diff --git a/Dockerfile b/Dockerfile
index 2350cf1e..c3a23a4f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -36,6 +36,15 @@ RUN mkdir -p /usr/src/criu \
     && cd /usr/src/criu \
     && make install-criu
 
+# install shfmt
+RUN mkdir -p /go/src/github.com/mvdan \
+    && cd /go/src/github.com/mvdan \
+    && git clone https://github.com/mvdan/sh \
+    && cd sh \
+    && git checkout -f v0.4.0 \
+    && go install ./cmd/shfmt \
+    && rm -rf /go/src/github.com/mvdan
+
 # setup a playground for us to spawn containers in
 ENV ROOTFS /busybox
 RUN mkdir -p ${ROOTFS} \
diff --git a/Makefile b/Makefile
index 779be925..c728fd58 100644
--- a/Makefile
+++ b/Makefile
@@ -119,6 +119,7 @@ clean:
 
 validate:
 	script/validate-gofmt
+	script/validate-shfmt
 	go vet ./...
 
 ci: validate localtest
diff --git a/contrib/completions/bash/runc b/contrib/completions/bash/runc
index d73af773..0d6039df 100644
--- a/contrib/completions/bash/runc
+++ b/contrib/completions/bash/runc
@@ -16,7 +16,6 @@
 # Configuration:
 #
 
-
 # Note for developers:
 # Please arrange options sorted alphabetically by long name with the short
 # options immediately following their corresponding long form.
@@ -26,7 +25,7 @@ __runc_previous_extglob_setting=$(shopt -p extglob)
 shopt -s extglob
 
 __runc_list_all() {
-    COMPREPLY=( $( compgen -W "$(runc list -q)" -- $cur) )
+	COMPREPLY=($(compgen -W "$(runc list -q)" -- $cur))
 }
 
 __runc_pos_first_nonflag() {
@@ -35,17 +34,16 @@ __runc_pos_first_nonflag() {
 	local counter=$((${subcommand_pos:-${command_pos}} + 1))
 	while [ $counter -le $cword ]; do
 		if [ -n "$argument_flags" ] && eval "case '${words[$counter]}' in $argument_flags) true ;; *) false ;; esac"; then
-			(( counter++ ))
+			((counter++))
 		else
 			case "${words[$counter]}" in
-				-*)
-					;;
+				-*) ;;
 				*)
 					break
 					;;
 			esac
 		fi
-		(( counter++ ))
+		((counter++))
 	done
 
 	echo $counter
@@ -55,7 +53,7 @@ __runc_pos_first_nonflag() {
 # with the words separated by "|".
 # This is used to prepare arguments to __runc_pos_first_nonflag().
 __runc_to_alternatives() {
-	local parts=( $1 )
+	local parts=($1)
 	local IFS='|'
 	echo "${parts[*]}"
 }
@@ -63,7 +61,7 @@ __runc_to_alternatives() {
 # Transforms a multiline list of options into an extglob pattern
 # suitable for use in case statements.
 __runc_to_extglob() {
-	local extglob=$( __runc_to_alternatives "$1" )
+	local extglob=$(__runc_to_alternatives "$1")
 	echo "@($extglob)"
 }
 
@@ -83,7 +81,7 @@ __runc_subcommands() {
 	local counter=$(($command_pos + 1))
 	while [ $counter -lt $cword ]; do
 		case "${words[$counter]}" in
-			$(__runc_to_extglob "$subcommands") )
+			$(__runc_to_extglob "$subcommands"))
 				subcommand_pos=$counter
 				local subcommand=${words[$counter]}
 				local completions_func=_runc_${command}_${subcommand}
@@ -91,14 +89,14 @@ __runc_subcommands() {
 				return 0
 				;;
 		esac
-		(( counter++ ))
+		((counter++))
 	done
 	return 1
 }
 
 # List all Signals
 __runc_list_signals() {
-    COMPREPLY=( $( compgen -W "$(for i in $(kill -l | xargs); do echo $i; done | grep SIG)"))
+	COMPREPLY=($(compgen -W "$(for i in $(kill -l | xargs); do echo $i; done | grep SIG)"))
 }
 
 # suppress trailing whitespace
@@ -109,7 +107,7 @@ __runc_nospace() {
 
 # The list of capabilities is defined in types.go, ALL was added manually.
 __runc_complete_capabilities() {
-	COMPREPLY=( $( compgen -W "
+	COMPREPLY=($(compgen -W "
 		ALL
 		AUDIT_CONTROL
 		AUDIT_WRITE
@@ -149,10 +147,9 @@ __runc_complete_capabilities() {
 		SYS_TIME
 		SYS_TTY_CONFIG
 		WAKE_ALARM
-	" -- "$cur" ) )
+	" -- "$cur"))
 }
 
-
 _runc_exec() {
 	local boolean_options="
 	   --help
@@ -176,18 +173,16 @@ _runc_exec() {
 	local all_options="$options_with_args $boolean_options"
 
 	case "$prev" in
-		--cap|-c)
+		--cap | -c)
 			__runc_complete_capabilities
 			return
 			;;
 
-		--console|--cwd|--process|--apparmor)
+		--console | --cwd | --process | --apparmor)
 			case "$cur" in
-				*:*)
-					# TODO somehow do _filedir for stuff inside the image, if it's already specified (which is also somewhat difficult to determine)
-					;;
+				*:*) ;; # TODO somehow do _filedir for stuff inside the image, if it's already specified (which is also somewhat difficult to determine)
 				'')
-					COMPREPLY=( $( compgen -W '/' -- "$cur" ) )
+					COMPREPLY=($(compgen -W '/' -- "$cur"))
 					__runc_nospace
 					;;
 				/*)
@@ -197,19 +192,19 @@ _runc_exec() {
 			esac
 			return
 			;;
-		--env|-e)
-			COMPREPLY=( $( compgen -e -- "$cur" ) )
+		--env | -e)
+			COMPREPLY=($(compgen -e -- "$cur"))
 			__runc_nospace
 			return
 			;;
-		$(__runc_to_extglob "$options_with_args") )
+		$(__runc_to_extglob "$options_with_args"))
 			return
 			;;
 	esac
 
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$all_options" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$all_options" -- "$cur"))
 			;;
 		*)
 			__runc_list_all
@@ -233,13 +228,11 @@ _runc_runc() {
 	"
 
 	case "$prev" in
-		--log|--root|--criu)
+		--log | --root | --criu)
 			case "$cur" in
-				*:*)
-					# TODO somehow do _filedir for stuff inside the image, if it's already specified (which is also somewhat difficult to determine)
-					;;
+				*:*) ;; # TODO somehow do _filedir for stuff inside the image, if it's already specified (which is also somewhat difficult to determine)
 				'')
-					COMPREPLY=( $( compgen -W '/' -- "$cur" ) )
+					COMPREPLY=($(compgen -W '/' -- "$cur"))
 					__runc_nospace
 					;;
 				*)
@@ -251,23 +244,23 @@ _runc_runc() {
 			;;
 
 		--log-format)
-			COMPREPLY=( $( compgen -W 'text json' -- "$cur" ) )
+			COMPREPLY=($(compgen -W 'text json' -- "$cur"))
 			return
 			;;
 
-		$(__runc_to_extglob "$options_with_args") )
+		$(__runc_to_extglob "$options_with_args"))
 			return
 			;;
 	esac
 
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
 			;;
 		*)
-			local counter=$( __runc_pos_first_nonflag $(__runc_to_extglob "$options_with_args") )
+			local counter=$(__runc_pos_first_nonflag $(__runc_to_extglob "$options_with_args"))
 			if [ $cword -eq $counter ]; then
-				COMPREPLY=( $( compgen -W "${commands[*]} help" -- "$cur" ) )
+				COMPREPLY=($(compgen -W "${commands[*]} help" -- "$cur"))
 			fi
 			;;
 	esac
@@ -281,11 +274,11 @@ _runc_pause() {
 
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
 			;;
 		*)
-		    __runc_list_all
-		    ;;
+			__runc_list_all
+			;;
 	esac
 }
 
@@ -297,11 +290,11 @@ _runc_ps() {
 
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
 			;;
 		*)
-		    __runc_list_all
-		    ;;
+			__runc_list_all
+			;;
 	esac
 }
 
@@ -313,11 +306,11 @@ _runc_delete() {
 
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
 			;;
 		*)
-		    __runc_list_all
-		    ;;
+			__runc_list_all
+			;;
 	esac
 }
 
@@ -330,18 +323,18 @@ _runc_kill() {
 	"
 
 	case "$prev" in
-	    "kill")
-		__runc_list_all
-		return
-		;;
-	    *)
-		__runc_list_signals
-		return
-		;;
+		"kill")
+			__runc_list_all
+			return
+			;;
+		*)
+			__runc_list_signals
+			return
+			;;
 	esac
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
 			;;
 		*)
 			__runc_list_all
@@ -360,14 +353,14 @@ _runc_events() {
 	"
 
 	case "$prev" in
-	   $(__runc_to_extglob "$options_with_args"))
-	       return
-	       ;;
+		$(__runc_to_extglob "$options_with_args"))
+			return
+			;;
 	esac
 
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
 			;;
 		*)
 			__runc_list_all
@@ -388,22 +381,22 @@ _runc_list() {
 	"
 
 	case "$prev" in
-	    --format|-f)
-		COMPREPLY=( $( compgen -W 'text json' -- "$cur" ) )
-		return
-		;;
+		--format | -f)
+			COMPREPLY=($(compgen -W 'text json' -- "$cur"))
+			return
+			;;
 
-	   $(__runc_to_extglob "$options_with_args"))
-	       return
-	       ;;
+		$(__runc_to_extglob "$options_with_args"))
+			return
+			;;
 	esac
 
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
 			;;
 		*)
-			local counter=$( __runc_pos_first_nonflag $(__runc_to_extglob "$options_with_args") )
+			local counter=$(__runc_pos_first_nonflag $(__runc_to_extglob "$options_with_args"))
 			;;
 	esac
 }
@@ -419,31 +412,31 @@ _runc_spec() {
 	"
 
 	case "$prev" in
-	    --bundle|-b)
-		case "$cur" in
-		    '')
-			COMPREPLY=( $( compgen -W '/' -- "$cur" ) )
-			__runc_nospace
+		--bundle | -b)
+			case "$cur" in
+				'')
+					COMPREPLY=($(compgen -W '/' -- "$cur"))
+					__runc_nospace
+					;;
+				/*)
+					_filedir
+					__runc_nospace
+					;;
+			esac
+			return
 			;;
-		    /*)
-			_filedir
-			__runc_nospace
-			;;
-		esac
-		return
-		;;
 
-	   $(__runc_to_extglob "$options_with_args"))
-	       return
-	       ;;
+		$(__runc_to_extglob "$options_with_args"))
+			return
+			;;
 	esac
 
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
 			;;
 		*)
-			local counter=$( __runc_pos_first_nonflag $(__runc_to_extglob "$options_with_args") )
+			local counter=$(__runc_pos_first_nonflag $(__runc_to_extglob "$options_with_args"))
 			;;
 	esac
 }
@@ -466,32 +459,32 @@ _runc_run() {
 	"
 
 	case "$prev" in
-	    --bundle|-b|--console|--pid-file)
-		case "$cur" in
-		    '')
-			COMPREPLY=( $( compgen -W '/' -- "$cur" ) )
-			__runc_nospace
+		--bundle | -b | --console | --pid-file)
+			case "$cur" in
+				'')
+					COMPREPLY=($(compgen -W '/' -- "$cur"))
+					__runc_nospace
+					;;
+				/*)
+					_filedir
+					__runc_nospace
+					;;
+			esac
+			return
 			;;
-		    /*)
-			_filedir
-			__runc_nospace
-			;;
-		esac
-		return
-		;;
 
-	   $(__runc_to_extglob "$options_with_args"))
-	       return
-	       ;;
+		$(__runc_to_extglob "$options_with_args"))
+			return
+			;;
 	esac
 
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
 			;;
 		*)
-		    __runc_list_all
-		    ;;
+			__runc_list_all
+			;;
 	esac
 }
 
@@ -514,39 +507,36 @@ _runc_checkpoint() {
 	"
 
 	case "$prev" in
-	    --page-server)
-	    ;;
+		--page-server) ;;
 
-	    --manage-cgroups-mode)
-		COMPREPLY=( $( compgen -W "soft full strict" -- "$cur" ) )
-		return
-		;;
+		--manage-cgroups-mode)
+			COMPREPLY=($(compgen -W "soft full strict" -- "$cur"))
+			return
+			;;
 
-	   --image-path|--work-path)
-	       case "$cur" in
-		   *:*)
-		   # TODO somehow do _filedir for stuff inside the image, if it's already specified (which is also somewhat difficult to determine)
-		   ;;
-		   '')
-		       COMPREPLY=( $( compgen -W '/' -- "$cur" ) )
-		       __runc_nospace
-		       ;;
-		   *)
-		       _filedir
-		       __runc_nospace
-		       ;;
-	       esac
-	       return
-	       ;;
+		--image-path | --work-path)
+			case "$cur" in
+				*:*) ;; # TODO somehow do _filedir for stuff inside the image, if it's already specified (which is also somewhat difficult to determine)
+				'')
+					COMPREPLY=($(compgen -W '/' -- "$cur"))
+					__runc_nospace
+					;;
+				*)
+					_filedir
+					__runc_nospace
+					;;
+			esac
+			return
+			;;
 
-	   $(__runc_to_extglob "$options_with_args"))
-	       return
-	       ;;
+		$(__runc_to_extglob "$options_with_args"))
+			return
+			;;
 	esac
 
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
 			;;
 		*)
 			__runc_list_all
@@ -567,28 +557,28 @@ _runc_create() {
 	   --pid-file
 	"
 	case "$prev" in
-	    --bundle|-b|--console|--pid-file)
-		case "$cur" in
-		    '')
-			COMPREPLY=( $( compgen -W '/' -- "$cur" ) )
-			__runc_nospace
+		--bundle | -b | --console | --pid-file)
+			case "$cur" in
+				'')
+					COMPREPLY=($(compgen -W '/' -- "$cur"))
+					__runc_nospace
+					;;
+				/*)
+					_filedir
+					__runc_nospace
+					;;
+			esac
+			return
 			;;
-		    /*)
-			_filedir
-			__runc_nospace
-			;;
-		esac
-		return
-		;;
 
-	   $(__runc_to_extglob "$options_with_args"))
-	       return
-	       ;;
+		$(__runc_to_extglob "$options_with_args"))
+			return
+			;;
 	esac
 
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
 			;;
 		*)
 			__runc_list_all
@@ -600,7 +590,7 @@ _runc_create() {
 _runc_help() {
 	local counter=$(__runc_pos_first_nonflag)
 	if [ $cword -eq $counter ]; then
-		COMPREPLY=( $( compgen -W "${commands[*]}" -- "$cur" ) )
+		COMPREPLY=($(compgen -W "${commands[*]}" -- "$cur"))
 	fi
 }
 
@@ -629,40 +619,38 @@ _runc_restore() {
 	local all_options="$options_with_args $boolean_options"
 
 	case "$prev" in
-	    --manage-cgroups-mode)
-		COMPREPLY=( $( compgen -W "soft full strict" -- "$cur" ) )
-		return
-		;;
-
-	    --pid-file|--image-path|--work-path|--bundle|-b)
-		case "$cur" in
-		    *:*)
-		    # TODO somehow do _filedir for stuff inside the image, if it's already specified (which is also somewhat difficult to determine)
-		    ;;
-		    '')
-			COMPREPLY=( $( compgen -W '/' -- "$cur" ) )
-			__runc_nospace
+		--manage-cgroups-mode)
+			COMPREPLY=($(compgen -W "soft full strict" -- "$cur"))
+			return
 			;;
-		    /*)
-			_filedir
-			__runc_nospace
-			;;
-		esac
-		return
-		;;
 
-	    $(__runc_to_extglob "$options_with_args") )
-                return
-		;;
+		--pid-file | --image-path | --work-path | --bundle | -b)
+			case "$cur" in
+				*:*) ;; # TODO somehow do _filedir for stuff inside the image, if it's already specified (which is also somewhat difficult to determine)
+				'')
+					COMPREPLY=($(compgen -W '/' -- "$cur"))
+					__runc_nospace
+					;;
+				/*)
+					_filedir
+					__runc_nospace
+					;;
+			esac
+			return
+			;;
+
+		$(__runc_to_extglob "$options_with_args"))
+			return
+			;;
 	esac
 
 	case "$cur" in
 		-*)
-		    COMPREPLY=( $( compgen -W "$all_options" -- "$cur" ) )
-		    ;;
+			COMPREPLY=($(compgen -W "$all_options" -- "$cur"))
+			;;
 		*)
-		    __runc_list_all
-		    ;;
+			__runc_list_all
+			;;
 	esac
 }
 
@@ -674,11 +662,11 @@ _runc_resume() {
 
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
 			;;
 		*)
-		    __runc_list_all
-		    ;;
+			__runc_list_all
+			;;
 	esac
 }
 
@@ -690,11 +678,11 @@ _runc_state() {
 
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
 			;;
 		*)
-		    __runc_list_all
-		    ;;
+			__runc_list_all
+			;;
 	esac
 }
 _runc_start() {
@@ -705,11 +693,11 @@ _runc_start() {
 
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
 			;;
 		*)
-		    __runc_list_all
-		    ;;
+			__runc_list_all
+			;;
 	esac
 }
 _runc_update() {
@@ -735,14 +723,14 @@ _runc_update() {
 	"
 
 	case "$prev" in
-	   $(__runc_to_extglob "$options_with_args"))
-	       return
-	       ;;
+		$(__runc_to_extglob "$options_with_args"))
+			return
+			;;
 	esac
 
 	case "$cur" in
 		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+			COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
 			;;
 		*)
 			__runc_list_all
@@ -755,25 +743,25 @@ _runc() {
 	shopt -s extglob
 
 	local commands=(
-	    checkpoint
-	    create
-	    delete
-	    events
-	    exec
-	    init
-	    kill
-	    list
-	    pause
-	    ps
-	    restore
-	    resume
-	    run
-	    spec
-	    start
-	    state
-	    update
-	    help
-	    h
+		checkpoint
+		create
+		delete
+		events
+		exec
+		init
+		kill
+		list
+		pause
+		ps
+		restore
+		resume
+		run
+		spec
+		start
+		state
+		update
+		help
+		h
 	)
 
 	# These options are valid as global options for all client commands
@@ -791,10 +779,9 @@ _runc() {
 	local counter=1
 	while [ $counter -lt $cword ]; do
 		case "${words[$counter]}" in
-			-*)
-				;;
+			-*) ;;
 			=)
-				(( counter++ ))
+				((counter++))
 				;;
 			*)
 				command="${words[$counter]}"
@@ -802,7 +789,7 @@ _runc() {
 				break
 				;;
 		esac
-		(( counter++ ))
+		((counter++))
 	done
 
 	local completions_func=_runc_${command}
diff --git a/script/check-config.sh b/script/check-config.sh
index d53991ed..0fd9ab19 100755
--- a/script/check-config.sh
+++ b/script/check-config.sh
@@ -15,8 +15,8 @@ possibleConfigFiles=(
 	"config-$(uname -r)"
 	'.config'
 )
-	
-if ! command -v zgrep &> /dev/null; then
+
+if ! command -v zgrep &>/dev/null; then
 	zgrep() {
 		zcat "$2" | grep "$1"
 	}
@@ -28,19 +28,19 @@ kernelMinor="${kernelVersion#$kernelMajor.}"
 kernelMinor="${kernelMinor%%.*}"
 
 is_set() {
-	zgrep "CONFIG_$1=[y|m]" "$CONFIG" > /dev/null
+	zgrep "CONFIG_$1=[y|m]" "$CONFIG" >/dev/null
 }
 is_set_in_kernel() {
-	zgrep "CONFIG_$1=y" "$CONFIG" > /dev/null
+	zgrep "CONFIG_$1=y" "$CONFIG" >/dev/null
 }
 is_set_as_module() {
-	zgrep "CONFIG_$1=m" "$CONFIG" > /dev/null
+	zgrep "CONFIG_$1=m" "$CONFIG" >/dev/null
 }
 
 color() {
 	local codes=()
 	if [ "$1" = 'bold' ]; then
-		codes=( "${codes[@]}" '1' )
+		codes=("${codes[@]}" '1')
 		shift
 	fi
 	if [ "$#" -gt 0 ]; then
@@ -57,7 +57,7 @@ color() {
 			white) code=37 ;;
 		esac
 		if [ "$code" ]; then
-			codes=( "${codes[@]}" "$code" )
+			codes=("${codes[@]}" "$code")
 		fi
 	fi
 	local IFS=';'
@@ -109,8 +109,7 @@ check_distro_userns() {
 	fi
 }
 
-is_config()
-{
+is_config() {
 	local config="$1"
 
 	# Todo: more check
@@ -118,8 +117,7 @@ is_config()
 	return 1
 }
 
-search_config()
-{
+search_config() {
 	local target_dir="$1"
 	[[ "$target_dir" ]] || target_dir=("${possibleConfigs[@]}")
 
@@ -181,14 +179,14 @@ fi
 
 if [ "$(cat /sys/module/apparmor/parameters/enabled 2>/dev/null)" = 'Y' ]; then
 	echo -n '- '
-	if command -v apparmor_parser &> /dev/null; then
+	if command -v apparmor_parser &>/dev/null; then
 		echo "$(wrap_good 'apparmor' 'enabled and tools installed')"
 	else
 		echo "$(wrap_bad 'apparmor' 'enabled, but apparmor_parser missing')"
 		echo -n '    '
-		if command -v apt-get &> /dev/null; then
+		if command -v apt-get &>/dev/null; then
 			echo "$(wrap_color '(use "apt-get install apparmor" to fix this)')"
-		elif command -v yum &> /dev/null; then
+		elif command -v yum &>/dev/null; then
 			echo "$(wrap_color '(your best bet is "yum install apparmor-parser")')"
 		else
 			echo "$(wrap_color '(look for an "apparmor" package for your distribution)')"
@@ -220,7 +218,7 @@ echo 'Optional Features:'
 	check_flags CGROUP_PIDS
 
 	check_flags MEMCG_SWAP MEMCG_SWAP_ENABLED
-	if  is_set MEMCG_SWAP && ! is_set MEMCG_SWAP_ENABLED; then
+	if is_set MEMCG_SWAP && ! is_set MEMCG_SWAP_ENABLED; then
 		echo "    $(wrap_color '(note that cgroup swap accounting is not enabled in your kernel config, you can enable it by setting boot option "swapaccount=1")' bold black)"
 	fi
 }
diff --git a/script/validate-gofmt b/script/validate-gofmt
index c565976b..0810765f 100755
--- a/script/validate-gofmt
+++ b/script/validate-gofmt
@@ -3,14 +3,14 @@
 source "$(dirname "$BASH_SOURCE")/.validate"
 
 IFS=$'\n'
-files=( $(validate_diff --diff-filter=ACMR --name-only -- '*.go' | grep -v '^Godeps/' || true) )
+files=($(validate_diff --diff-filter=ACMR --name-only -- '*.go' | grep -v '^Godeps/' || true))
 unset IFS
 
 badFiles=()
 for f in "${files[@]}"; do
 	# we use "git show" here to validate that what's committed is formatted
 	if [ "$(git show "$VALIDATE_HEAD:$f" | gofmt -s -l)" ]; then
-		badFiles+=( "$f" )
+		badFiles+=("$f")
 	fi
 done
 
diff --git a/script/validate-shfmt b/script/validate-shfmt
new file mode 100755
index 00000000..84930399
--- /dev/null
+++ b/script/validate-shfmt
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+badFiles=()
+while read f; do
+	badFiles+=("$f")
+done < <(shfmt -l . | grep -v Godeps/)
+
+if [ ${#badFiles[@]} -eq 0 ]; then
+	echo 'Congratulations!  All shell source files are properly formatted.'
+else
+	{
+		echo "These files are not properly shfmt'd:"
+		for f in "${badFiles[@]}"; do
+			echo " - $f"
+		done
+		echo
+		echo 'Please reformat the above files using "shfmt -w" and commit the result.'
+		echo
+	} >&2
+	false
+fi
diff --git a/tests/integration/helpers.bash b/tests/integration/helpers.bash
index bf3b36b1..b5b83298 100644
--- a/tests/integration/helpers.bash
+++ b/tests/integration/helpers.bash
@@ -29,24 +29,24 @@ KERNEL_MINOR="${KERNEL_MINOR%%.*}"
 ROOT="$BATS_TMPDIR/runc"
 
 # Cgroup mount
-CGROUP_BASE_PATH=$(grep "cgroup"  /proc/self/mountinfo | gawk 'toupper($NF) ~ /\<MEMORY\>/ { print $5; exit }')
+CGROUP_BASE_PATH=$(grep "cgroup" /proc/self/mountinfo | gawk 'toupper($NF) ~ /\<MEMORY\>/ { print $5; exit }')
 
 # CONFIG_MEMCG_KMEM support
 KMEM="${CGROUP_BASE_PATH}/memory.kmem.limit_in_bytes"
 
 # Wrapper for runc.
 function runc() {
-  run __runc "$@"
+	run __runc "$@"
 
-  # Some debug information to make life easier. bats will only print it if the
-  # test failed, in which case the output is useful.
-  echo "runc $@ (status=$status):" >&2
-  echo "$output" >&2
+	# Some debug information to make life easier. bats will only print it if the
+	# test failed, in which case the output is useful.
+	echo "runc $@ (status=$status):" >&2
+	echo "$output" >&2
 }
 
 # Raw wrapper for runc.
 function __runc() {
-  "$RUNC" --root "$ROOT" "$@"
+	"$RUNC" --root "$ROOT" "$@"
 }
 
 # Fails the current test, providing the error given.
@@ -79,118 +79,118 @@ function requires() {
 
 # Retry a command $1 times until it succeeds. Wait $2 seconds between retries.
 function retry() {
-  local attempts=$1
-  shift
-  local delay=$1
-  shift
-  local i
+	local attempts=$1
+	shift
+	local delay=$1
+	shift
+	local i
 
-  for ((i=0; i < attempts; i++)); do
-    run "$@"
-    if [[ "$status" -eq 0 ]] ; then
-      return 0
-    fi
-    sleep $delay
-  done
+	for ((i = 0; i < attempts; i++)); do
+		run "$@"
+		if [[ "$status" -eq 0 ]]; then
+			return 0
+		fi
+		sleep $delay
+	done
 
-  echo "Command \"$@\" failed $attempts times. Output: $output"
-  false
+	echo "Command \"$@\" failed $attempts times. Output: $output"
+	false
 }
 
 # retry until the given container has state
 function wait_for_container() {
-  local attempts=$1
-  local delay=$2
-  local cid=$3
-  local i
+	local attempts=$1
+	local delay=$2
+	local cid=$3
+	local i
 
-  for ((i=0; i < attempts; i++)); do
-    runc state $cid
-    if [[ "$status" -eq 0 ]] ; then
-      return 0
-    fi
-    sleep $delay
-  done
+	for ((i = 0; i < attempts; i++)); do
+		runc state $cid
+		if [[ "$status" -eq 0 ]]; then
+			return 0
+		fi
+		sleep $delay
+	done
 
-  echo "runc state failed to return state $statecheck $attempts times. Output: $output"
-  false
+	echo "runc state failed to return state $statecheck $attempts times. Output: $output"
+	false
 }
 
 # retry until the given container has state
 function wait_for_container_inroot() {
-  local attempts=$1
-  local delay=$2
-  local cid=$3
-  local i
+	local attempts=$1
+	local delay=$2
+	local cid=$3
+	local i
 
-  for ((i=0; i < attempts; i++)); do
-    ROOT=$4 runc state $cid
-    if [[ "$status" -eq 0 ]] ; then
-      return 0
-    fi
-    sleep $delay
-  done
+	for ((i = 0; i < attempts; i++)); do
+		ROOT=$4 runc state $cid
+		if [[ "$status" -eq 0 ]]; then
+			return 0
+		fi
+		sleep $delay
+	done
 
-  echo "runc state failed to return state $statecheck $attempts times. Output: $output"
-  false
+	echo "runc state failed to return state $statecheck $attempts times. Output: $output"
+	false
 }
 
 function testcontainer() {
-  # test state of container
-  runc state $1
-  [ "$status" -eq 0 ]
-  [[ "${output}" == *"$2"* ]]
+	# test state of container
+	runc state $1
+	[ "$status" -eq 0 ]
+	[[ "${output}" == *"$2"* ]]
 }
 
 function setup_busybox() {
-  run mkdir "$BUSYBOX_BUNDLE"
-  run mkdir "$BUSYBOX_BUNDLE"/rootfs
-  if [ -e "/testdata/busybox.tar" ]; then
-    BUSYBOX_IMAGE="/testdata/busybox.tar"
-  fi
-  if [ ! -e $BUSYBOX_IMAGE ]; then
-    curl -o $BUSYBOX_IMAGE -sSL 'https://github.com/jpetazzo/docker-busybox/raw/buildroot-2014.11/rootfs.tar'
-  fi
-  tar -C "$BUSYBOX_BUNDLE"/rootfs -xf "$BUSYBOX_IMAGE"
-  cd "$BUSYBOX_BUNDLE"
-  runc spec
+	run mkdir "$BUSYBOX_BUNDLE"
+	run mkdir "$BUSYBOX_BUNDLE"/rootfs
+	if [ -e "/testdata/busybox.tar" ]; then
+		BUSYBOX_IMAGE="/testdata/busybox.tar"
+	fi
+	if [ ! -e $BUSYBOX_IMAGE ]; then
+		curl -o $BUSYBOX_IMAGE -sSL 'https://github.com/jpetazzo/docker-busybox/raw/buildroot-2014.11/rootfs.tar'
+	fi
+	tar -C "$BUSYBOX_BUNDLE"/rootfs -xf "$BUSYBOX_IMAGE"
+	cd "$BUSYBOX_BUNDLE"
+	runc spec
 }
 
 function setup_hello() {
-  run mkdir "$HELLO_BUNDLE"
-  run mkdir "$HELLO_BUNDLE"/rootfs
-  tar -C "$HELLO_BUNDLE"/rootfs -xf "$HELLO_IMAGE"
-  cd "$HELLO_BUNDLE"
-  runc spec
-  sed -i 's;"sh";"/hello";' config.json
+	run mkdir "$HELLO_BUNDLE"
+	run mkdir "$HELLO_BUNDLE"/rootfs
+	tar -C "$HELLO_BUNDLE"/rootfs -xf "$HELLO_IMAGE"
+	cd "$HELLO_BUNDLE"
+	runc spec
+	sed -i 's;"sh";"/hello";' config.json
 }
 
 function teardown_running_container() {
-  runc list
-  if [[ "${output}" == *"$1"* ]]; then
-    runc kill $1 KILL
-    retry 10 1 eval "__runc state '$1' | grep -q 'stopped'"
-    runc delete $1
-  fi
+	runc list
+	if [[ "${output}" == *"$1"* ]]; then
+		runc kill $1 KILL
+		retry 10 1 eval "__runc state '$1' | grep -q 'stopped'"
+		runc delete $1
+	fi
 }
 
 function teardown_running_container_inroot() {
-  ROOT=$2 runc list
-  if [[ "${output}" == *"$1"* ]]; then
-    ROOT=$2 runc kill $1 KILL
-    retry 10 1 eval "ROOT='$2' __runc state '$1' | grep -q 'stopped'"
-    ROOT=$2 runc delete $1
-  fi
+	ROOT=$2 runc list
+	if [[ "${output}" == *"$1"* ]]; then
+		ROOT=$2 runc kill $1 KILL
+		retry 10 1 eval "ROOT='$2' __runc state '$1' | grep -q 'stopped'"
+		ROOT=$2 runc delete $1
+	fi
 }
 
 function teardown_busybox() {
-  cd "$INTEGRATION_ROOT"
-  teardown_running_container test_busybox
-  run rm -f -r "$BUSYBOX_BUNDLE"
+	cd "$INTEGRATION_ROOT"
+	teardown_running_container test_busybox
+	run rm -f -r "$BUSYBOX_BUNDLE"
 }
 
 function teardown_hello() {
-  cd "$INTEGRATION_ROOT"
-  teardown_running_container test_hello
-  run rm -f -r "$HELLO_BUNDLE"
+	cd "$INTEGRATION_ROOT"
+	teardown_running_container test_hello
+	run rm -f -r "$HELLO_BUNDLE"
 }