diff --git a/layer/filestore.go b/layer/filestore.go
index 19990a3681..ce3a309d8d 100644
--- a/layer/filestore.go
+++ b/layer/filestore.go
@@ -39,7 +39,7 @@ type fileMetadataTransaction struct {
 // which is backed by files on disk using the provided root
 // as the root of metadata files.
 func newFSMetadataStore(root string) (*fileMetadataStore, error) {
-	if err := os.MkdirAll(root, 0700); err != nil {
+	if err := os.MkdirAll(root, 0o700); err != nil {
 		return nil, err
 	}
 	return &fileMetadataStore{
@@ -66,7 +66,7 @@ func (fms *fileMetadataStore) getMountFilename(mount, filename string) string {
 
 func (fms *fileMetadataStore) StartTransaction() (*fileMetadataTransaction, error) {
 	tmpDir := filepath.Join(fms.root, "tmp")
-	if err := os.MkdirAll(tmpDir, 0755); err != nil {
+	if err := os.MkdirAll(tmpDir, 0o755); err != nil {
 		return nil, err
 	}
 	ws, err := ioutils.NewAtomicWriteSet(tmpDir)
@@ -85,15 +85,15 @@ func (fm *fileMetadataTransaction) SetSize(size int64) error {
 }
 
 func (fm *fileMetadataTransaction) SetParent(parent ChainID) error {
-	return fm.ws.WriteFile("parent", []byte(digest.Digest(parent).String()), 0644)
+	return fm.ws.WriteFile("parent", []byte(digest.Digest(parent).String()), 0o644)
 }
 
 func (fm *fileMetadataTransaction) SetDiffID(diff DiffID) error {
-	return fm.ws.WriteFile("diff", []byte(digest.Digest(diff).String()), 0644)
+	return fm.ws.WriteFile("diff", []byte(digest.Digest(diff).String()), 0o644)
 }
 
 func (fm *fileMetadataTransaction) SetCacheID(cacheID string) error {
-	return fm.ws.WriteFile("cache-id", []byte(cacheID), 0644)
+	return fm.ws.WriteFile("cache-id", []byte(cacheID), 0o644)
 }
 
 func (fm *fileMetadataTransaction) SetDescriptor(ref distribution.Descriptor) error {
@@ -101,11 +101,11 @@ func (fm *fileMetadataTransaction) SetDescriptor(ref distribution.Descriptor) er
 	if err != nil {
 		return err
 	}
-	return fm.ws.WriteFile("descriptor.json", jsonRef, 0644)
+	return fm.ws.WriteFile("descriptor.json", jsonRef, 0o644)
 }
 
 func (fm *fileMetadataTransaction) TarSplitWriter(compressInput bool) (io.WriteCloser, error) {
-	f, err := fm.ws.FileWriter("tar-split.json.gz", os.O_TRUNC|os.O_CREATE|os.O_WRONLY, 0644)
+	f, err := fm.ws.FileWriter("tar-split.json.gz", os.O_TRUNC|os.O_CREATE|os.O_WRONLY, 0o644)
 	if err != nil {
 		return nil, err
 	}
@@ -124,7 +124,7 @@ func (fm *fileMetadataTransaction) TarSplitWriter(compressInput bool) (io.WriteC
 
 func (fm *fileMetadataTransaction) Commit(layer ChainID) error {
 	finalDir := fm.store.getLayerDirectory(layer)
-	if err := os.MkdirAll(filepath.Dir(finalDir), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(finalDir), 0o755); err != nil {
 		return err
 	}
 
@@ -234,24 +234,24 @@ func (fms *fileMetadataStore) TarSplitReader(layer ChainID) (io.ReadCloser, erro
 }
 
 func (fms *fileMetadataStore) SetMountID(mount string, mountID string) error {
-	if err := os.MkdirAll(fms.getMountDirectory(mount), 0755); err != nil {
+	if err := os.MkdirAll(fms.getMountDirectory(mount), 0o755); err != nil {
 		return err
 	}
-	return os.WriteFile(fms.getMountFilename(mount, "mount-id"), []byte(mountID), 0644)
+	return os.WriteFile(fms.getMountFilename(mount, "mount-id"), []byte(mountID), 0o644)
 }
 
 func (fms *fileMetadataStore) SetInitID(mount string, init string) error {
-	if err := os.MkdirAll(fms.getMountDirectory(mount), 0755); err != nil {
+	if err := os.MkdirAll(fms.getMountDirectory(mount), 0o755); err != nil {
 		return err
 	}
-	return os.WriteFile(fms.getMountFilename(mount, "init-id"), []byte(init), 0644)
+	return os.WriteFile(fms.getMountFilename(mount, "init-id"), []byte(init), 0o644)
 }
 
 func (fms *fileMetadataStore) SetMountParent(mount string, parent ChainID) error {
-	if err := os.MkdirAll(fms.getMountDirectory(mount), 0755); err != nil {
+	if err := os.MkdirAll(fms.getMountDirectory(mount), 0o755); err != nil {
 		return err
 	}
-	return os.WriteFile(fms.getMountFilename(mount, "parent"), []byte(digest.Digest(parent).String()), 0644)
+	return os.WriteFile(fms.getMountFilename(mount, "parent"), []byte(digest.Digest(parent).String()), 0o644)
 }
 
 func (fms *fileMetadataStore) GetMountID(mount string) (string, error) {
diff --git a/layer/filestore_test.go b/layer/filestore_test.go
index c0e6010722..554a77abb7 100644
--- a/layer/filestore_test.go
+++ b/layer/filestore_test.go
@@ -51,7 +51,7 @@ func TestCommitFailure(t *testing.T) {
 	fms, td, cleanup := newFileMetadataStore(t)
 	defer cleanup()
 
-	if err := os.WriteFile(filepath.Join(td, "sha256"), []byte("was here first!"), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(td, "sha256"), []byte("was here first!"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -75,7 +75,7 @@ func TestStartTransactionFailure(t *testing.T) {
 	fms, td, cleanup := newFileMetadataStore(t)
 	defer cleanup()
 
-	if err := os.WriteFile(filepath.Join(td, "tmp"), []byte("was here first!"), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(td, "tmp"), []byte("was here first!"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -108,7 +108,7 @@ func TestGetOrphan(t *testing.T) {
 	defer cleanup()
 
 	layerRoot := filepath.Join(td, "sha256")
-	if err := os.MkdirAll(layerRoot, 0755); err != nil {
+	if err := os.MkdirAll(layerRoot, 0o755); err != nil {
 		t.Fatal(err)
 	}
 
@@ -123,7 +123,7 @@ func TestGetOrphan(t *testing.T) {
 		t.Fatal(err)
 	}
 	layerPath := fms.getLayerDirectory(layerid)
-	if err := os.WriteFile(filepath.Join(layerPath, "cache-id"), []byte(stringid.GenerateRandomID()), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(layerPath, "cache-id"), []byte(stringid.GenerateRandomID()), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/layer/layer_test.go b/layer/layer_test.go
index afda53a871..6161e48751 100644
--- a/layer/layer_test.go
+++ b/layer/layer_test.go
@@ -139,7 +139,7 @@ func newTestFile(name string, content []byte, perm os.FileMode) FileApplier {
 
 func (tf *testFile) ApplyFile(root string) error {
 	fullPath := filepath.Join(root, tf.name)
-	if err := os.MkdirAll(filepath.Dir(fullPath), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(fullPath), 0o755); err != nil {
 		return err
 	}
 	// Check if already exists
@@ -247,7 +247,7 @@ func TestMountAndRegister(t *testing.T) {
 	ls, _, cleanup := newTestStore(t)
 	defer cleanup()
 
-	li := initWithFiles(newTestFile("testfile.txt", []byte("some test data"), 0644))
+	li := initWithFiles(newTestFile("testfile.txt", []byte("some test data"), 0o644))
 	layer, err := createLayer(ls, "", li)
 	if err != nil {
 		t.Fatal(err)
@@ -292,12 +292,12 @@ func TestLayerRelease(t *testing.T) {
 	ls, _, cleanup := newTestStore(t)
 	defer cleanup()
 
-	layer1, err := createLayer(ls, "", initWithFiles(newTestFile("layer1.txt", []byte("layer 1 file"), 0644)))
+	layer1, err := createLayer(ls, "", initWithFiles(newTestFile("layer1.txt", []byte("layer 1 file"), 0o644)))
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	layer2, err := createLayer(ls, layer1.ChainID(), initWithFiles(newTestFile("layer2.txt", []byte("layer 2 file"), 0644)))
+	layer2, err := createLayer(ls, layer1.ChainID(), initWithFiles(newTestFile("layer2.txt", []byte("layer 2 file"), 0o644)))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -306,12 +306,12 @@ func TestLayerRelease(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	layer3a, err := createLayer(ls, layer2.ChainID(), initWithFiles(newTestFile("layer3.txt", []byte("layer 3a file"), 0644)))
+	layer3a, err := createLayer(ls, layer2.ChainID(), initWithFiles(newTestFile("layer3.txt", []byte("layer 3a file"), 0o644)))
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	layer3b, err := createLayer(ls, layer2.ChainID(), initWithFiles(newTestFile("layer3.txt", []byte("layer 3b file"), 0644)))
+	layer3b, err := createLayer(ls, layer2.ChainID(), initWithFiles(newTestFile("layer3.txt", []byte("layer 3b file"), 0o644)))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -341,12 +341,12 @@ func TestStoreRestore(t *testing.T) {
 	ls, _, cleanup := newTestStore(t)
 	defer cleanup()
 
-	layer1, err := createLayer(ls, "", initWithFiles(newTestFile("layer1.txt", []byte("layer 1 file"), 0644)))
+	layer1, err := createLayer(ls, "", initWithFiles(newTestFile("layer1.txt", []byte("layer 1 file"), 0o644)))
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	layer2, err := createLayer(ls, layer1.ChainID(), initWithFiles(newTestFile("layer2.txt", []byte("layer 2 file"), 0644)))
+	layer2, err := createLayer(ls, layer1.ChainID(), initWithFiles(newTestFile("layer2.txt", []byte("layer 2 file"), 0o644)))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -355,7 +355,7 @@ func TestStoreRestore(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	layer3, err := createLayer(ls, layer2.ChainID(), initWithFiles(newTestFile("layer3.txt", []byte("layer 3 file"), 0644)))
+	layer3, err := createLayer(ls, layer2.ChainID(), initWithFiles(newTestFile("layer3.txt", []byte("layer 3 file"), 0o644)))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -374,7 +374,7 @@ func TestStoreRestore(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := os.WriteFile(filepath.Join(pathFS, "testfile.txt"), []byte("nothing here"), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(pathFS, "testfile.txt"), []byte("nothing here"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -457,14 +457,14 @@ func TestTarStreamStability(t *testing.T) {
 	defer cleanup()
 
 	files1 := []FileApplier{
-		newTestFile("/etc/hosts", []byte("mydomain 10.0.0.1"), 0644),
-		newTestFile("/etc/profile", []byte("PATH=/usr/bin"), 0644),
+		newTestFile("/etc/hosts", []byte("mydomain 10.0.0.1"), 0o644),
+		newTestFile("/etc/profile", []byte("PATH=/usr/bin"), 0o644),
 	}
-	addedFile := newTestFile("/etc/shadow", []byte("root:::::::"), 0644)
+	addedFile := newTestFile("/etc/shadow", []byte("root:::::::"), 0o644)
 	files2 := []FileApplier{
-		newTestFile("/etc/hosts", []byte("mydomain 10.0.0.2"), 0644),
-		newTestFile("/etc/profile", []byte("PATH=/usr/bin"), 0664),
-		newTestFile("/root/.bashrc", []byte("PATH=/usr/sbin:/usr/bin"), 0644),
+		newTestFile("/etc/hosts", []byte("mydomain 10.0.0.2"), 0o644),
+		newTestFile("/etc/profile", []byte("PATH=/usr/bin"), 0o664),
+		newTestFile("/root/.bashrc", []byte("PATH=/usr/sbin:/usr/bin"), 0o644),
 	}
 
 	tar1, err := tarFromFiles(files1...)
@@ -646,11 +646,11 @@ func TestRegisterExistingLayer(t *testing.T) {
 	defer cleanup()
 
 	baseFiles := []FileApplier{
-		newTestFile("/etc/profile", []byte("# Base configuration"), 0644),
+		newTestFile("/etc/profile", []byte("# Base configuration"), 0o644),
 	}
 
 	layerFiles := []FileApplier{
-		newTestFile("/root/.bashrc", []byte("# Root configuration"), 0644),
+		newTestFile("/root/.bashrc", []byte("# Root configuration"), 0o644),
 	}
 
 	li := initWithFiles(baseFiles...)
@@ -686,12 +686,12 @@ func TestTarStreamVerification(t *testing.T) {
 	defer cleanup()
 
 	files1 := []FileApplier{
-		newTestFile("/foo", []byte("abc"), 0644),
-		newTestFile("/bar", []byte("def"), 0644),
+		newTestFile("/foo", []byte("abc"), 0o644),
+		newTestFile("/bar", []byte("def"), 0o644),
 	}
 	files2 := []FileApplier{
-		newTestFile("/foo", []byte("abc"), 0644),
-		newTestFile("/bar", []byte("def"), 0600), // different perm
+		newTestFile("/foo", []byte("abc"), 0o644),
+		newTestFile("/bar", []byte("def"), 0o600), // different perm
 	}
 
 	tar1, err := tarFromFiles(files1...)
diff --git a/layer/layer_unix_test.go b/layer/layer_unix_test.go
index 64cda566b1..66ff7c8d32 100644
--- a/layer/layer_unix_test.go
+++ b/layer/layer_unix_test.go
@@ -25,12 +25,12 @@ func TestLayerSize(t *testing.T) {
 	content1 := []byte("Base contents")
 	content2 := []byte("Added contents")
 
-	layer1, err := createLayer(ls, "", initWithFiles(newTestFile("file1", content1, 0644)))
+	layer1, err := createLayer(ls, "", initWithFiles(newTestFile("file1", content1, 0o644)))
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	layer2, err := createLayer(ls, layer1.ChainID(), initWithFiles(newTestFile("file2", content2, 0644)))
+	layer2, err := createLayer(ls, layer1.ChainID(), initWithFiles(newTestFile("file2", content2, 0o644)))
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/layer/migration_test.go b/layer/migration_test.go
index de3e15f517..9d307fe5c2 100644
--- a/layer/migration_test.go
+++ b/layer/migration_test.go
@@ -16,7 +16,7 @@ import (
 )
 
 func writeTarSplitFile(name string, tarContent []byte) error {
-	f, err := os.OpenFile(name, os.O_TRUNC|os.O_CREATE|os.O_WRONLY, 0644)
+	f, err := os.OpenFile(name, os.O_TRUNC|os.O_CREATE|os.O_WRONLY, 0o644)
 	if err != nil {
 		return err
 	}
@@ -51,12 +51,12 @@ func TestLayerMigration(t *testing.T) {
 	defer os.RemoveAll(td)
 
 	layer1Files := []FileApplier{
-		newTestFile("/root/.bashrc", []byte("# Boring configuration"), 0644),
-		newTestFile("/etc/profile", []byte("# Base configuration"), 0644),
+		newTestFile("/root/.bashrc", []byte("# Boring configuration"), 0o644),
+		newTestFile("/etc/profile", []byte("# Base configuration"), 0o644),
 	}
 
 	layer2Files := []FileApplier{
-		newTestFile("/root/.bashrc", []byte("# Updated configuration"), 0644),
+		newTestFile("/root/.bashrc", []byte("# Updated configuration"), 0o644),
 	}
 
 	tar1, err := tarFromFiles(layer1Files...)
@@ -187,12 +187,12 @@ func TestLayerMigrationNoTarsplit(t *testing.T) {
 	defer os.RemoveAll(td)
 
 	layer1Files := []FileApplier{
-		newTestFile("/root/.bashrc", []byte("# Boring configuration"), 0644),
-		newTestFile("/etc/profile", []byte("# Base configuration"), 0644),
+		newTestFile("/root/.bashrc", []byte("# Boring configuration"), 0o644),
+		newTestFile("/etc/profile", []byte("# Base configuration"), 0o644),
 	}
 
 	layer2Files := []FileApplier{
-		newTestFile("/root/.bashrc", []byte("# Updated configuration"), 0644),
+		newTestFile("/root/.bashrc", []byte("# Updated configuration"), 0o644),
 	}
 
 	graph, err := newVFSGraphDriver(filepath.Join(td, "graphdriver-"))
diff --git a/layer/mount_test.go b/layer/mount_test.go
index 643a52c524..dea4a436a0 100644
--- a/layer/mount_test.go
+++ b/layer/mount_test.go
@@ -20,8 +20,8 @@ func TestMountInit(t *testing.T) {
 	ls, _, cleanup := newTestStore(t)
 	defer cleanup()
 
-	basefile := newTestFile("testfile.txt", []byte("base data!"), 0644)
-	initfile := newTestFile("testfile.txt", []byte("init data!"), 0777)
+	basefile := newTestFile("testfile.txt", []byte("base data!"), 0o644)
+	initfile := newTestFile("testfile.txt", []byte("init data!"), 0o777)
 
 	li := initWithFiles(basefile)
 	layer, err := createLayer(ls, "", li)
@@ -66,8 +66,8 @@ func TestMountInit(t *testing.T) {
 		t.Fatalf("Unexpected test file contents %q, expected %q", string(b), expected)
 	}
 
-	if fi.Mode().Perm() != 0777 {
-		t.Fatalf("Unexpected filemode %o, expecting %o", fi.Mode().Perm(), 0777)
+	if fi.Mode().Perm() != 0o777 {
+		t.Fatalf("Unexpected filemode %o, expecting %o", fi.Mode().Perm(), 0o777)
 	}
 }
 
@@ -83,14 +83,14 @@ func TestMountSize(t *testing.T) {
 	content2 := []byte("Mutable contents")
 	contentInit := []byte("why am I excluded from the size ☹")
 
-	li := initWithFiles(newTestFile("file1", content1, 0644))
+	li := initWithFiles(newTestFile("file1", content1, 0o644))
 	layer, err := createLayer(ls, "", li)
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	mountInit := func(root string) error {
-		return newTestFile("file-init", contentInit, 0777).ApplyFile(root)
+		return newTestFile("file-init", contentInit, 0o777).ApplyFile(root)
 	}
 	rwLayerOpts := &CreateRWLayerOpts{
 		InitFunc: mountInit,
@@ -106,7 +106,7 @@ func TestMountSize(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := os.WriteFile(filepath.Join(pathFS, "file2"), content2, 0755); err != nil {
+	if err := os.WriteFile(filepath.Join(pathFS, "file2"), content2, 0o755); err != nil {
 		t.Fatal(err)
 	}
 
@@ -129,11 +129,11 @@ func TestMountChanges(t *testing.T) {
 	defer cleanup()
 
 	basefiles := []FileApplier{
-		newTestFile("testfile1.txt", []byte("base data!"), 0644),
-		newTestFile("testfile2.txt", []byte("base data!"), 0644),
-		newTestFile("testfile3.txt", []byte("base data!"), 0644),
+		newTestFile("testfile1.txt", []byte("base data!"), 0o644),
+		newTestFile("testfile2.txt", []byte("base data!"), 0o644),
+		newTestFile("testfile3.txt", []byte("base data!"), 0o644),
 	}
-	initfile := newTestFile("testfile1.txt", []byte("init data!"), 0777)
+	initfile := newTestFile("testfile1.txt", []byte("init data!"), 0o777)
 
 	li := initWithFiles(basefiles...)
 	layer, err := createLayer(ls, "", li)
@@ -158,11 +158,11 @@ func TestMountChanges(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := driver.LocalDriver.Lchmod(filepath.Join(pathFS, "testfile1.txt"), 0755); err != nil {
+	if err := driver.LocalDriver.Lchmod(filepath.Join(pathFS, "testfile1.txt"), 0o755); err != nil {
 		t.Fatal(err)
 	}
 
-	if err := os.WriteFile(filepath.Join(pathFS, "testfile1.txt"), []byte("mount data!"), 0755); err != nil {
+	if err := os.WriteFile(filepath.Join(pathFS, "testfile1.txt"), []byte("mount data!"), 0o755); err != nil {
 		t.Fatal(err)
 	}
 
@@ -170,11 +170,11 @@ func TestMountChanges(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := driver.LocalDriver.Lchmod(filepath.Join(pathFS, "testfile3.txt"), 0755); err != nil {
+	if err := driver.LocalDriver.Lchmod(filepath.Join(pathFS, "testfile3.txt"), 0o755); err != nil {
 		t.Fatal(err)
 	}
 
-	if err := os.WriteFile(filepath.Join(pathFS, "testfile4.txt"), []byte("mount data!"), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(pathFS, "testfile4.txt"), []byte("mount data!"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -215,8 +215,8 @@ func TestMountApply(t *testing.T) {
 	ls, _, cleanup := newTestStore(t)
 	defer cleanup()
 
-	basefile := newTestFile("testfile.txt", []byte("base data!"), 0644)
-	newfile := newTestFile("newfile.txt", []byte("new data!"), 0755)
+	basefile := newTestFile("testfile.txt", []byte("base data!"), 0o644)
+	newfile := newTestFile("newfile.txt", []byte("new data!"), 0o755)
 
 	li := initWithFiles(basefile)
 	layer, err := createLayer(ls, "", li)
diff --git a/layer/ro_layer.go b/layer/ro_layer.go
index 96418cab8d..55d5a4a5bb 100644
--- a/layer/ro_layer.go
+++ b/layer/ro_layer.go
@@ -175,6 +175,7 @@ func (vrc *verifiedReadCloser) Read(p []byte) (n int, err error) {
 	}
 	return
 }
+
 func (vrc *verifiedReadCloser) Close() error {
 	return vrc.rc.Close()
 }