diff --git a/docker/test/run.sh b/docker/test/run.sh
index f41e2b49c89..280e750679c 100755
--- a/docker/test/run.sh
+++ b/docker/test/run.sh
@@ -122,7 +122,7 @@ if [[ -n "$existing_cache_image" ]]; then
 fi
 
 # Fix permissions before copying files, to avoid AUFS bug other must have read/access permissions
-chmod -R o=rx *;
+chmod -R o=rx -- *;
 
 # This is required by the vtctld_web_test.py test.
 # Otherwise, /usr/bin/chromium will crash with the error:
@@ -153,10 +153,10 @@ fi
 
 # Mount in host VTDATAROOT if one exists, since it might be a RAM disk or SSD.
 if [[ -n "$VTDATAROOT" ]]; then
-  hostdir=`mktemp -d $VTDATAROOT/test-XXX`
-  testid=`basename $hostdir`
+  hostdir=$(mktemp -d "$VTDATAROOT/test-XXX")
+  testid=$(basename "$hostdir")
 
-  chmod 777 $hostdir
+  chmod 777 "$hostdir"
 
   echo "Mounting host dir $hostdir as VTDATAROOT"
   args="$args -v $hostdir:/vt/vtdataroot --name=$testid -h $testid"
@@ -201,12 +201,14 @@ bashcmd=$(append_cmd "$bashcmd" "$cmd")
 if tty -s; then
   # interactive shell
   # See above why we turn on "extglob" (extended Glob).
-  docker run -ti $args $image bash -O extglob -c "$bashcmd"
+  # shellcheck disable=SC2086
+  docker run -ti $args "$image" bash -O extglob -c "$bashcmd"
   exitcode=$?
 else
   # non-interactive shell (kill child on signal)
   trap 'docker kill $testid &>/dev/null' SIGTERM SIGINT
-  docker run $args $image bash -O extglob -c "$bashcmd" &
+  # shellcheck disable=SC2086
+  docker run $args "$image" bash -O extglob -c "$bashcmd" &
   wait $!
   exitcode=$?
   trap - SIGTERM SIGINT
@@ -215,23 +217,21 @@ fi
 # Clean up host dir mounted VTDATAROOT
 if [[ -n "$hostdir" ]]; then
   # Use Docker user to clean up first, to avoid permission errors.
-  docker run --name=rm_$testid -v $hostdir:/vt/vtdataroot $image bash -c 'rm -rf /vt/vtdataroot/*'
-  docker rm -f rm_$testid &>/dev/null
-  rm -rf $hostdir
+  docker run --name="rm_$testid" -v "$hostdir":/vt/vtdataroot "$image" bash -c 'rm -rf /vt/vtdataroot/*'
+  docker rm -f "rm_$testid" &>/dev/null
+  rm -rf "$hostdir"
 fi
 
 # If requested, create the cache image.
 if [[ "$mode" == "create_cache" && $exitcode == 0 ]]; then
   msg="DO NOT PUSH: This is a temporary layer meant to persist e.g. the result of 'make build'. Never push this layer back to our official Docker Hub repository."
-  docker commit -m "$msg" $testid $cache_image
-
-  if [[  $? != 0 ]]; then
+  if ! docker commit -m "$msg" "$testid" "$cache_image"; then
     exitcode=$?
     echo "ERROR: Failed to create Docker cache. Used command: docker commit -m '$msg' $testid $image"
   fi
 fi
 
 # Delete the container
-docker rm -f $testid &>/dev/null
+docker rm -f "$testid" &>/dev/null
 
 exit $exitcode
diff --git a/test.go b/test.go
index 7973ae83ff5..4c535157020 100755
--- a/test.go
+++ b/test.go
@@ -344,7 +344,7 @@ func main() {
 	}
 
 	junitDir := path.Join("_test", "junit")
-	if err := os.MkdirAll(junitDir, os.FileMode(0755)); err != nil {
+	if err := os.MkdirAll(junitDir, os.FileMode(0o755)); err != nil {
 		log.Fatalf("Can't create junit directory: %v", err)
 	}
 
@@ -533,7 +533,7 @@ func main() {
 					outFile := fmt.Sprintf("%v.%v-%v.log", test.flavor, test.name, test.runIndex+1)
 					outFilePath := path.Join(outDir, outFile)
 					test.logf("saving test output to %v", outFilePath)
-					if fileErr := os.WriteFile(outFilePath, output, os.FileMode(0644)); fileErr != nil {
+					if fileErr := os.WriteFile(outFilePath, output, os.FileMode(0o644)); fileErr != nil {
 						test.logf("WriteFile error: %v", fileErr)
 					}
 				}
diff --git a/tools/unit_test_runner.sh b/tools/unit_test_runner.sh
index 43cf94de30d..1a99d641ff2 100755
--- a/tools/unit_test_runner.sh
+++ b/tools/unit_test_runner.sh
@@ -68,4 +68,5 @@ if [[ -n "${JSON_OUTPUT:-}" ]]; then
 	GOTESTSUM_ARGS="$GOTESTSUM_ARGS --jsonfile $JSON_OUTPUT"
 fi
 
+# shellcheck disable=SC2086
 go tool gotestsum $GOTESTSUM_ARGS --packages="$packages_with_tests" -- $VT_GO_PARALLEL $RACE_FLAG -count=1