diff --git a/cmd/gitmirror/.gitignore b/cmd/gitmirror/.gitignore
new file mode 100644
index 0000000..ad91027
--- /dev/null
+++ b/cmd/gitmirror/.gitignore
@@ -0,0 +1 @@
+gitmirror
diff --git a/cmd/gitmirror/Dockerfile b/cmd/gitmirror/Dockerfile
index ec4bec2..0c3e7de 100644
--- a/cmd/gitmirror/Dockerfile
+++ b/cmd/gitmirror/Dockerfile
@@ -1,36 +1,25 @@
 # Copyright 2017 The Go Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style
 # license that can be found in the LICENSE file.
-
-# Note that OpenSSH 6.5+ is required for the Github SSH private key, which requires
-# at least Debian Jessie (not Wheezy). This uses Jessie:
-FROM golang:1.8
+FROM debian:jessie
 LABEL maintainer "golang-dev@googlegroups.com"
 
-# todo(bradfitz): remove duplication between this and coordinator.
-# Maybe make both derive FROM "golang_org:buildbase" or something. But
-# then I want to make sure that FROM base is rebuilt always when things in
-# x/build change.
+# For interacting with the Go source & subrepos
+RUN apt-get update && apt-get install -y \
+	--no-install-recommends \
+	ca-certificates \
+	git-core \
+	openssh-client \
+	&& rm -rf /var/lib/apt/lists/*
 
-# You can verify this list with prdeps:
-# go get github.com/davecheney/prdeps
-# prdeps -d 1 golang.org/x/build/cmd/coordinator
+# Add Github.com's known_hosts entries, so git push calls later don't
+# prompt, and don't need to have their strict host key checking
+# disabled.
+RUN mkdir -p ~/.ssh/ \
+	&& chmod 0700 ~/.ssh/ \
+	&& echo "|1|SFEvEAqYsJ18JCr+0iV4GtlwS4w=|P6oCZUUd/5t9pH4Om7ShlfltRyE= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==" > ~/.ssh/known_hosts \
+	&& echo "|1|HygGkfOGLovavKfixjXWFJ7Yk1I=|lb/724row8KDTMC1dZiJlHyjxWM= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==" >> ~/.ssh/known_hosts \
+	&& chmod 0600 ~/.ssh/known_hosts
 
-RUN go get -d cloud.google.com/go/compute/metadata
-RUN cd /go/src/cloud.google.com/go/compute/metadata && git reset --hard cd0da878c66091060d2e7403abd62192b3e387e0
-# Need to rerun because cd0da878 depends on gax-go and tip doesn't.
-RUN go get -d -v cloud.google.com/go/compute/metadata
-
-RUN go get -d golang.org/x/net/context golang.org/x/net/context/ctxhttp
-RUN cd /go/src/golang.org/x/net && git reset --hard f2499483f923065a842d38eb4c7f1927e6fc6e6d
-
-RUN cd /go/src/google.golang.org/grpc && git reset --hard 50955793b0183f9de69bd78e2ec251cf20aab121
-
-COPY /cmd/gitmirror/install-apt-deps.sh /scripts/install-apt-deps.sh
-RUN  /scripts/install-apt-deps.sh
-
-COPY . /go/src/golang.org/x/build/
-
-RUN go install golang.org/x/build/cmd/gitmirror
-
-ENTRYPOINT ["/go/bin/gitmirror"]
+COPY gitmirror /
+ENTRYPOINT ["/gitmirror"]
diff --git a/cmd/gitmirror/Dockerfile.0 b/cmd/gitmirror/Dockerfile.0
new file mode 100644
index 0000000..64bca93
--- /dev/null
+++ b/cmd/gitmirror/Dockerfile.0
@@ -0,0 +1,26 @@
+# Copyright 2017 The Go Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style
+# license that can be found in the LICENSE file.
+
+# Note that OpenSSH 6.5+ is required for the Github SSH private key, which requires
+# at least Debian Jessie (not Wheezy). This uses Jessie:
+FROM golang:1.8
+LABEL maintainer "golang-dev@googlegroups.com"
+
+# You can verify this list with prdeps:
+# go get github.com/davecheney/prdeps
+# prdeps -d 1 golang.org/x/build/cmd/coordinator
+
+RUN go get -d cloud.google.com/go/compute/metadata
+RUN cd /go/src/cloud.google.com/go/compute/metadata && git reset --hard cd0da878c66091060d2e7403abd62192b3e387e0
+# Need to rerun because cd0da878 depends on gax-go and tip doesn't.
+RUN go get -d -v cloud.google.com/go/compute/metadata
+
+RUN go get -d golang.org/x/net/context golang.org/x/net/context/ctxhttp
+RUN cd /go/src/golang.org/x/net && git reset --hard f2499483f923065a842d38eb4c7f1927e6fc6e6d
+
+RUN cd /go/src/google.golang.org/grpc && git reset --hard 50955793b0183f9de69bd78e2ec251cf20aab121
+
+COPY . /go/src/golang.org/x/build/
+
+RUN go install golang.org/x/build/cmd/gitmirror
diff --git a/cmd/gitmirror/Makefile b/cmd/gitmirror/Makefile
index 1c998c7..b034456 100644
--- a/cmd/gitmirror/Makefile
+++ b/cmd/gitmirror/Makefile
@@ -3,13 +3,27 @@
 # license that can be found in the LICENSE file.
 
 VERSION=v4
+DOCKER_IMAGE_build0=build0/gitmirror:latest
+DOCKER_CTR_build0=gitmirror-build0
 
-docker-prod: Dockerfile
-	docker build -f Dockerfile --tag=gcr.io/symbolic-datum-552/gitmirror:$(VERSION)  ../..
-docker-dev: Dockerfile
-	docker build -f Dockerfile --tag=gcr.io/go-dashboard-dev/gitmirror:latest  ../..
+build0: *.go Dockerfile.0
+	docker build --force-rm -f Dockerfile.0 --tag=$(DOCKER_IMAGE_build0) ../..
+
+gitmirror: build0
+	docker create --name $(DOCKER_CTR_build0) $(DOCKER_IMAGE_build0)
+	docker cp $(DOCKER_CTR_build0):/go/bin/$@ $@
+	docker rm $(DOCKER_CTR_build0)
+
+docker-prod: Dockerfile gitmirror
+	docker build --force-rm --tag=gcr.io/symbolic-datum-552/gitmirror:$(VERSION) .
+docker-dev: Dockerfile gitmirror
+	docker build --force-rm --tag=gcr.io/go-dashboard-dev/gitmirror:latest .
 
 push-prod: docker-prod
 	gcloud docker -- push gcr.io/symbolic-datum-552/gitmirror:$(VERSION)
 push-dev: docker-dev
 	gcloud docker -- push gcr.io/go-dashboard-dev/gitmirror:latest
+
+.PHONY: clean
+clean:
+	$(RM) gitmirror
diff --git a/cmd/gitmirror/install-apt-deps.sh b/cmd/gitmirror/install-apt-deps.sh
deleted file mode 100755
index 4d5254f..0000000
--- a/cmd/gitmirror/install-apt-deps.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-# Copyright 2015 The Go Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style
-# license that can be found in the LICENSE file.
-
-set -ex
-
-apt-get update
-apt-get install -y --no-install-recommends ca-certificates
-# For interacting with the Go source & subrepos:
-apt-get install -y --no-install-recommends git-core openssh-client
-
-apt-get clean
-rm -fr /var/lib/apt/lists
-
-mkdir -p ~/.ssh/
-chmod 0700 ~/.ssh/
-
-# Add Github.com's known_hosts entries, so git push calls later don't
-# prompt, and don't need to have their strict host key checking
-# disabled.
-echo "|1|SFEvEAqYsJ18JCr+0iV4GtlwS4w=|P6oCZUUd/5t9pH4Om7ShlfltRyE= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==" > ~/.ssh/known_hosts
-echo "|1|HygGkfOGLovavKfixjXWFJ7Yk1I=|lb/724row8KDTMC1dZiJlHyjxWM= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==" >> ~/.ssh/known_hosts
-chmod 0600 ~/.ssh/known_hosts