diff --git a/scripts/fuse-nbd b/scripts/fuse-nbd
index 013ed0d3..3fc79b6b 100644
--- a/scripts/fuse-nbd
+++ b/scripts/fuse-nbd
@@ -28,12 +28,14 @@ if [ ! -f "${PACKER_OUTPUT}" ]; then
     exit
 fi
 
-sync -f ${PACKER_OUTPUT}
+sync -f "${PACKER_OUTPUT}"
 
 TMP_DIR=$(mktemp -d /tmp/packer-maas-XXXX)
 cleanup() {
-    for dev in $(ls -d ${TMP_DIR}/p*); do
-        fusermount -u ${dev}
+    for dev in "${TMP_DIR}"/p*/; do
+        dev=${dev%*/}
+        fusermount -u -z "${dev}"
+        grep -qs "${dev} " /proc/mounts && umount -f "${dev}"
     done
     rm -rf "${TMP_DIR}"
 }
@@ -44,12 +46,12 @@ function mount_part() {
     MOUNTPOINT=$2
     FUSEDRV=${3:-fuse2fs}
     DEV=${TMP_DIR}/p${PART}
-    [ -d ${MOUNTPOINT} ] || mkdir -p ${MOUNTPOINT}
-    mkdir ${DEV}
-    nbdfuse ${DEV} \
+    mkdir -p "${MOUNTPOINT}"
+    mkdir -p "${DEV}"
+    nbdfuse "${DEV}" \
         --command nbdkit -s nbd \
-        socket=$(pwd)/qemu-img.sock \
-        --filter=partition partition=${PART} &
+        socket="$(pwd)"/qemu-img.sock \
+        --filter=partition partition="${PART}" &
     retries=0
     until [ -f "${DEV}/nbd" ]; do
         sleep 1
@@ -58,15 +60,15 @@ function mount_part() {
         fi
     done
     case "${FUSEDRV}" in
-    "fusefat") fusefat ${DEV}/nbd ${MOUNTPOINT} -o rw+ -s ;;
-    "fuse2fs") fuse2fs ${DEV}/nbd ${MOUNTPOINT} -o fakeroot ;;
+    "fusefat") fusefat "${DEV}"/nbd "${MOUNTPOINT}" -o rw+ -s ;;
+    "fuse2fs") fuse2fs "${DEV}"/nbd "${MOUNTPOINT}" -o fakeroot ;;
     *) echo "Unsupported Fuse driver" && exit 1 ;;
     esac
 }
 
-qemu-nbd --socket=$(pwd)/qemu-img.sock \
-    --format=${IMG_FMT} \
+qemu-nbd --socket="$(pwd)"/qemu-img.sock \
+    --format="${IMG_FMT}" \
     --shared=10 \
-    ${PACKER_OUTPUT} &
+    "${PACKER_OUTPUT}" &
 
-mkdir "${TMP_DIR}/root"
+mkdir -p "${TMP_DIR}/root"
diff --git a/scripts/fuse-tar-root b/scripts/fuse-tar-root
index 426da16d..6f469170 100644
--- a/scripts/fuse-tar-root
+++ b/scripts/fuse-tar-root
@@ -27,20 +27,22 @@ mount_part "${ROOT_PARTITION}" "${ROOT_MOUNT}"
 
 if [ -d curtin ] || [ -d "$CURTIN_HOOKS" ]; then
     echo 'Adding Curtin hooks...'
-    cp -r ${CURTIN_HOOKS:-curtin} ${ROOT_MOUNT}
+    cp -r "${CURTIN_HOOKS:-curtin}" "${ROOT_MOUNT}"
 fi
 
 echo "Creating MAAS image ${OUTPUT}..."
-tar -Sczpf "${OUTPUT}" --acls --selinux --xattrs -C $ROOT_MOUNT .
+tar -Sczpf "${OUTPUT}" --acls --selinux --xattrs --exclude='agent.*' --exclude='*.socket' -C "$ROOT_MOUNT" .
 
 if [ -n "$MANIFEST" ]; then
     echo "Creating manifest..."
     # RPM on CentOS/RHEL 7 needs /dev mounted so it can use /dev/urandom
     mount -o bind /dev "${ROOT_MOUNT}/dev"
-    chroot "${ROOT_MOUNT}" rpm -qa | sort -u -o $MANIFEST
+    chroot "${ROOT_MOUNT}" rpm -qa | sort -u -o "$MANIFEST"
     umount "${ROOT_MOUNT}/dev"
+    grep -qs "${ROOT_MOUNT}/dev " /proc/mounts && umount -f "${ROOT_MOUNT}/dev"
 fi
 
 sync
-fusermount -u "${ROOT_MOUNT}"
+fusermount -z -u "${ROOT_MOUNT}"
+grep -qs "${ROOT_MOUNT} " /proc/mounts && umount -f "${ROOT_MOUNT}"
 echo 'Done'