diff --git a/cmd/coordinator/.gitignore b/cmd/coordinator/.gitignore
index 91d0fb0..6a029fb 100644
--- a/cmd/coordinator/.gitignore
+++ b/cmd/coordinator/.gitignore
@@ -1,3 +1,4 @@
 buildongce/client-*.dat
 buildongce/token.dat
 coordinator
+ca-certificates.crt
diff --git a/cmd/coordinator/Dockerfile b/cmd/coordinator/Dockerfile
index da9fe20..4e92885 100644
--- a/cmd/coordinator/Dockerfile
+++ b/cmd/coordinator/Dockerfile
@@ -1,46 +1,9 @@
 # Copyright 2017 The Go Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style
 # license that can be found in the LICENSE file.
-
-FROM golang:1.8-wheezy
+FROM scratch
 LABEL maintainer "golang-dev@googlegroups.com"
 
-# You can verify this list with prdeps:
-# go get github.com/davecheney/prdeps
-# prdeps -d 1 golang.org/x/build/cmd/coordinator
-
-RUN go get -d cloud.google.com/go/compute/metadata cloud.google.com/go/datastore cloud.google.com/go/storage
-RUN cd /go/src/cloud.google.com/go && git reset --hard cd0da878c66091060d2e7403abd62192b3e387e0
-
-RUN go get -d golang.org/x/time/rate
-RUN cd /go/src/golang.org/x/time/rate && git reset --hard f51c12702a4d776e4c1fa9b0fabab841babae631
-
-RUN go get -d golang.org/x/oauth2 golang.org/x/oauth2/google
-RUN cd /go/src/golang.org/x/oauth2 && git reset --hard 314dd2c0bf3ebd592ec0d20847d27e79d0dbe8dd
-
-RUN go get -d golang.org/x/crypto/acme/autocert
-RUN cd /go/src/golang.org/x/crypto && git reset --hard 573951cbe80bb6352881271bb276f48749eab6f4
-
-RUN go get -d go4.org/syncutil
-RUN cd /go/src/go4.org && git reset --hard 7ce08ca145dbe0e66a127c447b80ee7914f3e4f9
-
-RUN go get -d golang.org/x/net/context
-RUN cd /go/src/golang.org/x/net && git reset --hard f2499483f923065a842d38eb4c7f1927e6fc6e6d
-
-RUN go get -d google.golang.org/api/container/v1 google.golang.org/api/compute/v1 google.golang.org/api/googleapi
-RUN cd /go/src/google.golang.org/api && git reset --hard dfa61ae24628a06502b9c2805d983b57e89399b5
-
-RUN go get -d google.golang.org/genproto/googleapis/type/latlng
-RUN cd /go/src/google.golang.org/genproto  && git reset --hard b3e7c2fb04031add52c4817f53f43757ccbf9c18
-RUN go get -d google.golang.org/genproto/googleapis/datastore/v1
-
-RUN go get -d gopkg.in/inf.v0
-RUN cd /go/src/gopkg.in/inf.v0 && git reset --hard 3887ee99ecf07df5b447e9b00d9c0b2adaa9f3e4
-
-RUN cd /go/src/google.golang.org/grpc && git reset --hard 50955793b0183f9de69bd78e2ec251cf20aab121
-
-COPY . /go/src/golang.org/x/build/
-
-RUN go install golang.org/x/build/cmd/coordinator
-
-ENTRYPOINT ["/go/bin/coordinator"]
+COPY ca-certificates.crt /etc/ssl/certs/
+COPY coordinator /
+ENTRYPOINT ["/coordinator"]
diff --git a/cmd/coordinator/Dockerfile.0 b/cmd/coordinator/Dockerfile.0
new file mode 100644
index 0000000..c2ea01c
--- /dev/null
+++ b/cmd/coordinator/Dockerfile.0
@@ -0,0 +1,44 @@
+# Copyright 2017 The Go Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style
+# license that can be found in the LICENSE file.
+
+FROM golang:1.8
+LABEL maintainer "golang-dev@googlegroups.com"
+
+# You can verify this list with prdeps:
+# go get github.com/davecheney/prdeps
+# prdeps -d 1 golang.org/x/build/cmd/coordinator
+
+RUN go get -d cloud.google.com/go/compute/metadata cloud.google.com/go/datastore cloud.google.com/go/storage
+RUN cd /go/src/cloud.google.com/go && git reset --hard cd0da878c66091060d2e7403abd62192b3e387e0
+
+RUN go get -d golang.org/x/time/rate
+RUN cd /go/src/golang.org/x/time/rate && git reset --hard f51c12702a4d776e4c1fa9b0fabab841babae631
+
+RUN go get -d golang.org/x/oauth2 golang.org/x/oauth2/google
+RUN cd /go/src/golang.org/x/oauth2 && git reset --hard 314dd2c0bf3ebd592ec0d20847d27e79d0dbe8dd
+
+RUN go get -d golang.org/x/crypto/acme/autocert
+RUN cd /go/src/golang.org/x/crypto && git reset --hard 573951cbe80bb6352881271bb276f48749eab6f4
+
+RUN go get -d go4.org/syncutil
+RUN cd /go/src/go4.org && git reset --hard 7ce08ca145dbe0e66a127c447b80ee7914f3e4f9
+
+RUN go get -d golang.org/x/net/context
+RUN cd /go/src/golang.org/x/net && git reset --hard f2499483f923065a842d38eb4c7f1927e6fc6e6d
+
+RUN go get -d google.golang.org/api/container/v1 google.golang.org/api/compute/v1 google.golang.org/api/googleapi
+RUN cd /go/src/google.golang.org/api && git reset --hard dfa61ae24628a06502b9c2805d983b57e89399b5
+
+RUN go get -d google.golang.org/genproto/googleapis/type/latlng
+RUN cd /go/src/google.golang.org/genproto  && git reset --hard b3e7c2fb04031add52c4817f53f43757ccbf9c18
+RUN go get -d google.golang.org/genproto/googleapis/datastore/v1
+
+RUN go get -d gopkg.in/inf.v0
+RUN cd /go/src/gopkg.in/inf.v0 && git reset --hard 3887ee99ecf07df5b447e9b00d9c0b2adaa9f3e4
+
+RUN cd /go/src/google.golang.org/grpc && git reset --hard 50955793b0183f9de69bd78e2ec251cf20aab121
+
+COPY . /go/src/golang.org/x/build/
+
+RUN go install -ldflags "-linkmode=external -extldflags '-static -pthread'" golang.org/x/build/cmd/coordinator
diff --git a/cmd/coordinator/Makefile b/cmd/coordinator/Makefile
index 1c8c33b..60ddd4a 100644
--- a/cmd/coordinator/Makefile
+++ b/cmd/coordinator/Makefile
@@ -16,8 +16,33 @@
 	go install golang.org/x/build/cmd/upload
 	upload --verbose --osarch=linux-amd64 --file=go:golang.org/x/build/cmd/coordinator --public dev-go-builder-data/coordinator
 
-# Work-in-progress:
-docker-prod: FORCE
-	docker build -f Dockerfile --tag=gcr.io/symbolic-datum-552/coordinator:latest ../..
-docker-dev: FORCE
-	docker build -f Dockerfile --tag=gcr.io/go-dashboard-dev/coordinator:latest ../..
+VERSION=v1
+DOCKER_IMAGE_STAGE0=stage0/coordinator:latest
+DOCKER_CTR_STAGE0=coordinator-stage0
+
+stage0: *.go Dockerfile.0
+	docker build --force-rm -f Dockerfile.0 --tag=$(DOCKER_IMAGE_STAGE0) ../..
+
+coordinator: stage0
+	docker create --name $(DOCKER_CTR_STAGE0) $(DOCKER_IMAGE_STAGE0)
+	docker cp $(DOCKER_CTR_STAGE0):/go/bin/$@ $@
+	docker rm $(DOCKER_CTR_STAGE0)
+
+ca-certificates.crt:
+	docker create --name $(DOCKER_CTR_STAGE0) $(DOCKER_IMAGE_STAGE0)
+	docker cp $(DOCKER_CTR_STAGE0):/etc/ssl/certs/$@ $@
+	docker rm $(DOCKER_CTR_STAGE0)
+
+docker-prod: Dockerfile coordinator ca-certificates.crt
+	docker build --force-rm --tag=gcr.io/symbolic-datum-552/coordinator:$(VERSION) .
+docker-dev: Dockerfile coordinator ca-certificates.crt
+	docker build --force-rm --tag=gcr.io/go-dashboard-dev/coordinator:latest .
+
+push-prod: docker-prod
+	gcloud docker -- push gcr.io/symbolic-datum-552/coordinator:$(VERSION)
+push-dev: docker-dev
+	gcloud docker -- push gcr.io/go-dashboard-dev/coordinator:latest
+
+clean: FORCE
+	$(RM) coordinator
+	$(RM) ca-certificates.crt