diff --git a/tests/container-smoke.sh b/tests/container-smoke.sh
index f0117e9..2079fa7 100755
--- a/tests/container-smoke.sh
+++ b/tests/container-smoke.sh
@@ -8,7 +8,6 @@ unconfigured="mohomo-docker-unconfigured-${suffix}"
 provider="mohomo-provider-smoke-${suffix}"
 network="mohomo-network-smoke-${suffix}"
 volume="mohomo-volume-smoke-${suffix}"
-cookie=""
 secret="container-smoke-secret"
 admin_password="container-smoke-admin-password"
 
@@ -21,7 +20,6 @@ cleanup() {
 	docker container rm --force "$container" "$unconfigured" "$provider" >/dev/null 2>&1 || true
 	docker volume rm "$volume" >/dev/null 2>&1 || true
 	docker network rm "$network" >/dev/null 2>&1 || true
-	[ -z "$cookie" ] || rm -f "$cookie"
 }
 trap cleanup EXIT INT TERM
 
@@ -51,27 +49,34 @@ assert_published_ports() {
 
 assert_web_login() {
 	web_port=$1
-	: > "$cookie"
-	setup_redirect=$(curl --silent --show-error --output /dev/null \
-		--write-out '%{http_code} %{redirect_url}' \
-		"http://127.0.0.1:${web_port}/setup")
-	if [ "$setup_redirect" != "303 http://127.0.0.1:${web_port}/login" ]; then
-		echo "configured Web UI exposed setup: ${setup_redirect}" >&2
-		exit 1
-	fi
-	login_html=$(curl --fail --silent --show-error --cookie-jar "$cookie" \
-		"http://127.0.0.1:${web_port}/login")
-	login_csrf=$(printf '%s' "$login_html" | sed -n 's/.*name="csrf" value="\([^"]*\)".*/\1/p' | head -1)
-	test -n "$login_csrf"
-	curl --fail --silent --show-error \
-		--cookie "$cookie" \
-		--cookie-jar "$cookie" \
-		--request POST \
-		--data-urlencode "csrf=${login_csrf}" \
-		--data-urlencode "password=${admin_password}" \
-		"http://127.0.0.1:${web_port}/login" >/dev/null
-	curl --fail --silent --show-error --cookie "$cookie" \
-		"http://127.0.0.1:${web_port}/config" | grep -F 'csrf-token' >/dev/null
+	docker run --rm --network host \
+		--env "WEB_PORT=${web_port}" \
+		--env "ADMIN_PASSWORD=${admin_password}" \
+		--entrypoint /bin/sh \
+		"$image" -c '
+			set -eu
+			cookie=$(mktemp)
+			setup_redirect=$(curl --silent --show-error --output /dev/null \
+				--write-out "%{http_code} %{redirect_url}" \
+				"http://127.0.0.1:${WEB_PORT}/setup")
+			if [ "$setup_redirect" != "303 http://127.0.0.1:${WEB_PORT}/login" ]; then
+				echo "configured Web UI exposed setup: ${setup_redirect}" >&2
+				exit 1
+			fi
+			login_html=$(curl --fail --silent --show-error --cookie-jar "$cookie" \
+				"http://127.0.0.1:${WEB_PORT}/login")
+			login_csrf=$(printf "%s" "$login_html" | sed -n "s/.*name=\"csrf\" value=\"\([^\"]*\)\".*/\1/p" | head -1)
+			test -n "$login_csrf"
+			curl --fail --silent --show-error \
+				--cookie "$cookie" \
+				--cookie-jar "$cookie" \
+				--request POST \
+				--data-urlencode "csrf=${login_csrf}" \
+				--data-urlencode "password=${ADMIN_PASSWORD}" \
+				"http://127.0.0.1:${WEB_PORT}/login" >/dev/null
+			curl --fail --silent --show-error --cookie "$cookie" \
+				"http://127.0.0.1:${WEB_PORT}/config" | grep -F csrf-token >/dev/null
+		'
 }
 
 default_compose=$(SUBSCRIPTION_URL=https://subscription.example.invalid/mihomo docker compose config)
@@ -150,7 +155,6 @@ if docker logs "$unconfigured" 2>&1 | grep -F 'web UI listening' >/dev/null; the
 	exit 1
 fi
 docker container rm "$unconfigured" >/dev/null
-cookie=$(mktemp)
 
 docker run --detach \
 	--name "$container" \