diff --git a/backend/build.sh b/backend/build.sh
index e45a694c89..f5fc7d5436 100755
--- a/backend/build.sh
+++ b/backend/build.sh
@@ -11,8 +11,8 @@ SCOPE_SRC=$GOPATH/src/github.com/weaveworks/scope
 # will have awkward ownership.  So we switch to a user with the
 # same user and group IDs as source directory.  We have to set a
 # few things up so that sudo works without complaining later on.
-uid=$(stat --format="%u" $SCOPE_SRC)
-gid=$(stat --format="%g" $SCOPE_SRC)
+uid=$(stat --format="%u" "$SCOPE_SRC")
+gid=$(stat --format="%g" "$SCOPE_SRC")
 echo "weave:x:$uid:$gid::$SCOPE_SRC:/bin/sh" >>/etc/passwd
 echo "weave:*:::::::" >>/etc/shadow
 echo "weave	ALL=(ALL)	NOPASSWD: ALL" >>/etc/sudoers
diff --git a/bin/release b/bin/release
index 8a8a7feb47..36ce33c290 100755
--- a/bin/release
+++ b/bin/release
@@ -8,15 +8,12 @@ DOCKERHUB_USER=${DOCKERHUB_USER:-weaveworks}
 RELEASE_NAME=${RELEASE_NAME:-"Weave Scope"}
 RELEASE_DESCRIPTION=${RELEASE_DESCRIPTION:-"Container Visibility"}
 
-PWD=`pwd`
-WC="wc"
-# Use GNU wc on Darwin
-case $OSTYPE in darwin*) WC="gwc" ;; esac
+PWD=$(pwd)
 
 infer_release_type() {
-    if echo $1 | grep -qE '^v[0-9]+\.[0-9]+\.0+$' ; then
+    if echo "$1" | grep -qE '^v[0-9]+\.[0-9]+\.0+$' ; then
         echo MAINLINE
-    elif echo $1 | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$' ; then
+    elif echo "$1" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$' ; then
         echo BRANCH
     else
         echo PRERELEASE
@@ -26,10 +23,10 @@ infer_release_type() {
 setup() {
     # Ensure we have exactly one annotated tag pointing at HEAD
     HEAD_TAGS=$(git tag --points-at HEAD)
-	TAG_COUNT=$(echo $(echo $HEAD_TAGS | wc -w)) # mac hack
+    TAG_COUNT=$(echo "$HEAD_TAGS" | wc -w) # mac hack
     case $TAG_COUNT in
         1)
-            if [ $HEAD_TAGS != "latest_release" ] ; then
+            if [ "$HEAD_TAGS" != "latest_release" ] ; then
                 LATEST_TAG=$HEAD_TAGS
             else
                 echo "Cannot determine version - latest_release points at HEAD" >&2
@@ -49,11 +46,11 @@ setup() {
             ;;
     esac
 
-    RELEASE_TYPE=$(infer_release_type $LATEST_TAG)
+    RELEASE_TYPE=$(infer_release_type "$LATEST_TAG")
     echo "== Inferred release type $RELEASE_TYPE from tag $LATEST_TAG"
 
-    LATEST_TAG_SHA=$(git rev-parse $LATEST_TAG)
-    LATEST_TAG_COMMIT_SHA=$(git rev-list -1 $LATEST_TAG)
+    LATEST_TAG_SHA=$(git rev-parse "$LATEST_TAG")
+    LATEST_TAG_COMMIT_SHA=$(git rev-list -1 "$LATEST_TAG")
     LATEST_RELEASE_SHA=$(git rev-parse latest_release)
     LATEST_RELEASE_COMMIT_SHA=$(git rev-list -1 latest_release)
     if [ "$RELEASE_TYPE" != 'PRERELEASE' ] ; then
@@ -69,7 +66,7 @@ build() {
     setup
 
     echo "== Clone repo at $LATEST_TAG for version $VERSION"
-    if [ -d $RELEASE_DIR ]; then
+    if [ -d "$RELEASE_DIR" ]; then
         echo -e "\u2757 Release directory $RELEASE_DIR already exists, you may want to" >&2
         echo -e "\trm -rf $RELEASE_DIR" >&2
         exit 1
@@ -77,12 +74,12 @@ build() {
 
     ## Clone the repo at the tag and go there
     mkdir -p releases
-    git clone -q -b $LATEST_TAG . $RELEASE_DIR 2>/dev/null
-    cd $RELEASE_DIR
+    git clone -q -b "$LATEST_TAG" . "$RELEASE_DIR" 2>/dev/null
+    cd "$RELEASE_DIR"
 
     ## Check that the top changelog entry is this version
     if ! latest_changelog=$(perl -nle'print $& if m{(?<=^## Release ).*}' ./CHANGELOG.md | head -1) || \
-       ! [ `echo "$latest_changelog" = "$VERSION"` ]; then
+       ! [ "$latest_changelog" = "$VERSION" ]; then
         echo -e "\u2757 Latest changelog entry \"$latest_changelog\" does not match the release version $VERSION" >&2
         exit 1
     fi
@@ -93,9 +90,9 @@ build() {
     ## Inject the version numbers and build the distributables
     ## (library versions?)
     sed -i.tmp "s/SCRIPT_VERSION=\"[^\"]*\"/SCRIPT_VERSION=\"$VERSION\"/" ./scope
-    make SUDO=$SUDO SCOPE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER
+    make SUDO="$SUDO" SCOPE_VERSION="$VERSION" DOCKERHUB_USER="$DOCKERHUB_USER"
 
-    if make tests SUDO=$SUDO; then
+    if make tests SUDO="$SUDO"; then
         echo -e '\u2713 Tests pass'
     else
         echo -e "\u2757 Tests failed, probably best not publish this one" >&2
@@ -110,18 +107,18 @@ build() {
     #fi
 
     echo -e '\u2713 Build OK'
-    echo '** Release artefacts in' $RELEASE_DIR
+    echo '** Release artefacts in' "$RELEASE_DIR"
 }
 
 draft() {
     setup
 
-    cd $PWD/$RELEASE_DIR
+    cd "$PWD"/"$RELEASE_DIR"
 
     echo "== Sanity checks"
 
     ## Check that the tag exists by looking at github
-    if ! curl -sSf https://api.github.com/repos/$GITHUB_USER/scope/git/tags/$LATEST_TAG_SHA >/dev/null 2>&1; then
+    if ! curl -sSf "https://api.github.com/repos/$GITHUB_USER/scope/git/tags/$LATEST_TAG_SHA" >/dev/null 2>&1; then
         echo -e "\u2757 Tag $LATEST_TAG is not on GitHub, or is not the same as the local tag" >&2
         echo -e "\thttps://github.com/$GITHUB_USER/scope/tags" >&2
         echo "You may need to" >&2
@@ -133,13 +130,13 @@ draft() {
 
     ## Check that the version does not already exist by looking at github
     ## releases
-    if github-release info --user $GITHUB_USER --repo scope --tag $LATEST_TAG >/dev/null 2>&1; then
+    if github-release info --user "$GITHUB_USER" --repo scope --tag "$LATEST_TAG" >/dev/null 2>&1; then
         echo -e "\u2757 Release $LATEST_TAG already exists on GitHub" >&2
         echo -e "\thttps://github.com/$GITHUB_USER/scope/releases/$LATEST_TAG" >&2
         exit 1
     fi
 
-    echo '** Sanity checks OK for publishing tag' $LATEST_TAG as $DOCKERHUB_USER/scope:$VERSION
+    echo '** Sanity checks OK for publishing tag' "$LATEST_TAG" as "$DOCKERHUB_USER/scope:$VERSION"
 
     RELEASE_ARGS="--draft"
     if [ "$RELEASE_TYPE" = 'PRERELEASE' ] ; then
@@ -147,17 +144,17 @@ draft() {
     fi
 
     echo "== Creating GitHub release $RELEASE_ARGS $RELEASE_NAME $VERSION"
-    github-release release $RELEASE_ARGS \
-        --user $GITHUB_USER \
+    github-release release "$RELEASE_ARGS" \
+        --user "$GITHUB_USER" \
         --repo scope \
-        --tag $LATEST_TAG \
+        --tag "$LATEST_TAG" \
         --name "$RELEASE_NAME $VERSION" \
         --description "$RELEASE_DESCRIPTION"
 
     github-release upload \
-        --user $GITHUB_USER \
+        --user "$GITHUB_USER" \
         --repo scope \
-        --tag $LATEST_TAG \
+        --tag "$LATEST_TAG" \
         --name "scope" \
         --file "./scope"
 
@@ -167,25 +164,20 @@ draft() {
 
 publish() {
     setup
-    cd $PWD/$RELEASE_DIR
-
-    UPDATE_LATEST=false
-    if [ "$RELEASE_TYPE" = 'MAINLINE' ] ; then
-        UPDATE_LATEST=true
-    fi
+    cd "$PWD"/"$RELEASE_DIR"
 
     if [ "$RELEASE_TYPE" = 'PRERELEASE' ] ; then
         echo "== Tagging and pushing images on docker hub as user $DOCKERHUB_USER"
-        $SUDO docker tag -f $DOCKERHUB_USER/scope $DOCKERHUB_USER/scope:$VERSION
-        $SUDO docker push   $DOCKERHUB_USER/scope:$VERSION
+        $SUDO docker tag -f "$DOCKERHUB_USER"/scope "$DOCKERHUB_USER/scope:$VERSION"
+        $SUDO docker push   "$DOCKERHUB_USER/scope:$VERSION"
         echo "** Docker images tagged and pushed"
 
         echo "== Publishing pre-release on GitHub"
 
         github-release publish \
-            --user $GITHUB_USER \
+            --user "$GITHUB_USER" \
             --repo scope \
-            --tag $LATEST_TAG
+            --tag "$LATEST_TAG"
 
         echo "** Pre-release $RELEASE_NAME $VERSION published at"
         echo -e "\thttps://github.com/$GITHUB_USER/scope/releases/$LATEST_TAG"
@@ -199,44 +191,44 @@ publish() {
         fi
 
         ## Check that the 'latest_release' tag exists by looking at github
-        if ! curl -sSf https://api.github.com/repos/$GITHUB_USER/scope/git/tags/$LATEST_RELEASE_SHA >/dev/null 2>&1; then
+        if ! curl -sSf "https://api.github.com/repos/$GITHUB_USER/scope/git/tags/$LATEST_RELEASE_SHA" >/dev/null 2>&1; then
             echo -e "\u2757 Tag latest_release is not on GitHub, or is not the same as the local tag" >&2
             echo -e "\thttps://github.com/$GITHUB_USER/scope/tags" >&2
             echo "You may need to" >&2
             echo -e "\tgit push -f git@github.com:$GITHUB_USER/scope latest_release" >&2
             exit 1
         fi
-        echo '** Sanity checks OK for publishing tag' $LATEST_TAG as $DOCKERHUB_USER/scope:$VERSION
+        echo '** Sanity checks OK for publishing tag' "$LATEST_TAG" as "$DOCKERHUB_USER/scope:$VERSION"
 
         echo "== Tagging and pushing images on docker hub as user $DOCKERHUB_USER"
-        $SUDO docker tag -f $DOCKERHUB_USER/scope $DOCKERHUB_USER/scope:$VERSION
-        $SUDO docker push   $DOCKERHUB_USER/scope:$VERSION
+        $SUDO docker tag -f "$DOCKERHUB_USER"/scope "$DOCKERHUB_USER/scope:$VERSION"
+        $SUDO docker push   "$DOCKERHUB_USER"/scope:$"VERSION"
         echo "** Docker images tagged and pushed"
 
         echo "== Publishing release on GitHub"
 
         github-release publish \
-            --user $GITHUB_USER \
+            --user "$GITHUB_USER" \
             --repo scope \
-            --tag $LATEST_TAG
+            --tag "$LATEST_TAG"
 
-        if github-release info --user $GITHUB_USER --repo scope \
+        if github-release info --user "$GITHUB_USER" --repo scope \
             --tag latest_release >/dev/null 2>&1; then
             github-release delete \
-                --user $GITHUB_USER \
+                --user "$GITHUB_USER" \
                 --repo scope \
                 --tag latest_release
         fi
 
         github-release release \
-            --user $GITHUB_USER \
+            --user "$GITHUB_USER" \
             --repo scope \
             --tag latest_release \
             --name "$RELEASE_NAME latest ($VERSION)" \
             --description "[Release Notes](https://github.com/$GITHUB_USER/scope/releases/$LATEST_TAG)"
 
         github-release upload \
-            --user $GITHUB_USER \
+            --user "$GITHUB_USER" \
             --repo scope \
             --tag latest_release \
             --name "scope" \
diff --git a/bin/setup-circleci-secrets b/bin/setup-circleci-secrets
index d592253efa..d39df87646 100755
--- a/bin/setup-circleci-secrets
+++ b/bin/setup-circleci-secrets
@@ -8,7 +8,7 @@ set -eu
 openssl base64 -d << EOF \
   | openssl enc \
     -out bin/do-setup-circleci-secrets \
-		-d -aes256 -pass pass:$1
+		-d -aes256 -pass pass:"$1"
 U2FsdGVkX193YHZJXNzxU9GqigQaXWrA0AKd+BIjRcx7bmmKn/zSgOv+FfApRRjn
 KGBd2ulZw9CwsftX0HWHzVdtpgqbJUW+FEma8eNldau4/f+T+yWTVpCNQXGc3DvB
 cWYhmkoTfGWmI2v/0/Bv2TYkw7MAfjCocdluFAv7sSvYnSgIjoYxD4XXkTjLWy1P
diff --git a/client/test/run-jankie.sh b/client/test/run-jankie.sh
index 005c8444ad..877ca6ccf3 100755
--- a/client/test/run-jankie.sh
+++ b/client/test/run-jankie.sh
@@ -37,4 +37,4 @@ echo "Testing $COMMIT on $DATE"
 # ../../scope launch
 # sleep 5
 
-COMMIT="$COMMIT" DATE=$DATE HOST=$HOST DEBUG=scope* node ./perfjankie/main.js
+COMMIT="$COMMIT" DATE=$DATE HOST=$HOST DEBUG="scope*" node ./perfjankie/main.js
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index 0a0703fed1..3a7d24c919 100755
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -2,7 +2,7 @@
 
 mkdir -p /var/run/weave
 
-for arg in $@; do
+for arg in "$@"; do
     case "$arg" in
         --no-app|--probe-only|--service-token*|--probe.token*)
             touch /etc/service/app/down
@@ -13,9 +13,11 @@ for arg in $@; do
     esac
 done
 
+# shellcheck disable=SC2034
 ARGS=("$@")
 
 typeset -p ARGS >/var/run/weave/scope-app.args
+# shellcheck disable=SC2034
 typeset -p ARGS >/var/run/weave/scope-probe.args
 
 exec /home/weave/runsvinit
diff --git a/docker/run-app b/docker/run-app
index c3a7187b21..4d6c9d1948 100755
--- a/docker/run-app
+++ b/docker/run-app
@@ -1,5 +1,6 @@
 #!/bin/bash
 
+# shellcheck disable=SC1091
 source /var/run/weave/scope-app.args
  
 exec -a scope-app /home/weave/scope --mode app "${ARGS[@]}"
diff --git a/docker/run-probe b/docker/run-probe
index 0959a2e63d..7a1e05b5e5 100755
--- a/docker/run-probe
+++ b/docker/run-probe
@@ -1,5 +1,6 @@
 #!/bin/bash
 
+# shellcheck disable=SC1091
 source /var/run/weave/scope-probe.args
 
 exec -a scope-probe /home/weave/scope --mode probe "${ARGS[@]}"
diff --git a/extras/build_on_circle.sh b/extras/build_on_circle.sh
index d372e51ee3..cdbbcf42c3 100755
--- a/extras/build_on_circle.sh
+++ b/extras/build_on_circle.sh
@@ -2,4 +2,4 @@
 
 set -e
 
-./in_parallel.sh "make RM=" $(find . -maxdepth 2 -name *.go -printf "%h\n" | sort -u | sed -n 's/\.\/\(.*\)/\1\/\1/p')
+./in_parallel.sh "make RM=" "$(find . -maxdepth 2 -name "./*.go" -printf "%h\n" | sort -u | sed -n 's/\.\/\(.*\)/\1\/\1/p')"
diff --git a/extras/dialer/dialer b/extras/dialer/dialer
index a14d9d798a..eeecd86277 100755
--- a/extras/dialer/dialer
+++ b/extras/dialer/dialer
@@ -9,7 +9,7 @@ readonly addr=$1
 readonly max_dialer=${2:-50}
 
 dialer=()
-trap 'echo -n "stopping ... "; for c in "${dialer[@]}"; do docker rm -f "$c" >/dev/null; done; echo "done"' EXIT
+trap 'echo -n "stopping ... "; for _ in "${dialer[@]}"; do docker rm -f "$c" >/dev/null; done; echo "done"' EXIT
 
 while true; do
   rand=$(( ( RANDOM % max_dialer )  + 1 ))
diff --git a/extras/example/run.sh b/extras/example/run.sh
index 0498cf5bfc..633883d3d2 100755
--- a/extras/example/run.sh
+++ b/extras/example/run.sh
@@ -4,11 +4,11 @@ set -ex
 
 readonly ARG="$1"
 
-if ! $(weave status 1>/dev/null 2>&1); then
+if ! weave status 1>/dev/null 2>&1; then
     WEAVE_NO_PLUGIN=y weave launch
 fi
 
-eval $(weave env)
+eval "$(weave env)"
 
 start_container() {
     local IMAGE=$2
@@ -17,12 +17,12 @@ start_container() {
     shift 3
     local HOSTNAME=$BASENAME.weave.local
 
-    for i in $(seq $REPLICAS); do
-        if docker inspect $BASENAME$i >/dev/null 2>&1; then
-            docker rm -f $BASENAME$i
+    for i in $(seq "$REPLICAS"); do
+        if docker inspect "$BASENAME""$i" >/dev/null 2>&1; then
+            docker rm -f "$BASENAME""$i"
         fi
         if [ "$ARG" != "-rm" ]; then
-            docker run -d --name=$BASENAME$i --hostname=$HOSTNAME $@ $IMAGE
+            docker run -d --name="$BASENAME""$i" --hostname="$HOSTNAME" "$@" "$IMAGE"
         fi
     done
 }
@@ -33,6 +33,6 @@ start_container 1 redis redis
 start_container 1 tomwilkie/qotd qotd
 start_container 1 tomwilkie/echo echo
 start_container 2 tomwilkie/app app
-start_container 2 tomwilkie/frontend frontend --add-host=dns.weave.local:$(weave docker-bridge-ip)
+start_container 2 tomwilkie/frontend frontend --add-host=dns.weave.local:"$(weave docker-bridge-ip)"
 start_container 1 tomwilkie/client client
 
diff --git a/extras/example/run_tracer.sh b/extras/example/run_tracer.sh
index 0be04decea..d9da6e9bb2 100755
--- a/extras/example/run_tracer.sh
+++ b/extras/example/run_tracer.sh
@@ -4,11 +4,11 @@ set -ex
 
 readonly ARG="$1"
 
-if ! $(weave status 1>/dev/null 2>&1); then
+if ! weave status 1>/dev/null 2>&1; then
     WEAVE_NO_PLUGIN=y weave launch
 fi
 
-eval $(weave env)
+eval "$(weave env)"
 
 start_container() {
     local replicas=$1
@@ -30,14 +30,14 @@ start_container() {
             ;;
         esac
     done
-    local container_args="$@"
+    local container_args="$*"
 
-    for i in $(seq ${replicas}); do
-        if docker inspect ${basename}${i} >/dev/null 2>&1; then
-            docker rm -f ${basename}${i}
+    for i in $(seq "${replicas}"); do
+        if docker inspect "${basename}""${i}" >/dev/null 2>&1; then
+            docker rm -f "${basename}""${i}"
         fi
-        docker run -d -e CHECKPOINT_DISABLE --name=${basename}${i} --hostname=${hostname} \
-            ${docker_args} ${image} ${container_args}
+        docker run -d -e CHECKPOINT_DISABLE --name="${basename}""${i}" --hostname="${hostname}" \
+            "${docker_args}" "${image}" "${container_args}"
     done
 }
 
diff --git a/extras/in_parallel.sh b/extras/in_parallel.sh
index 9d1a70bc4e..e8c5e1f166 100755
--- a/extras/in_parallel.sh
+++ b/extras/in_parallel.sh
@@ -19,14 +19,14 @@ shift 1
 
 INPUTS="$*"
 SCHED_NAME=parallel-$CIRCLE_PROJECT_USERNAME-$CIRCLE_PROJECT_REPONAME-$CIRCLE_BUILD_NUM
-INPUTS=$(echo $INPUTS | "../tools/sched" sched $SCHED_NAME $CIRCLE_NODE_TOTAL $CIRCLE_NODE_INDEX)
+INPUTS=$(echo "$INPUTS" | "../tools/sched" sched "$SCHED_NAME" "$CIRCLE_NODE_TOTAL" "$CIRCLE_NODE_INDEX")
 
-echo Doing $INPUTS
+echo Doing "$INPUTS"
 
 for INPUT in $INPUTS; do
     START=$(date +%s)
-    $COMMAND $INPUT
-    RUNTIME=$(( $(date +%s) - $START ))
+    "$COMMAND" "$INPUT"
+    RUNTIME=$(( $(date +%s) - START ))
 
-    "../tools/sched" time $INPUT $RUNTIME
+    "../tools/sched" time "$INPUT" "$RUNTIME"
 done
diff --git a/integration/100_launch_test.sh b/integration/100_launch_test.sh
index 3dd7ca853d..b3509e12b3 100755
--- a/integration/100_launch_test.sh
+++ b/integration/100_launch_test.sh
@@ -1,16 +1,17 @@
 #! /bin/bash
 
-. ./config.sh
+# shellcheck disable=SC1091
+ ./config.sh
 
 start_suite "Launch scope and check it boots"
 
-weave_on $HOST1 launch
-scope_on $HOST1 launch
+weave_on "$HOST1" launch
+scope_on "$HOST1" launch
 
-wait_for_containers $HOST1 60 weave weaveproxy weavescope
+wait_for_containers "$HOST1" 60 weave weaveproxy weavescope
 
-has_container $HOST1 weave
-has_container $HOST1 weaveproxy
-has_container $HOST1 weavescope
+has_container "$HOST1" weave
+has_container "$HOST1" weaveproxy
+has_container "$HOST1" weavescope
 
 scope_end_suite
diff --git a/integration/105_launch_sans_weave_test.sh b/integration/105_launch_sans_weave_test.sh
index d3a66a5623..ac27d5aa73 100755
--- a/integration/105_launch_sans_weave_test.sh
+++ b/integration/105_launch_sans_weave_test.sh
@@ -1,15 +1,16 @@
 #! /bin/bash
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 start_suite "Launch scope (without weave installed) and check it boots"
 
-scope_on $HOST1 launch
+scope_on "$HOST1" launch
 
-wait_for_containers $HOST1 60 weavescope
+wait_for_containers "$HOST1" 60 weavescope
 
-has_container $HOST1 weave 0
-has_container $HOST1 weaveproxy 0
-has_container $HOST1 weavescope
+has_container "$HOST1" weave 0
+has_container "$HOST1" weaveproxy 0
+has_container "$HOST1" weavescope
 
 scope_end_suite
diff --git a/integration/106_launch_with_peers_test.sh b/integration/106_launch_with_peers_test.sh
index d4a5e94dad..84b5ced685 100755
--- a/integration/106_launch_with_peers_test.sh
+++ b/integration/106_launch_with_peers_test.sh
@@ -1,13 +1,14 @@
 #! /bin/bash
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 start_suite "Launch scope and check it boots, with a spurious host arg"
 
-scope_on $HOST1 launch noatrealhost.foo
+scope_on "$HOST1" launch noatrealhost.foo
 
-wait_for_containers $HOST1 60 weavescope
+wait_for_containers "$HOST1" 60 weavescope
 
-has_container $HOST1 weavescope
+has_container "$HOST1" weavescope
 
 scope_end_suite
diff --git a/integration/110_shutdown_test.sh b/integration/110_shutdown_test.sh
index 05330fbc69..a69ac994e7 100755
--- a/integration/110_shutdown_test.sh
+++ b/integration/110_shutdown_test.sh
@@ -1,12 +1,13 @@
 #! /bin/bash
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 start_suite "Check scope exits cleanly within 5 seconds"
 
-scope_on $HOST1 launch
+scope_on "$HOST1" launch
 sleep 5
-scope_on $HOST1 stop
+scope_on "$HOST1" stop
 
 sleep 5
 
diff --git a/integration/115_topologies_test.sh b/integration/115_topologies_test.sh
index 6a2753a015..81ed72eeb9 100755
--- a/integration/115_topologies_test.sh
+++ b/integration/115_topologies_test.sh
@@ -1,21 +1,25 @@
 #! /bin/bash
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 start_suite "Test some key topologies are not empty"
 
-scope_on $HOST1 launch
+scope_on "$HOST1" launch
 
-wait_for_containers $HOST1 60 weavescope
+wait_for_containers "$HOST1" 60 weavescope
 
 topology_is_not_empty() {
 	local host="$1"
 	local topology="$2"
 	local timeout="${5:-60}"
 
-	for i in $(seq $timeout); do
-		local report="$(curl -s http://$host:4040/api/report)"
-		local count=$(echo "$report" | jq -r ".$topology.nodes | length > 0" 2>/dev/null)
+	for _ in $(seq "$timeout"); do
+		local report
+		local count
+		report="$(curl -s "http://$host:4040/api/report")"
+		count=$(echo "$report" | jq -r ".$topology.nodes | length > 0" 2>/dev/null)
+
 		if [ "$count" = "true" ]; then
       assert "curl -s http://$host:4040/api/report | jq -r '.$topology.nodes | length > 0'" true
 			return
@@ -27,10 +31,10 @@ topology_is_not_empty() {
   assert "curl -s http://$host:4040/api/report | jq -r '.$topology.nodes | length > 0'" true
 }
 
-topology_is_not_empty $HOST1 Endpoint
-topology_is_not_empty $HOST1 Process
-topology_is_not_empty $HOST1 Container
-topology_is_not_empty $HOST1 ContainerImage
-topology_is_not_empty $HOST1 Host
+topology_is_not_empty "$HOST1" Endpoint
+topology_is_not_empty "$HOST1" Process
+topology_is_not_empty "$HOST1" Container
+topology_is_not_empty "$HOST1" ContainerImage
+topology_is_not_empty "$HOST1" Host
 
 scope_end_suite
diff --git a/integration/200_clustering_2_test.sh b/integration/200_clustering_2_test.sh
index 3982d11aa9..7cba456574 100755
--- a/integration/200_clustering_2_test.sh
+++ b/integration/200_clustering_2_test.sh
@@ -1,29 +1,30 @@
 #! /bin/bash
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 start_suite "Launch 2 scopes and check they cluster automatically"
 
-weave_on $HOST1 launch $HOST1 $HOST2
-weave_on $HOST2 launch $HOST1 $HOST2
+weave_on "$HOST1" launch "$HOST1" "$HOST2"
+weave_on "$HOST2" launch "$HOST1" "$HOST2"
 
-scope_on $HOST1 launch
-scope_on $HOST2 launch
+scope_on "$HOST1" launch
+scope_on "$HOST2" launch
 
-docker_on $HOST1 run -dit --name db1 peterbourgon/tns-db
-docker_on $HOST2 run -dit --name db2 peterbourgon/tns-db
+docker_on "$HOST1" run -dit --name db1 peterbourgon/tns-db
+docker_on "$HOST2" run -dit --name db2 peterbourgon/tns-db
 
 sleep 30 # need to allow the scopes to poll dns, resolve the other app ids, and send them reports
 
 check() {
-	has_container $1 weave 2
-	has_container $1 weaveproxy 2
-	has_container $1 weavescope 2
-	has_container $1 db1
-	has_container $1 db2
+	has_container "$1" weave 2
+	has_container "$1" weaveproxy 2
+	has_container "$1" weavescope 2
+	has_container "$1" db1
+	has_container "$1" db2
 }
 
-check $HOST1
-check $HOST2
+check "$HOST1"
+check "$HOST2"
 
 scope_end_suite
diff --git a/integration/205_clustering_sans_weave_2_test.sh b/integration/205_clustering_sans_weave_2_test.sh
index 21d5921a6c..b2cff6f71f 100755
--- a/integration/205_clustering_sans_weave_2_test.sh
+++ b/integration/205_clustering_sans_weave_2_test.sh
@@ -1,26 +1,27 @@
 #! /bin/bash
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 start_suite "Launch 2 scopes and check they cluster (without weave)"
 
-scope_on $HOST1 launch $HOST2
-scope_on $HOST2 launch $HOST1
+scope_on "$HOST1" launch "$HOST2"
+scope_on "$HOST2" launch "$HOST1"
 
-docker_on $HOST1 run -dit --name db1 peterbourgon/tns-db
-docker_on $HOST2 run -dit --name db2 peterbourgon/tns-db
+docker_on "$HOST1" run -dit --name db1 peterbourgon/tns-db
+docker_on "$HOST2" run -dit --name db2 peterbourgon/tns-db
 
 sleep 30 # need to allow the scopes to poll dns, resolve the other app ids, and send them reports.
 
 check() {
-	has_container $1 weave 0
-	has_container $1 weaveproxy 0
-	has_container $1 weavescope 2
-	has_container $1 db1
-	has_container $1 db2
+	has_container "$1" weave 0
+	has_container "$1" weaveproxy 0
+	has_container "$1" weavescope 2
+	has_container "$1" db1
+	has_container "$1" db2
 }
 
-check $HOST1
-check $HOST2
+check "$HOST1"
+check "$HOST2"
 
 scope_end_suite
diff --git a/integration/210_clustering_custom_hostname_2_test.sh b/integration/210_clustering_custom_hostname_2_test.sh
index 765094d905..43897b4f85 100755
--- a/integration/210_clustering_custom_hostname_2_test.sh
+++ b/integration/210_clustering_custom_hostname_2_test.sh
@@ -1,29 +1,30 @@
 #! /bin/bash
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 start_suite "Launch 2 scopes and check they cluster automatically, with custom weave domain"
 
-weave_on $HOST1 launch --dns-domain foo.local $HOST1 $HOST2
-weave_on $HOST2 launch --dns-domain foo.local $HOST1 $HOST2
+weave_on "$HOST1" launch --dns-domain foo.local "$HOST1" "$HOST2"
+weave_on "$HOST2" launch --dns-domain foo.local "$HOST1" "$HOST2"
 
-scope_on $HOST1 launch --weave.hostname=bar.foo.local
-scope_on $HOST2 launch --weave.hostname bar.foo.local
+scope_on "$HOST1" launch --weave.hostname=bar.foo.local
+scope_on "$HOST2" launch --weave.hostname bar.foo.local
 
-docker_on $HOST1 run -dit --name db1 peterbourgon/tns-db
-docker_on $HOST2 run -dit --name db2 peterbourgon/tns-db
+docker_on "$HOST1" run -dit --name db1 peterbourgon/tns-db
+docker_on "$HOST2" run -dit --name db2 peterbourgon/tns-db
 
 sleep 30 # need to allow the scopes to poll dns, resolve the other app ids, and send them reports
 
 check() {
-	has_container $1 weave 2
-	has_container $1 weaveproxy 2
-	has_container $1 weavescope 2
-	has_container $1 db1
-	has_container $1 db2
+	has_container "$1" weave 2
+	has_container "$1" weaveproxy 2
+	has_container "$1" weavescope 2
+	has_container "$1" db1
+	has_container "$1" db2
 }
 
-check $HOST1
-check $HOST2
+check "$HOST1"
+check "$HOST2"
 
 scope_end_suite
diff --git a/integration/215_clustering_split_2_test.sh b/integration/215_clustering_split_2_test.sh
index 7a399976d4..7acf794123 100755
--- a/integration/215_clustering_split_2_test.sh
+++ b/integration/215_clustering_split_2_test.sh
@@ -1,17 +1,18 @@
 #! /bin/bash
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 start_suite "Launch 2 scopes and check they cluster (without weave)"
 
-scope_on $HOST1 launch --no-app $HOST2
-scope_on $HOST2 launch --no-probe
+scope_on "$HOST1" launch --no-app "$HOST2"
+scope_on "$HOST2" launch --no-probe
 
-docker_on $HOST1 run -dit --name db1 peterbourgon/tns-db
+docker_on "$HOST1" run -dit --name db1 peterbourgon/tns-db
 
 sleep 30 # need to allow the scopes to poll dns, resolve the other app ids, and send them reports.
 
-has_container $HOST2 weavescope
-has_container $HOST2 db1
+has_container "$HOST2" weavescope
+has_container "$HOST2" db1
 
 scope_end_suite
diff --git a/integration/300_internet_edge_test.sh b/integration/300_internet_edge_test.sh
index 614123fcdd..6c844d75b0 100755
--- a/integration/300_internet_edge_test.sh
+++ b/integration/300_internet_edge_test.sh
@@ -1,5 +1,6 @@
 #! /bin/bash
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 start_suite "Test short lived connections from the Internet"
@@ -10,21 +11,21 @@ if ! echo "$HOST1" | grep "us-central1-a"; then
 	exit
 fi
 
-weave_on $HOST1 launch
-scope_on $HOST1 launch
-docker_on $HOST1 run -d -p 80:80 --name nginx nginx
+weave_on "$HOST1" launch
+scope_on "$HOST1" launch
+docker_on "$HOST1" run -d -p 80:80 --name nginx nginx
 
 do_connections() {
 	while true; do
-		curl -s http://$HOST1:80/ >/dev/null || true
+		curl -s "http://$HOST1:80/" >/dev/null || true
 		sleep 1
 	done
 }
 do_connections&
 
-wait_for_containers $HOST1 60 nginx "The Internet"
+wait_for_containers "$HOST1" 60 nginx "The Internet"
 
-has_connection_by_id containers $HOST1 "in-theinternet" $(node_id containers $HOST1 nginx)
+has_connection_by_id containers "$HOST1" "in-theinternet" "$(node_id containers "$HOST1" nginx)"
 
 kill %do_connections
 
diff --git a/integration/310_container_to_container_edge_test.sh b/integration/310_container_to_container_edge_test.sh
index 3922c7309c..bb67b9fd00 100755
--- a/integration/310_container_to_container_edge_test.sh
+++ b/integration/310_container_to_container_edge_test.sh
@@ -1,21 +1,22 @@
 #! /bin/bash
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 start_suite "Test short lived connections between containers"
 
-weave_on $HOST1 launch
-scope_on $HOST1 launch
-weave_on $HOST1 run -d --name nginx nginx
-weave_on $HOST1 run -d --name client alpine /bin/sh -c "while true; do \
+weave_on "$HOST1" launch
+scope_on "$HOST1" launch
+weave_on "$HOST1" run -d --name nginx nginx
+weave_on "$HOST1" run -d --name client alpine /bin/sh -c "while true; do \
 	wget http://nginx.weave.local:80/ -O - >/dev/null || true; \
 	sleep 1; \
 done"
 
-wait_for_containers $HOST1 60 nginx client
+wait_for_containers "$HOST1" 60 nginx client
 
-has_container $HOST1 nginx
-has_container $HOST1 client
-has_connection containers $HOST1 client nginx
+has_container "$HOST1" nginx
+has_container "$HOST1" client
+has_connection containers "$HOST1" client nginx
 
 scope_end_suite
diff --git a/integration/320_container_edge_cross_host_2_test.sh b/integration/320_container_edge_cross_host_2_test.sh
index 26d6a3c02d..d2a879649c 100755
--- a/integration/320_container_edge_cross_host_2_test.sh
+++ b/integration/320_container_edge_cross_host_2_test.sh
@@ -1,17 +1,18 @@
 #! /bin/bash
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 start_suite "Test short lived connections between containers on different hosts"
 
-weave_on $HOST1 launch $HOST1 $HOST2
-weave_on $HOST2 launch $HOST1 $HOST2
+weave_on "$HOST1" launch "$HOST1" "$HOST2"
+weave_on "$HOST2" launch "$HOST1" "$HOST2"
 
-scope_on $HOST1 launch
-scope_on $HOST2 launch
+scope_on "$HOST1" launch
+scope_on "$HOST2" launch
 
-weave_on $HOST1 run -d --name nginx nginx
-weave_on $HOST2 run -d --name client alpine /bin/sh -c "while true; do \
+weave_on "$HOST1" run -d --name nginx nginx
+weave_on "$HOST2" run -d --name client alpine /bin/sh -c "while true; do \
 	wget http://nginx.weave.local:80/ -O - >/dev/null || true; \
 	sleep 1; \
 done"
@@ -19,12 +20,12 @@ done"
 sleep 30 # need to allow the scopes to poll dns, resolve the other app ids, and send them reports
 
 check() {
-	has_container $1 nginx
-	has_container $1 client
-	has_connection containers $1 client nginx
+	has_container "$1" nginx
+	has_container "$1" client
+	has_connection containers "$1" client nginx
 }
 
-check $HOST1
-check $HOST2
+check "$HOST1"
+check "$HOST2"
 
 scope_end_suite
diff --git a/integration/330_process_edge_test.sh b/integration/330_process_edge_test.sh
index 6927a19644..e986d13cef 100755
--- a/integration/330_process_edge_test.sh
+++ b/integration/330_process_edge_test.sh
@@ -1,21 +1,22 @@
 #! /bin/bash
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 start_suite "Test long connections (procspy) between processes"
 
-weave_on $HOST1 launch
-scope_on $HOST1 launch --probe.conntrack=false
-weave_on $HOST1 run -d --name nginx nginx
-weave_on $HOST1 run -dti --name client alpine /bin/sh -c "while true; do \
+weave_on "$HOST1" launch
+scope_on "$HOST1" launch --probe.conntrack=false
+weave_on "$HOST1" run -d --name nginx nginx
+weave_on "$HOST1" run -dti --name client alpine /bin/sh -c "while true; do \
 	nc nginx.weave.local 80 || true; \
 	sleep 1; \
 done"
 
-wait_for processes $HOST1 60 "nginx: worker process" nc
+wait_for processes "$HOST1" 60 "nginx: worker process" nc
 
-has processes $HOST1 "nginx: worker process"
-has processes $HOST1 nc
-has_connection processes $HOST1 nc "nginx: worker process"
+has processes "$HOST1" "nginx: worker process"
+has processes "$HOST1" nc
+has_connection processes "$HOST1" nc "nginx: worker process"
 
 scope_end_suite
diff --git a/integration/340_process_edge_across_host_2_test.sh b/integration/340_process_edge_across_host_2_test.sh
index 60d3622362..9947e7fbf2 100755
--- a/integration/340_process_edge_across_host_2_test.sh
+++ b/integration/340_process_edge_across_host_2_test.sh
@@ -1,17 +1,18 @@
 #! /bin/bash
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 start_suite "Test long connections (procspy) between processes on different hosts"
 
-weave_on $HOST1 launch $HOST1 $HOST2
-weave_on $HOST2 launch $HOST1 $HOST2
+weave_on "$HOST1" launch "$HOST1" "$HOST2"
+weave_on "$HOST2" launch "$HOST1" "$HOST2"
 
-scope_on $HOST1 launch --probe.conntrack=false
-scope_on $HOST2 launch --probe.conntrack=false
+scope_on "$HOST1" launch --probe.conntrack=false
+scope_on "$HOST2" launch --probe.conntrack=false
 
-weave_on $HOST1 run -d --name nginx nginx
-weave_on $HOST2 run -dti --name client alpine /bin/sh -c "while true; do \
+weave_on "$HOST1" run -d --name nginx nginx
+weave_on "$HOST2" run -dti --name client alpine /bin/sh -c "while true; do \
 	nc nginx.weave.local 80 || true; \
 	sleep 1; \
 done"
@@ -19,12 +20,12 @@ done"
 sleep 30 # need to allow the scopes to poll dns, resolve the other app ids, and send them reports
 
 check() {
-    has processes $1 "nginx: worker process"
-    has processes $1 nc
-    has_connection processes $1 nc "nginx: worker process"
+    has processes "$1" "nginx: worker process"
+    has processes "$1" nc
+    has_connection processes "$1" nc "nginx: worker process"
 }
 
-check $HOST1
-check $HOST2
+check "$HOST1"
+check "$HOST2"
 
 scope_end_suite
diff --git a/integration/410_container_control_test.sh b/integration/410_container_control_test.sh
index 5b898af526..7aa354fb42 100755
--- a/integration/410_container_control_test.sh
+++ b/integration/410_container_control_test.sh
@@ -1,18 +1,19 @@
 #! /bin/bash
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 start_suite "Test container controls"
 
-weave_on $HOST1 launch
-scope_on $HOST1 launch
+weave_on "$HOST1" launch
+scope_on "$HOST1" launch
 
-CID=$(weave_on $HOST1 run -dti --name alpine alpine /bin/sh)
+CID=$(weave_on "$HOST1" run -dti --name alpine alpine /bin/sh)
 
-wait_for_containers $HOST1 60 alpine
+wait_for_containers "$HOST1" 60 alpine
 
 assert "docker_on $HOST1 inspect --format='{{.State.Running}}' alpine" "true"
-PROBEID=$(docker_on $HOST1 logs weavescope 2>&1 | grep "probe starting" | sed -n 's/^.*ID \([0-9a-f]*\)$/\1/p')
+PROBEID=$(docker_on "$HOST1" logs weavescope 2>&1 | grep "probe starting" | sed -n 's/^.*ID \([0-9a-f]*\)$/\1/p')
 
 # Execute 'echo foo' in a container tty and check its output
 PIPEID=$(curl -s -f -X POST  "http://$HOST1:4040/api/control/$PROBEID/$CID;<container>/docker_exec_container" | jq -r '.pipe' )
diff --git a/integration/420_host_control_test.sh b/integration/420_host_control_test.sh
index 54d23314f0..6e146b0d58 100755
--- a/integration/420_host_control_test.sh
+++ b/integration/420_host_control_test.sh
@@ -1,16 +1,17 @@
 #! /bin/bash
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 start_suite "Test host controls"
 
-weave_on $HOST1 launch
-scope_on $HOST1 launch
+weave_on "$HOST1" launch
+scope_on "$HOST1" launch
 
 sleep 10
 
-PROBEID=$(docker_on $HOST1 logs weavescope 2>&1 | grep "probe starting" | sed -n 's/^.*ID \([0-9a-f]*\)$/\1/p')
-HOSTID=$($SSH $HOST1 hostname)
+PROBEID=$(docker_on "$HOST1" logs weavescope 2>&1 | grep "probe starting" | sed -n 's/^.*ID \([0-9a-f]*\)$/\1/p')
+HOSTID=$($SSH "$HOST1" hostname)
 
 # Execute 'echo foo' in the host tty and check its output
 PIPEID=$(curl -s -f -X POST  "http://$HOST1:4040/api/control/$PROBEID/$HOSTID;<host>/host_exec" | jq -r '.pipe' )
diff --git a/integration/config.sh b/integration/config.sh
index 9d70867ee7..0a51acf5e2 100644
--- a/integration/config.sh
+++ b/integration/config.sh
@@ -1,3 +1,4 @@
+#!/bin/sh
 # NB only to be sourced
 
 set -e
@@ -7,6 +8,7 @@ set -e
 export SSH_DIR="$PWD"
 export HOSTS
 
+# shellcheck disable=SC1091
 . "../tools/integration/config.sh"
 
 WEAVE="./weave"
@@ -15,21 +17,21 @@ SCOPE="../scope"
 scope_on() {
 	local host=$1
 	shift 1
-	[ -z "$DEBUG" ] || greyly echo "Scope on $host: $@" >&2
-	DOCKER_HOST=tcp://$host:$DOCKER_PORT CHECKPOINT_DISABLE=true $SCOPE "$@"
+	[ -z "$DEBUG" ] || greyly echo "Scope on $host: $*" >&2
+	DOCKER_HOST=tcp://$host:$DOCKER_PORT CHECKPOINT_DISABLE=true "$SCOPE" "$@"
 }
 
 weave_on() {
 	local host=$1
 	shift 1
-	[ -z "$DEBUG" ] || greyly echo "Weave on $host: $@" >&2
-	DOCKER_HOST=tcp://$host:$DOCKER_PORT CHECKPOINT_DISABLE=true $WEAVE "$@"
+	[ -z "$DEBUG" ] || greyly echo "Weave on $host: $*" >&2
+	DOCKER_HOST=tcp://$host:$DOCKER_PORT CHECKPOINT_DISABLE=true "$WEAVE" "$@"
 }
 
 scope_end_suite() {
 	end_suite
 	for host in $HOSTS; do
-		docker_on $host rm -f $(docker_on $host ps -a -q) 2>/dev/null 1>&2 || true
+		docker_on "$host" rm -f "$(docker_on "$host" ps -a -q)" 2>/dev/null 1>&2 || true
 	done
 }
 
@@ -39,7 +41,7 @@ has() {
 	local host=$2
 	local name=$3
 	local count=${4:-1}
-	assert "curl -s http://${host}:4040/api/topology/${view}?system=show | jq -r '[.nodes[] | select(.label == \"${name}\")] | length'" $count
+	assert "curl -s http://${host}:4040/api/topology/${view}?system=show | jq -r '[.nodes[] | select(.label == \"${name}\")] | length'" "$count"
 }
 
 # this checks we have a named container
@@ -51,7 +53,7 @@ node_id() {
     local view="$1"
 	local host="$2"
 	local name="$3"
-	echo $(curl -s http://${host}:4040/api/topology/${view}?system=show | jq -r ".nodes[] | select(.label == \"${name}\") | .id")
+	curl -s "http://${host}:4040/api/topology/${view}?system=show" | jq -r ".nodes[] | select(.label == \"${name}\") | .id"
 }
 
 container_id() {
@@ -66,9 +68,11 @@ has_connection_by_id() {
 	local to_id="$4"
 	local timeout="${5:-60}"
 
-	for i in $(seq $timeout); do
-		local nodes="$(curl -s http://$host:4040/api/topology/${view}?system=show)"
-		local edge=$(echo "$nodes" |  jq -r ".nodes[\"$from_id\"].adjacency | contains([\"$to_id\"])" 2>/dev/null)
+	for i in $(seq "$timeout"); do
+		local nodes
+		local edge
+		edge==$(echo "$nodes" |  jq -r ".nodes[\"$from_id\"].adjacency | contains([\"$to_id\"])" 2>/dev/null)
+		nodes="$(curl -s "http://$host:4040/api/topology/${view}?system=show")"
 		if [ "$edge" = "true" ]; then
 			echo "Found edge $from -> $to after $i secs"
 			assert "curl -s http://$host:4040/api/topology/${view}?system=show |  jq -r '.nodes[\"$from_id\"].adjacency | contains([\"$to_id\"])'" true
@@ -87,10 +91,13 @@ has_connection() {
 	local from="$3"
 	local to="$4"
 	local timeout="${5:-60}"
-    local from_id="$(node_id "${view}" "${host}" "${from}")"
-    local to_id="$(node_id "${view}" "${host}" "${to}")"
+	local from_id
+	local to_id
 
-    has_connection_by_id "${view}" "${host}" "${from_id}" "${to_id}" "${timeout}"
+	from_id="$(node_id "${view}" "${host}" "${from}")"
+	to_id="$(node_id "${view}" "${host}" "${to}")"
+
+	has_connection_by_id "${view}" "${host}" "${from_id}" "${to_id}" "${timeout}"
 }
 
 wait_for() {
@@ -99,9 +106,10 @@ wait_for() {
 	local timeout="$3"
 	shift 3
 
-	for i in $(seq ${timeout}); do
-		local nodes="$(curl -s http://$host:4040/api/topology/${view}?system=show)"
+	for i in $(seq "${timeout}"); do
+		local nodes
 		local found=0
+		nodes="$(curl -s "http://$host:4040/api/topology/${view}?system=show")"
 		for name in "$@"; do
 			local count=$(echo "${nodes}" | jq -r "[.nodes[] | select(.label == \"${name}\")] | length")
 			if [ -n "${count}" ] && [ "${count}" -ge 1 ]; then
@@ -117,7 +125,7 @@ wait_for() {
 		sleep 1
 	done
 
-	echo "Failed to find nodes $@ after $i secs"
+	echo "Failed to find nodes $* after $i secs"
 }
 
 
diff --git a/integration/gce.sh b/integration/gce.sh
index 24f05b12e8..7e491e9d13 100755
--- a/integration/gce.sh
+++ b/integration/gce.sh
@@ -2,9 +2,11 @@
 
 set -e
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 export PROJECT=scope-integration-tests
 export TEMPLATE_NAME="test-template-5"
 export NUM_HOSTS=5
+# shellcheck disable=SC1091
 . "../tools/integration/gce.sh" "$@"
diff --git a/integration/run_all.sh b/integration/run_all.sh
index 3c8de0d10a..32f35442c6 100755
--- a/integration/run_all.sh
+++ b/integration/run_all.sh
@@ -2,6 +2,7 @@
 
 set -e
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 ../tools/integration/run_all.sh "$@"
diff --git a/integration/setup.sh b/integration/setup.sh
index 00616768d6..2da3e605bb 100755
--- a/integration/setup.sh
+++ b/integration/setup.sh
@@ -2,33 +2,35 @@
 
 set -e # NB don't set -u, as weave's config.sh doesn't like that.
 
+# shellcheck disable=SC1091
 . ./config.sh
 
 echo Copying scope images and scripts to hosts
+# shellcheck disable=SC2153
 for HOST in $HOSTS; do
     SIZE=$(stat --printf="%s" ../scope.tar)
-    cat ../scope.tar | pv -N "scope.tar" -s $SIZE | $SSH -C $HOST sudo docker load
+    pv -N "scope.tar" -s "$SIZE" ../scope.tar | $SSH -C "$HOST" sudo docker load
 done
 
 setup_host() {
     local HOST=$1
-    echo Installing weave on $HOST
+    echo Installing weave on "$HOST"
     # Download the latest released weave script locally,
     # for use by weave_on
     curl -sL git.io/weave -o ./weave
     chmod a+x ./weave
-    run_on $HOST "sudo curl -sL git.io/weave -o /usr/local/bin/weave"
-    run_on $HOST "sudo chmod a+x /usr/local/bin/weave"
-    weave_on $HOST setup
+    run_on "$HOST" "sudo curl -sL git.io/weave -o /usr/local/bin/weave"
+    run_on "$HOST" "sudo chmod a+x /usr/local/bin/weave"
+    weave_on "$HOST" setup
 
-    echo Prefetching Images on $HOST
-    docker_on $HOST pull peterbourgon/tns-db
-    docker_on $HOST pull alpine
-    docker_on $HOST pull nginx
+    echo Prefetching Images on "$HOST"
+    docker_on "$HOST" pull peterbourgon/tns-db
+    docker_on "$HOST" pull alpine
+    docker_on "$HOST" pull nginx
 }
 
 for HOST in $HOSTS; do
-    setup_host $HOST &
+    setup_host "$HOST" &
 done
 
 wait
diff --git a/scope b/scope
index ccfa7c0307..5cb55787ec 100755
--- a/scope
+++ b/scope
@@ -39,7 +39,7 @@ usage() {
 		Launch options:
 	EOF
     docker run --rm -e CHECKPOINT_DISABLE --entrypoint=/home/weave/scope \
-        $WEAVESCOPE_DOCKER_ARGS "$SCOPE_IMAGE" -h >&2
+        "$WEAVESCOPE_DOCKER_ARGS" "$SCOPE_IMAGE" -h >&2
 }
 
 usage_and_die() {
@@ -72,7 +72,7 @@ check_docker_access() {
 }
 
 # - The image embeds the weave script & Docker 1.3.1 client
-# - Docker versions prior to 1.5.0 do not support --pid=host
+# - Docker versions prior to 1.5.0 do not support --pid=host
 # - Weave needs 1.6.0 now (image pulling changes)
 MIN_DOCKER_VERSION=1.6.0
 
@@ -160,14 +160,14 @@ launch_command() {
             -v /var/run/docker.sock:/var/run/docker.sock \
             -v /var/run/scope/plugins:/var/run/scope/plugins \
             -e CHECKPOINT_DISABLE \
-            $WEAVESCOPE_DOCKER_ARGS "$SCOPE_IMAGE" --probe.docker=true
+            "$WEAVESCOPE_DOCKER_ARGS" "$SCOPE_IMAGE" --probe.docker=true
 }
 
 launch_docker4mac_app_command() {
     echo docker run -d --name="$SCOPE_APP_CONTAINER_NAME" \
             -e CHECKPOINT_DISABLE \
             -p 0.0.0.0:4040:4040 \
-            $WEAVESCOPE_DOCKER_ARGS "$SCOPE_IMAGE" --no-probe
+            "$WEAVESCOPE_DOCKER_ARGS" "$SCOPE_IMAGE" --no-probe
 }
 
 launch() {
@@ -192,6 +192,7 @@ case "$COMMAND" in
         # Most systems should have printf, but the %q specifier isn't mandated by posix
         # and can't be guaranteed. Since this is mainly a cosmetic output and the alternative
         # is not making any attempt to do escaping at all, we might as well try.
+        # shellcheck disable=SC2039
         quoted=$(printf '%q ' "$@" 2>/dev/null || true)
         # printf %q behaves oddly with zero args (it acts as though it recieved one empty arg)
         # so we ignore that case.
@@ -203,7 +204,7 @@ case "$COMMAND" in
 
     version)
         docker run --rm -e CHECKPOINT_DISABLE --entrypoint=/home/weave/scope \
-            $WEAVESCOPE_DOCKER_ARGS "$SCOPE_IMAGE" --mode=version
+            "$WEAVESCOPE_DOCKER_ARGS" "$SCOPE_IMAGE" --mode=version
         ;;
 
     -h|help|-help|--help)
@@ -214,7 +215,7 @@ case "$COMMAND" in
         # Do a dry run of scope in the foreground, so it can parse args etc
         # avoiding the entrypoint script in the process.
         docker run --rm -e CHECKPOINT_DISABLE --entrypoint=/home/weave/scope \
-            $WEAVESCOPE_DOCKER_ARGS "$SCOPE_IMAGE" --dry-run "$@"
+            "$WEAVESCOPE_DOCKER_ARGS" "$SCOPE_IMAGE" --dry-run "$@"
 
         if check_docker_for_mac ; then
             create_plugins_dir
@@ -234,6 +235,7 @@ case "$COMMAND" in
             echo "Scope probe started"
             app_ip=$(docker inspect -f '{{.NetworkSettings.IPAddress}}' "${CONTAINER}")
             docker rm -f "$SCOPE_CONTAINER_NAME" >/dev/null 2>&1 || true
+            # shellcheck disable=SC2091
             CONTAINER=$($(launch_command --no-app "$@" "${app_ip}:4040"))
             print_app_endpoints "localhost"
             exit
@@ -242,7 +244,7 @@ case "$COMMAND" in
         launch "$@"
         if ! check_probe_only ; then
             IP_ADDRS=$(docker run --rm --net=host --entrypoint /bin/sh "$SCOPE_IMAGE" -c "$IP_ADDR_CMD")
-            print_app_endpoints $IP_ADDRS
+            print_app_endpoints "$IP_ADDRS"
         fi
 
         ;;
diff --git a/tools/lint b/tools/lint
index 566e329b66..b48a5c0b42 100755
--- a/tools/lint
+++ b/tools/lint
@@ -67,8 +67,9 @@ spell_check() {
 
 test_mismatch() {
     local filename="$1"
-    local package=$(grep '^package ' "$filename" | awk '{print $2}')
     local lint_result=0
+    local package
+    package=$(grep '^package ' "$filename" | awk '{print $2}')
 
     if [[ $package == "main" ]]; then
         return # in package main, all bets are off