diff --git a/Makefile b/Makefile
index 2b9c4c087bd..916a5cc2442 100644
--- a/Makefile
+++ b/Makefile
@@ -121,6 +121,7 @@ validate:
 	script/validate-gofmt
 	script/validate-c
 	$(GO) vet $(MOD_VENDOR) ./...
+	shellcheck tests/integration/*.bats
 
 ci: validate test release
 
diff --git a/tests/integration/cgroups.bats b/tests/integration/cgroups.bats
index 4e81ac50c04..676655edef5 100644
--- a/tests/integration/cgroups.bats
+++ b/tests/integration/cgroups.bats
@@ -3,7 +3,7 @@
 load helpers
 
 function teardown() {
-    rm -f $BATS_TMPDIR/runc-cgroups-integration-test.json
+    rm -f "$BATS_TMPDIR"/runc-cgroups-integration-test.json
     teardown_running_container test_cgroups_kmem
     teardown_running_container test_cgroups_permissions
     teardown_busybox
@@ -21,10 +21,10 @@ function setup() {
     set_cgroups_path "$BUSYBOX_BUNDLE"
 
     # Set some initial known values
-    update_config '.linux.resources.memory |= {"kernel": 16777216, "kernelTCP": 11534336}' ${BUSYBOX_BUNDLE}
+    update_config '.linux.resources.memory |= {"kernel": 16777216, "kernelTCP": 11534336}' "${BUSYBOX_BUNDLE}"
 
     # run a detached busybox to work with
-    runc run -d --console-socket $CONSOLE_SOCKET test_cgroups_kmem
+    runc run -d --console-socket "$CONSOLE_SOCKET" test_cgroups_kmem
     [ "$status" -eq 0 ]
 
     check_cgroup_value "memory.kmem.limit_in_bytes" 16777216
@@ -48,14 +48,14 @@ function setup() {
     set_cgroups_path "$BUSYBOX_BUNDLE"
 
     # run a detached busybox to work with
-    runc run -d --console-socket $CONSOLE_SOCKET test_cgroups_kmem
+    runc run -d --console-socket "$CONSOLE_SOCKET" test_cgroups_kmem
     [ "$status" -eq 0 ]
 
     # update kernel memory limit
     runc update test_cgroups_kmem --kernel-memory 50331648
     # Since kernel 4.6, we can update kernel memory without initialization
     # because it's accounted by default.
-    if [ "$KERNEL_MAJOR" -lt 4 ] || [ "$KERNEL_MAJOR" -eq 4 -a "$KERNEL_MINOR" -le 5 ]; then
+    if [[ "$KERNEL_MAJOR" -lt 4 || ( "$KERNEL_MAJOR" -eq 4 && "$KERNEL_MINOR" -le 5 ) ]]; then
         [ ! "$status" -eq 0 ]
     else
         [ "$status" -eq 0 ]
@@ -64,7 +64,7 @@ function setup() {
 }
 
 @test "runc create (no limits + no cgrouppath + no permission) succeeds" {
-    runc run -d --console-socket $CONSOLE_SOCKET test_cgroups_permissions
+    runc run -d --console-socket "$CONSOLE_SOCKET" test_cgroups_permissions
     [ "$status" -eq 0 ]
 }
 
@@ -76,7 +76,7 @@ function setup() {
 
     set_cgroups_path "$BUSYBOX_BUNDLE"
 
-    runc run -d --console-socket $CONSOLE_SOCKET test_cgroups_permissions
+    runc run -d --console-socket "$CONSOLE_SOCKET" test_cgroups_permissions
     [ "$status" -eq 1 ]
     [[ ${lines[1]} == *"permission denied"* ]]
 }
@@ -89,7 +89,7 @@ function setup() {
 
     set_resources_limit "$BUSYBOX_BUNDLE"
 
-    runc run -d --console-socket $CONSOLE_SOCKET test_cgroups_permissions
+    runc run -d --console-socket "$CONSOLE_SOCKET" test_cgroups_permissions
     [ "$status" -eq 1 ]
     [[ ${lines[1]} == *"rootless needs no limits + no cgrouppath when no permission is granted for cgroups"* ]] || [[ ${lines[1]} == *"cannot set pids limit: container could not join or create cgroup"* ]]
 }
@@ -100,13 +100,14 @@ function setup() {
     set_cgroups_path "$BUSYBOX_BUNDLE"
     set_resources_limit "$BUSYBOX_BUNDLE"
 
-    runc run -d --console-socket $CONSOLE_SOCKET test_cgroups_permissions
+    runc run -d --console-socket "$CONSOLE_SOCKET" test_cgroups_permissions
     [ "$status" -eq 0 ]
     if [ "$CGROUP_UNIFIED" != "no" ]; then
         if [ -n "${RUNC_USE_SYSTEMD}" ] ; then
-            if [ $(id -u) = "0" ]; then
+            if [ "$(id -u)" = "0" ]; then
                 check_cgroup_value "cgroup.controllers" "$(cat /sys/fs/cgroup/machine.slice/cgroup.controllers)"
             else
+                # shellcheck disable=SC2046
                 check_cgroup_value "cgroup.controllers" "$(cat /sys/fs/cgroup/user.slice/user-$(id -u).slice/cgroup.controllers)"
             fi
         else
@@ -121,7 +122,7 @@ function setup() {
     set_cgroups_path "$BUSYBOX_BUNDLE"
     set_resources_limit "$BUSYBOX_BUNDLE"
 
-    runc run -d --console-socket $CONSOLE_SOCKET test_cgroups_permissions
+    runc run -d --console-socket "$CONSOLE_SOCKET" test_cgroups_permissions
     [ "$status" -eq 0 ]
 
     runc exec test_cgroups_permissions echo "cgroups_exec"
@@ -135,7 +136,7 @@ function setup() {
     set_cgroups_path "$BUSYBOX_BUNDLE"
     set_cgroup_mount_writable "$BUSYBOX_BUNDLE"
 
-    runc run -d --console-socket $CONSOLE_SOCKET test_cgroups_group
+    runc run -d --console-socket "$CONSOLE_SOCKET" test_cgroups_group
     [ "$status" -eq 0 ]
 
     runc exec test_cgroups_group cat /sys/fs/cgroup/cgroup.controllers
@@ -169,6 +170,7 @@ function setup() {
     [[ ${lines[0]} == "0::/foo" ]]
 
 # teardown: remove "/foo"
+    # shellcheck disable=SC2016
     runc exec test_cgroups_group sh -uxc 'echo -memory > /sys/fs/cgroup/cgroup.subtree_control; for f in $(cat /sys/fs/cgroup/foo/cgroup.procs); do echo $f > /sys/fs/cgroup/cgroup.procs; done; rmdir /sys/fs/cgroup/foo'
     runc exec test_cgroups_group test ! -d /sys/fs/cgroup/foo
     [ "$status" -eq 0 ]
diff --git a/tests/integration/checkpoint.bats b/tests/integration/checkpoint.bats
index 68c02ec3594..4cb4b648ec5 100644
--- a/tests/integration/checkpoint.bats
+++ b/tests/integration/checkpoint.bats
@@ -15,7 +15,7 @@ function teardown() {
   local pid fd
 
   for pid in "${PIDS_TO_KILL[@]}"; do
-    kill -9 $pid || true
+    kill -9 "$pid" || true
   done
   PIDS_TO_KILL=()
 
@@ -27,6 +27,7 @@ function teardown() {
 
 function setup_pipes() {
 	# The changes to 'terminal' are needed for running in detached mode
+	# shellcheck disable=SC2016
 	update_config 	' (.. | select(.terminal? != null)) .terminal |= false
 			| (.. | select(.[]? == "sh")) += ["-c", "for i in `seq 10`; do read xxx || continue; echo ponG $xxx; done"]'
 
@@ -41,6 +42,7 @@ function setup_pipes() {
 	exec {in_r}</proc/self/fd/$pipe
 	exec {in_w}>/proc/self/fd/$pipe
 	exec {pipe}>&-
+	# shellcheck disable=SC2206
 	FDS_TO_CLOSE=($in_r $in_w $out_r $out_w)
 }
 
@@ -54,23 +56,24 @@ function check_pipes() {
 }
 
 function simple_cr() {
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   testcontainer test_busybox running
 
-  for i in `seq 2`; do
+  # shellcheck disable=SC2034
+  for i in $(seq 2); do
     # checkpoint the running container
     runc --criu "$CRIU" checkpoint --work-path ./work-dir test_busybox
-    cat ./work-dir/dump.log | grep -B 5 Error || true
+    grep -B 5 Error ./work-dir/dump.log || true
     [ "$status" -eq 0 ]
 
     # after checkpoint busybox is no longer running
     testcontainer test_busybox checkpointed
 
     # restore from checkpoint
-    runc --criu "$CRIU" restore -d --work-path ./work-dir --console-socket $CONSOLE_SOCKET test_busybox
-    cat ./work-dir/restore.log | grep -B 5 Error || true
+    runc --criu "$CRIU" restore -d --work-path ./work-dir --console-socket "$CONSOLE_SOCKET" test_busybox
+    grep -B 5 Error ./work-dir/restore.log || true
     [ "$status" -eq 0 ]
 
     # busybox should be back up and running
@@ -112,7 +115,7 @@ function simple_cr() {
   mkdir image-dir
   mkdir work-dir
   runc --criu "$CRIU" checkpoint --parent-path ./parent-dir --work-path ./work-dir --image-path ./image-dir test_busybox
-  cat ./work-dir/dump.log | grep -B 5 Error || true
+  grep -B 5 Error ./work-dir/dump.log || true
   [ "$status" -eq 0 ]
 
   # after checkpoint busybox is no longer running
@@ -121,7 +124,7 @@ function simple_cr() {
   # restore from checkpoint
   ret=0
   __runc --criu "$CRIU" restore -d --work-path ./work-dir --image-path ./image-dir test_busybox <&${in_r} >&${out_w} 2>&${out_w} || ret=$?
-  cat ./work-dir/restore.log | grep -B 5 Error || true
+  grep -B 5 Error ./work-dir/restore.log || true
   [ $ret -eq 0 ]
 
   # busybox should be back up and running
@@ -136,7 +139,7 @@ function simple_cr() {
 
 @test "checkpoint --lazy-pages and restore" {
   # check if lazy-pages is supported
-  run ${CRIU} check --feature uffd-noncoop
+  run "${CRIU}" check --feature uffd-noncoop
   if [ "$status" -eq 1 ]; then
     skip "this criu does not support lazy migration"
   fi
@@ -158,17 +161,21 @@ function simple_cr() {
   # For lazy migration we need to know when CRIU is ready to serve
   # the memory pages via TCP.
   exec {pipe}<> <(:)
+  # shellcheck disable=SC2094
   exec {lazy_r}</proc/self/fd/$pipe {lazy_w}>/proc/self/fd/$pipe
   exec {pipe}>&-
+  # shellcheck disable=SC2206
   FDS_TO_CLOSE+=($lazy_r $lazy_w)
 
   __runc --criu "$CRIU" checkpoint --lazy-pages --page-server 0.0.0.0:${port} --status-fd ${lazy_w} --work-path ./work-dir --image-path ./image-dir test_busybox &
   cpt_pid=$!
+  # shellcheck disable=SC2206
   PIDS_TO_KILL=($cpt_pid)
 
   # wait for lazy page server to be ready
   out=$(timeout 2 dd if=/proc/self/fd/${lazy_r} bs=1 count=1 2>/dev/null | od)
   exec {lazy_w}>&-
+  # shellcheck disable=SC2116,SC2086
   out=$(echo $out) # rm newlines
   # show errors if there are any before we fail
   grep -B5 Error ./work-dir/dump.log || true
@@ -181,6 +188,7 @@ function simple_cr() {
   # Start CRIU in lazy-daemon mode
   ${CRIU} lazy-pages --page-server --address 127.0.0.1 --port ${port} -D image-dir &
   lp_pid=$!
+  # shellcheck disable=SC2206
   PIDS_TO_KILL+=($lp_pid)
 
   # Restore lazily from checkpoint.
@@ -191,7 +199,7 @@ function simple_cr() {
   # continue to run if the migration failed at some point.
   ret=0
   __runc --criu "$CRIU" restore -d --work-path ./image-dir --image-path ./image-dir --lazy-pages test_busybox_restore <&${in_r} >&${out_w} 2>&${out_w} || ret=$?
-  cat ./work-dir/restore.log | grep -B 5 Error || true
+  grep -B 5 Error ./work-dir/restore.log || true
   [ $ret -eq 0 ]
 
   # busybox should be back up and running
@@ -211,70 +219,69 @@ function simple_cr() {
 
 @test "checkpoint and restore in external network namespace" {
   # check if external_net_ns is supported; only with criu 3.10++
-  run ${CRIU} check --feature external_net_ns
+  run "${CRIU}" check --feature external_net_ns
   if [ "$status" -eq 1 ]; then
     # this criu does not support external_net_ns; skip the test
     skip "this criu does not support external network namespaces"
   fi
 
   # create a temporary name for the test network namespace
-  tmp=`mktemp`
-  rm -f $tmp
-  ns_name=`basename $tmp`
+  tmp=$(mktemp)
+  rm -f "$tmp"
+  ns_name=$(basename "$tmp")
   # create network namespace
-  ip netns add $ns_name
-  ns_path=`ip netns add $ns_name 2>&1 | sed -e 's/.*"\(.*\)".*/\1/'`
-
-  ns_inode=`ls -iL $ns_path | awk '{ print $1 }'`
+  ip netns add "$ns_name"
+  ns_path=$(ip netns add "$ns_name" 2>&1 | sed -e 's/.*"\(.*\)".*/\1/')
+  # shellcheck disable=SC2012
+  ns_inode=$(ls -iL "$ns_path" | awk '{ print $1 }')
 
   # tell runc which network namespace to use
   update_config '(.. | select(.type? == "network")) .path |= "'"$ns_path"'"'
 
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   testcontainer test_busybox running
 
-  for i in `seq 2`; do
+  # shellcheck disable=SC2034
+  for i in $(seq 2); do
     # checkpoint the running container; this automatically tells CRIU to
     # handle the network namespace defined in config.json as an external
     runc --criu "$CRIU" checkpoint --work-path ./work-dir test_busybox
-    # if you are having problems getting criu to work uncomment the following dump:
-    #cat /run/opencontainer/containers/test_busybox/criu.work/dump.log
-    cat ./work-dir/dump.log | grep -B 5 Error || true
+    grep -B 5 Error ./work-dir/dump.log || true
     [ "$status" -eq 0 ]
 
     # after checkpoint busybox is no longer running
     testcontainer test_busybox checkpointed
 
     # restore from checkpoint; this should restore the container into the existing network namespace
-    runc --criu "$CRIU" restore -d --work-path ./work-dir --console-socket $CONSOLE_SOCKET test_busybox
-    cat ./work-dir/restore.log | grep -B 5 Error || true
+    runc --criu "$CRIU" restore -d --work-path ./work-dir --console-socket "$CONSOLE_SOCKET" test_busybox
+    grep -B 5 Error ./work-dir/restore.log || true
     [ "$status" -eq 0 ]
 
     # busybox should be back up and running
     testcontainer test_busybox running
 
     # container should be running in same network namespace as before
-    pid=`__runc state test_busybox | jq '.pid'`
-    ns_inode_new=`readlink /proc/$pid/ns/net | sed -e 's/.*\[\(.*\)\]/\1/'`
+    pid=$(__runc state test_busybox | jq '.pid')
+    ns_inode_new=$(readlink /proc/"$pid"/ns/net | sed -e 's/.*\[\(.*\)\]/\1/')
     echo "old network namespace inode $ns_inode"
     echo "new network namespace inode $ns_inode_new"
     [ "$ns_inode" -eq "$ns_inode_new" ]
   done
-  ip netns del $ns_name
+  ip netns del "$ns_name"
 }
 
 @test "checkpoint and restore with container specific CRIU config" {
-  tmp=`mktemp /tmp/runc-criu-XXXXXX.conf`
+  tmp=$(mktemp /tmp/runc-criu-XXXXXX.conf)
   # This is the file we write to /etc/criu/default.conf
-  tmplog1=`mktemp /tmp/runc-criu-log-XXXXXX.log`
-  unlink $tmplog1
-  tmplog1=`basename $tmplog1`
+  tmplog1=$(mktemp /tmp/runc-criu-log-XXXXXX.log)
+  unlink "$tmplog1"
+  tmplog1=$(basename "$tmplog1")
   # That is the actual configuration file to be used
-  tmplog2=`mktemp /tmp/runc-criu-log-XXXXXX.log`
-  unlink $tmplog2
-  tmplog2=`basename $tmplog2`
+  tmplog2=$(mktemp /tmp/runc-criu-log-XXXXXX.log)
+  unlink "$tmplog2"
+  tmplog2=$(basename "$tmplog2")
   # This adds the annotation 'org.criu.config' to set a container
   # specific CRIU config file.
   update_config '.annotations += {"org.criu.config": "'"$tmp"'"}'
@@ -283,34 +290,34 @@ function simple_cr() {
   mkdir -p /etc/criu
   echo "log-file=$tmplog1" > /etc/criu/default.conf
   # Make sure the RPC defined configuration file overwrites the previous
-  echo "log-file=$tmplog2" > $tmp
+  echo "log-file=$tmplog2" > "$tmp"
 
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   testcontainer test_busybox running
 
   # checkpoint the running container
   runc --criu "$CRIU" checkpoint --work-path ./work-dir test_busybox
-  cat ./work-dir/dump.log | grep -B 5 Error || true
+  grep -B 5 Error ./work-dir/dump.log || true
   [ "$status" -eq 0 ]
-  ! test -f ./work-dir/$tmplog1
-  test -f ./work-dir/$tmplog2
+  ! test -f ./work-dir/"$tmplog1"
+  test -f ./work-dir/"$tmplog2"
 
   # after checkpoint busybox is no longer running
   testcontainer test_busybox checkpointed
 
-  test -f ./work-dir/$tmplog2 && unlink ./work-dir/$tmplog2
+  test -f ./work-dir/"$tmplog2" && unlink ./work-dir/"$tmplog2"
   # restore from checkpoint
-  runc --criu "$CRIU" restore -d --work-path ./work-dir --console-socket $CONSOLE_SOCKET test_busybox
-  cat ./work-dir/restore.log | grep -B 5 Error || true
+  runc --criu "$CRIU" restore -d --work-path ./work-dir --console-socket "$CONSOLE_SOCKET" test_busybox
+  grep -B 5 Error ./work-dir/restore.log || true
   [ "$status" -eq 0 ]
-  ! test -f ./work-dir/$tmplog1
-  test -f ./work-dir/$tmplog2
+  ! test -f ./work-dir/"$tmplog1"
+  test -f ./work-dir/"$tmplog2"
 
   # busybox should be back up and running
   testcontainer test_busybox running
-  unlink $tmp
-  test -f ./work-dir/$tmplog2 && unlink ./work-dir/$tmplog2
+  unlink "$tmp"
+  test -f ./work-dir/"$tmplog2" && unlink ./work-dir/"$tmplog2"
 }
 
diff --git a/tests/integration/create.bats b/tests/integration/create.bats
index abd4da24dbc..99b001b0f71 100644
--- a/tests/integration/create.bats
+++ b/tests/integration/create.bats
@@ -12,7 +12,7 @@ function teardown() {
 }
 
 @test "runc create" {
-  runc create --console-socket $CONSOLE_SOCKET test_busybox
+  runc create --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   testcontainer test_busybox created
@@ -25,7 +25,7 @@ function teardown() {
 }
 
 @test "runc create exec" {
-  runc create --console-socket $CONSOLE_SOCKET test_busybox
+  runc create --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   testcontainer test_busybox created
@@ -43,7 +43,7 @@ function teardown() {
 }
 
 @test "runc create --pid-file" {
-  runc create --pid-file pid.txt --console-socket $CONSOLE_SOCKET test_busybox
+  runc create --pid-file pid.txt --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   testcontainer test_busybox created
@@ -69,7 +69,7 @@ function teardown() {
   run cd pid_file
   [ "$status" -eq 0 ]
 
-  runc create --pid-file pid.txt -b $BUSYBOX_BUNDLE --console-socket $CONSOLE_SOCKET  test_busybox
+  runc create --pid-file pid.txt -b "$BUSYBOX_BUNDLE" --console-socket "$CONSOLE_SOCKET"  test_busybox
   [ "$status" -eq 0 ]
 
   testcontainer test_busybox created
diff --git a/tests/integration/delete.bats b/tests/integration/delete.bats
index b356e764758..43f6b9de861 100644
--- a/tests/integration/delete.bats
+++ b/tests/integration/delete.bats
@@ -12,7 +12,7 @@ function teardown() {
 }
 
 @test "runc delete" {
-  runc run -d --console-socket $CONSOLE_SOCKET testbusyboxdelete
+  runc run -d --console-socket "$CONSOLE_SOCKET" testbusyboxdelete
   [ "$status" -eq 0 ]
 
   testcontainer testbusyboxdelete running
@@ -34,7 +34,7 @@ function teardown() {
 
 @test "runc delete --force" {
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # check state
@@ -58,7 +58,7 @@ function teardown() {
   set_cgroup_mount_writable "$BUSYBOX_BUNDLE"
 
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # check state
@@ -82,12 +82,12 @@ function teardown() {
   echo ${pid} > cgroup.threads
   cat cgroup.threads
 EOF
-  cat nest.sh | runc exec test_busybox sh
+  runc exec test_busybox sh < nest.sh
   [ "$status" -eq 0 ]
   [[ "$output" =~ [0-9]+ ]]
 
   # check create subcgroups success
-  [ -d $CGROUP_PATH/foo ]
+  [ -d "$CGROUP_PATH"/foo ]
 
   # force delete test_busybox
   runc delete --force test_busybox
@@ -96,5 +96,5 @@ EOF
   [ "$status" -ne 0 ]
 
   # check delete subcgroups success
-  [ ! -d $CGROUP_PATH/foo ]
+  [ ! -d "$CGROUP_PATH"/foo ]
 }
diff --git a/tests/integration/events.bats b/tests/integration/events.bats
index a69ef9bbeb5..d4aa803e3e0 100644
--- a/tests/integration/events.bats
+++ b/tests/integration/events.bats
@@ -17,7 +17,7 @@ function teardown() {
   init_cgroup_paths
 
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # generate stats
@@ -33,7 +33,7 @@ function teardown() {
   init_cgroup_paths
 
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # spawn two sub processes (shells)
@@ -61,7 +61,7 @@ function teardown() {
   init_cgroup_paths
 
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # spawn two sub processes (shells)
@@ -88,7 +88,7 @@ function teardown() {
   init_cgroup_paths
 
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   #prove there is no carry over of events.log from a prior test
@@ -118,10 +118,10 @@ function teardown() {
   init_cgroup_paths
 
   # we need the container to hit OOM, so disable swap
-  update_config '(.. | select(.resources? != null)) .resources.memory |= {"limit": 33554432, "swap": 33554432}' ${BUSYBOX_BUNDLE}
+  update_config '(.. | select(.resources? != null)) .resources.memory |= {"limit": 33554432, "swap": 33554432}' "${BUSYBOX_BUNDLE}"
 
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # spawn two sub processes (shells)
@@ -131,6 +131,7 @@ function teardown() {
   (__runc events test_busybox > events.log) &
   (
     retry 10 1 eval "grep -q 'test_busybox' events.log"
+    # shellcheck disable=SC2016
     __runc exec -d test_busybox sh -c 'test=$(dd if=/dev/urandom ibs=5120k)'
     retry 10 1 eval "grep -q 'oom' events.log"
     __runc delete -f test_busybox
diff --git a/tests/integration/exec.bats b/tests/integration/exec.bats
index 19647c155c1..e97f8d8a706 100644
--- a/tests/integration/exec.bats
+++ b/tests/integration/exec.bats
@@ -13,7 +13,7 @@ function teardown() {
 
 @test "runc exec" {
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   runc exec test_busybox echo Hello from exec
@@ -24,7 +24,7 @@ function teardown() {
 
 @test "runc exec --pid-file" {
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   runc exec --pid-file pid.txt test_busybox echo Hello from exec
@@ -49,7 +49,7 @@ function teardown() {
   [ "$status" -eq 0 ]
 
   # run busybox detached
-  runc run -d -b $BUSYBOX_BUNDLE --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d -b "$BUSYBOX_BUNDLE" --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   runc exec --pid-file pid.txt test_busybox echo Hello from exec
@@ -68,7 +68,7 @@ function teardown() {
 
 @test "runc exec ls -la" {
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   runc exec test_busybox ls -la
@@ -80,7 +80,7 @@ function teardown() {
 
 @test "runc exec ls -la with --cwd" {
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   runc exec --cwd /bin test_busybox pwd
@@ -90,7 +90,7 @@ function teardown() {
 
 @test "runc exec --env" {
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   runc exec --env RUNC_EXEC_TEST=true test_busybox env
@@ -104,7 +104,7 @@ function teardown() {
   [[ "$ROOTLESS" -ne 0 ]] && requires rootless_idmap
 
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   runc exec --user 1000:1000 test_busybox id
@@ -117,7 +117,7 @@ function teardown() {
   requires root
 
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   wait_for_container 15 1 test_busybox
@@ -130,7 +130,7 @@ function teardown() {
 
 @test "runc exec --preserve-fds" {
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   run bash -c "cat hello > preserve-fds.test; exec 3<preserve-fds.test; $RUNC ${RUNC_USE_SYSTEMD:+--systemd-cgroup} --log /proc/self/fd/2 --root $ROOT exec --preserve-fds=1 test_busybox cat /proc/self/fd/3"
diff --git a/tests/integration/hooks.bats b/tests/integration/hooks.bats
index d64441f2515..db0a33c5b22 100644
--- a/tests/integration/hooks.bats
+++ b/tests/integration/hooks.bats
@@ -9,16 +9,16 @@ HOOKLIBCC=librunc-hooks-create-container.so
 LIBPATH="$DEBIAN_BUNDLE/rootfs/lib/"
 
 function setup() {
-	umount $LIBPATH/$HOOKLIBCR.1.0.0 &> /dev/null || true
-	umount $LIBPATH/$HOOKLIBCC.1.0.0 &> /dev/null || true
+	umount "$LIBPATH"/$HOOKLIBCR.1.0.0 &> /dev/null || true
+	umount "$LIBPATH"/$HOOKLIBCC.1.0.0 &> /dev/null || true
 
 	teardown_debian
 	setup_debian
 }
 
 function teardown() {
-	umount $LIBPATH/$HOOKLIBCR.1.0.0 &> /dev/null || true
-	umount $LIBPATH/$HOOKLIBCC.1.0.0 &> /dev/null || true
+	umount "$LIBPATH"/$HOOKLIBCR.1.0.0 &> /dev/null || true
+	umount "$LIBPATH"/$HOOKLIBCC.1.0.0 &> /dev/null || true
 
 	rm -f $HOOKLIBCR.1.0.0 $HOOKLIBCC.1.0.0
 	teardown_debian
@@ -39,7 +39,8 @@ function teardown() {
 		pid=\$(cat - | jq -r '.pid')
 		touch "$LIBPATH/$HOOKLIBCR.1.0.0"
 		nsenter -m \$ns -t \$pid mount --bind "$current_pwd/$HOOKLIBCR.1.0.0" "$LIBPATH/$HOOKLIBCR.1.0.0"
-	EOF)
+EOF
+)
 
 	create_container_hook="touch ./lib/$HOOKLIBCC.1.0.0 && mount --bind $current_pwd/$HOOKLIBCC.1.0.0 ./lib/$HOOKLIBCC.1.0.0"
 
@@ -47,15 +48,15 @@ function teardown() {
 		.hooks |= . + {"createRuntime": [{"path": "/bin/sh", "args": ["/bin/sh", "-c", $create_runtime_hook]}]} |
 		.hooks |= . + {"createContainer": [{"path": "/bin/sh", "args": ["/bin/sh", "-c", $create_container_hook]}]} |
 		.hooks |= . + {"startContainer": [{"path": "/bin/sh", "args": ["/bin/sh", "-c", "ldconfig"]}]} |
-		.process.args = ["/bin/sh", "-c", "ldconfig -p | grep librunc"]' $DEBIAN_BUNDLE/config.json)
+		.process.args = ["/bin/sh", "-c", "ldconfig -p | grep librunc"]' "$DEBIAN_BUNDLE"/config.json)
 	echo "${CONFIG}" > config.json
 
 	runc run test_debian
 	[ "$status" -eq 0 ]
 
 	echo "Checking create-runtime library"
-	echo $output | grep $HOOKLIBCR
+	echo "$output" | grep $HOOKLIBCR
 
 	echo "Checking create-container library"
-	echo $output | grep $HOOKLIBCC
+	echo "$output" | grep $HOOKLIBCC
 }
diff --git a/tests/integration/kill.bats b/tests/integration/kill.bats
index ef8de3b2805..f08b1e10bba 100644
--- a/tests/integration/kill.bats
+++ b/tests/integration/kill.bats
@@ -14,7 +14,7 @@ function teardown() {
 
 @test "kill detached busybox" {
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # check state
diff --git a/tests/integration/list.bats b/tests/integration/list.bats
index 0a938c0a0c6..084f3f030d9 100644
--- a/tests/integration/list.bats
+++ b/tests/integration/list.bats
@@ -3,29 +3,29 @@
 load helpers
 
 function setup() {
-  teardown_running_container_inroot test_box1 $HELLO_BUNDLE
-  teardown_running_container_inroot test_box2 $HELLO_BUNDLE
-  teardown_running_container_inroot test_box3 $HELLO_BUNDLE
+  teardown_running_container_inroot test_box1 "$HELLO_BUNDLE"
+  teardown_running_container_inroot test_box2 "$HELLO_BUNDLE"
+  teardown_running_container_inroot test_box3 "$HELLO_BUNDLE"
   teardown_busybox
   setup_busybox
 }
 
 function teardown() {
-  teardown_running_container_inroot test_box1 $HELLO_BUNDLE
-  teardown_running_container_inroot test_box2 $HELLO_BUNDLE
-  teardown_running_container_inroot test_box3 $HELLO_BUNDLE
+  teardown_running_container_inroot test_box1 "$HELLO_BUNDLE"
+  teardown_running_container_inroot test_box2 "$HELLO_BUNDLE"
+  teardown_running_container_inroot test_box3 "$HELLO_BUNDLE"
   teardown_busybox
 }
 
 @test "list" {
   # run a few busyboxes detached
-  ROOT=$HELLO_BUNDLE runc run -d --console-socket $CONSOLE_SOCKET test_box1
+  ROOT=$HELLO_BUNDLE runc run -d --console-socket "$CONSOLE_SOCKET" test_box1
   [ "$status" -eq 0 ]
 
-  ROOT=$HELLO_BUNDLE runc run -d --console-socket $CONSOLE_SOCKET test_box2
+  ROOT=$HELLO_BUNDLE runc run -d --console-socket "$CONSOLE_SOCKET" test_box2
   [ "$status" -eq 0 ]
 
-  ROOT=$HELLO_BUNDLE runc run -d --console-socket $CONSOLE_SOCKET test_box3
+  ROOT=$HELLO_BUNDLE runc run -d --console-socket "$CONSOLE_SOCKET" test_box3
   [ "$status" -eq 0 ]
 
   ROOT=$HELLO_BUNDLE runc list
diff --git a/tests/integration/mask.bats b/tests/integration/mask.bats
index 79c08153eea..827d17b324b 100644
--- a/tests/integration/mask.bats
+++ b/tests/integration/mask.bats
@@ -20,7 +20,7 @@ function teardown() {
 
 @test "mask paths [file]" {
 	# run busybox detached
-	runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+	runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
 	[ "$status" -eq 0 ]
 
 	runc exec test_busybox cat /testfile
@@ -38,7 +38,7 @@ function teardown() {
 
 @test "mask paths [directory]" {
 	# run busybox detached
-	runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+	runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
 	[ "$status" -eq 0 ]
 
 	runc exec test_busybox ls /testdir
diff --git a/tests/integration/mounts.bats b/tests/integration/mounts.bats
index bf2afa3d565..bd41dc6ea77 100644
--- a/tests/integration/mounts.bats
+++ b/tests/integration/mounts.bats
@@ -17,5 +17,5 @@ function teardown() {
 
 	runc run test_bind_mount
 	[ "$status" -eq 0 ]
-	[[ "${lines[0]}" =~ '/tmp/bind/config.json' ]]
+	[[ "${lines[0]}" == *'/tmp/bind/config.json'* ]]
 }
diff --git a/tests/integration/pause.bats b/tests/integration/pause.bats
index f2576f34a6c..7fd7d00e09b 100644
--- a/tests/integration/pause.bats
+++ b/tests/integration/pause.bats
@@ -20,7 +20,7 @@ function teardown() {
   requires cgroups_freezer
 
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   testcontainer test_busybox running
@@ -49,7 +49,7 @@ function teardown() {
   requires cgroups_freezer
 
   # run test_busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   testcontainer test_busybox running
diff --git a/tests/integration/ps.bats b/tests/integration/ps.bats
index e8ea5532e21..e25de88453b 100644
--- a/tests/integration/ps.bats
+++ b/tests/integration/ps.bats
@@ -16,7 +16,7 @@ function teardown() {
   requires root
 
   # start busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # check state
@@ -33,7 +33,7 @@ function teardown() {
   requires root
 
   # start busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # check state
@@ -49,7 +49,7 @@ function teardown() {
   requires root
 
   # start busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # check state
@@ -67,7 +67,7 @@ function teardown() {
   set_cgroups_path "$BUSYBOX_BUNDLE"
 
   # start busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # check state
diff --git a/tests/integration/root.bats b/tests/integration/root.bats
index 90b53b4b476..346dbeb0c2b 100644
--- a/tests/integration/root.bats
+++ b/tests/integration/root.bats
@@ -3,23 +3,23 @@
 load helpers
 
 function setup() {
-  teardown_running_container_inroot test_dotbox $HELLO_BUNDLE
+  teardown_running_container_inroot test_dotbox "$HELLO_BUNDLE"
   teardown_busybox
   setup_busybox
 }
 
 function teardown() {
-  teardown_running_container_inroot test_dotbox $HELLO_BUNDLE
+  teardown_running_container_inroot test_dotbox "$HELLO_BUNDLE"
   teardown_busybox
 }
 
 @test "global --root" {
   # run busybox detached using $HELLO_BUNDLE for state
-  ROOT=$HELLO_BUNDLE runc run -d --console-socket $CONSOLE_SOCKET test_dotbox
+  ROOT=$HELLO_BUNDLE runc run -d --console-socket "$CONSOLE_SOCKET" test_dotbox
   [ "$status" -eq 0 ]
 
   # run busybox detached in default root
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   runc state test_busybox
diff --git a/tests/integration/spec.bats b/tests/integration/spec.bats
index 1aa3881587f..b6d11835d82 100644
--- a/tests/integration/spec.bats
+++ b/tests/integration/spec.bats
@@ -4,18 +4,15 @@ load helpers
 
 function setup() {
   # initial cleanup in case a prior test exited and did not cleanup
-  cd "$INTEGRATION_ROOT"
-  run rm -f -r "$HELLO_BUNDLE"
+  rm -rf "$HELLO_BUNDLE"
 
   # setup hello-world for spec generation testing
-  run mkdir "$HELLO_BUNDLE"
-  run mkdir "$HELLO_BUNDLE"/rootfs
-  run tar -C "$HELLO_BUNDLE"/rootfs -xf "$HELLO_IMAGE"
+  mkdir -p "$HELLO_BUNDLE"/rootfs
+  tar -C "$HELLO_BUNDLE"/rootfs -xf "$HELLO_IMAGE"
 }
 
 function teardown() {
-  cd "$INTEGRATION_ROOT"
-  run rm -f -r "$HELLO_BUNDLE"
+  rm -rf "$HELLO_BUNDLE"
 }
 
 @test "spec generation cwd" {
@@ -58,7 +55,7 @@ function teardown() {
   [ -e "$HELLO_BUNDLE"/config.json ]
 
   # change the default args parameter from sh to hello
-  update_config '(.. | select(.? == "sh")) |= "/hello"' $HELLO_BUNDLE
+  update_config '(.. | select(.? == "sh")) |= "/hello"' "$HELLO_BUNDLE"
 
   # ensure the generated spec works by running hello-world
   runc run --bundle "$HELLO_BUNDLE" test_hello
@@ -72,12 +69,12 @@ function teardown() {
   run git clone https://github.com/opencontainers/runtime-spec.git src/runtime-spec
   [ "$status" -eq 0 ]
 
-  SPEC_VERSION=$(grep 'github.com/opencontainers/runtime-spec' ${TESTDIR}/../../go.mod | cut -d ' ' -f 2)
+  SPEC_VERSION=$(grep 'github.com/opencontainers/runtime-spec' "${TESTDIR}"/../../go.mod | cut -d ' ' -f 2)
 
   # Will look like this when not pinned to spesific tag: "v0.0.0-20190207185410-29686dbc5559", otherwise "v1.0.0"
-  SPEC_COMMIT=$(cut -d "-" -f 3 <<< $SPEC_VERSION)
+  SPEC_COMMIT=$(cut -d "-" -f 3 <<< "$SPEC_VERSION")
 
-  SPEC_REF=$([[ -z "$SPEC_COMMIT" ]] && echo $SPEC_VERSION || echo $SPEC_COMMIT)
+  SPEC_REF=$([[ -z "$SPEC_COMMIT" ]] && echo "$SPEC_VERSION" || echo "$SPEC_COMMIT")
 
   run bash -c "cd src/runtime-spec && git reset --hard ${SPEC_REF}"
 
diff --git a/tests/integration/start.bats b/tests/integration/start.bats
index 1f0ea8e1c3b..a6ea4ce928c 100644
--- a/tests/integration/start.bats
+++ b/tests/integration/start.bats
@@ -12,7 +12,7 @@ function teardown() {
 }
 
 @test "runc start" {
-  runc create --console-socket $CONSOLE_SOCKET test_busybox
+  runc create --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   testcontainer test_busybox created
diff --git a/tests/integration/start_detached.bats b/tests/integration/start_detached.bats
index 80672e47d77..b55239b2f74 100644
--- a/tests/integration/start_detached.bats
+++ b/tests/integration/start_detached.bats
@@ -13,7 +13,7 @@ function teardown() {
 
 @test "runc run detached" {
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # check state
@@ -30,7 +30,7 @@ function teardown() {
 		| (.. | select(.gid? == 0)) .gid |= 100' 
 
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # check state
@@ -39,7 +39,7 @@ function teardown() {
 
 @test "runc run detached --pid-file" {
   # run busybox detached
-  runc run --pid-file pid.txt -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run --pid-file pid.txt -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # check state
@@ -61,7 +61,7 @@ function teardown() {
   [ "$status" -eq 0 ]
 
   # run busybox detached
-  runc run --pid-file pid.txt -d  -b $BUSYBOX_BUNDLE --console-socket $CONSOLE_SOCKET test_busybox
+  runc run --pid-file pid.txt -d  -b "$BUSYBOX_BUNDLE" --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # check state
diff --git a/tests/integration/state.bats b/tests/integration/state.bats
index 68dae38b593..94e4dca5a19 100644
--- a/tests/integration/state.bats
+++ b/tests/integration/state.bats
@@ -16,7 +16,7 @@ function teardown() {
   [ "$status" -ne 0 ]
 
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # check state
@@ -44,7 +44,7 @@ function teardown() {
   [ "$status" -ne 0 ]
 
   # run busybox detached
-  runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+  runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
   [ "$status" -eq 0 ]
 
   # check state
diff --git a/tests/integration/tty.bats b/tests/integration/tty.bats
index e18857fc7dd..7193f327c28 100644
--- a/tests/integration/tty.bats
+++ b/tests/integration/tty.bats
@@ -13,7 +13,8 @@ function teardown() {
 
 @test "runc run [tty ptsname]" {
 	# Replace sh script with readlink.
-	update_config '(.. | select(.[]? == "sh")) += ["-c", "for file in /proc/self/fd/[012]; do readlink $file; done"]' 
+	# shellcheck disable=SC2016
+	update_config '(.. | select(.[]? == "sh")) += ["-c", "for file in /proc/self/fd/[012]; do readlink $file; done"]'
 
 	# run busybox
 	runc run test_busybox
@@ -29,7 +30,8 @@ function teardown() {
 	[[ "$ROOTLESS" -ne 0 ]] && requires rootless_idmap
 
 	# Replace sh script with stat.
-	update_config '(.. | select(.[]? == "sh")) += ["-c", "stat -c %u:%g $(tty) | tr : \\\\n"]' 
+	# shellcheck disable=SC2016
+	update_config '(.. | select(.[]? == "sh")) += ["-c", "stat -c %u:%g $(tty) | tr : \\\\n"]'
 
 	# run busybox
 	runc run test_busybox
@@ -46,7 +48,8 @@ function teardown() {
 	# replace "uid": 0 with "uid": 1000
 	# and do a similar thing for gid.
 	# Replace sh script with stat.
-	update_config 	' (.. | select(.uid? == 0)) .uid |= 1000 
+	# shellcheck disable=SC2016
+	update_config 	' (.. | select(.uid? == 0)) .uid |= 1000
 			| (.. | select(.gid? == 0)) .gid |= 100
 			| (.. | select(.[]? == "sh")) += ["-c", "stat -c %u:%g $(tty) | tr : \\\\n"]'
 
@@ -60,14 +63,15 @@ function teardown() {
 
 @test "runc exec [tty ptsname]" {
 	# run busybox detached
-	runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+	runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
 	[ "$status" -eq 0 ]
 
 	# make sure we're running
 	testcontainer test_busybox running
 
 	# run the exec
-    runc exec -t test_busybox sh -c 'for file in /proc/self/fd/[012]; do readlink $file; done'
+	# shellcheck disable=SC2016
+	runc exec -t test_busybox sh -c 'for file in /proc/self/fd/[012]; do readlink $file; done'
 	[ "$status" -eq 0 ]
 	[[ ${lines[0]} =~ /dev/pts/+ ]]
 	[[ ${lines[1]} =~ /dev/pts/+ ]]
@@ -80,14 +84,15 @@ function teardown() {
 	[[ "$ROOTLESS" -ne 0 ]] && requires rootless_idmap
 
 	# run busybox detached
-	runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+	runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
 	[ "$status" -eq 0 ]
 
 	# make sure we're running
 	testcontainer test_busybox running
 
 	# run the exec
-    runc exec -t test_busybox sh -c 'stat -c %u:%g $(tty) | tr : \\n'
+	# shellcheck disable=SC2016
+	runc exec -t test_busybox sh -c 'stat -c %u:%g $(tty) | tr : \\n'
 	[ "$status" -eq 0 ]
 	[[ ${lines[0]} =~ 0 ]]
 	[[ ${lines[1]} =~ 5 ]]
@@ -99,17 +104,19 @@ function teardown() {
 
 	# replace "uid": 0 with "uid": 1000
 	# and do a similar thing for gid.
+	# shellcheck disable=SC2016
 	update_config 	' (.. | select(.uid? == 0)) .uid |= 1000
-  			| (.. | select(.gid? == 0)) .gid |= 100' 
+			| (.. | select(.gid? == 0)) .gid |= 100'
 
 	# run busybox detached
-	runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+	runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
 	[ "$status" -eq 0 ]
 
 	# make sure we're running
 	testcontainer test_busybox running
 
 	# run the exec
+	# shellcheck disable=SC2016
 	runc exec -t test_busybox sh -c 'stat -c %u:%g $(tty) | tr : \\n'
 	[ "$status" -eq 0 ]
 	[[ ${lines[0]} =~ 1000 ]]
@@ -121,7 +128,7 @@ function teardown() {
 	update_config '(.. | select(.readonly? != null)) .readonly |= false'
 
 	# run busybox detached
-	runc run -d --console-socket $CONSOLE_SOCKET test_busybox
+	runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
 	[ "$status" -eq 0 ]
 
 	# make sure we're running
@@ -145,14 +152,14 @@ EOF
 	)
 
 	# run the exec
-	runc exec -t --pid-file pid.txt -d --console-socket $CONSOLE_SOCKET -p <( echo $tty_info_with_consize_size ) test_busybox
+	runc exec -t --pid-file pid.txt -d --console-socket "$CONSOLE_SOCKET" -p <( echo "$tty_info_with_consize_size" ) test_busybox
 	[ "$status" -eq 0 ]
 
 	# check the pid was generated
 	[ -e pid.txt ]
 
 	#wait user process to finish
-	timeout 1 tail --pid=$(head -n 1 pid.txt) -f /dev/null
+	timeout 1 tail --pid="$(head -n 1 pid.txt)" -f /dev/null
 
 	tty_info=$( cat <<EOF
 {
@@ -166,7 +173,7 @@ EOF
 	)
 
 	# run the exec
-	runc exec -t -p <( echo $tty_info ) test_busybox
+	runc exec -t -p <( echo "$tty_info" ) test_busybox
 	[ "$status" -eq 0 ]
 
 	# test tty width and height against original process.json
@@ -197,7 +204,7 @@ EOF
 @test "runc run [terminal=false]" {
 	# Disable terminal creation.
 	# Replace sh script with sleep.
-	
+
 	update_config   ' (.. | select(.terminal? != null)) .terminal |= false
 			| (.. | select(.[]? == "sh")) += ["sleep", "1000s"]
 			| del(.. | select(.? == "sh"))'
@@ -219,7 +226,7 @@ EOF
 	# Disable terminal creation.
 	# Replace sh script with sleep.
 	update_config 	' (.. | select(.terminal? != null)) .terminal |= false
-			| (.. | select(.[]? == "sh")) += ["sleep", "1000s"] 
+			| (.. | select(.[]? == "sh")) += ["sleep", "1000s"]
 			| del(.. | select(.? == "sh"))'
 
 	# Make sure that the handling of detached IO is done properly. See #1354.
diff --git a/tests/integration/update.bats b/tests/integration/update.bats
index 87eb479fb09..8b08f80aca6 100644
--- a/tests/integration/update.bats
+++ b/tests/integration/update.bats
@@ -3,7 +3,7 @@
 load helpers
 
 function teardown() {
-    rm -f $BATS_TMPDIR/runc-cgroups-integration-test.json
+    rm -f "$BATS_TMPDIR"/runc-cgroups-integration-test.json
     teardown_running_container test_update
     teardown_running_container test_update_rt
     teardown_busybox
@@ -18,7 +18,7 @@ function setup() {
     # Set some initial known values
     update_config 	' .linux.resources.memory |= {"limit": 33554432, "reservation": 25165824}
 			| .linux.resources.cpu |= {"shares": 100, "quota": 500000, "period": 1000000, "cpus": "0"}
-			| .linux.resources.pids |= {"limit": 20}' ${BUSYBOX_BUNDLE}
+			| .linux.resources.pids |= {"limit": 20}' "${BUSYBOX_BUNDLE}"
 }
 
 # Tests whatever limits are (more or less) common between cgroup
@@ -29,7 +29,7 @@ function setup() {
         file="/sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.controllers"
         # NOTE: delegation of cpuset requires systemd >= 244 (Fedora >= 32, Ubuntu >= 20.04).
         for f in memory pids cpuset; do
-            if grep -qwv $f $file; then
+            if grep -qwv $f "$file"; then
                 skip "$f is not enabled in $file"
             fi
         done
@@ -37,7 +37,7 @@ function setup() {
     init_cgroup_paths
 
     # run a few busyboxes detached
-    runc run -d --console-socket $CONSOLE_SOCKET test_update
+    runc run -d --console-socket "$CONSOLE_SOCKET" test_update
     [ "$status" -eq 0 ]
 
     # Set a few variables to make the code below work for both v1 and v2
@@ -68,7 +68,7 @@ function setup() {
     esac
     SD_UNLIMITED="infinity"
     SD_VERSION=$(systemctl --version | awk '{print $2; exit}')
-    if [ $SD_VERSION -lt 227 ]; then
+    if [ "$SD_VERSION" -lt 227 ]; then
         SD_UNLIMITED="18446744073709551615"
     fi
 
@@ -89,7 +89,7 @@ function setup() {
 
     # update cpuset if supported (i.e. we're running on a multicore cpu)
     cpu_count=$(grep -c '^processor' /proc/cpuinfo)
-    if [ $cpu_count -gt 1 ]; then
+    if [ "$cpu_count" -gt 1 ]; then
         runc update test_update --cpuset-cpus "1"
         [ "$status" -eq 0 ]
         check_cgroup_value "cpuset.cpus" 1
@@ -208,7 +208,7 @@ EOF
     check_systemd_value "TasksMax" 10
 
     # reset to initial test value via json file
-    cat << EOF > $BATS_TMPDIR/runc-cgroups-integration-test.json
+    cat << EOF > "$BATS_TMPDIR"/runc-cgroups-integration-test.json
 {
   "memory": {
     "limit": 33554432,
@@ -226,7 +226,7 @@ EOF
 }
 EOF
 
-    runc update  -r $BATS_TMPDIR/runc-cgroups-integration-test.json test_update
+    runc update  -r "$BATS_TMPDIR"/runc-cgroups-integration-test.json test_update
     [ "$status" -eq 0 ]
     check_cgroup_value "cpuset.cpus" 0
 
@@ -252,10 +252,10 @@ function check_cpu_quota() {
         check_cgroup_value "cpu.max" "$quota $period"
     else
         check_cgroup_value "cpu.cfs_quota_us" $quota
-        check_cgroup_value "cpu.cfs_period_us" $period
+        check_cgroup_value "cpu.cfs_period_us" "$period"
     fi
     # systemd values are the same for v1 and v2
-    check_systemd_value "CPUQuotaPerSecUSec" $sd_quota
+    check_systemd_value "CPUQuotaPerSecUSec" "$sd_quota"
 
     # CPUQuotaPeriodUSec requires systemd >= v242
     [ "$(systemd_version)" -lt 242 ] && return
@@ -276,8 +276,8 @@ function check_cpu_shares() {
         check_cgroup_value "cpu.weight" $weight
         check_systemd_value "CPUWeight" $weight
     else
-        check_cgroup_value "cpu.shares" $shares
-        check_systemd_value "CPUShares" $shares
+        check_cgroup_value "cpu.shares" "$shares"
+        check_systemd_value "CPUShares" "$shares"
     fi
 }
 
@@ -285,7 +285,7 @@ function check_cpu_shares() {
     [[ "$ROOTLESS" -ne 0 ]] && requires rootless_cgroup
 
     # run a few busyboxes detached
-    runc run -d --console-socket $CONSOLE_SOCKET test_update
+    runc run -d --console-socket "$CONSOLE_SOCKET" test_update
     [ "$status" -eq 0 ]
 
     # check that initial values were properly set
@@ -338,7 +338,7 @@ EOF
     check_cpu_quota -1 100000 "infinity"
 
     # reset to initial test value via json file
-    cat << EOF > $BATS_TMPDIR/runc-cgroups-integration-test.json
+    cat << EOF > "$BATS_TMPDIR"/runc-cgroups-integration-test.json
 {
   "cpu": {
     "shares": 100,
@@ -348,7 +348,7 @@ EOF
 }
 EOF
 
-    runc update  -r $BATS_TMPDIR/runc-cgroups-integration-test.json test_update
+    runc update  -r "$BATS_TMPDIR"/runc-cgroups-integration-test.json test_update
     [ "$status" -eq 0 ]
     check_cpu_quota 500000 1000000 "500ms"
     check_cpu_shares 100
@@ -357,9 +357,9 @@ EOF
 @test "set cpu period with no quota" {
     [[ "$ROOTLESS" -ne 0 ]] && requires rootless_cgroup
 
-    update_config '.linux.resources.cpu |= { "period": 1000000 }' ${BUSYBOX_BUNDLE}
+    update_config '.linux.resources.cpu |= { "period": 1000000 }' "${BUSYBOX_BUNDLE}"
 
-    runc run -d --console-socket $CONSOLE_SOCKET test_update
+    runc run -d --console-socket "$CONSOLE_SOCKET" test_update
     [ "$status" -eq 0 ]
 
     check_cpu_quota -1 1000000 "infinity"
@@ -368,9 +368,9 @@ EOF
 @test "set cpu quota with no period" {
     [[ "$ROOTLESS" -ne 0 ]] && requires rootless_cgroup
 
-    update_config '.linux.resources.cpu |= { "quota": 5000 }' ${BUSYBOX_BUNDLE}
+    update_config '.linux.resources.cpu |= { "quota": 5000 }' "${BUSYBOX_BUNDLE}"
 
-    runc run -d --console-socket $CONSOLE_SOCKET test_update
+    runc run -d --console-socket "$CONSOLE_SOCKET" test_update
     [ "$status" -eq 0 ]
     check_cpu_quota 5000 100000 "50ms"
 }
@@ -378,9 +378,9 @@ EOF
 @test "update cpu period with no previous period/quota set" {
     [[ "$ROOTLESS" -ne 0 ]] && requires rootless_cgroup
 
-    update_config '.linux.resources.cpu |= {}' ${BUSYBOX_BUNDLE}
+    update_config '.linux.resources.cpu |= {}' "${BUSYBOX_BUNDLE}"
 
-    runc run -d --console-socket $CONSOLE_SOCKET test_update
+    runc run -d --console-socket "$CONSOLE_SOCKET" test_update
     [ "$status" -eq 0 ]
 
     # update the period alone, no old values were set
@@ -392,9 +392,9 @@ EOF
 @test "update cpu quota with no previous period/quota set" {
     [[ "$ROOTLESS" -ne 0 ]] && requires rootless_cgroup
 
-    update_config '.linux.resources.cpu |= {}' ${BUSYBOX_BUNDLE}
+    update_config '.linux.resources.cpu |= {}' "${BUSYBOX_BUNDLE}"
 
-    runc run -d --console-socket $CONSOLE_SOCKET test_update
+    runc run -d --console-socket "$CONSOLE_SOCKET" test_update
     [ "$status" -eq 0 ]
 
     # update the quota alone, no old values were set
@@ -419,10 +419,11 @@ EOF
     #
     # TODO: support systemd
     mkdir -p "$CGROUP_CPU"
-    local root_period=$(cat "${CGROUP_CPU_BASE_PATH}/cpu.rt_period_us")
-    local root_runtime=$(cat "${CGROUP_CPU_BASE_PATH}/cpu.rt_runtime_us")
+    local root_period root_runtime
+    root_period=$(cat "${CGROUP_CPU_BASE_PATH}/cpu.rt_period_us")
+    root_runtime=$(cat "${CGROUP_CPU_BASE_PATH}/cpu.rt_runtime_us")
     # the following IFS magic sets dirs=("runc-cgroups-integration-test" "test-cgroup")
-    IFS='/' read -r -a dirs <<< $(echo ${CGROUP_CPU} | sed -e s@^${CGROUP_CPU_BASE_PATH}/@@)
+    IFS='/' read -r -a dirs <<< "${CGROUP_CPU//${CGROUP_CPU_BASE_PATH}/}"
     for (( i = 0; i < ${#dirs[@]}; i++ )); do
         local target="$CGROUP_CPU_BASE_PATH"
         for (( j = 0; j <= i; j++ )); do
@@ -437,7 +438,7 @@ EOF
     done
 
     # run a detached busybox
-    runc run -d --console-socket $CONSOLE_SOCKET test_update_rt
+    runc run -d --console-socket "$CONSOLE_SOCKET" test_update_rt
     [ "$status" -eq 0 ]
 
     runc update  -r - test_update_rt <<EOF