diff --git a/scope b/scope
index 4fdb07786..9bb0ddbed 100755
--- a/scope
+++ b/scope
@@ -2,7 +2,7 @@
 
 set -eu
 
-ARGS="$@"
+ARGS="$*"
 
 usage() {
     echo "Usage:"
@@ -18,11 +18,11 @@ SCRIPT_VERSION="(unreleased version)"
 if [ "$SCRIPT_VERSION" = "(unreleased version)" ] ; then
     IMAGE_VERSION=latest
 else
-    IMAGE_VERSION=$SCRIPT_VERSION
+    IMAGE_VERSION="$SCRIPT_VERSION"
 fi
 IMAGE_VERSION=${VERSION:-$IMAGE_VERSION}
 SCOPE_IMAGE_NAME=weaveworks/scope
-SCOPE_IMAGE=$SCOPE_IMAGE_NAME:$IMAGE_VERSION
+SCOPE_IMAGE="$SCOPE_IMAGE_NAME:$IMAGE_VERSION"
 SCOPE_CONTAINER_NAME=weavescope
 SCOPE_APP_CONTAINER_NAME=weavescope-app
 IP_REGEXP="[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}"
@@ -98,7 +98,7 @@ check_docker_for_mac() {
 
 # Check that a container named $1 with image $2 is not running
 check_not_running() {
-    case $(docker inspect --format='{{.State.Running}} {{.Config.Image}}' $1 2>/dev/null) in
+    case $(docker inspect --format='{{.State.Running}} {{.Config.Image}}' "$1" 2>/dev/null) in
         "true $2")
             echo "$1 is already running." >&2
             exit 1
@@ -108,10 +108,10 @@ check_not_running() {
             exit 1
             ;;
         "false $2")
-            docker rm $1 >/dev/null
+            docker rm "$1" >/dev/null
             ;;
         "false $2:"*)
-            docker rm $1 >/dev/null
+            docker rm "$1" >/dev/null
             ;;
         true*)
             echo "Found another running container named '$1'. Aborting." >&2
@@ -135,29 +135,29 @@ create_plugins_dir() {
    # sockets do not cross VM boundaries. We need this directory to exits on the VM.
    docker run --rm --entrypoint=/bin/sh \
             -v /var/run:/var/run \
-            $SCOPE_IMAGE -c "mkdir -p /var/run/scope/plugins"
+            "$SCOPE_IMAGE" -c "mkdir -p /var/run/scope/plugins"
 }
 
 launch_command() {
-    echo docker run --privileged -d --name=$SCOPE_CONTAINER_NAME --net=host --pid=host \
+    echo docker run --privileged -d --name="$SCOPE_CONTAINER_NAME" --net=host --pid=host \
             -v /var/run/docker.sock:/var/run/docker.sock \
             -v /var/run/scope/plugins:/var/run/scope/plugins \
             -e CHECKPOINT_DISABLE \
-            $WEAVESCOPE_DOCKER_ARGS $SCOPE_IMAGE --probe.docker=true
+            $WEAVESCOPE_DOCKER_ARGS "$SCOPE_IMAGE" --probe.docker=true
 }
 
 launch_docker4mac_app_command() {
-    echo docker run -d --name=$SCOPE_APP_CONTAINER_NAME \
+    echo docker run -d --name="$SCOPE_APP_CONTAINER_NAME" \
             -e CHECKPOINT_DISABLE \
             -p 0.0.0.0:4040:4040 \
-            $WEAVESCOPE_DOCKER_ARGS $SCOPE_IMAGE --no-probe
+            $WEAVESCOPE_DOCKER_ARGS "$SCOPE_IMAGE" --no-probe
 }
 
 launch() {
-    check_not_running $SCOPE_CONTAINER_NAME $SCOPE_IMAGE_NAME
-    docker rm -f $SCOPE_CONTAINER_NAME >/dev/null 2>&1 || true
+    check_not_running "$SCOPE_CONTAINER_NAME" "$SCOPE_IMAGE_NAME"
+    docker rm -f "$SCOPE_CONTAINER_NAME" >/dev/null 2>&1 || true
     CONTAINER=$($(launch_command) "$@")
-    echo $CONTAINER
+    echo "$CONTAINER"
 }
 
 print_app_endpoints() {
@@ -173,12 +173,12 @@ check_docker_version
 case "$COMMAND" in
     command)
 	# TODO: properly escape/quote the output of "$@"
-        echo $(launch_command) "$@"
+        echo "$(launch_command)" "$@"
         ;;
 
     version)
         docker run --rm -e CHECKPOINT_DISABLE --entrypoint=/home/weave/scope \
-            $WEAVESCOPE_DOCKER_ARGS $SCOPE_IMAGE --mode=version
+            $WEAVESCOPE_DOCKER_ARGS "$SCOPE_IMAGE" --mode=version
         ;;
 
     help)
@@ -190,7 +190,7 @@ scope help     - Print this
 scope launch   - Launch Scope
 EOF
         docker run --rm -e CHECKPOINT_DISABLE --entrypoint=/home/weave/scope \
-            $WEAVESCOPE_DOCKER_ARGS $SCOPE_IMAGE -h
+            $WEAVESCOPE_DOCKER_ARGS "$SCOPE_IMAGE" -h
 
         cat >&2 <<EOF
 
@@ -205,7 +205,7 @@ EOF
         # Do a dry run of scope in the foreground, so it can parse args etc
         # avoiding the entrypoint script in the process.
         docker run --rm -e CHECKPOINT_DISABLE --entrypoint=/home/weave/scope \
-            $WEAVESCOPE_DOCKER_ARGS $SCOPE_IMAGE --dry-run "$@"
+            $WEAVESCOPE_DOCKER_ARGS "$SCOPE_IMAGE" --dry-run "$@"
 
         if check_docker_for_mac ; then
             create_plugins_dir
@@ -218,13 +218,13 @@ EOF
             # access to host ports of the VM.
             # - https://github.com/weaveworks/scope/issues/1411
             # - https://forums.docker.com/t/ports-in-host-network-namespace-are-not-accessible/10789
-            check_not_running $SCOPE_APP_CONTAINER_NAME $SCOPE_IMAGE_NAME
-            check_not_running $SCOPE_CONTAINER_NAME $SCOPE_IMAGE_NAME
-            docker rm -f $SCOPE_APP_CONTAINER_NAME >/dev/null 2>&1 || true
+            check_not_running "$SCOPE_APP_CONTAINER_NAME" "$SCOPE_IMAGE_NAME"
+            check_not_running "$SCOPE_CONTAINER_NAME" "$SCOPE_IMAGE_NAME"
+            docker rm -f "$SCOPE_APP_CONTAINER_NAME" >/dev/null 2>&1 || true
             CONTAINER=$($(launch_docker4mac_app_command) "$@")
-            echo $CONTAINER
+            echo "$CONTAINER"
             app_ip=$(docker inspect -f '{{.NetworkSettings.IPAddress}}' "${CONTAINER}")
-            docker rm -f $SCOPE_CONTAINER_NAME >/dev/null 2>&1 || true
+            docker rm -f "$SCOPE_CONTAINER_NAME" >/dev/null 2>&1 || true
             CONTAINER=$($(launch_command --no-app "$@" "${app_ip}:4040"))
             print_app_endpoints "localhost"
             exit
@@ -232,7 +232,7 @@ EOF
 
         launch "$@"
         if ! check_probe_only ; then
-            IP_ADDRS=$(docker run --rm --net=host --entrypoint /bin/sh $SCOPE_IMAGE -c "$IP_ADDR_CMD")
+            IP_ADDRS=$(docker run --rm --net=host --entrypoint /bin/sh "$SCOPE_IMAGE" -c "$IP_ADDR_CMD")
             print_app_endpoints $IP_ADDRS
         fi
 
@@ -240,12 +240,12 @@ EOF
 
     stop)
         [ $# -eq 0 ] || usage
-        if docker inspect $SCOPE_CONTAINER_NAME >/dev/null 2>&1 ; then
-           docker stop $SCOPE_CONTAINER_NAME >/dev/null
+        if docker inspect "$SCOPE_CONTAINER_NAME" >/dev/null 2>&1 ; then
+           docker stop "$SCOPE_CONTAINER_NAME" >/dev/null
         fi
         if check_docker_for_mac ; then
-            if docker inspect $SCOPE_APP_CONTAINER_NAME >/dev/null 2>&1 ; then
-		docker stop $SCOPE_APP_CONTAINER_NAME >/dev/null
+            if docker inspect "$SCOPE_APP_CONTAINER_NAME" >/dev/null 2>&1 ; then
+		docker stop "$SCOPE_APP_CONTAINER_NAME" >/dev/null
             fi
         fi
         ;;