diff --git a/kernel-builder/build_kernel b/kernel-builder/build_kernel
index dbe3acf..6807c90 100755
--- a/kernel-builder/build_kernel
+++ b/kernel-builder/build_kernel
@@ -138,6 +138,7 @@ install_kernel(){
 	)
 }
 
+# shellcheck disable=SC2068
 install_kernel $@
 
 echo "Kernel successfully installed!"
diff --git a/kvm/start.sh b/kvm/start.sh
index 7b0ef55..88868d8 100755
--- a/kvm/start.sh
+++ b/kvm/start.sh
@@ -17,4 +17,5 @@ iptables -t nat -A POSTROUTING -s 172.20.0.1/16 -j MASQUERADE
 # start the virtlogd daemon
 exec virtlogd --daemon &
 
+# shellcheck disable=SC2068
 exec $@
diff --git a/latest-versions.sh b/latest-versions.sh
index 8381335..2376313 100755
--- a/latest-versions.sh
+++ b/latest-versions.sh
@@ -16,14 +16,17 @@ AUTH_HEADER="Authorization: token ${GITHUB_TOKEN}"
 get_latest() {
 	local repo=$1
 
-	local resp=$(curl -sSL -H "${AUTH_HEADER}" -H "${API_HEADER}" "${URI}/repos/${repo}/releases")
-	local tag=$(echo $resp | jq -e --raw-output .[0].tag_name)
-	local name=$(echo $resp | jq -e --raw-output .[0].name)
+	local resp
+	resp=$(curl -sSL -H "${AUTH_HEADER}" -H "${API_HEADER}" "${URI}/repos/${repo}/releases")
+	local tag
+	tag=$(echo "$resp" | jq -e --raw-output .[0].tag_name)
+	local name
+	name=$(echo "$resp" | jq -e --raw-output .[0].name)
 
 	if [[ "$tag" == "null" ]]; then
 		# get the latest tag
-		local resp=$(curl -sSL -H "${AUTH_HEADER}" -H "${API_HEADER}" "${URI}/repos/${repo}/tags")
-		local tag=$(echo $resp | jq -e --raw-output .[0].name)
+		resp=$(curl -sSL -H "${AUTH_HEADER}" -H "${API_HEADER}" "${URI}/repos/${repo}/tags")
+		tag=$(echo "$resp" | jq -e --raw-output .[0].name)
 		tag=${tag#release-}
 	fi
 
@@ -52,7 +55,8 @@ get_latest() {
 	fi
 
 	# Change to upper case for grep
-	local udir=$(echo $dir | awk '{print toupper($0)}')
+	local udir
+	udir=$(echo $dir | awk '{print toupper($0)}')
 	# Replace dashes (-) with underscores (_)
 	udir=${udir//-/_}
 	udir=${udir%/*}
@@ -60,9 +64,9 @@ get_latest() {
 	local current
 	if [[ ! -d "$dir" ]]; then
 		# If the directory does not exist, then grep all for it
-		current=$(grep -m 1 "${udir}_VERSION"  **/Dockerfile | head -n 1 | awk '{print $(NF)}')
+		current=$(grep -m 1 "${udir}_VERSION" -- **/Dockerfile | head -n 1 | awk '{print $(NF)}')
 	else
-		current=$(cat "${dir}/Dockerfile" | grep -m 1 "${udir}_VERSION" | awk '{print $(NF)}')
+		current=$(grep -m 1 "${udir}_VERSION" "${dir}/Dockerfile" | awk '{print $(NF)}')
 	fi
 
 
@@ -85,14 +89,14 @@ compare() {
 	local name="$1" dir="$2" tag="$3" current="$4" releases="$5"
 	ignore_dirs=( "bazel" "bcc" "mc" "nzbget" "osquery" "powershell" "rstudio" )
 
-	if [[ "$tag" =~ "$current" ]] || [[ "$name" =~ "$current" ]] || [[ "$current" =~ "$tag" ]] || [[ "$current" == "master" ]]; then
-		echo -e "\e[36m${dir}:\e[39m current ${current} | ${tag} | ${name}"
+	if [[ "$tag" =~ $current ]] || [[ "$name" =~ $current ]] || [[ "$current" =~ $tag ]] || [[ "$current" == "master" ]]; then
+		echo -e "\\e[36m${dir}:\\e[39m current ${current} | ${tag} | ${name}"
 	else
 		# add to the bad versions
-		if [[ ! " ${ignore_dirs[@]} " =~ " ${dir} " ]]; then
+		if [[ ! " ${ignore_dirs[*]} " =~  ${dir}  ]]; then
 			bad_versions+=( "${dir}" )
 		fi
-		echo -e "\e[31m${dir}:\e[39m current ${current} | ${tag} | ${name} | ${releases}"
+		echo -e "\\e[31m${dir}:\\e[39m current ${current} | ${tag} | ${name} | ${releases}"
 	fi
 }
 
@@ -152,16 +156,18 @@ unifi
 bad_versions=()
 
 main() {
+	# shellcheck disable=SC2068
 	for p in ${projects[@]}; do
 		get_latest "$p"
 	done
+	# shellcheck disable=SC2068
 	for p in ${other_projects[@]}; do
 		get_latest_"$p"
 	done
 
 	if [[ ${#bad_versions[@]} -ne 0 ]]; then
 		echo
-		echo "These Dockerfiles are not up to date: ${bad_versions[@]}" >&2
+		echo "These Dockerfiles are not up to date: ${bad_versions[*]}" >&2
 		exit 1
 	fi
 }
diff --git a/mitmproxy/docker-entrypoint.sh b/mitmproxy/docker-entrypoint.sh
index a4abe4c..c299848 100755
--- a/mitmproxy/docker-entrypoint.sh
+++ b/mitmproxy/docker-entrypoint.sh
@@ -3,7 +3,7 @@ set -e
 
 MITMPROXY_PATH="/home/mitmproxy/.mitmproxy"
 
-if [[ "$1" = "mitmdump" || "$1" = "mitmproxy" || "$1" = "mitmweb" ]]; then
+if [ "$1" = "mitmdump" ] || [ "$1" = "mitmproxy" ] || [ "$1" = "mitmweb" ]; then
         mkdir -p "$MITMPROXY_PATH"
         chown -R mitmproxy:mitmproxy "$MITMPROXY_PATH"
 
diff --git a/mutt/entrypoint.sh b/mutt/entrypoint.sh
index ae62c13..86ca55e 100755
--- a/mutt/entrypoint.sh
+++ b/mutt/entrypoint.sh
@@ -47,7 +47,7 @@ if [ -d "$HOME/.gnupg" ]; then
 		if [ -f "/usr/share/doc/mutt/examples/gpg.rc" ]; then
 			echo 'source /usr/share/doc/mutt/examples/gpg.rc'
 		fi
-		if [[ ! -z "$GPG_ID" ]]; then
+		if [ ! -z "$GPG_ID" ]; then
 			echo "set pgp_sign_as = $GPG_ID"
 		fi
 		echo 'set crypt_replysign=yes'
diff --git a/postfix/service/postfix/run b/postfix/service/postfix/run
index 4e58fe2..eeb1411 100755
--- a/postfix/service/postfix/run
+++ b/postfix/service/postfix/run
@@ -11,6 +11,7 @@ inet_protocols = ipv4
 EOF
 
 # Do we want to modify the config first with the script?
+# shellcheck disable=SC1091
 [ -f /etc/service/postfix/run.config ] && source /etc/service/postfix/run.config
 
 if [[ ! -z "$MAILNAME" ]]; then
@@ -79,5 +80,5 @@ if [[ ! -z "$SASL_AUTH" ]]; then
 	chmod 600 /etc/postfix/sasl_passwd.db
 fi
 
-exec /usr/lib/postfix/master -c /etc/postfix -d 2>&1
+/usr/lib/postfix/master -c /etc/postfix -d 2>&1
 tail -F /var/log/mail.log
diff --git a/run.sh b/run.sh
index aa2f750..5aa93ec 100755
--- a/run.sh
+++ b/run.sh
@@ -27,7 +27,7 @@ for name in "$@"; do
 		exit 1
 	fi
 
-	script=$(sed -n '/docker run/,/^#$/p' "$name/Dockerfile" | head -n -1 | sed "s/#//" | sed "s#\\\##" | tr '\n' ' ' | sed "s/\$@//" | sed 's/""//')
+	script=$(sed -n '/docker run/,/^#$/p' "$name/Dockerfile" | head -n -1 | sed "s/#//" | sed "s#\\\\##" | tr '\n' ' ' | sed "s/\$@//" | sed 's/""//')
 	echo "Running: $script"
 
 	if [ $TEST ]; then