diff --git a/elements/apt-conf/extra-data.d/99-override-default-apt-conf b/elements/apt-conf/extra-data.d/99-override-default-apt-conf
index 662b618bd..02df80cea 100755
--- a/elements/apt-conf/extra-data.d/99-override-default-apt-conf
+++ b/elements/apt-conf/extra-data.d/99-override-default-apt-conf
@@ -2,6 +2,7 @@
 # Override the default /etc/apt/apt.conf with $DIB_APT_CONF
 
 set -ue
+set -o pipefail
 
 # exit directly if DIB_APT_CONF is not defined properly
 if [ -z "${DIB_APT_CONF:-}" ] ; then
diff --git a/elements/apt-sources/extra-data.d/99-override-default-apt-sources b/elements/apt-sources/extra-data.d/99-override-default-apt-sources
index e89cd5f97..0c8ae1854 100755
--- a/elements/apt-sources/extra-data.d/99-override-default-apt-sources
+++ b/elements/apt-sources/extra-data.d/99-override-default-apt-sources
@@ -1,7 +1,8 @@
 #!/bin/bash
 # Override the default /etc/apt/sources.list with $DIB_APT_SOURCES
 
-set -e
+set -eu
+set -o pipefail
 
 # exit directly if DIB_APT_SOURCES is not defined properly
 if [ -z "$DIB_APT_SOURCES" ] ; then
diff --git a/elements/baremetal/cleanup.d/99-extract-kernel-and-ramdisk b/elements/baremetal/cleanup.d/99-extract-kernel-and-ramdisk
index 2622ae7f7..6c136577b 100755
--- a/elements/baremetal/cleanup.d/99-extract-kernel-and-ramdisk
+++ b/elements/baremetal/cleanup.d/99-extract-kernel-and-ramdisk
@@ -14,7 +14,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-set -e
+set -eu
+set -o pipefail
 
 [ -n "$TARGET_ROOT" ]
 
diff --git a/elements/base/cleanup.d/01-ccache b/elements/base/cleanup.d/01-ccache
index fd23437a8..543736e15 100755
--- a/elements/base/cleanup.d/01-ccache
+++ b/elements/base/cleanup.d/01-ccache
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 # As this is run in cleanup, it's already been automatically unmounted,
 # so all we need to do here is remove the directory
diff --git a/elements/base/dib-first-boot b/elements/base/dib-first-boot
index 1e39860b1..7d9e2f98d 100755
--- a/elements/base/dib-first-boot
+++ b/elements/base/dib-first-boot
@@ -1,5 +1,6 @@
 #!/bin/bash
-set -e
+set -eu
+set -o pipefail
 set -o xtrace
 
 touch /var/log/first-boot.d.log
diff --git a/elements/base/dib-init-system b/elements/base/dib-init-system
index 88cf5faeb..3338f87e8 100755
--- a/elements/base/dib-init-system
+++ b/elements/base/dib-init-system
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 set -eu
+set -o pipefail
 
 if [ -f /sbin/initctl ]; then
     echo "upstart"
diff --git a/elements/base/extra-data.d/50-store-build-settings b/elements/base/extra-data.d/50-store-build-settings
index 09ed73d66..20b50a3eb 100755
--- a/elements/base/extra-data.d/50-store-build-settings
+++ b/elements/base/extra-data.d/50-store-build-settings
@@ -1,7 +1,9 @@
 #!/bin/bash
 # Store the build-time environment and command line arguments
 
-set -e
+set -eu
+set -o pipefail
+
 source $_LIB/die
 [ -n "$TMP_HOOKS_PATH" ] || die "Temp hook path not set"
 
diff --git a/elements/base/extra-data.d/99-enable-install-types b/elements/base/extra-data.d/99-enable-install-types
index 2b5c262a4..8fdae7ed1 100755
--- a/elements/base/extra-data.d/99-enable-install-types
+++ b/elements/base/extra-data.d/99-enable-install-types
@@ -15,6 +15,7 @@
 
 
 set -eux
+set -o pipefail
 
 declare -a SPECIFIED_ELEMS
 
diff --git a/elements/base/finalise.d/01-install-dib-first-boot b/elements/base/finalise.d/01-install-dib-first-boot
index 39e544d43..37bac7371 100755
--- a/elements/base/finalise.d/01-install-dib-first-boot
+++ b/elements/base/finalise.d/01-install-dib-first-boot
@@ -1,5 +1,6 @@
 #!/bin/bash
-set -e
+set -eu
+set -o pipefail
 
 if [ -d /etc/first-boot.d ]; then
     install -m 0755 -o root -g root $(dirname $0)/../dib-first-boot /usr/sbin/
diff --git a/elements/base/install.d/00-baseline-environment b/elements/base/install.d/00-baseline-environment
index 13b28df5f..449f50964 100755
--- a/elements/base/install.d/00-baseline-environment
+++ b/elements/base/install.d/00-baseline-environment
@@ -1,6 +1,7 @@
 #!/bin/bash
 # These are useful, or at worst not harmful, for all images we build.
 
-set -e
+set -eu
+set -o pipefail
 
 install-packages vlan open-iscsi
diff --git a/elements/base/install.d/10-cloud-init b/elements/base/install.d/10-cloud-init
index f4eefa67d..17b1c4b80 100755
--- a/elements/base/install.d/10-cloud-init
+++ b/elements/base/install.d/10-cloud-init
@@ -1,7 +1,8 @@
 #!/bin/bash
 # Tweak the stock ubuntu cloud-init config
 
-set -e
+set -eu
+set -o pipefail
 
 dd of=/etc/cloud/cloud.cfg.d/10_etc_hosts.cfg << EOF
 manage_etc_hosts: True
diff --git a/elements/base/install.d/50-store-build-settings b/elements/base/install.d/50-store-build-settings
index bb2679127..8c11aa38a 100755
--- a/elements/base/install.d/50-store-build-settings
+++ b/elements/base/install.d/50-store-build-settings
@@ -1,7 +1,8 @@
 #!/bin/bash
 # Store build-time environment and command line arguments
 
-set -e
+set -eu
+set -o pipefail
 
 if [ -e "/tmp/in_target.d/dib_environment" ]; then
   cp /tmp/in_target.d/dib_environment /etc/
diff --git a/elements/base/pre-install.d/03-baseline-tools b/elements/base/pre-install.d/03-baseline-tools
index d2bcd6c03..39361da38 100755
--- a/elements/base/pre-install.d/03-baseline-tools
+++ b/elements/base/pre-install.d/03-baseline-tools
@@ -1,7 +1,8 @@
 #!/bin/bash
 # Install baseline packages and tools.
 
-set -e
+set -eu
+set -o pipefail
 
 # If lsb_release is missing, just do nothing.
 DISTRO=`lsb_release -si` || true
diff --git a/elements/base/pre-install.d/04-dib-init-system b/elements/base/pre-install.d/04-dib-init-system
index 54ea25876..aea564b28 100755
--- a/elements/base/pre-install.d/04-dib-init-system
+++ b/elements/base/pre-install.d/04-dib-init-system
@@ -1,5 +1,6 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 install -m 0755 -o root -g root $(dirname $0)/../dib-init-system /usr/bin/
diff --git a/elements/base/root.d/01-ccache b/elements/base/root.d/01-ccache
index 2bad46469..67b7e250f 100755
--- a/elements/base/root.d/01-ccache
+++ b/elements/base/root.d/01-ccache
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 # Don't do anything if already mounted (if disk-image-create is invoked with
 # no elements specified, this hook actually fires twice, once during
diff --git a/elements/cache-url/bin/cache-url b/elements/cache-url/bin/cache-url
index 37aff537f..f37e3212d 100755
--- a/elements/cache-url/bin/cache-url
+++ b/elements/cache-url/bin/cache-url
@@ -15,7 +15,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-set -e
+set -eu
+set -o pipefail
 
 # Download a URL to a local cache
 # e.g. cache-url http://.../foo ~/.cache/image-create/foo
diff --git a/elements/debian-systemd/root.d/05-debian-systemd b/elements/debian-systemd/root.d/05-debian-systemd
index 0a37a3067..3cafeb104 100755
--- a/elements/debian-systemd/root.d/05-debian-systemd
+++ b/elements/debian-systemd/root.d/05-debian-systemd
@@ -1,5 +1,6 @@
 #!/bin/bash
 set -eux
+set -o pipefail
 cat > ${TARGET_ROOT}/.extra_settings << EOF
 DIB_DEBIAN_ALT_INIT_PACKAGE=systemd-sysv
 EOF
diff --git a/elements/debian-upstart/root.d/05-debian-upstart b/elements/debian-upstart/root.d/05-debian-upstart
index 32eb199bb..e400af32a 100755
--- a/elements/debian-upstart/root.d/05-debian-upstart
+++ b/elements/debian-upstart/root.d/05-debian-upstart
@@ -1,5 +1,7 @@
 #!/bin/bash
 set -eux
+set -o pipefail
+
 cat > ${TARGET_ROOT}/.extra_settings << EOF
 DIB_DEBIAN_ALT_INIT_PACKAGE=upstart
 EOF
diff --git a/elements/debian-upstart/root.d/20-debian-fix-upstart-jobs b/elements/debian-upstart/root.d/20-debian-fix-upstart-jobs
index 1ea1eb4bf..877a7c14f 100755
--- a/elements/debian-upstart/root.d/20-debian-fix-upstart-jobs
+++ b/elements/debian-upstart/root.d/20-debian-fix-upstart-jobs
@@ -1,5 +1,6 @@
 #!/bin/bash
 set -eux
+set -o pipefail
 # Working around bug in Debian cloud-init packages with upstart
 # where startpar will wait forever for these because they are tasks
 # http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=735204
diff --git a/elements/debian/root.d/08-debootstrap b/elements/debian/root.d/08-debootstrap
index 5170a70b7..ca9fa89eb 100755
--- a/elements/debian/root.d/08-debootstrap
+++ b/elements/debian/root.d/08-debootstrap
@@ -15,6 +15,7 @@
 # under the License.
 #
 set -eu
+set -o pipefail
 if [ -f ${TARGET_ROOT}/.extra_settings ] ; then
     . ${TARGET_ROOT}/.extra_settings
 fi
diff --git a/elements/dhcp-all-interfaces/install.d/dhcp-all-interfaces.sh b/elements/dhcp-all-interfaces/install.d/dhcp-all-interfaces.sh
index 37a324b47..0c9b7a775 100755
--- a/elements/dhcp-all-interfaces/install.d/dhcp-all-interfaces.sh
+++ b/elements/dhcp-all-interfaces/install.d/dhcp-all-interfaces.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 INTERFACE=${1:-} #optional, if not specified configure all available interfaces
 ENI_FILE="/etc/network/interfaces"
@@ -68,7 +69,7 @@ function config_exists() {
             return 0
         fi
     else
-        ifquery $interface >/dev/null 2>&1 && return 0
+        ifquery $interface >/dev/null 2>&1 && return 0 || return 1
     fi
     return 1
 }
diff --git a/elements/dib-run-parts/bin/dib-run-parts b/elements/dib-run-parts/bin/dib-run-parts
index c2028a7dd..c2a4e5e4e 100755
--- a/elements/dib-run-parts/bin/dib-run-parts
+++ b/elements/dib-run-parts/bin/dib-run-parts
@@ -19,6 +19,7 @@ allowed_regex=${RUN_PARTS_REGEX:-"^[0-9A-Za-z_-]+$"}
 show_list=
 
 set -ue
+set -o pipefail
 
 name=$(basename $0)
 
diff --git a/elements/dib-run-parts/root.d/90-base-dib-run-parts b/elements/dib-run-parts/root.d/90-base-dib-run-parts
index 7d5028572..98d52b9bd 100755
--- a/elements/dib-run-parts/root.d/90-base-dib-run-parts
+++ b/elements/dib-run-parts/root.d/90-base-dib-run-parts
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -e
+set -eu
 set -o pipefail
 
 home=$(dirname $0)
diff --git a/elements/dpkg/bin/install-packages b/elements/dpkg/bin/install-packages
index 800ce37ff..285bf267a 100755
--- a/elements/dpkg/bin/install-packages
+++ b/elements/dpkg/bin/install-packages
@@ -14,7 +14,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-set -e
+set -eu
+set -o pipefail
 
 # install-packages package [package ...]
 
diff --git a/elements/dpkg/cleanup.d/40-unblock-daemons b/elements/dpkg/cleanup.d/40-unblock-daemons
index 7d50f1f49..b9712fd36 100755
--- a/elements/dpkg/cleanup.d/40-unblock-daemons
+++ b/elements/dpkg/cleanup.d/40-unblock-daemons
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 [ -n "$TARGET_ROOT" ]
 
diff --git a/elements/dpkg/cleanup.d/50-remove-img-build-proxy b/elements/dpkg/cleanup.d/50-remove-img-build-proxy
index 3a27b68ec..096b13eae 100755
--- a/elements/dpkg/cleanup.d/50-remove-img-build-proxy
+++ b/elements/dpkg/cleanup.d/50-remove-img-build-proxy
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 [ -n "$TARGET_ROOT" ]
 
diff --git a/elements/dpkg/post-install.d/99-clean-up-cache b/elements/dpkg/post-install.d/99-clean-up-cache
index 2457f78d3..8046c8a0e 100755
--- a/elements/dpkg/post-install.d/99-clean-up-cache
+++ b/elements/dpkg/post-install.d/99-clean-up-cache
@@ -1,6 +1,7 @@
 #!/bin/bash
 # Do an apt-get clean. This will free some space.
 
-set -e
+set -eu
+set -o pipefail
 
 apt-get clean
diff --git a/elements/dpkg/post-install.d/99-write-dpkg-manifest b/elements/dpkg/post-install.d/99-write-dpkg-manifest
index 22473a755..6750e63d5 100755
--- a/elements/dpkg/post-install.d/99-write-dpkg-manifest
+++ b/elements/dpkg/post-install.d/99-write-dpkg-manifest
@@ -15,6 +15,7 @@
 # under the License.
 #
 set -eux
+set -o pipefail
 
 DPKG_MANIFEST_NAME=dib-manifest-dpkg-$(basename ${IMAGE_NAME})
 
diff --git a/elements/dpkg/pre-install.d/99-apt-get-update b/elements/dpkg/pre-install.d/99-apt-get-update
index 212386783..ab846154a 100755
--- a/elements/dpkg/pre-install.d/99-apt-get-update
+++ b/elements/dpkg/pre-install.d/99-apt-get-update
@@ -1,6 +1,7 @@
 #!/bin/bash
 # Do an apt-get update, so that packages can be installed.
 
-set -e
+set -eu
+set -o pipefail
 
 apt-get -y update
diff --git a/elements/dpkg/root.d/50-build-with-http-cache b/elements/dpkg/root.d/50-build-with-http-cache
index 28cedd2d5..5ba1e889c 100755
--- a/elements/dpkg/root.d/50-build-with-http-cache
+++ b/elements/dpkg/root.d/50-build-with-http-cache
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 [ -n "$TARGET_ROOT" ]
 
diff --git a/elements/dpkg/root.d/60-block-apt-translations b/elements/dpkg/root.d/60-block-apt-translations
index 77a640cc9..4fde777d7 100755
--- a/elements/dpkg/root.d/60-block-apt-translations
+++ b/elements/dpkg/root.d/60-block-apt-translations
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 [ -n "$TARGET_ROOT" ]
 
diff --git a/elements/dpkg/root.d/99-block-daemons b/elements/dpkg/root.d/99-block-daemons
index 57d9992cf..4663013f8 100755
--- a/elements/dpkg/root.d/99-block-daemons
+++ b/elements/dpkg/root.d/99-block-daemons
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 [ -n "$TARGET_ROOT" ]
 
diff --git a/elements/dracut-network/install.d/10-install-dracut-network b/elements/dracut-network/install.d/10-install-dracut-network
index 71bfe23a6..c01f26ea1 100755
--- a/elements/dracut-network/install.d/10-install-dracut-network
+++ b/elements/dracut-network/install.d/10-install-dracut-network
@@ -1,5 +1,6 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 install-packages dracut-network patch
diff --git a/elements/fedora/root.d/10-fedora-cloud-image b/elements/fedora/root.d/10-fedora-cloud-image
index 47abc17eb..cc203087e 100755
--- a/elements/fedora/root.d/10-fedora-cloud-image
+++ b/elements/fedora/root.d/10-fedora-cloud-image
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 set -eu
+set -o pipefail
 
 [ -n "$ARCH" ]
 [ -n "$TARGET_ROOT" ]
diff --git a/elements/hwdiscovery/install.d/10-hwinfo b/elements/hwdiscovery/install.d/10-hwinfo
index baf74b63a..21588eaaa 100755
--- a/elements/hwdiscovery/install.d/10-hwinfo
+++ b/elements/hwdiscovery/install.d/10-hwinfo
@@ -1,7 +1,8 @@
 #!/bin/bash
 # Support for hard ware discovery
 
-set -e
+set -eu
+set -o pipefail
 set -o xtrace
 
 install-packages hwinfo
diff --git a/elements/local-config/extra-data.d/62-ssh-key b/elements/local-config/extra-data.d/62-ssh-key
index a6ad5dc88..f2d0d2185 100755
--- a/elements/local-config/extra-data.d/62-ssh-key
+++ b/elements/local-config/extra-data.d/62-ssh-key
@@ -2,7 +2,9 @@
 # Save user SSH public key if available.
 # (Obviously not suitable for downloadable images).
 
-set -e
+set -eu
+set -o pipefail
+
 source $_LIB/die
 [ -n "$TMP_HOOKS_PATH" ] || die "Temp hook path not set"
 
diff --git a/elements/local-config/install.d/62-ssh-key b/elements/local-config/install.d/62-ssh-key
index 544162ec1..cbdb92c67 100755
--- a/elements/local-config/install.d/62-ssh-key
+++ b/elements/local-config/install.d/62-ssh-key
@@ -2,7 +2,8 @@
 # Save user SSH public key if available.
 # XXX: Obviously not suitable for downloadable images.
 
-set -e
+set -eu
+set -o pipefail
 
 if [ -e "/tmp/in_target.d/ssh-authorized-keys" ]; then
   mkdir -p /root/.ssh
diff --git a/elements/local-config/pre-install.d/02-proxy-settings b/elements/local-config/pre-install.d/02-proxy-settings
index 15afdb3f7..cd05ce8f9 100755
--- a/elements/local-config/pre-install.d/02-proxy-settings
+++ b/elements/local-config/pre-install.d/02-proxy-settings
@@ -2,7 +2,8 @@
 # Save the HTTP/[S] and noproxy settings if available.
 # XXX: Obviously not suitable for downloadable images.
 
-set -e
+set -eu
+set -o pipefail
 set -o xtrace
 
 have_apt=
diff --git a/elements/manifests/cleanup.d/01-copy-manifests-dir b/elements/manifests/cleanup.d/01-copy-manifests-dir
index fd78541be..a805bb3c6 100755
--- a/elements/manifests/cleanup.d/01-copy-manifests-dir
+++ b/elements/manifests/cleanup.d/01-copy-manifests-dir
@@ -15,6 +15,7 @@
 # under the License.
 #
 set -eux
+set -o pipefail
 
 if [ -d $TMP_MOUNT_PATH/${DIB_MANIFEST_IMAGE_DIR} ]; then
     # Move the dib_environment and dib_arguments files into the manifests dir
diff --git a/elements/manifests/environment.d/15-manifests b/elements/manifests/environment.d/15-manifests
index 063cd6ca9..89b817e8a 100755
--- a/elements/manifests/environment.d/15-manifests
+++ b/elements/manifests/environment.d/15-manifests
@@ -15,6 +15,7 @@
 # under the License.
 #
 set -eu
+set -o pipefail
 
 export DIB_MANIFEST_IMAGE_DIR=${DIB_MANIFEST_IMAGE_DIR:-/etc/dib-manifests}
 export DIB_MANIFEST_SAVE_DIR=${DIB_MANIFEST_SAVE_DIR:-${IMAGE_NAME}.d/}
diff --git a/elements/manifests/extra-data.d/20-manifest-dir b/elements/manifests/extra-data.d/20-manifest-dir
index efdcb90ae..d40f0b6a1 100755
--- a/elements/manifests/extra-data.d/20-manifest-dir
+++ b/elements/manifests/extra-data.d/20-manifest-dir
@@ -15,5 +15,6 @@
 # under the License.
 #
 set -eux
+set -o pipefail
 
 sudo mkdir -p $TMP_MOUNT_PATH/${DIB_MANIFEST_IMAGE_DIR}
diff --git a/elements/mellanox/install.d/65-mellanox b/elements/mellanox/install.d/65-mellanox
index e35b92780..1df3ea77c 100755
--- a/elements/mellanox/install.d/65-mellanox
+++ b/elements/mellanox/install.d/65-mellanox
@@ -1,7 +1,8 @@
 #!/bin/bash
 # Ensure we load the mellanox driver somehow
 
-set -e
+set -eu
+set -o pipefail
 
 home=$(dirname $0)
 
diff --git a/elements/modprobe-blacklist/install.d/80-modprobe-blacklist b/elements/modprobe-blacklist/install.d/80-modprobe-blacklist
index f787d0163..3a844420e 100755
--- a/elements/modprobe-blacklist/install.d/80-modprobe-blacklist
+++ b/elements/modprobe-blacklist/install.d/80-modprobe-blacklist
@@ -1,5 +1,6 @@
 #!/bin/bash
-set -ex
+set -eux
+set -o pipefail
 
 MODULES_LIST=${DIB_MODPROBE_BLACKLIST:?"Please set DIB_MODPROBE_BLACKLIST."}
 
diff --git a/elements/opensuse/bin/install-packages b/elements/opensuse/bin/install-packages
index 6d8a66acf..7585d308e 100755
--- a/elements/opensuse/bin/install-packages
+++ b/elements/opensuse/bin/install-packages
@@ -14,7 +14,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-set -e
+set -eu
+set -o pipefail
 
 function run_zypper() {
   # TODO: Uncertain if this can ever block wanting input from user
diff --git a/elements/opensuse/extra-data.d/01-inject-defaults b/elements/opensuse/extra-data.d/01-inject-defaults
index d07abd061..102040003 100755
--- a/elements/opensuse/extra-data.d/01-inject-defaults
+++ b/elements/opensuse/extra-data.d/01-inject-defaults
@@ -1,7 +1,7 @@
 #!/bin/bash
 
-set -e
-set -x
+set -eux
+set -o pipefail
 
 export OPENSUSE_EXTRAS_PATH="$TMP_MOUNT_PATH/tmp/opensuse-extras"
 mkdir -p $OPENSUSE_EXTRAS_PATH
diff --git a/elements/opensuse/install.d/01-ccache-symlinks b/elements/opensuse/install.d/01-ccache-symlinks
index 2b14c6c94..c58839888 100755
--- a/elements/opensuse/install.d/01-ccache-symlinks
+++ b/elements/opensuse/install.d/01-ccache-symlinks
@@ -1,5 +1,6 @@
 #!/bin/bash
-set -e
+set -eu
+set -o pipefail
 
 # Setup ccache symlinks, as openSUSE's ccache package doesn't
 # include them.
diff --git a/elements/opensuse/install.d/01-login-defs b/elements/opensuse/install.d/01-login-defs
index 9dd567fae..90329bd8b 100755
--- a/elements/opensuse/install.d/01-login-defs
+++ b/elements/opensuse/install.d/01-login-defs
@@ -1,5 +1,6 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 sed -i -e "s,^USERGROUPS_ENAB.*$,USERGROUPS_ENAB yes," /etc/login.defs
diff --git a/elements/opensuse/post-install.d/10-mkinitrd b/elements/opensuse/post-install.d/10-mkinitrd
index 1c7b234dc..476d8f0a1 100755
--- a/elements/opensuse/post-install.d/10-mkinitrd
+++ b/elements/opensuse/post-install.d/10-mkinitrd
@@ -3,6 +3,7 @@
 # here. 
 
 set -eu
+set -o pipefail
 
 # To have access to FS_TYPE
 _LIB="/tmp/opensuse-extras"
diff --git a/elements/opensuse/root.d/10-opensuse-cloud-image b/elements/opensuse/root.d/10-opensuse-cloud-image
index a57ac3b31..074ff544f 100755
--- a/elements/opensuse/root.d/10-opensuse-cloud-image
+++ b/elements/opensuse/root.d/10-opensuse-cloud-image
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 set -eu
+set -o pipefail
 
 [ -n "$ARCH" ]
 [ -n "$TARGET_ROOT" ]
diff --git a/elements/pip-cache/root.d/01-pip-cache b/elements/pip-cache/root.d/01-pip-cache
index aecbdc27e..c3e37bdde 100755
--- a/elements/pip-cache/root.d/01-pip-cache
+++ b/elements/pip-cache/root.d/01-pip-cache
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 PIP_CACHE_DIR=$HOME/.cache/image-create/pip
 mkdir -p $PIP_CACHE_DIR
diff --git a/elements/pypi/extra-data.d/00-mount-pypi-mirror b/elements/pypi/extra-data.d/00-mount-pypi-mirror
index 6cc12534b..5784c62b1 100755
--- a/elements/pypi/extra-data.d/00-mount-pypi-mirror
+++ b/elements/pypi/extra-data.d/00-mount-pypi-mirror
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 set -eu
+set -o pipefail
 
 PYPI_MIRROR_URL=${PYPI_MIRROR_URL:-''}
 if [ -n "$PYPI_MIRROR_URL" ]; then
diff --git a/elements/pypi/post-install.d/00-unconfigure-pypi-mirror b/elements/pypi/post-install.d/00-unconfigure-pypi-mirror
index 100543831..e0289d454 100755
--- a/elements/pypi/post-install.d/00-unconfigure-pypi-mirror
+++ b/elements/pypi/post-install.d/00-unconfigure-pypi-mirror
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 set -eu
+set -o pipefail
 
 if [ -e ~/.pip/pip.conf.orig ]; then
     mv ~/.pip/pip.conf{.orig,}
diff --git a/elements/ramdisk/cleanup.d/99-extract-ramdisk-files b/elements/ramdisk/cleanup.d/99-extract-ramdisk-files
index 85cfa1d1f..ed57f76ca 100755
--- a/elements/ramdisk/cleanup.d/99-extract-ramdisk-files
+++ b/elements/ramdisk/cleanup.d/99-extract-ramdisk-files
@@ -1,7 +1,7 @@
 #!/bin/bash
 
-set -e
-set -x
+set -eux
+set -o pipefail
 
 IMAGE_NAME=${IMAGE_NAME:-'image'}
 
diff --git a/elements/ramdisk/extra-data.d/01-inject-ramdisk-build-files b/elements/ramdisk/extra-data.d/01-inject-ramdisk-build-files
index d9240f756..e0ee3e2a7 100755
--- a/elements/ramdisk/extra-data.d/01-inject-ramdisk-build-files
+++ b/elements/ramdisk/extra-data.d/01-inject-ramdisk-build-files
@@ -1,7 +1,7 @@
 #!/bin/bash
 
-set -e
-set -x
+set -eux
+set -o pipefail
 
 export RAMDISK_BUILD_PATH="$TMP_MOUNT_PATH/tmp/ramdisk-build"
 mkdir -p $RAMDISK_BUILD_PATH
diff --git a/elements/ramdisk/install.d/20-install-dhcp-client b/elements/ramdisk/install.d/20-install-dhcp-client
index db03d1fe0..5b52bc1ae 100755
--- a/elements/ramdisk/install.d/20-install-dhcp-client
+++ b/elements/ramdisk/install.d/20-install-dhcp-client
@@ -1,5 +1,6 @@
 #!/bin/bash
 set -eux
+set -o pipefail
 
 DISTRO=`lsb_release -si` || true
 
diff --git a/elements/ramdisk/post-install.d/01-ensure-binaries b/elements/ramdisk/post-install.d/01-ensure-binaries
index c6297b673..88417e223 100755
--- a/elements/ramdisk/post-install.d/01-ensure-binaries
+++ b/elements/ramdisk/post-install.d/01-ensure-binaries
@@ -1,8 +1,8 @@
 #!/bin/bash
 # Ensure that all binaries listed in ramdisk elements, exist
 
-set -e
-set -x
+set -eux
+set -o pipefail
 
 export TARGET_DIR="/tmp/in_target.d/"
 
diff --git a/elements/ramdisk/post-install.d/99-build-ramdisk b/elements/ramdisk/post-install.d/99-build-ramdisk
index 49110f064..61a373791 100755
--- a/elements/ramdisk/post-install.d/99-build-ramdisk
+++ b/elements/ramdisk/post-install.d/99-build-ramdisk
@@ -1,7 +1,7 @@
 #!/bin/bash
 
-set -e
-set -x
+set -eux
+set -o pipefail
 
 _LIB="/tmp/ramdisk-build"
 
diff --git a/elements/redhat-common/bin/extract-image b/elements/redhat-common/bin/extract-image
index 3a216b0ef..db812610c 100755
--- a/elements/redhat-common/bin/extract-image
+++ b/elements/redhat-common/bin/extract-image
@@ -5,6 +5,7 @@
 
 
 set -eu
+set -o pipefail
 
 BASE_IMAGE_FILE=$1
 BASE_IMAGE_TAR=$2
diff --git a/elements/redhat-common/finalise.d/99-cleanup-tmp-grub b/elements/redhat-common/finalise.d/99-cleanup-tmp-grub
index a2065bf2a..ace72f09a 100755
--- a/elements/redhat-common/finalise.d/99-cleanup-tmp-grub
+++ b/elements/redhat-common/finalise.d/99-cleanup-tmp-grub
@@ -1,5 +1,6 @@
 #!/bin/bash
 
 set -eux
+set -o pipefail
 
 rm -rf /tmp/grub
diff --git a/elements/redhat-common/finalise.d/99-setup-first-boot b/elements/redhat-common/finalise.d/99-setup-first-boot
index 7e7870590..516d1b5bd 100755
--- a/elements/redhat-common/finalise.d/99-setup-first-boot
+++ b/elements/redhat-common/finalise.d/99-setup-first-boot
@@ -1,5 +1,6 @@
 #!/bin/bash
-set -e
+set -eu
+set -o pipefail
 
 if [ -d /etc/first-boot.d ]; then
     rc_local=/etc/rc.d/rc.local
diff --git a/elements/redhat-common/pre-install.d/02-lsb b/elements/redhat-common/pre-install.d/02-lsb
index d4fb1f3de..f3eed2c1d 100755
--- a/elements/redhat-common/pre-install.d/02-lsb
+++ b/elements/redhat-common/pre-install.d/02-lsb
@@ -1,5 +1,6 @@
 #!/bin/bash
 
 set -eu
+set -o pipefail
 
 install -m 0755 -o root -g root /opt/stack/lsb-release/lsb_release /usr/local/bin
\ No newline at end of file
diff --git a/elements/redhat-common/pre-install.d/15-remove-grub b/elements/redhat-common/pre-install.d/15-remove-grub
index dd3e9830a..3958baaf1 100755
--- a/elements/redhat-common/pre-install.d/15-remove-grub
+++ b/elements/redhat-common/pre-install.d/15-remove-grub
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 yum remove -y grub2
 # Install grub2 dependencies to minimise packages installed during finalise.
diff --git a/elements/rhel/finalise.d/60-rhsm-unregister b/elements/rhel/finalise.d/60-rhsm-unregister
index e00da8536..3ec367f4a 100755
--- a/elements/rhel/finalise.d/60-rhsm-unregister
+++ b/elements/rhel/finalise.d/60-rhsm-unregister
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 if [ -n "$DIB_RHSM_USER" ] && [ -n "$DIB_RHSM_PASSWORD" ]; then
   if [[ "$DIB_REG_TYPE" == "rhn" ]]; then
diff --git a/elements/rhel/pre-install.d/00-rhsm b/elements/rhel/pre-install.d/00-rhsm
index a33381616..17efd2394 100755
--- a/elements/rhel/pre-install.d/00-rhsm
+++ b/elements/rhel/pre-install.d/00-rhsm
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 if [ -n "$DIB_RHSM_USER" ] && [ -n "$DIB_RHSM_PASSWORD" ]
   then
diff --git a/elements/rhel/root.d/10-rhel-cloud-image b/elements/rhel/root.d/10-rhel-cloud-image
index 56d119305..9f4c24fb6 100755
--- a/elements/rhel/root.d/10-rhel-cloud-image
+++ b/elements/rhel/root.d/10-rhel-cloud-image
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 set -eu
+set -o pipefail
 
 [ -n "$ARCH" ]
 [ -n "$TARGET_ROOT" ]
diff --git a/elements/rhel7/root.d/10-rhel-cloud-image b/elements/rhel7/root.d/10-rhel-cloud-image
index 6a53a721f..33127a289 100755
--- a/elements/rhel7/root.d/10-rhel-cloud-image
+++ b/elements/rhel7/root.d/10-rhel-cloud-image
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 set -eu
+set -o pipefail
 
 [ -n "$ARCH" ]
 [ -n "$TARGET_ROOT" ]
diff --git a/elements/rpm-distro/pre-install.d/01-override-yum-arch b/elements/rpm-distro/pre-install.d/01-override-yum-arch
index 78f783a16..74ab9bb98 100755
--- a/elements/rpm-distro/pre-install.d/01-override-yum-arch
+++ b/elements/rpm-distro/pre-install.d/01-override-yum-arch
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -e
+set -eu
 set -o pipefail
 
 if [ "i386" = "$ARCH" ]; then
diff --git a/elements/serial-console/install.d/20-stty b/elements/serial-console/install.d/20-stty
index 57e6312ea..cd69811da 100755
--- a/elements/serial-console/install.d/20-stty
+++ b/elements/serial-console/install.d/20-stty
@@ -1,5 +1,6 @@
 #!/bin/bash
 set -uex
+set -o pipefail
 SCRIPTDIR=$(dirname $0)
 
 DIB_INIT_SYSTEM=$(dib-init-system)
diff --git a/elements/source-repositories/extra-data.d/98-source-repositories b/elements/source-repositories/extra-data.d/98-source-repositories
index 56b8ae485..168beb787 100755
--- a/elements/source-repositories/extra-data.d/98-source-repositories
+++ b/elements/source-repositories/extra-data.d/98-source-repositories
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 set -eu
+set -o pipefail
 
 # If the old cache exists, move it to the new name
 function make_new_cache(){
diff --git a/elements/source-repositories/install.d/01-source-repositories b/elements/source-repositories/install.d/01-source-repositories
index 4ef606a75..47d37891a 100755
--- a/elements/source-repositories/install.d/01-source-repositories
+++ b/elements/source-repositories/install.d/01-source-repositories
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 set -uex
+set -o pipefail
 
 # Git isn't a dependency of this element, but is a dependency of pbr
 # if you are doing pip install on a git cloned directoy, because this
diff --git a/elements/ubuntu/finalise.d/99-setup-first-boot b/elements/ubuntu/finalise.d/99-setup-first-boot
index 4529d8196..e147244a8 100755
--- a/elements/ubuntu/finalise.d/99-setup-first-boot
+++ b/elements/ubuntu/finalise.d/99-setup-first-boot
@@ -1,5 +1,6 @@
 #!/bin/bash
-set -e
+set -eu
+set -o pipefail
 
 if [ -d /etc/first-boot.d ]; then
     rc_local=/etc/rc.local
diff --git a/elements/ubuntu/install.d/10-support-physical-hardware b/elements/ubuntu/install.d/10-support-physical-hardware
index 5120c826a..08d4d5434 100755
--- a/elements/ubuntu/install.d/10-support-physical-hardware
+++ b/elements/ubuntu/install.d/10-support-physical-hardware
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 # Ubuntu's cloud images don't include drivers for real hardware.
 install-packages linux-image-generic
diff --git a/elements/ubuntu/pre-install.d/00-remove-grub b/elements/ubuntu/pre-install.d/00-remove-grub
index 399e7b222..76f1d0c26 100755
--- a/elements/ubuntu/pre-install.d/00-remove-grub
+++ b/elements/ubuntu/pre-install.d/00-remove-grub
@@ -3,7 +3,8 @@
 # found (as happens in a chroot).
 # Temporarily remove grub, to avoid that confusion.
 
-set -e
+set -eu
+set -o pipefail
 
 if dpkg-query -W grub-pc; then
   apt-get -y remove grub-pc
diff --git a/elements/ubuntu/pre-install.d/01-set-ubuntu-mirror b/elements/ubuntu/pre-install.d/01-set-ubuntu-mirror
index a1b364949..5c1c7546d 100755
--- a/elements/ubuntu/pre-install.d/01-set-ubuntu-mirror
+++ b/elements/ubuntu/pre-install.d/01-set-ubuntu-mirror
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 set -eu
+set -o pipefail
 
 DIB_DISTRIBUTION_MIRROR=${DIB_DISTRIBUTION_MIRROR:-}
 
diff --git a/elements/ubuntu/root.d/10-cache-ubuntu-tarball b/elements/ubuntu/root.d/10-cache-ubuntu-tarball
index 3bb17457f..ebef64702 100755
--- a/elements/ubuntu/root.d/10-cache-ubuntu-tarball
+++ b/elements/ubuntu/root.d/10-cache-ubuntu-tarball
@@ -2,6 +2,7 @@
 # These are useful, or at worst not harmful, for all images we build.
 
 set -eu
+set -o pipefail
 
 [ -n "$ARCH" ]
 [ -n "$TARGET_ROOT" ]
diff --git a/elements/vm/block-device.d/10-partition b/elements/vm/block-device.d/10-partition
index 10c8dc17f..2608e004f 100755
--- a/elements/vm/block-device.d/10-partition
+++ b/elements/vm/block-device.d/10-partition
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 source $_LIB/die
 [ -n "$IMAGE_BLOCK_DEVICE" ] || die "Image block device not set"
 
diff --git a/elements/vm/finalise.d/50-remove-bogus-udev-links b/elements/vm/finalise.d/50-remove-bogus-udev-links
index 879880aa7..a0cd6cef1 100755
--- a/elements/vm/finalise.d/50-remove-bogus-udev-links
+++ b/elements/vm/finalise.d/50-remove-bogus-udev-links
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 set -eux
+set -o pipefail
 
 if [ "openSUSE project" = "$(lsb_release -is)" ]; then
     # workaround for https://bugzilla.novell.com/show_bug.cgi?id=859493
diff --git a/elements/vm/finalise.d/51-bootloader b/elements/vm/finalise.d/51-bootloader
index 54bf04ae6..71021ae3e 100755
--- a/elements/vm/finalise.d/51-bootloader
+++ b/elements/vm/finalise.d/51-bootloader
@@ -3,8 +3,8 @@
 # Configure grub. Note that the various conditionals here are to handle
 # different distributions gracefully.
 
-set -e
-set -x
+set -eux
+set -o pipefail
 
 # FIXME:
 [ -n "$IMAGE_BLOCK_DEVICE" ]
diff --git a/elements/yum/bin/install-packages b/elements/yum/bin/install-packages
index 2ee49cb66..98c0ced0f 100755
--- a/elements/yum/bin/install-packages
+++ b/elements/yum/bin/install-packages
@@ -14,7 +14,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-set -e
+set -eu
+set -o pipefail
 
 EXTRA_ARGS=
 ACTION=install
diff --git a/elements/yum/pre-install.d/01-yum-keepcache b/elements/yum/pre-install.d/01-yum-keepcache
index e5d7b1451..121f30f35 100755
--- a/elements/yum/pre-install.d/01-yum-keepcache
+++ b/elements/yum/pre-install.d/01-yum-keepcache
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 sudo sed -i 's/keepcache=0/keepcache=1/' /etc/yum.conf
 sudo sed -i 's/cachedir=\/var\/cache\/yum/cachedir=\/tmp\/yum/' /etc/yum.conf
diff --git a/elements/yum/root.d/50-yum-cache b/elements/yum/root.d/50-yum-cache
index a1e43a550..1453db098 100755
--- a/elements/yum/root.d/50-yum-cache
+++ b/elements/yum/root.d/50-yum-cache
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 [ -n "$TARGET_ROOT" ]
 
diff --git a/elements/zypper/post-install.d/99-zypper-no-keep-packages b/elements/zypper/post-install.d/99-zypper-no-keep-packages
index a68a05e1b..675275b6c 100755
--- a/elements/zypper/post-install.d/99-zypper-no-keep-packages
+++ b/elements/zypper/post-install.d/99-zypper-no-keep-packages
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 # Disable caching packages for all repositories
 sudo zypper modifyrepo --all --no-keep-packages
diff --git a/elements/zypper/pre-install.d/01-zypper-keep-packages b/elements/zypper/pre-install.d/01-zypper-keep-packages
index 43c01882f..7440c185b 100755
--- a/elements/zypper/pre-install.d/01-zypper-keep-packages
+++ b/elements/zypper/pre-install.d/01-zypper-keep-packages
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 # Enable caching packages for all repositories
 sudo zypper modifyrepo --all --keep-packages
diff --git a/elements/zypper/root.d/50-zypper-cache b/elements/zypper/root.d/50-zypper-cache
index 9504bf3a5..947499efa 100755
--- a/elements/zypper/root.d/50-zypper-cache
+++ b/elements/zypper/root.d/50-zypper-cache
@@ -1,6 +1,7 @@
 #!/bin/bash
 
-set -e
+set -eu
+set -o pipefail
 
 [ -n "$TARGET_ROOT" ]