diff --git a/build-docker-image.sh b/build-docker-image.sh
index fd16c0de9..68cf604fb 100755
--- a/build-docker-image.sh
+++ b/build-docker-image.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 cd docker
 
diff --git a/ci/azure-install-rust.yml b/ci/azure-install-rust.yml
index fc98089ce..d9202f53c 100644
--- a/ci/azure-install-rust.yml
+++ b/ci/azure-install-rust.yml
@@ -2,7 +2,8 @@
 
 steps:
   - bash: |
-      set -e
+      set -euo pipefail
+
       if command -v rustup; then
         echo `command -v rustup` `rustup -V` already installed
         rustup self update
@@ -17,13 +18,16 @@ steps:
     displayName: Install rustup
 
   - bash: |
-      set -e
+      set -euo pipefail
+
       rustup update $TOOLCHAIN
       rustup default $TOOLCHAIN
     displayName: Install rust
 
   - bash: |
-      set -ex
+      set -x
+      set -euo pipefail
+
       rustup -V
       rustc -Vv
       cargo -V
diff --git a/ci/test.sh b/ci/test.sh
index 474e48cad..54fb5ddab 100755
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 function retry {
   local tries=${TRIES-5}
@@ -41,7 +42,7 @@ main() {
     export QEMU_STRACE=1
 
     # test `cross check`
-    if [ ! -z $STD ]; then
+    if [[ ! -z ${STD:-} ]]; then
         td=$(mktemp -d)
         cargo init --lib --name foo $td
         pushd $td
@@ -52,7 +53,7 @@ main() {
     fi
 
     # `cross build` test for targets where `std` is not available
-    if [ -z "$STD" ]; then
+    if [[ -z "${STD:-}" ]]; then
         td=$(mktemp -d)
 
         git clone \
@@ -98,9 +99,9 @@ EOF
         rm -rf $td
     fi
 
-    if [ $RUN ]; then
+    if [[ ${RUN:-} ]]; then
         # `cross test` test
-        if [ $DYLIB ]; then
+        if [[ ${DYLIB:-} ]]; then
             td=$(mktemp -d)
 
             pushd $td
@@ -150,7 +151,7 @@ EOF
     fi
 
     # Test C++ support
-    if [ $CPP ]; then
+    if [[ ${CPP:-} ]]; then
         td=$(mktemp -d)
 
         git clone --depth 1 https://github.com/japaric/hellopp $td
@@ -158,7 +159,7 @@ EOF
         pushd $td
         cargo update -p gcc
         retry cargo fetch
-        if [ $RUN ]; then
+        if [[ ${RUN:-} ]]; then
             cross_run --target $TARGET
         else
             cross build --target $TARGET
@@ -170,7 +171,7 @@ EOF
 }
 
 cross_run() {
-    if [ -z "$RUNNERS" ]; then
+    if [[ -z "${RUNNERS:-}" ]]; then
         cross run "$@"
     else
         for runner in $RUNNERS; do
@@ -181,7 +182,7 @@ cross_run() {
 }
 
 cross_test() {
-    if [ -z "$RUNNERS" ]; then
+    if [[ -z "${RUNNERS:-}" ]]; then
         cross test "$@"
     else
         for runner in $RUNNERS; do
@@ -192,7 +193,7 @@ cross_test() {
 }
 
 cross_bench() {
-    if [ -z "$RUNNERS" ]; then
+    if [[ -z "${RUNNERS:-}" ]]; then
         cross bench "$@"
     else
         for runner in $RUNNERS; do
diff --git a/docker/Dockerfile.aarch64-linux-android b/docker/Dockerfile.aarch64-linux-android
index 0025dfb1f..3a2d9025a 100644
--- a/docker/Dockerfile.aarch64-linux-android
+++ b/docker/Dockerfile.aarch64-linux-android
@@ -14,7 +14,7 @@ COPY android-system.sh /
 RUN /android-system.sh arm64
 
 COPY qemu.sh /
-RUN /qemu.sh aarch64 android
+RUN /qemu.sh aarch64
 
 RUN cp /android-ndk/sysroot/usr/lib/libz.so /system/lib/
 
diff --git a/docker/Dockerfile.aarch64-unknown-linux-gnu b/docker/Dockerfile.aarch64-unknown-linux-gnu
index 4fa959742..0f0703e3f 100644
--- a/docker/Dockerfile.aarch64-unknown-linux-gnu
+++ b/docker/Dockerfile.aarch64-unknown-linux-gnu
@@ -15,7 +15,7 @@ RUN apt-get install -y --no-install-recommends \
     libc6-dev-arm64-cross
 
 COPY qemu.sh /
-RUN /qemu.sh aarch64 linux softmmu
+RUN /qemu.sh aarch64 softmmu
 
 COPY dropbear.sh /
 RUN /dropbear.sh
diff --git a/docker/Dockerfile.arm-linux-androideabi b/docker/Dockerfile.arm-linux-androideabi
index 38439fe68..16cd3a712 100644
--- a/docker/Dockerfile.arm-linux-androideabi
+++ b/docker/Dockerfile.arm-linux-androideabi
@@ -14,7 +14,7 @@ COPY android-system.sh /
 RUN /android-system.sh arm
 
 COPY qemu.sh /
-RUN /qemu.sh arm android
+RUN /qemu.sh arm
 
 RUN cp /android-ndk/sysroot/usr/lib/libz.so /system/lib/
 
diff --git a/docker/Dockerfile.armv7-linux-androideabi b/docker/Dockerfile.armv7-linux-androideabi
index 3eac0b7b3..11ffd5882 100644
--- a/docker/Dockerfile.armv7-linux-androideabi
+++ b/docker/Dockerfile.armv7-linux-androideabi
@@ -14,7 +14,7 @@ COPY android-system.sh /
 RUN /android-system.sh arm
 
 COPY qemu.sh /
-RUN /qemu.sh arm android
+RUN /qemu.sh arm
 
 RUN cp /android-ndk/sysroot/usr/lib/libz.so /system/lib/
 
diff --git a/docker/Dockerfile.armv7-unknown-linux-gnueabihf b/docker/Dockerfile.armv7-unknown-linux-gnueabihf
index 5ec9986d9..080a11eaf 100644
--- a/docker/Dockerfile.armv7-unknown-linux-gnueabihf
+++ b/docker/Dockerfile.armv7-unknown-linux-gnueabihf
@@ -15,7 +15,7 @@ RUN apt-get install -y --no-install-recommends \
     libc6-dev-armhf-cross
 
 COPY qemu.sh /
-RUN /qemu.sh arm linux softmmu
+RUN /qemu.sh arm softmmu
 
 COPY dropbear.sh /
 RUN /dropbear.sh
diff --git a/docker/Dockerfile.i686-linux-android b/docker/Dockerfile.i686-linux-android
index b720060a8..fa3cdefe8 100644
--- a/docker/Dockerfile.i686-linux-android
+++ b/docker/Dockerfile.i686-linux-android
@@ -21,7 +21,7 @@ RUN /android-system.sh x86
 #
 # Running with qemu works as expected
 COPY qemu.sh /
-RUN /qemu.sh i386 android
+RUN /qemu.sh i386
 
 RUN cp /android-ndk/sysroot/usr/lib/libz.so /system/lib/
 
diff --git a/docker/Dockerfile.i686-unknown-linux-gnu b/docker/Dockerfile.i686-unknown-linux-gnu
index 6957d7f55..babb43721 100644
--- a/docker/Dockerfile.i686-unknown-linux-gnu
+++ b/docker/Dockerfile.i686-unknown-linux-gnu
@@ -14,7 +14,7 @@ RUN apt-get install -y --no-install-recommends \
     g++-multilib
 
 COPY qemu.sh /
-RUN /qemu.sh i386 linux softmmu
+RUN /qemu.sh i386 softmmu
 
 COPY dropbear.sh /
 RUN /dropbear.sh
diff --git a/docker/Dockerfile.mips-unknown-linux-gnu b/docker/Dockerfile.mips-unknown-linux-gnu
index e205a3a2b..0419ae202 100644
--- a/docker/Dockerfile.mips-unknown-linux-gnu
+++ b/docker/Dockerfile.mips-unknown-linux-gnu
@@ -11,7 +11,7 @@ RUN apt-get install -y --no-install-recommends \
     libc6-dev-mips-cross
 
 COPY qemu.sh /
-RUN /qemu.sh mips linux softmmu
+RUN /qemu.sh mips softmmu
 
 COPY dropbear.sh /
 RUN /dropbear.sh
diff --git a/docker/Dockerfile.mips64el-unknown-linux-gnuabi64 b/docker/Dockerfile.mips64el-unknown-linux-gnuabi64
index 69e935e9e..a94311451 100644
--- a/docker/Dockerfile.mips64el-unknown-linux-gnuabi64
+++ b/docker/Dockerfile.mips64el-unknown-linux-gnuabi64
@@ -11,7 +11,7 @@ RUN apt-get install -y --no-install-recommends \
     libc6-dev-mips64el-cross
 
 COPY qemu.sh /
-RUN /qemu.sh mips64el linux softmmu
+RUN /qemu.sh mips64el softmmu
 
 COPY dropbear.sh /
 RUN /dropbear.sh
diff --git a/docker/Dockerfile.mipsel-unknown-linux-gnu b/docker/Dockerfile.mipsel-unknown-linux-gnu
index 8f6a1e89d..941df0eb6 100644
--- a/docker/Dockerfile.mipsel-unknown-linux-gnu
+++ b/docker/Dockerfile.mipsel-unknown-linux-gnu
@@ -11,7 +11,7 @@ RUN apt-get install -y --no-install-recommends \
     libc6-dev-mipsel-cross
 
 COPY qemu.sh /
-RUN /qemu.sh mipsel linux softmmu
+RUN /qemu.sh mipsel softmmu
 
 COPY dropbear.sh /
 RUN /dropbear.sh
diff --git a/docker/Dockerfile.powerpc-unknown-linux-gnu b/docker/Dockerfile.powerpc-unknown-linux-gnu
index d99d72555..d8fad1fb0 100644
--- a/docker/Dockerfile.powerpc-unknown-linux-gnu
+++ b/docker/Dockerfile.powerpc-unknown-linux-gnu
@@ -15,7 +15,7 @@ RUN apt-get install -y --no-install-recommends \
     libc6-dev-powerpc-cross
 
 COPY qemu.sh /
-RUN /qemu.sh ppc linux softmmu
+RUN /qemu.sh ppc softmmu
 
 COPY dropbear.sh /
 RUN /dropbear.sh
diff --git a/docker/Dockerfile.powerpc64-unknown-linux-gnu b/docker/Dockerfile.powerpc64-unknown-linux-gnu
index 9bd6b1957..babf3bf7d 100644
--- a/docker/Dockerfile.powerpc64-unknown-linux-gnu
+++ b/docker/Dockerfile.powerpc64-unknown-linux-gnu
@@ -11,7 +11,7 @@ RUN apt-get install -y --no-install-recommends \
     libc6-dev-ppc64-cross
 
 COPY qemu.sh /
-RUN /qemu.sh ppc64 linux softmmu
+RUN /qemu.sh ppc64 softmmu
 
 COPY dropbear.sh /
 RUN /dropbear.sh
diff --git a/docker/Dockerfile.powerpc64le-unknown-linux-gnu b/docker/Dockerfile.powerpc64le-unknown-linux-gnu
index 47d8f88b1..a209f92e8 100644
--- a/docker/Dockerfile.powerpc64le-unknown-linux-gnu
+++ b/docker/Dockerfile.powerpc64le-unknown-linux-gnu
@@ -11,7 +11,7 @@ RUN apt-get install -y --no-install-recommends \
     libc6-dev-ppc64el-cross
 
 COPY qemu.sh /
-RUN /qemu.sh ppc64le linux softmmu
+RUN /qemu.sh ppc64le softmmu
 
 COPY dropbear.sh /
 RUN /dropbear.sh
diff --git a/docker/Dockerfile.s390x-unknown-linux-gnu b/docker/Dockerfile.s390x-unknown-linux-gnu
index a087f2903..122d79d32 100644
--- a/docker/Dockerfile.s390x-unknown-linux-gnu
+++ b/docker/Dockerfile.s390x-unknown-linux-gnu
@@ -11,7 +11,7 @@ RUN apt-get install -y --no-install-recommends \
     libc6-dev-s390x-cross
 
 COPY qemu.sh /
-RUN /qemu.sh s390x linux softmmu
+RUN /qemu.sh s390x softmmu
 
 COPY dropbear.sh /
 RUN /dropbear.sh
diff --git a/docker/Dockerfile.sparc64-unknown-linux-gnu b/docker/Dockerfile.sparc64-unknown-linux-gnu
index 8a957dde6..bf89c936b 100644
--- a/docker/Dockerfile.sparc64-unknown-linux-gnu
+++ b/docker/Dockerfile.sparc64-unknown-linux-gnu
@@ -11,7 +11,7 @@ RUN apt-get install -y --no-install-recommends \
     libc6-dev-sparc64-cross
 
 COPY qemu.sh /
-RUN /qemu.sh sparc64 linux softmmu
+RUN /qemu.sh sparc64 softmmu
 
 COPY dropbear.sh /
 RUN /dropbear.sh
diff --git a/docker/Dockerfile.x86_64-linux-android b/docker/Dockerfile.x86_64-linux-android
index 919b7ae80..be961ccc4 100644
--- a/docker/Dockerfile.x86_64-linux-android
+++ b/docker/Dockerfile.x86_64-linux-android
@@ -15,7 +15,7 @@ RUN /android-system.sh x86_64
 
 # Using qemu allows older host cpus (without sse4) to execute the target binaries
 COPY qemu.sh /
-RUN /qemu.sh x86_64 android
+RUN /qemu.sh x86_64
 
 RUN cp /android-ndk/sysroot/usr/lib/libz.so /system/lib/
 
diff --git a/docker/Dockerfile.x86_64-unknown-linux-gnu b/docker/Dockerfile.x86_64-unknown-linux-gnu
index 5c9a7174d..85b1bc021 100644
--- a/docker/Dockerfile.x86_64-unknown-linux-gnu
+++ b/docker/Dockerfile.x86_64-unknown-linux-gnu
@@ -15,7 +15,7 @@ RUN apt-get install -y --no-install-recommends \
     zlib1g-dev
 
 COPY qemu.sh /
-RUN /qemu.sh x86_64 linux softmmu
+RUN /qemu.sh x86_64 softmmu
 
 COPY dropbear.sh /
 RUN /dropbear.sh
diff --git a/docker/android-ndk.sh b/docker/android-ndk.sh
index 9fdb94bae..bfce054ba 100755
--- a/docker/android-ndk.sh
+++ b/docker/android-ndk.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 NDK_URL=https://dl.google.com/android/repository/android-ndk-r13b-linux-x86_64.zip
 
diff --git a/docker/android-system.sh b/docker/android-system.sh
index 6325c035e..9b3f83ce5 100755
--- a/docker/android-system.sh
+++ b/docker/android-system.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 main() {
     local arch=$1
@@ -89,11 +90,13 @@ EOF
     # FATAL: kernel did not supply AT_SECURE
     sed -i -e 's/if (!kernel_supplied_AT_SECURE)/if (false)/g' bionic/linker/linker_environ.cpp
 
+    set +u
     source build/envsetup.sh
     lunch aosp_$arch-user
     mmma bionic/
     mmma external/mksh/
     mmma system/core/toolbox/
+    set -u
 
     if [ $arch = "arm" ]; then
         mv out/target/product/generic/system/ /
diff --git a/docker/cmake.sh b/docker/cmake.sh
index bde1b3c2d..c4a04dcac 100755
--- a/docker/cmake.sh
+++ b/docker/cmake.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 main() {
     local version=3.5.1
diff --git a/docker/common.sh b/docker/common.sh
index b7f7f4322..05efd82ff 100755
--- a/docker/common.sh
+++ b/docker/common.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 apt-get update
 
diff --git a/docker/dragonfly.sh b/docker/dragonfly.sh
index a5ba894c0..11dac522d 100755
--- a/docker/dragonfly.sh
+++ b/docker/dragonfly.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 main() {
     local binutils=2.25.1 \
diff --git a/docker/dropbear.sh b/docker/dropbear.sh
index a0499a971..e31e0777b 100755
--- a/docker/dropbear.sh
+++ b/docker/dropbear.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 main() {
     local version=2019.78 \
diff --git a/docker/emscripten-entry.sh b/docker/emscripten-entry.sh
index 9e1f3ca07..ed6cdb5f3 100755
--- a/docker/emscripten-entry.sh
+++ b/docker/emscripten-entry.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
 export HOME=/emsdk-portable/
 
diff --git a/docker/emscripten.sh b/docker/emscripten.sh
index 31e209f87..c0ce0faae 100755
--- a/docker/emscripten.sh
+++ b/docker/emscripten.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 main() {
     local dependencies=(
diff --git a/docker/freebsd.sh b/docker/freebsd.sh
index 909765374..ef72fc38f 100755
--- a/docker/freebsd.sh
+++ b/docker/freebsd.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 main() {
     local arch=$1
diff --git a/docker/linux-image.sh b/docker/linux-image.sh
index f8e208b31..7aedd4f24 100755
--- a/docker/linux-image.sh
+++ b/docker/linux-image.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 main() {
     # arch in the rust target
@@ -12,6 +13,9 @@ main() {
 
     local dropbear="dropbear-bin"
 
+    local deps=
+    local kernel=
+
     # select debian arch and kernel version
     case $arch in
         aarch64)
@@ -50,7 +54,7 @@ main() {
             # there is no stable port
             arch=ppc64
             # https://packages.debian.org/en/sid/linux-image-powerpc64
-            kernel=5.3.0-1-powerpc64
+            kernel=5.3.0-2-powerpc64
             debsource="deb http://ftp.ports.debian.org/debian-ports unreleased main"
             debsource="$debsource\ndeb http://ftp.ports.debian.org/debian-ports unstable main"
             # sid version of dropbear requires these dependencies
@@ -67,7 +71,7 @@ main() {
         sparc64)
             # there is no stable port
             # https://packages.debian.org/en/sid/linux-image-sparc64
-            kernel=5.3.0-1-sparc64
+            kernel=5.3.0-2-sparc64
             debsource="deb http://ftp.ports.debian.org/debian-ports unreleased main"
             debsource="$debsource\ndeb http://ftp.ports.debian.org/debian-ports unstable main"
             # sid version of dropbear requires these dependencies
diff --git a/docker/musl.sh b/docker/musl.sh
index 68f23ad39..73deaa9b3 100755
--- a/docker/musl.sh
+++ b/docker/musl.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 hide_output() {
     set +x
diff --git a/docker/netbsd.sh b/docker/netbsd.sh
index 061647e6a..5ba291892 100755
--- a/docker/netbsd.sh
+++ b/docker/netbsd.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 main() {
     local binutils=2.25.1 \
diff --git a/docker/qemu.sh b/docker/qemu.sh
index 332875ebd..69f3dac5d 100755
--- a/docker/qemu.sh
+++ b/docker/qemu.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 main() {
     local version=4.1.0
@@ -15,8 +16,7 @@ main() {
     fi
 
     local arch=$1 \
-          os=$2 \
-          softmmu=$3 \
+          softmmu=${2:-} \
           td=$(mktemp -d)
 
     local dependencies=(
diff --git a/docker/solaris.sh b/docker/solaris.sh
index 73f6456e6..bb521a64c 100755
--- a/docker/solaris.sh
+++ b/docker/solaris.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 main() {
     local arch=$1
diff --git a/docker/xargo.sh b/docker/xargo.sh
index 56a3ec7de..9717c581a 100755
--- a/docker/xargo.sh
+++ b/docker/xargo.sh
@@ -1,11 +1,9 @@
 #!/usr/bin/env bash
 
-set -ex
+set -x
+set -euo pipefail
 
 main() {
-    local tag=v0.3.5
-    local target=x86_64-unknown-linux-gnu
-
     local dependencies=(
         ca-certificates
         curl
@@ -20,8 +18,16 @@ main() {
         fi
     done
 
-    curl -LSfs http://japaric.github.io/trust/install.sh | \
-    sh -s -- --git japaric/xargo --tag $tag --target $target --to /usr/bin && \
+    export RUSTUP_HOME=/tmp/rustup
+    export CARGO_HOME=/tmp/cargo
+
+    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -o rustup-init.sh
+    sh rustup-init.sh -y --no-modify-path
+    rm rustup-init.sh
+
+    PATH="${CARGO_HOME}/bin:${PATH}" cargo install xargo --root /usr
+
+    rm -r "${RUSTUP_HOME}" "${CARGO_HOME}"
 
     apt-get purge --auto-remove -y ${purge_list[@]}
     rm $0