diff --git a/build/docker/scripts/sca.sh b/build/docker/scripts/sca.sh
new file mode 100755
index 0000000..2f2fb68
--- /dev/null
+++ b/build/docker/scripts/sca.sh
@@ -0,0 +1,48 @@
+#!/bin/sh
+set -ev
+
+#
+# C/C++ static code analysis with cppcheck
+# add --error-exitcode=1 to --enable=all as soon as everything is fixed
+#
+# Python code style check with flake8
+#
+# search for TODO etc within source tree
+# some statistics about the code base
+# some info about the build machine
+
+# Compiler cppcheck (All)
+cppcheck --force --quiet --inline-suppr --enable=all -j2 compiler/cpp/src
+
+# C++ cppcheck (All)
+cppcheck --force --quiet --inline-suppr --enable=all -j2 lib/cpp/src lib/cpp/test test/cpp tutorial/cpp
+
+# C Glib cppcheck (All)
+cppcheck --force --quiet --inline-suppr --enable=all -j2 lib/c_glib/src lib/c_glib/test test/c_glib/src tutorial/c_glib
+
+# Silent error checks
+cppcheck --force --quiet --inline-suppr --error-exitcode=1 -j2 compiler/cpp/src
+cppcheck --force --quiet --inline-suppr --error-exitcode=1 -j2 lib/cpp/src lib/cpp/test test/cpp tutorial/cpp
+cppcheck --force --quiet --inline-suppr --error-exitcode=1 -j2 lib/c_glib/src lib/c_glib/test test/c_glib/src tutorial/c_glib
+
+# Python code style
+flake8 --ignore=E501 lib/py
+flake8 tutorial/py
+flake8 --ignore=E501 test/py
+flake8 test/py.twisted
+flake8 test/py.tornado
+flake8 --ignore=E501 test/test.py
+flake8 --ignore=E501 test/crossrunner
+flake8 test/features
+
+# TODO etc
+echo FIXMEs: `grep -r FIXME * | wc -l`
+echo  HACKs: `grep -r HACK * | wc -l`
+echo  TODOs: `grep -r TODO * | wc -l`
+
+# LoC
+sloccount .
+
+# System Info
+dpkg -l
+uname -a
diff --git a/build/docker/scripts/ubsan.sh b/build/docker/scripts/ubsan.sh
index e1e82c9..650dba0 100755
--- a/build/docker/scripts/ubsan.sh
+++ b/build/docker/scripts/ubsan.sh
@@ -1,27 +1,28 @@
 #!/bin/sh
 
-set -ex
+set -e
 
-# Wraps autotools.sh, but each binary crashes if it exhibits undefined behavior. See
-# http://releases.llvm.org/3.8.0/tools/clang/docs/UndefinedBehaviorSanitizer.html
-
+# Wraps autotools.sh, but each binary crashes if it exhibits undefined behavior. 
 # Set the undefined behavior flags. This crashes on all undefined behavior except for
 # undefined casting, aka "vptr".
-#
 # TODO: fix undefined vptr behavior and turn this option back on.
-export CFLAGS="-fsanitize=undefined -fno-sanitize-recover=undefined"
-# Builds without optimization and with debugging symbols for making crash reports more
-# readable.
-export CFLAGS="${CFLAGS} -O0 -ggdb3"
+
+export CFLAGS="-fsanitize=undefined -fno-sanitize-recover=undefined -O0 -ggdb3 -fno-omit-frame-pointer"
 export CXXFLAGS="${CFLAGS}"
+export LDFLAGS="-lubsan"
 export UBSAN_OPTIONS=print_stacktrace=1
 
-# llvm-symbolizer must be on PATH, but the above installation instals a binary called
-# "llvm-symbolizer-3.8", not "llvm-symbolizer". This fixes that with a softlink in a new
-# directory.
+#
+# work around https://svn.boost.org/trac10/ticket/11632 if present
+#
+
+sed -i 's/, stream_t(rdbuf()) /, stream_t(pbase_type::member.get())/g' /usr/include/boost/format/alt_sstream.hpp
+
+# llvm-symbolizer must be on PATH to get a stack trace on error
+
 CLANG_PATH="$(mktemp -d)"
 trap "rm -rf ${CLANG_PATH}" EXIT
-ln -s "$(whereis llvm-symbolizer-3.8  | rev | cut -d ' ' -f 1 | rev)" \
+ln -s "$(whereis llvm-symbolizer-4.0  | rev | cut -d ' ' -f 1 | rev)" \
   "${CLANG_PATH}/llvm-symbolizer"
 export PATH="${CLANG_PATH}:${PATH}"
 llvm-symbolizer -version