diff --git a/dokku b/dokku
index d056c65580f..e91bd687fd0 100755
--- a/dokku
+++ b/dokku
@@ -36,8 +36,8 @@ source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_CORE_AVAILABLE_PATH/checks/functions"
 source "$PLUGIN_CORE_AVAILABLE_PATH/proxy/functions"
 
-[[ -f $DOKKU_ROOT/dokkurc ]] && source $DOKKU_ROOT/dokkurc
-[[ -d $DOKKU_ROOT/.dokkurc ]] && for f in $DOKKU_ROOT/.dokkurc/*; do source $f; done
+[[ -f $DOKKU_ROOT/dokkurc ]] && source "$DOKKU_ROOT/dokkurc"
+[[ -d $DOKKU_ROOT/.dokkurc ]] && for f in $DOKKU_ROOT/.dokkurc/*; do source "$f"; done
 
 [[ $DOKKU_TRACE ]] && set -x
 
@@ -56,7 +56,7 @@ fi
 
 if [[ $(id -un) != "dokku" ]] && [[ ! $1 =~ plugin:* ]]; then
   export SSH_USER=$(id -un)
-  sudo -u dokku -E -H $0 "$@"
+  sudo -u dokku -E -H "$0" "$@"
   exit $?
 fi
 
@@ -67,10 +67,12 @@ fi
 if [[ -n "$SSH_ORIGINAL_COMMAND" ]]; then
   export -n SSH_ORIGINAL_COMMAND
   if [[ $1 =~ config-* ]] || [[ $1 =~ docker-options* ]]; then
+    # shellcheck disable=SC2086
     xargs $0 <<<$SSH_ORIGINAL_COMMAND
     exit $?
   else
     set -f
+    # shellcheck disable=SC2086
     $0 $SSH_ORIGINAL_COMMAND
     set +f
     exit $?
@@ -84,7 +86,7 @@ fi
 
 case "$1" in
   receive)
-    APP="$2"; IMAGE=$(get_app_image_name $APP); IMAGE_SOURCE_TYPE="$3"; TMP_WORK_DIR="$4"
+    APP="$2"; IMAGE=$(get_app_image_name "$APP"); IMAGE_SOURCE_TYPE="$3"; TMP_WORK_DIR="$4"
     if [[ -z "$DOKKU_SKIP_CLEANUP" ]]; then
       dokku_log_info1 "Cleaning up..."
       docker_cleanup
@@ -98,16 +100,16 @@ case "$1" in
 
   deploy)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to deploy"
-    APP="$2"; IMAGE_TAG="$3"; IMAGE=$(get_app_image_name $APP $IMAGE_TAG)
+    APP="$2"; IMAGE_TAG="$3"; IMAGE=$(get_app_image_name "$APP" "$IMAGE_TAG")
     verify_app_name "$APP"
-    plugn trigger pre-deploy $APP $IMAGE_TAG
+    plugn trigger pre-deploy "$APP" "$IMAGE_TAG"
 
     is_image_herokuish_based "$IMAGE" && DOKKU_HEROKUISH=true
     DOKKU_SCALE_FILE="$DOKKU_ROOT/$APP/DOKKU_SCALE"
-    oldids=$(get_app_container_ids $APP)
+    oldids=$(get_app_container_ids "$APP")
 
-    DOKKU_DEFAULT_DOCKER_ARGS=$(: | plugn trigger docker-args-deploy $APP $IMAGE_TAG)
-    DOKKU_IS_APP_PROXY_ENABLED="$(is_app_proxy_enabled $APP)"
+    DOKKU_DEFAULT_DOCKER_ARGS=$(: | plugn trigger docker-args-deploy "$APP" "$IMAGE_TAG")
+    DOKKU_IS_APP_PROXY_ENABLED="$(is_app_proxy_enabled "$APP")"
 
     while read -r line || [[ -n "$line" ]]; do
       [[ "$line" =~ ^#.* ]] && continue
@@ -130,10 +132,10 @@ case "$1" in
         [[ -n "$DOKKU_HEROKUISH" ]] && START_CMD="/start $PROC_TYPE"
 
         if [[ -z "$DOKKU_HEROKUISH" ]]; then
-          DOKKU_DOCKERFILE_PORTS=($(dokku config:get $APP DOKKU_DOCKERFILE_PORTS || true))
-          DOKKU_DOCKERFILE_PORT=$(dokku config:get $APP DOKKU_DOCKERFILE_PORT || true)
-          DOKKU_DOCKERFILE_START_CMD=$(dokku config:get $APP DOKKU_DOCKERFILE_START_CMD || true)
-          DOKKU_PROCFILE_START_CMD=$(get_cmd_from_procfile $APP $PROC_TYPE)
+          DOKKU_DOCKERFILE_PORTS=($(dokku config:get "$APP" DOKKU_DOCKERFILE_PORTS || true))
+          DOKKU_DOCKERFILE_PORT=$(dokku config:get "$APP" DOKKU_DOCKERFILE_PORT || true)
+          DOKKU_DOCKERFILE_START_CMD=$(dokku config:get "$APP" DOKKU_DOCKERFILE_START_CMD || true)
+          DOKKU_PROCFILE_START_CMD=$(get_cmd_from_procfile "$APP" "$PROC_TYPE")
           START_CMD=${DOKKU_DOCKERFILE_START_CMD:-$DOKKU_PROCFILE_START_CMD}
         fi
 
@@ -152,45 +154,48 @@ case "$1" in
             done
           fi
           if [[ "$DOKKU_IS_APP_PROXY_ENABLED" = "true" ]]; then
+            # shellcheck disable=SC2086
             id=$(docker run $DOKKU_GLOBAL_RUN_ARGS -d -e PORT=$port $DOCKER_ARGS $IMAGE $START_CMD)
-            ipaddr=$(docker inspect --format='{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' $id)
+            ipaddr=$(docker inspect --format='{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$id")
             # Docker < 1.9 compatibility
             if [[ -z $ipaddr ]]; then
-              ipaddr=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}' $id)
+              ipaddr=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}' "$id")
             fi
           else
+            # shellcheck disable=SC2086
             id=$(docker run $DOKKU_GLOBAL_RUN_ARGS -d $DOKKU_DOCKER_PORT_ARGS -e PORT=$port $DOCKER_ARGS $IMAGE $START_CMD)
-            port=$(docker port $id $port | sed 's/[0-9.]*://')
+            port=$(docker port "$id" "$port" | sed 's/[0-9.]*://')
             ipaddr=127.0.0.1
           fi
         else
+          # shellcheck disable=SC2086
           id=$(docker run $DOKKU_GLOBAL_RUN_ARGS -d $DOCKER_ARGS $IMAGE $START_CMD)
         fi
 
         # if we can't post-deploy successfully, kill new container
         kill_new() {
-          docker inspect $id &> /dev/null && docker stop $id > /dev/null && docker kill $id > /dev/null
+          docker inspect "$id" &> /dev/null && docker stop "$id" > /dev/null && docker kill "$id" > /dev/null
           trap - INT TERM EXIT
           kill -9 $$
         }
 
         # run checks first, then post-deploy hooks, which switches Nginx traffic
-        if [[ "$(is_app_checks_enabled $APP)" == "false" ]]; then
+        if [[ "$(is_app_checks_enabled "$APP")" == "false" ]]; then
           dokku_log_info1 "zero downtime is disabled for app ($APP). skipping pre-flight checks"
         else
           trap kill_new INT TERM EXIT
           dokku_log_info1 "Running pre-flight checks"
-          plugn trigger check-deploy  $APP $id $PROC_TYPE $port $ipaddr
+          plugn trigger check-deploy  "$APP" "$id" "$PROC_TYPE" "$port" "$ipaddr"
           trap -        INT TERM EXIT
         fi
 
         # now using the new container
-        [[ -n "$id" ]] && echo $id > "$DOKKU_CONTAINER_ID_FILE"
-        [[ -n "$ipaddr" ]] && echo $ipaddr > "$DOKKU_IP_FILE"
-        [[ -n "$port" ]] && echo $port > "$DOKKU_PORT_FILE"
+        [[ -n "$id" ]] && echo "$id" > "$DOKKU_CONTAINER_ID_FILE"
+        [[ -n "$ipaddr" ]] && echo "$ipaddr" > "$DOKKU_IP_FILE"
+        [[ -n "$port" ]] && echo "$port" > "$DOKKU_PORT_FILE"
 
         # cleanup pre-migration files
-        rm -f $DOKKU_ROOT/$APP/CONTAINER $DOKKU_ROOT/$APP/IP $DOKKU_ROOT/$APP/PORT
+        rm -f "$DOKKU_ROOT/$APP/CONTAINER" "$DOKKU_ROOT/$APP/IP" "$DOKKU_ROOT/$APP/PORT"
 
         CONTAINER_INDEX=$(( CONTAINER_INDEX + 1 ))
       done
@@ -201,19 +206,19 @@ case "$1" in
         CONTAINER_IDX_OFFSET=$((PROC_COUNT + 1))
       fi
       for container_state_filetype in CONTAINER IP PORT; do
-        cd $DOKKU_ROOT/$APP
+        cd "$DOKKU_ROOT/$APP"
         find . -maxdepth 1 -name "$container_state_filetype.$PROC_TYPE.*" -printf "%f\n" | sort -t . -k 3 -n | tail -n +$CONTAINER_IDX_OFFSET | xargs rm -f
       done
     done < "$DOKKU_SCALE_FILE"
 
     dokku_log_info1 "Running post-deploy"
-    plugn trigger post-deploy $APP $port $ipaddr $IMAGE_TAG
+    plugn trigger post-deploy "$APP" "$port" "$ipaddr" "$IMAGE_TAG"
 
     # kill the old container
     if [[ -n "$oldids" ]]; then
 
       if [[ -z "$DOKKU_WAIT_TO_RETIRE" ]]; then
-        DOKKU_APP_DOKKU_WAIT_TO_RETIRE=$(dokku config:get $APP DOKKU_WAIT_TO_RETIRE || true)
+        DOKKU_APP_DOKKU_WAIT_TO_RETIRE=$(dokku config:get "$APP" DOKKU_WAIT_TO_RETIRE || true)
         DOKKU_GLOBAL_DOKKU_WAIT_TO_RETIRE=$(dokku config:get --global DOKKU_WAIT_TO_RETIRE || true)
         DOKKU_WAIT_TO_RETIRE=${DOKKU_APP_DOKKU_WAIT_TO_RETIRE:="$DOKKU_GLOBAL_DOKKU_WAIT_TO_RETIRE"}
       fi
@@ -227,14 +232,14 @@ case "$1" in
       (
         exec >/dev/null 2>/dev/null </dev/null
         trap '' INT HUP
-        sleep $WAIT
+        sleep "$WAIT"
         for oldid in $oldids; do
           # Attempt to stop, if that fails, then force a kill as docker seems
           # to not send SIGKILL as the docs would indicate. If that fails, move
           # on to the next.
-          docker stop $oldid \
-          || docker kill $oldid \
-          || plugn trigger retire-container-failed $APP # plugin trigger for event logging
+          docker stop "$oldid" \
+          || docker kill "$oldid" \
+          || plugn trigger retire-container-failed "$APP" # plugin trigger for event logging
         done
       ) & disown -a
       # Use trap since disown/nohup don't seem to keep child alive
diff --git a/plugins/00_dokku-standard/backup-check b/plugins/00_dokku-standard/backup-check
index aae373832d0..a86a7e15723 100755
--- a/plugins/00_dokku-standard/backup-check
+++ b/plugins/00_dokku-standard/backup-check
@@ -4,7 +4,7 @@ set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 VERSION="$1"
 IMPORT_DIR="$2"
 TARGET_DIR="$3"
-APPS="$(< $4 )"
+APPS="$(< "$4" )"
 
 ret=0
 
diff --git a/plugins/00_dokku-standard/backup-import b/plugins/00_dokku-standard/backup-import
index 47ec23314da..6f2af5fbd43 100755
--- a/plugins/00_dokku-standard/backup-import
+++ b/plugins/00_dokku-standard/backup-import
@@ -5,12 +5,12 @@ VERSION="$1"
 IMPORT_DIR="$2"
 TARGET_DIR="$3"
 
-[[ -f $IMPORT_DIR/.sshcommand ]] && mv $IMPORT_DIR/.sshcommand $TARGET_DIR/.sshcommand
+[[ -f $IMPORT_DIR/.sshcommand ]] && mv "$IMPORT_DIR/.sshcommand" "$TARGET_DIR/.sshcommand"
 if [[ -f $IMPORT_DIR/.ssh/authorized_keys ]]; then
-  mkdir -p $TARGET_DIR/.ssh
-  cat $IMPORT_DIR/.ssh/authorized_keys $TARGET_DIR/.ssh/authorized_keys | uniq > tmpfile && mv tmpfile $TARGET_DIR/.ssh/authorized_keys
-  chmod 0700 $TARGET_DIR/.ssh
-  chmod 0600 $TARGET_DIR/.ssh/*
+  mkdir -p "$TARGET_DIR/.ssh"
+  cat "$IMPORT_DIR/.ssh/authorized_keys" "$TARGET_DIR/.ssh/authorized_keys" | uniq > tmpfile && mv tmpfile "$TARGET_DIR/.ssh/authorized_keys"
+  chmod 0700 "$TARGET_DIR/.ssh"
+  chmod 0600 "$TARGET_DIR"/.ssh/*
 fi
-[[ -f $IMPORT_DIR/HOSTNAME ]] && mv $IMPORT_DIR/HOSTNAME $TARGET_DIR/HOSTNAME
-[[ -f $IMPORT_DIR/VHOST ]] && mv $IMPORT_DIR/VHOST $TARGET_DIR/VHOST
+[[ -f $IMPORT_DIR/HOSTNAME ]] && mv "$IMPORT_DIR/HOSTNAME" "$TARGET_DIR/HOSTNAME"
+[[ -f $IMPORT_DIR/VHOST ]] && mv "$IMPORT_DIR/VHOST" "$TARGET_DIR/VHOST"
diff --git a/plugins/00_dokku-standard/commands b/plugins/00_dokku-standard/commands
index b57be413235..e9bef16a25c 100755
--- a/plugins/00_dokku-standard/commands
+++ b/plugins/00_dokku-standard/commands
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-[[ " build release trace delete ls run url urls report version help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " build release trace delete ls run url urls report version help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_AVAILABLE_PATH/config/functions"
@@ -8,28 +8,29 @@ source "$PLUGIN_CORE_AVAILABLE_PATH/proxy/functions"
 
 case "$1" in
   build)
-    APP="$2"; IMAGE_SOURCE_TYPE="$3"; TMP_WORK_DIR="$4"; IMAGE=$(get_app_image_name $APP)
+    APP="$2"; IMAGE_SOURCE_TYPE="$3"; TMP_WORK_DIR="$4"; IMAGE=$(get_app_image_name "$APP")
     verify_app_name "$APP"
 
     CACHE_DIR="$DOKKU_ROOT/$APP/cache"
 
-    eval "$(config_export app $APP)"
+    eval "$(config_export app "$APP")"
     pushd "$TMP_WORK_DIR" &> /dev/null
 
     case "$IMAGE_SOURCE_TYPE" in
       herokuish)
-        id=$(tar -c . | docker run $DOKKU_GLOBAL_RUN_ARGS -i -a stdin $DOKKU_IMAGE /bin/bash -c "mkdir -p /app && tar -xC /app")
-        test "$(docker wait $id)" -eq 0
-        docker commit $id $IMAGE > /dev/null
-        [[ -d $CACHE_DIR ]] || mkdir $CACHE_DIR
+        id=$(tar -c . | docker run "$DOKKU_GLOBAL_RUN_ARGS" -i -a stdin "$DOKKU_IMAGE" /bin/bash -c "mkdir -p /app && tar -xC /app")
+        test "$(docker wait "$id")" -eq 0
+        docker commit "$id" "$IMAGE" > /dev/null
+        [[ -d $CACHE_DIR ]] || mkdir "$CACHE_DIR"
         plugn trigger pre-build-buildpack "$APP"
 
-        DOCKER_ARGS=$(: | plugn trigger docker-args-build $APP $IMAGE_SOURCE_TYPE)
+        DOCKER_ARGS=$(: | plugn trigger docker-args-build "$APP" "$IMAGE_SOURCE_TYPE")
         [[ "$DOKKU_TRACE" ]] && DOCKER_ARGS+=" -e TRACE=true "
+        # shellcheck disable=SC2086
         id=$(docker run $DOKKU_GLOBAL_RUN_ARGS -d -v $CACHE_DIR:/cache -e CACHE_PATH=/cache $DOCKER_ARGS $IMAGE /build)
-        docker attach $id
-        test "$(docker wait $id)" -eq 0
-        docker commit $id $IMAGE > /dev/null
+        docker attach "$id"
+        test "$(docker wait "$id")" -eq 0
+        docker commit "$id" "$IMAGE" > /dev/null
 
         plugn trigger post-build-buildpack "$APP"
         ;;
@@ -37,12 +38,13 @@ case "$1" in
       dockerfile)
         # extract first port from Dockerfile
         DOCKERFILE_PORTS=$(get_dockerfile_exposed_ports Dockerfile)
-        [[ -n "$DOCKERFILE_PORTS" ]] && config_set --no-restart $APP DOKKU_DOCKERFILE_PORTS="$DOCKERFILE_PORTS"
+        [[ -n "$DOCKERFILE_PORTS" ]] && config_set --no-restart "$APP" DOKKU_DOCKERFILE_PORTS="$DOCKERFILE_PORTS"
         plugn trigger pre-build-dockerfile "$APP"
 
         [[ "$DOKKU_DOCKERFILE_CACHE_BUILD" == "false" ]] && DOKKU_DOCKER_BUILD_OPTS="$DOKKU_DOCKER_BUILD_OPTS --no-cache"
-        DOCKER_ARGS=$(: | plugn trigger docker-args-build $APP $IMAGE_SOURCE_TYPE)
-        docker build $DOCKER_ARGS $DOKKU_DOCKER_BUILD_OPTS -t "$IMAGE" .
+        DOCKER_ARGS=$(: | plugn trigger docker-args-build "$APP" "$IMAGE_SOURCE_TYPE")
+        # shellcheck disable=SC2086
+        docker build $DOCKER_ARGS $DOKKU_DOCKER_BUILD_OPTS -t $IMAGE .
 
         plugn trigger post-build-dockerfile "$APP"
         ;;
@@ -54,21 +56,21 @@ case "$1" in
     ;;
 
   release)
-    APP="$2"; IMAGE_SOURCE_TYPE="$3"; IMAGE_TAG="$4"; IMAGE=$(get_app_image_name $APP $IMAGE_TAG)
+    APP="$2"; IMAGE_SOURCE_TYPE="$3"; IMAGE_TAG="$4"; IMAGE=$(get_app_image_name "$APP" "$IMAGE_TAG")
     verify_app_name "$APP"
 
     case "$IMAGE_SOURCE_TYPE" in
       herokuish)
         plugn trigger pre-release-buildpack "$APP" "$IMAGE_TAG"
         if [[ -n $(config_export global) ]]; then
-          id=$(config_export global | docker run $DOKKU_GLOBAL_RUN_ARGS -i -a stdin $IMAGE /bin/bash -c "mkdir -p /app/.profile.d && cat > /app/.profile.d/00-global-env.sh")
-          test "$(docker wait $id)" -eq 0
-          docker commit $id $IMAGE > /dev/null
+          id=$(config_export global | docker run "$DOKKU_GLOBAL_RUN_ARGS" -i -a stdin "$IMAGE" /bin/bash -c "mkdir -p /app/.profile.d && cat > /app/.profile.d/00-global-env.sh")
+          test "$(docker wait "$id")" -eq 0
+          docker commit "$id" "$IMAGE" > /dev/null
         fi
-        if [[ -n $(config_export app $APP) ]]; then
-          id=$(config_export app $APP | docker run $DOKKU_GLOBAL_RUN_ARGS -i -a stdin $IMAGE /bin/bash -c "mkdir -p /app/.profile.d && cat > /app/.profile.d/01-app-env.sh")
-          test "$(docker wait $id)" -eq 0
-          docker commit $id $IMAGE > /dev/null
+        if [[ -n $(config_export app "$APP") ]]; then
+          id=$(config_export app "$APP" | docker run "$DOKKU_GLOBAL_RUN_ARGS" -i -a stdin "$IMAGE" /bin/bash -c "mkdir -p /app/.profile.d && cat > /app/.profile.d/01-app-env.sh")
+          test "$(docker wait "$id")" -eq 0
+          docker commit "$id" "$IMAGE" > /dev/null
         fi
         plugn trigger post-release-buildpack "$APP" "$IMAGE_TAG"
         ;;
@@ -86,24 +88,24 @@ case "$1" in
     ;;
 
   trace)
-    [[ -d $DOKKU_ROOT/.dokkurc ]] || mkdir -p $DOKKU_ROOT/.dokkurc
+    [[ -d $DOKKU_ROOT/.dokkurc ]] || mkdir -p "$DOKKU_ROOT/.dokkurc"
     [[ "$2" == "on" ]] || [[ "$2" == "off" ]] || {
       dokku_log_fail "Valid trace options are [on/off]"
     }
 
     if [[ "$2" == "on" ]]; then
       echo "Enabling dokku trace"
-      echo "export DOKKU_TRACE=1" > $DOKKU_ROOT/.dokkurc/DOKKU_TRACE
+      echo "export DOKKU_TRACE=1" > "$DOKKU_ROOT/.dokkurc/DOKKU_TRACE"
     fi
 
     if [[ "$2" == "off" ]]; then
       echo "Disabling dokku trace"
-      rm -f $DOKKU_ROOT/.dokkurc/DOKKU_TRACE
+      rm -f "$DOKKU_ROOT/.dokkurc/DOKKU_TRACE"
     fi
     ;;
 
   delete)
-    dokku apps:destroy $2
+    dokku apps:destroy "$2"
     ;;
 
   ls)
@@ -112,14 +114,14 @@ case "$1" in
     dokku_col_log_info1_quiet "App Name" "Container Type" "Container Id" "Status"
 
     for dokku_app in $installed_apps; do
-      APP=$(basename $dokku_app)
-      DOKKU_APP_CIDS=$(get_app_container_ids $APP)
+      APP=$(basename "$dokku_app")
+      DOKKU_APP_CIDS=$(get_app_container_ids "$APP")
       DOCKER_RUNNING_CONTAINERS=$(docker ps -q --no-trunc)
       if [[ -n $DOKKU_APP_CIDS ]]; then
         for DOKKU_APP_CID in $DOKKU_APP_CIDS; do
           DOKKU_APP_CONTAINER_STATUS="stopped"
           [[ $DOCKER_RUNNING_CONTAINERS =~ $DOKKU_APP_CID ]] && DOKKU_APP_CONTAINER_STATUS="running"
-          DOKKU_APP_CONTAINER_TYPE=$(grep -l $DOKKU_APP_CID $DOKKU_ROOT/$APP/CONTAINER.* | awk -F '/' '{ print $5 }' | awk -F '.' '{ print $2 }')
+          DOKKU_APP_CONTAINER_TYPE=$(grep -l "$DOKKU_APP_CID" "$DOKKU_ROOT/$APP"/CONTAINER.* | awk -F '/' '{ print $5 }' | awk -F '.' '{ print $2 }')
           dokku_col_log_msg "$APP" "$DOKKU_APP_CONTAINER_TYPE" "${DOKKU_APP_CID:0:12}" "$DOKKU_APP_CONTAINER_STATUS"
         done
       else
@@ -130,23 +132,23 @@ case "$1" in
 
   run)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
-    APP="$2"; IMAGE_TAG=$(get_running_image_tag $APP); IMAGE=$(get_app_image_name $APP $IMAGE_TAG)
+    APP="$2"; IMAGE_TAG=$(get_running_image_tag "$APP"); IMAGE=$(get_app_image_name "$APP" "$IMAGE_TAG")
     verify_app_name "$APP"
 
     shift 2
 
     if [[ -z "$DOKKU_RM_CONTAINER" ]]; then
-      DOKKU_APP_RM_CONTAINER=$(dokku config:get $APP DOKKU_RM_CONTAINER || true)
+      DOKKU_APP_RM_CONTAINER=$(dokku config:get "$APP" DOKKU_RM_CONTAINER || true)
       DOKKU_GLOBAL_RM_CONTAINER=$(dokku config:get --global DOKKU_RM_CONTAINER || true)
       DOKKU_RM_CONTAINER=${DOKKU_APP_RM_CONTAINER:="$DOKKU_GLOBAL_RM_CONTAINER"}
     fi
 
-    DOCKER_ARGS=$(: | plugn trigger docker-args-run $APP $IMAGE_TAG)
+    DOCKER_ARGS=$(: | plugn trigger docker-args-run "$APP" "$IMAGE_TAG")
     [[ "$DOKKU_TRACE" ]] && DOCKER_ARGS+=" -e TRACE=true "
     [[ "$DOKKU_RM_CONTAINER" ]] && DOKKU_RUN_OPTS="--rm"
     has_tty && DOKKU_RUN_OPTS+=" -i -t"
     is_image_herokuish_based "$IMAGE" && EXEC_CMD="/exec"
-
+    # shellcheck disable=SC2086
     docker run $DOKKU_GLOBAL_RUN_ARGS $DOKKU_RUN_OPTS $DOCKER_ARGS $IMAGE $EXEC_CMD "$@"
     ;;
 
@@ -187,7 +189,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/00_dokku-standard/exec-app-json-scripts b/plugins/00_dokku-standard/exec-app-json-scripts
index 89985426f33..009297c0b46 100755
--- a/plugins/00_dokku-standard/exec-app-json-scripts
+++ b/plugins/00_dokku-standard/exec-app-json-scripts
@@ -6,26 +6,26 @@ APP="$1"
 case "$0" in
   *pre-deploy)
     IMAGE_TAG="$2"
-    IMAGE=$(get_app_image_name $APP $IMAGE_TAG)
+    IMAGE=$(get_app_image_name "$APP" "$IMAGE_TAG")
     PHASE_SCRIPT_KEY="predeploy"
     ;;
   *post-deploy)
     IMAGE_TAG="$4"
-    IMAGE=$(get_app_image_name $APP $IMAGE_TAG)
+    IMAGE=$(get_app_image_name "$APP" "$IMAGE_TAG")
     PHASE_SCRIPT_KEY="postdeploy"
     ;;
 esac
 
 get_phase_script() {
   local PHASE_SCRIPT_KEY="$1"
-  local TMP_WORK_DIR=$(mktemp -d)
+  local TMP_WORK_DIR=$(mktemp -d -t "dokku_get_phase_script.XXXX")
   local APP_JSON_FILE="$TMP_WORK_DIR/app.json"
   trap 'rm -rf "$TMP_WORK_DIR" > /dev/null' RETURN
 
   copy_from_image "$IMAGE" "/app/app.json" "$TMP_WORK_DIR" 2>/dev/null || true
 
   if [[ -f "$APP_JSON_FILE" ]];then
-    local VALUE=$(get_json_value scripts.dokku.${PHASE_SCRIPT_KEY} < "$APP_JSON_FILE")
+    local VALUE=$(get_json_value "scripts.dokku.${PHASE_SCRIPT_KEY}" < "$APP_JSON_FILE")
   else
     return 0
   fi
@@ -44,11 +44,12 @@ execute_script() {
     local COMMAND+=" $SCRIPT_CMD ; "
     local COMMAND+=" echo removing installation cache... ; "
     local COMMAND+=" rm -rf /tmp/cache || true "
-    local DOCKER_ARGS=$(: | plugn trigger docker-args-deploy $APP)
+    local DOCKER_ARGS=$(: | plugn trigger docker-args-deploy "$APP")
     local CACHE_DIR="$DOKKU_ROOT/$APP/cache"
-    id=$(docker run $DOKKU_GLOBAL_RUN_ARGS --label=dokku_phase_script=${PHASE_SCRIPT_KEY} -d -v $CACHE_DIR:/cache $DOCKER_ARGS $IMAGE /bin/bash -c "$COMMAND")
-    test "$(docker wait $id)" -eq 0
-    dokku_container_log_verbose_quiet $id
+    # shellcheck disable=SC2086
+    id=$(docker run "$DOKKU_GLOBAL_RUN_ARGS" --label=dokku_phase_script="${PHASE_SCRIPT_KEY}" -d -v "$CACHE_DIR:/cache" $DOCKER_ARGS "$IMAGE" /bin/bash -c "$COMMAND")
+    test "$(docker wait "$id")" -eq 0
+    dokku_container_log_verbose_quiet "$id"
     if [[ "$PHASE_SCRIPT_KEY" != "postdeploy" ]];then
       docker commit "$id" "$IMAGE" > /dev/null
     fi
diff --git a/plugins/00_dokku-standard/install b/plugins/00_dokku-standard/install
index 9bbf574e2db..3c611818ead 100755
--- a/plugins/00_dokku-standard/install
+++ b/plugins/00_dokku-standard/install
@@ -2,7 +2,7 @@
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 
 if [[ ! -f  "$DOKKU_ROOT/HOSTNAME" ]]; then
-  hostname -f > $DOKKU_ROOT/HOSTNAME
+  hostname -f > "$DOKKU_ROOT/HOSTNAME"
 fi
 
 if [[ ! -f  "$DOKKU_ROOT/VHOST" ]]; then
diff --git a/plugins/20_events/commands b/plugins/20_events/commands
index 0b2c2f7e716..d661899bb10 100755
--- a/plugins/20_events/commands
+++ b/plugins/20_events/commands
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-[[ " events events:on events:off events:list help events:help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " events events:on events:off events:list help events:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 
@@ -7,28 +7,28 @@ case "$1" in
   events)
     if [[ -f $DOKKU_EVENTS_LOGFILE ]]; then
       if [[ $2 == "-t" ]]; then
-        tail -F $DOKKU_EVENTS_LOGFILE
+        tail -F "$DOKKU_EVENTS_LOGFILE"
       else
-        tail -n 100 $DOKKU_EVENTS_LOGFILE
+        tail -n 100 "$DOKKU_EVENTS_LOGFILE"
       fi
     fi
     ;;
 
   events:on)
     echo "Enabling dokku events logger"
-    [[ -d $DOKKU_ROOT/.dokkurc ]] || mkdir -p $DOKKU_ROOT/.dokkurc
-    echo "export DOKKU_EVENTS=1" > $DOKKU_ROOT/.dokkurc/DOKKU_EVENTS
+    [[ -d $DOKKU_ROOT/.dokkurc ]] || mkdir -p "$DOKKU_ROOT/.dokkurc"
+    echo "export DOKKU_EVENTS=1" > "$DOKKU_ROOT/.dokkurc/DOKKU_EVENTS"
     ;;
 
   events:off)
     echo "Disabling dokku events logger"
-    rm -f $DOKKU_ROOT/.dokkurc/DOKKU_EVENTS
+    rm -f "$DOKKU_ROOT/.dokkurc/DOKKU_EVENTS"
     ;;
 
   events:list)
-    PLUGIN_DIR="$(dirname $0)/"
+    PLUGIN_DIR="$(dirname "$0")/"
     if [[ "$DOKKU_EVENTS" ]]; then
-      logged="$(find $PLUGIN_DIR -type l -printf '%f ' | sort)"
+      logged="$(find "$PLUGIN_DIR" -type l -printf '%f ' | sort)"
       dokku_col_log_info2_quiet "Events currently logged"
       for hook in $logged; do
         dokku_col_log_msg "$hook"
@@ -48,7 +48,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/20_events/hook b/plugins/20_events/hook
index e9a05dd2145..3c099ee2168 100755
--- a/plugins/20_events/hook
+++ b/plugins/20_events/hook
@@ -2,4 +2,4 @@
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 
-[[ ! "$DOKKU_EVENTS" ]] || dokku_log_plugn_trigger_call "$(basename $0)" "$@"
+[[ ! "$DOKKU_EVENTS" ]] || dokku_log_plugn_trigger_call "$(basename "$0")" "$@"
diff --git a/plugins/20_events/install b/plugins/20_events/install
index 02d65f0b1f9..6c7da6a358e 100755
--- a/plugins/20_events/install
+++ b/plugins/20_events/install
@@ -68,6 +68,6 @@ if [[ "$flag_rsyslog_needs_restart" == "y" ]]; then
   service rsyslog restart
 fi
 
-[[ ! "$DOKKU_EVENTS" ]] || dokku_log_plugn_trigger_call "$(basename $0)" "$@"
+[[ ! "$DOKKU_EVENTS" ]] || dokku_log_plugn_trigger_call "$(basename "$0")" "$@"
 
 exit 0
diff --git a/plugins/apps/commands b/plugins/apps/commands
index 4f9d612d7e9..14a57b37996 100755
--- a/plugins/apps/commands
+++ b/plugins/apps/commands
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-[[ " apps apps:create apps:rename apps:destroy help apps:help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " apps apps:create apps:rename apps:destroy help apps:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_AVAILABLE_PATH/apps/functions"
@@ -13,7 +13,7 @@ case "$1" in
     ;;
 
   apps:create)
-    apps_create $2
+    apps_create "$2"
     ;;
 
   apps:rename)
@@ -23,15 +23,15 @@ case "$1" in
     NEW_APP="$3"
 
     mkdir -p "$DOKKU_ROOT/$NEW_APP"
-    docker run $DOKKU_GLOBAL_RUN_ARGS --rm -v "$DOKKU_ROOT/$OLD_APP/cache:/cache" "dokku/$OLD_APP" chmod 777 -R /cache
+    docker run "$DOKKU_GLOBAL_RUN_ARGS" --rm -v "$DOKKU_ROOT/$OLD_APP/cache:/cache" "dokku/$OLD_APP" chmod 777 -R /cache
     rm -rf "$DOKKU_ROOT/$OLD_APP/cache"
     cp -a "$DOKKU_ROOT/$OLD_APP/." "$DOKKU_ROOT/$NEW_APP"
-    dokku apps:destroy $OLD_APP --force
+    dokku apps:destroy "$OLD_APP" --force
     sed -i -e "s/$OLD_APP/$NEW_APP/g" "$DOKKU_ROOT/$NEW_APP/URLS"
     sed -i -e "s/$OLD_APP/$NEW_APP/g" "$DOKKU_ROOT/$NEW_APP/VHOST"
     sed -i -e "s/git-hook $OLD_APP/git-hook $NEW_APP/g" "$DOKKU_ROOT/$NEW_APP/hooks/pre-receive"
-    dokku ps:rebuild $NEW_APP
-    plugn trigger post-app-rename $OLD_APP $NEW_APP
+    dokku ps:rebuild "$NEW_APP"
+    plugn trigger post-app-rename "$OLD_APP" "$NEW_APP"
     echo "Renaming $OLD_APP to $NEW_APP... done"
     ;;
 
@@ -39,7 +39,7 @@ case "$1" in
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
     [[ "$2" == "tls" ]] && dokku_log_fail "Unable to destroy tls directory"
     [[ "$3" == "force" ]] && DOKKU_APPS_FORCE_DELETE=1
-    APP="$2"; IMAGE_TAG=$(get_running_image_tag $APP)
+    APP="$2"; IMAGE_TAG=$(get_running_image_tag "$APP")
     verify_app_name "$APP"
 
     if [[ -z "$DOKKU_APPS_FORCE_DELETE" ]]; then
@@ -56,16 +56,16 @@ case "$1" in
 
     echo "Destroying $APP (including all add-ons)"
 
-    plugn trigger pre-delete $APP $IMAGE_TAG
-    DOKKU_APP_CIDS=$(get_app_container_ids $APP)
+    plugn trigger pre-delete "$APP" "$IMAGE_TAG"
+    DOKKU_APP_CIDS=$(get_app_container_ids "$APP")
     if [[ -n $DOKKU_APP_CIDS ]]; then
       for ID in $DOKKU_APP_CIDS; do
-        docker stop $ID > /dev/null || true
-        docker rm $ID  > /dev/null || true
+        docker stop "$ID" > /dev/null || true
+        docker rm "$ID"  > /dev/null || true
       done
     fi
 
-    plugn trigger post-delete $APP $IMAGE_TAG
+    plugn trigger post-delete "$APP" "$IMAGE_TAG"
     ;;
 
   help | apps:help)
@@ -78,7 +78,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/apps/functions b/plugins/apps/functions
index 53756049141..a8e0db70231 100755
--- a/plugins/apps/functions
+++ b/plugins/apps/functions
@@ -10,5 +10,5 @@ apps_create() {
 
   mkdir -p "$DOKKU_ROOT/$APP"
   echo "Creating $APP... done"
-  plugn trigger post-create $APP
+  plugn trigger post-create "$APP"
 }
diff --git a/plugins/apps/post-delete b/plugins/apps/post-delete
index 3a552c508f9..081f0af17fc 100755
--- a/plugins/apps/post-delete
+++ b/plugins/apps/post-delete
@@ -2,11 +2,11 @@
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 
-APP="$1"; IMAGE_REPO=$(get_app_image_repo $APP)
+APP="$1"; IMAGE_REPO=$(get_app_image_repo "$APP")
 [[ -n $APP ]] && rm -rf "${DOKKU_ROOT:?}/$APP" > /dev/null
 
 # remove all application containers & images
 # shellcheck disable=SC2046
 docker rm -f $(docker ps -a --no-trunc | egrep "dokku/${APP}:" | awk '{ print $1 }' | xargs) &>/dev/null || true
 # shellcheck disable=SC2046
-docker rmi $(docker images -q $IMAGE_REPO | xargs) &>/dev/null || true
+docker rmi $(docker images -q "$IMAGE_REPO" | xargs) &>/dev/null || true
diff --git a/plugins/apps/pre-delete b/plugins/apps/pre-delete
index 29fdc5fb353..8ace7bca358 100755
--- a/plugins/apps/pre-delete
+++ b/plugins/apps/pre-delete
@@ -2,9 +2,9 @@
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 
-APP="$1"; IMAGE_TAG="$2"; IMAGE=$(get_app_image_name $APP $IMAGE_TAG); CACHE_DIR="$DOKKU_ROOT/$APP/cache"
+APP="$1"; IMAGE_TAG="$2"; IMAGE=$(get_app_image_name "$APP" "$IMAGE_TAG"); CACHE_DIR="$DOKKU_ROOT/$APP/cache"
 verify_app_name "$APP"
 
 if [[ -d $CACHE_DIR ]]; then
-  docker run $DOKKU_GLOBAL_RUN_ARGS --rm -v "$CACHE_DIR:/cache" "$IMAGE" find /cache -depth -mindepth 1 -maxdepth 1 -exec rm -Rf {} \; || true
+  docker run "$DOKKU_GLOBAL_RUN_ARGS" --rm -v "$CACHE_DIR:/cache" "$IMAGE" find /cache -depth -mindepth 1 -maxdepth 1 -exec rm -Rf {} \; || true
 fi
diff --git a/plugins/backup/commands b/plugins/backup/commands
index 3997bc68e27..32f6ddba6b2 100755
--- a/plugins/backup/commands
+++ b/plugins/backup/commands
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-[[ " backup:export backup:import help backup:help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " backup:export backup:import help backup:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 
 case "$1" in
@@ -11,27 +11,27 @@ case "$1" in
     BACKUP_TMP_DIR=$(mktemp -d)
     BACKUP_TMP_FILE="$BACKUP_TMP_DIR/backup.tar"
 
-    : | plugn trigger backup-export 1 $BACKUP_DIR | tar -cf $BACKUP_TMP_FILE --files-from -
+    : | plugn trigger backup-export 1 "$BACKUP_DIR" | tar -cf "$BACKUP_TMP_FILE" --files-from -
 
-    pushd $BACKUP_DIR > /dev/null
+    pushd "$BACKUP_DIR" > /dev/null
     find . -maxdepth 1 -type d -not -name . | sed 's:./::g' > "$BACKUP_TMP_DIR/.dokku_backup_apps"
     popd > /dev/null
 
     # we want to insert the files in the root of the tar
-    pushd $BACKUP_TMP_DIR > /dev/null
+    pushd "$BACKUP_TMP_DIR" > /dev/null
     echo $CURRENT_BACKUP_VERSION > .dokku_backup_version
-    tar --append -f $BACKUP_TMP_FILE .dokku_backup_version
-    tar --append -f $BACKUP_TMP_FILE .dokku_backup_apps
+    tar --append -f "$BACKUP_TMP_FILE" .dokku_backup_version
+    tar --append -f "$BACKUP_TMP_FILE" .dokku_backup_apps
     popd > /dev/null
 
     # if no file specified, output to stdout
     if [[ -z $OUTPUT_FILE ]]; then
-      cat $BACKUP_TMP_FILE
+      cat "$BACKUP_TMP_FILE"
     else
-      mv $BACKUP_TMP_FILE $OUTPUT_FILE
+      mv "$BACKUP_TMP_FILE" "$OUTPUT_FILE"
     fi
 
-    rm -rf $BACKUP_TMP_DIR
+    rm -rf "$BACKUP_TMP_DIR"
     ;;
 
   backup:import)
@@ -47,13 +47,13 @@ case "$1" in
 
     BACKUP_TMP_DIR=$(mktemp -d)
 
-    tar xf $INPUT_FILE --directory=$BACKUP_TMP_DIR
+    tar xf $INPUT_FILE --directory="$BACKUP_TMP_DIR"
 
     if [[ ! -f $BACKUP_TMP_DIR/.dokku_backup_version ]]; then
       dokku_log_fail "Unable to determine backup version"
     fi
 
-    VERSION=$(< $BACKUP_TMP_DIR/.dokku_backup_version)
+    VERSION=$(< "$BACKUP_TMP_DIR/.dokku_backup_version")
     if [[ $VERSION -ne 1 ]]; then
       dokku_log_fail "Unknown format version $VERSION"
     fi
@@ -63,7 +63,7 @@ case "$1" in
     BACKUP_ROOT="$BACKUP_TMP_DIR""$DOKKU_ROOT"
     TARGET_DIR="$DOKKU_ROOT"
 
-    if ! plugn trigger backup-check $VERSION "$BACKUP_ROOT" "$TARGET_DIR" "$BACKUP_TMP_DIR/.dokku_backup_apps"; then
+    if ! plugn trigger backup-check "$VERSION" "$BACKUP_ROOT" "$TARGET_DIR" "$BACKUP_TMP_DIR/.dokku_backup_apps"; then
       if $force; then
         echo "-f used. Ignoring warnings."
       else
@@ -72,12 +72,12 @@ case "$1" in
     fi
 
     # create all the app directories
-    while read -r app; do mkdir "$TARGET_DIR/$app"; echo "Imported $app"; done < $BACKUP_TMP_DIR/.dokku_backup_apps
+    while read -r app; do mkdir "$TARGET_DIR/$app"; echo "Imported $app"; done < "$BACKUP_TMP_DIR/.dokku_backup_apps"
 
     # have the plugins import their stuff
-    plugn trigger backup-import $VERSION "$BACKUP_ROOT" $TARGET_DIR "$BACKUP_TMP_DIR/.dokku_backup_apps"
+    plugn trigger backup-import "$VERSION" "$BACKUP_ROOT" "$TARGET_DIR" "$BACKUP_TMP_DIR/.dokku_backup_apps"
 
-    rm -rf $BACKUP_TMP_DIR
+    rm -rf "$BACKUP_TMP_DIR"
 
     echo "Import complete."
     ;;
@@ -90,7 +90,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/build-env/pre-build-buildpack b/plugins/build-env/pre-build-buildpack
index 48de40d735e..fac11f26156 100755
--- a/plugins/build-env/pre-build-buildpack
+++ b/plugins/build-env/pre-build-buildpack
@@ -3,7 +3,7 @@ set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_AVAILABLE_PATH/config/functions"
 
-APP="$1"; IMAGE=$(get_app_image_name $APP); BUILD_ENV=""
+APP="$1"; IMAGE=$(get_app_image_name "$APP"); BUILD_ENV=""
 verify_app_name "$APP"
 
 [[ -z $(config_get --global CURL_CONNECT_TIMEOUT) ]] && config_set --global CURL_CONNECT_TIMEOUT=5
@@ -14,9 +14,9 @@ if [[ -n $(config_export global) ]]; then
   BUILD_ENV+=$(config_export global)
   BUILD_ENV+=$'\n'
 fi
-if [[ -n $(config_export app $APP) ]]; then
+if [[ -n $(config_export app "$APP") ]]; then
   BUILD_ENV+=$'\n'
-  BUILD_ENV+=$(config_export app $APP)
+  BUILD_ENV+=$(config_export app "$APP")
   BUILD_ENV+=$'\n'
 fi
 
@@ -24,12 +24,12 @@ if [[ ! -z "$BUILD_ENV" ]]; then
   dokku_log_info1 "Adding BUILD_ENV to build environment..."
   # create build env files for use in buildpacks like this:
   # https://github.com/niteoweb/heroku-buildpack-buildout/blob/5879fa3418f7d8e079f1aa5816ba1adde73f4948/bin/compile#L34
-  id=$(echo $BUILD_ENV |sed -e 's@export @@g' -e 's@\\n@ @g' | docker run $DOKKU_GLOBAL_RUN_ARGS -i -a stdin $IMAGE /bin/bash -c "for ENV_VAR in $(cat); do echo \$ENV_VAR |sed 's@^\([^=]*\)=\(.*\)\$@echo \\\"\2\\\" >/tmp/env/\1@g' >>/tmp/set_env.sh; done && mkdir -p /tmp/env && /bin/bash /tmp/set_env.sh")
-  test "$(docker wait $id)" -eq 0
-  docker commit $id $IMAGE > /dev/null
+  id=$(echo $BUILD_ENV |sed -e 's@export @@g' -e 's@\\n@ @g' | docker run "$DOKKU_GLOBAL_RUN_ARGS" -i -a stdin "$IMAGE" /bin/bash -c "for ENV_VAR in $(cat); do echo \$ENV_VAR |sed 's@^\([^=]*\)=\(.*\)\$@echo \\\"\2\\\" >/tmp/env/\1@g' >>/tmp/set_env.sh; done && mkdir -p /tmp/env && /bin/bash /tmp/set_env.sh")
+  test "$(docker wait "$id")" -eq 0
+  docker commit "$id" "$IMAGE" > /dev/null
 
   # create build env for 'old style' buildpacks and dokku plugins
-  id=$(echo -e "$BUILD_ENV" | docker run $DOKKU_GLOBAL_RUN_ARGS -i -a stdin $IMAGE /bin/bash -c "cat >> /app/.env")
-  test "$(docker wait $id)" -eq 0
-  docker commit $id $IMAGE > /dev/null
+  id=$(echo -e "$BUILD_ENV" | docker run "$DOKKU_GLOBAL_RUN_ARGS" -i -a stdin "$IMAGE" /bin/bash -c "cat >> /app/.env")
+  test "$(docker wait "$id")" -eq 0
+  docker commit "$id" "$IMAGE" > /dev/null
 fi
diff --git a/plugins/certs/commands b/plugins/certs/commands
index e1779611141..cddc43bff6e 100755
--- a/plugins/certs/commands
+++ b/plugins/certs/commands
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-[[ " certs:add certs:generate certs:info certs:remove certs:update help certs:help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " certs:add certs:generate certs:info certs:remove certs:update help certs:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_AVAILABLE_PATH/certs/functions"
@@ -32,11 +32,12 @@ certs_set() {
   verify_app_name "$2"
   local APP="$2"; local CRT_FILE="$3"; local KEY_FILE="$4"; local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"
 
-  is_file_import $CRT_FILE $KEY_FILE || is_tar_import || dokku_log_fail "Tar archive containing server.crt and server.key expected on stdin"
+  is_file_import "$CRT_FILE" "$KEY_FILE" || is_tar_import || dokku_log_fail "Tar archive containing server.crt and server.key expected on stdin"
 
   if is_tar_import; then
-    TEMP_DIR=$(mktemp -d)
-    cd $TEMP_DIR
+    TEMP_DIR=$(mktemp -d -t "dokku_certs_set.XXXX")
+    pushd "$TEMP_DIR" &> /dev/null
+    trap 'popd &> /dev/null || true; rm -rf $TEMP_DIR > /dev/null' RETURN
     tar xvf - <&0
 
     CRT_FILE_SEARCH=$(find . -not -path '*/\.*' -type f -name "*.crt")
@@ -63,11 +64,10 @@ certs_set() {
   mkdir -p "$APP_SSL_PATH"
   cp "$CRT_FILE" "$APP_SSL_PATH/server.crt"
   cp "$KEY_FILE" "$APP_SSL_PATH/server.key"
-  chmod 750 $APP_SSL_PATH
-  chmod 640 $APP_SSL_PATH/server.crt $APP_SSL_PATH/server.key
-  cd $DOKKU_ROOT
-  rm -rf $TEMP_DIR
-  nginx_build_config $APP
+  chmod 750 "$APP_SSL_PATH"
+  chmod 640 "$APP_SSL_PATH/server.crt" "$APP_SSL_PATH/server.key"
+  cd "$DOKKU_ROOT"
+  nginx_build_config "$APP"
 }
 
 case "$1" in
@@ -82,9 +82,8 @@ case "$1" in
 
     if [[ ! -f "$APP_SSL_PATH/server.key" ]] && [[ ! -f "$APP_SSL_PATH/server.crt" ]]; then
       TMP_WORK_DIR=$(mktemp -d -t "dokku_certs.XXXXXXXXX")
-      trap 'rm -rf "$TMP_WORK_DIR" > /dev/null' INT TERM EXIT
-
-      pushd $TMP_WORK_DIR > /dev/null
+      pushd "$TMP_WORK_DIR" > /dev/null
+      trap 'popd &> /dev/null || true; rm -rf "$TMP_WORK_DIR" > /dev/null' INT TERM EXIT
 
       openssl genrsa -des3 -passout pass:x -out server.pass.key 2048
       openssl rsa -passin pass:x -in server.pass.key -out server.key
@@ -93,10 +92,10 @@ case "$1" in
 
       mkdir -p "$APP_SSL_PATH"
       dokku_log_info1 "Installing certificate and key..."
-      mv -f $TMP_WORK_DIR/server.key $TMP_WORK_DIR/server.crt $APP_SSL_PATH
-      chmod 750 $APP_SSL_PATH
-      chmod 640 $APP_SSL_PATH/server.key $APP_SSL_PATH/server.crt
-      [[ -n "$DOMAIN" ]] && (dokku domains:add $APP $DOMAIN || nginx_build_config $APP)
+      mv -f "$TMP_WORK_DIR/server.key" "$TMP_WORK_DIR/server.crt" "$APP_SSL_PATH"
+      chmod 750 "$APP_SSL_PATH"
+      chmod 640 "$APP_SSL_PATH/server.key" "$APP_SSL_PATH/server.crt"
+      [[ -n "$DOMAIN" ]] && (dokku domains:add "$APP" "$DOMAIN" || nginx_build_config "$APP")
       dokku_log_info1 "The following is a certificate signing request that can be used"
       dokku_log_info1 "to generate an 'officially' signed SSL certificate for $APP at $DOMAIN"
       dokku_log_info1 "by a CA of your choosing."
@@ -109,7 +108,7 @@ case "$1" in
   certs:info)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
     verify_app_name "$2"
-    APP="$2"; SSL_TYPE=$(is_ssl_enabled $APP)
+    APP="$2"; SSL_TYPE=$(is_ssl_enabled "$APP")
     case "$SSL_TYPE" in
       app)
         SSL_PATH="$DOKKU_ROOT/$APP/tls"
@@ -128,15 +127,15 @@ case "$1" in
       dokku_log_info1 "Certificate details:"
       dokku_log_info2 "Common Name(s): "
 
-      for domain in $(get_ssl_hostnames $APP | xargs); do
+      for domain in $(get_ssl_hostnames "$APP" | xargs); do
         dokku_log_info2 "   $domain"
       done
 
-      dokku_log_info2 "Expires At: $(openssl x509 -in $SSL_PATH/server.crt -noout -text | grep "Not After :" | awk -F " : " '{ print $2 }')"
-      dokku_log_info2 "Issuer: $(openssl x509 -in $SSL_PATH/server.crt -noout -text | grep "Issuer:" | xargs | sed -e "s/Issuer: //g")"
-      dokku_log_info2 "Starts At: $(openssl x509 -in $SSL_PATH/server.crt -noout -text | grep "Not Before:" | awk -F ": " '{ print $2 }')"
-      dokku_log_info2 "Subject: $(openssl x509 -in $SSL_PATH/server.crt -noout -subject | sed -e "s:subject= ::g"| sed -e "s:^/::g" | sed -e "s:/:; :g")"
-      SSL_VERIFY_OUTPUT="$(openssl verify -verbose -purpose sslserver $SSL_PATH/server.crt | awk -F ':' '{ print $2 }' | tail -1 | xargs || true)"
+      dokku_log_info2 "Expires At: $(openssl x509 -in "$SSL_PATH/server.crt" -noout -text | grep "Not After :" | awk -F " : " '{ print $2 }')"
+      dokku_log_info2 "Issuer: $(openssl x509 -in "$SSL_PATH/server.crt" -noout -text | grep "Issuer:" | xargs | sed -e "s/Issuer: //g")"
+      dokku_log_info2 "Starts At: $(openssl x509 -in "$SSL_PATH/server.crt" -noout -text | grep "Not Before:" | awk -F ": " '{ print $2 }')"
+      dokku_log_info2 "Subject: $(openssl x509 -in "$SSL_PATH/server.crt" -noout -subject | sed -e "s:subject= ::g"| sed -e "s:^/::g" | sed -e "s:/:; :g")"
+      SSL_VERIFY_OUTPUT="$(openssl verify -verbose -purpose sslserver "$SSL_PATH/server.crt" | awk -F ':' '{ print $2 }' | tail -1 | xargs || true)"
       if [[ "$SSL_VERIFY_OUTPUT" == "OK" ]]; then
         SSL_SELF_SIGNED="verified by a certificate authority."
       else
@@ -155,8 +154,8 @@ case "$1" in
 
     if [[ -d "$APP_SSL_PATH" ]]; then
       dokku_log_info1 "Removing SSL endpoint from $APP"
-      rm -rf $APP_SSL_PATH
-      plugn trigger post-domains-update $APP
+      rm -rf "$APP_SSL_PATH"
+      plugn trigger post-domains-update "$APP"
     else
       dokku_log_fail "An app-specific SSL endpoint is not defined"
     fi
@@ -180,7 +179,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/certs/functions b/plugins/certs/functions
index e4bc012c42a..25200f5bb86 100755
--- a/plugins/certs/functions
+++ b/plugins/certs/functions
@@ -5,7 +5,7 @@ source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 # returns 'global', 'app', 'false'
 # if both are configured, app trumps global
 is_ssl_enabled() {
-  local APP=$1; verify_app_name $APP
+  local APP=$1; verify_app_name "$APP"
   APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"
 
   if [[ -e "$APP_SSL_PATH/server.crt" ]] && [[ -e "$APP_SSL_PATH/server.key" ]]; then
@@ -16,16 +16,16 @@ is_ssl_enabled() {
 }
 
 get_ssl_hostnames() {
-  local APP=$1; verify_app_name $APP
+  local APP=$1; verify_app_name "$APP"
   local SSL_PATH="$DOKKU_ROOT/$APP/tls"
 
-  local SSL_HOSTNAME=$(openssl x509 -in $SSL_PATH/server.crt -noout -subject | tr '/' '\n' | grep CN= | cut -c4-)
-  local SSL_HOSTNAME_ALT=$(openssl x509 -in $SSL_PATH/server.crt -noout -text | grep --after-context=1 '509v3 Subject Alternative Name:' | tail -n 1 | sed -e "s/[[:space:]]*DNS://g"  | tr ',' '\n' || true)
+  local SSL_HOSTNAME=$(openssl x509 -in "$SSL_PATH/server.crt" -noout -subject | tr '/' '\n' | grep CN= | cut -c4-)
+  local SSL_HOSTNAME_ALT=$(openssl x509 -in "$SSL_PATH/server.crt" -noout -text | grep --after-context=1 '509v3 Subject Alternative Name:' | tail -n 1 | sed -e "s/[[:space:]]*DNS://g"  | tr ',' '\n' || true)
   if [[ -n "$SSL_HOSTNAME_ALT" ]]; then
     local SSL_HOSTNAMES="${SSL_HOSTNAME}\n${SSL_HOSTNAME_ALT}"
   else
     local SSL_HOSTNAMES=$SSL_HOSTNAME
   fi
-  echo -e $SSL_HOSTNAMES
+  echo -e "$SSL_HOSTNAMES"
   return 0
 }
diff --git a/plugins/checks/check-deploy b/plugins/checks/check-deploy
index ab37ef50049..d34bd4a222a 100755
--- a/plugins/checks/check-deploy
+++ b/plugins/checks/check-deploy
@@ -47,16 +47,16 @@ if [[ -z "$DOKKU_APP_LISTEN_IP" ]] && [[ -f "$DOKKU_ROOT/$APP/IP" ]]; then
   DOKKU_APP_LISTEN_IP=$(< "$DOKKU_ROOT/$APP/IP")
 fi
 if [[ -z "$DOKKU_APP_CONTAINER_ID" ]]; then
-  DOKKU_APP_CIDS=( $(get_app_container_ids $APP) )
+  DOKKU_APP_CIDS=( $(get_app_container_ids "$APP") )
   DOKKU_APP_CONTAINER_ID=${DOKKU_APP_CIDS[0]}
 fi
 
 
 # source global and in-app envs to get DOKKU_CHECKS_WAIT and any other necessary vars
 eval "$(config_export global)"
-eval "$(config_export app $APP)"
+eval "$(config_export app "$APP")"
 
-if [[ "$(is_app_checks_enabled $APP)" == "false" ]];then
+if [[ "$(is_app_checks_enabled "$APP")" == "false" ]];then
   dokku_log_info2_quiet "Zero downtime checks for app ($APP) have been disabled. moving on..."
   exit 0
 fi
@@ -72,13 +72,13 @@ ATTEMPTS="${DOKKU_CHECKS_ATTEMPTS:-5}"
 # docker cp exits with status 1 when run as non-root user when it tries to chown the file
 # after successfully copying the file. Thus, we suppress stderr.
 # ref: https://github.com/dotcloud/docker/issues/3986
-TMPDIR=$(mktemp -d /tmp/CHECKS.XXXXX)
-docker cp $DOKKU_APP_CONTAINER_ID:/app/CHECKS $TMPDIR 2> /dev/null || true
+TMPDIR=$(mktemp -d /tmp/dokku_CHECKS.XXXXX)
+docker cp $DOKKU_APP_CONTAINER_ID:/app/CHECKS "$TMPDIR" 2> /dev/null || true
 
 FILENAME=${TMPDIR}/CHECKS
 
 cleanup() {
-  rm -rf $TMPDIR
+  rm -rf "$TMPDIR"
   dokku_log_info2_quiet             "$APP container output:"
   dokku_container_log_verbose_quiet $DOKKU_APP_CONTAINER_ID
   dokku_log_info2_quiet             "end $APP container output"
@@ -95,12 +95,12 @@ if [[ ! -s "${TMPDIR}/CHECKS" ]] || [[ "$DOKKU_APP_CONTAINER_TYPE" != "web" ]];
     dokku_log_verbose "Non web container detected: Running default container check..."
   fi
 
-  rm -rf $TMPDIR
+  rm -rf "$TMPDIR"
 
   # simple default check to see if the container stuck around
   DOKKU_DEFAULT_CHECKS_WAIT="${DOKKU_DEFAULT_CHECKS_WAIT:-10}"
   dokku_log_info1 "Waiting for $DOKKU_DEFAULT_CHECKS_WAIT seconds ..."
-  sleep $DOKKU_DEFAULT_CHECKS_WAIT
+  sleep "$DOKKU_DEFAULT_CHECKS_WAIT"
 
   ! (is_container_running $DOKKU_APP_CONTAINER_ID) && dokku_log_fail "App container failed to start!!"
   container_restarts=$(docker inspect -f "{{ .RestartCount }}" $DOKKU_APP_CONTAINER_ID)
@@ -133,7 +133,7 @@ do
   FAILEDCHECKS=0
   ATTEMPT=$(( ATTEMPT + 1 ))
   dokku_log_info1 "Attempt $ATTEMPT/$ATTEMPTS Waiting for $WAIT seconds ..."
-  sleep $WAIT
+  sleep "$WAIT"
 
 
   # -q           do not use .curlrc (must come first)
@@ -190,6 +190,7 @@ do
     [[ $DOKKU_TRACE ]] && dokku_log_verbose "$ curl $CURL_ARGS"
 
     # Capture HTTP response or CURL error message
+    # shellcheck disable=SC2086
     if OUTPUT=$(curl -# $CURL_ARGS 2>&1); then
       # OUTPUT contains the HTTP response
       if [[ ! "$OUTPUT" =~ $EXPECTED ]]; then
diff --git a/plugins/checks/commands b/plugins/checks/commands
index 8f14188a8f5..54a4d4f1e1b 100755
--- a/plugins/checks/commands
+++ b/plugins/checks/commands
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-[[ " checks checks:enable checks:disable help ps:help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " checks checks:enable checks:disable help ps:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_AVAILABLE_PATH/checks/functions"
@@ -15,7 +15,7 @@ checks_main() {
   dokku_col_log_info1_quiet "App Name" "Zero-Downtime Status"
   for app in $APPS; do
     verify_app_name "$app"
-    dokku_col_log_msg "$app" "$(is_app_checks_enabled $app)"
+    dokku_col_log_msg "$app" "$(is_app_checks_enabled "$app")"
   done
 }
 
@@ -23,9 +23,10 @@ checks_enable() {
   local desc="enable zero-downtime for app"
   local APP="$1"; verify_app_name "$APP"
 
-  if [[ "$(is_app_checks_enabled $APP)" == "false" ]]; then
+  if [[ "$(is_app_checks_enabled "$APP")" == "false" ]]; then
     dokku_log_info1 "Enabling zero downtime for app ($APP)"
     [[ "$2" == "--no-restart" ]] && local CONFIG_SET_ARGS=$2
+    # shellcheck disable=SC2086
     config_set $CONFIG_SET_ARGS $APP DOKKU_CHECKS_ENABLED=1
   else
     dokku_log_info1 "zero downtime is already enabled for app ($APP)"
@@ -36,9 +37,10 @@ checks_disable() {
   local desc="disable zero-downtime for app"
   local APP="$1"; verify_app_name "$APP"
 
-  if [[ "$(is_app_checks_enabled $APP)" == "true" ]]; then
+  if [[ "$(is_app_checks_enabled "$APP")" == "true" ]]; then
     dokku_log_info1 "Disabling zero downtime for app ($APP)"
     [[ "$2" == "--no-restart" ]] && local CONFIG_SET_ARGS=$2
+    # shellcheck disable=SC2086
     config_set $CONFIG_SET_ARGS $APP DOKKU_CHECKS_ENABLED=0
   else
     dokku_log_info1 "zero downtime is already disable for app ($APP)"
@@ -47,17 +49,17 @@ checks_disable() {
 
 case "$1" in
   checks)
-    checks_main $2
+    checks_main "$2"
     ;;
 
   checks:enable)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
-    checks_enable $2 --no-restart
+    checks_enable "$2" --no-restart
     ;;
 
   checks:disable)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
-    checks_disable $2 --no-restart
+    checks_disable "$2" --no-restart
     ;;
 
   help | ps:help)
@@ -69,7 +71,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/checks/functions b/plugins/checks/functions
index 5bc027c8fa4..3ed9e227ae6 100755
--- a/plugins/checks/functions
+++ b/plugins/checks/functions
@@ -6,7 +6,7 @@ source "$PLUGIN_AVAILABLE_PATH/config/functions"
 is_app_checks_enabled() {
   local desc="return app zero-downtime checks status"
   local APP="$1"; verify_app_name "$APP"
-  local DOKKU_CHECKS_ENABLED=$(config_get $APP DOKKU_CHECKS_ENABLED)
+  local DOKKU_CHECKS_ENABLED=$(config_get "$APP" DOKKU_CHECKS_ENABLED)
 
   if [[ -z "$DOKKU_CHECKS_ENABLED" ]] || [[ "$DOKKU_CHECKS_ENABLED" == "1" ]];then
     local status=true
diff --git a/plugins/checks/install b/plugins/checks/install
index 3af04234051..7905c13ed70 100755
--- a/plugins/checks/install
+++ b/plugins/checks/install
@@ -15,17 +15,17 @@ migrate_checks_vars() {
   dokku_log_info2 "Please use dokku checks:[disable|enable] <app> to control zero downtime functionality"
 
   for app in $APPS; do
-    local APP_SKIP_ALL_CHECKS=$(dokku config:get $app DOKKU_SKIP_ALL_CHECKS || true)
-    local APP_SKIP_DEFAULT_CHECKS=$(dokku config:get $app DOKKU_SKIP_DEFAULT_CHECKS || true)
+    local APP_SKIP_ALL_CHECKS=$(dokku config:get "$app" DOKKU_SKIP_ALL_CHECKS || true)
+    local APP_SKIP_DEFAULT_CHECKS=$(dokku config:get "$app" DOKKU_SKIP_DEFAULT_CHECKS || true)
 
     if [[ "$APP_SKIP_ALL_CHECKS" == "true" ]] || [[ "$APP_SKIP_DEFAULT_CHECKS" == "true" ]] || \
        [[ "$GLOBAL_SKIP_ALL_CHECKS" == "true" ]] || [[ "$GLOBAL_SKIP_DEFAULT_CHECKS" == "true" ]]; then
        dokku_log_info2 ""
        dokku_log_info2 "zero downtime disabled for app ($app)"
-      config_set --no-restart $app DOKKU_CHECKS_ENABLED=0
+      config_set --no-restart "$app" DOKKU_CHECKS_ENABLED=0
     fi
     if [[ -n "$APP_SKIP_ALL_CHECKS" ]] || [[ -n "$APP_SKIP_DEFAULT_CHECKS" ]]; then
-      config_unset --no-restart $app DOKKU_SKIP_ALL_CHECKS DOKKU_SKIP_DEFAULT_CHECKS
+      config_unset --no-restart "$app" DOKKU_SKIP_ALL_CHECKS DOKKU_SKIP_DEFAULT_CHECKS
     fi
     dokku_log_info2 "Migration complete"
     dokku_log_info2 ""
diff --git a/plugins/common/functions b/plugins/common/functions
index 757386ba046..d32c5f8ade2 100755
--- a/plugins/common/functions
+++ b/plugins/common/functions
@@ -10,8 +10,8 @@ has_tty() {
 }
 
 dokku_apps() {
-  local INSTALLED_APPS=$(find $DOKKU_ROOT -follow -maxdepth 1 -mindepth 1 -type d ! -name 'tls' ! -name '.*' -printf "%f\n" | sort) || (dokku_log_fail "You haven't deployed any applications yet")
-  [[ $INSTALLED_APPS ]] && echo $INSTALLED_APPS
+  local INSTALLED_APPS=$(find "$DOKKU_ROOT" -follow -maxdepth 1 -mindepth 1 -type d ! -name 'tls' ! -name '.*' -printf "%f\n" | sort) || (dokku_log_fail "You haven't deployed any applications yet")
+  [[ $INSTALLED_APPS ]] && echo "$INSTALLED_APPS"
 }
 
 dokku_log_info1() {
@@ -112,7 +112,7 @@ dokku_container_log_verbose_quiet() {
 
   OIFS=$IFS
   IFS=$'\n'
-  for line in $(docker logs $CID 2>&1); do
+  for line in $(docker logs "$CID" 2>&1); do
     dokku_log_verbose_quiet "$line"
   done
   IFS=$OIFS
@@ -143,12 +143,12 @@ get_app_image_repo() {
   # central definition of our image repo pattern
   local APP="$1"; local IMAGE_REPO="dokku/$APP"
   [[ -z "$APP" ]] && dokku_log_fail "(get_app_image_repo) APP must not be null"
-  echo $IMAGE_REPO
+  echo "$IMAGE_REPO"
 }
 
 get_app_image_name() {
   # return image identifier for a given app, tag tuple. validate if tag is presented
-  local APP="$1"; local IMAGE_TAG="$2"; local IMAGE_REPO=$(get_app_image_repo $APP)
+  local APP="$1"; local IMAGE_TAG="$2"; local IMAGE_REPO=$(get_app_image_repo "$APP")
   [[ -z "$APP" ]] && dokku_log_fail "(get_app_image_name) APP must not be null"
 
   if [[ -n "$IMAGE_TAG" ]]; then
@@ -157,7 +157,7 @@ get_app_image_name() {
   else
     IMAGE="$IMAGE_REPO:latest"
   fi
-  echo $IMAGE
+  echo "$IMAGE"
 }
 
 get_running_image_tag() {
@@ -166,15 +166,15 @@ get_running_image_tag() {
   [[ ! -n "$APP" ]] && dokku_log_fail "(get_running_image_tag) APP must not be null"
   verify_app_name "$APP"
 
-  CIDS=( $(get_app_container_ids $APP) )
+  CIDS=( $(get_app_container_ids "$APP") )
   RUNNING_IMAGE_TAG=$(docker inspect -f '{{ .Config.Image }}' ${CIDS[0]} 2>/dev/null | awk -F: '{ print $2 }' || echo '')
-  echo $RUNNING_IMAGE_TAG
+  echo "$RUNNING_IMAGE_TAG"
 }
 
 is_image_herokuish_based() {
   # circleci can't support --rm as they run lxc in lxc
   [[ ! -f "/home/ubuntu/.circlerc" ]] && local DOCKER_ARGS="--rm"
-  docker run $DOKKU_GLOBAL_RUN_ARGS --entrypoint="/bin/sh" $DOCKER_ARGS "$@" -c "test -f /exec"
+  docker run "$DOKKU_GLOBAL_RUN_ARGS" --entrypoint="/bin/sh" $DOCKER_ARGS "$@" -c "test -f /exec"
 }
 
 is_number() {
@@ -217,15 +217,15 @@ parse_args() {
 
 copy_from_image() {
   local IMAGE="$1"; local SRC_FILE="$2"; local DST_DIR="$3"
-  verify_app_name $APP
+  verify_app_name "$APP"
 
   if verify_image "$IMAGE"; then
-    if ! is_abs_path $SRC_FILE; then
-      local WORKDIR=$(docker inspect -f '{{.Config.WorkingDir}}' $IMAGE)
+    if ! is_abs_path "$SRC_FILE"; then
+      local WORKDIR=$(docker inspect -f '{{.Config.WorkingDir}}' "$IMAGE")
       [[ -z "$WORKDIR" ]] && WORKDIR=/app
       SRC_FILE="$WORKDIR/$SRC_FILE"
     fi
-    CID=$(docker run $DOKKU_GLOBAL_RUN_ARGS -d $IMAGE bash)
+    CID=$(docker run "$DOKKU_GLOBAL_RUN_ARGS" -d "$IMAGE" bash)
     docker cp "$CID:$SRC_FILE" "$DST_DIR"
     docker rm -f "$CID" &> /dev/null
   else
@@ -235,8 +235,8 @@ copy_from_image() {
 
 get_app_container_ids() {
   local APP="$1"; local CONTAINER_TYPE="$2"
-  verify_app_name $APP
-  [[ -f $DOKKU_ROOT/$APP/CONTAINER ]] && DOKKU_CIDS+=$(< $DOKKU_ROOT/$APP/CONTAINER)
+  verify_app_name "$APP"
+  [[ -f $DOKKU_ROOT/$APP/CONTAINER ]] && DOKKU_CIDS+=$(< "$DOKKU_ROOT/$APP/CONTAINER")
 
   if [[ -n "$CONTAINER_TYPE" ]]; then
     CONTAINER_PATTERN="$DOKKU_ROOT/$APP/CONTAINER.$CONTAINER_TYPE.*"
@@ -251,19 +251,19 @@ get_app_container_ids() {
   shopt -s nullglob
   for DOKKU_CID_FILE in $CONTAINER_PATTERN; do
     DOKKU_CIDS+=" "
-    DOKKU_CIDS+=$(< $DOKKU_CID_FILE)
+    DOKKU_CIDS+=$(< "$DOKKU_CID_FILE")
     DOKKU_CIDS+=" "
   done
   shopt -u nullglob
-  echo $DOKKU_CIDS
+  echo "$DOKKU_CIDS"
 }
 
 get_app_running_container_ids() {
   local APP=$1
-  verify_app_name $APP
+  verify_app_name "$APP"
 
-  ! (is_deployed $APP) && dokku_log_fail "App $APP has not been deployed"
-  local CIDS=$(get_app_container_ids $APP)
+  ! (is_deployed "$APP") && dokku_log_fail "App $APP has not been deployed"
+  local CIDS=$(get_app_container_ids "$APP")
 
   for CID in $CIDS; do
     local APP_CONTAINER_STATUS=$(docker inspect -f '{{.State.Running}}' "$CID" || true)
@@ -276,7 +276,7 @@ get_app_running_container_ids() {
 get_cmd_from_procfile() {
   local APP=$1; local PROC_TYPE=$2; local DOKKU_PROCFILE="$DOKKU_ROOT/$APP/DOKKU_PROCFILE"
   local name; local command;
-  verify_app_name $APP
+  verify_app_name "$APP"
 
   if [[ -f $DOKKU_PROCFILE ]]; then
     while read line || [[ -n "$line" ]]; do
@@ -286,13 +286,13 @@ get_cmd_from_procfile() {
       name="${line%%:*}"
       command="${line#*:[[:space:]]}"
       [[ "$name" == "$PROC_TYPE" ]] && echo "$command" && break
-    done < $DOKKU_PROCFILE
+    done < "$DOKKU_PROCFILE"
   fi
 }
 
 is_deployed() {
   local APP="$1"
-  if [[ -f "$DOKKU_ROOT/$APP/CONTAINER" ]] || [[ $(ls $DOKKU_ROOT/$APP/CONTAINER.* &> /dev/null; echo $?) -eq 0 ]]; then
+  if [[ -f "$DOKKU_ROOT/$APP/CONTAINER" ]] || [[ $(ls "$DOKKU_ROOT/$APP"/CONTAINER.* &> /dev/null; echo $?) -eq 0 ]]; then
     return 0
   else
     return 1
@@ -324,9 +324,9 @@ is_container_status () {
 
 is_app_running() {
   local APP="$1"
-  verify_app_name $APP
+  verify_app_name "$APP"
 
-  local APP_RUNNING_CONTAINER_IDS=$(get_app_running_container_ids $APP)
+  local APP_RUNNING_CONTAINER_IDS=$(get_app_running_container_ids "$APP")
 
   if [[ -n "$APP_RUNNING_CONTAINER_IDS" ]]; then
     return 0
@@ -336,7 +336,7 @@ is_app_running() {
 }
 
 release_and_deploy() {
-  local APP="$1"; local IMAGE_TAG="$2"; local IMAGE=$(get_app_image_name $APP $IMAGE_TAG)
+  local APP="$1"; local IMAGE_TAG="$2"; local IMAGE=$(get_app_image_name "$APP" "$IMAGE_TAG")
   verify_app_name "$APP"
 
   if verify_image "$IMAGE"; then
@@ -346,7 +346,7 @@ release_and_deploy() {
       IMAGE_SOURCE_TYPE="dockerfile"
     fi
 
-    DOKKU_APP_SKIP_DEPLOY="$(dokku config:get $APP DOKKU_SKIP_DEPLOY || true)"
+    DOKKU_APP_SKIP_DEPLOY="$(dokku config:get "$APP" DOKKU_SKIP_DEPLOY || true)"
     DOKKU_GLOBAL_SKIP_DEPLOY="$(dokku config:get --global DOKKU_SKIP_DEPLOY || true)"
 
     DOKKU_SKIP_DEPLOY=${DOKKU_APP_SKIP_DEPLOY:="$DOKKU_GLOBAL_SKIP_DEPLOY"}
@@ -358,7 +358,7 @@ release_and_deploy() {
       dokku_log_info1 "Deploying $APP ($IMAGE)..."
       dokku deploy "$APP" "$IMAGE_TAG"
       dokku_log_info2 "Application deployed:"
-      dokku urls $APP | sed "s/^/       /"
+      dokku urls "$APP" | sed "s/^/       /"
     else
       dokku_log_info1 "Skipping deployment"
     fi
@@ -384,8 +384,8 @@ docker_cleanup() {
 get_available_port() {
   while true; do
     local port=$(shuf -i 1025-65535 -n 1)
-    if ! nc -z 0.0.0.0 $port; then
-      echo $port
+    if ! nc -z 0.0.0.0 "$port"; then
+      echo "$port"
       return 0
     else
       continue
@@ -396,7 +396,7 @@ get_available_port() {
 dokku_auth() {
   export SSH_USER=${SSH_USER:=$USER}
   export SSH_NAME=${NAME:="default"}
-  if ! plugn trigger user-auth $SSH_USER $SSH_NAME "$@" ; then
+  if ! plugn trigger user-auth "$SSH_USER" "$SSH_NAME" "$@" ; then
     return 1
   fi
   return 0
@@ -440,7 +440,7 @@ get_ipv6_regex() {
 get_global_vhost() {
  local GLOBAL_VHOST_FILE="$DOKKU_ROOT/VHOST"
  [[ -f "$GLOBAL_VHOST_FILE" ]] && local GLOBAL_VHOST=$(< "$GLOBAL_VHOST_FILE")
- echo $GLOBAL_VHOST
+ echo "$GLOBAL_VHOST"
 }
 
 is_global_vhost_enabled() {
@@ -458,9 +458,9 @@ is_global_vhost_enabled() {
 
 is_app_vhost_enabled() {
   local desc="returns true or false if vhost support is enabled for a given application"
-  local APP=$1; verify_app_name $APP
+  local APP=$1; verify_app_name "$APP"
 
-  local NO_VHOST=$(config_get $APP NO_VHOST)
+  local NO_VHOST=$(config_get "$APP" NO_VHOST)
   local APP_VHOST_ENABLED=true
 
   if [[ "$NO_VHOST" == "1" ]]; then
@@ -472,11 +472,11 @@ is_app_vhost_enabled() {
 
 disable_app_vhost() {
   local desc="disable vhost support for given application"
-  local APP=$1; verify_app_name $APP
+  local APP=$1; verify_app_name "$APP"
   local APP_VHOST_FILE="$DOKKU_ROOT/$APP/VHOST"
   local APP_URLS_FILE="$DOKKU_ROOT/$APP/URLS"
-  local DOKKU_NGINX_PORT=$(config_get $APP DOKKU_NGINX_PORT)
-  local DOKKU_NGINX_SSL_PORT=$(config_get $APP DOKKU_NGINX_SSL_PORT)
+  local DOKKU_NGINX_PORT=$(config_get "$APP" DOKKU_NGINX_PORT)
+  local DOKKU_NGINX_SSL_PORT=$(config_get "$APP" DOKKU_NGINX_SSL_PORT)
 
   if [[ -f "$APP_VHOST_FILE" ]]; then
     dokku_log_info1 "VHOST support disabled, deleting $APP/VHOST"
@@ -487,69 +487,71 @@ disable_app_vhost() {
     rm "$APP_URLS_FILE"
   fi
   if [[ "$DOKKU_NGINX_PORT" == "80" ]]; then
-    config_unset --no-restart $APP DOKKU_NGINX_PORT
+    config_unset --no-restart "$APP" DOKKU_NGINX_PORT
   fi
   if [[ "$DOKKU_NGINX_SSL_PORT" == "443" ]]; then
-    config_unset --no-restart $APP DOKKU_NGINX_SSL_PORT
+    config_unset --no-restart "$APP" DOKKU_NGINX_SSL_PORT
   fi
 
   [[ "$2" == "--no-restart" ]] && local CONFIG_SET_ARGS=$2
+  # shellcheck disable=SC2086
   config_set $CONFIG_SET_ARGS $APP NO_VHOST=1
 }
 
 enable_app_vhost() {
   local desc="enable vhost support for given application"
-  local APP=$1; verify_app_name $APP
+  local APP=$1; verify_app_name "$APP"
 
-  config_unset --no-restart $APP DOKKU_NGINX_PORT DOKKU_NGINX_SSL_PORT
+  config_unset --no-restart "$APP" DOKKU_NGINX_PORT DOKKU_NGINX_SSL_PORT
   [[ "$2" == "--no-restart" ]] && local CONFIG_SET_ARGS=$2
-  config_set $CONFIG_SET_ARGS $APP NO_VHOST=0
+  # shellcheck disable=SC2086
+  config_set $CONFIG_SET_ARGS "$APP" NO_VHOST=0
 }
 
 get_dockerfile_exposed_ports() {
-  local DOCKERFILE_PORTS=$(egrep "^EXPOSE " $1 | awk '{ print $2 }' | xargs) || true
+  local DOCKERFILE_PORTS=$(egrep "^EXPOSE " "$1" | awk '{ print $2 }' | xargs) || true
   echo "$DOCKERFILE_PORTS"
 }
 
 get_app_raw_tcp_ports() {
   local APP="$1"; verify_app_name "$APP"
-  local DOCKERFILE_PORTS="$(config_get $APP DOKKU_DOCKERFILE_PORTS)"
+  local DOCKERFILE_PORTS="$(config_get "$APP" DOKKU_DOCKERFILE_PORTS)"
   for p in $DOCKERFILE_PORTS; do
     if [[ ! "$p" =~ .*udp.* ]]; then
       p=${p//\/tcp}
       raw_tcp_ports+="$p "
     fi
   done
-  raw_tcp_ports="$(echo $raw_tcp_ports| xargs)"
+  raw_tcp_ports="$(echo "$raw_tcp_ports"| xargs)"
   echo "$raw_tcp_ports"
 }
 
 get_container_ports() {
   local APP="$1"; verify_app_name "$APP"
-  local APP_CIDS="$(get_app_container_ids $APP)"
+  local APP_CIDS="$(get_app_container_ids "$APP")"
   local cid
 
   for cid in $APP_CIDS; do
-    local container_ports="$(docker port $cid | awk '{ print $3 "->" $1}' | awk -F ":" '{ print $2 }')"
+    local container_ports="$(docker port "$cid" | awk '{ print $3 "->" $1}' | awk -F ":" '{ print $2 }')"
   done
 
-  echo $container_ports
+  echo "$container_ports"
 }
 
 get_app_urls() {
   local APP="$2"; verify_app_name "$APP"
-  local RAW_TCP_PORTS="$(get_app_raw_tcp_ports $APP)"
+  local RAW_TCP_PORTS="$(get_app_raw_tcp_ports "$APP")"
   local URLS_FILE="$DOKKU_ROOT/$APP/URLS"
 
   if [[ -s "$URLS_FILE" ]]; then
-    local app_urls="$(egrep -v "^#" $URLS_FILE)"
+    local app_urls="$(egrep -v "^#" "$URLS_FILE")"
     if [[ -n "$RAW_TCP_PORTS" ]]; then
       for url in ${app_urls[*]}; do
         for p in $RAW_TCP_PORTS; do
           local port_urls+="$url:$p "
         done
       done
-      local port_urls="$(echo $port_urls| xargs)"
+      local port_urls="$(echo "$port_urls"| xargs)"
     fi
     local URLS=${port_urls:=$app_urls}
     case "$1" in
@@ -562,16 +564,16 @@ get_app_urls() {
     esac
   else
     local SCHEME="http"; local SSL="$DOKKU_ROOT/$APP/tls"
-    local DOKKU_NGINX_PORT=$(config_get $APP DOKKU_NGINX_PORT || true)
-    local DOKKU_NGINX_SSL_PORT=$(config_get $APP DOKKU_NGINX_SSL_PORT || true)
+    local DOKKU_NGINX_PORT=$(config_get "$APP" DOKKU_NGINX_PORT || true)
+    local DOKKU_NGINX_SSL_PORT=$(config_get "$APP" DOKKU_NGINX_SSL_PORT || true)
 
     if [[ -e "$SSL/server.crt" && -e "$SSL/server.key" ]]; then
       local SCHEME="https"
     fi
 
-    if [[ "$(is_app_proxy_enabled $APP)" == "false" ]]; then
+    if [[ "$(is_app_proxy_enabled "$APP")" == "false" ]]; then
       if [[ -n "$RAW_TCP_PORTS" ]]; then
-        local APP_CONTAINER_PORTS="$(get_container_ports $APP)"
+        local APP_CONTAINER_PORTS="$(get_container_ports "$APP")"
         local app_port
         for app_port in $APP_CONTAINER_PORTS; do
           echo "$(< "$DOKKU_ROOT/HOSTNAME"):$app_port (container)"
@@ -585,10 +587,10 @@ get_app_urls() {
       fi
     elif [[ -n "$DOKKU_NGINX_PORT" ]] || [[ -n "$DOKKU_NGINX_SSL_PORT" ]]; then
       if [[ -n "$DOKKU_NGINX_PORT" ]];then
-        echo "http://$(< "$DOKKU_ROOT/HOSTNAME"):$DOKKU_NGINX_PORT ($(get_app_proxy_type $APP))"
+        echo "http://$(< "$DOKKU_ROOT/HOSTNAME"):$DOKKU_NGINX_PORT ($(get_app_proxy_type "$APP"))"
       fi
       if [[ -n "$DOKKU_NGINX_SSL_PORT" ]]; then
-        echo "https://$(< "$DOKKU_ROOT/HOSTNAME"):$DOKKU_NGINX_SSL_PORT ($(get_app_proxy_type $APP)-ssl)"
+        echo "https://$(< "$DOKKU_ROOT/HOSTNAME"):$DOKKU_NGINX_SSL_PORT ($(get_app_proxy_type "$APP")-ssl)"
       fi
     elif [[ -n "$RAW_TCP_PORTS" ]]; then
       for p in $RAW_TCP_PORTS; do
diff --git a/plugins/config/backup-export b/plugins/config/backup-export
index bc709ce83a5..594c18feda7 100755
--- a/plugins/config/backup-export
+++ b/plugins/config/backup-export
@@ -5,4 +5,4 @@ shopt -s nullglob
 VERSION="$1"
 BASE_DIR="$2"
 
-cat; for i in $BASE_DIR/*/ENV; do echo $i; done
+cat; for i in $BASE_DIR/*/ENV; do echo "$i"; done
diff --git a/plugins/config/backup-import b/plugins/config/backup-import
index 7652df5155d..75c7165188d 100755
--- a/plugins/config/backup-import
+++ b/plugins/config/backup-import
@@ -6,7 +6,7 @@ VERSION="$1"
 IMPORT_DIR="$2"
 TARGET_DIR="$3"
 
-cd $IMPORT_DIR
+cd "$IMPORT_DIR"
 for file in */ENV; do
-  cp $file "$TARGET_DIR/$file"
+  cp "$file" "$TARGET_DIR/$file"
 done
diff --git a/plugins/config/commands b/plugins/config/commands
index f5b929449d3..36b1c013b58 100755
--- a/plugins/config/commands
+++ b/plugins/config/commands
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-[[ " config config:get config:set config:unset help config:help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " config config:get config:set config:unset help config:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_AVAILABLE_PATH/config/functions"
@@ -31,7 +31,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/config/docker-args-deploy b/plugins/config/docker-args-deploy
index 51d80f193ce..c42207da2f3 100755
--- a/plugins/config/docker-args-deploy
+++ b/plugins/config/docker-args-deploy
@@ -3,14 +3,14 @@ set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_AVAILABLE_PATH/config/functions"
 
-STDIN=$(cat); APP="$1"; IMAGE_TAG="$2"; IMAGE=$(get_app_image_name $APP $IMAGE_TAG)
+STDIN=$(cat); APP="$1"; IMAGE_TAG="$2"; IMAGE=$(get_app_image_name "$APP" "$IMAGE_TAG")
 DOCKERFILE_ENV_FILE="$DOKKU_ROOT/$APP/DOCKERFILE_ENV_FILE"
 verify_app_name "$APP"
 
 if ! is_image_herokuish_based "$IMAGE"; then
   > "$DOCKERFILE_ENV_FILE"
   config_export global | sed -e "s:^export ::g" -e "s:=':=:g" -e "s:'$::g" > "$DOCKERFILE_ENV_FILE"
-  config_export app $APP | sed -e "s:^export ::g" -e "s:=':=:g" -e "s:'$::g" >> "$DOCKERFILE_ENV_FILE"
+  config_export app "$APP" | sed -e "s:^export ::g" -e "s:=':=:g" -e "s:'$::g" >> "$DOCKERFILE_ENV_FILE"
 
   echo "$STDIN --env-file=$DOCKERFILE_ENV_FILE"
 else
diff --git a/plugins/config/functions b/plugins/config/functions
index 5fff3c8bdef..b63dd2ac10d 100644
--- a/plugins/config/functions
+++ b/plugins/config/functions
@@ -11,7 +11,7 @@ config_export() {
   [[ ! -f $ENV_FILE ]] && return 0
   [[ ! -s $ENV_FILE ]] && return 0
 
-  local VARS=$(grep -Eo "export ([a-zA-Z_][a-zA-Z0-9_]*=.*)" $ENV_FILE | cut -d" " -f2-)
+  local VARS=$(grep -Eo "export ([a-zA-Z_][a-zA-Z0-9_]*=.*)" "$ENV_FILE" | cut -d" " -f2-)
   echo "$VARS" | awk '{print "export " $0}'
   return 0
 }
@@ -49,7 +49,7 @@ config_parse_args() {
 
 config_create () {
   local ENV_FILE=$1
-  [[ -f $ENV_FILE ]] || touch $ENV_FILE
+  [[ -f $ENV_FILE ]] || touch "$ENV_FILE"
 }
 
 config_styled_hash () {
@@ -58,15 +58,15 @@ config_styled_hash () {
   local longest=""
 
   while read -r word; do
-    local KEY=$(echo $word | cut -d"=" -f1)
+    local KEY=$(echo "$word" | cut -d"=" -f1)
     if [[ ${#KEY} -gt ${#longest} ]]; then
       local longest=$KEY
     fi
   done <<< "$vars"
 
   while read -r word; do
-    local KEY=$(echo $word | cut -d"=" -f1)
-    local VALUE=$(echo $word | cut -d"=" -f2- | sed -e "s/^'//" -e "s/'$//" -e "s/\$$//g")
+    local KEY=$(echo "$word" | cut -d"=" -f1)
+    local VALUE=$(echo "$word" | cut -d"=" -f2- | sed -e "s/^'//" -e "s/'$//" -e "s/\$$//g")
 
     local num_zeros=$((${#longest} - ${#KEY}))
     local zeros=" "
@@ -82,12 +82,12 @@ config_write() {
   local ENV_TEMP="$1"
   local ENV_FILE_TEMP="${ENV_FILE}.tmp"
 
-  echo "$ENV_TEMP" | sed '/^$/d' | sort > $ENV_FILE_TEMP
-  if ! cmp -s $ENV_FILE $ENV_FILE_TEMP; then
-    cp -f $ENV_FILE_TEMP $ENV_FILE
-    chmod 600 $ENV_FILE
+  echo "$ENV_TEMP" | sed '/^$/d' | sort > "$ENV_FILE_TEMP"
+  if ! cmp -s "$ENV_FILE" "$ENV_FILE_TEMP"; then
+    cp -f "$ENV_FILE_TEMP" "$ENV_FILE"
+    chmod 600 "$ENV_FILE"
   fi
-  rm -f $ENV_FILE_TEMP
+  rm -f "$ENV_FILE_TEMP"
 }
 
 is_config_export() {
@@ -109,11 +109,11 @@ config_all() {
   [[ "$APP" ]] && local DOKKU_CONFIG_TYPE=$APP
   [[ ! -s $ENV_FILE ]] && dokku_log_fail "no config vars for $DOKKU_CONFIG_TYPE"
 
-  local VARS=$(grep -Eo "export ([a-zA-Z_][a-zA-Z0-9_]*=.*)" $ENV_FILE | cut -d" " -f2-)
+  local VARS=$(grep -Eo "export ([a-zA-Z_][a-zA-Z0-9_]*=.*)" "$ENV_FILE" | cut -d" " -f2-)
 
   for var in "$@"; do
     if [[ "$var" == "--shell" ]]; then
-      echo $VARS
+      echo "$VARS"
       return 0
     fi
   done
@@ -139,7 +139,7 @@ config_get() {
 
   local KEY="$3"
 
-  grep -Eo "export ([a-zA-Z_][a-zA-Z0-9_]*=.*)" $ENV_FILE | grep "^export $KEY=" | cut -d"=" -f2- | sed -e "s/^'//" -e "s/'$//"
+  grep -Eo "export ([a-zA-Z_][a-zA-Z0-9_]*=.*)" "$ENV_FILE" | grep "^export $KEY=" | cut -d"=" -f2- | sed -e "s/^'//" -e "s/'$//"
 }
 
 config_set() {
@@ -190,12 +190,12 @@ ${var}"
     config_styled_hash "$ENV_ADD" "       "
 
     config_write "$ENV_TEMP"
-    plugn trigger post-config-update $APP "set" "$@"
+    plugn trigger post-config-update "$APP" "set" "$@"
   fi
 
   if [[ "$DOKKU_CONFIG_RESTART" == "true" ]]; then
     dokku_log_info1 "Restarting app $APP"
-    dokku ps:restart $APP
+    dokku ps:restart "$APP"
   fi
 }
 
@@ -221,11 +221,11 @@ config_unset() {
     config_write "$ENV_TEMP"
   done
 
-  plugn trigger post-config-update $APP "unset" "$@"
+  plugn trigger post-config-update "$APP" "unset" "$@"
 
   if [[ "$DOKKU_CONFIG_RESTART" == "true" ]]; then
     dokku_log_info1 "Restarting app $APP"
-    dokku ps:restart $APP
+    dokku ps:restart "$APP"
   fi
 
 }
diff --git a/plugins/docker-options/docker-args-deploy b/plugins/docker-options/docker-args-deploy
index d0cc4b19de7..519de709ea6 100755
--- a/plugins/docker-options/docker-args-deploy
+++ b/plugins/docker-options/docker-args-deploy
@@ -65,7 +65,7 @@ if [[ -f "$PHASE_FILE_PATH" ]]; then
         esac
         ;;
     esac
-  done < $PHASE_FILE_PATH
+  done < "$PHASE_FILE_PATH"
 fi
 
 echo "$STDIN$output"
diff --git a/plugins/domains/backup-export b/plugins/domains/backup-export
index e131dfbf95c..65479a959ad 100755
--- a/plugins/domains/backup-export
+++ b/plugins/domains/backup-export
@@ -5,5 +5,5 @@ shopt -s nullglob
 VERSION="$1"
 BASE_DIR="$2"
 
-cat; for i in $BASE_DIR/*/VHOST; do echo $i; done
-cat; for i in $BASE_DIR/*/nginx.conf.template; do echo $i; done
+cat; for i in $BASE_DIR/*/VHOST; do echo "$i"; done
+cat; for i in $BASE_DIR/*/nginx.conf.template; do echo "$i"; done
diff --git a/plugins/domains/backup-import b/plugins/domains/backup-import
index f16caaf8a04..e0129830c4a 100755
--- a/plugins/domains/backup-import
+++ b/plugins/domains/backup-import
@@ -6,10 +6,10 @@ VERSION="$1"
 IMPORT_DIR="$2"
 TARGET_DIR="$3"
 
-cd $IMPORT_DIR
+cd "$IMPORT_DIR"
 for file in */VHOST; do
-  cp $file "$TARGET_DIR/$file"
+  cp "$file" "$TARGET_DIR/$file"
 done
 for file in */nginx.conf.template; do
-  cp $file "$TARGET_DIR/$file"
+  cp "$file" "$TARGET_DIR/$file"
 done
diff --git a/plugins/domains/commands b/plugins/domains/commands
index d3cf60520d9..b860ba70f87 100755
--- a/plugins/domains/commands
+++ b/plugins/domains/commands
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-[[ " domains domains:setup domains:add domains:clear domains:remove domains:disable domains:enable domains:set-global help domains:help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " domains domains:setup domains:add domains:clear domains:remove domains:disable domains:enable domains:set-global help domains:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_AVAILABLE_PATH/domains/functions"
@@ -73,7 +73,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/domains/functions b/plugins/domains/functions
index 135d207ba52..334eff5694d 100755
--- a/plugins/domains/functions
+++ b/plugins/domains/functions
@@ -4,12 +4,12 @@ source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 
 get_app_domains() {
   local desc="return app domains"
-  verify_app_name $1
+  verify_app_name "$1"
   local APP=$1; local APP_VHOST_FILE="$DOKKU_ROOT/$APP/VHOST"
   local GLOBAL_VHOST_PATH="$DOKKU_ROOT/VHOST"
   local GLOBAL_HOSTNAME_PATH="$DOKKU_ROOT/HOSTNAME"
 
-  if [[ "$(is_app_vhost_enabled $APP)" == "true" ]]; then
+  if [[ "$(is_app_vhost_enabled "$APP")" == "true" ]]; then
     if [[ -f "$APP_VHOST_FILE" ]]; then
       cat "$APP_VHOST_FILE"
     elif [[ -f "$GLOBAL_VHOST_PATH" ]]; then
@@ -29,7 +29,7 @@ get_default_vhost() {
     local VHOST=$(get_global_vhost)
     if ! ([[ "$VHOST" =~ $RE_IPV4 ]] || [[ "$VHOST" =~ $RE_IPV6 ]]); then
       local SUBDOMAIN=${APP/%\.${VHOST}/}
-      local hostname=$(: | plugn trigger nginx-hostname $APP $SUBDOMAIN $VHOST)
+      local hostname=$(: | plugn trigger nginx-hostname "$APP" "$SUBDOMAIN" "$VHOST")
       if [[ ! -n $hostname ]]; then
         if [[ "$APP" == *.* ]] && [[ "$SUBDOMAIN" == "$APP" ]]; then
           local hostname="${APP/\//-}"
@@ -48,15 +48,15 @@ domains_setup() {
   verify_app_name "$1"
   local APP="$1"; local APP_VHOST_PATH="$DOKKU_ROOT/$APP/VHOST"; local GLOBAL_VHOST_PATH="$DOKKU_ROOT/VHOST"
   local RE_IPV4="$(get_ipv4_regex)"; local RE_IPV6="$(get_ipv6_regex)"
-  local DEFAULT_VHOST="$(get_default_vhost $APP)"
+  local DEFAULT_VHOST="$(get_default_vhost "$APP")"
 
   if [[ ! -f $APP_VHOST_PATH ]]; then
     if [[ -n "$DEFAULT_VHOST" ]]; then
       dokku_log_info1 "Creating new $APP_VHOST_PATH..."
-      echo "$DEFAULT_VHOST" > $APP_VHOST_PATH
+      echo "$DEFAULT_VHOST" > "$APP_VHOST_PATH"
     else
       dokku_log_info2 "no global VHOST set. disabling vhost support"
-      disable_app_vhost $APP --no-restart
+      disable_app_vhost "$APP" --no-restart
     fi
   fi
 }
@@ -70,7 +70,7 @@ domains_main() {
     get_global_vhost
   fi
   if [[ -n "$APP" ]]; then
-    verify_app_name $APP
+    verify_app_name "$APP"
     if [[ -f "$DOKKU_ROOT/$APP/VHOST" ]]; then
       dokku_log_info2_quiet "$APP Domain Names"
       get_app_domains "$APP"
@@ -96,11 +96,11 @@ domains_add() {
     dokku_log_info1 "Added $DOMAIN to $APP"
   done
 
-  if [[ "$(is_app_vhost_enabled $APP)" == "false" ]];then
+  if [[ "$(is_app_vhost_enabled "$APP")" == "false" ]];then
     domains_enable "$APP" --no-restart
   fi
 
-  plugn trigger post-domains-update $APP "add" "$@"
+  plugn trigger post-domains-update "$APP" "add" "$@"
 }
 
 domains_clear() {
@@ -110,7 +110,7 @@ domains_clear() {
 
   rm -f "$APP_VHOST_PATH"
   domains_setup "$APP"
-  plugn trigger post-domains-update $APP "clear"
+  plugn trigger post-domains-update "$APP" "clear"
   dokku_log_info1 "Cleared domains in $APP"
 }
 
@@ -118,14 +118,14 @@ domains_remove() {
   local desc="remove list of app domains"
   verify_app_name "$1"
   local APP="$1"; local APP_VHOST_PATH="$DOKKU_ROOT/$APP/VHOST"
-  local DEFAULT_VHOST="$(get_default_vhost $APP)"
+  local DEFAULT_VHOST="$(get_default_vhost "$APP")"
   shift 1
 
   for DOMAIN in "$@"; do
     sed -i "/^$DOMAIN$/d" "$DOKKU_ROOT/$APP/VHOST"
     dokku_log_info1 "Removed $DOMAIN from $APP"
   done
-  plugn trigger post-domains-update $APP "remove" "$@"
+  plugn trigger post-domains-update "$APP" "remove" "$@"
 }
 
 domains_disable() {
@@ -133,7 +133,7 @@ domains_disable() {
   verify_app_name "$1"
   local APP="$1"; local APP_VHOST_PATH="$DOKKU_ROOT/$APP/VHOST"
 
-  if [[ "$(is_app_vhost_enabled $APP)" == "true" ]];then
+  if [[ "$(is_app_vhost_enabled "$APP")" == "true" ]];then
     disable_app_vhost "$APP"
   else
     dokku_log_info1 "domains (VHOST) support is already disabled for app ($APP)"
@@ -144,9 +144,9 @@ domains_enable() {
   local desc="enable domains/VHOST support"
   verify_app_name "$1"
   local APP="$1"; local APP_VHOST_PATH="$DOKKU_ROOT/$APP/VHOST"
-  local DEFAULT_VHOST="$(get_default_vhost $APP)"
+  local DEFAULT_VHOST="$(get_default_vhost "$APP")"
 
-  if [[ "$(is_app_vhost_enabled $APP)" == "false" ]];then
+  if [[ "$(is_app_vhost_enabled "$APP")" == "false" ]];then
     if [[ -n "$DEFAULT_VHOST" ]]; then
       echo "$DEFAULT_VHOST" > "$APP_VHOST_PATH"
     fi
@@ -162,7 +162,7 @@ domains_set_global() {
   local NEW_GLOBAL_VHOST="$1"; local GLOBAL_VHOST_PATH="$DOKKU_ROOT/VHOST"
 
   if [[ -n "$NEW_GLOBAL_VHOST" ]]; then
-    echo "$NEW_GLOBAL_VHOST" > $GLOBAL_VHOST_PATH
+    echo "$NEW_GLOBAL_VHOST" > "$GLOBAL_VHOST_PATH"
     dokku_log_info1 "Set global domain to $NEW_GLOBAL_VHOST"
   else
     dokku_log_fail "New global domain name must not be blank"
diff --git a/plugins/domains/install b/plugins/domains/install
index 835ad7217a4..ca32d9a947d 100755
--- a/plugins/domains/install
+++ b/plugins/domains/install
@@ -3,6 +3,6 @@ set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 shopt -s nullglob
 
 for app in $DOKKU_ROOT/*/CONTAINER; do
-  APP=$(basename "$(dirname $app)");
-  dokku domains:setup $APP
+  APP=$(basename "$(dirname "$app")");
+  dokku domains:setup "$APP"
 done
diff --git a/plugins/enter/commands b/plugins/enter/commands
index 81d884a4116..df0997a3819 100755
--- a/plugins/enter/commands
+++ b/plugins/enter/commands
@@ -1,11 +1,11 @@
 #!/usr/bin/env bash
-[[ " enter help enter:help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " enter help enter:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 
 case "$1" in
   enter)
-    APP="$2"; CONTAINER_TYPE="$3"; IMAGE_TAG=$(get_running_image_tag $APP); IMAGE=$(get_app_image_name $APP $IMAGE_TAG)
+    APP="$2"; CONTAINER_TYPE="$3"; IMAGE_TAG=$(get_running_image_tag "$APP"); IMAGE=$(get_app_image_name "$APP" "$IMAGE_TAG")
     verify_app_name "$APP"
 
     [[ ! -n "$3" ]] && dokku_log_fail "No container id specified"
@@ -30,7 +30,7 @@ case "$1" in
     EXEC_CMD=""
     has_tty && DOKKU_RUN_OPTS+=" -i -t"
     is_image_herokuish_based "$IMAGE" && EXEC_CMD="/exec"
-    docker exec $DOKKU_RUN_OPTS $ID $EXEC_CMD "${@:-/bin/bash}"
+    docker exec "$DOKKU_RUN_OPTS" $ID $EXEC_CMD "${@:-/bin/bash}"
     ;;
 
   help | enter:help)
diff --git a/plugins/git/backup-import b/plugins/git/backup-import
index 41aaa115909..066c3210ef1 100755
--- a/plugins/git/backup-import
+++ b/plugins/git/backup-import
@@ -8,13 +8,13 @@ APPS="$4"
 
 while read -r APP; do
   APP_PATH="$TARGET_DIR/$APP";
-  git init --bare $APP_PATH > /dev/null
+  git init --bare "$APP_PATH" > /dev/null
   PRERECEIVE_HOOK="$APP_PATH/hooks/pre-receive"
-  cat > $PRERECEIVE_HOOK <<EOF
+  cat > "$PRERECEIVE_HOOK" <<EOF
 #!/usr/bin/env bash
 set -e; set -o pipefail;
 
-cat | DOKKU_ROOT="$DOKKU_ROOT" dokku git-hook $APP
+cat | DOKKU_ROOT="$DOKKU_ROOT" dokku git-hook "$APP"
 EOF
-  chmod +x $PRERECEIVE_HOOK
-done < $APPS > /dev/null
+  chmod +x "$PRERECEIVE_HOOK"
+done < "$APPS" > /dev/null
diff --git a/plugins/git/commands b/plugins/git/commands
index de3efb57164..8cc9fec8b1f 100755
--- a/plugins/git/commands
+++ b/plugins/git/commands
@@ -8,18 +8,18 @@ git_build_app_repo() {
   APP="$1"; REV="$2"
 
   # clean up after ourselves
-  TMP_WORK_DIR=$(mktemp -d)
-  trap 'rm -rf "$TMP_WORK_DIR" > /dev/null' RETURN
+  TMP_WORK_DIR=$(mktemp -d -t "dokku_git.XXXX")
+  trap 'rm -rf "$TMP_WORK_DIR" > /dev/null' RETURN INT TERM EXIT
 
 
   # git clone - this method creates a new git repository and adds the primary
   #             repo as a remote, then does a fetch depth=1 to avoid cloning
   #             the entire repo
   TMP_TAG="dokku/$REV"
-  chmod 755 $TMP_WORK_DIR
+  chmod 755 "$TMP_WORK_DIR"
   unset GIT_DIR GIT_WORK_TREE
-  pushd $TMP_WORK_DIR > /dev/null
-  [[ ! -d "$DOKKU_ROOT/$APP" ]] && apps_create $APP
+  pushd "$TMP_WORK_DIR" > /dev/null
+  [[ ! -d "$DOKKU_ROOT/$APP" ]] && apps_create "$APP"
   GIT_DIR="$DOKKU_ROOT/$APP" git tag -d "$TMP_TAG" &> /dev/null || true
   GIT_DIR="$DOKKU_ROOT/$APP" git tag "$TMP_TAG" "$REV" &> /dev/null
   git init &> /dev/null
@@ -49,9 +49,11 @@ case "$1" in
       # if block if you wish to run it for others as well.
       if [[ $refname = "refs/heads/master" ]]; then
         # broken out into plugin so we might support other methods to receive an app
+        # shellcheck disable=SC2086
         plugn trigger receive-app $APP $newrev
       else
         if test -f "$PLUGIN_PATH"/enabled/*/receive-branch; then
+          # shellcheck disable=SC2086
           plugn trigger receive-branch $APP $newrev $refname
         else
           echo $'\e[1G\e[K'"-----> WARNING: deploy did not complete, you must push to master."
@@ -62,10 +64,10 @@ case "$1" in
     ;;
 
   git-upload-pack)
-    APP="$(echo $2 | perl -pe 's/(?<!\\)'\''//g' | sed 's/\\'\''/'\''/g')"
-    plugn trigger git-pre-pull $APP
+    APP="$(echo "$2" | perl -pe 's/(?<!\\)'\''//g' | sed 's/\\'\''/'\''/g')"
+    plugn trigger git-pre-pull "$APP"
     cat | git-upload-pack "$DOKKU_ROOT/$APP"
-    plugn trigger git-post-pull $APP
+    plugn trigger git-post-pull "$APP"
     ;;
 
   git-build)
@@ -84,23 +86,24 @@ case "$1" in
     else
       REF=$(< "$DOKKU_ROOT/$APP/refs/heads/master")
     fi
+    # shellcheck disable=SC2086
     git_build_app_repo $APP $REF
     ;;
 
   git-*)
-    APP="$(echo $2 | perl -pe 's/(?<!\\)'\''//g' | sed 's/\\'\''/'\''/g' | sed 's/^\///g')"
+    APP="$(echo "$2" | perl -pe 's/(?<!\\)'\''//g' | sed 's/\\'\''/'\''/g' | sed 's/^\///g')"
     APP_PATH=$DOKKU_ROOT/$APP
 
     if [[ $1 == "git-receive-pack" && ! -d "$APP_PATH/refs" ]]; then
-      git init --bare $APP_PATH > /dev/null
+      git init --bare "$APP_PATH" > /dev/null
       PRERECEIVE_HOOK="$APP_PATH/hooks/pre-receive"
-      cat > $PRERECEIVE_HOOK <<EOF
+      cat > "$PRERECEIVE_HOOK" <<EOF
 #!/usr/bin/env bash
 set -e; set -o pipefail;
 
 cat | DOKKU_ROOT="$DOKKU_ROOT" dokku git-hook $APP
 EOF
-      chmod +x $PRERECEIVE_HOOK
+      chmod +x "$PRERECEIVE_HOOK"
     fi
 
     if [[ $1 == "git-receive-pack" ]]; then
@@ -116,7 +119,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/git/receive-app b/plugins/git/receive-app
index 0b1366b1392..3dc0eb5deb4 100755
--- a/plugins/git/receive-app
+++ b/plugins/git/receive-app
@@ -8,5 +8,6 @@ APP="$1"; REV="$2"
 if [[ ! -d "$DOKKU_ROOT/$APP/refs" ]]; then
   true
 else
+  # shellcheck disable=SC2086
   dokku git-build $APP $REV
 fi
diff --git a/plugins/logs/commands b/plugins/logs/commands
index 032cf637ad5..d3e1534dce6 100755
--- a/plugins/logs/commands
+++ b/plugins/logs/commands
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+[[ " logs help logs:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$(dirname "$0")/functions"
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
@@ -72,7 +73,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/named-containers/post-deploy b/plugins/named-containers/post-deploy
index fef01c72752..f69508e402f 100755
--- a/plugins/named-containers/post-deploy
+++ b/plugins/named-containers/post-deploy
@@ -7,7 +7,7 @@ APP="$1"; APP_ROOT="$DOKKU_ROOT/$APP"
 for container in "$APP_ROOT"/CONTAINER.*; do
   DYNO=$(echo "$container" | sed -r 's/.*CONTAINER\.(.*)/\1/') || true
   NAME="$APP.$DYNO"
-  CURRENT_CONTAINER_ID="$(< $container)"
+  CURRENT_CONTAINER_ID="$(< "$container")"
   PREVIOUS_CIDS=$(docker ps -a -q -f name="^.?$NAME\$" | xargs) || true
   if [[ -n $PREVIOUS_CIDS ]]; then
     dokku_log_info1_quiet "Found previous container(s) ($PREVIOUS_CIDS) named $NAME"
diff --git a/plugins/nginx-vhosts/backup-export b/plugins/nginx-vhosts/backup-export
index 1d4a364f245..a8ca3687372 100755
--- a/plugins/nginx-vhosts/backup-export
+++ b/plugins/nginx-vhosts/backup-export
@@ -5,4 +5,4 @@ shopt -s nullglob
 VERSION="$1"
 BASE_DIR="$2"
 
-cat; for i in $BASE_DIR/*/tls/server.*; do echo $i; done
+cat; for i in $BASE_DIR/*/tls/server.*; do echo "$i"; done
diff --git a/plugins/nginx-vhosts/backup-import b/plugins/nginx-vhosts/backup-import
index 7b6b4b77e57..f8ca3a1485e 100755
--- a/plugins/nginx-vhosts/backup-import
+++ b/plugins/nginx-vhosts/backup-import
@@ -6,9 +6,9 @@ VERSION="$1"
 IMPORT_DIR="$2"
 TARGET_DIR="$3"
 
-cd $IMPORT_DIR
+cd "$IMPORT_DIR"
 
 for file in */tls/server.*; do
-  mkdir -p "$(dirname $TARGET_DIR$file)"
-  cp $file $TARGET_DIR$file
+  mkdir -p "$(dirname "$TARGET_DIR$file")"
+  cp "$file" "$TARGET_DIR$file"
 done
diff --git a/plugins/nginx-vhosts/commands b/plugins/nginx-vhosts/commands
index 97aabc3416a..190a25a10a0 100755
--- a/plugins/nginx-vhosts/commands
+++ b/plugins/nginx-vhosts/commands
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-[[ " nginx:build-config nginx:access-logs nginx:error-logs help nginx:help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " nginx:build-config nginx:access-logs nginx:error-logs help nginx:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_AVAILABLE_PATH/config/functions"
@@ -8,7 +8,7 @@ source "$PLUGIN_AVAILABLE_PATH/nginx-vhosts/functions"
 case "$1" in
   nginx:build-config)
     [[ -z $2 ]] && echo "Please specify an app to run the command on" && exit 1
-    nginx_build_config $2
+    nginx_build_config "$2"
   ;;
 
   nginx:access-logs|nginx:error-logs)
@@ -25,7 +25,7 @@ EOF
   ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
   ;;
 
 esac
diff --git a/plugins/nginx-vhosts/functions b/plugins/nginx-vhosts/functions
index 16472c09170..40c6621a4c5 100755
--- a/plugins/nginx-vhosts/functions
+++ b/plugins/nginx-vhosts/functions
@@ -54,10 +54,10 @@ nginx_logs() {
 configure_nginx_ports() {
   local desc="configure nginx listening ports"
   local APP=$1; verify_app_name "$APP"
-  local RAW_TCP_PORTS="$(get_app_raw_tcp_ports $APP)"
-  local DOKKU_NGINX_PORT=$(config_get $APP DOKKU_NGINX_PORT)
-  local DOKKU_NGINX_SSL_PORT=$(config_get $APP DOKKU_NGINX_SSL_PORT)
-  local IS_APP_VHOST_ENABLED="$(is_app_vhost_enabled $APP)"
+  local RAW_TCP_PORTS="$(get_app_raw_tcp_ports "$APP")"
+  local DOKKU_NGINX_PORT=$(config_get "$APP" DOKKU_NGINX_PORT)
+  local DOKKU_NGINX_SSL_PORT=$(config_get "$APP" DOKKU_NGINX_SSL_PORT)
+  local IS_APP_VHOST_ENABLED="$(is_app_vhost_enabled "$APP")"
 
   if [[ -z "$DOKKU_NGINX_PORT" ]]; then
     if [[ -z "$RAW_TCP_PORTS" ]]; then
@@ -69,37 +69,37 @@ configure_nginx_ports() {
       fi
     fi
     if [[ -n "$NGINX_PORT" ]]; then
-      config_set --no-restart $APP DOKKU_NGINX_PORT="${NGINX_PORT}"
+      config_set --no-restart "$APP" DOKKU_NGINX_PORT="${NGINX_PORT}"
     fi
   fi
 
-  if (is_ssl_enabled $APP) && [[ -z "$DOKKU_NGINX_SSL_PORT" ]] && [[ -z "$RAW_TCP_PORTS" ]]; then
+  if (is_ssl_enabled "$APP") && [[ -z "$DOKKU_NGINX_SSL_PORT" ]] && [[ -z "$RAW_TCP_PORTS" ]]; then
     if [[ "$IS_APP_VHOST_ENABLED" == "false" ]]; then
       dokku_log_info1 "no nginx ssl port set. setting to random open high port"
       local NGINX_SSL_PORT=$(get_available_port)
     else
       local NGINX_SSL_PORT=443
     fi
-    config_set --no-restart $APP DOKKU_NGINX_SSL_PORT=${NGINX_SSL_PORT}
+    config_set --no-restart "$APP" DOKKU_NGINX_SSL_PORT="${NGINX_SSL_PORT}"
   fi
 }
 
 validate_ssl_domains() {
   local desc="check configured domains against SSL cert contents and show warning if mismatched"
   local APP=$1; verify_app_name "$APP"
-  local SSL_HOSTNAME=$(get_ssl_hostnames $APP)
+  local SSL_HOSTNAME=$(get_ssl_hostnames "$APP")
   local SSL_HOSTNAME_REGEX=$(echo "$SSL_HOSTNAME" | xargs | sed 's|\.|\\.|g' | sed 's/\*/\[^\.\]\*/g' | sed 's/ /|/g')
   local domain
 
-  if ! (egrep -q "^${SSL_HOSTNAME_REGEX}$" $VHOST_PATH &> /dev/null); then
+  if ! (egrep -q "^${SSL_HOSTNAME_REGEX}$" "$VHOST_PATH" &> /dev/null); then
     dokku_log_info1 "No matching configured domains for $APP found in SSL certificate. Your app will show as insecure in a browser if accessed via SSL"
     dokku_log_info1 "Please add appropriate domains via the dokku domains command"
     [[ -n "$NONSSL_VHOSTS" ]] && dokku_log_info1 "Configured domains for app:"
-    for domain in $(echo $NONSSL_VHOSTS| xargs); do
+    for domain in $(echo "$NONSSL_VHOSTS"| xargs); do
       dokku_log_info2 "$domain"
     done
     [[ -n "$SSL_HOSTNAME" ]] && dokku_log_info1 "Domains found in SSL certificate:"
-    for domain in $(echo $SSL_HOSTNAME | xargs); do
+    for domain in $(echo "$SSL_HOSTNAME" | xargs); do
       dokku_log_info2 "$domain"
     done
   fi
@@ -108,8 +108,8 @@ validate_ssl_domains() {
 get_custom_nginx_template() {
   local APP="$1"; verify_app_name "$APP"
   local DESTINATION="$2"
-  local IMAGE_TAG="$(get_running_image_tag $APP)"
-  local IMAGE=$(get_app_image_name $APP $IMAGE_TAG)
+  local IMAGE_TAG="$(get_running_image_tag "$APP")"
+  local IMAGE=$(get_app_image_name "$APP" "$IMAGE_TAG")
   local NGINX_TEMPLATE_NAME="nginx.conf.sigil"
 
   copy_from_image "$IMAGE" "$NGINX_TEMPLATE_NAME" "$DESTINATION" 2>/dev/null || true
@@ -124,10 +124,10 @@ nginx_build_config() {
   local DEFAULT_NGINX_TEMPLATE="$PLUGIN_AVAILABLE_PATH/nginx-vhosts/templates/$NGINX_TEMPLATE_NAME"
   local NGINX_TEMPLATE="$DEFAULT_NGINX_TEMPLATE"; local SCHEME=http
   local NGINX_TEMPLATE_SOURCE="built-in"; local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"
-  local RAW_TCP_PORTS="$(get_app_raw_tcp_ports $APP)"
+  local RAW_TCP_PORTS="$(get_app_raw_tcp_ports "$APP")"
 
-  local DOKKU_DISABLE_PROXY=$(config_get $APP DOKKU_DISABLE_PROXY)
-  local IS_APP_VHOST_ENABLED=$(is_app_vhost_enabled $APP)
+  local DOKKU_DISABLE_PROXY=$(config_get "$APP" DOKKU_DISABLE_PROXY)
+  local IS_APP_VHOST_ENABLED=$(is_app_vhost_enabled "$APP")
 
   if [[ -z "$DOKKU_DISABLE_PROXY" ]]; then
     if [[ -z "$DOKKU_APP_LISTEN_PORT" ]] && [[ -z "$DOKKU_APP_LISTEN_IP" ]]; then
@@ -135,25 +135,26 @@ nginx_build_config() {
       local DOKKU_APP_IP_FILE
       for DOKKU_APP_IP_FILE in $DOKKU_ROOT/$APP/IP.web.*; do
         local DOKKU_APP_PORT_FILE="${DOKKU_APP_IP_FILE//IP/PORT}"
-        local DOKKU_APP_LISTENER_IP=$(< $DOKKU_APP_IP_FILE)
-        local DOKKU_APP_LISTENER_PORT=$(< $DOKKU_APP_PORT_FILE)
+        local DOKKU_APP_LISTENER_IP=$(< "$DOKKU_APP_IP_FILE")
+        local DOKKU_APP_LISTENER_PORT=$(< "$DOKKU_APP_PORT_FILE")
 
         if [[ -z "$RAW_TCP_PORTS" ]]; then
           local DOKKU_APP_LISTENERS+=" $DOKKU_APP_LISTENER_IP:$DOKKU_APP_LISTENER_PORT "
         else
           local DOKKU_APP_LISTENERS+=" $DOKKU_APP_LISTENER_IP "
         fi
-        local DOKKU_APP_LISTENERS=$(echo $DOKKU_APP_LISTENERS | xargs)
+        local DOKKU_APP_LISTENERS=$(echo "$DOKKU_APP_LISTENERS" | xargs)
       done
       shopt -u nullglob
     elif [[ -n "$DOKKU_APP_LISTEN_PORT" ]] && [[ -n "$DOKKU_APP_LISTEN_IP" ]]; then
       local PASSED_LISTEN_IP_PORT=true
     fi
 
-    local TMPDIR=$(mktemp -d /tmp/nginx_template.XXXXX)
-    local NGINX_CONF=$(mktemp -p ${TMPDIR} -t "nginx.conf.XXXXXX")
+    local TMPDIR=$(mktemp -d /tmp/dokku_nginx_template.XXXXX)
+    local NGINX_CONF=$(mktemp -p "${TMPDIR}" -t "nginx.conf.XXXXXX")
     local CUSTOM_NGINX_TEMPLATE="$TMPDIR/$NGINX_TEMPLATE_NAME"
-    trap 'rm -rf "$NGINX_CONF $TMPDIR" > /dev/null' RETURN
+    # shellcheck disable=SC2086
+    trap 'rm -rf $NGINX_CONF $TMPDIR > /dev/null' RETURN INT TERM EXIT
 
     get_custom_nginx_template "$APP" "$CUSTOM_NGINX_TEMPLATE"
     if [[ -f "$CUSTOM_NGINX_TEMPLATE" ]]; then
@@ -164,23 +165,23 @@ nginx_build_config() {
 
     # setup nginx listen ports
     configure_nginx_ports "$APP"
-    local NGINX_PORT=$(config_get $APP DOKKU_NGINX_PORT)
-    local NGINX_SSL_PORT=$(config_get $APP DOKKU_NGINX_SSL_PORT)
+    local NGINX_PORT=$(config_get "$APP" DOKKU_NGINX_PORT)
+    local NGINX_SSL_PORT=$(config_get "$APP" DOKKU_NGINX_SSL_PORT)
 
     local NONSSL_VHOSTS=$(get_app_domains "$APP")
-    local NOSSL_SERVER_NAME=$(echo $NONSSL_VHOSTS | xargs)
+    local NOSSL_SERVER_NAME=$(echo "$NONSSL_VHOSTS" | xargs)
     if is_ssl_enabled "$APP"; then
       local SSL_INUSE=true; local SCHEME=https
       validate_ssl_domains "$APP"
-      local SSL_HOSTNAME=$(get_ssl_hostnames $APP)
+      local SSL_HOSTNAME=$(get_ssl_hostnames "$APP")
       local SSL_HOSTNAME_REGEX=$(echo "$SSL_HOSTNAME" | xargs | sed 's|\.|\\.|g' | sed 's/\*/\[^\.\]\*/g' | sed 's/ /|/g')
 
       if [[ "$IS_APP_VHOST_ENABLED" == "true" ]]; then
-        local SSL_VHOSTS=$(egrep "^${SSL_HOSTNAME_REGEX}$" $VHOST_PATH || true)
+        local SSL_VHOSTS=$(egrep "^${SSL_HOSTNAME_REGEX}$" "$VHOST_PATH" || true)
       else
-        local SSL_VHOSTS=$(< $DOKKU_ROOT/HOSTNAME)
+        local SSL_VHOSTS=$(< "$DOKKU_ROOT/HOSTNAME")
       fi
-      local SSL_SERVER_NAME=$(echo $SSL_VHOSTS | xargs)
+      local SSL_SERVER_NAME=$(echo "$SSL_VHOSTS" | xargs)
     fi
     local SIGIL_PARAMS=(-f $NGINX_TEMPLATE APP="$APP" DOKKU_ROOT="$DOKKU_ROOT"
           NOSSL_SERVER_NAME="$NOSSL_SERVER_NAME"
@@ -191,29 +192,29 @@ nginx_build_config() {
           NGINX_PORT="$NGINX_PORT" NGINX_SSL_PORT="$NGINX_SSL_PORT" RAW_TCP_PORTS="$RAW_TCP_PORTS")
 
     # execute sigil template processing
-    xargs -i echo "-----> Configuring {}...(using $NGINX_TEMPLATE_SOURCE template)" <<< "$(echo ${SSL_VHOSTS} ${NONSSL_VHOSTS} | tr ' ' '\n' | sort -u)"
+    xargs -i echo "-----> Configuring {}...(using $NGINX_TEMPLATE_SOURCE template)" <<< "$(echo "${SSL_VHOSTS}" "${NONSSL_VHOSTS}" | tr ' ' '\n' | sort -u)"
     # echo "sigil ${SIGIL_PARAMS[@]}"
-    sigil "${SIGIL_PARAMS[@]}" > $NGINX_CONF
+    sigil "${SIGIL_PARAMS[@]}" > "$NGINX_CONF"
 
     if is_deployed "$APP"; then
       dokku_log_info1 "Creating $SCHEME nginx.conf"
-      mv $NGINX_CONF "$DOKKU_ROOT/$APP/nginx.conf"
+      mv "$NGINX_CONF" "$DOKKU_ROOT/$APP/nginx.conf"
     else
       dokku_log_info1 "App $APP has not been deployed. Skipping nginx config creation"
-      rm -f $NGINX_CONF
+      rm -f "$NGINX_CONF"
     fi
 
     if is_deployed "$APP"; then
       dokku_log_info1 "Running nginx-pre-reload"
-      plugn trigger nginx-pre-reload $APP $DOKKU_APP_LISTEN_PORT $DOKKU_APP_LISTEN_IP
+      plugn trigger nginx-pre-reload "$APP" "$DOKKU_APP_LISTEN_PORT" "$DOKKU_APP_LISTEN_IP"
 
       dokku_log_verbose "Reloading nginx"
       validate_nginx && restart_nginx
     fi
 
     if ([[ -n "$NONSSL_VHOSTS" ]] || [[ -n "$SSL_VHOSTS" ]]) && [[ "$IS_APP_VHOST_ENABLED" == "true" ]]; then
-      echo "# THIS FILE IS GENERATED BY DOKKU - DO NOT EDIT, YOUR CHANGES WILL BE OVERWRITTEN" > $URLS_PATH
-      xargs -i echo "$SCHEME://{}" <<< "$(echo ${SSL_VHOSTS} ${NONSSL_VHOSTS} | tr ' ' '\n' | sort -u)" >> $URLS_PATH
+      echo "# THIS FILE IS GENERATED BY DOKKU - DO NOT EDIT, YOUR CHANGES WILL BE OVERWRITTEN" > "$URLS_PATH"
+      xargs -i echo "$SCHEME://{}" <<< "$(echo "${SSL_VHOSTS}" "${NONSSL_VHOSTS}" | tr ' ' '\n' | sort -u)" >> "$URLS_PATH"
     fi
   else
     # note because this clause is long. if $DOKKU_DISABLE_PROXY is set:
diff --git a/plugins/nginx-vhosts/post-deploy b/plugins/nginx-vhosts/post-deploy
index 9bc8ae8d62a..02a08a73dda 100755
--- a/plugins/nginx-vhosts/post-deploy
+++ b/plugins/nginx-vhosts/post-deploy
@@ -8,16 +8,16 @@ source "$PLUGIN_AVAILABLE_PATH/proxy/functions"
 nginx_post_deploy() {
   local APP="$1"
   if [[ -f "$DOKKU_ROOT/$APP/IP.web.1" ]] && [[ -f "$DOKKU_ROOT/$APP/PORT.web.1" ]]; then
-    if [[ "$(is_app_vhost_enabled $APP)" == "false" ]]; then
+    if [[ "$(is_app_vhost_enabled "$APP")" == "false" ]]; then
       dokku_log_info1 "VHOST support disabled. Skipping domains setup"
     elif [[ ! -f "$DOKKU_ROOT/$APP/VHOST" ]]; then
-      domains_setup $APP
+      domains_setup "$APP"
     fi
 
-    nginx_build_config $APP
+    nginx_build_config "$APP"
   fi
 }
 
-if [[ "$(get_app_proxy_type $1)" == "nginx" ]]; then
+if [[ "$(get_app_proxy_type "$1")" == "nginx" ]]; then
   nginx_post_deploy "$@"
 fi
diff --git a/plugins/nginx-vhosts/post-domains-update b/plugins/nginx-vhosts/post-domains-update
index ee1a4ab3064..ae25701220d 100755
--- a/plugins/nginx-vhosts/post-domains-update
+++ b/plugins/nginx-vhosts/post-domains-update
@@ -4,6 +4,6 @@ source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_AVAILABLE_PATH/nginx-vhosts/functions"
 source "$PLUGIN_AVAILABLE_PATH/proxy/functions"
 
-if [[ "$(get_app_proxy_type $1)" == "nginx" ]]; then
-  nginx_build_config $1
+if [[ "$(get_app_proxy_type "$1")" == "nginx" ]]; then
+  nginx_build_config "$1"
 fi
diff --git a/plugins/nginx-vhosts/proxy-disable b/plugins/nginx-vhosts/proxy-disable
index 50485a9a663..c70cd441d4b 100755
--- a/plugins/nginx-vhosts/proxy-disable
+++ b/plugins/nginx-vhosts/proxy-disable
@@ -8,9 +8,9 @@ nginx_disable() {
   local desc="disable nginx proxy"
   local APP="$1"; verify_app_name "$APP"
 
-  if [[ "$(get_app_proxy_type $APP)" == "nginx" ]]; then
-    disable_app_vhost $APP --no-restart
-    ps_restart $APP
+  if [[ "$(get_app_proxy_type "$APP")" == "nginx" ]]; then
+    disable_app_vhost "$APP" --no-restart
+    ps_restart "$APP"
   fi
 }
 
diff --git a/plugins/nginx-vhosts/proxy-enable b/plugins/nginx-vhosts/proxy-enable
index b99804b42d8..23ddb190d8b 100755
--- a/plugins/nginx-vhosts/proxy-enable
+++ b/plugins/nginx-vhosts/proxy-enable
@@ -8,9 +8,9 @@ nginx_enable() {
   local desc="enable nginx proxy"
   local APP="$1"; verify_app_name "$APP"
 
-  if [[ "$(get_app_proxy_type $APP)" == "nginx" ]]; then
-    enable_app_vhost $APP --no-restart
-    ps_restart $APP
+  if [[ "$(get_app_proxy_type "$APP")" == "nginx" ]]; then
+    enable_app_vhost "$APP" --no-restart
+    ps_restart "$APP"
   fi
 }
 
diff --git a/plugins/plugin/commands b/plugins/plugin/commands
index 2873a13e6d7..6916719e788 100755
--- a/plugins/plugin/commands
+++ b/plugins/plugin/commands
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-[[ " plugin plugin:install plugin:install-dependencies plugin:update plugin:disable plugin:enable plugin:uninstall help plugin:help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " plugin plugin:install plugin:install-dependencies plugin:update plugin:disable plugin:enable plugin:uninstall help plugin:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_AVAILABLE_PATH/plugin/functions"
@@ -74,7 +74,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/plugin/functions b/plugins/plugin/functions
index b5f345fd519..6003dcb6b19 100755
--- a/plugins/plugin/functions
+++ b/plugins/plugin/functions
@@ -7,7 +7,7 @@ disable_plugin() {
   [[ -e $PLUGIN_CORE_AVAILABLE_PATH/$PLUGIN ]] && dokku_log_fail "Cannot disable a core plugin"
   [[ ! -e $PLUGIN_ENABLED_PATH/$PLUGIN ]] && dokku_log_fail "Plugin already disabled"
   [[ ! -e $PLUGIN_AVAILABLE_PATH/$PLUGIN ]] && dokku_log_fail "Plugin does not exist"
-  plugn disable $PLUGIN
+  plugn disable "$PLUGIN"
   dokku_log_info1_quiet "Plugin $PLUGIN disabled"
 }
 
@@ -15,7 +15,7 @@ enable_plugin() {
   local PLUGIN="$1"
   [[ -e $PLUGIN_ENABLED_PATH/$PLUGIN ]] && dokku_log_fail "Plugin already enabled"
   [[ ! -e $PLUGIN_AVAILABLE_PATH/$PLUGIN ]] && dokku_log_fail "Plugin does not exist"
-  plugn enable $PLUGIN
+  plugn enable "$PLUGIN"
   dokku_log_info1_quiet "Plugin $PLUGIN enabled"
 }
 
@@ -64,7 +64,7 @@ uninstall_plugin() {
   local PLUGIN="$1"
   [[ -e $PLUGIN_CORE_AVAILABLE_PATH/$PLUGIN ]] && dokku_log_fail "Cannot uninstall a core plugin"
   [[ ! -e $PLUGIN_AVAILABLE_PATH/$PLUGIN ]] && dokku_log_fail "Plugin ($PLUGIN) is not currently installed"
-  plugn uninstall $PLUGIN
+  plugn uninstall "$PLUGIN"
   dokku_log_info1_quiet "Plugin $PLUGIN uninstalled"
 }
 
diff --git a/plugins/proxy/commands b/plugins/proxy/commands
index c49a573cb91..56062b805a2 100755
--- a/plugins/proxy/commands
+++ b/plugins/proxy/commands
@@ -1,27 +1,27 @@
 #!/usr/bin/env bash
-[[ " proxy proxy:set proxy:enable proxy:disable help proxy:help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " proxy proxy:set proxy:enable proxy:disable help proxy:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_AVAILABLE_PATH/proxy/functions"
 
 case "$1" in
   proxy)
-    proxy_main $2
+    proxy_main "$2"
     ;;
 
   proxy:set)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
-    proxy_set $2
+    proxy_set "$2"
     ;;
 
   proxy:enable)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
-    proxy_enable $2 --no-restart
+    proxy_enable "$2" --no-restart
     ;;
 
   proxy:disable)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
-    proxy_disable $2 --no-restart
+    proxy_disable "$2" --no-restart
     ;;
 
   help | proxy:help)
@@ -34,7 +34,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/proxy/functions b/plugins/proxy/functions
index a8799b99474..ad6935a466b 100755
--- a/plugins/proxy/functions
+++ b/plugins/proxy/functions
@@ -8,7 +8,7 @@ is_app_proxy_enabled() {
   local APP="$1"; verify_app_name "$APP"
   local APP_PROXY_ENABLED=true
 
-  local DOKKU_DISABLE_PROXY=$(config_get $APP DOKKU_DISABLE_PROXY)
+  local DOKKU_DISABLE_PROXY=$(config_get "$APP" DOKKU_DISABLE_PROXY)
   if [[ -n "$DOKKU_DISABLE_PROXY" ]]; then
     local APP_PROXY_ENABLED=false
   fi
@@ -34,7 +34,7 @@ proxy_main() {
   dokku_col_log_info1_quiet "App Name" "Proxy Type"
   for app in $APPS; do
     verify_app_name "$app"
-    dokku_col_log_msg "$app" "$(get_app_proxy_type $app)"
+    dokku_col_log_msg "$app" "$(get_app_proxy_type "$app")"
   done
 }
 
@@ -49,9 +49,10 @@ proxy_enable() {
   local desc="enable proxy for app"
   local APP="$1"; verify_app_name "$APP"
 
-  if [[ "$(is_app_proxy_enabled $APP)" == "false" ]]; then
+  if [[ "$(is_app_proxy_enabled "$APP")" == "false" ]]; then
     dokku_log_info1 "Enabling proxy for app ($APP)"
     [[ "$2" == "--no-restart" ]] && local CONFIG_SET_ARGS=$2
+    # shellcheck disable=SC2086
     config_unset $CONFIG_SET_ARGS $APP DOKKU_DISABLE_PROXY
     plugn trigger proxy-enable "$APP"
   else
@@ -63,9 +64,10 @@ proxy_disable() {
   local desc="disable proxy for app"
   local APP="$1"; verify_app_name "$APP"
 
-  if [[ "$(is_app_proxy_enabled $APP)" == "true" ]]; then
+  if [[ "$(is_app_proxy_enabled "$APP")" == "true" ]]; then
     dokku_log_info1 "Disabling proxy for app ($APP)"
     [[ "$2" == "--no-restart" ]] && local CONFIG_SET_ARGS=$2
+    # shellcheck disable=SC2086
     config_set $CONFIG_SET_ARGS $APP DOKKU_DISABLE_PROXY=1
     plugn trigger proxy-disable "$APP"
   else
diff --git a/plugins/ps/commands b/plugins/ps/commands
index b353a8d8e64..71472b8a199 100755
--- a/plugins/ps/commands
+++ b/plugins/ps/commands
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-[[ " ps ps:start ps:stop ps:rebuild ps:rebuildall ps:restart ps:restartall ps:restore ps:scale help ps:help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " ps ps:start ps:stop ps:rebuild ps:rebuildall ps:restart ps:restartall ps:restore ps:scale help ps:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_AVAILABLE_PATH/ps/functions"
@@ -7,47 +7,47 @@ source "$PLUGIN_AVAILABLE_PATH/ps/functions"
 case "$1" in
   ps)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
-    ps_main $2
+    ps_main "$2"
     ;;
 
   ps:start)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
-    ps_start $2
+    ps_start "$2"
     ;;
 
   ps:stop)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
-    ps_stop $2
+    ps_stop "$2"
     ;;
 
   ps:rebuild)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
-    ps_rebuild $2
+    ps_rebuild "$2"
     ;;
 
   ps:rebuildall)
     for app in $(dokku_apps); do
-      is_deployed $app && ps_rebuild $app
+      is_deployed "$app" && ps_rebuild "$app"
     done
     ;;
 
   ps:restart)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
-    ps_restart $2
+    ps_restart "$2"
     ;;
 
   ps:restartall)
     for app in $(dokku_apps); do
-      ps_restart $app
+      ps_restart "$app"
     done
     ;;
 
   ps:restore)
     for app in $(dokku_apps); do
-      DOKKU_APP_RESTORE=$(dokku config:get $app DOKKU_APP_RESTORE || true)
+      DOKKU_APP_RESTORE=$(dokku config:get "$app" DOKKU_APP_RESTORE || true)
       if [[ $DOKKU_APP_RESTORE != 0 ]]; then
         echo "Restoring app $app ..."
-        ps_start $app
+        ps_start "$app"
       fi
     done
   ;;
@@ -73,7 +73,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/ps/functions b/plugins/ps/functions
index 35d021da30b..7bf9d6bee69 100755
--- a/plugins/ps/functions
+++ b/plugins/ps/functions
@@ -11,8 +11,8 @@ print_dokku_scale_file() {
 
 extract_procfile() {
   local APP="$1"
-  local IMAGE_TAG="$(get_running_image_tag $APP)"
-  local IMAGE="$(get_app_image_name $APP $IMAGE_TAG)"
+  local IMAGE_TAG="$(get_running_image_tag "$APP")"
+  local IMAGE="$(get_app_image_name "$APP" "$IMAGE_TAG")"
   local DOKKU_PROCFILE="$DOKKU_ROOT/$APP/DOKKU_PROCFILE"
   verify_app_name "$APP"
 
@@ -32,7 +32,7 @@ remove_procfile() {
 }
 
 generate_scale_file() {
-  local APP="$1"; local IMAGE_TAG="$2"; local IMAGE=$(get_app_image_name $APP $IMAGE_TAG); local DOKKU_SCALE_FILE="$DOKKU_ROOT/$APP/DOKKU_SCALE"
+  local APP="$1"; local IMAGE_TAG="$2"; local IMAGE=$(get_app_image_name "$APP" "$IMAGE_TAG"); local DOKKU_SCALE_FILE="$DOKKU_ROOT/$APP/DOKKU_SCALE"
   local DOKKU_PROCFILE="$DOKKU_ROOT/$APP/DOKKU_PROCFILE"
   verify_app_name "$APP"
 
@@ -40,7 +40,7 @@ generate_scale_file() {
   if [[ ! -f $DOKKU_SCALE_FILE ]]; then
     dokku_log_info1_quiet "DOKKU_SCALE file not found in app image. Generating one based on Procfile..."
 
-    TMP_WORK_DIR=$(mktemp -d)
+    TMP_WORK_DIR=$(mktemp -d -t "dokku_scale.XXXX")
     trap 'rm -rf "$TMP_WORK_DIR" > /dev/null' RETURN
 
     if [[ -f $DOKKU_PROCFILE ]]; then
@@ -51,16 +51,16 @@ generate_scale_file() {
         NAME=${line%%:*}
         NUM_PROCS=0
         [[ "$NAME" == "web" ]] && NUM_PROCS=1
-        [[ -n "$NAME" ]] && echo "$NAME=$NUM_PROCS" >> $DOKKU_SCALE_FILE
-      done < $DOKKU_PROCFILE
+        [[ -n "$NAME" ]] && echo "$NAME=$NUM_PROCS" >> "$DOKKU_SCALE_FILE"
+      done < "$DOKKU_PROCFILE"
     else
-      echo "web=1" >> $DOKKU_SCALE_FILE
+      echo "web=1" >> "$DOKKU_SCALE_FILE"
     fi
     dokku_log_info1_quiet "New DOKKU_SCALE file generated"
   else
     dokku_log_info1_quiet "DOKKU_SCALE file found ($DOKKU_SCALE_FILE)"
   fi
-  print_dokku_scale_file $APP
+  print_dokku_scale_file "$APP"
 }
 
 set_scale() {
@@ -72,34 +72,35 @@ set_scale() {
     PROC_COUNT=${procscale#*=}
     is_number $PROC_COUNT || dokku_log_fail "ps:scale $PROC_COUNT is not a number"
     dokku_log_info1_quiet "Scaling $APP:$PROC_NAME to $PROC_COUNT"
-    if (egrep -q ^${PROC_NAME}= $DOKKU_SCALE_FILE > /dev/null 2>&1); then
-      sed --in-place "s:^${PROC_NAME}=.*:$PROC_NAME=$PROC_COUNT:g" $DOKKU_SCALE_FILE
+    if (egrep -q ^${PROC_NAME}= "$DOKKU_SCALE_FILE" > /dev/null 2>&1); then
+      sed --in-place "s:^${PROC_NAME}=.*:$PROC_NAME=$PROC_COUNT:g" "$DOKKU_SCALE_FILE"
     else
-      echo "$PROC_NAME=$PROC_COUNT" >> $DOKKU_SCALE_FILE
+      echo "$PROC_NAME=$PROC_COUNT" >> "$DOKKU_SCALE_FILE"
     fi
   done
 }
 
 ps_main() {
   local APP="$1"; verify_app_name "$APP"
-  local DOKKU_APP_RUNNING_CONTAINER_IDS=$(get_app_running_container_ids $APP)
+  local DOKKU_APP_RUNNING_CONTAINER_IDS=$(get_app_running_container_ids "$APP")
 
-  ! (is_deployed $APP) && echo "App $APP has not been deployed" && exit 0
+  ! (is_deployed "$APP") && echo "App $APP has not been deployed" && exit 0
 
   for CID in $DOKKU_APP_RUNNING_CONTAINER_IDS; do
     has_tty && DOKKU_RUN_OPTS="-i -t"
     dokku_log_info1_quiet "running processes in container: $CID"
+    # shellcheck disable=SC2086
     docker exec $DOKKU_RUN_OPTS $CID /bin/sh -c "ps auxwww"
   done
 }
 
 ps_start() {
   local APP="$1"; verify_app_name "$APP"
-  local IMAGE_TAG=$(get_running_image_tag $APP);
+  local IMAGE_TAG=$(get_running_image_tag "$APP");
 
-  ! (is_deployed $APP) && echo "App $APP has not been deployed" && exit 0
+  ! (is_deployed "$APP") && echo "App $APP has not been deployed" && exit 0
 
-  if ! (is_app_running $APP); then
+  if ! (is_app_running "$APP"); then
     release_and_deploy "$APP" "$IMAGE_TAG"
   else
     echo "App $APP already running"
@@ -108,14 +109,15 @@ ps_start() {
 
 ps_stop() {
   local APP="$1"; verify_app_name "$APP"
-  local DOKKU_APP_RUNNING_CONTAINER_IDS=$(get_app_running_container_ids $APP)
+  local DOKKU_APP_RUNNING_CONTAINER_IDS=$(get_app_running_container_ids "$APP")
 
-  ! (is_deployed $APP) && echo "App $APP has not been deployed" && exit 0
+  ! (is_deployed "$APP") && echo "App $APP has not been deployed" && exit 0
 
   if [[ -n "$DOKKU_APP_RUNNING_CONTAINER_IDS" ]]; then
     echo "Stopping $APP ..."
+    # shellcheck disable=SC2086
     docker stop $DOKKU_APP_RUNNING_CONTAINER_IDS > /dev/null || true
-    plugn trigger post-stop $APP
+    plugn trigger post-stop "$APP"
   else
     echo "App $APP already stopped"
   fi
@@ -124,21 +126,21 @@ ps_stop() {
 ps_rebuild() {
   local APP="$1"; verify_app_name "$APP"
 
-  plugn trigger receive-app $APP
+  plugn trigger receive-app "$APP"
 }
 
 ps_restart() {
   local APP="$1"; verify_app_name "$APP"
-  local IMAGE_TAG=$(get_running_image_tag $APP)
+  local IMAGE_TAG=$(get_running_image_tag "$APP")
 
-  ! (is_deployed $APP) && echo "App $APP has not been deployed" && exit 0
+  ! (is_deployed "$APP") && echo "App $APP has not been deployed" && exit 0
 
   release_and_deploy "$APP" "$IMAGE_TAG"
 }
 
 ps_scale() {
   local APP="$1"; verify_app_name "$APP"
-  local IMAGE_TAG=$(get_running_image_tag $APP)
+  local IMAGE_TAG=$(get_running_image_tag "$APP")
   local DOKKU_SCALE_FILE="$DOKKU_ROOT/$APP/DOKKU_SCALE"
   shift 1
 
diff --git a/plugins/ps/post-deploy b/plugins/ps/post-deploy
index 3a8338f4dac..07deb042896 100755
--- a/plugins/ps/post-deploy
+++ b/plugins/ps/post-deploy
@@ -6,4 +6,4 @@ source "$PLUGIN_AVAILABLE_PATH/ps/functions"
 APP="$1"
 
 remove_procfile "$APP"
-dokku config:set --no-restart $APP DOKKU_APP_RESTORE=1
+dokku config:set --no-restart "$APP" DOKKU_APP_RESTORE=1
diff --git a/plugins/ps/post-stop b/plugins/ps/post-stop
index 1f88be9b836..d2d156c2acf 100755
--- a/plugins/ps/post-stop
+++ b/plugins/ps/post-stop
@@ -5,4 +5,4 @@ source "$PLUGIN_AVAILABLE_PATH/ps/functions"
 
 APP="$1"
 
-dokku config:set --no-restart $APP DOKKU_APP_RESTORE=0
+dokku config:set --no-restart "$APP" DOKKU_APP_RESTORE=0
diff --git a/plugins/shell/commands b/plugins/shell/commands
index 134a4ac5aee..182c33b95ce 100755
--- a/plugins/shell/commands
+++ b/plugins/shell/commands
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-[[ " shell help shell:help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " shell help shell:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 
 case "$1" in
@@ -23,8 +23,8 @@ case "$1" in
       }
       trap - SIGINT
 
-      line=$(echo $line | trim)
-      CMD=$(echo $line | awk '{ print $1 }')
+      line=$(echo "$line" | trim)
+      CMD=$(echo "$line" | awk '{ print $1 }')
 
       [[ -z $CMD ]] && continue
 
@@ -42,7 +42,7 @@ case "$1" in
 
         # Not a built-in, run as regular dokku command
         *)
-          dokku $line || true
+          dokku "$line" || true
       esac
 
     done
@@ -55,7 +55,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/tags/commands b/plugins/tags/commands
index 53335141698..5d76164a807 100755
--- a/plugins/tags/commands
+++ b/plugins/tags/commands
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-[[ " tags tags:create tags:deploy tags:destroy help tags:help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " tags tags:create tags:deploy tags:destroy help tags:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 source "$PLUGIN_AVAILABLE_PATH/tags/functions"
@@ -7,7 +7,7 @@ source "$PLUGIN_AVAILABLE_PATH/tags/functions"
 case "$1" in
   tags)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
-    APP="$2"; IMAGE_REPO=$(get_app_image_repo $APP)
+    APP="$2"; IMAGE_REPO=$(get_app_image_repo "$APP")
     verify_app_name "$APP"
 
     dokku_log_info2_quiet "Image tags for $IMAGE_REPO"
@@ -16,12 +16,12 @@ case "$1" in
 
   tags:create)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
-    APP="$2"; IMAGE_TAG="$3"; IMAGE_REPO=$(get_app_image_repo $APP)
+    APP="$2"; IMAGE_TAG="$3"; IMAGE_REPO=$(get_app_image_repo "$APP")
     verify_app_name "$APP"
 
     tag_image "$IMAGE_REPO:latest" "$IMAGE_REPO:$IMAGE_TAG"
     dokku_log_info2_quiet "Added $IMAGE_TAG tag to $IMAGE_REPO"
-    plugn trigger tags-create $APP $IMAGE_TAG
+    plugn trigger tags-create "$APP" "$IMAGE_TAG"
     ;;
 
   tags:deploy)
@@ -29,12 +29,12 @@ case "$1" in
     APP="$2"; IMAGE_TAG="$3"
     verify_app_name "$APP"
 
-    release_and_deploy $APP $IMAGE_TAG
+    release_and_deploy "$APP" "$IMAGE_TAG"
     ;;
 
   tags:destroy)
     [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
-    APP="$2"; IMAGE_TAG="$3"; IMAGE_REPO=$(get_app_image_repo $APP)
+    APP="$2"; IMAGE_TAG="$3"; IMAGE_REPO=$(get_app_image_repo "$APP")
     verify_app_name "$2"
 
     case "$IMAGE_TAG" in
@@ -46,7 +46,7 @@ case "$1" in
         docker rmi "$IMAGE_REPO:$IMAGE_TAG"
         ;;
     esac
-    plugn trigger tags-destroy $APP $IMAGE_TAG
+    plugn trigger tags-destroy "$APP" "$IMAGE_TAG"
     ;;
 
   help | tags:help)
@@ -59,7 +59,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/tar/commands b/plugins/tar/commands
index cb2d4b4210d..4d6eaa4887b 100755
--- a/plugins/tar/commands
+++ b/plugins/tar/commands
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-[[ " tar-from tar:from tar-in tar:in tar-build tar-build-locked help tar:help " == *" $1 "* ]] || exit $DOKKU_NOT_IMPLEMENTED_EXIT
+[[ " tar-from tar:from tar-in tar:in tar-build tar-build-locked help tar:help " == *" $1 "* ]] || exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 
@@ -9,14 +9,14 @@ case "$1" in
     APP=$2
     URL=$3
     shift 3
-    curl -# --insecure -L "$URL" | dokku tar-in $APP "$@"
+    curl -# --insecure -L "$URL" | dokku tar-in "$APP" "$@"
     ;;
 
   tar-in|tar:in)
     APP="$2"
     verify_app_name "$2"
     tee "$DOKKU_ROOT/$APP/src.tar" | wc -c
-    plugn trigger receive-app $APP
+    plugn trigger receive-app "$APP"
     ;;
 
   tar-build)
@@ -35,12 +35,12 @@ case "$1" in
     shift 2
 
     # clean up after ourselves
-    TMP_WORK_DIR=$(mktemp -d)
-    trap 'rm -rf "$TMP_WORK_DIR" > /dev/null' RETURN
+    TMP_WORK_DIR=$(mktemp -d -t "dokku_tar.XXXX")
+    trap 'rm -rf "$TMP_WORK_DIR" > /dev/null' INT TERM EXIT
 
     # extract tar file
-    chmod 755 $TMP_WORK_DIR
-    pushd $TMP_WORK_DIR > /dev/null
+    chmod 755 "$TMP_WORK_DIR"
+    pushd "$TMP_WORK_DIR" > /dev/null
 
     # Detect a common prefix that all files in the tar have, and strip off each directory found in it
     COMMON_PREFIX=$(tar -tf "$DOKKU_ROOT/$APP/src.tar" | sed -e 'N;s/^\(.*\).*\n\1.*$/\1\n\1/;D')
@@ -48,7 +48,7 @@ case "$1" in
 
     dokku_log_info1_quiet "Striping $BOGUS_PARTS worth of directories from tarball"
 
-    tar -x -C "$TMP_WORK_DIR" -f "$DOKKU_ROOT/$APP/src.tar" --strip-components=$BOGUS_PARTS
+    tar -x -C "$TMP_WORK_DIR" -f "$DOKKU_ROOT/$APP/src.tar" --strip-components="$BOGUS_PARTS"
     chmod -R u+r "$TMP_WORK_DIR"
 
     if [[ -f Dockerfile ]] && [[ "$([[ -f .env ]] && grep -q BUILDPACK_URL .env; echo $?)" != "0" ]] && [[ ! -f ".buildpacks" ]]; then
@@ -68,7 +68,7 @@ EOF
     ;;
 
   *)
-    exit $DOKKU_NOT_IMPLEMENTED_EXIT
+    exit "$DOKKU_NOT_IMPLEMENTED_EXIT"
     ;;
 
 esac
diff --git a/plugins/tar/receive-app b/plugins/tar/receive-app
index 57a379f1d4c..99ab6201702 100755
--- a/plugins/tar/receive-app
+++ b/plugins/tar/receive-app
@@ -8,5 +8,5 @@ APP="$1"; REV="$2"
 if [[ ! -f "$DOKKU_ROOT/$APP/src.tar" ]]; then
   true
 else
-  dokku tar-build $APP
+  dokku tar-build "$APP"
 fi
diff --git a/tests.mk b/tests.mk
index 7c50ac4781a..2ad8b345da8 100644
--- a/tests.mk
+++ b/tests.mk
@@ -68,10 +68,8 @@ endif
 lint:
 	# these are disabled due to their expansive existence in the codebase. we should clean it up though
 	# SC2034: VAR appears unused - https://github.com/koalaman/shellcheck/wiki/SC2034
-	# SC2086: Double quote to prevent globbing and word splitting - https://github.com/koalaman/shellcheck/wiki/SC2086
 	@echo linting...
-	@$(QUIET) shellcheck ./contrib/dokku_client.sh
-	@$(QUIET) find . -not -path '*/\.*' | xargs file | egrep "shell|bash" | egrep -v "directory|toml" | awk '{ print $$1 }' | sed 's/://g' | grep -v dokku_client.sh | xargs shellcheck -e SC2034,SC2086
+	@$(QUIET) find . -not -path '*/\.*' -not -path './debian/*' -type f | xargs file | grep text | awk -F ':' '{ print $$1 }' | xargs head -n1 | egrep -B1 "bash" | grep "==>" | awk '{ print $$2 }' | xargs shellcheck -e SC2034
 
 unit-tests:
 	@echo running unit tests...
diff --git a/tests/apps/clojure/check_deploy b/tests/apps/clojure/check_deploy
index 87e1cf9ad72..fa1f6e489f6 100755
--- a/tests/apps/clojure/check_deploy
+++ b/tests/apps/clojure/check_deploy
@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-set -e; sleep 5; output="$(curl -s -S $1)"; echo $output; test "$output" == "Hello World!"
+set -e; sleep 5; output="$(curl -s -S "$1")"; echo "$output"; test "$output" == "Hello World!"
diff --git a/tests/apps/dockerfile-noexpose/check_deploy b/tests/apps/dockerfile-noexpose/check_deploy
index 63a809e1f38..b652fb8f6dd 100755
--- a/tests/apps/dockerfile-noexpose/check_deploy
+++ b/tests/apps/dockerfile-noexpose/check_deploy
@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-set -e; output="$(curl -s -S $1)"; echo $output; test "$output" == "Hello World!"
+set -e; output="$(curl -s -S "$1")"; echo "$output"; test "$output" == "Hello World!"
diff --git a/tests/apps/dockerfile/check_deploy b/tests/apps/dockerfile/check_deploy
index 63a809e1f38..b652fb8f6dd 100755
--- a/tests/apps/dockerfile/check_deploy
+++ b/tests/apps/dockerfile/check_deploy
@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-set -e; output="$(curl -s -S $1)"; echo $output; test "$output" == "Hello World!"
+set -e; output="$(curl -s -S "$1")"; echo "$output"; test "$output" == "Hello World!"
diff --git a/tests/apps/gitsubmodules/check_deploy b/tests/apps/gitsubmodules/check_deploy
index 63a809e1f38..b652fb8f6dd 100755
--- a/tests/apps/gitsubmodules/check_deploy
+++ b/tests/apps/gitsubmodules/check_deploy
@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-set -e; output="$(curl -s -S $1)"; echo $output; test "$output" == "Hello World!"
+set -e; output="$(curl -s -S "$1")"; echo "$output"; test "$output" == "Hello World!"
diff --git a/tests/apps/java/check_deploy b/tests/apps/java/check_deploy
index 837b16b228d..aad082553e7 100755
--- a/tests/apps/java/check_deploy
+++ b/tests/apps/java/check_deploy
@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-set -e; output="$(curl -s -S $1)"; echo $output; test "$output" == "Hello from Java!"
+set -e; output="$(curl -s -S "$1")"; echo "$output"; test "$output" == "Hello from Java!"
diff --git a/tests/apps/scala/check_deploy b/tests/apps/scala/check_deploy
index 982d596fc74..40c0692c62f 100755
--- a/tests/apps/scala/check_deploy
+++ b/tests/apps/scala/check_deploy
@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-set -e; output="$(curl -s -S $1)"; echo $output; test "$output" == "Hello from Scala!"
+set -e; output="$(curl -s -S "$1")"; echo "$output"; test "$output" == "Hello from Scala!"
diff --git a/tests/ci/receiver b/tests/ci/receiver
deleted file mode 100755
index f692f275b5b..00000000000
--- a/tests/ci/receiver
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-set -eo pipefail
-
-export PATH=/usr/local/sbin:/usr/sbin:/sbin:/bin:/usr/bin:/usr/local/bin
-unset GIT_DIR
-
-if [[ $2 == *dokku* ]]; then
-  date -uIseconds
-  rm -rf /tmp/build
-  mkdir /tmp/build
-  cd /tmp/build
-  tar -xf -
-  echo "-----> Installing dependencies"
-  DEBIAN_FRONTEND=noninteractive apt-get install -qq -y git make curl software-properties-common
-  echo "-----> Set hostname to dokku.me"
-  hostname dokku.me
-	echo "-----> Enabling tracing"
-	mkdir -p /home/dokku
-	echo "export DOKKU_TRACE=1" >> /home/dokku/dokkurc
-  echo "-----> Running make install"
-  DEBIAN_FRONTEND=noninteractive make install
-  echo "-----> Generating keypair..."
-  echo -e  "y\n" | ssh-keygen -f /root/.ssh/id_rsa -t rsa -N ''
-  echo "-----> Installing SSH public key..."
-  PUBLIC_KEY=$(< /root/.ssh/id_rsa.pub)
-  echo $PUBLIC_KEY | sudo sshcommand acl-add dokku test
-  echo "-----> Intitial SSH connection to populate known_hosts..."
-  ssh -o StrictHostKeyChecking=no dokku@dokku.me help > /dev/null
-  echo "-----> Running tests"
-  cd tests
-  for app_path in apps/*; do
-    app=$(basename $app_path)
-    echo "-----> Running test deploy of $app..."
-   ./test_deploy $app_path dokku.me $FORWARDED_PORT
-  done
-else
-  echo "-----> Repository invalid."
-fi
diff --git a/tests/ci/setup.sh b/tests/ci/setup.sh
deleted file mode 100755
index d0a9656421a..00000000000
--- a/tests/ci/setup.sh
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-set -eo pipefail
-
-export DEBIAN_FRONTEND=noninteractive
-apt-get install -qq -y git make curl
-
-cd /tmp
-
-wget http://j.mp/godeb
-tar -zxvf ./godeb
-./godeb install 1.1.2
-
-export GOPATH=/root/go
-git clone https://github.com/flynn/gitreceive-next.git
-cd gitreceive-next && make install
-
-ssh-keygen -f $HOME/.ssh/id_rsa -t rsa -N ''
-
-cat<<EOF > /etc/init/gitreceived.conf
-start on runlevel [2345]
-exec /usr/local/bin/gitreceived -p 2022 -n /root/.ssh/id_rsa /tmp/receiver
-EOF
-
-cat<<EOF > /etc/rc.local
-curl https://raw.githubusercontent.com/dokku/dokku/master/tests/ci/receiver -s > /tmp/receiver
-chmod +x /tmp/receiver
-EOF
diff --git a/tests/ci/unit_test_runner.sh b/tests/ci/unit_test_runner.sh
index 2cd735df318..d3f632bd94c 100755
--- a/tests/ci/unit_test_runner.sh
+++ b/tests/ci/unit_test_runner.sh
@@ -15,8 +15,9 @@ usage() {
 }
 
 BATCH_NUM="$1"
-is_number $BATCH_NUM || usage
+is_number "$BATCH_NUM" || usage
 
-TESTS=$(find "$(dirname $0)"/../unit -maxdepth 1 -name "${BATCH_NUM}0*.bats" | sort -n | xargs)
+TESTS=$(find "$(dirname "$0")/../unit" -maxdepth 1 -name "${BATCH_NUM}0*.bats" | sort -n | xargs)
 echo "running the following tests $TESTS"
+# shellcheck disable=SC2086
 bats $TESTS
diff --git a/tests/run_ec2 b/tests/run_ec2
deleted file mode 100755
index 550d1272f90..00000000000
--- a/tests/run_ec2
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/usr/bin/env bash
-set -eo pipefail
-KEYNAME="$1"
-indent() { sed "s/^/       /"; }
-echo "-----> Booting EC2 instance..."
-start=$(ec2-run-instances -k $1 ami-f3d1bb9a 2>&1 )
-if [[ $? -gt 0 ]]; then
-  echo "$start" | indent
-  exit 3
-fi
-INSTANCE=$(echo "$start" | awk '/^INSTANCE/ {print $2}')
-terminate() {
-  echo "-----> Terminating $INSTANCE..."
-  ec2-terminate-instances $INSTANCE &>/dev/null && echo "       Shutting down"
-}
-[[ $NOCLEANUP ]] || trap "terminate" EXIT
-sleep 30
-status=""
-while [[ "$status" != "running" ]]; do
-    info=$(ec2-describe-instances 2>/dev/null | grep $INSTANCE)
-    status=$(echo "$info" | cut -f 6 | grep run)
-    echo "       Waiting..."
-    sleep 5
-    if [[ $status == "running" ]]; then
-        echo "-----> $INSTANCE has succesfully booted!"
-        break
-    fi
-done
-PUBLIC_IP=$(echo "$info" | awk '{print $14}')
-echo "-----> Waiting for SSH at $PUBLIC_IP..."
-while [[ ! $(echo | nc $PUBLIC_IP 22) ]]; do
-  sleep 5
-  echo "       Waiting..."
-done
-set -e
-echo "-----> Connecting and running bootstrap script..."
-ssh -o "StrictHostKeyChecking=no" ubuntu@$PUBLIC_IP "HOSTNAME=\$PUBLIC_IP sudo bash" < ../bootstrap.sh 2>&1 | indent
-echo "-----> Installing SSH public keys..."
-PUBLIC_KEY=$(< ~/.ssh/id_rsa.pub)
-echo $PUBLIC_KEY | ssh -o "StrictHostKeyChecking=no" ubuntu@$PUBLIC_IP "sudo sshcommand acl-add dokku test" > /dev/null
-for app_path in apps/*; do
-  app=$(basename $app_path)
-  echo "-----> Running test deploy of $app..."
-  ./test_deploy $app_path $PUBLIC_IP
-done
diff --git a/tests/run_vagrant b/tests/run_vagrant
deleted file mode 100755
index 48a71059b94..00000000000
--- a/tests/run_vagrant
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-set -eo pipefail
-SELF=$(which $0)
-VAGRANT_SSH_PORT=${VAGRANT_SSH_PORT:-"2222"}
-PUBLIC_KEY=${PUBLIC_KEY:-"$HOME/.ssh/id_rsa.pub"}
-FORWARDED_PORT=${FORWARDED_PORT:-":8080"}
-indent() { sed "s/^/       /"; }
-if ! grep dokku.me ~/.ssh/config 2>/dev/null; then
-  echo "-----> Configuring SSH to use $VAGRANT_SSH_PORT for dokku.me..."
-  touch ~/.ssh/config
-  {
-    echo "Host dokku.me"
-    echo "    Port $VAGRANT_SSH_PORT"
-    echo "    RequestTTY yes"
-  } >> ~/.ssh/config
-fi
-echo "-----> Ensuring Vagrant is running..."
-pushd $PWD > /dev/null
-cd "$(dirname $SELF)/.." && vagrant up | indent
-popd > /dev/null
-
-echo "-----> Installing SSH public keys..."
-ssh -o "StrictHostKeyChecking=no" -i ~/.vagrant.d/insecure_private_key vagrant@dokku.me "sudo sshcommand acl-add dokku test" < $PUBLIC_KEY
-
-for app_path in apps/*; do
-  app=$(basename $app_path)
-  echo "-----> Running test deploy of $app..."
-  ./test_deploy $app_path dokku.me $FORWARDED_PORT
-done
diff --git a/tests/test_deploy b/tests/test_deploy
index 07b0a27e4fd..233a17bac00 100755
--- a/tests/test_deploy
+++ b/tests/test_deploy
@@ -1,12 +1,13 @@
 #!/usr/bin/env bash
 set -xeo pipefail
 
-SELF=$(which $0); APP="$1"; TARGET="$2"; FORWARDED_PORT="$3"; SHOULD_FAIL="$4"
+SELF=$(which "$0"); APP="$1"; TARGET="$2"; FORWARDED_PORT="$3"; SHOULD_FAIL="$4"
 REMOTE="dokku@$TARGET"
-REPO="test-$(basename $APP)-$RANDOM"
+REPO="test-$(basename "$APP")-$RANDOM"
 
 destroy_app() {
-  echo $REPO | ssh $REMOTE apps:destroy $REPO
+  # shellcheck disable=SC2029
+  echo "$REPO" | ssh "$REMOTE" apps:destroy "$REPO"
 }
 
 failed() {
@@ -22,17 +23,17 @@ succeeded() {
 }
 
 TMP=$(mktemp -d -t "$TARGET.XXXXX")
-rmdir $TMP && cp -r "$(dirname "$SELF")"/$APP $TMP
-cd $TMP
+rmdir "$TMP" && cp -r "$(dirname "$SELF")/$APP" "$TMP"
+cd "$TMP"
 git init
 git config user.email "robot@example.com"
 git config user.name "Test Robot"
-git remote add target $REMOTE:$REPO
+git remote add target "${REMOTE}:${REPO}"
 
 [[ -f gitignore ]] && mv gitignore .gitignore
 git add .
 
-[[ -x pre-commit ]] && ./pre-commit $REMOTE $REPO
+[[ -x pre-commit ]] && ./pre-commit "$REMOTE" "$REPO"
 git commit -m 'initial commit'
 if [[ "$SHOULD_FAIL" == true ]]; then
   git push target master && succeeded git-push
@@ -40,7 +41,7 @@ else
   git push target master || failed git-push
 fi
 if [[ -x post-deploy ]]; then
-  ./post-deploy $REMOTE $REPO || failed post-deploy
+  ./post-deploy "$REMOTE" "$REPO" || failed post-deploy
 fi
 
 if [[ "$SHOULD_FAIL" == true ]]; then
@@ -49,13 +50,13 @@ if [[ "$SHOULD_FAIL" == true ]]; then
   exit 0
 fi
 
-URL=$(dokku url $REPO)$FORWARDED_PORT
+URL=$(dokku url "$REPO")$FORWARDED_PORT
 sleep 2
-if (./check_deploy $URL); then
+if (./check_deploy "$URL"); then
   echo "-----> Deploy success!"
 else
   sleep 4
-  if (./check_deploy $URL); then
+  if (./check_deploy "$URL"); then
     echo "-----> Deploy success!"
   else
     failed check-deploy
diff --git a/tests/unit/10_core_1.bats b/tests/unit/10_core_1.bats
index 5b2272b7a2a..a1eeef9a7f8 100644
--- a/tests/unit/10_core_1.bats
+++ b/tests/unit/10_core_1.bats
@@ -11,6 +11,7 @@ teardown() {
   rm -rf /home/dokku/$TEST_APP/tls /home/dokku/tls
   destroy_app
   dokku config:unset --global DOKKU_RM_CONTAINER
+  rm -f "$DOCKERFILE"
 }
 
 assert_urls() {
diff --git a/tests/unit/10_tar.bats b/tests/unit/10_tar.bats
index 2a094238b89..20a061ffedf 100644
--- a/tests/unit/10_tar.bats
+++ b/tests/unit/10_tar.bats
@@ -13,8 +13,11 @@ teardown() {
 deploy_app_tar() {
   APP_TYPE="$1"; APP_TYPE=${APP_TYPE:="nodejs-express"}
   TMP=$(mktemp -d -t "dokku.me.XXXXX")
-  rmdir $TMP && cp -r ./tests/apps/$APP_TYPE $TMP
-  cd $TMP
+
+  rmdir "$TMP" && cp -r "./tests/apps/$APP_TYPE" "$TMP"
+  pushd "$TMP" &> /dev/null || exit 1
+  trap 'popd &> /dev/null || true; rm -rf "$TMP"' RETURN INT TERM
+
   shift 1
   tar c . $* | ssh dokku@dokku.me tar:in $TEST_APP || destroy_app $?
   sleep 5 # nginx needs some time to itself...
diff --git a/tests/unit/test_helper.bash b/tests/unit/test_helper.bash
index 1756830bdd9..ca61fdc20bf 100644
--- a/tests/unit/test_helper.bash
+++ b/tests/unit/test_helper.bash
@@ -67,7 +67,7 @@ assert_output_contains() {
     input="${input/$expected/}"
     let found+=1
   done
-  assert_equal $count $found
+  assert_equal "$count" "$found"
 }
 
 # ShellCheck doesn't know about $lines from Bats
@@ -118,27 +118,27 @@ create_app() {
 destroy_app() {
   local RC="$1"; local RC=${RC:=0}
   dokku --force apps:destroy $TEST_APP
-  return $RC
+  return "$RC"
 }
 
 add_domain() {
-  dokku domains:add $TEST_APP $1
+  dokku domains:add $TEST_APP "$1"
 }
 
 # shellcheck disable=SC2119
 check_urls() {
   local PATTERN="$1"
   run bash -c "dokku --quiet urls $TEST_APP | egrep \"${1}\""
-  echo "output: "$output
-  echo "status: "$status
+  echo "output: $output"
+  echo "status: $status"
   assert_success
 }
 
 assert_http_success() {
   local url=$1
   run curl -kSso /dev/null -w "%{http_code}" "${url}"
-  echo "output: "$output
-  echo "status: "$status
+  echo "output: $output"
+  echo "status: $status"
   assert_output "200"
 }
 
@@ -158,8 +158,8 @@ assert_nonssl_domain() {
 assert_app_domain() {
   local domain=$1
   run /bin/bash -c "dokku domains $TEST_APP | grep -xF ${domain}"
-  echo "output: "$output
-  echo "status: "$status
+  echo "output: $output"
+  echo "status: $status"
   assert_output "${domain}"
 }
 
@@ -167,8 +167,8 @@ assert_http_redirect() {
   local from=$1
   local to=$2
   run curl -kSso /dev/null -w "%{redirect_url}" "${from}"
-  echo "output: "$output
-  echo "status: "$status
+  echo "output: $output"
+  echo "status: $status"
   assert_output "${to}"
 }
 
@@ -178,14 +178,19 @@ deploy_app() {
   local CUSTOM_TEMPLATE="$3"; local TMP=$(mktemp -d -t "dokku.me.XXXXX")
   local CUSTOM_PATH="$4"
 
-  rmdir $TMP && cp -r ./tests/apps/$APP_TYPE $TMP
-  cd $TMP || exit 1
+  rmdir "$TMP" && cp -r "./tests/apps/$APP_TYPE" "$TMP"
+
+  # shellcheck disable=SC2086
   [[ -n "$CUSTOM_TEMPLATE" ]] && $CUSTOM_TEMPLATE $TEST_APP $TMP/$CUSTOM_PATH
+
+  pushd "$TMP" &> /dev/null || exit 1
+  trap 'popd &> /dev/null || true; rm -rf "$TMP"' RETURN INT TERM
+
   git init
   git config user.email "robot@example.com"
   git config user.name "Test Robot"
   echo "setting up remote: $GIT_REMOTE"
-  git remote add target $GIT_REMOTE
+  git remote add target "$GIT_REMOTE"
 
   [[ -f gitignore ]] && mv gitignore .gitignore
   git add .
@@ -195,8 +200,8 @@ deploy_app() {
 
 setup_client_repo() {
   local TMP=$(mktemp -d -t "dokku.me.XXXXX")
-  rmdir $TMP && cp -r ./tests/apps/nodejs-express $TMP
-  cd $TMP || exit 1
+  rmdir "$TMP" && cp -r ./tests/apps/nodejs-express "$TMP"
+  cd "$TMP" || exit 1
   git init
   git config user.email "robot@example.com"
   git config user.name "Test Robot"
@@ -221,14 +226,14 @@ setup_test_tls() {
       local TLS_ARCHIVE=server_ssl.tar
       ;;
   esac
-  tar xf $BATS_TEST_DIRNAME/$TLS_ARCHIVE -C $TLS
+  tar xf "$BATS_TEST_DIRNAME/$TLS_ARCHIVE" -C $TLS
   sudo chown -R dokku:dokku ${TLS}/..
 }
 
 custom_ssl_nginx_template() {
   local APP="$1"; local APP_REPO_DIR="$2"
   [[ -z "$APP" ]] && local APP="$TEST_APP"
-  mkdir -p $APP_REPO_DIR
+  mkdir -p "$APP_REPO_DIR"
 
   echo "injecting custom_ssl_nginx_template -> $APP_REPO_DIR/nginx.conf.sigil"
 cat<<EOF > "$APP_REPO_DIR/nginx.conf.sigil"
@@ -276,7 +281,7 @@ EOF
 custom_nginx_template() {
   local APP="$1"; local APP_REPO_DIR="$2"
   [[ -z "$APP" ]] && local APP="$TEST_APP"
-  mkdir -p $APP_REPO_DIR
+  mkdir -p "$APP_REPO_DIR"
 
   echo "injecting custom_nginx_template -> $APP_REPO_DIR/nginx.conf.sigil"
 cat<<EOF > "$APP_REPO_DIR/nginx.conf.sigil"