diff --git a/Dockerfile.manifest b/Dockerfile.manifest
index 52a70cffadcf..369c64677cdb 100644
--- a/Dockerfile.manifest
+++ b/Dockerfile.manifest
@@ -1,4 +1,4 @@
-ARG GOLANG=golang:1.18.8-alpine3.16
+ARG GOLANG=golang:1.18.10-alpine3.17
 FROM ${GOLANG}
 
 COPY --from=plugins/manifest:1.2.3 /bin/* /bin/
diff --git a/Dockerfile.test b/Dockerfile.test
index 141a46d33b2a..f281c03dc8c7 100644
--- a/Dockerfile.test
+++ b/Dockerfile.test
@@ -1,4 +1,4 @@
-ARG GOLANG=golang:1.18.8-alpine3.16
+ARG GOLANG=golang:1.19.4-alpine3.17
 FROM ${GOLANG} as test-base
 
 RUN apk -U --no-cache add bash jq
@@ -7,16 +7,17 @@ WORKDIR ${K3S_SOURCE}
 
 COPY . ${K3S_SOURCE}
 
-
-From test-base as test-mods
+FROM test-base as test-mods
 
 COPY ./scripts/test-mods /bin/
 ENTRYPOINT ["/bin/test-mods"]
 
-From test-base as test-k3s
+FROM test-base as test-k3s
 
 RUN apk -U --no-cache add git gcc musl-dev docker curl coreutils python3 openssl py3-pip procps findutils
 
+RUN python3 -m pip install awscli
+
 ENV SONOBUOY_VERSION 0.56.10
 
 RUN OS=linux; \
diff --git a/conformance/Dockerfile b/conformance/Dockerfile
index f87e1452d309..cb8a350a0e8e 100644
--- a/conformance/Dockerfile
+++ b/conformance/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.16
+FROM alpine:3.17
 ENV SONOBUOY_VERSION 0.56.10
 RUN apk add curl tar gzip
 RUN curl -sfL https://github.com/vmware-tanzu/sonobuoy/releases/download/v${SONOBUOY_VERSION}/sonobuoy_${SONOBUOY_VERSION}_linux_amd64.tar.gz | tar xvzf - -C /usr/bin
diff --git a/package/Dockerfile b/package/Dockerfile
index 362507b526d8..7cf48853ddb6 100644
--- a/package/Dockerfile
+++ b/package/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.16 as base
+FROM alpine:3.17 as base
 RUN apk add -U ca-certificates tar zstd
 COPY build/out/data.tar.zst /
 RUN mkdir -p /image/etc/ssl/certs /image/run /image/var/run /image/tmp /image/lib/modules /image/lib/firmware && \
diff --git a/pkg/agent/config/config.go b/pkg/agent/config/config.go
index 698ec42e40db..a907cf86f571 100644
--- a/pkg/agent/config/config.go
+++ b/pkg/agent/config/config.go
@@ -485,9 +485,8 @@ func get(ctx context.Context, envInfo *cmds.Agent, proxy proxy.Proxy) (*config.N
 		}
 	}
 	nodeConfig.Containerd.Opt = filepath.Join(envInfo.DataDir, "agent", "containerd")
-	if !envInfo.Debug {
-		nodeConfig.Containerd.Log = filepath.Join(envInfo.DataDir, "agent", "containerd", "containerd.log")
-	}
+	nodeConfig.Containerd.Log = filepath.Join(envInfo.DataDir, "agent", "containerd", "containerd.log")
+	nodeConfig.Containerd.Debug = envInfo.Debug
 	applyContainerdStateAndAddress(nodeConfig)
 	applyCRIDockerdAddress(nodeConfig)
 	nodeConfig.Containerd.Template = filepath.Join(envInfo.DataDir, "agent", "etc", "containerd", "config.toml.tmpl")
diff --git a/pkg/agent/containerd/containerd.go b/pkg/agent/containerd/containerd.go
index 3d7666381da9..0b2190072d9d 100644
--- a/pkg/agent/containerd/containerd.go
+++ b/pkg/agent/containerd/containerd.go
@@ -47,14 +47,22 @@ func Run(ctx context.Context, cfg *config.Node) error {
 
 	if cfg.Containerd.Log != "" {
 		logrus.Infof("Logging containerd to %s", cfg.Containerd.Log)
-		stdOut = &lumberjack.Logger{
+		fileOut := &lumberjack.Logger{
 			Filename:   cfg.Containerd.Log,
 			MaxSize:    50,
 			MaxBackups: 3,
 			MaxAge:     28,
 			Compress:   true,
 		}
-		stdErr = stdOut
+		// If k3s is started with --debug, write logs to both the log file and stdout/stderr,
+		// even if a log path is set.
+		if cfg.Containerd.Debug {
+			stdOut = io.MultiWriter(stdOut, fileOut)
+			stdErr = io.MultiWriter(stdErr, fileOut)
+		} else {
+			stdOut = fileOut
+			stdErr = fileOut
+		}
 	}
 
 	go func() {
diff --git a/pkg/daemons/config/types.go b/pkg/daemons/config/types.go
index f79dcdfe94dd..1f67757885b1 100644
--- a/pkg/daemons/config/types.go
+++ b/pkg/daemons/config/types.go
@@ -64,6 +64,7 @@ type Containerd struct {
 	Opt      string
 	Template string
 	SELinux  bool
+	Debug    bool
 }
 
 type CRIDockerd struct {
diff --git a/scripts/test-helpers b/scripts/test-helpers
index c001590a10de..7f3f517e1084 100755
--- a/scripts/test-helpers
+++ b/scripts/test-helpers
@@ -71,7 +71,7 @@ export -f pod-ready
 # ---
 
 wait-for-services() {
-    for service in $@; do
+    for service in "$@"; do
         while [[ "$(pod-ready $service | sort -u)" != 'true' ]]; do
             echo "Waiting for service $service to be ready..." >&2
             sleep 5
@@ -98,7 +98,7 @@ export -f wait-for-db-connection
 # ---
 
 verify-valid-version() {
-    docker exec $@ 2>&1 | tee .version.tmp
+    docker exec "$@" 2>&1 | tee .version.tmp
     # check for bad strings in the version output, including '.' in the build metadata
     if grep -oiE '.*(dev|head|unknown|fail|refuse|\+[^"]*\.).*' .version.tmp; then
         return 1
@@ -190,12 +190,10 @@ retrieve-sonobuoy-logs() {
     fi
 
     mkdir -p $TEST_DIR/sonobuoy
-    sonobuoy retrieve $TEST_DIR/sonobuoy 2>/dev/null || true
-    local logTarball=$TEST_DIR/sonobuoy/*_sonobuoy_*.tar.gz
-
-    if [ -f $logTarball ]; then
-        tar -xz -f $logTarball -C $TEST_DIR/sonobuoy
-        rm $logTarball
+    local logTarball="$(sonobuoy retrieve $TEST_DIR/sonobuoy)"
+    if [ -f "$logTarball" ]; then
+        tar -xz -f "$logTarball" -C $TEST_DIR/sonobuoy
+        rm "$logTarball"
     else
         rm -rf $TEST_DIR/sonobuoy
     fi
@@ -244,7 +242,7 @@ sonobuoy-test() {
         --plugin-env=e2e.E2E_USE_GO_RUNNER=true \
         --kubernetes-version=${VERSION_K8S} \
         --wait=90 \
-        $@ &
+        "$@" &
 
     local sonobuoyPID=$!
     local code=0
@@ -338,19 +336,18 @@ export -f test-setup
 
 # ---
 
-inc-count() {(
-    shopt -s extglob
-    local count=$(exec 2>/dev/null; ls -1d $TEST_DIR/$1/+([0-9]) | xargs -n1 basename | sort -n -r | head -1)
+inc-count() {
+    local count=$(find $TEST_DIR -type d -mindepth 2 -maxdepth 2 -regex ".*/$1/[0-9]+" -printf '%f\n' | sort -nr | head -1)
     count=$((count+1))
     mkdir -p $TEST_DIR/$1/$count/metadata
     echo $count
-)}
+}
 export -f inc-count
 
 # ---
 
 has-function() {
-  [[ ! -z "$1" && $(type -t $1) == "function" ]]
+  [[ -n "$1" && $(type -t $1) == "function" ]]
 } 2> /dev/null
 export -f has-function
 
@@ -358,7 +355,7 @@ export -f has-function
 
 run-function() {
     has-function $1 || return 0
-    $@
+    "$@"
 }
 export -f run-function
 
@@ -379,7 +376,7 @@ provision-server() {
         --privileged \
         -p 127.0.0.1:$port:6443 \
         -p 6443 \
-        -e K3S_TOKEN=$(cat $TEST_DIR/metadata/secret) \
+        -e K3S_TOKEN="$(cat $TEST_DIR/metadata/secret)" \
         -e K3S_DEBUG=true \
         ${SERVER_DOCKER_ARGS:-} \
         ${REGISTRY_CLUSTER_ARGS:-} \
@@ -497,7 +494,7 @@ export -f provision-registry-proxy
 # ---
 
 early-exit() {
-    printf "\033[33m$1\033[m\n"
+    printf "\033[33m%s\033[m\n" "$1"
     exit $2
 }
 export -f early-exit
@@ -514,7 +511,7 @@ run-test() {
     )
 
     export PROVISION_LOCK=$(mktemp)
-    ./scripts/test-runner $@ &
+    ./scripts/test-runner "$@" &
     pids+=($!)
 
     (
@@ -535,7 +532,7 @@ cleanup-test-env(){
       export NUM_AGENTS=1
       export AGENT_ARGS=''
       export SERVER_ARGS=''
-      export WAIT_SERVICES="${all_services[@]}"
+      export WAIT_SERVICES="${all_services[*]}"
 
       unset AGENT_1_ARGS AGENT_2_ARGS AGENT_3_ARGS AGENT_DOCKER_ARGS
       unset SERVER_1_ARGS SERVER_2_ARGS SERVER_3_ARGS SERVER_DOCKER_ARGS
@@ -547,7 +544,7 @@ cleanup-test-env(){
 
 count-running-tests(){
       local count=0
-      for pid in ${pids[@]}; do
+      for pid in "${pids[@]}"; do
           if [ $(pgrep -c -P $pid) -gt 0 ]; then
             ((count++))
           fi
@@ -569,9 +566,9 @@ e2e-test() {
         logOutput=$E2E_OUTPUT/$logName
     fi
     if [[ $label =~ ^PARALLEL.* ]]; then
-        LABEL=$label LOG_OUTPUT=$logOutput MAX_CONCURRENT_TESTS=3 run-test $@
+        LABEL=$label LOG_OUTPUT=$logOutput MAX_CONCURRENT_TESTS=3 run-test "$@"
     else
-        LABEL=$label LOG_OUTPUT=$logOutput run-test $@
+        LABEL=$label LOG_OUTPUT=$logOutput run-test "$@"
     fi
 
 }
@@ -593,14 +590,14 @@ test-run-sonobuoy() {
     if [ "$1" = "parallel" ] || [ "$2" = "parallel" ]; then
         label=PARALLEL \
             logName=e2e-STATUS-${ARCH}-parallel.log \
-            e2e-test ${sonobuoyParallelArgs[@]}
+            e2e-test "${sonobuoyParallelArgs[@]}"
         echo "Exit code $? for parallel start"
     fi
 
     if [ "$1" = "serial" ] || [ "$2" = "serial" ]; then
         label=SERIAL \
             logName=e2e-STATUS-${ARCH}-serial.log \
-            e2e-test ${sonobuoySerialArgs[@]}
+            e2e-test "${sonobuoySerialArgs[@]}"
         echo "Exit code $? for serial start"
     fi
 }
@@ -613,12 +610,12 @@ pid-cleanup() {
     local failCount=0
     set +e
     if [ $code -eq 0 ]; then
-        for pid in ${pids[@]}; do
+        for pid in "${pids[@]}"; do
             wait $pid || code=$?
         done
     fi
     if [ $code -ne 0 ]; then
-        for pid in ${pids[@]}; do
+        for pid in "${pids[@]}"; do
             pkill -P $pid
             wait $pid || failCount=$((failCount+1))
         done
@@ -629,7 +626,7 @@ pid-cleanup() {
     if [ $failCount -eq 0 ]; then
         printf '\033[32mAll tests passed.\033[m\n'
     else
-        printf "\033[31m$failCount tests failed.\033[m\n"
+        printf "\033[31m%s tests failed.\033[m\n" "$failCount"
         if [ "$DRONE_BUILD_EVENT" = 'tag' ]; then
             printf "\033[31mIgnoring test failures on tag.\033[m\n"
             code=0
diff --git a/tests/e2e/scripts/Dockerfile b/tests/e2e/scripts/Dockerfile
index deb2dc4132da..f6beedbdae7e 100644
--- a/tests/e2e/scripts/Dockerfile
+++ b/tests/e2e/scripts/Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:20.04
+FROM ubuntu:22.04
 ARG EXTERNAL_ENCODED_VPN
 ARG VPN_ENCODED_LOGIN