Fuck tabs.  And gofmt in particular.
docker-hosts should run as a non-privileged user

That goes for everything, really.
Replace flags with github.com/jessevdk/go-flags