diff --git a/archive/tar_unix.go b/archive/tar_unix.go
index ed2b5e696..ac80df349 100644
--- a/archive/tar_unix.go
+++ b/archive/tar_unix.go
@@ -58,8 +58,7 @@ func setHeaderForSpecialDevice(hdr *tar.Header, name string, fi os.FileInfo) err
 		return errors.New("unsupported stat type")
 	}
 
-	// Rdev is int32 on darwin/bsd, int64 on linux/solaris
-	rdev := uint64(s.Rdev) // nolint: unconvert
+	rdev := uint64(s.Rdev) //nolint:unconvert // rdev is int32 on darwin/bsd, int64 on linux/solaris
 
 	// Currently go does not fill in the major/minors
 	if s.Mode&syscall.S_IFBLK != 0 ||
diff --git a/contrib/fuzz/content_fuzzer.go b/contrib/fuzz/content_fuzzer.go
index c0b67db57..da25650fd 100644
--- a/contrib/fuzz/content_fuzzer.go
+++ b/contrib/fuzz/content_fuzzer.go
@@ -14,7 +14,7 @@
    limitations under the License.
 */
 
-// nolint: golint
+//nolint:golint
 package fuzz
 
 import (
diff --git a/integration/client/restart_monitor_test.go b/integration/client/restart_monitor_test.go
index f80930719..0681f6fc8 100644
--- a/integration/client/restart_monitor_test.go
+++ b/integration/client/restart_monitor_test.go
@@ -40,8 +40,7 @@ import (
 	exec "golang.org/x/sys/execabs"
 )
 
-// the following nolint is for shutting up gometalinter on non-linux.
-// nolint: unused
+//nolint:unused // Ignore on non-Linux
 func newDaemonWithConfig(t *testing.T, configTOML string) (*Client, *daemon, func()) {
 	if testing.Short() {
 		t.Skip()
diff --git a/oci/spec_opts.go b/oci/spec_opts.go
index 8adb59180..45c4fc180 100644
--- a/oci/spec_opts.go
+++ b/oci/spec_opts.go
@@ -76,7 +76,6 @@ func setLinux(s *Spec) {
 	}
 }
 
-// nolint
 func setResources(s *Spec) {
 	if s.Linux != nil {
 		if s.Linux.Resources == nil {
@@ -85,7 +84,7 @@ func setResources(s *Spec) {
 	}
 }
 
-// nolint
+//nolint:unused // not used on all platforms
 func setResourcesWindows(s *Spec) {
 	if s.Windows != nil {
 		if s.Windows.Resources == nil {
@@ -94,7 +93,7 @@ func setResourcesWindows(s *Spec) {
 	}
 }
 
-// nolint
+//nolint:unused // not used on all platforms
 func setCPU(s *Spec) {
 	setResources(s)
 	if s.Linux != nil {
@@ -104,7 +103,7 @@ func setCPU(s *Spec) {
 	}
 }
 
-// nolint
+//nolint:deadcode,unused // not used on all platforms
 func setCPUWindows(s *Spec) {
 	setResourcesWindows(s)
 	if s.Windows != nil {
diff --git a/oci/spec_opts_linux_test.go b/oci/spec_opts_linux_test.go
index d41e0efca..2f48d52f2 100644
--- a/oci/spec_opts_linux_test.go
+++ b/oci/spec_opts_linux_test.go
@@ -31,7 +31,7 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-// nolint:gosec
+//nolint:gosec
 func TestWithUserID(t *testing.T) {
 	t.Parallel()
 
@@ -86,7 +86,7 @@ guest:x:405:100:guest:/dev/null:/sbin/nologin
 	}
 }
 
-// nolint:gosec
+//nolint:gosec
 func TestWithUsername(t *testing.T) {
 	t.Parallel()
 
@@ -148,7 +148,7 @@ guest:x:405:100:guest:/dev/null:/sbin/nologin
 
 }
 
-// nolint:gosec
+//nolint:gosec
 func TestWithAdditionalGIDs(t *testing.T) {
 	t.Parallel()
 	expectedPasswd := `root:x:0:0:root:/root:/bin/ash
diff --git a/oci/spec_opts_nonlinux.go b/oci/spec_opts_nonlinux.go
index 2f3ce80a4..e376a86b3 100644
--- a/oci/spec_opts_nonlinux.go
+++ b/oci/spec_opts_nonlinux.go
@@ -28,19 +28,22 @@ import (
 
 // WithAllCurrentCapabilities propagates the effective capabilities of the caller process to the container process.
 // The capability set may differ from WithAllKnownCapabilities when running in a container.
-// nolint: deadcode, unused
+//
+//nolint:unused
 var WithAllCurrentCapabilities = func(ctx context.Context, client Client, c *containers.Container, s *Spec) error {
 	return WithCapabilities(nil)(ctx, client, c, s)
 }
 
 // WithAllKnownCapabilities sets all the known linux capabilities for the container process
-// nolint: deadcode, unused
+//
+//nolint:unused
 var WithAllKnownCapabilities = func(ctx context.Context, client Client, c *containers.Container, s *Spec) error {
 	return WithCapabilities(nil)(ctx, client, c, s)
 }
 
 // WithBlockIO sets the container's blkio parameters
-// nolint: deadcode, unused
+//
+//nolint:unused
 func WithBlockIO(blockio interface{}) SpecOpts {
 	return func(ctx context.Context, _ Client, c *containers.Container, s *Spec) error {
 		return errors.New("blkio not supported")
@@ -48,7 +51,8 @@ func WithBlockIO(blockio interface{}) SpecOpts {
 }
 
 // WithCPUShares sets the container's cpu shares
-// nolint: deadcode, unused
+//
+//nolint:unused
 func WithCPUShares(shares uint64) SpecOpts {
 	return func(ctx context.Context, _ Client, c *containers.Container, s *Spec) error {
 		return nil
diff --git a/oci/utils_unix.go b/oci/utils_unix.go
index db75b0bad..921e882b2 100644
--- a/oci/utils_unix.go
+++ b/oci/utils_unix.go
@@ -127,7 +127,7 @@ func getDevices(path, containerPath string) ([]specs.LinuxDevice, error) {
 
 // TODO consider adding these consts to the OCI runtime-spec.
 const (
-	wildcardDevice = "a" //nolint // currently unused, but should be included when upstreaming to OCI runtime-spec.
+	wildcardDevice = "a" //nolint:deadcode,unused,varcheck // currently unused, but should be included when upstreaming to OCI runtime-spec.
 	blockDevice    = "b"
 	charDevice     = "c" // or "u"
 	fifoDevice     = "p"
@@ -148,7 +148,7 @@ func DeviceFromPath(path string) (*specs.LinuxDevice, error) {
 	}
 
 	var (
-		devNumber = uint64(stat.Rdev) //nolint: unconvert // the type is 32bit on mips.
+		devNumber = uint64(stat.Rdev) //nolint:unconvert // the type is 32bit on mips.
 		major     = unix.Major(devNumber)
 		minor     = unix.Minor(devNumber)
 	)
diff --git a/pkg/cri/opts/container.go b/pkg/cri/opts/container.go
index 85fd2fdfe..5ea1b8739 100644
--- a/pkg/cri/opts/container.go
+++ b/pkg/cri/opts/container.go
@@ -83,7 +83,7 @@ func WithVolumes(volumeMounts map[string]string) containerd.NewContainerOpts {
 		// if it fails but not RM snapshot data.
 		// refer to https://github.com/containerd/containerd/pull/1868
 		// https://github.com/containerd/containerd/pull/1785
-		defer os.Remove(root) // nolint: errcheck
+		defer os.Remove(root)
 
 		unmounter := func(mountPath string) {
 			if uerr := mount.Unmount(mountPath, 0); uerr != nil {
diff --git a/pkg/cri/sbserver/service.go b/pkg/cri/sbserver/service.go
index 02198f586..1d5b5d279 100644
--- a/pkg/cri/sbserver/service.go
+++ b/pkg/cri/sbserver/service.go
@@ -117,7 +117,7 @@ type criService struct {
 	baseOCISpecs map[string]*oci.Spec
 	// allCaps is the list of the capabilities.
 	// When nil, parsed from CapEff of /proc/self/status.
-	allCaps []string // nolint
+	allCaps []string //nolint:unused // Ignore on non-Linux
 	// unpackDuplicationSuppressor is used to make sure that there is only
 	// one in-flight fetch request or unpack handler for a given descriptor's
 	// or chain ID.
diff --git a/pkg/cri/server/service.go b/pkg/cri/server/service.go
index 2e2cca42b..0e411fa44 100644
--- a/pkg/cri/server/service.go
+++ b/pkg/cri/server/service.go
@@ -113,7 +113,7 @@ type criService struct {
 	baseOCISpecs map[string]*oci.Spec
 	// allCaps is the list of the capabilities.
 	// When nil, parsed from CapEff of /proc/self/status.
-	allCaps []string // nolint
+	allCaps []string //nolint:unused // Ignore on non-Linux
 	// unpackDuplicationSuppressor is used to make sure that there is only
 	// one in-flight fetch request or unpack handler for a given descriptor's
 	// or chain ID.
diff --git a/pkg/cri/store/container/container.go b/pkg/cri/store/container/container.go
index a5e35396b..524b58291 100644
--- a/pkg/cri/store/container/container.go
+++ b/pkg/cri/store/container/container.go
@@ -208,6 +208,6 @@ func (s *Store) Delete(id string) {
 		c.IO.Close()
 	}
 	s.labels.Release(c.ProcessLabel)
-	s.idIndex.Delete(id) // nolint: errcheck
+	s.idIndex.Delete(id)
 	delete(s.containers, id)
 }
diff --git a/pkg/cri/store/image/image.go b/pkg/cri/store/image/image.go
index 592384f35..d5f3d12b5 100644
--- a/pkg/cri/store/image/image.go
+++ b/pkg/cri/store/image/image.go
@@ -246,6 +246,6 @@ func (s *store) delete(id, ref string) {
 		return
 	}
 	// Remove the image if it is not referenced any more.
-	s.digestSet.Remove(digest) // nolint: errcheck
+	s.digestSet.Remove(digest)
 	delete(s.images, digest.String())
 }
diff --git a/pkg/cri/store/sandbox/sandbox.go b/pkg/cri/store/sandbox/sandbox.go
index 1cf208e4c..35e4603a2 100644
--- a/pkg/cri/store/sandbox/sandbox.go
+++ b/pkg/cri/store/sandbox/sandbox.go
@@ -160,6 +160,6 @@ func (s *Store) Delete(id string) {
 		return
 	}
 	s.labels.Release(s.sandboxes[id].ProcessLabel)
-	s.idIndex.Delete(id) // nolint: errcheck
+	s.idIndex.Delete(id)
 	delete(s.sandboxes, id)
 }
diff --git a/pkg/netns/netns_linux.go b/pkg/netns/netns_linux.go
index 09b5c9791..03f68a568 100644
--- a/pkg/netns/netns_linux.go
+++ b/pkg/netns/netns_linux.go
@@ -77,7 +77,7 @@ func newNS(baseDir string) (nsPath string, err error) {
 	defer func() {
 		// Ensure the mount point is cleaned up on errors
 		if err != nil {
-			os.RemoveAll(nsPath) // nolint: errcheck
+			os.RemoveAll(nsPath)
 		}
 	}()
 
@@ -107,7 +107,7 @@ func newNS(baseDir string) (nsPath string, err error) {
 		}
 
 		// Put this thread back to the orig ns, since it might get reused (pre go1.10)
-		defer origNS.Set() // nolint: errcheck
+		defer origNS.Set()
 
 		// bind mount the netns from the current thread (from /proc) onto the
 		// mount point. This causes the namespace to persist, even when there
@@ -214,6 +214,6 @@ func (n *NetNS) Do(f func(cnins.NetNS) error) error {
 	if err != nil {
 		return fmt.Errorf("get netns fd: %w", err)
 	}
-	defer ns.Close() // nolint: errcheck
+	defer ns.Close()
 	return ns.Do(f)
 }
diff --git a/pkg/progress/escape.go b/pkg/progress/escape.go
index d9ce5b088..e648fdda3 100644
--- a/pkg/progress/escape.go
+++ b/pkg/progress/escape.go
@@ -19,6 +19,6 @@ package progress
 const (
 	escape = "\x1b"
 	reset  = escape + "[0m"
-	red    = escape + "[31m" // nolint: deadcode, varcheck, unused
+	red    = escape + "[31m" //nolint:deadcode,unused,varcheck
 	green  = escape + "[32m"
 )
diff --git a/pkg/runtimeoptions/v1/doc.go b/pkg/runtimeoptions/v1/doc.go
index 62525652f..9617e7404 100644
--- a/pkg/runtimeoptions/v1/doc.go
+++ b/pkg/runtimeoptions/v1/doc.go
@@ -14,4 +14,4 @@
    limitations under the License.
 */
 
-package runtimeoptions_v1 //nolint
+package runtimeoptions_v1 //nolint:revive // Ignore var-naming: don't use an underscore in package name (revive)