diff --git a/Makefile b/Makefile
index 045fcd619..0d4bcc005 100644
--- a/Makefile
+++ b/Makefile
@@ -52,7 +52,7 @@ CGO_ENABLED ?= 1
 #
 
 # It's necessary to set this because some environments don't link sh -> bash.
-export SHELL := /bin/bash
+export SHELL := bash
 
 # It's necessary to set the errexit flags for the bash shell.
 export SHELLOPTS := errexit
@@ -77,7 +77,7 @@ DOCKER_LABELS ?= git-describe="$(shell date -u +v%Y%m%d)-$(shell git describe --
 # Golang standard bin directory.
 GOPATH ?= $(shell go env GOPATH)
 GOROOT ?= $(shell go env GOROOT)
-BIN_DIR := $(GOROOT)/bin
+BIN_DIR := $(GOPATH)/bin
 GOLANGCI_LINT := $(BIN_DIR)/golangci-lint
 
 # Default golang flags used in build and test
@@ -105,7 +105,7 @@ $(GOLANGCI_LINT):
 	curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(BIN_DIR) v1.23.6
 
 mockgen-install:
-	go get -u github.com/golang/mock/mockgen
+	go install github.com/golang/mock/mockgen@v1.6.0
 
 build-local:
 	@for target in $(TARGETS); do                                                      \
diff --git a/pkg/docker/docker.go b/pkg/docker/docker.go
index c5abd7cf2..713acd05e 100644
--- a/pkg/docker/docker.go
+++ b/pkg/docker/docker.go
@@ -99,7 +99,10 @@ func (g generalClient) StartBuildkitd(ctx context.Context,
 			if err != nil {
 				return "", errors.Wrap(err, "failed to pull image")
 			}
-			io.Copy(os.Stdout, body)
+			_, err = io.Copy(os.Stdout, body)
+			if err != nil {
+				logger.WithError(err).Warningln("failed to copy image pull output")
+			}
 			defer body.Close()
 		} else {
 			return "", errors.Wrap(err, "failed to inspect image")
diff --git a/pkg/lang/frontend/starlark/rules.go b/pkg/lang/frontend/starlark/rules.go
index 30cf0d848..0d704bfa1 100644
--- a/pkg/lang/frontend/starlark/rules.go
+++ b/pkg/lang/frontend/starlark/rules.go
@@ -175,7 +175,9 @@ func ruleFuncUbuntuAPT(thread *starlark.Thread, _ *starlark.Builtin,
 
 	logger.Debugf("rule `%s` is invoked, mode=%s, source=%s", ruleUbuntuAPT,
 		modeStr, sourceStr)
-	ir.UbuntuAPT(modeStr, sourceStr)
+	if err := ir.UbuntuAPT(modeStr, sourceStr); err != nil {
+		return nil, err
+	}
 
 	return starlark.None, nil
 }
@@ -200,7 +202,9 @@ func ruleFuncPyPIMirror(thread *starlark.Thread, _ *starlark.Builtin,
 
 	logger.Debugf("rule `%s` is invoked, mode=%s, mirror=%s", rulePyPIMirror,
 		modeStr, mirrorStr)
-	ir.PyPIMirror(modeStr, mirrorStr)
+	if err := ir.PyPIMirror(modeStr, mirrorStr); err != nil {
+		return nil, err
+	}
 
 	return starlark.None, nil
 }
diff --git a/pkg/progress/logging.go b/pkg/progress/logging.go
index 91634bce2..1709e6888 100644
--- a/pkg/progress/logging.go
+++ b/pkg/progress/logging.go
@@ -90,6 +90,7 @@ func (cl consoleLogger) PrintSuccess() {
 }
 
 // Printf prints formatted text to the console.
+// nolint:errcheck
 func (cl consoleLogger) Printf(format string, args ...interface{}) {
 	cl.mu.Lock()
 	defer cl.mu.Unlock()
@@ -103,6 +104,7 @@ func (cl consoleLogger) Printf(format string, args ...interface{}) {
 }
 
 // PrintBytes prints bytes directly to the console.
+// nolint:errcheck
 func (cl consoleLogger) PrintBytes(data []byte) {
 	// TODO: This does not deal well with control characters, because of the prefix.
 	cl.mu.Lock()
@@ -120,6 +122,7 @@ func (cl consoleLogger) PrintBytes(data []byte) {
 	}
 }
 
+// nolint:errcheck
 func (cl consoleLogger) printPrefix() {
 	// Assumes mu locked.
 	if cl.prefix == "" {
diff --git a/pkg/remote/sshd/sshd.go b/pkg/remote/sshd/sshd.go
index 3aff517d7..29655f950 100644
--- a/pkg/remote/sshd/sshd.go
+++ b/pkg/remote/sshd/sshd.go
@@ -75,11 +75,14 @@ type Server struct {
 
 // ListenAndServe starts the SSH server using port
 func (srv *Server) ListenAndServe() error {
-	server := srv.getServer()
+	server, err := srv.getServer()
+	if err != nil {
+		return errors.Wrap(err, "failed to parse server configs")
+	}
 	return server.ListenAndServe()
 }
 
-func (srv *Server) getServer() *ssh.Server {
+func (srv *Server) getServer() (*ssh.Server, error) {
 	forwardHandler := &ssh.ForwardedTCPHandler{}
 
 	server := &ssh.Server{
@@ -106,7 +109,10 @@ func (srv *Server) getServer() *ssh.Server {
 		},
 	}
 
-	server.SetOption(ssh.HostKeyPEM([]byte(hostKeyBytes)))
+	err := server.SetOption(ssh.HostKeyPEM([]byte(hostKeyBytes)))
+	if err != nil {
+		return nil, err
+	}
 
 	if srv.AuthorizedKeys != nil {
 		server.PublicKeyHandler = srv.authorize
@@ -115,7 +121,7 @@ func (srv *Server) getServer() *ssh.Server {
 		server.PasswordHandler = nil
 	}
 
-	return server
+	return server, nil
 }
 
 func (srv Server) buildCmd(logger *logrus.Entry, s ssh.Session) *exec.Cmd {
@@ -172,7 +178,10 @@ func (srv *Server) connectionHandler(s ssh.Session) {
 			return
 		}
 
-		s.Exit(0)
+		err := s.Exit(0)
+		if err != nil {
+			logger.Warningln("exit session with error:", err)
+		}
 		return
 	}
 
@@ -182,7 +191,10 @@ func (srv *Server) connectionHandler(s ssh.Session) {
 		return
 	}
 
-	s.Exit(0)
+	err := s.Exit(0)
+	if err != nil {
+		logger.Warningln("exit session with error:", err)
+	}
 }
 
 func handlePTY(logger *logrus.Entry, cmd *exec.Cmd, s ssh.Session, ptyReq ssh.Pty, winCh <-chan ssh.Window) error {
@@ -203,13 +215,19 @@ func handlePTY(logger *logrus.Entry, cmd *exec.Cmd, s ssh.Session, ptyReq ssh.Pt
 	}()
 
 	go func() {
-		io.Copy(f, s) // stdin
+		_, err := io.Copy(f, s) // stdin
+		if err != nil {
+			logger.WithError(err).Warningln("failed to copy stdin")
+		}
 	}()
 
 	waitCh := make(chan struct{})
 	go func() {
 		defer close(waitCh)
-		io.Copy(s, f) // stdout
+		_, err := io.Copy(s, f) // stdout
+		if err != nil {
+			logger.WithError(err).Warningln("failed to copy stdin")
+		}
 	}()
 
 	if err := cmd.Wait(); err != nil {
@@ -230,8 +248,11 @@ func handlePTY(logger *logrus.Entry, cmd *exec.Cmd, s ssh.Session, ptyReq ssh.Pt
 func setWinsize(f *os.File, w, h int) {
 	// TODO(gaocegege): Should we use syscall or docker resize?
 	// Refer to https://github.com/gliderlabs/ssh/blob/master/_examples/ssh-docker/docker.go#L99
-	syscall.Syscall(syscall.SYS_IOCTL, f.Fd(), uintptr(syscall.TIOCSWINSZ),
+	_, _, err := syscall.Syscall(syscall.SYS_IOCTL, f.Fd(), uintptr(syscall.TIOCSWINSZ),
 		uintptr(unsafe.Pointer(&struct{ h, w, x, y uint16 }{uint16(h), uint16(w), 0, 0})))
+	if err != 0 {
+		logrus.WithError(err).Error("failed to set winsize")
+	}
 }
 
 func sendErrAndExit(logger *logrus.Entry, s ssh.Session, err error) {
diff --git a/pkg/unzip/unzip.go b/pkg/unzip/unzip.go
index 58cb80f51..52aa8e26f 100644
--- a/pkg/unzip/unzip.go
+++ b/pkg/unzip/unzip.go
@@ -89,7 +89,10 @@ func Unzip(src string, dest string) ([]string, error) {
 	uid := os.Getuid()
 	gid := os.Getgid()
 
-	ensureDir(dest)
+	err := ensureDir(dest)
+	if err != nil {
+		return filenames, err
+	}
 	r, err := zip.OpenReader(src)
 	if err != nil {
 		return filenames, err