diff --git a/cmd/main.go b/cmd/main.go
index 5864257..313dfcb 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -68,5 +68,5 @@ func main() {
 	app.Commands = append(app.Commands, (&commands.Dev{}).Commands()...)
 	app.Commands = append(app.Commands, (&commands.SSH{}).Commands()...)
 
-	app.Run(os.Args)
+	app.Run(os.Args) // nolint: gosec
 }
diff --git a/commands/command.go b/commands/command.go
index f243d51..358adcf 100644
--- a/commands/command.go
+++ b/commands/command.go
@@ -29,7 +29,7 @@ func (cmd *BaseCommand) Before(c *cli.Context) error {
 	cmd.out = util.Logger()
 	cmd.machine = Machine{Name: c.GlobalString("name"), out: util.Logger()}
 
-	util.NotifyInit(fmt.Sprintf("Outrigger (rig) %s", c.App.Version))
+	util.NotifyInit(fmt.Sprintf("Outrigger (rig) %s", c.App.Version)) // nolint: gosec
 
 	// Hold onto Context so that we can use it later without having to pass it around everywhere
 	cmd.context = c
@@ -62,7 +62,7 @@ func (cmd *BaseCommand) Failure(message string, errorName string, exitCode int)
 	}
 
 	// Handle error messaging.
-	util.NotifyError(cmd.context, message)
+	util.NotifyError(cmd.context, message) // nolint: gosec
 	// Print expanded troubleshooting guidance.
 	if !cmd.context.GlobalBool("power-user") {
 		util.PrintDebugHelp(message, errorName, exitCode)
diff --git a/commands/config.go b/commands/config.go
index fcac72d..ae0feee 100644
--- a/commands/config.go
+++ b/commands/config.go
@@ -36,7 +36,7 @@ func (cmd *Config) Run(c *cli.Context) error {
 	if !util.IsMac() {
 		// Add stuff to PATH only once
 		path := os.Getenv("PATH")
-		dir, _ := util.GetExecutableDir()
+		dir, _ := util.GetExecutableDir() // nolint: gosec
 		if !strings.Contains(path, dir) {
 			fmt.Printf("export PATH=%s%c$PATH\n", dir, os.PathListSeparator)
 		}
@@ -44,13 +44,13 @@ func (cmd *Config) Run(c *cli.Context) error {
 
 	// Clear out any previous environment variables
 	if output, err := util.Command("docker-machine", "env", "-u").Output(); err == nil {
-		os.Stdout.Write(output)
+		os.Stdout.Write(output) // nolint: gosec
 	}
 
 	if cmd.machine.Exists() {
 		// Setup new values if machine is running
 		if output, err := util.Command("docker-machine", "env", cmd.machine.Name).Output(); err == nil {
-			os.Stdout.Write(output)
+			os.Stdout.Write(output) // nolint: gosec
 		}
 	} else {
 		return cmd.Failure(fmt.Sprintf("No machine named '%s' exists.", cmd.machine.Name), "MACHINE-NOT-FOUND", 12)
diff --git a/commands/dashboard.go b/commands/dashboard.go
index c471a96..fbaf3f2 100644
--- a/commands/dashboard.go
+++ b/commands/dashboard.go
@@ -65,7 +65,7 @@ func (cmd *Dashboard) LaunchDashboard(machine Machine) error {
 		cmd.out.Verbose("Successfully updated dashboard.")
 	}
 
-	dockerAPIVersion, _ := util.GetDockerServerAPIVersion()
+	dockerAPIVersion, _ := util.GetDockerServerAPIVersion() // nolint: gosec
 	args := []string{
 		"run",
 		"-d",
@@ -78,11 +78,11 @@ func (cmd *Dashboard) LaunchDashboard(machine Machine) error {
 		dashboardImageName,
 	}
 
-	util.ForceStreamCommand("docker", args...)
+	util.ForceStreamCommand("docker", args...) // nolint: gosec
 	if util.IsMac() {
-		util.Command("open", "http://dashboard.outrigger.vm").Run()
+		util.Command("open", "http://dashboard.outrigger.vm").Run() // nolint: gosec
 	} else if util.IsWindows() {
-		util.Command("start", "http://dashboard.outrigger.vm").Run()
+		util.Command("start", "http://dashboard.outrigger.vm").Run() // nolint: gosec
 	} else {
 		cmd.out.Info("Outrigger Dashboard is now available at http://dashboard.outrigger.vm")
 	}
@@ -92,6 +92,6 @@ func (cmd *Dashboard) LaunchDashboard(machine Machine) error {
 
 // StopDashboard stops and removes the dashboard container
 func (cmd *Dashboard) StopDashboard() {
-	util.Command("docker", "stop", dashboardContainerName).Run()
-	util.Command("docker", "rm", dashboardContainerName).Run()
+	util.Command("docker", "stop", dashboardContainerName).Run() // nolint: gosec
+	util.Command("docker", "rm", dashboardContainerName).Run()   // nolint: gosec
 }
diff --git a/commands/dns-records.go b/commands/dns-records.go
index 0380617..898ac45 100644
--- a/commands/dns-records.go
+++ b/commands/dns-records.go
@@ -73,7 +73,7 @@ func (cmd *DNSRecords) LoadRecords() ([]map[string]interface{}, error) {
 		return nil, fmt.Errorf("failed to parse dnsdock JSON: %s", err)
 	}
 
-	dnsdockMap, _ := js.Map()
+	dnsdockMap, _ := js.Map() // nolint: gosec
 	records := []map[string]interface{}{}
 	for id, value := range dnsdockMap {
 		record := value.(map[string]interface{})
diff --git a/commands/dns.go b/commands/dns.go
index 6770b5f..e3dce3b 100644
--- a/commands/dns.go
+++ b/commands/dns.go
@@ -74,17 +74,17 @@ func (cmd *DNS) configureMacRoutes(machine Machine) {
 	if machine.IsXhyve() {
 		cmd.removeHostFilter(machineIP)
 	}
-	util.Command("sudo", "route", "-n", "delete", "-net", "172.17.0.0").Run()
-	util.StreamCommand("sudo", "route", "-n", "add", "172.17.0.0/16", machineIP)
+	util.Command("sudo", "route", "-n", "delete", "-net", "172.17.0.0").Run()    // nolint: gosec
+	util.StreamCommand("sudo", "route", "-n", "add", "172.17.0.0/16", machineIP) // nolint: gosec
 	if _, err := os.Stat("/usr/sbin/discoveryutil"); err == nil {
 		// Put this here for people running OS X 10.10.0 to 10.10.3 (oy vey.)
 		cmd.out.Verbose("Restarting discoveryutil to flush DNS caches")
-		util.StreamCommand("sudo", "launchctl", "unload", "-w", "/System/Library/LaunchDaemons/com.apple.discoveryd.plist")
-		util.StreamCommand("sudo", "launchctl", "load", "-w", "/System/Library/LaunchDaemons/com.apple.discoveryd.plist")
+		util.StreamCommand("sudo", "launchctl", "unload", "-w", "/System/Library/LaunchDaemons/com.apple.discoveryd.plist") // nolint: gosec
+		util.StreamCommand("sudo", "launchctl", "load", "-w", "/System/Library/LaunchDaemons/com.apple.discoveryd.plist")   // nolint: gosec
 	} else {
 		// Reset DNS cache. We have seen this suddenly make /etc/resolver/vm work.
 		cmd.out.Verbose("Restarting mDNSResponder to flush DNS caches")
-		util.StreamCommand("sudo", "killall", "-HUP", "mDNSResponder")
+		util.StreamCommand("sudo", "killall", "-HUP", "mDNSResponder") // nolint: gosec
 	}
 }
 
@@ -109,13 +109,13 @@ func (cmd *DNS) removeHostFilter(ipAddr string) {
 	member := memberRegexp.FindStringSubmatch(string(ifaceData))[1]
 
 	// #4: ifconfig <bridge> -hostfilter <member>
-	util.StreamCommand("sudo", "ifconfig", iface, "-hostfilter", member)
+	util.StreamCommand("sudo", "ifconfig", iface, "-hostfilter", member) // nolint: gosec
 }
 
 // ConfigureWindowsRoutes configures network routing
 func (cmd *DNS) configureWindowsRoutes(machine Machine) {
-	util.Command("runas", "/noprofile", "/user:Administrator", "route", "DELETE", "172.17.0.0").Run()
-	util.StreamCommand("runas", "/noprofile", "/user:Administrator", "route", "-p", "ADD", "172.17.0.0/16", machine.GetIP())
+	util.Command("runas", "/noprofile", "/user:Administrator", "route", "DELETE", "172.17.0.0").Run()                        // nolint: gosec
+	util.StreamCommand("runas", "/noprofile", "/user:Administrator", "route", "-p", "ADD", "172.17.0.0/16", machine.GetIP()) // nolint: gosec
 }
 
 // StartDNS will start the dnsdock service
@@ -152,7 +152,7 @@ func (cmd *DNS) StartDNS(machine Machine, nameservers string) error {
 		args = append(args, "--nameserver="+server)
 	}
 
-	util.StreamCommand("docker", args...)
+	util.StreamCommand("docker", args...) // nolint: gosec
 	// Configure the resolvers based on platform
 	var resolverReturn error
 	if util.IsMac() {
@@ -181,12 +181,12 @@ func (cmd *DNS) configureMacResolver(machine Machine) error {
 	if _, err := os.Stat("/usr/sbin/discoveryutil"); err == nil {
 		// Put this here for people running OS X 10.10.0 to 10.10.3 (oy vey.)
 		cmd.out.Verbose("Restarting discoveryutil to flush DNS caches")
-		util.StreamCommand("sudo", "launchctl", "unload", "-w", "/System/Library/LaunchDaemons/com.apple.discoveryd.plist")
-		util.StreamCommand("sudo", "launchctl", "load", "-w", "/System/Library/LaunchDaemons/com.apple.discoveryd.plist")
+		util.StreamCommand("sudo", "launchctl", "unload", "-w", "/System/Library/LaunchDaemons/com.apple.discoveryd.plist") // nolint: gosec
+		util.StreamCommand("sudo", "launchctl", "load", "-w", "/System/Library/LaunchDaemons/com.apple.discoveryd.plist")   // nolint: gosec
 	} else {
 		// Reset DNS cache. We have seen this suddenly make /etc/resolver/vm work.
 		cmd.out.Verbose("Restarting mDNSResponder to flush DNS caches")
-		util.StreamCommand("sudo", "killall", "-HUP", "mDNSResponder")
+		util.StreamCommand("sudo", "killall", "-HUP", "mDNSResponder") // nolint: gosec
 	}
 	return nil
 }
@@ -202,18 +202,18 @@ func (cmd *DNS) configureLinuxResolver() error {
 	// Is NetworkManager in use
 	if _, err := os.Stat("/etc/NetworkManager/dnsmasq.d"); err == nil {
 		// Install for NetworkManager/dnsmasq connection to dnsdock
-		util.StreamCommand("bash", "-c", fmt.Sprintf("echo 'server=/vm/%s' | sudo tee /etc/NetworkManager/dnsmasq.d/dnsdock.conf", bridgeIP))
+		util.StreamCommand("bash", "-c", fmt.Sprintf("echo 'server=/vm/%s' | sudo tee /etc/NetworkManager/dnsmasq.d/dnsdock.conf", bridgeIP)) // nolint: gosec
 
 		// Restart NetworkManager if it is running
 		if err := util.Command("systemctl", "is-active", "NetworkManager").Run(); err != nil {
-			util.StreamCommand("sudo", "systemctl", "restart", "NetworkManager")
+			util.StreamCommand("sudo", "systemctl", "restart", "NetworkManager") // nolint: gosec
 		}
 	}
 
 	// Is libnss-resolver in use
 	if _, err := os.Stat("/etc/resolver"); err == nil {
 		// Install for libnss-resolver connection to dnsdock
-		util.Command("bash", "-c", fmt.Sprintf("echo 'nameserver %s:53' | sudo tee /etc/resolver/vm", bridgeIP)).Run()
+		util.Command("bash", "-c", fmt.Sprintf("echo 'nameserver %s:53' | sudo tee /etc/resolver/vm", bridgeIP)).Run() // nolint: gosec
 	}
 
 	return nil
@@ -228,6 +228,6 @@ func (cmd *DNS) configureWindowsResolver(machine Machine) error {
 
 // StopDNS stops the dnsdock service and cleans up
 func (cmd *DNS) StopDNS() {
-	util.Command("docker", "stop", "dnsdock").Run()
-	util.Command("docker", "rm", "dnsdock").Run()
+	util.Command("docker", "stop", "dnsdock").Run() // nolint: gosec
+	util.Command("docker", "rm", "dnsdock").Run()   // nolint: gosec
 }
diff --git a/commands/doctor.go b/commands/doctor.go
index 7c4ef1a..3a32aac 100644
--- a/commands/doctor.go
+++ b/commands/doctor.go
@@ -105,7 +105,7 @@ func (cmd *Doctor) Run(c *cli.Context) error {
 	cmd.out.Spin("Checking Docker version...")
 	clientAPIVersion := util.GetDockerClientAPIVersion()
 	serverAPIVersion, err := util.GetDockerServerAPIVersion()
-	serverMinAPIVersion, _ := util.GetDockerServerMinAPIVersion()
+	serverMinAPIVersion, _ := util.GetDockerServerMinAPIVersion() // nolint: gosec
 
 	// Older clients can talk to newer servers, and when you ask a newer server
 	// it's version in the presence of an older server it will downgrade it's
@@ -116,7 +116,7 @@ func (cmd *Doctor) Run(c *cli.Context) error {
 	if serverMinAPIVersion != nil {
 		constraintString = fmt.Sprintf(">= %s", serverMinAPIVersion)
 	}
-	apiConstraint, _ := version.NewConstraint(constraintString)
+	apiConstraint, _ := version.NewConstraint(constraintString) // nolint: gosec
 
 	if err != nil {
 		cmd.out.Error("Could not determine Docker Machine Docker versions: ", err)
diff --git a/commands/kill.go b/commands/kill.go
index 1bcd2d6..8cb59f5 100644
--- a/commands/kill.go
+++ b/commands/kill.go
@@ -41,13 +41,13 @@ func (cmd *Kill) Run(c *cli.Context) error {
 	}
 
 	cmd.out.Spin(fmt.Sprintf("Killing machine '%s'...", cmd.machine.Name))
-	util.StreamCommand("docker-machine", "kill", cmd.machine.Name)
+	util.StreamCommand("docker-machine", "kill", cmd.machine.Name) // nolint: gosec
 
 	// Ensure the underlying virtualization has stopped
 	driver := cmd.machine.GetDriver()
 	switch driver {
 	case util.VirtualBox:
-		util.StreamCommand("controlvm", cmd.machine.Name, "poweroff")
+		util.StreamCommand("controlvm", cmd.machine.Name, "poweroff") // nolint: gosec
 	case util.VMWare:
 		cmd.out.Warning("Add vmrun suspend command.")
 	case util.Xhyve:
diff --git a/commands/machine.go b/commands/machine.go
index 967dd56..a2c93ae 100644
--- a/commands/machine.go
+++ b/commands/machine.go
@@ -21,10 +21,13 @@ type Machine struct {
 }
 
 // Create will generate a new Docker Machine configured according to user specification
-func (m *Machine) Create(driver string, cpuCount string, memSize string, diskSize string) error {
+func (m *Machine) Create(driver string, cpuCount string, memSize string, diskSize string, isoURL string) error {
 	m.out.Info("Creating a %s machine named '%s' with CPU(%s) MEM(%s) DISK(%s)...", driver, m.Name, cpuCount, memSize, diskSize)
 
-	boot2dockerURL := "https://github.com/boot2docker/boot2docker/releases/download/v" + util.GetRawCurrentDockerVersion() + "/boot2docker.iso"
+	boot2dockerURL := isoURL
+	if boot2dockerURL == "" {
+		boot2dockerURL = "https://github.com/boot2docker/boot2docker/releases/download/v" + util.GetRawCurrentDockerVersion() + "/boot2docker.iso"
+	}
 
 	var create util.Executor
 
@@ -144,19 +147,19 @@ func (m *Machine) SetEnv() {
 		if js.Get("HostOptions").Get("EngineOptions").Get("TlsVerify").MustBool() {
 			tlsVerify = 1
 		}
-		os.Setenv("DOCKER_TLS_VERIFY", fmt.Sprintf("%d", tlsVerify))
-		os.Setenv("DOCKER_HOST", fmt.Sprintf("tcp://%s:2376", js.Get("Driver").Get("IPAddress").MustString()))
-		os.Setenv("DOCKER_MACHINE_NAME", js.Get("Driver").Get("MachineName").MustString())
-		os.Setenv("DOCKER_CERT_PATH", js.Get("HostOptions").Get("AuthOptions").Get("StorePath").MustString())
+		os.Setenv("DOCKER_TLS_VERIFY", fmt.Sprintf("%d", tlsVerify))                                           // nolint: gosec
+		os.Setenv("DOCKER_HOST", fmt.Sprintf("tcp://%s:2376", js.Get("Driver").Get("IPAddress").MustString())) // nolint: gosec
+		os.Setenv("DOCKER_MACHINE_NAME", js.Get("Driver").Get("MachineName").MustString())                     // nolint: gosec
+		os.Setenv("DOCKER_CERT_PATH", js.Get("HostOptions").Get("AuthOptions").Get("StorePath").MustString())  // nolint: gosec
 	}
 }
 
 // UnsetEnv will remove the Docker proxy variables
 func (m *Machine) UnsetEnv() {
-	os.Unsetenv("DOCKER_TLS_VERIFY")
-	os.Unsetenv("DOCKER_HOST")
-	os.Unsetenv("DOCKER_CERT_PATH")
-	os.Unsetenv("DOCKER_MACHINE_NAME")
+	os.Unsetenv("DOCKER_TLS_VERIFY")   // nolint: gosec
+	os.Unsetenv("DOCKER_HOST")         // nolint: gosec
+	os.Unsetenv("DOCKER_CERT_PATH")    // nolint: gosec
+	os.Unsetenv("DOCKER_MACHINE_NAME") // nolint: gosec
 }
 
 // Exists determines if the Docker Machine exist
diff --git a/commands/project_config.go b/commands/project_config.go
index d81123b..941e366 100644
--- a/commands/project_config.go
+++ b/commands/project_config.go
@@ -44,7 +44,7 @@ func NewProjectConfig() *ProjectConfig {
 	projectConfigFile := os.Getenv("RIG_PROJECT_CONFIG_FILE")
 
 	if projectConfigFile == "" {
-		projectConfigFile, _ = FindProjectConfigFilePath()
+		projectConfigFile, _ = FindProjectConfigFilePath() // nolint: gosec
 	}
 
 	if projectConfigFile != "" {
@@ -83,7 +83,7 @@ func FindProjectConfigFilePath() (string, error) {
 // nolint: gocyclo
 func NewProjectConfigFromFile(filename string) (*ProjectConfig, error) {
 	logger := util.Logger()
-	filepath, _ := filepath.Abs(filename)
+	filepath, _ := filepath.Abs(filename) // nolint: gosec
 	config := &ProjectConfig{
 		File: filename,
 		Path: filepath,
diff --git a/commands/project_script.go b/commands/project_script.go
index d33053a..8194601 100644
--- a/commands/project_script.go
+++ b/commands/project_script.go
@@ -90,6 +90,6 @@ func (p *ProjectScript) addCommandPath() {
 	if binDir != "" {
 		p.out.Verbose("Adding project bin directory to $PATH: %s", binDir)
 		path := os.Getenv("PATH")
-		os.Setenv("PATH", fmt.Sprintf("%s%c%s", binDir, os.PathListSeparator, path))
+		os.Setenv("PATH", fmt.Sprintf("%s%c%s", binDir, os.PathListSeparator, path)) // nolint: gosec
 	}
 }
diff --git a/commands/project_sync.go b/commands/project_sync.go
index 389fbcd..1129314 100644
--- a/commands/project_sync.go
+++ b/commands/project_sync.go
@@ -314,7 +314,7 @@ func (cmd *ProjectSync) StartUnisonSync(ctx *cli.Context, volumeName string, con
 
 	// Ensure the processes can handle a large number of watches
 	if err := cmd.machine.SetSysctl("fs.inotify.max_user_watches", maxWatches); err != nil {
-		cmd.Failure(fmt.Sprintf("Failure configuring file watches on Docker Machine: %v", err), "INOTIFY-WATCH-FAILURE", 12)
+		cmd.Failure(fmt.Sprintf("Failure configuring file watches on Docker Machine: %v", err), "INOTIFY-WATCH-FAILURE", 12) // nolint: gosec
 	}
 
 	cmd.out.SpinWithVerbose("Starting sync volume: %s", volumeName)
@@ -326,7 +326,7 @@ func (cmd *ProjectSync) StartUnisonSync(ctx *cli.Context, volumeName string, con
 	unisonMinorVersion := util.GetUnisonMinorVersion()
 
 	cmd.out.Verbose("Local Unison version for compatibility: %s", unisonMinorVersion)
-	util.Command("docker", "container", "stop", volumeName).Run()
+	util.Command("docker", "container", "stop", volumeName).Run() // nolint: gosec
 	containerArgs := []string{
 		"container", "run", "--detach", "--rm",
 		"-v", fmt.Sprintf("%s:/unison", volumeName),
@@ -337,7 +337,7 @@ func (cmd *ProjectSync) StartUnisonSync(ctx *cli.Context, volumeName string, con
 		fmt.Sprintf("outrigger/unison:%s", unisonMinorVersion),
 	}
 	if err := util.Command("docker", containerArgs...).Run(); err != nil {
-		cmd.Failure(fmt.Sprintf("Failure starting sync container %s: %v", volumeName, err), "SYNC-CONTAINER-START-FAILED", 13)
+		cmd.Failure(fmt.Sprintf("Failure starting sync container %s: %v", volumeName, err), "SYNC-CONTAINER-START-FAILED", 13) // nolint: gosec
 	}
 
 	ip, err := cmd.WaitForUnisonContainer(volumeName, ctx.Int("initial-sync-timeout"))
@@ -393,7 +393,7 @@ func (cmd *ProjectSync) StartUnisonSync(ctx *cli.Context, volumeName string, con
 // SetupBindVolume will create minimal Docker Volumes for systems that have native container/volume support
 func (cmd *ProjectSync) SetupBindVolume(volumeName string, workingDir string) error {
 	cmd.out.SpinWithVerbose("Starting local bind volume: %s", volumeName)
-	util.Command("docker", "volume", "rm", volumeName).Run()
+	util.Command("docker", "volume", "rm", volumeName).Run() // nolint: gosec
 
 	volumeArgs := []string{
 		"volume", "create",
@@ -476,7 +476,7 @@ func (cmd *ProjectSync) WaitForUnisonContainer(containerName string, timeoutSeco
 		cmd.out.Verbose("Attempt #%d...", i)
 		conn, err := net.Dial("tcp", fmt.Sprintf("%s:%d", ip, unisonPort))
 		if err == nil {
-			conn.Close()
+			conn.Close() // nolint: gosec
 			cmd.out.Verbose("Connected to unison on %s", containerName)
 			return ip, nil
 		}
diff --git a/commands/start.go b/commands/start.go
index d200be1..34a66a2 100644
--- a/commands/start.go
+++ b/commands/start.go
@@ -40,6 +40,10 @@ func (cmd *Start) Commands() []cli.Command {
 					Value: 2,
 					Usage: "Number of CPU to allocate to the VM. Defaults to 2. Only used if start needs to create a machine.",
 				},
+				cli.StringFlag{
+					Name:  "boot2docker-url",
+					Usage: "Fully qualified URL for a specific boot2docker ISO.",
+				},
 				cli.StringFlag{
 					Name:   "nameservers",
 					Value:  "8.8.8.8:53",
@@ -82,7 +86,8 @@ func (cmd *Start) Run(c *cli.Context) error {
 		diskSize := strconv.Itoa(c.Int("disk-size") * 1000)
 		memSize := strconv.Itoa(c.Int("memory-size"))
 		cpuCount := strconv.Itoa(c.Int("cpu-count"))
-		cmd.machine.Create(driver, cpuCount, memSize, diskSize)
+		isoURL := c.String("boot2docker-url")
+		cmd.machine.Create(driver, cpuCount, memSize, diskSize, isoURL) // nolint: gosec
 	}
 
 	if err := cmd.machine.Start(); err != nil {
@@ -95,7 +100,7 @@ func (cmd *Start) Run(c *cli.Context) error {
 	cmd.out.Info("Docker Machine (%s) Created", cmd.machine.Name)
 
 	dns := DNS{cmd.BaseCommand}
-	dns.StartDNS(cmd.machine, c.String("nameservers"))
+	dns.StartDNS(cmd.machine, c.String("nameservers")) // nolint: gosec
 
 	// NFS mounts are Mac-only.
 	if util.IsMac() {
@@ -142,7 +147,7 @@ func (cmd *Start) Run(c *cli.Context) error {
 
 	cmd.out.Spin("Launching Dashboard...")
 	dash := Dashboard{cmd.BaseCommand}
-	dash.LaunchDashboard(cmd.machine)
+	dash.LaunchDashboard(cmd.machine) // nolint: gosec
 	cmd.out.Info("Dashboard is ready")
 
 	// Check for availability of a rig upgrade
@@ -159,10 +164,10 @@ func (cmd *Start) Run(c *cli.Context) error {
 // a virtual machine and networking is not required or managed by Outrigger.
 func (cmd *Start) StartMinimal(nameservers string) error {
 	dns := DNS{cmd.BaseCommand}
-	dns.StartDNS(cmd.machine, nameservers)
+	dns.StartDNS(cmd.machine, nameservers) // nolint: gosec
 
 	dash := Dashboard{cmd.BaseCommand}
-	dash.LaunchDashboard(cmd.machine)
+	dash.LaunchDashboard(cmd.machine) // nolint: gosec
 
 	return cmd.Success("Outrigger services started")
 }
diff --git a/commands/status.go b/commands/status.go
index 805641e..12a38a2 100644
--- a/commands/status.go
+++ b/commands/status.go
@@ -37,10 +37,10 @@ func (cmd *Status) Run(c *cli.Context) error {
 	}
 
 	if cmd.out.IsVerbose {
-		util.StreamCommand("docker-machine", "ls", "--filter", "name="+cmd.machine.Name)
+		util.StreamCommand("docker-machine", "ls", "--filter", "name="+cmd.machine.Name) // nolint: gosec
 	} else {
-		output, _ := util.Command("docker-machine", "status", cmd.machine.Name).CombinedOutput()
-		os.Stdout.Write(output)
+		output, _ := util.Command("docker-machine", "status", cmd.machine.Name).CombinedOutput() // nolint: gosec
+		os.Stdout.Write(output)                                                                  // nolint: gosec
 	}
 
 	return cmd.Success("")
diff --git a/commands/stop.go b/commands/stop.go
index 31fde50..aa6e9ab 100644
--- a/commands/stop.go
+++ b/commands/stop.go
@@ -59,12 +59,12 @@ func (cmd *Stop) StopOutrigger() error {
 
 	cmd.out.Spin("Cleaning up local networking...")
 	if util.IsWindows() {
-		util.Command("runas", "/noprofile", "/user:Administrator", "route", "DELETE", "172.17.0.0").Run()
-		util.Command("runas", "/noprofile", "/user:Administrator", "route", "DELETE", "172.17.42.1").Run()
+		util.Command("runas", "/noprofile", "/user:Administrator", "route", "DELETE", "172.17.0.0").Run()  // nolint: gosec
+		util.Command("runas", "/noprofile", "/user:Administrator", "route", "DELETE", "172.17.42.1").Run() // nolint: gosec
 	} else {
-		util.EscalatePrivilege()
-		util.Command("sudo", "route", "-n", "delete", "-net", "172.17.0.0").Run()
-		util.Command("sudo", "route", "-n", "delete", "-net", "172.17.42.1").Run()
+		util.EscalatePrivilege()                                                   // nolint: gosec
+		util.Command("sudo", "route", "-n", "delete", "-net", "172.17.0.0").Run()  // nolint: gosec
+		util.Command("sudo", "route", "-n", "delete", "-net", "172.17.42.1").Run() // nolint: gosec
 	}
 	cmd.out.Info("Networking cleanup completed")
 
diff --git a/util/docker.go b/util/docker.go
index 8494d19..03a9da5 100644
--- a/util/docker.go
+++ b/util/docker.go
@@ -12,7 +12,7 @@ import (
 
 // GetRawCurrentDockerVersion returns the entire semver string from the docker version cli
 func GetRawCurrentDockerVersion() string {
-	output, _ := Command("docker", "--version").Output()
+	output, _ := Command("docker", "--version").Output() // nolint: gosec
 	re := regexp.MustCompile("Docker version (.*),")
 	return re.FindAllStringSubmatch(string(output), -1)[0][1]
 }
@@ -25,7 +25,7 @@ func GetCurrentDockerVersion() *version.Version {
 
 // GetDockerClientAPIVersion returns a Version for the docker client API version
 func GetDockerClientAPIVersion() *version.Version {
-	output, _ := Command("docker", "version", "--format", "{{.Client.APIVersion}}").Output()
+	output, _ := Command("docker", "version", "--format", "{{.Client.APIVersion}}").Output() // nolint: gosec
 	re := regexp.MustCompile(`^([\d|\.]+)`)
 	versionNumber := re.FindAllStringSubmatch(string(output), -1)[0][1]
 	return version.Must(version.NewVersion(versionNumber))
diff --git a/util/filesystem.go b/util/filesystem.go
index 5bc4b2f..a44e3c0 100644
--- a/util/filesystem.go
+++ b/util/filesystem.go
@@ -88,6 +88,6 @@ func TouchFile(pathToFile string, workingDir string) error {
 	}
 	// Not checking for an error here because we are not very currently concerned
 	// with file descriptor leaks
-	f.Close()
+	f.Close() // nolint: gosec
 	return nil
 }
diff --git a/util/help.go b/util/help.go
index add5b48..2c88b89 100644
--- a/util/help.go
+++ b/util/help.go
@@ -102,9 +102,9 @@ func StringPad(s string, pad string, size int) string {
 		delta := size - length
 		iterations := delta / padLength
 
-		buffer.WriteString(s)
+		buffer.WriteString(s) // nolint: gosec
 		for i := 0; i <= iterations; i += padLength {
-			buffer.WriteString(pad)
+			buffer.WriteString(pad) // nolint: gosec
 		}
 
 		return buffer.String()
diff --git a/util/logger.go b/util/logger.go
index 5f3e5fe..9150c28 100644
--- a/util/logger.go
+++ b/util/logger.go
@@ -39,7 +39,7 @@ type RigSpinner struct {
 
 // LoggerInit initializes the global logger
 func LoggerInit(verbose bool) {
-	s, _ := spun.NewSpinner(spun.Dots)
+	s, _ := spun.NewSpinner(spun.Dots) // nolint: gosec
 	logger = &RigLogger{
 		Channel: logChannels{
 			Info:    log.New(os.Stdout, color.BlueString("[INFO] "), 0),
@@ -87,7 +87,7 @@ func (log *RigLogger) SetVerbose(verbose bool) {
 // Spin restarts the spinner for a new task.
 func (log *RigLogger) Spin(message string) {
 	if !log.IsVerbose {
-		log.Progress.Spins.Start(message)
+		log.Progress.Spins.Start(message) // nolint: gosec
 		log.Spinning = true
 	}
 }
@@ -102,7 +102,7 @@ func (log *RigLogger) SpinWithVerbose(message string, a ...interface{}) {
 
 // NoSpin stops the Progress spinner.
 func (log *RigLogger) NoSpin() {
-	log.Progress.Spins.Stop()
+	log.Progress.Spins.Stop() // nolint: gosec
 	log.Spinning = false
 }
 
@@ -112,7 +112,7 @@ func (log *RigLogger) Info(format string, a ...interface{}) {
 		log.Channel.Info.Println(fmt.Sprintf(format, a...))
 	} else {
 		log.Progress.Spins.SetMessage(fmt.Sprintf(format, a...))
-		log.Progress.Spins.Succeed()
+		log.Progress.Spins.Succeed() // nolint: gosec
 		log.Spinning = false
 	}
 }
@@ -123,7 +123,7 @@ func (log *RigLogger) Warning(format string, a ...interface{}) {
 		log.Channel.Warning.Println(fmt.Sprintf(format, a...))
 	} else {
 		log.Progress.Spins.SetMessage(fmt.Sprintf(format, a...))
-		log.Progress.Spins.Warn()
+		log.Progress.Spins.Warn() // nolint: gosec
 		log.Spinning = false
 	}
 }
@@ -139,7 +139,7 @@ func (log *RigLogger) Error(format string, a ...interface{}) {
 		log.Channel.Error.Println(fmt.Sprintf(format, a...))
 	} else {
 		log.Progress.Spins.SetMessage(fmt.Sprintf(format, a...))
-		log.Progress.Spins.Fail()
+		log.Progress.Spins.Fail() // nolint: gosec
 		log.Spinning = false
 	}
 }
diff --git a/util/unison.go b/util/unison.go
index 693de6b..4e3e04d 100644
--- a/util/unison.go
+++ b/util/unison.go
@@ -10,7 +10,7 @@ import (
 // GetUnisonMinorVersion will return the local Unison version to try to load a compatible unison image
 // This function discovers a semver like 2.48.4 and return 2.48
 func GetUnisonMinorVersion() string {
-	output, _ := Command("unison", "-version").Output()
+	output, _ := Command("unison", "-version").Output() // nolint: gosec
 	re := regexp.MustCompile(`unison version (\d+\.\d+\.\d+)`)
 	rawVersion := re.FindAllStringSubmatch(string(output), -1)[0][1]
 	v := version.Must(version.NewVersion(rawVersion))