Migrate pkg/container to io.Medium abstraction (#292)

* chore(io): migrate pkg/container to Medium abstraction

Migrated State, Templates, and LinuxKitManager in pkg/container to use
the io.Medium abstraction for storage operations.

- Introduced TemplateManager struct to handle template logic with injected medium.
- Updated State struct to use injected medium for persistence.
- Updated LinuxKitManager to hold and use an io.Medium instance.
- Updated all internal callers in internal/cmd/vm and pkg/devops to use new APIs.
- Adapted and maintained comprehensive test coverage in linuxkit_test.go.
- Fixed naming collision with standard io package by aliasing it as goio.

* chore(io): migrate pkg/container to Medium abstraction (v2)

- Migrated State, Templates, and LinuxKitManager in pkg/container to use io.Medium.
- Introduced TemplateManager struct for dependency injection.
- Updated all call sites in internal/cmd/vm and pkg/devops.
- Restored and adapted comprehensive test suite in linuxkit_test.go.
- Fixed naming collisions and followed project test naming conventions.

* chore(io): address PR feedback for container Medium migration

- Added Open method to io.Medium interface to support log streaming.
- Implemented Open in local.Medium and MockMedium.
- Fixed extension inconsistency in GetTemplate (.yml vs .yaml).
- Refactored TemplateManager to use configurable WorkingDir and HomeDir.
- Reused TemplateManager instance in cmd_templates.go.
- Updated LinuxKitManager to use medium.Open for log access.
- Maintained and updated all tests to verify these improvements.

internal/cmd/vm/cmd_container.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io"
+	goio "io"
 	"os"
 	"strings"
 	"text/tabwriter"
@@ -12,6 +12,7 @@ import (
 
 	"github.com/host-uk/core/pkg/container"
 	"github.com/host-uk/core/pkg/i18n"
+	"github.com/host-uk/core/pkg/io"
 	"github.com/spf13/cobra"
 )
 
@@ -68,7 +69,7 @@ func addVMRunCommand(parent *cobra.Command) {
 }
 
 func runContainer(image, name string, detach bool, memory, cpus, sshPort int) error {
-	manager, err := container.NewLinuxKitManager()
+	manager, err := container.NewLinuxKitManager(io.Local)
 	if err != nil {
 		return fmt.Errorf(i18n.T("i18n.fail.init", "container manager")+": %w", err)
 	}
@@ -126,7 +127,7 @@ func addVMPsCommand(parent *cobra.Command) {
 }
 
 func listContainers(all bool) error {
-	manager, err := container.NewLinuxKitManager()
+	manager, err := container.NewLinuxKitManager(io.Local)
 	if err != nil {
 		return fmt.Errorf(i18n.T("i18n.fail.init", "container manager")+": %w", err)
 	}
@@ -221,7 +222,7 @@ func addVMStopCommand(parent *cobra.Command) {
 }
 
 func stopContainer(id string) error {
-	manager, err := container.NewLinuxKitManager()
+	manager, err := container.NewLinuxKitManager(io.Local)
 	if err != nil {
 		return fmt.Errorf(i18n.T("i18n.fail.init", "container manager")+": %w", err)
 	}
@@ -290,7 +291,7 @@ func addVMLogsCommand(parent *cobra.Command) {
 }
 
 func viewLogs(id string, follow bool) error {
-	manager, err := container.NewLinuxKitManager()
+	manager, err := container.NewLinuxKitManager(io.Local)
 	if err != nil {
 		return fmt.Errorf(i18n.T("i18n.fail.init", "container manager")+": %w", err)
 	}
@@ -307,7 +308,7 @@ func viewLogs(id string, follow bool) error {
 	}
 	defer func() { _ = reader.Close() }()
 
-	_, err = io.Copy(os.Stdout, reader)
+	_, err = goio.Copy(os.Stdout, reader)
 	return err
 }
 
@@ -329,7 +330,7 @@ func addVMExecCommand(parent *cobra.Command) {
 }
 
 func execInContainer(id string, cmd []string) error {
-	manager, err := container.NewLinuxKitManager()
+	manager, err := container.NewLinuxKitManager(io.Local)
 	if err != nil {
 		return fmt.Errorf(i18n.T("i18n.fail.init", "container manager")+": %w", err)
 	}

internal/cmd/vm/cmd_templates.go

@@ -12,9 +12,12 @@ import (
 
 	"github.com/host-uk/core/pkg/container"
 	"github.com/host-uk/core/pkg/i18n"
+	"github.com/host-uk/core/pkg/io"
 	"github.com/spf13/cobra"
 )
 
+var templateManager = container.NewTemplateManager(io.Local)
+
 // addVMTemplatesCommand adds the 'templates' command under vm.
 func addVMTemplatesCommand(parent *cobra.Command) {
 	templatesCmd := &cobra.Command{
@@ -68,7 +71,7 @@ func addTemplatesVarsCommand(parent *cobra.Command) {
 }
 
 func listTemplates() error {
-	templates := container.ListTemplates()
+	templates := templateManager.ListTemplates()
 
 	if len(templates) == 0 {
 		fmt.Println(i18n.T("cmd.vm.templates.no_templates"))
@@ -99,7 +102,7 @@ func listTemplates() error {
 }
 
 func showTemplate(name string) error {
-	content, err := container.GetTemplate(name)
+	content, err := templateManager.GetTemplate(name)
 	if err != nil {
 		return err
 	}
@@ -111,7 +114,7 @@ func showTemplate(name string) error {
 }
 
 func showTemplateVars(name string) error {
-	content, err := container.GetTemplate(name)
+	content, err := templateManager.GetTemplate(name)
 	if err != nil {
 		return err
 	}
@@ -148,7 +151,7 @@ func showTemplateVars(name string) error {
 // RunFromTemplate builds and runs a LinuxKit image from a template.
 func RunFromTemplate(templateName string, vars map[string]string, runOpts container.RunOptions) error {
 	// Apply template with variables
-	content, err := container.ApplyTemplate(templateName, vars)
+	content, err := templateManager.ApplyTemplate(templateName, vars)
 	if err != nil {
 		return fmt.Errorf(i18n.T("common.error.failed", map[string]any{"Action": "apply template"})+": %w", err)
 	}
@@ -185,7 +188,7 @@ func RunFromTemplate(templateName string, vars map[string]string, runOpts contai
 	fmt.Println()
 
 	// Run the image
-	manager, err := container.NewLinuxKitManager()
+	manager, err := container.NewLinuxKitManager(io.Local)
 	if err != nil {
 		return fmt.Errorf(i18n.T("common.error.failed", map[string]any{"Action": "initialize container manager"})+": %w", err)
 	}
@@ -196,7 +199,7 @@ func RunFromTemplate(templateName string, vars map[string]string, runOpts contai
 	ctx := context.Background()
 	c, err := manager.Run(ctx, imagePath, runOpts)
 	if err != nil {
-		return fmt.Errorf(i18n.T("common.error.failed", map[string]any{"Action": "run container"})+": %w", err)
+		return fmt.Errorf(i18n.T("i18n.fail.run", "container")+": %w", err)
 	}
 
 	if runOpts.Detach {

pkg/container/linuxkit.go

@@ -17,16 +17,17 @@ import (
 type LinuxKitManager struct {
 	state      *State
 	hypervisor Hypervisor
+	medium     io.Medium
 }
 
 // NewLinuxKitManager creates a new LinuxKit manager with auto-detected hypervisor.
-func NewLinuxKitManager() (*LinuxKitManager, error) {
+func NewLinuxKitManager(m io.Medium) (*LinuxKitManager, error) {
 	statePath, err := DefaultStatePath()
 	if err != nil {
 		return nil, fmt.Errorf("failed to determine state path: %w", err)
 	}
 
-	state, err := LoadState(statePath)
+	state, err := LoadState(m, statePath)
 	if err != nil {
 		return nil, fmt.Errorf("failed to load state: %w", err)
 	}
@@ -39,21 +40,23 @@ func NewLinuxKitManager() (*LinuxKitManager, error) {
 	return &LinuxKitManager{
 		state:      state,
 		hypervisor: hypervisor,
+		medium:     m,
 	}, nil
 }
 
 // NewLinuxKitManagerWithHypervisor creates a manager with a specific hypervisor.
-func NewLinuxKitManagerWithHypervisor(state *State, hypervisor Hypervisor) *LinuxKitManager {
+func NewLinuxKitManagerWithHypervisor(m io.Medium, state *State, hypervisor Hypervisor) *LinuxKitManager {
 	return &LinuxKitManager{
 		state:      state,
 		hypervisor: hypervisor,
+		medium:     m,
 	}
 }
 
 // Run starts a new LinuxKit VM from the given image.
 func (m *LinuxKitManager) Run(ctx context.Context, image string, opts RunOptions) (*Container, error) {
 	// Validate image exists
-	if !io.Local.IsFile(image) {
+	if !m.medium.IsFile(image) {
 		return nil, fmt.Errorf("image not found: %s", image)
 	}
 
@@ -87,7 +90,7 @@ func (m *LinuxKitManager) Run(ctx context.Context, image string, opts RunOptions
 	}
 
 	// Ensure logs directory exists
-	if err := EnsureLogsDir(); err != nil {
+	if err := EnsureLogsDir(m.medium); err != nil {
 		return nil, fmt.Errorf("failed to create logs directory: %w", err)
 	}
 
@@ -329,35 +332,36 @@ func (m *LinuxKitManager) Logs(ctx context.Context, id string, follow bool) (goi
 		return nil, fmt.Errorf("failed to determine log path: %w", err)
 	}
 
-	if !io.Local.IsFile(logPath) {
+	if !m.medium.IsFile(logPath) {
 		return nil, fmt.Errorf("no logs available for container: %s", id)
 	}
 
 	if !follow {
 		// Simple case: just open and return the file
-		return os.Open(logPath)
+		return m.medium.Open(logPath)
 	}
 
 	// Follow mode: create a reader that tails the file
-	return newFollowReader(ctx, logPath)
+	return newFollowReader(ctx, m.medium, logPath)
 }
 
 // followReader implements goio.ReadCloser for following log files.
 type followReader struct {
-	file   *os.File
+	file   goio.ReadCloser
 	ctx    context.Context
 	cancel context.CancelFunc
 	reader *bufio.Reader
+	medium io.Medium
+	path   string
 }
 
-func newFollowReader(ctx context.Context, path string) (*followReader, error) {
+func newFollowReader(ctx context.Context, m io.Medium, path string) (*followReader, error) {
-	file, err := os.Open(path)
+	file, err := m.Open(path)
 	if err != nil {
 		return nil, err
 	}
 
-	// Seek to end
+	// Note: We don't seek here because Medium.Open doesn't guarantee Seekability.
-	_, _ = file.Seek(0, goio.SeekEnd)
 
 	ctx, cancel := context.WithCancel(ctx)
 
@@ -366,6 +370,8 @@ func newFollowReader(ctx context.Context, path string) (*followReader, error) {
 		ctx:    ctx,
 		cancel: cancel,
 		reader: bufio.NewReader(file),
+		medium: m,
+		path:   path,
 	}, nil
 }
 

pkg/container/linuxkit_test.go

@@ -8,6 +8,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/host-uk/core/pkg/io"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -63,11 +64,11 @@ func newTestManager(t *testing.T) (*LinuxKitManager, *MockHypervisor, string) {
 
 	statePath := filepath.Join(tmpDir, "containers.json")
 
-	state, err := LoadState(statePath)
+	state, err := LoadState(io.Local, statePath)
 	require.NoError(t, err)
 
 	mock := NewMockHypervisor()
-	manager := NewLinuxKitManagerWithHypervisor(state, mock)
+	manager := NewLinuxKitManagerWithHypervisor(io.Local, state, mock)
 
 	return manager, mock, tmpDir
 }
@@ -75,10 +76,10 @@ func newTestManager(t *testing.T) (*LinuxKitManager, *MockHypervisor, string) {
 func TestNewLinuxKitManagerWithHypervisor_Good(t *testing.T) {
 	tmpDir := t.TempDir()
 	statePath := filepath.Join(tmpDir, "containers.json")
-	state, _ := LoadState(statePath)
+	state, _ := LoadState(io.Local, statePath)
 	mock := NewMockHypervisor()
 
-	manager := NewLinuxKitManagerWithHypervisor(state, mock)
+	manager := NewLinuxKitManagerWithHypervisor(io.Local, state, mock)
 
 	assert.NotNil(t, manager)
 	assert.Equal(t, state, manager.State())
@@ -213,9 +214,9 @@ func TestLinuxKitManager_Stop_Bad_NotFound(t *testing.T) {
 func TestLinuxKitManager_Stop_Bad_NotRunning(t *testing.T) {
 	_, _, tmpDir := newTestManager(t)
 	statePath := filepath.Join(tmpDir, "containers.json")
-	state, err := LoadState(statePath)
+	state, err := LoadState(io.Local, statePath)
 	require.NoError(t, err)
-	manager := NewLinuxKitManagerWithHypervisor(state, NewMockHypervisor())
+	manager := NewLinuxKitManagerWithHypervisor(io.Local, state, NewMockHypervisor())
 
 	container := &Container{
 		ID:     "abc12345",
@@ -233,9 +234,9 @@ func TestLinuxKitManager_Stop_Bad_NotRunning(t *testing.T) {
 func TestLinuxKitManager_List_Good(t *testing.T) {
 	_, _, tmpDir := newTestManager(t)
 	statePath := filepath.Join(tmpDir, "containers.json")
-	state, err := LoadState(statePath)
+	state, err := LoadState(io.Local, statePath)
 	require.NoError(t, err)
-	manager := NewLinuxKitManagerWithHypervisor(state, NewMockHypervisor())
+	manager := NewLinuxKitManagerWithHypervisor(io.Local, state, NewMockHypervisor())
 
 	_ = state.Add(&Container{ID: "aaa11111", Status: StatusStopped})
 	_ = state.Add(&Container{ID: "bbb22222", Status: StatusStopped})
@@ -250,9 +251,9 @@ func TestLinuxKitManager_List_Good(t *testing.T) {
 func TestLinuxKitManager_List_Good_VerifiesRunningStatus(t *testing.T) {
 	_, _, tmpDir := newTestManager(t)
 	statePath := filepath.Join(tmpDir, "containers.json")
-	state, err := LoadState(statePath)
+	state, err := LoadState(io.Local, statePath)
 	require.NoError(t, err)
-	manager := NewLinuxKitManagerWithHypervisor(state, NewMockHypervisor())
+	manager := NewLinuxKitManagerWithHypervisor(io.Local, state, NewMockHypervisor())
 
 	// Add a "running" container with a fake PID that doesn't exist
 	_ = state.Add(&Container{
@@ -475,7 +476,7 @@ func TestFollowReader_Read_Good_WithData(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
 	defer cancel()
 
-	reader, err := newFollowReader(ctx, logPath)
+	reader, err := newFollowReader(ctx, io.Local, logPath)
 	require.NoError(t, err)
 	defer func() { _ = reader.Close() }()
 
@@ -506,7 +507,7 @@ func TestFollowReader_Read_Good_ContextCancel(t *testing.T) {
 
 	ctx, cancel := context.WithCancel(context.Background())
 
-	reader, err := newFollowReader(ctx, logPath)
+	reader, err := newFollowReader(ctx, io.Local, logPath)
 	require.NoError(t, err)
 
 	// Cancel the context
@@ -528,7 +529,7 @@ func TestFollowReader_Close_Good(t *testing.T) {
 	require.NoError(t, err)
 
 	ctx := context.Background()
-	reader, err := newFollowReader(ctx, logPath)
+	reader, err := newFollowReader(ctx, io.Local, logPath)
 	require.NoError(t, err)
 
 	err = reader.Close()
@@ -542,7 +543,7 @@ func TestFollowReader_Close_Good(t *testing.T) {
 
 func TestNewFollowReader_Bad_FileNotFound(t *testing.T) {
 	ctx := context.Background()
-	_, err := newFollowReader(ctx, "/nonexistent/path/to/file.log")
+	_, err := newFollowReader(ctx, io.Local, "/nonexistent/path/to/file.log")
 
 	assert.Error(t, err)
 }
@@ -672,7 +673,7 @@ func TestLinuxKitManager_Run_Good_WithPortsAndVolumes(t *testing.T) {
 	time.Sleep(50 * time.Millisecond)
 }
 
-func TestFollowReader_Read_Good_ReaderError(t *testing.T) {
+func TestFollowReader_Read_Bad_ReaderError(t *testing.T) {
 	tmpDir := t.TempDir()
 	logPath := filepath.Join(tmpDir, "test.log")
 
@@ -681,7 +682,7 @@ func TestFollowReader_Read_Good_ReaderError(t *testing.T) {
 	require.NoError(t, err)
 
 	ctx := context.Background()
-	reader, err := newFollowReader(ctx, logPath)
+	reader, err := newFollowReader(ctx, io.Local, logPath)
 	require.NoError(t, err)
 
 	// Close the underlying file to cause read errors

pkg/container/state.go

@@ -15,6 +15,7 @@ type State struct {
 	Containers map[string]*Container `json:"containers"`
 
 	mu       sync.RWMutex
+	medium   io.Medium
 	filePath string
 }
 
@@ -46,24 +47,25 @@ func DefaultLogsDir() (string, error) {
 }
 
 // NewState creates a new State instance.
-func NewState(filePath string) *State {
+func NewState(m io.Medium, filePath string) *State {
 	return &State{
 		Containers: make(map[string]*Container),
+		medium:     m,
 		filePath:   filePath,
 	}
 }
 
 // LoadState loads the state from the given file path.
 // If the file doesn't exist, returns an empty state.
-func LoadState(filePath string) (*State, error) {
+func LoadState(m io.Medium, filePath string) (*State, error) {
-	state := NewState(filePath)
+	state := NewState(m, filePath)
 
 	absPath, err := filepath.Abs(filePath)
 	if err != nil {
 		return nil, err
 	}
 
-	content, err := io.Local.Read(absPath)
+	content, err := m.Read(absPath)
 	if err != nil {
 		if os.IsNotExist(err) {
 			return state, nil
@@ -93,8 +95,8 @@ func (s *State) SaveState() error {
 		return err
 	}
 
-	// io.Local.Write creates parent directories automatically
+	// s.medium.Write creates parent directories automatically
-	return io.Local.Write(absPath, string(data))
+	return s.medium.Write(absPath, string(data))
 }
 
 // Add adds a container to the state and persists it.
@@ -168,10 +170,10 @@ func LogPath(id string) (string, error) {
 }
 
 // EnsureLogsDir ensures the logs directory exists.
-func EnsureLogsDir() error {
+func EnsureLogsDir(m io.Medium) error {
 	logsDir, err := DefaultLogsDir()
 	if err != nil {
 		return err
 	}
-	return io.Local.EnsureDir(logsDir)
+	return m.EnsureDir(logsDir)
 }

pkg/container/state_test.go

@@ -6,12 +6,13 @@ import (
 	"testing"
 	"time"
 
+	"github.com/host-uk/core/pkg/io"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestNewState_Good(t *testing.T) {
-	state := NewState("/tmp/test-state.json")
+	state := NewState(io.Local, "/tmp/test-state.json")
 
 	assert.NotNil(t, state)
 	assert.NotNil(t, state.Containers)
@@ -23,7 +24,7 @@ func TestLoadState_Good_NewFile(t *testing.T) {
 	tmpDir := t.TempDir()
 	statePath := filepath.Join(tmpDir, "containers.json")
 
-	state, err := LoadState(statePath)
+	state, err := LoadState(io.Local, statePath)
 
 	require.NoError(t, err)
 	assert.NotNil(t, state)
@@ -50,7 +51,7 @@ func TestLoadState_Good_ExistingFile(t *testing.T) {
 	err := os.WriteFile(statePath, []byte(content), 0644)
 	require.NoError(t, err)
 
-	state, err := LoadState(statePath)
+	state, err := LoadState(io.Local, statePath)
 
 	require.NoError(t, err)
 	assert.Len(t, state.Containers, 1)
@@ -69,14 +70,14 @@ func TestLoadState_Bad_InvalidJSON(t *testing.T) {
 	err := os.WriteFile(statePath, []byte("invalid json{"), 0644)
 	require.NoError(t, err)
 
-	_, err = LoadState(statePath)
+	_, err = LoadState(io.Local, statePath)
 	assert.Error(t, err)
 }
 
 func TestState_Add_Good(t *testing.T) {
 	tmpDir := t.TempDir()
 	statePath := filepath.Join(tmpDir, "containers.json")
-	state := NewState(statePath)
+	state := NewState(io.Local, statePath)
 
 	container := &Container{
 		ID:        "abc12345",
@@ -103,7 +104,7 @@ func TestState_Add_Good(t *testing.T) {
 func TestState_Update_Good(t *testing.T) {
 	tmpDir := t.TempDir()
 	statePath := filepath.Join(tmpDir, "containers.json")
-	state := NewState(statePath)
+	state := NewState(io.Local, statePath)
 
 	container := &Container{
 		ID:     "abc12345",
@@ -125,7 +126,7 @@ func TestState_Update_Good(t *testing.T) {
 func TestState_Remove_Good(t *testing.T) {
 	tmpDir := t.TempDir()
 	statePath := filepath.Join(tmpDir, "containers.json")
-	state := NewState(statePath)
+	state := NewState(io.Local, statePath)
 
 	container := &Container{
 		ID: "abc12345",
@@ -140,7 +141,7 @@ func TestState_Remove_Good(t *testing.T) {
 }
 
 func TestState_Get_Bad_NotFound(t *testing.T) {
-	state := NewState("/tmp/test-state.json")
+	state := NewState(io.Local, "/tmp/test-state.json")
 
 	_, ok := state.Get("nonexistent")
 	assert.False(t, ok)
@@ -149,7 +150,7 @@ func TestState_Get_Bad_NotFound(t *testing.T) {
 func TestState_All_Good(t *testing.T) {
 	tmpDir := t.TempDir()
 	statePath := filepath.Join(tmpDir, "containers.json")
-	state := NewState(statePath)
+	state := NewState(io.Local, statePath)
 
 	_ = state.Add(&Container{ID: "aaa11111"})
 	_ = state.Add(&Container{ID: "bbb22222"})
@@ -162,7 +163,7 @@ func TestState_All_Good(t *testing.T) {
 func TestState_SaveState_Good_CreatesDirectory(t *testing.T) {
 	tmpDir := t.TempDir()
 	nestedPath := filepath.Join(tmpDir, "nested", "dir", "containers.json")
-	state := NewState(nestedPath)
+	state := NewState(io.Local, nestedPath)
 
 	_ = state.Add(&Container{ID: "abc12345"})
 
@@ -200,7 +201,7 @@ func TestLogPath_Good(t *testing.T) {
 
 func TestEnsureLogsDir_Good(t *testing.T) {
 	// This test creates real directories - skip in CI if needed
-	err := EnsureLogsDir()
+	err := EnsureLogsDir(io.Local)
 	assert.NoError(t, err)
 
 	logsDir, _ := DefaultLogsDir()

pkg/container/templates.go

@@ -38,17 +38,52 @@ var builtinTemplates = []Template{
 	},
 }
 
+// TemplateManager manages LinuxKit templates using a storage medium.
+type TemplateManager struct {
+	medium     io.Medium
+	workingDir string
+	homeDir    string
+}
+
+// NewTemplateManager creates a new TemplateManager instance.
+func NewTemplateManager(m io.Medium) *TemplateManager {
+	tm := &TemplateManager{medium: m}
+
+	// Default working and home directories from local system
+	// These can be overridden if needed.
+	if wd, err := os.Getwd(); err == nil {
+		tm.workingDir = wd
+	}
+	if home, err := os.UserHomeDir(); err == nil {
+		tm.homeDir = home
+	}
+
+	return tm
+}
+
+// WithWorkingDir sets the working directory for user template discovery.
+func (tm *TemplateManager) WithWorkingDir(wd string) *TemplateManager {
+	tm.workingDir = wd
+	return tm
+}
+
+// WithHomeDir sets the home directory for user template discovery.
+func (tm *TemplateManager) WithHomeDir(home string) *TemplateManager {
+	tm.homeDir = home
+	return tm
+}
+
 // ListTemplates returns all available LinuxKit templates.
 // It combines embedded templates with any templates found in the user's
 // .core/linuxkit directory.
-func ListTemplates() []Template {
+func (tm *TemplateManager) ListTemplates() []Template {
 	templates := make([]Template, len(builtinTemplates))
 	copy(templates, builtinTemplates)
 
 	// Check for user templates in .core/linuxkit/
-	userTemplatesDir := getUserTemplatesDir()
+	userTemplatesDir := tm.getUserTemplatesDir()
 	if userTemplatesDir != "" {
-		userTemplates := scanUserTemplates(userTemplatesDir)
+		userTemplates := tm.scanUserTemplates(userTemplatesDir)
 		templates = append(templates, userTemplates...)
 	}
 
@@ -57,7 +92,7 @@ func ListTemplates() []Template {
 
 // GetTemplate returns the content of a template by name.
 // It first checks embedded templates, then user templates.
-func GetTemplate(name string) (string, error) {
+func (tm *TemplateManager) GetTemplate(name string) (string, error) {
 	// Check embedded templates first
 	for _, t := range builtinTemplates {
 		if t.Name == name {
@@ -70,15 +105,18 @@ func GetTemplate(name string) (string, error) {
 	}
 
 	// Check user templates
-	userTemplatesDir := getUserTemplatesDir()
+	userTemplatesDir := tm.getUserTemplatesDir()
 	if userTemplatesDir != "" {
-		templatePath := filepath.Join(userTemplatesDir, name+".yml")
+		// Check both .yml and .yaml extensions
-		if io.Local.IsFile(templatePath) {
+		for _, ext := range []string{".yml", ".yaml"} {
-			content, err := io.Local.Read(templatePath)
+			templatePath := filepath.Join(userTemplatesDir, name+ext)
-			if err != nil {
+			if tm.medium.IsFile(templatePath) {
-				return "", fmt.Errorf("failed to read user template %s: %w", name, err)
+				content, err := tm.medium.Read(templatePath)
+				if err != nil {
+					return "", fmt.Errorf("failed to read user template %s: %w", name, err)
+				}
+				return content, nil
 			}
-			return content, nil
 		}
 	}
 
@@ -86,11 +124,8 @@ func GetTemplate(name string) (string, error) {
 }
 
 // ApplyTemplate applies variable substitution to a template.
-// It supports two syntaxes:
+func (tm *TemplateManager) ApplyTemplate(name string, vars map[string]string) (string, error) {
-//   - ${VAR} - required variable, returns error if not provided
+	content, err := tm.GetTemplate(name)
-//   - ${VAR:-default} - variable with default value
-func ApplyTemplate(name string, vars map[string]string) (string, error) {
-	content, err := GetTemplate(name)
 	if err != nil {
 		return "", err
 	}
@@ -191,35 +226,31 @@ func ExtractVariables(content string) (required []string, optional map[string]st
 
 // getUserTemplatesDir returns the path to user templates directory.
 // Returns empty string if the directory doesn't exist.
-func getUserTemplatesDir() string {
+func (tm *TemplateManager) getUserTemplatesDir() string {
 	// Try workspace-relative .core/linuxkit first
-	cwd, err := os.Getwd()
+	if tm.workingDir != "" {
-	if err == nil {
+		wsDir := filepath.Join(tm.workingDir, ".core", "linuxkit")
-		wsDir := filepath.Join(cwd, ".core", "linuxkit")
+		if tm.medium.IsDir(wsDir) {
-		if io.Local.IsDir(wsDir) {
 			return wsDir
 		}
 	}
 
 	// Try home directory
-	home, err := os.UserHomeDir()
+	if tm.homeDir != "" {
-	if err != nil {
+		homeDir := filepath.Join(tm.homeDir, ".core", "linuxkit")
-		return ""
+		if tm.medium.IsDir(homeDir) {
-	}
+			return homeDir
-
+		}
-	homeDir := filepath.Join(home, ".core", "linuxkit")
-	if io.Local.IsDir(homeDir) {
-		return homeDir
 	}
 
 	return ""
 }
 
 // scanUserTemplates scans a directory for .yml template files.
-func scanUserTemplates(dir string) []Template {
+func (tm *TemplateManager) scanUserTemplates(dir string) []Template {
 	var templates []Template
 
-	entries, err := io.Local.List(dir)
+	entries, err := tm.medium.List(dir)
 	if err != nil {
 		return templates
 	}
@@ -250,7 +281,7 @@ func scanUserTemplates(dir string) []Template {
 		}
 
 		// Read file to extract description from comments
-		description := extractTemplateDescription(filepath.Join(dir, name))
+		description := tm.extractTemplateDescription(filepath.Join(dir, name))
 		if description == "" {
 			description = "User-defined template"
 		}
@@ -267,8 +298,8 @@ func scanUserTemplates(dir string) []Template {
 
 // extractTemplateDescription reads the first comment block from a YAML file
 // to use as a description.
-func extractTemplateDescription(path string) string {
+func (tm *TemplateManager) extractTemplateDescription(path string) string {
-	content, err := io.Local.Read(path)
+	content, err := tm.medium.Read(path)
 	if err != nil {
 		return ""
 	}

pkg/container/templates_test.go

@@ -6,12 +6,14 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/host-uk/core/pkg/io"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestListTemplates_Good(t *testing.T) {
-	templates := ListTemplates()
+	tm := NewTemplateManager(io.Local)
+	templates := tm.ListTemplates()
 
 	// Should have at least the builtin templates
 	assert.GreaterOrEqual(t, len(templates), 2)
@@ -42,7 +44,8 @@ func TestListTemplates_Good(t *testing.T) {
 }
 
 func TestGetTemplate_Good_CoreDev(t *testing.T) {
-	content, err := GetTemplate("core-dev")
+	tm := NewTemplateManager(io.Local)
+	content, err := tm.GetTemplate("core-dev")
 
 	require.NoError(t, err)
 	assert.NotEmpty(t, content)
@@ -53,7 +56,8 @@ func TestGetTemplate_Good_CoreDev(t *testing.T) {
 }
 
 func TestGetTemplate_Good_ServerPhp(t *testing.T) {
-	content, err := GetTemplate("server-php")
+	tm := NewTemplateManager(io.Local)
+	content, err := tm.GetTemplate("server-php")
 
 	require.NoError(t, err)
 	assert.NotEmpty(t, content)
@@ -64,7 +68,8 @@ func TestGetTemplate_Good_ServerPhp(t *testing.T) {
 }
 
 func TestGetTemplate_Bad_NotFound(t *testing.T) {
-	_, err := GetTemplate("nonexistent-template")
+	tm := NewTemplateManager(io.Local)
+	_, err := tm.GetTemplate("nonexistent-template")
 
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "template not found")
@@ -162,11 +167,12 @@ func TestApplyVariables_Bad_MultipleMissing(t *testing.T) {
 }
 
 func TestApplyTemplate_Good(t *testing.T) {
+	tm := NewTemplateManager(io.Local)
 	vars := map[string]string{
 		"SSH_KEY": "ssh-rsa AAAA... user@host",
 	}
 
-	result, err := ApplyTemplate("core-dev", vars)
+	result, err := tm.ApplyTemplate("core-dev", vars)
 
 	require.NoError(t, err)
 	assert.NotEmpty(t, result)
@@ -176,21 +182,23 @@ func TestApplyTemplate_Good(t *testing.T) {
 }
 
 func TestApplyTemplate_Bad_TemplateNotFound(t *testing.T) {
+	tm := NewTemplateManager(io.Local)
 	vars := map[string]string{
 		"SSH_KEY": "test",
 	}
 
-	_, err := ApplyTemplate("nonexistent", vars)
+	_, err := tm.ApplyTemplate("nonexistent", vars)
 
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "template not found")
 }
 
 func TestApplyTemplate_Bad_MissingVariable(t *testing.T) {
+	tm := NewTemplateManager(io.Local)
 	// server-php requires SSH_KEY
 	vars := map[string]string{} // Missing required SSH_KEY
 
-	_, err := ApplyTemplate("server-php", vars)
+	_, err := tm.ApplyTemplate("server-php", vars)
 
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "missing required variables")
@@ -239,6 +247,7 @@ func TestExtractVariables_Good_OnlyDefaults(t *testing.T) {
 }
 
 func TestScanUserTemplates_Good(t *testing.T) {
+	tm := NewTemplateManager(io.Local)
 	// Create a temporary directory with template files
 	tmpDir := t.TempDir()
 
@@ -255,7 +264,7 @@ kernel:
 	err = os.WriteFile(filepath.Join(tmpDir, "readme.txt"), []byte("Not a template"), 0644)
 	require.NoError(t, err)
 
-	templates := scanUserTemplates(tmpDir)
+	templates := tm.scanUserTemplates(tmpDir)
 
 	assert.Len(t, templates, 1)
 	assert.Equal(t, "custom", templates[0].Name)
@@ -263,6 +272,7 @@ kernel:
 }
 
 func TestScanUserTemplates_Good_MultipleTemplates(t *testing.T) {
+	tm := NewTemplateManager(io.Local)
 	tmpDir := t.TempDir()
 
 	// Create multiple template files
@@ -271,7 +281,7 @@ func TestScanUserTemplates_Good_MultipleTemplates(t *testing.T) {
 	err = os.WriteFile(filepath.Join(tmpDir, "db.yaml"), []byte("# Database Server\nkernel:"), 0644)
 	require.NoError(t, err)
 
-	templates := scanUserTemplates(tmpDir)
+	templates := tm.scanUserTemplates(tmpDir)
 
 	assert.Len(t, templates, 2)
 
@@ -285,20 +295,23 @@ func TestScanUserTemplates_Good_MultipleTemplates(t *testing.T) {
 }
 
 func TestScanUserTemplates_Good_EmptyDirectory(t *testing.T) {
+	tm := NewTemplateManager(io.Local)
 	tmpDir := t.TempDir()
 
-	templates := scanUserTemplates(tmpDir)
+	templates := tm.scanUserTemplates(tmpDir)
 
 	assert.Empty(t, templates)
 }
 
 func TestScanUserTemplates_Bad_NonexistentDirectory(t *testing.T) {
-	templates := scanUserTemplates("/nonexistent/path/to/templates")
+	tm := NewTemplateManager(io.Local)
+	templates := tm.scanUserTemplates("/nonexistent/path/to/templates")
 
 	assert.Empty(t, templates)
 }
 
 func TestExtractTemplateDescription_Good(t *testing.T) {
+	tm := NewTemplateManager(io.Local)
 	tmpDir := t.TempDir()
 	path := filepath.Join(tmpDir, "test.yml")
 
@@ -310,12 +323,13 @@ kernel:
 	err := os.WriteFile(path, []byte(content), 0644)
 	require.NoError(t, err)
 
-	desc := extractTemplateDescription(path)
+	desc := tm.extractTemplateDescription(path)
 
 	assert.Equal(t, "My Template Description", desc)
 }
 
 func TestExtractTemplateDescription_Good_NoComments(t *testing.T) {
+	tm := NewTemplateManager(io.Local)
 	tmpDir := t.TempDir()
 	path := filepath.Join(tmpDir, "test.yml")
 
@@ -325,13 +339,14 @@ func TestExtractTemplateDescription_Good_NoComments(t *testing.T) {
 	err := os.WriteFile(path, []byte(content), 0644)
 	require.NoError(t, err)
 
-	desc := extractTemplateDescription(path)
+	desc := tm.extractTemplateDescription(path)
 
 	assert.Empty(t, desc)
 }
 
 func TestExtractTemplateDescription_Bad_FileNotFound(t *testing.T) {
-	desc := extractTemplateDescription("/nonexistent/file.yml")
+	tm := NewTemplateManager(io.Local)
+	desc := tm.extractTemplateDescription("/nonexistent/file.yml")
 
 	assert.Empty(t, desc)
 }
@@ -399,14 +414,8 @@ kernel:
 	err = os.WriteFile(filepath.Join(coreDir, "user-custom.yml"), []byte(templateContent), 0644)
 	require.NoError(t, err)
 
-	// Change to the temp directory
+	tm := NewTemplateManager(io.Local).WithWorkingDir(tmpDir)
-	oldWd, err := os.Getwd()
+	templates := tm.ListTemplates()
-	require.NoError(t, err)
-	err = os.Chdir(tmpDir)
-	require.NoError(t, err)
-	defer func() { _ = os.Chdir(oldWd) }()
-
-	templates := ListTemplates()
 
 	// Should have at least the builtin templates plus the user template
 	assert.GreaterOrEqual(t, len(templates), 3)
@@ -440,21 +449,39 @@ services:
 	err = os.WriteFile(filepath.Join(coreDir, "my-user-template.yml"), []byte(templateContent), 0644)
 	require.NoError(t, err)
 
-	// Change to the temp directory
+	tm := NewTemplateManager(io.Local).WithWorkingDir(tmpDir)
-	oldWd, err := os.Getwd()
+	content, err := tm.GetTemplate("my-user-template")
-	require.NoError(t, err)
-	err = os.Chdir(tmpDir)
-	require.NoError(t, err)
-	defer func() { _ = os.Chdir(oldWd) }()
-
-	content, err := GetTemplate("my-user-template")
 
 	require.NoError(t, err)
 	assert.Contains(t, content, "kernel:")
 	assert.Contains(t, content, "My user template")
 }
 
+func TestGetTemplate_Good_UserTemplate_YamlExtension(t *testing.T) {
+	// Create a workspace directory with user templates
+	tmpDir := t.TempDir()
+	coreDir := filepath.Join(tmpDir, ".core", "linuxkit")
+	err := os.MkdirAll(coreDir, 0755)
+	require.NoError(t, err)
+
+	// Create a user template with .yaml extension
+	templateContent := `# My yaml template
+kernel:
+  image: linuxkit/kernel:6.6
+`
+	err = os.WriteFile(filepath.Join(coreDir, "my-yaml-template.yaml"), []byte(templateContent), 0644)
+	require.NoError(t, err)
+
+	tm := NewTemplateManager(io.Local).WithWorkingDir(tmpDir)
+	content, err := tm.GetTemplate("my-yaml-template")
+
+	require.NoError(t, err)
+	assert.Contains(t, content, "kernel:")
+	assert.Contains(t, content, "My yaml template")
+}
+
 func TestScanUserTemplates_Good_SkipsBuiltinNames(t *testing.T) {
+	tm := NewTemplateManager(io.Local)
 	tmpDir := t.TempDir()
 
 	// Create a template with a builtin name (should be skipped)
@@ -465,7 +492,7 @@ func TestScanUserTemplates_Good_SkipsBuiltinNames(t *testing.T) {
 	err = os.WriteFile(filepath.Join(tmpDir, "unique.yml"), []byte("# Unique\nkernel:"), 0644)
 	require.NoError(t, err)
 
-	templates := scanUserTemplates(tmpDir)
+	templates := tm.scanUserTemplates(tmpDir)
 
 	// Should only have the unique template, not the builtin name
 	assert.Len(t, templates, 1)
@@ -473,6 +500,7 @@ func TestScanUserTemplates_Good_SkipsBuiltinNames(t *testing.T) {
 }
 
 func TestScanUserTemplates_Good_SkipsDirectories(t *testing.T) {
+	tm := NewTemplateManager(io.Local)
 	tmpDir := t.TempDir()
 
 	// Create a subdirectory (should be skipped)
@@ -483,13 +511,14 @@ func TestScanUserTemplates_Good_SkipsDirectories(t *testing.T) {
 	err = os.WriteFile(filepath.Join(tmpDir, "valid.yml"), []byte("# Valid\nkernel:"), 0644)
 	require.NoError(t, err)
 
-	templates := scanUserTemplates(tmpDir)
+	templates := tm.scanUserTemplates(tmpDir)
 
 	assert.Len(t, templates, 1)
 	assert.Equal(t, "valid", templates[0].Name)
 }
 
 func TestScanUserTemplates_Good_YamlExtension(t *testing.T) {
+	tm := NewTemplateManager(io.Local)
 	tmpDir := t.TempDir()
 
 	// Create templates with both extensions
@@ -498,7 +527,7 @@ func TestScanUserTemplates_Good_YamlExtension(t *testing.T) {
 	err = os.WriteFile(filepath.Join(tmpDir, "template2.yaml"), []byte("# Template 2\nkernel:"), 0644)
 	require.NoError(t, err)
 
-	templates := scanUserTemplates(tmpDir)
+	templates := tm.scanUserTemplates(tmpDir)
 
 	assert.Len(t, templates, 2)
 
@@ -511,6 +540,7 @@ func TestScanUserTemplates_Good_YamlExtension(t *testing.T) {
 }
 
 func TestExtractTemplateDescription_Good_EmptyComment(t *testing.T) {
+	tm := NewTemplateManager(io.Local)
 	tmpDir := t.TempDir()
 	path := filepath.Join(tmpDir, "test.yml")
 
@@ -523,12 +553,13 @@ kernel:
 	err := os.WriteFile(path, []byte(content), 0644)
 	require.NoError(t, err)
 
-	desc := extractTemplateDescription(path)
+	desc := tm.extractTemplateDescription(path)
 
 	assert.Equal(t, "Actual description here", desc)
 }
 
 func TestExtractTemplateDescription_Good_MultipleEmptyComments(t *testing.T) {
+	tm := NewTemplateManager(io.Local)
 	tmpDir := t.TempDir()
 	path := filepath.Join(tmpDir, "test.yml")
 
@@ -543,30 +574,20 @@ kernel:
 	err := os.WriteFile(path, []byte(content), 0644)
 	require.NoError(t, err)
 
-	desc := extractTemplateDescription(path)
+	desc := tm.extractTemplateDescription(path)
 
 	assert.Equal(t, "Real description", desc)
 }
 
 func TestGetUserTemplatesDir_Good_NoDirectory(t *testing.T) {
-	// Save current working directory
+	tm := NewTemplateManager(io.Local).WithWorkingDir("/tmp/nonexistent-wd").WithHomeDir("/tmp/nonexistent-home")
-	oldWd, err := os.Getwd()
+	dir := tm.getUserTemplatesDir()
-	require.NoError(t, err)
 
-	// Create a temp directory without .core/linuxkit
+	assert.Empty(t, dir)
-	tmpDir := t.TempDir()
-	err = os.Chdir(tmpDir)
-	require.NoError(t, err)
-	defer func() { _ = os.Chdir(oldWd) }()
-
-	dir := getUserTemplatesDir()
-
-	// Should return empty string since no templates dir exists
-	// (unless home dir has one)
-	assert.True(t, dir == "" || strings.Contains(dir, "linuxkit"))
 }
 
 func TestScanUserTemplates_Good_DefaultDescription(t *testing.T) {
+	tm := NewTemplateManager(io.Local)
 	tmpDir := t.TempDir()
 
 	// Create a template without comments
@@ -576,7 +597,7 @@ func TestScanUserTemplates_Good_DefaultDescription(t *testing.T) {
 	err := os.WriteFile(filepath.Join(tmpDir, "nocomment.yml"), []byte(content), 0644)
 	require.NoError(t, err)
 
-	templates := scanUserTemplates(tmpDir)
+	templates := tm.scanUserTemplates(tmpDir)
 
 	assert.Len(t, templates, 1)
 	assert.Equal(t, "User-defined template", templates[0].Description)

pkg/devops/devops.go

@@ -33,7 +33,7 @@ func New(m io.Medium) (*DevOps, error) {
 		return nil, fmt.Errorf("devops.New: failed to create image manager: %w", err)
 	}
 
-	mgr, err := container.NewLinuxKitManager()
+	mgr, err := container.NewLinuxKitManager(io.Local)
 	if err != nil {
 		return nil, fmt.Errorf("devops.New: failed to create container manager: %w", err)
 	}

pkg/devops/devops_test.go

@@ -108,9 +108,9 @@ func TestDevOps_Status_Good(t *testing.T) {
 
 	// Setup mock container manager
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -148,9 +148,9 @@ func TestDevOps_Status_Good_NotInstalled(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -179,9 +179,9 @@ func TestDevOps_Status_Good_NoContainer(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -205,9 +205,9 @@ func TestDevOps_IsRunning_Good(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -238,9 +238,9 @@ func TestDevOps_IsRunning_Bad_NotRunning(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -261,9 +261,9 @@ func TestDevOps_IsRunning_Bad_ContainerStopped(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -294,9 +294,9 @@ func TestDevOps_findContainer_Good(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -329,9 +329,9 @@ func TestDevOps_findContainer_Bad_NotFound(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -352,9 +352,9 @@ func TestDevOps_Stop_Bad_NotFound(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -409,9 +409,9 @@ func TestDevOps_Boot_Bad_NotInstalled(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -437,9 +437,9 @@ func TestDevOps_Boot_Bad_AlreadyRunning(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -482,9 +482,9 @@ func TestDevOps_Status_Good_WithImageVersion(t *testing.T) {
 	}
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		config:    cfg,
@@ -507,9 +507,9 @@ func TestDevOps_findContainer_Good_MultipleContainers(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -552,9 +552,9 @@ func TestDevOps_Status_Good_ContainerWithUptime(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -589,9 +589,9 @@ func TestDevOps_IsRunning_Bad_DifferentContainerName(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -631,9 +631,9 @@ func TestDevOps_Boot_Good_FreshFlag(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -673,9 +673,9 @@ func TestDevOps_Stop_Bad_ContainerNotRunning(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -715,9 +715,9 @@ func TestDevOps_Boot_Good_FreshWithNoExisting(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,
@@ -797,9 +797,9 @@ func TestDevOps_Boot_Good_Success(t *testing.T) {
 	require.NoError(t, err)
 
 	statePath := filepath.Join(tempDir, "containers.json")
-	state := container.NewState(statePath)
+	state := container.NewState(io.Local, statePath)
 	h := &mockHypervisor{}
-	cm := container.NewLinuxKitManagerWithHypervisor(state, h)
+	cm := container.NewLinuxKitManagerWithHypervisor(io.Local, state, h)
 
 	d := &DevOps{medium: io.Local,
 		images:    mgr,

pkg/io/io.go

@@ -1,6 +1,7 @@
 package io
 
 import (
+	goio "io"
 	"io/fs"
 	"os"
 	"path/filepath"
@@ -21,6 +22,9 @@ type Medium interface {
 	// Write saves the given content to a file, overwriting it if it exists.
 	Write(path, content string) error
 
+	// Open opens a file for reading.
+	Open(path string) (goio.ReadCloser, error)
+
 	// EnsureDir makes sure a directory exists, creating it if necessary.
 	EnsureDir(path string) error
 
@@ -169,6 +173,15 @@ func (m *MockMedium) Write(path, content string) error {
 	return nil
 }
 
+// Open opens a file for reading in the mock filesystem.
+func (m *MockMedium) Open(path string) (goio.ReadCloser, error) {
+	content, ok := m.Files[path]
+	if !ok {
+		return nil, coreerr.E("io.MockMedium.Open", "file not found: "+path, os.ErrNotExist)
+	}
+	return goio.NopCloser(strings.NewReader(content)), nil
+}
+
 // EnsureDir records that a directory exists in the mock filesystem.
 func (m *MockMedium) EnsureDir(path string) error {
 	m.Dirs[path] = true

pkg/io/local/client.go

@@ -2,6 +2,7 @@
 package local
 
 import (
+	goio "io"
 	"io/fs"
 	"os"
 	"path/filepath"
@@ -106,6 +107,11 @@ func (m *Medium) Write(p, content string) error {
 	return os.WriteFile(full, []byte(content), 0644)
 }
 
+// Open opens a file for reading.
+func (m *Medium) Open(p string) (goio.ReadCloser, error) {
+	return os.Open(m.path(p))
+}
+
 // EnsureDir creates directory if it doesn't exist.
 func (m *Medium) EnsureDir(p string) error {
 	full, err := m.validatePath(p)