diff --git a/build/common.sh b/build/common.sh
index b3b7748a6a..54538303e8 100755
--- a/build/common.sh
+++ b/build/common.sh
@@ -26,13 +26,13 @@ USER_ID=$(id -u)
 GROUP_ID=$(id -g)
 
 DOCKER_OPTS=${DOCKER_OPTS:-""}
-DOCKER=(docker ${DOCKER_OPTS})
+IFS=" " read -r -a DOCKER <<< "docker ${DOCKER_OPTS}"
 DOCKER_HOST=${DOCKER_HOST:-""}
 DOCKER_MACHINE_NAME=${DOCKER_MACHINE_NAME:-"kube-dev"}
 readonly DOCKER_MACHINE_DRIVER=${DOCKER_MACHINE_DRIVER:-"virtualbox --virtualbox-cpu-count -1"}
 
 # This will canonicalize the path
-KUBE_ROOT=$(cd "$(dirname "${BASH_SOURCE}")"/.. && pwd -P)
+KUBE_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")"/.. && pwd -P)
 
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
@@ -137,7 +137,7 @@ function kube::build::verify_prereqs() {
     fi
     kube::util::ensure_docker_daemon_connectivity || return 1
 
-    if (( ${KUBE_VERBOSE} > 6 )); then
+    if (( KUBE_VERBOSE > 6 )); then
       kube::log::status "Docker Version:"
       "${DOCKER[@]}" version | kube::log::info_from_stdin
     fi
@@ -185,7 +185,8 @@ function kube::build::docker_available_on_osx() {
 function kube::build::prepare_docker_machine() {
   kube::log::status "docker-machine was found."
 
-  local available_memory_bytes=$(sysctl -n hw.memsize 2>/dev/null)
+  local available_memory_bytes
+  available_memory_bytes=$(sysctl -n hw.memsize 2>/dev/null)
 
   local bytes_in_mb=1048576
 
@@ -193,7 +194,7 @@ function kube::build::prepare_docker_machine() {
   # of multiple by .5, because bash can only multiply by ints.
   local memory_divisor=2
 
-  local virtualbox_memory_mb=$(( ${available_memory_bytes} / (${bytes_in_mb} * ${memory_divisor}) ))
+  local virtualbox_memory_mb=$(( available_memory_bytes / (bytes_in_mb * memory_divisor) ))
 
   docker-machine inspect "${DOCKER_MACHINE_NAME}" &> /dev/null || {
     kube::log::status "Creating a machine to build Kubernetes"
@@ -215,7 +216,7 @@ function kube::build::prepare_docker_machine() {
   while ! docker_machine_out=$(docker-machine env "${DOCKER_MACHINE_NAME}" 2>&1); do
     if [[ ${docker_machine_out} =~ "Error checking TLS connection" ]]; then
       echo "${docker_machine_out}"
-      docker-machine regenerate-certs ${DOCKER_MACHINE_NAME}
+      docker-machine regenerate-certs "${DOCKER_MACHINE_NAME}"
     else
       sleep 1
     fi
@@ -368,7 +369,7 @@ function kube::build::short_hash() {
   else
     short_hash=$(echo -n "$1" | md5sum)
   fi
-  echo ${short_hash:0:10}
+  echo "${short_hash:0:10}"
 }
 
 # Pedantically kill, wait-on and remove a container. The -f -v options
@@ -412,7 +413,7 @@ function kube::build::clean() {
 function kube::build::build_image() {
   mkdir -p "${LOCAL_OUTPUT_BUILD_CONTEXT}"
   # Make sure the context directory owned by the right user for syncing sources to container.
-  chown -R ${USER_ID}:${GROUP_ID} "${LOCAL_OUTPUT_BUILD_CONTEXT}"
+  chown -R "${USER_ID}":"${GROUP_ID}" "${LOCAL_OUTPUT_BUILD_CONTEXT}"
 
   cp /etc/localtime "${LOCAL_OUTPUT_BUILD_CONTEXT}/"
 
@@ -503,7 +504,7 @@ function kube::build::ensure_data_container() {
       --name "${KUBE_DATA_CONTAINER_NAME}"
       --hostname "${HOSTNAME}"
       "${KUBE_BUILD_IMAGE}"
-      chown -R ${USER_ID}:${GROUP_ID}
+      chown -R "${USER_ID}":"${GROUP_ID}"
         "${REMOTE_ROOT}"
         /usr/local/go/pkg/
     )
@@ -582,7 +583,7 @@ function kube::build::run_build_command_ex() {
   if [[ -t 0 ]]; then
     docker_run_opts+=(--interactive --tty)
   elif [[ "${detach}" == false ]]; then
-    docker_run_opts+=(--attach=stdout --attach=stderr)
+    docker_run_opts+=("--attach=stdout" "--attach=stderr")
   fi
 
   local -ra docker_cmd=(
@@ -599,13 +600,13 @@ function kube::build::run_build_command_ex() {
 function kube::build::rsync_probe {
   # Wait unil rsync is up and running.
   local tries=20
-  while (( ${tries} > 0 )) ; do
+  while (( tries > 0 )) ; do
     if rsync "rsync://k8s@${1}:${2}/" \
          --password-file="${LOCAL_OUTPUT_BUILD_CONTEXT}/rsyncd.password" \
          &> /dev/null ; then
       return 0
     fi
-    tries=$(( ${tries} - 1))
+    tries=$(( tries - 1))
     sleep 0.1
   done
 
@@ -625,7 +626,7 @@ function kube::build::start_rsyncd_container() {
   kube::build::stop_rsyncd_container
   V=3 kube::log::status "Starting rsyncd container"
   kube::build::run_build_command_ex \
-    "${KUBE_RSYNC_CONTAINER_NAME}" -p 127.0.0.1:${KUBE_RSYNC_PORT}:${KUBE_CONTAINER_RSYNC_PORT} -d \
+    "${KUBE_RSYNC_CONTAINER_NAME}" -p 127.0.0.1:"${KUBE_RSYNC_PORT}":"${KUBE_CONTAINER_RSYNC_PORT}" -d \
     -e ALLOW_HOST="$(${IPTOOL} | grep -Eo 'inet (addr:)?([0-9]*\.){3}[0-9]*' | grep -Eo '([0-9]*\.){3}[0-9]*' | grep -v '127.0.0.1')" \
     -- /rsyncd.sh >/dev/null
 
@@ -643,7 +644,7 @@ function kube::build::start_rsyncd_container() {
   # machines) we have to talk directly to the container IP.  There is no one
   # strategy that works in all cases so we test to figure out which situation we
   # are in.
-  if kube::build::rsync_probe 127.0.0.1 ${mapped_port}; then
+  if kube::build::rsync_probe 127.0.0.1 "${mapped_port}"; then
     KUBE_RSYNC_ADDR="127.0.0.1:${mapped_port}"
     return 0
   elif kube::build::rsync_probe "${container_ip}" ${KUBE_CONTAINER_RSYNC_PORT}; then
@@ -664,12 +665,12 @@ function kube::build::stop_rsyncd_container() {
 function kube::build::rsync {
   local -a rsync_opts=(
     --archive
-    --password-file="${LOCAL_OUTPUT_BUILD_CONTEXT}/rsyncd.password"
+    "--password-file=${LOCAL_OUTPUT_BUILD_CONTEXT}/rsyncd.password"
   )
-  if (( ${KUBE_VERBOSE} >= 6 )); then
+  if (( KUBE_VERBOSE >= 6 )); then
     rsync_opts+=("-iv")
   fi
-  if (( ${KUBE_RSYNC_COMPRESS} > 0 )); then
+  if (( KUBE_RSYNC_COMPRESS > 0 )); then
      rsync_opts+=("--compress-level=${KUBE_RSYNC_COMPRESS}")
   fi
   V=3 kube::log::status "Running rsync"
@@ -712,11 +713,6 @@ function kube::build::copy_output() {
 
   kube::build::start_rsyncd_container
 
-  local rsync_extra=""
-  if (( ${KUBE_VERBOSE} >= 6 )); then
-    rsync_extra="-iv"
-  fi
-
   # The filter syntax for rsync is a little obscure. It filters on files and
   # directories.  If you don't go in to a directory you won't find any files
   # there.  Rules are evaluated in order.  The last two rules are a little
diff --git a/hack/.shellcheck_failures b/hack/.shellcheck_failures
index 89e2460b07..2ef9f636eb 100644
--- a/hack/.shellcheck_failures
+++ b/hack/.shellcheck_failures
@@ -1,4 +1,3 @@
-./build/common.sh
 ./build/lib/release.sh
 ./cluster/addons/addon-manager/kube-addons.sh
 ./cluster/addons/fluentd-elasticsearch/es-image/run.sh