diff --git a/.gitignore b/.gitignore
index 05d2662884..097fd203b0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -31,3 +31,6 @@ bin/swarmkitstate
 
 # ignore code coverage output
 *coverage.txt
+
+# dev sync, if used
+/.docker-sync/
diff --git a/.gometalinter.json b/.gometalinter.json
new file mode 100644
index 0000000000..6710a180dc
--- /dev/null
+++ b/.gometalinter.json
@@ -0,0 +1,17 @@
+{
+	"Vendor": true,
+	"Exclude": [
+		".*\\.pb\\.go"
+	],
+	"Enable": [
+		"vet",
+		"misspell",
+		"gofmt",
+		"goimports",
+		"golint",
+		"ineffassign",
+		"deadcode",
+		"unconvert"
+	],
+	"Deadline": "2m"
+}
diff --git a/BUILDING.md b/BUILDING.md
index 70e96f5abb..db82902a90 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -113,3 +113,15 @@ NB: As of version 3.0.0-7 the Debian `protobuf-compiler` package lacks
 a dependency on `libprotobuf-dev` which contains some standard proto
 definitions, be sure to install both packages. This is [Debian bug
 #842158](https://bugs.debian.org/842158).
+
+### Build in a container instead of your local environment
+
+You can also choose to use a container to build SwarmKit and run tests. Simply
+set the `DOCKER_SWARMKIT_USE_CONTAINER` environment variable to any value,
+export it, then run `make` targets as you would have done within your local
+environment.
+
+Additionally, if your OS is not Linux, you might want to set and export the
+`DOCKER_SWARMKIT_USE_DOCKER_SYNC` environment variable, which will make use of
+[docker-sync](https://github.com/EugenMayer/docker-sync) to sync the code to
+the container, instead of native mounted volumes.
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000000..4a951ecc69
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,30 @@
+# NOTE(dperny): for some reason, alpine was giving me trouble
+FROM golang:1.10.3-stretch
+
+RUN apt-get update && apt-get install -y make git unzip
+
+# should stay consistent with the version we use in Circle builds
+ARG PROTOC_VERSION=3.5.0
+# make a directory to do these operations in
+RUN export PROTOC_TMP_DIR=protoc && mkdir -p $PROTOC_TMP_DIR && cd $PROTOC_TMP_DIR \
+  # download the pre-built protoc binary
+  && curl --silent --show-error --location --output protoc.zip \
+    https://github.com/google/protobuf/releases/download/v$PROTOC_VERSION/protoc-$PROTOC_VERSION-linux-x86_64.zip \
+  # move the binary to /bin. move the well-known types ot /usr/local/include
+  && unzip protoc.zip && mv bin/protoc /bin/protoc && mv include/* /usr/local/include \
+  # remove all of the installation files
+  && cd .. && rm -rf $PROTOC_TMP_DIR
+
+WORKDIR /go/src/github.com/docker/swarmkit/
+
+# install the dependencies from `make setup`
+# we only copy `direct.mk` to avoid busting the cache too easily
+COPY direct.mk .
+RUN make --file=direct.mk setup
+
+# now we can copy the rest
+COPY . .
+
+# default to just `make`. If you want to change the default command, change the
+# default make command, not this command.
+CMD ["make"]
diff --git a/Makefile b/Makefile
index b9dbdd3d3a..8696f2dd64 100644
--- a/Makefile
+++ b/Makefile
@@ -24,136 +24,15 @@ VNDR=$(shell which vndr || echo '')
 
 GO_LDFLAGS=-ldflags "-X `go list ./version`.Version=$(VERSION)"
 
-.PHONY: clean all AUTHORS fmt vet lint build binaries test integration setup generate protos checkprotos coverage ci check help install uninstall dep-validate
-.DEFAULT: default
-
-all: check binaries test integration ## run fmt, vet, lint, build the binaries and run the tests
-
-check: fmt vet lint ineffassign misspell ## run fmt, vet, lint, ineffassign, misspell
-
-ci: check binaries checkprotos coverage coverage-integration ## to be used by the CI
-
-AUTHORS: .mailmap .git/HEAD
-	git log --format='%aN <%aE>' | sort -fu > $@
-
-# This only needs to be generated by hand when cutting full releases.
-version/version.go:
-	./version/version.sh > $@
-
-setup: ## install dependencies
-	@echo "🐳 $@"
-	# TODO(stevvooe): Install these from the vendor directory
-	@go get -u github.com/golang/lint/golint
-	#@go get -u github.com/kisielk/errcheck
-	@go get -u github.com/gordonklaus/ineffassign
-	@go get -u github.com/client9/misspell/cmd/misspell
-	@go get -u github.com/lk4d4/vndr
-	@go get -u github.com/stevvooe/protobuild
-
-generate: protos
-	@echo "🐳 $@"
-	@PATH=${ROOTDIR}/bin:${PATH} go generate -x ${PACKAGES}
-
-protos: bin/protoc-gen-gogoswarm ## generate protobuf
-	@echo "🐳 $@"
-	@PATH=${ROOTDIR}/bin:${PATH} protobuild ${PACKAGES}
-
-checkprotos: generate ## check if protobufs needs to be generated again
-	@echo "🐳 $@"
-	@test -z "$$(git status --short | grep ".pb.go" | tee /dev/stderr)" || \
-		((git diff | cat) && \
-		(echo "👹 please run 'make generate' when making changes to proto files" && false))
-
-# Depends on binaries because vet will silently fail if it can't load compiled
-# imports
-vet: binaries ## run go vet
-	@echo "🐳 $@"
-	@test -z "$$(go vet ${PACKAGES} 2>&1 | grep -v 'constant [0-9]* not a string in call to Errorf' | egrep -v '(timestamp_test.go|duration_test.go|exit status 1)' | tee /dev/stderr)"
-
-misspell:
-	@echo "🐳 $@"
-	@test -z "$$(find . -type f | grep -v vendor/ | grep -v bin/ | grep -v .git/ | grep -v MAINTAINERS | xargs misspell | tee /dev/stderr)"
-
-fmt: ## run go fmt
-	@echo "🐳 $@"
-	@test -z "$$(gofmt -s -l . | grep -v vendor/ | grep -v ".pb.go$$" | tee /dev/stderr)" || \
-		(echo "👹 please format Go code with 'gofmt -s -w'" && false)
-	@test -z "$$(find . -path ./vendor -prune -o ! -name timestamp.proto ! -name duration.proto -name '*.proto' -type f -exec grep -Hn -e "^ " {} \; | tee /dev/stderr)" || \
-		(echo "👹 please indent proto files with tabs only" && false)
-	@test -z "$$(find . -path ./vendor -prune -o -name '*.proto' -type f -exec grep -Hn "Meta meta = " {} \; | grep -v '(gogoproto.nullable) = false' | tee /dev/stderr)" || \
-		(echo "👹 meta fields in proto files must have option (gogoproto.nullable) = false" && false)
-
-lint: ## run go lint
-	@echo "🐳 $@"
-	@test -z "$$(golint ./... | grep -v vendor/ | grep -v ".pb.go:" | tee /dev/stderr)"
-
-ineffassign: ## run ineffassign
-	@echo "🐳 $@"
-	@test -z "$$(ineffassign . | grep -v vendor/ | grep -v ".pb.go:" | tee /dev/stderr)"
-
-#errcheck: ## run go errcheck
-#	@echo "🐳 $@"
-#	@test -z "$$(errcheck ./... | grep -v vendor/ | grep -v ".pb.go:" | tee /dev/stderr)"
-
-build: ## build the go packages
-	@echo "🐳 $@"
-	@go build -i -tags "${DOCKER_BUILDTAGS}" -v ${GO_LDFLAGS} ${GO_GCFLAGS} ${PACKAGES}
-
-test: ## run tests, except integration tests
-	@echo "🐳 $@"
-	@go test -parallel 8 ${RACE} -tags "${DOCKER_BUILDTAGS}" $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES})
-
-integration: ## run integration tests
-	@echo "🐳 $@"
-	@go test -parallel 8 ${RACE} -tags "${DOCKER_BUILDTAGS}" ${INTEGRATION_PACKAGE}
-
-FORCE:
-
-# Build a binary from a cmd.
-bin/%: cmd/% FORCE
-	@test $$(go list) = "${PROJECT_ROOT}" || \
-		(echo "👹 Please correctly set up your Go build environment. This project must be located at <GOPATH>/src/${PROJECT_ROOT}" && false)
-	@echo "🐳 $@"
-	@go build -i -tags "${DOCKER_BUILDTAGS}" -o $@ ${GO_LDFLAGS}  ${GO_GCFLAGS} ./$<
-
-binaries: $(BINARIES) ## build binaries
-	@echo "🐳 $@"
-
-clean: ## clean up binaries
-	@echo "🐳 $@"
-	@rm -f $(BINARIES)
-
-install: $(BINARIES) ## install binaries
-	@echo "🐳 $@"
-	@mkdir -p $(DESTDIR)/bin
-	@install $(BINARIES) $(DESTDIR)/bin
-
-uninstall:
-	@echo "🐳 $@"
-	@rm -f $(addprefix $(DESTDIR)/bin/,$(notdir $(BINARIES)))
-
-coverage: ## generate coverprofiles from the unit tests
-	@echo "🐳 $@"
-	@( for pkg in $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES}); do \
-		go test -i ${RACE} -tags "${DOCKER_BUILDTAGS}" -test.short -coverprofile="../../../$$pkg/coverage.txt" -covermode=atomic $$pkg || exit; \
-		go test ${RACE} -tags "${DOCKER_BUILDTAGS}" -test.short -coverprofile="../../../$$pkg/coverage.txt" -covermode=atomic $$pkg || exit; \
-	done )
-
-coverage-integration: ## generate coverprofiles from the integration tests
-	@echo "🐳 $@"
-	go test ${RACE} -tags "${DOCKER_BUILDTAGS}" -test.short -coverprofile="../../../${INTEGRATION_PACKAGE}/coverage.txt" -covermode=atomic ${INTEGRATION_PACKAGE}
-
-help: ## this help
-	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST) | sort
-
-dep-validate:
-	@echo "+ $@"
-	$(if $(VNDR), , \
-		$(error Please install vndr: go get github.com/lk4d4/vndr))
-	@rm -Rf .vendor.bak
-	@mv vendor .vendor.bak
-	@$(VNDR)
-	@test -z "$$(diff -r vendor .vendor.bak 2>&1 | tee /dev/stderr)" || \
-		(echo >&2 "+ inconsistent dependencies! what you have in vendor.conf does not match with what you have in vendor" && false)
-	@rm -Rf vendor
-	@mv .vendor.bak vendor
+SHELL := /bin/bash
+
+# stop here. do we want to run everything inside of a container, or do we want
+# to run it directly on the host? if the user has set ANY non-empty value for
+# the variable DOCKER_SWARMKIT_USE_CONTAINER, then we do all of the making
+# inside of a container. We will default to using no container, to avoid
+# breaking anyone's workflow
+ifdef DOCKER_SWARMKIT_USE_CONTAINER
+include containerized.mk
+else
+include direct.mk
+endif
diff --git a/agent/agent.go b/agent/agent.go
index 4a11c69e2f..a40221a99a 100644
--- a/agent/agent.go
+++ b/agent/agent.go
@@ -2,6 +2,7 @@ package agent
 
 import (
 	"bytes"
+	"context"
 	"fmt"
 	"math/rand"
 	"reflect"
@@ -11,7 +12,6 @@ import (
 	"github.com/docker/swarmkit/agent/exec"
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/log"
-	"golang.org/x/net/context"
 )
 
 const (
diff --git a/agent/agent_test.go b/agent/agent_test.go
index 8b84e957b2..49c33b908a 100644
--- a/agent/agent_test.go
+++ b/agent/agent_test.go
@@ -1,6 +1,7 @@
 package agent
 
 import (
+	"context"
 	"crypto/tls"
 	"errors"
 	"fmt"
@@ -25,7 +26,6 @@ import (
 	"github.com/docker/swarmkit/xnet"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 )
 
 var localDispatcher = false
@@ -90,7 +90,8 @@ func TestAgentStartStop(t *testing.T) {
 	require.NoError(t, err)
 	assert.NotNil(t, agent)
 
-	ctx, _ := context.WithTimeout(tc.Context, 5000*time.Millisecond)
+	ctx, cancel := context.WithTimeout(tc.Context, 5000*time.Millisecond)
+	defer cancel()
 
 	assert.Equal(t, errAgentNotStarted, agent.Stop(ctx))
 	assert.NoError(t, agent.Start(ctx))
diff --git a/agent/errors.go b/agent/errors.go
index 29f8ff1c9f..f5514d8311 100644
--- a/agent/errors.go
+++ b/agent/errors.go
@@ -13,10 +13,5 @@ var (
 	errAgentStarted    = errors.New("agent: already started")
 	errAgentNotStarted = errors.New("agent: not started")
 
-	errTaskNoController         = errors.New("agent: no task controller")
-	errTaskNotAssigned          = errors.New("agent: task not assigned")
-	errTaskStatusUpdateNoChange = errors.New("agent: no change in task status")
-	errTaskUnknown              = errors.New("agent: task unknown")
-
-	errTaskInvalid = errors.New("task: invalid")
+	errTaskUnknown = errors.New("agent: task unknown")
 )
diff --git a/agent/exec/containerd/adapter.go b/agent/exec/containerd/adapter.go
index 36365e8887..a07a6947d9 100644
--- a/agent/exec/containerd/adapter.go
+++ b/agent/exec/containerd/adapter.go
@@ -1,6 +1,7 @@
 package containerd
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -20,7 +21,6 @@ import (
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 )
 
 var (
diff --git a/agent/exec/containerd/controller.go b/agent/exec/containerd/controller.go
index 43b8bfebc4..8c1070f88a 100644
--- a/agent/exec/containerd/controller.go
+++ b/agent/exec/containerd/controller.go
@@ -1,6 +1,7 @@
 package containerd
 
 import (
+	"context"
 	"fmt"
 
 	"github.com/containerd/containerd"
@@ -8,7 +9,6 @@ import (
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/log"
 	"github.com/pkg/errors"
-	"golang.org/x/net/context"
 )
 
 type controller struct {
diff --git a/agent/exec/containerd/executor.go b/agent/exec/containerd/executor.go
index 3b9f9ba09c..8949ec7ec7 100644
--- a/agent/exec/containerd/executor.go
+++ b/agent/exec/containerd/executor.go
@@ -1,6 +1,7 @@
 package containerd
 
 import (
+	"context"
 	"os"
 	"runtime"
 
@@ -12,7 +13,6 @@ import (
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/log"
 	"github.com/pkg/errors"
-	"golang.org/x/net/context"
 )
 
 type executor struct {
diff --git a/agent/exec/controller.go b/agent/exec/controller.go
index c9e9343fd7..b617d37ca3 100644
--- a/agent/exec/controller.go
+++ b/agent/exec/controller.go
@@ -1,6 +1,7 @@
 package exec
 
 import (
+	"context"
 	"fmt"
 	"time"
 
@@ -10,7 +11,6 @@ import (
 	"github.com/docker/swarmkit/protobuf/ptypes"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 )
 
 // Controller controls execution of a task.
diff --git a/agent/exec/controller_stub.go b/agent/exec/controller_stub.go
index 076955ff80..dd16ce457d 100644
--- a/agent/exec/controller_stub.go
+++ b/agent/exec/controller_stub.go
@@ -1,10 +1,11 @@
 package exec
 
 import (
-	"github.com/docker/swarmkit/api"
-	"golang.org/x/net/context"
+	"context"
 	"runtime"
 	"strings"
+
+	"github.com/docker/swarmkit/api"
 )
 
 // StubController implements the Controller interface,
diff --git a/agent/exec/controller_test.go b/agent/exec/controller_test.go
index 2de4f436f3..76634056a2 100644
--- a/agent/exec/controller_test.go
+++ b/agent/exec/controller_test.go
@@ -1,6 +1,7 @@
 package exec
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"runtime"
@@ -10,7 +11,6 @@ import (
 	"github.com/docker/swarmkit/log"
 	gogotypes "github.com/gogo/protobuf/types"
 	"github.com/stretchr/testify/assert"
-	"golang.org/x/net/context"
 )
 
 func TestResolve(t *testing.T) {
diff --git a/agent/exec/dockerapi/adapter.go b/agent/exec/dockerapi/adapter.go
index 45943dd9ea..fd3cab4b31 100644
--- a/agent/exec/dockerapi/adapter.go
+++ b/agent/exec/dockerapi/adapter.go
@@ -1,6 +1,7 @@
 package dockerapi
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -16,7 +17,6 @@ import (
 	gogotypes "github.com/gogo/protobuf/types"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 	"golang.org/x/time/rate"
 )
 
@@ -144,15 +144,13 @@ func (c *containerAdapter) removeNetworks(ctx context.Context) error {
 }
 
 func (c *containerAdapter) create(ctx context.Context) error {
-	if _, err := c.client.ContainerCreate(ctx,
+	_, err := c.client.ContainerCreate(ctx,
 		c.container.config(),
 		c.container.hostConfig(),
 		c.container.networkingConfig(),
-		c.container.name()); err != nil {
-		return err
-	}
+		c.container.name())
 
-	return nil
+	return err
 }
 
 func (c *containerAdapter) start(ctx context.Context) error {
diff --git a/agent/exec/dockerapi/controller.go b/agent/exec/dockerapi/controller.go
index 12bac6ec63..1450fbdc36 100644
--- a/agent/exec/dockerapi/controller.go
+++ b/agent/exec/dockerapi/controller.go
@@ -3,6 +3,7 @@ package dockerapi
 import (
 	"bufio"
 	"bytes"
+	"context"
 	"encoding/binary"
 	"fmt"
 	"io"
@@ -19,7 +20,6 @@ import (
 	"github.com/docker/swarmkit/log"
 	gogotypes "github.com/gogo/protobuf/types"
 	"github.com/pkg/errors"
-	"golang.org/x/net/context"
 	"golang.org/x/time/rate"
 )
 
diff --git a/agent/exec/dockerapi/controller_integration_test.go b/agent/exec/dockerapi/controller_integration_test.go
index 3c4d6866d5..7e766e051a 100644
--- a/agent/exec/dockerapi/controller_integration_test.go
+++ b/agent/exec/dockerapi/controller_integration_test.go
@@ -1,6 +1,7 @@
 package dockerapi
 
 import (
+	"context"
 	"flag"
 	"testing"
 
@@ -9,7 +10,6 @@ import (
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/api/genericresource"
 	"github.com/stretchr/testify/assert"
-	"golang.org/x/net/context"
 )
 
 var (
diff --git a/agent/exec/dockerapi/controller_test.go b/agent/exec/dockerapi/controller_test.go
index 7c95fabbe4..2ec2e8af52 100644
--- a/agent/exec/dockerapi/controller_test.go
+++ b/agent/exec/dockerapi/controller_test.go
@@ -2,6 +2,7 @@ package dockerapi
 
 import (
 	"bytes"
+	"context"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -20,7 +21,6 @@ import (
 	"github.com/docker/swarmkit/log"
 	gogotypes "github.com/gogo/protobuf/types"
 	"github.com/stretchr/testify/assert"
-	"golang.org/x/net/context"
 )
 
 var tenSecond = 10 * time.Second
diff --git a/agent/exec/dockerapi/docker_client_stub.go b/agent/exec/dockerapi/docker_client_stub.go
index 653f3df1a8..41ee3ee89c 100644
--- a/agent/exec/dockerapi/docker_client_stub.go
+++ b/agent/exec/dockerapi/docker_client_stub.go
@@ -1,16 +1,17 @@
 package dockerapi
 
 import (
+	"context"
+	"io"
+	"runtime"
+	"strings"
+	"time"
+
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/events"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/client"
-	"golang.org/x/net/context"
-	"io"
-	"runtime"
-	"strings"
-	"time"
 )
 
 // StubAPIClient implements the client.APIClient interface, but allows
diff --git a/agent/exec/dockerapi/executor.go b/agent/exec/dockerapi/executor.go
index 6601ce224b..011164596c 100644
--- a/agent/exec/dockerapi/executor.go
+++ b/agent/exec/dockerapi/executor.go
@@ -1,8 +1,10 @@
 package dockerapi
 
 import (
+	"context"
 	"sort"
 	"strings"
+	"sync"
 
 	"github.com/docker/docker/api/types/filters"
 	engineapi "github.com/docker/docker/client"
@@ -10,8 +12,6 @@ import (
 	"github.com/docker/swarmkit/agent/secrets"
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/log"
-	"golang.org/x/net/context"
-	"sync"
 )
 
 type executor struct {
diff --git a/agent/exec/executor.go b/agent/exec/executor.go
index 8c3fd03506..26c1bfcba7 100644
--- a/agent/exec/executor.go
+++ b/agent/exec/executor.go
@@ -1,8 +1,9 @@
 package exec
 
 import (
+	"context"
+
 	"github.com/docker/swarmkit/api"
-	"golang.org/x/net/context"
 )
 
 // Executor provides controllers for tasks.
diff --git a/agent/helpers.go b/agent/helpers.go
index 5fdf166059..5e95d93297 100644
--- a/agent/helpers.go
+++ b/agent/helpers.go
@@ -1,6 +1,6 @@
 package agent
 
-import "golang.org/x/net/context"
+import "context"
 
 // runctx blocks until the function exits, closed is closed, or the context is
 // cancelled. Call as part of go statement.
diff --git a/agent/reporter.go b/agent/reporter.go
index 73e6ab3fd9..2afb75795f 100644
--- a/agent/reporter.go
+++ b/agent/reporter.go
@@ -1,12 +1,12 @@
 package agent
 
 import (
+	"context"
 	"reflect"
 	"sync"
 
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/log"
-	"golang.org/x/net/context"
 )
 
 // StatusReporter receives updates to task status. Method may be called
diff --git a/agent/reporter_test.go b/agent/reporter_test.go
index d0b5dc6d8e..fcafec5a8c 100644
--- a/agent/reporter_test.go
+++ b/agent/reporter_test.go
@@ -1,6 +1,7 @@
 package agent
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"math/rand"
@@ -9,7 +10,6 @@ import (
 
 	"github.com/docker/swarmkit/api"
 	"github.com/stretchr/testify/assert"
-	"golang.org/x/net/context"
 )
 
 type uniqueStatus struct {
diff --git a/agent/resource.go b/agent/resource.go
index 8e88d2cd65..32be069c11 100644
--- a/agent/resource.go
+++ b/agent/resource.go
@@ -1,8 +1,9 @@
 package agent
 
 import (
+	"context"
+
 	"github.com/docker/swarmkit/api"
-	"golang.org/x/net/context"
 )
 
 type resourceAllocator struct {
diff --git a/agent/session.go b/agent/session.go
index 9bb9773a6c..66e5a8cf0b 100644
--- a/agent/session.go
+++ b/agent/session.go
@@ -1,6 +1,7 @@
 package agent
 
 import (
+	"context"
 	"errors"
 	"sync"
 	"time"
@@ -9,14 +10,12 @@ import (
 	"github.com/docker/swarmkit/connectionbroker"
 	"github.com/docker/swarmkit/log"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 )
 
 var (
 	dispatcherRPCTimeout = 5 * time.Second
-	errSessionDisconnect = errors.New("agent: session disconnect") // instructed to disconnect
 	errSessionClosed     = errors.New("agent: session closed")
 )
 
@@ -129,7 +128,7 @@ func (s *session) start(ctx context.Context, description *api.NodeDescription) e
 	// `ctx` is done and hence fail to propagate the timeout error to the agent.
 	// If the error is not propogated to the agent, the agent will not close
 	// the session or rebuild a new sesssion.
-	sessionCtx, cancelSession := context.WithCancel(ctx)
+	sessionCtx, cancelSession := context.WithCancel(ctx) // nolint: vet
 
 	// Need to run Session in a goroutine since there's no way to set a
 	// timeout for an individual Recv call in a stream.
@@ -152,7 +151,7 @@ func (s *session) start(ctx context.Context, description *api.NodeDescription) e
 	select {
 	case err := <-errChan:
 		if err != nil {
-			return err
+			return err // nolint: vet
 		}
 	case <-time.After(dispatcherRPCTimeout):
 		cancelSession()
diff --git a/agent/task.go b/agent/task.go
index 95fe93179b..17c713c092 100644
--- a/agent/task.go
+++ b/agent/task.go
@@ -1,6 +1,7 @@
 package agent
 
 import (
+	"context"
 	"sync"
 	"time"
 
@@ -8,7 +9,6 @@ import (
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/api/equality"
 	"github.com/docker/swarmkit/log"
-	"golang.org/x/net/context"
 )
 
 // taskManager manages all aspects of task execution and reporting for an agent
diff --git a/agent/task_test.go b/agent/task_test.go
index 3a6afce51b..85b83ddba2 100644
--- a/agent/task_test.go
+++ b/agent/task_test.go
@@ -1,6 +1,7 @@
 package agent
 
 import (
+	"context"
 	"testing"
 	"time"
 
@@ -8,7 +9,6 @@ import (
 	"github.com/docker/swarmkit/api"
 	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
-	"golang.org/x/net/context"
 )
 
 func init() {
diff --git a/agent/testutils/fakes.go b/agent/testutils/fakes.go
index b2e5c81150..150d06935f 100644
--- a/agent/testutils/fakes.go
+++ b/agent/testutils/fakes.go
@@ -1,6 +1,7 @@
 package testutils
 
 import (
+	"context"
 	"io/ioutil"
 	"net"
 	"os"
@@ -17,7 +18,6 @@ import (
 	"github.com/docker/swarmkit/identity"
 	"github.com/docker/swarmkit/log"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 )
 
 // TestExecutor is executor for integration tests
@@ -140,17 +140,13 @@ func (m *MockDispatcher) UpdateTaskStatus(context.Context, *api.UpdateTaskStatus
 
 // Tasks keeps an open stream until canceled
 func (m *MockDispatcher) Tasks(_ *api.TasksRequest, stream api.Dispatcher_TasksServer) error {
-	select {
-	case <-stream.Context().Done():
-	}
+	<-stream.Context().Done()
 	return nil
 }
 
 // Assignments keeps an open stream until canceled
 func (m *MockDispatcher) Assignments(_ *api.AssignmentsRequest, stream api.Dispatcher_AssignmentsServer) error {
-	select {
-	case <-stream.Context().Done():
-	}
+	<-stream.Context().Done()
 	return nil
 }
 
diff --git a/agent/worker.go b/agent/worker.go
index 6b500059a8..a5bf94f833 100644
--- a/agent/worker.go
+++ b/agent/worker.go
@@ -1,6 +1,7 @@
 package agent
 
 import (
+	"context"
 	"sync"
 
 	"github.com/boltdb/bolt"
@@ -9,7 +10,6 @@ import (
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/watch"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 )
 
 // Worker implements the core task management logic and persistence. It
diff --git a/agent/worker_test.go b/agent/worker_test.go
index f75e925e71..307a753c54 100644
--- a/agent/worker_test.go
+++ b/agent/worker_test.go
@@ -1,6 +1,7 @@
 package agent
 
 import (
+	"context"
 	"testing"
 
 	"github.com/boltdb/bolt"
@@ -9,7 +10,6 @@ import (
 	"github.com/docker/swarmkit/log"
 	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
-	"golang.org/x/net/context"
 )
 
 type testPublisherProvider struct {
diff --git a/api/genericresource/resource_management.go b/api/genericresource/resource_management.go
index a89a118d62..506257ab97 100644
--- a/api/genericresource/resource_management.go
+++ b/api/genericresource/resource_management.go
@@ -2,6 +2,7 @@ package genericresource
 
 import (
 	"fmt"
+
 	"github.com/docker/swarmkit/api"
 )
 
diff --git a/api/genericresource/validate.go b/api/genericresource/validate.go
index eee3706c74..0ad49ff75f 100644
--- a/api/genericresource/validate.go
+++ b/api/genericresource/validate.go
@@ -2,6 +2,7 @@ package genericresource
 
 import (
 	"fmt"
+
 	"github.com/docker/swarmkit/api"
 )
 
diff --git a/ca/auth.go b/ca/auth.go
index df4547fb13..e0ff898c19 100644
--- a/ca/auth.go
+++ b/ca/auth.go
@@ -1,6 +1,7 @@
 package ca
 
 import (
+	"context"
 	"crypto/tls"
 	"crypto/x509/pkix"
 	"strings"
@@ -9,7 +10,6 @@ import (
 
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/log"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/peer"
diff --git a/ca/certificates.go b/ca/certificates.go
index f2d3dbac55..32e852d9e0 100644
--- a/ca/certificates.go
+++ b/ca/certificates.go
@@ -2,6 +2,7 @@ package ca
 
 import (
 	"bytes"
+	"context"
 	"crypto"
 	"crypto/ecdsa"
 	"crypto/elliptic"
@@ -31,7 +32,6 @@ import (
 	"github.com/docker/swarmkit/ioutils"
 	"github.com/opencontainers/go-digest"
 	"github.com/pkg/errors"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
diff --git a/ca/certificates_test.go b/ca/certificates_test.go
index 2c7895510c..6a6670bbd6 100644
--- a/ca/certificates_test.go
+++ b/ca/certificates_test.go
@@ -1,6 +1,7 @@
 package ca_test
 
 import (
+	"context"
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	cryptorand "crypto/rand"
@@ -38,7 +39,6 @@ import (
 	"github.com/phayes/permbits"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 )
 
 func init() {
@@ -705,12 +705,10 @@ func TestGetRemoteSignedCertificateWithPending(t *testing.T) {
 	var node *api.Node
 	// wait for a new node to show up
 	for node == nil {
-		select {
-		case event := <-updates: // we want to skip the first node, which is the test CA
-			n := event.(api.EventCreateNode).Node.Copy()
-			if n.Certificate.Status.State == api.IssuanceStatePending {
-				node = n
-			}
+		event := <-updates // we want to skip the first node, which is the test CA
+		n := event.(api.EventCreateNode).Node.Copy()
+		if n.Certificate.Status.State == api.IssuanceStatePending {
+			node = n
 		}
 	}
 
@@ -747,7 +745,8 @@ func TestGetRemoteSignedCertificateWithPending(t *testing.T) {
 	// make sure if we time out the GetRemoteSignedCertificate call, it cancels immediately and doesn't keep
 	// polling the status
 	go func() {
-		ctx, _ := context.WithTimeout(tc.Context, 1*time.Second)
+		ctx, cancel := context.WithTimeout(tc.Context, 1*time.Second)
+		defer cancel()
 		_, err := ca.GetRemoteSignedCertificate(ctx, csr, tc.RootCA.Pool,
 			ca.CertificateRequestConfig{
 				Token:      tc.WorkerToken,
diff --git a/ca/config.go b/ca/config.go
index 4a7230ac2f..4befee5bcc 100644
--- a/ca/config.go
+++ b/ca/config.go
@@ -1,6 +1,7 @@
 package ca
 
 import (
+	"context"
 	cryptorand "crypto/rand"
 	"crypto/tls"
 	"crypto/x509"
@@ -23,8 +24,6 @@ import (
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"google.golang.org/grpc/credentials"
-
-	"golang.org/x/net/context"
 )
 
 const (
@@ -32,7 +31,6 @@ const (
 	rootCAKeyFilename   = "swarm-root-ca.key"
 	nodeTLSCertFilename = "swarm-node.crt"
 	nodeTLSKeyFilename  = "swarm-node.key"
-	nodeCSRFilename     = "swarm-node.csr"
 
 	// DefaultRootCN represents the root CN that we should create roots CAs with by default
 	DefaultRootCN = "swarm-ca"
@@ -626,10 +624,10 @@ func calculateRandomExpiry(validFrom, validUntil time.Time) time.Duration {
 	if maxValidity-minValidity < 1 {
 		randomExpiry = minValidity
 	} else {
-		randomExpiry = rand.Intn(maxValidity-minValidity) + int(minValidity)
+		randomExpiry = rand.Intn(maxValidity-minValidity) + minValidity
 	}
 
-	expiry := validFrom.Add(time.Duration(randomExpiry) * time.Minute).Sub(time.Now())
+	expiry := time.Until(validFrom.Add(time.Duration(randomExpiry) * time.Minute))
 	if expiry < 0 {
 		return 0
 	}
diff --git a/ca/config_test.go b/ca/config_test.go
index f30d7e3284..ad7528775e 100644
--- a/ca/config_test.go
+++ b/ca/config_test.go
@@ -2,6 +2,7 @@ package ca_test
 
 import (
 	"bytes"
+	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
@@ -15,8 +16,6 @@ import (
 
 	"google.golang.org/grpc"
 
-	"golang.org/x/net/context"
-
 	cfconfig "github.com/cloudflare/cfssl/config"
 	"github.com/cloudflare/cfssl/helpers"
 	"github.com/docker/swarmkit/api"
@@ -743,24 +742,22 @@ func TestRenewTLSConfigUpdatesRootNonUnknownAuthError(t *testing.T) {
 	go func() {
 		updates, cancel := state.Watch(tc.MemoryStore.WatchQueue(), api.EventCreateNode{})
 		defer cancel()
-		select {
-		case event := <-updates: // we want to skip the first node, which is the test CA
-			n := event.(api.EventCreateNode).Node
-			if n.Certificate.Status.State == api.IssuanceStatePending {
-				signErr <- tc.MemoryStore.Update(func(tx store.Tx) error {
-					node := store.GetNode(tx, n.ID)
-					certChain, err := rootCA.ParseValidateAndSignCSR(node.Certificate.CSR, node.Certificate.CN, ca.WorkerRole, tc.Organization)
-					if err != nil {
-						return err
-					}
-					node.Certificate.Certificate = cautils.ReDateCert(t, certChain, cert, key, time.Now().Add(-5*time.Hour), time.Now().Add(-4*time.Hour))
-					node.Certificate.Status = api.IssuanceStatus{
-						State: api.IssuanceStateIssued,
-					}
-					return store.UpdateNode(tx, node)
-				})
-				return
-			}
+		event := <-updates // we want to skip the first node, which is the test CA
+		n := event.(api.EventCreateNode).Node
+		if n.Certificate.Status.State == api.IssuanceStatePending {
+			signErr <- tc.MemoryStore.Update(func(tx store.Tx) error {
+				node := store.GetNode(tx, n.ID)
+				certChain, err := rootCA.ParseValidateAndSignCSR(node.Certificate.CSR, node.Certificate.CN, ca.WorkerRole, tc.Organization)
+				if err != nil {
+					return err
+				}
+				node.Certificate.Certificate = cautils.ReDateCert(t, certChain, cert, key, time.Now().Add(-5*time.Hour), time.Now().Add(-4*time.Hour))
+				node.Certificate.Status = api.IssuanceStatus{
+					State: api.IssuanceStateIssued,
+				}
+				return store.UpdateNode(tx, node)
+			})
+			return
 		}
 	}()
 
diff --git a/ca/external.go b/ca/external.go
index 789361eb61..6b81204595 100644
--- a/ca/external.go
+++ b/ca/external.go
@@ -2,6 +2,7 @@ package ca
 
 import (
 	"bytes"
+	"context"
 	cryptorand "crypto/rand"
 	"crypto/tls"
 	"crypto/x509"
@@ -21,7 +22,6 @@ import (
 	"github.com/docker/swarmkit/log"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 	"golang.org/x/net/context/ctxhttp"
 )
 
diff --git a/ca/external_test.go b/ca/external_test.go
index 7018ba1f95..17272dfbd5 100644
--- a/ca/external_test.go
+++ b/ca/external_test.go
@@ -113,9 +113,7 @@ func TestExternalCASignRequestTimesOut(t *testing.T) {
 	mux := http.NewServeMux()
 	mux.HandleFunc("/", func(http.ResponseWriter, *http.Request) {
 		// hang forever
-		select {
-		case <-allDone:
-		}
+		<-allDone
 	})
 
 	server := httptest.NewServer(mux)
diff --git a/ca/forward.go b/ca/forward.go
index 617b151423..db4fd67da7 100644
--- a/ca/forward.go
+++ b/ca/forward.go
@@ -1,7 +1,8 @@
 package ca
 
 import (
-	"golang.org/x/net/context"
+	"context"
+
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/peer"
 )
diff --git a/ca/renewer.go b/ca/renewer.go
index 2a2fae7808..e5d165f6a8 100644
--- a/ca/renewer.go
+++ b/ca/renewer.go
@@ -1,6 +1,7 @@
 package ca
 
 import (
+	"context"
 	"sync"
 	"time"
 
@@ -9,7 +10,6 @@ import (
 	"github.com/docker/swarmkit/log"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 )
 
 // RenewTLSExponentialBackoff sets the exponential backoff when trying to renew TLS certificates that have expired
diff --git a/ca/renewer_test.go b/ca/renewer_test.go
index b8ce3f81be..a0f3cd3258 100644
--- a/ca/renewer_test.go
+++ b/ca/renewer_test.go
@@ -1,6 +1,7 @@
 package ca_test
 
 import (
+	"context"
 	"testing"
 	"time"
 
@@ -10,7 +11,6 @@ import (
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 )
 
 func TestForceRenewTLSConfig(t *testing.T) {
diff --git a/ca/server.go b/ca/server.go
index a456df7900..c3e8999f89 100644
--- a/ca/server.go
+++ b/ca/server.go
@@ -2,6 +2,7 @@ package ca
 
 import (
 	"bytes"
+	"context"
 	"crypto/subtle"
 	"crypto/x509"
 	"sync"
@@ -15,7 +16,6 @@ import (
 	gogotypes "github.com/gogo/protobuf/types"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
diff --git a/ca/server_test.go b/ca/server_test.go
index 996051960d..d628347a87 100644
--- a/ca/server_test.go
+++ b/ca/server_test.go
@@ -2,6 +2,7 @@ package ca_test
 
 import (
 	"bytes"
+	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
@@ -25,7 +26,6 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 )
diff --git a/ca/testutils/cautils.go b/ca/testutils/cautils.go
index c3b086ed76..eb8ca882c1 100644
--- a/ca/testutils/cautils.go
+++ b/ca/testutils/cautils.go
@@ -1,6 +1,7 @@
 package testutils
 
 import (
+	"context"
 	"crypto"
 	cryptorand "crypto/rand"
 	"crypto/tls"
@@ -29,7 +30,6 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 )
diff --git a/ca/transport.go b/ca/transport.go
index 6a6309a613..c4ae764a8d 100644
--- a/ca/transport.go
+++ b/ca/transport.go
@@ -1,6 +1,7 @@
 package ca
 
 import (
+	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
@@ -9,7 +10,6 @@ import (
 	"sync"
 
 	"github.com/pkg/errors"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc/credentials"
 )
 
@@ -18,12 +18,6 @@ var (
 	alpnProtoStr = []string{"h2"}
 )
 
-type timeoutError struct{}
-
-func (timeoutError) Error() string   { return "mutablecredentials: Dial timed out" }
-func (timeoutError) Timeout() bool   { return true }
-func (timeoutError) Temporary() bool { return true }
-
 // MutableTLSCreds is the credentials required for authenticating a connection using TLS.
 type MutableTLSCreds struct {
 	// Mutex for the tls config
diff --git a/cmd/swarm-bench/benchmark.go b/cmd/swarm-bench/benchmark.go
index fe2b61f276..312649e502 100644
--- a/cmd/swarm-bench/benchmark.go
+++ b/cmd/swarm-bench/benchmark.go
@@ -1,13 +1,13 @@
 package main
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"strconv"
 	"time"
 
 	"github.com/docker/swarmkit/api"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 )
 
diff --git a/cmd/swarm-bench/collector.go b/cmd/swarm-bench/collector.go
index 62d5022868..7c886bbec9 100644
--- a/cmd/swarm-bench/collector.go
+++ b/cmd/swarm-bench/collector.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"net"
@@ -9,7 +10,6 @@ import (
 
 	"github.com/docker/swarmkit/log"
 	"github.com/rcrowley/go-metrics"
-	"golang.org/x/net/context"
 )
 
 // Collector waits for tasks to phone home while collecting statistics.
@@ -23,10 +23,7 @@ type Collector struct {
 func (c *Collector) Listen(port int) error {
 	var err error
 	c.ln, err = net.Listen("tcp", ":"+strconv.Itoa(port))
-	if err != nil {
-		return err
-	}
-	return nil
+	return err
 }
 
 // Collect blocks until `count` tasks phoned home.
diff --git a/cmd/swarm-bench/main.go b/cmd/swarm-bench/main.go
index 8dab2244d8..445c7cace3 100644
--- a/cmd/swarm-bench/main.go
+++ b/cmd/swarm-bench/main.go
@@ -1,12 +1,12 @@
 package main
 
 import (
+	"context"
 	"errors"
 	"os"
 	"time"
 
 	"github.com/spf13/cobra"
-	"golang.org/x/net/context"
 )
 
 var (
diff --git a/cmd/swarm-rafttool/common.go b/cmd/swarm-rafttool/common.go
index a169b9af6e..dddb6e2428 100644
--- a/cmd/swarm-rafttool/common.go
+++ b/cmd/swarm-rafttool/common.go
@@ -1,13 +1,12 @@
 package main
 
 import (
+	"context"
 	"errors"
 	"io/ioutil"
 	"os"
 	"path/filepath"
 
-	"golang.org/x/net/context"
-
 	"github.com/coreos/etcd/pkg/fileutil"
 	"github.com/coreos/etcd/wal/walpb"
 	"github.com/docker/swarmkit/ca"
diff --git a/cmd/swarmctl/cluster/common.go b/cmd/swarmctl/cluster/common.go
index 0f9a922d1d..a667d05fbd 100644
--- a/cmd/swarmctl/cluster/common.go
+++ b/cmd/swarmctl/cluster/common.go
@@ -1,10 +1,9 @@
 package cluster
 
 import (
+	"context"
 	"fmt"
 
-	"golang.org/x/net/context"
-
 	"github.com/docker/swarmkit/api"
 )
 
diff --git a/cmd/swarmctl/common/common.go b/cmd/swarmctl/common/common.go
index 5872a77258..4f27e1a670 100644
--- a/cmd/swarmctl/common/common.go
+++ b/cmd/swarmctl/common/common.go
@@ -1,6 +1,7 @@
 package common
 
 import (
+	"context"
 	"crypto/tls"
 	"net"
 	"strings"
@@ -10,7 +11,6 @@ import (
 	"github.com/docker/swarmkit/xnet"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 )
diff --git a/cmd/swarmctl/common/resolver.go b/cmd/swarmctl/common/resolver.go
index 28d79ee70f..b4a9d416a1 100644
--- a/cmd/swarmctl/common/resolver.go
+++ b/cmd/swarmctl/common/resolver.go
@@ -1,11 +1,11 @@
 package common
 
 import (
+	"context"
 	"fmt"
 
 	"github.com/docker/swarmkit/api"
 	"github.com/spf13/cobra"
-	"golang.org/x/net/context"
 )
 
 // Resolver provides ID to Name resolution.
diff --git a/cmd/swarmctl/config/common.go b/cmd/swarmctl/config/common.go
index 247c3e5969..bbdc1d5c29 100644
--- a/cmd/swarmctl/config/common.go
+++ b/cmd/swarmctl/config/common.go
@@ -1,10 +1,10 @@
 package config
 
 import (
+	"context"
 	"fmt"
 
 	"github.com/docker/swarmkit/api"
-	"golang.org/x/net/context"
 )
 
 func getConfig(ctx context.Context, c api.ControlClient, input string) (*api.Config, error) {
diff --git a/cmd/swarmctl/network/common.go b/cmd/swarmctl/network/common.go
index f4d4dc76d2..ad2c68bd73 100644
--- a/cmd/swarmctl/network/common.go
+++ b/cmd/swarmctl/network/common.go
@@ -1,10 +1,10 @@
 package network
 
 import (
+	"context"
 	"fmt"
 
 	"github.com/docker/swarmkit/api"
-	"golang.org/x/net/context"
 )
 
 // GetNetwork tries to query for a network as an ID and if it can't be
diff --git a/cmd/swarmctl/node/common.go b/cmd/swarmctl/node/common.go
index 2d0beb9ad3..c70384817a 100644
--- a/cmd/swarmctl/node/common.go
+++ b/cmd/swarmctl/node/common.go
@@ -1,13 +1,12 @@
 package node
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"reflect"
 	"strings"
 
-	"golang.org/x/net/context"
-
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/cmd/swarmctl/common"
 	"github.com/spf13/cobra"
@@ -49,49 +48,7 @@ func changeNodeAvailability(cmd *cobra.Command, args []string, availability api.
 		Spec:        spec,
 	})
 
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func changeNodeMembership(cmd *cobra.Command, args []string, membership api.NodeSpec_Membership) error {
-	if len(args) == 0 {
-		return errors.New("missing node ID")
-	}
-
-	if len(args) > 1 {
-		return errors.New("command takes exactly 1 argument")
-	}
-
-	c, err := common.Dial(cmd)
-	if err != nil {
-		return err
-	}
-	node, err := getNode(common.Context(cmd), c, args[0])
-	if err != nil {
-		return err
-	}
-	spec := &node.Spec
-
-	if spec.Membership == membership {
-		return errNoChange
-	}
-
-	spec.Membership = membership
-
-	_, err = c.UpdateNode(common.Context(cmd), &api.UpdateNodeRequest{
-		NodeID:      node.ID,
-		NodeVersion: &node.Meta.Version,
-		Spec:        spec,
-	})
-
-	if err != nil {
-		return err
-	}
-
-	return nil
+	return err
 }
 
 func changeNodeRole(cmd *cobra.Command, args []string, role api.NodeRole) error {
@@ -125,11 +82,7 @@ func changeNodeRole(cmd *cobra.Command, args []string, role api.NodeRole) error
 		Spec:        spec,
 	})
 
-	if err != nil {
-		return err
-	}
-
-	return nil
+	return err
 }
 
 func getNode(ctx context.Context, c api.ControlClient, input string) (*api.Node, error) {
@@ -208,9 +161,5 @@ func updateNode(cmd *cobra.Command, args []string) error {
 		Spec:        spec,
 	})
 
-	if err != nil {
-		return err
-	}
-
-	return nil
+	return err
 }
diff --git a/cmd/swarmctl/secret/common.go b/cmd/swarmctl/secret/common.go
index b6d5b0d4c3..5f7ca4e888 100644
--- a/cmd/swarmctl/secret/common.go
+++ b/cmd/swarmctl/secret/common.go
@@ -1,10 +1,10 @@
 package secret
 
 import (
+	"context"
 	"fmt"
 
 	"github.com/docker/swarmkit/api"
-	"golang.org/x/net/context"
 )
 
 func getSecret(ctx context.Context, c api.ControlClient, input string) (*api.Secret, error) {
diff --git a/cmd/swarmctl/service/common.go b/cmd/swarmctl/service/common.go
index bab0a32d37..5d5db81fb0 100644
--- a/cmd/swarmctl/service/common.go
+++ b/cmd/swarmctl/service/common.go
@@ -1,10 +1,9 @@
 package service
 
 import (
+	"context"
 	"fmt"
 
-	"golang.org/x/net/context"
-
 	"github.com/docker/swarmkit/api"
 )
 
diff --git a/cmd/swarmctl/service/logs.go b/cmd/swarmctl/service/logs.go
index df7d0a5dcc..12ba7af664 100644
--- a/cmd/swarmctl/service/logs.go
+++ b/cmd/swarmctl/service/logs.go
@@ -1,6 +1,7 @@
 package service
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"os"
@@ -9,7 +10,6 @@ import (
 	"github.com/docker/swarmkit/cmd/swarmctl/common"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
-	"golang.org/x/net/context"
 )
 
 var (
diff --git a/cmd/swarmd/main.go b/cmd/swarmd/main.go
index d5ffec0b3d..e4c5b5948f 100644
--- a/cmd/swarmd/main.go
+++ b/cmd/swarmd/main.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	_ "expvar"
 	"fmt"
 	"net"
@@ -25,7 +26,6 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
-	"golang.org/x/net/context"
 )
 
 var externalCAOpt cli.ExternalCAOpt
diff --git a/containerized.mk b/containerized.mk
new file mode 100644
index 0000000000..4910352242
--- /dev/null
+++ b/containerized.mk
@@ -0,0 +1,49 @@
+IMAGE_NAME=docker/swarmkit
+GOPATH=/go
+DOCKER_IMAGE_DIR=${GOPATH}/src/${PROJECT_ROOT}
+
+# don't bother writing every single make target. just pass the call through to
+# docker and make
+# we prefer `%:` to `.DEFAULT` as the latter doesn't run phony deps
+# (see https://www.gnu.org/software/make/manual/html_node/Special-Targets.html)
+%::
+	@ echo "Running target $@ inside a container"
+	@ DOCKER_SWARMKIT_DOCKER_RUN_CMD="make $*" $(MAKE) run
+
+shell:
+	@ DOCKER_SWARMKIT_DOCKER_RUN_CMD='bash' DOCKER_SWARMKIT_DOCKER_RUN_FLAGS='-i' $(MAKE) run
+
+.PHONY: image
+image:
+	docker build -t ${IMAGE_NAME} .
+
+# internal target, only builds the image if it doesn't exist
+.PHONY: ensure_image_exists
+ensure_image_exists:
+	@ if [ ! $$(docker images -q ${IMAGE_NAME}) ]; then $(MAKE) image; fi
+
+# internal target, starts the sync if needed
+# uses https://github.com/EugenMayer/docker-sync/blob/47363ee31b71810a60b05822b9c4bd2176951ce8/tasks/sync/sync.thor#L193-L196
+# which is not great, but that's all they expose so far to do this...
+# checks if the daemon pid in the .docker-sync directory maps to a running
+# process owned by the current user, and otherwise assumes the sync is not
+# running, and starts it
+.PHONY: ensure_sync_started
+ensure_sync_started:
+	@ kill -0 $$(cat .docker-sync/daemon.pid) 2&> /dev/null || docker-sync start
+
+# internal target, actually runs a command inside a container
+# we don't use the `-i` flag for `docker run` by default as that makes it a pain
+# to kill running containers (can't kill with ctrl-c)
+.PHONY: run
+run: ensure_image_exists
+	@ [ "$$DOCKER_SWARMKIT_DOCKER_RUN_CMD" ] || exit 1
+	@ DOCKER_RUN_COMMAND="docker run -t -v swarmkit-cache:${GOPATH}" \
+		&& if [ "$$DOCKER_SWARMKIT_USE_DOCKER_SYNC" ]; then \
+			$(MAKE) ensure_sync_started && DOCKER_RUN_COMMAND="$$DOCKER_RUN_COMMAND -v swarmkit-sync:${DOCKER_IMAGE_DIR}"; \
+		else \
+			DOCKER_RUN_COMMAND="$$DOCKER_RUN_COMMAND -v ${ROOTDIR}:${DOCKER_IMAGE_DIR}"; \
+		fi \
+		&& DOCKER_RUN_COMMAND="$$DOCKER_RUN_COMMAND $$DOCKER_SWARMKIT_DOCKER_RUN_FLAGS ${IMAGE_NAME} $$DOCKER_SWARMKIT_DOCKER_RUN_CMD" \
+		&& echo $$DOCKER_RUN_COMMAND \
+		&& $$DOCKER_RUN_COMMAND
diff --git a/direct.mk b/direct.mk
new file mode 100644
index 0000000000..8ac8348c22
--- /dev/null
+++ b/direct.mk
@@ -0,0 +1,128 @@
+.DEFAULT_GOAL = all
+.PHONY: all
+all: check binaries test integration-tests ## run check, build the binaries and run the tests
+
+.PHONY: ci
+ci: check binaries checkprotos coverage coverage-integration ## to be used by the CI
+
+.PHONY: AUTHORS
+AUTHORS: .mailmap .git/HEAD
+	git log --format='%aN <%aE>' | sort -fu > $@
+
+# This only needs to be generated by hand when cutting full releases.
+version/version.go:
+	./version/version.sh > $@
+
+.PHONY: setup
+setup: ## install dependencies
+	@echo "🐳 $@"
+	# TODO(stevvooe): Install these from the vendor directory
+	@go get -u github.com/alecthomas/gometalinter
+	@gometalinter --install
+	@go get -u github.com/lk4d4/vndr
+	@go get -u github.com/stevvooe/protobuild
+
+.PHONY: generate
+generate: protos
+	@echo "🐳 $@"
+	@PATH=${ROOTDIR}/bin:${PATH} go generate -x ${PACKAGES}
+
+.PHONY: protos
+protos: bin/protoc-gen-gogoswarm ## generate protobuf
+	@echo "🐳 $@"
+	@PATH=${ROOTDIR}/bin:${PATH} protobuild ${PACKAGES}
+
+.PHONY: checkprotos
+checkprotos: generate ## check if protobufs needs to be generated again
+	@echo "🐳 $@"
+	@test -z "$$(git status --short | grep ".pb.go" | tee /dev/stderr)" || \
+		((git diff | cat) && \
+		(echo "👹 please run 'make generate' when making changes to proto files" && false))
+
+.PHONY: check
+check: fmt-proto
+check: ## Run various source code validation tools
+	@echo "🐳 $@"
+	@gometalinter ./...
+
+.PHONY: fmt-proto
+fmt-proto:
+	@test -z "$$(find . -path ./vendor -prune -o ! -name timestamp.proto ! -name duration.proto -name '*.proto' -type f -exec grep -Hn -e "^ " {} \; | tee /dev/stderr)" || \
+		(echo "👹 please indent proto files with tabs only" && false)
+	@test -z "$$(find . -path ./vendor -prune -o -name '*.proto' -type f -exec grep -Hn "Meta meta = " {} \; | grep -v '(gogoproto.nullable) = false' | tee /dev/stderr)" || \
+		(echo "👹 meta fields in proto files must have option (gogoproto.nullable) = false" && false)
+
+.PHONY: build
+build: ## build the go packages
+	@echo "🐳 $@"
+	@go build -i -tags "${DOCKER_BUILDTAGS}" -v ${GO_LDFLAGS} ${GO_GCFLAGS} ${PACKAGES}
+
+.PHONY: test
+test: ## run tests, except integration tests
+	@echo "🐳 $@"
+	@go test -parallel 8 ${RACE} -tags "${DOCKER_BUILDTAGS}" $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES})
+
+.PHONY: integration-tests
+integration-tests: ## run integration tests
+	@echo "🐳 $@"
+	@go test -parallel 8 ${RACE} -tags "${DOCKER_BUILDTAGS}" ${INTEGRATION_PACKAGE}
+
+# Build a binary from a cmd.
+bin/%: cmd/% .FORCE
+	@test $$(go list) = "${PROJECT_ROOT}" || \
+		(echo "👹 Please correctly set up your Go build environment. This project must be located at <GOPATH>/src/${PROJECT_ROOT}" && false)
+	@echo "🐳 $@"
+	@go build -i -tags "${DOCKER_BUILDTAGS}" -o $@ ${GO_LDFLAGS}  ${GO_GCFLAGS} ./$<
+
+.PHONY: .FORCE
+.FORCE:
+
+.PHONY: binaries
+binaries: $(BINARIES) ## build binaries
+	@echo "🐳 $@"
+
+.PHONY: clean
+clean: ## clean up binaries
+	@echo "🐳 $@"
+	@rm -f $(BINARIES)
+
+.PHONY: install
+install: $(BINARIES) ## install binaries
+	@echo "🐳 $@"
+	@mkdir -p $(DESTDIR)/bin
+	@install $(BINARIES) $(DESTDIR)/bin
+
+.PHONY: uninstall
+uninstall:
+	@echo "🐳 $@"
+	@rm -f $(addprefix $(DESTDIR)/bin/,$(notdir $(BINARIES)))
+
+.PHONY: coverage
+coverage: ## generate coverprofiles from the unit tests
+	@echo "🐳 $@"
+	@( for pkg in $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES}); do \
+		go test -i ${RACE} -tags "${DOCKER_BUILDTAGS}" -test.short -coverprofile="../../../$$pkg/coverage.txt" -covermode=atomic $$pkg || exit; \
+		go test ${RACE} -tags "${DOCKER_BUILDTAGS}" -test.short -coverprofile="../../../$$pkg/coverage.txt" -covermode=atomic $$pkg || exit; \
+	done )
+
+.PHONY: coverage-integration
+coverage-integration: ## generate coverprofiles from the integration tests
+	@echo "🐳 $@"
+	go test ${RACE} -tags "${DOCKER_BUILDTAGS}" -test.short -coverprofile="../../../${INTEGRATION_PACKAGE}/coverage.txt" -covermode=atomic ${INTEGRATION_PACKAGE}
+
+.PHONY: help
+help: ## this help
+	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST) | sort
+
+.PHONY: dep-validate
+dep-validate:
+	@echo "+ $@"
+	$(if $(VNDR), , \
+		$(error Please install vndr: go get github.com/lk4d4/vndr))
+	@rm -Rf .vendor.bak
+	@mv vendor .vendor.bak
+	@$(VNDR)
+	@test -z "$$(diff -r vendor .vendor.bak 2>&1 | tee /dev/stderr)" || \
+		(echo >&2 "+ inconsistent dependencies! what you have in vendor.conf does not match with what you have in vendor" && false)
+	@rm -Rf vendor
+	@mv .vendor.bak vendor
diff --git a/docker-sync.yml b/docker-sync.yml
new file mode 100644
index 0000000000..67856985da
--- /dev/null
+++ b/docker-sync.yml
@@ -0,0 +1,9 @@
+version: "2"
+
+options:
+  verbose: true
+syncs:
+  # should stay the same as the volume name used in `containerized.mk`'s `run` target
+  swarmkit-sync:
+    src: '.'
+    sync_excludes: ['_obj', '_test', 'bin']
diff --git a/integration/api.go b/integration/api.go
index 0f44037887..b0042309dd 100644
--- a/integration/api.go
+++ b/integration/api.go
@@ -1,8 +1,9 @@
 package integration
 
 import (
+	"context"
+
 	"github.com/docker/swarmkit/api"
-	"golang.org/x/net/context"
 )
 
 type dummyAPI struct {
diff --git a/integration/cluster.go b/integration/cluster.go
index e46e01edbe..1c605f7214 100644
--- a/integration/cluster.go
+++ b/integration/cluster.go
@@ -1,6 +1,7 @@
 package integration
 
 import (
+	"context"
 	"crypto/tls"
 	"fmt"
 	"math/rand"
@@ -19,7 +20,6 @@ import (
 	"github.com/docker/swarmkit/node"
 	"github.com/docker/swarmkit/testutils"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 )
 
 const opsTimeout = 64 * time.Second
@@ -39,23 +39,6 @@ type testCluster struct {
 
 var testnameKey struct{}
 
-// NewCluster creates new cluster to which nodes can be added.
-// AcceptancePolicy is set to most permissive mode on first manager node added.
-func newTestCluster(testname string, fips bool) *testCluster {
-	ctx, cancel := context.WithCancel(context.Background())
-	ctx = context.WithValue(ctx, testnameKey, testname)
-	c := &testCluster{
-		ctx:        ctx,
-		cancel:     cancel,
-		nodes:      make(map[string]*testNode),
-		nodesOrder: make(map[string]int),
-		errs:       make(chan error, 1024),
-		fips:       fips,
-	}
-	c.api = &dummyAPI{c: c}
-	return c
-}
-
 // Stop makes best effort to stop all nodes and close connections to them.
 func (c *testCluster) Stop() error {
 	c.cancel()
diff --git a/integration/integration_test.go b/integration/integration_test.go
index 5fc6ef0efb..4c3011575c 100644
--- a/integration/integration_test.go
+++ b/integration/integration_test.go
@@ -2,6 +2,7 @@ package integration
 
 import (
 	"bytes"
+	"context"
 	"flag"
 	"fmt"
 	"io/ioutil"
@@ -14,8 +15,6 @@ import (
 
 	"github.com/docker/swarmkit/node"
 
-	"golang.org/x/net/context"
-
 	"reflect"
 
 	"github.com/cloudflare/cfssl/helpers"
@@ -63,6 +62,23 @@ func TestMain(m *testing.M) {
 	os.Exit(res)
 }
 
+// newTestCluster creates new cluster to which nodes can be added.
+// AcceptancePolicy is set to most permissive mode on first manager node added.
+func newTestCluster(testname string, fips bool) *testCluster {
+	ctx, cancel := context.WithCancel(context.Background())
+	ctx = context.WithValue(ctx, testnameKey, testname)
+	c := &testCluster{
+		ctx:        ctx,
+		cancel:     cancel,
+		nodes:      make(map[string]*testNode),
+		nodesOrder: make(map[string]int),
+		errs:       make(chan error, 1024),
+		fips:       fips,
+	}
+	c.api = &dummyAPI{c: c}
+	return c
+}
+
 // pollClusterReady calls control api until all conditions are true:
 // * all nodes are ready
 // * all managers has membership == accepted
diff --git a/integration/node.go b/integration/node.go
index 6b2100bfdf..263c3b7eec 100644
--- a/integration/node.go
+++ b/integration/node.go
@@ -1,6 +1,7 @@
 package integration
 
 import (
+	"context"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -15,7 +16,6 @@ import (
 	"github.com/docker/swarmkit/ca"
 	"github.com/docker/swarmkit/node"
 	"github.com/docker/swarmkit/testutils"
-	"golang.org/x/net/context"
 )
 
 // TestNode is representation of *agent.Node. It stores listeners, connections,
diff --git a/ioutils/ioutils_test.go b/ioutils/ioutils_test.go
index 40717a5108..56a69c4ec6 100644
--- a/ioutils/ioutils_test.go
+++ b/ioutils/ioutils_test.go
@@ -25,7 +25,7 @@ func TestAtomicWriteToFile(t *testing.T) {
 		t.Fatalf("Error reading from file: %v", err)
 	}
 
-	if bytes.Compare(actual, expected) != 0 {
+	if !bytes.Equal(actual, expected) {
 		t.Fatalf("Data mismatch, expected %q, got %q", expected, actual)
 	}
 }
diff --git a/log/context.go b/log/context.go
index ac4f848806..cc1d590f11 100644
--- a/log/context.go
+++ b/log/context.go
@@ -1,10 +1,10 @@
 package log
 
 import (
+	"context"
 	"path"
 
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 )
 
 var (
diff --git a/log/context_test.go b/log/context_test.go
index ddff398938..6c59874c0a 100644
--- a/log/context_test.go
+++ b/log/context_test.go
@@ -1,10 +1,10 @@
 package log
 
 import (
+	"context"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"golang.org/x/net/context"
 )
 
 func TestLoggerContext(t *testing.T) {
diff --git a/log/grpc.go b/log/grpc.go
index 4978d49730..c209f75417 100644
--- a/log/grpc.go
+++ b/log/grpc.go
@@ -1,7 +1,8 @@
 package log
 
 import (
-	"golang.org/x/net/context"
+	"context"
+
 	"google.golang.org/grpc/grpclog"
 )
 
diff --git a/manager/allocator/allocator.go b/manager/allocator/allocator.go
index 5ca50623bb..3686721a95 100644
--- a/manager/allocator/allocator.go
+++ b/manager/allocator/allocator.go
@@ -1,6 +1,7 @@
 package allocator
 
 import (
+	"context"
 	"sync"
 
 	"github.com/docker/docker/pkg/plugingetter"
@@ -8,7 +9,6 @@ import (
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/manager/state"
 	"github.com/docker/swarmkit/manager/state/store"
-	"golang.org/x/net/context"
 )
 
 // Allocator controls how the allocation stage in the manager is handled.
diff --git a/manager/allocator/allocator_linux_test.go b/manager/allocator/allocator_linux_test.go
index b94b1b0637..765adc1299 100644
--- a/manager/allocator/allocator_linux_test.go
+++ b/manager/allocator/allocator_linux_test.go
@@ -1,10 +1,9 @@
 package allocator
 
 import (
+	"context"
 	"testing"
 
-	"golang.org/x/net/context"
-
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/manager/state"
 	"github.com/docker/swarmkit/manager/state/store"
diff --git a/manager/allocator/allocator_test.go b/manager/allocator/allocator_test.go
index 5c1dc6b5b3..2bff7d3695 100644
--- a/manager/allocator/allocator_test.go
+++ b/manager/allocator/allocator_test.go
@@ -1,14 +1,13 @@
 package allocator
 
 import (
+	"context"
 	"net"
 	"runtime/debug"
 	"strconv"
 	"testing"
 	"time"
 
-	"golang.org/x/net/context"
-
 	"github.com/docker/go-events"
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/manager/state"
diff --git a/manager/allocator/cnmallocator/networkallocator.go b/manager/allocator/cnmallocator/networkallocator.go
index 2d533a47cd..8f23319aae 100644
--- a/manager/allocator/cnmallocator/networkallocator.go
+++ b/manager/allocator/cnmallocator/networkallocator.go
@@ -1,6 +1,7 @@
 package cnmallocator
 
 import (
+	"context"
 	"fmt"
 	"net"
 	"strings"
@@ -16,7 +17,6 @@ import (
 	"github.com/docker/swarmkit/manager/allocator/networkallocator"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 )
 
 const (
@@ -805,8 +805,7 @@ func (na *cnmNetworkAllocator) resolveDriver(n *api.Network) (*networkDriver, er
 
 	d, drvcap := na.drvRegistry.Driver(dName)
 	if d == nil {
-		var err error
-		err = na.loadDriver(dName)
+		err := na.loadDriver(dName)
 		if err != nil {
 			return nil, err
 		}
diff --git a/manager/allocator/cnmallocator/portallocator.go b/manager/allocator/cnmallocator/portallocator.go
index 113f900242..81447cbdb4 100644
--- a/manager/allocator/cnmallocator/portallocator.go
+++ b/manager/allocator/cnmallocator/portallocator.go
@@ -407,12 +407,12 @@ func (ps *portSpace) allocate(p *api.PortConfig) (err error) {
 	}
 	defer func() {
 		if err != nil {
-			ps.dynamicPortSpace.Release(uint64(swarmPort))
+			ps.dynamicPortSpace.Release(swarmPort)
 		}
 	}()
 
 	// Make sure we allocate the same port from the master space.
-	if err = ps.masterPortSpace.GetSpecificID(uint64(swarmPort)); err != nil {
+	if err = ps.masterPortSpace.GetSpecificID(swarmPort); err != nil {
 		return
 	}
 
diff --git a/manager/allocator/network.go b/manager/allocator/network.go
index 1036017490..437f455afe 100644
--- a/manager/allocator/network.go
+++ b/manager/allocator/network.go
@@ -1,6 +1,7 @@
 package allocator
 
 import (
+	"context"
 	"fmt"
 	"time"
 
@@ -13,7 +14,6 @@ import (
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/docker/swarmkit/protobuf/ptypes"
 	"github.com/pkg/errors"
-	"golang.org/x/net/context"
 )
 
 const (
diff --git a/manager/constraint/constraint.go b/manager/constraint/constraint.go
index 9f13217ae4..6c49c07728 100644
--- a/manager/constraint/constraint.go
+++ b/manager/constraint/constraint.go
@@ -56,7 +56,7 @@ func Parse(env []string) ([]Constraint, error) {
 			part0 := strings.TrimSpace(parts[0])
 			// validate key
 			matched := alphaNumeric.MatchString(part0)
-			if matched == false {
+			if !matched {
 				return nil, fmt.Errorf("key '%s' is invalid", part0)
 			}
 
@@ -64,7 +64,7 @@ func Parse(env []string) ([]Constraint, error) {
 
 			// validate Value
 			matched = valuePattern.MatchString(part1)
-			if matched == false {
+			if !matched {
 				return nil, fmt.Errorf("value '%s' is invalid", part1)
 			}
 			// TODO(dongluochen): revisit requirements to see if globing or regex are useful
diff --git a/manager/controlapi/cluster.go b/manager/controlapi/cluster.go
index adc0c1a485..fd2daad125 100644
--- a/manager/controlapi/cluster.go
+++ b/manager/controlapi/cluster.go
@@ -1,6 +1,7 @@
 package controlapi
 
 import (
+	"context"
 	"strings"
 	"time"
 
@@ -10,7 +11,6 @@ import (
 	"github.com/docker/swarmkit/manager/encryption"
 	"github.com/docker/swarmkit/manager/state/store"
 	gogotypes "github.com/gogo/protobuf/types"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
diff --git a/manager/controlapi/cluster_test.go b/manager/controlapi/cluster_test.go
index ad05a13596..4c22b0e2ab 100644
--- a/manager/controlapi/cluster_test.go
+++ b/manager/controlapi/cluster_test.go
@@ -1,6 +1,7 @@
 package controlapi
 
 import (
+	"context"
 	"fmt"
 	"testing"
 	"time"
@@ -13,7 +14,6 @@ import (
 	gogotypes "github.com/gogo/protobuf/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 )
diff --git a/manager/controlapi/config.go b/manager/controlapi/config.go
index ae08885b00..bc8726fb86 100644
--- a/manager/controlapi/config.go
+++ b/manager/controlapi/config.go
@@ -2,6 +2,7 @@ package controlapi
 
 import (
 	"bytes"
+	"context"
 	"strings"
 
 	"github.com/docker/swarmkit/api"
@@ -9,7 +10,6 @@ import (
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
diff --git a/manager/controlapi/config_test.go b/manager/controlapi/config_test.go
index 3774527442..460a08ba6a 100644
--- a/manager/controlapi/config_test.go
+++ b/manager/controlapi/config_test.go
@@ -1,6 +1,7 @@
 package controlapi
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"testing"
@@ -8,7 +9,6 @@ import (
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/stretchr/testify/assert"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 )
diff --git a/manager/controlapi/network.go b/manager/controlapi/network.go
index 481b0cfe4b..d3047fec72 100644
--- a/manager/controlapi/network.go
+++ b/manager/controlapi/network.go
@@ -1,6 +1,7 @@
 package controlapi
 
 import (
+	"context"
 	"net"
 
 	"github.com/docker/docker/pkg/plugingetter"
@@ -11,7 +12,6 @@ import (
 	"github.com/docker/swarmkit/manager/allocator"
 	"github.com/docker/swarmkit/manager/allocator/networkallocator"
 	"github.com/docker/swarmkit/manager/state/store"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
diff --git a/manager/controlapi/network_test.go b/manager/controlapi/network_test.go
index e719018acc..d11792221e 100644
--- a/manager/controlapi/network_test.go
+++ b/manager/controlapi/network_test.go
@@ -1,10 +1,9 @@
 package controlapi
 
 import (
+	"context"
 	"testing"
 
-	"golang.org/x/net/context"
-
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 
diff --git a/manager/controlapi/node.go b/manager/controlapi/node.go
index e1fe3dec1d..18576ae25c 100644
--- a/manager/controlapi/node.go
+++ b/manager/controlapi/node.go
@@ -1,6 +1,7 @@
 package controlapi
 
 import (
+	"context"
 	"crypto/x509"
 	"encoding/pem"
 
@@ -8,7 +9,6 @@ import (
 	"github.com/docker/swarmkit/manager/state/raft/membership"
 	"github.com/docker/swarmkit/manager/state/store"
 	gogotypes "github.com/gogo/protobuf/types"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
diff --git a/manager/controlapi/node_test.go b/manager/controlapi/node_test.go
index 603b72b894..9290a19d42 100644
--- a/manager/controlapi/node_test.go
+++ b/manager/controlapi/node_test.go
@@ -1,6 +1,7 @@
 package controlapi
 
 import (
+	"context"
 	"fmt"
 	"io/ioutil"
 	"log"
@@ -15,7 +16,6 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/grpclog"
diff --git a/manager/controlapi/secret.go b/manager/controlapi/secret.go
index fdcd2c412c..f3d87d1a7c 100644
--- a/manager/controlapi/secret.go
+++ b/manager/controlapi/secret.go
@@ -1,6 +1,7 @@
 package controlapi
 
 import (
+	"context"
 	"crypto/subtle"
 	"strings"
 
@@ -10,7 +11,6 @@ import (
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
diff --git a/manager/controlapi/secret_test.go b/manager/controlapi/secret_test.go
index cf66e39144..00d87ea85f 100644
--- a/manager/controlapi/secret_test.go
+++ b/manager/controlapi/secret_test.go
@@ -1,6 +1,7 @@
 package controlapi
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"testing"
@@ -8,7 +9,6 @@ import (
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/stretchr/testify/assert"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 )
diff --git a/manager/controlapi/server_test.go b/manager/controlapi/server_test.go
index c788c796f4..3f07db8781 100644
--- a/manager/controlapi/server_test.go
+++ b/manager/controlapi/server_test.go
@@ -1,6 +1,7 @@
 package controlapi
 
 import (
+	"context"
 	"io/ioutil"
 	"net"
 	"os"
@@ -15,7 +16,6 @@ import (
 	"github.com/docker/swarmkit/manager/state/store"
 	stateutils "github.com/docker/swarmkit/manager/state/testutils"
 	"github.com/stretchr/testify/assert"
-	"golang.org/x/net/context"
 )
 
 type testServer struct {
diff --git a/manager/controlapi/service.go b/manager/controlapi/service.go
index 3912052bf0..17bc2500e2 100644
--- a/manager/controlapi/service.go
+++ b/manager/controlapi/service.go
@@ -1,6 +1,7 @@
 package controlapi
 
 import (
+	"context"
 	"errors"
 	"reflect"
 	"strings"
@@ -18,7 +19,6 @@ import (
 	"github.com/docker/swarmkit/protobuf/ptypes"
 	"github.com/docker/swarmkit/template"
 	gogotypes "github.com/gogo/protobuf/types"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
@@ -197,7 +197,7 @@ func validateHealthCheck(hc *api.HealthConfig) error {
 		if err != nil {
 			return err
 		}
-		if interval != 0 && interval < time.Duration(minimumDuration) {
+		if interval != 0 && interval < minimumDuration {
 			return status.Errorf(codes.InvalidArgument, "ContainerSpec: Interval in HealthConfig cannot be less than %s", minimumDuration)
 		}
 	}
@@ -207,7 +207,7 @@ func validateHealthCheck(hc *api.HealthConfig) error {
 		if err != nil {
 			return err
 		}
-		if timeout != 0 && timeout < time.Duration(minimumDuration) {
+		if timeout != 0 && timeout < minimumDuration {
 			return status.Errorf(codes.InvalidArgument, "ContainerSpec: Timeout in HealthConfig cannot be less than %s", minimumDuration)
 		}
 	}
@@ -217,7 +217,7 @@ func validateHealthCheck(hc *api.HealthConfig) error {
 		if err != nil {
 			return err
 		}
-		if sp != 0 && sp < time.Duration(minimumDuration) {
+		if sp != 0 && sp < minimumDuration {
 			return status.Errorf(codes.InvalidArgument, "ContainerSpec: StartPeriod in HealthConfig cannot be less than %s", minimumDuration)
 		}
 	}
diff --git a/manager/controlapi/service_test.go b/manager/controlapi/service_test.go
index 7ce97cd982..81b71caa21 100644
--- a/manager/controlapi/service_test.go
+++ b/manager/controlapi/service_test.go
@@ -1,6 +1,7 @@
 package controlapi
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"testing"
@@ -10,7 +11,6 @@ import (
 	"github.com/docker/swarmkit/manager/state/store"
 	gogotypes "github.com/gogo/protobuf/types"
 	"github.com/stretchr/testify/assert"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 )
diff --git a/manager/controlapi/task.go b/manager/controlapi/task.go
index dc56e74105..5f85f9a93c 100644
--- a/manager/controlapi/task.go
+++ b/manager/controlapi/task.go
@@ -1,11 +1,12 @@
 package controlapi
 
 import (
+	"context"
+
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/api/naming"
 	"github.com/docker/swarmkit/manager/orchestrator"
 	"github.com/docker/swarmkit/manager/state/store"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
diff --git a/manager/controlapi/task_test.go b/manager/controlapi/task_test.go
index 075428bb8b..031fe0006d 100644
--- a/manager/controlapi/task_test.go
+++ b/manager/controlapi/task_test.go
@@ -1,10 +1,10 @@
 package controlapi
 
 import (
+	"context"
 	"strings"
 	"testing"
 
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 
diff --git a/manager/dirty_test.go b/manager/dirty_test.go
index 259cedcb2f..3f6468f8b2 100644
--- a/manager/dirty_test.go
+++ b/manager/dirty_test.go
@@ -1,12 +1,11 @@
 package manager
 
 import (
+	"context"
 	"io/ioutil"
 	"os"
 	"testing"
 
-	"golang.org/x/net/context"
-
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/ca"
 	"github.com/docker/swarmkit/ca/testutils"
diff --git a/manager/dispatcher/dispatcher.go b/manager/dispatcher/dispatcher.go
index 991459574a..7fb287b9f1 100644
--- a/manager/dispatcher/dispatcher.go
+++ b/manager/dispatcher/dispatcher.go
@@ -1,6 +1,7 @@
 package dispatcher
 
 import (
+	"context"
 	"fmt"
 	"net"
 	"strconv"
@@ -21,7 +22,6 @@ import (
 	gogotypes "github.com/gogo/protobuf/types"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/grpc/transport"
@@ -1055,14 +1055,10 @@ func (d *Dispatcher) moveTasksToOrphaned(nodeID string) error {
 				task.Status.State = api.TaskStateOrphaned
 			}
 
-			if err := batch.Update(func(tx store.Tx) error {
-				err := store.UpdateTask(tx, task)
-				if err != nil {
-					return err
-				}
-
-				return nil
-			}); err != nil {
+			err := batch.Update(func(tx store.Tx) error {
+				return store.UpdateTask(tx, task)
+			})
+			if err != nil {
 				return err
 			}
 
diff --git a/manager/dispatcher/dispatcher_test.go b/manager/dispatcher/dispatcher_test.go
index 09dcf0d684..173e75b7c4 100644
--- a/manager/dispatcher/dispatcher_test.go
+++ b/manager/dispatcher/dispatcher_test.go
@@ -1,6 +1,7 @@
 package dispatcher
 
 import (
+	"context"
 	"crypto/tls"
 	"encoding/json"
 	"errors"
@@ -13,8 +14,6 @@ import (
 	"testing"
 	"time"
 
-	"golang.org/x/net/context"
-
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
@@ -2088,7 +2087,6 @@ func (m *mockPluginGetter) GetAllManagedPluginsByCap(capability string) []plugin
 	return nil
 }
 func (m *mockPluginGetter) Handle(capability string, callback func(string, *plugins.Client)) {
-	return
 }
 
 // MockPlugin mocks a v2 docker plugin
diff --git a/manager/dispatcher/nodes.go b/manager/dispatcher/nodes.go
index cf35bb869a..fae6dc5f82 100644
--- a/manager/dispatcher/nodes.go
+++ b/manager/dispatcher/nodes.go
@@ -156,7 +156,7 @@ func (s *nodeStore) Heartbeat(id, sid string) (time.Duration, error) {
 		return 0, err
 	}
 	period := s.periodChooser.Choose() // base period for node
-	grace := period * time.Duration(s.gracePeriodMultiplierNormal)
+	grace := period * s.gracePeriodMultiplierNormal
 	rn.mu.Lock()
 	rn.Heartbeat.Update(grace)
 	rn.Heartbeat.Beat()
diff --git a/manager/health/health.go b/manager/health/health.go
index ef6658b09d..d75cbf4b60 100644
--- a/manager/health/health.go
+++ b/manager/health/health.go
@@ -8,10 +8,10 @@
 package health
 
 import (
+	"context"
 	"sync"
 
 	"github.com/docker/swarmkit/api"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
diff --git a/manager/keymanager/keymanager.go b/manager/keymanager/keymanager.go
index e61979cb36..7a5d7bf14d 100644
--- a/manager/keymanager/keymanager.go
+++ b/manager/keymanager/keymanager.go
@@ -6,6 +6,7 @@ package keymanager
 // which is used to exchange service discovery and overlay network control
 // plane information. It can also be used to encrypt overlay data traffic.
 import (
+	"context"
 	cryptorand "crypto/rand"
 	"encoding/binary"
 	"sync"
@@ -15,7 +16,6 @@ import (
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/pkg/errors"
-	"golang.org/x/net/context"
 )
 
 const (
diff --git a/manager/keymanager/keymanager_test.go b/manager/keymanager/keymanager_test.go
index fc4e06f340..6b91cbf0bd 100644
--- a/manager/keymanager/keymanager_test.go
+++ b/manager/keymanager/keymanager_test.go
@@ -2,13 +2,13 @@ package keymanager
 
 import (
 	"bytes"
+	"context"
 	"testing"
 	"time"
 
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/stretchr/testify/assert"
-	"golang.org/x/net/context"
 )
 
 func createClusterSpec(name string) *api.ClusterSpec {
diff --git a/manager/logbroker/broker.go b/manager/logbroker/broker.go
index dfc898e070..c19438a27a 100644
--- a/manager/logbroker/broker.go
+++ b/manager/logbroker/broker.go
@@ -1,6 +1,7 @@
 package logbroker
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"io"
@@ -14,7 +15,6 @@ import (
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/docker/swarmkit/watch"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
diff --git a/manager/logbroker/broker_test.go b/manager/logbroker/broker_test.go
index c133f0097c..ec85921016 100644
--- a/manager/logbroker/broker_test.go
+++ b/manager/logbroker/broker_test.go
@@ -1,6 +1,7 @@
 package logbroker
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"net"
@@ -8,7 +9,6 @@ import (
 	"testing"
 	"time"
 
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 
 	"github.com/docker/swarmkit/api"
diff --git a/manager/logbroker/subscription.go b/manager/logbroker/subscription.go
index b9c9c7b403..883ddce655 100644
--- a/manager/logbroker/subscription.go
+++ b/manager/logbroker/subscription.go
@@ -1,6 +1,7 @@
 package logbroker
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"sync"
@@ -11,7 +12,6 @@ import (
 	"github.com/docker/swarmkit/manager/state"
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/docker/swarmkit/watch"
-	"golang.org/x/net/context"
 )
 
 type subscription struct {
diff --git a/manager/manager.go b/manager/manager.go
index 2c6a0d3dcc..040f7f9ff8 100644
--- a/manager/manager.go
+++ b/manager/manager.go
@@ -1,6 +1,7 @@
 package manager
 
 import (
+	"context"
 	"crypto/tls"
 	"fmt"
 	"net"
@@ -44,7 +45,6 @@ import (
 	grpc_prometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 )
diff --git a/manager/manager_test.go b/manager/manager_test.go
index f55b7f38a8..7aa3be104c 100644
--- a/manager/manager_test.go
+++ b/manager/manager_test.go
@@ -2,6 +2,7 @@ package manager
 
 import (
 	"bytes"
+	"context"
 	"crypto/tls"
 	"encoding/pem"
 	"errors"
@@ -12,8 +13,6 @@ import (
 	"testing"
 	"time"
 
-	"golang.org/x/net/context"
-
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 
diff --git a/manager/metrics/collector.go b/manager/metrics/collector.go
index 384743707d..5539a898ca 100644
--- a/manager/metrics/collector.go
+++ b/manager/metrics/collector.go
@@ -188,7 +188,6 @@ func (c *Collector) handleNodeEvent(event events.Event) {
 	if newNode != nil {
 		nodesMetric.WithValues(strings.ToLower(newNode.Status.State.String())).Inc(1)
 	}
-	return
 }
 
 func (c *Collector) handleTaskEvent(event events.Event) {
@@ -218,8 +217,6 @@ func (c *Collector) handleTaskEvent(event events.Event) {
 			strings.ToLower(newTask.Status.State.String()),
 		).Inc(1)
 	}
-
-	return
 }
 
 func (c *Collector) handleServiceEvent(event events.Event) {
diff --git a/manager/orchestrator/global/global.go b/manager/orchestrator/global/global.go
index 2b20813ce2..715781e817 100644
--- a/manager/orchestrator/global/global.go
+++ b/manager/orchestrator/global/global.go
@@ -1,6 +1,8 @@
 package global
 
 import (
+	"context"
+
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/manager/constraint"
@@ -9,7 +11,6 @@ import (
 	"github.com/docker/swarmkit/manager/orchestrator/taskinit"
 	"github.com/docker/swarmkit/manager/orchestrator/update"
 	"github.com/docker/swarmkit/manager/state/store"
-	"golang.org/x/net/context"
 )
 
 type globalService struct {
@@ -585,11 +586,3 @@ func (g *Orchestrator) SlotTuple(t *api.Task) orchestrator.SlotTuple {
 		NodeID:    t.NodeID,
 	}
 }
-
-func isTaskCompleted(t *api.Task, restartPolicy api.RestartPolicy_RestartCondition) bool {
-	if t == nil || t.DesiredState <= api.TaskStateRunning {
-		return false
-	}
-	return restartPolicy == api.RestartOnNone ||
-		(restartPolicy == api.RestartOnFailure && t.Status.State == api.TaskStateCompleted)
-}
diff --git a/manager/orchestrator/global/global_test.go b/manager/orchestrator/global/global_test.go
index 4a88f763c9..c7cede8d94 100644
--- a/manager/orchestrator/global/global_test.go
+++ b/manager/orchestrator/global/global_test.go
@@ -1,6 +1,7 @@
 package global
 
 import (
+	"context"
 	"testing"
 	"time"
 
@@ -13,7 +14,6 @@ import (
 	gogotypes "github.com/gogo/protobuf/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 )
 
 var (
diff --git a/manager/orchestrator/replicated/drain_test.go b/manager/orchestrator/replicated/drain_test.go
index 58a76c4a7f..690cc09aa8 100644
--- a/manager/orchestrator/replicated/drain_test.go
+++ b/manager/orchestrator/replicated/drain_test.go
@@ -1,6 +1,7 @@
 package replicated
 
 import (
+	"context"
 	"testing"
 
 	"github.com/docker/swarmkit/api"
@@ -8,7 +9,6 @@ import (
 	"github.com/docker/swarmkit/manager/state"
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/stretchr/testify/assert"
-	"golang.org/x/net/context"
 )
 
 func TestDrain(t *testing.T) {
diff --git a/manager/orchestrator/replicated/replicated.go b/manager/orchestrator/replicated/replicated.go
index 18b8e24aba..dc45528682 100644
--- a/manager/orchestrator/replicated/replicated.go
+++ b/manager/orchestrator/replicated/replicated.go
@@ -1,12 +1,13 @@
 package replicated
 
 import (
+	"context"
+
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/manager/orchestrator/restart"
 	"github.com/docker/swarmkit/manager/orchestrator/update"
 	"github.com/docker/swarmkit/manager/state"
 	"github.com/docker/swarmkit/manager/state/store"
-	"golang.org/x/net/context"
 )
 
 // An Orchestrator runs a reconciliation loop to create and destroy
diff --git a/manager/orchestrator/replicated/replicated_test.go b/manager/orchestrator/replicated/replicated_test.go
index 3b1e9133fe..6484b0ba50 100644
--- a/manager/orchestrator/replicated/replicated_test.go
+++ b/manager/orchestrator/replicated/replicated_test.go
@@ -1,6 +1,7 @@
 package replicated
 
 import (
+	"context"
 	"testing"
 	"time"
 
@@ -12,7 +13,6 @@ import (
 	gogotypes "github.com/gogo/protobuf/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 )
 
 func TestReplicatedOrchestrator(t *testing.T) {
diff --git a/manager/orchestrator/replicated/restart_test.go b/manager/orchestrator/replicated/restart_test.go
index b90268db94..2105b84a95 100644
--- a/manager/orchestrator/replicated/restart_test.go
+++ b/manager/orchestrator/replicated/restart_test.go
@@ -1,6 +1,7 @@
 package replicated
 
 import (
+	"context"
 	"testing"
 	"time"
 
@@ -12,7 +13,6 @@ import (
 	gogotypes "github.com/gogo/protobuf/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 )
 
 func TestOrchestratorRestartOnAny(t *testing.T) {
diff --git a/manager/orchestrator/replicated/services.go b/manager/orchestrator/replicated/services.go
index 04aea8795a..b5e6bb12e8 100644
--- a/manager/orchestrator/replicated/services.go
+++ b/manager/orchestrator/replicated/services.go
@@ -1,6 +1,7 @@
 package replicated
 
 import (
+	"context"
 	"sort"
 
 	"github.com/docker/go-events"
@@ -8,7 +9,6 @@ import (
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/manager/orchestrator"
 	"github.com/docker/swarmkit/manager/state/store"
-	"golang.org/x/net/context"
 )
 
 // This file provices service-level orchestration. It observes changes to
diff --git a/manager/orchestrator/replicated/slot.go b/manager/orchestrator/replicated/slot.go
index cee9fe10a0..1160d4c96c 100644
--- a/manager/orchestrator/replicated/slot.go
+++ b/manager/orchestrator/replicated/slot.go
@@ -1,10 +1,11 @@
 package replicated
 
 import (
+	"context"
+
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/manager/orchestrator"
 	"github.com/docker/swarmkit/manager/state/store"
-	"golang.org/x/net/context"
 )
 
 type slotsByRunningState []orchestrator.Slot
diff --git a/manager/orchestrator/replicated/tasks.go b/manager/orchestrator/replicated/tasks.go
index 66000e5d86..b6336aa88a 100644
--- a/manager/orchestrator/replicated/tasks.go
+++ b/manager/orchestrator/replicated/tasks.go
@@ -1,13 +1,14 @@
 package replicated
 
 import (
+	"context"
+
 	"github.com/docker/go-events"
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/manager/orchestrator"
 	"github.com/docker/swarmkit/manager/orchestrator/taskinit"
 	"github.com/docker/swarmkit/manager/state/store"
-	"golang.org/x/net/context"
 )
 
 // This file provides task-level orchestration. It observes changes to task
diff --git a/manager/orchestrator/replicated/update_test.go b/manager/orchestrator/replicated/update_test.go
index 1599256fe8..45dacac6f6 100644
--- a/manager/orchestrator/replicated/update_test.go
+++ b/manager/orchestrator/replicated/update_test.go
@@ -1,6 +1,7 @@
 package replicated
 
 import (
+	"context"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -12,7 +13,6 @@ import (
 	gogotypes "github.com/gogo/protobuf/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 )
 
 func TestUpdaterRollback(t *testing.T) {
@@ -51,38 +51,36 @@ func testUpdaterRollback(t *testing.T, rollbackFailureAction api.UpdateConfig_Fa
 	go func() {
 		failedLast := false
 		for {
-			select {
-			case e := <-watchUpdate:
-				task := e.(api.EventUpdateTask).Task
-				if task.DesiredState == task.Status.State {
-					continue
-				}
-				if task.DesiredState == api.TaskStateRunning && task.Status.State != api.TaskStateFailed && task.Status.State != api.TaskStateRunning {
-					err := s.Update(func(tx store.Tx) error {
-						task = store.GetTask(tx, task.ID)
-						// Never fail two image2 tasks in a row, so there's a mix of
-						// failed and successful tasks for the rollback.
-						if task.Spec.GetContainer().Image == "image1" && atomic.LoadUint32(&failImage1) == 1 {
-							task.Status.State = api.TaskStateFailed
-							failedLast = true
-						} else if task.Spec.GetContainer().Image == "image2" && atomic.LoadUint32(&failImage2) == 1 && !failedLast {
-							task.Status.State = api.TaskStateFailed
-							failedLast = true
-						} else {
-							task.Status.State = task.DesiredState
-							failedLast = false
-						}
-						return store.UpdateTask(tx, task)
-					})
-					assert.NoError(t, err)
-				} else if task.DesiredState > api.TaskStateRunning {
-					err := s.Update(func(tx store.Tx) error {
-						task = store.GetTask(tx, task.ID)
+			e := <-watchUpdate
+			task := e.(api.EventUpdateTask).Task
+			if task.DesiredState == task.Status.State {
+				continue
+			}
+			if task.DesiredState == api.TaskStateRunning && task.Status.State != api.TaskStateFailed && task.Status.State != api.TaskStateRunning {
+				err := s.Update(func(tx store.Tx) error {
+					task = store.GetTask(tx, task.ID)
+					// Never fail two image2 tasks in a row, so there's a mix of
+					// failed and successful tasks for the rollback.
+					if task.Spec.GetContainer().Image == "image1" && atomic.LoadUint32(&failImage1) == 1 {
+						task.Status.State = api.TaskStateFailed
+						failedLast = true
+					} else if task.Spec.GetContainer().Image == "image2" && atomic.LoadUint32(&failImage2) == 1 && !failedLast {
+						task.Status.State = api.TaskStateFailed
+						failedLast = true
+					} else {
 						task.Status.State = task.DesiredState
-						return store.UpdateTask(tx, task)
-					})
-					assert.NoError(t, err)
-				}
+						failedLast = false
+					}
+					return store.UpdateTask(tx, task)
+				})
+				assert.NoError(t, err)
+			} else if task.DesiredState > api.TaskStateRunning {
+				err := s.Update(func(tx store.Tx) error {
+					task = store.GetTask(tx, task.ID)
+					task.Status.State = task.DesiredState
+					return store.UpdateTask(tx, task)
+				})
+				assert.NoError(t, err)
 			}
 		}
 	}()
diff --git a/manager/orchestrator/restart/restart.go b/manager/orchestrator/restart/restart.go
index 6af44b734c..c034183ba2 100644
--- a/manager/orchestrator/restart/restart.go
+++ b/manager/orchestrator/restart/restart.go
@@ -2,6 +2,7 @@ package restart
 
 import (
 	"container/list"
+	"context"
 	"errors"
 	"sync"
 	"time"
@@ -14,7 +15,6 @@ import (
 	"github.com/docker/swarmkit/manager/state"
 	"github.com/docker/swarmkit/manager/state/store"
 	gogotypes "github.com/gogo/protobuf/types"
-	"golang.org/x/net/context"
 )
 
 const defaultOldTaskTimeout = time.Minute
diff --git a/manager/orchestrator/service.go b/manager/orchestrator/service.go
index 7356c38cd5..037e493b30 100644
--- a/manager/orchestrator/service.go
+++ b/manager/orchestrator/service.go
@@ -1,10 +1,11 @@
 package orchestrator
 
 import (
+	"context"
+
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/manager/state/store"
-	"golang.org/x/net/context"
 )
 
 // IsReplicatedService checks if a service is a replicated service.
diff --git a/manager/orchestrator/task_test.go b/manager/orchestrator/task_test.go
index 6ac210b1c2..ec7f379f7a 100644
--- a/manager/orchestrator/task_test.go
+++ b/manager/orchestrator/task_test.go
@@ -1,12 +1,13 @@
 package orchestrator
 
 import (
-	google_protobuf "github.com/gogo/protobuf/types"
-	"github.com/stretchr/testify/assert"
 	"sort"
 	"strconv"
 	"testing"
 
+	google_protobuf "github.com/gogo/protobuf/types"
+	"github.com/stretchr/testify/assert"
+
 	"github.com/docker/swarmkit/api"
 )
 
diff --git a/manager/orchestrator/taskinit/init.go b/manager/orchestrator/taskinit/init.go
index b893428d51..be319cc25d 100644
--- a/manager/orchestrator/taskinit/init.go
+++ b/manager/orchestrator/taskinit/init.go
@@ -1,6 +1,7 @@
 package taskinit
 
 import (
+	"context"
 	"sort"
 	"time"
 
@@ -11,7 +12,6 @@ import (
 	"github.com/docker/swarmkit/manager/orchestrator/restart"
 	"github.com/docker/swarmkit/manager/state/store"
 	gogotypes "github.com/gogo/protobuf/types"
-	"golang.org/x/net/context"
 )
 
 // InitHandler defines orchestrator's action to fix tasks at start.
@@ -80,7 +80,7 @@ func CheckTasks(ctx context.Context, s *store.MemoryStore, readTx store.ReadTx,
 				}
 				if err == nil {
 					restartTime := timestamp.Add(restartDelay)
-					calculatedRestartDelay := restartTime.Sub(time.Now())
+					calculatedRestartDelay := time.Until(restartTime)
 					if calculatedRestartDelay < restartDelay {
 						restartDelay = calculatedRestartDelay
 					}
diff --git a/manager/orchestrator/taskreaper/task_reaper.go b/manager/orchestrator/taskreaper/task_reaper.go
index cbeb321de9..5d2d2c7490 100644
--- a/manager/orchestrator/taskreaper/task_reaper.go
+++ b/manager/orchestrator/taskreaper/task_reaper.go
@@ -1,6 +1,7 @@
 package taskreaper
 
 import (
+	"context"
 	"sort"
 	"sync"
 	"time"
@@ -10,7 +11,6 @@ import (
 	"github.com/docker/swarmkit/manager/orchestrator"
 	"github.com/docker/swarmkit/manager/state"
 	"github.com/docker/swarmkit/manager/state/store"
-	"golang.org/x/net/context"
 )
 
 const (
diff --git a/manager/orchestrator/update/updater.go b/manager/orchestrator/update/updater.go
index 5a7d61231c..7c977dba1c 100644
--- a/manager/orchestrator/update/updater.go
+++ b/manager/orchestrator/update/updater.go
@@ -1,14 +1,13 @@
 package update
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"reflect"
 	"sync"
 	"time"
 
-	"golang.org/x/net/context"
-
 	"github.com/docker/go-events"
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/api/defaults"
diff --git a/manager/orchestrator/update/updater_test.go b/manager/orchestrator/update/updater_test.go
index 1eca0f24eb..d54086d529 100644
--- a/manager/orchestrator/update/updater_test.go
+++ b/manager/orchestrator/update/updater_test.go
@@ -1,6 +1,7 @@
 package update
 
 import (
+	"context"
 	"testing"
 	"time"
 
@@ -12,7 +13,6 @@ import (
 	gogotypes "github.com/gogo/protobuf/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 )
 
 func getRunnableSlotSlice(t *testing.T, s *store.MemoryStore, service *api.Service) []orchestrator.Slot {
diff --git a/manager/raftselector/raftselector.go b/manager/raftselector/raftselector.go
index 89e7918a3d..47adcf0fd9 100644
--- a/manager/raftselector/raftselector.go
+++ b/manager/raftselector/raftselector.go
@@ -1,10 +1,9 @@
 package raftselector
 
 import (
+	"context"
 	"errors"
 
-	"golang.org/x/net/context"
-
 	"google.golang.org/grpc"
 )
 
diff --git a/manager/resourceapi/allocator.go b/manager/resourceapi/allocator.go
index ec19fba850..545e4ded99 100644
--- a/manager/resourceapi/allocator.go
+++ b/manager/resourceapi/allocator.go
@@ -1,6 +1,7 @@
 package resourceapi
 
 import (
+	"context"
 	"errors"
 	"time"
 
@@ -9,7 +10,6 @@ import (
 	"github.com/docker/swarmkit/identity"
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/docker/swarmkit/protobuf/ptypes"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
diff --git a/manager/role_manager.go b/manager/role_manager.go
index e5cf27b62f..a68bc3fc3b 100644
--- a/manager/role_manager.go
+++ b/manager/role_manager.go
@@ -1,6 +1,7 @@
 package manager
 
 import (
+	"context"
 	"time"
 
 	"github.com/docker/swarmkit/api"
@@ -9,7 +10,6 @@ import (
 	"github.com/docker/swarmkit/manager/state/raft/membership"
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/pivotal-golang/clock"
-	"golang.org/x/net/context"
 )
 
 const (
diff --git a/manager/scheduler/nodeinfo.go b/manager/scheduler/nodeinfo.go
index 78fa630ca3..3094402a58 100644
--- a/manager/scheduler/nodeinfo.go
+++ b/manager/scheduler/nodeinfo.go
@@ -1,12 +1,12 @@
 package scheduler
 
 import (
+	"context"
 	"time"
 
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/api/genericresource"
 	"github.com/docker/swarmkit/log"
-	"golang.org/x/net/context"
 )
 
 // hostPortSpec specifies a used host port.
diff --git a/manager/scheduler/scheduler.go b/manager/scheduler/scheduler.go
index 9e708ed1b6..939fc6f96d 100644
--- a/manager/scheduler/scheduler.go
+++ b/manager/scheduler/scheduler.go
@@ -1,6 +1,7 @@
 package scheduler
 
 import (
+	"context"
 	"time"
 
 	"github.com/docker/swarmkit/api"
@@ -9,7 +10,6 @@ import (
 	"github.com/docker/swarmkit/manager/state"
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/docker/swarmkit/protobuf/ptypes"
-	"golang.org/x/net/context"
 )
 
 const (
diff --git a/manager/scheduler/scheduler_test.go b/manager/scheduler/scheduler_test.go
index d387dc4a01..da59acd72d 100644
--- a/manager/scheduler/scheduler_test.go
+++ b/manager/scheduler/scheduler_test.go
@@ -1,6 +1,7 @@
 package scheduler
 
 import (
+	"context"
 	"fmt"
 	"runtime"
 	"strconv"
@@ -16,7 +17,6 @@ import (
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 )
 
 func TestScheduler(t *testing.T) {
diff --git a/manager/state/proposer.go b/manager/state/proposer.go
index 4967f98a1e..8d53f5772f 100644
--- a/manager/state/proposer.go
+++ b/manager/state/proposer.go
@@ -1,8 +1,9 @@
 package state
 
 import (
+	"context"
+
 	"github.com/docker/swarmkit/api"
-	"golang.org/x/net/context"
 )
 
 // A Change includes a version number and a set of store actions from a
diff --git a/manager/state/raft/membership/cluster_test.go b/manager/state/raft/membership/cluster_test.go
index fc37de3d50..1917066a98 100644
--- a/manager/state/raft/membership/cluster_test.go
+++ b/manager/state/raft/membership/cluster_test.go
@@ -1,6 +1,7 @@
 package membership_test
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"io/ioutil"
@@ -9,8 +10,6 @@ import (
 	"testing"
 	"time"
 
-	"golang.org/x/net/context"
-
 	"google.golang.org/grpc/grpclog"
 
 	"github.com/coreos/etcd/raft/raftpb"
@@ -279,7 +278,8 @@ func TestCanRemoveMember(t *testing.T) {
 
 	// Removing nodes at this point fails because we lost quorum
 	for i := 1; i <= 3; i++ {
-		ctx, _ := context.WithTimeout(context.Background(), 10*time.Second)
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
 		err := nodes[1].RemoveMember(ctx, uint64(i))
 		assert.Error(t, err)
 		members := nodes[1].GetMemberlist()
@@ -341,15 +341,17 @@ func TestCanRemoveMember(t *testing.T) {
 	}))
 
 	// Removing node 2 should fail (this would break the quorum)
-	ctx, _ := context.WithTimeout(context.Background(), 10*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	err := nodes[leader].RemoveMember(ctx, nodes[2].Config.ID)
+	cancel()
 	assert.EqualError(t, err, raft.ErrCannotRemoveMember.Error())
 	members := nodes[leader].GetMemberlist()
 	assert.Equal(t, len(members), 3)
 
 	// Removing node 3 works fine because it is already unreachable
-	ctx, _ = context.WithTimeout(context.Background(), 10*time.Second)
+	ctx, cancel = context.WithTimeout(context.Background(), 10*time.Second)
 	err = nodes[leader].RemoveMember(ctx, nodes[3].Config.ID)
+	cancel()
 	assert.NoError(t, err)
 	members = nodes[leader].GetMemberlist()
 	assert.Nil(t, members[nodes[3].Config.ID])
@@ -380,16 +382,18 @@ func TestCanRemoveMember(t *testing.T) {
 	}))
 
 	// Removing node 3 should succeed
-	ctx, _ = context.WithTimeout(context.Background(), 10*time.Second)
+	ctx, cancel = context.WithTimeout(context.Background(), 10*time.Second)
 	err = nodes[leader].RemoveMember(ctx, nodes[3].Config.ID)
+	cancel()
 	assert.NoError(t, err)
 	members = nodes[leader].GetMemberlist()
 	assert.Nil(t, members[nodes[3].Config.ID])
 	assert.Equal(t, len(members), 2)
 
 	// Removing node 2 should succeed
-	ctx, _ = context.WithTimeout(context.Background(), 10*time.Second)
+	ctx, cancel = context.WithTimeout(context.Background(), 10*time.Second)
 	err = nodes[leader].RemoveMember(ctx, nodes[2].Config.ID)
+	cancel()
 	assert.NoError(t, err)
 	members = nodes[leader].GetMemberlist()
 	assert.Nil(t, members[nodes[2].Config.ID])
diff --git a/manager/state/raft/raft.go b/manager/state/raft/raft.go
index 9eec8d4dfb..2a2bbfe54c 100644
--- a/manager/state/raft/raft.go
+++ b/manager/state/raft/raft.go
@@ -1,6 +1,7 @@
 package raft
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"math"
@@ -30,7 +31,6 @@ import (
 	"github.com/pivotal-golang/clock"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 	"golang.org/x/time/rate"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
@@ -1172,11 +1172,8 @@ func (n *Node) CanRemoveMember(id uint64) bool {
 	}
 
 	nquorum := (len(members)-1)/2 + 1
-	if nreachable < nquorum {
-		return false
-	}
 
-	return true
+	return nreachable >= nquorum
 }
 
 func (n *Node) removeMember(ctx context.Context, id uint64) error {
@@ -1581,10 +1578,7 @@ func (n *Node) ProposeValue(ctx context.Context, storeAction []api.StoreAction,
 	defer cancel()
 	_, err := n.processInternalRaftRequest(ctx, &api.InternalRaftRequest{Action: storeAction}, cb)
 
-	if err != nil {
-		return err
-	}
-	return nil
+	return err
 }
 
 // GetVersion returns the sequence information for the current raft round.
diff --git a/manager/state/raft/raft_test.go b/manager/state/raft/raft_test.go
index 3b3172e3dd..152d830e06 100644
--- a/manager/state/raft/raft_test.go
+++ b/manager/state/raft/raft_test.go
@@ -1,6 +1,7 @@
 package raft_test
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"io/ioutil"
@@ -18,8 +19,6 @@ import (
 	"google.golang.org/grpc/grpclog"
 	"google.golang.org/grpc/status"
 
-	"golang.org/x/net/context"
-
 	"github.com/coreos/etcd/raft/raftpb"
 	"github.com/coreos/etcd/wal"
 	"github.com/docker/swarmkit/api"
@@ -112,8 +111,9 @@ func TestRaftJoinTwice(t *testing.T) {
 	assert.NoError(t, err)
 	raftClient := api.NewRaftMembershipClient(cc)
 	defer cc.Close()
-	ctx, _ := context.WithTimeout(context.Background(), 10*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	_, err = raftClient.Join(ctx, &api.JoinRequest{Addr: l.Addr().String()})
+	cancel()
 	assert.NoError(t, err)
 
 	// Propose a value and wait for it to propagate
@@ -369,8 +369,9 @@ func TestRaftFollowerLeave(t *testing.T) {
 	assert.NoError(t, err)
 	raftClient := api.NewRaftMembershipClient(cc)
 	defer cc.Close()
-	ctx, _ := context.WithTimeout(context.Background(), 10*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	resp, err := raftClient.Leave(ctx, &api.LeaveRequest{Node: &api.RaftMember{RaftID: nodes[5].Config.ID}})
+	cancel()
 	assert.NoError(t, err, "error sending message to leave the raft")
 	assert.NotNil(t, resp, "leave response message is nil")
 
@@ -414,8 +415,8 @@ func TestRaftLeaderLeave(t *testing.T) {
 	raftClient := api.NewRaftMembershipClient(cc)
 	defer cc.Close()
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
 	resp, err := raftClient.Leave(ctx, &api.LeaveRequest{Node: &api.RaftMember{RaftID: nodes[1].Config.ID}})
+	cancel()
 	assert.NoError(t, err, "error sending message to leave the raft")
 	assert.NotNil(t, resp, "leave response message is nil")
 
diff --git a/manager/state/raft/storage.go b/manager/state/raft/storage.go
index 547b775645..915cc3f241 100644
--- a/manager/state/raft/storage.go
+++ b/manager/state/raft/storage.go
@@ -1,6 +1,7 @@
 package raft
 
 import (
+	"context"
 	"fmt"
 
 	"github.com/coreos/etcd/raft"
@@ -13,7 +14,6 @@ import (
 	"github.com/docker/swarmkit/manager/state/raft/storage"
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/pkg/errors"
-	"golang.org/x/net/context"
 )
 
 var (
diff --git a/manager/state/raft/storage/storage.go b/manager/state/raft/storage/storage.go
index bbd262f37c..64d821894e 100644
--- a/manager/state/raft/storage/storage.go
+++ b/manager/state/raft/storage/storage.go
@@ -1,13 +1,12 @@
 package storage
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"path/filepath"
 	"sync"
 
-	"golang.org/x/net/context"
-
 	"github.com/coreos/etcd/pkg/fileutil"
 	"github.com/coreos/etcd/raft/raftpb"
 	"github.com/coreos/etcd/snap"
diff --git a/manager/state/raft/storage/storage_test.go b/manager/state/raft/storage/storage_test.go
index f192eb48c2..2811f6e7d4 100644
--- a/manager/state/raft/storage/storage_test.go
+++ b/manager/state/raft/storage/storage_test.go
@@ -1,6 +1,7 @@
 package storage
 
 import (
+	"context"
 	"io/ioutil"
 	"os"
 	"path/filepath"
@@ -11,7 +12,6 @@ import (
 	"github.com/docker/swarmkit/manager/encryption"
 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 )
 
 func TestBootstrapFromDisk(t *testing.T) {
diff --git a/manager/state/raft/storage/walwrap.go b/manager/state/raft/storage/walwrap.go
index 3c1208cdd0..d1155975bf 100644
--- a/manager/state/raft/storage/walwrap.go
+++ b/manager/state/raft/storage/walwrap.go
@@ -1,6 +1,7 @@
 package storage
 
 import (
+	"context"
 	"io"
 	"io/ioutil"
 	"os"
@@ -14,7 +15,6 @@ import (
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/manager/encryption"
 	"github.com/pkg/errors"
-	"golang.org/x/net/context"
 )
 
 // This package wraps the github.com/coreos/etcd/wal package, and encrypts
diff --git a/manager/state/raft/storage/walwrap_test.go b/manager/state/raft/storage/walwrap_test.go
index 18fa5b77ea..ffe4d39107 100644
--- a/manager/state/raft/storage/walwrap_test.go
+++ b/manager/state/raft/storage/walwrap_test.go
@@ -2,6 +2,7 @@ package storage
 
 import (
 	"bytes"
+	"context"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -13,7 +14,6 @@ import (
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/manager/encryption"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 )
 
 var _ WALFactory = walCryptor{}
diff --git a/manager/state/raft/storage_test.go b/manager/state/raft/storage_test.go
index 2fcbcd18c1..9b49c6bd59 100644
--- a/manager/state/raft/storage_test.go
+++ b/manager/state/raft/storage_test.go
@@ -1,6 +1,7 @@
 package raft_test
 
 import (
+	"context"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -18,7 +19,6 @@ import (
 	"github.com/pivotal-golang/clock/fakeclock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 )
 
 func TestRaftSnapshot(t *testing.T) {
@@ -276,8 +276,9 @@ func TestRaftSnapshotForceNewCluster(t *testing.T) {
 	assert.NoError(t, err)
 	raftClient := api.NewRaftMembershipClient(cc)
 	defer cc.Close()
-	ctx, _ := context.WithTimeout(context.Background(), 10*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	resp, err := raftClient.Leave(ctx, &api.LeaveRequest{Node: &api.RaftMember{RaftID: nodes[2].Config.ID}})
+	cancel()
 	assert.NoError(t, err, "error sending message to leave the raft")
 	assert.NotNil(t, resp, "leave response message is nil")
 
@@ -502,12 +503,13 @@ func proposeLargeValue(t *testing.T, raftNode *raftutils.TestNode, time time.Dur
 		},
 	}
 
-	ctx, _ := context.WithTimeout(context.Background(), time)
+	ctx, cancel := context.WithTimeout(context.Background(), time)
 
 	err := raftNode.ProposeValue(ctx, storeActions, func() {
 		err := raftNode.MemoryStore().ApplyStoreActions(storeActions)
 		assert.NoError(t, err, "error applying actions")
 	})
+	cancel()
 	if err != nil {
 		return nil, err
 	}
diff --git a/manager/state/raft/testutils/testutils.go b/manager/state/raft/testutils/testutils.go
index dae38b9afa..d5ceeaeade 100644
--- a/manager/state/raft/testutils/testutils.go
+++ b/manager/state/raft/testutils/testutils.go
@@ -1,6 +1,7 @@
 package testutils
 
 import (
+	"context"
 	"io/ioutil"
 	"net"
 	"os"
@@ -9,8 +10,6 @@ import (
 	"testing"
 	"time"
 
-	"golang.org/x/net/context"
-
 	"google.golang.org/grpc"
 
 	etcdraft "github.com/coreos/etcd/raft"
@@ -526,12 +525,13 @@ func ProposeValue(t *testing.T, raftNode *TestNode, time time.Duration, nodeID .
 		},
 	}
 
-	ctx, _ := context.WithTimeout(context.Background(), time)
+	ctx, cancel := context.WithTimeout(context.Background(), time)
 
 	err := raftNode.ProposeValue(ctx, storeActions, func() {
 		err := raftNode.MemoryStore().ApplyStoreActions(storeActions)
 		assert.NoError(t, err, "error applying actions")
 	})
+	cancel()
 	if err != nil {
 		return nil, err
 	}
diff --git a/manager/state/raft/transport/mock_raft_test.go b/manager/state/raft/transport/mock_raft_test.go
index f6aa625acf..c8f4a9ebb0 100644
--- a/manager/state/raft/transport/mock_raft_test.go
+++ b/manager/state/raft/transport/mock_raft_test.go
@@ -1,6 +1,7 @@
 package transport
 
 import (
+	"context"
 	"io"
 	"net"
 	"time"
@@ -11,7 +12,6 @@ import (
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/manager/health"
 	"github.com/docker/swarmkit/manager/state/raft/membership"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
diff --git a/manager/state/raft/transport/peer.go b/manager/state/raft/transport/peer.go
index bdd3ec0293..aabfddf97e 100644
--- a/manager/state/raft/transport/peer.go
+++ b/manager/state/raft/transport/peer.go
@@ -1,12 +1,11 @@
 package transport
 
 import (
+	"context"
 	"fmt"
 	"sync"
 	"time"
 
-	"golang.org/x/net/context"
-
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 
diff --git a/manager/state/raft/transport/peer_test.go b/manager/state/raft/transport/peer_test.go
index 1b04e1b72a..21089eba98 100644
--- a/manager/state/raft/transport/peer_test.go
+++ b/manager/state/raft/transport/peer_test.go
@@ -1,11 +1,10 @@
 package transport
 
 import (
+	"context"
 	"math"
 	"testing"
 
-	"golang.org/x/net/context"
-
 	"github.com/coreos/etcd/raft/raftpb"
 	"github.com/stretchr/testify/assert"
 )
diff --git a/manager/state/raft/transport/transport.go b/manager/state/raft/transport/transport.go
index b741c4aa67..72cf073ba5 100644
--- a/manager/state/raft/transport/transport.go
+++ b/manager/state/raft/transport/transport.go
@@ -3,12 +3,11 @@
 package transport
 
 import (
+	"context"
 	"net"
 	"sync"
 	"time"
 
-	"golang.org/x/net/context"
-
 	grpc_prometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
diff --git a/manager/state/raft/transport/transport_test.go b/manager/state/raft/transport/transport_test.go
index c203e7447b..b631958ea5 100644
--- a/manager/state/raft/transport/transport_test.go
+++ b/manager/state/raft/transport/transport_test.go
@@ -1,11 +1,10 @@
 package transport
 
 import (
+	"context"
 	"testing"
 	"time"
 
-	"golang.org/x/net/context"
-
 	"github.com/coreos/etcd/raft"
 	"github.com/coreos/etcd/raft/raftpb"
 	"github.com/stretchr/testify/assert"
diff --git a/manager/state/raft/util.go b/manager/state/raft/util.go
index da44dca6a5..75872fe77c 100644
--- a/manager/state/raft/util.go
+++ b/manager/state/raft/util.go
@@ -1,10 +1,9 @@
 package raft
 
 import (
+	"context"
 	"time"
 
-	"golang.org/x/net/context"
-
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/manager/state"
 	"github.com/docker/swarmkit/manager/state/store"
diff --git a/manager/state/store/memory.go b/manager/state/store/memory.go
index e64565fae8..a1d84021f7 100644
--- a/manager/state/store/memory.go
+++ b/manager/state/store/memory.go
@@ -1,6 +1,7 @@
 package store
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"runtime"
@@ -18,7 +19,6 @@ import (
 	"github.com/docker/swarmkit/watch"
 	gogotypes "github.com/gogo/protobuf/types"
 	memdb "github.com/hashicorp/go-memdb"
-	"golang.org/x/net/context"
 )
 
 const (
@@ -689,7 +689,7 @@ func (tx readTx) findIterators(table string, by By, checkType func(By) error) ([
 		}
 		return []memdb.ResultIterator{it}, nil
 	case bySlot:
-		it, err := tx.memDBTx.Get(table, indexSlot, v.serviceID+"\x00"+strconv.FormatUint(uint64(v.slot), 10))
+		it, err := tx.memDBTx.Get(table, indexSlot, v.serviceID+"\x00"+strconv.FormatUint(v.slot, 10))
 		if err != nil {
 			return nil, err
 		}
diff --git a/manager/state/testutils/mock_proposer.go b/manager/state/testutils/mock_proposer.go
index caf8ebaf55..38b0662b3e 100644
--- a/manager/state/testutils/mock_proposer.go
+++ b/manager/state/testutils/mock_proposer.go
@@ -1,11 +1,11 @@
 package testutils
 
 import (
+	"context"
 	"errors"
 
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/manager/state"
-	"golang.org/x/net/context"
 )
 
 // MockProposer is a simple proposer implementation for use in tests.
diff --git a/manager/watchapi/server.go b/manager/watchapi/server.go
index 6d49dca715..eb086b8ac0 100644
--- a/manager/watchapi/server.go
+++ b/manager/watchapi/server.go
@@ -1,11 +1,11 @@
 package watchapi
 
 import (
+	"context"
 	"errors"
 	"sync"
 
 	"github.com/docker/swarmkit/manager/state/store"
-	"golang.org/x/net/context"
 )
 
 var (
diff --git a/manager/watchapi/server_test.go b/manager/watchapi/server_test.go
index 2e223ba91a..afc8b39780 100644
--- a/manager/watchapi/server_test.go
+++ b/manager/watchapi/server_test.go
@@ -1,6 +1,7 @@
 package watchapi
 
 import (
+	"context"
 	"io/ioutil"
 	"log"
 	"net"
@@ -15,7 +16,6 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/grpclog"
 )
diff --git a/manager/watchapi/watch_test.go b/manager/watchapi/watch_test.go
index 3d908c1766..41aa7a0e97 100644
--- a/manager/watchapi/watch_test.go
+++ b/manager/watchapi/watch_test.go
@@ -1,13 +1,13 @@
 package watchapi
 
 import (
+	"context"
 	"testing"
 
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/manager/state/store"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 )
 
 func TestWatch(t *testing.T) {
diff --git a/node/node.go b/node/node.go
index 9845192c47..d4153d6177 100644
--- a/node/node.go
+++ b/node/node.go
@@ -2,6 +2,7 @@ package node
 
 import (
 	"bytes"
+	"context"
 	"crypto/tls"
 	"encoding/json"
 	"io/ioutil"
@@ -34,7 +35,6 @@ import (
 	grpc_prometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
@@ -1061,19 +1061,16 @@ func (s *persistentRemotes) Observe(peer api.Peer, weight int) {
 	s.c.Broadcast()
 	if err := s.save(); err != nil {
 		logrus.Errorf("error writing cluster state file: %v", err)
-		return
 	}
-	return
 }
+
 func (s *persistentRemotes) Remove(peers ...api.Peer) {
 	s.Lock()
 	defer s.Unlock()
 	s.Remotes.Remove(peers...)
 	if err := s.save(); err != nil {
 		logrus.Errorf("error writing cluster state file: %v", err)
-		return
 	}
-	return
 }
 
 func (s *persistentRemotes) save() error {
diff --git a/node/node_test.go b/node/node_test.go
index ebd44b03e8..6f6bd25c67 100644
--- a/node/node_test.go
+++ b/node/node_test.go
@@ -2,6 +2,7 @@ package node
 
 import (
 	"bytes"
+	"context"
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
@@ -25,7 +26,6 @@ import (
 	"github.com/docker/swarmkit/testutils"
 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/net/context"
 )
 
 func getLoggingContext(t *testing.T) context.Context {
diff --git a/protobuf/plugin/raftproxy/test/raftproxy_test.go b/protobuf/plugin/raftproxy/test/raftproxy_test.go
index 3dd8990661..00fe9f3a06 100644
--- a/protobuf/plugin/raftproxy/test/raftproxy_test.go
+++ b/protobuf/plugin/raftproxy/test/raftproxy_test.go
@@ -1,6 +1,7 @@
 package test
 
 import (
+	"context"
 	"net"
 	"testing"
 	"time"
@@ -8,8 +9,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"golang.org/x/net/context"
-
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 )
diff --git a/watch/sinks_test.go b/watch/sinks_test.go
index 867b2f7c42..69593885eb 100644
--- a/watch/sinks_test.go
+++ b/watch/sinks_test.go
@@ -39,8 +39,7 @@ func TestTimeoutDropErrSinkGen(t *testing.T) {
 	<-ch2.Done()
 
 	// Make sure that closing a sink closes the channel
-	var errClose error
-	errClose = sink.Close()
+	errClose := sink.Close()
 	<-ch.Done()
 	require.NoError(errClose)