diff --git a/hack/dind b/hack/dind
index 3036fa3e3f..4188c1befe 100755
--- a/hack/dind
+++ b/hack/dind
@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/sh
 set -e
 
 # DinD: a wrapper script which allows docker to be run inside a docker container.
@@ -13,7 +13,7 @@ set -e
 # apparmor sucks and Docker needs to know that it's in a container (c) @tianon
 export container=docker
 
-if [[ -d /sys/kernel/security ]] && ! mountpoint -q /sys/kernel/security; then
+if [ -d /sys/kernel/security ] && ! mountpoint -q /sys/kernel/security; then
 	mount -t securityfs none /sys/kernel/security || {
 		echo >&2 'Could not mount /sys/kernel/security.'
 		echo >&2 'AppArmor detection and --privileged mode might break.'
@@ -25,7 +25,7 @@ if ! mountpoint -q /tmp; then
 	mount -t tmpfs none /tmp
 fi
 
-if [[ $# -gt 0 ]]; then
+if [ $# -gt 0 ]; then
 	exec "$@"
 fi
 
diff --git a/hack/dockerfile/install/install.sh b/hack/dockerfile/install/install.sh
index c0402a8508..5e4a396789 100755
--- a/hack/dockerfile/install/install.sh
+++ b/hack/dockerfile/install/install.sh
@@ -9,7 +9,7 @@ TMP_GOPATH=${TMP_GOPATH:-""}
 
 : ${PREFIX:="/usr/local/bin"}
 
-if [[ -z "$TMP_GOPATH" ]]; then
+if [ -z "$TMP_GOPATH" ]; then
 	export GOPATH="$(mktemp -d)"
 	RM_GOPATH=1
 else
@@ -21,7 +21,7 @@ dir="$(dirname $0)"
 bin=$1
 shift
 
-if [[ ! -f "${dir}/${bin}.installer" ]]; then
+if [ ! -f "${dir}/${bin}.installer" ]; then
 	echo "Could not find installer for \"$bin\""
 	exit 1
 fi
diff --git a/hack/make.sh b/hack/make.sh
index 0d5aa1367b..e1e3dc46fa 100755
--- a/hack/make.sh
+++ b/hack/make.sh
@@ -31,17 +31,17 @@ export PKG_CONFIG=${PKG_CONFIG:-pkg-config}
 # We're a nice, sexy, little shell script, and people might try to run us;
 # but really, they shouldn't. We want to be in a container!
 inContainer="AssumeSoInitially"
-if [[ "$(go env GOHOSTOS)" = 'windows' ]]; then
-	if [[ -z "$FROM_DOCKERFILE" ]]; then
+if [ "$(go env GOHOSTOS)" = 'windows' ]; then
+	if [ -z "$FROM_DOCKERFILE" ]; then
 		unset inContainer
 	fi
 else
-	if [[ "$PWD" != "/go/src/$DOCKER_PKG" ]]; then
+	if [ "$PWD" != "/go/src/$DOCKER_PKG" ]; then
 		unset inContainer
 	fi
 fi
 
-if [[ -z "$inContainer" ]]; then
+if [ -z "$inContainer" ]; then
 	{
 		echo "# WARNING! I don't seem to be running in a Docker container."
 		echo "# The result of this command might be an incorrect build, and will not be"
@@ -67,11 +67,11 @@ DEFAULT_BUNDLES=(
 
 VERSION=${VERSION:-dev}
 ! BUILDTIME=$(date -u -d "@${SOURCE_DATE_EPOCH:-$(date +%s)}" --rfc-3339 ns 2> /dev/null | sed -e 's/ /T/')
-if [[ "$DOCKER_GITCOMMIT" ]]; then
+if [ "$DOCKER_GITCOMMIT" ]; then
 	GITCOMMIT="$DOCKER_GITCOMMIT"
 elif command -v git &> /dev/null && [ -e .git ] && git rev-parse &> /dev/null; then
 	GITCOMMIT=$(git rev-parse --short HEAD)
-	if [[ -n "$(git status --porcelain --untracked-files=no)" ]]; then
+	if [ -n "$(git status --porcelain --untracked-files=no)" ]; then
 		GITCOMMIT="$GITCOMMIT-unsupported"
 		echo "#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
 		echo "# GITCOMMIT = $GITCOMMIT"
@@ -90,14 +90,14 @@ else
 	exit 1
 fi
 
-if [[ "$AUTO_GOPATH" ]]; then
+if [ "$AUTO_GOPATH" ]; then
 	rm -rf .gopath
 	mkdir -p .gopath/src/"$(dirname "${DOCKER_PKG}")"
 	ln -sf ../../../.. .gopath/src/"${DOCKER_PKG}"
 	export GOPATH="${PWD}/.gopath"
 fi
 
-if [[ ! "$GOPATH" ]]; then
+if [ ! "$GOPATH" ]; then
 	echo >&2 'error: missing GOPATH; please see https://golang.org/doc/code.html#GOPATH'
 	echo >&2 '  alternatively, set AUTO_GOPATH=1'
 	exit 1
@@ -137,7 +137,7 @@ fi
 # Use these flags when compiling the tests and final binary
 
 IAMSTATIC='true'
-if [[ -z "$DOCKER_DEBUG" ]]; then
+if [ -z "$DOCKER_DEBUG" ]; then
 	LDFLAGS='-w'
 fi
 
@@ -151,9 +151,9 @@ ORIG_BUILDFLAGS=( -tags "autogen netgo osusergo static_build $DOCKER_BUILDTAGS"
 BUILDFLAGS=( ${BUILDFLAGS} "${ORIG_BUILDFLAGS[@]}" )
 
 # Test timeout.
-if [[ "${DOCKER_ENGINE_GOARCH}" == "arm64" ]] || [[ "${DOCKER_ENGINE_GOARCH}" == "arm" ]]; then
+if [ "${DOCKER_ENGINE_GOARCH}" == "arm64" ] || [ "${DOCKER_ENGINE_GOARCH}" == "arm" ]; then
 	: ${TIMEOUT:=10m}
-elif [[ "${DOCKER_ENGINE_GOARCH}" == "windows" ]]; then
+elif [ "${DOCKER_ENGINE_GOARCH}" == "windows" ]; then
 	: ${TIMEOUT:=8m}
 else
 	: ${TIMEOUT:=5m}
@@ -164,7 +164,7 @@ LDFLAGS_STATIC_DOCKER="
 	-extldflags \"$EXTLDFLAGS_STATIC\"
 "
 
-if [[ "$(uname -s)" = 'FreeBSD' ]]; then
+if [ "$(uname -s)" = 'FreeBSD' ]; then
 	# Tell cgo the compiler is Clang, not GCC
 	# https://code.google.com/p/go/source/browse/src/cmd/cgo/gcc.go?spec=svne77e74371f2340ee08622ce602e9f7b15f29d8d3&r=e6794866ebeba2bf8818b9261b54e2eef1c9e588#752
 	export CC=clang
@@ -181,7 +181,7 @@ bundle() {
 }
 
 main() {
-	if [[ -z "${KEEPBUNDLE-}" ]]; then
+	if [ -z "${KEEPBUNDLE-}" ]; then
 		echo "Removing bundles/"
 		rm -rf "bundles/*"
 		echo
@@ -189,13 +189,13 @@ main() {
 	mkdir -p bundles
 
 	# Windows and symlinks don't get along well
-	if [[ "$(go env GOHOSTOS)" != 'windows' ]]; then
+	if [ "$(go env GOHOSTOS)" != 'windows' ]; then
 		rm -f bundles/latest
 		# preserve latest symlink for backward compatibility
 		ln -sf . bundles/latest
 	fi
 
-	if [[ $# -lt 1 ]]; then
+	if [ $# -lt 1 ]; then
 		bundles=(${DEFAULT_BUNDLES[@]})
 	else
 		bundles=($@)
diff --git a/hack/make/.binary b/hack/make/.binary
index 6d2a843428..ff33e18cab 100644
--- a/hack/make/.binary
+++ b/hack/make/.binary
@@ -3,7 +3,7 @@ set -e
 
 # a helper to provide ".exe" when it's appropriate
 binary_extension() {
-	if [[ "$(go env GOOS)" = 'windows' ]]; then
+	if [ "$(go env GOOS)" = 'windows' ]; then
 		echo -n '.exe'
 	fi
 }
@@ -17,7 +17,7 @@ BINARY_FULLNAME="$BINARY_NAME$BINARY_EXTENSION"
 source "${MAKEDIR}/.go-autogen"
 
 hash_files() {
-	while [[ $# -gt 0 ]]; do
+	while [ $# -gt 0 ]; do
 		f="$1"
 		shift
 		dir="$(dirname "$f")"
@@ -40,7 +40,7 @@ hash_files() {
 (
 export GOGC=${DOCKER_BUILD_GOGC:-1000}
 
-if [[ "$(go env GOOS)/$(go env GOARCH)" != "$(go env GOHOSTOS)/$(go env GOHOSTARCH)" ]]; then
+if [ "$(go env GOOS)/$(go env GOARCH)" != "$(go env GOHOSTOS)/$(go env GOHOSTARCH)" ]; then
 	# must be cross-compiling!
 	case "$(go env GOOS)/$(go env GOARCH)" in
 		windows/amd64)
diff --git a/hack/make/.detect-daemon-osarch b/hack/make/.detect-daemon-osarch
index 92814dedf2..91e2c53c75 100644
--- a/hack/make/.detect-daemon-osarch
+++ b/hack/make/.detect-daemon-osarch
@@ -36,7 +36,7 @@ DOCKER_CLIENT_GOARCH=${DOCKER_CLIENT_GOARCH:=amd64}
 
 DOCKERFILE='Dockerfile'
 
-if [[ "${DOCKER_ENGINE_GOOS:-$DOCKER_CLIENT_GOOS}" = "windows" ]]; then
+if [ "${DOCKER_ENGINE_GOOS:-$DOCKER_CLIENT_GOOS}" = "windows" ]; then
 	DOCKERFILE='Dockerfile.windows'
 fi
 
diff --git a/hack/make/.ensure-emptyfs b/hack/make/.ensure-emptyfs
index f2f98f73a1..898cc22834 100644
--- a/hack/make/.ensure-emptyfs
+++ b/hack/make/.ensure-emptyfs
@@ -16,7 +16,7 @@ if ! docker image inspect emptyfs > /dev/null; then
 		tar -cf layer.tar --files-from /dev/null
 	)
 	(
-		[[ -n "$TESTDEBUG" ]] && set -x
+		[ -n "$TESTDEBUG" ] && set -x
 		tar -cC "$dir" . | docker load
 	)
 	rm -rf "$dir"
diff --git a/hack/make/.go-autogen b/hack/make/.go-autogen
index 7ce3994752..ef5c6a40f2 100644
--- a/hack/make/.go-autogen
+++ b/hack/make/.go-autogen
@@ -43,7 +43,7 @@ const (
 DVEOF
 
 # Compile the Windows resources into the sources
-if [[ "$(go env GOOS)" = "windows" ]]; then
+if [ "$(go env GOOS)" = "windows" ]; then
 	mkdir -p autogen/winresources/tmp autogen/winresources/docker autogen/winresources/dockerd
 	cp hack/make/.resources-windows/resources.go autogen/winresources/docker/
 	cp hack/make/.resources-windows/resources.go autogen/winresources/dockerd/
@@ -62,9 +62,9 @@ if [[ "$(go env GOOS)" = "windows" ]]; then
 
 	# Pass version and commit information into the resource compiler
 	defs=
-	[[ ! -z $VERSION ]]      && defs="$defs -D DOCKER_VERSION=\"$VERSION\""
-	[[ ! -z $VERSION_QUAD ]] && defs="$defs -D DOCKER_VERSION_QUAD=$VERSION_QUAD"
-	[[ ! -z $GITCOMMIT ]]    && defs="$defs -D DOCKER_COMMIT=\"$GITCOMMIT\""
+	[ ! -z $VERSION ]      && defs="$defs -D DOCKER_VERSION=\"$VERSION\""
+	[ ! -z $VERSION_QUAD ] && defs="$defs -D DOCKER_VERSION_QUAD=$VERSION_QUAD"
+	[ ! -z $GITCOMMIT ]    && defs="$defs -D DOCKER_COMMIT=\"$GITCOMMIT\""
 
 	function makeres {
 		${WINDRES} \
diff --git a/hack/make/.integration-daemon-setup b/hack/make/.integration-daemon-setup
index 397d833b0a..c130e23560 100644
--- a/hack/make/.integration-daemon-setup
+++ b/hack/make/.integration-daemon-setup
@@ -2,6 +2,6 @@
 set -e
 
 source "$MAKEDIR/.detect-daemon-osarch"
-if [[ "$DOCKER_ENGINE_GOOS" != "windows" ]]; then
+if [ "$DOCKER_ENGINE_GOOS" != "windows" ]; then
 	bundle .ensure-emptyfs
 fi
diff --git a/hack/make/.integration-daemon-start b/hack/make/.integration-daemon-start
index f84f0bedb7..aaa573b741 100644
--- a/hack/make/.integration-daemon-start
+++ b/hack/make/.integration-daemon-start
@@ -7,7 +7,7 @@ export PATH="$base/binary-daemon:$base/dynbinary-daemon:$PATH"
 
 export TEST_CLIENT_BINARY=docker
 
-if [[ -n "$DOCKER_CLI_PATH" ]]; then
+if [ -n "$DOCKER_CLI_PATH" ]; then
 	export TEST_CLIENT_BINARY=/usr/local/cli/$(basename "$DOCKER_CLI_PATH")
 fi
 
@@ -19,11 +19,11 @@ fi
 
 # This is a temporary hack for split-binary mode. It can be removed once
 # https://github.com/docker/docker/pull/22134 is merged into docker master
-if [[ "$(go env GOOS)" = 'windows' ]]; then
+if [ "$(go env GOOS)" = 'windows' ]; then
        return
 fi
 
-if [[ -z "$DOCKER_TEST_HOST" ]]; then
+if [ -z "$DOCKER_TEST_HOST" ]; then
 	if docker version &> /dev/null; then
 		echo >&2 'skipping daemon start, since daemon appears to be already started'
 		return
@@ -43,7 +43,7 @@ export DOCKER_USERLANDPROXY=${DOCKER_USERLANDPROXY:-true}
 
 # example usage: DOCKER_STORAGE_OPTS="dm.basesize=20G,dm.loopdatasize=200G"
 storage_params=""
-if [[ -n "$DOCKER_STORAGE_OPTS" ]]; then
+if [ -n "$DOCKER_STORAGE_OPTS" ]; then
 	IFS=','
 	for i in ${DOCKER_STORAGE_OPTS}; do
 		storage_params="--storage-opt $i $storage_params"
@@ -53,24 +53,24 @@ fi
 
 # example usage: DOCKER_REMAP_ROOT=default
 extra_params=""
-if [[ "$DOCKER_REMAP_ROOT" ]]; then
+if [ "$DOCKER_REMAP_ROOT" ]; then
 	extra_params="--userns-remap $DOCKER_REMAP_ROOT"
 fi
 
 # example usage: DOCKER_EXPERIMENTAL=1
-if [[  "$DOCKER_EXPERIMENTAL" ]]; then
+if [  "$DOCKER_EXPERIMENTAL" ]; then
 	echo >&2 '# DOCKER_EXPERIMENTAL is set: starting daemon with experimental features enabled! '
 	extra_params="$extra_params --experimental"
 fi
 
-if [[ -z "$DOCKER_TEST_HOST" ]]; then
+if [ -z "$DOCKER_TEST_HOST" ]; then
 	# Start apparmor if it is enabled
-	if [[ -e "/sys/module/apparmor/parameters/enabled" ]] && [[ "$(cat /sys/module/apparmor/parameters/enabled)" == "Y" ]]; then
+	if [ -e "/sys/module/apparmor/parameters/enabled" ] && [ "$(cat /sys/module/apparmor/parameters/enabled)" == "Y" ]; then
 		# reset container variable so apparmor profile is applied to process
 		# see https://github.com/docker/libcontainer/blob/master/apparmor/apparmor.go#L16
 		export container=""
 		(
-			[[ -n "$TESTDEBUG" ]] && set -x
+			[ -n "$TESTDEBUG" ] && set -x
 			/etc/init.d/apparmor start
 		)
 	fi
@@ -79,7 +79,7 @@ if [[ -z "$DOCKER_TEST_HOST" ]]; then
 	export DOCKER_HOST="unix://$(cd "$DEST" && pwd)/docker.sock"
 	(
 		echo "Starting dockerd"
-		[[ -n "$TESTDEBUG" ]] && set -x
+		[ -n "$TESTDEBUG" ] && set -x
 		exec \
 			dockerd --debug \
 			--host "$DOCKER_HOST" \
@@ -99,9 +99,9 @@ tries=60
 echo "INFO: Waiting for daemon to start..."
 while ! ${TEST_CLIENT_BINARY} version &> /dev/null; do
 	(( tries-- ))
-	if [[ $tries -le 0 ]]; then
+	if [ $tries -le 0 ]; then
 		printf "\n"
-		if [[ -z "$DOCKER_HOST" ]]; then
+		if [ -z "$DOCKER_HOST" ]; then
 			echo >&2 "error: daemon failed to start"
 			echo >&2 "  check $DEST/docker.log for details"
 		else
@@ -109,7 +109,7 @@ while ! ${TEST_CLIENT_BINARY} version &> /dev/null; do
 			${TEST_CLIENT_BINARY} version >&2 || true
 			# Additional Windows CI debugging as this is a common error as of
 			# January 2016
-			if [[ "$(go env GOOS)" = 'windows' ]]; then
+			if [ "$(go env GOOS)" = 'windows' ]; then
 				echo >&2 "Container log below:"
 				echo >&2 "---"
 				# Important - use the docker on the CI host, not the one built locally
diff --git a/hack/make/.integration-daemon-stop b/hack/make/.integration-daemon-stop
index e0d58b7d22..c1d43e1a5e 100644
--- a/hack/make/.integration-daemon-stop
+++ b/hack/make/.integration-daemon-stop
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 
-if [[ ! "$(go env GOOS)" = 'windows' ]]; then
+if [ ! "$(go env GOOS)" = 'windows' ]; then
 	for pidFile in $(find "$DEST" -name docker.pid); do
-		pid=$([[ -n "$TESTDEBUG" ]] && set -x; cat "$pidFile")
+		pid=$([ -n "$TESTDEBUG" ] && set -x; cat "$pidFile")
 		(
-			[[ -n "$TESTDEBUG" ]] && set -x
+			[ -n "$TESTDEBUG" ] && set -x
 			kill "$pid"
 		)
 		if ! wait "$pid"; then
@@ -12,11 +12,11 @@ if [[ ! "$(go env GOOS)" = 'windows' ]]; then
 		fi
 	done
 
-	if [[ -z "$DOCKER_TEST_HOST" ]]; then
+	if [ -z "$DOCKER_TEST_HOST" ]; then
 		# Stop apparmor if it is enabled
-		if [[ -e "/sys/module/apparmor/parameters/enabled" ]] && [[ "$(cat /sys/module/apparmor/parameters/enabled)" == "Y" ]]; then
+		if [ -e "/sys/module/apparmor/parameters/enabled" ] && [ "$(cat /sys/module/apparmor/parameters/enabled)" == "Y" ]; then
 			(
-				[[ -n "$TESTDEBUG" ]] && set -x
+				[ -n "$TESTDEBUG" ] && set -x
 				/etc/init.d/apparmor stop
 			)
 		fi
diff --git a/hack/make/.integration-test-helpers b/hack/make/.integration-test-helpers
index 4ece2dedae..d9196b9c49 100644
--- a/hack/make/.integration-test-helpers
+++ b/hack/make/.integration-test-helpers
@@ -5,7 +5,7 @@
 #
 #     TESTFLAGS='-check.f DockerSuite.TestBuild*' ./hack/make.sh binary test-integration
 #
-if [[ -z ${MAKEDIR} ]]; then
+if [ -z ${MAKEDIR} ]; then
 	export MAKEDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 fi
 source "$MAKEDIR/.go-autogen"
@@ -28,7 +28,7 @@ run_test_integration_suites() {
 	local flags="-test.v -test.timeout=${TIMEOUT} $TESTFLAGS"
 	for dir in ${integration_api_dirs}; do
 		if ! (
-			cd ${dir}
+			cd "$dir"
 			echo "Running $PWD"
 			test_env ./test.main ${flags}
 		); then exit 1; fi
@@ -45,7 +45,7 @@ run_test_integration_legacy_suites() {
 }
 
 build_test_suite_binaries() {
-	if [[ ${DOCKER_INTEGRATION_TESTS_VERIFIED-} ]]; then
+	if [ ${DOCKER_INTEGRATION_TESTS_VERIFIED-} ]; then
 		echo "Skipping building test binaries; as DOCKER_INTEGRATION_TESTS_VERIFIED is set"
 		return
 	fi
@@ -64,7 +64,7 @@ build_test_suite_binary() {
 }
 
 cleanup_test_suite_binaries() {
-	[[ -n "$TESTDEBUG" ]] && return
+	[ -n "$TESTDEBUG" ] && return
 	echo "Removing test suite binaries"
 	find integration* -name test.main | xargs -r rm
 }
@@ -80,7 +80,7 @@ repeat() {
 test_env() {
 	(
 		set -e
-		[[ -n "$TESTDEBUG" ]] && set -x
+		[ -n "$TESTDEBUG" ] && set -x
 		env -i \
 			DEST="$ABS_DEST" \
 			DOCKER_API_VERSION="$DOCKER_API_VERSION" \
@@ -107,13 +107,13 @@ test_env() {
    
 
 error_on_leaked_containerd_shims() {
-	if [[ "$(go env GOOS)" == 'windows' ]]; then
+	if [ "$(go env GOOS)" == 'windows' ]; then
 		return
 	fi
 
 	leftovers=$(ps -ax -o pid,cmd |
 	            awk '$2 == "containerd-shim" && $4 ~ /.*\/bundles\/.*\/test-integration/ { print $1 }')
-	if [[ -n "$leftovers" ]]; then
+	if [ -n "$leftovers" ]; then
 		ps aux
 		kill -9 ${leftovers} 2> /dev/null
 		echo "!!!! WARNING you have left over shim(s), Cleanup your test !!!!"
diff --git a/hack/make/binary-daemon b/hack/make/binary-daemon
index 13c1d66c76..c1a6e6f9ed 100644
--- a/hack/make/binary-daemon
+++ b/hack/make/binary-daemon
@@ -7,21 +7,21 @@ copy_binaries() {
 	# Add nested executables to bundle dir so we have complete set of
 	# them available, but only if the native OS/ARCH is the same as the
 	# OS/ARCH of the build target
-	if [[ "$(go env GOOS)/$(go env GOARCH)" != "$(go env GOHOSTOS)/$(go env GOHOSTARCH)" ]]; then
+	if [ "$(go env GOOS)/$(go env GOARCH)" != "$(go env GOHOSTOS)/$(go env GOHOSTARCH)" ]; then
 		return
 	fi
-	if [[ ! -x /usr/local/bin/runc ]]; then
+	if [ ! -x /usr/local/bin/runc ]; then
 		return
 	fi
 	echo "Copying nested executables into $dir"
 	for file in containerd containerd-shim ctr runc docker-init docker-proxy; do
 		cp -f `which "$file"` "$dir/"
-		if [[ "$hash" == "hash" ]]; then
+		if [ "$hash" == "hash" ]; then
 			hash_files "$dir/$file"
 		fi
 	done
 }
 
-[[ -z "$KEEPDEST" ]] && rm -rf "$DEST"
+[ -z "$KEEPDEST" ] && rm -rf "$DEST"
 source "${MAKEDIR}/.binary"
 copy_binaries "$DEST" 'hash'
diff --git a/hack/make/cross b/hack/make/cross
index 669005beca..47cb667af2 100644
--- a/hack/make/cross
+++ b/hack/make/cross
@@ -2,14 +2,14 @@
 set -e
 
 # if we have our linux/amd64 version compiled, let's symlink it in
-if [[ -x "$DEST/../binary-daemon/dockerd-$VERSION" ]]; then
+if [ -x "${DEST}/../binary-daemon/dockerd-${VERSION}" ]; then
 	arch=$(go env GOHOSTARCH)
 	mkdir -p "$DEST/linux/${arch}"
 	(
-		cd "$DEST/linux/${arch}"
+		cd "${DEST}/linux/${arch}"
 		ln -sf ../../../binary-daemon/* ./
 	)
-	echo "Created symlinks:" "$DEST/linux/${arch}/"*
+	echo "Created symlinks:" "${DEST}/linux/${arch}/"*
 fi
 
 DOCKER_CROSSPLATFORMS=${DOCKER_CROSSPLATFORMS:-"linux/amd64 windows/amd64"}
@@ -17,13 +17,13 @@ DOCKER_CROSSPLATFORMS=${DOCKER_CROSSPLATFORMS:-"linux/amd64 windows/amd64"}
 for platform in ${DOCKER_CROSSPLATFORMS}; do
 	(
 		export KEEPDEST=1
-		export DEST="$DEST/$platform" # bundles/VERSION/cross/GOOS/GOARCH/docker-VERSION
+		export DEST="${DEST}/${platform}" # bundles/VERSION/cross/GOOS/GOARCH/docker-VERSION
 		export GOOS=${platform%/*}
 		export GOARCH=${platform##*/}
 
-		echo "Cross building: $DEST"
-		mkdir -p "$DEST"
-		ABS_DEST="$(cd "$DEST" && pwd -P)"
+		echo "Cross building: ${DEST}"
+		mkdir -p "${DEST}"
+		ABS_DEST="$(cd "${DEST}" && pwd -P)"
 		source "${MAKEDIR}/binary-daemon"
 
 		source "${MAKEDIR}/cross-platform-dependent"
diff --git a/hack/make/cross-platform-dependent b/hack/make/cross-platform-dependent
index 135fc031f5..21824ed7c9 100644
--- a/hack/make/cross-platform-dependent
+++ b/hack/make/cross-platform-dependent
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 set -e
 
-if [[ ${platform} == "windows/amd64" ]]; then
+if [ ${platform} == "windows/amd64" ]; then
 	source "${MAKEDIR}/containerutility"
 fi
diff --git a/hack/make/install-binary b/hack/make/install-binary
index 7a1af19b9c..f6a4361fdb 100644
--- a/hack/make/install-binary
+++ b/hack/make/install-binary
@@ -6,7 +6,7 @@ rm -rf "$DEST"
 install_binary() {
 	local file="$1"
 	local target="${DOCKER_MAKE_INSTALL_PREFIX:=/usr/local}/bin/"
-	if [[ "$(go env GOOS)" == "linux" ]]; then
+	if [ "$(go env GOOS)" == "linux" ]; then
 		echo "Installing $(basename $file) to ${target}"
 		mkdir -p "$target"
 		cp -f -L "$file" "$target"
diff --git a/hack/make/run b/hack/make/run
index d8cbb3e46b..eff7dd95aa 100644
--- a/hack/make/run
+++ b/hack/make/run
@@ -13,7 +13,7 @@ DOCKER_USERLANDPROXY=${DOCKER_USERLANDPROXY:-true}
 
 # example usage: DOCKER_STORAGE_OPTS="dm.basesize=20G,dm.loopdatasize=200G"
 storage_params=""
-if [[ -n "$DOCKER_STORAGE_OPTS" ]]; then
+if [ -n "$DOCKER_STORAGE_OPTS" ]; then
 	IFS=','
 	for i in ${DOCKER_STORAGE_OPTS}; do
 		storage_params="--storage-opt $i $storage_params"
@@ -23,13 +23,13 @@ fi
 
 
 listen_port=2375
-if [[ -n "$DOCKER_PORT" ]]; then
+if [ -n "$DOCKER_PORT" ]; then
 	IFS=':' read -r -a ports <<< "$DOCKER_PORT"
 	listen_port="${ports[-1]}"
 fi
 
 extra_params="$DOCKERD_ARGS"
-if [[ "$DOCKER_REMAP_ROOT" ]]; then
+if [ "$DOCKER_REMAP_ROOT" ]; then
 	extra_params="$extra_params --userns-remap $DOCKER_REMAP_ROOT"
 fi
 
diff --git a/hack/make/test-docker-py b/hack/make/test-docker-py
index 6a35b44896..b30879e3a0 100644
--- a/hack/make/test-docker-py
+++ b/hack/make/test-docker-py
@@ -8,7 +8,7 @@ source hack/make/.integration-test-helpers
 	bundle .integration-daemon-start
 
 	dockerPy='/docker-py'
-	[[ -d "$dockerPy" ]] || {
+	[ -d "$dockerPy" ] || {
 		dockerPy="$DEST/docker-py"
 		git clone https://github.com/docker/docker-py.git "$dockerPy"
 	}
diff --git a/hack/test/e2e-run.sh b/hack/test/e2e-run.sh
index d4ac42b872..122d58f8ef 100755
--- a/hack/test/e2e-run.sh
+++ b/hack/test/e2e-run.sh
@@ -2,7 +2,7 @@
 set -e -u -o pipefail
 
 ARCH=$(uname -m)
-if [[ "$ARCH" == "x86_64" ]]; then
+if [ "$ARCH" == "x86_64" ]; then
   ARCH="amd64"
 fi
 
@@ -45,7 +45,7 @@ run_test_integration_legacy_suites() {
 test_env() {
 	(
 		set -e +u
-		[[ -n "$TESTDEBUG" ]] && set -x
+		[ -n "$TESTDEBUG" ] && set -x
 		env -i \
 			DOCKER_API_VERSION="$DOCKER_API_VERSION" \
 			DOCKER_INTEGRATION_DAEMON_DEST="$DOCKER_INTEGRATION_DAEMON_DEST" \
diff --git a/hack/validate/.validate b/hack/validate/.validate
index e9c54b25e5..32cb6b6d64 100644
--- a/hack/validate/.validate
+++ b/hack/validate/.validate
@@ -2,7 +2,7 @@
 
 set -e -o pipefail
 
-if [[ -z "$VALIDATE_UPSTREAM" ]]; then
+if [ -z "$VALIDATE_UPSTREAM" ]; then
 	# this is kind of an expensive check, so let's not do this twice if we
 	# are running more than one validate bundlescript
 
@@ -18,12 +18,12 @@ if [[ -z "$VALIDATE_UPSTREAM" ]]; then
 	VALIDATE_COMMIT_DIFF="$VALIDATE_UPSTREAM...$VALIDATE_HEAD"
 
 	validate_diff() {
-		if [[ "$VALIDATE_UPSTREAM" != "$VALIDATE_HEAD" ]]; then
+		if [ "$VALIDATE_UPSTREAM" != "$VALIDATE_HEAD" ]; then
 			git diff "$VALIDATE_COMMIT_DIFF" "$@"
 		fi
 	}
 	validate_log() {
-		if [[ "$VALIDATE_UPSTREAM" != "$VALIDATE_HEAD" ]]; then
+		if [ "$VALIDATE_UPSTREAM" != "$VALIDATE_HEAD" ]; then
 			git log "$VALIDATE_COMMIT_LOG" "$@"
 		fi
 	}
diff --git a/hack/validate/changelog-date-descending b/hack/validate/changelog-date-descending
index 183da80700..b9c3368ca6 100755
--- a/hack/validate/changelog-date-descending
+++ b/hack/validate/changelog-date-descending
@@ -2,7 +2,7 @@
 
 changelogFile=${1:-CHANGELOG.md}
 
-if [[ ! -r "$changelogFile" ]]; then
+if [ ! -r "$changelogFile" ]; then
   echo "Unable to read file $changelogFile" >&2
   exit 1
 fi
diff --git a/hack/validate/changelog-well-formed b/hack/validate/changelog-well-formed
index fe629c8d08..6c7ce1a1c0 100755
--- a/hack/validate/changelog-well-formed
+++ b/hack/validate/changelog-well-formed
@@ -2,7 +2,7 @@
 
 changelogFile=${1:-CHANGELOG.md}
 
-if [[ ! -r "$changelogFile" ]]; then
+if [ ! -r "$changelogFile" ]; then
   echo "Unable to read file $changelogFile" >&2
   exit 1
 fi
diff --git a/hack/validate/dco b/hack/validate/dco
index 9051562f90..9e1ed80f77 100755
--- a/hack/validate/dco
+++ b/hack/validate/dco
@@ -21,13 +21,13 @@ check_dco() {
 	grep -qE "$dcoRegex"
 }
 
-if [[ ${adds} -eq 0 && ${dels} -eq 0 ]]; then
+if [ ${adds} -eq 0 -a ${dels} -eq 0 ]; then
 	echo '0 adds, 0 deletions; nothing to validate! :)'
 else
 	commits=( $(validate_log --format='format:%H%n') )
 	badCommits=()
 	for commit in "${commits[@]}"; do
-		if [[ -z "$(git log -1 --format='format:' --name-status "$commit")" ]]; then
+		if [ -z "$(git log -1 --format='format:' --name-status "$commit")" ]; then
 			# no content (ie, Merge commit, etc)
 			continue
 		fi
@@ -35,7 +35,7 @@ else
 			badCommits+=( "$commit" )
 		fi
 	done
-	if [[ ${#badCommits[@]} -eq 0 ]]; then
+	if [ ${#badCommits[@]} -eq 0 ]; then
 		echo "Congratulations!  All commits are properly signed with the DCO!"
 	else
 		{
diff --git a/hack/validate/default-seccomp b/hack/validate/default-seccomp
index 328bd9a68e..24cbf00d24 100755
--- a/hack/validate/default-seccomp
+++ b/hack/validate/default-seccomp
@@ -7,12 +7,12 @@ IFS=$'\n'
 files=( $(validate_diff --diff-filter=ACMR --name-only -- 'profiles/seccomp' || true) )
 unset IFS
 
-if [[ ${#files[@]} -gt 0 ]]; then
+if [ ${#files[@]} -gt 0 ]; then
 	# We run 'go generate' and see if we have a diff afterwards
 	go generate ./profiles/seccomp/ >/dev/null
 	# Let see if the working directory is clean
 	diffs="$(git status --porcelain -- profiles/seccomp 2>/dev/null)"
-	if [[ "$diffs" ]]; then
+	if [ "$diffs" ]; then
 		{
 			echo 'The result of go generate ./profiles/seccomp/ differs'
 			echo
diff --git a/hack/validate/deprecate-integration-cli b/hack/validate/deprecate-integration-cli
index d83a2881d7..da6f8310f4 100755
--- a/hack/validate/deprecate-integration-cli
+++ b/hack/validate/deprecate-integration-cli
@@ -9,7 +9,7 @@ new_tests=$(
     grep -E '^\+func (.*) Test' || true
 )
 
-if [[ -z "$new_tests" ]]; then
+if [ -z "$new_tests" ]; then
 	echo 'Congratulations!  No new tests added to integration-cli.'
     exit
 fi
diff --git a/hack/validate/pkg-imports b/hack/validate/pkg-imports
index f25d7291e6..a9aab6456f 100755
--- a/hack/validate/pkg-imports
+++ b/hack/validate/pkg-imports
@@ -19,7 +19,7 @@ for f in "${files[@]}"; do
 	done
 done
 
-if [[ ${#badFiles[@]} -eq 0 ]]; then
+if [ ${#badFiles[@]} -eq 0 ]; then
 	echo 'Congratulations!  "./pkg/..." is safely isolated from internal code.'
 else
 	{
diff --git a/hack/validate/swagger b/hack/validate/swagger
index 7eae418d18..0b3c2719d8 100755
--- a/hack/validate/swagger
+++ b/hack/validate/swagger
@@ -7,7 +7,7 @@ IFS=$'\n'
 files=( $(validate_diff --diff-filter=ACMR --name-only -- 'api/swagger.yaml' || true) )
 unset IFS
 
-if [[ ${#files[@]} -gt 0 ]]; then
+if [ ${#files[@]} -gt 0 ]; then
   yamllint -c ${SCRIPTDIR}/.swagger-yamllint api/swagger.yaml
   swagger validate api/swagger.yaml
 fi
diff --git a/hack/validate/swagger-gen b/hack/validate/swagger-gen
index f678d524dc..07c22b5a62 100755
--- a/hack/validate/swagger-gen
+++ b/hack/validate/swagger-gen
@@ -7,11 +7,11 @@ IFS=$'\n'
 files=( $(validate_diff --diff-filter=ACMR --name-only -- 'api/types/' 'api/swagger.yaml' || true) )
 unset IFS
 
-if [[ ${#files[@]} -gt 0 ]]; then
+if [ ${#files[@]} -gt 0 ]; then
 	${SCRIPTDIR}/../generate-swagger-api.sh 2> /dev/null
 	# Let see if the working directory is clean
 	diffs="$(git diff -- api/types/)"
-	if [[ "$diffs" ]]; then
+	if [ "$diffs" ]; then
 		{
 			echo 'The result of hack/generate-swagger-api.sh differs'
 			echo
diff --git a/hack/validate/test-imports b/hack/validate/test-imports
index 70440749bd..0e836a31c0 100755
--- a/hack/validate/test-imports
+++ b/hack/validate/test-imports
@@ -11,20 +11,20 @@ unset IFS
 badFiles=()
 for f in "${files[@]}"; do
 	# skip check_test.go since it *does* use the testing package
-	if [[ "$f" = "integration-cli/check_test.go" ]]; then
+	if [ "$f" = "integration-cli/check_test.go" ]; then
 		continue
 	fi
 
 	# we use "git show" here to validate that what's committed doesn't contain golang built-in testing
 	if git show "$VALIDATE_HEAD:$f" | grep -q testing.T; then
-		if [[ "$(echo $f | grep '_test')" ]]; then
+		if [ "$(echo $f | grep '_test')" ]; then
 			# allow testing.T for non- _test files
 			badFiles+=( "$f" )
 		fi
 	fi
 done
 
-if [[ ${#badFiles[@]} -eq 0 ]]; then
+if [ ${#badFiles[@]} -eq 0 ]; then
 	echo 'Congratulations!  No testing.T found.'
 else
 	{
diff --git a/hack/validate/toml b/hack/validate/toml
index f8ec729f6b..d5b2ce1c29 100755
--- a/hack/validate/toml
+++ b/hack/validate/toml
@@ -15,7 +15,7 @@ for f in "${files[@]}"; do
 	fi
 done
 
-if [[ ${#badFiles[@]} -eq 0 ]]; then
+if [ ${#badFiles[@]} -eq 0 ]; then
 	echo 'Congratulations!  All toml source files changed here have valid syntax.'
 else
 	{
diff --git a/hack/validate/vendor b/hack/validate/vendor
index 60cce34112..41676fed53 100755
--- a/hack/validate/vendor
+++ b/hack/validate/vendor
@@ -8,12 +8,12 @@ validate_vendor_diff(){
 	files=( $(validate_diff --diff-filter=ACMR --name-only -- 'vendor.conf' 'vendor/' || true) )
 	unset IFS
 
-	if [[ ${#files[@]} -gt 0 ]]; then
+	if [ ${#files[@]} -gt 0 ]; then
 		# recreate vendor/
 		vndr
 		# check if any files have changed
 		diffs="$(git status --porcelain -- vendor 2>/dev/null)"
-		if [[ "$diffs" ]]; then
+		if [ "$diffs" ]; then
 			{
 				echo 'The result of vndr differs'
 				echo
@@ -38,7 +38,7 @@ validate_vendor_used() {
 	for f in $pkgs; do
 	if ls -d vendor/$f  > /dev/null 2>&1; then
 		found=$(find vendor/$f -iregex '.*LICENSE.*' -or -iregex '.*COPYRIGHT.*' -or -iregex '.*COPYING.*' | wc -l)
-		if [[ ${found} -eq 0 ]]; then
+		if [ $found -eq 0 ]; then
 		echo "WARNING: could not find copyright information for $f"
 		fi
 	else