diff --git a/contrib/check-config.sh b/contrib/check-config.sh
index 52e01aa8eb..3d82118c9b 100755
--- a/contrib/check-config.sh
+++ b/contrib/check-config.sh
@@ -43,7 +43,7 @@ is_set_as_module() {
 color() {
 	local codes=()
 	if [ "$1" = 'bold' ]; then
-		codes=( "${codes[@]}" '1' )
+		codes=("${codes[@]}" '1')
 		shift
 	fi
 	if [ "$#" -gt 0 ]; then
@@ -60,7 +60,7 @@ color() {
 			white) code=37 ;;
 		esac
 		if [ "$code" ]; then
-			codes=( "${codes[@]}" "$code" )
+			codes=("${codes[@]}" "$code")
 		fi
 	fi
 	local IFS=';'
@@ -98,12 +98,13 @@ check_flag() {
 
 check_flags() {
 	for flag in "$@"; do
-		echo -n "- "; check_flag "$flag"
+		echo -n "- "
+		check_flag "$flag"
 	done
 }
 
 check_command() {
-	if command -v "$1" >/dev/null 2>&1; then
+	if command -v "$1" > /dev/null 2>&1; then
 		wrap_good "$1 command" 'available'
 	else
 		wrap_bad "$1 command" 'missing'
@@ -121,7 +122,7 @@ check_device() {
 }
 
 check_distro_userns() {
-	source /etc/os-release 2>/dev/null || /bin/true
+	source /etc/os-release 2> /dev/null || /bin/true
 	if [[ "${ID}" =~ ^(centos|rhel)$ && "${VERSION_ID}" =~ ^7 ]]; then
 		# this is a CentOS7 or RHEL7 system
 		grep -q "user_namespace.enable=1" /proc/cmdline || {
@@ -156,7 +157,7 @@ echo 'Generally Necessary:'
 echo -n '- '
 cgroupSubsystemDir="$(awk '/[, ](cpu|cpuacct|cpuset|devices|freezer|memory)[, ]/ && $3 == "cgroup" { print $2 }' /proc/mounts | head -n1)"
 cgroupDir="$(dirname "$cgroupSubsystemDir")"
-if [ -d "$cgroupDir/cpu" ] || [ -d "$cgroupDir/cpuacct" ] || [ -d "$cgroupDir/cpuset" ] || [  -d "$cgroupDir/devices" ] || [ -d "$cgroupDir/freezer" ] || [ -d "$cgroupDir/memory" ]; then
+if [ -d "$cgroupDir/cpu" ] || [ -d "$cgroupDir/cpuacct" ] || [ -d "$cgroupDir/cpuset" ] || [ -d "$cgroupDir/devices" ] || [ -d "$cgroupDir/freezer" ] || [ -d "$cgroupDir/memory" ]; then
 	echo "$(wrap_good 'cgroup hierarchy' 'properly mounted') [$cgroupDir]"
 else
 	if [ "$cgroupSubsystemDir" ]; then
@@ -168,7 +169,7 @@ else
 	echo "    $(wrap_color '(see https://github.com/tianon/cgroupfs-mount)' yellow)"
 fi
 
-if [ "$(cat /sys/module/apparmor/parameters/enabled 2>/dev/null)" = 'Y' ]; then
+if [ "$(cat /sys/module/apparmor/parameters/enabled 2> /dev/null)" = 'Y' ]; then
 	echo -n '- '
 	if command -v apparmor_parser &> /dev/null; then
 		wrap_good 'apparmor' 'enabled and tools installed'
@@ -199,8 +200,8 @@ flags=(
 	POSIX_MQUEUE
 )
 check_flags "${flags[@]}"
-if [ "$kernelMajor" -lt 4 ] || ( [ "$kernelMajor" -eq 4 ] && [ "$kernelMinor" -lt 8 ] ); then
-        check_flags DEVPTS_MULTIPLE_INSTANCES
+if [ "$kernelMajor" -lt 4 ] || ([ "$kernelMajor" -eq 4 ] && [ "$kernelMinor" -lt 8 ]); then
+	check_flags DEVPTS_MULTIPLE_INSTANCES
 fi
 
 echo
@@ -228,12 +229,15 @@ echo 'Optional Features:'
 }
 {
 	if is_set LEGACY_VSYSCALL_NATIVE; then
-		echo -n "- "; wrap_bad "CONFIG_LEGACY_VSYSCALL_NATIVE" 'enabled'
+		echo -n "- "
+		wrap_bad "CONFIG_LEGACY_VSYSCALL_NATIVE" 'enabled'
 		echo "    $(wrap_color '(dangerous, provides an ASLR-bypassing target with usable ROP gadgets.)' bold black)"
 	elif is_set LEGACY_VSYSCALL_EMULATE; then
-		echo -n "- "; wrap_good "CONFIG_LEGACY_VSYSCALL_EMULATE" 'enabled'
+		echo -n "- "
+		wrap_good "CONFIG_LEGACY_VSYSCALL_EMULATE" 'enabled'
 	elif is_set LEGACY_VSYSCALL_NONE; then
-		echo -n "- "; wrap_bad "CONFIG_LEGACY_VSYSCALL_NONE" 'enabled'
+		echo -n "- "
+		wrap_bad "CONFIG_LEGACY_VSYSCALL_NONE" 'enabled'
 		echo "    $(wrap_color '(containers using eglibc <= 2.13 will not work. Switch to' bold black)"
 		echo "    $(wrap_color ' "CONFIG_VSYSCALL_[NATIVE|EMULATE]" or use "vsyscall=[native|emulate]"' bold black)"
 		echo "    $(wrap_color ' on kernel command line. Note that this will disable ASLR for the,' bold black)"
@@ -245,15 +249,15 @@ echo 'Optional Features:'
 	fi
 }
 
-if [ "$kernelMajor" -lt 4 ] || ( [ "$kernelMajor" -eq 4 ] && [ "$kernelMinor" -le 5 ] ); then
+if [ "$kernelMajor" -lt 4 ] || ([ "$kernelMajor" -eq 4 ] && [ "$kernelMinor" -le 5 ]); then
 	check_flags MEMCG_KMEM
 fi
 
-if [ "$kernelMajor" -lt 3 ] || ( [ "$kernelMajor" -eq 3 ] && [ "$kernelMinor" -le 18 ] ); then
+if [ "$kernelMajor" -lt 3 ] || ([ "$kernelMajor" -eq 3 ] && [ "$kernelMinor" -le 18 ]); then
 	check_flags RESOURCE_COUNTERS
 fi
 
-if [ "$kernelMajor" -lt 3 ] || ( [ "$kernelMajor" -eq 3 ] && [ "$kernelMinor" -le 13 ] ); then
+if [ "$kernelMajor" -lt 3 ] || ([ "$kernelMajor" -eq 3 ] && [ "$kernelMinor" -le 13 ]); then
 	netprio=NETPRIO_CGROUP
 else
 	netprio=CGROUP_NET_PRIO
@@ -270,7 +274,7 @@ flags=(
 	IP_VS_NFCT
 	IP_VS_PROTO_TCP
 	IP_VS_PROTO_UDP
- 	IP_VS_RR
+	IP_VS_RR
 )
 check_flags "${flags[@]}"
 
@@ -295,7 +299,7 @@ echo "  - \"$(wrap_color 'overlay' blue)\":"
 check_flags VXLAN BRIDGE_VLAN_FILTERING | sed 's/^/    /'
 echo '      Optional (for encrypted networks):'
 check_flags CRYPTO CRYPTO_AEAD CRYPTO_GCM CRYPTO_SEQIV CRYPTO_GHASH \
-            XFRM XFRM_USER XFRM_ALGO INET_ESP INET_XFRM_MODE_TRANSPORT | sed 's/^/      /'
+	XFRM XFRM_USER XFRM_ALGO INET_ESP INET_XFRM_MODE_TRANSPORT | sed 's/^/      /'
 echo "  - \"$(wrap_color 'ipvlan' blue)\":"
 check_flags IPVLAN | sed 's/^/    /'
 echo "  - \"$(wrap_color 'macvlan' blue)\":"
@@ -334,9 +338,12 @@ check_flags OVERLAY_FS | sed 's/^/    /'
 EXITCODE=0
 
 echo "  - \"$(wrap_color 'zfs' blue)\":"
-echo -n "    - "; check_device /dev/zfs
-echo -n "    - "; check_command zfs
-echo -n "    - "; check_command zpool
+echo -n "    - "
+check_device /dev/zfs
+echo -n "    - "
+check_command zfs
+echo -n "    - "
+check_command zpool
 [ "$EXITCODE" = 0 ] && STORAGE=0
 EXITCODE=0
 
@@ -345,8 +352,7 @@ EXITCODE=$CODE
 
 echo
 
-check_limit_over()
-{
+check_limit_over() {
 	if [ "$(cat "$1")" -le "$2" ]; then
 		wrap_bad "- $1" "$(cat "$1")"
 		wrap_color "    This should be set to at least $2, for example set: sysctl -w kernel/keys/root_maxkeys=1000000" bold black
diff --git a/contrib/docker-machine-install-bundle.sh b/contrib/docker-machine-install-bundle.sh
index eff821799c..c02e57081d 100755
--- a/contrib/docker-machine-install-bundle.sh
+++ b/contrib/docker-machine-install-bundle.sh
@@ -16,37 +16,38 @@ set -e
 set -o pipefail
 
 errexit() {
-    echo "$1"
-    exit 1
+	echo "$1"
+	exit 1
 }
 
 BUNDLE="bundles/$(cat VERSION)"
 
-bundle_files(){
-    # prefer dynbinary if exists
-    for f in dockerd docker-proxy; do
-	if [ -d $BUNDLE/dynbinary-daemon ]; then
-	    echo $BUNDLE/dynbinary-daemon/$f
+bundle_files() {
+	# prefer dynbinary if exists
+	for f in dockerd docker-proxy; do
+		if [ -d $BUNDLE/dynbinary-daemon ]; then
+			echo $BUNDLE/dynbinary-daemon/$f
+		else
+			echo $BUNDLE/binary-daemon/$f
+		fi
+	done
+	for f in containerd ctr containerd-shim docker-init runc; do
+		echo $BUNDLE/binary-daemon/$f
+	done
+	if [ -d $BUNDLE/dynbinary-client ]; then
+		echo $BUNDLE/dynbinary-client/docker
 	else
-	    echo $BUNDLE/binary-daemon/$f
+		echo $BUNDLE/binary-client/docker
 	fi
-    done
-    for f in containerd ctr containerd-shim docker-init runc; do
-	echo $BUNDLE/binary-daemon/$f
-    done
-    if [ -d $BUNDLE/dynbinary-client ]; then
-	echo $BUNDLE/dynbinary-client/docker
-    else
-	echo $BUNDLE/binary-client/docker
-    fi
 }
 
-control_docker(){
-    m=$1; op=$2
-    # NOTE: `docker-machine ssh $m sh -c "foo bar"` does not work
-    #       (but `docker-machine ssh $m sh -c "foo\ bar"` works)
-    #       Anyway we avoid using `sh -c` here for avoiding confusion
-    cat <<EOF | docker-machine ssh $m sudo sh
+control_docker() {
+	m=$1
+	op=$2
+	# NOTE: `docker-machine ssh $m sh -c "foo bar"` does not work
+	#       (but `docker-machine ssh $m sh -c "foo\ bar"` works)
+	#       Anyway we avoid using `sh -c` here for avoiding confusion
+	cat << EOF | docker-machine ssh $m sudo sh
 if command -v systemctl > /dev/null; then
   systemctl $op docker
 elif command -v service > /dev/null; then
@@ -60,52 +61,58 @@ fi
 EOF
 }
 
-detect_prefix(){
-    m=$1
-    script='dirname $(dirname $(which dockerd))'
-    echo $script | docker-machine ssh $m sh
+detect_prefix() {
+	m=$1
+	script='dirname $(dirname $(which dockerd))'
+	echo $script | docker-machine ssh $m sh
 }
 
-install_to(){
-    m=$1; shift; files=$@
-    echo "$m: detecting docker"
-    prefix=$(detect_prefix $m)
-    echo "$m: detected docker on $prefix"
-    echo "$m: stopping docker"
-    control_docker $m stop
-    echo "$m: installing docker"
-    # NOTE: GNU tar is required because we use --transform here
-    # TODO: compression (should not be default)
-    tar ch --transform 's/.*\///' $files | docker-machine ssh $m sudo tar Cx $prefix/bin
-    echo "$m: starting docker"
-    control_docker $m start
-    echo "$m: done"
+install_to() {
+	m=$1
+	shift
+	files=$@
+	echo "$m: detecting docker"
+	prefix=$(detect_prefix $m)
+	echo "$m: detected docker on $prefix"
+	echo "$m: stopping docker"
+	control_docker $m stop
+	echo "$m: installing docker"
+	# NOTE: GNU tar is required because we use --transform here
+	# TODO: compression (should not be default)
+	tar ch --transform 's/.*\///' $files | docker-machine ssh $m sudo tar Cx $prefix/bin
+	echo "$m: starting docker"
+	control_docker $m start
+	echo "$m: done"
 }
 
-check_prereq(){
-    command -v docker-machine > /dev/null || errexit "docker-machine not installed"
-    ( tar --version | grep GNU > /dev/null ) || errexit "GNU tar not installed"
+check_prereq() {
+	command -v docker-machine > /dev/null || errexit "docker-machine not installed"
+	(tar --version | grep GNU > /dev/null) || errexit "GNU tar not installed"
 }
 
 case "$1" in
-    "install")
-	shift; machines=$@
-	check_prereq
-	files=$(bundle_files)
-	echo "Files to be installed:"
-	for f in $files; do echo $f; done
-	pids=()
-	for m in $machines; do
-	    install_to $m $files &
-	    pids+=($!)
-	done
-	status=0
-	for pid in ${pids[@]}; do
-	    wait $pid || { status=$?; echo "background process $pid failed with exit status $status"; }
-	done
-	exit $status
-	;;
-    *)
-	errexit "Usage: $0 install MACHINES"
-	;;
+	"install")
+		shift
+		machines=$@
+		check_prereq
+		files=$(bundle_files)
+		echo "Files to be installed:"
+		for f in $files; do echo $f; done
+		pids=()
+		for m in $machines; do
+			install_to $m $files &
+			pids+=($!)
+		done
+		status=0
+		for pid in ${pids[@]}; do
+			wait $pid || {
+				status=$?
+				echo "background process $pid failed with exit status $status"
+			}
+		done
+		exit $status
+		;;
+	*)
+		errexit "Usage: $0 install MACHINES"
+		;;
 esac
diff --git a/contrib/dockerd-rootless.sh b/contrib/dockerd-rootless.sh
index 410013d9be..8f0d543e32 100755
--- a/contrib/dockerd-rootless.sh
+++ b/contrib/dockerd-rootless.sh
@@ -25,7 +25,7 @@ fi
 
 rootlesskit=""
 for f in docker-rootlesskit rootlesskit; do
-	if which $f >/dev/null 2>&1; then
+	if which $f > /dev/null 2>&1; then
 		rootlesskit=$f
 		break
 	fi
@@ -43,7 +43,7 @@ fi
 net=$DOCKERD_ROOTLESS_ROOTLESSKIT_NET
 mtu=$DOCKERD_ROOTLESS_ROOTLESSKIT_MTU
 if [ -z $net ]; then
-	if which slirp4netns >/dev/null 2>&1; then
+	if which slirp4netns > /dev/null 2>&1; then
 		if slirp4netns --help | grep -- --disable-host-loopback; then
 			net=slirp4netns
 			if [ -z $mtu ]; then
@@ -54,7 +54,7 @@ if [ -z $net ]; then
 		fi
 	fi
 	if [ -z $net ]; then
-		if which vpnkit >/dev/null 2>&1; then
+		if which vpnkit > /dev/null 2>&1; then
 			net=vpnkit
 		else
 			echo "Either slirp4netns (v0.3+) or vpnkit needs to be installed"
diff --git a/contrib/dockerize-disk.sh b/contrib/dockerize-disk.sh
index 444e243abe..744fc79d0f 100755
--- a/contrib/dockerize-disk.sh
+++ b/contrib/dockerize-disk.sh
@@ -2,21 +2,21 @@
 set -e
 
 if ! command -v qemu-nbd &> /dev/null; then
-  echo >&2 'error: "qemu-nbd" not found!'
-  exit 1
+	echo >&2 'error: "qemu-nbd" not found!'
+	exit 1
 fi
 
 usage() {
-  echo "Convert disk image to docker image"
-  echo ""
-  echo "usage: $0 image-name disk-image-file [ base-image ]"
-  echo "   ie: $0 cirros:0.3.3 cirros-0.3.3-x86_64-disk.img"
-  echo "       $0 ubuntu:cloud ubuntu-14.04-server-cloudimg-amd64-disk1.img ubuntu:14.04"
+	echo "Convert disk image to docker image"
+	echo ""
+	echo "usage: $0 image-name disk-image-file [ base-image ]"
+	echo "   ie: $0 cirros:0.3.3 cirros-0.3.3-x86_64-disk.img"
+	echo "       $0 ubuntu:cloud ubuntu-14.04-server-cloudimg-amd64-disk1.img ubuntu:14.04"
 }
 
 if [ "$#" -lt 2 ]; then
-  usage
-  exit 1
+	usage
+	exit 1
 fi
 
 CURDIR=$(pwd)
@@ -24,7 +24,7 @@ CURDIR=$(pwd)
 image_name="${1%:*}"
 image_tag="${1#*:}"
 if [ "$image_tag" == "$1" ]; then
-  image_tag="latest"
+	image_tag="latest"
 fi
 
 disk_image_file="$2"
@@ -35,10 +35,10 @@ block_device=/dev/nbd0
 builddir=$(mktemp -d)
 
 cleanup() {
-  umount "$builddir/disk_image" || true
-  umount "$builddir/workdir" || true
-  qemu-nbd -d $block_device &> /dev/null || true
-  rm -rf $builddir
+	umount "$builddir/disk_image" || true
+	umount "$builddir/workdir" || true
+	qemu-nbd -d $block_device &> /dev/null || true
+	rm -rf $builddir
 }
 trap cleanup EXIT
 
@@ -55,18 +55,18 @@ base_image_mounts=""
 
 # Unpack base image
 if [ -n "$docker_base_image" ]; then
-  mkdir -p "$builddir/base"
-  docker pull "$docker_base_image"
-  docker save "$docker_base_image" | tar -xC "$builddir/base"
+	mkdir -p "$builddir/base"
+	docker pull "$docker_base_image"
+	docker save "$docker_base_image" | tar -xC "$builddir/base"
 
-  image_id=$(docker inspect -f "{{.Id}}" "$docker_base_image")
-  while [ -n "$image_id" ]; do
-    mkdir -p "$builddir/base/$image_id/layer"
-    tar -xf "$builddir/base/$image_id/layer.tar" -C "$builddir/base/$image_id/layer"
+	image_id=$(docker inspect -f "{{.Id}}" "$docker_base_image")
+	while [ -n "$image_id" ]; do
+		mkdir -p "$builddir/base/$image_id/layer"
+		tar -xf "$builddir/base/$image_id/layer.tar" -C "$builddir/base/$image_id/layer"
 
-    base_image_mounts="${base_image_mounts}:$builddir/base/$image_id/layer=ro+wh"
-    image_id=$(docker inspect -f "{{.Parent}}" "$image_id")
-  done
+		base_image_mounts="${base_image_mounts}:$builddir/base/$image_id/layer=ro+wh"
+		image_id=$(docker inspect -f "{{.Parent}}" "$image_id")
+	done
 fi
 
 # Mount work directory
@@ -75,20 +75,20 @@ mount -t aufs -o "br=$builddir/diff=rw${base_image_mounts},dio,xino=/dev/shm/auf
 # Update files
 cd $builddir
 LC_ALL=C diff -rq disk_image workdir \
-  | sed -re "s|Only in workdir(.*?): |DEL \1/|g;s|Only in disk_image(.*?): |ADD \1/|g;s|Files disk_image/(.+) and workdir/(.+) differ|UPDATE /\1|g" \
-  | while read action entry; do
-      case "$action" in
-        ADD|UPDATE)
-          cp -a "disk_image$entry" "workdir$entry"
-          ;;
-        DEL)
-          rm -rf "workdir$entry"
-          ;;
-        *)
-          echo "Error: unknown diff line: $action $entry" >&2
-          ;;
-      esac
-    done
+	| sed -re "s|Only in workdir(.*?): |DEL \1/|g;s|Only in disk_image(.*?): |ADD \1/|g;s|Files disk_image/(.+) and workdir/(.+) differ|UPDATE /\1|g" \
+	| while read action entry; do
+		case "$action" in
+			ADD | UPDATE)
+				cp -a "disk_image$entry" "workdir$entry"
+				;;
+			DEL)
+				rm -rf "workdir$entry"
+				;;
+			*)
+				echo "Error: unknown diff line: $action $entry" >&2
+				;;
+		esac
+	done
 
 # Pack new image
 new_image_id="$(for i in $(seq 1 32); do printf "%02x" $(($RANDOM % 256)); done)"
@@ -96,15 +96,15 @@ mkdir -p $builddir/result/$new_image_id
 cd diff
 tar -cf $builddir/result/$new_image_id/layer.tar *
 echo "1.0" > $builddir/result/$new_image_id/VERSION
-cat > $builddir/result/$new_image_id/json <<-EOS
-{ "docker_version": "1.4.1"
-, "id": "$new_image_id"
-, "created": "$(date -u +%Y-%m-%dT%H:%M:%S.%NZ)"
+cat > $builddir/result/$new_image_id/json <<- EOS
+	{ "docker_version": "1.4.1"
+	, "id": "$new_image_id"
+	, "created": "$(date -u +%Y-%m-%dT%H:%M:%S.%NZ)"
 EOS
 
 if [ -n "$docker_base_image" ]; then
-  image_id=$(docker inspect -f "{{.Id}}" "$docker_base_image")
-  echo ", \"parent\": \"$image_id\"" >> $builddir/result/$new_image_id/json
+ image_id=$(docker inspect -f "{{.Id}}" "$docker_base_image")
+ echo ", \"parent\": \"$image_id\"" >> $builddir/result/$new_image_id/json
 fi
 
 echo "}" >> $builddir/result/$new_image_id/json
diff --git a/contrib/download-frozen-image-v1.sh b/contrib/download-frozen-image-v1.sh
index 77c91d1f1b..6e56a6d73b 100755
--- a/contrib/download-frozen-image-v1.sh
+++ b/contrib/download-frozen-image-v1.sh
@@ -59,13 +59,13 @@ while [ $# -gt 0 ]; do
 	fi
 
 	IFS=','
-	ancestry=( ${ancestryJson//[\[\] \"]/} )
+	ancestry=(${ancestryJson//[\[\] \"]/})
 	unset IFS
 
 	if [ -s "$dir/tags-$imageFile.tmp" ]; then
 		echo -n ', ' >> "$dir/tags-$imageFile.tmp"
 	else
-		images=( "${images[@]}" "$image" )
+		images=("${images[@]}" "$image")
 	fi
 	echo -n '"'"$tag"'": "'"$imageId"'"' >> "$dir/tags-$imageFile.tmp"
 
diff --git a/contrib/download-frozen-image-v2.sh b/contrib/download-frozen-image-v2.sh
index 38d94d32d9..283a9ab34d 100755
--- a/contrib/download-frozen-image-v2.sh
+++ b/contrib/download-frozen-image-v2.sh
@@ -49,11 +49,15 @@ authService='registry.docker.io'
 
 # https://github.com/moby/moby/issues/33700
 fetch_blob() {
-	local token="$1"; shift
-	local image="$1"; shift
-	local digest="$1"; shift
-	local targetFile="$1"; shift
-	local curlArgs=( "$@" )
+	local token="$1"
+	shift
+	local image="$1"
+	shift
+	local digest="$1"
+	shift
+	local targetFile="$1"
+	shift
+	local curlArgs=("$@")
 
 	local curlHeaders="$(
 		curl -S "${curlArgs[@]}" \
@@ -63,7 +67,7 @@ fetch_blob() {
 			-D-
 	)"
 	curlHeaders="$(echo "$curlHeaders" | tr -d '\r')"
-	if grep -qE "^HTTP/[0-9].[0-9] 3" <<<"$curlHeaders"; then
+	if grep -qE "^HTTP/[0-9].[0-9] 3" <<< "$curlHeaders"; then
 		rm -f "$targetFile"
 
 		local blobRedirect="$(echo "$curlHeaders" | awk -F ': ' 'tolower($1) == "location" { print $2; exit }')"
@@ -81,7 +85,8 @@ fetch_blob() {
 
 # handle 'application/vnd.docker.distribution.manifest.v2+json' manifest
 handle_single_manifest_v2() {
-	local manifestJson="$1"; shift
+	local manifestJson="$1"
+	shift
 
 	local configDigest="$(echo "$manifestJson" | jq --raw-output '.config.digest')"
 	local imageId="${configDigest#*:}" # strip off "sha256:"
@@ -91,7 +96,7 @@ handle_single_manifest_v2() {
 
 	local layersFs="$(echo "$manifestJson" | jq --raw-output --compact-output '.layers[]')"
 	local IFS="$newlineIFS"
-	local layers=( $layersFs )
+	local layers=($layersFs)
 	unset IFS
 
 	echo "Downloading '$imageIdentifier' (${#layers[@]} layers)..."
@@ -116,7 +121,7 @@ handle_single_manifest_v2() {
 			local parentJson="$(printf ', parent: "%s"' "$parentId")"
 			local addJson="$(printf '{ id: "%s"%s }' "$layerId" "${parentId:+$parentJson}")"
 			# this starter JSON is taken directly from Docker's own "docker save" output for unimportant layers
-			jq "$addJson + ." > "$dir/$layerId/json" <<-'EOJSON'
+			jq "$addJson + ." > "$dir/$layerId/json" <<- 'EOJSON'
 				{
 					"created": "0001-01-01T00:00:00Z",
 					"container_config": {
@@ -145,7 +150,7 @@ handle_single_manifest_v2() {
 		case "$layerMediaType" in
 			application/vnd.docker.image.rootfs.diff.tar.gzip)
 				local layerTar="$layerId/layer.tar"
-				layerFiles=( "${layerFiles[@]}" "$layerTar" )
+				layerFiles=("${layerFiles[@]}" "$layerTar")
 				# TODO figure out why "-C -" doesn't work here
 				# "curl: (33) HTTP server doesn't seem to support byte ranges. Cannot resume."
 				# "HTTP/1.1 416 Requested Range Not Satisfiable"
@@ -179,7 +184,7 @@ handle_single_manifest_v2() {
 			Layers: '"$(echo '[]' | jq --raw-output ".$(for layerFile in "${layerFiles[@]}"; do echo " + [ \"$layerFile\" ]"; done)")"'
 		}'
 	)"
-	manifestJsonEntries=( "${manifestJsonEntries[@]}" "$manifestJsonEntry" )
+	manifestJsonEntries=("${manifestJsonEntries[@]}" "$manifestJsonEntry")
 }
 
 while [ $# -gt 0 ]; do
@@ -227,7 +232,7 @@ while [ $# -gt 0 ]; do
 				application/vnd.docker.distribution.manifest.list.v2+json)
 					layersFs="$(echo "$manifestJson" | jq --raw-output --compact-output '.manifests[]')"
 					IFS="$newlineIFS"
-					layers=( $layersFs )
+					layers=($layersFs)
 					unset IFS
 
 					found=""
@@ -273,7 +278,7 @@ while [ $# -gt 0 ]; do
 
 			layersFs="$(echo "$manifestJson" | jq --raw-output '.fsLayers | .[] | .blobSum')"
 			IFS="$newlineIFS"
-			layers=( $layersFs )
+			layers=($layersFs)
 			unset IFS
 
 			history="$(echo "$manifestJson" | jq '.history | [.[] | .v1Compatibility]')"
@@ -314,7 +319,7 @@ while [ $# -gt 0 ]; do
 	if [ -s "$dir/tags-$imageFile.tmp" ]; then
 		echo -n ', ' >> "$dir/tags-$imageFile.tmp"
 	else
-		images=( "${images[@]}" "$image" )
+		images=("${images[@]}" "$image")
 	fi
 	echo -n '"'"$tag"'": "'"$imageId"'"' >> "$dir/tags-$imageFile.tmp"
 done
diff --git a/contrib/gitdm/generate_aliases.sh b/contrib/gitdm/generate_aliases.sh
index dfff5ff204..f61b0ef843 100755
--- a/contrib/gitdm/generate_aliases.sh
+++ b/contrib/gitdm/generate_aliases.sh
@@ -8,9 +8,9 @@
 #  $> ./generate_aliases <mailmap_file> > aliases
 #
 
-cat $1 | \
-    grep -v '^#' | \
-    sed 's/^[^<]*<\([^>]*\)>/\1/' | \
-    grep '<.*>' | sed -e 's/[<>]/ /g' | \
-    awk '{if ($3 != "") { print $3" "$1 } else {print $2" "$1}}' | \
-    sort | uniq
+cat $1 \
+	| grep -v '^#' \
+	| sed 's/^[^<]*<\([^>]*\)>/\1/' \
+	| grep '<.*>' | sed -e 's/[<>]/ /g' \
+	| awk '{if ($3 != "") { print $3" "$1 } else {print $2" "$1}}' \
+	| sort | uniq
diff --git a/contrib/init/openrc/docker.initd b/contrib/init/openrc/docker.initd
index 05d910ffd8..3229223bad 100644
--- a/contrib/init/openrc/docker.initd
+++ b/contrib/init/openrc/docker.initd
@@ -22,7 +22,7 @@ start_pre() {
 }
 
 reload() {
-        ebegin "Reloading ${RC_SVCNAME}"
-        start-stop-daemon --signal HUP --pidfile "${pidfile}"
-        eend $? "Failed to stop ${RC_SVCNAME}"
+	ebegin "Reloading ${RC_SVCNAME}"
+	start-stop-daemon --signal HUP --pidfile "${pidfile}"
+	eend $? "Failed to stop ${RC_SVCNAME}"
 }
diff --git a/contrib/init/sysvinit-debian/docker b/contrib/init/sysvinit-debian/docker
index 9c8fa6be73..a2ba4f4b7d 100755
--- a/contrib/init/sysvinit-debian/docker
+++ b/contrib/init/sysvinit-debian/docker
@@ -46,7 +46,7 @@ fi
 
 check_init() {
 	# see also init_is_upstart in /lib/lsb/init-functions (which isn't available in Ubuntu 12.04, or we'd use it directly)
-	if [ -x /sbin/initctl ] && /sbin/initctl version 2>/dev/null | grep -q upstart; then
+	if [ -x /sbin/initctl ] && /sbin/initctl version 2> /dev/null | grep -q upstart; then
 		log_failure_msg "$DOCKER_DESC is managed via upstart, try using service $BASE $1"
 		exit 1
 	fi
@@ -85,7 +85,7 @@ cgroupfs_mount() {
 case "$1" in
 	start)
 		check_init
-		
+
 		fail_unless_root
 
 		cgroupfs_mount
@@ -110,9 +110,9 @@ case "$1" in
 			--pidfile "$DOCKER_SSD_PIDFILE" \
 			--make-pidfile \
 			-- \
-				-p "$DOCKER_PIDFILE" \
-				$DOCKER_OPTS \
-					>> "$DOCKER_LOGFILE" 2>&1
+			-p "$DOCKER_PIDFILE" \
+			$DOCKER_OPTS \
+			>> "$DOCKER_LOGFILE" 2>&1
 		log_end_msg $?
 		;;
 
@@ -131,7 +131,7 @@ case "$1" in
 	restart)
 		check_init
 		fail_unless_root
-		docker_pid=`cat "$DOCKER_SSD_PIDFILE" 2>/dev/null`
+		docker_pid=$(cat "$DOCKER_SSD_PIDFILE" 2> /dev/null)
 		[ -n "$docker_pid" ] \
 			&& ps -p $docker_pid > /dev/null 2>&1 \
 			&& $0 stop
diff --git a/contrib/init/sysvinit-redhat/docker b/contrib/init/sysvinit-redhat/docker
index df9b02a2a4..7bcb2d88ad 100755
--- a/contrib/init/sysvinit-redhat/docker
+++ b/contrib/init/sysvinit-redhat/docker
@@ -109,10 +109,9 @@ rh_status() {
 }
 
 rh_status_q() {
-	rh_status >/dev/null 2>&1
+	rh_status > /dev/null 2>&1
 }
 
-
 check_for_cleanup() {
 	if [ -f ${pidfile} ]; then
 		/bin/ps -fp $(cat ${pidfile}) > /dev/null || rm ${pidfile}
@@ -141,13 +140,14 @@ case "$1" in
 	status)
 		rh_status
 		;;
-	condrestart|try-restart)
+	condrestart | try-restart)
 		rh_status_q || exit 0
 		restart
 		;;
 	*)
 		echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
 		exit 2
+		;;
 esac
 
 exit $?
diff --git a/contrib/mac-install-bundle.sh b/contrib/mac-install-bundle.sh
index 2110d044d0..f51546e116 100755
--- a/contrib/mac-install-bundle.sh
+++ b/contrib/mac-install-bundle.sh
@@ -20,26 +20,26 @@ DATABASE_KEY="$DATABASE/com.docker.driver.amd64-linux/bundle"
 [ -d "$DATABASE" ] || errexit "Docker for Mac must be installed for this script"
 
 case "$1" in
-"install")
-	[ -d "$BUNDLE" ] || errexit "cannot find bundle $BUNDLE"
-	[ -e "$CLIENT_PATH" ] || errexit "you need to run make cross first"
-	[ -e "$BUNDLE/binary-daemon/dockerd" ] || errexit "you need to build binaries first"
-	[ -f "$BUNDLE/binary-client/docker" ] || errexit "you need to build binaries first"
-	git -C "$DATABASE" reset --hard >/dev/null
-	echo "$BUNDLE_PATH" > "$DATABASE_KEY"
-	git -C "$DATABASE" add "$DATABASE_KEY"
-	git -C "$DATABASE" commit -m "update bundle to $BUNDLE_PATH"
-	rm -f /usr/local/bin/docker
-	cp "$CLIENT_PATH" /usr/local/bin
-	echo "Bundle installed. Restart Docker to use. To uninstall, reset Docker to factory defaults."
-	;;
-"undo")
-	git -C "$DATABASE" reset --hard >/dev/null
-	[ -f "$DATABASE_KEY" ] || errexit "bundle not set"
-	git -C "$DATABASE" rm "$DATABASE_KEY"
-	git -C "$DATABASE" commit -m "remove bundle"
-	rm -f /usr/local/bin/docker
-	ln -s "$HOME/Library/Group Containers/group.com.docker/bin/docker" /usr/local/bin
-	echo "Bundle removed. Using dev versions may cause issues, a reset to factory defaults is recommended."
-	;;
+	"install")
+		[ -d "$BUNDLE" ] || errexit "cannot find bundle $BUNDLE"
+		[ -e "$CLIENT_PATH" ] || errexit "you need to run make cross first"
+		[ -e "$BUNDLE/binary-daemon/dockerd" ] || errexit "you need to build binaries first"
+		[ -f "$BUNDLE/binary-client/docker" ] || errexit "you need to build binaries first"
+		git -C "$DATABASE" reset --hard > /dev/null
+		echo "$BUNDLE_PATH" > "$DATABASE_KEY"
+		git -C "$DATABASE" add "$DATABASE_KEY"
+		git -C "$DATABASE" commit -m "update bundle to $BUNDLE_PATH"
+		rm -f /usr/local/bin/docker
+		cp "$CLIENT_PATH" /usr/local/bin
+		echo "Bundle installed. Restart Docker to use. To uninstall, reset Docker to factory defaults."
+		;;
+	"undo")
+		git -C "$DATABASE" reset --hard > /dev/null
+		[ -f "$DATABASE_KEY" ] || errexit "bundle not set"
+		git -C "$DATABASE" rm "$DATABASE_KEY"
+		git -C "$DATABASE" commit -m "remove bundle"
+		rm -f /usr/local/bin/docker
+		ln -s "$HOME/Library/Group Containers/group.com.docker/bin/docker" /usr/local/bin
+		echo "Bundle removed. Using dev versions may cause issues, a reset to factory defaults is recommended."
+		;;
 esac
diff --git a/contrib/mkimage-alpine.sh b/contrib/mkimage-alpine.sh
index 16791a758d..60bfc80dd9 100755
--- a/contrib/mkimage-alpine.sh
+++ b/contrib/mkimage-alpine.sh
@@ -19,13 +19,13 @@ tmp() {
 }
 
 apkv() {
-	curl -sSL $MAINREPO/$ARCH/APKINDEX.tar.gz | tar -Oxz |
-		grep --text '^P:apk-tools-static$' -A1 | tail -n1 | cut -d: -f2
+	curl -sSL $MAINREPO/$ARCH/APKINDEX.tar.gz | tar -Oxz \
+		| grep --text '^P:apk-tools-static$' -A1 | tail -n1 | cut -d: -f2
 }
 
 getapk() {
-	curl -sSL $MAINREPO/$ARCH/apk-tools-static-$(apkv).apk |
-		tar -xz -C $TMP sbin/apk.static
+	curl -sSL $MAINREPO/$ARCH/apk-tools-static-$(apkv).apk \
+		| tar -xz -C $TMP sbin/apk.static
 }
 
 mkbase() {
diff --git a/contrib/mkimage-arch.sh b/contrib/mkimage-arch.sh
index dae39824da..a618f2ccab 100755
--- a/contrib/mkimage-arch.sh
+++ b/contrib/mkimage-arch.sh
@@ -7,12 +7,12 @@ set -e
 # reset umask to default
 umask 022
 
-hash pacstrap &>/dev/null || {
+hash pacstrap &> /dev/null || {
 	echo "Could not find pacstrap. Run pacman -S arch-install-scripts"
 	exit 1
 }
 
-hash expect &>/dev/null || {
+hash expect &> /dev/null || {
 	echo "Could not find expect. Run pacman -S expect"
 	exit 1
 }
@@ -64,7 +64,7 @@ PKGIGNORE=(
 
 PKGREMOVE=(
 	gawk
-	haveged 
+	haveged
 	less
 	linux-libre
 	linux-libre-firmware
@@ -79,7 +79,7 @@ PKGREMOVE="${PKGREMOVE[*]}"
 arch="$(uname -m)"
 case "$arch" in
 	armv*)
-		if pacman -Q archlinuxarm-keyring >/dev/null 2>&1; then
+		if pacman -Q archlinuxarm-keyring > /dev/null 2>&1; then
 			pacman-key --init
 			pacman-key --populate archlinuxarm
 		else
@@ -107,7 +107,7 @@ esac
 
 export PACMAN_MIRRORLIST
 
-expect <<EOF
+expect << EOF
 	set send_slow {1 .1}
 	proc send {ignore arg} {
 		sleep .1
diff --git a/contrib/mkimage-crux.sh b/contrib/mkimage-crux.sh
index 3f0bdcae3c..cb4fc23b0c 100755
--- a/contrib/mkimage-crux.sh
+++ b/contrib/mkimage-crux.sh
@@ -5,9 +5,9 @@
 
 set -e
 
-die () {
-    echo >&2 "$@"
-    exit 1
+die() {
+	echo >&2 "$@"
+	exit 1
 }
 
 [ "$#" -eq 1 ] || die "1 argument(s) required, $# provided. Usage: ./mkimage-crux.sh /path/to/iso"
@@ -33,15 +33,15 @@ export PATH="$TMP/usr/bin:$PATH"
 mkdir -p $ROOTFS/var/lib/pkg
 touch $ROOTFS/var/lib/pkg/db
 for pkg in $CRUX/crux/core/*; do
-    pkgadd -r $ROOTFS $pkg
+	pkgadd -r $ROOTFS $pkg
 done
 
 # Remove agetty and inittab config
 if (grep agetty ${ROOTFS}/etc/inittab 2>&1 > /dev/null); then
-    echo "Removing agetty from /etc/inittab ..."
-    chroot ${ROOTFS} sed -i -e "/agetty/d" /etc/inittab
-    chroot ${ROOTFS} sed -i -e "/shutdown/d" /etc/inittab
-    chroot ${ROOTFS} sed -i -e "/^$/N;/^\n$/d" /etc/inittab
+	echo "Removing agetty from /etc/inittab ..."
+	chroot ${ROOTFS} sed -i -e "/agetty/d" /etc/inittab
+	chroot ${ROOTFS} sed -i -e "/shutdown/d" /etc/inittab
+	chroot ${ROOTFS} sed -i -e "/^$/N;/^\n$/d" /etc/inittab
 fi
 
 # Remove kernel source
diff --git a/contrib/mkimage-yum.sh b/contrib/mkimage-yum.sh
index 47632ed783..ac53d2862f 100755
--- a/contrib/mkimage-yum.sh
+++ b/contrib/mkimage-yum.sh
@@ -9,7 +9,7 @@
 set -e
 
 usage() {
-    cat <<EOOPTS
+	cat << EOOPTS
 $(basename $0) [OPTIONS] <name>
 OPTIONS:
   -p "<packages>"  The list of packages to install in the container.
@@ -21,7 +21,7 @@ OPTIONS:
   -t <tag>         Specify Tag information.
                    default is reffered at /etc/{redhat,system}-release
 EOOPTS
-    exit 1
+	exit 1
 }
 
 # option defaults
@@ -35,38 +35,38 @@ install_groups=()
 install_packages=()
 version=
 while getopts ":y:p:g:t:h" opt; do
-    case $opt in
-        y)
-            yum_config=$OPTARG
-            ;;
-        h)
-            usage
-            ;;
-        p)
-            install_packages+=("$OPTARG")
-            ;;
-        g)
-            install_groups+=("$OPTARG")
-            ;;
-        t)
-            version="$OPTARG"
-            ;;
-        \?)
-            echo "Invalid option: -$OPTARG"
-            usage
-            ;;
-    esac
+	case $opt in
+		y)
+			yum_config=$OPTARG
+			;;
+		h)
+			usage
+			;;
+		p)
+			install_packages+=("$OPTARG")
+			;;
+		g)
+			install_groups+=("$OPTARG")
+			;;
+		t)
+			version="$OPTARG"
+			;;
+		\?)
+			echo "Invalid option: -$OPTARG"
+			usage
+			;;
+	esac
 done
 shift $((OPTIND - 1))
 name=$1
 
 if [[ -z $name ]]; then
-    usage
+	usage
 fi
 
 # default to Core group if not specified otherwise
 if [ ${#install_groups[*]} -eq 0 ]; then
-   install_groups=('Core')
+	install_groups=('Core')
 fi
 
 target=$(mktemp -d --tmpdir $(basename $0).XXXXXX)
@@ -91,21 +91,19 @@ if [ -d /etc/yum/vars ]; then
 	cp -a /etc/yum/vars "$target"/etc/yum/
 fi
 
-if [[ -n "$install_groups" ]];
-then
-    yum -c "$yum_config" --installroot="$target" --releasever=/ --setopt=tsflags=nodocs \
-        --setopt=group_package_types=mandatory -y groupinstall "${install_groups[@]}"
+if [[ -n "$install_groups" ]]; then
+	yum -c "$yum_config" --installroot="$target" --releasever=/ --setopt=tsflags=nodocs \
+		--setopt=group_package_types=mandatory -y groupinstall "${install_groups[@]}"
 fi
 
-if [[ -n "$install_packages" ]];
-then
-    yum -c "$yum_config" --installroot="$target" --releasever=/ --setopt=tsflags=nodocs \
-        --setopt=group_package_types=mandatory -y install "${install_packages[@]}"
+if [[ -n "$install_packages" ]]; then
+	yum -c "$yum_config" --installroot="$target" --releasever=/ --setopt=tsflags=nodocs \
+		--setopt=group_package_types=mandatory -y install "${install_packages[@]}"
 fi
 
 yum -c "$yum_config" --installroot="$target" -y clean all
 
-cat > "$target"/etc/sysconfig/network <<EOF
+cat > "$target"/etc/sysconfig/network << EOF
 NETWORKING=yes
 HOSTNAME=localhost.localdomain
 EOF
@@ -129,18 +127,17 @@ rm -rf "$target"/etc/ld.so.cache "$target"/var/cache/ldconfig
 mkdir -p --mode=0755 "$target"/var/cache/ldconfig
 
 if [ -z "$version" ]; then
-    for file in "$target"/etc/{redhat,system}-release
-    do
-        if [ -r "$file" ]; then
-            version="$(sed 's/^[^0-9\]*\([0-9.]\+\).*$/\1/' "$file")"
-            break
-        fi
-    done
+	for file in "$target"/etc/{redhat,system}-release; do
+		if [ -r "$file" ]; then
+			version="$(sed 's/^[^0-9\]*\([0-9.]\+\).*$/\1/' "$file")"
+			break
+		fi
+	done
 fi
 
 if [ -z "$version" ]; then
-    echo >&2 "warning: cannot autodetect OS version, using '$name' as tag"
-    version=$name
+	echo >&2 "warning: cannot autodetect OS version, using '$name' as tag"
+	version=$name
 fi
 
 tar --numeric-owner -c -C "$target" . | docker import - $name:$version
diff --git a/contrib/mkimage.sh b/contrib/mkimage.sh
index ae05d139c3..278a109ff2 100755
--- a/contrib/mkimage.sh
+++ b/contrib/mkimage.sh
@@ -28,12 +28,27 @@ tag=
 compression="auto"
 while true; do
 	case "$1" in
-		-d|--dir) dir="$2" ; shift 2 ;;
-		-t|--tag) tag="$2" ; shift 2 ;;
-		--compression)    compression="$2"   ; shift 2 ;;
-		--no-compression) compression="none" ; shift 1 ;;
-		-h|--help) usage ;;
-		--) shift ; break ;;
+		-d | --dir)
+			dir="$2"
+			shift 2
+			;;
+		-t | --tag)
+			tag="$2"
+			shift 2
+			;;
+		--compression)
+			compression="$2"
+			shift 2
+			;;
+		--no-compression)
+			compression="none"
+			shift 1
+			;;
+		-h | --help) usage ;;
+		--)
+			shift
+			break
+			;;
 	esac
 done
 
@@ -41,9 +56,8 @@ script="$1"
 [ "$script" ] || usage
 shift
 
-if [ "$compression" == 'auto' ] || [ -z "$compression" ]
-then
-    compression='xz'
+if [ "$compression" == 'auto' ] || [ -z "$compression" ]; then
+	compression='xz'
 fi
 
 [ "$compression" == 'none' ] && compression=''
@@ -68,7 +82,10 @@ if [ -z "$dir" ]; then
 fi
 
 rootfsDir="$dir/rootfs"
-( set -x; mkdir -p "$rootfsDir" )
+(
+	set -x
+	mkdir -p "$rootfsDir"
+)
 
 # pass all remaining arguments to $script
 "$scriptDir/$script" "$rootfsDir" "$@"
@@ -79,7 +96,7 @@ mkdir -p "$rootfsDir/dev" "$rootfsDir/proc"
 
 # make sure /etc/resolv.conf has something useful in it
 mkdir -p "$rootfsDir/etc"
-cat > "$rootfsDir/etc/resolv.conf" <<'EOF'
+cat > "$rootfsDir/etc/resolv.conf" << 'EOF'
 nameserver 8.8.8.8
 nameserver 8.8.4.4
 EOF
@@ -93,7 +110,7 @@ touch "$tarFile"
 )
 
 echo >&2 "+ cat > '$dir/Dockerfile'"
-cat > "$dir/Dockerfile" <<EOF
+cat > "$dir/Dockerfile" << EOF
 FROM scratch
 ADD $(basename "$tarFile") /
 EOF
@@ -101,20 +118,35 @@ EOF
 # if our generated image has a decent shell, let's set a default command
 for shell in /bin/bash /usr/bin/fish /usr/bin/zsh /bin/sh; do
 	if [ -x "$rootfsDir/$shell" ]; then
-		( set -x; echo 'CMD ["'"$shell"'"]' >> "$dir/Dockerfile" )
+		(
+			set -x
+			echo 'CMD ["'"$shell"'"]' >> "$dir/Dockerfile"
+		)
 		break
 	fi
 done
 
-( set -x; rm -rf "$rootfsDir" )
+(
+	set -x
+	rm -rf "$rootfsDir"
+)
 
 if [ "$tag" ]; then
-	( set -x; docker build -t "$tag" "$dir" )
+	(
+		set -x
+		docker build -t "$tag" "$dir"
+	)
 elif [ "$delDir" ]; then
 	# if we didn't specify a tag and we're going to delete our dir, let's just build an untagged image so that we did _something_
-	( set -x; docker build "$dir" )
+	(
+		set -x
+		docker build "$dir"
+	)
 fi
 
 if [ "$delDir" ]; then
-	( set -x; rm -rf "$dir" )
+	(
+		set -x
+		rm -rf "$dir"
+	)
 fi
diff --git a/contrib/mkimage/busybox-static b/contrib/mkimage/busybox-static
index e15322b49d..acaca38aa0 100755
--- a/contrib/mkimage/busybox-static
+++ b/contrib/mkimage/busybox-static
@@ -4,7 +4,7 @@ set -e
 rootfsDir="$1"
 shift
 
-busybox="$(which busybox 2>/dev/null || true)"
+busybox="$(which busybox 2> /dev/null || true)"
 if [ -z "$busybox" ]; then
 	echo >&2 'error: busybox: not found'
 	echo >&2 '  install it with your distribution "busybox-static" package'
@@ -24,7 +24,7 @@ cp "$busybox" "$rootfsDir/bin/busybox"
 	cd "$rootfsDir"
 
 	IFS=$'\n'
-	modules=( $(bin/busybox --list-modules) )
+	modules=($(bin/busybox --list-modules))
 	unset IFS
 
 	for module in "${modules[@]}"; do
diff --git a/contrib/mkimage/debootstrap b/contrib/mkimage/debootstrap
index a919429b0b..7046b6e14f 100755
--- a/contrib/mkimage/debootstrap
+++ b/contrib/mkimage/debootstrap
@@ -22,7 +22,7 @@ shift
 
 before=()
 while [ $# -gt 0 ] && [[ "$1" == -* ]]; do
-	before+=( "$1" )
+	before+=("$1")
 	shift
 done
 
@@ -62,7 +62,7 @@ rootfs_chroot() {
 
 # prevent init scripts from running during install/update
 echo >&2 "+ echo exit 101 > '$rootfsDir/usr/sbin/policy-rc.d'"
-cat > "$rootfsDir/usr/sbin/policy-rc.d" <<-'EOF'
+cat > "$rootfsDir/usr/sbin/policy-rc.d" <<- 'EOF'
 	#!/bin/sh
 
 	# For most Docker users, "apt-get install" only happens during "docker build",
@@ -82,7 +82,10 @@ chmod +x "$rootfsDir/usr/sbin/policy-rc.d"
 )
 
 # shrink a little, since apt makes us cache-fat (wheezy: ~157.5MB vs ~120MB)
-( set -x; rootfs_chroot apt-get clean )
+(
+	set -x
+	rootfs_chroot apt-get clean
+)
 
 # this file is one APT creates to make sure we don't "autoremove" our currently
 # in-use kernel, which doesn't really apply to debootstraps/Docker images that
@@ -93,7 +96,7 @@ rm -f "$rootfsDir/etc/apt/apt.conf.d/01autoremove-kernels"
 if strings "$rootfsDir/usr/bin/dpkg" | grep -q unsafe-io; then
 	# force dpkg not to call sync() after package extraction (speeding up installs)
 	echo >&2 "+ echo force-unsafe-io > '$rootfsDir/etc/dpkg/dpkg.cfg.d/docker-apt-speedup'"
-	cat > "$rootfsDir/etc/dpkg/dpkg.cfg.d/docker-apt-speedup" <<-'EOF'
+	cat > "$rootfsDir/etc/dpkg/dpkg.cfg.d/docker-apt-speedup" <<- 'EOF'
 		# For most Docker users, package installs happen during "docker build", which
 		# doesn't survive power loss and gets restarted clean afterwards anyhow, so
 		# this minor tweak gives us a nice speedup (much nicer on spinning disks,
@@ -107,7 +110,7 @@ if [ -d "$rootfsDir/etc/apt/apt.conf.d" ]; then
 	# _keep_ us lean by effectively running "apt-get clean" after every install
 	aptGetClean='"rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true";'
 	echo >&2 "+ cat > '$rootfsDir/etc/apt/apt.conf.d/docker-clean'"
-	cat > "$rootfsDir/etc/apt/apt.conf.d/docker-clean" <<-EOF
+	cat > "$rootfsDir/etc/apt/apt.conf.d/docker-clean" <<- EOF
 		# Since for most Docker users, package installs happen in "docker build" steps,
 		# they essentially become individual layers due to the way Docker handles
 		# layering, especially using CoW filesystems.  What this means for us is that
@@ -131,7 +134,7 @@ if [ -d "$rootfsDir/etc/apt/apt.conf.d" ]; then
 
 	# remove apt-cache translations for fast "apt-get update"
 	echo >&2 "+ echo Acquire::Languages 'none' > '$rootfsDir/etc/apt/apt.conf.d/docker-no-languages'"
-	cat > "$rootfsDir/etc/apt/apt.conf.d/docker-no-languages" <<-'EOF'
+	cat > "$rootfsDir/etc/apt/apt.conf.d/docker-no-languages" <<- 'EOF'
 		# In Docker, we don't often need the "Translations" files, so we're just wasting
 		# time and space by downloading them, and this inhibits that.  For users that do
 		# need them, it's a simple matter to delete this file and "apt-get update". :)
@@ -140,7 +143,7 @@ if [ -d "$rootfsDir/etc/apt/apt.conf.d" ]; then
 	EOF
 
 	echo >&2 "+ echo Acquire::GzipIndexes 'true' > '$rootfsDir/etc/apt/apt.conf.d/docker-gzip-indexes'"
-	cat > "$rootfsDir/etc/apt/apt.conf.d/docker-gzip-indexes" <<-'EOF'
+	cat > "$rootfsDir/etc/apt/apt.conf.d/docker-gzip-indexes" <<- 'EOF'
 		# Since Docker users using "RUN apt-get update && apt-get install -y ..." in
 		# their Dockerfiles don't go delete the lists files afterwards, we want them to
 		# be as small as possible on-disk, so we explicitly request "gz" versions and
@@ -156,7 +159,7 @@ if [ -d "$rootfsDir/etc/apt/apt.conf.d" ]; then
 
 	# update "autoremove" configuration to be aggressive about removing suggests deps that weren't manually installed
 	echo >&2 "+ echo Apt::AutoRemove::SuggestsImportant 'false' > '$rootfsDir/etc/apt/apt.conf.d/docker-autoremove-suggests'"
-	cat > "$rootfsDir/etc/apt/apt.conf.d/docker-autoremove-suggests" <<-'EOF'
+	cat > "$rootfsDir/etc/apt/apt.conf.d/docker-autoremove-suggests" <<- 'EOF'
 		# Since Docker users are looking for the smallest possible final images, the
 		# following emerges as a very common pattern:
 
diff --git a/contrib/mkimage/mageia-urpmi b/contrib/mkimage/mageia-urpmi
index 93fb289cac..d9e88eca8f 100755
--- a/contrib/mkimage/mageia-urpmi
+++ b/contrib/mkimage/mageia-urpmi
@@ -20,9 +20,18 @@ installversion=
 mirror=
 while true; do
 	case "$1" in
-		-v|--version) installversion="$2" ; shift 2 ;;
-		-m|--mirror) mirror="$2" ; shift 2 ;;
-		--) shift ; break ;;
+		-v | --version)
+			installversion="$2"
+			shift 2
+			;;
+		-m | --mirror)
+			mirror="$2"
+			shift 2
+			;;
+		--)
+			shift
+			break
+			;;
 	esac
 done
 
diff --git a/contrib/nuke-graph-directory.sh b/contrib/nuke-graph-directory.sh
index 3d2f49e869..3a1b5713d2 100755
--- a/contrib/nuke-graph-directory.sh
+++ b/contrib/nuke-graph-directory.sh
@@ -31,7 +31,10 @@ echo "Nuking $dir ..."
 echo '  (if this is wrong, press Ctrl+C NOW!)'
 echo
 
-( set -x; sleep 10 )
+(
+	set -x
+	sleep 10
+)
 echo
 
 dir_in_dir() {
@@ -45,7 +48,10 @@ dir_in_dir() {
 for mount in $(awk '{ print $5 }' /proc/self/mountinfo); do
 	mount="$(readlink -f "$mount" || true)"
 	if [ "$dir" != "$mount" ] && dir_in_dir "$mount" "$dir"; then
-		( set -x; umount -f "$mount" )
+		(
+			set -x
+			umount -f "$mount"
+		)
 	fi
 done
 
@@ -55,10 +61,17 @@ if command -v btrfs > /dev/null 2>&1; then
 	# Source: http://stackoverflow.com/a/32865333
 	for subvol in $(find "$dir" -type d -inum 256 | sort -r); do
 		if [ "$dir" != "$subvol" ]; then
-			( set -x; btrfs subvolume delete "$subvol" )
+			(
+				set -x
+				btrfs subvolume delete "$subvol"
+			)
 		fi
 	done
 fi
 
 # finally, DESTROY ALL THINGS
-( shopt -s dotglob; set -x; rm -rf "$dir"/* )
+(
+	shopt -s dotglob
+	set -x
+	rm -rf "$dir"/*
+)
diff --git a/contrib/report-issue.sh b/contrib/report-issue.sh
index cb54f1a5bc..b45da891c0 100755
--- a/contrib/report-issue.sh
+++ b/contrib/report-issue.sh
@@ -16,59 +16,59 @@ function urlencode() {
 	# urlencode <string>
 
 	local length="${#1}"
-	for (( i = 0; i < length; i++ )); do
-			local c="${1:i:1}"
-			case $c in
-					[a-zA-Z0-9.~_-]) printf "$c" ;;
-					*) printf '%%%02X' "'$c"
-			esac
+	for ((i = 0; i < length; i++)); do
+		local c="${1:i:1}"
+		case $c in
+			[a-zA-Z0-9.~_-]) printf "$c" ;;
+			*) printf '%%%02X' "'$c" ;;
+		esac
 	done
 }
 
 function template() {
-# this should always match the template from CONTRIBUTING.md
+	# this should always match the template from CONTRIBUTING.md
 	cat <<- EOM
-	Description of problem:
+		Description of problem:
 
 
-	\`docker version\`:
-	`${DOCKER_COMMAND} -D version`
+		\`docker version\`:
+		$(${DOCKER_COMMAND} -D version)
 
 
-	\`docker info\`:
-	`${DOCKER_COMMAND} -D info`
+		\`docker info\`:
+		$(${DOCKER_COMMAND} -D info)
 
 
-	\`uname -a\`:
-	`uname -a`
+		\`uname -a\`:
+		$(uname -a)
 
 
-	Environment details (AWS, VirtualBox, physical, etc.):
+		Environment details (AWS, VirtualBox, physical, etc.):
 
 
-	How reproducible:
+		How reproducible:
 
 
-	Steps to Reproduce:
-	1.
-	2.
-	3.
+		Steps to Reproduce:
+		1.
+		2.
+		3.
 
 
-	Actual Results:
+		Actual Results:
 
 
-	Expected Results:
+		Expected Results:
 
 
-	Additional info:
+		Additional info:
 
 
 	EOM
 }
 
 function format_issue_url() {
-	if [ ${#@} -ne 2 ] ; then
+	if [ ${#@} -ne 2 ]; then
 		return 1
 	fi
 	local issue_name=$(urlencode "${DOCKER_ISSUE_NAME_PREFIX}${1}")
@@ -76,7 +76,6 @@ function format_issue_url() {
 	echo "${DOCKER_ISSUE_URL}?title=${issue_name}&body=${issue_body}"
 }
 
-
 echo -ne "Do you use \`sudo\` to call docker? [y|N]: "
 read -r -n 1 use_sudo
 echo ""
@@ -91,7 +90,7 @@ echo ""
 
 issue_url=$(format_issue_url "${issue_title}" "$(template)")
 
-if which xdg-open 2>/dev/null >/dev/null ; then
+if which xdg-open 2> /dev/null > /dev/null; then
 	echo -ne "Would like to launch this report in your browser? [Y|n]: "
 	read -r -n 1 launch_now
 	echo ""
@@ -102,4 +101,3 @@ if which xdg-open 2>/dev/null >/dev/null ; then
 fi
 
 echo "If you would like to manually open the url, you can open this link if your browser: ${issue_url}"
-
diff --git a/hack/dockerfile/install/containerd.installer b/hack/dockerfile/install/containerd.installer
index 723a8bd958..4f16c2af24 100755
--- a/hack/dockerfile/install/containerd.installer
+++ b/hack/dockerfile/install/containerd.installer
@@ -1,6 +1,5 @@
 #!/bin/sh
 
-
 # containerd is also pinned in vendor.conf. When updating the binary
 # version you may also need to update the vendor version to pick up bug
 # fixes or new APIs.
diff --git a/hack/dockerfile/install/proxy.installer b/hack/dockerfile/install/proxy.installer
index 237c1f3a8a..440bc7e7b7 100755
--- a/hack/dockerfile/install/proxy.installer
+++ b/hack/dockerfile/install/proxy.installer
@@ -34,5 +34,3 @@ _install_proxy() {
 	git checkout -q "$LIBNETWORK_COMMIT"
 	go build ${BUILD_MODE} -ldflags="$PROXY_LDFLAGS" -o ${PREFIX}/docker-proxy github.com/docker/libnetwork/cmd/proxy
 }
-
-
diff --git a/hack/dockerfile/install/rootlesskit.installer b/hack/dockerfile/install/rootlesskit.installer
index 6e12dd703d..df55e5105d 100755
--- a/hack/dockerfile/install/rootlesskit.installer
+++ b/hack/dockerfile/install/rootlesskit.installer
@@ -5,17 +5,17 @@
 
 install_rootlesskit() {
 	case "$1" in
-	"dynamic")
-		install_rootlesskit_dynamic
-		return
-		;;
-	"")
-		export CGO_ENABLED=0
-		_install_rootlesskit
-		;;
-	*)
-		echo 'Usage: $0 [dynamic]'
-		;;
+		"dynamic")
+			install_rootlesskit_dynamic
+			return
+			;;
+		"")
+			export CGO_ENABLED=0
+			_install_rootlesskit
+			;;
+		*)
+			echo 'Usage: $0 [dynamic]'
+			;;
 	esac
 }
 
diff --git a/hack/generate-authors.sh b/hack/generate-authors.sh
index 680bdb7b3f..dc42294052 100755
--- a/hack/generate-authors.sh
+++ b/hack/generate-authors.sh
@@ -6,9 +6,9 @@ cd "$(dirname "$(readlink -f "$BASH_SOURCE")")/.."
 # see also ".mailmap" for how email addresses and names are deduplicated
 
 {
-	cat <<-'EOH'
-	# This file lists all individuals having contributed content to the repository.
-	# For how it is generated, see `hack/generate-authors.sh`.
+	cat <<- 'EOH'
+		# This file lists all individuals having contributed content to the repository.
+		# For how it is generated, see `hack/generate-authors.sh`.
 	EOH
 	echo
 	git log --format='%aN <%aE>' | LC_ALL=C.UTF-8 sort -uf
diff --git a/hack/make.sh b/hack/make.sh
index 357e6a17bb..e19abba6d2 100755
--- a/hack/make.sh
+++ b/hack/make.sh
@@ -24,7 +24,7 @@ set -e
 set -o pipefail
 
 export DOCKER_PKG='github.com/docker/docker'
-export SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 export MAKEDIR="$SCRIPTDIR/make"
 export PKG_CONFIG=${PKG_CONFIG:-pkg-config}
 
@@ -34,10 +34,10 @@ echo
 DEFAULT_BUNDLES=(
 	binary-daemon
 	dynbinary
-
+	\
 	test-integration
 	test-docker-py
-
+	\
 	cross
 )
 
@@ -85,9 +85,9 @@ add_buildtag() {
 	[[ " $DOCKER_BUILDTAGS" == *" $1_"* ]] || DOCKER_BUILDTAGS+=" $1_$2"
 }
 
-if ${PKG_CONFIG} 'libsystemd >= 209' 2> /dev/null ; then
+if ${PKG_CONFIG} 'libsystemd >= 209' 2> /dev/null; then
 	DOCKER_BUILDTAGS+=" journald"
-elif ${PKG_CONFIG} 'libsystemd-journal' 2> /dev/null ; then
+elif ${PKG_CONFIG} 'libsystemd-journal' 2> /dev/null; then
 	DOCKER_BUILDTAGS+=" journald journald_compat"
 fi
 
@@ -95,10 +95,11 @@ fi
 # functionality. We favour libdm_dlsym_deferred_remove over
 # libdm_no_deferred_remove in dynamic cases because the binary could be shipped
 # with a newer libdevmapper than the one it was built with.
-if \
+if
 	command -v gcc &> /dev/null \
-	&& ! ( echo -e  '#include <libdevmapper.h>\nint main() { dm_task_deferred_remove(NULL); }'| gcc -xc - -o /dev/null $(pkg-config --libs devmapper) &> /dev/null ) \
-; then
+		&& ! (echo -e '#include <libdevmapper.h>\nint main() { dm_task_deferred_remove(NULL); }' | gcc -xc - -o /dev/null $(pkg-config --libs devmapper) &> /dev/null) \
+		;
+then
 	add_buildtag libdm dlsym_deferred_remove
 fi
 
@@ -113,10 +114,10 @@ LDFLAGS_STATIC=''
 EXTLDFLAGS_STATIC='-static'
 # ORIG_BUILDFLAGS is necessary for the cross target which cannot always build
 # with options like -race.
-ORIG_BUILDFLAGS=( -tags "netgo osusergo static_build $DOCKER_BUILDTAGS" -installsuffix netgo )
+ORIG_BUILDFLAGS=(-tags "netgo osusergo static_build $DOCKER_BUILDTAGS" -installsuffix netgo)
 # see https://github.com/golang/go/issues/9369#issuecomment-69864440 for why -installsuffix is necessary here
 
-BUILDFLAGS=( ${BUILDFLAGS} "${ORIG_BUILDFLAGS[@]}" )
+BUILDFLAGS=(${BUILDFLAGS} "${ORIG_BUILDFLAGS[@]}")
 
 LDFLAGS_STATIC_DOCKER="
 	$LDFLAGS_STATIC
@@ -134,7 +135,8 @@ if [ "$(uname -s)" = 'FreeBSD' ]; then
 fi
 
 bundle() {
-	local bundle="$1"; shift
+	local bundle="$1"
+	shift
 	echo "---> Making bundle: $(basename "$bundle") (in $DEST)"
 	source "$SCRIPTDIR/make/$bundle" "$@"
 }
diff --git a/hack/make/.binary b/hack/make/.binary
index 66f4ca05f3..2e194f2f10 100644
--- a/hack/make/.binary
+++ b/hack/make/.binary
@@ -38,58 +38,58 @@ hash_files() {
 }
 
 (
-export GOGC=${DOCKER_BUILD_GOGC:-1000}
+	export GOGC=${DOCKER_BUILD_GOGC:-1000}
 
-if [ "$(go env GOOS)/$(go env GOARCH)" != "$(go env GOHOSTOS)/$(go env GOHOSTARCH)" ]; then
-	# must be cross-compiling!
+	if [ "$(go env GOOS)/$(go env GOARCH)" != "$(go env GOHOSTOS)/$(go env GOHOSTARCH)" ]; then
+		# must be cross-compiling!
+		case "$(go env GOOS)/$(go env GOARCH)" in
+			windows/amd64)
+				export CC="${CC:-x86_64-w64-mingw32-gcc}"
+				export CGO_ENABLED=1
+				;;
+			linux/arm)
+				case "${GOARM}" in
+					5 | "")
+						export CC="${CC:-arm-linux-gnueabi-gcc}"
+						export CGO_ENABLED=1
+						;;
+					7)
+						export CC="${CC:-arm-linux-gnueabihf-gcc}"
+						export CGO_ENABLED=1
+						;;
+				esac
+				;;
+			linux/arm64)
+				export CC="${CC:-aarch64-linux-gnu-gcc}"
+				export CGO_ENABLED=1
+				;;
+			linux/amd64)
+				export CC="${CC:-x86_64-linux-gnu-gcc}"
+				export CGO_ENABLED=1
+				;;
+		esac
+	fi
+
+	# -buildmode=pie is not supported on Windows and Linux on mips.
 	case "$(go env GOOS)/$(go env GOARCH)" in
-		windows/amd64)
-			export CC="${CC:-x86_64-w64-mingw32-gcc}"
-			export CGO_ENABLED=1
-			;;
-		linux/arm)
-			case "${GOARM}" in
-			5|"")
-				export CC="${CC:-arm-linux-gnueabi-gcc}"
-				export CGO_ENABLED=1
-				;;
-			7)
-				export CC="${CC:-arm-linux-gnueabihf-gcc}"
-				export CGO_ENABLED=1
-				;;
-			esac
-			;;
-		linux/arm64)
-			export CC="${CC:-aarch64-linux-gnu-gcc}"
-			export CGO_ENABLED=1
-			;;
-		linux/amd64)
-			export CC="${CC:-x86_64-linux-gnu-gcc}"
-			export CGO_ENABLED=1
+		windows/* | linux/mips*) ;;
+
+		*)
+			BUILDFLAGS+=("-buildmode=pie")
 			;;
 	esac
-fi
 
-# -buildmode=pie is not supported on Windows and Linux on mips.
-case "$(go env GOOS)/$(go env GOARCH)" in
-	windows/*|linux/mips*)
-		;;
-	*)
-		BUILDFLAGS+=( "-buildmode=pie" )
-		;;
-esac
-
-echo "Building: $DEST/$BINARY_FULLNAME"
-echo "GOOS=\"${GOOS}\" GOARCH=\"${GOARCH}\" GOARM=\"${GOARM}\""
-go build \
-	-o "$DEST/$BINARY_FULLNAME" \
-	"${BUILDFLAGS[@]}" \
-	-ldflags "
+	echo "Building: $DEST/$BINARY_FULLNAME"
+	echo "GOOS=\"${GOOS}\" GOARCH=\"${GOARCH}\" GOARM=\"${GOARM}\""
+	go build \
+		-o "$DEST/$BINARY_FULLNAME" \
+		"${BUILDFLAGS[@]}" \
+		-ldflags "
 		$LDFLAGS
 		$LDFLAGS_STATIC_DOCKER
 		$DOCKER_LDFLAGS
 	" \
-	${GO_PACKAGE}
+		${GO_PACKAGE}
 )
 
 echo "Created binary: $DEST/$BINARY_FULLNAME"
diff --git a/hack/make/.detect-daemon-osarch b/hack/make/.detect-daemon-osarch
index 91e2c53c75..9190cd0264 100644
--- a/hack/make/.detect-daemon-osarch
+++ b/hack/make/.detect-daemon-osarch
@@ -2,13 +2,13 @@
 set -e
 
 docker-version-osarch() {
-	if ! type docker &>/dev/null; then
+	if ! type docker &> /dev/null; then
 		# docker is not installed
 		return
 	fi
 	local target="$1" # "Client" or "Server"
 	local fmtStr="{{.${target}.Os}}/{{.${target}.Arch}}"
-	if docker version -f "$fmtStr" 2>/dev/null; then
+	if docker version -f "$fmtStr" 2> /dev/null; then
 		# if "docker version -f" works, let's just use that!
 		return
 	fi
diff --git a/hack/make/.integration-daemon-start b/hack/make/.integration-daemon-start
index 34a2c872a6..557590be8f 100644
--- a/hack/make/.integration-daemon-start
+++ b/hack/make/.integration-daemon-start
@@ -58,7 +58,7 @@ if [ "$DOCKER_REMAP_ROOT" ]; then
 fi
 
 # example usage: DOCKER_EXPERIMENTAL=1
-if [  "$DOCKER_EXPERIMENTAL" ]; then
+if [ "$DOCKER_EXPERIMENTAL" ]; then
 	echo >&2 '# DOCKER_EXPERIMENTAL is set: starting daemon with experimental features enabled! '
 	extra_params="$extra_params --experimental"
 fi
@@ -88,7 +88,7 @@ if [ -z "$DOCKER_TEST_HOST" ]; then
 			--userland-proxy="$DOCKER_USERLANDPROXY" \
 			${storage_params} \
 			${extra_params} \
-				&> "$DEST/docker.log"
+			&> "$DEST/docker.log"
 	) &
 else
 	export DOCKER_HOST="$DOCKER_TEST_HOST"
@@ -98,7 +98,7 @@ fi
 tries=60
 echo "INFO: Waiting for daemon to start..."
 while ! ${TEST_CLIENT_BINARY} version &> /dev/null; do
-	(( tries-- ))
+	((tries--))
 	if [ $tries -le 0 ]; then
 		printf "\n"
 		if [ -z "$DOCKER_HOST" ]; then
diff --git a/hack/make/.integration-daemon-stop b/hack/make/.integration-daemon-stop
index 82d9c3f242..59f62aa593 100644
--- a/hack/make/.integration-daemon-stop
+++ b/hack/make/.integration-daemon-stop
@@ -2,7 +2,10 @@
 
 if [ ! "$(go env GOOS)" = 'windows' ]; then
 	for pidFile in $(find "$DEST" -name docker.pid); do
-		pid=$([ -n "$TESTDEBUG" ] && set -x; cat "$pidFile")
+		pid=$(
+			[ -n "$TESTDEBUG" ] && set -x
+			cat "$pidFile"
+		)
 		(
 			[ -n "$TESTDEBUG" ] && set -x
 			kill "$pid"
@@ -26,7 +29,7 @@ if [ ! "$(go env GOOS)" = 'windows' ]; then
 		fi
 	fi
 else
-	# Note this script is not actionable on Windows to Linux CI. Instead the 
+	# Note this script is not actionable on Windows to Linux CI. Instead the
 	# DIND daemon under test is torn down by the Jenkins tear-down script
 	echo "INFO: Not stopping daemon on Windows CI"
 fi
diff --git a/hack/make/.integration-test-helpers b/hack/make/.integration-test-helpers
index 9be9a43b85..5770deca7c 100644
--- a/hack/make/.integration-test-helpers
+++ b/hack/make/.integration-test-helpers
@@ -7,7 +7,7 @@
 #
 
 if [ -z "${MAKEDIR}" ]; then
-	MAKEDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+	MAKEDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 	export MAKEDIR
 fi
 source "${MAKEDIR}/.go-autogen"
@@ -46,7 +46,7 @@ setup_integration_test_filter() {
 
 setup_integration_test_filter
 if [ -z "${TEST_SKIP_INTEGRATION}" ] && [ -z "${TEST_INTEGRATION_DIR}" ]; then
-	integration_api_dirs="$(go list -test -f '{{- if ne .ForTest "" -}}{{- .Dir -}}{{- end -}}'  ./integration/...)"
+	integration_api_dirs="$(go list -test -f '{{- if ne .ForTest "" -}}{{- .Dir -}}{{- end -}}' ./integration/...)"
 else
 	integration_api_dirs="${TEST_INTEGRATION_DIR}"
 fi
@@ -163,8 +163,8 @@ error_on_leaked_containerd_shims() {
 		return
 	fi
 
-	leftovers=$(ps -ax -o pid,cmd |
-	            awk '$2 == "containerd-shim" && $4 ~ /.*\/bundles\/.*\/test-integration/ { print $1 }')
+	leftovers=$(ps -ax -o pid,cmd \
+		| awk '$2 == "containerd-shim" && $4 ~ /.*\/bundles\/.*\/test-integration/ { print $1 }')
 	if [ -n "$leftovers" ]; then
 		ps aux
 		# shellcheck disable=SC2086
@@ -190,6 +190,6 @@ set_platform_timeout() {
 		# - remove last character (usually 'm' from '10m')
 		# - multiply by testcount
 		# - add last character back
-		TIMEOUT=$((${TIMEOUT::-1} * ${TEST_REPEAT}))${TIMEOUT:$((${#TIMEOUT}-1)):1}
+		TIMEOUT=$((${TIMEOUT::-1} * ${TEST_REPEAT}))${TIMEOUT:$((${#TIMEOUT} - 1)):1}
 	fi
 }
diff --git a/hack/make/binary-daemon b/hack/make/binary-daemon
index 3b360a9e03..d19fe09b6f 100644
--- a/hack/make/binary-daemon
+++ b/hack/make/binary-daemon
@@ -22,7 +22,7 @@ copy_binaries() {
 	done
 
 	# vpnkit is amd64 only
-	if command -v "vpnkit.$(uname -m)" 2>&1 >/dev/null; then
+	if command -v "vpnkit.$(uname -m)" 2>&1 > /dev/null; then
 		cp -f "$(command -v "vpnkit.$(uname -m)")" "$dir/vpnkit"
 		if [ "$hash" = "hash" ]; then
 			hash_files "$dir/vpnkit"
diff --git a/hack/make/dynbinary-daemon b/hack/make/dynbinary-daemon
index c712bfefc2..67622338c9 100644
--- a/hack/make/dynbinary-daemon
+++ b/hack/make/dynbinary-daemon
@@ -4,8 +4,8 @@ set -e
 (
 	export IAMSTATIC='false'
 	export LDFLAGS_STATIC_DOCKER=''
-	export BUILDFLAGS=( "${BUILDFLAGS[@]/netgo /}" ) # disable netgo, since we don't need it for a dynamic binary
-	export BUILDFLAGS=( "${BUILDFLAGS[@]/osusergo /}" ) # ditto for osusergo
-	export BUILDFLAGS=( "${BUILDFLAGS[@]/static_build /}" ) # we're not building a "static" binary here
+	export BUILDFLAGS=("${BUILDFLAGS[@]/netgo /}")        # disable netgo, since we don't need it for a dynamic binary
+	export BUILDFLAGS=("${BUILDFLAGS[@]/osusergo /}")     # ditto for osusergo
+	export BUILDFLAGS=("${BUILDFLAGS[@]/static_build /}") # we're not building a "static" binary here
 	source "${MAKEDIR}/.binary"
 )
diff --git a/hack/make/run b/hack/make/run
index eff7dd95aa..4522ed4502 100644
--- a/hack/make/run
+++ b/hack/make/run
@@ -21,7 +21,6 @@ if [ -n "$DOCKER_STORAGE_OPTS" ]; then
 	unset IFS
 fi
 
-
 listen_port=2375
 if [ -n "$DOCKER_PORT" ]; then
 	IFS=':' read -r -a ports <<< "$DOCKER_PORT"
diff --git a/hack/make/test-docker-py b/hack/make/test-docker-py
index 97bfd77827..f6e4f4e202 100644
--- a/hack/make/test-docker-py
+++ b/hack/make/test-docker-py
@@ -37,6 +37,7 @@ source hack/make/.integration-test-helpers
 			echo "WARN: Skipping test-docker-py: connecting to docker daemon using ${docker_host_scheme} (${DOCKER_HOST}) not supported"
 			bundle .integration-daemon-stop
 			return 0
+			;;
 	esac
 
 	docker_py_image="docker-sdk-python3:${DOCKER_PY_COMMIT}"
diff --git a/hack/make/test-integration b/hack/make/test-integration
index 5ea41b0a32..b9741a594e 100755
--- a/hack/make/test-integration
+++ b/hack/make/test-integration
@@ -15,7 +15,7 @@ fi
 	bundle .integration-daemon-setup
 
 	testexit=0
-	( repeat run_test_integration ) || testexit=$?
+	(repeat run_test_integration) || testexit=$?
 
 	# Always run cleanup, even if the subshell fails
 	bundle .integration-daemon-stop
diff --git a/hack/make/test-integration-flaky b/hack/make/test-integration-flaky
index 5c28b94423..eef203b96c 100644
--- a/hack/make/test-integration-flaky
+++ b/hack/make/test-integration-flaky
@@ -3,11 +3,10 @@ set -e -o pipefail
 
 source hack/validate/.validate
 
-
 run_integration_flaky() {
 	new_tests=$(
-		validate_diff --diff-filter=ACMR --unified=0 -- 'integration/*_test.go' |
-			grep -E '^(\+func Test)(.*)(\*testing\.T\))' || true
+		validate_diff --diff-filter=ACMR --unified=0 -- 'integration/*_test.go' \
+			| grep -E '^(\+func Test)(.*)(\*testing\.T\))' || true
 	)
 
 	if [ -z "$new_tests" ]; then
diff --git a/hack/test/e2e-run.sh b/hack/test/e2e-run.sh
index 4ca1d35289..57127c0d18 100755
--- a/hack/test/e2e-run.sh
+++ b/hack/test/e2e-run.sh
@@ -3,7 +3,7 @@ set -e -u -o pipefail
 
 ARCH=$(uname -m)
 if [ "$ARCH" = "x86_64" ]; then
-  ARCH="amd64"
+	ARCH="amd64"
 fi
 
 export DOCKER_ENGINE_GOARCH=${DOCKER_ENGINE_GOARCH:-${ARCH}}
@@ -13,8 +13,9 @@ export DOCKER_ENGINE_GOARCH=${DOCKER_ENGINE_GOARCH:-${ARCH}}
 : ${TESTDEBUG:=}
 
 integration_api_dirs=${TEST_INTEGRATION_DIR:-"$(
-	find /tests/integration -type d |
-	grep -vE '(^/tests/integration($|/internal)|/testdata)')"}
+	find /tests/integration -type d \
+		| grep -vE '(^/tests/integration($|/internal)|/testdata)'
+)"}
 
 run_test_integration() {
 	set_platform_timeout
diff --git a/hack/test/unit b/hack/test/unit
index a47a93935f..fa54c6eb71 100755
--- a/hack/test/unit
+++ b/hack/test/unit
@@ -12,7 +12,7 @@
 #
 set -eu -o pipefail
 
-BUILDFLAGS=( -tags 'netgo seccomp libdm_no_deferred_remove' )
+BUILDFLAGS=(-tags 'netgo seccomp libdm_no_deferred_remove')
 TESTFLAGS+=" -test.timeout=${TIMEOUT:-5m}"
 TESTDIRS="${TESTDIRS:-./...}"
 exclude_paths='/vendor/|/integration'
diff --git a/hack/validate/all b/hack/validate/all
index 8e3cbfcd3b..3224fe57c2 100755
--- a/hack/validate/all
+++ b/hack/validate/all
@@ -2,7 +2,7 @@
 #
 # Run all validation
 
-export SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 . ${SCRIPTDIR}/default
 . ${SCRIPTDIR}/vendor
diff --git a/hack/validate/dco b/hack/validate/dco
index 9e1ed80f77..0e61ccca5d 100755
--- a/hack/validate/dco
+++ b/hack/validate/dco
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-export SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPTDIR}/.validate"
 
 adds=$(validate_diff --numstat | awk '{ s += $1 } END { print s }')
@@ -24,7 +24,7 @@ check_dco() {
 if [ ${adds} -eq 0 -a ${dels} -eq 0 ]; then
 	echo '0 adds, 0 deletions; nothing to validate! :)'
 else
-	commits=( $(validate_log --format='format:%H%n') )
+	commits=($(validate_log --format='format:%H%n'))
 	badCommits=()
 	for commit in "${commits[@]}"; do
 		if [ -z "$(git log -1 --format='format:' --name-status "$commit")" ]; then
@@ -32,7 +32,7 @@ else
 			continue
 		fi
 		if ! git log -1 --format='format:%B' "$commit" | check_dco; then
-			badCommits+=( "$commit" )
+			badCommits+=("$commit")
 		fi
 	done
 	if [ ${#badCommits[@]} -eq 0 ]; then
diff --git a/hack/validate/default b/hack/validate/default
index b91390f691..fbe442ee15 100755
--- a/hack/validate/default
+++ b/hack/validate/default
@@ -2,7 +2,7 @@
 #
 # Run default validation, exclude vendor because it's slow
 
-export SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 . "${SCRIPTDIR}"/dco
 . "${SCRIPTDIR}"/default-seccomp
diff --git a/hack/validate/default-seccomp b/hack/validate/default-seccomp
index 10baf52c91..c5f8c7e3c8 100755
--- a/hack/validate/default-seccomp
+++ b/hack/validate/default-seccomp
@@ -1,17 +1,17 @@
 #!/usr/bin/env bash
 
-export SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPTDIR}/.validate"
 
 IFS=$'\n'
-files=( $(validate_diff --diff-filter=ACMR --name-only -- 'profiles/seccomp' || true) )
+files=($(validate_diff --diff-filter=ACMR --name-only -- 'profiles/seccomp' || true))
 unset IFS
 
 if [ -n "${TEST_FORCE_VALIDATE:-}" ] || [ ${#files[@]} -gt 0 ]; then
 	# We run 'go generate' and see if we have a diff afterwards
-	go generate ./profiles/seccomp/ >/dev/null
+	go generate ./profiles/seccomp/ > /dev/null
 	# Let see if the working directory is clean
-	diffs="$(git status --porcelain -- profiles/seccomp 2>/dev/null)"
+	diffs="$(git status --porcelain -- profiles/seccomp 2> /dev/null)"
 	if [ "$diffs" ]; then
 		{
 			echo 'The result of go generate ./profiles/seccomp/ differs'
diff --git a/hack/validate/deprecate-integration-cli b/hack/validate/deprecate-integration-cli
index 0ec1709834..f53b48eedc 100755
--- a/hack/validate/deprecate-integration-cli
+++ b/hack/validate/deprecate-integration-cli
@@ -1,12 +1,12 @@
 #!/usr/bin/env bash
 # Check that no new tests are being added to integration-cli
 
-export SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPTDIR}/.validate"
 
 new_tests=$(
-	validate_diff --diff-filter=ACMR --unified=0 -- 'integration-cli/*_api_*.go' 'integration-cli/*_cli_*.go' |
-	grep -E '^\+func (.*) Test' || true
+	validate_diff --diff-filter=ACMR --unified=0 -- 'integration-cli/*_api_*.go' 'integration-cli/*_cli_*.go' \
+		| grep -E '^\+func (.*) Test' || true
 )
 
 if [ -n "$new_tests" ]; then
diff --git a/hack/validate/golangci-lint b/hack/validate/golangci-lint
index 3c168757ff..fd14690ae1 100755
--- a/hack/validate/golangci-lint
+++ b/hack/validate/golangci-lint
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -e -o pipefail
 
-SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # CI platforms differ, so per-platform GOLANGCI_LINT_OPTS can be set
 # from a platform-specific Dockerfile, otherwise let's just set
@@ -11,9 +11,9 @@ SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 [ -n "${TESTDEBUG}" ] && set -x
 
 # TODO find a way to share this code with hack/make.sh
-if ${PKG_CONFIG} 'libsystemd >= 209' 2> /dev/null ; then
+if ${PKG_CONFIG} 'libsystemd >= 209' 2> /dev/null; then
 	DOCKER_BUILDTAGS+=" journald"
-elif ${PKG_CONFIG} 'libsystemd-journal' 2> /dev/null ; then
+elif ${PKG_CONFIG} 'libsystemd-journal' 2> /dev/null; then
 	DOCKER_BUILDTAGS+=" journald journald_compat"
 fi
 
diff --git a/hack/validate/pkg-imports b/hack/validate/pkg-imports
index 485032be38..f82e315f83 100755
--- a/hack/validate/pkg-imports
+++ b/hack/validate/pkg-imports
@@ -1,21 +1,21 @@
 #!/usr/bin/env bash
 set -e
 
-export SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPTDIR}/.validate"
 
 IFS=$'\n'
-files=( $(validate_diff --diff-filter=ACMR --name-only -- 'pkg/*.go' || true) )
+files=($(validate_diff --diff-filter=ACMR --name-only -- 'pkg/*.go' || true))
 unset IFS
 
 badFiles=()
 for f in "${files[@]}"; do
 	IFS=$'\n'
-	badImports=( $(go list -e -f '{{ join .Deps "\n" }}' "$f" | sort -u | grep -vE '^github.com/docker/docker/pkg/' | grep -vE '^github.com/docker/docker/vendor' | grep -E '^github.com/docker/docker' || true) )
+	badImports=($(go list -e -f '{{ join .Deps "\n" }}' "$f" | sort -u | grep -vE '^github.com/docker/docker/pkg/' | grep -vE '^github.com/docker/docker/vendor' | grep -E '^github.com/docker/docker' || true))
 	unset IFS
 
 	for import in "${badImports[@]}"; do
-		badFiles+=( "$f imports $import" )
+		badFiles+=("$f imports $import")
 	done
 done
 
diff --git a/hack/validate/swagger b/hack/validate/swagger
index 160a002a14..5bf9c1cbcc 100755
--- a/hack/validate/swagger
+++ b/hack/validate/swagger
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 set -e
-export SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPTDIR}/.validate"
 
 IFS=$'\n'
-files=( $(validate_diff --diff-filter=ACMR --name-only -- 'api/swagger.yaml' || true) )
+files=($(validate_diff --diff-filter=ACMR --name-only -- 'api/swagger.yaml' || true))
 unset IFS
 
 if [ -n "${TEST_FORCE_VALIDATE:-}" ] || [ ${#files[@]} -gt 0 ]; then
@@ -12,7 +12,7 @@ if [ -n "${TEST_FORCE_VALIDATE:-}" ] || [ ${#files[@]} -gt 0 ]; then
 	if out=$(swagger validate api/swagger.yaml); then
 		echo "Congratulations!  ${out}"
 	else
-		echo  "${out}" >&2
+		echo "${out}" >&2
 		false
 	fi
 fi
diff --git a/hack/validate/swagger-gen b/hack/validate/swagger-gen
index fafa2c296b..0d000ea39b 100755
--- a/hack/validate/swagger-gen
+++ b/hack/validate/swagger-gen
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 
-export SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPTDIR}/.validate"
 
 IFS=$'\n'
-files=( $(validate_diff --diff-filter=ACMR --name-only -- 'api/types/' 'api/swagger.yaml' || true) )
+files=($(validate_diff --diff-filter=ACMR --name-only -- 'api/types/' 'api/swagger.yaml' || true))
 unset IFS
 
 if [ -n "${TEST_FORCE_VALIDATE:-}" ] || [ ${#files[@]} -gt 0 ]; then
diff --git a/hack/validate/toml b/hack/validate/toml
index 2b7f4607b7..3d22619b1a 100755
--- a/hack/validate/toml
+++ b/hack/validate/toml
@@ -1,17 +1,17 @@
 #!/usr/bin/env bash
 
-export SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+export SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPTDIR}/.validate"
 
 IFS=$'\n'
-files=( $(validate_diff --diff-filter=ACMR --name-only -- 'MAINTAINERS' || true) )
+files=($(validate_diff --diff-filter=ACMR --name-only -- 'MAINTAINERS' || true))
 unset IFS
 
 badFiles=()
 for f in "${files[@]}"; do
 	# we use "git show" here to validate that what's committed has valid TOML syntax
-	if ! git show "$VALIDATE_HEAD:$f" | tomlv /proc/self/fd/0 ; then
-		badFiles+=( "$f" )
+	if ! git show "$VALIDATE_HEAD:$f" | tomlv /proc/self/fd/0; then
+		badFiles+=("$f")
 	fi
 done
 
diff --git a/integration-cli/fixtures/auth/docker-credential-shell-test b/integration-cli/fixtures/auth/docker-credential-shell-test
index 97b3f1483e..5acab52179 100755
--- a/integration-cli/fixtures/auth/docker-credential-shell-test
+++ b/integration-cli/fixtures/auth/docker-credential-shell-test
@@ -6,7 +6,7 @@ listFile=shell_test_list.json
 
 case $1 in
 	"store")
-		in=$(</dev/stdin)
+		in=$(< /dev/stdin)
 		server=$(echo "$in" | jq --raw-output ".ServerURL")
 		serverHash=$(echo "$server" | sha1sum - | awk '{print $1}')
 
@@ -17,34 +17,34 @@ case $1 in
 		if [[ ! -f $TEMP/$listFile ]]; then
 			echo "{ \"${server}\": \"${username}\" }" > $TEMP/$listFile
 		else
-			list=$(<$TEMP/$listFile)
+			list=$(< $TEMP/$listFile)
 			echo "$list" | jq ". + {\"${server}\": \"${username}\"}" > $TEMP/$listFile
 		fi
 		;;
 	"get")
-		in=$(</dev/stdin)
+		in=$(< /dev/stdin)
 		serverHash=$(echo "$in" | sha1sum - | awk '{print $1}')
 		if [[ ! -f $TEMP/$serverHash ]]; then
 			echo "credentials not found in native keychain"
 			exit 1
 		fi
-		payload=$(<$TEMP/$serverHash)
+		payload=$(< $TEMP/$serverHash)
 		echo "$payload"
 		;;
 	"erase")
-		in=$(</dev/stdin)
+		in=$(< /dev/stdin)
 		serverHash=$(echo "$in" | sha1sum - | awk '{print $1}')
 		rm -f $TEMP/$serverHash
 
 		# Remove the server from the list
-		list=$(<$TEMP/$listFile)
+		list=$(< $TEMP/$listFile)
 		echo "$list" | jq "del(.[\"${in}\"])" > $TEMP/$listFile
 		;;
 	"list")
 		if [[ ! -f $TEMP/$listFile ]]; then
 			echo "{}"
 		else
-			payload=$(<$TEMP/$listFile)
+			payload=$(< $TEMP/$listFile)
 			echo "$payload"
 		fi
 		;;