diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d41e43a6..e950117f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -6,19 +6,7 @@ on:
       - 'master'
     tags:
       - 'v*'
-    paths-ignore:
-      - '**.md'
-      - '.github/workflows/docs.yml'
-      - 'docs/**'
-      - 'mkdocs.yml'
   pull_request:
-    branches:
-      - 'master'
-    paths-ignore:
-      - '**.md'
-      - '.github/workflows/docs.yml'
-      - 'docs/**'
-      - 'mkdocs.yml'
 
 env:
   DOCKERHUB_SLUG: crazymax/diun
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 57fc28cf..7ab9cccf 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -5,19 +5,7 @@ on:
   push:
     tags:
       - 'v*'
-    paths:
-      - '.github/workflows/docs.yml'
-      - 'docs/**'
-      - 'CHANGELOG.md'
-      - 'mkdocs.yml'
   pull_request:
-    branches:
-      - 'master'
-    paths:
-      - '.github/workflows/docs.yml'
-      - 'docs/**'
-      - 'CHANGELOG.md'
-      - 'mkdocs.yml'
 
 jobs:
   publish:
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index d24d8e83..b0cdb978 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -15,7 +15,7 @@ on:
       - '**.md'
 
 env:
-  BUILD_TAG: 'crazymax/diun:local'
+  BUILD_TAG: 'diun:local'
   CONTAINER_NAME: 'diun'
   RUNNING_TIMEOUT: '240'
   RUNNING_LOG_CHECK: 'Next run in'
diff --git a/Dockerfile b/Dockerfile
index 364d0cf8..19f58d16 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,30 +1,49 @@
-# syntax=docker/dockerfile:1.2
-ARG GO_VERSION
+# syntax=docker/dockerfile:1.3-labs
 
-FROM --platform=$BUILDPLATFORM crazymax/goreleaser-xx:latest AS goreleaser-xx
+ARG GO_VERSION
+ARG GORELEASER_XX_VERSION="1.2.2"
+
+FROM --platform=$BUILDPLATFORM crazymax/goreleaser-xx:${GORELEASER_XX_VERSION} AS goreleaser-xx
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS base
+ENV CGO_ENABLED=0
 COPY --from=goreleaser-xx / /
-RUN apk add --no-cache ca-certificates gcc file git linux-headers musl-dev tar
+RUN apk add --no-cache file git
 WORKDIR /src
 
-FROM base AS build
+FROM base AS vendored
+RUN --mount=type=bind,source=.,target=/src,rw \
+  --mount=type=cache,target=/go/pkg/mod \
+  go mod tidy && go mod download
+
+FROM vendored AS test
+ENV CGO_ENABLED=1
+RUN apk add --no-cache gcc linux-headers musl-dev
+RUN --mount=type=bind,target=. \
+  --mount=type=cache,target=/go/pkg/mod \
+  --mount=type=cache,target=/root/.cache/go-build <<EOT
+go test -v -coverprofile=/tmp/coverage.txt -covermode=atomic -race ./...
+go tool cover -func=/tmp/coverage.txt
+EOT
+
+FROM scratch AS test-coverage
+COPY --from=test /tmp/coverage.txt /coverage.txt
+
+FROM vendored AS build
 ARG TARGETPLATFORM
-ARG GIT_REF
-RUN --mount=type=bind,target=/src,rw \
-  --mount=type=cache,target=/root/.cache/go-build \
+RUN --mount=type=bind,target=. \
+  --mount=type=cache,target=/root/.cache \
   --mount=target=/go/pkg/mod,type=cache \
   goreleaser-xx --debug \
     --name "diun" \
     --dist "/out" \
-    --hooks="go mod tidy" \
-    --hooks="go mod download" \
     --main="./cmd" \
+    --flags="-trimpath" \
     --ldflags="-s -w -X 'main.version={{.Version}}'" \
     --files="CHANGELOG.md" \
     --files="LICENSE" \
     --files="README.md"
 
-FROM scratch AS artifacts
+FROM scratch AS artifact
 COPY --from=build /out/*.tar.gz /
 COPY --from=build /out/*.zip /
 
@@ -39,7 +58,6 @@ RUN apk --update --no-cache add \
   && rm -rf /tmp/*
 
 COPY --from=build /usr/local/bin/diun /usr/local/bin/diun
-RUN diun --version
 
 ENV PROFILER_PATH="/profiler" \
   DIUN_DB_PATH="/data/diun.db"
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 687ad15a..48d1e006 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -1,90 +1,23 @@
 variable "GO_VERSION" {
   default = "1.17"
 }
-variable "PROTOC_VERSION" {
-  default = "3.17.3"
-}
-variable "GITHUB_REF" {
-  default = ""
-}
-
-// Special target: https://github.com/docker/metadata-action#bake-definition
-target "docker-metadata-action" {
-  tags = ["crazymax/diun:local"]
-}
 
 target "_common" {
   args = {
     GO_VERSION = GO_VERSION
-    PROTOC_VERSION = PROTOC_VERSION
-    GIT_REF = GITHUB_REF
     BUILDKIT_CONTEXT_KEEP_GIT_DIR = 1
   }
 }
 
+// Special target: https://github.com/docker/metadata-action#bake-definition
+target "docker-metadata-action" {
+  tags = ["diun:local"]
+}
+
 group "default" {
   targets = ["image-local"]
 }
 
-group "validate" {
-  targets = ["lint", "vendor-validate", "gen-validate"]
-}
-
-target "lint" {
-  inherits = ["_common"]
-  dockerfile = "./hack/lint.Dockerfile"
-  target = "lint"
-  output = ["type=cacheonly"]
-}
-
-target "vendor-validate" {
-  inherits = ["_common"]
-  dockerfile = "./hack/vendor.Dockerfile"
-  target = "validate"
-  output = ["type=cacheonly"]
-}
-
-target "vendor-update" {
-  inherits = ["_common"]
-  dockerfile = "./hack/vendor.Dockerfile"
-  target = "update"
-  output = ["."]
-}
-
-target "vendor-outdated" {
-  inherits = ["_common"]
-  dockerfile = "./hack/vendor.Dockerfile"
-  target = "outdated"
-  output = ["type=cacheonly"]
-}
-
-target "gen-validate" {
-  inherits = ["_common"]
-  dockerfile = "./hack/gen.Dockerfile"
-  target = "validate"
-  output = ["type=cacheonly"]
-}
-
-target "gen-update" {
-  inherits = ["_common"]
-  dockerfile = "./hack/gen.Dockerfile"
-  target = "update"
-  output = ["."]
-}
-
-target "test" {
-  inherits = ["_common"]
-  dockerfile = "./hack/test.Dockerfile"
-  target = "test-coverage"
-  output = ["."]
-}
-
-target "docs" {
-  dockerfile = "./hack/docs.Dockerfile"
-  target = "release"
-  output = ["./site"]
-}
-
 target "binary" {
   inherits = ["_common"]
   target = "binary"
@@ -93,7 +26,7 @@ target "binary" {
 
 target "artifact" {
   inherits = ["_common"]
-  target = "artifacts"
+  target = "artifact"
   output = ["./dist"]
 }
 
@@ -137,3 +70,61 @@ target "image-all" {
     "linux/ppc64le"
   ]
 }
+
+target "test" {
+  inherits = ["_common"]
+  target = "test-coverage"
+  output = ["."]
+}
+
+target "vendor" {
+  inherits = ["_common"]
+  dockerfile = "./hack/vendor.Dockerfile"
+  target = "update"
+  output = ["."]
+}
+
+target "gen" {
+  inherits = ["_common"]
+  dockerfile = "./hack/gen.Dockerfile"
+  target = "update"
+  output = ["."]
+}
+
+target "docs" {
+  dockerfile = "./hack/docs.Dockerfile"
+  target = "release"
+  output = ["./site"]
+}
+
+target "gomod-outdated" {
+  inherits = ["_common"]
+  dockerfile = "./hack/vendor.Dockerfile"
+  target = "outdated"
+  output = ["type=cacheonly"]
+}
+
+group "validate" {
+  targets = ["lint", "vendor-validate", "gen-validate"]
+}
+
+target "lint" {
+  inherits = ["_common"]
+  dockerfile = "./hack/lint.Dockerfile"
+  target = "lint"
+  output = ["type=cacheonly"]
+}
+
+target "vendor-validate" {
+  inherits = ["_common"]
+  dockerfile = "./hack/vendor.Dockerfile"
+  target = "validate"
+  output = ["type=cacheonly"]
+}
+
+target "gen-validate" {
+  inherits = ["_common"]
+  dockerfile = "./hack/gen.Dockerfile"
+  target = "validate"
+  output = ["type=cacheonly"]
+}
diff --git a/hack/docs.Dockerfile b/hack/docs.Dockerfile
index 42bb90e2..296cc411 100644
--- a/hack/docs.Dockerfile
+++ b/hack/docs.Dockerfile
@@ -1,6 +1,8 @@
 # syntax=docker/dockerfile:1.2
 
-FROM squidfunk/mkdocs-material:8.1.0 AS base
+ARG MKDOCS_VERSION="8.1.0"
+
+FROM squidfunk/mkdocs-material:${MKDOCS_VERSION} AS base
 RUN apk add --no-cache \
     git \
     git-fast-import \
@@ -18,7 +20,7 @@ RUN apk add --no-cache \
 
 FROM base AS generate
 RUN --mount=type=bind,target=. \
-  mkdocs build --strict --site-dir /tmp/site
+  mkdocs build --strict --site-dir /out
 
 FROM scratch AS release
-COPY --from=generate /tmp/site/ /
+COPY --from=generate /out /
diff --git a/hack/gen.Dockerfile b/hack/gen.Dockerfile
index a544e1f1..d927e46a 100644
--- a/hack/gen.Dockerfile
+++ b/hack/gen.Dockerfile
@@ -1,7 +1,8 @@
-# syntax=docker/dockerfile:1.2
+# syntax=docker/dockerfile:1.3-labs
+
 ARG GO_VERSION
-ARG PROTOC_VERSION
-ARG GLIBC_VERSION=2.33-r0
+ARG PROTOC_VERSION="3.17.3"
+ARG GLIBC_VERSION="2.33-r0"
 
 FROM golang:${GO_VERSION}-alpine AS base
 ARG GLIBC_VERSION
@@ -17,24 +18,37 @@ RUN curl -sSL "https://github.com/protocolbuffers/protobuf/releases/download/v${
   && rm "protoc.zip"
 WORKDIR /src
 
-FROM base AS gomod
+FROM base AS vendored
 RUN --mount=type=bind,target=.,rw \
   --mount=type=cache,target=/go/pkg/mod \
-  go mod tidy && go mod download && go install -v $(sed -n -e 's|^\s*_\s*"\(.*\)".*$|\1| p' tools.go)
+  go mod tidy && go mod download
 
-FROM gomod AS generate
+FROM vendored AS tools
 RUN --mount=type=bind,target=.,rw \
   --mount=type=cache,target=/go/pkg/mod \
-  go generate ./... && mkdir /out && cp -Rf pb /out
+  go install -v $(sed -n -e 's|^\s*_\s*"\(.*\)".*$|\1| p' tools.go)
+
+FROM tools AS generate
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/go/pkg/mod <<EOT
+set -e
+go generate ./...
+mkdir /out
+cp -Rf pb /out
+EOT
 
 FROM scratch AS update
 COPY --from=generate /out /
 
 FROM generate AS validate
-RUN --mount=type=bind,target=.,rw \
-  git add -A && cp -rf /out/* .; \
-  if [ -n "$(git status --porcelain -- pb)" ]; then \
-    echo >&2 'ERROR: Generate result differs. Please update with "docker buildx bake gen-update"'; \
-    git status --porcelain -- pb; \
-    exit 1; \
-  fi
+RUN --mount=type=bind,target=.,rw <<EOT
+set -e
+git add -A
+cp -rf /out/* .
+diff=$(git status --porcelain -- pb)
+if [ -n "$diff" ]; then
+  echo >&2 'ERROR: Vendor result differs. Please vendor your package with "docker buildx bake gen"'
+  echo "$diff"
+  exit 1
+fi
+EOT
diff --git a/hack/lint.Dockerfile b/hack/lint.Dockerfile
index 53c1e933..8a2dc038 100644
--- a/hack/lint.Dockerfile
+++ b/hack/lint.Dockerfile
@@ -1,15 +1,15 @@
 # syntax=docker/dockerfile:1.2
+
 ARG GO_VERSION
+ARG GOLANGCI_LINT_VERSION="v1.37"
 
 FROM golang:${GO_VERSION}-alpine AS base
 RUN apk add --no-cache gcc linux-headers musl-dev
 WORKDIR /src
 
-FROM golangci/golangci-lint:v1.37-alpine AS golangci-lint
-
+FROM golangci/golangci-lint:${GOLANGCI_LINT_VERSION}-alpine AS golangci-lint
 FROM base AS lint
 RUN --mount=type=bind,target=. \
-  --mount=type=cache,target=/root/.cache/go-build \
-  --mount=type=cache,target=/root/.cache/golangci-lint \
+  --mount=type=cache,target=/root/.cache \
   --mount=from=golangci-lint,source=/usr/bin/golangci-lint,target=/usr/bin/golangci-lint \
   golangci-lint run --timeout 10m0s ./...
diff --git a/hack/test.Dockerfile b/hack/test.Dockerfile
deleted file mode 100644
index 49b42983..00000000
--- a/hack/test.Dockerfile
+++ /dev/null
@@ -1,21 +0,0 @@
-# syntax=docker/dockerfile:1.2
-ARG GO_VERSION
-
-FROM golang:${GO_VERSION}-alpine AS base
-RUN apk add --no-cache gcc linux-headers musl-dev
-WORKDIR /src
-
-FROM base AS gomod
-RUN --mount=type=bind,target=.,rw \
-  --mount=type=cache,target=/go/pkg/mod \
-  go mod tidy && go mod download
-
-FROM gomod AS test
-RUN --mount=type=bind,target=. \
-  --mount=type=cache,target=/go/pkg/mod \
-  --mount=type=cache,target=/root/.cache/go-build \
-  go test -v -coverprofile=/tmp/coverage.txt -covermode=atomic -race ./... && \
-  go tool cover -func=/tmp/coverage.txt
-
-FROM scratch AS test-coverage
-COPY --from=test /tmp/coverage.txt /coverage.txt
diff --git a/hack/vendor.Dockerfile b/hack/vendor.Dockerfile
index 0f63ca04..08527a4f 100644
--- a/hack/vendor.Dockerfile
+++ b/hack/vendor.Dockerfile
@@ -1,5 +1,7 @@
-# syntax=docker/dockerfile:1.2
+# syntax=docker/dockerfile:1.3-labs
+
 ARG GO_VERSION
+ARG GOMOD_OUTDATED_VERSION="v0.8.0"
 
 FROM golang:${GO_VERSION}-alpine AS base
 RUN apk add --no-cache git linux-headers musl-dev
@@ -7,25 +9,33 @@ WORKDIR /src
 
 FROM base AS vendored
 RUN --mount=type=bind,target=.,rw \
-  --mount=type=cache,target=/go/pkg/mod \
-  go mod tidy && go mod download && \
-  mkdir /out && cp go.mod go.sum /out
+  --mount=type=cache,target=/go/pkg/mod <<EOT
+set -e
+go mod tidy
+go mod download
+mkdir /out
+cp go.mod go.sum /out
+EOT
 
 FROM scratch AS update
 COPY --from=vendored /out /
 
 FROM vendored AS validate
-RUN --mount=type=bind,target=.,rw \
-  git add -A && cp -rf /out/* .; \
-  if [ -n "$(git status --porcelain -- go.mod go.sum)" ]; then \
-    echo >&2 'ERROR: Vendor result differs. Please vendor your package with "docker buildx bake vendor-update"'; \
-    git status --porcelain -- go.mod go.sum; \
-    exit 1; \
-  fi
+RUN --mount=type=bind,target=.,rw <<EOT
+set -e
+git add -A
+cp -rf /out/* .
+diff=$(git status --porcelain -- go.mod go.sum)
+if [ -n "$diff" ]; then
+  echo >&2 'ERROR: Vendor result differs. Please vendor your package with "docker buildx bake vendor"'
+  echo "$diff"
+  exit 1
+fi
+EOT
 
-FROM psampaz/go-mod-outdated:v0.8.0 AS go-mod-outdated
+FROM psampaz/go-mod-outdated:${GOMOD_OUTDATED_VERSION} AS go-mod-outdated
 FROM base AS outdated
-RUN --mount=type=bind,target=.,ro \
+RUN --mount=type=bind,target=. \
   --mount=type=cache,target=/go/pkg/mod \
   --mount=from=go-mod-outdated,source=/home/go-mod-outdated,target=/usr/bin/go-mod-outdated \
   go list -mod=readonly -u -m -json all | go-mod-outdated -update -direct
diff --git a/test/dockerfile1/mount/Dockerfile1 b/test/dockerfile1/mount/Dockerfile1
index 617d53ee..33bd3567 100644
--- a/test/dockerfile1/mount/Dockerfile1
+++ b/test/dockerfile1/mount/Dockerfile1
@@ -7,11 +7,16 @@ FROM --platform=$BUILDPLATFORM crazymax/goreleaser-xx:latest AS goreleaser-xx
 # diun:"watch_repo=true,max_tags=100"
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS base
 COPY --from=goreleaser-xx / /
-COPY --from=crazymax/goreleaser-xx:0.162.0 / /
+COPY --from=crazymax/goreleaser-xx:1.2.2 / /
 RUN apk add --no-cache ca-certificates gcc file git linux-headers musl-dev tar
 WORKDIR /src
 
-FROM base AS build
+FROM base AS vendored
+RUN --mount=type=bind,source=.,target=/src,rw \
+  --mount=type=cache,target=/go/pkg/mod \
+  go mod tidy && go mod download
+
+FROM vendored AS build
 ARG TARGETPLATFORM
 ARG GIT_REF
 RUN --mount=type=bind,target=/src,rw \
@@ -20,20 +25,17 @@ RUN --mount=type=bind,target=/src,rw \
   goreleaser-xx --debug \
     --name "diun" \
     --dist "/out" \
-    --hooks="go mod tidy" \
-    --hooks="go mod download" \
-    --main="./cmd/main.go" \
+    --main="./cmd" \
     --ldflags="-s -w -X 'main.version={{.Version}}'" \
     --files="CHANGELOG.md" \
     --files="LICENSE" \
     --files="README.md"
 
-FROM scratch AS artifacts
+FROM scratch AS artifact
 COPY --from=build /out/*.tar.gz /
 COPY --from=build /out/*.zip /
 
 FROM alpine
-LABEL maintainer="CrazyMax"
 
 RUN apk --update --no-cache add \
     ca-certificates \
@@ -41,7 +43,6 @@ RUN apk --update --no-cache add \
   && rm -rf /tmp/*
 
 COPY --from=build /usr/local/bin/diun /usr/local/bin/diun
-RUN diun --version
 
 ENV DIUN_DB_PATH="/data/diun.db"