diff --git a/Dockerfile-alpine-perl.template b/Dockerfile-alpine-perl.template
index c4e0640041055149cad7543417db0516d576796e..c8c56ae8a484beaef9f6352384c63da2b4d5e307 100644
--- a/Dockerfile-alpine-perl.template
+++ b/Dockerfile-alpine-perl.template
@@ -66,6 +66,6 @@ RUN set -x \
 # remove checksum deps
     && apk del --no-network .checksum-deps \
 # if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-    && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
-    && if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
-    && if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi
+    && if [ -f "$tempDir" ]; then rm -rf "$tempDir"; fi \
+    && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
+    && if [ -f "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi
diff --git a/Dockerfile-alpine-slim.template b/Dockerfile-alpine-slim.template
index 7c8347e9083d1b82251024abda55bb7a91241254..4a88c230d10b49e48ec1887d6910b0ac788edc71 100644
--- a/Dockerfile-alpine-slim.template
+++ b/Dockerfile-alpine-slim.template
@@ -73,9 +73,9 @@ RUN set -x \
 # remove checksum deps
     && apk del --no-network .checksum-deps \
 # if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-    && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
-    && if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
-    && if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
+    && if [ -f "$tempDir" ]; then rm -rf "$tempDir"; fi \
+    && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
+    && if [ -f "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
 # Bring in gettext so we can get `envsubst`, then throw
 # the rest away. To do this, we need to install `gettext`
 # then move `envsubst` out of the way so `gettext` can
diff --git a/Dockerfile-alpine.template b/Dockerfile-alpine.template
index ba91fe6cc4d8b5c7c66199fc9d3800a4ff06c001..9bff5ab813565085e2fb5935c79a6df2dce4377c 100644
--- a/Dockerfile-alpine.template
+++ b/Dockerfile-alpine.template
@@ -71,8 +71,8 @@ RUN set -x \
 # remove checksum deps
     && apk del --no-network .checksum-deps \
 # if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-    && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
-    && if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
-    && if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
+    && if [ -f "$tempDir" ]; then rm -rf "$tempDir"; fi \
+    && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
+    && if [ -f "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
 # Bring in curl and ca-certificates to make registering on DNS SD easier
     && apk add --no-cache curl ca-certificates
diff --git a/entrypoint/10-listen-on-ipv6-by-default.sh b/entrypoint/10-listen-on-ipv6-by-default.sh
index b2655860d88231775d0a34f234b223cd69efe47c..b90bf0c94d74cabd177af466e78870da4f211094 100755
--- a/entrypoint/10-listen-on-ipv6-by-default.sh
+++ b/entrypoint/10-listen-on-ipv6-by-default.sh
@@ -9,7 +9,7 @@ entrypoint_log() {
     fi
 }
 
-ME=$(basename $0)
+ME=$(basename "$0")
 DEFAULT_CONF_FILE="etc/nginx/conf.d/default.conf"
 
 # check if we have ipv6 available
diff --git a/entrypoint/15-local-resolvers.envsh b/entrypoint/15-local-resolvers.envsh
index 9306215988ecb2382296a743f62751f78147c467..da963525b59a5370944541a9dd3742330acd39b9 100755
--- a/entrypoint/15-local-resolvers.envsh
+++ b/entrypoint/15-local-resolvers.envsh
@@ -8,4 +8,5 @@ PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 [ "${NGINX_ENTRYPOINT_LOCAL_RESOLVERS:-}" ] || return 0
 
-export NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {print $2}' /etc/resolv.conf)
+NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {print $2}' /etc/resolv.conf)
+export NGINX_LOCAL_RESOLVERS
diff --git a/entrypoint/20-envsubst-on-templates.sh b/entrypoint/20-envsubst-on-templates.sh
index f3fb9fcb9c19957651bd068c484b74985d184bd1..3804165c94faeb8aecc31a5df368333be74b3d58 100755
--- a/entrypoint/20-envsubst-on-templates.sh
+++ b/entrypoint/20-envsubst-on-templates.sh
@@ -2,7 +2,7 @@
 
 set -e
 
-ME=$(basename $0)
+ME=$(basename "$0")
 
 entrypoint_log() {
     if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then
@@ -44,8 +44,8 @@ auto_envsubst() {
     return 0
   fi
   find "$template_dir" -follow -type f -name "*$suffix" -print | while read -r template; do
-    relative_path="${template#$template_dir/}"
-    output_path="$output_dir/${relative_path%$suffix}"
+    relative_path="${template#"$template_dir/"}"
+    output_path="$output_dir/${relative_path%"$suffix"}"
     subdir=$(dirname "$relative_path")
     # create a subdirectory where the template file exists
     mkdir -p "$output_dir/$subdir"
@@ -62,8 +62,8 @@ auto_envsubst() {
     fi
     add_stream_block
     find "$template_dir" -follow -type f -name "*$stream_suffix" -print | while read -r template; do
-      relative_path="${template#$template_dir/}"
-      output_path="$stream_output_dir/${relative_path%$stream_suffix}"
+      relative_path="${template#"$template_dir/"}"
+      output_path="$stream_output_dir/${relative_path%"$stream_suffix"}"
       subdir=$(dirname "$relative_path")
       # create a subdirectory where the template file exists
       mkdir -p "$stream_output_dir/$subdir"
diff --git a/entrypoint/30-tune-worker-processes.sh b/entrypoint/30-tune-worker-processes.sh
index 9aa42e98ddc752f4f7a05db7e617821cce6a04f7..defb994f3d035e9b3423543fcaf3d602f6354708 100755
--- a/entrypoint/30-tune-worker-processes.sh
+++ b/entrypoint/30-tune-worker-processes.sh
@@ -4,7 +4,7 @@
 set -eu
 
 LC_ALL=C
-ME=$( basename "$0" )
+ME=$(basename "$0")
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 [ "${NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE:-}" ] || exit 0
diff --git a/entrypoint/docker-entrypoint.sh b/entrypoint/docker-entrypoint.sh
index e201fe608452cd72679887c0f759e164754c1815..8ea04f217da809b407e87b54b3c1f88c070f1b79 100755
--- a/entrypoint/docker-entrypoint.sh
+++ b/entrypoint/docker-entrypoint.sh
@@ -9,7 +9,7 @@ entrypoint_log() {
     fi
 }
 
-if [ "$1" = "nginx" -o "$1" = "nginx-debug" ]; then
+if [ "$1" = "nginx" ] || [ "$1" = "nginx-debug" ]; then
     if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then
         entrypoint_log "$0: /docker-entrypoint.d/ is not empty, will attempt to perform configuration"
 
diff --git a/mainline/alpine-perl/Dockerfile b/mainline/alpine-perl/Dockerfile
index e392c742fa1df66bf5b1171d39db29db929aeed5..6119fbd070a71d6aea85a2b3fcffa6ff106e529d 100644
--- a/mainline/alpine-perl/Dockerfile
+++ b/mainline/alpine-perl/Dockerfile
@@ -77,6 +77,6 @@ RUN set -x \
 # remove checksum deps
     && apk del --no-network .checksum-deps \
 # if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-    && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
-    && if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
-    && if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi
+    && if [ -f "$tempDir" ]; then rm -rf "$tempDir"; fi \
+    && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
+    && if [ -f "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi
diff --git a/mainline/alpine-slim/10-listen-on-ipv6-by-default.sh b/mainline/alpine-slim/10-listen-on-ipv6-by-default.sh
index b2655860d88231775d0a34f234b223cd69efe47c..b90bf0c94d74cabd177af466e78870da4f211094 100755
--- a/mainline/alpine-slim/10-listen-on-ipv6-by-default.sh
+++ b/mainline/alpine-slim/10-listen-on-ipv6-by-default.sh
@@ -9,7 +9,7 @@ entrypoint_log() {
     fi
 }
 
-ME=$(basename $0)
+ME=$(basename "$0")
 DEFAULT_CONF_FILE="etc/nginx/conf.d/default.conf"
 
 # check if we have ipv6 available
diff --git a/mainline/alpine-slim/15-local-resolvers.envsh b/mainline/alpine-slim/15-local-resolvers.envsh
index 9306215988ecb2382296a743f62751f78147c467..da963525b59a5370944541a9dd3742330acd39b9 100755
--- a/mainline/alpine-slim/15-local-resolvers.envsh
+++ b/mainline/alpine-slim/15-local-resolvers.envsh
@@ -8,4 +8,5 @@ PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 [ "${NGINX_ENTRYPOINT_LOCAL_RESOLVERS:-}" ] || return 0
 
-export NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {print $2}' /etc/resolv.conf)
+NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {print $2}' /etc/resolv.conf)
+export NGINX_LOCAL_RESOLVERS
diff --git a/mainline/alpine-slim/20-envsubst-on-templates.sh b/mainline/alpine-slim/20-envsubst-on-templates.sh
index f3fb9fcb9c19957651bd068c484b74985d184bd1..3804165c94faeb8aecc31a5df368333be74b3d58 100755
--- a/mainline/alpine-slim/20-envsubst-on-templates.sh
+++ b/mainline/alpine-slim/20-envsubst-on-templates.sh
@@ -2,7 +2,7 @@
 
 set -e
 
-ME=$(basename $0)
+ME=$(basename "$0")
 
 entrypoint_log() {
     if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then
@@ -44,8 +44,8 @@ auto_envsubst() {
     return 0
   fi
   find "$template_dir" -follow -type f -name "*$suffix" -print | while read -r template; do
-    relative_path="${template#$template_dir/}"
-    output_path="$output_dir/${relative_path%$suffix}"
+    relative_path="${template#"$template_dir/"}"
+    output_path="$output_dir/${relative_path%"$suffix"}"
     subdir=$(dirname "$relative_path")
     # create a subdirectory where the template file exists
     mkdir -p "$output_dir/$subdir"
@@ -62,8 +62,8 @@ auto_envsubst() {
     fi
     add_stream_block
     find "$template_dir" -follow -type f -name "*$stream_suffix" -print | while read -r template; do
-      relative_path="${template#$template_dir/}"
-      output_path="$stream_output_dir/${relative_path%$stream_suffix}"
+      relative_path="${template#"$template_dir/"}"
+      output_path="$stream_output_dir/${relative_path%"$stream_suffix"}"
       subdir=$(dirname "$relative_path")
       # create a subdirectory where the template file exists
       mkdir -p "$stream_output_dir/$subdir"
diff --git a/mainline/alpine-slim/30-tune-worker-processes.sh b/mainline/alpine-slim/30-tune-worker-processes.sh
index 9aa42e98ddc752f4f7a05db7e617821cce6a04f7..defb994f3d035e9b3423543fcaf3d602f6354708 100755
--- a/mainline/alpine-slim/30-tune-worker-processes.sh
+++ b/mainline/alpine-slim/30-tune-worker-processes.sh
@@ -4,7 +4,7 @@
 set -eu
 
 LC_ALL=C
-ME=$( basename "$0" )
+ME=$(basename "$0")
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 [ "${NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE:-}" ] || exit 0
diff --git a/mainline/alpine-slim/Dockerfile b/mainline/alpine-slim/Dockerfile
index b9133e069d1944239ee7b875bf55a3b4ece3ac4b..9de2c8c75200d8fc11568e6082f13d7d64c0d59e 100644
--- a/mainline/alpine-slim/Dockerfile
+++ b/mainline/alpine-slim/Dockerfile
@@ -79,9 +79,9 @@ RUN set -x \
 # remove checksum deps
     && apk del --no-network .checksum-deps \
 # if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-    && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
-    && if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
-    && if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
+    && if [ -f "$tempDir" ]; then rm -rf "$tempDir"; fi \
+    && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
+    && if [ -f "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
 # Bring in gettext so we can get `envsubst`, then throw
 # the rest away. To do this, we need to install `gettext`
 # then move `envsubst` out of the way so `gettext` can
diff --git a/mainline/alpine-slim/docker-entrypoint.sh b/mainline/alpine-slim/docker-entrypoint.sh
index e201fe608452cd72679887c0f759e164754c1815..8ea04f217da809b407e87b54b3c1f88c070f1b79 100755
--- a/mainline/alpine-slim/docker-entrypoint.sh
+++ b/mainline/alpine-slim/docker-entrypoint.sh
@@ -9,7 +9,7 @@ entrypoint_log() {
     fi
 }
 
-if [ "$1" = "nginx" -o "$1" = "nginx-debug" ]; then
+if [ "$1" = "nginx" ] || [ "$1" = "nginx-debug" ]; then
     if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then
         entrypoint_log "$0: /docker-entrypoint.d/ is not empty, will attempt to perform configuration"
 
diff --git a/mainline/alpine/Dockerfile b/mainline/alpine/Dockerfile
index f2c5c88df2797e5a2c2c3edeed21ac6469ba2c81..58282e3eb59eb156f5d488feee7af4b934747770 100644
--- a/mainline/alpine/Dockerfile
+++ b/mainline/alpine/Dockerfile
@@ -81,8 +81,8 @@ RUN set -x \
 # remove checksum deps
     && apk del --no-network .checksum-deps \
 # if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-    && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
-    && if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
-    && if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
+    && if [ -f "$tempDir" ]; then rm -rf "$tempDir"; fi \
+    && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
+    && if [ -f "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
 # Bring in curl and ca-certificates to make registering on DNS SD easier
     && apk add --no-cache curl ca-certificates
diff --git a/mainline/debian/10-listen-on-ipv6-by-default.sh b/mainline/debian/10-listen-on-ipv6-by-default.sh
index b2655860d88231775d0a34f234b223cd69efe47c..b90bf0c94d74cabd177af466e78870da4f211094 100755
--- a/mainline/debian/10-listen-on-ipv6-by-default.sh
+++ b/mainline/debian/10-listen-on-ipv6-by-default.sh
@@ -9,7 +9,7 @@ entrypoint_log() {
     fi
 }
 
-ME=$(basename $0)
+ME=$(basename "$0")
 DEFAULT_CONF_FILE="etc/nginx/conf.d/default.conf"
 
 # check if we have ipv6 available
diff --git a/mainline/debian/15-local-resolvers.envsh b/mainline/debian/15-local-resolvers.envsh
index 9306215988ecb2382296a743f62751f78147c467..da963525b59a5370944541a9dd3742330acd39b9 100755
--- a/mainline/debian/15-local-resolvers.envsh
+++ b/mainline/debian/15-local-resolvers.envsh
@@ -8,4 +8,5 @@ PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 [ "${NGINX_ENTRYPOINT_LOCAL_RESOLVERS:-}" ] || return 0
 
-export NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {print $2}' /etc/resolv.conf)
+NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {print $2}' /etc/resolv.conf)
+export NGINX_LOCAL_RESOLVERS
diff --git a/mainline/debian/20-envsubst-on-templates.sh b/mainline/debian/20-envsubst-on-templates.sh
index f3fb9fcb9c19957651bd068c484b74985d184bd1..3804165c94faeb8aecc31a5df368333be74b3d58 100755
--- a/mainline/debian/20-envsubst-on-templates.sh
+++ b/mainline/debian/20-envsubst-on-templates.sh
@@ -2,7 +2,7 @@
 
 set -e
 
-ME=$(basename $0)
+ME=$(basename "$0")
 
 entrypoint_log() {
     if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then
@@ -44,8 +44,8 @@ auto_envsubst() {
     return 0
   fi
   find "$template_dir" -follow -type f -name "*$suffix" -print | while read -r template; do
-    relative_path="${template#$template_dir/}"
-    output_path="$output_dir/${relative_path%$suffix}"
+    relative_path="${template#"$template_dir/"}"
+    output_path="$output_dir/${relative_path%"$suffix"}"
     subdir=$(dirname "$relative_path")
     # create a subdirectory where the template file exists
     mkdir -p "$output_dir/$subdir"
@@ -62,8 +62,8 @@ auto_envsubst() {
     fi
     add_stream_block
     find "$template_dir" -follow -type f -name "*$stream_suffix" -print | while read -r template; do
-      relative_path="${template#$template_dir/}"
-      output_path="$stream_output_dir/${relative_path%$stream_suffix}"
+      relative_path="${template#"$template_dir/"}"
+      output_path="$stream_output_dir/${relative_path%"$stream_suffix"}"
       subdir=$(dirname "$relative_path")
       # create a subdirectory where the template file exists
       mkdir -p "$stream_output_dir/$subdir"
diff --git a/mainline/debian/30-tune-worker-processes.sh b/mainline/debian/30-tune-worker-processes.sh
index 9aa42e98ddc752f4f7a05db7e617821cce6a04f7..defb994f3d035e9b3423543fcaf3d602f6354708 100755
--- a/mainline/debian/30-tune-worker-processes.sh
+++ b/mainline/debian/30-tune-worker-processes.sh
@@ -4,7 +4,7 @@
 set -eu
 
 LC_ALL=C
-ME=$( basename "$0" )
+ME=$(basename "$0")
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 [ "${NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE:-}" ] || exit 0
diff --git a/mainline/debian/docker-entrypoint.sh b/mainline/debian/docker-entrypoint.sh
index e201fe608452cd72679887c0f759e164754c1815..8ea04f217da809b407e87b54b3c1f88c070f1b79 100755
--- a/mainline/debian/docker-entrypoint.sh
+++ b/mainline/debian/docker-entrypoint.sh
@@ -9,7 +9,7 @@ entrypoint_log() {
     fi
 }
 
-if [ "$1" = "nginx" -o "$1" = "nginx-debug" ]; then
+if [ "$1" = "nginx" ] || [ "$1" = "nginx-debug" ]; then
     if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then
         entrypoint_log "$0: /docker-entrypoint.d/ is not empty, will attempt to perform configuration"
 
diff --git a/stable/alpine-perl/Dockerfile b/stable/alpine-perl/Dockerfile
index 633809b82f7c169229db00d42970ca9c6a45a1a1..5e5b3af12f38d72962d5de8f4f1e86c1abcb2241 100644
--- a/stable/alpine-perl/Dockerfile
+++ b/stable/alpine-perl/Dockerfile
@@ -77,6 +77,6 @@ RUN set -x \
 # remove checksum deps
     && apk del --no-network .checksum-deps \
 # if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-    && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
-    && if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
-    && if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi
+    && if [ -f "$tempDir" ]; then rm -rf "$tempDir"; fi \
+    && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
+    && if [ -f "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi
diff --git a/stable/alpine-slim/10-listen-on-ipv6-by-default.sh b/stable/alpine-slim/10-listen-on-ipv6-by-default.sh
index b2655860d88231775d0a34f234b223cd69efe47c..b90bf0c94d74cabd177af466e78870da4f211094 100755
--- a/stable/alpine-slim/10-listen-on-ipv6-by-default.sh
+++ b/stable/alpine-slim/10-listen-on-ipv6-by-default.sh
@@ -9,7 +9,7 @@ entrypoint_log() {
     fi
 }
 
-ME=$(basename $0)
+ME=$(basename "$0")
 DEFAULT_CONF_FILE="etc/nginx/conf.d/default.conf"
 
 # check if we have ipv6 available
diff --git a/stable/alpine-slim/15-local-resolvers.envsh b/stable/alpine-slim/15-local-resolvers.envsh
index 9306215988ecb2382296a743f62751f78147c467..da963525b59a5370944541a9dd3742330acd39b9 100755
--- a/stable/alpine-slim/15-local-resolvers.envsh
+++ b/stable/alpine-slim/15-local-resolvers.envsh
@@ -8,4 +8,5 @@ PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 [ "${NGINX_ENTRYPOINT_LOCAL_RESOLVERS:-}" ] || return 0
 
-export NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {print $2}' /etc/resolv.conf)
+NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {print $2}' /etc/resolv.conf)
+export NGINX_LOCAL_RESOLVERS
diff --git a/stable/alpine-slim/20-envsubst-on-templates.sh b/stable/alpine-slim/20-envsubst-on-templates.sh
index f3fb9fcb9c19957651bd068c484b74985d184bd1..3804165c94faeb8aecc31a5df368333be74b3d58 100755
--- a/stable/alpine-slim/20-envsubst-on-templates.sh
+++ b/stable/alpine-slim/20-envsubst-on-templates.sh
@@ -2,7 +2,7 @@
 
 set -e
 
-ME=$(basename $0)
+ME=$(basename "$0")
 
 entrypoint_log() {
     if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then
@@ -44,8 +44,8 @@ auto_envsubst() {
     return 0
   fi
   find "$template_dir" -follow -type f -name "*$suffix" -print | while read -r template; do
-    relative_path="${template#$template_dir/}"
-    output_path="$output_dir/${relative_path%$suffix}"
+    relative_path="${template#"$template_dir/"}"
+    output_path="$output_dir/${relative_path%"$suffix"}"
     subdir=$(dirname "$relative_path")
     # create a subdirectory where the template file exists
     mkdir -p "$output_dir/$subdir"
@@ -62,8 +62,8 @@ auto_envsubst() {
     fi
     add_stream_block
     find "$template_dir" -follow -type f -name "*$stream_suffix" -print | while read -r template; do
-      relative_path="${template#$template_dir/}"
-      output_path="$stream_output_dir/${relative_path%$stream_suffix}"
+      relative_path="${template#"$template_dir/"}"
+      output_path="$stream_output_dir/${relative_path%"$stream_suffix"}"
       subdir=$(dirname "$relative_path")
       # create a subdirectory where the template file exists
       mkdir -p "$stream_output_dir/$subdir"
diff --git a/stable/alpine-slim/30-tune-worker-processes.sh b/stable/alpine-slim/30-tune-worker-processes.sh
index 9aa42e98ddc752f4f7a05db7e617821cce6a04f7..defb994f3d035e9b3423543fcaf3d602f6354708 100755
--- a/stable/alpine-slim/30-tune-worker-processes.sh
+++ b/stable/alpine-slim/30-tune-worker-processes.sh
@@ -4,7 +4,7 @@
 set -eu
 
 LC_ALL=C
-ME=$( basename "$0" )
+ME=$(basename "$0")
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 [ "${NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE:-}" ] || exit 0
diff --git a/stable/alpine-slim/Dockerfile b/stable/alpine-slim/Dockerfile
index 875877566c1d49628bacd6b5d09974ea3f10da6b..1826029e66a19f1daeff5bde7bad1b5cd0283c45 100644
--- a/stable/alpine-slim/Dockerfile
+++ b/stable/alpine-slim/Dockerfile
@@ -79,9 +79,9 @@ RUN set -x \
 # remove checksum deps
     && apk del --no-network .checksum-deps \
 # if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-    && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
-    && if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
-    && if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
+    && if [ -f "$tempDir" ]; then rm -rf "$tempDir"; fi \
+    && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
+    && if [ -f "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
 # Bring in gettext so we can get `envsubst`, then throw
 # the rest away. To do this, we need to install `gettext`
 # then move `envsubst` out of the way so `gettext` can
diff --git a/stable/alpine-slim/docker-entrypoint.sh b/stable/alpine-slim/docker-entrypoint.sh
index e201fe608452cd72679887c0f759e164754c1815..8ea04f217da809b407e87b54b3c1f88c070f1b79 100755
--- a/stable/alpine-slim/docker-entrypoint.sh
+++ b/stable/alpine-slim/docker-entrypoint.sh
@@ -9,7 +9,7 @@ entrypoint_log() {
     fi
 }
 
-if [ "$1" = "nginx" -o "$1" = "nginx-debug" ]; then
+if [ "$1" = "nginx" ] || [ "$1" = "nginx-debug" ]; then
     if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then
         entrypoint_log "$0: /docker-entrypoint.d/ is not empty, will attempt to perform configuration"
 
diff --git a/stable/alpine/Dockerfile b/stable/alpine/Dockerfile
index b703af15e0b1f688677e7cbb74a14bf2178e56ca..629e1755d9c7f237df0f19a81c94f8712c68fa18 100644
--- a/stable/alpine/Dockerfile
+++ b/stable/alpine/Dockerfile
@@ -81,8 +81,8 @@ RUN set -x \
 # remove checksum deps
     && apk del --no-network .checksum-deps \
 # if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
-    && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
-    && if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
-    && if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
+    && if [ -f "$tempDir" ]; then rm -rf "$tempDir"; fi \
+    && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
+    && if [ -f "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
 # Bring in curl and ca-certificates to make registering on DNS SD easier
     && apk add --no-cache curl ca-certificates
diff --git a/stable/debian/10-listen-on-ipv6-by-default.sh b/stable/debian/10-listen-on-ipv6-by-default.sh
index b2655860d88231775d0a34f234b223cd69efe47c..b90bf0c94d74cabd177af466e78870da4f211094 100755
--- a/stable/debian/10-listen-on-ipv6-by-default.sh
+++ b/stable/debian/10-listen-on-ipv6-by-default.sh
@@ -9,7 +9,7 @@ entrypoint_log() {
     fi
 }
 
-ME=$(basename $0)
+ME=$(basename "$0")
 DEFAULT_CONF_FILE="etc/nginx/conf.d/default.conf"
 
 # check if we have ipv6 available
diff --git a/stable/debian/15-local-resolvers.envsh b/stable/debian/15-local-resolvers.envsh
index 9306215988ecb2382296a743f62751f78147c467..da963525b59a5370944541a9dd3742330acd39b9 100755
--- a/stable/debian/15-local-resolvers.envsh
+++ b/stable/debian/15-local-resolvers.envsh
@@ -8,4 +8,5 @@ PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 [ "${NGINX_ENTRYPOINT_LOCAL_RESOLVERS:-}" ] || return 0
 
-export NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {print $2}' /etc/resolv.conf)
+NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {print $2}' /etc/resolv.conf)
+export NGINX_LOCAL_RESOLVERS
diff --git a/stable/debian/20-envsubst-on-templates.sh b/stable/debian/20-envsubst-on-templates.sh
index f3fb9fcb9c19957651bd068c484b74985d184bd1..3804165c94faeb8aecc31a5df368333be74b3d58 100755
--- a/stable/debian/20-envsubst-on-templates.sh
+++ b/stable/debian/20-envsubst-on-templates.sh
@@ -2,7 +2,7 @@
 
 set -e
 
-ME=$(basename $0)
+ME=$(basename "$0")
 
 entrypoint_log() {
     if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then
@@ -44,8 +44,8 @@ auto_envsubst() {
     return 0
   fi
   find "$template_dir" -follow -type f -name "*$suffix" -print | while read -r template; do
-    relative_path="${template#$template_dir/}"
-    output_path="$output_dir/${relative_path%$suffix}"
+    relative_path="${template#"$template_dir/"}"
+    output_path="$output_dir/${relative_path%"$suffix"}"
     subdir=$(dirname "$relative_path")
     # create a subdirectory where the template file exists
     mkdir -p "$output_dir/$subdir"
@@ -62,8 +62,8 @@ auto_envsubst() {
     fi
     add_stream_block
     find "$template_dir" -follow -type f -name "*$stream_suffix" -print | while read -r template; do
-      relative_path="${template#$template_dir/}"
-      output_path="$stream_output_dir/${relative_path%$stream_suffix}"
+      relative_path="${template#"$template_dir/"}"
+      output_path="$stream_output_dir/${relative_path%"$stream_suffix"}"
       subdir=$(dirname "$relative_path")
       # create a subdirectory where the template file exists
       mkdir -p "$stream_output_dir/$subdir"
diff --git a/stable/debian/30-tune-worker-processes.sh b/stable/debian/30-tune-worker-processes.sh
index 9aa42e98ddc752f4f7a05db7e617821cce6a04f7..defb994f3d035e9b3423543fcaf3d602f6354708 100755
--- a/stable/debian/30-tune-worker-processes.sh
+++ b/stable/debian/30-tune-worker-processes.sh
@@ -4,7 +4,7 @@
 set -eu
 
 LC_ALL=C
-ME=$( basename "$0" )
+ME=$(basename "$0")
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 [ "${NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE:-}" ] || exit 0
diff --git a/stable/debian/docker-entrypoint.sh b/stable/debian/docker-entrypoint.sh
index e201fe608452cd72679887c0f759e164754c1815..8ea04f217da809b407e87b54b3c1f88c070f1b79 100755
--- a/stable/debian/docker-entrypoint.sh
+++ b/stable/debian/docker-entrypoint.sh
@@ -9,7 +9,7 @@ entrypoint_log() {
     fi
 }
 
-if [ "$1" = "nginx" -o "$1" = "nginx-debug" ]; then
+if [ "$1" = "nginx" ] || [ "$1" = "nginx-debug" ]; then
     if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then
         entrypoint_log "$0: /docker-entrypoint.d/ is not empty, will attempt to perform configuration"