diff --git a/common/.codespelldict b/common/.codespelldict
new file mode 100644
index 0000000000..bd2f5da9a3
--- /dev/null
+++ b/common/.codespelldict
@@ -0,0 +1,14 @@
+alterting->altering
+annotationg->annotating
+assemlbe->assemble
+capabiltiies->capabilities
+custommizing->customizing
+eaxecutes->executes
+maximumn->maximum
+mountns->mounts
+name_missmatch->name_mismatch
+notaibly->notably
+pessimitically->pessimistically
+recoreded->recorded
+specicifed->specified
+unsuppored->unsupported
diff --git a/common/.codespellrc b/common/.codespellrc
index c97ba88c4a..138da03118 100644
--- a/common/.codespellrc
+++ b/common/.codespellrc
@@ -1,4 +1,15 @@
+# https://github.com/codespell-project/codespell#using-a-config-file
 [codespell]
-skip = ./vendor,./.git #,bin,vendor,.git,go.sum,changelog.txt,.cirrus.yml,"RELEASE_NOTES.md,*.xz,*.gz,*.tar,*.tgz,bin2img,*ico,*.png,*.1,*.5,copyimg,*.orig,apidoc.go"
-ignore-words-list = clos,creat
 
+# Comma-separated list of files to skip.
+skip = ./vendor,./.git #,bin,vendor,.git,go.sum,changelog.txt,.cirrus.yml,"RELEASE_NOTES.md,*.xz,*.gz,*.tar,*.tgz,bin2img,*ico,*.png,*.1,*.5,copyimg,*.orig,apidoc.go"
+
+# Comma separated list of words to be ignored. Words must be lowercased.
+ignore-words-list = clos,creat,ro,hastable,shouldnot
+
+# Custom dictionary file that contains spelling corrections.
+# Run with option '--dictionary=-' to include also default dictionary.
+dictionary = .codespelldict
+
+# Check file names as well.
+check-filenames = true
diff --git a/common/.github/workflows/validate.yml b/common/.github/workflows/validate.yml
index c466daf171..b149593f8c 100644
--- a/common/.github/workflows/validate.yml
+++ b/common/.github/workflows/validate.yml
@@ -22,7 +22,7 @@ jobs:
       # Version of codespell bundled with Ubuntu is way old, so use pip.
       run: pip install codespell
     - name: run codespell
-      run: codespell -L ro,hastable,shouldnot
+      run: codespell --dictionary=-
   lint:
     runs-on: ubuntu-22.04
     steps:
diff --git a/common/Makefile b/common/Makefile
index 8e9642e979..9eb657b1d0 100644
--- a/common/Makefile
+++ b/common/Makefile
@@ -103,7 +103,7 @@ test-unit: netavark-testplugin
 
 .PHONY: codespell
 codespell:
-	codespell -L ro,hastable,shouldnot -w
+	codespell --dictionary=- -w
 
 clean: ## Clean artifacts
 	$(MAKE) -C docs clean
diff --git a/common/docs/containers.conf.5.md b/common/docs/containers.conf.5.md
index df61681496..4734f4fcc9 100644
--- a/common/docs/containers.conf.5.md
+++ b/common/docs/containers.conf.5.md
@@ -577,7 +577,7 @@ The unit can be b (bytes), k (kilobytes), m (megabytes) or g (gigabytes).
 The format for the size is `<number><unit>`, e.g., `1b` or `3g`.
 If no unit is included then the size will be in bytes.
 When the limit is exceeded, the logfile will be rotated and the old one will be deleted.
-If the maximumn size is set to 0, then no limit will be applied,
+If the maximum size is set to 0, then no limit will be applied,
 and the logfile will not be rotated.
 
 **events_logger**="journald"
diff --git a/common/internal/attributedstring/slice_test.go b/common/internal/attributedstring/slice_test.go
index dd2c636cd6..734fb79d44 100644
--- a/common/internal/attributedstring/slice_test.go
+++ b/common/internal/attributedstring/slice_test.go
@@ -13,7 +13,7 @@ type testConfig struct {
 }
 
 const (
-	confingDefault    = `array=["1", "2", "3"]`
+	configDefault     = `array=["1", "2", "3"]`
 	configAppendFront = `array=[{append=true},"4", "5", "6"]`
 	configAppendMid   = `array=["7", {append=true}, "8"]`
 	configAppendBack  = `array=["9", {append=true}]`
@@ -43,19 +43,19 @@ func TestSliceLoading(t *testing.T) {
 		expectedErrorSubstring string
 	}{
 		// Load single configs
-		{[]string{confingDefault}, []string{"1", "2", "3"}, nil, ""},
+		{[]string{configDefault}, []string{"1", "2", "3"}, nil, ""},
 		{[]string{configAppendFront}, []string{"4", "5", "6"}, &bTrue, ""},
 		{[]string{configAppendMid}, []string{"7", "8"}, &bTrue, ""},
 		{[]string{configAppendBack}, []string{"9"}, &bTrue, ""},
 		{[]string{configAppendFalse}, []string{"10"}, &bFalse, ""},
 		// Append=true
-		{[]string{confingDefault, configAppendFront}, []string{"1", "2", "3", "4", "5", "6"}, &bTrue, ""},
-		{[]string{configAppendFront, confingDefault}, []string{"4", "5", "6", "1", "2", "3"}, &bTrue, ""}, // The attribute is sticky unless explicitly being turned off in a later config
-		{[]string{configAppendFront, confingDefault, configAppendBack}, []string{"4", "5", "6", "1", "2", "3", "9"}, &bTrue, ""},
+		{[]string{configDefault, configAppendFront}, []string{"1", "2", "3", "4", "5", "6"}, &bTrue, ""},
+		{[]string{configAppendFront, configDefault}, []string{"4", "5", "6", "1", "2", "3"}, &bTrue, ""}, // The attribute is sticky unless explicitly being turned off in a later config
+		{[]string{configAppendFront, configDefault, configAppendBack}, []string{"4", "5", "6", "1", "2", "3", "9"}, &bTrue, ""},
 		// Append=false
-		{[]string{confingDefault, configAppendFalse}, []string{"10"}, &bFalse, ""},
-		{[]string{confingDefault, configAppendMid, configAppendFalse}, []string{"10"}, &bFalse, ""},
-		{[]string{confingDefault, configAppendFalse, configAppendMid}, []string{"10", "7", "8"}, &bTrue, ""}, // Append can be re-enabled by a later config
+		{[]string{configDefault, configAppendFalse}, []string{"10"}, &bFalse, ""},
+		{[]string{configDefault, configAppendMid, configAppendFalse}, []string{"10"}, &bFalse, ""},
+		{[]string{configDefault, configAppendFalse, configAppendMid}, []string{"10", "7", "8"}, &bTrue, ""}, // Append can be re-enabled by a later config
 
 		// Error checks
 		{[]string{`array=["1", false]`}, nil, nil, `unsupported item in attributed string slice: false`},
@@ -84,7 +84,7 @@ func TestSliceEncoding(t *testing.T) {
 		expectedAppend *bool
 	}{
 		{
-			[]string{confingDefault},
+			[]string{configDefault},
 			"array = [\"1\", \"2\", \"3\"]\n",
 			[]string{"1", "2", "3"},
 			nil,
diff --git a/common/libimage/copier.go b/common/libimage/copier.go
index 1edf7d6cb9..b7017d17a3 100644
--- a/common/libimage/copier.go
+++ b/common/libimage/copier.go
@@ -518,8 +518,8 @@ func checkRegistrySourcesAllows(dest types.ImageReference) (insecure *bool, err
 		return nil, fmt.Errorf("registry %q denied by policy: not in allowed registries list (%s)", reference.Domain(dref), registrySources)
 	}
 
-	for _, inseureDomain := range sources.InsecureRegistries {
-		if inseureDomain == reference.Domain(dref) {
+	for _, insecureDomain := range sources.InsecureRegistries {
+		if insecureDomain == reference.Domain(dref) {
 			insecure := true
 			return &insecure, nil
 		}
diff --git a/common/libimage/image.go b/common/libimage/image.go
index 4d106d42f8..5221ad478e 100644
--- a/common/libimage/image.go
+++ b/common/libimage/image.go
@@ -67,7 +67,7 @@ type Image struct {
 	}
 }
 
-// reload the image and pessimitically clear all cached data.
+// reload the image and pessimistically clear all cached data.
 func (i *Image) reload() error {
 	logrus.Tracef("Reloading image %s", i.ID())
 	img, err := i.runtime.store.Image(i.ID())
@@ -611,7 +611,7 @@ func (i *Image) Untag(name string) error {
 	}
 
 	// FIXME: this is breaking Podman CI but must be re-enabled once
-	// c/storage supports alterting the digests of an image.  Then,
+	// c/storage supports altering the digests of an image.  Then,
 	// Podman will do the right thing.
 	//
 	// !!! Also make sure to re-enable the tests !!!
diff --git a/common/libimage/image_test.go b/common/libimage/image_test.go
index d80b4a23a7..75bdcbbf81 100644
--- a/common/libimage/image_test.go
+++ b/common/libimage/image_test.go
@@ -71,7 +71,7 @@ func TestImageFunctions(t *testing.T) {
 	// manifest list we chose it from.
 	digests := image.Digests()
 	require.Len(t, digests, 2)
-	require.Equal(t, origDigest.String(), digests[0].String(), "first recoreded digest should be the one of the image")
+	require.Equal(t, origDigest.String(), digests[0].String(), "first recorded digest should be the one of the image")
 
 	// containers/podman/issues/12729: make sure manifest lookup returns
 	// the correct error for both digests.
@@ -385,7 +385,7 @@ func TestUntag(t *testing.T) {
 			require.EqualError(t, err, test.expectError, "untag should have failed: %v", test)
 			continue
 		}
-		require.NoError(t, err, "untag should have succeedded: %v", test)
+		require.NoError(t, err, "untag should have succeeded: %v", test)
 		_, resolvedName, err := runtime.LookupImage(test.tag, nil)
 		require.Error(t, err, "image should not resolve after untag anymore (%s): %v", resolvedName, test)
 	}
diff --git a/common/libimage/image_tree.go b/common/libimage/image_tree.go
index 8143d3779c..0c2db810cc 100644
--- a/common/libimage/image_tree.go
+++ b/common/libimage/image_tree.go
@@ -53,7 +53,7 @@ func (i *Image) Tree(traverseChildren bool) (string, error) {
 		return tree.Print(), nil
 	}
 
-	// Walk all layers of the image and assemlbe their data.  Note that the
+	// Walk all layers of the image and assemble their data.  Note that the
 	// tree is constructed in reverse order to remain backwards compatible
 	// with Podman.
 	contents := []string{}
diff --git a/common/libimage/manifest_list.go b/common/libimage/manifest_list.go
index c36bfda968..6af9910699 100644
--- a/common/libimage/manifest_list.go
+++ b/common/libimage/manifest_list.go
@@ -314,7 +314,7 @@ func (m *ManifestList) Add(ctx context.Context, name string, options *ManifestLi
 	return newDigest, nil
 }
 
-// Options for annotationg a manifest list.
+// Options for annotating a manifest list.
 type ManifestListAnnotateOptions struct {
 	// Add the specified annotations to the added image.
 	Annotations map[string]string
diff --git a/common/libimage/pull.go b/common/libimage/pull.go
index bc8e849816..63fd307dfd 100644
--- a/common/libimage/pull.go
+++ b/common/libimage/pull.go
@@ -31,7 +31,7 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
-// PullOptions allows for custommizing image pulls.
+// PullOptions allows for customizing image pulls.
 type PullOptions struct {
 	CopyOptions
 
diff --git a/common/libimage/push.go b/common/libimage/push.go
index ed1d90c14b..7c4aec7109 100644
--- a/common/libimage/push.go
+++ b/common/libimage/push.go
@@ -13,7 +13,7 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
-// PushOptions allows for custommizing image pushes.
+// PushOptions allows for customizing image pushes.
 type PushOptions struct {
 	CopyOptions
 }
diff --git a/common/libimage/runtime.go b/common/libimage/runtime.go
index 1948fe0ad8..a5f676d0cd 100644
--- a/common/libimage/runtime.go
+++ b/common/libimage/runtime.go
@@ -162,7 +162,7 @@ func (r *Runtime) storageToImage(storageImage *storage.Image, ref types.ImageRef
 	}
 }
 
-// Exists returns true if the specicifed image exists in the local containers
+// Exists returns true if the specified image exists in the local containers
 // storage.  Note that it may return false if an image corrupted.
 func (r *Runtime) Exists(name string) (bool, error) {
 	image, _, err := r.LookupImage(name, nil)
diff --git a/common/libnetwork/cni/run_test.go b/common/libnetwork/cni/run_test.go
index 498ed6d472..c81661073d 100644
--- a/common/libnetwork/cni/run_test.go
+++ b/common/libnetwork/cni/run_test.go
@@ -47,14 +47,14 @@ var _ = Describe("run CNI", func() {
 	const cniVarDir = "/var/lib/cni"
 
 	// runTest is a helper function to run a test. It ensures that each test
-	// is run in its own netns. It also creates a mountns to mount a tmpfs to /var/lib/cni.
+	// is run in its own netns. It also creates a mounts to mount a tmpfs to /var/lib/cni.
 	runTest := func(run func()) {
 		_ = netNSTest.Do(func(_ ns.NetNS) error {
 			defer GinkgoRecover()
 			err := os.MkdirAll(cniVarDir, 0o755)
 			Expect(err).To(BeNil(), "Failed to create cniVarDir")
 			err = unix.Unshare(unix.CLONE_NEWNS)
-			Expect(err).To(BeNil(), "Failed to create new mountns")
+			Expect(err).To(BeNil(), "Failed to create new mounts")
 			err = unix.Mount("tmpfs", cniVarDir, "tmpfs", unix.MS_NOEXEC|unix.MS_NOSUID|unix.MS_NODEV, "")
 			Expect(err).To(BeNil(), "Failed to mount tmpfs for cniVarDir")
 			defer unix.Unmount(cniVarDir, 0) //nolint:errcheck
diff --git a/common/libnetwork/internal/util/interface.go b/common/libnetwork/internal/util/interface.go
index 650fcb193c..9b66e66a3e 100644
--- a/common/libnetwork/internal/util/interface.go
+++ b/common/libnetwork/internal/util/interface.go
@@ -7,7 +7,7 @@ import "github.com/containers/common/libnetwork/types"
 
 // NetUtil is a helper interface which all network interfaces should implement to allow easy code sharing
 type NetUtil interface {
-	// ForEach eaxecutes the given function for each network
+	// ForEach executes the given function for each network
 	ForEach(func(types.Network))
 	// Len returns the number of networks
 	Len() int
diff --git a/common/libnetwork/netavark/config_test.go b/common/libnetwork/netavark/config_test.go
index d799a18a2b..6814fdf35c 100644
--- a/common/libnetwork/netavark/config_test.go
+++ b/common/libnetwork/netavark/config_test.go
@@ -2162,7 +2162,7 @@ var _ = Describe("Config", func() {
 			logString := logBuffer.String()
 			Expect(logString).To(ContainSubstring("Error reading network config file \\\"%s/broken.json\\\": unexpected EOF", networkConfDir))
 			Expect(logString).To(ContainSubstring("Network config \\\"%s/invalid name.json\\\" has invalid name: \\\"invalid name\\\", skipping: names must match [a-zA-Z0-9][a-zA-Z0-9_.-]*: invalid argument", networkConfDir))
-			Expect(logString).To(ContainSubstring("Network config name \\\"name_miss\\\" does not match file name \\\"name_missmatch.json\\\", skipping"))
+			Expect(logString).To(ContainSubstring("Network config name \\\"name_miss\\\" does not match file name \\\"name_mismatch.json\\\", skipping"))
 			Expect(logString).To(ContainSubstring("Network config \\\"%s/wrongID.json\\\" could not be parsed, skipping: invalid network ID \\\"someID\\\"", networkConfDir))
 			Expect(logString).To(ContainSubstring("Network config \\\"%s/invalid_gateway.json\\\" could not be parsed, skipping: gateway 10.89.100.1 not in subnet 10.89.9.0/24", networkConfDir))
 		})
diff --git a/common/libnetwork/netavark/run_test.go b/common/libnetwork/netavark/run_test.go
index f75f70b9d4..487adb162a 100644
--- a/common/libnetwork/netavark/run_test.go
+++ b/common/libnetwork/netavark/run_test.go
@@ -43,7 +43,7 @@ var _ = Describe("run netavark", func() {
 	)
 
 	// runTest is a helper function to run a test. It ensures that each test
-	// is run in its own netns. It also creates a mountns to mount a tmpfs to /var/lib/cni.
+	// is run in its own netns. It also creates a mounts to mount a tmpfs to /var/lib/cni.
 	runTest := func(run func()) {
 		_ = netNSTest.Do(func(_ ns.NetNS) error {
 			defer GinkgoRecover()
diff --git a/common/libnetwork/netavark/testfiles/invalid/name_missmatch.json b/common/libnetwork/netavark/testfiles/invalid/name_mismatch.json
similarity index 100%
rename from common/libnetwork/netavark/testfiles/invalid/name_missmatch.json
rename to common/libnetwork/netavark/testfiles/invalid/name_mismatch.json
diff --git a/common/pkg/capabilities/capabilities_test.go b/common/pkg/capabilities/capabilities_test.go
index cd4ff4f3b2..5381553613 100644
--- a/common/pkg/capabilities/capabilities_test.go
+++ b/common/pkg/capabilities/capabilities_test.go
@@ -98,7 +98,7 @@ func TestValidateCapabilities(t *testing.T) {
 	require.Nil(t, err)
 }
 
-func TestValidateCapabilitieBadCapabilities(t *testing.T) {
+func TestValidateCapabilitiesBadCapabilities(t *testing.T) {
 	strSlice := []string{"CAP_SYS_ADMIN", "NO_ADMIN"}
 	err := ValidateCapabilities(strSlice)
 	assert.Error(t, err)
diff --git a/common/pkg/config/config.go b/common/pkg/config/config.go
index d25dd019a2..8463e47d01 100644
--- a/common/pkg/config/config.go
+++ b/common/pkg/config/config.go
@@ -918,7 +918,7 @@ func (c *Config) GetDefaultEnvEx(envHost, httpProxy bool) []string {
 }
 
 // Capabilities returns the capabilities parses the Add and Drop capability
-// list from the default capabiltiies for the container
+// list from the default capabilities for the container
 func (c *Config) Capabilities(user string, addCapabilities, dropCapabilities []string) ([]string, error) {
 	userNotRoot := func(user string) bool {
 		if user == "" || user == "root" || user == "0" {
@@ -1245,7 +1245,7 @@ func (c *Config) FindInitBinary() (string, error) {
 	if c.Engine.InitPath != "" {
 		return c.Engine.InitPath, nil
 	}
-	// keep old default working to guarantee backwards comapt
+	// keep old default working to guarantee backwards compat
 	if _, err := os.Stat(DefaultInitPath); err == nil {
 		return DefaultInitPath, nil
 	}
diff --git a/common/pkg/config/default.go b/common/pkg/config/default.go
index 9e65d5c201..b869d22fff 100644
--- a/common/pkg/config/default.go
+++ b/common/pkg/config/default.go
@@ -340,7 +340,7 @@ func defaultEngineConfig() (*EngineConfig, error) {
 
 	c.HelperBinariesDir.Set(defaultHelperBinariesDir)
 	if additionalHelperBinariesDir != "" {
-		// Prioritize addtionalHelperBinariesDir over defaults.
+		// Prioritize additionalHelperBinariesDir over defaults.
 		c.HelperBinariesDir.Set(append([]string{additionalHelperBinariesDir}, c.HelperBinariesDir.Get()...))
 	}
 	c.HooksDir.Set(DefaultHooksDirs)
@@ -556,7 +556,7 @@ func (c *Config) DNSServers() []string {
 	return c.Containers.DNSServers.Get()
 }
 
-// DNSSerches returns the default DNS searches to add to resolv.conf in containers.
+// DNSSearches returns the default DNS searches to add to resolv.conf in containers.
 func (c *Config) DNSSearches() []string {
 	return c.Containers.DNSSearches.Get()
 }
diff --git a/common/pkg/configmaps/filedriver/filedriver.go b/common/pkg/configmaps/filedriver/filedriver.go
index 0d4d2a555b..a2c056706b 100644
--- a/common/pkg/configmaps/filedriver/filedriver.go
+++ b/common/pkg/configmaps/filedriver/filedriver.go
@@ -79,7 +79,7 @@ func (d *Driver) Lookup(id string) ([]byte, error) {
 	return nil, fmt.Errorf("%s: %w", id, errNoSecretData)
 }
 
-// Store stores the bytes associated with an ID. An error is returned if the ID arleady exists
+// Store stores the bytes associated with an ID. An error is returned if the ID already exists
 func (d *Driver) Store(id string, data []byte) error {
 	d.lockfile.Lock()
 	defer d.lockfile.Unlock()
diff --git a/common/pkg/seccomp/seccomp_unsupported.go b/common/pkg/seccomp/seccomp_unsupported.go
index da5230c563..6b3afce009 100644
--- a/common/pkg/seccomp/seccomp_unsupported.go
+++ b/common/pkg/seccomp/seccomp_unsupported.go
@@ -15,12 +15,12 @@ import (
 
 var errNotSupported = errors.New("seccomp not enabled in this build")
 
-// LoadProfile returns an error on unsuppored systems
+// LoadProfile returns an error on unsupported systems
 func LoadProfile(body string, rs *specs.Spec) (*specs.LinuxSeccomp, error) {
 	return nil, errNotSupported
 }
 
-// GetDefaultProfile returns an error on unsuppored systems
+// GetDefaultProfile returns an error on unsupported systems
 func GetDefaultProfile(rs *specs.Spec) (*specs.LinuxSeccomp, error) {
 	return nil, errNotSupported
 }
diff --git a/common/pkg/secrets/filedriver/filedriver.go b/common/pkg/secrets/filedriver/filedriver.go
index 3054a2bb5a..1959cb069a 100644
--- a/common/pkg/secrets/filedriver/filedriver.go
+++ b/common/pkg/secrets/filedriver/filedriver.go
@@ -79,7 +79,7 @@ func (d *Driver) Lookup(id string) ([]byte, error) {
 	return nil, fmt.Errorf("%s: %w", id, errNoSecretData)
 }
 
-// Store stores the bytes associated with an ID. An error is returned if the ID arleady exists
+// Store stores the bytes associated with an ID. An error is returned if the ID already exists
 func (d *Driver) Store(id string, data []byte) error {
 	d.lockfile.Lock()
 	defer d.lockfile.Unlock()
diff --git a/common/pkg/ssh/connection_golang.go b/common/pkg/ssh/connection_golang.go
index 1abb5802cd..9e9690121a 100644
--- a/common/pkg/ssh/connection_golang.go
+++ b/common/pkg/ssh/connection_golang.go
@@ -262,7 +262,7 @@ func ValidateAndConfigure(uri *url.URL, iden string, insecureIsMachineConnection
 			}
 		}
 	}
-	var authMethods []ssh.AuthMethod // now we validate and check for the authorization methods, most notaibly public key authorization
+	var authMethods []ssh.AuthMethod // now we validate and check for the authorization methods, most notably public key authorization
 	if len(signers) > 0 {
 		dedup := make(map[string]ssh.Signer)
 		for _, s := range signers {