diff --git a/prog/weavedns/main.go b/prog/weavedns/main.go
index 1b0b46bb..06aa0780 100644
--- a/prog/weavedns/main.go
+++ b/prog/weavedns/main.go
@@ -1,12 +1,12 @@
 package main
 
 import (
-	"flag"
 	"fmt"
 	"net"
 	"os"
 	"strconv"
 
+	"github.com/docker/docker/pkg/mflag"
 	"github.com/miekg/dns"
 	. "github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/common/docker"
@@ -42,28 +42,28 @@ func main() {
 		err             error
 	)
 
-	flag.BoolVar(&justVersion, "version", false, "print version and exit")
-	flag.StringVar(&ifaceName, "iface", "", "name of interface to use for multicast")
-	flag.StringVar(&apiPath, "api", "unix:///var/run/docker.sock", "path to Docker API socket")
-	flag.StringVar(&domain, "domain", weavedns.DefaultLocalDomain, "local domain (ie, 'weave.local.')")
-	flag.IntVar(&wait, "wait", -1, "number of seconds to wait for interfaces to come up (0=don't wait, -1=wait forever)")
-	flag.IntVar(&dnsPort, "dnsport", weavedns.DefaultServerPort, "port to listen to DNS requests")
-	flag.StringVar(&httpIfaceName, "httpiface", "", "interface on which to listen for HTTP requests (defaults to empty string which listens on all interfaces)")
-	flag.IntVar(&httpPort, "httpport", weavedns.DefaultHTTPPort, "port to listen to HTTP requests")
-	flag.IntVar(&cacheLen, "cache", weavedns.DefaultCacheLen, "cache length")
-	flag.IntVar(&ttl, "ttl", weavedns.DefaultLocalTTL, "TTL (in secs) for responses for local names")
-	flag.BoolVar(&watch, "watch", true, "watch the docker socket for container events")
-	flag.StringVar(&logLevel, "log-level", "info", "logging level (debug, info, warning, error)")
+	mflag.BoolVar(&justVersion, []string{"#version", "-version"}, false, "print version and exit")
+	mflag.StringVar(&ifaceName, []string{"#iface", "-iface"}, "", "name of interface to use for multicast")
+	mflag.StringVar(&apiPath, []string{"#api", "-api"}, "unix:///var/run/docker.sock", "path to Docker API socket")
+	mflag.StringVar(&domain, []string{"#domain", "-domain"}, weavedns.DefaultLocalDomain, "local domain (ie, 'weave.local.')")
+	mflag.IntVar(&wait, []string{"#wait", "-wait"}, -1, "number of seconds to wait for interfaces to come up (0=don't wait, -1=wait forever)")
+	mflag.IntVar(&dnsPort, []string{"#dnsport", "#-dnsport", "-dns-port"}, weavedns.DefaultServerPort, "port to listen to DNS requests")
+	mflag.StringVar(&httpIfaceName, []string{"#httpiface", "#-httpiface", "-http-iface"}, "", "interface on which to listen for HTTP requests (empty string means listen on all interfaces)")
+	mflag.IntVar(&httpPort, []string{"#httpport", "#-httpport", "-http-port"}, weavedns.DefaultHTTPPort, "port to listen to HTTP requests")
+	mflag.IntVar(&cacheLen, []string{"#cache", "-cache"}, weavedns.DefaultCacheLen, "cache length")
+	mflag.IntVar(&ttl, []string{"#ttl", "-ttl"}, weavedns.DefaultLocalTTL, "TTL (in secs) for responses for local names")
+	mflag.BoolVar(&watch, []string{"#watch", "-watch"}, true, "watch the docker socket for container events")
+	mflag.StringVar(&logLevel, []string{"-log-level"}, "info", "logging level (debug, info, warning, error)")
 	// advanced options
-	flag.IntVar(&negTTL, "neg-ttl", 0, "negative TTL (in secs) for unanswered queries for local names (0=same value as -ttl")
-	flag.IntVar(&refreshInterval, "refresh", weavedns.DefaultRefreshInterval, "refresh interval (in secs) for local names (0=disable)")
-	flag.IntVar(&maxAnswers, "max-answers", weavedns.DefaultMaxAnswers, "maximum number of answers returned to clients (0=unlimited)")
-	flag.IntVar(&relevantTime, "relevant", weavedns.DefaultRelevantTime, "life time for info in the absence of queries (in secs)")
-	flag.IntVar(&udpbuf, "udpbuf", weavedns.DefaultUDPBuflen, "UDP buffer length")
-	flag.IntVar(&timeout, "timeout", weavedns.DefaultTimeout, "timeout for resolutions (in millisecs)")
-	flag.BoolVar(&cacheDisabled, "no-cache", false, "disable the cache")
-	flag.StringVar(&fallback, "fallback", "", "force a fallback server (ie, '8.8.8.8:53') (instead of /etc/resolv.conf values)")
-	flag.Parse()
+	mflag.IntVar(&negTTL, []string{"#neg-ttl", "-neg-ttl"}, 0, "negative TTL (in secs) for unanswered queries for local names (0=same value as --ttl")
+	mflag.IntVar(&refreshInterval, []string{"#refresh", "-refresh"}, weavedns.DefaultRefreshInterval, "refresh interval (in secs) for local names (0=disable)")
+	mflag.IntVar(&maxAnswers, []string{"#max-answers", "#-max-answers", "-dns-max-answers"}, weavedns.DefaultMaxAnswers, "maximum number of answers returned to clients (0=unlimited)")
+	mflag.IntVar(&relevantTime, []string{"#relevant", "-relevant"}, weavedns.DefaultRelevantTime, "life time for info in the absence of queries (in secs)")
+	mflag.IntVar(&udpbuf, []string{"#udpbuf", "#-udpbuf", "-dns-udpbuf"}, weavedns.DefaultUDPBuflen, "UDP buffer length for DNS")
+	mflag.IntVar(&timeout, []string{"#timeout", "#-timeout", "-dns-timeout"}, weavedns.DefaultTimeout, "timeout for resolutions (in millisecs)")
+	mflag.BoolVar(&cacheDisabled, []string{"#no-cache", "-no-cache"}, false, "disable the cache")
+	mflag.StringVar(&fallback, []string{"#fallback", "#-fallback", "-dns-fallback"}, "", "force a fallback server (ie, '8.8.8.8:53') (instead of /etc/resolv.conf values)")
+	mflag.Parse()
 
 	if justVersion {
 		fmt.Printf("weave DNS %s\n", version)
diff --git a/prog/weaveproxy/main.go b/prog/weaveproxy/main.go
index 23c78a29..7a86bccd 100644
--- a/prog/weaveproxy/main.go
+++ b/prog/weaveproxy/main.go
@@ -5,7 +5,7 @@ import (
 	"os"
 	"strings"
 
-	"github.com/pborman/getopt"
+	"github.com/docker/docker/pkg/mflag"
 	. "github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/proxy"
 )
@@ -15,27 +15,51 @@ var (
 	defaultListenAddrs = []string{"tcp://0.0.0.0:12375", "unix:///var/run/weave.sock"}
 )
 
+type listOpts struct {
+	value      *[]string
+	hasBeenSet bool
+}
+
+func ListVar(p *[]string, names []string, value []string, usage string) {
+	*p = value
+	mflag.Var(&listOpts{p, false}, names, usage)
+}
+
+func (opts *listOpts) Set(value string) error {
+	if opts.hasBeenSet {
+		(*opts.value) = append((*opts.value), value)
+	} else {
+		(*opts.value) = []string{value}
+		opts.hasBeenSet = true
+	}
+	return nil
+}
+
+func (opts *listOpts) String() string {
+	return fmt.Sprintf("%v", []string(*opts.value))
+}
+
 func main() {
 	var (
 		justVersion bool
 		logLevel    = "info"
-		c           = proxy.Config{ListenAddrs: defaultListenAddrs}
+		c           = proxy.Config{ListenAddrs: []string{}}
 	)
 
 	c.Version = version
-	getopt.BoolVarLong(&justVersion, "version", 0, "print version and exit")
-	getopt.StringVarLong(&logLevel, "log-level", 0, "logging level (debug, info, warning, error)", "info")
-	getopt.ListVar(&c.ListenAddrs, 'H', fmt.Sprintf("address on which to listen (default %s)", defaultListenAddrs))
-	getopt.BoolVarLong(&c.NoDefaultIPAM, "no-default-ipalloc", 0, "do not automatically allocate addresses for containers without a WEAVE_CIDR")
-	getopt.BoolVarLong(&c.NoDefaultIPAM, "no-default-ipam", 0, "do not automatically allocate addresses for containers without a WEAVE_CIDR (deprecated; please use --no-default-ipalloc")
-	getopt.StringVarLong(&c.TLSConfig.CACert, "tlscacert", 0, "Trust certs signed only by this CA")
-	getopt.StringVarLong(&c.TLSConfig.Cert, "tlscert", 0, "Path to TLS certificate file")
-	getopt.BoolVarLong(&c.TLSConfig.Enabled, "tls", 0, "Use TLS; implied by --tlsverify")
-	getopt.StringVarLong(&c.TLSConfig.Key, "tlskey", 0, "Path to TLS key file")
-	getopt.BoolVarLong(&c.TLSConfig.Verify, "tlsverify", 0, "Use TLS and verify the remote")
-	getopt.BoolVarLong(&c.WithDNS, "with-dns", 'w', "instruct created containers to always use weaveDNS as their nameserver")
-	getopt.BoolVarLong(&c.WithoutDNS, "without-dns", 0, "instruct created containers to never use weaveDNS as their nameserver")
-	getopt.Parse()
+
+	mflag.BoolVar(&justVersion, []string{"#version", "-version"}, false, "print version and exit")
+	mflag.StringVar(&logLevel, []string{"-log-level"}, "info", "logging level (debug, info, warning, error)")
+	ListVar(&c.ListenAddrs, []string{"H"}, defaultListenAddrs, "addresses on which to listen")
+	mflag.BoolVar(&c.NoDefaultIPAM, []string{"#-no-default-ipam", "-no-default-ipalloc"}, false, "do not automatically allocate addresses for containers without a WEAVE_CIDR")
+	mflag.StringVar(&c.TLSConfig.CACert, []string{"#tlscacert", "-tlscacert"}, "", "Trust certs signed only by this CA")
+	mflag.StringVar(&c.TLSConfig.Cert, []string{"#tlscert", "-tlscert"}, "", "Path to TLS certificate file")
+	mflag.BoolVar(&c.TLSConfig.Enabled, []string{"#tls", "-tls"}, false, "Use TLS; implied by --tls-verify")
+	mflag.StringVar(&c.TLSConfig.Key, []string{"#tlskey", "-tlskey"}, "", "Path to TLS key file")
+	mflag.BoolVar(&c.TLSConfig.Verify, []string{"#tlsverify", "-tlsverify"}, false, "Use TLS and verify the remote")
+	mflag.BoolVar(&c.WithDNS, []string{"-with-dns", "w"}, false, "instruct created containers to always use weaveDNS as their nameserver")
+	mflag.BoolVar(&c.WithoutDNS, []string{"-without-dns"}, false, "instruct created containers to never use weaveDNS as their nameserver")
+	mflag.Parse()
 
 	if justVersion {
 		fmt.Printf("weave proxy %s\n", version)
diff --git a/prog/weaver/main.go b/prog/weaver/main.go
index 4f4b68de..43710a11 100644
--- a/prog/weaver/main.go
+++ b/prog/weaver/main.go
@@ -2,7 +2,6 @@ package main
 
 import (
 	"crypto/sha256"
-	"flag"
 	"fmt"
 	"net"
 	"net/http"
@@ -11,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/davecheney/profile"
+	"github.com/docker/docker/pkg/mflag"
 	"github.com/gorilla/mux"
 	. "github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/common/docker"
@@ -52,26 +52,26 @@ func main() {
 		peers        []string
 	)
 
-	flag.BoolVar(&justVersion, "version", false, "print version and exit")
-	flag.IntVar(&config.Port, "port", weave.Port, "router port")
-	flag.StringVar(&ifaceName, "iface", "", "name of interface to capture/inject from (disabled if blank)")
-	flag.StringVar(&routerName, "name", "", "name of router (defaults to MAC of interface)")
-	flag.StringVar(&nickName, "nickname", "", "nickname of peer (defaults to hostname)")
-	flag.StringVar(&password, "password", "", "network password")
-	flag.IntVar(&wait, "wait", -1, "number of seconds to wait for interface to come up (0=don't wait, -1=wait forever)")
-	flag.StringVar(&logLevel, "log-level", "info", "logging level (debug, info, warning, error)")
-	flag.BoolVar(&pktdebug, "pktdebug", false, "enable per-packet debug logging")
-	flag.StringVar(&prof, "profile", "", "enable profiling and write profiles to given path")
-	flag.IntVar(&config.ConnLimit, "connlimit", 30, "connection limit (0 for unlimited)")
-	flag.BoolVar(&noDiscovery, "nodiscovery", false, "disable peer discovery")
-	flag.IntVar(&bufSzMB, "bufsz", 8, "capture buffer size in MB")
-	flag.StringVar(&httpAddr, "httpaddr", fmt.Sprintf(":%d", weave.HTTPPort), "address to bind HTTP interface to (disabled if blank, absolute path indicates unix domain socket)")
-	flag.StringVar(&iprangeCIDR, "iprange", "", "IP address range reserved for automatic allocation, in CIDR notation")
-	flag.StringVar(&ipsubnetCIDR, "ipsubnet", "", "subnet to allocate within by default, in CIDR notation")
-	flag.IntVar(&peerCount, "initpeercount", 0, "number of peers in network (for IP address allocation)")
-	flag.StringVar(&apiPath, "api", "unix:///var/run/docker.sock", "Path to Docker API socket")
-	flag.Parse()
-	peers = flag.Args()
+	mflag.BoolVar(&justVersion, []string{"#version", "-version"}, false, "print version and exit")
+	mflag.IntVar(&config.Port, []string{"#port", "-port"}, weave.Port, "router port")
+	mflag.StringVar(&ifaceName, []string{"#iface", "-iface"}, "", "name of interface to capture/inject from (disabled if blank)")
+	mflag.StringVar(&routerName, []string{"#name", "-name"}, "", "name of router (defaults to MAC of interface)")
+	mflag.StringVar(&nickName, []string{"#nickname", "-nickname"}, "", "nickname of peer (defaults to hostname)")
+	mflag.StringVar(&password, []string{"#password", "-password"}, "", "network password")
+	mflag.IntVar(&wait, []string{"#wait", "-wait"}, -1, "number of seconds to wait for interface to come up (0=don't wait, -1=wait forever)")
+	mflag.StringVar(&logLevel, []string{"-log-level"}, "info", "logging level (debug, info, warning, error)")
+	mflag.BoolVar(&pktdebug, []string{"#pktdebug", "#-pktdebug", "-pkt-debug"}, false, "enable per-packet debug logging")
+	mflag.StringVar(&prof, []string{"#profile", "-profile"}, "", "enable profiling and write profiles to given path")
+	mflag.IntVar(&config.ConnLimit, []string{"#connlimit", "#-connlimit", "-conn-limit"}, 30, "connection limit (0 for unlimited)")
+	mflag.BoolVar(&noDiscovery, []string{"#nodiscovery", "#-nodiscovery", "-no-discovery"}, false, "disable peer discovery")
+	mflag.IntVar(&bufSzMB, []string{"#bufsz", "-bufsz"}, 8, "capture buffer size in MB")
+	mflag.StringVar(&httpAddr, []string{"#httpaddr", "#-httpaddr", "-http-addr"}, fmt.Sprintf(":%d", weave.HTTPPort), "address to bind HTTP interface to (disabled if blank, absolute path indicates unix domain socket)")
+	mflag.StringVar(&iprangeCIDR, []string{"#iprange", "#-iprange", "-ipalloc-range"}, "", "IP address range reserved for automatic allocation, in CIDR notation")
+	mflag.StringVar(&ipsubnetCIDR, []string{"#ipsubnet", "#-ipsubnet", "-ipalloc-default-subnet"}, "", "subnet to allocate within by default, in CIDR notation")
+	mflag.IntVar(&peerCount, []string{"#initpeercount", "#-initpeercount", "-init-peer-count"}, 0, "number of peers in network (for IP address allocation)")
+	mflag.StringVar(&apiPath, []string{"#api", "-api"}, "unix:///var/run/docker.sock", "Path to Docker API socket")
+	mflag.Parse()
+	peers = mflag.Args()
 
 	SetLogLevel(logLevel)
 	if justVersion {
@@ -93,7 +93,7 @@ func main() {
 
 	if routerName == "" {
 		if config.Iface == nil {
-			Log.Fatal("Either an interface must be specified with -iface or a name with -name")
+			Log.Fatal("Either an interface must be specified with --iface or a name with -name")
 		}
 		routerName = config.Iface.HardwareAddr.String()
 	}
@@ -146,7 +146,7 @@ func main() {
 			Log.Fatal("Unable to start watcher", err)
 		}
 	} else if peerCount > 0 {
-		Log.Fatal("-initpeercount flag specified without -iprange")
+		Log.Fatal("--init-peer-count flag specified without --ipalloc-range")
 	}
 
 	router.Start()
@@ -155,7 +155,7 @@ func main() {
 	}
 
 	// The weave script always waits for a status call to succeed,
-	// so there is no point in doing "weave launch -httpaddr ''".
+	// so there is no point in doing "weave launch --http-addr ''".
 	// This is here to support stand-alone use of weaver.
 	if httpAddr != "" {
 		go handleHTTP(router, httpAddr, allocator, defaultSubnet, dockerCli)
@@ -174,16 +174,26 @@ func errorMessages(errors []error) string {
 
 func options() map[string]string {
 	options := make(map[string]string)
-	flag.Visit(func(f *flag.Flag) {
+	mflag.Visit(func(f *mflag.Flag) {
 		value := f.Value.String()
-		if f.Name == "password" {
+		name := canonicalName(f)
+		if name == "password" {
 			value = "<elided>"
 		}
-		options[f.Name] = value
+		options[name] = value
 	})
 	return options
 }
 
+func canonicalName(f *mflag.Flag) string {
+	for _, n := range f.Names {
+		if n[0] != '#' {
+			return strings.TrimLeft(n, "#-")
+		}
+	}
+	return ""
+}
+
 func logFrameFunc(debug bool) weave.LogFrameFunc {
 	if !debug {
 		return func(prefix string, frame []byte, dec *weave.EthernetDecoder) {}
diff --git a/weave b/weave
index b35ffbbe..4b9e1b75 100755
--- a/weave
+++ b/weave
@@ -890,9 +890,8 @@ show_addrs() {
 # TODO: Handle relative paths for args
 # TODO: Handle args with spaces
 tls_arg() {
-    filename=${3:-$2}
-    PROXY_VOLUMES="$PROXY_VOLUMES -v $1:/home/weave/tls/$filename.pem"
-    PROXY_ARGS="$PROXY_ARGS --tls$2 /home/weave/tls/$filename.pem"
+    PROXY_VOLUMES="$PROXY_VOLUMES -v $2:/home/weave/tls/$3.pem"
+    PROXY_ARGS="$PROXY_ARGS $1 /home/weave/tls/$3.pem"
 }
 
 proxy_args() {
@@ -901,25 +900,25 @@ proxy_args() {
     while [ $# -gt 0 ]; do
         case "$1" in
           --tlscacert)
+            tls_arg "$1" "$2" ca
             shift
-            tls_arg "$1" cacert ca
             ;;
           --tlscacert=*)
-            tls_arg "${1#*=}" cacert ca
+            tls_arg "${1%%=*}" "${1#*=}" ca
             ;;
           --tlscert)
+            tls_arg "$1" "$2" cert
             shift
-            tls_arg "$1" cert
             ;;
           --tlscert=*)
-            tls_arg "${1#*=}" cert
+            tls_arg "${1%%=*}" "${1#*=}" cert
             ;;
           --tlskey)
+            tls_arg "$1" "$2" key
             shift
-            tls_arg "$1" key
             ;;
           --tlskey=*)
-            tls_arg "${1#*=}" key
+            tls_arg "${1%%=*}" "${1#*=}" key
             ;;
           *)
             PROXY_ARGS="$PROXY_ARGS $1"
@@ -973,18 +972,18 @@ launch_router() {
     IPRANGE_SPECIFIED=
     while [ $# -gt 0 ] ; do
         case "$1" in
-            -password)
+            -password|--password)
                 [ $# -gt 1 ] || usage
                 WEAVE_PASSWORD="$2"
                 export WEAVE_PASSWORD
                 shift 2
                 ;;
-            -port)
+            -port|--port)
                 [ $# -gt 1 ] || usage
                 CONTAINER_PORT="$2"
                 shift 2
                 ;;
-            -iprange)
+            -iprange|--iprange|--ipalloc-range)
                 [ $# -gt 1 ] || usage
                 IPRANGE="$2"
                 IPRANGE_SPECIFIED=1
@@ -1000,7 +999,7 @@ launch_router() {
     if [ -z "$IPRANGE_SPECIFIED" ] ; then
         IPRANGE="10.32.0.0/12"
         if command_exists netcheck && ! netcheck $IPRANGE ; then
-            echo "Default -iprange $IPRANGE overlaps with existing route on host." >&2
+            echo "Default --ipalloc-range $IPRANGE overlaps with existing route on host." >&2
             echo "Please pick another range and set it on all hosts." >&2
             exit 1
         fi
@@ -1013,7 +1012,7 @@ launch_router() {
         -v /var/run/docker.sock:/var/run/docker.sock \
         -e WEAVE_PASSWORD \
         -e WEAVE_CIDR=none \
-        $WEAVE_DOCKER_ARGS $IMAGE -iface $CONTAINER_IFNAME -port $CONTAINER_PORT -name "$PEERNAME" -nickname "$(hostname)" -iprange "$IPRANGE" "$@")
+        $WEAVE_DOCKER_ARGS $IMAGE --iface $CONTAINER_IFNAME --port $CONTAINER_PORT --name "$PEERNAME" --nickname "$(hostname)" --ipalloc-range "$IPRANGE" "$@")
     with_container_netns_or_die $CONTAINER launch
     wait_for_status $CONTAINER_NAME $HTTP_PORT
     if [ -n "$IPRANGE" ] ; then
@@ -1035,7 +1034,7 @@ launch_dns() {
         -p $DOCKER_BRIDGE_IP:53:53/udp \
         -e WEAVE_CIDR=none \
         -v /var/run/docker.sock:/var/run/docker.sock \
-        $WEAVEDNS_DOCKER_ARGS $DNS_IMAGE -iface $CONTAINER_IFNAME -httpiface "$DNS_HTTP_IFNAME" "$@")
+        $WEAVEDNS_DOCKER_ARGS $DNS_IMAGE --iface $CONTAINER_IFNAME --http-iface "$DNS_HTTP_IFNAME" "$@")
     ipam_cidrs_or_die $DNS_CONTAINER $CIDR_ARGS
     with_container_netns_or_die $DNS_CONTAINER attach $ALL_CIDRS
     populate_dns