diff --git a/cmd/buildlet/stage0/Dockerfile b/cmd/buildlet/stage0/Dockerfile
index fc7f4d5..579cd39 100644
--- a/cmd/buildlet/stage0/Dockerfile
+++ b/cmd/buildlet/stage0/Dockerfile
@@ -2,32 +2,28 @@
 # Use of this source code is governed by a BSD-style
 # license that can be found in the LICENSE file.
 
-FROM golang:1.11
+FROM golang:1.12 AS build
 LABEL maintainer "golang-dev@googlegroups.com"
 
-ENV CGO_ENABLED=0
+ENV GO111MODULE=on
+ENV GOPROXY=https://proxy.golang.org
 
-# BEGIN deps (run `make update-deps` to update)
+RUN mkdir /gocache
+ENV GOCACHE /gocache
 
-# Repo cloud.google.com/go at 5c31045 (2018-05-08)
-ENV REV=5c31045bc3f4855c97f997a1940dfefc1598aa2d
-RUN go get -d cloud.google.com/go/compute/metadata &&\
-    (cd /go/src/cloud.google.com/go && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
+COPY go.mod /go/src/golang.org/x/build/go.mod
+COPY go.sum /go/src/golang.org/x/build/go.sum
 
-# Repo golang.org/x/net at d11bb6c (2018-05-07)
-ENV REV=d11bb6cd8e3c4e60239c9cb20ef68586d74500d0
-RUN go get -d golang.org/x/net/context `#and 2 other pkgs` &&\
-    (cd /go/src/golang.org/x/net && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
+WORKDIR /go/src/golang.org/x/build
 
-# Optimization to speed up iterative development, not necessary for correctness:
-RUN go install cloud.google.com/go/compute/metadata \
-	golang.org/x/net/context \
-	golang.org/x/net/context/ctxhttp
-# END deps.
+# Optimization for iterative docker build speed, not necessary for correctness:
+# TODO: write a tool to make writing Go module-friendly Dockerfiles easier.
+RUN go install cloud.google.com/go/compute/metadata
 
 COPY . /go/src/golang.org/x/build/
 
-# Install static binary to /go/bin/stage0
+# Install binary to /go/bin/stage0
 RUN go install golang.org/x/build/cmd/buildlet/stage0
 
-
+FROM golang:1.12
+COPY --from=build /go/bin/stage0 /go/bin/stage0
diff --git a/cmd/buildlet/stage0/Makefile b/cmd/buildlet/stage0/Makefile
index 174ce74..899c644 100644
--- a/cmd/buildlet/stage0/Makefile
+++ b/cmd/buildlet/stage0/Makefile
@@ -14,10 +14,6 @@
 
 FORCE:
 
-update-deps:
-	go install golang.org/x/build/cmd/gitlock
-	gitlock --update=Dockerfile golang.org/x/build/cmd/buildlet/stage0
-
 docker: Dockerfile
 	go install golang.org/x/build/cmd/xb
 	xb docker build --force-rm -f Dockerfile --tag=golang/buildlet-stage0 ../../..
diff --git a/cmd/scaleway/Dockerfile b/cmd/scaleway/Dockerfile
index 8fdb445..b76e26a 100644
--- a/cmd/scaleway/Dockerfile
+++ b/cmd/scaleway/Dockerfile
@@ -5,21 +5,25 @@
 FROM golang:1.12-stretch AS build
 LABEL maintainer "golang-dev@googlegroups.com"
 
-# BEGIN deps (run `make update-deps` to update)
+ENV GO111MODULE=on
+ENV GOPROXY=https://proxy.golang.org
 
-# Repo go4.org at ce4c26f (2019-02-17)
-ENV REV=ce4c26f7be8eb27dc77f996b08d286dd80bc4a01
-RUN go get -d go4.org/types &&\
-    (cd /go/src/go4.org && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
+RUN mkdir /gocache
+ENV GOCACHE /gocache
 
-# Optimization to speed up iterative development, not necessary for correctness:
+COPY go.mod /go/src/golang.org/x/build/go.mod
+COPY go.sum /go/src/golang.org/x/build/go.sum
+
+WORKDIR /go/src/golang.org/x/build
+
+# Optimization for iterative docker build speed, not necessary for correctness:
+# TODO: write a tool to make writing Go module-friendly Dockerfiles easier.
 RUN go install go4.org/types
-# END deps.
 
 COPY . /go/src/golang.org/x/build/
 
-RUN go install -ldflags "-X 'main.Version=$version'" golang.org/x/build/cmd/scaleway
-
+# Install binary to /go/bin:
+RUN go install golang.org/x/build/cmd/scaleway
 
 FROM debian:stretch
 
diff --git a/cmd/scaleway/Makefile b/cmd/scaleway/Makefile
index c1b2462..52a5753 100644
--- a/cmd/scaleway/Makefile
+++ b/cmd/scaleway/Makefile
@@ -4,10 +4,6 @@
 
 VERSION=latest
 
-update-deps:
-	go install golang.org/x/build/cmd/gitlock
-	gitlock --update=Dockerfile golang.org/x/build/cmd/scaleway
-
 docker: Dockerfile *.go
 	xb docker build -f Dockerfile --force-rm --tag=golang/scaleway:$(VERSION) ../..
 
diff --git a/cmd/tip/Dockerfile b/cmd/tip/Dockerfile
index 388d39a..4ae8d96 100644
--- a/cmd/tip/Dockerfile
+++ b/cmd/tip/Dockerfile
@@ -1,176 +1,34 @@
-FROM golang:1.11
+FROM golang:1.12 AS build
+
+ENV GO111MODULE=on
+ENV GOPROXY=https://proxy.golang.org
+
+RUN mkdir /gocache
+ENV GOCACHE /gocache
+
+COPY go.mod /go/src/golang.org/x/build/go.mod
+COPY go.sum /go/src/golang.org/x/build/go.sum
+
+# Optimization for iterative docker build speed, not necessary for correctness:
+# TODO: write a tool to make writing Go module-friendly Dockerfiles easier.
+RUN go install golang.org/x/crypto/acme/autocert
+RUN go install cloud.google.com/go/storage
+COPY autocertcache /go/src/golang.org/x/build/autocertcache
+RUN go install golang.org/x/build/autocertcache
+
+COPY . /go/src/golang.org/x/build/
+# Install binary to /go/bin:
+RUN go install golang.org/x/build/cmd/tip
+
+FROM golang:1.12
 
 RUN apt-get update && apt-get install --no-install-recommends -y -q build-essential git
-
-# For implicit GOCACHE (Issues 29243 and 29251), set HOME:
-RUN mkdir -p /home/gopher
-ENV HOME /home/gopher
-
 # golang puts its go install here (weird but true)
 ENV GOROOT_BOOTSTRAP /usr/local/go
 
-# BEGIN deps (run `make update-deps` to update)
-
-# Repo cloud.google.com/go at b5eca92 (2018-10-23)
-ENV REV=b5eca92245a08e245bc29c4880c9779ea4aeaa9a
-RUN go get -d cloud.google.com/go/compute/metadata `#and 7 other pkgs` &&\
-    (cd /go/src/cloud.google.com/go && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo github.com/golang/protobuf at b4deda0 (2018-04-30)
-ENV REV=b4deda0973fb4c70b50d226b1af49f3da59f5265
-RUN go get -d github.com/golang/protobuf/proto `#and 6 other pkgs` &&\
-    (cd /go/src/github.com/golang/protobuf && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo github.com/googleapis/gax-go at 317e000 (2017-09-15)
-ENV REV=317e0006254c44a0ac427cc52a0e083ff0b9622f
-RUN go get -d github.com/googleapis/gax-go &&\
-    (cd /go/src/github.com/googleapis/gax-go && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo go.opencensus.io at ebd8d31 (2018-05-16)
-ENV REV=ebd8d31470fedf6c27d0e3056653ddff642509b8
-RUN go get -d go.opencensus.io/exporter/stackdriver/propagation `#and 12 other pkgs` &&\
-    (cd /go/src/go.opencensus.io && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo golang.org/x/build at 7b78c20 (2018-12-13)
-ENV REV=7b78c2042368d5c56ee9dbd92ab5fa988c763944
-RUN go get -d golang.org/x/build/autocertcache &&\
-    (cd /go/src/golang.org/x/build && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo golang.org/x/crypto at e4dc69e (2018-11-06)
-ENV REV=e4dc69e5b2fd71dcaf8bd5d054eb936deb78d1fa
-RUN go get -d golang.org/x/crypto/acme `#and 2 other pkgs` &&\
-    (cd /go/src/golang.org/x/crypto && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo golang.org/x/net at 891ebc4 (2018-12-13)
-ENV REV=891ebc4b82d6e74f468c533b06f983c7be918a96
-RUN go get -d golang.org/x/net/context `#and 8 other pkgs` &&\
-    (cd /go/src/golang.org/x/net && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo golang.org/x/oauth2 at f42d051 (2018-11-06)
-ENV REV=f42d05182288abf10faef86d16c0d07b8d40ea2d
-RUN go get -d golang.org/x/oauth2 `#and 5 other pkgs` &&\
-    (cd /go/src/golang.org/x/oauth2 && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo golang.org/x/sys at 4d1cda0 (2018-12-13)
-ENV REV=4d1cda033e0619309c606fc686de3adcf599539e
-RUN go get -d golang.org/x/sys/unix &&\
-    (cd /go/src/golang.org/x/sys && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo golang.org/x/text at 6f44c5a (2018-10-30)
-ENV REV=6f44c5a2ea40ee3593d98cdcc905cc1fdaa660e2
-RUN go get -d golang.org/x/text/secure/bidirule `#and 4 other pkgs` &&\
-    (cd /go/src/golang.org/x/text && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo google.golang.org/api at 20530fd (2018-05-06)
-ENV REV=20530fd5d65ad2caee87891f9896d7547cb400c9
-RUN go get -d google.golang.org/api/gensupport `#and 9 other pkgs` &&\
-    (cd /go/src/google.golang.org/api && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo google.golang.org/genproto at 86e600f (2018-04-27)
-ENV REV=86e600f69ee4704c6efbf6a2a40a5c10700e76c2
-RUN go get -d google.golang.org/genproto/googleapis/api/annotations `#and 4 other pkgs` &&\
-    (cd /go/src/google.golang.org/genproto && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo google.golang.org/grpc at 07ef407 (2018-08-06)
-ENV REV=07ef407d991f1004e6c3367c8f452ed9a02f17ff
-RUN go get -d google.golang.org/grpc `#and 26 other pkgs` &&\
-    (cd /go/src/google.golang.org/grpc && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Optimization to speed up iterative development, not necessary for correctness:
-RUN go install cloud.google.com/go/compute/metadata \
-	cloud.google.com/go/iam \
-	cloud.google.com/go/internal \
-	cloud.google.com/go/internal/optional \
-	cloud.google.com/go/internal/trace \
-	cloud.google.com/go/internal/version \
-	cloud.google.com/go/storage \
-	github.com/golang/protobuf/proto \
-	github.com/golang/protobuf/protoc-gen-go/descriptor \
-	github.com/golang/protobuf/ptypes \
-	github.com/golang/protobuf/ptypes/any \
-	github.com/golang/protobuf/ptypes/duration \
-	github.com/golang/protobuf/ptypes/timestamp \
-	github.com/googleapis/gax-go \
-	go.opencensus.io/exporter/stackdriver/propagation \
-	go.opencensus.io/internal \
-	go.opencensus.io/internal/tagencoding \
-	go.opencensus.io/plugin/ochttp \
-	go.opencensus.io/plugin/ochttp/propagation/b3 \
-	go.opencensus.io/stats \
-	go.opencensus.io/stats/internal \
-	go.opencensus.io/stats/view \
-	go.opencensus.io/tag \
-	go.opencensus.io/trace \
-	go.opencensus.io/trace/internal \
-	go.opencensus.io/trace/propagation \
-	golang.org/x/build/autocertcache \
-	golang.org/x/crypto/acme \
-	golang.org/x/crypto/acme/autocert \
-	golang.org/x/net/context \
-	golang.org/x/net/context/ctxhttp \
-	golang.org/x/net/http/httpguts \
-	golang.org/x/net/http2 \
-	golang.org/x/net/http2/hpack \
-	golang.org/x/net/idna \
-	golang.org/x/net/internal/timeseries \
-	golang.org/x/net/trace \
-	golang.org/x/oauth2 \
-	golang.org/x/oauth2/google \
-	golang.org/x/oauth2/internal \
-	golang.org/x/oauth2/jws \
-	golang.org/x/oauth2/jwt \
-	golang.org/x/sys/unix \
-	golang.org/x/text/secure/bidirule \
-	golang.org/x/text/transform \
-	golang.org/x/text/unicode/bidi \
-	golang.org/x/text/unicode/norm \
-	google.golang.org/api/gensupport \
-	google.golang.org/api/googleapi \
-	google.golang.org/api/googleapi/internal/uritemplates \
-	google.golang.org/api/googleapi/transport \
-	google.golang.org/api/internal \
-	google.golang.org/api/iterator \
-	google.golang.org/api/option \
-	google.golang.org/api/storage/v1 \
-	google.golang.org/api/transport/http \
-	google.golang.org/genproto/googleapis/api/annotations \
-	google.golang.org/genproto/googleapis/iam/v1 \
-	google.golang.org/genproto/googleapis/rpc/code \
-	google.golang.org/genproto/googleapis/rpc/status \
-	google.golang.org/grpc \
-	google.golang.org/grpc/balancer \
-	google.golang.org/grpc/balancer/base \
-	google.golang.org/grpc/balancer/roundrobin \
-	google.golang.org/grpc/codes \
-	google.golang.org/grpc/connectivity \
-	google.golang.org/grpc/credentials \
-	google.golang.org/grpc/encoding \
-	google.golang.org/grpc/encoding/proto \
-	google.golang.org/grpc/grpclog \
-	google.golang.org/grpc/internal \
-	google.golang.org/grpc/internal/backoff \
-	google.golang.org/grpc/internal/channelz \
-	google.golang.org/grpc/internal/envconfig \
-	google.golang.org/grpc/internal/grpcrand \
-	google.golang.org/grpc/internal/transport \
-	google.golang.org/grpc/keepalive \
-	google.golang.org/grpc/metadata \
-	google.golang.org/grpc/naming \
-	google.golang.org/grpc/peer \
-	google.golang.org/grpc/resolver \
-	google.golang.org/grpc/resolver/dns \
-	google.golang.org/grpc/resolver/passthrough \
-	google.golang.org/grpc/stats \
-	google.golang.org/grpc/status \
-	google.golang.org/grpc/tap
-# END deps.
-
-# golang sets GOPATH=/go
-ADD . /go/src/tip
-WORKDIR /go/src/tip
-RUN go install
-ENTRYPOINT ["/go/bin/tip"]
-
 # We listen on 8080 (for historical reasons). The service.yaml maps public port 80 to 8080.
 # We also listen on 443 for LetsEncrypt TLS.
 EXPOSE 8080 443
+
+COPY --from=build /go/bin/tip /go/bin/tip
+ENTRYPOINT ["/go/bin/tip"]
diff --git a/cmd/tip/Makefile b/cmd/tip/Makefile
index 52941b2..3cb144a 100644
--- a/cmd/tip/Makefile
+++ b/cmd/tip/Makefile
@@ -14,12 +14,8 @@
 	echo "See Makefile"
 	exit 1
 
-update-deps:
-	go install golang.org/x/build/cmd/gitlock
-	gitlock --update=Dockerfile --ignore=NONE golang.org/x/tools/cmd/tip
-
 docker-image: Dockerfile *.go
-	docker build --force-rm -f Dockerfile --tag=$(IMAGE_PROD):$(VERSION) .
+	docker build --force-rm -f Dockerfile --tag=$(IMAGE_PROD):$(VERSION) ../..
 	docker tag $(IMAGE_PROD):$(VERSION) $(IMAGE_PROD):$(MUTABLE_VERSION)
 	docker tag $(IMAGE_PROD):$(VERSION) $(IMAGE_STAGING):$(VERSION)
 	docker tag $(IMAGE_PROD):$(VERSION) $(IMAGE_STAGING):$(MUTABLE_VERSION)
diff --git a/devapp/Dockerfile b/devapp/Dockerfile
index 11096d6..0431f5d 100644
--- a/devapp/Dockerfile
+++ b/devapp/Dockerfile
@@ -1,196 +1,43 @@
 # Copyright 2017 The Go Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style
 # license that can be found in the LICENSE file.
-FROM golang:1.10 AS builder
+
+FROM golang:1.12 AS builder
 LABEL maintainer "golang-dev@googlegroups.com"
 
-ENV CGO_ENABLED=0
+ENV GO111MODULE=on
+ENV GOPROXY=https://proxy.golang.org
 
-# BEGIN deps (run `make update-deps` to update)
+RUN mkdir /gocache
+ENV GOCACHE /gocache
 
-# Repo cloud.google.com/go at c41d1f0 (2018-04-11)
-ENV REV=c41d1f0620c95e5a241910263809a53a5425af0d
-RUN go get -d cloud.google.com/go/compute/metadata `#and 7 other pkgs` &&\
-    (cd /go/src/cloud.google.com/go && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
+COPY go.mod /go/src/golang.org/x/build/go.mod
+COPY go.sum /go/src/golang.org/x/build/go.sum
 
-# Repo github.com/golang/protobuf at e09c5db (2018-03-28)
-ENV REV=e09c5db296004fbe3f74490e84dcd62c3c5ddb1b
-RUN go get -d github.com/golang/protobuf/proto `#and 6 other pkgs` &&\
-    (cd /go/src/github.com/golang/protobuf && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
+WORKDIR /go/src/golang.org/x/build
 
-# Repo github.com/google/go-github at 60131d1 (2018-03-29)
-ENV REV=60131d157172230b327fee58845dfcae3dee57b4
-RUN go get -d github.com/google/go-github/github &&\
-    (cd /go/src/github.com/google/go-github && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
+# Optimization for iterative docker build speed, not necessary for correctness:
+# TODO: write a tool to make writing Go module-friendly Dockerfiles easier.
+RUN go install cloud.google.com/go/storage
+RUN go install golang.org/x/net/http2
+RUN go install golang.org/x/crypto/acme/autocert
+COPY cmd/pubsubhelper/pubsubtypes /go/src/golang.org/x/build/cmd/pubsubhelper/pubsubtypes
+RUN go install golang.org/x/build/cmd/pubsubhelper/pubsubtypes
+COPY autocertcache /go/src/golang.org/x/build/autocertcache
+RUN go install golang.org/x/build/autocertcache
+COPY maintner /go/src/golang.org/x/build/maintner
+RUN go install golang.org/x/build/maintner/godata
 
-# Repo github.com/google/go-querystring at 53e6ce1 (2017-01-11)
-ENV REV=53e6ce116135b80d037921a7fdd5138cf32d7a8a
-RUN go get -d github.com/google/go-querystring/query &&\
-    (cd /go/src/github.com/google/go-querystring && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
+COPY . /go/src/golang.org/x/build/
 
-# Repo github.com/googleapis/gax-go at de2cc08 (2018-03-29)
-ENV REV=de2cc08e690b99dd3f7d19937d80d3d54e04682f
-RUN go get -d github.com/googleapis/gax-go &&\
-    (cd /go/src/github.com/googleapis/gax-go && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo github.com/gregjones/httpcache at 2bcd89a (2017-11-19)
-ENV REV=2bcd89a1743fd4b373f7370ce8ddc14dfbd18229
-RUN go get -d github.com/gregjones/httpcache &&\
-    (cd /go/src/github.com/gregjones/httpcache && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo go.opencensus.io at 5710257 (2018-04-10)
-ENV REV=5710257e78ab540a7c6f0e203009abea60eb97b7
-RUN go get -d go.opencensus.io/exporter/stackdriver/propagation `#and 12 other pkgs` &&\
-    (cd /go/src/go.opencensus.io && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo go4.org at fba789b (2018-01-03)
-ENV REV=fba789b7e39ba524b9e60c45c37a50fae63a2a09
-RUN go get -d go4.org/types &&\
-    (cd /go/src/go4.org && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo golang.org/x/crypto at d644981 (2018-04-11)
-ENV REV=d6449816ce06963d9d136eee5a56fca5b0616e7e
-RUN go get -d golang.org/x/crypto/acme `#and 2 other pkgs` &&\
-    (cd /go/src/golang.org/x/crypto && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo golang.org/x/net at 61147c4 (2018-04-06)
-ENV REV=61147c48b25b599e5b561d2e9c4f3e1ef489ca41
-RUN go get -d golang.org/x/net/context `#and 8 other pkgs` &&\
-    (cd /go/src/golang.org/x/net && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo golang.org/x/oauth2 at 921ae39 (2018-04-02)
-ENV REV=921ae394b9430ed4fb549668d7b087601bd60a81
-RUN go get -d golang.org/x/oauth2 `#and 5 other pkgs` &&\
-    (cd /go/src/golang.org/x/oauth2 && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo golang.org/x/sync at 1d60e46 (2018-03-14)
-ENV REV=1d60e4601c6fd243af51cc01ddf169918a5407ca
-RUN go get -d golang.org/x/sync/errgroup &&\
-    (cd /go/src/golang.org/x/sync && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo golang.org/x/text at 7922cc4 (2018-04-10)
-ENV REV=7922cc490dd5a7dbaa7fd5d6196b49db59ac042f
-RUN go get -d golang.org/x/text/secure/bidirule `#and 4 other pkgs` &&\
-    (cd /go/src/golang.org/x/text && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo golang.org/x/time at 6dc1736 (2017-09-27)
-ENV REV=6dc17368e09b0e8634d71cac8168d853e869a0c7
-RUN go get -d golang.org/x/time/rate &&\
-    (cd /go/src/golang.org/x/time && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo google.golang.org/api at 9f7560f (2018-04-10)
-ENV REV=9f7560f3b05bd90f33f9d56a449e5afd4dab15b3
-RUN go get -d google.golang.org/api/gensupport `#and 9 other pkgs` &&\
-    (cd /go/src/google.golang.org/api && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo google.golang.org/genproto at 51d0944 (2018-04-09)
-ENV REV=51d0944304c3cbce4afe9e5247e21100037bff78
-RUN go get -d google.golang.org/genproto/googleapis/api/annotations `#and 4 other pkgs` &&\
-    (cd /go/src/google.golang.org/genproto && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Repo google.golang.org/grpc at 858463a (2018-04-10)
-ENV REV=858463ac273fd87e6b2343eda6e96ed3a91e3b20
-RUN go get -d google.golang.org/grpc `#and 24 other pkgs` &&\
-    (cd /go/src/google.golang.org/grpc && (git cat-file -t $REV 2>/dev/null || git fetch -q origin $REV) && git reset --hard $REV)
-
-# Optimization to speed up iterative development, not necessary for correctness:
-RUN go install cloud.google.com/go/compute/metadata \
-	cloud.google.com/go/iam \
-	cloud.google.com/go/internal \
-	cloud.google.com/go/internal/optional \
-	cloud.google.com/go/internal/trace \
-	cloud.google.com/go/internal/version \
-	cloud.google.com/go/storage \
-	github.com/golang/protobuf/proto \
-	github.com/golang/protobuf/protoc-gen-go/descriptor \
-	github.com/golang/protobuf/ptypes \
-	github.com/golang/protobuf/ptypes/any \
-	github.com/golang/protobuf/ptypes/duration \
-	github.com/golang/protobuf/ptypes/timestamp \
-	github.com/google/go-github/github \
-	github.com/google/go-querystring/query \
-	github.com/googleapis/gax-go \
-	github.com/gregjones/httpcache \
-	go.opencensus.io/exporter/stackdriver/propagation \
-	go.opencensus.io/internal \
-	go.opencensus.io/internal/tagencoding \
-	go.opencensus.io/plugin/ochttp \
-	go.opencensus.io/plugin/ochttp/propagation/b3 \
-	go.opencensus.io/stats \
-	go.opencensus.io/stats/internal \
-	go.opencensus.io/stats/view \
-	go.opencensus.io/tag \
-	go.opencensus.io/trace \
-	go.opencensus.io/trace/internal \
-	go.opencensus.io/trace/propagation \
-	go4.org/types \
-	golang.org/x/crypto/acme \
-	golang.org/x/crypto/acme/autocert \
-	golang.org/x/net/context \
-	golang.org/x/net/context/ctxhttp \
-	golang.org/x/net/http2 \
-	golang.org/x/net/http2/hpack \
-	golang.org/x/net/idna \
-	golang.org/x/net/internal/timeseries \
-	golang.org/x/net/lex/httplex \
-	golang.org/x/net/trace \
-	golang.org/x/oauth2 \
-	golang.org/x/oauth2/google \
-	golang.org/x/oauth2/internal \
-	golang.org/x/oauth2/jws \
-	golang.org/x/oauth2/jwt \
-	golang.org/x/sync/errgroup \
-	golang.org/x/text/secure/bidirule \
-	golang.org/x/text/transform \
-	golang.org/x/text/unicode/bidi \
-	golang.org/x/text/unicode/norm \
-	golang.org/x/time/rate \
-	google.golang.org/api/gensupport \
-	google.golang.org/api/googleapi \
-	google.golang.org/api/googleapi/internal/uritemplates \
-	google.golang.org/api/googleapi/transport \
-	google.golang.org/api/internal \
-	google.golang.org/api/iterator \
-	google.golang.org/api/option \
-	google.golang.org/api/storage/v1 \
-	google.golang.org/api/transport/http \
-	google.golang.org/genproto/googleapis/api/annotations \
-	google.golang.org/genproto/googleapis/iam/v1 \
-	google.golang.org/genproto/googleapis/rpc/code \
-	google.golang.org/genproto/googleapis/rpc/status \
-	google.golang.org/grpc \
-	google.golang.org/grpc/balancer \
-	google.golang.org/grpc/balancer/base \
-	google.golang.org/grpc/balancer/roundrobin \
-	google.golang.org/grpc/channelz \
-	google.golang.org/grpc/codes \
-	google.golang.org/grpc/connectivity \
-	google.golang.org/grpc/credentials \
-	google.golang.org/grpc/encoding \
-	google.golang.org/grpc/encoding/proto \
-	google.golang.org/grpc/grpclb/grpc_lb_v1/messages \
-	google.golang.org/grpc/grpclog \
-	google.golang.org/grpc/internal \
-	google.golang.org/grpc/keepalive \
-	google.golang.org/grpc/metadata \
-	google.golang.org/grpc/naming \
-	google.golang.org/grpc/peer \
-	google.golang.org/grpc/resolver \
-	google.golang.org/grpc/resolver/dns \
-	google.golang.org/grpc/resolver/passthrough \
-	google.golang.org/grpc/stats \
-	google.golang.org/grpc/status \
-	google.golang.org/grpc/tap \
-	google.golang.org/grpc/transport
-# END deps
+# Install binary to /go/bin:
+RUN go install golang.org/x/build/devapp
 
 COPY . /go/src/golang.org/x/build/
 
 RUN go install golang.org/x/build/devapp
 
-FROM scratch
-LABEL maintainer "golang-dev@googlegroups.com"
-COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+FROM debian:stretch
 COPY --from=builder /go/bin/devapp /
 COPY devapp/static /static
 COPY devapp/templates /templates
diff --git a/devapp/Makefile b/devapp/Makefile
index c384e64..8447081 100644
--- a/devapp/Makefile
+++ b/devapp/Makefile
@@ -8,10 +8,6 @@
 IMAGE_STAGING := gcr.io/go-dashboard-dev/devapp
 IMAGE_PROD := gcr.io/symbolic-datum-552/devapp
 
-update-deps:
-	go install golang.org/x/build/cmd/gitlock
-	gitlock --update=Dockerfile golang.org/x/build/devapp
-
 docker-prod: Dockerfile
 	docker build --force-rm -f Dockerfile --tag=$(IMAGE_PROD):$(VERSION) ../
 	docker tag $(IMAGE_PROD):$(VERSION) $(IMAGE_PROD):$(MUTABLE_VERSION)