diff --git a/Makefile b/Makefile
index 7be13758..b91dca33 100644
--- a/Makefile
+++ b/Makefile
@@ -135,9 +135,6 @@ PUSH_ML=push_ml_weave push_ml_weaveexec push_ml_weave-kube push_ml_weave-npc
 
 WEAVE_EXPORT=weave$(ARCH_EXT).tar.gz
 
-DOCKER_VERSION=1.10.3
-DOCKER_DISTRIB=prog/weaveexec/docker-$(DOCKER_VERSION).tgz
-DOCKER_DISTRIB_URL=https://get.docker.com/builds/Linux/$(WEAVEEXEC_DOCKER_ARCH)/docker-$(DOCKER_VERSION).tgz
 NETGO_CHECK=@strings $@ | grep cgo_stub\\\.go >/dev/null || { \
 	rm $@; \
 	echo "\nYour go standard library was built without the 'netgo' build tag."; \
@@ -260,13 +257,11 @@ $(WEAVER_UPTODATE): prog/weaver/Dockerfile.$(DOCKERHUB_USER) $(WEAVER_EXE) weave
 	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build -f prog/weaver/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVER_IMAGE) prog/weaver
 	touch $@
 
-$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile.$(DOCKERHUB_USER) prog/weaveexec/symlink $(DOCKER_DISTRIB) $(SIGPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVER_UPTODATE)
+$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile.$(DOCKERHUB_USER) prog/weaveexec/symlink $(SIGPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVER_UPTODATE)
 	cp $(SIGPROXY_EXE) prog/weaveexec/sigproxy
 	cp $(WEAVEWAIT_EXE) prog/weaveexec/weavewait
 	cp $(WEAVEWAIT_NOOP_EXE) prog/weaveexec/weavewait_noop
 	cp $(WEAVEWAIT_NOMCAST_EXE) prog/weaveexec/weavewait_nomcast
-	tar -xf $(DOCKER_DISTRIB) usr/local/bin/docker -O > prog/weaveexec/docker
-	chmod +x prog/weaveexec/docker
 	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build -f prog/weaveexec/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVEEXEC_IMAGE) prog/weaveexec
 	touch $@
 
@@ -307,10 +302,6 @@ $(NETWORKTESTER_UPTODATE): test/images/network-tester/Dockerfile $(NETWORKTESTER
 $(WEAVE_EXPORT): $(IMAGES_UPTODATE) $(WEAVEDB_UPTODATE)
 	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker save $(addsuffix :latest,$(IMAGES)) | gzip > $@
 
-$(DOCKER_DISTRIB):
-	curl -o $(DOCKER_DISTRIB) $(DOCKER_DISTRIB_URL)
-	cd $(shell dirname $@) && sha256sum -c $(shell pwd)/build/shasums/docker-tgz-$(WEAVEEXEC_DOCKER_ARCH).sha256sum
-
 tools/.git $(MANIFEST_TOOL_DIR)/.git:
 	git submodule update --init
 
@@ -383,7 +374,7 @@ clean-bin:
 	-$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker rmi $(IMAGES)
 	find prog -type f -name "Dockerfile.*" -not -name "Dockerfile.template" -print | xargs rm -f
 	find prog -type f -name "*qemu-*" -print | xargs rm -f
-	rm -rf $(EXES) $(IMAGES_UPTODATE) $(WEAVEDB_UPTODATE) weave*.tar.gz $(DOCKER_DISTRIB) prog/weaveexec/docker .pkg
+	rm -rf $(EXES) $(IMAGES_UPTODATE) $(WEAVEDB_UPTODATE) weave*.tar.gz .pkg
 
 clean: clean-bin clean-work-dir
 	-$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker rmi $(BUILD_IMAGE)
diff --git a/build/shasums/docker-tgz-armel.sha256sum b/build/shasums/docker-tgz-armel.sha256sum
deleted file mode 100644
index 49fdca83..00000000
--- a/build/shasums/docker-tgz-armel.sha256sum
+++ /dev/null
@@ -1 +0,0 @@
-8f313a9df867c207ae9ceac6e0935d1d2a0360aafce780dd5d1e0687ee98e0c3 docker-1.10.3.tgz
diff --git a/build/shasums/docker-tgz-x86_64.sha256sum b/build/shasums/docker-tgz-x86_64.sha256sum
deleted file mode 100644
index 330e1425..00000000
--- a/build/shasums/docker-tgz-x86_64.sha256sum
+++ /dev/null
@@ -1 +0,0 @@
-7541b5490cee1183d911f909c0e91d3d9d57b2b775e40f14a1a7a6de216ca4a8 docker-1.10.3.tgz
diff --git a/prog/weaveexec/Dockerfile.template b/prog/weaveexec/Dockerfile.template
index 1f9e8bd6..e0e66436 100644
--- a/prog/weaveexec/Dockerfile.template
+++ b/prog/weaveexec/Dockerfile.template
@@ -3,7 +3,6 @@ FROM DOCKERHUB_USER/weaveARCH_EXT
 ENTRYPOINT ["/home/weave/sigproxy", "/home/weave/weave"]
 
 ADD ./sigproxy ./symlink /home/weave/
-ADD ./docker /usr/bin/
 ADD ./weavewait /w/w
 ADD ./weavewait_noop /w-noop/w
 ADD ./weavewait_nomcast /w-nomcast/w
diff --git a/prog/weaveutil/attach.go b/prog/weaveutil/attach.go
index d1f636b2..8ffce5f2 100644
--- a/prog/weaveutil/attach.go
+++ b/prog/weaveutil/attach.go
@@ -8,7 +8,6 @@ import (
 	"strings"
 	"syscall"
 
-	docker "github.com/fsouza/go-dockerclient"
 	"github.com/vishvananda/netns"
 
 	weavenet "github.com/weaveworks/weave/net"
@@ -70,21 +69,6 @@ func attach(args []string) error {
 	return err
 }
 
-func containerPid(containerID string) (int, error) {
-	c, err := docker.NewVersionedClientFromEnv("1.18")
-	if err != nil {
-		return 0, fmt.Errorf("unable to connect to docker: %s", err)
-	}
-	container, err := c.InspectContainer(containerID)
-	if err != nil {
-		return 0, fmt.Errorf("unable to inspect container %s: %s", containerID, err)
-	}
-	if container.State.Pid == 0 {
-		return 0, fmt.Errorf("container %s not running", containerID)
-	}
-	return container.State.Pid, nil
-}
-
 func processExists(pid int) bool {
 	err := syscall.Kill(pid, syscall.Signal(0))
 	return err == nil || err == syscall.EPERM
@@ -119,21 +103,31 @@ func detach(args []string) error {
 }
 
 func rewriteEtcHosts(args []string) error {
-	if len(args) < 4 {
-		cmdUsage("rewrite-etc-hosts", "<hosts-path> <fqdn> <image> <cidr>... [name:addr...]")
+	if len(args) < 3 {
+		cmdUsage("rewrite-etc-hosts", "<container-id> <image> <cidr> [name:addr...]")
 	}
-	hostsPath := args[0]
-	fqdn := args[1]
-	image := args[2]
+	containerID := args[0]
+	image := args[1]
+	cidrs := args[2]
+	extraHosts := args[3:]
+
+	container, err := inspectContainer(containerID)
+	if err != nil {
+		return err
+	}
+
+	hostsPath := container.HostsPath
+	fqdn := container.Config.Hostname + "." + container.Config.Domainname
+
 	var ips []*net.IPNet
-	for _, cidr := range strings.Fields(args[3]) {
+	for _, cidr := range strings.Fields(cidrs) {
 		_, ipnet, err := net.ParseCIDR(cidr)
 		if err != nil {
 			return err
 		}
 		ips = append(ips, ipnet)
 	}
-	extraHosts := args[4:]
+
 	docker := os.Getenv("DOCKER_HOST")
 	if docker == "" {
 		docker = "unix:///var/run/docker.sock"
diff --git a/prog/weaveutil/container.go b/prog/weaveutil/container.go
new file mode 100644
index 00000000..cbbc5622
--- /dev/null
+++ b/prog/weaveutil/container.go
@@ -0,0 +1,285 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	docker "github.com/fsouza/go-dockerclient"
+)
+
+func inspectContainer(containerNameOrID string) (*docker.Container, error) {
+	c, err := docker.NewVersionedClientFromEnv("1.18")
+	if err != nil {
+		return nil, fmt.Errorf("unable to connect to docker: %s", err)
+	}
+
+	container, err := c.InspectContainer(containerNameOrID)
+	if err != nil {
+		return nil, fmt.Errorf("unable to inspect container %s: %s", containerNameOrID, err)
+	}
+	return container, nil
+}
+
+func containerPid(containerID string) (int, error) {
+	container, err := inspectContainer(containerID)
+	if err != nil {
+		return 0, err
+
+	}
+
+	if container.State.Pid == 0 {
+		return 0, fmt.Errorf("container %s not running", containerID)
+	}
+	return container.State.Pid, nil
+}
+
+func containerID(args []string) error {
+	if len(args) < 1 {
+		cmdUsage("container-id", "<container-name-or-short-id>")
+	}
+
+	container, err := inspectContainer(args[0])
+	if err != nil {
+		return err
+	}
+
+	fmt.Print(container.ID)
+	return nil
+}
+
+func containerState(args []string) error {
+	if len(args) < 1 {
+		cmdUsage("container-state", "<container-id> [<image-prefix>]")
+	}
+
+	container, err := inspectContainer(args[0])
+	if err != nil {
+		return err
+	}
+
+	if len(args) == 1 {
+		fmt.Print(container.State.StateString())
+	} else {
+		imagePrefix := args[1]
+		if strings.HasPrefix(container.Config.Image, imagePrefix) {
+			fmt.Print(container.State.StateString())
+		} else {
+			if container.State.Running {
+				fmt.Print("running image mismatch: ", container.Config.Image)
+			} else {
+				fmt.Print("image mismatch: ", container.Config.Image)
+			}
+		}
+	}
+	return nil
+}
+
+func containerFQDN(args []string) error {
+	if len(args) < 1 {
+		cmdUsage("container-fqdn", "<container-id>")
+	}
+
+	container, err := inspectContainer(args[0])
+	if err != nil {
+		return err
+	}
+
+	fmt.Print(container.Config.Hostname, ".", container.Config.Domainname)
+	return nil
+}
+
+func runContainer(args []string) error {
+	env := []string{}
+	name := ""
+	net := ""
+	pid := ""
+	privileged := false
+	restart := docker.NeverRestart()
+	volumes := []string{}
+	volumesFrom := []string{}
+
+	done := false
+	for i := 0; i < len(args) && !done; {
+		switch args[i] {
+		case "-e", "--env":
+			if v := os.Getenv(args[i+1]); v != "" {
+				env = append(env, args[i+1]+"="+v)
+			} else {
+				env = append(env, args[i+1])
+			}
+			args = append(args[:i], args[i+2:]...)
+		case "--name":
+			name = args[i+1]
+			args = append(args[:i], args[i+2:]...)
+		case "--net":
+			net = args[i+1]
+			args = append(args[:i], args[i+2:]...)
+		case "--pid":
+			pid = args[i+1]
+			args = append(args[:i], args[i+2:]...)
+		case "--privileged":
+			privileged = true
+			args = append(args[:i], args[i+1:]...)
+		case "--restart":
+			restart = docker.RestartPolicy{Name: args[i+1]}
+			args = append(args[:i], args[i+2:]...)
+		case "-v", "--volume":
+			// Must dedup binds, otherwise, container fails creation
+			skip := false
+			for _, v := range volumes {
+				if v == args[i+1] {
+					skip = true
+				}
+			}
+			if !skip {
+				volumes = append(volumes, args[i+1])
+			}
+			args = append(args[:i], args[i+2:]...)
+		case "--volumes-from":
+			volumesFrom = append(volumesFrom, args[i+1])
+			args = append(args[:i], args[i+2:]...)
+		default:
+			done = true
+		}
+	}
+
+	if len(args) < 2 {
+		cmdUsage("run-container", `[options] <image> <cmd> [[<cmd-options>] <cmd-arg1> [<cmd-arg2> ...]]
+
+  -e, --env list                       Set environment variables
+      --name string                    Assign a name to the container
+      --net string                     Network Mode
+      --pid string                     PID namespace to use
+      --privileged                     Give extended privileges to this container
+      --restart string                 Restart policy to apply when a container exits (default "no")
+  -v, --volume list                    Bind mount a volume
+      --volumes-from list              Mount volumes from the specified container(s)
+`)
+	}
+
+	image := args[0]
+	cmds := args[1:]
+
+	c, err := docker.NewVersionedClientFromEnv("1.18")
+	if err != nil {
+		return fmt.Errorf("unable to connect to docker: %s", err)
+	}
+
+	config := docker.Config{Image: image, Env: env, Cmd: cmds}
+	hostConfig := docker.HostConfig{NetworkMode: net, PidMode: pid, Privileged: privileged, RestartPolicy: restart, Binds: volumes, VolumesFrom: volumesFrom}
+	container, err := c.CreateContainer(docker.CreateContainerOptions{Name: name, Config: &config, HostConfig: &hostConfig})
+	if err != nil {
+		return fmt.Errorf("unable to create container: %s", err)
+	}
+
+	err = c.StartContainer(container.ID, &hostConfig)
+	if err != nil {
+		return fmt.Errorf("unable to start container: %s", err)
+	}
+
+	fmt.Print(container.ID)
+	return nil
+}
+
+func listContainers(args []string) error {
+	if len(args) > 1 {
+		cmdUsage("list-containers", "[<label>]")
+	}
+
+	c, err := docker.NewVersionedClientFromEnv("1.18")
+	if err != nil {
+		return fmt.Errorf("unable to connect to docker: %s", err)
+	}
+
+	opts := docker.ListContainersOptions{All: true}
+	if len(args) == 1 {
+		label := args[0]
+		opts.Filters = map[string][]string{"label": {label}}
+	}
+
+	containers, err := c.ListContainers(opts)
+	if err != nil {
+		return fmt.Errorf("unable to list containers: %s", err)
+	}
+
+	for _, container := range containers {
+		fmt.Println(container.ID)
+	}
+	return nil
+}
+
+func stopContainer(args []string) error {
+	if len(args) < 1 {
+		cmdUsage("stop-container", "<container-id> [<container-id2> ...]")
+	}
+
+	c, err := docker.NewVersionedClientFromEnv("1.18")
+	if err != nil {
+		return fmt.Errorf("unable to connect to docker: %s", err)
+	}
+
+	for _, containerID := range args {
+		err = c.StopContainer(containerID, 10)
+		if err != nil {
+			return fmt.Errorf("unable to stop container %s: %s", containerID, err)
+		}
+	}
+	return nil
+}
+
+func killContainer(args []string) error {
+	if len(args) < 1 {
+		cmdUsage("kill-container", "<container-id> [<container-id2> ...]")
+	}
+
+	c, err := docker.NewVersionedClientFromEnv("1.18")
+	if err != nil {
+		return fmt.Errorf("unable to connect to docker: %s", err)
+	}
+
+	for _, containerID := range args {
+		err = c.KillContainer(docker.KillContainerOptions{ID: containerID, Signal: docker.SIGKILL})
+		if err != nil {
+			return fmt.Errorf("unable to stop container %s: %s", containerID, err)
+		}
+	}
+	return nil
+}
+
+func removeContainer(args []string) error {
+	if len(args) < 1 {
+		cmdUsage("remove-container", "[-f | --force]  [-v | --volumes] <container-id> [<container-id2> ...]")
+	}
+
+	force := false
+	volumes := false
+	for i := 0; i < len(args); {
+		switch args[i] {
+		case "--force":
+		case "-f":
+			force = true
+			args = append(args[:i], args[i+1:]...)
+		case "--volumes":
+		case "-v":
+			volumes = true
+			args = append(args[:i], args[i+1:]...)
+		default:
+			i++
+		}
+	}
+
+	c, err := docker.NewVersionedClientFromEnv("1.18")
+	if err != nil {
+		return fmt.Errorf("unable to connect to docker: %s", err)
+	}
+
+	for _, containerID := range args {
+		err = c.RemoveContainer(docker.RemoveContainerOptions{
+			ID: containerID, Force: force, RemoveVolumes: volumes})
+		if err != nil {
+			return fmt.Errorf("unable to stop container %s: %s", containerID, err)
+		}
+	}
+	return nil
+}
diff --git a/prog/weaveutil/main.go b/prog/weaveutil/main.go
index 525516ea..4efabb39 100644
--- a/prog/weaveutil/main.go
+++ b/prog/weaveutil/main.go
@@ -26,6 +26,15 @@ func init() {
 		"remove-plugin-network":    removePluginNetwork,
 		"container-addrs":          containerAddrs,
 		"process-addrs":            processAddrs,
+		"container-id":             containerID,
+		"container-state":          containerState,
+		"container-fqdn":           containerFQDN,
+		"run-container":            runContainer,
+		"list-containers":          listContainers,
+		"stop-container":           stopContainer,
+		"kill-container":           killContainer,
+		"remove-container":         removeContainer,
+		"create-volume-container":  createVolumeContainer,
 		"attach-container":         attach,
 		"detach-container":         detach,
 		"configure-arp":            configureARP,
diff --git a/prog/weaveutil/volume.go b/prog/weaveutil/volume.go
new file mode 100644
index 00000000..e193256b
--- /dev/null
+++ b/prog/weaveutil/volume.go
@@ -0,0 +1,42 @@
+package main
+
+import (
+	"fmt"
+
+	docker "github.com/fsouza/go-dockerclient"
+)
+
+func createVolumeContainer(args []string) error {
+	if len(args) < 3 {
+		cmdUsage("create-volume-container", "<name> <image-name-or-id> <label> [<bind-mount1> <bind-mount2> ...]")
+	}
+	containerName := args[0]
+	image := args[1]
+	label := args[2]
+	bindMounts := args[3:]
+
+	c, err := docker.NewVersionedClientFromEnv("1.18")
+	if err != nil {
+		return fmt.Errorf("unable to connect to docker: %s", err)
+	}
+
+	container, err := c.InspectContainer(containerName)
+	if err == nil {
+		fmt.Println("volume container already exists " + containerName + ":" + container.ID)
+		return nil
+	}
+
+	volumes := make(map[string]struct{})
+	for _, m := range bindMounts {
+		volumes[m] = struct{}{}
+	}
+	labels := map[string]string{label: ""}
+	config := docker.Config{Image: image, Volumes: volumes, Labels: labels, Entrypoint: []string{"data-only"}}
+	hostConfig := docker.HostConfig{}
+	container, err = c.CreateContainer(docker.CreateContainerOptions{Name: containerName, Config: &config, HostConfig: &hostConfig})
+	if err != nil {
+		return fmt.Errorf("unable to create container: %s", err)
+	}
+
+	return nil
+}
diff --git a/weave b/weave
index 7680b0ff..1b173941 100755
--- a/weave
+++ b/weave
@@ -8,12 +8,7 @@ IMAGE_VERSION=latest
 [ "$SCRIPT_VERSION" = "unreleased" ] || IMAGE_VERSION=$SCRIPT_VERSION
 IMAGE_VERSION=${WEAVE_VERSION:-$IMAGE_VERSION}
 
-# - The weavexec image embeds a Docker 1.10.3 client. Docker will give
-#   a "client is newer than server error" if the daemon has an older
-#   API version, which could be confusing if the user's Docker client
-#   is correctly matched with that older version.
-#
-# We therefore check that the user's Docker *client* is >= 1.10.3
+# Minimum tested version of Docker + Weave Net
 MIN_DOCKER_VERSION=1.10.0
 
 # These are needed for remote execs, hence we introduce them here
@@ -105,13 +100,6 @@ usage() {
     exit 1
 }
 
-handle_help_arg() {
-    if [ "$1" = "--help" ] ; then
-        usage_no_exit
-        exit 0
-    fi
-}
-
 docker_sock_options() {
     # Pass through DOCKER_HOST if it is a Unix socket;
     # a TCP socket may be secured by TLS, in which case we can't use it
@@ -123,7 +111,7 @@ docker_sock_options() {
 }
 
 docker_run_options() {
-    echo --privileged --net=host $(docker_sock_options)
+    echo --privileged --net host $(docker_sock_options)
 }
 
 exec_options() {
@@ -142,7 +130,7 @@ exec_options() {
 exec_remote() {
     docker $DOCKER_CLIENT_ARGS run --rm \
         $(docker_run_options) \
-        --pid=host \
+        --pid host \
         $(exec_options "$@") \
         -e DOCKERHUB_USER="$DOCKERHUB_USER" \
         -e WEAVE_VERSION \
@@ -213,7 +201,7 @@ collect_cidr_args() {
 }
 
 kill_container() {
-    docker kill $1 >/dev/null 2>&1 || true
+    util_op kill-container $1 >/dev/null 2>&1 || true
 }
 
 ######################################################################
@@ -222,28 +210,40 @@ kill_container() {
 
 [ "$1" = "--local" ] && shift 1 && IS_LOCAL=1
 
-# "--help|help" and "<command> --help" are special because we always want to
-# process them at the client end.
-handle_help_arg "$1"
-handle_help_arg "--$1"
-handle_help_arg "$2"
-
-if [ "$1" = "version" -a -z "$IS_LOCAL" ] ; then
-    # non-local "version" is special because we want to show the
-    # version of the script executed by the user rather than what is
-    # embedded in weaveexec.
-    echo "weave script $SCRIPT_VERSION"
-elif [ "$1" = "env" -a "$2" = "--restore" ] ; then
-    # "env --restore" is special because we always want to process it
-    # at the client end.
-    if [ "${ORIG_DOCKER_HOST-unset}" = "unset" ] ; then
-        echo "Nothing to restore. This is most likely because there was no preceding invocation of 'eval \$(weave env)' in this shell." >&2
-        exit 1
-    else
-        echo "DOCKER_HOST=$ORIG_DOCKER_HOST"
+# Handle special case $1 commands that run locally at the client end
+case "$1" in
+    help|--help)
+        usage_no_exit
         exit 0
-    fi
-fi
+        ;;
+    version)
+        # non-local "version" is special because we want to show the
+        # version of the script executed by the user rather than what is
+        # embedded in weaveexec.
+        [ -z "$IS_LOCAL" ] && echo "weave script $SCRIPT_VERSION"
+        ;;
+    env)
+        if [ "$2" = "--restore" ] ; then
+            # "env --restore" is special because we always want to process it
+            # at the client end.
+            if [ "${ORIG_DOCKER_HOST-unset}" = "unset" ] ; then
+                echo "Nothing to restore. This is most likely because there was no preceding invocation of 'eval \$(weave env)' in this shell." >&2
+                exit 1
+            else
+                echo "DOCKER_HOST=$ORIG_DOCKER_HOST"
+                exit 0
+            fi
+        fi
+        ;;
+    setup)
+        for img in $IMAGE $EXEC_IMAGE $WEAVEDB_IMAGE ; do
+          docker pull $img
+        done
+        ;;
+    *)
+        [ "$2" = "--help" ] && usage_no_exit && exit 0
+        ;;
+esac
 
 if [ -z "$IS_LOCAL" ] ; then
     check_docker_version
@@ -256,7 +256,7 @@ fi
 ######################################################################
 
 # Default restart policy for router/proxy
-RESTART_POLICY="--restart=always"
+RESTART_POLICY="--restart always"
 BASE_IMAGE=$DOCKERHUB_USER/weave
 IMAGE=$BASE_IMAGE:$IMAGE_VERSION
 CONTAINER_NAME=${WEAVE_CONTAINER_NAME:-weave}
@@ -265,6 +265,7 @@ PLUGIN_NAME="$DOCKERHUB_USER/net-plugin"
 OLD_PLUGIN_CONTAINER_NAME=weaveplugin
 CNI_PLUGIN_NAME="weave-plugin-$IMAGE_VERSION"
 CNI_PLUGIN_DIR=${WEAVE_CNI_PLUGIN_DIR:-$HOST_ROOT/opt/cni/bin}
+VOLUMES_LABEL=weavevolumes
 # Note VOLUMES_CONTAINER which is for weavewait should change when you upgrade Weave
 VOLUMES_CONTAINER_NAME=weavevolumes-$IMAGE_VERSION
 # DB files should remain when you upgrade, so version number not included in name
@@ -367,7 +368,7 @@ util_op() {
     if command_exists weaveutil ; then
         weaveutil "$@"
     else
-        docker run --rm --pid=host $(docker_run_options) \
+        docker run --rm --pid host $(docker_run_options) \
             --entrypoint=/usr/bin/weaveutil $EXEC_IMAGE "$@"
     fi
 }
@@ -564,15 +565,6 @@ router_bridge_opts() {
     [ -z $WEAVE_NO_FASTDP ] || echo --no-fastdp
 }
 
-ask_version() {
-    if check_running $1 2>/dev/null ; then
-        DOCKERIMAGE=$(docker inspect --format='{{.Image}}' $1 )
-    elif ! DOCKERIMAGE=$(docker inspect --format='{{.Id}}' $2 2>/dev/null) ; then
-        echo "Unable to find $2 image." >&2
-    fi
-    [ -n "$DOCKERIMAGE" ] && docker run --rm --net=none -e WEAVE_CIDR=none $3 $DOCKERIMAGE $COVERAGE_ARGS --version
-}
-
 attach() {
     ATTACH_ARGS=""
     [ -n "$NO_MULTICAST_ROUTE" ] && ATTACH_ARGS="--no-multicast-route"
@@ -585,43 +577,52 @@ attach() {
 # functions for interacting with containers
 ######################################################################
 
-# Check that a container for component $1 named $2 with image $3 is not running
+# Print an error to stderr and return with an indicative exit status
+# if the container $1 does not exist or isn't running.
+check_running() {
+    if ! STATE=$(util_op container-state $1 2> /dev/null) ; then
+        echo  "$1 container is not present. Have you launched it?" >&2
+        return 1
+    elif [ "$STATE" = "restarting" ] ; then
+        echo "$1 container is restarting." >&2
+        return 2
+    elif [ "$STATE" != "running" ] ; then
+        echo "$1 container is not running." >&2
+        return 2
+    fi
+}
+
+# Execute $@ only if the weave container is running
+when_weave_running() {
+    ! check_running $CONTAINER_NAME 2>/dev/null || "$@"
+}
+
+# Check that a container $1 with image $2 is not running
 check_not_running() {
-    RUN_STATUS=$(docker inspect --format='{{.State.Running}} {{.State.Status}} {{.Config.Image}}' $2 2>/dev/null) || true
-    case ${RUN_STATUS%:*} in
-        "true restarting $3")
-            echo "$2 is restarting; you can stop it with 'weave stop'." >&2
+    STATE=$(util_op container-state $1 $2 2> /dev/null) || true
+    case ${STATE} in
+        "running")
+            echo "$1 is already running; you can stop it with 'weave stop'." >&2
             return 3
             ;;
-        "true "*" $3")
-            echo "$2 is already running; you can stop it with 'weave stop'." >&2
+        "created" | "paused" | "restarting")
+            echo "$1 is created, paused, or restarting; you can stop it with 'weave stop'." >&2
             return 1
             ;;
-        "false "*" $3")
-            docker rm $2 >/dev/null
+        "exited" | "dead")
+            util_op remove-container $1 >/dev/null
             ;;
-        true*)
-            echo "Found another running container named '$2'. Aborting." >&2
+        "running image mismatch"*)
+            echo "Found another running container named '$1'. Aborting." >&2
             return 2
             ;;
-        false*)
-            echo "Found another container named '$2'. Aborting." >&2
+        "image mismatch"*)
+            echo "Found another container named '$1'. Aborting." >&2
             return 2
             ;;
     esac
 }
 
-# Given a container name or short ID in $1, ensure the specified
-# container exists and then print its full ID to stdout. If
-# it doesn't exist, print an error to stderr and
-# return with an indicative non-zero exit code.
-container_id() {
-    if ! docker inspect --format='{{.Id}}' $1 2>/dev/null ; then
-        echo "Error: No such container: $1" >&2
-        return 1
-    fi
-}
-
 http_call() {
     addr="$1"
     http_verb="$2"
@@ -825,32 +826,9 @@ dns_args() {
 }
 
 rewrite_etc_hosts() {
-    HOSTS_PATH_AND_FQDN=$(docker inspect -f '{{.HostsPath}} {{.Config.Hostname}}.{{.Config.Domainname}}' $CONTAINER) || return 1
-    HOSTS=${HOSTS_PATH_AND_FQDN% *}
-    FQDN=${HOSTS_PATH_AND_FQDN#* }
     # rewrite /etc/hosts, unlinking the file (so Docker does not modify it again) but
     # leaving it with valid contents...
-    util_op rewrite-etc-hosts "$HOSTS" "$FQDN" "$EXEC_IMAGE" "$ALL_CIDRS" "$@"
-}
-
-# Print an error to stderr and return with an indicative exit status
-# if the container $1 does not exist or isn't running.
-check_running() {
-    if ! STATUS=$(docker inspect --format='{{.State.Running}} {{.State.Restarting}}' $1 2>/dev/null) ; then
-        echo  "$1 container is not present. Have you launched it?" >&2
-        return 1
-    elif [ "$STATUS" = "true true" ] ; then
-        echo "$1 container is restarting." >&2
-        return 2
-    elif [ "$STATUS" != "true false" ] ; then
-        echo "$1 container is not running." >&2
-        return 2
-    fi
-}
-
-# Execute $@ only if the weave container is running
-when_weave_running() {
-    ! check_running $CONTAINER_NAME 2>/dev/null || "$@"
+    util_op rewrite-etc-hosts "$CONTAINER" "$EXEC_IMAGE" "$ALL_CIDRS" "$@" || return 1
 }
 
 # Iff the container in $1 has an FQDN, invoke $2 as a command passing
@@ -861,7 +839,7 @@ with_container_fqdn() {
     COMMAND_WCF="$2"
     shift 2
 
-    CONT_FQDN=$(docker inspect --format='{{.Config.Hostname}}.{{.Config.Domainname}}' $CONT 2>/dev/null) || return 0
+    CONT_FQDN=$(util_op container-fqdn $CONT 2>/dev/null) || return 0
     CONT_NAME=${CONT_FQDN%%.*}
     [ "$CONT_NAME" = "$CONT_FQDN" -o "$CONT_NAME." = "$CONT_FQDN" ] || $COMMAND_WCF "$CONT" "$CONT_FQDN" "$@"
 }
@@ -931,7 +909,7 @@ collect_dns_add_remove_args() {
     check_running $CONTAINER_NAME
     if [ -n "$C" ] ; then
         check_running $C
-        CONTAINER=$(container_id $C)
+        CONTAINER=$(util_op container-id $C)
         [ $IP_COUNT -gt 0 ] || IP_ARGS=$(with_container_addresses echo_ips $CONTAINER)
     fi
 }
@@ -1231,10 +1209,10 @@ launch() {
     fi
 
     # Create a data-only container for persistence data
-    if ! docker inspect -f ' ' $DB_CONTAINER_NAME > /dev/null 2>&1 ; then
-       protect_against_docker_hang
-       docker create -v /weavedb --name=$DB_CONTAINER_NAME \
-           --label=weavevolumes $WEAVEDB_IMAGE >/dev/null
+    if ! util_op container-state $DB_CONTAINER_NAME > /dev/null 2>&1 ; then
+        protect_against_docker_hang
+        util_op create-volume-container $DB_CONTAINER_NAME $WEAVEDB_IMAGE $VOLUMES_LABEL \
+            /weavedb >/dev/null
     fi
 
     # Figure out the location of the actual resolv.conf file because
@@ -1254,19 +1232,19 @@ launch() {
     proxy_args "$@"
     mkdir -p /var/run/weave
     # Create a data-only container to mount the weavewait files from
-    if ! docker inspect -f ' ' $VOLUMES_CONTAINER_NAME > /dev/null 2>&1 ; then
-       protect_against_docker_hang
-       docker create -v /w -v /w-noop -v /w-nomcast --name=$VOLUMES_CONTAINER_NAME \
-           --label=weavevolumes --entrypoint=/bin/false $EXEC_IMAGE >/dev/null
+    if ! util_op container-state $VOLUMES_CONTAINER_NAME > /dev/null 2>&1 ; then
+        protect_against_docker_hang
+        util_op create-volume-container $VOLUMES_CONTAINER_NAME $EXEC_IMAGE $VOLUMES_LABEL \
+            /w /w-noop /w-nomcast >/dev/null
     fi
 
     # Set WEAVE_DOCKER_ARGS in the environment in order to supply
     # additional parameters, such as resource limits, to docker
     # when launching the weave container.
-    WEAVE_CONTAINER=$(docker run -d --name=$CONTAINER_NAME \
+    WEAVE_CONTAINER=$(util_op run-container --name $CONTAINER_NAME \
         $(docker_run_options) \
         $RESTART_POLICY \
-        --pid=host \
+        --pid host \
         --volumes-from $DB_CONTAINER_NAME \
         --volumes-from $VOLUMES_CONTAINER_NAME \
         $PROXY_VOLUMES \
@@ -1299,10 +1277,10 @@ launch() {
 stop() {
     util_op remove-plugin-network weave || true
     warn_if_stopping_proxy_in_env
-    docker stop $CONTAINER_NAME >/dev/null 2>&1 || echo "Weave is not running." >&2
+    util_op stop-container $CONTAINER_NAME >/dev/null 2>&1 || echo "Weave is not running." >&2
     # In case user has upgraded from <v2.0 and left old containers running
-    docker stop $OLD_PLUGIN_CONTAINER_NAME >/dev/null 2>&1 || true
-    docker stop $OLD_PROXY_CONTAINER_NAME >/dev/null 2>&1 || true
+    util_op stop-container $OLD_PLUGIN_CONTAINER_NAME >/dev/null 2>&1 || true
+    util_op stop-container $OLD_PROXY_CONTAINER_NAME >/dev/null 2>&1 || true
     conntrack -D -p udp --dport $PORT >/dev/null 2>&1 || true
 }
 
@@ -1346,18 +1324,13 @@ COMMAND=$1
 shift 1
 
 case "$COMMAND" in
-    setup)
-        for img in $IMAGE $EXEC_IMAGE $WEAVEDB_IMAGE ; do
-            docker pull $img
-        done
-        setup_cni
-        ;;
-    setup-cni)
+    setup|setup-cni)
         setup_cni
         ;;
     version)
         [ $# -eq 0 ] || usage
-        ask_version $CONTAINER_NAME $IMAGE || true
+        VERSION="weave $(call_weave GET /report --get --data-urlencode "format={{ .Version }}" 2> /dev/null)" || VERSION="$(/home/weave/weaver $COVERAGE_ARGS --version)"
+        echo $VERSION
         ;;
     attach-bridge)
         if detect_bridge_type ; then
@@ -1372,7 +1345,7 @@ case "$COMMAND" in
         detect_bridge_type && echo $BRIDGE_TYPE
         ;;
     launch)
-        check_not_running router $CONTAINER_NAME        $BASE_IMAGE
+        check_not_running $CONTAINER_NAME $BASE_IMAGE
         if http_call $HTTP_ADDR GET /status >/dev/null 2>&1 ; then
             echo "Weave Net is already running" >&2
             exit 1
@@ -1470,7 +1443,7 @@ case "$COMMAND" in
             shift
         done
         [ $# -eq 1 ] || usage
-        CONTAINER=$(container_id $1)
+        CONTAINER=$(util_op container-id $1)
         create_bridge
         ipam_cidrs allocate $CONTAINER $CIDR_ARGS
         [ -n "$REWRITE_HOSTS" ] && rewrite_etc_hosts $DNS_EXTRA_HOSTS
@@ -1482,7 +1455,7 @@ case "$COMMAND" in
         collect_cidr_args "$@"
         shift $CIDR_ARG_COUNT
         [ $# -eq 1 ] || usage
-        CONTAINER=$(container_id $1)
+        CONTAINER=$(util_op container-id $1)
         ipam_cidrs lookup $CONTAINER $CIDR_ARGS
         util_op detach-container $CONTAINER $ALL_CIDRS >/dev/null
         when_weave_running with_container_fqdn $CONTAINER delete_dns_fqdn $ALL_CIDRS
@@ -1575,11 +1548,11 @@ case "$COMMAND" in
         esac
         stop
         for NAME in $CONTAINER_NAME $OLD_PROXY_CONTAINER_NAME $OLD_PLUGIN_CONTAINER_NAME ; do
-            docker rm -f $NAME >/dev/null 2>&1 || true
+            util_op remove-container -f $NAME >/dev/null 2>&1 || true
         done
         protect_against_docker_hang
-        VOLUME_CONTAINERS=$(docker ps -qa --filter label=weavevolumes)
-        [ -n "$VOLUME_CONTAINERS" ] && docker rm -v $VOLUME_CONTAINERS  >/dev/null 2>&1 || true
+        VOLUME_CONTAINERS=$(util_op list-containers $VOLUMES_LABEL)
+        [ -n "$VOLUME_CONTAINERS" ] && util_op remove-container -v $VOLUME_CONTAINERS  >/dev/null 2>&1 || true
         # weave-kube and v2-plugin put this file in different places; remove either
         rm -f $HOST_ROOT/var/lib/weave/weave-netdata.db >/dev/null 2>&1 || true
         rm -f $HOST_ROOT/var/lib/weave/weavedata.db     >/dev/null 2>&1 || true