diff --git a/hack/go-lint.sh b/hack/go-lint.sh
index f0b5f1fa9b7..972b8efdd6a 100755
--- a/hack/go-lint.sh
+++ b/hack/go-lint.sh
@@ -4,9 +4,11 @@
 if [ "$IS_CONTAINER" != "" ]; then
   golint -set_exit_status "${@}"
 else
-  docker run --rm --env IS_CONTAINER='TRUE' \
-    -v "$PWD":/go/src/github.com/openshift/installer \
-    -w /go/src/github.com/openshift/installer \
-    --entrypoint sh quay.io/coreos/golang-testing \
+  docker run --rm \
+    --env IS_CONTAINER=TRUE \
+    --volume "${PWD}:/go/src/github.com/openshift/installer:z" \
+    --workdir /go/src/github.com/openshift/installer \
+    --entrypoint sh \
+    quay.io/coreos/golang-testing \
     ./hack/go-lint.sh "${@}"
 fi
diff --git a/hack/go-vet.sh b/hack/go-vet.sh
index cc016fef0f7..4351e4ff9b0 100755
--- a/hack/go-vet.sh
+++ b/hack/go-vet.sh
@@ -2,5 +2,10 @@
 if [ "$IS_CONTAINER" != "" ]; then
   go vet "${@}"
 else
-  docker run --rm --env IS_CONTAINER='TRUE' -v "$PWD":/go/src/github.com/openshift/installer -w /go/src/github.com/openshift/installer quay.io/coreos/golang-testing ./hack/go-vet.sh "${@}"
+  docker run --rm \
+    --env IS_CONTAINER=TRUE \
+    --volume "${PWD}:/go/src/github.com/openshift/installer:z" \
+    --workdir /go/src/github.com/openshift/installer \
+    quay.io/coreos/golang-testing \
+    ./hack/go-vet.sh "${@}"
 fi;
diff --git a/hack/shellcheck.sh b/hack/shellcheck.sh
index 1b553ba7c79..33d35e53c47 100755
--- a/hack/shellcheck.sh
+++ b/hack/shellcheck.sh
@@ -6,5 +6,10 @@ if [ "$IS_CONTAINER" != "" ]; then
     -o -path "${TOP_DIR}/.build" -prune \
     -o -type f -name '*.sh' -exec shellcheck --format=gcc {} \+
 else
-  docker run -e IS_CONTAINER='TRUE' --rm -v "$(pwd)":/workdir:ro --entrypoint sh quay.io/coreos/shellcheck-alpine:v0.5.0 /workdir/hack/shellcheck.sh /workdir;
+  docker run --rm \
+    --env IS_CONTAINER=TRUE \
+    --volume "${PWD}:/workdir:ro,z" \
+    --entrypoint sh \
+    quay.io/coreos/shellcheck-alpine:v0.5.0 \
+    /workdir/hack/shellcheck.sh /workdir
 fi;
diff --git a/hack/test-bazel-build-tarball.sh b/hack/test-bazel-build-tarball.sh
index 625cbbbce4e..de84fca03cb 100755
--- a/hack/test-bazel-build-tarball.sh
+++ b/hack/test-bazel-build-tarball.sh
@@ -3,5 +3,10 @@ if [ "$IS_CONTAINER" != "" ]; then
   set -x
   bazel --output_base=/tmp build "$@" tarball
 else
-  docker run -e IS_CONTAINER='TRUE' --rm -v "$PWD":"$PWD" -v /tmp:/tmp:rw -w "$PWD" quay.io/coreos/tectonic-builder:bazel-v0.3 ./hack/test-bazel-build-tarball.sh
+  docker run --rm \
+    --env IS_CONTAINER=TRUE \
+    --volume "${PWD}:${PWD}:z" \
+    --workdir "${PWD}" \
+    quay.io/coreos/tectonic-builder:bazel-v0.3 \
+    ./hack/test-bazel-build-tarball.sh
 fi
diff --git a/hack/tf-fmt.sh b/hack/tf-fmt.sh
index 5cc9151f750..e9ab0659249 100755
--- a/hack/tf-fmt.sh
+++ b/hack/tf-fmt.sh
@@ -5,5 +5,10 @@ if [ "$IS_CONTAINER" != "" ]; then
   set -x
   /terraform fmt -list -check -write=false
 else
-  docker run -e IS_CONTAINER='TRUE' --rm -v "$PWD":"$PWD":ro -v /tmp:/tmp:rw -w "$PWD" quay.io/coreos/terraform-alpine:v0.11.7 ./hack/tf-fmt.sh
+  docker run --rm \
+    --env IS_CONTAINER=TRUE \
+    --volume "${PWD}:${PWD}:ro,z" \
+    --workdir "${PWD}" \
+    quay.io/coreos/terraform-alpine:v0.11.7 \
+    ./hack/tf-fmt.sh
 fi
diff --git a/hack/tf-lint.sh b/hack/tf-lint.sh
index 6c04df04647..2291682b027 100755
--- a/hack/tf-lint.sh
+++ b/hack/tf-lint.sh
@@ -2,5 +2,10 @@
 if [ "$IS_CONTAINER" != "" ]; then
   tflint
 else
-  docker run -t --rm -v "$(pwd)":/data --env IS_CONTAINER='TRUE' --entrypoint sh quay.io/coreos/tflint ./hack/tf-lint.sh
+  docker run --rm \
+    --env IS_CONTAINER=TRUE \
+    --volume "${PWD}:/data:z" \
+    --entrypoint sh \
+    quay.io/coreos/tflint \
+    ./hack/tf-lint.sh
 fi;
diff --git a/hack/yaml-lint.sh b/hack/yaml-lint.sh
index a8f144bcb58..36f0e17dd3b 100755
--- a/hack/yaml-lint.sh
+++ b/hack/yaml-lint.sh
@@ -2,5 +2,10 @@
 if [ "$IS_CONTAINER" != "" ]; then
   yamllint --config-data "{extends: default, rules: {line-length: {level: warning, max: 120}}}" ./examples/ ./installer/
 else
-  docker run -t --rm -v "$(pwd)":/workdir --env IS_CONTAINER='TRUE' --entrypoint sh quay.io/coreos/yamllint ./hack/yaml-lint.sh
+  docker run --rm \
+    --env IS_CONTAINER=TRUE \
+    --volume "${PWD}:/workdir:z" \
+    --entrypoint sh \
+    quay.io/coreos/yamllint \
+    ./hack/yaml-lint.sh
 fi;