--- a/taskcluster/docker/recipes/centos-install-debug-symbols.sh
+++ b/taskcluster/docker/recipes/centos-install-debug-symbols.sh
@@ -12,84 +12,84 @@ install_options="-q -t -y --skip-broken"
 debuginfo_install="debuginfo-install $install_options"
 
 install_debuginfo_for_installed_packages() {
     yum list installed \
         | awk 'NF >= 3 && $1 !~ /debuginfo/ {
                 # Remove arch suffix
                 print gensub(/\.(i.86|x86_64|noarch)/, "", "", $1)
             }' \
-        | xargs $debuginfo_install \
+        | xargs "$debuginfo_install" \
         || : # ignore errors
 }
 
 echo "Installing debuginfo packages..."
 install_debuginfo_for_installed_packages > /dev/null
 
 # Now search for debuginfo for individual libraries in the system
 
 # Get the length of a string in bytes.
 # We have to set LANG=C to get the length in bytes, not chars.
 strlen() {
     local old_lang byteslen
     old_lang=$LANG
     LANG=C
     byteslen=${#1}
     LANG=$old_lang
-    echo $byteslen
+    echo "$byteslen"
 }
 
 echo "Searching for additional debuginfo packages..."
 
 # libraries contains the list of libraries found in the system
 libraries=""
 
 # As we accumulate libraries in the $libraries variable, we have
 # to constantly check we didn't extrapolate the command line
 # argument length limit. arg_max stores the argument limit in
 # bytes, discounting the $debuginfo_install command plus one
 # space.
-arg_max=$(( $(getconf ARG_MAX)-$(strlen $debuginfo_install)-$(strlen " ") ))
+arg_max=$(( $(getconf ARG_MAX)-$(strlen "$debuginfo_install")-$(strlen " ") ))
 
 to_debuginfo() {
     # extracted from debuginfo-install script
     if [[ $1 == *-rpms ]]; then
-        echo ${1%*-rpms}-debug-rpms
+        echo "${1%*-rpms}-debug-rpms"
     else
-        echo $1-debuginfo
+        echo "$1-debuginfo"
     fi
 }
 
 get_debuginfo_package() {
     local package=${1%.so*}
 
     # Remove version suffix because some libraries have their debuginfo
     # package without it in the name.
     local unversioned_package=${package%-*}
     if [ "$unversioned_package" != "$package" ]; then
         package="$package $unversioned_package"
     fi
 
-    echo $package
+    echo "$package"
 }
 
 walk_dir() {
     local lib
     for i in $1/*; do
         # if we found a library...
         if [[ $i == *.so ]]; then
-            lib="$(get_debuginfo_package $(basename $i))"
-            if [ $(strlen "$debuginfo_install $libraries $lib") -ge $arg_max ]; then
+            lib="$(get_debuginfo_package "$(basename "$i")")"
+            if [ "$(strlen "$debuginfo_install $libraries $lib")" -ge $arg_max ]; then
                 $debuginfo_install $libraries > /dev/null
                 libraries=""
             fi
             libraries="$libraries $lib"
         fi
     done
 }
 
 for i in /usr/lib /usr/lib64 /lib /lib64; do
     walk_dir $i
 done
 
 if [ ${#libraries} -gt 0 ]; then
-    $debuginfo_install $libraries > /dev/null
+    $debuginfo_install "$libraries" > /dev/null
 fi

--- a/taskcluster/docker/recipes/centos6-build-system-setup.sh
+++ b/taskcluster/docker/recipes/centos6-build-system-setup.sh
@@ -1,17 +1,22 @@
 #!/bin/bash
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-cd /setup
+cd /setup || exit
 
+# shellcheck source=taskcluster/docker/recipes/common.sh
 . /setup/common.sh
+# shellcheck source=taskcluster/docker/recipes/install-mercurial.sh
 . /setup/install-mercurial.sh
+# shellcheck source=taskcluster/docker/recipes/install-make.sh
 . /setup/install-make.sh
+# shellcheck source=taskcluster/docker/recipes/install-cmake.sh
 . /setup/install-cmake.sh
 
 if [ -f /setup/install-debug-symbols.sh ]; then
+    # shellcheck disable=SC1091
     . /setup/install-debug-symbols.sh
 fi
 
 rm -rf /setup

--- a/taskcluster/docker/recipes/debian-build-system-setup.sh
+++ b/taskcluster/docker/recipes/debian-build-system-setup.sh
@@ -1,11 +1,13 @@
 #!/bin/bash
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-cd /setup
+cd /setup || exit
 
+# shellcheck source=taskcluster/docker/recipes/common.sh
 . /setup/common.sh
+# shellcheck source=taskcluster/docker/recipes/install-mercurial.sh
 . /setup/install-mercurial.sh
 
 rm -rf /setup

--- a/taskcluster/docker/recipes/install-cmake.sh
+++ b/taskcluster/docker/recipes/install-cmake.sh
@@ -10,12 +10,13 @@ tooltool_fetch <<'EOF'
     "size": 7361172,
     "digest": "0539d70ce3ac77042a45d638443b09fbf368e253622db980bc6fb15988743eacd031ab850a45c821ec3e9f0f5f886b9c9cb0668aeda184cd457b78abbfe7b629",
     "algorithm": "sha512",
     "filename": "cmake-3.7.1.tar.gz",
     "unpack": true
   }
 ]
 EOF
-cd cmake-3.7.1
-./bootstrap && make install
-cd ..
+(
+  cd cmake-3.7.1 || exit
+  ./bootstrap && make install
+)
 rm -rf cmake-3.7.1

--- a/taskcluster/docker/recipes/install-make.sh
+++ b/taskcluster/docker/recipes/install-make.sh
@@ -11,17 +11,18 @@ tooltool_fetch <<'EOF'
     "visibility": "public",
     "digest": "bc5083937a6cf473be12c0105b2064e546e1765cfc8d3882346cd50e2f3e967acbc5a679b861da07d32dce833d6b55e9c812fe3216cf6db7c4b1f3c232339c88",
     "algorithm": "sha512",
     "filename": "make-4.0.tar.gz",
     "unpack": true
   }
 ]
 EOF
-cd make-4.0
-./configure
-make
-make install
+(
+  cd make-4.0 || exit
+  ./configure
+  make
+  make install
 # The build system will find `gmake` ahead of `make`, so make sure it finds
 # the version we just installed.
-ln -s /usr/local/bin/make /usr/local/bin/gmake
-cd ..
+  ln -s /usr/local/bin/make /usr/local/bin/gmake
+)
 rm -rf make-4.0

--- a/taskcluster/docker/recipes/install-mercurial.sh
+++ b/taskcluster/docker/recipes/install-mercurial.sh
@@ -4,35 +4,41 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 # This script installs and configures Mercurial.
 
 set -e
 
 # Detect OS.
 if [ -f /etc/lsb-release ]; then
+    # Disabled so linting works on Mac
+    # shellcheck disable=SC1091
     . /etc/lsb-release
 
-    if [ "${DISTRIB_ID}" = "Ubuntu" -a "${DISTRIB_RELEASE}" = "16.04" ]; then
+    if [ "${DISTRIB_ID}" = "Ubuntu" ] && [ "${DISTRIB_RELEASE}" = "16.04" ]
+    then
         HG_DEB=1
         HG_DIGEST=458746bd82b4732c72c611f1041f77a47a683bc75ff3f6ab7ed86ea394f48d94cd7e2d3d1d5b020906318a9a24bea27401a3a63d7e645514dbc2cb581621977f
         HG_SIZE=193710
         HG_FILENAME=mercurial_4.4.2_amd64.deb
 
         HG_COMMON_DIGEST=8074efbfff974f0bbdd0c3be3d272cc7a634456921e04db31369fbec1c9256ddaf44bdbe120f6f33113d2be9324a1537048028ebaaf205c6659e476a757358fd
         HG_COMMON_SIZE=2097892
         HG_COMMON_FILENAME=mercurial-common_4.4.2_all.deb
-    elif [ "${DISTRIB_ID}" = "Ubuntu" -a "${DISTRIB_RELEASE}" = "12.04" ]; then
+    elif [ "${DISTRIB_ID}" = "Ubuntu" ] && [ "${DISTRIB_RELEASE}" = "12.04" ]
+    then
         echo "Ubuntu 12.04 not supported"
         exit 1
     fi
 
     CERT_PATH=/etc/ssl/certs/ca-certificates.crt
 
 elif [ -f /etc/os-release ]; then
+    # Disabled so linting works on Mac
+    # shellcheck disable=SC1091
     . /etc/os-release
 
     if [ "${ID}" = "debian" ]; then
         if [ -f /usr/bin/pip2 ]; then
             PIP_PATH=/usr/bin/pip2
         elif [ -f /usr/bin/pip ]; then
             # Versions of debian that don't have pip2 have pip pointing to the python2 version.
             PIP_PATH=/usr/bin/pip
@@ -43,17 +49,17 @@ elif [ -f /etc/os-release ]; then
     else
         echo "Unsupported debian-like system with ID '${ID}' and VERSION_ID '${VERSION_ID}'"
         exit 1
     fi
 
     CERT_PATH=/etc/ssl/certs/ca-certificates.crt
 
 elif [ -f /etc/centos-release ]; then
-    CENTOS_VERSION=`rpm -q --queryformat '%{VERSION}' centos-release`
+    CENTOS_VERSION="$(rpm -q --queryformat '%{VERSION}' centos-release)"
     if [ "${CENTOS_VERSION}" = "6" ]; then
         if [ -f /usr/bin/pip2.7 ]; then
             PIP_PATH=/usr/bin/pip2.7
         else
             echo "We currently require Python 2.7 and /usr/bin/pip2.7 to run Mercurial"
             exit 1
         fi
     else

--- a/taskcluster/docker/recipes/ubuntu1604-test-system-setup.sh
+++ b/taskcluster/docker/recipes/ubuntu1604-test-system-setup.sh
@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
 
 set -ve
 
-test `whoami` == 'root'
+test "$(whoami)" == 'root'
 
 mkdir -p /setup
 cd /setup
 
 apt_packages=()
 
 apt_packages+=('alsa-base')
 apt_packages+=('alsa-utils')
@@ -82,27 +82,30 @@ apt_packages+=('x11-xserver-utils')
 
 # use Ubuntu's Python-2.7 (2.7.3 on Precise)
 apt_packages+=('python-dev')
 apt_packages+=('python-pip')
 
 apt-get update
 # This allows ubuntu-desktop to be installed without human interaction
 export DEBIAN_FRONTEND=noninteractive
-apt-get install -y -f ${apt_packages[@]}
+apt-get install -y -f "${apt_packages[@]}"
 
 dpkg-reconfigure locales
 
+# shellcheck source=taskcluster/docker/recipes/common.sh
 . /setup/common.sh
+# shellcheck source=taskcluster/docker/recipes/install-mercurial.sh
 . /setup/install-mercurial.sh
 
 pip install --upgrade pip
 
 pip install virtualenv
 
+# shellcheck source=taskcluster/docker/recipes/install-node.sh
 . /setup/install-node.sh
 
 # Install custom-built Debian packages.  These come from a set of repositories
 # packaged in tarballs on tooltool to make them replicable.  Because they have
 # inter-dependenices, we install all repositories first, then perform the
 # installation.
 cp /etc/apt/sources.list sources.list.orig
 
@@ -171,9 +174,9 @@ apt-get -q -y -f install \
 cp sources.list.orig /etc/apt/sources.list
 apt-get update
 
 # clean up
 cd /
 rm -rf /setup ~/.ccache ~/.cache ~/.npm
 apt-get clean
 apt-get autoclean
-rm -f $0
+rm -f "$0"