diff --git a/go.mod b/go.mod
index 7c8ea527..4481b34a 100644
--- a/go.mod
+++ b/go.mod
@@ -5,7 +5,7 @@ go 1.18
 require (
 	github.com/containers/common v0.57.2
 	github.com/containers/image/v5 v5.29.1
-	github.com/containers/podman/v4 v4.8.3
+	github.com/containers/podman/v4 v4.9.0
 	github.com/go-kit/log v0.2.1
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.18.0
@@ -38,7 +38,7 @@ require (
 	github.com/containerd/typeurl/v2 v2.1.1 // indirect
 	github.com/containernetworking/cni v1.1.2 // indirect
 	github.com/containernetworking/plugins v1.3.0 // indirect
-	github.com/containers/buildah v1.33.2 // indirect
+	github.com/containers/buildah v1.33.3 // indirect
 	github.com/containers/conmon v2.0.20+incompatible // indirect
 	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
 	github.com/containers/luksy v0.0.0-20231030195837-b5a7f79da98b // indirect
@@ -152,7 +152,7 @@ require (
 	golang.org/x/mod v0.13.0 // indirect
 	golang.org/x/net v0.20.0 // indirect
 	golang.org/x/oauth2 v0.16.0 // indirect
-	golang.org/x/sync v0.5.0 // indirect
+	golang.org/x/sync v0.6.0 // indirect
 	golang.org/x/sys v0.16.0 // indirect
 	golang.org/x/term v0.16.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
diff --git a/go.sum b/go.sum
index 0bbafdfc..fe6d7f8c 100644
--- a/go.sum
+++ b/go.sum
@@ -241,8 +241,8 @@ github.com/containernetworking/plugins v0.8.6/go.mod h1:qnw5mN19D8fIwkqW7oHHYDHV
 github.com/containernetworking/plugins v0.9.1/go.mod h1:xP/idU2ldlzN6m4p5LmGiwRDjeJr6FLK6vuiUwoH7P8=
 github.com/containernetworking/plugins v1.3.0 h1:QVNXMT6XloyMUoO2wUOqWTC1hWFV62Q6mVDp5H1HnjM=
 github.com/containernetworking/plugins v1.3.0/go.mod h1:Pc2wcedTQQCVuROOOaLBPPxrEXqqXBFt3cZ+/yVg6l0=
-github.com/containers/buildah v1.33.2 h1:8xdFFP2txJ5lQP91MqYrs/cGhF4o8f46wzFgnrTDJBM=
-github.com/containers/buildah v1.33.2/go.mod h1:P1fI6kIw3d3ENk5eUJjkXeT9YFoG3uAAWglCk5BeuWc=
+github.com/containers/buildah v1.33.3 h1:wkNu4to1vS4ZskV8TExRVFZoEiOrVISeB5qdGH2Hle8=
+github.com/containers/buildah v1.33.3/go.mod h1:twgn5g4zD8rUCfU/3PqfaaiepB2Ybz/tEACza18iuvE=
 github.com/containers/common v0.57.2 h1:50Zp9VuXt2u5uNTKEc4aU2+PfWzFNAulD9JX43VihyI=
 github.com/containers/common v0.57.2/go.mod h1:ZG9ab1bEssX98ZBclWFIyzx4+MyUN8dXj1oSEugp7N0=
 github.com/containers/conmon v2.0.20+incompatible h1:YbCVSFSCqFjjVwHTPINGdMX1F6JXHGTUje2ZYobNrkg=
@@ -258,8 +258,8 @@ github.com/containers/ocicrypt v1.1.0/go.mod h1:b8AOe0YR67uU8OqfVNcznfFpAzu3rdgU
 github.com/containers/ocicrypt v1.1.1/go.mod h1:Dm55fwWm1YZAjYRaJ94z2mfZikIyIN4B0oB3dj3jFxY=
 github.com/containers/ocicrypt v1.1.9 h1:2Csfba4jse85Raxk5HIyEk8OwZNjRvfkhEGijOjIdEM=
 github.com/containers/ocicrypt v1.1.9/go.mod h1:dTKx1918d8TDkxXvarscpNVY+lyPakPNFN4jwA9GBys=
-github.com/containers/podman/v4 v4.8.3 h1:gufLP9pJL/pBKW2P9CHmvfpXqjIRpo8lhHeZiwh8tpc=
-github.com/containers/podman/v4 v4.8.3/go.mod h1:ArI44imM/lS2u5XAXXtdehFT5cWPimzA/oyICc03IqI=
+github.com/containers/podman/v4 v4.9.0 h1:K7lSZAlloEa3SoEHebFC+v8fY+gBMhFfjpestFDdphQ=
+github.com/containers/podman/v4 v4.9.0/go.mod h1:mYrL/jqmfFbcyWpiGhXgGJJgCp0V18okNUFzsADNv7I=
 github.com/containers/psgo v1.8.0 h1:2loGekmGAxM9ir5OsXWEfGwFxorMPYnc6gEDsGFQvhY=
 github.com/containers/psgo v1.8.0/go.mod h1:T8ZxnX3Ur4RvnhxFJ7t8xJ1F48RhiZB4rSrOaR/qGHc=
 github.com/containers/storage v1.43.0/go.mod h1:uZ147thiIFGdVTjMmIw19knttQnUCl3y9zjreHrg11s=
@@ -1161,8 +1161,8 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
-golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
diff --git a/vendor/github.com/containers/buildah/CHANGELOG.md b/vendor/github.com/containers/buildah/CHANGELOG.md
index e1c3bef2..7a8b0bd7 100644
--- a/vendor/github.com/containers/buildah/CHANGELOG.md
+++ b/vendor/github.com/containers/buildah/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 # Changelog
 
+## v1.33.3 (2024-01-18)
+
+    Bump c/common to 0.57.2 and c/image to 5.29.1
+
 ## v1.33.2 (2023-11-22)
 
     Update minimum to golang 1.20
diff --git a/vendor/github.com/containers/buildah/changelog.txt b/vendor/github.com/containers/buildah/changelog.txt
index fa13a80a..ceec4a11 100644
--- a/vendor/github.com/containers/buildah/changelog.txt
+++ b/vendor/github.com/containers/buildah/changelog.txt
@@ -1,3 +1,7 @@
+-Changelog for v1.33.3 (2024-01-18)
+
+  * Bump c/common to 0.57.2 and c/image to 5.29.1
+
 - Changelog for v1.33.2 (2023-11-22)
   * Update minimum to golang 1.20
   * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
diff --git a/vendor/github.com/containers/buildah/define/types.go b/vendor/github.com/containers/buildah/define/types.go
index a592cc6a..6838a158 100644
--- a/vendor/github.com/containers/buildah/define/types.go
+++ b/vendor/github.com/containers/buildah/define/types.go
@@ -29,7 +29,7 @@ const (
 	// identify working containers.
 	Package = "buildah"
 	// Version for the Package. Also used by .packit.sh for Packit builds.
-	Version = "1.33.2"
+	Version = "1.33.3"
 
 	// DefaultRuntime if containers.conf fails.
 	DefaultRuntime = "runc"
diff --git a/vendor/github.com/containers/buildah/internal/mkcw/embed/entrypoint.gz b/vendor/github.com/containers/buildah/internal/mkcw/embed/entrypoint.gz
index f8218a05..e63fa4be 100644
Binary files a/vendor/github.com/containers/buildah/internal/mkcw/embed/entrypoint.gz and b/vendor/github.com/containers/buildah/internal/mkcw/embed/entrypoint.gz differ
diff --git a/vendor/github.com/containers/podman/v4/cmd/podman/registry/registry.go b/vendor/github.com/containers/podman/v4/cmd/podman/registry/registry.go
index b45a34ff..867d145d 100644
--- a/vendor/github.com/containers/podman/v4/cmd/podman/registry/registry.go
+++ b/vendor/github.com/containers/podman/v4/cmd/podman/registry/registry.go
@@ -64,6 +64,14 @@ func ContainerEngine() entities.ContainerEngine {
 func NewContainerEngine(cmd *cobra.Command, args []string) (entities.ContainerEngine, error) {
 	if containerEngine == nil {
 		podmanOptions.FlagSet = cmd.Flags()
+		if cmd.Name() == "reset" && cmd.Parent().Name() == "system" {
+			logrus.Debugf("Performing system reset, runtime validation checks will be relaxed")
+			podmanOptions.IsReset = true
+		}
+		if cmd.Name() == "renumber" && cmd.Parent().Name() == "system" {
+			logrus.Debugf("Performing system renumber, runtime validation checks will be relaxed")
+			podmanOptions.IsRenumber = true
+		}
 		engine, err := infra.NewContainerEngine(&podmanOptions)
 		if err != nil {
 			return nil, err
diff --git a/vendor/github.com/containers/podman/v4/libpod/options.go b/vendor/github.com/containers/podman/v4/libpod/options.go
index b8a374ed..4bd96f46 100644
--- a/vendor/github.com/containers/podman/v4/libpod/options.go
+++ b/vendor/github.com/containers/podman/v4/libpod/options.go
@@ -465,9 +465,10 @@ func WithDefaultInfraCommand(cmd string) RuntimeOption {
 	}
 }
 
-// WithReset instructs libpod to reset all storage to factory defaults.
-// All containers, pods, volumes, images, and networks will be removed.
-// All directories created by Libpod will be removed.
+// WithReset tells Libpod that the runtime will be used to perform a system
+// reset. A number of checks at initialization are relaxed as the runtime is
+// going to be used to remove all containers, pods, volumes, images, and
+// networks.
 func WithReset() RuntimeOption {
 	return func(rt *Runtime) error {
 		if rt.valid {
@@ -480,10 +481,8 @@ func WithReset() RuntimeOption {
 	}
 }
 
-// WithRenumber instructs libpod to perform a lock renumbering while
-// initializing. This will handle migrations from early versions of libpod with
-// file locks to newer versions with SHM locking, as well as changes in the
-// number of configured locks.
+// WithRenumber tells Libpod that the runtime will be used to perform a system
+// renumber. A number of checks on initialization related to locks are relaxed.
 func WithRenumber() RuntimeOption {
 	return func(rt *Runtime) error {
 		if rt.valid {
@@ -496,43 +495,6 @@ func WithRenumber() RuntimeOption {
 	}
 }
 
-// WithMigrate instructs libpod to migrate container configurations to account
-// for changes between Engine versions. All running containers will be stopped
-// during a migration, then restarted after the migration is complete.
-func WithMigrate() RuntimeOption {
-	return func(rt *Runtime) error {
-		if rt.valid {
-			return define.ErrRuntimeFinalized
-		}
-
-		rt.doMigrate = true
-
-		return nil
-	}
-}
-
-// WithMigrateRuntime instructs Engine to change the default OCI runtime on all
-// containers during a migration. This is not used if `MigrateRuntime()` is not
-// also passed.
-// Engine makes no promises that your containers continue to work with the new
-// runtime - migrations between dissimilar runtimes may well break things.
-// Use with caution.
-func WithMigrateRuntime(requestedRuntime string) RuntimeOption {
-	return func(rt *Runtime) error {
-		if rt.valid {
-			return define.ErrRuntimeFinalized
-		}
-
-		if requestedRuntime == "" {
-			return fmt.Errorf("must provide a non-empty name for new runtime: %w", define.ErrInvalidArg)
-		}
-
-		rt.migrateRuntime = requestedRuntime
-
-		return nil
-	}
-}
-
 // WithEventsLogger sets the events backend to use.
 // Currently supported values are "file" for file backend and "journald" for
 // journald backend.
diff --git a/vendor/github.com/containers/podman/v4/libpod/reset.go b/vendor/github.com/containers/podman/v4/libpod/reset.go
index 8833eb94..de06e578 100644
--- a/vendor/github.com/containers/podman/v4/libpod/reset.go
+++ b/vendor/github.com/containers/podman/v4/libpod/reset.go
@@ -92,8 +92,24 @@ func (r *Runtime) removeAllDirs() error {
 	return lastErr
 }
 
-// Reset removes all storage
-func (r *Runtime) reset(ctx context.Context) error {
+// Reset removes all Libpod files.
+// All containers, images, volumes, pods, and networks will be removed.
+// Calls Shutdown(), rendering the runtime unusable after this is run.
+func (r *Runtime) Reset(ctx context.Context) error {
+	// Acquire the alive lock and hold it.
+	// Ensures that we don't let other Podman commands run while we are
+	// removing everything.
+	aliveLock, err := r.getRuntimeAliveLock()
+	if err != nil {
+		return fmt.Errorf("retrieving alive lock: %w", err)
+	}
+	aliveLock.Lock()
+	defer aliveLock.Unlock()
+
+	if !r.valid {
+		return define.ErrRuntimeStopped
+	}
+
 	var timeout *uint
 	pods, err := r.GetAllPods()
 	if err != nil {
@@ -119,13 +135,23 @@ func (r *Runtime) reset(ctx context.Context) error {
 	}
 
 	for _, c := range ctrs {
-		if err := r.RemoveContainer(ctx, c, true, true, timeout); err != nil {
-			if err := r.RemoveStorageContainer(c.ID(), true); err != nil {
-				if errors.Is(err, define.ErrNoSuchCtr) {
-					continue
-				}
-				logrus.Errorf("Removing container %s: %v", c.ID(), err)
+		if ctrs, _, err := r.RemoveContainerAndDependencies(ctx, c, true, true, timeout); err != nil {
+			for ctr, err := range ctrs {
+				logrus.Errorf("Error removing container %s: %v", ctr, err)
 			}
+
+			if errors.Is(err, define.ErrNoSuchCtr) || errors.Is(err, define.ErrCtrRemoved) {
+				continue
+			}
+
+			logrus.Errorf("Removing container %s: %v", c.ID(), err)
+
+			// There's no point trying a storage container removal
+			// here. High likelihood it doesn't work
+			// (RemoveStorageContainer will refuse to remove if a
+			// container exists in the Libpod database) and, even if
+			// it would, we'll get the container later on during
+			// image removal.
 		}
 	}
 
@@ -133,11 +159,7 @@ func (r *Runtime) reset(ctx context.Context) error {
 		logrus.Errorf("Stopping pause process: %v", err)
 	}
 
-	rmiOptions := &libimage.RemoveImagesOptions{Filters: []string{"readonly=false"}}
-	if _, rmiErrors := r.LibimageRuntime().RemoveImages(ctx, nil, rmiOptions); rmiErrors != nil {
-		return errorhandling.JoinErrors(rmiErrors)
-	}
-
+	// Volumes before images, as volumes can mount images.
 	volumes, err := r.state.AllVolumes()
 	if err != nil {
 		return err
@@ -151,6 +173,19 @@ func (r *Runtime) reset(ctx context.Context) error {
 		}
 	}
 
+	// Set force and ignore.
+	// Ignore shouldn't be necessary, but it seems safer. We want everything
+	// gone anyways...
+	rmiOptions := &libimage.RemoveImagesOptions{
+		Force:               true,
+		Ignore:              true,
+		RemoveContainerFunc: r.RemoveContainersForImageCallback(ctx),
+		Filters:             []string{"readonly=false"},
+	}
+	if _, rmiErrors := r.LibimageRuntime().RemoveImages(ctx, nil, rmiOptions); rmiErrors != nil {
+		return errorhandling.JoinErrors(rmiErrors)
+	}
+
 	// remove all networks
 	nets, err := r.network.NetworkList()
 	if err != nil {
@@ -241,5 +276,13 @@ func (r *Runtime) reset(ctx context.Context) error {
 		prevError = err
 	}
 
+	// Shut down the runtime, it's no longer usable after mass-deletion.
+	if err := r.Shutdown(false); err != nil {
+		if prevError != nil {
+			logrus.Error(prevError)
+		}
+		prevError = err
+	}
+
 	return prevError
 }
diff --git a/vendor/github.com/containers/podman/v4/libpod/runtime.go b/vendor/github.com/containers/podman/v4/libpod/runtime.go
index 8af18648..986e40f6 100644
--- a/vendor/github.com/containers/podman/v4/libpod/runtime.go
+++ b/vendor/github.com/containers/podman/v4/libpod/runtime.go
@@ -90,22 +90,21 @@ type Runtime struct {
 	// This bool is just needed so that we can set it for netavark interface.
 	syslog bool
 
-	// doReset indicates that the runtime should perform a system reset.
-	// All Podman files will be removed.
+	// doReset indicates that the runtime will perform a system reset.
+	// A reset will remove all containers, pods, volumes, networks, etc.
+	// A number of validation checks are relaxed, or replaced with logic to
+	// remove as much of the runtime as possible if they fail. This ensures
+	// that even a broken Libpod can still be removed via `system reset`.
+	// This does not actually perform a `system reset`. That is done by
+	// calling "Reset()" on the returned runtime.
 	doReset bool
-
-	// doRenumber indicates that the runtime should perform a lock renumber
-	// during initialization.
-	// Once the runtime has been initialized and returned, this variable is
-	// unused.
+	// doRenumber indicates that the runtime will perform a system renumber.
+	// A renumber will reassign lock numbers for all containers, pods, etc.
+	// This will not perform the renumber itself, but will ignore some
+	// errors related to lock initialization so a renumber can be performed
+	// if something has gone wrong.
 	doRenumber bool
 
-	doMigrate bool
-	// System migrate can move containers to a new runtime.
-	// We make no promises that these migrated containers work on the new
-	// runtime, though.
-	migrateRuntime string
-
 	// valid indicates whether the runtime is ready to use.
 	// valid is set to true when a runtime is returned from GetRuntime(),
 	// and remains true until the runtime is shut down (rendering its
@@ -233,11 +232,6 @@ func newRuntimeFromConfig(conf *config.Config, options ...RuntimeOption) (*Runti
 
 	runtime.config.CheckCgroupsAndAdjustConfig()
 
-	// If resetting storage, do *not* return a runtime.
-	if runtime.doReset {
-		return nil, nil
-	}
-
 	return runtime, nil
 }
 
@@ -563,9 +557,8 @@ func makeRuntime(runtime *Runtime) (retErr error) {
 	// We now need to see if the system has restarted
 	// We check for the presence of a file in our tmp directory to verify this
 	// This check must be locked to prevent races
-	runtimeAliveLock := filepath.Join(runtime.config.Engine.TmpDir, "alive.lck")
 	runtimeAliveFile := filepath.Join(runtime.config.Engine.TmpDir, "alive")
-	aliveLock, err := lockfile.GetLockFile(runtimeAliveLock)
+	aliveLock, err := runtime.getRuntimeAliveLock()
 	if err != nil {
 		return fmt.Errorf("acquiring runtime init lock: %w", err)
 	}
@@ -639,27 +632,6 @@ func makeRuntime(runtime *Runtime) (retErr error) {
 		return err
 	}
 
-	// If we're resetting storage, do it now.
-	// We will not return a valid runtime.
-	// TODO: Plumb this context out so it can be set.
-	if runtime.doReset {
-		// Mark the runtime as valid, so normal functionality "mostly"
-		// works and we can use regular functions to remove
-		// ctrs/pods/etc
-		runtime.valid = true
-
-		return runtime.reset(context.Background())
-	}
-
-	// If we're renumbering locks, do it now.
-	// It breaks out of normal runtime init, and will not return a valid
-	// runtime.
-	if runtime.doRenumber {
-		if err := runtime.renumberLocks(); err != nil {
-			return err
-		}
-	}
-
 	// If we need to refresh the state, do it now - things are guaranteed to
 	// be set up by now.
 	if doRefresh {
@@ -681,12 +653,6 @@ func makeRuntime(runtime *Runtime) (retErr error) {
 	// further
 	runtime.valid = true
 
-	if runtime.doMigrate {
-		if err := runtime.migrate(); err != nil {
-			return err
-		}
-	}
-
 	return nil
 }
 
@@ -1195,6 +1161,11 @@ func (r *Runtime) graphRootMountedFlag(mounts []spec.Mount) string {
 	return ""
 }
 
+// Returns a copy of the runtime alive lock
+func (r *Runtime) getRuntimeAliveLock() (*lockfile.LockFile, error) {
+	return lockfile.GetLockFile(filepath.Join(r.config.Engine.TmpDir, "alive.lck"))
+}
+
 // Network returns the network interface which is used by the runtime
 func (r *Runtime) Network() nettypes.ContainerNetwork {
 	return r.network
diff --git a/vendor/github.com/containers/podman/v4/libpod/runtime_migrate_linux.go b/vendor/github.com/containers/podman/v4/libpod/runtime_migrate_linux.go
index 717b123b..8a3793b8 100644
--- a/vendor/github.com/containers/podman/v4/libpod/runtime_migrate_linux.go
+++ b/vendor/github.com/containers/podman/v4/libpod/runtime_migrate_linux.go
@@ -43,7 +43,24 @@ func (r *Runtime) stopPauseProcess() error {
 	return nil
 }
 
-func (r *Runtime) migrate() error {
+// Migrate stops the rootless pause process and performs any necessary database
+// migrations that are required. It can also migrate all containers to a new OCI
+// runtime, if requested.
+func (r *Runtime) Migrate(newRuntime string) error {
+	// Acquire the alive lock and hold it.
+	// Ensures that we don't let other Podman commands run while we are
+	// rewriting things in the DB.
+	aliveLock, err := r.getRuntimeAliveLock()
+	if err != nil {
+		return fmt.Errorf("retrieving alive lock: %w", err)
+	}
+	aliveLock.Lock()
+	defer aliveLock.Unlock()
+
+	if !r.valid {
+		return define.ErrRuntimeStopped
+	}
+
 	runningContainers, err := r.GetRunningContainers()
 	if err != nil {
 		return err
@@ -63,10 +80,14 @@ func (r *Runtime) migrate() error {
 	}
 
 	// Did the user request a new runtime?
-	runtimeChangeRequested := r.migrateRuntime != ""
-	requestedRuntime, runtimeExists := r.ociRuntimes[r.migrateRuntime]
-	if !runtimeExists && runtimeChangeRequested {
-		return fmt.Errorf("change to runtime %q requested but no such runtime is defined: %w", r.migrateRuntime, define.ErrInvalidArg)
+	runtimeChangeRequested := newRuntime != ""
+	var requestedRuntime OCIRuntime
+	if runtimeChangeRequested {
+		runtime, exists := r.ociRuntimes[newRuntime]
+		if !exists {
+			return fmt.Errorf("change to runtime %q requested but no such runtime is defined: %w", newRuntime, define.ErrInvalidArg)
+		}
+		requestedRuntime = runtime
 	}
 
 	for _, ctr := range allCtrs {
@@ -81,9 +102,9 @@ func (r *Runtime) migrate() error {
 		}
 
 		// Reset runtime
-		if runtimeChangeRequested {
-			logrus.Infof("Resetting container %s runtime to runtime %s", ctr.ID(), r.migrateRuntime)
-			ctr.config.OCIRuntime = r.migrateRuntime
+		if runtimeChangeRequested && ctr.config.OCIRuntime != newRuntime {
+			logrus.Infof("Resetting container %s runtime to runtime %s", ctr.ID(), newRuntime)
+			ctr.config.OCIRuntime = newRuntime
 			ctr.ociRuntime = requestedRuntime
 
 			needsWrite = true
diff --git a/vendor/github.com/containers/podman/v4/libpod/runtime_migrate_unsupported.go b/vendor/github.com/containers/podman/v4/libpod/runtime_migrate_unsupported.go
index 0a1b0b9f..af6e05c6 100644
--- a/vendor/github.com/containers/podman/v4/libpod/runtime_migrate_unsupported.go
+++ b/vendor/github.com/containers/podman/v4/libpod/runtime_migrate_unsupported.go
@@ -11,6 +11,6 @@ func (r *Runtime) stopPauseProcess() error {
 	return errors.New("not implemented (*Runtime) stopPauseProcess")
 }
 
-func (r *Runtime) migrate() error {
+func (r *Runtime) Migrate(newRuntime string) error {
 	return errors.New("not implemented (*Runtime) migrate")
 }
diff --git a/vendor/github.com/containers/podman/v4/libpod/runtime_renumber.go b/vendor/github.com/containers/podman/v4/libpod/runtime_renumber.go
index d4eaddaf..f4d6c431 100644
--- a/vendor/github.com/containers/podman/v4/libpod/runtime_renumber.go
+++ b/vendor/github.com/containers/podman/v4/libpod/runtime_renumber.go
@@ -6,18 +6,34 @@ package libpod
 import (
 	"fmt"
 
+	"github.com/containers/podman/v4/libpod/define"
 	"github.com/containers/podman/v4/libpod/events"
 )
 
-// renumberLocks reassigns lock numbers for all containers and pods in the
-// state.
-// TODO: It would be desirable to make it impossible to call this until all
-// other libpod sessions are dead.
-// Possibly use a read-write file lock, with all non-renumber podmans owning the
-// lock as read, renumber attempting to take a write lock?
-// The alternative is some sort of session tracking, and I don't know how
-// reliable that can be.
-func (r *Runtime) renumberLocks() error {
+// RenumberLocks reassigns lock numbers for all containers and pods in the
+// state. This should NOT be run while there are other Libpod
+func (r *Runtime) RenumberLocks() error {
+	// TODO: It would be desirable to make it impossible to call this until all
+	// other libpod sessions are dead.
+	// Possibly use a read-write file lock, with all non-renumber podmans owning the
+	// lock as read, renumber attempting to take a write lock?
+	// The alternative is some sort of session tracking, and I don't know how
+	// reliable that can be.
+
+	// Acquire the alive lock and hold it.
+	// Ensures that we don't let other Podman commands run while we are
+	// changing around lock numbers.
+	aliveLock, err := r.getRuntimeAliveLock()
+	if err != nil {
+		return fmt.Errorf("retrieving alive lock: %w", err)
+	}
+	aliveLock.Lock()
+	defer aliveLock.Unlock()
+
+	if !r.valid {
+		return define.ErrRuntimeStopped
+	}
+
 	// Start off by deallocating all locks
 	if err := r.lockManager.FreeAllLocks(); err != nil {
 		return err
@@ -77,5 +93,5 @@ func (r *Runtime) renumberLocks() error {
 
 	r.NewSystemEvent(events.Renumber)
 
-	return nil
+	return r.Shutdown(false)
 }
diff --git a/vendor/github.com/containers/podman/v4/pkg/domain/entities/engine.go b/vendor/github.com/containers/podman/v4/pkg/domain/entities/engine.go
index 6c7f0abb..60091319 100644
--- a/vendor/github.com/containers/podman/v4/pkg/domain/entities/engine.go
+++ b/vendor/github.com/containers/podman/v4/pkg/domain/entities/engine.go
@@ -14,12 +14,6 @@ type EngineSetup string
 const (
 	ABIMode    = EngineMode("abi")
 	TunnelMode = EngineMode("tunnel")
-
-	MigrateMode  = EngineSetup("migrate")
-	NoFDsMode    = EngineSetup("disablefds")
-	NormalMode   = EngineSetup("normal")
-	RenumberMode = EngineSetup("renumber")
-	ResetMode    = EngineSetup("reset")
 )
 
 // Convert EngineMode to String
@@ -42,6 +36,8 @@ type PodmanConfig struct {
 	EngineMode               EngineMode     // ABI or Tunneling mode
 	HooksDir                 []string
 	Identity                 string   // ssh identity for connecting to server
+	IsRenumber               bool     // Is this a system renumber command? If so, a number of checks will be relaxed
+	IsReset                  bool     // Is this a system reset command? If so, a number of checks will be skipped/omitted
 	MaxWorks                 int      // maximum number of parallel threads
 	MemoryProfile            string   // Hidden: Should memory profile be taken
 	RegistriesConf           string   // allows for specifying a custom registries.conf
diff --git a/vendor/github.com/containers/podman/v4/pkg/domain/entities/engine_container.go b/vendor/github.com/containers/podman/v4/pkg/domain/entities/engine_container.go
index 1ae819c5..e697b601 100644
--- a/vendor/github.com/containers/podman/v4/pkg/domain/entities/engine_container.go
+++ b/vendor/github.com/containers/podman/v4/pkg/domain/entities/engine_container.go
@@ -63,6 +63,7 @@ type ContainerEngine interface { //nolint:interfacebloat
 	Info(ctx context.Context) (*define.Info, error)
 	KubeApply(ctx context.Context, body io.Reader, opts ApplyOptions) error
 	Locks(ctx context.Context) (*LocksReport, error)
+	Migrate(ctx context.Context, options SystemMigrateOptions) error
 	NetworkConnect(ctx context.Context, networkname string, options NetworkConnectOptions) error
 	NetworkCreate(ctx context.Context, network types.Network, createOptions *types.NetworkCreateOptions) (*types.Network, error)
 	NetworkUpdate(ctx context.Context, networkname string, options NetworkUpdateOptions) error
@@ -91,6 +92,8 @@ type ContainerEngine interface { //nolint:interfacebloat
 	PodStop(ctx context.Context, namesOrIds []string, options PodStopOptions) ([]*PodStopReport, error)
 	PodTop(ctx context.Context, options PodTopOptions) (*StringSliceReport, error)
 	PodUnpause(ctx context.Context, namesOrIds []string, options PodunpauseOptions) ([]*PodUnpauseReport, error)
+	Renumber(ctx context.Context) error
+	Reset(ctx context.Context) error
 	SetupRootless(ctx context.Context, noMoveProcess bool) error
 	SecretCreate(ctx context.Context, name string, reader io.Reader, options SecretCreateOptions) (*SecretCreateReport, error)
 	SecretInspect(ctx context.Context, nameOrIDs []string, options SecretInspectOptions) ([]*SecretInfoReport, []error, error)
diff --git a/vendor/github.com/containers/podman/v4/pkg/domain/entities/engine_image.go b/vendor/github.com/containers/podman/v4/pkg/domain/entities/engine_image.go
index 6702c3d1..fee4656f 100644
--- a/vendor/github.com/containers/podman/v4/pkg/domain/entities/engine_image.go
+++ b/vendor/github.com/containers/podman/v4/pkg/domain/entities/engine_image.go
@@ -45,6 +45,4 @@ type ImageEngine interface { //nolint:interfacebloat
 	FarmNodeName(ctx context.Context) string
 	FarmNodeDriver(ctx context.Context) string
 	FarmNodeInspect(ctx context.Context) (*FarmInspectReport, error)
-	PullToFile(ctx context.Context, options PullToFileOptions) (string, error)
-	PullToLocal(ctx context.Context, options PullToLocalOptions) (string, error)
 }
diff --git a/vendor/github.com/containers/podman/v4/pkg/domain/entities/engine_system.go b/vendor/github.com/containers/podman/v4/pkg/domain/entities/engine_system.go
deleted file mode 100644
index a0ecfe9e..00000000
--- a/vendor/github.com/containers/podman/v4/pkg/domain/entities/engine_system.go
+++ /dev/null
@@ -1,14 +0,0 @@
-package entities
-
-import (
-	"context"
-
-	"github.com/spf13/pflag"
-)
-
-type SystemEngine interface {
-	Renumber(ctx context.Context, flags *pflag.FlagSet, config *PodmanConfig) error
-	Migrate(ctx context.Context, flags *pflag.FlagSet, config *PodmanConfig, options SystemMigrateOptions) error
-	Reset(ctx context.Context) error
-	Shutdown(ctx context.Context)
-}
diff --git a/vendor/github.com/containers/podman/v4/pkg/domain/entities/images.go b/vendor/github.com/containers/podman/v4/pkg/domain/entities/images.go
index b0bd43a5..45cebb55 100644
--- a/vendor/github.com/containers/podman/v4/pkg/domain/entities/images.go
+++ b/vendor/github.com/containers/podman/v4/pkg/domain/entities/images.go
@@ -492,19 +492,3 @@ type FarmInspectReport struct {
 	Arch              string
 	Variant           string
 }
-
-// PullToFileOptions are the options for pulling the images from farm
-// nodes into a dir
-type PullToFileOptions struct {
-	ImageID    string
-	SaveFormat string
-	SaveFile   string
-}
-
-// PullToLocalOptions are the options for pulling the images from farm
-// nodes into containers-storage
-type PullToLocalOptions struct {
-	ImageID     string
-	SaveFormat  string
-	Destination ImageEngine
-}
diff --git a/vendor/github.com/containers/podman/v4/pkg/domain/entities/types.go b/vendor/github.com/containers/podman/v4/pkg/domain/entities/types.go
index 5de661c1..6cf354a8 100644
--- a/vendor/github.com/containers/podman/v4/pkg/domain/entities/types.go
+++ b/vendor/github.com/containers/podman/v4/pkg/domain/entities/types.go
@@ -131,6 +131,10 @@ type BuildReport struct {
 type FarmBuildOptions struct {
 	// Cleanup removes built images from farm nodes on success
 	Cleanup bool
+	// Authfile is the path to the file holding registry credentials
+	Authfile string
+	// SkipTLSVerify skips tls verification when set to true
+	SkipTLSVerify bool
 }
 
 type IDOrNameResponse struct {
diff --git a/vendor/github.com/containers/podman/v4/pkg/domain/infra/abi/farm.go b/vendor/github.com/containers/podman/v4/pkg/domain/infra/abi/farm.go
index c7e103bb..b4b47dd3 100644
--- a/vendor/github.com/containers/podman/v4/pkg/domain/infra/abi/farm.go
+++ b/vendor/github.com/containers/podman/v4/pkg/domain/infra/abi/farm.go
@@ -6,12 +6,10 @@ package abi
 import (
 	"context"
 	"fmt"
-	"os"
 	"strings"
 
 	"github.com/containers/buildah/pkg/parse"
 	lplatform "github.com/containers/common/libimage/platform"
-	istorage "github.com/containers/image/v5/storage"
 	"github.com/containers/podman/v4/pkg/domain/entities"
 	"github.com/containers/podman/v4/pkg/emulation"
 )
@@ -57,64 +55,3 @@ func (ir *ImageEngine) FarmNodeInspect(ctx context.Context) (*entities.FarmInspe
 		Arch:              ir.arch,
 		Variant:           ir.variant}, ir.platformsErr
 }
-
-// PullToFile pulls the image from the remote engine and saves it to a file,
-// returning a string-format reference which can be parsed by containers/image.
-func (ir *ImageEngine) PullToFile(ctx context.Context, options entities.PullToFileOptions) (reference string, err error) {
-	saveOptions := entities.ImageSaveOptions{
-		Format: options.SaveFormat,
-		Output: options.SaveFile,
-	}
-	if err := ir.Save(ctx, options.ImageID, nil, saveOptions); err != nil {
-		return "", fmt.Errorf("saving image %q: %w", options.ImageID, err)
-	}
-	return options.SaveFormat + ":" + options.SaveFile, nil
-}
-
-// PullToFile pulls the image from the remote engine and saves it to the local
-// engine passed in via options, returning a string-format reference which can
-// be parsed by containers/image.
-func (ir *ImageEngine) PullToLocal(ctx context.Context, options entities.PullToLocalOptions) (reference string, err error) {
-	destination := options.Destination
-	if destination == nil {
-		return "", fmt.Errorf("destination not given, cannot pull image %q", options.ImageID)
-	}
-
-	// Check if the image is already present at destination
-	var br *entities.BoolReport
-	br, err = destination.Exists(ctx, options.ImageID)
-	if err != nil {
-		return "", err
-	}
-	if br.Value {
-		return istorage.Transport.Name() + ":" + options.ImageID, nil
-	}
-
-	tempFile, err := os.CreateTemp("", "")
-	if err != nil {
-		return "", err
-	}
-	defer os.Remove(tempFile.Name())
-	defer tempFile.Close()
-
-	saveOptions := entities.ImageSaveOptions{
-		Format: options.SaveFormat,
-		Output: tempFile.Name(),
-	}
-	// Save image built on builder in a temp file
-	if err := ir.Save(ctx, options.ImageID, nil, saveOptions); err != nil {
-		return "", fmt.Errorf("saving image %q: %w", options.ImageID, err)
-	}
-
-	// Load the image saved in tempFile into the local engine
-	loadOptions := entities.ImageLoadOptions{
-		Input: tempFile.Name(),
-	}
-
-	_, err = destination.Load(ctx, loadOptions)
-	if err != nil {
-		return "", err
-	}
-
-	return istorage.Transport.Name() + ":" + options.ImageID, nil
-}
diff --git a/vendor/github.com/containers/podman/v4/pkg/domain/infra/abi/images.go b/vendor/github.com/containers/podman/v4/pkg/domain/infra/abi/images.go
index 16b2f92c..6c06d68a 100644
--- a/vendor/github.com/containers/podman/v4/pkg/domain/infra/abi/images.go
+++ b/vendor/github.com/containers/podman/v4/pkg/domain/infra/abi/images.go
@@ -39,6 +39,8 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
+const UnknownDigestSuffix = docker.UnknownDigestSuffix
+
 func (ir *ImageEngine) Exists(_ context.Context, nameOrID string) (*entities.BoolReport, error) {
 	exists, err := ir.Libpod.LibimageRuntime().Exists(nameOrID)
 	if err != nil {
diff --git a/vendor/github.com/containers/podman/v4/pkg/domain/infra/abi/system.go b/vendor/github.com/containers/podman/v4/pkg/domain/infra/abi/system.go
index 4d2f8c30..f212de5b 100644
--- a/vendor/github.com/containers/podman/v4/pkg/domain/infra/abi/system.go
+++ b/vendor/github.com/containers/podman/v4/pkg/domain/infra/abi/system.go
@@ -21,7 +21,6 @@ import (
 	"github.com/containers/storage/pkg/directory"
 	"github.com/containers/storage/pkg/unshare"
 	"github.com/sirupsen/logrus"
-	"github.com/spf13/pflag"
 )
 
 func (ic *ContainerEngine) Info(ctx context.Context) (*define.Info, error) {
@@ -370,16 +369,16 @@ func (ic *ContainerEngine) SystemDf(ctx context.Context, options entities.System
 	}, nil
 }
 
-func (se *SystemEngine) Reset(ctx context.Context) error {
-	return nil
+func (ic *ContainerEngine) Reset(ctx context.Context) error {
+	return ic.Libpod.Reset(ctx)
 }
 
-func (se *SystemEngine) Renumber(ctx context.Context, flags *pflag.FlagSet, config *entities.PodmanConfig) error {
-	return nil
+func (ic *ContainerEngine) Renumber(ctx context.Context) error {
+	return ic.Libpod.RenumberLocks()
 }
 
-func (se SystemEngine) Migrate(ctx context.Context, flags *pflag.FlagSet, config *entities.PodmanConfig, options entities.SystemMigrateOptions) error {
-	return nil
+func (ic *ContainerEngine) Migrate(ctx context.Context, options entities.SystemMigrateOptions) error {
+	return ic.Libpod.Migrate(options.NewRuntime)
 }
 
 func (se SystemEngine) Shutdown(ctx context.Context) {
diff --git a/vendor/github.com/containers/podman/v4/pkg/domain/infra/runtime_abi.go b/vendor/github.com/containers/podman/v4/pkg/domain/infra/runtime_abi.go
index 7f9b177d..1f9c8170 100644
--- a/vendor/github.com/containers/podman/v4/pkg/domain/infra/runtime_abi.go
+++ b/vendor/github.com/containers/podman/v4/pkg/domain/infra/runtime_abi.go
@@ -7,10 +7,8 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/containers/podman/v4/libpod"
 	"github.com/containers/podman/v4/pkg/bindings"
 	"github.com/containers/podman/v4/pkg/domain/entities"
-	"github.com/containers/podman/v4/pkg/domain/infra/abi"
 	"github.com/containers/podman/v4/pkg/domain/infra/tunnel"
 )
 
@@ -43,32 +41,3 @@ func NewImageEngine(facts *entities.PodmanConfig) (entities.ImageEngine, error)
 	}
 	return nil, fmt.Errorf("runtime mode '%v' is not supported", facts.EngineMode)
 }
-
-// NewSystemEngine factory provides a libpod runtime for specialized system operations
-func NewSystemEngine(setup entities.EngineSetup, facts *entities.PodmanConfig) (entities.SystemEngine, error) {
-	switch facts.EngineMode {
-	case entities.ABIMode:
-		var r *libpod.Runtime
-		var err error
-		switch setup {
-		case entities.NormalMode:
-			r, err = GetRuntime(context.Background(), facts.FlagSet, facts)
-		case entities.RenumberMode:
-			r, err = GetRuntimeRenumber(context.Background(), facts.FlagSet, facts)
-		case entities.ResetMode:
-			r, err = GetRuntimeReset(context.Background(), facts.FlagSet, facts)
-		case entities.MigrateMode:
-			name, flagErr := facts.FlagSet.GetString("new-runtime")
-			if flagErr != nil {
-				return nil, flagErr
-			}
-			r, err = GetRuntimeMigrate(context.Background(), facts.FlagSet, facts, name)
-		case entities.NoFDsMode:
-			r, err = GetRuntimeDisableFDs(context.Background(), facts.FlagSet, facts)
-		}
-		return &abi.SystemEngine{Libpod: r}, err
-	case entities.TunnelMode:
-		return nil, fmt.Errorf("tunnel system runtime not supported")
-	}
-	return nil, fmt.Errorf("runtime mode '%v' is not supported", facts.EngineMode)
-}
diff --git a/vendor/github.com/containers/podman/v4/pkg/domain/infra/runtime_abi_unsupported.go b/vendor/github.com/containers/podman/v4/pkg/domain/infra/runtime_abi_unsupported.go
deleted file mode 100644
index 9e5bd01e..00000000
--- a/vendor/github.com/containers/podman/v4/pkg/domain/infra/runtime_abi_unsupported.go
+++ /dev/null
@@ -1,15 +0,0 @@
-//go:build remote
-// +build remote
-
-package infra
-
-import (
-	"errors"
-
-	"github.com/containers/podman/v4/pkg/domain/entities"
-)
-
-// NewSystemEngine factory provides a libpod runtime for specialized system operations
-func NewSystemEngine(setup entities.EngineSetup, facts *entities.PodmanConfig) (entities.SystemEngine, error) {
-	return nil, errors.New("not implemented")
-}
diff --git a/vendor/github.com/containers/podman/v4/pkg/domain/infra/runtime_libpod.go b/vendor/github.com/containers/podman/v4/pkg/domain/infra/runtime_libpod.go
index 52c882b8..fa23bd4d 100644
--- a/vendor/github.com/containers/podman/v4/pkg/domain/infra/runtime_libpod.go
+++ b/vendor/github.com/containers/podman/v4/pkg/domain/infra/runtime_libpod.go
@@ -34,61 +34,21 @@ var (
 )
 
 type engineOpts struct {
-	name     string
-	renumber bool
-	migrate  bool
 	noStore  bool
 	withFDS  bool
 	reset    bool
+	renumber bool
 	config   *entities.PodmanConfig
 }
 
-// GetRuntimeMigrate gets a libpod runtime that will perform a migration of existing containers
-func GetRuntimeMigrate(ctx context.Context, fs *flag.FlagSet, cfg *entities.PodmanConfig, newRuntime string) (*libpod.Runtime, error) {
-	return getRuntime(ctx, fs, &engineOpts{
-		name:     newRuntime,
-		renumber: false,
-		migrate:  true,
-		noStore:  false,
-		withFDS:  true,
-		reset:    false,
-		config:   cfg,
-	})
-}
-
-// GetRuntimeDisableFDs gets a libpod runtime that will disable sd notify
-func GetRuntimeDisableFDs(ctx context.Context, fs *flag.FlagSet, cfg *entities.PodmanConfig) (*libpod.Runtime, error) {
-	return getRuntime(ctx, fs, &engineOpts{
-		renumber: false,
-		migrate:  false,
-		noStore:  false,
-		withFDS:  false,
-		reset:    false,
-		config:   cfg,
-	})
-}
-
-// GetRuntimeRenumber gets a libpod runtime that will perform a lock renumber
-func GetRuntimeRenumber(ctx context.Context, fs *flag.FlagSet, cfg *entities.PodmanConfig) (*libpod.Runtime, error) {
-	return getRuntime(ctx, fs, &engineOpts{
-		renumber: true,
-		migrate:  false,
-		noStore:  false,
-		withFDS:  true,
-		reset:    false,
-		config:   cfg,
-	})
-}
-
 // GetRuntime generates a new libpod runtime configured by command line options
 func GetRuntime(ctx context.Context, flags *flag.FlagSet, cfg *entities.PodmanConfig) (*libpod.Runtime, error) {
 	runtimeSync.Do(func() {
 		runtimeLib, runtimeErr = getRuntime(ctx, flags, &engineOpts{
-			renumber: false,
-			migrate:  false,
 			noStore:  false,
 			withFDS:  true,
-			reset:    false,
+			reset:    cfg.IsReset,
+			renumber: cfg.IsRenumber,
 			config:   cfg,
 		})
 	})
@@ -98,23 +58,10 @@ func GetRuntime(ctx context.Context, flags *flag.FlagSet, cfg *entities.PodmanCo
 // GetRuntimeNoStore generates a new libpod runtime configured by command line options
 func GetRuntimeNoStore(ctx context.Context, fs *flag.FlagSet, cfg *entities.PodmanConfig) (*libpod.Runtime, error) {
 	return getRuntime(ctx, fs, &engineOpts{
-		renumber: false,
-		migrate:  false,
-		noStore:  true,
-		withFDS:  true,
-		reset:    false,
-		config:   cfg,
-	})
-}
-
-func GetRuntimeReset(ctx context.Context, fs *flag.FlagSet, cfg *entities.PodmanConfig) (*libpod.Runtime, error) {
-	return getRuntime(ctx, fs, &engineOpts{
-		renumber: false,
-		migrate:  false,
-		noStore:  false,
-		withFDS:  true,
-		reset:    true,
-		config:   cfg,
+		noStore: true,
+		withFDS: true,
+		reset:   false,
+		config:  cfg,
 	})
 }
 
@@ -180,17 +127,10 @@ func getRuntime(ctx context.Context, fs *flag.FlagSet, opts *engineOpts) (*libpo
 	if fs.Changed("transient-store") {
 		options = append(options, libpod.WithTransientStore(cfg.TransientStore))
 	}
-	if opts.migrate {
-		options = append(options, libpod.WithMigrate())
-		if opts.name != "" {
-			options = append(options, libpod.WithMigrateRuntime(opts.name))
-		}
-	}
 
 	if opts.reset {
 		options = append(options, libpod.WithReset())
 	}
-
 	if opts.renumber {
 		options = append(options, libpod.WithRenumber())
 	}
diff --git a/vendor/github.com/containers/podman/v4/pkg/domain/infra/tunnel/farm.go b/vendor/github.com/containers/podman/v4/pkg/domain/infra/tunnel/farm.go
index 811c5e43..1dbde317 100644
--- a/vendor/github.com/containers/podman/v4/pkg/domain/infra/tunnel/farm.go
+++ b/vendor/github.com/containers/podman/v4/pkg/domain/infra/tunnel/farm.go
@@ -2,11 +2,8 @@ package tunnel
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"os"
 
-	istorage "github.com/containers/image/v5/storage"
 	"github.com/containers/podman/v4/pkg/bindings/system"
 	"github.com/containers/podman/v4/pkg/domain/entities"
 )
@@ -47,47 +44,3 @@ func (ir *ImageEngine) FarmNodeInspect(ctx context.Context) (*entities.FarmInspe
 		Arch:    ir.arch,
 		Variant: ir.variant}, ir.platformsErr
 }
-
-// PullToFile pulls the image from the remote engine and saves it to a file,
-// returning a string-format reference which can be parsed by containers/image.
-func (ir *ImageEngine) PullToFile(ctx context.Context, options entities.PullToFileOptions) (reference string, err error) {
-	saveOptions := entities.ImageSaveOptions{
-		Format: options.SaveFormat,
-		Output: options.SaveFile,
-	}
-	if err := ir.Save(ctx, options.ImageID, nil, saveOptions); err != nil {
-		return "", fmt.Errorf("saving image %q: %w", options.ImageID, err)
-	}
-	return options.SaveFormat + ":" + options.SaveFile, nil
-}
-
-// PullToLocal pulls the image from the remote engine and saves it to the local
-// engine passed in via options, returning a string-format reference which can
-// be parsed by containers/image.
-func (ir *ImageEngine) PullToLocal(ctx context.Context, options entities.PullToLocalOptions) (reference string, err error) {
-	tempFile, err := os.CreateTemp("", "")
-	if err != nil {
-		return "", err
-	}
-	defer os.Remove(tempFile.Name())
-	defer tempFile.Close()
-	saveOptions := entities.ImageSaveOptions{
-		Format: options.SaveFormat,
-		Output: tempFile.Name(),
-	}
-	if err := ir.Save(ctx, options.ImageID, nil, saveOptions); err != nil {
-		return "", fmt.Errorf("saving image %q to temporary file: %w", options.ImageID, err)
-	}
-	loadOptions := entities.ImageLoadOptions{
-		Input: tempFile.Name(),
-	}
-	if options.Destination == nil {
-		return "", errors.New("internal error: options.Destination not set")
-	} else {
-		if _, err = options.Destination.Load(ctx, loadOptions); err != nil {
-			return "", fmt.Errorf("loading image %q: %w", options.ImageID, err)
-		}
-	}
-	name := fmt.Sprintf("%s:%s", istorage.Transport.Name(), options.ImageID)
-	return name, err
-}
diff --git a/vendor/github.com/containers/podman/v4/pkg/domain/infra/tunnel/system.go b/vendor/github.com/containers/podman/v4/pkg/domain/infra/tunnel/system.go
index 7096c2cc..fc82e7b2 100644
--- a/vendor/github.com/containers/podman/v4/pkg/domain/infra/tunnel/system.go
+++ b/vendor/github.com/containers/podman/v4/pkg/domain/infra/tunnel/system.go
@@ -23,6 +23,18 @@ func (ic *ContainerEngine) SystemPrune(ctx context.Context, opts entities.System
 	return system.Prune(ic.ClientCtx, options)
 }
 
+func (ic *ContainerEngine) Migrate(ctx context.Context, options entities.SystemMigrateOptions) error {
+	return errors.New("runtime migration is not supported on remote clients")
+}
+
+func (ic *ContainerEngine) Renumber(ctx context.Context) error {
+	return errors.New("lock renumbering is not supported on remote clients")
+}
+
+func (ic *ContainerEngine) Reset(ctx context.Context) error {
+	return errors.New("system reset is not supported on remote clients")
+}
+
 func (ic *ContainerEngine) SystemDf(ctx context.Context, options entities.SystemDfOptions) (*entities.SystemDfReport, error) {
 	return system.DiskUsage(ic.ClientCtx, nil)
 }
diff --git a/vendor/github.com/containers/podman/v4/version/rawversion/version.go b/vendor/github.com/containers/podman/v4/version/rawversion/version.go
index c4c68323..e18dcf6e 100644
--- a/vendor/github.com/containers/podman/v4/version/rawversion/version.go
+++ b/vendor/github.com/containers/podman/v4/version/rawversion/version.go
@@ -7,4 +7,4 @@ package rawversion
 //
 // NOTE: remember to bump the version at the top of the top-level README.md
 // file when this is bumped.
-const RawVersion = "4.8.3"
+const RawVersion = "4.9.0"
diff --git a/vendor/golang.org/x/sync/errgroup/errgroup.go b/vendor/golang.org/x/sync/errgroup/errgroup.go
index b18efb74..948a3ee6 100644
--- a/vendor/golang.org/x/sync/errgroup/errgroup.go
+++ b/vendor/golang.org/x/sync/errgroup/errgroup.go
@@ -4,6 +4,9 @@
 
 // Package errgroup provides synchronization, error propagation, and Context
 // cancelation for groups of goroutines working on subtasks of a common task.
+//
+// [errgroup.Group] is related to [sync.WaitGroup] but adds handling of tasks
+// returning errors.
 package errgroup
 
 import (
diff --git a/vendor/modules.txt b/vendor/modules.txt
index d98995ba..c2198c4e 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -111,7 +111,7 @@ github.com/containernetworking/cni/pkg/version
 # github.com/containernetworking/plugins v1.3.0
 ## explicit; go 1.20
 github.com/containernetworking/plugins/pkg/ns
-# github.com/containers/buildah v1.33.2
+# github.com/containers/buildah v1.33.3
 ## explicit; go 1.20
 github.com/containers/buildah
 github.com/containers/buildah/bind
@@ -288,7 +288,7 @@ github.com/containers/ocicrypt/keywrap/pkcs7
 github.com/containers/ocicrypt/spec
 github.com/containers/ocicrypt/utils
 github.com/containers/ocicrypt/utils/keyprovider
-# github.com/containers/podman/v4 v4.8.3
+# github.com/containers/podman/v4 v4.9.0
 ## explicit; go 1.18
 github.com/containers/podman/v4/cmd/podman/parse
 github.com/containers/podman/v4/cmd/podman/registry
@@ -953,7 +953,7 @@ golang.org/x/net/trace
 golang.org/x/oauth2
 golang.org/x/oauth2/clientcredentials
 golang.org/x/oauth2/internal
-# golang.org/x/sync v0.5.0
+# golang.org/x/sync v0.6.0
 ## explicit; go 1.18
 golang.org/x/sync/errgroup
 golang.org/x/sync/semaphore