diff --git a/api/jobs/replication.go b/api/jobs/replication.go
index 0dee3765b..2cf6b05db 100644
--- a/api/jobs/replication.go
+++ b/api/jobs/replication.go
@@ -181,13 +181,14 @@ func getRepoList(projectID int64) ([]string, error) {
 		log.Errorf("Error when calling UI api to get repositories, error: %v", err)
 		return nil, err
 	}
+	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
 		log.Errorf("Unexpected status code: %d", resp.StatusCode)
 		dump, _ := httputil.DumpResponse(resp, true)
 		log.Debugf("response: %q", dump)
 		return nil, fmt.Errorf("Unexpected status code when getting repository list: %d", resp.StatusCode)
 	}
-	defer resp.Body.Close()
+
 	body, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		log.Errorf("Failed to read the response body, error: %v", err)
diff --git a/api/replication_job.go b/api/replication_job.go
index 93ce92183..ae3d080a3 100644
--- a/api/replication_job.go
+++ b/api/replication_job.go
@@ -155,7 +155,7 @@ func (ra *RepJobAPI) GetLog() {
 		log.Errorf("failed to get log for job %d: %v", ra.jobID, err)
 		ra.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
 	}
-
+	defer resp.Body.Close()
 	if resp.StatusCode == http.StatusOK {
 		ra.Ctx.ResponseWriter.Header().Set(http.CanonicalHeaderKey("Content-Length"), resp.Header.Get(http.CanonicalHeaderKey("Content-Length")))
 		ra.Ctx.ResponseWriter.Header().Set(http.CanonicalHeaderKey("Content-Type"), "text/plain")
@@ -167,7 +167,6 @@ func (ra *RepJobAPI) GetLog() {
 		return
 	}
 
-	defer resp.Body.Close()
 	b, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		log.Errorf("failed to read reponse body: %v", err)
diff --git a/api/utils.go b/api/utils.go
index 3aafebb1c..0eabc5793 100644
--- a/api/utils.go
+++ b/api/utils.go
@@ -119,13 +119,12 @@ func TriggerReplication(policyID int64, repository string,
 	if err != nil {
 		return err
 	}
+	defer resp.Body.Close()
 
 	if resp.StatusCode == http.StatusOK {
 		return nil
 	}
 
-	defer resp.Body.Close()
-
 	b, err = ioutil.ReadAll(resp.Body)
 	if err != nil {
 		return err
@@ -194,12 +193,12 @@ func postReplicationAction(policyID int64, acton string) error {
 		return err
 	}
 
+	defer resp.Body.Close()
+
 	if resp.StatusCode == http.StatusOK {
 		return nil
 	}
 
-	defer resp.Body.Close()
-
 	b, err = ioutil.ReadAll(resp.Body)
 	if err != nil {
 		return err
diff --git a/job/replication/transfer.go b/job/replication/transfer.go
index 506f35477..7226883a4 100644
--- a/job/replication/transfer.go
+++ b/job/replication/transfer.go
@@ -250,6 +250,8 @@ func (c *Checker) projectExist() (exist, canWrite bool, err error) {
 		return
 	}
 
+	defer resp.Body.Close()
+
 	if resp.StatusCode == http.StatusNotFound {
 		return
 	}
@@ -259,7 +261,6 @@ func (c *Checker) projectExist() (exist, canWrite bool, err error) {
 		return
 	}
 
-	defer resp.Body.Close()
 	data, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		return
@@ -328,6 +329,8 @@ func (c *Checker) createProject(isPublic bool) error {
 		return err
 	}
 
+	defer resp.Body.Close()
+
 	// version 0.1.1's reponse code is 200
 	if resp.StatusCode == http.StatusCreated ||
 		resp.StatusCode == http.StatusOK {
@@ -338,7 +341,6 @@ func (c *Checker) createProject(isPublic bool) error {
 		return ErrConflict
 	}
 
-	defer resp.Body.Close()
 	message, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		c.logger.Errorf("an error occurred while reading message from response: %v", err)
@@ -460,6 +462,9 @@ func (b *BlobTransfer) enter() (string, error) {
 			b.logger.Errorf("an error occurred while pulling blob %s of %s:%s from %s: %v", blob, name, tag, b.srcURL, err)
 			return "", err
 		}
+		if data != nil {
+			defer data.Close()
+		}
 		if err = b.dstClient.PushBlob(blob, size, data); err != nil {
 			b.logger.Errorf("an error occurred while pushing blob %s of %s:%s to %s : %v", blob, name, tag, b.dstURL, err)
 			return "", err
diff --git a/utils/registry/auth/authorizer.go b/utils/registry/auth/authorizer.go
index 5f81e1e22..ea21dfb02 100644
--- a/utils/registry/auth/authorizer.go
+++ b/utils/registry/auth/authorizer.go
@@ -55,6 +55,7 @@ func NewAuthorizerStore(endpoint string, insecure bool, authorizers ...Authorize
 	if err != nil {
 		return nil, err
 	}
+	defer resp.Body.Close()
 
 	challenges := ParseChallengeFromResponse(resp)
 	return &AuthorizerStore{
diff --git a/utils/registry/registry.go b/utils/registry/registry.go
index 49b2cd124..0ef6e9dc9 100644
--- a/utils/registry/registry.go
+++ b/utils/registry/registry.go
@@ -131,13 +131,12 @@ func (r *Registry) Ping() error {
 	if err != nil {
 		return parseError(err)
 	}
+	defer resp.Body.Close()
 
 	if resp.StatusCode == http.StatusOK {
 		return nil
 	}
 
-	defer resp.Body.Close()
-
 	b, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		return err
diff --git a/utils/registry/repository.go b/utils/registry/repository.go
index 0d5abce40..5ae2eb9d7 100644
--- a/utils/registry/repository.go
+++ b/utils/registry/repository.go
@@ -150,6 +150,8 @@ func (r *Repository) ManifestExist(reference string) (digest string, exist bool,
 		return
 	}
 
+	defer resp.Body.Close()
+
 	if resp.StatusCode == http.StatusOK {
 		exist = true
 		digest = resp.Header.Get(http.CanonicalHeaderKey("Docker-Content-Digest"))
@@ -160,8 +162,6 @@ func (r *Repository) ManifestExist(reference string) (digest string, exist bool,
 		return
 	}
 
-	defer resp.Body.Close()
-
 	b, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		return
@@ -227,13 +227,13 @@ func (r *Repository) PushManifest(reference, mediaType string, payload []byte) (
 		return
 	}
 
+	defer resp.Body.Close()
+
 	if resp.StatusCode == http.StatusCreated {
 		digest = resp.Header.Get(http.CanonicalHeaderKey("Docker-Content-Digest"))
 		return
 	}
 
-	defer resp.Body.Close()
-
 	b, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		return
@@ -259,12 +259,12 @@ func (r *Repository) DeleteManifest(digest string) error {
 		return parseError(err)
 	}
 
+	defer resp.Body.Close()
+
 	if resp.StatusCode == http.StatusAccepted {
 		return nil
 	}
 
-	defer resp.Body.Close()
-
 	b, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		return err
@@ -304,6 +304,8 @@ func (r *Repository) BlobExist(digest string) (bool, error) {
 		return false, parseError(err)
 	}
 
+	defer resp.Body.Close()
+
 	if resp.StatusCode == http.StatusOK {
 		return true, nil
 	}
@@ -312,8 +314,6 @@ func (r *Repository) BlobExist(digest string) (bool, error) {
 		return false, nil
 	}
 
-	defer resp.Body.Close()
-
 	b, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		return false, err
@@ -325,7 +325,7 @@ func (r *Repository) BlobExist(digest string) (bool, error) {
 	}
 }
 
-// PullBlob ...
+// PullBlob : client must close data if it is not nil
 func (r *Repository) PullBlob(digest string) (size int64, data io.ReadCloser, err error) {
 	req, err := http.NewRequest("GET", buildBlobURL(r.Endpoint.String(), r.Name, digest), nil)
 	if err != nil {
@@ -349,6 +349,7 @@ func (r *Repository) PullBlob(digest string) (size int64, data io.ReadCloser, er
 	}
 
 	defer resp.Body.Close()
+
 	b, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		return
@@ -372,14 +373,14 @@ func (r *Repository) initiateBlobUpload(name string) (location, uploadUUID strin
 		return
 	}
 
+	defer resp.Body.Close()
+
 	if resp.StatusCode == http.StatusAccepted {
 		location = resp.Header.Get(http.CanonicalHeaderKey("Location"))
 		uploadUUID = resp.Header.Get(http.CanonicalHeaderKey("Docker-Upload-UUID"))
 		return
 	}
 
-	defer resp.Body.Close()
-
 	b, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		return
@@ -404,12 +405,12 @@ func (r *Repository) monolithicBlobUpload(location, digest string, size int64, d
 		return parseError(err)
 	}
 
+	defer resp.Body.Close()
+
 	if resp.StatusCode == http.StatusCreated {
 		return nil
 	}
 
-	defer resp.Body.Close()
-
 	b, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		return err
@@ -443,12 +444,12 @@ func (r *Repository) DeleteBlob(digest string) error {
 		return parseError(err)
 	}
 
+	defer resp.Body.Close()
+
 	if resp.StatusCode == http.StatusAccepted {
 		return nil
 	}
 
-	defer resp.Body.Close()
-
 	b, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		return err