diff --git a/graph/export.go b/graph/export.go
index 7f7e972053..3a47f318e4 100644
--- a/graph/export.go
+++ b/graph/export.go
@@ -29,11 +29,11 @@ func (s *TagStore) ImageExport(names []string, outStream io.Writer) error {
 	}
 	defer os.RemoveAll(tempdir)
 
-	rootRepoMap := map[string]Repository{}
+	rootRepoMap := map[string]repository{}
 	addKey := func(name string, tag string, id string) {
 		logrus.Debugf("add key [%s:%s]", name, tag)
 		if repo, ok := rootRepoMap[name]; !ok {
-			rootRepoMap[name] = Repository{tag: id}
+			rootRepoMap[name] = repository{tag: id}
 		} else {
 			repo[tag] = id
 		}
@@ -163,7 +163,7 @@ func (s *TagStore) exportImage(name, tempdir string) error {
 		if err != nil {
 			return err
 		}
-		if err := s.ImageTarLayer(n, fsTar); err != nil {
+		if err := s.imageTarLayer(n, fsTar); err != nil {
 			return err
 		}
 
diff --git a/graph/graph.go b/graph/graph.go
index 0fedee0b7f..845ed33d24 100644
--- a/graph/graph.go
+++ b/graph/graph.go
@@ -123,10 +123,10 @@ const (
 )
 
 var (
-	// ErrDigestNotSet is used when request the digest for a layer
+	// errDigestNotSet is used when request the digest for a layer
 	// but the layer has no digest value or content to compute the
 	// the digest.
-	ErrDigestNotSet = errors.New("digest is not set for layer")
+	errDigestNotSet = errors.New("digest is not set for layer")
 )
 
 // NewGraph instantiates a new graph at the given root path in the filesystem.
@@ -368,7 +368,7 @@ func createRootFilesystemInDriver(graph *Graph, id, parent string) error {
 // TempLayerArchive creates a temporary archive of the given image's filesystem layer.
 //   The archive is stored on disk and will be automatically deleted as soon as has been read.
 //   If output is not nil, a human-readable progress bar will be written to it.
-func (graph *Graph) TempLayerArchive(id string, sf *streamformatter.StreamFormatter, output io.Writer) (*archive.TempArchive, error) {
+func (graph *Graph) tempLayerArchive(id string, sf *streamformatter.StreamFormatter, output io.Writer) (*archive.TempArchive, error) {
 	image, err := graph.Get(id)
 	if err != nil {
 		return nil, err
@@ -378,7 +378,7 @@ func (graph *Graph) TempLayerArchive(id string, sf *streamformatter.StreamFormat
 		return nil, err
 	}
 	defer os.RemoveAll(tmp)
-	a, err := graph.TarLayer(image)
+	a, err := graph.tarLayer(image)
 	if err != nil {
 		return nil, err
 	}
@@ -505,9 +505,9 @@ func (graph *Graph) Release(sessionID string, layerIDs ...string) {
 	graph.retained.Delete(sessionID, layerIDs)
 }
 
-// Heads returns all heads in the graph, keyed by id.
+// heads returns all heads in the graph, keyed by id.
 // A head is an image which is not the parent of another image in the graph.
-func (graph *Graph) Heads() map[string]*image.Image {
+func (graph *Graph) heads() map[string]*image.Image {
 	heads := make(map[string]*image.Image)
 	graph.walkAll(func(image *image.Image) {
 		// if it has no children, then it's not a parent, so it's an head
@@ -518,11 +518,11 @@ func (graph *Graph) Heads() map[string]*image.Image {
 	return heads
 }
 
-// TarLayer returns a tar archive of the image's filesystem layer.
-func (graph *Graph) TarLayer(img *image.Image) (arch io.ReadCloser, err error) {
+// tarLayer returns a tar archive of the image's filesystem layer.
+func (graph *Graph) tarLayer(img *image.Image) (arch io.ReadCloser, err error) {
 	rdr, err := graph.assembleTarLayer(img)
 	if err != nil {
-		logrus.Debugf("[graph] TarLayer with traditional differ: %s", img.ID)
+		logrus.Debugf("[graph] tarLayer with traditional differ: %s", img.ID)
 		return graph.driver.Diff(img.ID, img.Parent)
 	}
 	return rdr, nil
@@ -598,8 +598,8 @@ func (graph *Graph) saveSize(root string, size int64) error {
 	return nil
 }
 
-// SetLayerDigest sets the digest for the image layer to the provided value.
-func (graph *Graph) SetLayerDigest(id string, dgst digest.Digest) error {
+// setLayerDigestWithLock sets the digest for the image layer to the provided value.
+func (graph *Graph) setLayerDigestWithLock(id string, dgst digest.Digest) error {
 	graph.imageMutex.Lock(id)
 	defer graph.imageMutex.Unlock(id)
 
@@ -613,8 +613,8 @@ func (graph *Graph) setLayerDigest(id string, dgst digest.Digest) error {
 	return nil
 }
 
-// GetLayerDigest gets the digest for the provide image layer id.
-func (graph *Graph) GetLayerDigest(id string) (digest.Digest, error) {
+// getLayerDigestWithLock gets the digest for the provide image layer id.
+func (graph *Graph) getLayerDigestWithLock(id string) (digest.Digest, error) {
 	graph.imageMutex.Lock(id)
 	defer graph.imageMutex.Unlock(id)
 
@@ -626,44 +626,31 @@ func (graph *Graph) getLayerDigest(id string) (digest.Digest, error) {
 	cs, err := ioutil.ReadFile(filepath.Join(root, digestFileName))
 	if err != nil {
 		if os.IsNotExist(err) {
-			return "", ErrDigestNotSet
+			return "", errDigestNotSet
 		}
 		return "", err
 	}
 	return digest.ParseDigest(string(cs))
 }
 
-// SetV1CompatibilityConfig stores the v1Compatibility JSON data associated
+// setV1CompatibilityConfig stores the v1Compatibility JSON data associated
 // with the image in the manifest to the disk
-func (graph *Graph) SetV1CompatibilityConfig(id string, data []byte) error {
-	graph.imageMutex.Lock(id)
-	defer graph.imageMutex.Unlock(id)
-
-	return graph.setV1CompatibilityConfig(id, data)
-}
 func (graph *Graph) setV1CompatibilityConfig(id string, data []byte) error {
 	root := graph.imageRoot(id)
 	return ioutil.WriteFile(filepath.Join(root, v1CompatibilityFileName), data, 0600)
 }
 
-// GetV1CompatibilityConfig reads the v1Compatibility JSON data for the image
+// getV1CompatibilityConfig reads the v1Compatibility JSON data for the image
 // from the disk
-func (graph *Graph) GetV1CompatibilityConfig(id string) ([]byte, error) {
-	graph.imageMutex.Lock(id)
-	defer graph.imageMutex.Unlock(id)
-
-	return graph.getV1CompatibilityConfig(id)
-}
-
 func (graph *Graph) getV1CompatibilityConfig(id string) ([]byte, error) {
 	root := graph.imageRoot(id)
 	return ioutil.ReadFile(filepath.Join(root, v1CompatibilityFileName))
 }
 
-// GenerateV1CompatibilityChain makes sure v1Compatibility JSON data exists
+// generateV1CompatibilityChain makes sure v1Compatibility JSON data exists
 // for the image. If it doesn't it generates and stores it for the image and
 // all of it's parents based on the image config JSON.
-func (graph *Graph) GenerateV1CompatibilityChain(id string) ([]byte, error) {
+func (graph *Graph) generateV1CompatibilityChain(id string) ([]byte, error) {
 	graph.imageMutex.Lock(id)
 	defer graph.imageMutex.Unlock(id)
 
@@ -681,7 +668,7 @@ func (graph *Graph) GenerateV1CompatibilityChain(id string) ([]byte, error) {
 	img.ID = strings.TrimPrefix(img.ID, digestPrefix)
 
 	if img.Parent != "" {
-		parentConfig, err := graph.GenerateV1CompatibilityChain(img.Parent)
+		parentConfig, err := graph.generateV1CompatibilityChain(img.Parent)
 		if err != nil {
 			return nil, err
 		}
@@ -703,18 +690,6 @@ func (graph *Graph) GenerateV1CompatibilityChain(id string) ([]byte, error) {
 	return json, nil
 }
 
-// RawJSON returns the JSON representation for an image as a byte array.
-func (graph *Graph) RawJSON(id string) ([]byte, error) {
-	root := graph.imageRoot(id)
-
-	buf, err := ioutil.ReadFile(jsonPath(root))
-	if err != nil {
-		return nil, fmt.Errorf("Failed to read json for image %s: %s", id, err)
-	}
-
-	return buf, nil
-}
-
 func jsonPath(root string) string {
 	return filepath.Join(root, jsonFileName)
 }
diff --git a/graph/history.go b/graph/history.go
index 1b5de32f06..de702987a4 100644
--- a/graph/history.go
+++ b/graph/history.go
@@ -9,9 +9,9 @@ import (
 	"github.com/docker/docker/utils"
 )
 
-// WalkHistory calls the handler function for each image in the
+// walkHistory calls the handler function for each image in the
 // provided images lineage starting from immediate parent.
-func (graph *Graph) WalkHistory(img *image.Image, handler func(image.Image) error) (err error) {
+func (graph *Graph) walkHistory(img *image.Image, handler func(image.Image) error) (err error) {
 	currentImg := img
 	for currentImg != nil {
 		if handler != nil {
@@ -85,7 +85,7 @@ func (s *TagStore) History(name string) ([]*types.ImageHistory, error) {
 
 	history := []*types.ImageHistory{}
 
-	err = s.graph.WalkHistory(foundImage, func(img image.Image) error {
+	err = s.graph.walkHistory(foundImage, func(img image.Image) error {
 		history = append(history, &types.ImageHistory{
 			ID:        img.ID,
 			Created:   img.Created.Unix(),
@@ -108,12 +108,12 @@ func (graph *Graph) GetParent(img *image.Image) (*image.Image, error) {
 	return graph.Get(img.Parent)
 }
 
-// GetParentsSize returns the combined size of all parent images. If there is
+// getParentsSize returns the combined size of all parent images. If there is
 // no parent image or it's unavailable, it returns 0.
-func (graph *Graph) GetParentsSize(img *image.Image) int64 {
+func (graph *Graph) getParentsSize(img *image.Image) int64 {
 	parentImage, err := graph.GetParent(img)
 	if err != nil || parentImage == nil {
 		return 0
 	}
-	return parentImage.Size + graph.GetParentsSize(parentImage)
+	return parentImage.Size + graph.getParentsSize(parentImage)
 }
diff --git a/graph/list.go b/graph/list.go
index 8110beed28..675110ff61 100644
--- a/graph/list.go
+++ b/graph/list.go
@@ -64,7 +64,7 @@ func (s *TagStore) Images(filterArgs, filter string, all bool) ([]*types.Image,
 	if all && filtTagged {
 		allImages = s.graph.Map()
 	} else {
-		allImages = s.graph.Heads()
+		allImages = s.graph.heads()
 	}
 
 	lookup := make(map[string]*types.Image)
@@ -122,7 +122,7 @@ func (s *TagStore) Images(filterArgs, filter string, all bool) ([]*types.Image,
 					}
 				}
 				if filtTagged {
-					newImage := newImage(image, s.graph.GetParentsSize(image))
+					newImage := newImage(image, s.graph.getParentsSize(image))
 
 					if utils.DigestReference(ref) {
 						newImage.RepoTags = []string{}
@@ -158,7 +158,7 @@ func (s *TagStore) Images(filterArgs, filter string, all bool) ([]*types.Image,
 					continue
 				}
 			}
-			newImage := newImage(image, s.graph.GetParentsSize(image))
+			newImage := newImage(image, s.graph.getParentsSize(image))
 			newImage.RepoTags = []string{"<none>:<none>"}
 			newImage.RepoDigests = []string{"<none>@<none>"}
 
diff --git a/graph/load.go b/graph/load.go
index f74dced216..3be3a8e815 100644
--- a/graph/load.go
+++ b/graph/load.go
@@ -64,7 +64,7 @@ func (s *TagStore) Load(inTar io.ReadCloser, outStream io.Writer) error {
 	}
 	defer reposJSONFile.Close()
 
-	repositories := map[string]Repository{}
+	repositories := map[string]repository{}
 	if err := json.NewDecoder(reposJSONFile).Decode(&repositories); err != nil {
 		return err
 	}
diff --git a/graph/pull.go b/graph/pull.go
index b640348579..ce60047913 100644
--- a/graph/pull.go
+++ b/graph/pull.go
@@ -24,8 +24,8 @@ type ImagePullConfig struct {
 	OutStream io.Writer
 }
 
-// Puller is an interface that abstracts pulling for different API versions.
-type Puller interface {
+// puller is an interface that abstracts pulling for different API versions.
+type puller interface {
 	// Pull tries to pull the image referenced by `tag`
 	// Pull returns an error if any, as well as a boolean that determines whether to retry Pull on the next configured endpoint.
 	//
@@ -33,12 +33,12 @@ type Puller interface {
 	Pull(tag string) (fallback bool, err error)
 }
 
-// NewPuller returns a Puller interface that will pull from either a v1 or v2
+// newPuller returns a Puller interface that will pull from either a v1 or v2
 // registry. The endpoint argument contains a Version field that determines
 // whether a v1 or v2 puller will be created. The other parameters are passed
 // through to the underlying puller implementation for use during the actual
 // pull operation.
-func NewPuller(s *TagStore, endpoint registry.APIEndpoint, repoInfo *registry.RepositoryInfo, imagePullConfig *ImagePullConfig, sf *streamformatter.StreamFormatter) (Puller, error) {
+func newPuller(s *TagStore, endpoint registry.APIEndpoint, repoInfo *registry.RepositoryInfo, imagePullConfig *ImagePullConfig, sf *streamformatter.StreamFormatter) (puller, error) {
 	switch endpoint.Version {
 	case registry.APIVersion2:
 		return &v2Puller{
@@ -101,7 +101,7 @@ func (s *TagStore) Pull(image string, tag string, imagePullConfig *ImagePullConf
 	for _, endpoint := range endpoints {
 		logrus.Debugf("Trying to pull %s from %s %s", repoInfo.LocalName, endpoint.URL, endpoint.Version)
 
-		puller, err := NewPuller(s, endpoint, repoInfo, imagePullConfig, sf)
+		puller, err := newPuller(s, endpoint, repoInfo, imagePullConfig, sf)
 		if err != nil {
 			lastErr = err
 			continue
diff --git a/graph/pull_v2.go b/graph/pull_v2.go
index 5058125b15..9eb0b5dda7 100644
--- a/graph/pull_v2.go
+++ b/graph/pull_v2.go
@@ -34,7 +34,7 @@ type v2Puller struct {
 
 func (p *v2Puller) Pull(tag string) (fallback bool, err error) {
 	// TODO(tiborvass): was ReceiveTimeout
-	p.repo, err = NewV2Repository(p.repoInfo, p.endpoint, p.config.MetaHeaders, p.config.AuthConfig, "pull")
+	p.repo, err = newV2Repository(p.repoInfo, p.endpoint, p.config.MetaHeaders, p.config.AuthConfig, "pull")
 	if err != nil {
 		logrus.Warnf("Error getting v2 registry: %v", err)
 		return true, err
@@ -404,7 +404,7 @@ func (p *v2Puller) pullV2Tag(out io.Writer, tag, taggedName string) (tagUpdated
 
 	// Check for new tag if no layers downloaded
 	if !tagUpdated {
-		repo, err := p.Get(p.repoInfo.LocalName)
+		repo, err := p.get(p.repoInfo.LocalName)
 		if err != nil {
 			return false, err
 		}
@@ -423,7 +423,7 @@ func (p *v2Puller) pullV2Tag(out io.Writer, tag, taggedName string) (tagUpdated
 		// use the digest whether we pull by it or not. Unfortunately, the tag
 		// store treats the digest as a separate tag, meaning there may be an
 		// untagged digest image that would seem to be dangling by a user.
-		if err = p.SetDigest(p.repoInfo.LocalName, tag, firstID); err != nil {
+		if err = p.setDigest(p.repoInfo.LocalName, tag, firstID); err != nil {
 			return false, err
 		}
 	} else {
@@ -570,7 +570,7 @@ func (p *v2Puller) attemptIDReuse(imgs []contentAddressableDescriptor) {
 		idMap[img.compatibilityID] = struct{}{}
 
 		if p.graph.Exists(img.compatibilityID) {
-			if _, err := p.graph.GenerateV1CompatibilityChain(img.compatibilityID); err != nil {
+			if _, err := p.graph.generateV1CompatibilityChain(img.compatibilityID); err != nil {
 				logrus.Debugf("Migration v1Compatibility generation error: %v", err)
 				return
 			}
diff --git a/graph/push.go b/graph/push.go
index ae5802dcb9..750eec50e0 100644
--- a/graph/push.go
+++ b/graph/push.go
@@ -27,8 +27,8 @@ type ImagePushConfig struct {
 	OutStream io.Writer
 }
 
-// Pusher is an interface that abstracts pushing for different API versions.
-type Pusher interface {
+// pusher is an interface that abstracts pushing for different API versions.
+type pusher interface {
 	// Push tries to push the image configured at the creation of Pusher.
 	// Push returns an error if any, as well as a boolean that determines whether to retry Push on the next configured endpoint.
 	//
@@ -36,12 +36,12 @@ type Pusher interface {
 	Push() (fallback bool, err error)
 }
 
-// NewPusher creates a new Pusher interface that will push to either a v1 or v2
+// newPusher creates a new Pusher interface that will push to either a v1 or v2
 // registry. The endpoint argument contains a Version field that determines
 // whether a v1 or v2 pusher will be created. The other parameters are passed
 // through to the underlying pusher implementation for use during the actual
 // push operation.
-func (s *TagStore) NewPusher(endpoint registry.APIEndpoint, localRepo Repository, repoInfo *registry.RepositoryInfo, imagePushConfig *ImagePushConfig, sf *streamformatter.StreamFormatter) (Pusher, error) {
+func (s *TagStore) newPusher(endpoint registry.APIEndpoint, localRepo repository, repoInfo *registry.RepositoryInfo, imagePushConfig *ImagePushConfig, sf *streamformatter.StreamFormatter) (pusher, error) {
 	switch endpoint.Version {
 	case registry.APIVersion2:
 		return &v2Pusher{
@@ -100,7 +100,7 @@ func (s *TagStore) Push(localName string, imagePushConfig *ImagePushConfig) erro
 	for _, endpoint := range endpoints {
 		logrus.Debugf("Trying to push %s to %s %s", repoInfo.CanonicalName, endpoint.URL, endpoint.Version)
 
-		pusher, err := s.NewPusher(endpoint, localRepo, repoInfo, imagePushConfig, sf)
+		pusher, err := s.newPusher(endpoint, localRepo, repoInfo, imagePushConfig, sf)
 		if err != nil {
 			lastErr = err
 			continue
diff --git a/graph/push_v1.go b/graph/push_v1.go
index 0f3e1593a5..01ad73ed20 100644
--- a/graph/push_v1.go
+++ b/graph/push_v1.go
@@ -20,7 +20,7 @@ import (
 type v1Pusher struct {
 	*TagStore
 	endpoint  registry.APIEndpoint
-	localRepo Repository
+	localRepo repository
 	repoInfo  *registry.RepositoryInfo
 	config    *ImagePushConfig
 	sf        *streamformatter.StreamFormatter
@@ -296,7 +296,7 @@ func (p *v1Pusher) pushImage(imgID, ep string) (checksum string, err error) {
 		return "", err
 	}
 
-	layerData, err := p.graph.TempLayerArchive(imgID, p.sf, p.out)
+	layerData, err := p.graph.tempLayerArchive(imgID, p.sf, p.out)
 	if err != nil {
 		return "", fmt.Errorf("Failed to generate layer archive: %s", err)
 	}
@@ -346,7 +346,7 @@ func (p *v1Pusher) getV1ID(id string) (string, error) {
 // getV1Config returns v1Compatibility config for the image in the graph. If
 // there is no v1Compatibility file on disk for the image
 func (p *v1Pusher) getV1Config(id string) ([]byte, error) {
-	jsonData, err := p.graph.GenerateV1CompatibilityChain(id)
+	jsonData, err := p.graph.generateV1CompatibilityChain(id)
 	if err != nil {
 		return nil, err
 	}
diff --git a/graph/push_v2.go b/graph/push_v2.go
index 5ba51e986f..8586fa914a 100644
--- a/graph/push_v2.go
+++ b/graph/push_v2.go
@@ -27,7 +27,7 @@ const compressionBufSize = 32768
 type v2Pusher struct {
 	*TagStore
 	endpoint  registry.APIEndpoint
-	localRepo Repository
+	localRepo repository
 	repoInfo  *registry.RepositoryInfo
 	config    *ImagePushConfig
 	sf        *streamformatter.StreamFormatter
@@ -40,7 +40,7 @@ type v2Pusher struct {
 }
 
 func (p *v2Pusher) Push() (fallback bool, err error) {
-	p.repo, err = NewV2Repository(p.repoInfo, p.endpoint, p.config.MetaHeaders, p.config.AuthConfig, "push", "pull")
+	p.repo, err = newV2Repository(p.repoInfo, p.endpoint, p.config.MetaHeaders, p.config.AuthConfig, "push", "pull")
 	if err != nil {
 		logrus.Debugf("Error getting v2 registry: %v", err)
 		return true, err
@@ -144,7 +144,7 @@ func (p *v2Pusher) pushV2Tag(tag string) error {
 		}
 
 		var exists bool
-		dgst, err := p.graph.GetLayerDigest(layer.ID)
+		dgst, err := p.graph.getLayerDigestWithLock(layer.ID)
 		switch err {
 		case nil:
 			if p.layersPushed[dgst] {
@@ -165,7 +165,7 @@ func (p *v2Pusher) pushV2Tag(tag string) error {
 				out.Write(p.sf.FormatProgress(stringid.TruncateID(layer.ID), "Image push failed", nil))
 				return err
 			}
-		case ErrDigestNotSet:
+		case errDigestNotSet:
 			// nop
 		case digest.ErrDigestInvalidFormat, digest.ErrDigestUnsupported:
 			return fmt.Errorf("error getting image checksum: %v", err)
@@ -180,7 +180,7 @@ func (p *v2Pusher) pushV2Tag(tag string) error {
 			}
 			if dgst == "" {
 				// Cache new checksum
-				if err := p.graph.SetLayerDigest(layer.ID, pushDigest); err != nil {
+				if err := p.graph.setLayerDigestWithLock(layer.ID, pushDigest); err != nil {
 					return err
 				}
 			}
@@ -188,7 +188,7 @@ func (p *v2Pusher) pushV2Tag(tag string) error {
 		}
 
 		// read v1Compatibility config, generate new if needed
-		jsonData, err := p.graph.GenerateV1CompatibilityChain(layer.ID)
+		jsonData, err := p.graph.generateV1CompatibilityChain(layer.ID)
 		if err != nil {
 			return err
 		}
@@ -230,7 +230,7 @@ func (p *v2Pusher) pushV2Image(bs distribution.BlobService, img *image.Image) (d
 	if err != nil {
 		return "", err
 	}
-	arch, err := p.graph.TarLayer(image)
+	arch, err := p.graph.tarLayer(image)
 	if err != nil {
 		return "", err
 	}
diff --git a/graph/registry.go b/graph/registry.go
index 5e44709ee7..a9a4ad187e 100644
--- a/graph/registry.go
+++ b/graph/registry.go
@@ -7,6 +7,8 @@ import (
 	"net/url"
 	"time"
 
+	"strings"
+
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/distribution"
 	"github.com/docker/distribution/digest"
@@ -17,7 +19,6 @@ import (
 	"github.com/docker/docker/cliconfig"
 	"github.com/docker/docker/registry"
 	"golang.org/x/net/context"
-	"strings"
 )
 
 type dumbCredentialStore struct {
@@ -28,10 +29,10 @@ func (dcs dumbCredentialStore) Basic(*url.URL) (string, string) {
 	return dcs.auth.Username, dcs.auth.Password
 }
 
-// NewV2Repository returns a repository (v2 only). It creates a HTTP transport
+// newV2Repository returns a repository (v2 only). It creates a HTTP transport
 // providing timeout settings and authentication support, and also verifies the
 // remote API version.
-func NewV2Repository(repoInfo *registry.RepositoryInfo, endpoint registry.APIEndpoint, metaHeaders http.Header, authConfig *cliconfig.AuthConfig, actions ...string) (distribution.Repository, error) {
+func newV2Repository(repoInfo *registry.RepositoryInfo, endpoint registry.APIEndpoint, metaHeaders http.Header, authConfig *cliconfig.AuthConfig, actions ...string) (distribution.Repository, error) {
 	ctx := context.Background()
 
 	repoName := repoInfo.CanonicalName
diff --git a/graph/service.go b/graph/service.go
index 3f83ea999c..11fe926655 100644
--- a/graph/service.go
+++ b/graph/service.go
@@ -52,7 +52,7 @@ func (s *TagStore) Lookup(name string) (*types.ImageInspect, error) {
 		Architecture:    image.Architecture,
 		Os:              image.OS,
 		Size:            image.Size,
-		VirtualSize:     s.graph.GetParentsSize(image) + image.Size,
+		VirtualSize:     s.graph.getParentsSize(image) + image.Size,
 	}
 
 	imageInspect.GraphDriver.Name = s.graph.driver.String()
@@ -65,13 +65,13 @@ func (s *TagStore) Lookup(name string) (*types.ImageInspect, error) {
 	return imageInspect, nil
 }
 
-// ImageTarLayer return the tarLayer of the image
-func (s *TagStore) ImageTarLayer(name string, dest io.Writer) error {
+// imageTarLayer return the tarLayer of the image
+func (s *TagStore) imageTarLayer(name string, dest io.Writer) error {
 	if image, err := s.LookupImage(name); err == nil && image != nil {
 		// On Windows, the base layer cannot be exported
 		if runtime.GOOS != "windows" || image.Parent != "" {
 
-			fs, err := s.graph.TarLayer(image)
+			fs, err := s.graph.tarLayer(image)
 			if err != nil {
 				return err
 			}
diff --git a/graph/tags.go b/graph/tags.go
index 027dc7e020..d9423373b9 100644
--- a/graph/tags.go
+++ b/graph/tags.go
@@ -34,7 +34,7 @@ type TagStore struct {
 	path  string
 	graph *Graph
 	// Repositories is a map of repositories, indexed by name.
-	Repositories map[string]Repository
+	Repositories map[string]repository
 	trustKey     libtrust.PrivateKey
 	sync.Mutex
 	// FIXME: move push/pull-related fields
@@ -45,8 +45,8 @@ type TagStore struct {
 	eventsService   *events.Events
 }
 
-// Repository maps tags to image IDs.
-type Repository map[string]string
+// repository maps tags to image IDs.
+type repository map[string]string
 
 // TagStoreConfig provides parameters for a new TagStore.
 type TagStoreConfig struct {
@@ -73,7 +73,7 @@ func NewTagStore(path string, cfg *TagStoreConfig) (*TagStore, error) {
 		path:            abspath,
 		graph:           cfg.Graph,
 		trustKey:        cfg.Key,
-		Repositories:    make(map[string]Repository),
+		Repositories:    make(map[string]repository),
 		pullingPool:     make(map[string]*broadcaster.Buffered),
 		pushingPool:     make(map[string]*broadcaster.Buffered),
 		registryService: cfg.Registry,
@@ -118,8 +118,6 @@ func (store *TagStore) reload() error {
 // name. The name can include an optional tag; otherwise the default tag will
 // be used.
 func (store *TagStore) LookupImage(name string) (*image.Image, error) {
-	// FIXME: standardize on returning nil when the image doesn't exist, and err for everything else
-	// (so we can pass all errors here)
 	repoName, ref := parsers.ParseRepositoryTag(name)
 	if ref == "" {
 		ref = tags.DefaultTag
@@ -129,7 +127,7 @@ func (store *TagStore) LookupImage(name string) (*image.Image, error) {
 		img *image.Image
 	)
 
-	img, err = store.GetImage(repoName, ref)
+	img, err = store.getImage(repoName, ref)
 	if err != nil {
 		return nil, err
 	}
@@ -257,7 +255,7 @@ func (store *TagStore) setLoad(repoName, tag, imageName string, force bool, out
 	if err := store.reload(); err != nil {
 		return err
 	}
-	var repo Repository
+	var repo repository
 	repoName = registry.NormalizeLocalName(repoName)
 	if r, exists := store.Repositories[repoName]; exists {
 		repo = r
@@ -281,8 +279,8 @@ func (store *TagStore) setLoad(repoName, tag, imageName string, force bool, out
 	return store.save()
 }
 
-// SetDigest creates a digest reference to an image ID.
-func (store *TagStore) SetDigest(repoName, digest, imageName string) error {
+// setDigest creates a digest reference to an image ID.
+func (store *TagStore) setDigest(repoName, digest, imageName string) error {
 	img, err := store.LookupImage(imageName)
 	if err != nil {
 		return err
@@ -305,7 +303,7 @@ func (store *TagStore) SetDigest(repoName, digest, imageName string) error {
 	repoName = registry.NormalizeLocalName(repoName)
 	repoRefs, exists := store.Repositories[repoName]
 	if !exists {
-		repoRefs = Repository{}
+		repoRefs = repository{}
 		store.Repositories[repoName] = repoRefs
 	} else if oldID, exists := repoRefs[digest]; exists && oldID != img.ID {
 		return fmt.Errorf("Conflict: Digest %s is already set to image %s", digest, oldID)
@@ -315,8 +313,8 @@ func (store *TagStore) SetDigest(repoName, digest, imageName string) error {
 	return store.save()
 }
 
-// Get returns the Repository tag/image map for a given repository.
-func (store *TagStore) Get(repoName string) (Repository, error) {
+// get returns the repository tag/image map for a given repository.
+func (store *TagStore) get(repoName string) (repository, error) {
 	store.Lock()
 	defer store.Unlock()
 	if err := store.reload(); err != nil {
@@ -329,10 +327,10 @@ func (store *TagStore) Get(repoName string) (Repository, error) {
 	return nil, nil
 }
 
-// GetImage returns a pointer to an Image structure describing the image
+// getImage returns a pointer to an Image structure describing the image
 // referred to by refOrID inside repository repoName.
-func (store *TagStore) GetImage(repoName, refOrID string) (*image.Image, error) {
-	repo, err := store.Get(repoName)
+func (store *TagStore) getImage(repoName, refOrID string) (*image.Image, error) {
+	repo, err := store.get(repoName)
 
 	if err != nil {
 		return nil, err
diff --git a/graph/tags_unit_test.go b/graph/tags_unit_test.go
index 9a7336be01..0406f15443 100644
--- a/graph/tags_unit_test.go
+++ b/graph/tags_unit_test.go
@@ -92,7 +92,7 @@ func mkTestTagStore(root string, t *testing.T) *TagStore {
 	if err := store.Tag(testPrivateImageName, "", testPrivateImageID, false); err != nil {
 		t.Fatal(err)
 	}
-	if err := store.SetDigest(testPrivateImageName, testPrivateImageDigest, testPrivateImageID); err != nil {
+	if err := store.setDigest(testPrivateImageName, testPrivateImageDigest, testPrivateImageID); err != nil {
 		t.Fatal(err)
 	}
 	return store