10 @@ func TestIPCHost(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
 	l, err := os.Readlink("/proc/1/ns/ipc")
 	ok(t, err)
 
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.Namespaces.Remove(configs.NEWIPC)
 	buffers, exitCode, err := runContainer(t, config, "", "readlink", "/proc/self/ns/ipc")
 	ok(t, err)
@@ -120,14 +106,10 @@ func TestIPCJoinPath(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
 	l, err := os.Readlink("/proc/1/ns/ipc")
 	ok(t, err)
 
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.Namespaces.Add(configs.NEWIPC, "/proc/1/ns/ipc")
 
 	buffers, exitCode, err := runContainer(t, config, "", "readlink", "/proc/self/ns/ipc")
@@ -147,15 +129,10 @@ func TestIPCBadPath(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.Namespaces.Add(configs.NEWIPC, "/proc/1/ns/ipcc")
 
-	_, _, err = runContainer(t, config, "", "true")
-	if err == nil {
+	if _, _, err := runContainer(t, config, "", "true"); err == nil {
 		t.Fatal("container succeeded with bad ipc path")
 	}
 }
@@ -177,14 +154,7 @@ func testRlimit(t *testing.T, userns bool) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{
-		rootfs: rootfs,
-		userns: userns,
-	})
+	config := newTemplateConfig(t, &tParam{userns: userns})
 
 	// ensure limit is lower than what the config requests to test that in a user namespace
 	// the Setrlimit call happens early enough that we still have permissions to raise the limit.
@@ -205,11 +175,7 @@ func TestEnter(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 
 	container, err := newContainer(t, config)
 	ok(t, err)
@@ -292,12 +258,7 @@ func TestProcessEnv(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
-
+	config := newTemplateConfig(t, nil)
 	container, err := newContainer(t, config)
 	ok(t, err)
 	defer destroyContainer(container)
@@ -340,11 +301,7 @@ func TestProcessEmptyCaps(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.Capabilities = nil
 
 	container, err := newContainer(t, config)
@@ -389,12 +346,7 @@ func TestProcessCaps(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
-
+	config := newTemplateConfig(t, nil)
 	container, err := newContainer(t, config)
 	ok(t, err)
 	defer destroyContainer(container)
@@ -454,12 +406,8 @@ func TestAdditionalGroups(t *testing.T) {
 	if testing.Short() {
 		return
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
 
+	config := newTemplateConfig(t, nil)
 	container, err := newContainer(t, config)
 	ok(t, err)
 	defer destroyContainer(container)
@@ -521,14 +469,7 @@ func testFreeze(t *testing.T, withSystemd bool, useSet bool) {
 		t.Skip("Test requires systemd.")
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{
-		rootfs:  rootfs,
-		systemd: withSystemd,
-	})
+	config := newTemplateConfig(t, &tParam{systemd: withSystemd})
 	container, err := newContainer(t, config)
 	ok(t, err)
 	defer destroyContainer(container)
@@ -593,18 +534,10 @@ func testCpuShares(t *testing.T, systemd bool) {
 		t.Skip("cgroup v2 does not support CpuShares")
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{
-		rootfs:  rootfs,
-		systemd: systemd,
-	})
+	config := newTemplateConfig(t, &tParam{systemd: systemd})
 	config.Cgroups.Resources.CpuShares = 1
 
-	_, _, err = runContainer(t, config, "", "ps")
-	if err == nil {
+	if _, _, err := runContainer(t, config, "", "ps"); err == nil {
 		t.Fatalf("runContainer should failed with invalid CpuShares")
 	}
 }
@@ -625,14 +558,7 @@ func testPids(t *testing.T, systemd bool) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{
-		rootfs:  rootfs,
-		systemd: systemd,
-	})
+	config := newTemplateConfig(t, &tParam{systemd: systemd})
 	config.Cgroups.Resources.PidsLimit = -1
 
 	// Running multiple processes.
@@ -701,18 +627,12 @@ func testCgroupResourcesUnifiedErrorOnV1(t *testing.T, systemd bool) {
 	if cgroups.IsCgroup2UnifiedMode() {
 		t.Skip("requires cgroup v1")
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
 
-	config := newTemplateConfig(t, &tParam{
-		rootfs:  rootfs,
-		systemd: systemd,
-	})
+	config := newTemplateConfig(t, &tParam{systemd: systemd})
 	config.Cgroups.Resources.Unified = map[string]string{
 		"memory.min": "10240",
 	}
-	_, _, err = runContainer(t, config, "", "true")
+	_, _, err := runContainer(t, config, "", "true")
 	if !strings.Contains(err.Error(), cgroups.ErrV1NoUnified.Error()) {
 		t.Fatalf("expected error to contain %v, got %v", cgroups.ErrV1NoUnified, err)
 	}
@@ -736,14 +656,8 @@ func testCgroupResourcesUnified(t *testing.T, systemd bool) {
 	if !cgroups.IsCgroup2UnifiedMode() {
 		t.Skip("requires cgroup v2")
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
 
-	config := newTemplateConfig(t, &tParam{
-		rootfs:  rootfs,
-		systemd: systemd,
-	})
+	config := newTemplateConfig(t, &tParam{systemd: systemd})
 	config.Cgroups.Resources.Memory = 536870912     // 512M
 	config.Cgroups.Resources.MemorySwap = 536870912 // 512M, i.e. no swap
 	config.Namespaces.Add(configs.NEWCGROUP, "")
@@ -832,14 +746,10 @@ func TestContainerState(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
 	l, err := os.Readlink("/proc/1/ns/ipc")
 	ok(t, err)
 
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.Namespaces = configs.Namespaces([]configs.Namespace{
 		{Type: configs.NEWNS},
 		{Type: configs.NEWUTS},
@@ -885,12 +795,7 @@ func TestPassExtraFiles(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
-
+	config := newTemplateConfig(t, nil)
 	container, err := newContainer(t, config)
 	ok(t, err)
 	defer destroyContainer(container)
@@ -940,15 +845,9 @@ func TestMountCmds(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	tmpDir, err := ioutil.TempDir("", "tmpdir")
-	ok(t, err)
-	defer remove(tmpDir)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	tmpDir := t.TempDir()
+	config := newTemplateConfig(t, nil)
+	rootfs := config.Rootfs
 	config.Mounts = append(config.Mounts, &configs.Mount{
 		Source:      tmpDir,
 		Destination: "/tmp",
@@ -995,11 +894,7 @@ func TestSysctl(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.Sysctl = map[string]string{
 		"kernel.shmmni": "8192",
 	}
@@ -1033,10 +928,7 @@ func TestMountCgroupRO(t *testing.T) {
 	if testing.Short() {
 		return
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	buffers, exitCode, err := runContainer(t, config, "", "mount")
 	if err != nil {
 		t.Fatalf("%s: %s", buffers, err)
@@ -1075,10 +967,7 @@ func TestMountCgroupRW(t *testing.T) {
 	if testing.Short() {
 		return
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	// clear the RO flag from cgroup mount
 	for _, m := range config.Mounts {
 		if m.Device == "cgroup" {
@@ -1126,11 +1015,7 @@ func TestOomScoreAdj(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.OomScoreAdj = ptrInt(200)
 
 	container, err := newContainer(t, config)
@@ -1164,16 +1049,8 @@ func TestHook(t *testing.T) {
 		return
 	}
 
-	bundle, err := newTestBundle()
-	ok(t, err)
-	defer remove(bundle)
-
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
-	expectedBundle := bundle
+	config := newTemplateConfig(t, nil)
+	expectedBundle := t.TempDir()
 	config.Labels = append(config.Labels, "bundle="+expectedBundle)
 
 	getRootfsFromBundle := func(bundle string) (string, error) {
@@ -1270,7 +1147,7 @@ func TestHook(t *testing.T) {
 	}
 
 	// write config of json format into config.json under bundle
-	f, err := os.OpenFile(filepath.Join(bundle, "config.json"), os.O_CREATE|os.O_RDWR, 0o644)
+	f, err := os.OpenFile(filepath.Join(expectedBundle, "config.json"), os.O_CREATE|os.O_RDWR, 0o644)
 	ok(t, err)
 	ok(t, json.NewEncoder(f).Encode(config))
 
@@ -1303,7 +1180,7 @@ func TestHook(t *testing.T) {
 	}
 
 	for _, hook := range []string{"prestart", "createRuntime", "poststart"} {
-		fi, err := os.Stat(filepath.Join(rootfs, hook))
+		fi, err := os.Stat(filepath.Join(config.Rootfs, hook))
 		if err == nil || !os.IsNotExist(err) {
 			t.Fatalf("expected file '%s to not exists, but it does", fi.Name())
 		}
@@ -1315,10 +1192,7 @@ func TestSTDIOPermissions(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	buffers, exitCode, err := runContainer(t, config, "", "sh", "-c", "echo hi > /dev/stderr")
 	ok(t, err)
 	if exitCode != 0 {
@@ -1348,21 +1222,15 @@ func TestRootfsPropagationSlaveMount(t *testing.T) {
 	if testing.Short() {
 		return
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
-
+	config := newTemplateConfig(t, nil)
 	config.RootPropagation = unix.MS_SLAVE | unix.MS_REC
 
-	// Bind mount a volume
-	dir1host, err := ioutil.TempDir("", "mnt1host")
-	ok(t, err)
-	defer remove(dir1host)
+	// Bind mount a volume.
+	dir1host := t.TempDir()
 
 	// Make this dir a "shared" mount point. This will make sure a
 	// slave relationship can be established in container.
-	err = unix.Mount(dir1host, dir1host, "bind", unix.MS_BIND|unix.MS_REC, "")
+	err := unix.Mount(dir1host, dir1host, "bind", unix.MS_BIND|unix.MS_REC, "")
 	ok(t, err)
 	err = unix.Mount("", dir1host, "", unix.MS_SHARED|unix.MS_REC, "")
 	ok(t, err)
@@ -1395,9 +1263,10 @@ func TestRootfsPropagationSlaveMount(t *testing.T) {
 	defer stdinW.Close() //nolint: errcheck
 	ok(t, err)
 
-	// Create mnt1host/mnt2host and bind mount itself on top of it. This
-	// should be visible in container.
-	dir2host, err := ioutil.TempDir(dir1host, "mnt2host")
+	// Create mnt2host under dir1host and bind mount itself on top of it.
+	// This should be visible in container.
+	dir2host := filepath.Join(dir1host, "mnt2host")
+	err = os.Mkdir(dir2host, 0o700)
 	ok(t, err)
 	defer remove(dir2host)
 
@@ -1465,20 +1334,15 @@ func TestRootfsPropagationSharedMount(t *testing.T) {
 	if testing.Short() {
 		return
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.RootPropagation = unix.MS_PRIVATE
 
-	// Bind mount a volume
-	dir1host, err := ioutil.TempDir("", "mnt1host")
-	ok(t, err)
-	defer remove(dir1host)
+	// Bind mount a volume.
+	dir1host := t.TempDir()
 
 	// Make this dir a "shared" mount point. This will make sure a
 	// shared relationship can be established in container.
-	err = unix.Mount(dir1host, dir1host, "bind", unix.MS_BIND|unix.MS_REC, "")
+	err := unix.Mount(dir1host, dir1host, "bind", unix.MS_BIND|unix.MS_REC, "")
 	ok(t, err)
 	err = unix.Mount("", dir1host, "", unix.MS_SHARED|unix.MS_REC, "")
 	ok(t, err)
@@ -1511,10 +1375,11 @@ func TestRootfsPropagationSharedMount(t *testing.T) {
 	defer stdinW.Close() //nolint: errcheck
 	ok(t, err)
 
-	// Create mnt1host/mnt2cont.  This will become visible inside container
+	// Create mnt2cont under dir1host. This will become visible inside container
 	// at mnt1cont/mnt2cont. Bind mount itself on top of it. This
 	// should be visible on host now.
-	dir2host, err := ioutil.TempDir(dir1host, "mnt2cont")
+	dir2host := filepath.Join(dir1host, "mnt2cont")
+	err = os.Mkdir(dir2host, 0o700)
 	ok(t, err)
 	defer remove(dir2host)
 
@@ -1571,14 +1436,10 @@ func TestPIDHost(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
 	l, err := os.Readlink("/proc/1/ns/pid")
 	ok(t, err)
 
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.Namespaces.Remove(configs.NEWPID)
 	buffers, exitCode, err := runContainer(t, config, "", "readlink", "/proc/self/ns/pid")
 	ok(t, err)
@@ -1597,14 +1458,10 @@ func TestPIDHostInitProcessWait(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
 	pidns := "/proc/1/ns/pid"
 
 	// Run a container with two long-running processes.
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.Namespaces.Add(configs.NEWPID, pidns)
 	container, err := newContainer(t, config)
 	ok(t, err)
@@ -1649,12 +1506,9 @@ func TestInitJoinPID(t *testing.T) {
 	if testing.Short() {
 		return
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
 	// Execute a long-running container
-	container1, err := newContainer(t, newTemplateConfig(t, &tParam{rootfs: rootfs}))
+	config1 := newTemplateConfig(t, nil)
+	container1, err := newContainer(t, config1)
 	ok(t, err)
 	defer destroyContainer(container1)
 
@@ -1678,7 +1532,7 @@ func TestInitJoinPID(t *testing.T) {
 	pidns1 := state1.NamespacePaths[configs.NEWPID]
 
 	// Run a container inside the existing pidns but with different cgroups
-	config2 := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config2 := newTemplateConfig(t, nil)
 	config2.Namespaces.Add(configs.NEWPID, pidns1)
 	config2.Cgroups.Path = "integration/test2"
 	container2, err := newContainer(t, config2)
@@ -1752,15 +1606,9 @@ func TestInitJoinNetworkAndUser(t *testing.T) {
 	if testing.Short() {
 		return
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
 
 	// Execute a long-running container
-	config1 := newTemplateConfig(t, &tParam{
-		rootfs: rootfs,
-		userns: true,
-	})
+	config1 := newTemplateConfig(t, &tParam{userns: true})
 	container1, err := newContainer(t, config1)
 	ok(t, err)
 	defer destroyContainer(container1)
@@ -1785,15 +1633,8 @@ func TestInitJoinNetworkAndUser(t *testing.T) {
 	netns1 := state1.NamespacePaths[configs.NEWNET]
 	userns1 := state1.NamespacePaths[configs.NEWUSER]
 
-	// Run a container inside the existing pidns but with different cgroups
-	rootfs2, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs2)
-
-	config2 := newTemplateConfig(t, &tParam{
-		rootfs: rootfs2,
-		userns: true,
-	})
+	// Run a container inside the existing pidns but with different cgroups.
+	config2 := newTemplateConfig(t, &tParam{userns: true})
 	config2.Namespaces.Add(configs.NEWNET, netns1)
 	config2.Namespaces.Add(configs.NEWUSER, userns1)
 	config2.Cgroups.Path = "integration/test2"
@@ -1847,12 +1688,7 @@ func TestTmpfsCopyUp(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
-
+	config := newTemplateConfig(t, nil)
 	config.Mounts = append(config.Mounts, &configs.Mount{
 		Source:      "tmpfs",
 		Destination: "/etc",
@@ -1894,14 +1730,10 @@ func TestCGROUPPrivate(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
 	l, err := os.Readlink("/proc/1/ns/cgroup")
 	ok(t, err)
 
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.Namespaces.Add(configs.NEWCGROUP, "")
 	buffers, exitCode, err := runContainer(t, config, "", "readlink", "/proc/self/ns/cgroup")
 	ok(t, err)
@@ -1923,14 +1755,10 @@ func TestCGROUPHost(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
 	l, err := os.Readlink("/proc/1/ns/cgroup")
 	ok(t, err)
 
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	buffers, exitCode, err := runContainer(t, config, "", "readlink", "/proc/self/ns/cgroup")
 	ok(t, err)
 
@@ -1959,10 +1787,6 @@ func testFdLeaks(t *testing.T, systemd bool) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
 	pfd, err := os.Open("/proc/self/fd")
 	ok(t, err)
 	defer pfd.Close()
@@ -1971,10 +1795,7 @@ func testFdLeaks(t *testing.T, systemd bool) {
 	_, err = pfd.Seek(0, 0)
 	ok(t, err)
 
-	config := newTemplateConfig(t, &tParam{
-		rootfs:  rootfs,
-		systemd: systemd,
-	})
+	config := newTemplateConfig(t, &tParam{systemd: systemd})
 	buffers, exitCode, err := runContainer(t, config, "", "true")
 	ok(t, err)
 
diff --git a/libcontainer/integration/execin_test.go b/libcontainer/integration/execin_test.go
index bfdbac028..f8a6a9c69 100644
--- a/libcontainer/integration/execin_test.go
+++ b/libcontainer/integration/execin_test.go
@@ -22,10 +22,7 @@ func TestExecIn(t *testing.T) {
 	if testing.Short() {
 		return
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	container, err := newContainer(t, config)
 	ok(t, err)
 	defer destroyContainer(container)
@@ -87,15 +84,7 @@ func testExecInRlimit(t *testing.T, userns bool) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{
-		rootfs: rootfs,
-		userns: userns,
-	})
-
+	config := newTemplateConfig(t, &tParam{userns: userns})
 	container, err := newContainer(t, config)
 	ok(t, err)
 	defer destroyContainer(container)
@@ -146,11 +135,7 @@ func TestExecInAdditionalGroups(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	container, err := newContainer(t, config)
 	ok(t, err)
 	defer destroyContainer(container)
@@ -204,10 +189,7 @@ func TestExecInError(t *testing.T) {
 	if testing.Short() {
 		return
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	container, err := newContainer(t, config)
 	ok(t, err)
 	defer destroyContainer(container)
@@ -258,10 +240,7 @@ func TestExecInTTY(t *testing.T) {
 		return
 	}
 	t.Skip("racy; see https://github.com/opencontainers/runc/issues/2425")
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	container, err := newContainer(t, config)
 	ok(t, err)
 	defer destroyContainer(container)
@@ -352,10 +331,7 @@ func TestExecInEnvironment(t *testing.T) {
 	if testing.Short() {
 		return
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	container, err := newContainer(t, config)
 	ok(t, err)
 	defer destroyContainer(container)
@@ -412,11 +388,7 @@ func TestExecinPassExtraFiles(t *testing.T) {
 	if testing.Short() {
 		return
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	container, err := newContainer(t, config)
 	ok(t, err)
 	defer destroyContainer(container)
@@ -481,10 +453,7 @@ func TestExecInOomScoreAdj(t *testing.T) {
 	if testing.Short() {
 		return
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.OomScoreAdj = ptrInt(200)
 	container, err := newContainer(t, config)
 	ok(t, err)
@@ -533,13 +502,7 @@ func TestExecInUserns(t *testing.T) {
 	if testing.Short() {
 		return
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-	config := newTemplateConfig(t, &tParam{
-		rootfs: rootfs,
-		userns: true,
-	})
+	config := newTemplateConfig(t, &tParam{userns: true})
 	container, err := newContainer(t, config)
 	ok(t, err)
 	defer destroyContainer(container)
diff --git a/libcontainer/integration/init_test.go b/libcontainer/integration/init_test.go
index f5180eac0..effcde06d 100644
--- a/libcontainer/integration/init_test.go
+++ b/libcontainer/integration/init_test.go
@@ -28,19 +28,10 @@ func init() {
 	}
 }
 
-var testRoots []string
-
 func TestMain(m *testing.M) {
 	logrus.SetOutput(os.Stderr)
 	logrus.SetLevel(logrus.InfoLevel)
 
-	// Clean up roots after running everything.
-	defer func() {
-		for _, root := range testRoots {
-			os.RemoveAll(root)
-		}
-	}()
-
 	ret := m.Run()
 	os.Exit(ret)
 }
diff --git a/libcontainer/integration/seccomp_test.go b/libcontainer/integration/seccomp_test.go
index 244f2752f..b25413060 100644
--- a/libcontainer/integration/seccomp_test.go
+++ b/libcontainer/integration/seccomp_test.go
@@ -17,13 +17,9 @@ func TestSeccompDenyGetcwdWithErrno(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
 	errnoRet := uint(syscall.ESRCH)
 
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
@@ -83,11 +79,7 @@ func TestSeccompDenyGetcwd(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
@@ -146,11 +138,7 @@ func TestSeccompPermitWriteConditional(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
@@ -202,11 +190,7 @@ func TestSeccompDenyWriteConditional(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
@@ -274,11 +258,7 @@ func TestSeccompPermitWriteMultipleConditions(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
@@ -327,11 +307,7 @@ func TestSeccompDenyWriteMultipleConditions(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	config := newTemplateConfig(t, nil)
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
@@ -374,12 +350,8 @@ func TestSeccompMultipleConditionSameArgDeniesStdout(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	// Prevent writing to both stdout and stderr
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	// Prevent writing to both stdout and stderr.
+	config := newTemplateConfig(t, nil)
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
@@ -420,12 +392,8 @@ func TestSeccompMultipleConditionSameArgDeniesStderr(t *testing.T) {
 		return
 	}
 
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	// Prevent writing to both stdout and stderr
-	config := newTemplateConfig(t, &tParam{rootfs: rootfs})
+	// Prevent writing to both stdout and stderr.
+	config := newTemplateConfig(t, nil)
 	config.Seccomp = &configs.Seccomp{
 		DefaultAction: configs.Allow,
 		Syscalls: []*configs.Syscall{
diff --git a/libcontainer/integration/template_test.go b/libcontainer/integration/template_test.go
index 039cd7375..d35904766 100644
--- a/libcontainer/integration/template_test.go
+++ b/libcontainer/integration/template_test.go
@@ -22,22 +22,26 @@ var standardEnvironment = []string{
 const defaultMountFlags = unix.MS_NOEXEC | unix.MS_NOSUID | unix.MS_NODEV
 
 type tParam struct {
-	rootfs  string
 	userns  bool
 	systemd bool
 }
 
-// newTemplateConfig returns a base template for running a container
+// newTemplateConfig returns a base template for running a container.
 //
-// it uses a network strategy of just setting a loopback interface
-// and the default setup for devices
+// It uses a network strategy of just setting a loopback interface
+// and the default setup for devices.
+//
+// If p is nil, a default container is created.
 func newTemplateConfig(t *testing.T, p *tParam) *configs.Config {
 	var allowedDevices []*devices.Rule
 	for _, device := range specconv.AllowedDevices {
 		allowedDevices = append(allowedDevices, &device.Rule)
 	}
+	if p == nil {
+		p = &tParam{}
+	}
 	config := &configs.Config{
-		Rootfs: p.rootfs,
+		Rootfs: newRootfs(t),
 		Capabilities: &configs.Capabilities{
 			Bounding: []string{
 				"CAP_CHOWN",
diff --git a/libcontainer/integration/update_test.go b/libcontainer/integration/update_test.go
index 4222b7e2a..5678b6f63 100644
--- a/libcontainer/integration/update_test.go
+++ b/libcontainer/integration/update_test.go
@@ -15,13 +15,7 @@ func testUpdateDevices(t *testing.T, systemd bool) {
 	if testing.Short() {
 		return
 	}
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-	config := newTemplateConfig(t, &tParam{
-		rootfs:  rootfs,
-		systemd: systemd,
-	})
+	config := newTemplateConfig(t, &tParam{systemd: systemd})
 	container, err := newContainer(t, config)
 	ok(t, err)
 	defer destroyContainer(container)
diff --git a/libcontainer/integration/utils_test.go b/libcontainer/integration/utils_test.go
index a22c8744b..4aae604ae 100644
--- a/libcontainer/integration/utils_test.go
+++ b/libcontainer/integration/utils_test.go
@@ -3,7 +3,6 @@ package integration
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -98,42 +97,15 @@ func waitProcess(p *libcontainer.Process, t *testing.T) {
 	}
 }
 
-func newTestRoot() (string, error) {
-	dir, err := ioutil.TempDir("", "libcontainer")
-	if err != nil {
-		return "", err
-	}
-	if err := os.MkdirAll(dir, 0o700); err != nil {
-		return "", err
-	}
-	testRoots = append(testRoots, dir)
-	return dir, nil
-}
-
-func newTestBundle() (string, error) {
-	dir, err := ioutil.TempDir("", "bundle")
-	if err != nil {
-		return "", err
-	}
-	if err := os.MkdirAll(dir, 0o700); err != nil {
-		return "", err
-	}
-	return dir, nil
-}
-
-// newRootfs creates a new tmp directory and copies the busybox root filesystem
-func newRootfs() (string, error) {
-	dir, err := ioutil.TempDir("", "")
-	if err != nil {
-		return "", err
-	}
-	if err := os.MkdirAll(dir, 0o700); err != nil {
-		return "", err
-	}
+// newRootfs creates a new tmp directory and copies the busybox root
+// filesystem to it.
+func newRootfs(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
 	if err := copyBusybox(dir); err != nil {
-		return "", err
+		t.Fatal(err)
 	}
-	return dir, nil
+	return dir
 }
 
 func remove(dir string) {
@@ -152,10 +124,7 @@ func copyBusybox(dest string) error {
 
 func newContainer(t *testing.T, config *configs.Config) (libcontainer.Container, error) {
 	name := strings.ReplaceAll(t.Name(), "/", "_") + strconv.FormatInt(-int64(time.Now().Nanosecond()), 35)
-	root, err := newTestRoot()
-	if err != nil {
-		return nil, err
-	}
+	root := t.TempDir()
 
 	f, err := libcontainer.New(root, libcontainer.Cgroupfs)
 	if err != nil {